added repo
This commit is contained in:
Your Name
@@ -0,0 +1,2 @@
|
||||
1. Inspect the operator logs by running the following command:
|
||||
kubectl logs -n {{ .Release.Namespace }} sts/{{ .Release.Name }}
|
||||
@@ -0,0 +1,418 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "eck-operator.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "eck-operator.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "eck-operator.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "eck-operator.labels" -}}
|
||||
{{- include "eck-operator.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
helm.sh/chart: {{ include "eck-operator.chart" . }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "eck-operator.selectorLabels" -}}
|
||||
{{- if .Values.global.manifestGen -}}
|
||||
control-plane: elastic-operator
|
||||
{{- else -}}
|
||||
app.kubernetes.io/name: {{ include "eck-operator.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "eck-operator.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "eck-operator.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Determine effective Kubernetes version
|
||||
*/}}
|
||||
{{- define "eck-operator.effectiveKubeVersion" -}}
|
||||
{{- if .Values.global.manifestGen -}}
|
||||
{{- semver .Values.global.kubeVersion -}}
|
||||
{{- else -}}
|
||||
{{- .Capabilities.KubeVersion.Version -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Determine the name for the webhook
|
||||
*/}}
|
||||
{{- define "eck-operator.webhookName" -}}
|
||||
{{- if .Values.global.manifestGen -}}
|
||||
elastic-webhook.k8s.elastic.co
|
||||
{{- else -}}
|
||||
{{- $name := include "eck-operator.name" . -}}
|
||||
{{ printf "%s.%s.k8s.elastic.co" $name .Release.Namespace }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Determine the name for the webhook secret
|
||||
*/}}
|
||||
{{- define "eck-operator.webhookSecretName" -}}
|
||||
{{- if .Values.global.manifestGen -}}
|
||||
elastic-webhook-server-cert
|
||||
{{- else if .Values.webhook.certsSecret -}}
|
||||
{{- .Values.webhook.certsSecret }}
|
||||
{{- else -}}
|
||||
{{- $name := include "eck-operator.name" . -}}
|
||||
{{ printf "%s-webhook-cert" $name | trunc 63 }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Determine the name for the webhook service
|
||||
*/}}
|
||||
{{- define "eck-operator.webhookServiceName" -}}
|
||||
{{- if .Values.global.manifestGen -}}
|
||||
elastic-webhook-server
|
||||
{{- else -}}
|
||||
{{- $name := include "eck-operator.name" . -}}
|
||||
{{ printf "%s-webhook" $name | trunc 63 }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Determine the metrics port
|
||||
*/}}
|
||||
{{- define "eck-operator.metrics.port" -}}
|
||||
{{- if .Values.config.metrics.port -}}
|
||||
{{- .Values.config.metrics.port -}}
|
||||
{{- else if .Values.config.metricsPort -}}
|
||||
{{- .Values.config.metricsPort -}}
|
||||
{{- else -}}
|
||||
0
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
|
||||
{{/*
|
||||
RBAC permissions
|
||||
NOTE - any changes made to RBAC permissions below require
|
||||
updating docs/operating-eck/eck-permissions.asciidoc file.
|
||||
*/}}
|
||||
{{- define "eck-operator.rbacRules" -}}
|
||||
- apiGroups:
|
||||
- "authorization.k8s.io"
|
||||
resources:
|
||||
- subjectaccessreviews
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
resourceNames:
|
||||
- elastic-operator-leader
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- events
|
||||
- persistentvolumeclaims
|
||||
- secrets
|
||||
- services
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
- statefulsets
|
||||
- daemonsets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- policy
|
||||
resources:
|
||||
- poddisruptionbudgets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- elasticsearch.k8s.elastic.co
|
||||
resources:
|
||||
- elasticsearches
|
||||
- elasticsearches/status
|
||||
- elasticsearches/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- autoscaling.k8s.elastic.co
|
||||
resources:
|
||||
- elasticsearchautoscalers
|
||||
- elasticsearchautoscalers/status
|
||||
- elasticsearchautoscalers/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- kibana.k8s.elastic.co
|
||||
resources:
|
||||
- kibanas
|
||||
- kibanas/status
|
||||
- kibanas/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- apm.k8s.elastic.co
|
||||
resources:
|
||||
- apmservers
|
||||
- apmservers/status
|
||||
- apmservers/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- enterprisesearch.k8s.elastic.co
|
||||
resources:
|
||||
- enterprisesearches
|
||||
- enterprisesearches/status
|
||||
- enterprisesearches/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- beat.k8s.elastic.co
|
||||
resources:
|
||||
- beats
|
||||
- beats/status
|
||||
- beats/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- agent.k8s.elastic.co
|
||||
resources:
|
||||
- agents
|
||||
- agents/status
|
||||
- agents/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- maps.k8s.elastic.co
|
||||
resources:
|
||||
- elasticmapsservers
|
||||
- elasticmapsservers/status
|
||||
- elasticmapsservers/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- stackconfigpolicy.k8s.elastic.co
|
||||
resources:
|
||||
- stackconfigpolicies
|
||||
- stackconfigpolicies/status
|
||||
- stackconfigpolicies/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- logstash.k8s.elastic.co
|
||||
resources:
|
||||
- logstashes
|
||||
- logstashes/status
|
||||
- logstashes/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- autoops.k8s.elastic.co
|
||||
resources:
|
||||
- autoopsagentpolicies
|
||||
- autoopsagentpolicies/status
|
||||
