mirror of
https://github.com/outbackdingo/cozystack.git
synced 2026-03-27 14:02:49 +00:00
Compare commits
10 Commits
proxmox-cs
...
cilium-new
| Author | SHA1 | Date | |
|---|---|---|---|
|
fe859dfd46 | ||
|
|
53f2365e79 | ||
|
|
9145be14c1 | ||
|
|
fca349c641 | ||
|
|
0b38599394 | ||
|
|
0a33950a40 | ||
|
|
e3376a223e | ||
|
|
dee190ad4f | ||
|
|
be508fd107 | ||
|
|
a6d0f7cfd4 |
@@ -63,7 +63,7 @@ spec:
|
||||
serviceAccountName: cozystack
|
||||
containers:
|
||||
- name: cozystack
|
||||
image: "ghcr.io/aenix-io/cozystack/cozystack:v0.3.1"
|
||||
image: "ghcr.io/aenix-io/cozystack/cozystack:v0.4.0"
|
||||
env:
|
||||
- name: KUBERNETES_SERVICE_HOST
|
||||
value: localhost
|
||||
@@ -82,7 +82,7 @@ spec:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: darkhttpd
|
||||
image: "ghcr.io/aenix-io/cozystack/cozystack:v0.3.1"
|
||||
image: "ghcr.io/aenix-io/cozystack/cozystack:v0.4.0"
|
||||
command:
|
||||
- /usr/bin/darkhttpd
|
||||
- /cozystack/assets
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{
|
||||
"containerimage.config.digest": "sha256:e406d5ac59cc06bbab51e16ae9a520143ad4f54952ef8f8cca982dc89454d616",
|
||||
"containerimage.digest": "sha256:08e5063e65d2adc17278abee0ab43ce31cf37bc9bc7eb7988ef16f1f1c459862"
|
||||
"containerimage.config.digest": "sha256:9eb68d2d503d7e22afc6fde2635f566fd3456bbdb3caad5dc9f887be1dc2b8ab",
|
||||
"containerimage.digest": "sha256:1f44274dbc2c3be2a98e6cef83d68a041ae9ef31abb8ab069a525a2a92702bdd"
|
||||
}
|
||||
@@ -1,4 +1,4 @@
|
||||
{
|
||||
"containerimage.config.digest": "sha256:62baab666445d76498fb14cc1d0865fc82e4bdd5cb1d7ba80475dc5024184622",
|
||||
"containerimage.digest": "sha256:9363d717f966f4e7927da332eaaf17401b42203a2fcb493b428f94d096dae3a5"
|
||||
"containerimage.config.digest": "sha256:a7e8e6e35ac07bcf6253c9cfcf21fd3c315bd0653ad0427dd5f0cae95ffd3722",
|
||||
"containerimage.digest": "sha256:c03bffeeb70fe7dd680d2eca3021d2405fbcd9961dd38437f5673560c31c72cc"
|
||||
}
|
||||
@@ -15,6 +15,12 @@ spec:
|
||||
labels:
|
||||
app: {{ .Release.Name }}-cluster-autoscaler
|
||||
spec:
|
||||
tolerations:
|
||||
- key: CriticalAddonsOnly
|
||||
operator: Exists
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: "NoSchedule"
|
||||
containers:
|
||||
- image: ghcr.io/kvaps/test:cluster-autoscaller
|
||||
name: cluster-autoscaler
|
||||
|
||||
@@ -16,12 +16,10 @@ spec:
|
||||
spec:
|
||||
serviceAccountName: {{ .Release.Name }}-kcsi
|
||||
priorityClassName: system-cluster-critical
|
||||
nodeSelector:
|
||||
node-role.kubernetes.io/control-plane: ""
|
||||
tolerations:
|
||||
- key: CriticalAddonsOnly
|
||||
operator: Exists
|
||||
- key: node-role.kubernetes.io/master
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: "NoSchedule"
|
||||
containers:
|
||||
|
||||
@@ -12,6 +12,12 @@ spec:
|
||||
spec:
|
||||
serviceAccountName: {{ .Release.Name }}-flux-teardown
|
||||
restartPolicy: Never
|
||||
tolerations:
|
||||
- key: CriticalAddonsOnly
|
||||
operator: Exists
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: "NoSchedule"
|
||||
containers:
|
||||
- name: kubectl
|
||||
image: docker.io/clastix/kubectl:v1.29.1
|
||||
|
||||
@@ -14,6 +14,12 @@ spec:
|
||||
labels:
|
||||
k8s-app: {{ .Release.Name }}-kccm
|
||||
spec:
|
||||
tolerations:
|
||||
- key: CriticalAddonsOnly
|
||||
operator: Exists
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: "NoSchedule"
|
||||
containers:
|
||||
- name: kubevirt-cloud-controller-manager
|
||||
args:
|
||||
@@ -44,6 +50,4 @@ spec:
|
||||
- secret:
|
||||
secretName: {{ .Release.Name }}-admin-kubeconfig
|
||||
name: kubeconfig
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
serviceAccountName: {{ .Release.Name }}-kccm
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{
|
||||
"containerimage.config.digest": "sha256:29b11ecbb92bae830f2e55cd4b6f7f3ada09b2f5514c0eeee395bd2dbd12fb81",
|
||||
"containerimage.digest": "sha256:791df989ff37a76062c7c638dbfc93435df9ee0db48797f2045c80b6d6b937c0"
|
||||
"containerimage.config.digest": "sha256:aefc3ca9f56f69270d7ce6f56a1ce5b531332d5641481eb54c8e74b66b0f3341",
|
||||
"containerimage.digest": "sha256:a2bf43cb7eb812166edfeb1a4fae6a76a4ddba93be2c0ba9040a804ccb53c261"
|
||||
}
|
||||
@@ -1 +1 @@
|
||||
ghcr.io/aenix-io/cozystack/cozystack:v0.3.1
|
||||
ghcr.io/aenix-io/cozystack/cozystack:v0.4.0
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{
|
||||
"containerimage.config.digest": "sha256:d63ac434876b4e47c130e6b99f0c9657e718f9d97f522f5ccd878eab75844122",
|
||||
"containerimage.digest": "sha256:9963580a02ac4ddccafb60f2411365910bcadd73f92d1c9187a278221306a4ed"
|
||||
"containerimage.config.digest": "sha256:68ea72fcc581352fabfd87fa6fd482968cc85ee520cab7a614f1244d7ae36eb0",
|
||||
"containerimage.digest": "sha256:cea915e08a19eb6892f3facf3b3648368cd4a05abefc49bc2616ba3340c27e82"
|
||||
}
|
||||
@@ -1 +1 @@
|
||||
ghcr.io/aenix-io/cozystack/matchbox:v1.6.4
|
||||
ghcr.io/aenix-io/cozystack/matchbox:v1.7.1
|
||||
|
||||
@@ -3,24 +3,25 @@
|
||||
arch: amd64
|
||||
platform: metal
|
||||
secureboot: false
|
||||
version: v1.6.4
|
||||
version: v1.7.1
|
||||
input:
|
||||
kernel:
|
||||
path: /usr/install/amd64/vmlinuz
|
||||
initramfs:
|
||||
path: /usr/install/amd64/initramfs.xz
|
||||
baseInstaller:
|
||||
imageRef: ghcr.io/siderolabs/installer:v1.6.4
|
||||
imageRef: ghcr.io/siderolabs/installer:v1.7.1
|
||||
systemExtensions:
|
||||
- imageRef: ghcr.io/siderolabs/amd-ucode:20240115
|
||||
- imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240115
|
||||
- imageRef: ghcr.io/siderolabs/i915-ucode:20240115
|
||||
- imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/intel-ucode:20231114
|
||||
- imageRef: ghcr.io/siderolabs/qlogic-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/drbd:9.2.6-v1.6.4
|
||||
- imageRef: ghcr.io/siderolabs/zfs:2.1.14-v1.6.4
|
||||
- imageRef: ghcr.io/siderolabs/amd-ucode:20240410
|
||||
- imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240410
|
||||
- imageRef: ghcr.io/siderolabs/i915-ucode:20240410
|
||||
- imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/intel-ucode:20240312
|
||||
- imageRef: ghcr.io/siderolabs/qlogic-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/drbd:9.2.8-v1.7.1
|
||||
- imageRef: ghcr.io/siderolabs/zfs:2.2.3-v1.7.1
|
||||
output:
|
||||
kind: initramfs
|
||||
imageOptions: {}
|
||||
outFormat: raw
|
||||
|
||||
@@ -3,24 +3,25 @@
|
||||
arch: amd64
|
||||
platform: metal
|
||||
secureboot: false
|
||||
version: v1.6.4
|
||||
version: v1.7.1
|
||||
input:
|
||||
kernel:
|
||||
path: /usr/install/amd64/vmlinuz
|
||||
initramfs:
|
||||
path: /usr/install/amd64/initramfs.xz
|
||||
baseInstaller:
|
||||
imageRef: ghcr.io/siderolabs/installer:v1.6.4
|
||||
imageRef: ghcr.io/siderolabs/installer:v1.7.1
|
||||
systemExtensions:
|
||||
