added repo
This commit is contained in:
Your Name
@@ -0,0 +1,133 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "reports-server.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "reports-server.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "reports-server.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "reports-server.labels" -}}
|
||||
helm.sh/chart: {{ include "reports-server.chart" . }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{ include "reports-server.commonLabels" . }}
|
||||
{{- end }}
|
||||
{{ include "reports-server.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "reports-server.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "reports-server.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "reports-server.commonLabels" -}}
|
||||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "reports-server.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "reports-server.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Database config is injected into the environment and passed to the command line from there, if secretName is set, the values will be read from there .
|
||||
*/}}
|
||||
{{- define "reports-server.dbHost" -}}
|
||||
{{- if .Values.config.db.secretName -}}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: {{ .Values.config.db.hostSecretKeyName }}
|
||||
name: {{ .Values.config.db.secretName }}
|
||||
{{- else -}}
|
||||
value: {{ default (printf "%s-postgresql.%s" $.Release.Name $.Release.Namespace ) .Values.config.db.host | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "reports-server.dbPort" -}}
|
||||
{{- if .Values.config.db.secretName -}}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: {{ .Values.config.db.portSecretKeyName }}
|
||||
name: {{ .Values.config.db.secretName }}
|
||||
{{- else -}}
|
||||
value: {{ .Values.config.db.port | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "reports-server.dbName" -}}
|
||||
{{- if .Values.config.db.secretName -}}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: {{ .Values.config.db.dbNameSecretKeyName }}
|
||||
name: {{ .Values.config.db.secretName }}
|
||||
{{- else -}}
|
||||
value: {{ .Values.config.db.name | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "reports-server.dbUser" -}}
|
||||
{{- if .Values.config.db.secretName -}}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: {{ .Values.config.db.userSecretKeyName }}
|
||||
name: {{ .Values.config.db.secretName }}
|
||||
{{- else -}}
|
||||
value: {{ .Values.config.db.user | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "reports-server.dbPassword" -}}
|
||||
{{- if .Values.config.db.secretName -}}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: {{ .Values.config.db.passwordSecretKeyName }}
|
||||
name: {{ .Values.config.db.secretName }}
|
||||
{{- else -}}
|
||||
value: {{ .Values.config.db.password | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -0,0 +1,94 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "reports-server.fullname" . }}
|
||||
labels:
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: 'true'
|
||||
rbac.authorization.k8s.io/aggregate-to-edit: 'true'
|
||||
rbac.authorization.k8s.io/aggregate-to-view: 'true'
|
||||
{{- include "reports-server.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- reports.kyverno.io
|
||||
resources:
|
||||
- ephemeralreports
|
||||
- clusterephemeralreports
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- apiregistration.k8s.io
|
||||
resources:
|
||||
- apiservices
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- apiregistration.k8s.io
|
||||
resources:
|
||||
- apiservices
|
||||
verbs:
|
||||
- get
|
||||
- delete
|
||||
- update
|
||||
- patch
|
||||
resourceNames:
|
||||
- v1.reports.kyverno.io
|
||||
- v1alpha2.wgpolicyk8s.io
|
||||
- v1alpha1.openreports.io
|
||||
- apiGroups:
|
||||
- wgpolicyk8s.io
|
||||
resources:
|
||||
- policyreports
|
||||
- policyreports/status
|
||||
- clusterpolicyreports
|
||||
- clusterpolicyreports/status
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- ''
|
||||
- events.k8s.io
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- authorization.k8s.io
|
||||
resources:
|
||||
- subjectaccessreviews
|
||||
verbs:
|
||||
- create
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "reports-server.fullname" . }}
|
||||
labels:
|
||||
{{- include "reports-server.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "reports-server.fullname" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "reports-server.serviceAccountName" $ }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
@@ -0,0 +1,118 @@
|
||||
{{- $env := .Values.podEnv }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "reports-server.fullname" . }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
{{- include "reports-server.labels" . | nindent 4 }}
|
||||
spec:
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxUnavailable: 0