- autoopsagentpolicies/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- packageregistry.k8s.elastic.co
|
||||
resources:
|
||||
- packageregistries
|
||||
- packageregistries/status
|
||||
- packageregistries/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- deletecollection
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
RBAC permissions on non-namespaced resources
|
||||
*/}}
|
||||
{{- define "eck-operator.clusterWideRbacRules" -}}
|
||||
- apiGroups: [""]
|
||||
resources:
|
||||
- namespaces
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- storage.k8s.io
|
||||
resources:
|
||||
- storageclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- admissionregistration.k8s.io
|
||||
resources:
|
||||
- validatingwebhookconfigurations
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
RBAC permissions to read node labels
|
||||
*/}}
|
||||
{{- define "eck-operator.readNodeLabelsRbacRule" -}}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,133 @@
|
||||
{{- if and (not .Values.createClusterScopedResources) (.Values.config.metrics.secureMode.enabled) -}}
|
||||
{{ fail "createClusterScopedResources is required to set config.metrics.secureMode.enabled to true" }}
|
||||
{{- end }}
|
||||
{{- if .Values.createClusterScopedResources -}}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "eck-operator.fullname" . }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
||||
rules:
|
||||
{{ template "eck-operator.rbacRules" . | toYaml | indent 2 }}
|
||||
{{ template "eck-operator.clusterWideRbacRules" . | toYaml | indent 2 }}
|
||||
{{ if .Values.config.exposedNodeLabels }}
|
||||
{{ template "eck-operator.readNodeLabelsRbacRule" . | toYaml | indent 2 }}
|
||||
{{ end -}}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: "{{ include "eck-operator.name" . }}-view"
|
||||
labels:
|
||||
rbac.authorization.k8s.io/aggregate-to-view: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ["elasticsearch.k8s.elastic.co"]
|
||||
resources: ["elasticsearches"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["autoscaling.k8s.elastic.co"]
|
||||
resources: ["elasticsearchautoscalers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["apm.k8s.elastic.co"]
|
||||
resources: ["apmservers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["kibana.k8s.elastic.co"]
|
||||
resources: ["kibanas"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["enterprisesearch.k8s.elastic.co"]
|
||||
resources: ["enterprisesearches"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["beat.k8s.elastic.co"]
|
||||
resources: ["beats"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["agent.k8s.elastic.co"]
|
||||
resources: ["agents"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["maps.k8s.elastic.co"]
|
||||
resources: ["elasticmapsservers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["stackconfigpolicy.k8s.elastic.co"]
|
||||
resources: ["stackconfigpolicies"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["logstash.k8s.elastic.co"]
|
||||
resources: ["logstashes"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["autoops.k8s.elastic.co"]
|
||||
resources: ["autoopsagentpolicies"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["packageregistry.k8s.elastic.co"]
|
||||
resources: ["packageregistries"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: "{{ include "eck-operator.name" . }}-edit"
|
||||
labels:
|
||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ["elasticsearch.k8s.elastic.co"]
|
||||
resources: ["elasticsearches"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
- apiGroups: ["autoscaling.k8s.elastic.co"]
|
||||
resources: ["elasticsearchautoscalers"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
- apiGroups: ["apm.k8s.elastic.co"]
|
||||
resources: ["apmservers"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
- apiGroups: ["kibana.k8s.elastic.co"]
|
||||
resources: ["kibanas"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
- apiGroups: ["enterprisesearch.k8s.elastic.co"]
|
||||
resources: ["enterprisesearches"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
- apiGroups: ["beat.k8s.elastic.co"]
|
||||
resources: ["beats"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
- apiGroups: ["agent.k8s.elastic.co"]
|
||||
resources: ["agents"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
- apiGroups: ["maps.k8s.elastic.co"]
|
||||
resources: ["elasticmapsservers"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
- apiGroups: ["stackconfigpolicy.k8s.elastic.co"]
|
||||
resources: ["stackconfigpolicies"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
- apiGroups: ["logstash.k8s.elastic.co"]
|
||||
resources: ["logstashes"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
- apiGroups: ["autoops.k8s.elastic.co"]
|
||||
resources: ["autoopsagentpolicies"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
- apiGroups: ["packageregistry.k8s.elastic.co"]
|
||||
resources: ["packageregistries"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
{{- if .Values.config.metrics.secureMode.enabled }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
||||
name: "{{ include "eck-operator.fullname" . }}-metrics-auth-role"
|
||||
rules:
|
||||
- apiGroups:
|
||||
- authentication.k8s.io
|
||||
resources:
|
||||
- tokenreviews
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- authorization.k8s.io
|
||||
resources:
|
||||
- subjectaccessreviews
|
||||
verbs:
|
||||
- create
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,88 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "eck-operator.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
||||
data:
|
