gstykalin/kube-forge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

migrate from kubespray to library helm client

Browse Source
This commit is contained in:
George Stykalin
2024-06-20 00:20:50 +03:00
parent 3109816dee
commit 78cf06e314
46 changed files with 6283 additions and 12035 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
cmd/main/main.go
View File

@@ -2,13 +2,28 @@ package main
import ( import (
"flag" "flag"
"fmt" "kube-forge/internal/additional"
"kube-forge/internal/cicd"
"kube-forge/internal/config" "kube-forge/internal/config"
"kube-forge/internal/csi"
"kube-forge/internal/kubespray" "kube-forge/internal/kubespray"
"kube-forge/internal/logging"
"kube-forge/internal/observability"
"kube-forge/internal/registry"
"kube-forge/internal/secrets_storage"
"kube-forge/internal/templates" "kube-forge/internal/templates"
"os" "os"
) )
func installAndConfigureModules() {
csi.ApplyCharts()
additional.ApplyCharts()
registry.ApplyCharts()
secrets_storage.ApplyCharts()
cicd.ApplyCharts()
observability.ApplyCharts()
}
func main() { func main() {
var password, configPath, workDir string var password, configPath, workDir string
var verbose bool var verbose bool
@@ -20,9 +35,6 @@ func main() {
flag.Parse() flag.Parse()
config := config.CreateConfig(configPath, workDir, password) config := config.CreateConfig(configPath, workDir, password)
config.Verbose = verbose config.Verbose = verbose
repositories, releases := templates.GetHelmAppsConfigData()
config.Repositories = repositories
config.Releases = releases
templates.ApplyK8sTemplates() templates.ApplyK8sTemplates()
@@ -30,9 +42,10 @@ func main() {
switch cmd { switch cmd {
case "apply": case "apply":
kubespray.InstallCluster("") kubespray.InstallCluster("")
installAndConfigureModules()
return return
case "apply-modules": case "apply-modules":
kubespray.InstallCluster("helm-apps") installAndConfigureModules()
return return
case "upgrade": case "upgrade":
kubespray.UpgradeCluster("") kubespray.UpgradeCluster("")
@@ -42,5 +55,5 @@ func main() {
return return
} }
} }
fmt.Println("No such command\nAvailable commands: apply, apply-modules, upgrade, scale") logging.Log.Error("No such command\nAvailable commands: apply, apply-modules, upgrade, scale")
} }

4
go.mod
View File

@@ -11,7 +11,9 @@ require (
github.com/apenella/go-ansible/v2 v2.0.0 github.com/apenella/go-ansible/v2 v2.0.0
github.com/ilyakaznacheev/cleanenv v1.5.0 github.com/ilyakaznacheev/cleanenv v1.5.0
github.com/mittwald/go-helm-client v0.12.9 github.com/mittwald/go-helm-client v0.12.9
github.com/sirupsen/logrus v1.9.3
golang.org/x/crypto v0.22.0 golang.org/x/crypto v0.22.0
helm.sh/helm/v3 v3.14.2
k8s.io/api v0.30.0 k8s.io/api v0.30.0
k8s.io/apimachinery v0.30.0 k8s.io/apimachinery v0.30.0
k8s.io/client-go v0.30.0 k8s.io/client-go v0.30.0
@@ -113,7 +115,6 @@ require (
github.com/rubenv/sql-migrate v1.6.0 // indirect github.com/rubenv/sql-migrate v1.6.0 // indirect
github.com/russross/blackfriday/v2 v2.1.0 // indirect github.com/russross/blackfriday/v2 v2.1.0 // indirect
github.com/shopspring/decimal v1.3.1 // indirect github.com/shopspring/decimal v1.3.1 // indirect
github.com/sirupsen/logrus v1.9.3 // indirect
github.com/spf13/cast v1.6.0 // indirect github.com/spf13/cast v1.6.0 // indirect
github.com/spf13/cobra v1.8.0 // indirect github.com/spf13/cobra v1.8.0 // indirect
github.com/spf13/pflag v1.0.5 // indirect github.com/spf13/pflag v1.0.5 // indirect
@@ -144,7 +145,6 @@ require (
gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect
helm.sh/helm/v3 v3.14.2 // indirect
k8s.io/apiextensions-apiserver v0.29.0 // indirect k8s.io/apiextensions-apiserver v0.29.0 // indirect
k8s.io/apiserver v0.29.0 // indirect k8s.io/apiserver v0.29.0 // indirect
k8s.io/cli-runtime v0.29.0 // indirect k8s.io/cli-runtime v0.29.0 // indirect

79
internal/additional/helm.go Normal file
View File

@@ -0,0 +1,79 @@
package additional
import (
"kube-forge/internal/config"
"kube-forge/internal/helm_client"
"kube-forge/internal/templates"
"time"
go_helm_client "github.com/mittwald/go-helm-client"
)
var HELM_REPOS = []config.RepoSettings{
{
Name: "kube-forge",
URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
},
}
func getCertManagerSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "cert-manager",
ChartName: appConfig.Modules.Additional.CertManager.ChartRef,
Version: appConfig.Modules.Additional.CertManager.ChartVersion,
Namespace: appConfig.Modules.Additional.CertManager.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl"),
}
}
func getIngressNginxSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "ingress-nginx",
ChartName: appConfig.Modules.Additional.Ingress.ChartRef,
Version: appConfig.Modules.Additional.Ingress.ChartVersion,
Namespace: appConfig.Modules.Additional.Ingress.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/ingress-nginx.yml.tmpl"),
}
}
func getDockerSecretsGeneratorSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "docker-secrets-generator",
ChartName: appConfig.Modules.Additional.DockerSecrets.ChartRef,
Version: appConfig.Modules.Additional.DockerSecrets.ChartVersion,
Namespace: appConfig.Modules.Additional.DockerSecrets.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/docker-secrets-generator.yml.tmpl"),
}
}
func ApplyCharts() {
appConfig := config.GetConfig()
helm_client.AddHelmRepos("kube-system", HELM_REPOS)
if appConfig.Modules.Additional.CertManager.Enabled {
helm_client.InstallChart(getCertManagerSpec())
} else {
helm_client.DeleteChart(getCertManagerSpec())
}
if appConfig.Modules.Additional.Ingress.Enabled && appConfig.Modules.Additional.Ingress.Type == "nginx" {
helm_client.InstallChart(getIngressNginxSpec())
} else {
helm_client.DeleteChart(getIngressNginxSpec())
}
if appConfig.Modules.Additional.DockerSecrets.Repositories != nil {
helm_client.InstallChart(getDockerSecretsGeneratorSpec())
} else {
helm_client.DeleteChart(getDockerSecretsGeneratorSpec())
}
}

108
internal/cicd/helm.go Normal file
View File

@@ -0,0 +1,108 @@
package cicd
import (
"kube-forge/internal/config"
"kube-forge/internal/helm_client"
"kube-forge/internal/templates"
"time"
go_helm_client "github.com/mittwald/go-helm-client"
)
var HELM_REPOS = [...]config.RepoSettings{
{
Name: "kube-forge",
URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
},
}
func getArgoCdSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "argo-cd",
ChartName: appConfig.Modules.Cicd.ArgoCd.ChartRef,
Version: appConfig.Modules.Cicd.ArgoCd.ChartVersion,
Namespace: appConfig.Modules.Cicd.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/argo-cd.yml.tmpl"),
}
}
func getArgoRolloutsSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "argo-rollouts",
ChartName: appConfig.Modules.Cicd.Rollouts.ChartRef,
Version: appConfig.Modules.Cicd.Rollouts.ChartVersion,
Namespace: appConfig.Modules.Cicd.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl"),
}
}
func getKeelSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "keel",
ChartName: appConfig.Modules.Cicd.UpdatesOperator.ChartRef,
Version: appConfig.Modules.Cicd.UpdatesOperator.ChartVersion,
Namespace: appConfig.Modules.Cicd.UpdatesOperator.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/keel.yml.tmpl"),
}
}
func getArgoCdIngressSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "argo-cd-ingress",
ChartName: appConfig.Modules.Cicd.ArgoCd.ServiceIngress.ChartRef,
Version: appConfig.Modules.Cicd.ArgoCd.ServiceIngress.ChartVersion,
Namespace: appConfig.Modules.Cicd.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl"),
}
}
func addCicdHelmRepos() {
appConfig := config.GetConfig()
for _, repoSettings := range HELM_REPOS {
helm_client.AddHelmRepo(appConfig.Modules.SecretsStorage.Namespace, repoSettings)
}
}
func ApplyCharts() {
addCicdHelmRepos()
appConfig := config.GetConfig()
if appConfig.Modules.Cicd.Enabled {
helm_client.InstallChart(getArgoCdSpec())
if appConfig.Modules.Cicd.ArgoCd.Expose.Type == "ingress" {
helm_client.InstallChart(getArgoCdIngressSpec())
} else {
helm_client.DeleteChart(getArgoCdIngressSpec())
}
if appConfig.Modules.Cicd.Rollouts.Enabled {
helm_client.InstallChart(getArgoRolloutsSpec())
} else {
helm_client.DeleteChart(getArgoRolloutsSpec())
}
if appConfig.Modules.Cicd.UpdatesOperator.Enabled {
helm_client.InstallChart(getKeelSpec())
} else {
helm_client.DeleteChart(getKeelSpec())
}
} else {
helm_client.DeleteChart(getArgoCdIngressSpec())
helm_client.DeleteChart(getArgoCdSpec())
helm_client.DeleteChart(getArgoRolloutsSpec())
helm_client.DeleteChart(getKeelSpec())
}
}

3
internal/config/config.go
View File

@@ -38,9 +38,6 @@ type Config struct {
Cicd Cicd `yaml:"cicd"` Cicd Cicd `yaml:"cicd"`
SecretsStorage SecretsStorage `yaml:"secrets_storage"` SecretsStorage SecretsStorage `yaml:"secrets_storage"`
} `yaml:"modules"` } `yaml:"modules"`
Repositories string
Releases string
} }
var instance *Config var instance *Config

26
internal/config/helm.go
View File

@@ -5,13 +5,30 @@ import (
"log" "log"
"os" "os"
"path/filepath" "path/filepath"
"time"
helm_client "github.com/mittwald/go-helm-client" helm_client "github.com/mittwald/go-helm-client"
) )
var client *helm_client.Client type RepoSettings struct {
Name string
URL string
Username string
Password string
}
func CreateHelmClient() helm_client.Client { type ChartSettings struct {
ReleaseName string
ChartRef string
ChartVersion string
Namespace string
CreateNamespace bool
Atomic bool
Timeout time.Duration
ValuesYaml string
}
func GetHelmClient(namespace string) helm_client.Client {
config := GetConfig() config := GetConfig()
file, err := os.Open(filepath.Join(config.WorkDir, config.KubeconfigFile)) file, err := os.Open(filepath.Join(config.WorkDir, config.KubeconfigFile))
if err != nil { if err != nil {
@@ -24,7 +41,7 @@ func CreateHelmClient() helm_client.Client {
} }
opts := &helm_client.KubeConfClientOptions{ opts := &helm_client.KubeConfClientOptions{
Options: &helm_client.Options{ Options: &helm_client.Options{
Namespace: "default", // Change this to the namespace you wish to install the chart in. Namespace: namespace,
RepositoryCache: "/tmp/.helmcache", RepositoryCache: "/tmp/.helmcache",
RepositoryConfig: "/tmp/.helmrepo", RepositoryConfig: "/tmp/.helmrepo",
Debug: true, Debug: true,
@@ -40,9 +57,6 @@ func CreateHelmClient() helm_client.Client {
if err != nil { if err != nil {
log.Fatalf("error while creating helm client: %s", err) log.Fatalf("error while creating helm client: %s", err)
} }
return client
}
func GetHelmClient() *helm_client.Client {
return client return client
} }

5
internal/config/modules_additional.go
View File

@@ -5,6 +5,7 @@ type Additional struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/cert-manager"` ChartRef string `yaml:"chart_ref" env-default:"kube-forge/cert-manager"`
ChartVersion string `yaml:"chart_version" env-default:"v1.14.5"` ChartVersion string `yaml:"chart_version" env-default:"v1.14.5"`
Enabled bool `yaml:"enabled"` Enabled bool `yaml:"enabled"`
Namespace string `yaml:"namespace" env-default:"cert-manager"`
HaEnabled bool `yaml:"ha_enabled"` HaEnabled bool `yaml:"ha_enabled"`
DnsServers []string `yaml:"dns_servers" env-default:"8.8.8.8,1.1.1.1"` DnsServers []string `yaml:"dns_servers" env-default:"8.8.8.8,1.1.1.1"`
AccountEmail string `yaml:"account_email"` AccountEmail string `yaml:"account_email"`
@@ -19,6 +20,7 @@ type Additional struct {
ChartVersion string `yaml:"chart_version" env-default:"4.10.1"` ChartVersion string `yaml:"chart_version" env-default:"4.10.1"`
Type string `yaml:"type" env-default:"nginx"` Type string `yaml:"type" env-default:"nginx"`
Enabled bool `yaml:"enabled"` Enabled bool `yaml:"enabled"`
Namespace string `yaml:"namespace" env-default:"ingress-nginx"`
IngressClassName string `yaml:"ingress_class_name" env-default:"nginx"` IngressClassName string `yaml:"ingress_class_name" env-default:"nginx"`
HostNetwork bool `yaml:"host_network"` HostNetwork bool `yaml:"host_network"`
EnableAdmissionWebhooks bool `yaml:"enable_admission_webhooks"` EnableAdmissionWebhooks bool `yaml:"enable_admission_webhooks"`
@@ -42,6 +44,7 @@ type Additional struct {
DockerSecrets struct { DockerSecrets struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/docker-secrets-generator"` ChartRef string `yaml:"chart_ref" env-default:"kube-forge/docker-secrets-generator"`
ChartVersion string `yaml:"chart_version" env-default:"0.1.0"` ChartVersion string `yaml:"chart_version" env-default:"0.1.0"`
Namespace string `yaml:"namespace" env-default:"kube-system"`
Repositories interface{} `yaml:"repositories"` Repositories interface{} `yaml:"repositories"`
} `yaml:"docker_secrets"` } `yaml:"docker_secrets"`
@@ -54,11 +57,13 @@ type Additional struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/longhorn"` ChartRef string `yaml:"chart_ref" env-default:"kube-forge/longhorn"`
ChartVersion string `yaml:"chart_version" env-default:"1.6.1"` ChartVersion string `yaml:"chart_version" env-default:"1.6.1"`
Enabled bool `yaml:"enabled"` Enabled bool `yaml:"enabled"`
Namespace string `yaml:"namespace" env-default:"longhorn-system"`
} `yaml:"longhorn"` } `yaml:"longhorn"`
SecretsStoreCsiDriver struct { SecretsStoreCsiDriver struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/secrets-store-csi-driver"` ChartRef string `yaml:"chart_ref" env-default:"kube-forge/secrets-store-csi-driver"`
ChartVersion string `yaml:"chart_version" env-default:"1.4.3"` ChartVersion string `yaml:"chart_version" env-default:"1.4.3"`
Enabled bool `yaml:"enabled"` Enabled bool `yaml:"enabled"`
Namespace string `yaml:"namespace" env-default:"kube-system"`
} `yaml:"secrets_store_csi_driver"` } `yaml:"secrets_store_csi_driver"`
} `yaml:"storage"` } `yaml:"storage"`
} }

