From 27a936e60a5777f017ad42840ca13c45a1e43dc9 Mon Sep 17 00:00:00 2001 From: YashasviDevtron Date: Thu, 25 Sep 2025 16:00:12 +0530 Subject: [PATCH 1/7] Adding 0.0.4 chart version of devtron-utilities --- charts/devtron-utilities/Chart.lock | 39 + charts/devtron-utilities/Chart.yaml | 99 +- .../argocd-certificate-refresh/Chart.yaml | 10 + .../argocd-certificate-refresh/README.md | 3 + .../templates/argo-cert-expire-alert-job.yaml | 44 + .../templates/clusterrole.yaml | 22 + .../templates/clusterrolebinding.yaml | 12 + .../templates/cronjob.yaml | 39 + .../templates/serviceaccount.yaml | 7 + .../argocd-certificate-refresh/values.yaml | 45 + .../aws-load-balancer-controller/.helmignore | 25 + .../aws-load-balancer-controller/Chart.yaml | 22 + .../aws-load-balancer-controller/README.md | 283 ++++ .../ci/extra_args | 1 + .../ci/values.yaml | 7 + .../crds/crds.yaml | 684 ++++++++++ .../templates/NOTES.txt | 1 + .../templates/_helpers.tpl | 131 ++ .../templates/deployment.yaml | 263 ++++ .../templates/hpa.yaml | 34 + .../templates/ingressclass.yaml | 41 + .../templates/pdb.yaml | 14 + .../templates/rbac.yaml | 107 ++ .../templates/service.yaml | 41 + .../templates/serviceaccount.yaml | 18 + .../templates/servicemonitor.yaml | 43 + .../templates/webhook.yaml | 250 ++++ .../aws-load-balancer-controller/values.yaml | 436 ++++++ .../aws-node-termination-handler/.helmignore | 23 + .../aws-node-termination-handler/Chart.yaml | 25 + .../aws-node-termination-handler/README.md | 176 +++ .../templates/NOTES.txt | 8 + .../templates/_helpers.tpl | 124 ++ .../templates/clusterrole.yaml | 52 + .../templates/clusterrolebinding.yaml | 16 + .../templates/daemonset.linux.yaml | 210 +++ .../templates/daemonset.windows.yaml | 204 +++ .../templates/deployment.yaml | 211 +++ .../templates/pdb.yaml | 14 + .../templates/podmonitor.yaml | 29 + .../templates/psp.yaml | 70 + .../templates/service.yaml | 18 + .../templates/serviceaccount.yaml | 13 + .../templates/servicemonitor.yaml | 29 + .../aws-node-termination-handler/values.yaml | 295 ++++ .../charts/cluster-autoscaler/.helmignore | 23 + .../charts/cluster-autoscaler/Chart.yaml | 13 + .../charts/cluster-autoscaler/README.md | 527 ++++++++ .../cluster-autoscaler/README.md.gotmpl | 417 ++++++ .../cluster-autoscaler/templates/NOTES.txt | 18 + .../cluster-autoscaler/templates/_helpers.tpl | 160 +++ .../templates/clusterrole.yaml | 175 +++ .../templates/clusterrolebinding.yaml | 16 + .../templates/configmap.yaml | 416 ++++++ .../templates/deployment.yaml | 367 +++++ .../templates/extra-manifests.yaml | 4 + .../cluster-autoscaler/templates/pdb.yaml | 16 + .../templates/podsecuritypolicy.yaml | 42 + .../priority-expander-configmap.yaml | 25 + .../templates/prometheusrule.yaml | 15 + .../cluster-autoscaler/templates/role.yaml | 87 ++ .../templates/rolebinding.yaml | 17 + .../cluster-autoscaler/templates/secret.yaml | 31 + .../cluster-autoscaler/templates/service.yaml | 39 + .../templates/serviceaccount.yaml | 13 + .../templates/servicemonitor.yaml | 36 + .../cluster-autoscaler/templates/vpa.yaml | 20 + .../charts/cluster-autoscaler/values.yaml | 467 +++++++ .../charts/devtron-backups/Chart.yaml | 5 + .../charts/devtron-backups/README.md | 55 + .../devtron-backups/templates/_helpers.tpl | 63 + .../templates/backup-on-azure.yaml | 213 +++ .../templates/backup-on-gcp.yaml | 194 +++ .../templates/backup-on-pvc.yaml | 154 +++ .../templates/backup-on-s3.yaml | 225 ++++ .../templates/serviceaccount.yaml | 51 + .../charts/devtron-backups/values.yaml | 110 ++ .../charts/devtron-generic-helm/Chart.yaml | 8 + .../charts/devtron-generic-helm/README.md | 8 + .../templates/generic.yaml | 4 + .../charts/devtron-generic-helm/values.yaml | 37 + .../charts/holmes/.helmignore | 23 + .../charts/holmes/Chart.yaml | 6 + .../charts/holmes/templates/holmes.yaml | 101 ++ .../templates/holmesgpt-service-account.yaml | 232 ++++ .../holmes/templates/toolset-config.yaml | 10 + .../charts/holmes/values.yaml | 50 + .../charts/ingress-nginx/.helmignore | 23 + .../charts/ingress-nginx/Chart.yaml | 24 + .../charts/ingress-nginx/OWNERS | 4 + .../charts/ingress-nginx/README.md | 564 ++++++++ .../charts/ingress-nginx/README.md.gotmpl | 247 ++++ .../changelog/helm-chart-2.10.0.md | 9 + .../changelog/helm-chart-2.11.0.md | 10 + .../changelog/helm-chart-2.11.1.md | 9 + .../changelog/helm-chart-2.11.2.md | 9 + .../changelog/helm-chart-2.11.3.md | 9 + .../changelog/helm-chart-2.12.0.md | 10 + .../changelog/helm-chart-2.12.1.md | 9 + .../changelog/helm-chart-2.13.0.md | 10 + .../changelog/helm-chart-2.14.0.md | 9 + .../changelog/helm-chart-2.15.0.md | 9 + .../changelog/helm-chart-2.16.0.md | 9 + .../changelog/helm-chart-2.9.0.md | 9 + .../changelog/helm-chart-2.9.1.md | 9 + .../changelog/helm-chart-3.0.0.md | 9 + .../changelog/helm-chart-3.10.0.md | 9 + .../changelog/helm-chart-3.10.1.md | 9 + .../changelog/helm-chart-3.11.0.md | 9 + .../changelog/helm-chart-3.11.1.md | 9 + .../changelog/helm-chart-3.12.0.md | 9 + .../changelog/helm-chart-3.13.0.md | 9 + .../changelog/helm-chart-3.14.0.md | 9 + .../changelog/helm-chart-3.15.0.md | 9 + .../changelog/helm-chart-3.15.1.md | 9 + .../changelog/helm-chart-3.16.0.md | 9 + .../changelog/helm-chart-3.16.1.md | 9 + .../changelog/helm-chart-3.17.0.md | 9 + .../changelog/helm-chart-3.18.0.md | 10 + .../changelog/helm-chart-3.19.0.md | 9 + .../changelog/helm-chart-3.20.0.md | 9 + .../changelog/helm-chart-3.20.1.md | 10 + .../changelog/helm-chart-3.21.0.md | 12 + .../changelog/helm-chart-3.22.0.md | 10 + .../changelog/helm-chart-3.23.0.md | 9 + .../changelog/helm-chart-3.24.0.md | 9 + .../changelog/helm-chart-3.25.0.md | 9 + .../changelog/helm-chart-3.26.0.md | 9 + .../changelog/helm-chart-3.27.0.md | 9 + .../changelog/helm-chart-3.28.0.md | 9 + .../changelog/helm-chart-3.29.0.md | 9 + .../changelog/helm-chart-3.3.0.md | 12 + .../changelog/helm-chart-3.3.1.md | 12 + .../changelog/helm-chart-3.30.0.md | 9 + .../changelog/helm-chart-3.31.0.md | 9 + .../changelog/helm-chart-3.32.0.md | 9 + .../changelog/helm-chart-3.33.0.md | 9 + .../changelog/helm-chart-3.34.0.md | 9 + .../changelog/helm-chart-3.4.0.md | 9 + .../changelog/helm-chart-3.5.0.md | 9 + .../changelog/helm-chart-3.5.1.md | 9 + .../changelog/helm-chart-3.6.0.md | 9 + .../changelog/helm-chart-3.7.0.md | 9 + .../changelog/helm-chart-3.7.1.md | 9 + .../changelog/helm-chart-3.8.0.md | 13 + .../changelog/helm-chart-3.9.0.md | 9 + .../changelog/helm-chart-4.0.1.md | 9 + .../changelog/helm-chart-4.0.10.md | 9 + .../changelog/helm-chart-4.0.11.md | 9 + .../changelog/helm-chart-4.0.12.md | 9 + .../changelog/helm-chart-4.0.13.md | 9 + .../changelog/helm-chart-4.0.14.md | 9 + .../changelog/helm-chart-4.0.15.md | 43 + .../changelog/helm-chart-4.0.18.md | 40 + .../changelog/helm-chart-4.0.2.md | 9 + .../changelog/helm-chart-4.0.3.md | 9 + .../changelog/helm-chart-4.0.5.md | 9 + .../changelog/helm-chart-4.0.6.md | 12 + .../changelog/helm-chart-4.0.7.md | 10 + .../changelog/helm-chart-4.0.9.md | 9 + .../changelog/helm-chart-4.1.0.md | 21 + .../changelog/helm-chart-4.1.2.md | 11 + .../changelog/helm-chart-4.10.0.md | 9 + .../changelog/helm-chart-4.10.1.md | 11 + .../changelog/helm-chart-4.10.2.md | 18 + .../changelog/helm-chart-4.10.3.md | 9 + .../changelog/helm-chart-4.10.4.md | 9 + .../changelog/helm-chart-4.11.0.md | 18 + .../changelog/helm-chart-4.11.1.md | 9 + .../changelog/helm-chart-4.11.2.md | 9 + .../changelog/helm-chart-4.12.0-beta.0.md | 9 + .../changelog/helm-chart-4.12.0.md | 10 + .../changelog/helm-chart-4.2.0.md | 47 + .../changelog/helm-chart-4.2.1.md | 10 + .../changelog/helm-chart-4.3.0.md | 14 + .../changelog/helm-chart-4.4.0.md | 12 + .../changelog/helm-chart-4.5.2.md | 13 + .../changelog/helm-chart-4.6.0.md | 24 + .../changelog/helm-chart-4.6.1.md | 11 + .../changelog/helm-chart-4.7.0.md | 14 + .../changelog/helm-chart-4.7.1.md | 12 + .../changelog/helm-chart-4.7.2.md | 9 + .../changelog/helm-chart-4.8.0-beta.0.md | 13 + .../changelog/helm-chart-4.8.0.md | 13 + .../changelog/helm-chart-4.8.1.md | 9 + .../changelog/helm-chart-4.8.2.md | 10 + .../changelog/helm-chart-4.8.3.md | 9 + .../changelog/helm-chart-4.9.0.md | 13 + .../changelog/helm-chart-4.9.1.md | 10 + .../changelog/helm-chart.md.gotmpl | 11 + ...dmission-webhooks-cert-manager-values.yaml | 12 + ...ontroller-configmap-addheaders-values.yaml | 11 + ...troller-configmap-proxyheaders-values.yaml | 11 + .../ci/controller-configmap-values.yaml | 11 + .../controller-daemonset-metrics-values.yaml | 13 + ...oller-daemonset-podannotations-values.yaml | 16 + .../ci/controller-daemonset-values.yaml | 10 + .../controller-deployment-metrics-values.yaml | 13 + ...ller-deployment-podannotations-values.yaml | 16 + .../ci/controller-deployment-values.yaml | 10 + .../ci/controller-hpa-values.yaml | 18 + .../ci/controller-ingressclass-values.yaml | 15 + .../controller-service-internal-values.yaml | 13 + .../ci/controller-service-values.yaml | 22 + .../charts/ingress-nginx/templates/NOTES.txt | 73 + .../ingress-nginx/templates/_helpers.tpl | 263 ++++ .../ingress-nginx/templates/_params.tpl | 77 ++ .../admission-webhooks/cert-manager.yaml | 63 + .../job-patch/clusterrole.yaml | 23 + .../job-patch/clusterrolebinding.yaml | 23 + .../job-patch/job-createSecret.yaml | 79 ++ .../job-patch/job-patchWebhook.yaml | 81 ++ .../job-patch/networkpolicy.yaml | 26 + .../admission-webhooks/job-patch/role.yaml | 24 + .../job-patch/rolebinding.yaml | 24 + .../job-patch/serviceaccount.yaml | 17 + .../validating-webhook.yaml | 54 + .../ingress-nginx/templates/clusterrole.yaml | 102 ++ .../templates/clusterrolebinding.yaml | 19 + .../controller-configmap-addheaders.yaml | 14 + .../controller-configmap-proxyheaders.yaml | 14 + .../templates/controller-configmap-tcp.yaml | 17 + .../templates/controller-configmap-udp.yaml | 17 + .../templates/controller-configmap.yaml | 30 + .../templates/controller-daemonset.yaml | 236 ++++ .../templates/controller-deployment.yaml | 242 ++++ .../templates/controller-hpa.yaml | 47 + .../controller-ingressclass-aliases.yaml | 23 + .../templates/controller-ingressclass.yaml | 26 + .../templates/controller-keda.yaml | 46 + .../templates/controller-networkpolicy.yaml | 45 + .../controller-poddisruptionbudget.yaml | 39 + .../templates/controller-prometheusrule.yaml | 26 + .../templates/controller-role.yaml | 94 ++ .../templates/controller-rolebinding.yaml | 21 + .../templates/controller-secret.yaml | 15 + .../controller-service-internal.yaml | 105 ++ .../templates/controller-service-metrics.yaml | 45 + .../templates/controller-service-webhook.yaml | 40 + .../templates/controller-service.yaml | 105 ++ .../templates/controller-serviceaccount.yaml | 17 + .../templates/controller-servicemonitor.yaml | 50 + .../templates/default-backend-deployment.yaml | 119 ++ .../default-backend-extra-configmaps.yaml | 23 + .../templates/default-backend-hpa.yaml | 40 + .../default-backend-networkpolicy.yaml | 25 + .../default-backend-poddisruptionbudget.yaml | 32 + .../templates/default-backend-service.yaml | 41 + .../default-backend-serviceaccount.yaml | 14 + .../job-patch/clusterrole_test.yaml | 11 + .../job-patch/clusterrolebinding_test.yaml | 11 + .../job-patch/role_test.yaml | 11 + .../job-patch/rolebinding_test.yaml | 11 + .../job-patch/serviceaccount_test.yaml | 47 + .../validating-webhook_test.yaml | 32 + .../controller-configmap-addheaders_test.yaml | 27 + ...ontroller-configmap-proxyheaders_test.yaml | 27 + .../tests/controller-configmap_test.yaml | 31 + .../tests/controller-daemonset_test.yaml | 192 +++ .../tests/controller-deployment_test.yaml | 217 +++ .../tests/controller-hpa_test.yaml | 31 + .../controller-ingressclass-aliases_test.yaml | 110 ++ .../tests/controller-ingressclass_test.yaml | 93 ++ .../tests/controller-keda_test.yaml | 31 + .../tests/controller-networkpolicy_test.yaml | 23 + .../controller-poddisruptionbudget_test.yaml | 102 ++ .../tests/controller-prometheusrule_test.yaml | 29 + .../controller-service-internal_test.yaml | 25 + .../controller-service-metrics_test.yaml | 41 + .../controller-service-webhook_test.yaml | 32 + .../tests/controller-service_test.yaml | 32 + .../tests/controller-serviceaccount_test.yaml | 47 + .../tests/controller-servicemonitor_test.yaml | 29 + .../default-backend-deployment_test.yaml | 189 +++ ...default-backend-extra-configmaps_test.yaml | 50 + ...ault-backend-poddisruptionbudget_test.yaml | 79 ++ .../tests/default-backend-service_test.yaml | 32 + .../default-backend-serviceaccount_test.yaml | 51 + .../charts/ingress-nginx/values.yaml | 1193 +++++++++++++++++ .../charts/k8s-shield/.helmignore | 23 + .../charts/k8s-shield/Chart.yaml | 20 + .../charts/k8s-shield/Readme.md | 72 + .../charts/k8s-shield/templates/_helpers.tpl | 16 + .../container-security-context-policy.yaml | 68 + .../templates/extraValidating-policy.yaml | 4 + .../pod-security-context-policy.yaml | 61 + ...ct-admin-cluster-role-creation-policy.yaml | 58 + .../restrict-application-deletion-policy.yaml | 51 + ...ng-with-cluster-admin-creation-policy.yaml | 42 + .../restrict-limit-resource-policy.yaml | 97 ++ .../restrict-loadbalance-creation-policy.yaml | 56 + .../restrict-namespace-deletion-policy.yaml | 44 + .../restrict-pvc-creation-policy.yaml | 52 + ...ict-without-readiness-liveness-policy.yaml | 64 + .../restrict-without-resource-policy.yaml | 60 + .../charts/k8s-shield/values.yaml | 164 +++ .../charts/karpenter/.helmignore | 23 + .../charts/karpenter/Chart.lock | 3 + .../charts/karpenter/Chart.yaml | 35 + .../charts/karpenter/README.md | 108 ++ .../charts/karpenter/README.md.gotmpl | 44 + .../charts/karpenter/artifacthub-repo.yaml | 7 + .../karpenter.k8s.aws_ec2nodeclasses.yaml | 742 ++++++++++ .../crds/karpenter.sh_nodeclaims.yaml | 395 ++++++ .../crds/karpenter.sh_nodepools.yaml | 519 +++++++ .../charts/karpenter/templates/_helpers.tpl | 142 ++ .../templates/aggregate-clusterrole.yaml | 18 + .../karpenter/templates/clusterrole-core.yaml | 71 + .../karpenter/templates/clusterrole.yaml | 38 + .../karpenter/templates/deployment.yaml | 223 +++ .../templates/poddisruptionbudget.yaml | 16 + .../charts/karpenter/templates/role.yaml | 45 + .../karpenter/templates/rolebinding.yaml | 39 + .../charts/karpenter/templates/service.yaml | 25 + .../karpenter/templates/serviceaccount.yaml | 18 + .../karpenter/templates/servicemonitor.yaml | 29 + .../charts/karpenter/values.yaml | 192 +++ .../devtron-utilities/charts/kcert/Chart.yaml | 14 + .../kcert/templates/020-ServiceAccount.yaml | 13 + .../kcert/templates/030-ClusterRole.yaml | 22 + .../templates/040-ClusterRoleBinding.yaml | 20 + .../charts/kcert/templates/050-Role.yaml | 17 + .../kcert/templates/060-RoleBinding.yaml | 21 + .../charts/kcert/templates/065-Secret.yaml | 18 + .../kcert/templates/070-Deployment.yaml | 83 ++ .../charts/kcert/templates/080-Service.yaml | 26 + .../charts/kcert/templates/NOTES.txt | 4 + .../charts/kcert/values.yaml | 35 + .../charts/minio/.helmignore | 23 + .../devtron-utilities/charts/minio/Chart.yaml | 18 + .../devtron-utilities/charts/minio/README.md | 264 ++++ .../charts/minio/templates/NOTES.txt | 43 + .../minio/templates/_helper_create_bucket.txt | 122 ++ .../minio/templates/_helper_create_policy.txt | 75 ++ .../templates/_helper_create_svcacct.txt | 106 ++ .../minio/templates/_helper_create_user.txt | 107 ++ .../templates/_helper_custom_command.txt | 58 + .../charts/minio/templates/_helper_policy.tpl | 28 + .../charts/minio/templates/_helpers.tpl | 218 +++ .../minio/templates/ciliumnetworkpolicy.yaml | 33 + .../charts/minio/templates/configmap.yaml | 32 + .../minio/templates/console-ingress.yaml | 55 + .../minio/templates/console-service.yaml | 45 + .../charts/minio/templates/deployment.yaml | 213 +++ .../charts/minio/templates/ingress.yaml | 55 + .../charts/minio/templates/networkpolicy.yaml | 26 + .../minio/templates/poddisruptionbudget.yaml | 17 + .../charts/minio/templates/post-job.yaml | 258 ++++ .../charts/minio/templates/pvc.yaml | 32 + .../charts/minio/templates/secrets.yaml | 21 + .../templates/securitycontextconstraints.yaml | 45 + .../charts/minio/templates/service.yaml | 46 + .../minio/templates/serviceaccount.yaml | 6 + .../minio/templates/servicemonitor.yaml | 112 ++ .../charts/minio/templates/statefulset.yaml | 267 ++++ .../charts/minio/values.yaml | 593 ++++++++ .../devtron-utilities/templates/_helpers.tpl | 9 + charts/devtron-utilities/values.yaml | 3 +- 358 files changed, 23109 insertions(+), 51 deletions(-) create mode 100644 charts/devtron-utilities/Chart.lock create mode 100644 charts/devtron-utilities/charts/argocd-certificate-refresh/Chart.yaml create mode 100644 charts/devtron-utilities/charts/argocd-certificate-refresh/README.md create mode 100644 charts/devtron-utilities/charts/argocd-certificate-refresh/templates/argo-cert-expire-alert-job.yaml create mode 100644 charts/devtron-utilities/charts/argocd-certificate-refresh/templates/clusterrole.yaml create mode 100644 charts/devtron-utilities/charts/argocd-certificate-refresh/templates/clusterrolebinding.yaml create mode 100644 charts/devtron-utilities/charts/argocd-certificate-refresh/templates/cronjob.yaml create mode 100644 charts/devtron-utilities/charts/argocd-certificate-refresh/templates/serviceaccount.yaml create mode 100644 charts/devtron-utilities/charts/argocd-certificate-refresh/values.yaml create mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/.helmignore create mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/Chart.yaml create mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/README.md create mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/ci/extra_args create mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/ci/values.yaml create mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/crds/crds.yaml create mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/templates/NOTES.txt create mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/templates/_helpers.tpl create mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/templates/deployment.yaml create mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/templates/hpa.yaml create mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/templates/ingressclass.yaml create mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/templates/pdb.yaml create mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/templates/rbac.yaml create mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/templates/service.yaml create mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/templates/serviceaccount.yaml create mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/templates/servicemonitor.yaml create mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/templates/webhook.yaml create mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/values.yaml create mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/.helmignore create mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/Chart.yaml create mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/README.md create mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/NOTES.txt create mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/_helpers.tpl create mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/clusterrole.yaml create mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/clusterrolebinding.yaml create mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/daemonset.linux.yaml create mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/daemonset.windows.yaml create mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/deployment.yaml create mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/pdb.yaml create mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/podmonitor.yaml create mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/psp.yaml create mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/service.yaml create mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/serviceaccount.yaml create mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/servicemonitor.yaml create mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/values.yaml create mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/.helmignore create mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/Chart.yaml create mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/README.md create mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/README.md.gotmpl create mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/NOTES.txt create mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/_helpers.tpl create mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/clusterrole.yaml create mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/clusterrolebinding.yaml create mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/configmap.yaml create mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/deployment.yaml create mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/extra-manifests.yaml create mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/pdb.yaml create mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/podsecuritypolicy.yaml create mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/priority-expander-configmap.yaml create mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/prometheusrule.yaml create mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/role.yaml create mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/rolebinding.yaml create mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/secret.yaml create mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/service.yaml create mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/serviceaccount.yaml create mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/servicemonitor.yaml create mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/vpa.yaml create mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/values.yaml create mode 100644 charts/devtron-utilities/charts/devtron-backups/Chart.yaml create mode 100644 charts/devtron-utilities/charts/devtron-backups/README.md create mode 100644 charts/devtron-utilities/charts/devtron-backups/templates/_helpers.tpl create mode 100644 charts/devtron-utilities/charts/devtron-backups/templates/backup-on-azure.yaml create mode 100644 charts/devtron-utilities/charts/devtron-backups/templates/backup-on-gcp.yaml create mode 100644 charts/devtron-utilities/charts/devtron-backups/templates/backup-on-pvc.yaml create mode 100644 charts/devtron-utilities/charts/devtron-backups/templates/backup-on-s3.yaml create mode 100644 charts/devtron-utilities/charts/devtron-backups/templates/serviceaccount.yaml create mode 100644 charts/devtron-utilities/charts/devtron-backups/values.yaml create mode 100644 charts/devtron-utilities/charts/devtron-generic-helm/Chart.yaml create mode 100644 charts/devtron-utilities/charts/devtron-generic-helm/README.md create mode 100644 charts/devtron-utilities/charts/devtron-generic-helm/templates/generic.yaml create mode 100644 charts/devtron-utilities/charts/devtron-generic-helm/values.yaml create mode 100644 charts/devtron-utilities/charts/holmes/.helmignore create mode 100644 charts/devtron-utilities/charts/holmes/Chart.yaml create mode 100644 charts/devtron-utilities/charts/holmes/templates/holmes.yaml create mode 100644 charts/devtron-utilities/charts/holmes/templates/holmesgpt-service-account.yaml create mode 100644 charts/devtron-utilities/charts/holmes/templates/toolset-config.yaml create mode 100644 charts/devtron-utilities/charts/holmes/values.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/.helmignore create mode 100644 charts/devtron-utilities/charts/ingress-nginx/Chart.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/OWNERS create mode 100644 charts/devtron-utilities/charts/ingress-nginx/README.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/README.md.gotmpl create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.10.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.1.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.2.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.3.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.12.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.12.1.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.13.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.14.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.15.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.16.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.9.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.9.1.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.0.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.10.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.10.1.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.11.