||||
eck.yaml: |-
|
||||
{{- $metricsPort := int (include "eck-operator.metrics.port" .)}}
|
||||
log-verbosity: {{ int .Values.config.logVerbosity }}
|
||||
{{- if and .Values.config.metrics.secureMode.enabled (eq $metricsPort 0) }}
|
||||
{{- fail "config.metrics.port must be greater than 0 when config.metrics.secureMode.enabled is true" }}
|
||||
{{- end }}
|
||||
metrics-port: {{ $metricsPort }}
|
||||
metrics-secure: {{ .Values.config.metrics.secureMode.enabled }}
|
||||
container-registry: {{ .Values.config.containerRegistry }}
|
||||
{{- with .Values.config.containerSuffix }}
|
||||
container-suffix: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.config.containerRepository }}
|
||||
container-repository: {{ . }}
|
||||
{{- end }}
|
||||
max-concurrent-reconciles: {{ int .Values.config.maxConcurrentReconciles }}
|
||||
{{- with .Values.config.passwordHashCacheSize }}
|
||||
password-hash-cache-size: {{ int . }}
|
||||
{{- end }}
|
||||
ca-cert-validity: {{ .Values.config.caValidity }}
|
||||
ca-cert-rotate-before: {{ .Values.config.caRotateBefore }}
|
||||
{{- with .Values.config.caDir }}
|
||||
ca-dir: {{ . }}
|
||||
{{- end }}
|
||||
cert-validity: {{ .Values.config.certificatesValidity }}
|
||||
cert-rotate-before: {{ .Values.config.certificatesRotateBefore }}
|
||||
disable-config-watch: {{ .Values.config.disableConfigWatch }}
|
||||
{{- with .Values.config.exposedNodeLabels }}
|
||||
exposed-node-labels: [{{ join "," . }}]
|
||||
{{- end }}
|
||||
{{- with .Values.config.ipFamily }}
|
||||
ip-family: {{ . }}
|
||||
{{- end }}
|
||||
set-default-security-context: {{ .Values.config.setDefaultSecurityContext }}
|
||||
kube-client-timeout: {{ .Values.config.kubeClientTimeout }}
|
||||
{{- with .Values.config.kubeClientQPS }}
|
||||
kube-client-qps: {{ int . }}
|
||||
{{- end }}
|
||||
elasticsearch-client-timeout: {{ .Values.config.elasticsearchClientTimeout }}
|
||||
disable-telemetry: {{ .Values.telemetry.disabled }}
|
||||
distribution-channel: {{ .Values.telemetry.distributionChannel }}
|
||||
{{- with .Values.telemetry.interval }}
|
||||
telemetry-interval: {{ . }}
|
||||
{{- end }}
|
||||
validate-storage-class: {{ .Values.config.validateStorageClass }}
|
||||
{{- if .Values.tracing.enabled }}
|
||||
enable-tracing: true
|
||||
{{- end }}
|
||||
{{- if .Values.refs.enforceRBAC }}
|
||||
enforce-rbac-on-refs: true
|
||||
{{- end }}
|
||||
enable-webhook: {{ .Values.webhook.enabled }}
|
||||
{{- if .Values.webhook.enabled }}
|
||||
webhook-name: {{ include "eck-operator.webhookName" . }}
|
||||
{{- if not .Values.webhook.manageCerts }}
|
||||
manage-webhook-certs: false
|
||||
webhook-cert-dir: {{ .Values.webhook.certsDir }}
|
||||
{{- end }}
|
||||
webhook-port: {{ .Values.webhook.port }}
|
||||
{{- end }}
|
||||
{{- with .Values.managedNamespaces }}
|
||||
namespaces: [{{ join "," . }}]
|
||||
{{- end }}
|
||||
operator-namespace: {{ .Release.Namespace }}
|
||||
enable-leader-election: {{ .Values.config.enableLeaderElection }}
|
||||
elasticsearch-observation-interval: {{ .Values.config.elasticsearchObservationInterval }}
|
||||
{{- if not .Values.config.containerSuffix }}
|
||||
ubi-only: {{ .Values.config.ubiOnly }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.certsSecret }}
|
||||
webhook-secret: {{ . }}
|
||||
{{- end }}
|
||||
{{- $passwordLength := int (dig "policies" "passwords" "length" 0 .Values.config) }}
|
||||
{{- with $passwordLength }}
|
||||
{{- if or (lt $passwordLength 6) (gt $passwordLength 72) }}
|
||||
{{- fail "config.policies.passwords.length must be >= 6 and <= 72" }}
|
||||
{{- end }}
|
||||
password-length: {{ $passwordLength }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.softMultiTenancy.enabled -}}
|
||||
{{- range .Values.managedNamespaces }}
|
||||
{{- $namespace := . }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: {{ $namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,228 @@
|
||||
{{- if .Values.softMultiTenancy.enabled -}}
|
||||
{{- $fullName := include "eck-operator.fullname" . -}}
|
||||
{{- $name := include "eck-operator.name" . -}}
|
||||
{{- range .Values.managedNamespaces -}}
|
||||
{{- $namespace := . }}
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: "{{ $name }}-elasticsearch"
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "elasticsearch"
|
||||
egress:
|
||||
# Transport port
|
||||
- ports:
|
||||
- port: 9300
|
||||
to:
|
||||
# Elasticsearch within namespace
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "elasticsearch"
|
||||
# DNS
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
to: []
|
||||
ingress:
|
||||
# HTTP Port
|
||||
- ports:
|
||||
- port: 9200
|
||||
from:
|
||||
# Operator
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
name: "{{ $.Release.Namespace }}"
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- include "eck-operator.selectorLabels" $ | nindent 14 }}
|
||||
# Within namespace
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
# Transport port
|
||||
- ports:
|
||||
- port: 9300
|
||||
from:
|
||||
# Within namespace (from other Elasticsearch nodes)
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "elasticsearch"
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: "{{ $name }}-kibana"
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "kibana"
|
||||
egress:
|
||||
# Elasticsearch HTTP port
|
||||
- ports:
|
||||
- port: 9200
|
||||
to:
|
||||
# Elasticsearch within namespace
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "elasticsearch"
|
||||
# DNS
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
to: []
|
||||
ingress:
|
||||
# HTTP Port
|
||||
- ports:
|