2
internal/config/modules_cicd.go
View File

@@ -2,6 +2,7 @@ package config
type Cicd struct { type Cicd struct {
Enabled bool `yaml:"enabled"` Enabled bool `yaml:"enabled"`
Namespace string `yaml:"namespace" env-default:"cicd"`
ArgoCd struct { ArgoCd struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/argo-cd"` ChartRef string `yaml:"chart_ref" env-default:"kube-forge/argo-cd"`
ChartVersion string `yaml:"chart_version" env-default:"6.7.10"` ChartVersion string `yaml:"chart_version" env-default:"6.7.10"`
@@ -69,6 +70,7 @@ type Cicd struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/keel"` ChartRef string `yaml:"chart_ref" env-default:"kube-forge/keel"`
ChartVersion string `yaml:"chart_version" env-default:"1.0.3"` ChartVersion string `yaml:"chart_version" env-default:"1.0.3"`
Enabled bool `yaml:"enabled"` Enabled bool `yaml:"enabled"`
Namespace string `yaml:"namespace" env-default:"kube-system"`
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/keelhq/keel"` Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/keelhq/keel"`
Tag string `yaml:"tag" env-default:"latest"` Tag string `yaml:"tag" env-default:"latest"`
} `yaml:"updates_operator"` } `yaml:"updates_operator"`

6
internal/config/modules_observability.go
View File

@@ -8,6 +8,7 @@ type Observability struct {
Tracing Tracing `yaml:"tracing"` Tracing Tracing `yaml:"tracing"`
Monitoring Monitoring `yaml:"monitoring"` Monitoring Monitoring `yaml:"monitoring"`
Visualization Visualization `yaml:"visualization"` Visualization Visualization `yaml:"visualization"`
Namespace string `yaml:"namespace" env-default:"observability"`
} }
type Logging struct { type Logging struct {
@@ -17,6 +18,7 @@ type Logging struct {
ChartVersion string `yaml:"chart_version" env-default:"2.7.0"` ChartVersion string `yaml:"chart_version" env-default:"2.7.0"`
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/kubesphere/fluent-operator"` Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/kubesphere/fluent-operator"`
Tag string `yaml:"tag" env-default:"v2.7.0"` Tag string `yaml:"tag" env-default:"v2.7.0"`
Namespace string `yaml:"namespace" env-default:"observability"`
InitContainer struct { InitContainer struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/docker"` Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/docker"`
Tag string `yaml:"tag" env-default:"20.10"` Tag string `yaml:"tag" env-default:"20.10"`
@@ -36,6 +38,7 @@ type Logging struct {
Registry string `yaml:"registry" env-default:"harbor.kvazaric.ru"` Registry string `yaml:"registry" env-default:"harbor.kvazaric.ru"`
Image string `yaml:"image" env-default:"kube-forge/grafana/loki"` Image string `yaml:"image" env-default:"kube-forge/grafana/loki"`
Tag string `yaml:"tag" env-default:"latest"` Tag string `yaml:"tag" env-default:"latest"`
Namespace string `yaml:"namespace" env-default:"observability"`
Persistence struct { Persistence struct {
StorageClass string `yaml:"storage_class" env-default:"local-path"` StorageClass string `yaml:"storage_class" env-default:"local-path"`
StorageSize string `yaml:"storage_size" env-default:"10Gi"` StorageSize string `yaml:"storage_size" env-default:"10Gi"`
@@ -65,6 +68,7 @@ type Tracing struct {
ChartVersion string `yaml:"chart_version" env-default:"0.55.0"` ChartVersion string `yaml:"chart_version" env-default:"0.55.0"`
Image string `yaml:"image" env-default:"ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator"` Image string `yaml:"image" env-default:"ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator"`
Tag string `yaml:"tag" env-default:""` Tag string `yaml:"tag" env-default:""`
Namespace string `yaml:"namespace" env-default:"observability"`
} `yaml:"operator"` } `yaml:"operator"`
Collector struct { Collector struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/otel/opentelemetry-collector-contrib"` Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/otel/opentelemetry-collector-contrib"`
@@ -75,6 +79,7 @@ type Tracing struct {
ChartVersion string `yaml:"chart_version" env-default:"1.7.2"` ChartVersion string `yaml:"chart_version" env-default:"1.7.2"`
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/grafana/tempo"` Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/grafana/tempo"`
Tag string `yaml:"tag" env-default:"2.3.1"` Tag string `yaml:"tag" env-default:"2.3.1"`
Namespace string `yaml:"namespace" env-default:"observability"`
Retention string `yaml:"retention" env-default:"24h"` Retention string `yaml:"retention" env-default:"24h"`
ListenPort int `yaml:"listen_port" env-default:"3100"` ListenPort int `yaml:"listen_port" env-default:"3100"`
Persistence struct { Persistence struct {
@@ -142,6 +147,7 @@ type Monitoring struct {
ChartVersion string `yaml:"chart_version" env-default:"3.12.1"` ChartVersion string `yaml:"chart_version" env-default:"3.12.1"`
Image string `yaml:"image" env-default:"registry.k8s.io/metrics-server/metrics-server"` Image string `yaml:"image" env-default:"registry.k8s.io/metrics-server/metrics-server"`
Tag string `yaml:"tag" env-default:""` Tag string `yaml:"tag" env-default:""`
Namespace string `yaml:"namespace" env-default:"kube-system"`
} }
} }

1
internal/config/modules_secrets_storage.go
View File

@@ -3,6 +3,7 @@ package config
type SecretsStorage struct { type SecretsStorage struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/vault"` ChartRef string `yaml:"chart_ref" env-default:"kube-forge/vault"`
ChartVersion string `yaml:"chart_version" env-default:"0.1.0"` ChartVersion string `yaml:"chart_version" env-default:"0.1.0"`
Namespace string `yaml:"namespace" env-default:"secrets-storage"`
Enabled bool `yaml:"enabled"` Enabled bool `yaml:"enabled"`
KeyShares int `yaml:"key_shares" env-default:"5"` KeyShares int `yaml:"key_shares" env-default:"5"`
KeyThreshold int `yaml:"key_threshold" env-default:"3"` KeyThreshold int `yaml:"key_threshold" env-default:"3"`

60
internal/csi/helm.go Normal file
View File

@@ -0,0 +1,60 @@
package csi
import (
"kube-forge/internal/config"
"kube-forge/internal/helm_client"
"kube-forge/internal/templates"
"time"
go_helm_client "github.com/mittwald/go-helm-client"
)
var HELM_REPOS = []config.RepoSettings{
{
Name: "kube-forge",
URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
},
}
func getLonghornSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "longhorn",
ChartName: appConfig.Modules.Additional.Storage.Longhorn.ChartRef,
Version: appConfig.Modules.Additional.Storage.Longhorn.ChartVersion,
Namespace: appConfig.Modules.Additional.Storage.Longhorn.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/longhorn.yml.tmpl"),
}
}
func getSecretsStoreSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "csi-secrets-store",
ChartName: appConfig.Modules.Additional.Storage.SecretsStoreCsiDriver.ChartRef,
Version: appConfig.Modules.Additional.Storage.SecretsStoreCsiDriver.ChartVersion,
Namespace: appConfig.Modules.Additional.Storage.SecretsStoreCsiDriver.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 60,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl"),
}
}
func ApplyCharts() {
appConfig := config.GetConfig()
helm_client.AddHelmRepos("kube-system", HELM_REPOS)
if appConfig.Modules.Additional.Storage.Longhorn.Enabled {
helm_client.InstallChart(getLonghornSpec())
} else {
helm_client.DeleteChart(getLonghornSpec())
}
if appConfig.Modules.Additional.Storage.SecretsStoreCsiDriver.Enabled {
helm_client.InstallChart(getSecretsStoreSpec())
} else {
helm_client.DeleteChart(getSecretsStoreSpec())
}
}

32
internal/helm_client/chart.go Normal file
View File

@@ -0,0 +1,32 @@
package helm_client
import (
"context"
"kube-forge/internal/config"
"kube-forge/internal/logging"
go_helm_client "github.com/mittwald/go-helm-client"
)
func InstallChart(chartSpec go_helm_client.ChartSpec) {
helmClient := config.GetHelmClient(chartSpec.Namespace)
_, error := helmClient.GetRelease(chartSpec.ReleaseName)
if error != nil {
logging.Log.Infof("Installing %s", chartSpec.ChartName)
} else {
logging.Log.Infof("Upgrading %s", chartSpec.ChartName)
}
if _, err := helmClient.InstallOrUpgradeChart(context.Background(), &chartSpec, nil); err != nil {
panic(err)
}
}
func DeleteChart(chartSpec go_helm_client.ChartSpec) {
helmClient := config.GetHelmClient(chartSpec.Namespace)
_, error := helmClient.GetRelease(chartSpec.ReleaseName)
if error != nil {
return
}
logging.Log.Warnf("Uninstalling %s", chartSpec.ChartName)
helmClient.UninstallRelease(&chartSpec)
}

27
internal/helm_client/repo.go Normal file
View File

@@ -0,0 +1,27 @@
package helm_client
import (
"kube-forge/internal/config"
"helm.sh/helm/v3/pkg/repo"
)
func AddHelmRepo(namespace string, repoSettings config.RepoSettings) {
helmClient := config.GetHelmClient(namespace)
chartRepo := repo.Entry{
Name: repoSettings.Name,
URL: repoSettings.URL,
Username: repoSettings.Username,
Password: repoSettings.Password,
}
if err := helmClient.AddOrUpdateChartRepo(chartRepo); err != nil {
panic(err)
}
}
func AddHelmRepos(namespace string, helmRepos []config.RepoSettings) {
for _, repoSettings := range helmRepos {
AddHelmRepo(namespace, repoSettings)
}
}

11
internal/kubespray/cluster.go
View File

@@ -1,22 +1,13 @@
package kubespray package kubespray
import ( import (
"fmt"
"kube-forge/internal/config" "kube-forge/internal/config"
"kube-forge/internal/secrets_storage"
) )
func InstallCluster(tags string) { func InstallCluster(tags string) {
appConfig := config.GetConfig() appConfig := config.GetConfig()
runPlaybook("kubespray/project/cluster.yml", tags) runPlaybook("kubespray/project/cluster.yml", tags)
CopyK8SAdminConfig(appConfig.KubeconfigFile) CopyK8SAdminConfig(appConfig.KubeconfigFile)
config.CreateHelmClient()
if appConfig.Modules.SecretsStorage.Enabled {
fmt.Println("## Additional Vault Configuration")
secrets_storage.InitVault()
secrets_storage.UnsealVault()
secrets_storage.AddKubernetesLocalIntegration()
}
} }
func UpgradeCluster(tags string) { func UpgradeCluster(tags string) {
@@ -26,7 +17,7 @@ func UpgradeCluster(tags string) {
} }
func ScaleCluster() { func ScaleCluster() {
runPlaybook("kubespray/project/scale.yml", "")
appConfig := config.GetConfig() appConfig := config.GetConfig()
runPlaybook("kubespray/project/scale.yml", "")
CopyK8SAdminConfig(appConfig.KubeconfigFile) CopyK8SAdminConfig(appConfig.KubeconfigFile)
} }

12
internal/logging/log.go Normal file
View File

@@ -0,0 +1,12 @@
package logging
import (
"github.com/sirupsen/logrus"
)
var Log = logrus.New()
func init() {
Log.SetLevel(logrus.InfoLevel)
Log.SetFormatter(&logrus.TextFormatter{})
}

122
internal/observability/helm.go Normal file
View File

@@ -0,0 +1,122 @@
package observability
import (
"kube-forge/internal/config"
"kube-forge/internal/helm_client"
"kube-forge/internal/templates"
"time"
go_helm_client "github.com/mittwald/go-helm-client"
)
var HELM_REPOS = []config.RepoSettings{
{
Name: "kube-forge",
URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
},
}
func getFluentOperatorSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "fluent-operator",
ChartName: appConfig.Modules.Observability.Logging.Operator.ChartRef,
Version: appConfig.Modules.Observability.Logging.Operator.ChartVersion,
Namespace: appConfig.Modules.Observability.Logging.Operator.Namespace,
CreateNamespace: true,
Atomic: true,
UpgradeCRDs: true,
Timeout: time.Second * 60,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/fluent-operator.yml.tmpl"),
}
}
func getOpenTelemetryOperatorSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "opentelemetry-operator",
ChartName: appConfig.Modules.Observability.Tracing.Operator.ChartRef,
Version: appConfig.Modules.Observability.Tracing.Operator.ChartVersion,
Namespace: appConfig.Modules.Observability.Tracing.Operator.Namespace,
CreateNamespace: true,
Atomic: true,
UpgradeCRDs: true,
Timeout: time.Second * 60,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl"),
}
}
func getMetricsServerSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "metrics-server",
ChartName: appConfig.Modules.Observability.Monitoring.MetricsServer.ChartRef,
Version: appConfig.Modules.Observability.Monitoring.MetricsServer.ChartVersion,
Namespace: appConfig.Modules.Observability.Monitoring.MetricsServer.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 60,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/metrics-server.yml.tmpl"),
}
}
func getTempoSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "tempo",
ChartName: appConfig.Modules.Observability.Tracing.Tempo.ChartRef,
Version: appConfig.Modules.Observability.Tracing.Tempo.ChartVersion,
Namespace: appConfig.Modules.Observability.Tracing.Tempo.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 60,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/tempo.yml.tmpl"),
}
}
func getLokiSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "loki",
ChartName: appConfig.Modules.Observability.Logging.Loki.ChartRef,
Version: appConfig.Modules.Observability.Logging.Loki.ChartVersion,
Namespace: appConfig.Modules.Observability.Logging.Loki.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 60,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/loki.yml.tmpl"),
}
}
func getObservabilitySpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "observability",
ChartName: appConfig.Modules.Observability.ChartRef,
Version: appConfig.Modules.Observability.ChartVersion,
Namespace: appConfig.Modules.Observability.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/observability.yml.tmpl"),
}
}
func ApplyCharts() {
appConfig := config.GetConfig()
helm_client.AddHelmRepos(appConfig.Modules.Registry.Namespace, HELM_REPOS)
if appConfig.Modules.Observability.Enabled {
if appConfig.Modules.Observability.Logging.Enabled {
helm_client.InstallChart(getFluentOperatorSpec())
helm_client.InstallChart(getLokiSpec())
}
if appConfig.Modules.Observability.Tracing.Enabled {
helm_client.InstallChart(getOpenTelemetryOperatorSpec())
helm_client.InstallChart(getTempoSpec())
}
if appConfig.Modules.Observability.Monitoring.Enabled {
helm_client.InstallChart(getMetricsServerSpec())
}
helm_client.InstallChart(getObservabilitySpec())
}
}

5
internal/registry/charts.go
View File

@@ -1,5 +0,0 @@
package registry
func InstallRegistryCharts() {
}

9
internal/registry/commands.go
View File

@@ -1,9 +0,0 @@
package registry
func CreateDockerRepositories() {
}
func CreateHelmRepositories() {
}