|
||||
{{- if not .Values.autoscaling.enabled }}
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "reports-server.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "reports-server.labels" . | nindent 8 }}
|
||||
spec:
|
||||
{{- with .Values.priorityClassName }}
|
||||
priorityClassName: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "reports-server.serviceAccountName" . }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
containers:
|
||||
- name: reports-server
|
||||
args:
|
||||
{{- if .Values.config.etcd.enabled }}
|
||||
- --etcd
|
||||
{{- if .Values.config.etcd.insecure }}
|
||||
- --etcdSkipTLS
|
||||
{{- end }}
|
||||
- --etcdEndpoints=https://etcd-0.etcd.{{ $.Release.Namespace }}:2379,https://etcd-1.etcd.{{ $.Release.Namespace }}:2379,https://etcd-2.etcd.{{ $.Release.Namespace }}:2379
|
||||
{{- else }}
|
||||
- --dbsslmode={{ .Values.config.db.sslmode }}
|
||||
- --dbsslrootcert={{ .Values.config.db.sslrootcert }}
|
||||
- --dbsslkey={{ .Values.config.db.sslkey }}
|
||||
- --dbsslcert={{ .Values.config.db.sslcert }}
|
||||
{{- end }}
|
||||
- --servicename={{ include "reports-server.fullname" . }}
|
||||
- --servicens={{ $.Release.Namespace }}
|
||||
- --storereports={{ .Values.apiServicesManagement.installApiServices.enabled }}
|
||||
- --storeephemeralreports={{ .Values.apiServicesManagement.installApiServices.installEphemeralReportsService }}
|
||||
- --storeopenreports={{ .Values.apiServicesManagement.installApiServices.installOpenreportsService }}
|
||||
- --cert-dir=/tmp
|
||||
- --secure-port=4443
|
||||
{{- if .Values.metrics.enabled }}
|
||||
- --authorization-always-allow-paths=/metrics
|
||||
{{- end }}
|
||||
- --clustername={{ .Values.clusterName }}
|
||||
env:
|
||||
- name: GOMEMLIMIT
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
resource: limits.memory
|
||||
divisor: '1'
|
||||
- name: DB_HOST
|
||||
{{- include "reports-server.dbHost" . | nindent 14 }}
|
||||
- name: DB_PORT
|
||||
{{- include "reports-server.dbPort" . | nindent 14 }}
|
||||
- name: DB_DATABASE
|
||||
{{- include "reports-server.dbName" . | nindent 14 }}
|
||||
- name: DB_USER
|
||||
{{- include "reports-server.dbUser" . | nindent 14 }}
|
||||
- name: DB_PASSWORD
|
||||
{{- include "reports-server.dbPassword" . | nindent 14 }}
|
||||
{{- with $env }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
volumeMounts:
|
||||
- mountPath: /tmp
|
||||
name: tmp-dir
|
||||
image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
ports:
|
||||
- name: https
|
||||
containerPort: 4443
|
||||
protocol: TCP
|
||||
{{- with .Values.livenessProbe }}
|
||||
livenessProbe:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.readinessProbe }}
|
||||
readinessProbe:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- emptyDir: {}
|
||||
name: tmp-dir
|
||||
@@ -0,0 +1,170 @@
|
||||
{{- if .Values.config.etcd.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: etcd
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
app: etcd-reports-server
|
||||
{{- include "reports-server.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
selector:
|
||||
app: etcd-reports-server
|
||||
publishNotReadyAddresses: true
|
||||
ports:
|
||||
- name: etcd-client
|
||||
port: 2379
|
||||
- name: etcd-server
|
||||
port: 2380
|
||||
- name: etcd-metrics
|
||||
port: 8080
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
namespace: {{ include "reports-server.fullname" . }}
|
||||
name: etcd
|
||||
labels:
|
||||
app: etcd-reports-server
|
||||
{{- include "reports-server.labels" . | nindent 4 }}
|
||||
spec:
|
||||
serviceName: etcd
|
||||
replicas: 3
|
||||
podManagementPolicy: Parallel
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: etcd-reports-server
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: etcd-reports-server
|
||||
annotations:
|
||||
serviceName: etcd
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 1
|
||||
podAffinityTerm:
|
||||
labelSelector:
|
||||
matchExpressions:
|
||||
- key: app
|
||||
operator: In
|
||||
values:
|
||||
- etcd-reports-server
|
||||
topologyKey: "kubernetes.io/hostname"
|
||||
containers:
|
||||
- name: etcd
|
||||
image: quay.io/coreos/etcd:v3.5.15
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: etcd-client
|
||||
containerPort: 2379
|
||||
- name: etcd-server
|
||||
containerPort: 2380
|
||||
- name: etcd-metrics
|
||||
containerPort: 8080
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 8080
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 5
|
||||
successThreshold: 1
|
||||
failureThreshold: 30
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /livez
|
||||
port: 8080
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
env:
|
||||
- name: K8S_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: HOSTNAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: SERVICE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.annotations['serviceName']