- imageRef: ghcr.io/siderolabs/amd-ucode:20240115
|
||||
- imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240115
|
||||
- imageRef: ghcr.io/siderolabs/i915-ucode:20240115
|
||||
- imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/intel-ucode:20231114
|
||||
- imageRef: ghcr.io/siderolabs/qlogic-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/drbd:9.2.6-v1.6.4
|
||||
- imageRef: ghcr.io/siderolabs/zfs:2.1.14-v1.6.4
|
||||
- imageRef: ghcr.io/siderolabs/amd-ucode:20240410
|
||||
- imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240410
|
||||
- imageRef: ghcr.io/siderolabs/i915-ucode:20240410
|
||||
- imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/intel-ucode:20240312
|
||||
- imageRef: ghcr.io/siderolabs/qlogic-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/drbd:9.2.8-v1.7.1
|
||||
- imageRef: ghcr.io/siderolabs/zfs:2.2.3-v1.7.1
|
||||
output:
|
||||
kind: installer
|
||||
imageOptions: {}
|
||||
outFormat: raw
|
||||
|
||||
@@ -3,24 +3,25 @@
|
||||
arch: amd64
|
||||
platform: metal
|
||||
secureboot: false
|
||||
version: v1.6.4
|
||||
version: v1.7.1
|
||||
input:
|
||||
kernel:
|
||||
path: /usr/install/amd64/vmlinuz
|
||||
initramfs:
|
||||
path: /usr/install/amd64/initramfs.xz
|
||||
baseInstaller:
|
||||
imageRef: ghcr.io/siderolabs/installer:v1.6.4
|
||||
imageRef: ghcr.io/siderolabs/installer:v1.7.1
|
||||
systemExtensions:
|
||||
- imageRef: ghcr.io/siderolabs/amd-ucode:20240115
|
||||
- imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240115
|
||||
- imageRef: ghcr.io/siderolabs/i915-ucode:20240115
|
||||
- imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/intel-ucode:20231114
|
||||
- imageRef: ghcr.io/siderolabs/qlogic-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/drbd:9.2.6-v1.6.4
|
||||
- imageRef: ghcr.io/siderolabs/zfs:2.1.14-v1.6.4
|
||||
- imageRef: ghcr.io/siderolabs/amd-ucode:20240410
|
||||
- imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240410
|
||||
- imageRef: ghcr.io/siderolabs/i915-ucode:20240410
|
||||
- imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/intel-ucode:20240312
|
||||
- imageRef: ghcr.io/siderolabs/qlogic-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/drbd:9.2.8-v1.7.1
|
||||
- imageRef: ghcr.io/siderolabs/zfs:2.2.3-v1.7.1
|
||||
output:
|
||||
kind: iso
|
||||
imageOptions: {}
|
||||
outFormat: raw
|
||||
|
||||
@@ -3,24 +3,25 @@
|
||||
arch: amd64
|
||||
platform: metal
|
||||
secureboot: false
|
||||
version: v1.6.4
|
||||
version: v1.7.1
|
||||
input:
|
||||
kernel:
|
||||
path: /usr/install/amd64/vmlinuz
|
||||
initramfs:
|
||||
path: /usr/install/amd64/initramfs.xz
|
||||
baseInstaller:
|
||||
imageRef: ghcr.io/siderolabs/installer:v1.6.4
|
||||
imageRef: ghcr.io/siderolabs/installer:v1.7.1
|
||||
systemExtensions:
|
||||
- imageRef: ghcr.io/siderolabs/amd-ucode:20240115
|
||||
- imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240115
|
||||
- imageRef: ghcr.io/siderolabs/i915-ucode:20240115
|
||||
- imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/intel-ucode:20231114
|
||||
- imageRef: ghcr.io/siderolabs/qlogic-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/drbd:9.2.6-v1.6.4
|
||||
- imageRef: ghcr.io/siderolabs/zfs:2.1.14-v1.6.4
|
||||
- imageRef: ghcr.io/siderolabs/amd-ucode:20240410
|
||||
- imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240410
|
||||
- imageRef: ghcr.io/siderolabs/i915-ucode:20240410
|
||||
- imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/intel-ucode:20240312
|
||||
- imageRef: ghcr.io/siderolabs/qlogic-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/drbd:9.2.8-v1.7.1
|
||||
- imageRef: ghcr.io/siderolabs/zfs:2.2.3-v1.7.1
|
||||
output:
|
||||
kind: kernel
|
||||
imageOptions: {}
|
||||
outFormat: raw
|
||||
|
||||
@@ -3,25 +3,25 @@
|
||||
arch: amd64
|
||||
platform: metal
|
||||
secureboot: false
|
||||
version: v1.6.4
|
||||
version: v1.7.1
|
||||
input:
|
||||
kernel:
|
||||
path: /usr/install/amd64/vmlinuz
|
||||
initramfs:
|
||||
path: /usr/install/amd64/initramfs.xz
|
||||
baseInstaller:
|
||||
imageRef: ghcr.io/siderolabs/installer:v1.6.4
|
||||
imageRef: ghcr.io/siderolabs/installer:v1.7.1
|
||||
systemExtensions:
|
||||
- imageRef: ghcr.io/siderolabs/amd-ucode:20240115
|
||||
- imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240115
|
||||
- imageRef: ghcr.io/siderolabs/i915-ucode:20240115
|
||||
- imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/intel-ucode:20231114
|
||||
- imageRef: ghcr.io/siderolabs/qlogic-firmware:20240115
|
||||
- imageRef: ghcr.io/siderolabs/drbd:9.2.6-v1.6.4
|
||||
- imageRef: ghcr.io/siderolabs/zfs:2.1.14-v1.6.4
|
||||
- imageRef: ghcr.io/siderolabs/amd-ucode:20240410
|
||||
- imageRef: ghcr.io/siderolabs/amdgpu-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/bnx2-bnx2x:20240410
|
||||
- imageRef: ghcr.io/siderolabs/i915-ucode:20240410
|
||||
- imageRef: ghcr.io/siderolabs/intel-ice-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/intel-ucode:20240312
|
||||
- imageRef: ghcr.io/siderolabs/qlogic-firmware:20240410
|
||||
- imageRef: ghcr.io/siderolabs/drbd:9.2.8-v1.7.1
|
||||
- imageRef: ghcr.io/siderolabs/zfs:2.2.3-v1.7.1
|
||||
output:
|
||||
kind: image
|
||||
kind: nocloud
|
||||
imageOptions: { diskSize: 1306525696, diskFormat: raw }
|
||||
outFormat: .xz
|
||||
|
||||
@@ -52,6 +52,12 @@ releases:
|
||||
privileged: true
|
||||
dependsOn: [cilium]
|
||||
|
||||
- name: etcd-operator
|
||||
releaseName: etcd-operator
|
||||
chart: cozy-etcd-operator
|
||||
namespace: cozy-etcd-operator
|
||||
dependsOn: [cilium,cert-manager]
|
||||
|
||||
- name: grafana-operator
|
||||
releaseName: grafana-operator
|
||||
chart: cozy-grafana-operator
|
||||
|
||||
@@ -26,6 +26,12 @@ releases:
|
||||
privileged: true
|
||||
dependsOn: [victoria-metrics-operator]
|
||||
|
||||
- name: etcd-operator
|
||||
releaseName: etcd-operator
|
||||
chart: cozy-etcd-operator
|
||||
namespace: cozy-etcd-operator
|
||||
dependsOn: [cert-manager]
|
||||
|
||||
- name: grafana-operator
|
||||
releaseName: grafana-operator
|
||||
chart: cozy-grafana-operator
|
||||
|
||||
@@ -81,6 +81,12 @@ releases:
|
||||
privileged: true
|
||||
dependsOn: [cilium,kubeovn]
|
||||
|
||||
- name: etcd-operator
|
||||
releaseName: etcd-operator
|
||||
chart: cozy-etcd-operator
|
||||
namespace: cozy-etcd-operator
|
||||
dependsOn: [cilium,kubeovn,cert-manager]
|
||||
|
||||
- name: grafana-operator
|
||||
releaseName: grafana-operator
|
||||
chart: cozy-grafana-operator
|
||||
|
||||
@@ -26,6 +26,12 @@ releases:
|
||||
privileged: true
|
||||
dependsOn: [victoria-metrics-operator]
|
||||
|
||||
- name: etcd-operator
|
||||
releaseName: etcd-operator
|
||||
chart: cozy-etcd-operator
|
||||
namespace: cozy-etcd-operator
|
||||
dependsOn: [cert-manager]
|
||||