||||
- port: 5601
|
||||
from:
|
||||
# Within namespace
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: "{{ $name }}-apm-server"
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "apm-server"
|
||||
egress:
|
||||
# Elasticsearch HTTP port
|
||||
- ports:
|
||||
- port: 9200
|
||||
to:
|
||||
# Elasticsearch within namespace
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "elasticsearch"
|
||||
# Kibana HTTP port
|
||||
- ports:
|
||||
- port: 5601
|
||||
to:
|
||||
# Kibana within namespace
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "kibana"
|
||||
# DNS
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
to: []
|
||||
ingress:
|
||||
# HTTP Port
|
||||
- ports:
|
||||
- port: 8200
|
||||
from:
|
||||
# Within namespace
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: "{{ $name }}-enterprise-search"
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "enterprise-search"
|
||||
egress:
|
||||
# Elasticsearch HTTP port
|
||||
- ports:
|
||||
- port: 9200
|
||||
to:
|
||||
# Elasticsearch within namespace
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "elasticsearch"
|
||||
# DNS
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
to: []
|
||||
ingress:
|
||||
# HTTP Port
|
||||
- ports:
|
||||
- port: 3002
|
||||
from:
|
||||
# Within namespace
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: "{{ $name }}-beats"
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "beat"
|
||||
egress:
|
||||
# Elasticsearch HTTP port
|
||||
- ports:
|
||||
- port: 9200
|
||||
to:
|
||||
# Elasticsearch within namespace
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "elasticsearch"
|
||||
# Kibana HTTP port
|
||||
- ports:
|
||||
- port: 5601
|
||||
to:
|
||||
# Kibana within namespace
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "kibana"
|
||||
# DNS
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
to: []
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,22 @@
|
||||
{{- if .Values.config.metrics.secureMode.enabled }}
|
||||
{{- $metricsPort := int (include "eck-operator.metrics.port" .)}}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ include "eck-operator.name" . }}-metrics-service
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
helm.sh/chart: {{ include "eck-operator.chart" . }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
name: "{{ include "eck-operator.fullname" . }}-metrics"
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
ports:
|
||||
- name: https
|
||||
port: {{ $metricsPort }}
|
||||
protocol: TCP
|
||||
targetPort: metrics
|
||||
selector:
|
||||
{{- include "eck-operator.selectorLabels" . | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,9 @@
|
||||
{{- if (and .Values.global.manifestGen .Values.global.createOperatorNamespace) -}}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: {{ .Release.Namespace }}
|
||||
labels:
|
||||
name: {{ .Release.Namespace }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,59 @@
|
||||
{{- if .Values.softMultiTenancy.enabled -}}
|
||||
{{- $kubeAPIServerIP := (required "kubeAPIServerIP is required" .Values.kubeAPIServerIP) -}}
|
||||
{{- $metricsPort := int (include "eck-operator.metrics.port" .)}}
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: {{ include "eck-operator.fullname" . }}
|
||||
namespace: {{ .Release.Namespace}}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- include "eck-operator.selectorLabels" . | nindent 6 }}
|
||||
egress:
|
||||
# DNS
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
to: []
|
||||
# API server
|
||||
- ports:
|
||||
- port: 443
|
||||
to:
|
||||
- ipBlock:
|
||||
cidr: "{{ $kubeAPIServerIP }}/32"
|
||||
# Elasticsearch
|
||||
- ports:
|
||||
- port: 9200
|
||||
to:
|
||||
- namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: "eck.k8s.elastic.co/tenant"
|
||||
operator: In
|
||||
values:
|
||||
{{- range .Values.managedNamespaces }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "elasticsearch"
|
||||
{{- if or .Values.webhook.enabled (gt $metricsPort 0) }}
|
||||
ingress:
|
||||
{{- if .Values.webhook.enabled }}
|
||||
- ports:
|
||||
- port: {{ .Values.webhook.port }}
|
||||
from:
|
||||
- ipBlock:
|
||||
cidr: "{{ $kubeAPIServerIP }}/32"
|
||||
{{- end }}
|
||||
{{- if gt $metricsPort 0 }}
|
||||
# Metrics
|
||||
- ports:
|
||||
- port: {{ $metricsPort }}
|
||||
from: []
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,19 @@
|
||||
{{- if .Values.podDisruptionBudget.enabled }}
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "eck-operator.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
||||
spec:
|
||||
{{- with .Values.podDisruptionBudget.minAvailable }}
|
||||
minAvailable: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.podDisruptionBudget.maxUnavailable }}
|
||||
maxUnavailable: {{ . }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "eck-operator.selectorLabels" . | nindent 6 }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,42 @@
|
||||
{{- $metricsPort := int (include "eck-operator.metrics.port" .)}}
|
||||
{{- if and .Values.config.metrics.secureMode.enabled (eq $metricsPort 0) }}
|
||||
{{- fail "config.metrics.port must be greater than 0 when config.metrics.secureMode.enabled is true" }}
|
||||
{{- end }}
|
||||
{{- if and .Values.podMonitor.enabled (gt $metricsPort 0) }}
|
||||
{{- if and .Values.podMonitor.enabled .Values.config.metrics.secureMode.enabled }}
|
||||
{{- fail "podMonitor and config.metrics.secureMode are mutually exclusive" }}
|
||||
{{- end }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PodMonitor
|
||||
metadata:
|
||||
name: {{ include "eck-operator.fullname" . }}
|
