Public Information
This commit is contained in:
72
charts/envtoolbox/templates/cronjob-nstore.tpl
Normal file
72
charts/envtoolbox/templates/cronjob-nstore.tpl
Normal file
@@ -0,0 +1,72 @@
|
||||
{{- define "nplus.environment.nstorecopy" -}}
|
||||
{{- if (.Values.nstoreDownloader).enabled }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "nplus.instanceLabels" . | nindent 6 }}
|
||||
spec:
|
||||
{{- include "nplus.podSecurityContext" . | nindent 4 }}
|
||||
{{- include "nplus.imagePullSecrets" . | nindent 4 }}
|
||||
containers:
|
||||
- name: downloader
|
||||
image: {{ include "nplus.image" (dict "global" .Values.global "image" .Values.image) }}
|
||||
imagePullPolicy: {{ include "nplus.imagePullPolicy" .Values.image }}
|
||||
{{ include "nplus.containerSecurityContext" . | nindent 6 }}
|
||||
command: [ "/bin/sh", "-c" ]
|
||||
args:
|
||||
- |
|
||||
mkdir -p /conf/{{ .Values.nstoreDownloader.target }}
|
||||
cd /conf/{{ .Values.nstoreDownloader.target }}
|
||||
wget -r -np -nH -nc -nd -A zip -X '*/*/*/*/*/*/1*,*/*/*/*/*/*/2*,*/*/*/*/*/*/3*,*/*/*/*/*/*/4*,*/*/*/*/*/*/5*,*/*/*/*/*/*/6*,*/*/*/*/*/*/7*,*/*/*/*/*/*/8*' -nd {{ .Values.nstoreDownloader.nstore }}
|
||||
volumeMounts:
|
||||
- name: conf
|
||||
mountPath: /conf
|
||||
|
||||
restartPolicy: OnFailure
|
||||
volumes:
|
||||
- name: conf
|
||||
persistentVolumeClaim:
|
||||
claimName: conf
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
---
|
||||
{{- if .Values.nstoreDownloader.enabled }}
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: {{ .component.fullName }}-nstore
|
||||
{{- if .this.utils.includeNamespace }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "nplus.instanceLabels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- include "nplus.annotations" . | nindent 4 }}
|
||||
{{- include "nplus.securityAnnotations" . | nindent 4 }}
|
||||
spec:
|
||||
schedule: "0 3 * * *"
|
||||
concurrencyPolicy: Forbid
|
||||
successfulJobsHistoryLimit: 0
|
||||
failedJobsHistoryLimit: 1
|
||||
jobTemplate:
|
||||
spec:
|
||||
{{- include "nplus.environment.nstorecopy" . | nindent 6 }}
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ .component.fullName }}-nstore-oncreate
|
||||
{{- if .this.utils.includeNamespace }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "nplus.instanceLabels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- include "nplus.annotations" . | nindent 4 }}
|
||||
{{- include "nplus.securityAnnotations" . | nindent 4 }}
|
||||
spec:
|
||||
ttlSecondsAfterFinished: 60
|
||||
{{- include "nplus.environment.nstorecopy" . | nindent 2 }}
|
||||
{{- else }}
|
||||
# nstore Downloader is disabled
|
||||
{{- end }}
|
||||
33
charts/envtoolbox/templates/networkpolicy.tpl
Normal file
33
charts/envtoolbox/templates/networkpolicy.tpl
Normal file
@@ -0,0 +1,33 @@
|
||||
{{- include "nplus.init" $ -}}
|
||||
{{- if ((.this.security).cni).createNetworkPolicy }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: {{ .component.fullName }}
|
||||
{{- if .this.utils.includeNamespace }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- include "nplus.selectorLabels" . | nindent 6 }}
|
||||
|
||||
policyTypes:
|
||||
- Egress
|
||||
- Ingress
|
||||
|
||||
egress:
|
||||
- ports:
|
||||
# -- Possible K8s API
|
||||
- protocol: TCP
|
||||
port: 16443
|
||||
# -- Possible K8s API AND potential git server
|
||||
- protocol: TCP
|
||||
port: 443
|
||||
# -- Access DNS
|
||||
- protocol: TCP
|
||||
port: 53
|
||||
# -- Access DNS
|
||||
- protocol: UDP
|
||||
port: 53
|
||||
{{- end }}
|
||||
2
charts/envtoolbox/templates/pdb.tpl
Normal file
2
charts/envtoolbox/templates/pdb.tpl
Normal file
@@ -0,0 +1,2 @@
|
||||
{{- include "nplus.init" $ -}}
|