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.11.1.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.12.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.13.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.14.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.15.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.15.1.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.16.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.16.1.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.17.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.18.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.19.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.20.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.20.1.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.21.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.22.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.23.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.24.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.25.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.26.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.27.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.28.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.29.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.3.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.3.1.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.30.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.31.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.32.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.33.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.34.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.4.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.5.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.5.1.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.6.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.7.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.7.1.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.8.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.9.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.1.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.10.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.11.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.12.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.13.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.14.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.15.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.18.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.2.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.3.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.5.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.6.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.7.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.9.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.1.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.1.2.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.1.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.2.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.3.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.4.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.1.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.2.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.12.0-beta.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.12.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.2.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.2.1.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.3.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.4.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.5.2.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.6.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.6.1.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.1.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.2.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.0-beta.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.1.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.2.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.3.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.9.0.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.9.1.md create mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart.md.gotmpl create mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/admission-webhooks-cert-manager-values.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-addheaders-values.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-proxyheaders-values.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-values.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-metrics-values.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-podannotations-values.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-values.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-metrics-values.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-podannotations-values.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-values.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-hpa-values.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-ingressclass-values.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-service-internal-values.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-service-values.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/NOTES.txt create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/_helpers.tpl create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/_params.tpl create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/cert-manager.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/networkpolicy.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/role.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/validating-webhook.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/clusterrole.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/clusterrolebinding.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-addheaders.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-proxyheaders.