||||
namespace: {{ ternary .Values.podMonitor.namespace .Release.Namespace (not (and (.Values.podMonitor) (empty .Values.podMonitor.namespace))) }}
|
||||
labels: {{- include "eck-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.podMonitor.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.podMonitor.annotations }}
|
||||
annotations: {{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.podMonitor.podTargetLabels }}
|
||||
podTargetLabels: {{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
podMetricsEndpoints:
|
||||
- port: metrics
|
||||
path: /metrics
|
||||
{{- with .Values.podMonitor.interval }}
|
||||
interval: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.podMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.podMonitor.podMetricsEndpointConfig }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ .Release.Namespace }}
|
||||
selector:
|
||||
matchLabels: {{- include "eck-operator.selectorLabels" . | nindent 6 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,98 @@
|
||||
{{- $operatorNSIsManaged := has .Release.Namespace .Values.managedNamespaces -}}
|
||||
{{- $fullName := include "eck-operator.fullname" . -}}
|
||||
{{- $svcAccount := include "eck-operator.serviceAccountName" . }}
|
||||
{{- $enableSecureMetrics := .Values.config.metrics.secureMode.enabled -}}
|
||||
|
||||
{{- if not .Values.createClusterScopedResources }}
|
||||
{{- range .Values.managedNamespaces }}
|
||||
{{- $namespace := . }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: "{{ $fullName }}"
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
||||
rules:
|
||||
{{ template "eck-operator.rbacRules" $ | toYaml | indent 2 }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: "{{ $fullName }}"
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: "{{ $fullName }}"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ $svcAccount }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
{{- end }} {{- /* end of range over managed namespaces */}}
|
||||
{{- /* If createClusterScopedResources is false and operator namespace is not in the managed namespaces list, create additional role binding */}}
|
||||
{{- if not $operatorNSIsManaged }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
||||
rules:
|
||||
{{ template "eck-operator.rbacRules" $ | toYaml | indent 2 }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: "{{ $fullName }}"
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: "{{ $fullName }}"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ $svcAccount }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
{{- end }} {{- /* end of operator role binding if operator namespace is not managed */}}
|
||||
{{- else }} {{- /* we can create cluster-scoped resources so just create a cluster role binding */}}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ $fullName }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ $svcAccount }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
{{- if $enableSecureMetrics }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
||||
name: "{{ include "eck-operator.fullname" . }}-metrics-auth-rolebinding"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: "{{ include "eck-operator.fullname" . }}-metrics-auth-role"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ $svcAccount }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,15 @@
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
|
||||
metadata:
|
||||
name: {{ include "eck-operator.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,34 @@
|
||||
{{- if and .Values.config.metrics.secureMode.enabled .Values.serviceMonitor.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ include "eck-operator.fullname" . }}
|
||||
namespace: {{ ternary .Values.serviceMonitor.namespace .Release.Namespace (not (and (.Values.serviceMonitor) (empty .Values.serviceMonitor.namespace))) }}
|
||||
labels: {{- include "eck-operator.labels" . | nindent 4 }}
|
||||
spec:
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ .Release.Namespace }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: {{ include "eck-operator.name" . }}-metrics-service
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
endpoints:
|
||||
- port: https
|
||||
path: /metrics
|
||||
scheme: https
|
||||
interval: 30s
|
||||
tlsConfig:
|
||||
{{- $insecureSkipVerify := (ternary .Values.config.metrics.secureMode.tls.insecureSkipVerify .Values.serviceMonitor.insecureSkipVerify (hasKey .Values.config.metrics.secureMode.tls "insecureSkipVerify")) }}
|
||||
insecureSkipVerify: {{ $insecureSkipVerify }}
|
||||
{{- if (not $insecureSkipVerify) }}
|
||||
{{- $caMountDirectory := or (.Values.config.metrics.secureMode.tls.caMountDirectory) (.Values.serviceMonitor.caMountDirectory) -}}
|
||||
{{- $leading_path := trimSuffix "/" $caMountDirectory }}
|
||||
{{- $caSecret := or (.Values.config.metrics.secureMode.tls.caSecret) (.Values.serviceMonitor.caSecret) -}}
|
||||
{{- with $caSecret }}
|
||||
caFile: "{{ $leading_path }}/{{ . }}/ca.crt"
|
||||
{{- end }}
|
||||
serverName: "{{ include "eck-operator.fullname" . }}-metrics.{{ .Release.Namespace }}.svc"
|
||||
{{- end }}
|
||||
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||
{{- end }}
|
||||
@@ -0,0 +1,166 @@
|
||||
---
|
||||
{{- $metricsPort := int (include "eck-operator.metrics.port" .)}}
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ include "eck-operator.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.statefulsetAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.statefulsetLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "eck-operator.selectorLabels" . | nindent 6 }}