|
||||
- name: grafana-operator
|
||||
releaseName: grafana-operator
|
||||
chart: cozy-grafana-operator
|
||||
|
||||
@@ -23,9 +23,11 @@ spec:
|
||||
interval: 1m
|
||||
releaseName: {{ $x.releaseName | default $x.name }}
|
||||
install:
|
||||
crds: CreateReplace
|
||||
remediation:
|
||||
retries: -1
|
||||
upgrade:
|
||||
crds: CreateReplace
|
||||
remediation:
|
||||
retries: -1
|
||||
chart:
|
||||
|
||||
@@ -3,4 +3,4 @@ name: etcd
|
||||
description: Storage for Kubernetes clusters
|
||||
icon: https://www.svgrepo.com/show/353714/etcd.svg
|
||||
type: application
|
||||
version: 1.0.0
|
||||
version: 2.0.0
|
||||
|
||||
50
packages/extra/etcd/templates/datastore.yaml
Normal file
50
packages/extra/etcd/templates/datastore.yaml
Normal file
@@ -0,0 +1,50 @@
|
||||
---
|
||||
apiVersion: kamaji.clastix.io/v1alpha1
|
||||
kind: DataStore
|
||||
metadata:
|
||||
name: {{ .Release.Namespace }}
|
||||
spec:
|
||||
driver: etcd
|
||||
endpoints:
|
||||
- etcd-0.etcd-headless.{{ .Release.Namespace }}.svc:2379
|
||||
- etcd-1.etcd-headless.{{ .Release.Namespace }}.svc:2379
|
||||
- etcd-2.etcd-headless.{{ .Release.Namespace }}.svc:2379
|
||||
tlsConfig:
|
||||
certificateAuthority:
|
||||
certificate:
|
||||
secretReference:
|
||||
keyPath: tls.crt
|
||||
name: etcd-ca-tls
|
||||
namespace: {{ .Release.Namespace }}
|
||||
privateKey:
|
||||
secretReference:
|
||||
keyPath: tls.key
|
||||
name: etcd-ca-tls
|
||||
namespace: {{ .Release.Namespace }}
|
||||
clientCertificate:
|
||||
certificate:
|
||||
secretReference:
|
||||
keyPath: tls.crt
|
||||
name: etcd-client-tls
|
||||
namespace: {{ .Release.Namespace }}
|
||||
privateKey:
|
||||
secretReference:
|
||||
keyPath: tls.key
|
||||
name: etcd-client-tls
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: etcd-ca-tls
|
||||
annotations:
|
||||
helm.sh/hook: pre-install
|
||||
helm.sh/resource-policy: keep
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: etcd-client-tls
|
||||
annotations:
|
||||
helm.sh/hook: pre-install
|
||||
helm.sh/resource-policy: keep
|
||||
176
packages/extra/etcd/templates/etcd-cluster.yaml
Normal file
176
packages/extra/etcd/templates/etcd-cluster.yaml
Normal file
@@ -0,0 +1,176 @@
|
||||
---
|
||||
apiVersion: etcd.aenix.io/v1alpha1
|
||||
kind: EtcdCluster
|
||||
metadata:
|
||||
name: etcd
|
||||
spec:
|
||||
storage: {}
|
||||
security:
|
||||
tls:
|
||||
peerTrustedCASecret: etcd-peer-ca-tls
|
||||
peerSecret: etcd-peer-tls
|
||||
serverSecret: etcd-server-tls
|
||||
clientTrustedCASecret: etcd-ca-tls
|
||||
clientSecret: etcd-client-tls
|
||||
podTemplate:
|
||||
spec:
|
||||
topologySpreadConstraints:
|
||||
- maxSkew: 1
|
||||
topologyKey: "kubernetes.io/hostname"
|
||||
whenUnsatisfiable: ScheduleAnyway
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: etcd
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: etcd-selfsigning-issuer
|
||||
spec:
|
||||
selfSigned: {}
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: etcd-peer-ca
|
||||
spec:
|
||||
isCA: true
|
||||
usages:
|
||||
- "signing"
|
||||
- "key encipherment"
|
||||
- "cert sign"
|
||||
commonName: etcd-peer-ca
|
||||
subject:
|
||||
organizations:
|
||||
- ACME Inc.
|
||||
organizationalUnits:
|
||||
- Widgets
|
||||
secretName: etcd-peer-ca-tls
|
||||
privateKey:
|
||||
algorithm: RSA
|
||||
size: 4096
|
||||
issuerRef:
|
||||
name: etcd-selfsigning-issuer
|
||||
kind: Issuer
|
||||
group: cert-manager.io
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: etcd-ca
|
||||
spec:
|
||||
isCA: true
|
||||
usages:
|
||||
- "signing"
|
||||
- "key encipherment"
|
||||
- "cert sign"
|
||||
commonName: etcd-ca
|
||||
subject:
|
||||
organizations:
|
||||
- ACME Inc.
|
||||
organizationalUnits:
|
||||
- Widgets
|
||||
secretName: etcd-ca-tls
|
||||
privateKey:
|
||||
algorithm: RSA
|
||||
size: 4096
|
||||
issuerRef:
|
||||
name: etcd-selfsigning-issuer
|
||||
kind: Issuer
|
||||
group: cert-manager.io
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: etcd-peer-issuer
|
||||
spec:
|
||||
ca:
|
||||
secretName: etcd-peer-ca-tls
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: etcd-issuer
|
||||
spec:
|
||||
ca:
|
||||
secretName: etcd-ca-tls
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: etcd-server
|
||||
spec:
|
||||
secretName: etcd-server-tls
|
||||
isCA: false
|
||||
usages:
|
||||
- "server auth"
|
||||
- "signing"
|
||||
- "key encipherment"
|
||||
dnsNames:
|
||||
- etcd-0
|
||||
- etcd-0.etcd-headless
|
||||
- etcd-0.etcd-headless.{{ .Release.Namespace }}.svc
|
||||
- etcd-1
|
||||
- etcd-1.etcd-headless
|
||||
- etcd-1.etcd-headless.{{ .Release.Namespace }}.svc
|
||||
- etcd-2
|
||||
- etcd-2.etcd-headless
|
||||
- etcd-2.etcd-headless.{{ .Release.Namespace }}.svc
|
||||
- localhost
|
||||
- "127.0.0.1"
|
||||
privateKey:
|
||||
rotationPolicy: Always
|
||||
algorithm: RSA
|
||||
size: 4096
|
||||
issuerRef:
|
||||
name: etcd-issuer
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: etcd-peer
|
||||
spec:
|
||||
secretName: etcd-peer-tls
|
||||
isCA: false
|
||||
usages:
|
||||
- "server auth"
|
||||
- "client auth"
|
||||
- "signing"
|
||||
- "key encipherment"
|
||||
dnsNames:
|
||||
- etcd-0
|
||||
- etcd-0.etcd-headless
|
||||
- etcd-0.etcd-headless.{{ .Release.Namespace }}.svc
|
||||
- etcd-1
|
||||
- etcd-1.etcd-headless
|
||||
- etcd-1.etcd-headless.{{ .Release.Namespace }}.svc
|
||||
- etcd-2
|
||||
- etcd-2.etcd-headless
|
||||
- etcd-2.etcd-headless.{{ .Release.Namespace }}.svc
|
||||
- localhost
|
||||
- "127.0.0.1"
|
||||
privateKey:
|
||||
rotationPolicy: Always
|
||||
algorithm: RSA
|
||||
size: 4096
|
||||
issuerRef:
|
||||
name: etcd-peer-issuer
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: etcd-client
|
||||
spec:
|
||||
commonName: root
|
||||
secretName: etcd-client-tls
|
||||
usages:
|
||||
- "signing"
|
||||
- "key encipherment"
|
||||
- "client auth"
|
||||
privateKey:
|
||||
rotationPolicy: Always
|
||||
algorithm: RSA
|
||||
size: 4096
|
||||
issuerRef:
|
||||
name: etcd-issuer
|
||||
kind: Issuer
|
||||
@@ -1,19 +0,0 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: kamaji-etcd
|
||||
spec:
|
||||
chart:
|
||||
spec:
|
||||
chart: cozy-kamaji-etcd
|
||||
reconcileStrategy: Revision
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: cozystack-system
|
||||
namespace: cozy-system
|
||||
version: '*'
|
||||
interval: 1m0s
|
||||
timeout: 5m0s
|
||||
values:
|
||||
kamaji-etcd:
|
||||
fullnameOverride: etcd
|
||||
@@ -1,3 +1,4 @@
|
||||
etcd 1.0.0 HEAD
|
||||
etcd 1.0.0 f7eaab0
|
||||
etcd 2.0.0 HEAD
|
||||
ingress 1.0.0 HEAD
|
||||
monitoring 1.0.0 HEAD
|
||||
|
||||
@@ -122,7 +122,7 @@ annotations:
|
||||
description: |
|
||||
CiliumPodIPPool defines an IP pool that can be used for pooled IPAM (i.e. the multi-pool IPAM mode).
