storytold/irsa-manager
2
0
Fork 0
mirror of https://github.com/storytold/irsa-manager.git synced 2026-10-21 07:45:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

autogenerate- docs, helm charts

Browse Source
This commit is contained in:
kkb0318
2024-04-05 20:45:27 +09:00
parent 2e1a36edeb
commit f01fcd85e9
18 changed files with 757 additions and 168 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/irsa-manager/.helmignore
+23
View File
@@ -0,0 +1,23 @@
# Patterns to ignore when building packages.
# This supports shell glob matching, relative path matching, and
# negation (prefixed with !). Only one pattern per line.
.DS_Store
# Common VCS dirs
.git/
.gitignore
.bzr/
.bzrignore
.hg/
.hgignore
.svn/
# Common backup files
*.swp
*.bak
*.tmp
*.orig
*~
# Various IDEs
.project
.idea/
*.tmproj
.vscode/
charts/irsa-manager/Chart.yaml
+21
View File
@@ -0,0 +1,21 @@
apiVersion: v2
name: irsa-manager
description: A Helm chart for Kubernetes
# A chart can be either an 'application' or a 'library' chart.
#
# Application charts are a collection of templates that can be packaged into versioned archives
# to be deployed.
#
# Library charts provide useful utilities or functions for the chart developer. They're included as
# a dependency of application charts to inject those utilities and functions into the rendering
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
type: application
# This is the chart version. This version number should be incremented each time you make changes
# to the chart and its templates, including the app version.
# Versions are expected to follow Semantic Versioning (https://semver.org/)
version: 0.1.0
# This is the version number of the application being deployed. This version number should be
# incremented each time you make changes to the application. Versions are not expected to
# follow Semantic Versioning. They should reflect the version the application is using.
# It is recommended to use it with quotes.
appVersion: "0.1.0"
charts/irsa-manager/README.md
+42
View File
@@ -0,0 +1,42 @@
# irsa-manager
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.1.0](https://img.shields.io/badge/AppVersion-0.1.0-informational?style=flat-square)
A Helm chart for Kubernetes
## Values
| Key | Type | Default | Description |
|-----|------|---------|-------------|
| controllerManager.kubeRbacProxy.args[0] | string | `"--secure-listen-address=0.0.0.0:8443"` | |
| controllerManager.kubeRbacProxy.args[1] | string | `"--upstream=http://127.0.0.1:8080/"` | |
| controllerManager.kubeRbacProxy.args[2] | string | `"--logtostderr=true"` | |
| controllerManager.kubeRbacProxy.args[3] | string | `"--v=0"` | |
| controllerManager.kubeRbacProxy.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | |
| controllerManager.kubeRbacProxy.containerSecurityContext.capabilities.drop[0] | string | `"ALL"` | |
| controllerManager.kubeRbacProxy.image.repository | string | `"gcr.io/kubebuilder/kube-rbac-proxy"` | |
| controllerManager.kubeRbacProxy.image.tag | string | `"v0.15.0"` | |
| controllerManager.kubeRbacProxy.resources.limits.cpu | string | `"500m"` | |
| controllerManager.kubeRbacProxy.resources.limits.memory | string | `"128Mi"` | |
| controllerManager.kubeRbacProxy.resources.requests.cpu | string | `"5m"` | |
| controllerManager.kubeRbacProxy.resources.requests.memory | string | `"64Mi"` | |
| controllerManager.manager.args[0] | string | `"--health-probe-bind-address=:8081"` | |
| controllerManager.manager.args[1] | string | `"--metrics-bind-address=127.0.0.1:8080"` | |
| controllerManager.manager.args[2] | string | `"--leader-elect"` | |
| controllerManager.manager.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | |
| controllerManager.manager.containerSecurityContext.capabilities.drop[0] | string | `"ALL"` | |
| controllerManager.manager.image.repository | string | `"controller"` | |