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-tcp.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-udp.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-daemonset.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-deployment.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-hpa.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-ingressclass-aliases.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-ingressclass.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-keda.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-networkpolicy.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-poddisruptionbudget.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-prometheusrule.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-role.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-rolebinding.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-secret.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-internal.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-metrics.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-webhook.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-service.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-serviceaccount.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-servicemonitor.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-deployment.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-extra-configmaps.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-hpa.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-networkpolicy.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-poddisruptionbudget.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-service.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-serviceaccount.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/clusterrole_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/clusterrolebinding_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/role_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/rolebinding_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/serviceaccount_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/validating-webhook_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap-addheaders_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap-proxyheaders_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-daemonset_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-deployment_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-hpa_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-ingressclass-aliases_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-ingressclass_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-keda_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-networkpolicy_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-poddisruptionbudget_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-prometheusrule_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-internal_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-metrics_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-webhook_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-service_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-serviceaccount_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-servicemonitor_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-deployment_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-extra-configmaps_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-poddisruptionbudget_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-service_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-serviceaccount_test.yaml create mode 100644 charts/devtron-utilities/charts/ingress-nginx/values.yaml create mode 100644 charts/devtron-utilities/charts/k8s-shield/.helmignore create mode 100644 charts/devtron-utilities/charts/k8s-shield/Chart.yaml create mode 100644 charts/devtron-utilities/charts/k8s-shield/Readme.md create mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/_helpers.tpl create mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/container-security-context-policy.yaml create mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/extraValidating-policy.yaml create mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/pod-security-context-policy.yaml create mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/restrict-admin-cluster-role-creation-policy.yaml create mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/restrict-application-deletion-policy.yaml create mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/restrict-cluster-rolebinding-with-cluster-admin-creation-policy.yaml create mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/restrict-limit-resource-policy.yaml create mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/restrict-loadbalance-creation-policy.yaml create mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/restrict-namespace-deletion-policy.yaml create mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/restrict-pvc-creation-policy.yaml create mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/restrict-without-readiness-liveness-policy.yaml create mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/restrict-without-resource-policy.yaml create mode 100644 charts/devtron-utilities/charts/k8s-shield/values.yaml create mode 100644 charts/devtron-utilities/charts/karpenter/.helmignore create mode 100644 charts/devtron-utilities/charts/karpenter/Chart.lock create mode 100644 charts/devtron-utilities/charts/karpenter/Chart.yaml create mode 100644 charts/devtron-utilities/charts/karpenter/README.md create mode 100644 charts/devtron-utilities/charts/karpenter/README.md.gotmpl create mode 100644 charts/devtron-utilities/charts/karpenter/artifacthub-repo.yaml create mode 100644 charts/devtron-utilities/charts/karpenter/crds/karpenter.k8s.aws_ec2nodeclasses.yaml create mode 100644 charts/devtron-utilities/charts/karpenter/crds/karpenter.sh_nodeclaims.yaml create mode 100644 charts/devtron-utilities/charts/karpenter/crds/karpenter.sh_nodepools.yaml create mode 100644 charts/devtron-utilities/charts/karpenter/templates/_helpers.tpl create mode 100644 