|
||||
apiVersion: v2
|
||||
appVersion: 1.14.9
|
||||
appVersion: 1.14.10
|
||||
description: eBPF-based Networking, Security, and Observability
|
||||
home: https://cilium.io/
|
||||
icon: https://cdn.jsdelivr.net/gh/cilium/cilium@v1.14/Documentation/images/logo-solo.svg
|
||||
@@ -138,4 +138,4 @@ kubeVersion: '>= 1.16.0-0'
|
||||
name: cilium
|
||||
sources:
|
||||
- https://github.com/cilium/cilium
|
||||
version: 1.14.9
|
||||
version: 1.14.10
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# cilium
|
||||
|
||||
 
|
||||
 
|
||||
|
||||
Cilium is open source software for providing and transparently securing
|
||||
network connectivity and loadbalancing between application workloads such as
|
||||
@@ -131,7 +131,7 @@ contributors across the globe, there is almost always someone available to help.
|
||||
| bpf.tproxy | bool | `false` | Configure the eBPF-based TPROXY to reduce reliance on iptables rules for implementing Layer 7 policy. |
|
||||
| bpf.vlanBypass | list | `[]` | Configure explicitly allowed VLAN id's for bpf logic bypass. [0] will allow all VLAN id's without any filtering. |
|
||||
| bpfClockProbe | bool | `false` | Enable BPF clock source probing for more efficient tick retrieval. |
|
||||
| certgen | object | `{"annotations":{"cronJob":{},"job":{}},"extraVolumeMounts":[],"extraVolumes":[],"image":{"digest":"sha256:89a0847753686444daabde9474b48340993bd19c7bea66a46e45b2974b82041f","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/certgen","tag":"v0.1.9","useDigest":true},"podLabels":{},"tolerations":[],"ttlSecondsAfterFinished":1800}` | Configure certificate generation for Hubble integration. If hubble.tls.auto.method=cronJob, these values are used for the Kubernetes CronJob which will be scheduled regularly to (re)generate any certificates not provided manually. |
|
||||
| certgen | object | `{"annotations":{"cronJob":{},"job":{}},"extraVolumeMounts":[],"extraVolumes":[],"image":{"digest":"sha256:5586de5019abc104637a9818a626956cd9b1e827327b958186ec412ae3d5dea6","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/certgen","tag":"v0.1.11","useDigest":true},"podLabels":{},"tolerations":[],"ttlSecondsAfterFinished":1800}` | Configure certificate generation for Hubble integration. If hubble.tls.auto.method=cronJob, these values are used for the Kubernetes CronJob which will be scheduled regularly to (re)generate any certificates not provided manually. |
|
||||
| certgen.annotations | object | `{"cronJob":{},"job":{}}` | Annotations to be added to the hubble-certgen initial Job and CronJob |
|
||||
| certgen.extraVolumeMounts | list | `[]` | Additional certgen volumeMounts. |
|
||||
| certgen.extraVolumes | list | `[]` | Additional certgen volumes. |
|
||||
@@ -155,12 +155,12 @@ contributors across the globe, there is almost always someone available to help.
|
||||
| clustermesh.apiserver.extraEnv | list | `[]` | Additional clustermesh-apiserver environment variables. |
|
||||
| clustermesh.apiserver.extraVolumeMounts | list | `[]` | Additional clustermesh-apiserver volumeMounts. |
|
||||
| clustermesh.apiserver.extraVolumes | list | `[]` | Additional clustermesh-apiserver volumes. |
|
||||
| clustermesh.apiserver.image | object | `{"digest":"sha256:5c16f8b8e22ce41e11998e70846fbcecea3a6b683a38253809ead8d871f6d8a3","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.14.9","useDigest":true}` | Clustermesh API server image. |
|
||||
| clustermesh.apiserver.image | object | `{"digest":"sha256:609fea274caa016f15646f6e0b0f1f7c56b238c551e7b261bc1e99ce64f7b798","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.14.10","useDigest":true}` | Clustermesh API server image. |
|
||||
| clustermesh.apiserver.kvstoremesh.enabled | bool | `false` | Enable KVStoreMesh. KVStoreMesh caches the information retrieved from the remote clusters in the local etcd instance. |
|
||||
| clustermesh.apiserver.kvstoremesh.extraArgs | list | `[]` | Additional KVStoreMesh arguments. |
|
||||
| clustermesh.apiserver.kvstoremesh.extraEnv | list | `[]` | Additional KVStoreMesh environment variables. |
|
||||
| clustermesh.apiserver.kvstoremesh.extraVolumeMounts | list | `[]` | Additional KVStoreMesh volumeMounts. |
|
||||
| clustermesh.apiserver.kvstoremesh.image | object | `{"digest":"sha256:9d9efb25806660f3663b9cd803fb8679f2b115763470002a9770e2c1eb1e5b22","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/kvstoremesh","tag":"v1.14.9","useDigest":true}` | KVStoreMesh image. |
|
||||
| clustermesh.apiserver.kvstoremesh.image | object | `{"digest":"sha256:871ec4e3b07401d90b4433c7e2b7210b9b0c5f1a536caab3d0281a5faeea5070","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/kvstoremesh","tag":"v1.14.10","useDigest":true}` | KVStoreMesh image. |
|
||||
| clustermesh.apiserver.kvstoremesh.resources | object | `{}` | Resource requests and limits for the KVStoreMesh container |
|
||||
| clustermesh.apiserver.kvstoremesh.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]}}` | KVStoreMesh Security context |
|
||||
| clustermesh.apiserver.metrics.enabled | bool | `true` | Enables exporting apiserver metrics in OpenMetrics format. |
|
||||
@@ -312,7 +312,7 @@ contributors across the globe, there is almost always someone available to help.
|
||||
| envoy.extraVolumes | list | `[]` | Additional envoy volumes. |
|
||||
| envoy.healthPort | int | `9878` | TCP port for the health API. |
|
||||
| envoy.idleTimeoutDurationSeconds | int | `60` | Set Envoy upstream HTTP idle connection timeout seconds. Does not apply to connections with pending requests. Default 60s |
|
||||
| envoy.image | object | `{"digest":"sha256:39b75548447978230dedcf25da8940e4d3540c741045ef391a8e74dbb9661a86","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.26.7-bbde4095997ea57ead209f56158790d47224a0f5","useDigest":true}` | Envoy container image. |
|
||||
| envoy.image | object | `{"digest":"sha256:d52f476c29a97c8b250fdbfbb8472191a268916f6a8503671d0da61e323b02cc","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.27.4-21905253931655328edaacf3cd16aeda73bbea2f","useDigest":true}` | Envoy container image. |
|
||||
| envoy.livenessProbe.failureThreshold | int | `10` | failure threshold of liveness probe |
|
||||
| envoy.livenessProbe.periodSeconds | int | `30` | interval between checks of the liveness probe |
|
||||
| envoy.log.format | string | `"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v"` | The format string to use for laying out the log message metadata of Envoy. |
|
||||
@@ -419,7 +419,7 @@ contributors across the globe, there is almost always someone available to help.
|
||||
| hubble.relay.extraVolumes | list | `[]` | Additional hubble-relay volumes. |
|
||||
| hubble.relay.gops.enabled | bool | `true` | Enable gops for hubble-relay |
|
||||
| hubble.relay.gops.port | int | `9893` | Configure gops listen port for hubble-relay |
|
||||
| hubble.relay.image | object | `{"digest":"sha256:f506f3c6e0a979437cde79eb781654fda4f10ddb5642cebc4dc81254cfb7eeaa","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.14.9","useDigest":true}` | Hubble-relay container image. |
|
||||
| hubble.relay.image | object | `{"digest":"sha256:c156c4fc2da520d2876142ea17490440b95431a1be755d2050e72115a495cfd0","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.14.10","useDigest":true}` | Hubble-relay container image. |
|
||||
| hubble.relay.listenHost | string | `""` | Host to listen to. Specify an empty string to bind to all the interfaces. |
|
||||
| hubble.relay.listenPort | string | `"4245"` | Port to listen to. |
|
||||
| hubble.relay.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
|
||||
@@ -511,7 +511,7 @@ contributors across the globe, there is almost always someone available to help.