|
||||
serviceName: {{ include "eck-operator.fullname" . }}
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
# Rename the fields "error" to "error.message" and "source" to "event.source"
|
||||
# This is to avoid a conflict with the ECS "error" and "source" documents.
|
||||
"co.elastic.logs/raw": "[{\"type\":\"filestream\",\"enabled\":true,\"id\":\"eck-container-logs-${data.kubernetes.container.id}\",\"paths\":[\"/var/log/containers/*${data.kubernetes.container.id}.log\"],\"parsers\":[{\"container\":{}},{\"ndjson\":{\"keys_under_root\":true}}],\"prospector.scanner.symlinks\":true,\"processors\":[{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"error\",\"to\":\"_error\"}]}},{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"_error\",\"to\":\"error.message\"}]}},{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"source\",\"to\":\"_source\"}]}},{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"_source\",\"to\":\"event.source\"}]}}]}]"
|
||||
"checksum/config": {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- if .Values.global.manifestGen }}
|
||||
{{- include "eck-operator.selectorLabels" . | nindent 8 }}
|
||||
{{- else }}
|
||||
{{- include "eck-operator.labels" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
terminationGracePeriodSeconds: 10
|
||||
serviceAccountName: {{ include "eck-operator.serviceAccountName" . }}
|
||||
automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
|
||||
{{- with .Values.priorityClassName }}
|
||||
priorityClassName: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- image: "{{ .Values.image.repository }}{{- if .Values.config.ubiOnly -}}-ubi{{- end -}}{{- if .Values.image.fips -}}-fips{{- end -}}:{{ default .Chart.AppVersion .Values.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
name: manager
|
||||
args:
|
||||
- "manager"
|
||||
- "--config=/conf/eck.yaml"
|
||||
{{- with .Values.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: OPERATOR_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
{{- if .Values.webhook.enabled }}
|
||||
- name: WEBHOOK_SECRET
|
||||
value: {{ include "eck-operator.webhookSecretName" . }}
|
||||
{{- end }}
|
||||
{{- with .Values.env }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.tracing.enabled -}}
|
||||
{{- range $name, $value := .Values.tracing.config }}
|
||||
- name: {{ $name }}
|
||||
value: {{ $value }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.webhook.enabled (gt $metricsPort 0) }}
|
||||
ports:
|
||||
{{- if (gt $metricsPort 0) }}
|
||||
- containerPort: {{ $metricsPort }}
|
||||
name: metrics
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if .Values.webhook.enabled }}
|
||||
- containerPort: {{ .Values.webhook.port }}
|
||||
name: https-webhook
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- mountPath: "/conf"
|
||||
name: conf
|
||||
readOnly: true
|
||||
{{- if .Values.webhook.enabled }}
|
||||
- mountPath: {{ .Values.webhook.certsDir }}
|
||||
name: cert
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if .Values.config.metrics.secureMode.tls.certificateSecret }}
|
||||
- mountPath: "/tmp/k8s-metrics-server/serving-certs"
|
||||
name: tls-certificate
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- with .Values.volumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: conf
|
||||
configMap:
|
||||
name: {{ include "eck-operator.fullname" . }}
|
||||
{{- if .Values.webhook.enabled }}
|
||||
- name: cert
|
||||
secret:
|
||||
defaultMode: 420
|
||||
secretName: {{ include "eck-operator.webhookSecretName" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.config.metrics.secureMode.tls.certificateSecret }}
|
||||
- name: tls-certificate
|
||||
secret:
|
||||
defaultMode: 420
|
||||
secretName: {{ .Values.config.metrics.secureMode.tls.certificateSecret }}
|
||||
{{- end }}
|
||||
{{- with .Values.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.hostNetwork }}
|
||||
hostNetwork: true
|
||||
{{- end }}
|
||||
{{- if .Values.dnsPolicy }}
|
||||
dnsPolicy: {{ .Values.dnsPolicy }}
|
||||
{{- else if .Values.hostNetwork }}
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
{{- end }}
|
||||
{{- with .Values.dnsConfig }}
|
||||
dnsConfig:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,47 @@
|
||||
suite: test operator webhook
|
||||
templates:
|
||||
- templates/webhook.yaml
|
||||
tests:
|
||||
- it: should render clientConfig.caBundle when certs are managed by the user
|
||||
set:
|
||||
webhook:
|
||||
manageCerts: false
|
||||
caBundle: Y2VydGlmaWNhdGU=
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
isKind:
|
||||
of: ValidatingWebhookConfiguration
|
||||
- documentIndex: 0
|
||||
equal:
|
||||
path: webhooks[0].clientConfig.caBundle
|
||||
value: Y2VydGlmaWNhdGU=
|
||||
- documentIndex: 0
|
||||
equal:
|
||||
path: webhooks[12].clientConfig.caBundle
|
||||
value: Y2VydGlmaWNhdGU=
|
||||
- it: should NOT render clientConfig.caBundle when certs are managed by the operator
|
||||
set:
|
||||
webhook:
|
||||
manageCerts: true
|
||||
caBundle: Cg==
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
isKind:
|
||||
of: ValidatingWebhookConfiguration
|
||||
- documentIndex: 0
|
||||
notExists:
|
||||
path: webhooks[0].clientConfig.caBundle
|
||||
|
||||
- it: should NOT render webhook clientConfig.caBundle when certs are managed by the cert manager
|
||||
set:
|
||||
webhook:
|
||||
manageCerts: false
|
||||
certManagerCert: "cert-manager-cert"
|
||||
caBundle: Cg==
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
isKind:
|
||||
of: ValidatingWebhookConfiguration
|
||||
- documentIndex: 0
|
||||
notExists:
|
||||
path: webhooks[0].clientConfig.caBundle
|
||||
@@ -0,0 +1,79 @@
|
||||
# yaml-language-server: $schema=https://raw.githubusercontent.com/helm-unittest/helm-unittest/main/schema/helm-testsuite.json
|
||||
suite: test operator service monitor
|
||||
templates:
|
||||
- service-monitor.yaml
|
||||
tests:
|
||||
- it: default service monitor
|
||||
set:
|
||||
config:
|
||||
metrics:
|
||||
secureMode:
|
||||
enabled: true
|
||||
asserts:
|
||||
- template: service-monitor.yaml
|
||||
equal:
|
||||
path: spec
|
||||
value:
|
||||
endpoints:
|
||||
- bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||
interval: 30s
|
||||
path: /metrics
|
||||
port: https
|
||||
scheme: https
|
||||
tlsConfig:
|
||||
insecureSkipVerify: true
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- NAMESPACE
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: RELEASE-NAME
|
||||
app.kubernetes.io/name: elastic-operator-metrics-service
|
||||
- it: legacy values
|
||||
set:
|
||||
config:
|
||||
metrics:
|
||||
secureMode:
|
||||
enabled: true
|
||||
tls:
|
||||
insecureSkipVerify: false
|
||||
caSecret: metrics-ca
|
||||