0
internal/registry/errors.go
View File

61
internal/registry/helm.go Normal file
View File

@@ -0,0 +1,61 @@
package registry
import (
"kube-forge/internal/config"
"kube-forge/internal/helm_client"
"kube-forge/internal/templates"
"time"
go_helm_client "github.com/mittwald/go-helm-client"
)
var HELM_REPOS = []config.RepoSettings{
{
Name: "kube-forge",
URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
},
}
func getHarborCertificateGeneratorSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "harbor-certificate-generator",
ChartName: appConfig.Modules.Registry.Tls.CertificateGenerator.ChartRef,
Version: appConfig.Modules.Registry.Tls.CertificateGenerator.ChartVersion,
Namespace: appConfig.Modules.Registry.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 60,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl"),
}
}
func getHarborSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "harbor",
ChartName: appConfig.Modules.Registry.ChartRef,
Version: appConfig.Modules.Registry.ChartVersion,
Namespace: appConfig.Modules.Registry.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/registry/harbor.yml.tmpl"),
}
}
func ApplyCharts() {
appConfig := config.GetConfig()
helm_client.AddHelmRepos(appConfig.Modules.Registry.Namespace, HELM_REPOS)
if appConfig.Modules.Registry.Enabled {
if appConfig.Modules.Registry.Expose.Type == "ingress" {
helm_client.InstallChart(getHarborCertificateGeneratorSpec())
} else {
helm_client.DeleteChart(getHarborCertificateGeneratorSpec())
}
helm_client.InstallChart(getHarborSpec())
} else {
helm_client.DeleteChart(getHarborSpec())
helm_client.DeleteChart(getHarborCertificateGeneratorSpec())
}
}

473
internal/resources/templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl
View File

@@ -1,15 +1,4 @@
- name: cert-manager global:
namespace: cert-manager
create_namespace: true
chart_ref: {{ .Modules.Additional.CertManager.ChartRef }}
chart_version: {{ .Modules.Additional.CertManager.ChartVersion }}
{{- if .Modules.Additional.CertManager.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
global:
imagePullSecrets: [] imagePullSecrets: []
commonLabels: {} commonLabels: {}
@@ -50,28 +39,28 @@
# renewal of a leadership. # renewal of a leadership.
# retryPeriod: 15s # retryPeriod: 15s
installCRDs: true installCRDs: true
# Number of replicas of the cert-manager controller to run. # Number of replicas of the cert-manager controller to run.
# #
# The default is 1, but in production you should set this to 2 or 3 to provide high # The default is 1, but in production you should set this to 2 or 3 to provide high
# availability. # availability.
# #
# If `replicas > 1` you should also consider setting `podDisruptionBudget.enabled=true`. # If `replicas > 1` you should also consider setting `podDisruptionBudget.enabled=true`.
# #
# Note: cert-manager uses leader election to ensure that there can # Note: cert-manager uses leader election to ensure that there can
# only be a single instance active at a time. # only be a single instance active at a time.
{{- if .Modules.Additional.CertManager.HaEnabled }} {{- if .Modules.Additional.CertManager.HaEnabled }}
replicaCount: 3 replicaCount: 3
{{- else }} {{- else }}
replicaCount: 1 replicaCount: 1
{{- end }} {{- end }}
# Deployment update strategy for the cert-manager controller deployment. # Deployment update strategy for the cert-manager controller deployment.
# See https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy # See https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
strategy: {} strategy: {}
podDisruptionBudget: podDisruptionBudget:
# Enable or disable the PodDisruptionBudget resource # Enable or disable the PodDisruptionBudget resource
# #
# This prevents downtime during voluntary disruptions such as during a Node upgrade. # This prevents downtime during voluntary disruptions such as during a Node upgrade.
@@ -92,14 +81,14 @@
# +docs:property # +docs:property
# maxUnavailable: 1 # maxUnavailable: 1
# Comma separated list of feature gates that should be enabled on the # Comma separated list of feature gates that should be enabled on the
# controller pod. # controller pod.
featureGates: "" featureGates: ""
# The maximum number of challenges that can be scheduled as 'processing' at once # The maximum number of challenges that can be scheduled as 'processing' at once
maxConcurrentChallenges: 60 maxConcurrentChallenges: 60
image: image:
# The container registry to pull the manager image from # The container registry to pull the manager image from
# +docs:property # +docs:property
# registry: quay.io # registry: quay.io
@@ -120,17 +109,17 @@
# Kubernetes imagePullPolicy on Deployment. # Kubernetes imagePullPolicy on Deployment.
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
# Override the namespace used to store DNS provider credentials etc. for ClusterIssuer # Override the namespace used to store DNS provider credentials etc. for ClusterIssuer
# resources. By default, the same namespace as cert-manager is deployed within is # resources. By default, the same namespace as cert-manager is deployed within is
# used. This namespace will not be automatically created by the Helm chart. # used. This namespace will not be automatically created by the Helm chart.
clusterResourceNamespace: "" clusterResourceNamespace: ""
# This namespace allows you to define where the services will be installed into # This namespace allows you to define where the services will be installed into
# if not set then they will use the namespace of the release # if not set then they will use the namespace of the release
# This is helpful when installing cert manager as a chart dependency (sub chart) # This is helpful when installing cert manager as a chart dependency (sub chart)
namespace: "" namespace: ""
serviceAccount: serviceAccount:
# Specifies whether a service account should be created # Specifies whether a service account should be created
create: true create: true
@@ -150,162 +139,162 @@
# Automount API credentials for a Service Account. # Automount API credentials for a Service Account.
automountServiceAccountToken: true automountServiceAccountToken: true
# Automounting API credentials for a particular pod # Automounting API credentials for a particular pod
# +docs:property # +docs:property
# automountServiceAccountToken: true # automountServiceAccountToken: true
# When this flag is enabled, secrets will be automatically removed when the certificate resource is deleted # When this flag is enabled, secrets will be automatically removed when the certificate resource is deleted
enableCertificateOwnerRef: false enableCertificateOwnerRef: false
# Used to configure options for the controller pod. # Used to configure options for the controller pod.
# This allows setting options that'd usually be provided via flags. # This allows setting options that'd usually be provided via flags.
# An APIVersion and Kind must be specified in your values.yaml file. # An APIVersion and Kind must be specified in your values.yaml file.
# Flags will override options that are set here. # Flags will override options that are set here.
# #
# For example: # For example:
# config: # config:
# apiVersion: controller.config.cert-manager.io/v1alpha1 # apiVersion: controller.config.cert-manager.io/v1alpha1
# kind: ControllerConfiguration # kind: ControllerConfiguration
# logging: # logging:
# verbosity: 2 # verbosity: 2
# format: text # format: text
# leaderElectionConfig: # leaderElectionConfig:
# namespace: kube-system # namespace: kube-system
# kubernetesAPIQPS: 9000 # kubernetesAPIQPS: 9000
# kubernetesAPIBurst: 9000 # kubernetesAPIBurst: 9000
# numberOfConcurrentWorkers: 200 # numberOfConcurrentWorkers: 200
# featureGates: # featureGates:
# AdditionalCertificateOutputFormats: true # AdditionalCertificateOutputFormats: true
# DisallowInsecureCSRUsageDefinition: true # DisallowInsecureCSRUsageDefinition: true
# ExperimentalCertificateSigningRequestControllers: true # ExperimentalCertificateSigningRequestControllers: true
# ExperimentalGatewayAPISupport: true # ExperimentalGatewayAPISupport: true
# LiteralCertificateSubject: true # LiteralCertificateSubject: true
# SecretsFilteredCaching: true # SecretsFilteredCaching: true
# ServerSideApply: true # ServerSideApply: true
# StableCertificateRequestName: true # StableCertificateRequestName: true
# UseCertificateRequestBasicConstraints: true # UseCertificateRequestBasicConstraints: true
# ValidateCAA: true # ValidateCAA: true
# metricsTLSConfig: # metricsTLSConfig:
# dynamic: # dynamic:
# secretNamespace: "cert-manager" # secretNamespace: "cert-manager"
# secretName: "cert-manager-metrics-ca" # secretName: "cert-manager-metrics-ca"
# dnsNames: # dnsNames:
# - cert-manager-metrics # - cert-manager-metrics
# - cert-manager-metrics.cert-manager # - cert-manager-metrics.cert-manager
# - cert-manager-metrics.cert-manager.svc # - cert-manager-metrics.cert-manager.svc
config: {} config: {}
# Setting Nameservers for DNS01 Self Check # Setting Nameservers for DNS01 Self Check
# See: https://cert-manager.io/docs/configuration/acme/dns01/#setting-nameservers-for-dns01-self-check # See: https://cert-manager.io/docs/configuration/acme/dns01/#setting-nameservers-for-dns01-self-check
# Comma separated string with host and port of the recursive nameservers cert-manager should query # Comma separated string with host and port of the recursive nameservers cert-manager should query
dns01RecursiveNameservers: "" dns01RecursiveNameservers: ""
# Forces cert-manager to only use the recursive nameservers for verification. # Forces cert-manager to only use the recursive nameservers for verification.
# Enabling this option could cause the DNS01 self check to take longer due to caching performed by the recursive nameservers # Enabling this option could cause the DNS01 self check to take longer due to caching performed by the recursive nameservers
dns01RecursiveNameserversOnly: false dns01RecursiveNameserversOnly: false
# Additional command line flags to pass to cert-manager controller binary. # Additional command line flags to pass to cert-manager controller binary.
# To see all available flags run docker run quay.io/jetstack/cert-manager-controller:<version> --help # To see all available flags run docker run quay.io/jetstack/cert-manager-controller:<version> --help
# #
# Use this flag to enable or disable arbitrary controllers, for example, disable the CertificiateRequests approver # Use this flag to enable or disable arbitrary controllers, for example, disable the CertificiateRequests approver
# #
# For example: # For example:
# extraArgs: # extraArgs:
# - --controllers=*,-certificaterequests-approver # - --controllers=*,-certificaterequests-approver
extraArgs: [] extraArgs: []
# Additional environment variables to pass to cert-manager controller binary. # Additional environment variables to pass to cert-manager controller binary.
extraEnv: [] extraEnv: []
# - name: SOME_VAR # - name: SOME_VAR
# value: 'some value' # value: 'some value'
# Resources to provide to the cert-manager controller pod # Resources to provide to the cert-manager controller pod
# #
# For example: # For example:
# requests: # requests:
# cpu: 10m # cpu: 10m
# memory: 32Mi # memory: 32Mi
# #
# ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ # ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources: {} resources: {}
# Pod Security Context # Pod Security Context
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
# +docs:property # +docs:property
securityContext: securityContext:
runAsNonRoot: true runAsNonRoot: true
seccompProfile: seccompProfile:
type: RuntimeDefault type: RuntimeDefault
# Container Security Context to be set on the controller component container # Container Security Context to be set on the controller component container
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
# +docs:property # +docs:property
containerSecurityContext: containerSecurityContext:
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
capabilities: capabilities:
drop: drop:
- ALL - ALL
readOnlyRootFilesystem: true readOnlyRootFilesystem: true
# Additional volumes to add to the cert-manager controller pod. # Additional volumes to add to the cert-manager controller pod.
volumes: [] volumes: []
# Additional volume mounts to add to the cert-manager controller container. # Additional volume mounts to add to the cert-manager controller container.
volumeMounts: [] volumeMounts: []
# Optional additional annotations to add to the controller Deployment # Optional additional annotations to add to the controller Deployment
# +docs:property # +docs:property
# deploymentAnnotations: {} # deploymentAnnotations: {}
# Optional additional annotations to add to the controller Pods # Optional additional annotations to add to the controller Pods
# +docs:property # +docs:property
# podAnnotations: {} # podAnnotations: {}
# Optional additional labels to add to the controller Pods # Optional additional labels to add to the controller Pods
podLabels: {} podLabels: {}
# Optional annotations to add to the controller Service # Optional annotations to add to the controller Service
# +docs:property # +docs:property
# serviceAnnotations: {} # serviceAnnotations: {}
# Optional additional labels to add to the controller Service # Optional additional labels to add to the controller Service
# +docs:property # +docs:property
# serviceLabels: {} # serviceLabels: {}
# Optional DNS settings, useful if you have a public and private DNS zone for # Optional DNS settings, useful if you have a public and private DNS zone for
# the same domain on Route 53. What follows is an example of ensuring # the same domain on Route 53. What follows is an example of ensuring
# cert-manager can access an ingress or DNS TXT records at all times. # cert-manager can access an ingress or DNS TXT records at all times.
# NOTE: This requires Kubernetes 1.10 or `CustomPodDNS` feature gate enabled for # NOTE: This requires Kubernetes 1.10 or `CustomPodDNS` feature gate enabled for
# the cluster to work. # the cluster to work.
# Pod DNS policy # Pod DNS policy
# ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy # ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy
# +docs:property # +docs:property
# podDnsPolicy: "None" # podDnsPolicy: "None"
# Pod DNS config, podDnsConfig field is optional and it can work with any podDnsPolicy # Pod DNS config, podDnsConfig field is optional and it can work with any podDnsPolicy
# settings. However, when a Pod's dnsPolicy is set to "None", the dnsConfig field has to be specified. # settings. However, when a Pod's dnsPolicy is set to "None", the dnsConfig field has to be specified.
# ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config # ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config
# +docs:property # +docs:property
podDnsConfig: podDnsConfig:
nameservers: nameservers:
{{- range $index,$value := .Modules.Additional.CertManager.DnsServers }} {{- range $index,$value := .Modules.Additional.CertManager.DnsServers }}
- "{{ $value }}" - "{{ $value }}"
{{- end }} {{- end }}
# The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
# matching labels. # matching labels.
# See https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ # See https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
# #
# This default ensures that Pods are only scheduled to Linux nodes. # This default ensures that Pods are only scheduled to Linux nodes.
# It prevents Pods being scheduled to Windows nodes in a mixed OS cluster. # It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
# +docs:property # +docs:property
nodeSelector: nodeSelector:
kubernetes.io/os: linux kubernetes.io/os: linux
# +docs:ignore # +docs:ignore
ingressShim: {} ingressShim: {}
# Optional default issuer to use for ingress resources # Optional default issuer to use for ingress resources
# +docs:property=ingressShim.defaultIssuerName # +docs:property=ingressShim.defaultIssuerName
@@ -319,68 +308,68 @@
# +docs:property=ingressShim.defaultIssuerGroup # +docs:property=ingressShim.defaultIssuerGroup
# defaultIssuerGroup: "" # defaultIssuerGroup: ""
# Use these variables to configure the HTTP_PROXY environment variables # Use these variables to configure the HTTP_PROXY environment variables
# Configures the HTTP_PROXY environment variable for where a HTTP proxy is required # Configures the HTTP_PROXY environment variable for where a HTTP proxy is required
# +docs:property # +docs:property
# http_proxy: "http://proxy:8080" # http_proxy: "http://proxy:8080"
# Configures the HTTPS_PROXY environment variable for where a HTTP proxy is required # Configures the HTTPS_PROXY environment variable for where a HTTP proxy is required
# +docs:property # +docs:property
# https_proxy: "https://proxy:8080" # https_proxy: "https://proxy:8080"
# Configures the NO_PROXY environment variable for where a HTTP proxy is required, # Configures the NO_PROXY environment variable for where a HTTP proxy is required,
# but certain domains should be excluded # but certain domains should be excluded
# +docs:property # +docs:property
# no_proxy: 127.0.0.1,localhost # no_proxy: 127.0.0.1,localhost
# A Kubernetes Affinity, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core # A Kubernetes Affinity, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core
# #
# For example: # For example:
# affinity: # affinity:
# nodeAffinity: # nodeAffinity:
# requiredDuringSchedulingIgnoredDuringExecution: # requiredDuringSchedulingIgnoredDuringExecution:
# nodeSelectorTerms: # nodeSelectorTerms:
# - matchExpressions: # - matchExpressions:
# - key: foo.bar.com/role # - key: foo.bar.com/role
# operator: In # operator: In
# values: # values:
# - master # - master
affinity: {} affinity: {}
# A list of Kubernetes Tolerations, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core # A list of Kubernetes Tolerations, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core
# #
# For example: # For example:
# tolerations: # tolerations:
# - key: foo.bar.com/role # - key: foo.bar.com/role
# operator: Equal # operator: Equal
# value: master # value: master
# effect: NoSchedule # effect: NoSchedule
tolerations: [] tolerations: []
# A list of Kubernetes TopologySpreadConstraints, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core # A list of Kubernetes TopologySpreadConstraints, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core
# #
# For example: # For example:
# topologySpreadConstraints: # topologySpreadConstraints:
# - maxSkew: 2 # - maxSkew: 2
# topologyKey: topology.kubernetes.io/zone # topologyKey: topology.kubernetes.io/zone
# whenUnsatisfiable: ScheduleAnyway # whenUnsatisfiable: ScheduleAnyway
# labelSelector: # labelSelector:
# matchLabels: # matchLabels:
# app.kubernetes.io/instance: cert-manager # app.kubernetes.io/instance: cert-manager
# app.kubernetes.io/component: controller # app.kubernetes.io/component: controller
topologySpreadConstraints: [] topologySpreadConstraints: []
# LivenessProbe settings for the controller container of the controller Pod. # LivenessProbe settings for the controller container of the controller Pod.
# #
# Enabled by default, because we want to enable the clock-skew liveness probe that # Enabled by default, because we want to enable the clock-skew liveness probe that
# restarts the controller in case of a skew between the system clock and the monotonic clock. # restarts the controller in case of a skew between the system clock and the monotonic clock.
# LivenessProbe durations and thresholds are based on those used for the Kubernetes # LivenessProbe durations and thresholds are based on those used for the Kubernetes
# controller-manager. See: # controller-manager. See:
# https://github.com/kubernetes/kubernetes/blob/806b30170c61a38fedd54cc9ede4cd6275a1ad3b/cmd/kubeadm/app/util/staticpod/utils.go#L241-L245 # https://github.com/kubernetes/kubernetes/blob/806b30170c61a38fedd54cc9ede4cd6275a1ad3b/cmd/kubeadm/app/util/staticpod/utils.go#L241-L245
# +docs:property # +docs:property
livenessProbe: livenessProbe:
enabled: true enabled: true
initialDelaySeconds: 10 initialDelaySeconds: 10
periodSeconds: 10 periodSeconds: 10
@@ -388,14 +377,14 @@
successThreshold: 1 successThreshold: 1
failureThreshold: 8 failureThreshold: 8
# enableServiceLinks indicates whether information about services should be # enableServiceLinks indicates whether information about services should be
# injected into pod's environment variables, matching the syntax of Docker # injected into pod's environment variables, matching the syntax of Docker
# links. # links.
enableServiceLinks: false enableServiceLinks: false
# +docs:section=Prometheus # +docs:section=Prometheus
prometheus: prometheus:
# Enable Prometheus monitoring for the cert-manager controller to use with the # Enable Prometheus monitoring for the cert-manager controller to use with the
# Prometheus Operator. If this option is enabled without enabling `prometheus.servicemonitor.enabled` or # Prometheus Operator. If this option is enabled without enabling `prometheus.servicemonitor.enabled` or
# `prometheus.podmonitor.enabled`, 'prometheus.io' annotations are added to the cert-manager Deployment # `prometheus.podmonitor.enabled`, 'prometheus.io' annotations are added to the cert-manager Deployment
@@ -490,9 +479,9 @@
# +docs:property # +docs:property
endpointAdditionalProperties: {} endpointAdditionalProperties: {}
# +docs:section=Webhook # +docs:section=Webhook
webhook: webhook:
# Number of replicas of the cert-manager webhook to run. # Number of replicas of the cert-manager webhook to run.
# #
# The default is 1, but in production you should set this to 2 or 3 to provide high # The default is 1, but in production you should set this to 2 or 3 to provide high
@@ -849,9 +838,9 @@
# links. # links.
enableServiceLinks: false enableServiceLinks: false
# +docs:section=CA Injector # +docs:section=CA Injector
cainjector: cainjector:
# Create the CA Injector deployment # Create the CA Injector deployment
enabled: true enabled: true
@@ -1070,9 +1059,9 @@
# links. # links.
enableServiceLinks: false enableServiceLinks: false
# +docs:section=ACME Solver # +docs:section=ACME Solver
acmesolver: acmesolver:
image: image:
# The container registry to pull the acmesolver image from # The container registry to pull the acmesolver image from
# +docs:property # +docs:property
@@ -1094,16 +1083,16 @@
# Kubernetes imagePullPolicy on Deployment. # Kubernetes imagePullPolicy on Deployment.
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
# +docs:section=Startup API Check # +docs:section=Startup API Check
# This startupapicheck is a Helm post-install hook that waits for the webhook # This startupapicheck is a Helm post-install hook that waits for the webhook
# endpoints to become available. # endpoints to become available.
# The check is implemented using a Kubernetes Job - if you are injecting mesh # The check is implemented using a Kubernetes Job - if you are injecting mesh
# sidecar proxies into cert-manager pods, you probably want to ensure that they # sidecar proxies into cert-manager pods, you probably want to ensure that they
# are not injected into this Job's pod. Otherwise the installation may time out # are not injected into this Job's pod. Otherwise the installation may time out
# due to the Job never being completed because the sidecar proxy does not exit. # due to the Job never being completed because the sidecar proxy does not exit.
# See https://github.com/cert-manager/cert-manager/pull/4414 for context. # See https://github.com/cert-manager/cert-manager/pull/4414 for context.
startupapicheck: startupapicheck:
# Enables the startup api check # Enables the startup api check
enabled: true enabled: true