||||
{{- include "nplus.podDisruptionBudget" . -}}
|
||||
76
charts/envtoolbox/templates/rbac.tpl
Executable file
76
charts/envtoolbox/templates/rbac.tpl
Executable file
@@ -0,0 +1,76 @@
|
||||
{{- include "nplus.init" $ -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ .component.fullName }}-svc-account
|
||||
{{- if .this.utils.includeNamespace }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "nplus.instanceLabels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- include "nplus.argoSharedResource" . | nindent 4 }}
|
||||
{{- include "nplus.annotations" . | nindent 4 }}
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ .component.fullName }}-role
|
||||
{{- if .this.utils.includeNamespace }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "nplus.instanceLabels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- include "nplus.argoSharedResource" . | nindent 4 }}
|
||||
{{- include "nplus.annotations" . | nindent 4 }}
|
||||
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "secrets","serviceaccounts", "persistentvolumeclaims", "configmaps", "services", "replicationcontrollers", "pods/log"]
|
||||
verbs: ["create", "get", "update", "patch", "delete", "list", "watch"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments", "statefulsets", "daemonsets", "replicasets"]
|
||||
verbs: ["create", "get", "update", "patch", "delete", "list", "watch"]
|
||||
- apiGroups: ["rbac.authorization.k8s.io"]
|
||||
resources: ["Role", "roles", "rolebindings"]
|
||||
verbs: ["create", "get", "update", "patch", "delete", "list", "watch"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs", "cronjobs"]
|
||||
verbs: ["create", "get", "update", "patch", "delete", "list", "watch"]
|
||||
- apiGroups: ["autoscaling"]
|
||||
resources: ["horizontalpodautoscalers"]
|
||||
verbs: ["create", "get", "update", "patch", "delete", "list", "watch"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses"]
|
||||
verbs: ["create", "get", "update", "patch", "delete", "list", "watch"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates"]
|
||||
verbs: ["create", "get", "update", "patch", "delete", "list", "watch"]
|
||||
|
||||
- apiGroups: ["nplus.cloud"]
|
||||
resources: ["components", "instances"]
|
||||
verbs: ["get", "update", "patch", "list", "watch"]
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ .component.fullName }}-role-binding
|
||||
{{- if .this.utils.includeNamespace }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "nplus.instanceLabels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- include "nplus.argoSharedResource" . | nindent 4 }}
|
||||
{{- include "nplus.annotations" . | nindent 4 }}
|
||||
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ .component.fullName }}-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ .component.fullName }}-svc-account
|
||||
125
charts/envtoolbox/templates/statefulset.tpl
Normal file
125
charts/envtoolbox/templates/statefulset.tpl
Normal file
@@ -0,0 +1,125 @@
|
||||
{{- include "nplus.init" $ -}}
|
||||
|
||||
{{- if not ((.this.storage).conf).name -}}
|
||||
{{ fail "conf name must be set" }}
|
||||
{{- end -}}
|
||||
{{- if not ((.this.storage).ptemp).name -}}
|
||||
{{ fail "ptemp name must be set" }}
|
||||
{{- end -}}
|
||||
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ .component.fullName }}
|
||||
{{- if .this.utils.includeNamespace }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "nplus.instanceLabels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- include "nplus.annotations" . | nindent 4 }}
|
||||
{{- include "nplus.securityAnnotations" . | nindent 4 }}
|
||||
|
||||
spec:
|
||||
