Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Simplify install #466

Merged
merged 3 commits into from
Oct 18, 2021
Merged

Simplify install #466

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8195f6d
update engine chart
mxyng Oct 14, 2021
c88c9f2
update registry chart
mxyng Oct 15, 2021
fae0f02
add back impersonate users/groups, list pods
mxyng Oct 15, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 62 additions & 0 deletions helm/charts/engine/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
{{/*
Expand the name of the chart.
*/}}
{{- define "engine.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "engine.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}

{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "engine.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}

{{/*
Common labels
*/}}
{{- define "engine.labels" -}}
helm.sh/chart: {{ include "engine.chart" . }}
{{ include "engine.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}

{{/*
Selector labels
*/}}
{{- define "engine.selectorLabels" -}}
app.kubernetes.io/name: {{ include "engine.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}

{{/*
Create the name of the service account to use
*/}}
{{- define "engine.serviceAccountName" -}}
{{- if .Values.serviceAccount.create }}
{{- default (include "engine.fullname" .) .Values.serviceAccount.name }}
{{- else }}
{{- default "default" .Values.serviceAccount.name }}
{{- end }}
{{- end }}
22 changes: 3 additions & 19 deletions helm/charts/engine/templates/clusterrole.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,9 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: infra-engine
name: {{ include "engine.fullname" . }}
labels:
{{- include "engine.labels" . | nindent 4 }}
rules:
- apiGroups: [""]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a nice cleanup

I do think we need:

  • impersonate – users & groups
  • list – pods

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we still need services and pods too:

services, err := clientset.CoreV1().Services(namespace).List(context.TODO(), metav1.ListOptions{
    LabelSelector: "app.kubernetes.io/instance=infra-engine",
})

componentPods, err := clientset.CoreV1().Pods("kube-system").List(context.TODO(), metav1.ListOptions{
    LabelSelector: "component=kube-controller-manager",
})

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep! Add list - services to that list

Copy link
Collaborator Author

@mxyng mxyng Oct 15, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

services list is still part of the role; only services get was removed. Will add back users|groups impersonate and pods list

resources:
Expand All @@ -17,24 +19,6 @@ rules:
- apiGroups: [""]
resources:
- services
resourceNames:
- kubernetes
verbs:
- get
- apiGroups: [""]
resources:
- services
verbs:
- list
- apiGroups:
- networking.k8s.io
resources:
- ingresses
verbs:
- list
- apiGroups: [""]
resources:
- namespaces
verbs:
- list
- apiGroups:
Expand Down
12 changes: 7 additions & 5 deletions helm/charts/engine/templates/clusterrolebinding.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,14 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: infra-engine
name: {{ include "engine.fullname" . }}
labels:
{{- include "engine.labels" . | nindent 4 }}
subjects:
- kind: ServiceAccount
name: infra-engine
namespace: {{ .Release.Namespace }}
- kind: ServiceAccount
name: {{ include "engine.fullname" . }}
namespace: {{ .Release.Namespace }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: infra-engine
name: {{ include "engine.fullname" . }}
18 changes: 11 additions & 7 deletions helm/charts/engine/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,28 +1,32 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: infra-engine
namespace: {{ .Release.Namespace }}
name: {{ include "engine.fullname" . }}
labels:
{{- include "engine.labels" . | nindent 4 }}
spec:
selector:
matchLabels:
app: infra-engine
{{- include "engine.selectorLabels" . | nindent 6 }}
replicas: 1
template:
metadata:
labels:
app: infra-engine
{{- include "engine.selectorLabels" . | nindent 8 }}
{{- with .Values.pod.annotations }}
annotations:
rollme: {{ randAlphaNum 5 | quote }}
{{- toYaml . | nindent 8 }}
{{- end }}
spec:
automountServiceAccountToken: true
serviceAccountName: infra-engine
serviceAccountName: {{ include "engine.serviceAccountName" . }}
dnsPolicy: ClusterFirst
{{- with .Values.image.pullSecrets }}
imagePullSecrets:
{{- range . }}
{{- range . }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end }}
containers:
- name: engine
Expand Down
10 changes: 0 additions & 10 deletions helm/charts/engine/templates/role.yaml
View file
Open in desktop

This file was deleted.