14
internal/resources/templates/helm-apps/releases/additional-modules/docker-secrets-generator.yml.tmpl
View File

@@ -1,14 +1,2 @@
- name: docker-secrets-generator repositories:
namespace: kube-system
chart_ref: {{ .Modules.Additional.DockerSecrets.ChartRef }}
chart_version: {{ .Modules.Additional.DockerSecrets.ChartVersion }}
{{- if .Modules.Additional.DockerSecrets.Repositories }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
{{- if .Modules.Additional.DockerSecrets.Repositories }}
values:
repositories:
{{- .Modules.Additional.DockerSecrets.Repositories | toYaml | nindent 6 }} {{- .Modules.Additional.DockerSecrets.Repositories | toYaml | nindent 6 }}
{{- end }}

85
internal/resources/templates/helm-apps/releases/additional-modules/ingress-nginx.yml.tmpl
View File

@@ -1,16 +1,5 @@
- name: ingress-nginx commonLabels: {}
namespace: ingress-nginx controller:
create_namespace: true
chart_ref: {{ .Modules.Additional.Ingress.ChartRef }}
chart_version: {{ .Modules.Additional.Ingress.ChartVersion }}
{{- if and .Modules.Additional.Ingress.Enabled (eq .Modules.Additional.Ingress.Type "nginx") }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
commonLabels: {}
controller:
name: controller name: controller
enableAnnotationValidations: false enableAnnotationValidations: false
image: image:
@@ -20,8 +9,6 @@
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
repository: {{ .Modules.Additional.Ingress.Nginx.Controller.Image }} repository: {{ .Modules.Additional.Ingress.Nginx.Controller.Image }}
tag: "{{ .Modules.Additional.Ingress.Nginx.Controller.Tag }}" tag: "{{ .Modules.Additional.Ingress.Nginx.Controller.Tag }}"
digest: sha256:5b161f051d017e55d358435f295f5e9a297e66158f136321d9b04520ec6c48a3
digestChroot: sha256:5976b1067cfbca8a21d0ba53d71f83543a73316a61ea7f7e436d6cf84ddf9b26
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
# www-data -> uid 101 # www-data -> uid 101
runAsUser: 101 runAsUser: 101
@@ -556,7 +543,7 @@
opentelemetry: opentelemetry:
enabled: false enabled: false
image: registry.k8s.io/ingress-nginx/opentelemetry:v20230721-3e2062ee5@sha256:13bee3f5223883d3ca62fee7309ad02d22ec00ff0d7033e3e9aca7a9f60fd472 # image: registry.k8s.io/ingress-nginx/opentelemetry:v20230721-3e2062ee5@sha256:13bee3f5223883d3ca62fee7309ad02d22ec00ff0d7033e3e9aca7a9f60fd472
containerSecurityContext: containerSecurityContext:
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
resources: {} resources: {}
@@ -737,12 +724,12 @@
command: command:
- /wait-shutdown - /wait-shutdown
priorityClassName: "" priorityClassName: ""
# -- Rollback limit # -- Rollback limit
## ##
revisionHistoryLimit: 10 revisionHistoryLimit: 10
## Default 404 backend ## Default 404 backend
## ##
defaultBackend: defaultBackend:
## ##
enabled: false enabled: false
name: defaultbackend name: defaultbackend
@@ -868,41 +855,41 @@
priorityClassName: "" priorityClassName: ""
# -- Labels to be added to the default backend resources # -- Labels to be added to the default backend resources
labels: {} labels: {}
## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266 ## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266
rbac: rbac:
create: true create: true
scope: false scope: false
## If true, create & use Pod Security Policy resources ## If true, create & use Pod Security Policy resources
## https://kubernetes.io/docs/concepts/policy/pod-security-policy/ ## https://kubernetes.io/docs/concepts/policy/pod-security-policy/
podSecurityPolicy: podSecurityPolicy:
enabled: false enabled: false
serviceAccount: serviceAccount:
create: true create: true
name: "" name: ""
automountServiceAccountToken: true automountServiceAccountToken: true
# -- Annotations for the controller service account # -- Annotations for the controller service account
annotations: {} annotations: {}
# -- Optional array of imagePullSecrets containing private registry credentials # -- Optional array of imagePullSecrets containing private registry credentials
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
imagePullSecrets: [] imagePullSecrets: []
# - name: secretName # - name: secretName
# -- TCP service key-value pairs # -- TCP service key-value pairs
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md ## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md
## ##
tcp: {} tcp: {}
# 8080: "default/example-tcp-svc:9000" # 8080: "default/example-tcp-svc:9000"
# -- UDP service key-value pairs # -- UDP service key-value pairs
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md ## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md
## ##
udp: {} udp: {}
# 53: "kube-system/kube-dns:53" # 53: "kube-system/kube-dns:53"
# -- Prefix for TCP and UDP ports names in ingress controller service # -- Prefix for TCP and UDP ports names in ingress controller service
## Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration ## Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration
portNamePrefix: "" portNamePrefix: ""
# -- (string) A base64-encoded Diffie-Hellman parameter. # -- (string) A base64-encoded Diffie-Hellman parameter.
# This can be generated with: `openssl dhparam 4096 2> /dev/null | base64` # This can be generated with: `openssl dhparam 4096 2> /dev/null | base64`
## Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param ## Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param
dhParam: "" dhParam: ""

61
internal/resources/templates/helm-apps/releases/additional-modules/longhorn.yml.tmpl
View File