| controllerManager.manager.image.tag | string | `"latest"` | |
| controllerManager.manager.resources.limits.cpu | string | `"500m"` | |
| controllerManager.manager.resources.limits.memory | string | `"128Mi"` | |
| controllerManager.manager.resources.requests.cpu | string | `"10m"` | |
| controllerManager.manager.resources.requests.memory | string | `"64Mi"` | |
| controllerManager.replicas | int | `1` | |
| controllerManager.serviceAccount.annotations | object | `{}` | |
| kubernetesClusterDomain | string | `"cluster.local"` | |
| metricsService.ports[0].name | string | `"https"` | |
| metricsService.ports[0].port | int | `8443` | |
| metricsService.ports[0].protocol | string | `"TCP"` | |
| metricsService.ports[0].targetPort | string | `"https"` | |
| metricsService.type | string | `"ClusterIP"` | |
charts/irsa-manager/crds/irsasetup-crd.yaml
+98
View File
@@ -0,0 +1,98 @@
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.14.0
name: irsasetups.irsa.kkb0318.github.io
spec:
group: irsa.kkb0318.github.io
names:
kind: IRSASetup
listKind: IRSASetupList
plural: irsasetups
singular: irsasetup
scope: Namespaced
versions:
- name: v1alpha1
schema:
openAPIV3Schema:
description: IRSASetup represents a configuration for setting up IAM Roles
for Service Accounts (IRSA) in a Kubernetes cluster.
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
spec:
description: IRSASetupSpec defines the desired state of IRSASetup
properties:
auth:
description: Auth contains authentication configuration details.
properties:
secretRef:
description: SecretRef specifies the reference to the Kubernetes
secret containing authentication details.
properties:
name:
description: Name specifies the name of the secret.
type: string
namespace:
description: Namespace specifies the namespace of the secret.
type: string
required:
- name
type: object
required:
- secretRef
type: object
discovery:
description: |-
Discovery configures the IdP Discovery process, essential for setting up IRSA by locating
the OIDC provider information.
properties:
s3:
description: S3 specifies the AWS S3 bucket details where the
OIDC provider's discovery information is hosted.
properties:
bucketName:
description: BucketName is the name of the S3 bucket that
hosts the OIDC discovery information.
type: string
region:
description: Region denotes the AWS region where the S3 bucket
is located.
type: string
required:
- bucketName
- region
type: object
type: object
mode:
description: Mode specifies the mode of operation. Can be either "selfhosted"
or "eks".
type: string
required:
- discovery
- mode
type: object
status:
description: IRSASetupStatus defines the observed state of IRSASetup
type: object
type: object
served: true
storage: true
subresources:
status: {}
charts/irsa-manager/templates/_helpers.tpl
+62
View File
@@ -0,0 +1,62 @@
{{/*
Expand the name of the chart.
*/}}
{{- define "irsa-manager.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "irsa-manager.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "irsa-manager.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Common labels
*/}}
{{- define "irsa-manager.labels" -}}
helm.sh/chart: {{ include "irsa-manager.chart" . }}
{{ include "irsa-manager.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}
{{/*
Selector labels
*/}}
{{- define "irsa-manager.selectorLabels" -}}
app.kubernetes.io/name: {{ include "irsa-manager.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}
{{/*
Create the name of the service account to use
*/}}
{{- define "irsa-manager.serviceAccountName" -}}
{{- if .Values.serviceAccount.create }}
{{- default (include "irsa-manager.fullname" .) .Values.serviceAccount.name }}
{{- else }}
{{- default "default" .Values.serviceAccount.name }}
{{- end }}
{{- end }}
charts/irsa-manager/templates/deployment.yaml
+69
View File