6 changes: 3 additions & 3 deletions helm/charts/engine/templates/secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
apiVersion: v1
kind: Secret
metadata:
name: infra-engine
namespace: {{ .Release.Namespace }}
name: {{ include "engine.fullname" . }}
labels:
{{- include "engine.labels" . | nindent 4 }}
type: Opaque
data:
api-key: {{ .Values.apiKey | b64enc | quote }}
api-key: {{ .Values.apiKey | b64enc | quote }}
7 changes: 3 additions & 4 deletions helm/charts/engine/templates/service.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,9 @@
apiVersion: v1
kind: Service
metadata:
name: infra-engine
namespace: {{ .Release.Namespace }}
name: {{ include "engine.fullname" . }}
labels:
app: infra-engine
{{- include "engine.labels" . | nindent 4 }}
{{- with .Values.service.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
Expand Down Expand Up @@ -47,4 +46,4 @@ spec:
{{- end }}
{{- end }}
selector:
app: infra-engine
{{- include "engine.selectorLabels" . | nindent 6 }}
11 changes: 9 additions & 2 deletions helm/charts/engine/templates/serviceaccount.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,12 @@
{{- if .Values.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: infra-engine
namespace: {{ .Release.Namespace }}
name: {{ include "engine.fullname" . }}
labels:
{{- include "engine.labels" . | nindent 4 }}
{{- with .Values.serviceAccount.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}
7 changes: 7 additions & 0 deletions helm/charts/engine/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,13 @@ name: ""
registry: ""
apiKey: ""

pod:
annotations: {}

serviceAccount:
create: true
annotations: {}

image:
repository: infrahq/infra
tag: ""
Expand Down
62 changes: 62 additions & 0 deletions helm/charts/registry/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
{{/*
Expand the name of the chart.
*/}}
{{- define "registry.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "registry.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}

{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "registry.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}

{{/*
Common labels
*/}}
{{- define "registry.labels" -}}
helm.sh/chart: {{ include "registry.chart" . }}
{{ include "registry.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}

{{/*
Selector labels
*/}}
{{- define "registry.selectorLabels" -}}
app.kubernetes.io/name: {{ include "registry.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}

{{/*
Create the name of the service account to use
*/}}
{{- define "registry.serviceAccountName" -}}
{{- if .Values.serviceAccount.create }}
{{- default (include "registry.fullname" .) .Values.serviceAccount.name }}
{{- else }}
{{- default "default" .Values.serviceAccount.name }}
{{- end }}
{{- end }}
5 changes: 3 additions & 2 deletions helm/charts/registry/templates/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,9 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: infra-registry
namespace: {{ .Release.Namespace }}
name: {{ include "registry.fullname" . }}
labels:
{{- include "registry.labels" . | nindent 4 }}
data:
{{- if kindIs "map" .Values.config }}
infra.yaml: |
Expand Down
18 changes: 11 additions & 7 deletions helm/charts/registry/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,28 +1,32 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: infra-registry
namespace: {{ .Release.Namespace }}
name: {{ include "registry.fullname" . }}
labels:
{{- include "registry.labels" . | nindent 4 }}
spec:
selector:
matchLabels:
app: infra-registry
{{- include "registry.selectorLabels" . | nindent 6 }}
replicas: 1
template:
metadata:
labels:
app: infra-registry
{{- include "registry.selectorLabels" . | nindent 8 }}
{{- with .Values.pod.annotations }}
annotations:
rollme: {{ randAlphaNum 5 | quote }}
{{- toYaml . | nindent 8 }}
{{- end }}
spec:
automountServiceAccountToken: true
serviceAccountName: infra-registry
serviceAccountName: {{ include "registry.serviceAccountName" . }}
dnsPolicy: ClusterFirst
{{- with .Values.image.pullSecrets }}
imagePullSecrets:
{{- range . }}
{{- range . }}
- name: {{ . }}
{{- end }}
{{- end }}
{{- end }}
containers:
- name: registry
Expand Down
5 changes: 2 additions & 3 deletions helm/charts/registry/templates/ingress.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,9 @@
apiVersion: {{ $apiVersion }}
kind: Ingress
metadata:
name: infra-registry
namespace: {{ .Release.Namespace }}
name: {{ include "registry.fullname" . }}
labels:
app: infra-registry
{{- include "registry.labels" . | nindent 4 }}
{{- with .Values.ingress.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
Expand Down
5 changes: 3 additions & 2 deletions helm/charts/registry/templates/pvc.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,9 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: infra-registry
namespace: {{ .Release.Namespace }}
name: {{ include "registry.fullname" . }}
labels:
{{- include "registry.labels" . | nindent 4 }}
spec:
accessModes:
- ReadWriteOnce
Expand Down
5 changes: 3 additions & 2 deletions helm/charts/registry/templates/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,9 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: infra-registry-secret-reader
namespace: {{ .Release.Namespace }}
name: {{ include "registry.fullname" . }}
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we be more descriptive in the name of this role still?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that depends on if we expect to add more roles for the registry. IMO keeping it simple and consistent produces the best experience for the user, i.e. if they want to know what permission infra-registry has, they can get the role without first looking up what the role is called.

labels:
{{- include "registry.labels" . | nindent 4 }}
rules:
- apiGroups: [""]
resources: ["secrets"]
Expand Down
Loading