@@ -1,15 +1,4 @@
- name: longhorn global:
namespace: longhorn-system
create_namespace: true
chart_ref: {{ .Modules.Additional.Storage.Longhorn.ChartRef }}
chart_version: {{ .Modules.Additional.Storage.Longhorn.ChartVersion }}
{{- if .Modules.Additional.Storage.Longhorn.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
global:
cattle: cattle:
# -- Default system registry. # -- Default system registry.
systemDefaultRegistry: "" systemDefaultRegistry: ""
@@ -31,13 +20,13 @@
# -- Node selector for system-managed Longhorn components. # -- Node selector for system-managed Longhorn components.
systemManagedComponentsNodeSelector: kubernetes.io/os:linux systemManagedComponentsNodeSelector: kubernetes.io/os:linux
networkPolicies: networkPolicies:
# -- Setting that allows you to enable network policies that control access to Longhorn pods. # -- Setting that allows you to enable network policies that control access to Longhorn pods.
enabled: false enabled: false
# -- Distribution that determines the policy for allowing access for an ingress. (Options: "k3s", "rke2", "rke1") # -- Distribution that determines the policy for allowing access for an ingress. (Options: "k3s", "rke2", "rke1")
type: "k3s" type: "k3s"
image: image:
longhorn: longhorn:
engine: engine:
# -- Repository for the Longhorn Engine image. # -- Repository for the Longhorn Engine image.
@@ -114,7 +103,7 @@
# -- Image pull policy that applies to all user-deployed Longhorn components, such as Longhorn Manager, Longhorn driver, and Longhorn UI. # -- Image pull policy that applies to all user-deployed Longhorn components, such as Longhorn Manager, Longhorn driver, and Longhorn UI.
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
service: service:
ui: ui:
# -- Service type for Longhorn UI. (Options: "ClusterIP", "NodePort", "LoadBalancer", "Rancher-Proxy") # -- Service type for Longhorn UI. (Options: "ClusterIP", "NodePort", "LoadBalancer", "Rancher-Proxy")
type: ClusterIP type: ClusterIP
@@ -126,7 +115,7 @@
# -- NodePort port number for Longhorn Manager. When unspecified, Longhorn selects a free port between 30000 and 32767. # -- NodePort port number for Longhorn Manager. When unspecified, Longhorn selects a free port between 30000 and 32767.
nodePort: "" nodePort: ""
persistence: persistence:
# -- Setting that allows you to specify the default Longhorn StorageClass. # -- Setting that allows you to specify the default Longhorn StorageClass.
defaultClass: true defaultClass: true
# -- Filesystem type of the default Longhorn StorageClass. # -- Filesystem type of the default Longhorn StorageClass.
@@ -170,13 +159,13 @@
# -- Setting that allows you to enable automatic snapshot removal during filesystem trim for a Longhorn StorageClass. (Options: "ignored", "enabled", "disabled") # -- Setting that allows you to enable automatic snapshot removal during filesystem trim for a Longhorn StorageClass. (Options: "ignored", "enabled", "disabled")
removeSnapshotsDuringFilesystemTrim: ignored removeSnapshotsDuringFilesystemTrim: ignored
preUpgradeChecker: preUpgradeChecker:
# -- Setting that allows Longhorn to perform pre-upgrade checks. Disable this setting when installing Longhorn using Argo CD or other GitOps solutions. # -- Setting that allows Longhorn to perform pre-upgrade checks. Disable this setting when installing Longhorn using Argo CD or other GitOps solutions.
jobEnabled: true jobEnabled: true
# -- Setting that allows Longhorn to perform upgrade version checks after starting the Longhorn Manager DaemonSet Pods. Disabling this setting also disables `preUpgradeChecker.jobEnabled`. Longhorn recommends keeping this setting enabled. # -- Setting that allows Longhorn to perform upgrade version checks after starting the Longhorn Manager DaemonSet Pods. Disabling this setting also disables `preUpgradeChecker.jobEnabled`. Longhorn recommends keeping this setting enabled.
upgradeVersionCheck: true upgradeVersionCheck: true
csi: csi:
# -- kubelet root directory. When unspecified, Longhorn uses the default value. # -- kubelet root directory. When unspecified, Longhorn uses the default value.
kubeletRootDir: ~ kubeletRootDir: ~
# -- Replica count of the CSI Attacher. When unspecified, Longhorn uses the default value ("3"). # -- Replica count of the CSI Attacher. When unspecified, Longhorn uses the default value ("3").
@@ -188,7 +177,7 @@
# -- Replica count of the CSI Snapshotter. When unspecified, Longhorn uses the default value ("3"). # -- Replica count of the CSI Snapshotter. When unspecified, Longhorn uses the default value ("3").
snapshotterReplicaCount: ~ snapshotterReplicaCount: ~
defaultSettings: defaultSettings:
# -- Endpoint used to access the backupstore. (Options: "NFS", "CIFS", "AWS", "GCP", "AZURE") # -- Endpoint used to access the backupstore. (Options: "NFS", "CIFS", "AWS", "GCP", "AZURE")
backupTarget: ~ backupTarget: ~
# -- Name of the Kubernetes secret associated with the backup target. # -- Name of the Kubernetes secret associated with the backup target.
@@ -330,7 +319,7 @@
# -- Maximum snapshot count for a volume. The value should be between 2 to 250 # -- Maximum snapshot count for a volume. The value should be between 2 to 250
snapshotMaxCount: ~ snapshotMaxCount: ~
privateRegistry: privateRegistry:
# -- Setting that allows you to create a private registry secret. # -- Setting that allows you to create a private registry secret.
createSecret: ~ createSecret: ~
# -- URL of a private registry. When unspecified, Longhorn uses the default system registry. # -- URL of a private registry. When unspecified, Longhorn uses the default system registry.
@@ -342,7 +331,7 @@
# -- Kubernetes secret that allows you to pull images from a private registry. This setting applies only when creation of private registry secrets is enabled. You must include the private registry name in the secret name. # -- Kubernetes secret that allows you to pull images from a private registry. This setting applies only when creation of private registry secrets is enabled. You must include the private registry name in the secret name.
registrySecret: ~ registrySecret: ~
longhornManager: longhornManager:
log: log:
# -- Format of Longhorn Manager logs. (Options: "plain", "json") # -- Format of Longhorn Manager logs. (Options: "plain", "json")
format: plain format: plain
@@ -369,7 +358,7 @@
# annotation-key1: "annotation-value1" # annotation-key1: "annotation-value1"
# annotation-key2: "annotation-value2" # annotation-key2: "annotation-value2"
longhornDriver: longhornDriver:
# -- PriorityClass for Longhorn Driver. # -- PriorityClass for Longhorn Driver.
priorityClass: *defaultPriorityClassNameRef priorityClass: *defaultPriorityClassNameRef
# -- Toleration for Longhorn Driver on nodes allowed to run Longhorn components. # -- Toleration for Longhorn Driver on nodes allowed to run Longhorn components.
@@ -387,7 +376,7 @@
# label-key1: "label-value1" # label-key1: "label-value1"
# label-key2: "label-value2" # label-key2: "label-value2"
longhornUI: longhornUI:
# -- Replica count for Longhorn UI. # -- Replica count for Longhorn UI.
replicas: 2 replicas: 2
# -- PriorityClass for Longhorn UI. # -- PriorityClass for Longhorn UI.
@@ -407,7 +396,7 @@
# label-key1: "label-value1" # label-key1: "label-value1"
# label-key2: "label-value2" # label-key2: "label-value2"
ingress: ingress:
# -- Setting that allows Longhorn to generate ingress records for the Longhorn UI service. # -- Setting that allows Longhorn to generate ingress records for the Longhorn UI service.
enabled: false enabled: false
@@ -456,26 +445,26 @@
# key: # key:
# certificate: # certificate:
# -- Setting that allows you to enable pod security policies (PSPs) that allow privileged Longhorn pods to start. This setting applies only to clusters running Kubernetes 1.25 and earlier, and with the built-in Pod Security admission controller enabled. # -- Setting that allows you to enable pod security policies (PSPs) that allow privileged Longhorn pods to start. This setting applies only to clusters running Kubernetes 1.25 and earlier, and with the built-in Pod Security admission controller enabled.
enablePSP: false enablePSP: false
# -- Specify override namespace, specifically this is useful for using longhorn as sub-chart and its release namespace is not the `longhorn-system`. # -- Specify override namespace, specifically this is useful for using longhorn as sub-chart and its release namespace is not the `longhorn-system`.
namespaceOverride: "" namespaceOverride: ""
# -- Annotation for the Longhorn Manager DaemonSet pods. This setting is optional. # -- Annotation for the Longhorn Manager DaemonSet pods. This setting is optional.
annotations: {} annotations: {}
serviceAccount: serviceAccount:
# -- Annotations to add to the service account # -- Annotations to add to the service account
annotations: {} annotations: {}
metrics: metrics:
serviceMonitor: serviceMonitor:
# -- Setting that allows the creation of a Prometheus ServiceMonitor resource for Longhorn Manager components. # -- Setting that allows the creation of a Prometheus ServiceMonitor resource for Longhorn Manager components.
enabled: false enabled: false
## openshift settings ## openshift settings
openshift: openshift:
# -- Setting that allows Longhorn to integrate with OpenShift. # -- Setting that allows Longhorn to integrate with OpenShift.
enabled: false enabled: false
ui: ui:
@@ -486,5 +475,5 @@
# -- Port for proxy that provides access to the OpenShift web console. # -- Port for proxy that provides access to the OpenShift web console.
proxy: 8443 proxy: 8443
# -- Setting that allows Longhorn to generate code coverage profiles. # -- Setting that allows Longhorn to generate code coverage profiles.
enableGoCoverDir: false enableGoCoverDir: false

72
internal/resources/templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl
View File

@@ -1,14 +1,4 @@
- name: csi-secrets-store linux:
namespace: kube-system
chart_ref: {{ .Modules.Additional.Storage.SecretsStoreCsiDriver.ChartRef }}
chart_version: {{ .Modules.Additional.Storage.SecretsStoreCsiDriver.ChartVersion }}
{{- if .Modules.Additional.Storage.SecretsStoreCsiDriver.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
linux:
enabled: true enabled: true
image: image:
repository: registry.k8s.io/csi-secrets-store/driver repository: registry.k8s.io/csi-secrets-store/driver
@@ -116,7 +106,7 @@
# mountPath: /bar # mountPath: /bar
# readOnly: true # readOnly: true
windows: windows:
enabled: false enabled: false
image: image:
repository: registry.k8s.io/csi-secrets-store/driver repository: registry.k8s.io/csi-secrets-store/driver
@@ -206,49 +196,49 @@
# mountPath: /bar # mountPath: /bar
# readOnly: true # readOnly: true
# log level. Uses V logs (klog) # log level. Uses V logs (klog)
logVerbosity: 0 logVerbosity: 0
# logging format JSON # logging format JSON
logFormatJSON: false logFormatJSON: false
livenessProbe: livenessProbe:
port: 9808 port: 9808
logLevel: 2 logLevel: 2
## Maximum size in bytes of gRPC response from plugins ## Maximum size in bytes of gRPC response from plugins
maxCallRecvMsgSize: 4194304 maxCallRecvMsgSize: 4194304
## Install Default RBAC roles and bindings ## Install Default RBAC roles and bindings
rbac: rbac:
install: true install: true
pspEnabled: false pspEnabled: false
## Install RBAC roles and bindings required for K8S Secrets syncing if true ## Install RBAC roles and bindings required for K8S Secrets syncing if true
syncSecret: syncSecret:
enabled: false enabled: false
## Enable secret rotation feature [alpha] ## Enable secret rotation feature [alpha]
enableSecretRotation: false enableSecretRotation: false
## Secret rotation poll interval duration ## Secret rotation poll interval duration
rotationPollInterval: rotationPollInterval:
## Provider HealthCheck ## Provider HealthCheck
providerHealthCheck: false providerHealthCheck: false
## Provider HealthCheck interval ## Provider HealthCheck interval
providerHealthCheckInterval: 2m providerHealthCheckInterval: 2m
imagePullSecrets: [] imagePullSecrets: []
## This allows CSI drivers to impersonate the pods that they mount the volumes for. ## This allows CSI drivers to impersonate the pods that they mount the volumes for.
# refer to https://kubernetes-csi.github.io/docs/token-requests.html for more details. # refer to https://kubernetes-csi.github.io/docs/token-requests.html for more details.
# Supported only for Kubernetes v1.20+ # Supported only for Kubernetes v1.20+
tokenRequests: [] tokenRequests: []
# - audience: aud1 # - audience: aud1
# - audience: aud2 # - audience: aud2
# -- Labels to apply to all resources # -- Labels to apply to all resources
commonLabels: {} commonLabels: {}
# team_name: dev # team_name: dev

15
internal/resources/templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl
View File

@@ -1,22 +1,11 @@
- name: argo-cd-ingress services:
namespace: cicd
create_namespace: true
chart_ref: {{ .Modules.Cicd.ArgoCd.ServiceIngress.ChartRef }}
chart_version: {{ .Modules.Cicd.ArgoCd.ServiceIngress.ChartVersion }}
{{- if and .Modules.Cicd.Enabled (eq .Modules.Cicd.ArgoCd.Expose.Type "ingress") }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
services:
- domain: {{ .Modules.Cicd.ArgoCd.Expose.Domain }} - domain: {{ .Modules.Cicd.ArgoCd.Expose.Domain }}
path: {{ .Modules.Cicd.ArgoCd.Expose.Path }} path: {{ .Modules.Cicd.ArgoCd.Expose.Path }}
address: argo-cd-argocd-server address: argo-cd-argocd-server
port: 80 port: 80
secretName: argo-cd-server-tls secretName: argo-cd-server-tls
ingress: ingress:
accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }} accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
class: {{ .Modules.Additional.Ingress.Type }} class: {{ .Modules.Additional.Ingress.Type }}
annotations: annotations:

37
internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl
View File

@@ -1,22 +1,11 @@
- name: argo-cd crds:
namespace: cicd
create_namespace: true
chart_ref: {{ .Modules.Cicd.ArgoCd.ChartRef }}
chart_version: {{ .Modules.Cicd.ArgoCd.ChartVersion }}
{{- if .Modules.Cicd.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
crds:
install: true install: true
global: global:
repository: {{ .Modules.Cicd.ArgoCd.Global.Image }} repository: {{ .Modules.Cicd.ArgoCd.Global.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Global.Tag }} tag: {{ .Modules.Cicd.ArgoCd.Global.Tag }}
server: server:
image: image:
repository: {{ .Modules.Cicd.ArgoCd.Server.Image }} repository: {{ .Modules.Cicd.ArgoCd.Server.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Server.Tag }} tag: {{ .Modules.Cicd.ArgoCd.Server.Tag }}
@@ -43,7 +32,7 @@
serviceMonitor: serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
redis: redis:
image: image:
repository: {{ .Modules.Cicd.ArgoCd.Redis.Image }} repository: {{ .Modules.Cicd.ArgoCd.Redis.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Redis.Tag }} tag: {{ .Modules.Cicd.ArgoCd.Redis.Tag }}
@@ -57,7 +46,7 @@
serviceMonitor: serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
controller: controller:
image: image:
repository: {{ .Modules.Cicd.ArgoCd.Controller.Image }} repository: {{ .Modules.Cicd.ArgoCd.Controller.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Controller.Tag }} tag: {{ .Modules.Cicd.ArgoCd.Controller.Tag }}
@@ -67,7 +56,7 @@
serviceMonitor: serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
applicationSet: applicationSet:
image: image:
repository: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Image }} repository: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Image }}
tag: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Tag }} tag: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Tag }}
@@ -79,7 +68,7 @@
serviceMonitor: serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
dex: dex:
image: image:
repository: {{ .Modules.Cicd.ArgoCd.Dex.Image }} repository: {{ .Modules.Cicd.ArgoCd.Dex.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Dex.Tag }} tag: {{ .Modules.Cicd.ArgoCd.Dex.Tag }}
@@ -89,7 +78,7 @@
serviceMonitor: serviceMonitor:
enabled: false enabled: false
repoServer: repoServer:
image: image:
repository: {{ .Modules.Cicd.ArgoCd.RepoServer.Image }} repository: {{ .Modules.Cicd.ArgoCd.RepoServer.Image }}
tag: {{ .Modules.Cicd.ArgoCd.RepoServer.Tag }} tag: {{ .Modules.Cicd.ArgoCd.RepoServer.Tag }}
@@ -107,7 +96,7 @@
serviceMonitor: serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
notifications: notifications:
image: image:
repository: {{ .Modules.Cicd.ArgoCd.Notifications.Image }} repository: {{ .Modules.Cicd.ArgoCd.Notifications.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Notifications.Tag }} tag: {{ .Modules.Cicd.ArgoCd.Notifications.Tag }}
@@ -116,7 +105,7 @@
serviceMonitor: serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
configs: configs:
params: params:
server.insecure: true server.insecure: true
{{- if not (eq .Modules.Cicd.ArgoCd.Expose.Path "/" ) }} {{- if not (eq .Modules.Cicd.ArgoCd.Expose.Path "/" ) }}
@@ -175,7 +164,7 @@
policy.default: role:'' policy.default: role:''
# scopes: "[roles,email,groups]" # scopes: "[roles,email,groups]"
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }} {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
redis-ha: redis-ha:
enabled: true enabled: true
{{- end }} {{- end }}

73
internal/resources/templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl
View File