@@ -0,0 +1,69 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "irsa-manager.fullname" . }}-controller-manager
labels:
app.kubernetes.io/component: manager
app.kubernetes.io/created-by: irsa-manager
app.kubernetes.io/part-of: irsa-manager
control-plane: controller-manager
{{- include "irsa-manager.labels" . | nindent 4 }}
spec:
replicas: {{ .Values.controllerManager.replicas }}
selector:
matchLabels:
control-plane: controller-manager
{{- include "irsa-manager.selectorLabels" . | nindent 6 }}
template:
metadata:
labels:
control-plane: controller-manager
{{- include "irsa-manager.selectorLabels" . | nindent 8 }}
annotations:
kubectl.kubernetes.io/default-container: manager
spec:
containers:
- args: {{- toYaml .Values.controllerManager.kubeRbacProxy.args | nindent 8 }}
env:
- name: KUBERNETES_CLUSTER_DOMAIN
value: {{ quote .Values.kubernetesClusterDomain }}
image: {{ .Values.controllerManager.kubeRbacProxy.image.repository }}:{{ .Values.controllerManager.kubeRbacProxy.image.tag
| default .Chart.AppVersion }}
name: kube-rbac-proxy
ports:
- containerPort: 8443
name: https
protocol: TCP
resources: {{- toYaml .Values.controllerManager.kubeRbacProxy.resources | nindent
10 }}
securityContext: {{- toYaml .Values.controllerManager.kubeRbacProxy.containerSecurityContext
| nindent 10 }}
- args: {{- toYaml .Values.controllerManager.manager.args | nindent 8 }}
command:
- /manager
env:
- name: KUBERNETES_CLUSTER_DOMAIN
value: {{ quote .Values.kubernetesClusterDomain }}
image: {{ .Values.controllerManager.manager.image.repository }}:{{ .Values.controllerManager.manager.image.tag
| default .Chart.AppVersion }}
livenessProbe:
httpGet:
path: /healthz
port: 8081
initialDelaySeconds: 15
periodSeconds: 20
name: manager
readinessProbe:
httpGet:
path: /readyz
port: 8081
initialDelaySeconds: 5
periodSeconds: 10
resources: {{- toYaml .Values.controllerManager.manager.resources | nindent 10
}}
securityContext: {{- toYaml .Values.controllerManager.manager.containerSecurityContext
| nindent 10 }}
securityContext:
runAsNonRoot: true
serviceAccountName: {{ include "irsa-manager.fullname" . }}-controller-manager
terminationGracePeriodSeconds: 10
charts/irsa-manager/templates/leader-election-rbac.yaml
+59
View File
@@ -0,0 +1,59 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ include "irsa-manager.fullname" . }}-leader-election-role
labels:
app.kubernetes.io/component: rbac
app.kubernetes.io/created-by: irsa-manager
app.kubernetes.io/part-of: irsa-manager
{{- include "irsa-manager.labels" . | nindent 4 }}
rules:
- apiGroups:
- ""
resources:
- configmaps
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- ""
resources:
- events
verbs:
- create
- patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ include "irsa-manager.fullname" . }}-leader-election-rolebinding
labels:
app.kubernetes.io/component: rbac
app.kubernetes.io/created-by: irsa-manager
app.kubernetes.io/part-of: irsa-manager
{{- include "irsa-manager.labels" . | nindent 4 }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: '{{ include "irsa-manager.fullname" . }}-leader-election-role'
subjects:
- kind: ServiceAccount
name: '{{ include "irsa-manager.fullname" . }}-controller-manager'
namespace: '{{ .Release.Namespace }}'
charts/irsa-manager/templates/manager-rbac.yaml
+51
View File
@@ -0,0 +1,51 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ include "irsa-manager.fullname" . }}-manager-role
labels:
{{- include "irsa-manager.labels" . | nindent 4 }}
rules:
- apiGroups:
- irsa.kkb0318.github.io
resources:
- irsasetups
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- irsa.kkb0318.github.io
resources:
- irsasetups/finalizers
verbs:
- update
- apiGroups:
- irsa.kkb0318.github.io
resources:
- irsasetups/status
verbs:
- get
- patch
- update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: {{ include "irsa-manager.fullname" . }}-manager-rolebinding
labels:
app.kubernetes.io/component: rbac