serviceName: {{ .component.fullName }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "nplus.selectorLabels" . | nindent 6 }}
|
||||
replicas: 1
|
||||
podManagementPolicy: OrderedReady
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
minReadySeconds: 30
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "nplus.templateLabels" . | nindent 8 }}
|
||||
annotations:
|
||||
{{- include "nplus.templateAnnotations" . | nindent 8 }}
|
||||
{{- include "nplus.securityAnnotations" . | nindent 8 }}
|
||||
kubectl.kubernetes.io/default-container: toolbox
|
||||
spec:
|
||||
serviceAccountName: {{ .component.fullName }}-svc-account
|
||||
{{- include "nplus.imagePullSecrets" . | nindent 6 }}
|
||||
{{- include "nplus.podSecurityContext" . | nindent 6 }}
|
||||
{{- include "nplus.securityIllumioReadinessGates" . | nindent 6 }}
|
||||
{{- include "nplus.terminationGracePeriodSeconds" . | nindent 6 }}
|
||||
|
||||
initContainers:
|
||||
{{/*
|
||||
- name: deploy
|
||||
image: {{ .Values.toolboxImage }}
|
||||
imagePullPolicy: {{ .Values.toolboxImagePullPolicy }}
|
||||
{{- include "nplus.containerSecurityContext" . | nindent 8 }}
|
||||
command: [ "/bin/sh", "-c" ]
|
||||
args:
|
||||
- |
|
||||
echo "deploying to /nplus"
|
||||
cp -rnxv /opt/42i/nplus/* /nplus
|
||||
volumeMounts:
|
||||
- name: nplus
|
||||
mountPath: /nplus
|
||||
{{- end }} */}}
|
||||
- name: dirprepare
|
||||
image: {{ include "nplus.image" (dict "global" .Values.global "image" .Values.image) }}
|
||||
imagePullPolicy: {{ include "nplus.imagePullPolicy" .Values.image }}
|
||||
{{- include "nplus.containerSecurityContext" . | nindent 8 }}
|
||||
{{- include "nplus.initResources" . | nindent 8 }}
|
||||
command: [ "/bin/sh", "-c" ]
|
||||
args:
|
||||
- |
|
||||
mkdir -p /conf/pool/{apps,fonts,snippets,scripts,snc} && \
|
||||
{{- if not ((.this.storage).conf).cifs }}
|
||||
chmod 775 -R /conf/pool && \
|
||||
{{- end }}
|
||||
echo "ok."
|
||||
volumeMounts:
|
||||
- name: conf
|
||||
mountPath: /conf
|
||||
- name: gitprepare
|
||||
image: {{ include "nplus.image" (dict "global" .Values.global "image" .Values.image) }}
|
||||
imagePullPolicy: {{ include "nplus.imagePullPolicy" .Values.image }}
|
||||
{{- include "nplus.containerSecurityContext" . | nindent 8 }}
|
||||
{{- include "nplus.initResources" . | nindent 8 }}
|
||||
command: [ "/bin/sh", "-c" ]
|
||||
args:
|
||||
- |
|
||||
echo "checking git in /conf..."
|
||||
if [ ! -f "/conf/.gitignore" ]; then
|
||||
echo "writing .gitignore"
|
||||
echo "/{{ .Values.nstoreDownloader.target }}/*" > /conf/.gitignore
|
||||
fi
|
||||
if [ ! -d "/conf/.git" ]; then
|
||||
echo "init git in /conf with branch master"
|
||||
git -C "/conf" init -b master
|
||||
git -C "/conf" add .gitignore
|
||||
echo "first commit (with .gitignore)"
|
||||
git -C "/conf" commit -m "Initial commit for config of nplus environment {{ .Release.Namespace }}"
|
||||
fi
|
||||
echo "ok."
|
||||
volumeMounts:
|
||||
- name: conf
|
||||
mountPath: /conf
|
||||
containers:
|
||||
- name: toolbox
|
||||
image: {{ include "nplus.image" (dict "global" .Values.global "image" .Values.image) }}
|
||||
imagePullPolicy: {{ include "nplus.imagePullPolicy" .Values.image }}
|
||||
{{- include "nplus.containerSecurityContext" . | nindent 8 }}
|
||||
command: [ "/bin/bash", "-c", "--" ]
|
||||
args: [ "while true; do sleep 30; done;" ]
|
||||
|
||||
volumeMounts:
|
||||
- name: conf
|
||||
mountPath: /conf
|
||||
- name: ptemp
|
||||
mountPath: /ptemp
|
||||
{{- include "nplus.resources" . | nindent 8 }}
|
||||
|
||||
volumes:
|
||||
- name: ptemp
|
||||
persistentVolumeClaim:
|
||||
claimName: ptemp
|
||||
- name: conf
|
||||
persistentVolumeClaim:
|
||||
claimName: conf
|
||||
|
||||
Reference in New Issue
Block a user