caMountDirectory: /etc/custom-ca/
|
||||
asserts:
|
||||
- template: service-monitor.yaml
|
||||
equal:
|
||||
path: spec.endpoints[0].tlsConfig
|
||||
value:
|
||||
caFile: /etc/custom-ca/metrics-ca/ca.crt
|
||||
insecureSkipVerify: false
|
||||
serverName: elastic-operator-metrics.NAMESPACE.svc
|
||||
- it: serviceMonitor values
|
||||
set:
|
||||
config:
|
||||
metrics:
|
||||
secureMode:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
insecureSkipVerify: false
|
||||
caSecret: metrics-ca
|
||||
caMountDirectory: /etc/custom-ca/
|
||||
asserts:
|
||||
- template: service-monitor.yaml
|
||||
equal:
|
||||
path: spec.endpoints[0].tlsConfig
|
||||
value:
|
||||
caFile: /etc/custom-ca/metrics-ca/ca.crt
|
||||
insecureSkipVerify: false
|
||||
serverName: elastic-operator-metrics.NAMESPACE.svc
|
||||
- it: secure mode without service monitor
|
||||
set:
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
config:
|
||||
metrics:
|
||||
secureMode:
|
||||
enabled: true
|
||||
asserts:
|
||||
- template: service-monitor.yaml
|
||||
hasDocuments:
|
||||
count: 0
|
||||
@@ -0,0 +1,156 @@
|
||||
# yaml-language-server: $schema=https://raw.githubusercontent.com/helm-unittest/helm-unittest/main/schema/helm-testsuite.json
|
||||
suite: test operator statefulset
|
||||
templates:
|
||||
- statefulset.yaml
|
||||
- configmap.yaml
|
||||
tests:
|
||||
- it: ECK image, fips + ubi
|
||||
set:
|
||||
config.ubiOnly: true
|
||||
image.fips: true
|
||||
image.tag: "2.16.1"
|
||||
asserts:
|
||||
- template: statefulset.yaml
|
||||
equal:
|
||||
path: spec.template.spec.containers[0].image
|
||||
value: "docker.elastic.co/eck/eck-operator-ubi-fips:2.16.1"
|
||||
- it: ECK image, no fips, no ubi
|
||||
set:
|
||||
image.tag: "2.16.1"
|
||||
asserts:
|
||||
- template: statefulset.yaml
|
||||
equal:
|
||||
path: spec.template.spec.containers[0].image
|
||||
value: "docker.elastic.co/eck/eck-operator:2.16.1"
|
||||
- it: ECK image, fips, no ubi
|
||||
set:
|
||||
image.fips: true
|
||||
image.tag: "2.16.1"
|
||||
asserts:
|
||||
- template: statefulset.yaml
|
||||
equal:
|
||||
path: spec.template.spec.containers[0].image
|
||||
value: "docker.elastic.co/eck/eck-operator-fips:2.16.1"
|
||||
- it: ECK image, no fips, ubi
|
||||
set:
|
||||
config.ubiOnly: true
|
||||
image.tag: "2.16.1"
|
||||
asserts:
|
||||
- template: statefulset.yaml
|
||||
equal:
|
||||
path: spec.template.spec.containers[0].image
|
||||
value: "docker.elastic.co/eck/eck-operator-ubi:2.16.1"
|
||||
- it: should have automount service account tokens set by default
|
||||
asserts:
|
||||
- template: statefulset.yaml
|
||||
equal:
|
||||
path: spec.template.spec.automountServiceAccountToken
|
||||
value: true
|
||||
- it: should disable automount service account tokens
|
||||
set:
|
||||
automountServiceAccountToken: false
|
||||
serviceAccount:
|
||||
automountServiceAccountToken: false
|
||||
asserts:
|
||||
- template: statefulset.yaml
|
||||
equal:
|
||||
path: spec.template.spec.automountServiceAccountToken
|
||||
value: false
|
||||
- it: should render custom labels, and annotations values properly
|
||||
set:
|
||||
statefulsetAnnotations:
|
||||
key1: value1
|
||||
statefulsetLabels:
|
||||
key2: value2
|
||||
podLabels:
|
||||
key3: value3
|
||||
asserts:
|
||||
- template: statefulset.yaml
|
||||
equal:
|
||||
path: metadata.annotations
|
||||
value:
|
||||
key1: value1
|
||||
- template: statefulset.yaml
|
||||
equal:
|
||||
path: metadata.labels
|
||||
value:
|
||||
app.kubernetes.io/instance: RELEASE-NAME
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: elastic-operator
|
||||
app.kubernetes.io/version: 3.3.1
|
||||
helm.sh/chart: eck-operator-3.3.1
|
||||
key2: value2
|
||||
- template: statefulset.yaml
|
||||
equal:
|
||||
path: spec.template.metadata.labels
|
||||
value:
|
||||
app.kubernetes.io/instance: RELEASE-NAME
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: elastic-operator
|
||||
app.kubernetes.io/version: 3.3.1
|
||||
helm.sh/chart: eck-operator-3.3.1
|
||||
key3: value3
|
||||
- it: should use the specified webhook secret name
|
||||
set:
|
||||
webhook:
|
||||
manageCerts: false
|
||||
certsSecret: "my-webhook-server-cert"
|
||||
asserts:
|
||||
- template: statefulset.yaml
|
||||
equal:
|
||||
path: spec.template.spec.volumes[1].name
|
||||
value: cert
|
||||
- template: statefulset.yaml
|
||||
equal:
|
||||
path: spec.template.spec.volumes[1].secret.secretName
|
||||
value: my-webhook-server-cert
|
||||
- template: statefulset.yaml
|
||||
equal:
|
||||
path: spec.template.spec.containers[0].env[2].name
|
||||
value: WEBHOOK_SECRET
|
||||
- template: statefulset.yaml
|
||||
equal:
|
||||
path: spec.template.spec.containers[0].env[2].value
|
||||
value: my-webhook-server-cert
|
||||
- it: should set dnsPolicy to ClusterFirstWithHostNet when hostNetwork is enabled
|
||||
set:
|
||||
hostNetwork: true
|
||||
asserts:
|
||||
- template: statefulset.yaml
|
||||
equal:
|
||||
path: spec.template.spec.hostNetwork
|
||||
value: true
|
||||
- template: statefulset.yaml
|
||||
equal:
|
||||
path: spec.template.spec.dnsPolicy
|
||||
value: "ClusterFirstWithHostNet"
|
||||
- it: should render dnsPolicy properly when hostNetwork is enabled
|
||||
set:
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirst
|
||||
asserts:
|
||||
- template: statefulset.yaml
|
||||
equal:
|
||||
path: spec.template.spec.hostNetwork
|
||||
value: true
|
||||
- template: statefulset.yaml
|
||||
equal:
|
||||
path: spec.template.spec.dnsPolicy
|
||||
value: "ClusterFirst"
|
||||
- it: should render dnsPolicy and dnsConfig properly
|
||||
set:
|
||||
dnsPolicy: ClusterFirst
|
||||
dnsConfig:
|
||||
nameservers: "1.2.3.4"
|
||||
asserts:
|
||||
- template: statefulset.yaml
|
||||
notExists:
|
||||
path: spec.template.spec.hostNetwork
|
||||
- template: statefulset.yaml
|
||||
equal:
|
||||
path: spec.template.spec.dnsPolicy
|
||||
value: "ClusterFirst"
|
||||
- template: statefulset.yaml
|
||||
equal:
|
||||
path: spec.template.spec.dnsConfig.nameservers
|
||||
value: "1.2.3.4"
|
||||
@@ -0,0 +1,29 @@
|
||||
{{- if .Values.softMultiTenancy.enabled -}}
|
||||
{{- if has .Release.Namespace .Values.managedNamespaces -}}
|
||||
{{- fail "Operator namespace cannot be in managed namespaces when soft multi-tenancy is enabled" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if empty .Values.managedNamespaces -}}
|
||||
{{- fail "Managed namespaces must be defined when soft multi-tenancy is enabled" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if empty .Values.kubeAPIServerIP -}}
|
||||
{{- fail "Soft multi-tenancy requires kubeAPIServerIP to be defined" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if (not .Values.createClusterScopedResources) -}}