app.kubernetes.io/created-by: irsa-manager
app.kubernetes.io/part-of: irsa-manager
{{- include "irsa-manager.labels" . | nindent 4 }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: '{{ include "irsa-manager.fullname" . }}-manager-role'
subjects:
- kind: ServiceAccount
name: '{{ include "irsa-manager.fullname" . }}-controller-manager'
namespace: '{{ .Release.Namespace }}'
charts/irsa-manager/templates/metrics-reader-rbac.yaml
+14
View File
@@ -0,0 +1,14 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ include "irsa-manager.fullname" . }}-metrics-reader
labels:
app.kubernetes.io/component: kube-rbac-proxy
app.kubernetes.io/created-by: irsa-manager
app.kubernetes.io/part-of: irsa-manager
{{- include "irsa-manager.labels" . | nindent 4 }}
rules:
- nonResourceURLs:
- /metrics
verbs:
- get
charts/irsa-manager/templates/metrics-service.yaml
+17
View File
@@ -0,0 +1,17 @@
apiVersion: v1
kind: Service
metadata:
name: {{ include "irsa-manager.fullname" . }}-controller-manager-metrics-service
labels:
app.kubernetes.io/component: kube-rbac-proxy
app.kubernetes.io/created-by: irsa-manager
app.kubernetes.io/part-of: irsa-manager
control-plane: controller-manager
{{- include "irsa-manager.labels" . | nindent 4 }}
spec:
type: {{ .Values.metricsService.type }}
selector:
control-plane: controller-manager
{{- include "irsa-manager.selectorLabels" . | nindent 4 }}
ports:
{{- .Values.metricsService.ports | toYaml | nindent 2 }}
charts/irsa-manager/templates/proxy-rbac.yaml
+40
View File
@@ -0,0 +1,40 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ include "irsa-manager.fullname" . }}-proxy-role
labels:
app.kubernetes.io/component: kube-rbac-proxy
app.kubernetes.io/created-by: irsa-manager
app.kubernetes.io/part-of: irsa-manager
{{- include "irsa-manager.labels" . | nindent 4 }}
rules:
- apiGroups:
- authentication.k8s.io
resources:
- tokenreviews
verbs:
- create
- apiGroups:
- authorization.k8s.io
resources:
- subjectaccessreviews
verbs:
- create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: {{ include "irsa-manager.fullname" . }}-proxy-rolebinding
labels:
app.kubernetes.io/component: kube-rbac-proxy
app.kubernetes.io/created-by: irsa-manager
app.kubernetes.io/part-of: irsa-manager
{{- include "irsa-manager.labels" . | nindent 4 }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: '{{ include "irsa-manager.fullname" . }}-proxy-role'
subjects:
- kind: ServiceAccount
name: '{{ include "irsa-manager.fullname" . }}-controller-manager'
namespace: '{{ .Release.Namespace }}'
charts/irsa-manager/templates/serviceaccount.yaml
+11
View File
@@ -0,0 +1,11 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "irsa-manager.fullname" . }}-controller-manager
labels:
app.kubernetes.io/component: rbac
app.kubernetes.io/created-by: irsa-manager
app.kubernetes.io/part-of: irsa-manager
{{- include "irsa-manager.labels" . | nindent 4 }}
annotations:
{{- toYaml .Values.controllerManager.serviceAccount.annotations | nindent 4 }}
charts/irsa-manager/values.yaml
+53
View File
@@ -0,0 +1,53 @@
controllerManager:
kubeRbacProxy:
args:
- --secure-listen-address=0.0.0.0:8443
- --upstream=http://127.0.0.1:8080/
- --logtostderr=true
- --v=0
containerSecurityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
image:
repository: gcr.io/kubebuilder/kube-rbac-proxy
tag: v0.15.0
resources:
limits:
cpu: 500m
memory: 128Mi
requests:
cpu: 5m
memory: 64Mi
manager:
args:
- --health-probe-bind-address=:8081
- --metrics-bind-address=127.0.0.1:8080
- --leader-elect
containerSecurityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
image:
repository: controller
tag: latest
resources:
limits:
cpu: 500m
memory: 128Mi
requests:
cpu: 10m
memory: 64Mi
replicas: 1
serviceAccount:
annotations: {}
kubernetesClusterDomain: cluster.local
metricsService:
ports:
- name: https
port: 8443
protocol: TCP
targetPort: https
type: ClusterIP