|
||||
| hubble.ui.updateStrategy | object | `{"rollingUpdate":{"maxUnavailable":1},"type":"RollingUpdate"}` | hubble-ui update strategy. |
|
||||
| identityAllocationMode | string | `"crd"` | Method to use for identity allocation (`crd` or `kvstore`). |
|
||||
| identityChangeGracePeriod | string | `"5s"` | Time to wait before using new identity on endpoint identity change. |
|
||||
| image | object | `{"digest":"sha256:4ef1eb7a3bc39d0fefe14685e6c0d4e01301c40df2a89bc93ffca9a1ab927301","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.14.9","useDigest":true}` | Agent container image. |
|
||||
| image | object | `{"digest":"sha256:0a1bcd2859c6d18d60dba6650cca8c707101716a3e47b126679040cbd621c031","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.14.10","useDigest":true}` | Agent container image. |
|
||||
| imagePullSecrets | string | `nil` | Configure image pull secrets for pulling container images |
|
||||
| ingressController.default | bool | `false` | Set cilium ingress controller to be the default ingress controller This will let cilium ingress controller route entries without ingress class set |
|
||||
| ingressController.defaultSecretName | string | `nil` | Default secret name for ingresses without .spec.tls[].secretName set. |
|
||||
@@ -596,7 +596,7 @@ contributors across the globe, there is almost always someone available to help.
|
||||
| nodeinit.extraEnv | list | `[]` | Additional nodeinit environment variables. |
|
||||
| nodeinit.extraVolumeMounts | list | `[]` | Additional nodeinit volumeMounts. |
|
||||
| nodeinit.extraVolumes | list | `[]` | Additional nodeinit volumes. |
|
||||
| nodeinit.image | object | `{"override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/startup-script","tag":"62093c5c233ea914bfa26a10ba41f8780d9b737f"}` | node-init image. |
|
||||
| nodeinit.image | object | `{"digest":"sha256:e1d442546e868db1a3289166c14011e0dbd32115b338b963e56f830972bc22a2","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/startup-script","tag":"62093c5c233ea914bfa26a10ba41f8780d9b737f","useDigest":true}` | node-init image. |
|
||||
| nodeinit.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for nodeinit pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
|
||||
| nodeinit.podAnnotations | object | `{}` | Annotations to be added to node-init pods. |
|
||||
| nodeinit.podLabels | object | `{}` | Labels to be added to node-init pods. |
|
||||
@@ -619,7 +619,7 @@ contributors across the globe, there is almost always someone available to help.
|
||||
| operator.extraVolumes | list | `[]` | Additional cilium-operator volumes. |
|
||||
| operator.identityGCInterval | string | `"15m0s"` | Interval for identity garbage collection. |
|
||||
| operator.identityHeartbeatTimeout | string | `"30m0s"` | Timeout for identity heartbeats. |
|
||||
| operator.image | object | `{"alibabacloudDigest":"sha256:765314779093b54750f83280f009229f20fe1f28466a633d9bb4143d2ad669c5","awsDigest":"sha256:041ad5b49ae63ba0f1974e1a1d9ebf9f52541cd2813088fa687f9d544125a1ec","azureDigest":"sha256:2d3b9d868eb03fa9256d34192a734a2abab283f527a9c97b7cefcd3401649d17","genericDigest":"sha256:1552d653870dd8ebbd16ee985a5497dd78a2097370978b0cfbd2da2072f30712","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.14.9","useDigest":true}` | cilium-operator image. |
|
||||
| operator.image | object | `{"alibabacloudDigest":"sha256:2fbb53c2fc9c7203db9065c4e6cedb8e98d32d5ebc64549949636b5344cd1f14","awsDigest":"sha256:72440aa4cb8a42dddb05cfc74c6fba0a18d0902b1e434f5dcde8dca0354a8be6","azureDigest":"sha256:404a46bb0a232c7d5ab7ab97a1d1a55635cdf0e334529a18d1ddb50f4aad71b4","genericDigest":"sha256:415b7f0bb0e7339c6231d4b9ee74a6a513b2865acfccec884dbc806ecc3dd909","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.14.10","useDigest":true}` | cilium-operator image. |
|
||||
| operator.nodeGCInterval | string | `"5m0s"` | Interval for cilium node garbage collection. |
|
||||
| operator.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for cilium-operator pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
|
||||
| operator.podAnnotations | object | `{}` | Annotations to be added to cilium-operator pods |
|
||||
@@ -666,7 +666,7 @@ contributors across the globe, there is almost always someone available to help.
|
||||
| preflight.extraEnv | list | `[]` | Additional preflight environment variables. |
|
||||
| preflight.extraVolumeMounts | list | `[]` | Additional preflight volumeMounts. |
|
||||
| preflight.extraVolumes | list | `[]` | Additional preflight volumes. |
|
||||
| preflight.image | object | `{"digest":"sha256:4ef1eb7a3bc39d0fefe14685e6c0d4e01301c40df2a89bc93ffca9a1ab927301","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.14.9","useDigest":true}` | Cilium pre-flight image. |
|
||||
| preflight.image | object | `{"digest":"sha256:0a1bcd2859c6d18d60dba6650cca8c707101716a3e47b126679040cbd621c031","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.14.10","useDigest":true}` | Cilium pre-flight image. |
|
||||
| preflight.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for preflight pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
|
||||
| preflight.podAnnotations | object | `{}` | Annotations to be added to preflight pods |
|
||||
| preflight.podDisruptionBudget.enabled | bool | `false` | enable PodDisruptionBudget ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
|
||||
|
||||
@@ -61,7 +61,7 @@ spec:
|
||||
image: {{ include "cilium.image" .Values.envoy.image | quote }}
|
||||
imagePullPolicy: {{ .Values.envoy.image.pullPolicy }}
|
||||
command:
|
||||
- /usr/bin/cilium-envoy
|
||||
- /usr/bin/cilium-envoy-starter
|
||||
args:
|
||||
- '-c /var/run/cilium/envoy/bootstrap-config.json'
|
||||
- '--base-id 0'
|
||||
|
||||
@@ -143,10 +143,10 @@ rollOutCiliumPods: false
|
||||
image:
|
||||
override: ~
|
||||
repository: "quay.io/cilium/cilium"
|
||||
tag: "v1.14.9"
|
||||
tag: "v1.14.10"
|
||||
pullPolicy: "IfNotPresent"
|
||||
# cilium-digest
|
||||
digest: "sha256:4ef1eb7a3bc39d0fefe14685e6c0d4e01301c40df2a89bc93ffca9a1ab927301"
|
||||
digest: "sha256:0a1bcd2859c6d18d60dba6650cca8c707101716a3e47b126679040cbd621c031"
|
||||
useDigest: true
|
||||
|
||||
# -- Affinity for cilium-agent.
|
||||
@@ -933,8 +933,8 @@ certgen:
|
||||
image:
|
||||
override: ~
|
||||
repository: "quay.io/cilium/certgen"
|
||||
tag: "v0.1.9"
|
||||
digest: "sha256:89a0847753686444daabde9474b48340993bd19c7bea66a46e45b2974b82041f"
|
||||
tag: "v0.1.11"
|
||||
digest: "sha256:5586de5019abc104637a9818a626956cd9b1e827327b958186ec412ae3d5dea6"
|
||||
useDigest: true
|
||||
pullPolicy: "IfNotPresent"
|
||||
# -- Seconds after which the completed job pod will be deleted
|
||||
@@ -1109,9 +1109,9 @@ hubble:
|
||||
image:
|
||||
override: ~
|
||||
repository: "quay.io/cilium/hubble-relay"
|
||||
tag: "v1.14.9"
|
||||
tag: "v1.14.10"
|
||||
# hubble-relay-digest
|
||||
digest: "sha256:f506f3c6e0a979437cde79eb781654fda4f10ddb5642cebc4dc81254cfb7eeaa"
|
||||
digest: "sha256:c156c4fc2da520d2876142ea17490440b95431a1be755d2050e72115a495cfd0"
|
||||
useDigest: true
|
||||
pullPolicy: "IfNotPresent"
|
||||
|
||||
@@ -1853,9 +1853,9 @@ envoy:
|
||||
image:
|
||||
override: ~
|
||||
repository: "quay.io/cilium/cilium-envoy"
|
||||
tag: "v1.26.7-bbde4095997ea57ead209f56158790d47224a0f5"
|
||||
tag: "v1.27.4-21905253931655328edaacf3cd16aeda73bbea2f"
|
||||
pullPolicy: "IfNotPresent"
|
||||
digest: "sha256:39b75548447978230dedcf25da8940e4d3540c741045ef391a8e74dbb9661a86"
|
||||
digest: "sha256:d52f476c29a97c8b250fdbfbb8472191a268916f6a8503671d0da61e323b02cc"