|
||||
- name: ETCDCTL_ENDPOINTS
|
||||
value: $(HOSTNAME).$(SERVICE_NAME):2379
|
||||
## TLS client configuration for etcdctl in the container.
|
||||
## These files paths are part of the "etcd-client-certs" volume mount.
|
||||
# - name: ETCDCTL_KEY
|
||||
# value: /etc/etcd/certs/client/tls.key
|
||||
# - name: ETCDCTL_CERT
|
||||
# value: /etc/etcd/certs/client/tls.crt
|
||||
# - name: ETCDCTL_CACERT
|
||||
# value: /etc/etcd/certs/client/ca.crt
|
||||
##
|
||||
## Use this URI_SCHEME value for non-TLS clusters.
|
||||
- name: URI_SCHEME
|
||||
value: "http"
|
||||
## TLS: Use this URI_SCHEME for TLS clusters.
|
||||
# - name: URI_SCHEME
|
||||
# value: "https"
|
||||
command:
|
||||
- /usr/local/bin/etcd
|
||||
args:
|
||||
- --name=$(HOSTNAME)
|
||||
- --data-dir=/data
|
||||
- --wal-dir=/data/wal
|
||||
- --listen-peer-urls=$(URI_SCHEME)://0.0.0.0:2380
|
||||
- --listen-client-urls=$(URI_SCHEME)://0.0.0.0:2379
|
||||
- --advertise-client-urls=$(URI_SCHEME)://$(HOSTNAME).$(SERVICE_NAME):2379
|
||||
- --initial-cluster-state=new
|
||||
- --initial-cluster-token=etcd-$(K8S_NAMESPACE)
|
||||
- --initial-cluster=etcd-0=$(URI_SCHEME)://etcd-0.$(SERVICE_NAME):2380,etcd-1=$(URI_SCHEME)://etcd-1.$(SERVICE_NAME):2380,etcd-2=$(URI_SCHEME)://etcd-2.$(SERVICE_NAME):2380
|
||||
- --initial-advertise-peer-urls=$(URI_SCHEME)://$(HOSTNAME).$(SERVICE_NAME):2380
|
||||
- --listen-metrics-urls=http://0.0.0.0:8080
|
||||
# - --auto-compaction-mode=periodic
|
||||
# - --auto-compaction-retention=10m
|
||||
# - --client-cert-auth
|
||||
# - --trusted-ca-file=$(ETCDCTL_CACERT)
|
||||
# - --cert-file=$(ETCDCTL_CERT)
|
||||
# - --key-file=$(ETCDCTL_KEY)
|
||||
# - --peer-client-cert-auth
|
||||
# - --peer-trusted-ca-file=/etc/etcd/certs/server/ca.crt
|
||||
# - --peer-cert-file=/etc/etcd/certs/server/tls.crt
|
||||
# - --peer-key-file=/etc/etcd/certs/server/tls.key
|
||||
volumeMounts:
|
||||
- name: etcd-data
|
||||
mountPath: /data
|
||||
# - name: etcd-client-tls
|
||||
# mountPath: "/etc/etcd/certs/client"
|
||||
# readOnly: true
|
||||
# - name: etcd-server-tls
|
||||
# mountPath: "/etc/etcd/certs/server"
|
||||
# readOnly: true
|
||||
volumes:
|
||||
# - name: etcd-client-tls
|
||||
# secret:
|
||||
# secretName: etcd-client-tls
|
||||
# optional: false
|
||||
# - name: etcd-server-tls
|
||||
# secret:
|
||||
# secretName: etcd-server-tls
|
||||
# optional: false
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: etcd-data
|
||||
spec:
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
{{- end }}
|
||||
|
||||
@@ -0,0 +1,8 @@
|
||||
{{- range .Values.extraObjects }}
|
||||
---
|
||||
{{- if kindIs "map" . }}
|
||||
{{- tpl (toYaml .) $ | nindent 0 }}
|
||||
{{- else if kindIs "string" . }}
|
||||
{{- tpl . $ | nindent 0 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
+77
@@ -0,0 +1,77 @@
|
||||
{{- if .Values.apiServicesManagement.enabled -}}
|
||||
{{- if not .Values.templating.enabled -}}
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ include "reports-server.fullname" . }}-pre-delete-api-services-cleanup
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
{{- include "reports-server.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
helm.sh/hook: pre-delete
|
||||
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
|
||||
helm.sh/hook-weight: "100"
|
||||
spec:
|
||||
backoffLimit: 2
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.apiServicesManagement.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- with .Values.apiServicesManagement.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- include "reports-server.labels" . | nindent 8 }}
|
||||
spec:
|
||||
serviceAccount: {{ include "reports-server.serviceAccountName" . }}
|
||||
{{- with .Values.apiServicesManagement.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
restartPolicy: Never
|
||||
{{- with .Values.apiServicesManagement.imagePullSecrets | default .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: kubectl
|
||||
image: "{{ .Values.apiServicesManagement.image.registry }}/{{ .Values.apiServicesManagement.image.repository }}:{{ .Values.apiServicesManagement.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.apiServicesManagement.image.pullPolicy }}
|
||||
command:
|
||||
- /bin/bash
|
||||
- '-c'
|
||||
- |-
|
||||
set -euo pipefail
|
||||
kubectl wait -n {{ $.Release.Namespace }} pod --for=condition=ready -l app.kubernetes.io/name={{ include "reports-server.name" . }} --timeout=120s
