-
Notifications
You must be signed in to change notification settings - Fork 1.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Remove namespace from linkerd2-viz chart (#6638)
* Remove namespace for linkerd2-viz chart Second part of #6584, followup of #6635 (and based off of alpeb/no-ns-helm-core) Stop rendering `namespace.yaml` in the `linkerd-viz` chart, same as we did in #6635. The additional change here is the addition of the `namespace-metadata.yaml` template (and its RBAC), _not_ rendered in CLI installs, which is a Helm `post-install` hook, consisting on a Job that executes a script adding the required annotations and labels to the viz namespace using a PATCH request against kube-api. The script first checks if the namespace doesn't already have an annotations/labels entries, in which case it has to add extra ops in that patch. The Job uses a multiarch `curlimages/curl` image, which is built by curl.haxx.se. I couldn't find a simple multiarch "kubectl" image that would have allowed us issuing simple kubectl commands. The `curlimages/curl` image is based on Alpine; it won't have as much as CVE-related reports noise as a Debian image, but it'd be better to have something slimmer still. Eventually we could build our own scratch-based binary if deemed worthy.
- Loading branch information
Showing
29 changed files
with
379 additions
and
130 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
43 changes: 43 additions & 0 deletions
43
viz/charts/linkerd-viz/templates/namespace-metadata-rbac.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| kind: ServiceAccount | ||
| apiVersion: v1 | ||
| metadata: | ||
| annotations: | ||
| {{ include "partials.annotations.created-by" . }} | ||
| "helm.sh/hook": post-install | ||
| "helm.sh/hook-weight": "0" | ||
| "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded | ||
| name: namespace-metadata | ||
| {{- include "partials.image-pull-secrets" .Values.imagePullSecrets }} | ||
| --- | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: Role | ||
| metadata: | ||
| annotations: | ||
| {{ include "partials.annotations.created-by" . }} | ||
| "helm.sh/hook": post-install | ||
| "helm.sh/hook-weight": "0" | ||
| "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded | ||
| name: namespace-metadata | ||
| rules: | ||
| - apiGroups: [""] | ||
| resources: ["namespaces"] | ||
| verbs: ["get", "patch"] | ||
| resourceNames: ["{{.Release.Namespace}}"] | ||
| --- | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: RoleBinding | ||
| metadata: | ||
| annotations: | ||
| {{ include "partials.annotations.created-by" . }} | ||
| "helm.sh/hook": post-install | ||
| "helm.sh/hook-weight": "0" | ||
| "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded | ||
| name: namespace-metadata | ||
| roleRef: | ||
| kind: Role | ||
| name: namespace-metadata | ||
| apiGroup: rbac.authorization.k8s.io | ||
| subjects: | ||
| - kind: ServiceAccount | ||
| name: namespace-metadata | ||
| namespace: {{.Release.Namespace}} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| apiVersion: batch/v1 | ||
| kind: Job | ||
| metadata: | ||
| annotations: | ||
| {{ include "partials.annotations.created-by" . }} | ||
| "helm.sh/hook": post-install | ||
| "helm.sh/hook-weight": "0" | ||
| "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded | ||
| labels: | ||
| app.kubernetes.io/name: namespace-metadata | ||
| app.kubernetes.io/part-of: Linkerd | ||
| app.kubernetes.io/version: {{default .Values.linkerdVersion .Values.cliVersion}} | ||
| name: namespace-metadata | ||
| spec: | ||
| template: | ||
| metadata: | ||
| annotations: | ||
| {{ include "partials.annotations.created-by" . }} | ||
| labels: | ||
| app.kubernetes.io/name: namespace-metadata | ||
| app.kubernetes.io/part-of: Linkerd | ||
| app.kubernetes.io/version: {{default .Values.linkerdVersion .Values.cliVersion}} | ||
| spec: | ||
| restartPolicy: Never | ||
| serviceAccountName: namespace-metadata | ||
| containers: | ||
| - name: namespace-metadata | ||
| image: curlimages/curl:7.78.0 | ||
| imagePullPolicy: {{.Values.defaultImagePullPolicy}} | ||
| command: ["/bin/sh"] | ||
| args: | ||
| - -c | ||
| - | | ||
| ops='' | ||
| token=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token) | ||
| ns=$(curl -kfv -H "Authorization: Bearer $token" \ | ||
| "https://kubernetes.default.svc/api/v1/namespaces/{{.Release.Namespace}}") | ||
| if echo "$ns" | grep -vq 'labels'; then | ||
| ops="$ops{\"op\": \"add\",\"path\": \"/metadata/labels\",\"value\": {}}," | ||
| fi | ||
| if echo "$ns" | grep -vq 'annotations'; then | ||
| ops="$ops{\"op\": \"add\", \"path\": \"/metadata/annotations\", \"value\": {}}," | ||
| fi | ||
| {{- if .Values.prometheusUrl }} | ||
| ops="$ops{\"op\": \"add\", \"path\": \"/metadata/annotations/viz.linkerd.io~1external-prometheus\", \"value\": \"{{.Values.prometheusUrl}}\"}," | ||
| {{- end }} | ||
| ops="$ops{\"op\": \"add\", \"path\": \"/metadata/labels/linkerd.io~1extension\", \"value\": \"viz\"}" | ||
| curl -kfv -XPATCH -H "Content-Type: application/json-patch+json" -H "Authorization: Bearer $token" \ | ||
| -d "[$ops]" \ | ||
| "https://kubernetes.default.svc/api/v1/namespaces/{{.Release.Namespace}}?fieldManager=kubectl-label" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,18 +1,16 @@ | ||
| {{- if (.Values.installNamespace) -}} | ||
| {{- if eq .Release.Service "CLI" -}} | ||
| --- | ||
| ### | ||
| ### Linkerd Viz Extension Namespace | ||
| ### | ||
| kind: Namespace | ||
| apiVersion: v1 | ||
| metadata: | ||
| name: {{.Values.namespace}} | ||
| name: {{.Release.Namespace}} | ||
| labels: | ||
| linkerd.io/extension: viz | ||
| annotations: | ||
| {{- if .Values.prometheusUrl }} | ||
| viz.linkerd.io/external-prometheus: {{.Values.prometheusUrl}} | ||
| {{- end }} | ||
| linkerd.io/inject: enabled | ||
| config.linkerd.io/proxy-await: "enabled" | ||
| {{ end -}} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.