|
||||
useDigest: true
|
||||
|
||||
# -- Additional containers added to the cilium Envoy DaemonSet.
|
||||
@@ -2269,15 +2269,15 @@ operator:
|
||||
image:
|
||||
override: ~
|
||||
repository: "quay.io/cilium/operator"
|
||||
tag: "v1.14.9"
|
||||
tag: "v1.14.10"
|
||||
# operator-generic-digest
|
||||
genericDigest: "sha256:1552d653870dd8ebbd16ee985a5497dd78a2097370978b0cfbd2da2072f30712"
|
||||
genericDigest: "sha256:415b7f0bb0e7339c6231d4b9ee74a6a513b2865acfccec884dbc806ecc3dd909"
|
||||
# operator-azure-digest
|
||||
azureDigest: "sha256:2d3b9d868eb03fa9256d34192a734a2abab283f527a9c97b7cefcd3401649d17"
|
||||
azureDigest: "sha256:404a46bb0a232c7d5ab7ab97a1d1a55635cdf0e334529a18d1ddb50f4aad71b4"
|
||||
# operator-aws-digest
|
||||
awsDigest: "sha256:041ad5b49ae63ba0f1974e1a1d9ebf9f52541cd2813088fa687f9d544125a1ec"
|
||||
awsDigest: "sha256:72440aa4cb8a42dddb05cfc74c6fba0a18d0902b1e434f5dcde8dca0354a8be6"
|
||||
# operator-alibabacloud-digest
|
||||
alibabacloudDigest: "sha256:765314779093b54750f83280f009229f20fe1f28466a633d9bb4143d2ad669c5"
|
||||
alibabacloudDigest: "sha256:2fbb53c2fc9c7203db9065c4e6cedb8e98d32d5ebc64549949636b5344cd1f14"
|
||||
useDigest: true
|
||||
pullPolicy: "IfNotPresent"
|
||||
suffix: ""
|
||||
@@ -2468,6 +2468,8 @@ nodeinit:
|
||||
override: ~
|
||||
repository: "quay.io/cilium/startup-script"
|
||||
tag: "62093c5c233ea914bfa26a10ba41f8780d9b737f"
|
||||
digest: "sha256:e1d442546e868db1a3289166c14011e0dbd32115b338b963e56f830972bc22a2"
|
||||
useDigest: true
|
||||
pullPolicy: "IfNotPresent"
|
||||
|
||||
# -- The priority class to use for the nodeinit pod.
|
||||
@@ -2554,9 +2556,9 @@ preflight:
|
||||
image:
|
||||
override: ~
|
||||
repository: "quay.io/cilium/cilium"
|
||||
tag: "v1.14.9"
|
||||
tag: "v1.14.10"
|
||||
# cilium-digest
|
||||
digest: "sha256:4ef1eb7a3bc39d0fefe14685e6c0d4e01301c40df2a89bc93ffca9a1ab927301"
|
||||
digest: "sha256:0a1bcd2859c6d18d60dba6650cca8c707101716a3e47b126679040cbd621c031"
|
||||
useDigest: true
|
||||
pullPolicy: "IfNotPresent"
|
||||
|
||||
@@ -2704,9 +2706,9 @@ clustermesh:
|
||||
image:
|
||||
override: ~
|
||||
repository: "quay.io/cilium/clustermesh-apiserver"
|
||||
tag: "v1.14.9"
|
||||
tag: "v1.14.10"
|
||||
# clustermesh-apiserver-digest
|
||||
digest: "sha256:5c16f8b8e22ce41e11998e70846fbcecea3a6b683a38253809ead8d871f6d8a3"
|
||||
digest: "sha256:609fea274caa016f15646f6e0b0f1f7c56b238c551e7b261bc1e99ce64f7b798"
|
||||
useDigest: true
|
||||
pullPolicy: "IfNotPresent"
|
||||
|
||||
@@ -2751,9 +2753,9 @@ clustermesh:
|
||||
image:
|
||||
override: ~
|
||||
repository: "quay.io/cilium/kvstoremesh"
|
||||
tag: "v1.14.9"
|
||||
tag: "v1.14.10"
|
||||
# kvstoremesh-digest
|
||||
digest: "sha256:9d9efb25806660f3663b9cd803fb8679f2b115763470002a9770e2c1eb1e5b22"
|
||||
digest: "sha256:871ec4e3b07401d90b4433c7e2b7210b9b0c5f1a536caab3d0281a5faeea5070"
|
||||
useDigest: true
|
||||
pullPolicy: "IfNotPresent"
|
||||
|
||||
|
||||
@@ -1854,9 +1854,9 @@ envoy:
|
||||
image:
|
||||
override: ~
|
||||
repository: "quay.io/cilium/cilium-envoy"
|
||||
tag: "v1.26.7-bbde4095997ea57ead209f56158790d47224a0f5"
|
||||
tag: "v1.27.4-21905253931655328edaacf3cd16aeda73bbea2f"
|
||||
pullPolicy: "${PULL_POLICY}"
|
||||
digest: "sha256:39b75548447978230dedcf25da8940e4d3540c741045ef391a8e74dbb9661a86"
|
||||
digest: "sha256:d52f476c29a97c8b250fdbfbb8472191a268916f6a8503671d0da61e323b02cc"
|
||||
useDigest: true
|
||||
|
||||
# -- Additional containers added to the cilium Envoy DaemonSet.
|
||||
@@ -2469,6 +2469,8 @@ nodeinit:
|
||||
override: ~
|
||||
repository: "${CILIUM_NODEINIT_REPO}"
|
||||
tag: "${CILIUM_NODEINIT_VERSION}"
|
||||
digest: "${CILIUM_NODEINIT_DIGEST}"
|
||||
useDigest: true
|
||||
pullPolicy: "${PULL_POLICY}"
|
||||
|
||||
# -- The priority class to use for the nodeinit pod.
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{
|
||||
"containerimage.config.digest": "sha256:ac9429d9bf66dd913a37fa9c22a6a2ccdc5d6bef50986bfef7868b5643ecaab2",
|
||||
"containerimage.digest": "sha256:b551704d07e93f9837d36bb610ae5d10508325c31e9bd98a019452eed12ed96f"
|
||||
"containerimage.config.digest": "sha256:78b413d1c9a4ecf3bec9383444b3e85c01d8b33bf903c6443bfa5bdfd8b5bc04",
|
||||
"containerimage.digest": "sha256:ddfaadb33e33123f553a36a3ee5857a1bf53f312043f91d76ad24316591fd26e"
|
||||
}
|
||||
@@ -1 +1 @@
|
||||
ghcr.io/aenix-io/cozystack/dashboard:latest
|
||||
ghcr.io/aenix-io/cozystack/dashboard:v0.4.0
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{
|
||||
"containerimage.config.digest": "sha256:ab059b6397905b2a2084def06582e61b49c4a8a3374747e87b08c82621357420",
|
||||
"containerimage.digest": "sha256:9c1093da42482f116b27407edcdf8b24122885e295cbb632e565213c66fc07c0"
|
||||
"containerimage.config.digest": "sha256:273a8e7055816068b2975d8ac10f0f7d114cafef74057680ffc60414d4d8cf4c",
|
||||
"containerimage.digest": "sha256:5e111f09ee9c34281e2ef02cb0d41700943f8c036014110765bb002831148547"
|
||||
}
|
||||
@@ -1 +1 @@
|
||||
ghcr.io/aenix-io/cozystack/kubeapps-apis:latest
|
||||
ghcr.io/aenix-io/cozystack/kubeapps-apis:v0.4.0
|
||||
|
||||
3
packages/system/etcd-operator/.helmignore
Normal file
3
packages/system/etcd-operator/.helmignore
Normal file
@@ -0,0 +1,3 @@
|
||||
images
|
||||
hack
|
||||
.gitkeep
|
||||
2
packages/system/etcd-operator/Chart.yaml
Normal file
2
packages/system/etcd-operator/Chart.yaml
Normal file
@@ -0,0 +1,2 @@
|
||||
name: cozy-etcd-operator
|
||||
version: 0.4.0
|
||||
8
packages/system/etcd-operator/Makefile
Normal file
8
packages/system/etcd-operator/Makefile
Normal file
@@ -0,0 +1,8 @@
|
||||
NAME=etcd-operator
|
||||
NAMESPACE=cozy-${NAME}
|
||||
|
||||
include ../../../scripts/package-system.mk
|
||||
|
||||
update:
|
||||
rm -rf charts
|
||||
helm pull oci://ghcr.io/aenix-io/charts/etcd-operator --untar --untardir charts
|
||||
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@@ -0,0 +1,5 @@
|
||||
apiVersion: v2
|
||||
appVersion: v0.2.0
|
||||
name: etcd-operator
|
||||
type: application
|
||||
version: 0.2.0
|
||||
63
packages/system/etcd-operator/charts/etcd-operator/README.md
Normal file
63
packages/system/etcd-operator/charts/etcd-operator/README.md
Normal file
@@ -0,0 +1,63 @@
|
||||
# etcd-operator
|
||||
|
||||
  
|
||||
|
||||
## Values
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| affinity | object | `{}` | |
|
||||
| etcdOperator.args[0] | string | `"--health-probe-bind-address=:8081"` | |
|
||||
| etcdOperator.args[1] | string | `"--metrics-bind-address=127.0.0.1:8080"` | |
|
||||
| etcdOperator.args[2] | string | `"--leader-elect"` | |
|
||||
| etcdOperator.envVars | object | `{}` | |
|
||||
| etcdOperator.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| etcdOperator.image.repository | string | `"ghcr.io/aenix-io/etcd-operator"` | |
|
||||
| etcdOperator.image.tag | string | `""` | |
|
||||
| etcdOperator.livenessProbe.httpGet.path | string | `"/healthz"` | |
|
||||
| etcdOperator.livenessProbe.httpGet.port | int | `8081` | |
|
||||
| etcdOperator.livenessProbe.initialDelaySeconds | int | `15` | |
|
||||
| etcdOperator.livenessProbe.periodSeconds | int | `20` | |
|
||||
| etcdOperator.readinessProbe.httpGet.path | string | `"/readyz"` | |
|
||||
| etcdOperator.readinessProbe.httpGet.port | int | `8081` | |
|
||||
| etcdOperator.readinessProbe.initialDelaySeconds | int | `5` | |
|
||||
| etcdOperator.readinessProbe.periodSeconds | int | `10` | |
|
||||
| etcdOperator.resources.limits.cpu | string | `"500m"` | |
|
||||
| etcdOperator.resources.limits.memory | string | `"128Mi"` | |
|
||||
| etcdOperator.resources.requests.cpu | string | `"100m"` | |
|
||||
| etcdOperator.resources.requests.memory | string | `"64Mi"` | |
|
||||
| etcdOperator.securityContext.allowPrivilegeEscalation | bool | `false` | |
|
||||
| etcdOperator.securityContext.capabilities.drop[0] | string | `"ALL"` | |
|
||||
| etcdOperator.service.port | int | `9443` | |
|
||||
| etcdOperator.service.type | string | `"ClusterIP"` | |