@@ -1,29 +1,18 @@
- name: argo-rollouts installCRDs: true
namespace: cicd keepCRDs: false
create_namespace: true clusterInstall: true
chart_ref: {{ .Modules.Cicd.Rollouts.ChartRef }} createClusterAggregateRoles: true
chart_version: {{ .Modules.Cicd.Rollouts.ChartVersion }}
{{- if and .Modules.Cicd.Enabled .Modules.Cicd.Rollouts.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
installCRDs: true
keepCRDs: false
clusterInstall: true
createClusterAggregateRoles: true
apiVersionOverrides: apiVersionOverrides:
# -- String to override apiVersion of ingresses rendered by this helm chart # -- String to override apiVersion of ingresses rendered by this helm chart
ingress: "" # networking.k8s.io/v1beta1 ingress: "" # networking.k8s.io/v1beta1
# -- Override the Kubernetes version, which is used to evaluate certain manifests # -- Override the Kubernetes version, which is used to evaluate certain manifests
kubeVersionOverride: "" kubeVersionOverride: ""
# -- Additional manifests to deploy within the chart. A list of objects. # -- Additional manifests to deploy within the chart. A list of objects.
## Can be used to add secrets for Analysis with 3rd-party monitoring solutions. ## Can be used to add secrets for Analysis with 3rd-party monitoring solutions.
extraObjects: [] extraObjects: []
# - apiVersion: v1 # - apiVersion: v1
# kind: Secret # kind: Secret
# metadata: # metadata:
@@ -34,11 +23,11 @@
# api-key: <datadog-api-key> # api-key: <datadog-api-key>
# app-key: <datadog-app-key> # app-key: <datadog-app-key>
global: global:
# -- Annotations for all deployed Deployments # -- Annotations for all deployed Deployments
deploymentAnnotations: {} deploymentAnnotations: {}
controller: controller:
# -- Value of label `app.kubernetes.io/component` # -- Value of label `app.kubernetes.io/component`
component: rollouts-controller component: rollouts-controller
# -- Annotations to be added to the controller deployment # -- Annotations to be added to the controller deployment
@@ -182,7 +171,7 @@
# - name: "argoproj-labs/sample-nginx" # name of the plugin, it must match the name required by the plugin so it can find it's configuration # - name: "argoproj-labs/sample-nginx" # name of the plugin, it must match the name required by the plugin so it can find it's configuration
# location: "file://./my-custom-plugin" # supports http(s):// urls and file:// # location: "file://./my-custom-plugin" # supports http(s):// urls and file://
serviceAccount: serviceAccount:
# -- Specifies whether a service account should be created # -- Specifies whether a service account should be created
create: true create: true
# -- Annotations to add to the service account # -- Annotations to add to the service account
@@ -191,18 +180,18 @@
# If not set and create is true, a name is generated using the fullname template # If not set and create is true, a name is generated using the fullname template
name: "" name: ""
# -- Annotations to be added to all CRDs # -- Annotations to be added to all CRDs
crdAnnotations: {} crdAnnotations: {}
# -- Annotations for the all deployed pods # -- Annotations for the all deployed pods
podAnnotations: {} podAnnotations: {}
# -- Security Context to set on pod level # -- Security Context to set on pod level
podSecurityContext: podSecurityContext:
runAsNonRoot: true runAsNonRoot: true
# -- Security Context to set on container level # -- Security Context to set on container level
containerSecurityContext: {} containerSecurityContext: {}
# capabilities: # capabilities:
# drop: # drop:
# - ALL # - ALL
@@ -210,17 +199,17 @@
# runAsNonRoot: true # runAsNonRoot: true
# runAsUser: 1000 # runAsUser: 1000
# -- Annotations to be added to the Rollout service # -- Annotations to be added to the Rollout service
serviceAnnotations: {} serviceAnnotations: {}
# -- Labels to be added to the Rollout pods # -- Labels to be added to the Rollout pods
podLabels: {} podLabels: {}
# -- Secrets with credentials to pull images from a private registry. Registry secret names as an array. # -- Secrets with credentials to pull images from a private registry. Registry secret names as an array.
imagePullSecrets: [] imagePullSecrets: []
# - name: argo-pull-secret # - name: argo-pull-secret
providerRBAC: providerRBAC:
# -- Toggles addition of provider-specific RBAC rules to the controller Role and ClusterRole # -- Toggles addition of provider-specific RBAC rules to the controller Role and ClusterRole
enabled: true enabled: true
# providerRBAC.enabled must be true in order to toggle the individual providers # providerRBAC.enabled must be true in order to toggle the individual providers
@@ -246,7 +235,7 @@
# -- Additional RBAC rules for others providers # -- Additional RBAC rules for others providers
additionalRules: [] additionalRules: []
dashboard: dashboard:
# -- Deploy dashboard server # -- Deploy dashboard server
enabled: true enabled: true
# -- Set cluster role to readonly # -- Set cluster role to readonly
@@ -412,7 +401,7 @@
# -- Additional volumeMounts to add to the dashboard container # -- Additional volumeMounts to add to the dashboard container
volumeMounts: [] volumeMounts: []
notifications: notifications:
secret: secret:
# -- Whether to create notifications secret # -- Whether to create notifications secret
create: false create: false

216
internal/resources/templates/helm-apps/releases/cicd/keel.yml.tmpl
View File

@@ -1,36 +1,26 @@
- name: keel image:
namespace: kube-system
chart_ref: {{ .Modules.Cicd.UpdatesOperator.ChartRef }}
chart_version: {{ .Modules.Cicd.UpdatesOperator.ChartVersion }}
{{- if and .Modules.Cicd.Enabled .Modules.Cicd.UpdatesOperator.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
image:
repository: {{ .Modules.Cicd.UpdatesOperator.Image }} repository: {{ .Modules.Cicd.UpdatesOperator.Image }}
tag: {{ .Modules.Cicd.UpdatesOperator.Tag }} tag: {{ .Modules.Cicd.UpdatesOperator.Tag }}
pullPolicy: Always pullPolicy: Always
# Enable insecure registries # Enable insecure registries
insecureRegistry: false insecureRegistry: false
# Polling is enabled by default, # Polling is enabled by default,
# you can disable it setting value below to false # you can disable it setting value below to false
polling: polling:
enabled: true enabled: true
defaultSchedule: "@every 1m" defaultSchedule: "@every 1m"
# Extra Containers to run alongside Keel # Extra Containers to run alongside Keel
# extraContainers: # extraContainers:
# - name: busybox # - name: busybox
# image: busybox # image: busybox
# imagePullPolicy: IfNotPresent # imagePullPolicy: IfNotPresent
# command: ['sh', '-c', 'echo Container 1 is Running ; sleep 3600'] # command: ['sh', '-c', 'echo Container 1 is Running ; sleep 3600']
# Helm provider support # Helm provider support
helmProvider: helmProvider:
enabled: true enabled: true
# set to version "v3" for Helm v3 # set to version "v3" for Helm v3
version: "v2" version: "v2"
@@ -39,12 +29,12 @@
# if you are using default configuration, setting it to # if you are using default configuration, setting it to
# 'tiller-deploy:44134' is usually fine # 'tiller-deploy:44134' is usually fine
tillerAddress: 'tiller-deploy:44134' tillerAddress: 'tiller-deploy:44134'
# helmDriver: '' # helmDriver: ''
# helmDriverSqlConnectionString: '' # helmDriverSqlConnectionString: ''
# Google Container Registry # Google Container Registry
# GCP Project ID # GCP Project ID
gcr: gcr:
enabled: false enabled: false
projectId: "" projectId: ""
gcpServiceAccount: "" gcpServiceAccount: ""
@@ -52,35 +42,35 @@
pubSub: pubSub:
enabled: false enabled: false
# Notification level (debug, info, success, warn, error, fatal) # Notification level (debug, info, success, warn, error, fatal)
notificationLevel: info notificationLevel: info
# AWS Elastic Container Registry # AWS Elastic Container Registry
# https://keel.sh/v1/guide/documentation.html#Polling-with-AWS-ECR # https://keel.sh/v1/guide/documentation.html#Polling-with-AWS-ECR
ecr: ecr:
enabled: false enabled: false
roleArn: "" roleArn: ""
accessKeyId: "" accessKeyId: ""
secretAccessKey: "" secretAccessKey: ""
region: "" region: ""
# Webhook Notification # Webhook Notification
# Remote webhook endpoint for notification delivery # Remote webhook endpoint for notification delivery
webhook: webhook:
enabled: false enabled: false
endpoint: "" endpoint: ""
# Slack Notification # Slack Notification
# bot name (default keel) must exist! # bot name (default keel) must exist!
slack: slack:
enabled: false enabled: false
botName: "" botName: ""
token: "" token: ""
channel: "" channel: ""
approvalsChannel: "" approvalsChannel: ""
# Hipchat notification and approvals # Hipchat notification and approvals
hipchat: hipchat:
enabled: false enabled: false
token: "" token: ""
channel: "" channel: ""
@@ -89,23 +79,23 @@
userName: "" userName: ""
password: "" password: ""
# Mattermost notifications # Mattermost notifications
mattermost: mattermost:
enabled: false enabled: false
endpoint: "" endpoint: ""
# MS Teams notifications # MS Teams notifications
teams: teams:
enabled: false enabled: false
webhookUrl: "" webhookUrl: ""
# Discord notifications # Discord notifications
discord: discord:
enabled: false enabled: false
webhookUrl: "" webhookUrl: ""
# Mail notifications # Mail notifications
mail: mail:
enabled: false enabled: false
from: "" from: ""
to: "" to: ""
@@ -115,24 +105,24 @@
user: "" user: ""
pass: "" pass: ""
# Basic auth on approvals # Basic auth on approvals
basicauth: basicauth:
enabled: true enabled: true
user: "admin" user: "admin"
password: "{{ .Modules.AdminPassword }}" password: "{{ .Modules.AdminPassword }}"
# Keel service # Keel service
# Enable to receive webhooks from Docker registries # Enable to receive webhooks from Docker registries
service: service:
enabled: false enabled: false
type: LoadBalancer type: LoadBalancer
externalPort: 9300 externalPort: 9300
clusterIP: "" clusterIP: ""
# Webhook Relay service # Webhook Relay service
# If you don’t want to expose your Keel service, you can use https://webhookrelay.com/ # If you don’t want to expose your Keel service, you can use https://webhookrelay.com/
# which can deliver webhooks to your internal Keel service through Keel sidecar container. # which can deliver webhooks to your internal Keel service through Keel sidecar container.
webhookRelay: webhookRelay:
enabled: false enabled: false
bucket: "" bucket: ""
# webhookrelay.com credentials # webhookrelay.com credentials
@@ -146,30 +136,30 @@
tag: latest tag: latest
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
# Use a secret file to define passwords and tokens of third parties. # Use a secret file to define passwords and tokens of third parties.
secret: secret:
# Leave blank to use `keel.fullname` # Leave blank to use `keel.fullname`
name: "" name: ""
# Set to false to manage your own secret file, with terraform for example. # Set to false to manage your own secret file, with terraform for example.
create: true create: true
# Keel self-update # Keel self-update
# uncomment lines below if you want Keel to automaticly # uncomment lines below if you want Keel to automaticly
# self-update to the latest release version # self-update to the latest release version
# keel: # keel:
# # keel policy (all/major/minor/patch/force) # # keel policy (all/major/minor/patch/force)
# policy: patch # policy: patch
# # trigger type, defaults to events such as pubsub, webhooks # # trigger type, defaults to events such as pubsub, webhooks
# trigger: poll # trigger: poll
# # polling schedule # # polling schedule
# pollSchedule: "@every 3m" # pollSchedule: "@every 3m"
# # images to track and update # # images to track and update
# images: # images:
# - repository: image.repository # - repository: image.repository
# tag: image.tag # tag: image.tag
# RBAC manifests management # RBAC manifests management
rbac: rbac:
enabled: true enabled: true
serviceAccount: serviceAccount:
# Kubernetes service account name to be used for ClusterRoleBinding and Deployment. # Kubernetes service account name to be used for ClusterRoleBinding and Deployment.
@@ -178,8 +168,8 @@
# If rbac.serviceAccount.name is not set, a new name for the service account is generated # If rbac.serviceAccount.name is not set, a new name for the service account is generated
create: true create: true
# Resources # Resources
resources: resources:
limits: limits:
cpu: 100m cpu: 100m
memory: 128Mi memory: 128Mi
@@ -187,69 +177,69 @@
cpu: 50m cpu: 50m
memory: 64Mi memory: 64Mi
# NodeSelector # NodeSelector
nodeSelector: {} nodeSelector: {}
affinity: {} affinity: {}
tolerations: {} tolerations: {}
# base64 encoded json of GCP service account # base64 encoded json of GCP service account
# more info available here: https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform # more info available here: https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform
# e.g. --set googleApplicationCredentials=$(cat <JSON_KEY_FIEL> | base64) # e.g. --set googleApplicationCredentials=$(cat <JSON_KEY_FIEL> | base64)
googleApplicationCredentials: "" googleApplicationCredentials: ""
# Enable DEBUG logging # Enable DEBUG logging
debug: false debug: false
# This is used by the static manifest generator in order to create a static # This is used by the static manifest generator in order to create a static
# namespace manifest for the namespace that keel is being installed # namespace manifest for the namespace that keel is being installed
# within. It should **not** be used if you are using Helm for deployment. # within. It should **not** be used if you are using Helm for deployment.
createNamespaceResource: false createNamespaceResource: false
podAnnotations: {} podAnnotations: {}
serviceAnnotations: {} serviceAnnotations: {}
# Useful for making the load balancer internal # Useful for making the load balancer internal
# serviceAnnotations: # serviceAnnotations:
# cloud.google.com/load-balancer-type: Internal # cloud.google.com/load-balancer-type: Internal
aws: aws:
region: null region: null
podDisruptionBudget: podDisruptionBudget:
enabled: false enabled: false
maxUnavailable: 1 maxUnavailable: 1
minAvailable: null minAvailable: null
# Google Cloud Certificates # Google Cloud Certificates
gcloud: gcloud:
managedCertificates: managedCertificates:
enabled: false enabled: false
domains: domains:
- "" - ""
ingress: ingress:
enabled: false enabled: false
labels: {} labels: {}
annotations: {} annotations: {}
# kubernetes.io/ingress.class: nginx # kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true" # kubernetes.io/tls-acme: "true"
hosts: [] hosts: []
# - host: chart-example.local # - host: chart-example.local
# paths: # paths:
# - / # - /
tls: [] tls: []
# - secretName: chart-example-tls # - secretName: chart-example-tls
# hosts: # hosts:
# - chart-example.local # - chart-example.local
dockerRegistry: dockerRegistry:
enabled: false enabled: false
name: "" name: ""
key: "" key: ""
persistence: persistence:
enabled: false enabled: false
storageClass: "-" storageClass: "-"
size: 1Gi size: 1Gi

29
internal/resources/templates/helm-apps/releases/observability/fluent-operator.yml.tmpl
View File

@@ -1,19 +1,8 @@
- name: fluent-operator # Set this to containerd or crio if you want to collect CRI format logs
namespace: observability containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
create_namespace: true Kubernetes: false
chart_ref: {{ .Modules.Observability.Logging.Operator.ChartRef }}
chart_version: {{ .Modules.Observability.Logging.Operator.ChartVersion }}
{{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
# Set this to containerd or crio if you want to collect CRI format logs
containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
Kubernetes: false
operator: operator:
initcontainer: initcontainer:
repository: "{{ .Modules.Observability.Logging.Operator.InitContainer.Image }}" repository: "{{ .Modules.Observability.Logging.Operator.InitContainer.Image }}"
tag: "{{ .Modules.Observability.Logging.Operator.InitContainer.Tag }}" tag: "{{ .Modules.Observability.Logging.Operator.InitContainer.Tag }}"
@@ -44,11 +33,11 @@
containerd: /var/log containerd: /var/log
disableComponentControllers: "" disableComponentControllers: ""
fluentbit: fluentbit:
crdsEnable: true crdsEnable: true
enable: false enable: false
fluentd: fluentd:
crdsEnable: true crdsEnable: true
enable: false enable: false
name: fluentd name: fluentd
@@ -61,6 +50,6 @@
repository: "{{ .Modules.Observability.Logging.Fluentd.Image }}" repository: "{{ .Modules.Observability.Logging.Fluentd.Image }}"
tag: "{{ .Modules.Observability.Logging.Fluentd.Tag }}" tag: "{{ .Modules.Observability.Logging.Fluentd.Tag }}"
nameOverride: "" nameOverride: ""
fullnameOverride: "" fullnameOverride: ""
namespaceOverride: "" namespaceOverride: ""

28
internal/resources/templates/helm-apps/releases/observability/loki.yml.tmpl
View File

@@ -1,15 +1,4 @@
- name: loki loki:
namespace: observability
create_namespace: true
chart_ref: {{ .Modules.Observability.Logging.Loki.ChartRef }}
chart_version: {{ .Modules.Observability.Logging.Loki.ChartVersion }}
{{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
loki:
image: image:
registry: {{ .Modules.Observability.Logging.Loki.Registry }} registry: {{ .Modules.Observability.Logging.Loki.Registry }}
repository: {{ .Modules.Observability.Logging.Loki.Image }} repository: {{ .Modules.Observability.Logging.Loki.Image }}
@@ -53,7 +42,7 @@
alertmanager_url: {{ .Modules.Observability.Logging.Loki.AlertManagerUrl }} alertmanager_url: {{ .Modules.Observability.Logging.Loki.AlertManagerUrl }}
singleBinary: singleBinary:
replicas: 1 replicas: 1
extraVolumes: extraVolumes:
@@ -66,19 +55,19 @@
mountPath: /var/loki/rules mountPath: /var/loki/rules
write: write:
persistence: persistence:
volumeClaimsEnabled: true volumeClaimsEnabled: true
storageClass: "{{ .Modules.Observability.Logging.Loki.Persistence.StorageClass }}" storageClass: "{{ .Modules.Observability.Logging.Loki.Persistence.StorageClass }}"
size: {{ .Modules.Observability.Logging.Loki.Persistence.StorageSize }} size: {{ .Modules.Observability.Logging.Loki.Persistence.StorageSize }}
test: test:
enabled: false enabled: false
gateway: gateway:
enabled: false enabled: false
monitoring: monitoring:
selfMonitoring: selfMonitoring:
enabled: false enabled: false
grafanaAgent: grafanaAgent:
@@ -88,9 +77,8 @@
rules: rules:
enabled: true enabled: true
alerting: true alerting: true
additionalGroups: {}
extraObjects: extraObjects:
- apiVersion: v1 - apiVersion: v1
kind: ConfigMap kind: ConfigMap
metadata: metadata:
@@ -168,7 +156,7 @@
jobName: kube_events jobName: kube_events
summary: BackOff events occured in cluster summary: BackOff events occured in cluster
addDefaultUrl: "true" addDefaultUrl: "true"
sidecar: sidecar:
rules: rules:
enabled: true enabled: true
# -- Label that the configmaps/secrets with rules will be marked with. # -- Label that the configmaps/secrets with rules will be marked with.