|
||||
kubectl delete apiservice v1alpha2.wgpolicyk8s.io v1.reports.kyverno.io --ignore-not-found=true
|
||||
{{- with .Values.apiServicesManagement.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.apiServicesManagement.tolerations | default .Values.tolerations}}
|
||||
tolerations:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.apiServicesManagement.nodeSelector | default .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.apiServicesManagement.podAntiAffinity .Values.apiServicesManagement.podAffinity .Values.apiServicesManagement.nodeAffinity }}
|
||||
affinity:
|
||||
{{- with .Values.apiServicesManagement.podAntiAffinity }}
|
||||
podAntiAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.apiServicesManagement.podAffinity }}
|
||||
podAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.apiServicesManagement.nodeAffinity }}
|
||||
nodeAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,6 @@
|
||||
{{- if .Values.templating.enabled -}}
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: {{ $.Release.Namespace }}
|
||||
{{- end -}}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
{{- if eq .Values.pdb.enabled true }}
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "reports-server.fullname" . }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
{{- include "reports-server.labels" . | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: {{ include "reports-server.name" . }}
|
||||
{{- if .Values.pdb.maxUnavailable }}
|
||||
maxUnavailable: {{ .Values.pdb.maxUnavailable }}
|
||||
{{- else if .Values.pdb.minAvailable }}
|
||||
minAvailable: {{ .Values.pdb.minAvailable }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,47 @@
|
||||
kind: RoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "reports-server.fullname" . }}
|
||||
namespace: kube-system
|
||||
labels:
|
||||
{{- include "reports-server.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: extension-apiserver-authentication-reader
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "reports-server.serviceAccountName" $ }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "reports-server.fullname" . }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
{{- include "reports-server.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ''
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
---
|
||||
kind: RoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "reports-server.fullname" . }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
{{- include "reports-server.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ include "reports-server.fullname" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "reports-server.serviceAccountName" $ }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "reports-server.serviceAccountName" . }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
{{- include "reports-server.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,36 @@
|
||||
{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled -}}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ include "reports-server.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "reports-server.labels" . | nindent 4 }}
|
||||
{{- with .Values.metrics.serviceMonitor.additionalLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "reports-server.selectorLabels" . | nindent 6 }}
|
||||
endpoints:
|
||||
- port: https
|
||||
path: /metrics
|
||||
scheme: https
|
||||
tlsConfig:
|
||||
insecureSkipVerify: true
|
||||
{{- if .Values.metrics.serviceMonitor.interval}}
|
||||
interval: {{ .Values.metrics.serviceMonitor.interval }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.scrapeTimeout}}
|
||||
scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }}
|
||||
{{- end }}
|
||||
{{- with .Values.metrics.serviceMonitor.metricRelabelings }}
|
||||
metricRelabelings:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.metrics.serviceMonitor.relabelings }}
|
||||
relabelings:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,16 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "reports-server.fullname" . }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
{{- include "reports-server.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
ports:
|
||||
- name: https
|
||||
port: {{ .Values.service.port }}
|
||||
protocol: TCP
|
||||
targetPort: https
|
||||
selector:
|
||||
{{- include "reports-server.selectorLabels" . | nindent 4 }}
|
||||
Reference in New Issue
Block a user