|
||||
| fullnameOverride | string | `""` | |
|
||||
| imagePullSecrets | list | `[]` | |
|
||||
| kubeRbacProxy.args[0] | string | `"--secure-listen-address=0.0.0.0:8443"` | |
|
||||
| kubeRbacProxy.args[1] | string | `"--upstream=http://127.0.0.1:8080/"` | |
|
||||
| kubeRbacProxy.args[2] | string | `"--logtostderr=true"` | |
|
||||
| kubeRbacProxy.args[3] | string | `"--v=0"` | |
|
||||
| kubeRbacProxy.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| kubeRbacProxy.image.repository | string | `"gcr.io/kubebuilder/kube-rbac-proxy"` | |
|
||||
| kubeRbacProxy.image.tag | string | `"v0.16.0"` | |
|
||||
| kubeRbacProxy.livenessProbe | object | `{}` | |
|
||||
| kubeRbacProxy.readinessProbe | object | `{}` | |
|
||||
| kubeRbacProxy.resources.limits.cpu | string | `"500m"` | |
|
||||
| kubeRbacProxy.resources.limits.memory | string | `"128Mi"` | |
|
||||
| kubeRbacProxy.resources.requests.cpu | string | `"100m"` | |
|
||||
| kubeRbacProxy.resources.requests.memory | string | `"64Mi"` | |
|
||||
| kubeRbacProxy.securityContext.allowPrivilegeEscalation | bool | `false` | |
|
||||
| kubeRbacProxy.securityContext.capabilities.drop[0] | string | `"ALL"` | |
|
||||
| kubeRbacProxy.service.port | int | `8443` | |
|
||||
| kubeRbacProxy.service.type | string | `"ClusterIP"` | |
|
||||
| kubernetesClusterDomain | string | `"cluster.local"` | |
|
||||
| nameOverride | string | `""` | |
|
||||
| nodeSelector | object | `{}` | |
|
||||
| podAnnotations | object | `{}` | |
|
||||
| podLabels | object | `{}` | |
|
||||
| podSecurityContext | object | `{}` | |
|
||||
| replicaCount | int | `1` | |
|
||||
| securityContext.runAsNonRoot | bool | `true` | |
|
||||
| serviceAccount.annotations | object | `{}` | |
|
||||
| serviceAccount.create | bool | `true` | |
|
||||
| tolerations | list | `[]` | |
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,51 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "etcd-operator.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "etcd-operator.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "etcd-operator.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "etcd-operator.labels" -}}
|
||||
helm.sh/chart: {{ include "etcd-operator.chart" . }}
|
||||
{{ include "etcd-operator.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "etcd-operator.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "etcd-operator.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-serving-cert
|
||||
spec:
|
||||
dnsNames:
|
||||
- {{ include "etcd-operator.fullname" . }}-webhook-service.{{ .Release.Namespace }}.svc
|
||||
- {{ include "etcd-operator.fullname" . }}-webhook-service.{{ .Release.Namespace }}.svc.{{ .Values.kubernetesClusterDomain }}
|
||||
issuerRef:
|
||||
kind: Issuer
|
||||
name: {{ include "etcd-operator.fullname" . }}-selfsigned-issuer
|
||||
secretName: webhook-server-cert
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-selfsigned-issuer
|
||||
spec:
|
||||
selfSigned: {}
|
||||
@@ -0,0 +1,29 @@
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "etcd-operator.fullname" . }}-serving-cert
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-mutating-webhook-configuration
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
service:
|
||||
name: {{ include "etcd-operator.fullname" . }}-webhook-service
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /mutate-etcd-aenix-io-v1alpha1-etcdcluster
|
||||
failurePolicy: Fail
|
||||
name: metcdcluster.kb.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- etcd.aenix.io
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- etcdclusters
|
||||
sideEffects: None
|
||||
@@ -0,0 +1,29 @@
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "etcd-operator.fullname" . }}-serving-cert
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-validating-webhook-configuration
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
service:
|
||||
name: {{ include "etcd-operator.fullname" . }}-webhook-service
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-etcd-aenix-io-v1alpha1-etcdcluster
|
||||
failurePolicy: Fail
|
||||
name: vetcdcluster.kb.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- etcd.aenix.io
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- etcdclusters
|
||||
sideEffects: None
|
||||
@@ -0,0 +1,81 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-manager-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- statefulsets
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- etcd.aenix.io
|
||||
resources:
|
||||
- etcdclusters
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- etcd.aenix.io
|
||||
resources:
|
||||
- etcdclusters/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- etcd.aenix.io
|
||||
resources:
|
||||
- etcdclusters/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- policy
|
||||
resources:
|
||||
- poddisruptionbudgets
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-metrics-reader
|
||||
rules:
|
||||
- nonResourceURLs:
|
||||
- /metrics
|
||||
verbs:
|
||||
- get
|
||||
@@ -0,0 +1,19 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-proxy-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- authentication.k8s.io
|
||||
resources:
|
||||
- tokenreviews
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- authorization.k8s.io
|
||||
resources:
|
||||
- subjectaccessreviews
|
||||
verbs:
|
||||
- create
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-manager-rolebinding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "etcd-operator.fullname" . }}-manager-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "etcd-operator.fullname" . }}-controller-manager
|
||||
namespace: {{ .Release.Namespace }}
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-proxy-rolebinding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "etcd-operator.fullname" . }}-proxy-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "etcd-operator.fullname" . }}-controller-manager
|
||||
namespace: {{ .Release.Namespace }}
|
||||
@@ -0,0 +1,38 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-leader-election-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-leader-election-rolebinding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ include "etcd-operator.fullname" . }}-leader-election-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "etcd-operator.fullname" . }}-controller-manager
|
||||
namespace: {{ .Release.Namespace }}
|
||||
@@ -0,0 +1,16 @@
|
||||
{{- if .Values.etcdOperator.envVars }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "etcd-operator.labels" . }}-env
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
data:
|
||||
{{- range $k, $v := .Values.etcdOperator.envVars }}
|
||||
{{- if typeOf $v | eq "string" }}
|
||||
{{- print (tpl $k $) ": " (tpl $v $ | quote) | nindent 2 }}
|
||||
{{- else }}
|
||||
{{- print (tpl $k $) ": " ($v | quote) | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,114 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "etcd-operator.fullname" . }}-controller-manager
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "etcd-operator.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 8 }}
|
||||
{{- with .Values.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: etcd-operator
|
||||
image: {{ .Values.etcdOperator.image.repository }}:{{ .Values.etcdOperator.image.tag | default .Chart.AppVersion }}
|
||||
imagePullPolicy: {{ .Values.etcdOperator.image.pullPolicy }}
|
||||
{{- with .Values.etcdOperator.args }}
|
||||
args:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.etcdOperator.service.port }}
|
||||
name: webhook-server
|
||||
protocol: TCP
|
||||
{{- with .Values.etcdOperator.livenessProbe }}
|
||||
livenessProbe:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.etcdOperator.readinessProbe }}
|
||||