101
internal/resources/templates/helm-apps/releases/observability/metrics-server.yml.tmpl
View File

@@ -1,26 +1,15 @@
- name: metrics-server image:
namespace: kube-system
create_namespace: true
chart_ref: {{ .Modules.Observability.Monitoring.MetricsServer.ChartRef }}
chart_version: {{ .Modules.Observability.Monitoring.MetricsServer.ChartVersion }}
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
image:
repository: {{.Modules.Observability.Monitoring.MetricsServer.Image }} repository: {{.Modules.Observability.Monitoring.MetricsServer.Image }}
tag: "{{ .Modules.Observability.Monitoring.MetricsServer.Tag }}" tag: "{{ .Modules.Observability.Monitoring.MetricsServer.Tag }}"
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
imagePullSecrets: [] imagePullSecrets: []
# - name: registrySecretName # - name: registrySecretName
nameOverride: "" nameOverride: ""
fullnameOverride: "" fullnameOverride: ""
serviceAccount: serviceAccount:
# Specifies whether a service account should be created # Specifies whether a service account should be created
create: true create: true
# Annotations to add to the service account # Annotations to add to the service account
@@ -32,12 +21,12 @@
# See https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets # See https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets
secrets: [] secrets: []
rbac: rbac:
# Specifies whether RBAC resources should be created # Specifies whether RBAC resources should be created
create: true create: true
pspEnabled: false pspEnabled: false
apiService: apiService:
create: true create: true
# Annotations to add to the API service # Annotations to add to the API service
annotations: {} annotations: {}
@@ -46,14 +35,14 @@
# The PEM encoded CA bundle for TLS verification # The PEM encoded CA bundle for TLS verification
caBundle: "" caBundle: ""
commonLabels: {} commonLabels: {}
podLabels: podLabels:
"app.kubernetes.io/component": "metrics-server" "app.kubernetes.io/component": "metrics-server"
podAnnotations: {} podAnnotations: {}
podSecurityContext: {} podSecurityContext: {}
securityContext: securityContext:
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
readOnlyRootFilesystem: true readOnlyRootFilesystem: true
runAsNonRoot: true runAsNonRoot: true
@@ -64,11 +53,11 @@
drop: drop:
- ALL - ALL
priorityClassName: system-cluster-critical priorityClassName: system-cluster-critical
containerPort: 10250 containerPort: 10250
hostNetwork: hostNetwork:
# Specifies if metrics-server should be started in hostNetwork mode. # Specifies if metrics-server should be started in hostNetwork mode.
# #
# You would require this enabled if you use alternate overlay networking for pods and # You would require this enabled if you use alternate overlay networking for pods and
@@ -76,32 +65,32 @@
# if you use Weave network on EKS # if you use Weave network on EKS
enabled: false enabled: false
replicas: 1 replicas: 1
revisionHistoryLimit: revisionHistoryLimit:
updateStrategy: {} updateStrategy: {}
# type: RollingUpdate # type: RollingUpdate
# rollingUpdate: # rollingUpdate:
# maxSurge: 0 # maxSurge: 0
# maxUnavailable: 1 # maxUnavailable: 1
podDisruptionBudget: podDisruptionBudget:
# https://kubernetes.io/docs/tasks/run-application/configure-pdb/ # https://kubernetes.io/docs/tasks/run-application/configure-pdb/
enabled: false enabled: false
minAvailable: minAvailable:
maxUnavailable: maxUnavailable:
defaultArgs: defaultArgs:
- --cert-dir=/tmp - --cert-dir=/tmp
- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
- --kubelet-use-node-status-port - --kubelet-use-node-status-port
- --metric-resolution=15s - --metric-resolution=15s
- --kubelet-insecure-tls - --kubelet-insecure-tls
args: [] args: []
livenessProbe: livenessProbe:
httpGet: httpGet:
path: /livez path: /livez
port: https port: https
@@ -110,7 +99,7 @@
periodSeconds: 10 periodSeconds: 10
failureThreshold: 3 failureThreshold: 3
readinessProbe: readinessProbe:
httpGet: httpGet:
path: /readyz path: /readyz
port: https port: https
@@ -119,7 +108,7 @@
periodSeconds: 10 periodSeconds: 10
failureThreshold: 3 failureThreshold: 3
service: service:
type: ClusterIP type: ClusterIP
port: 443 port: 443
annotations: {} annotations: {}
@@ -128,7 +117,7 @@
# kubernetes.io/cluster-service: "true" # kubernetes.io/cluster-service: "true"
# kubernetes.io/name: "Metrics-server" # kubernetes.io/name: "Metrics-server"
addonResizer: addonResizer:
enabled: false enabled: false
image: image:
repository: registry.k8s.io/autoscaling/addon-resizer repository: registry.k8s.io/autoscaling/addon-resizer
@@ -159,10 +148,10 @@
pollPeriod: 300000 pollPeriod: 300000
threshold: 5 threshold: 5
metrics: metrics:
enabled: true enabled: true
serviceMonitor: serviceMonitor:
enabled: true enabled: true
additionalLabels: {} additionalLabels: {}
interval: 1m interval: 1m
@@ -170,8 +159,8 @@
metricRelabelings: [] metricRelabelings: []
relabelings: [] relabelings: []
# See https://github.com/kubernetes-sigs/metrics-server#scaling # See https://github.com/kubernetes-sigs/metrics-server#scaling
resources: resources:
requests: requests:
cpu: 100m cpu: 100m
memory: 200Mi memory: 200Mi
@@ -179,25 +168,25 @@
# cpu: # cpu:
# memory: # memory:
extraVolumeMounts: [] extraVolumeMounts: []
extraVolumes: [] extraVolumes: []
nodeSelector: {} nodeSelector: {}
tolerations: [] tolerations: []
affinity: {} affinity: {}
topologySpreadConstraints: [] topologySpreadConstraints: []
dnsConfig: {} dnsConfig: {}
# Annotations to add to the deployment # Annotations to add to the deployment
deploymentAnnotations: {} deploymentAnnotations: {}
schedulerName: "" schedulerName: ""
tmpVolume: tmpVolume:
emptyDir: {} emptyDir: {}

35
internal/resources/templates/helm-apps/releases/observability/observability.yml.tmpl
View File

@@ -1,15 +1,4 @@
- name: observability prometheus:
namespace: observability
create_namespace: true
chart_ref: {{ .Modules.Observability.ChartRef }}
chart_version: {{ .Modules.Observability.ChartVersion }}
{{- if .Modules.Observability.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
prometheus:
enabled: {{ .Modules.Observability.Monitoring.Enabled }} enabled: {{ .Modules.Observability.Monitoring.Enabled }}
serviceMonitor: true serviceMonitor: true
image: image:
@@ -105,7 +94,7 @@
replacement: observability-blackbox-exporter:9115 replacement: observability-blackbox-exporter:9115
{{- end }} {{- end }}
alertManager: alertManager:
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.AlertManager.Enabled }} enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.AlertManager.Enabled }}
serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }} serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
enableDefaultRules: true enableDefaultRules: true
@@ -130,7 +119,7 @@
{{- .Modules.Observability.Monitoring.AlertManager.Receivers | toYaml | nindent 8 }} {{- .Modules.Observability.Monitoring.AlertManager.Receivers | toYaml | nindent 8 }}
{{- end }} {{- end }}
blackboxExporter: blackboxExporter:
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.Blackbox.Enabled }} enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.Blackbox.Enabled }}
serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }} serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
image: image:
@@ -144,7 +133,7 @@
additionalModules: additionalModules:
kubeStateMetrics: kubeStateMetrics:
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.KubeState.Enabled }} enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.KubeState.Enabled }}
image: image:
repository: {{ .Modules.Observability.Monitoring.KubeState.Image }} repository: {{ .Modules.Observability.Monitoring.KubeState.Image }}
@@ -158,7 +147,7 @@
memory: 240Mi memory: 240Mi
cpu: 60m cpu: 60m
prometheusOperator: prometheusOperator:
enabled: {{ .Modules.Observability.Monitoring.Enabled }} enabled: {{ .Modules.Observability.Monitoring.Enabled }}
image: image:
repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Image }} repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Image }}
@@ -177,14 +166,14 @@
tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Tag }} tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Tag }}
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
nodeExporter: nodeExporter:
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.Node.Enabled }} enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.Node.Enabled }}
image: image:
repository: {{ .Modules.Observability.Monitoring.Node.Image }} repository: {{ .Modules.Observability.Monitoring.Node.Image }}
tag: {{ .Modules.Observability.Monitoring.Node.Tag }} tag: {{ .Modules.Observability.Monitoring.Node.Tag }}
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
kubeEventsExporter: kubeEventsExporter:
enabled: {{ and .Modules.Observability.Logging.Enabled .Modules.Observability.Logging.Events.Enabled }} enabled: {{ and .Modules.Observability.Logging.Enabled .Modules.Observability.Logging.Events.Enabled }}
image: image:
repository: {{ .Modules.Observability.Logging.Events.Exporter.Image }} repository: {{ .Modules.Observability.Logging.Events.Exporter.Image }}
@@ -207,7 +196,7 @@
additionalRoutes: additionalRoutes:
additionalReceivers: additionalReceivers:
grafana: grafana:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Visualization.Grafana.Enabled }} enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Visualization.Grafana.Enabled }}
serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }} serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
domain: &grafanaDomain {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }} domain: &grafanaDomain {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
@@ -269,7 +258,7 @@
{{- .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources | toYaml | nindent 10 }} {{- .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources | toYaml | nindent 10 }}
{{- end }} {{- end }}
opentelemetryCollector: opentelemetryCollector:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }} enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
serviceMonitor: true serviceMonitor: true
config: | config: |
@@ -290,7 +279,7 @@
receivers: [otlp] receivers: [otlp]
exporters: [otlphttp] exporters: [otlphttp]
ingress: ingress:
{{- if and .Modules.Observability.Visualization.Grafana.Enabled (eq .Modules.Observability.Visualization.Grafana.Expose.Type "ingress") }} {{- if and .Modules.Observability.Visualization.Grafana.Enabled (eq .Modules.Observability.Visualization.Grafana.Expose.Type "ingress") }}
enabled: true enabled: true
{{- else }} {{- else }}
@@ -312,9 +301,9 @@
- host: {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }} - host: {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
secretName: grafana-tls secretName: grafana-tls
containerRuntime: {{ .Orchestrator.ContainerEngine.Type }} containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
fluentbit: fluentbit:
enable: {{ and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }} enable: {{ and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
serviceMonitor: true serviceMonitor: true
image: image:

45
internal/resources/templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl
View File

@@ -1,23 +1,12 @@
- name: opentelemetry-operator replicaCount: 1
namespace: observability nameOverride: ""
create_namespace: true imagePullSecrets: []
chart_ref: {{ .Modules.Observability.Tracing.Operator.ChartRef }} pdb:
chart_version: {{ .Modules.Observability.Tracing.Operator.ChartVersion }}
{{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
replicaCount: 1
nameOverride: ""
imagePullSecrets: []
pdb:
create: false create: false
minAvailable: 1 minAvailable: 1
maxUnavailable: "" maxUnavailable: ""
manager: manager:
image: image:
repository: {{ .Modules.Observability.Tracing.Operator.Image }} repository: {{ .Modules.Observability.Tracing.Operator.Image }}
tag: "{{ .Modules.Observability.Tracing.Operator.Tag }}" tag: "{{ .Modules.Observability.Tracing.Operator.Tag }}"
@@ -73,7 +62,7 @@
securityContext: {} securityContext: {}
kubeRBACProxy: kubeRBACProxy:
enabled: true enabled: true
image: image:
repository: quay.io/brancz/kube-rbac-proxy repository: quay.io/brancz/kube-rbac-proxy
@@ -92,7 +81,7 @@
securityContext: {} securityContext: {}
admissionWebhooks: admissionWebhooks:
create: true create: true
servicePort: 443 servicePort: 443
failurePolicy: Fail failurePolicy: Fail
@@ -119,27 +108,27 @@
secretAnnotations: {} secretAnnotations: {}
secretLabels: {} secretLabels: {}
role: role:
create: true create: true
clusterRole: clusterRole:
create: true create: true
affinity: {} affinity: {}
tolerations: [] tolerations: []
nodeSelector: {} nodeSelector: {}
topologySpreadConstraints: [] topologySpreadConstraints: []
hostNetwork: false hostNetwork: false
priorityClassName: "" priorityClassName: ""
securityContext: securityContext:
runAsGroup: 65532 runAsGroup: 65532
runAsNonRoot: true runAsNonRoot: true
runAsUser: 65532 runAsUser: 65532
fsGroup: 65532 fsGroup: 65532
testFramework: testFramework:
image: image:
repository: busybox repository: busybox
tag: latest tag: latest

27
internal/resources/templates/helm-apps/releases/observability/tempo.yml.tmpl
View File

@@ -1,17 +1,6 @@
- name: tempo replicas: 1
namespace: observability
create_namespace: true
chart_ref: {{ .Modules.Observability.Tracing.Tempo.ChartRef }}
chart_version: {{ .Modules.Observability.Tracing.Tempo.ChartVersion }}
{{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
replicas: 1
tempo: tempo:
repository: {{ .Modules.Observability.Tracing.Tempo.Image }} repository: {{ .Modules.Observability.Tracing.Tempo.Image }}
tag: "{{ .Modules.Observability.Tracing.Tempo.Tag }}" tag: "{{ .Modules.Observability.Tracing.Tempo.Tag }}"
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
@@ -46,7 +35,7 @@
http: http:
endpoint: "0.0.0.0:4318" endpoint: "0.0.0.0:4318"
tempoQuery: tempoQuery:
repository: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Image }} repository: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Image }}
tag: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Tag }} tag: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Tag }}
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
@@ -59,21 +48,21 @@
ingress: ingress:
enabled: false enabled: false
serviceAccount: serviceAccount:
create: true create: true
automountServiceAccountToken: true automountServiceAccountToken: true
service: service:
type: ClusterIP type: ClusterIP
serviceMonitor: serviceMonitor:
enabled: true enabled: true
persistence: persistence:
enabled: true enabled: true
storageClassName: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageClass }} storageClassName: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageClass }}
accessModes: accessModes:
- ReadWriteOnce - ReadWriteOnce
size: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageSize }} size: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageSize }}
priorityClassName: null priorityClassName: null