|
||||
{{- if .Values.webhook.enabled -}}
|
||||
{{- fail "Webhook cannot be enabled when cluster-scoped resource creation is disabled" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.config.validateStorageClass -}}
|
||||
{{- fail "Storage class validation cannot be enabled when cluster-scoped resource creation is disabled" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if (not .Values.config.enableLeaderElection) -}}
|
||||
{{- if gt (int .Values.replicaCount) 1 -}}
|
||||
{{- fail "Leader election must be enabled with more than one replica" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,535 @@
|
||||
{{- if .Values.webhook.enabled -}}
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: {{ include "eck-operator.webhookName" . }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.webhook.certManagerCert }}
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: "{{ $.Release.Namespace }}/{{ . }}"
|
||||
{{- end }}
|
||||
webhooks:
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-agent-k8s-elastic-co-v1alpha1-agent
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-agent-validation-v1alpha1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- agent.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- agents
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-apm-k8s-elastic-co-v1-apmserver
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-apm-validation-v1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- apm.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- apmservers
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-apm-k8s-elastic-co-v1beta1-apmserver
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-apm-validation-v1beta1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- apm.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1beta1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- apmservers
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-beat-k8s-elastic-co-v1beta1-beat
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-beat-validation-v1beta1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- beat.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1beta1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- beats
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-enterprisesearch-k8s-elastic-co-v1-enterprisesearch
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-ent-validation-v1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- enterprisesearch.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- enterprisesearches
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-enterprisesearch-k8s-elastic-co-v1beta1-enterprisesearch
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-ent-validation-v1beta1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- enterprisesearch.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1beta1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- enterprisesearches
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-elasticsearch-k8s-elastic-co-v1-elasticsearch
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-es-validation-v1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- elasticsearch.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- elasticsearches
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-elasticsearch-k8s-elastic-co-v1beta1-elasticsearch
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-es-validation-v1beta1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- elasticsearch.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1beta1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- elasticsearches
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-ems-k8s-elastic-co-v1alpha1-mapsservers
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-ems-validation-v1alpha1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- maps.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- mapsservers
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-kibana-k8s-elastic-co-v1-kibana
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-kb-validation-v1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- kibana.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- kibanas
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-kibana-k8s-elastic-co-v1beta1-kibana
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-kb-validation-v1beta1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- kibana.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1beta1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- kibanas
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-autoscaling-k8s-elastic-co-v1alpha1-elasticsearchautoscaler
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-esa-validation-v1alpha1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- autoscaling.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- elasticsearchautoscalers
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-scp-k8s-elastic-co-v1alpha1-stackconfigpolicies
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-scp-validation-v1alpha1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- stackconfigpolicy.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- stackconfigpolicies
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-logstash-k8s-elastic-co-v1alpha1-logstash
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-logstash-validation-v1alpha1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- logstash.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- logstashes
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-autoops-k8s-elastic-co-v1alpha1-autoopsagentpolicies
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-autoops-validation-v1alpha1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- autoops.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- autoopsagentpolicies
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-epr-k8s-elastic-co-v1alpha1-elasticpackageregistry
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-epr-validation-v1alpha1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1,v1beta1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- packageregistry.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- packageregistries
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
||||
spec:
|
||||
ports:
|
||||
- name: https
|
||||
port: 443
|
||||
targetPort: {{ .Values.webhook.port }}
|
||||
selector:
|
||||
{{- include "eck-operator.selectorLabels" . | nindent 4 }}
|
||||
{{- if .Values.webhook.manageCerts }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "eck-operator.webhookSecretName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
Reference in New Issue
Block a user