readinessProbe:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.etcdOperator.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.etcdOperator.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.etcdOperator.envVars }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: {{ include "etcd-operator.fullname" . }}-env
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- mountPath: /tmp/k8s-webhook-server/serving-certs
|
||||
name: cert
|
||||
readOnly: true
|
||||
- name: kube-rbac-proxy
|
||||
image: {{ .Values.kubeRbacProxy.image.repository }}:{{ .Values.kubeRbacProxy.image.tag }}
|
||||
imagePullPolicy: {{ .Values.kubeRbacProxy.image.pullPolicy }}
|
||||
{{- with .Values.kubeRbacProxy.args }}
|
||||
args:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.kubeRbacProxy.service.port }}
|
||||
name: https
|
||||
protocol: TCP
|
||||
{{- with .Values.kubeRbacProxy.livenessProbe }}
|
||||
livenessProbe:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kubeRbacProxy.readinessProbe }}
|
||||
readinessProbe:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kubeRbacProxy.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kubeRbacProxy.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "etcd-operator.fullname" . }}-controller-manager
|
||||
terminationGracePeriodSeconds: 10
|
||||
volumes:
|
||||
- name: cert
|
||||
secret:
|
||||
defaultMode: 420
|
||||
secretName: webhook-server-cert
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "etcd-operator.fullname" . }}-controller-manager-metrics-service
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.kubeRbacProxy.service.type }}
|
||||
ports:
|
||||
- name: https
|
||||
port: {{ .Values.kubeRbacProxy.service.port }}
|
||||
protocol: TCP
|
||||
targetPort: https
|
||||
selector:
|
||||
{{- include "etcd-operator.selectorLabels" . | nindent 4 }}
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
name: {{ include "etcd-operator.fullname" . }}-webhook-service
|
||||
spec:
|
||||
type: {{ .Values.etcdOperator.service.type }}
|
||||
ports:
|
||||
- port: 443
|
||||
protocol: TCP
|
||||
targetPort: {{ .Values.etcdOperator.service.port }}
|
||||
selector:
|
||||
{{- include "etcd-operator.selectorLabels" . | nindent 4 }}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "etcd-operator.fullname" . }}-controller-manager
|
||||
labels:
|
||||
{{- include "etcd-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,284 @@
|
||||
{
|
||||
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
||||
"properties": {
|
||||
"affinity": {
|
||||
"properties": {},
|
||||
"type": "object"
|
||||
},
|
||||
"etcdOperator": {
|
||||
"properties": {
|
||||
"args": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"envVars": {
|
||||
"properties": {},
|
||||
"type": "object"
|
||||
},
|
||||
"image": {
|
||||
"properties": {
|
||||
"pullPolicy": {
|
||||
"type": "string"
|
||||
},
|
||||
"repository": {
|
||||
"type": "string"
|
||||
},
|
||||
"tag": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"livenessProbe": {
|
||||
"properties": {
|
||||
"httpGet": {
|
||||
"properties": {
|
||||
"path": {
|
||||
"type": "string"
|
||||
},
|
||||
"port": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"initialDelaySeconds": {
|
||||
"type": "integer"
|
||||
},
|
||||
"periodSeconds": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"readinessProbe": {
|
||||
"properties": {
|
||||
"httpGet": {
|
||||
"properties": {
|
||||
"path": {
|
||||
"type": "string"
|
||||
},
|
||||
"port": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"initialDelaySeconds": {
|
||||
"type": "integer"
|
||||
},
|
||||
"periodSeconds": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"resources": {
|
||||
"properties": {
|
||||
"limits": {
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"requests": {
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"securityContext": {
|
||||
"properties": {
|
||||
"allowPrivilegeEscalation": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"capabilities": {
|
||||
"properties": {
|
||||
"drop": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"service": {
|
||||
"properties": {
|
||||
"port": {
|
||||
"type": "integer"
|
||||
},
|
||||
"type": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"fullnameOverride": {
|
||||
"type": "string"
|
||||
},
|
||||
"imagePullSecrets": {
|
||||
"type": "array"
|
||||
},
|
||||
"kubeRbacProxy": {
|
||||
"properties": {
|
||||
"args": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"image": {
|
||||
"properties": {
|
||||
"pullPolicy": {
|
||||
"type": "string"
|
||||
},
|
||||
"repository": {
|
||||
"type": "string"
|
||||
},
|
||||
"tag": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"livenessProbe": {
|
||||
"properties": {},
|
||||
"type": "object"
|
||||
},
|
||||
"readinessProbe": {
|
||||
"properties": {},
|
||||
"type": "object"
|
||||
},
|
||||
"resources": {
|
||||
"properties": {
|
||||
"limits": {
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"requests": {
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"securityContext": {
|
||||
"properties": {
|
||||
"allowPrivilegeEscalation": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"capabilities": {
|
||||
"properties": {
|
||||
"drop": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"service": {
|
||||
"properties": {
|
||||
"port": {
|
||||
"type": "integer"
|
||||
},
|
||||
"type": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"kubernetesClusterDomain": {
|
||||
"type": "string"
|
||||
},
|
||||
"nameOverride": {
|
||||
"type": "string"
|
||||
},
|
||||
"nodeSelector": {
|
||||
"properties": {},
|
||||
"type": "object"
|
||||
},
|
||||
"podAnnotations": {
|
||||
"properties": {},
|
||||
"type": "object"
|
||||
},
|
||||
"podLabels": {
|
||||
"properties": {},
|
||||
"type": "object"
|
||||
},
|
||||
"podSecurityContext": {
|
||||
"properties": {},
|
||||
"type": "object"
|
||||
},
|
||||
"replicaCount": {
|
||||
"type": "integer"
|
||||
},
|
||||
"securityContext": {
|
||||
"properties": {
|
||||
"runAsNonRoot": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"serviceAccount": {
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"properties": {},
|
||||
"type": "object"
|
||||
},
|
||||
"create": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"tolerations": {
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
@@ -0,0 +1,98 @@
|
||||
etcdOperator:
|
||||
image:
|
||||
repository: ghcr.io/aenix-io/etcd-operator
|
||||
pullPolicy: IfNotPresent
|
||||
# Overrides the image tag whose default is the chart appVersion.
|
||||
tag: ""
|
||||
args:
|
||||
- --health-probe-bind-address=:8081
|
||||
- --metrics-bind-address=127.0.0.1:8080
|
||||
- --leader-elect
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 9443
|
||||
envVars: {}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8081
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 8081
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
|
||||
kubeRbacProxy:
|
||||
image:
|
||||
repository: gcr.io/kubebuilder/kube-rbac-proxy
|
||||
pullPolicy: IfNotPresent
|
||||
tag: v0.16.0
|
||||
args:
|
||||
- --secure-listen-address=0.0.0.0:8443
|
||||
- --upstream=http://127.0.0.1:8080/
|
||||
- --logtostderr=true
|
||||
- --v=0
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 8443
|
||||
livenessProbe: {}
|
||||
readinessProbe: {}
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
|
||||
kubernetesClusterDomain: cluster.local
|
||||
|
||||
replicaCount: 1
|
||||
|
||||
imagePullSecrets: []
|
||||
|
||||
nameOverride: ""
|
||||
|
||||
fullnameOverride: ""
|
||||
|
||||
serviceAccount:
|
||||
# Specifies whether a service account should be created
|
||||
create: true
|
||||
# Annotations to add to the service account
|
||||
annotations: {}
|
||||
|
||||
podAnnotations: {}
|
||||
|
||||
podLabels: {}
|
||||
|
||||
podSecurityContext: {}
|
||||
# fsGroup: 2000
|
||||
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
|
||||
nodeSelector: {}
|
||||
|
||||
tolerations: []
|
||||
|
||||
affinity: {}
|
||||
Reference in New Issue
Block a user