17
internal/resources/templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl
View File

@@ -1,17 +1,6 @@
- name: harbor-certificate-generator issuer_email: {{ .Modules.Additional.CertManager.AccountEmail }}
namespace: {{ .Modules.Registry.Namespace }} solver_ingress_class: {{ .Modules.Additional.Ingress.Type }}
create_namespace: true
chart_ref: {{ .Modules.Registry.Tls.CertificateGenerator.ChartRef }}
chart_version: {{ .Modules.Registry.Tls.CertificateGenerator.ChartVersion }}
{{- if and .Modules.Registry.Enabled (eq .Modules.Registry.Expose.Type "ingress") }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
issuer_email: {{ .Modules.Additional.CertManager.AccountEmail }}
solver_ingress_class: {{ .Modules.Additional.Ingress.Type }}
certificates: certificates:
- name: harbor-tls - name: harbor-tls
domain: {{ .Modules.Registry.Expose.Domain }} domain: {{ .Modules.Registry.Expose.Domain }}

43
internal/resources/templates/helm-apps/releases/registry/harbor.yml.tmpl
View File

@@ -1,15 +1,4 @@
- name: harbor expose:
namespace: {{ .Modules.Registry.Namespace }}
create_namespace: true
chart_ref: {{ .Modules.Registry.ChartRef }}
chart_version: {{ .Modules.Registry.ChartVersion }}
{{- if .Modules.Registry.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
expose:
type: {{ .Modules.Registry.Expose.Type }} type: {{ .Modules.Registry.Expose.Type }}
tls: tls:
enabled: {{ .Modules.Registry.Tls.Enabled }} enabled: {{ .Modules.Registry.Tls.Enabled }}
@@ -41,8 +30,8 @@
port: 443 port: 443
nodePort: {{ .Modules.Registry.Expose.NodePortHttps }} nodePort: {{ .Modules.Registry.Expose.NodePortHttps }}
externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain }}{{ if not (eq .Modules.Registry.Expose.Path "/") }}{{ .Modules.Registry.Expose.Path }}{{ end }} externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain }}{{ if not (eq .Modules.Registry.Expose.Path "/") }}{{ .Modules.Registry.Expose.Path }}{{ end }}
persistence: persistence:
resourcePolicy: "keep" resourcePolicy: "keep"
persistentVolumeClaim: persistentVolumeClaim:
registry: registry:
@@ -90,16 +79,16 @@
rootdirectory: /storage rootdirectory: /storage
#maxthreads: 100 #maxthreads: 100
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
updateStrategy: updateStrategy:
type: RollingUpdate type: RollingUpdate
harborAdminPassword: "{{ .Modules.Registry.AdminPassword }}" harborAdminPassword: "{{ .Modules.Registry.AdminPassword }}"
logLevel: info logLevel: info
metrics: metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
core: core:
path: /metrics path: /metrics
@@ -117,7 +106,7 @@
serviceMonitor: serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
trace: trace:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }} enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
provider: otel provider: otel
sample_rate: 1 sample_rate: 1
@@ -132,7 +121,7 @@
insecure: true insecure: true
timeout: 10 timeout: 10
portal: portal:
image: image:
repository: {{ .Modules.Registry.Portal.Image }} repository: {{ .Modules.Registry.Portal.Image }}
tag: {{ .Modules.Registry.Portal.Tag }} tag: {{ .Modules.Registry.Portal.Tag }}
@@ -147,7 +136,7 @@
"app.kubernetes.io/component": "harbor-portal" "app.kubernetes.io/component": "harbor-portal"
priorityClassName: priorityClassName:
core: core:
image: image:
repository: {{ .Modules.Registry.Core.Image }} repository: {{ .Modules.Registry.Core.Image }}
tag: {{ .Modules.Registry.Portal.Tag }} tag: {{ .Modules.Registry.Portal.Tag }}
@@ -185,7 +174,7 @@
auditLogsCompliant: false auditLogsCompliant: false
jobservice: jobservice:
image: image:
repository: {{ .Modules.Registry.Jobservice.Image }} repository: {{ .Modules.Registry.Jobservice.Image }}
tag: {{ .Modules.Registry.Jobservice.Tag }} tag: {{ .Modules.Registry.Jobservice.Tag }}
@@ -213,7 +202,7 @@
existingSecret: "" existingSecret: ""
existingSecretKey: JOBSERVICE_SECRET existingSecretKey: JOBSERVICE_SECRET
registry: registry:
registry: registry:
image: image:
repository: {{ .Modules.Registry.Registry.Registry.Image }} repository: {{ .Modules.Registry.Registry.Registry.Image }}
@@ -262,7 +251,7 @@
interval: 24h interval: 24h
dryrun: false dryrun: false
trivy: trivy:
enabled: {{ .Modules.Registry.EnabledScanner }} enabled: {{ .Modules.Registry.EnabledScanner }}
image: image:
repository: {{ .Modules.Registry.Trivy.Image }} repository: {{ .Modules.Registry.Trivy.Image }}
@@ -278,7 +267,7 @@
memory: 1Gi memory: 1Gi
database: database:
# if external database is used, set "type" to "external" # if external database is used, set "type" to "external"
# and fill the connection information in "external" section # and fill the connection information in "external" section
type: internal type: internal
@@ -339,7 +328,7 @@
podLabels: {} podLabels: {}
redis: redis:
type: internal type: internal
internal: internal:
image: image:

27
internal/resources/templates/helm-apps/releases/secrets-storage/vault.yml.tmpl
View File

@@ -1,15 +1,4 @@
- name: vault global:
namespace: secrets-storage
create_namespace: true
chart_ref: {{ .Modules.SecretsStorage.ChartRef }}
chart_version: {{ .Modules.SecretsStorage.ChartVersion }}
{{- if .Modules.SecretsStorage.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
global:
enabled: true enabled: true
imagePullSecrets: [] imagePullSecrets: []
@@ -35,7 +24,7 @@
# See the top level serverTelemetry section below before enabling this feature. # See the top level serverTelemetry section below before enabling this feature.
prometheusOperator: false prometheusOperator: false
injector: injector:
enabled: true enabled: true
replicas: 1 replicas: 1
@@ -282,7 +271,7 @@
# maxUnavailable: 25% # maxUnavailable: 25%
# type: RollingUpdate # type: RollingUpdate
server: server:
enabled: true enabled: true
enterpriseLicense: enterpriseLicense:
# The name of the Kubernetes secret that holds the enterprise license. The # The name of the Kubernetes secret that holds the enterprise license. The
@@ -706,8 +695,8 @@
hostNetwork: false hostNetwork: false
# Vault UI # Vault UI
ui: ui:
enabled: true enabled: true
domain: {{ .Modules.SecretsStorage.Expose.Domain }} domain: {{ .Modules.SecretsStorage.Expose.Domain }}
path: {{ .Modules.SecretsStorage.Expose.Path }} path: {{ .Modules.SecretsStorage.Expose.Path }}
@@ -738,7 +727,7 @@
annotations: {} annotations: {}
csi: csi:
# True if you want to install a secrets-store-csi-driver-provider-vault daemonset. # True if you want to install a secrets-store-csi-driver-provider-vault daemonset.
# #
# Requires installing the secrets-store-csi-driver separately, see: # Requires installing the secrets-store-csi-driver separately, see:
@@ -833,7 +822,7 @@
debug: false debug: false
extraArgs: [] extraArgs: []
serverTelemetry: serverTelemetry:
# Enable support for the Prometheus Operator. Currently, this chart does not support # Enable support for the Prometheus Operator. Currently, this chart does not support
# authenticating to Vault's metrics endpoint, so the following `telemetry{}` must be included # authenticating to Vault's metrics endpoint, so the following `telemetry{}` must be included
# in the `listener "tcp"{}` stanza # in the `listener "tcp"{}` stanza
@@ -863,7 +852,7 @@
selectors: {} selectors: {}
rules: [] rules: []
ingress: ingress:
{{- if eq .Modules.SecretsStorage.Expose.Type "ingress" }} {{- if eq .Modules.SecretsStorage.Expose.Type "ingress" }}
enabled: true enabled: true
{{- end }} {{- end }}

5
internal/resources/templates/helm-apps/repositories/repositories.yml.tmpl
View File

@@ -1,5 +0,0 @@
- name: kube-forge
url: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable"
{{ if .Modules.AdditionalRepositories }}
{{ .Modules.AdditionalRepositories | toYaml }}
{{- end }}

10
internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl
View File

@@ -232,13 +232,3 @@ argocd_enabled: false
# The plugin manager for kubectl # The plugin manager for kubectl
krew_enabled: false krew_enabled: false
krew_root_dir: "/usr/local/krew" krew_root_dir: "/usr/local/krew"
########################################
# Helm apps configuration
########################################
repositories:
{{- .Repositories | nindent 2 }}
releases:
{{- .Releases | nindent 2 }}

23
internal/secrets_storage/commands.go
View File

@@ -4,44 +4,45 @@ import (
"fmt" "fmt"
"kube-forge/internal/config" "kube-forge/internal/config"
"kube-forge/internal/kubernetes_client" "kube-forge/internal/kubernetes_client"
"kube-forge/internal/logging"
"kube-forge/internal/templates" "kube-forge/internal/templates"
"regexp" "regexp"
"strings" "strings"
) )
func InitVault() { func initVault() {
_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage") _, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
if err != nil { if err != nil {
fmt.Println(err.Error()) logging.Log.Error(err.Error())
return return
} }
err = commandToInitVault() err = commandToInitVault()
if err != nil { if err != nil {
fmt.Println(err.Error()) logging.Log.Warn(err.Error())
return return
} }
fmt.Println("Vault initialized") logging.Log.Info("Vault initialized")
templates.ApplyVaultInitKeysTemplate() templates.ApplyVaultInitKeysTemplate()
} }
func AddKubernetesLocalIntegration() { func addKubernetesLocalIntegration() {
_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage") _, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
if err != nil { if err != nil {
fmt.Println(err.Error()) logging.Log.Error(err.Error())
return return
} }
err = commandToAddKubernetesLocalIntegration() err = commandToAddKubernetesLocalIntegration()
if err != nil { if err != nil {
fmt.Println(err.Error()) logging.Log.Error(err.Error())
return return
} }
fmt.Println("Vault local Kubernetes integration added") logging.Log.Info("Vault local Kubernetes integration added")
} }
func UnsealVault() { func unsealVault() {
_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage") _, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
if err != nil { if err != nil {
fmt.Println(err.Error()) logging.Log.Error(err.Error())
return return
} }
commandToUnsealVault() commandToUnsealVault()
@@ -92,7 +93,7 @@ func commandToUnsealVault() {
commandArray, "secrets-storage", "vault-0", "vault", commandArray, "secrets-storage", "vault-0", "vault",
) )
} }
fmt.Println("Vault unsealed") logging.Log.Info("Vault unsealed")
} }
func commandToAddKubernetesLocalIntegration() error { func commandToAddKubernetesLocalIntegration() error {

44
internal/secrets_storage/helm.go Normal file
View File

@@ -0,0 +1,44 @@
package secrets_storage
import (
"kube-forge/internal/config"
"kube-forge/internal/helm_client"
"kube-forge/internal/templates"
"time"
go_helm_client "github.com/mittwald/go-helm-client"
)
var HELM_REPOS = []config.RepoSettings{
{
Name: "kube-forge",
URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
},
}
func getVaultSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "vault",
ChartName: appConfig.Modules.SecretsStorage.ChartRef,
Version: appConfig.Modules.SecretsStorage.ChartVersion,
Namespace: appConfig.Modules.SecretsStorage.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/secrets-storage/vault.yml.tmpl"),
}
}
func ApplyCharts() {
appConfig := config.GetConfig()
helm_client.AddHelmRepos(appConfig.Modules.SecretsStorage.Namespace, HELM_REPOS)
if appConfig.Modules.SecretsStorage.Enabled {
helm_client.InstallChart(getVaultSpec())
initVault()
unsealVault()
addKubernetesLocalIntegration()
} else {
helm_client.DeleteChart(getVaultSpec())
}
}

12
internal/templates/helm.go Normal file
View File

@@ -0,0 +1,12 @@
package templates
import (
"kube-forge/internal/config"
"kube-forge/internal/resources"
)
func GetHelmValuesByTemplate(templateFile string) string {
cfg := config.GetConfig()
template := getTemplateFromEmbedFSFolder(resources.Templates, templateFile)
return executeTemplateToString(template, cfg)
}

46
internal/templates/helm_apps.go
View File

@@ -1,46 +0,0 @@
package templates
import (
"kube-forge/internal/config"
"kube-forge/internal/resources"
"strings"
)
var HELM_APPS_TEMPLATES = [...]string{
"templates/helm-apps/releases/additional-modules/docker-secrets-generator.yml.tmpl",
"templates/helm-apps/releases/additional-modules/longhorn.yml.tmpl",
"templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl",
"templates/helm-apps/releases/additional-modules/ingress-nginx.yml.tmpl",
"templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl",
"templates/helm-apps/releases/observability/fluent-operator.yml.tmpl",
"templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl",
"templates/helm-apps/releases/observability/metrics-server.yml.tmpl",
"templates/helm-apps/releases/observability/tempo.yml.tmpl",
"templates/helm-apps/releases/observability/loki.yml.tmpl",
"templates/helm-apps/releases/observability/observability.yml.tmpl",
"templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl",
"templates/helm-apps/releases/registry/harbor.yml.tmpl",
"templates/helm-apps/releases/cicd/argo-cd.yml.tmpl",
"templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl",
"templates/helm-apps/releases/cicd/keel.yml.tmpl",
"templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl",
"templates/helm-apps/releases/secrets-storage/vault.yml.tmpl",
}
var HELM_REPOSITORIES_TEMPLATES = [...]string{
"templates/helm-apps/repositories/repositories.yml.tmpl",
}
func GetHelmAppsConfigData() (string, string) {
cfg := config.GetConfig()
helmAppsTemplateResults := []string{}
for _, templateFile := range HELM_APPS_TEMPLATES {
template := getTemplateFromEmbedFSFolder(resources.Templates, templateFile)
helmAppsTemplateResults = append(helmAppsTemplateResults, executeTemplateToString(template, cfg))
}
repositoriesTemplateResults := []string{}
for _, templateFile := range HELM_REPOSITORIES_TEMPLATES {
template := getTemplateFromEmbedFSFolder(resources.Templates, templateFile)
repositoriesTemplateResults = append(repositoriesTemplateResults, executeTemplateToString(template, cfg))
}
return strings.Join(repositoriesTemplateResults, "\n"), strings.Join(helmAppsTemplateResults, "\n")
}

6064
kubespray/inventory/group_vars/k8s_cluster/addons.yml
View File

File diff suppressed because it is too large Load Diff

2
kubespray/project/cluster.yml
View File

@@ -90,7 +90,7 @@
- { role: kubernetes-apps/ingress_controller, tags: ingress-controller } - { role: kubernetes-apps/ingress_controller, tags: ingress-controller }
- { role: kubernetes-apps/external_provisioner, tags: external-provisioner } - { role: kubernetes-apps/external_provisioner, tags: external-provisioner }
- { role: kubernetes-apps, tags: apps } - { role: kubernetes-apps, tags: apps }
- { role: helm-apps, tags: helm-apps } # - { role: helm-apps, tags: helm-apps }
- name: Apply resolv.conf changes now that cluster DNS is up - name: Apply resolv.conf changes now that cluster DNS is up
hosts: k8s_cluster hosts: k8s_cluster