charts/devtron-utilities/charts/karpenter/templates/aggregate-clusterrole.yaml create mode 100644 charts/devtron-utilities/charts/karpenter/templates/clusterrole-core.yaml create mode 100644 charts/devtron-utilities/charts/karpenter/templates/clusterrole.yaml create mode 100644 charts/devtron-utilities/charts/karpenter/templates/deployment.yaml create mode 100644 charts/devtron-utilities/charts/karpenter/templates/poddisruptionbudget.yaml create mode 100644 charts/devtron-utilities/charts/karpenter/templates/role.yaml create mode 100644 charts/devtron-utilities/charts/karpenter/templates/rolebinding.yaml create mode 100644 charts/devtron-utilities/charts/karpenter/templates/service.yaml create mode 100644 charts/devtron-utilities/charts/karpenter/templates/serviceaccount.yaml create mode 100644 charts/devtron-utilities/charts/karpenter/templates/servicemonitor.yaml create mode 100644 charts/devtron-utilities/charts/karpenter/values.yaml create mode 100644 charts/devtron-utilities/charts/kcert/Chart.yaml create mode 100644 charts/devtron-utilities/charts/kcert/templates/020-ServiceAccount.yaml create mode 100644 charts/devtron-utilities/charts/kcert/templates/030-ClusterRole.yaml create mode 100644 charts/devtron-utilities/charts/kcert/templates/040-ClusterRoleBinding.yaml create mode 100644 charts/devtron-utilities/charts/kcert/templates/050-Role.yaml create mode 100644 charts/devtron-utilities/charts/kcert/templates/060-RoleBinding.yaml create mode 100644 charts/devtron-utilities/charts/kcert/templates/065-Secret.yaml create mode 100644 charts/devtron-utilities/charts/kcert/templates/070-Deployment.yaml create mode 100644 charts/devtron-utilities/charts/kcert/templates/080-Service.yaml create mode 100644 charts/devtron-utilities/charts/kcert/templates/NOTES.txt create mode 100644 charts/devtron-utilities/charts/kcert/values.yaml create mode 100644 charts/devtron-utilities/charts/minio/.helmignore create mode 100644 charts/devtron-utilities/charts/minio/Chart.yaml create mode 100644 charts/devtron-utilities/charts/minio/README.md create mode 100644 charts/devtron-utilities/charts/minio/templates/NOTES.txt create mode 100644 charts/devtron-utilities/charts/minio/templates/_helper_create_bucket.txt create mode 100644 charts/devtron-utilities/charts/minio/templates/_helper_create_policy.txt create mode 100644 charts/devtron-utilities/charts/minio/templates/_helper_create_svcacct.txt create mode 100644 charts/devtron-utilities/charts/minio/templates/_helper_create_user.txt create mode 100644 charts/devtron-utilities/charts/minio/templates/_helper_custom_command.txt create mode 100644 charts/devtron-utilities/charts/minio/templates/_helper_policy.tpl create mode 100644 charts/devtron-utilities/charts/minio/templates/_helpers.tpl create mode 100644 charts/devtron-utilities/charts/minio/templates/ciliumnetworkpolicy.yaml create mode 100644 charts/devtron-utilities/charts/minio/templates/configmap.yaml create mode 100644 charts/devtron-utilities/charts/minio/templates/console-ingress.yaml create mode 100644 charts/devtron-utilities/charts/minio/templates/console-service.yaml create mode 100644 charts/devtron-utilities/charts/minio/templates/deployment.yaml create mode 100644 charts/devtron-utilities/charts/minio/templates/ingress.yaml create mode 100644 charts/devtron-utilities/charts/minio/templates/networkpolicy.yaml create mode 100644 charts/devtron-utilities/charts/minio/templates/poddisruptionbudget.yaml create mode 100644 charts/devtron-utilities/charts/minio/templates/post-job.yaml create mode 100644 charts/devtron-utilities/charts/minio/templates/pvc.yaml create mode 100644 charts/devtron-utilities/charts/minio/templates/secrets.yaml create mode 100644 charts/devtron-utilities/charts/minio/templates/securitycontextconstraints.yaml create mode 100644 charts/devtron-utilities/charts/minio/templates/service.yaml create mode 100644 charts/devtron-utilities/charts/minio/templates/serviceaccount.yaml create mode 100644 charts/devtron-utilities/charts/minio/templates/servicemonitor.yaml create mode 100644 charts/devtron-utilities/charts/minio/templates/statefulset.yaml create mode 100644 charts/devtron-utilities/charts/minio/values.yaml create mode 100644 charts/devtron-utilities/templates/_helpers.tpl diff --git a/charts/devtron-utilities/Chart.lock b/charts/devtron-utilities/Chart.lock new file mode 100644 index 000000000..0510f34b9 --- /dev/null +++ b/charts/devtron-utilities/Chart.lock @@ -0,0 +1,39 @@ +dependencies: +- name: ingress-nginx + repository: https://kubernetes.github.io/ingress-nginx + version: 4.12.0 +- name: cluster-autoscaler + repository: https://kubernetes.github.io/autoscaler + version: 9.46.0 +- name: karpenter + repository: oci://public.ecr.aws/karpenter + version: 1.4.0 +- name: aws-load-balancer-controller + repository: https://aws.github.io/eks-charts + version: 1.11.0 +- name: aws-node-termination-handler + repository: https://aws.github.io/eks-charts + version: 0.21.0 +- name: minio + repository: https://charts.min.io/ + version: 5.4.0 +- name: kcert + repository: https://nabsul.github.io/helm + version: 1.0.7 +- name: argocd-certificate-refresh + repository: https://helm.devtron.ai/ + version: 0.10.8 +- name: k8s-shield + repository: https://helm.devtron.ai/ + version: 0.1.0 +- name: devtron-backups + repository: https://helm.devtron.ai/ + version: 0.2.5 +- name: devtron-generic-helm + repository: https://helm.devtron.ai/ + version: 0.10.1 +- name: holmes + repository: https://robusta-charts.storage.googleapis.com + version: 0.8.1 +digest: sha256:a496eecb07ba3de9d4def3cb2afbc652f95ded26af0745559bb6b7da033b33f8 +generated: "2025-07-07T17:13:45.33696+05:30" diff --git a/charts/devtron-utilities/Chart.yaml b/charts/devtron-utilities/Chart.yaml index 6814e7370..f87d0249c 100644 --- a/charts/devtron-utilities/Chart.yaml +++ b/charts/devtron-utilities/Chart.yaml @@ -1,69 +1,68 @@ apiVersion: v2 -name: devtron-utilities -description: Provides essential infrastructure and security utilities such as Nginx/AWS Load Balancer, Devtron Backup, Minio (Blob Storage), Network Policy, Cluster Auto Scaler (Karpenter), and more. - -type: application -version: 0.0.2 -appVersion: "0.0.1" -sources: -- https://github.com/kubernetes/ingress-nginx -- https://aws.github.io/eks-charts -- https://charts.min.io/ +appVersion: 0.0.1 dependencies: -- name: ingress-nginx - version: "4.12.0" +- condition: ingress-nginx.enabled + name: ingress-nginx repository: https://kubernetes.github.io/ingress-nginx - condition: ingress-nginx.enabled -- name: cluster-autoscaler - version: "9.46.0" + version: 4.12.0 +- condition: cluster-autoscaler.enabled + name: cluster-autoscaler repository: https://kubernetes.github.io/autoscaler - condition: cluster-autoscaler.enabled -- name: karpenter - version: "1.2.1" + version: 9.46.0 +- condition: karpenter.enabled + name: karpenter repository: oci://public.ecr.aws/karpenter - condition: karpenter.enabled -- name: aws-load-balancer-controller - version: "1.11.0" + version: 1.4.0 +- condition: aws-load-balancer-controller.enabled + name: aws-load-balancer-controller repository: https://aws.github.io/eks-charts - condition: aws-load-balancer-controller.enabled -- name: aws-node-termination-handler - version: "0.21.0" + version: 1.11.0 +- condition: aws-node-termination-handler.enabled + name: aws-node-termination-handler repository: https://aws.github.io/eks-charts - condition: aws-node-termination-handler.enabled -- name: minio - version: "5.4.0" + version: 0.21.0 +- condition: minio.enabled + name: minio repository: https://charts.min.io/ - condition: minio.enabled -- name: kcert - version: "1.0.7" + version: 5.4.0 +- condition: kcert.enabled + name: kcert repository: https://nabsul.github.io/helm - condition: kcert.enabled -- name: argocd-certificate-refresh - version: "0.10.8" + version: 1.0.7 +- condition: argocd-certificate-refresh.enabled + name: argocd-certificate-refresh repository: https://helm.devtron.ai/ - condition: argocd-certificate-refresh.enabled -- name: k8s-shield - version: "0.1.0" + version: 0.10.8 +- condition: k8s-shield.enabled + name: k8s-shield repository: https://helm.devtron.ai/ - condition: k8s-shield.enabled -- name: devtron-backups - version: "0.2.5" - repository: https://helm.devtron.ai/ - condition: devtron-backups.enabled -- name: devtron-generic-helm - version: "0.10.1" + version: 0.1.0 +- condition: devtron-backups.enabled + name: devtron-backups repository: https://helm.devtron.ai/ + version: 0.2.5 +- alias: nodepool condition: nodepool.enabled - alias: nodepool -- name: holmes - version: "0.8.1" - repository: https://robusta-charts.storage.googleapis.com + name: devtron-generic-helm + repository: https://helm.devtron.ai/ + version: 0.10.1 +- alias: holmes-ai condition: holmes-ai.enabled - alias: holmes-ai - - + name: holmes + repository: https://robusta-charts.storage.googleapis.com + version: 0.8.1 +description: Provides essential infrastructure and security utilities such as Nginx/AWS + Load Balancer, Devtron Backup, Minio (Blob Storage), Network Policy, Cluster Auto + Scaler (Karpenter), and more. maintainers: - email: badal@devtron.ai name: Badal Kumar - email: pawan.mehta@devtron.ai name: Pawan Kumar +name: devtron-utilities +sources: +- https://github.com/kubernetes/ingress-nginx +- https://aws.github.io/eks-charts +- https://charts.min.io/ +type: application +version: 0.0.4 diff --git a/charts/devtron-utilities/charts/argocd-certificate-refresh/Chart.yaml b/charts/devtron-utilities/charts/argocd-certificate-refresh/Chart.yaml new file mode 100644 index 000000000..c0169517d --- /dev/null +++ b/charts/devtron-utilities/charts/argocd-certificate-refresh/Chart.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +appVersion: 0.1.0 +description: Helm chart to deploy argocd certificate refresh CronJob. +maintainers: +- email: ajay@devtron.ai + name: Ajay +- email: badal@devtron.ai + name: Badal Kumar +name: argocd-certificate-refresh +version: 0.10.8 diff --git a/charts/devtron-utilities/charts/argocd-certificate-refresh/README.md b/charts/devtron-utilities/charts/argocd-certificate-refresh/README.md new file mode 100644 index 000000000..f9c4c1d14 --- /dev/null +++ b/charts/devtron-utilities/charts/argocd-certificate-refresh/README.md @@ -0,0 +1,3 @@ +# Devtron helm chart to deploy argocd certificate refresh cronjob + +To get the script, please follow this link-: https://github.com/devtron-labs/devtron-utilities/tree/main/scripts/argo-cert-refresh diff --git a/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/argo-cert-expire-alert-job.yaml b/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/argo-cert-expire-alert-job.yaml new file mode 100644 index 000000000..b17b8d931 --- /dev/null +++ b/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/argo-cert-expire-alert-job.yaml @@ -0,0 +1,44 @@ +{{- if $.Values.alert.enabled -}} +{{- if .Capabilities.APIVersions.Has "batch/v1/CronJob" }} +apiVersion: batch/v1 +{{- else -}} +apiVersion: batch/v1beta1 +{{- end }} +kind: CronJob +metadata: + name: argocd-cert-alert + namespace: {{ $.Values.argocdNamespace| default .Release.Namespace }} +spec: + schedule: {{ $.Values.alert.schedule | quote }} + concurrencyPolicy: Forbid + jobTemplate: + spec: + template: + spec: + {{- if $.Values.podSecurityContext }} + securityContext: +{{ toYaml $.Values.podSecurityContext | indent 12 }} + {{- end }} + serviceAccountName: argocd-cert-sa + serviceAccount: argocd-cert-sa + containers: + - name: argocd-alert-container + image: {{ $.Values.alert.image }} + imagePullPolicy: IfNotPresent + env: + - name: devtronNamespace + value: {{ $.Values.devtronNamespace| default .Release.Namespace }} + - name: argocdNamespace + value: {{ $.Values.argocdNamespace| default .Release.Namespace }} + - name: discordUrl + value: {{ $.Values.alert.discordUrl | quote }} + - name: alertBefore + value: {{ $.Values.alert.alertBefore | quote }} + - name: cronJobRunAfter + value: {{ $.Values.alert.cronJobRunAfter | quote }} + {{- if $.Values.containerSecurityContext }} + securityContext: +{{ toYaml $.Values.containerSecurityContext | indent 14 }} + {{- end}} + restartPolicy: OnFailure +{{- end }} \ No newline at end of file diff --git a/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/clusterrole.yaml b/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/clusterrole.yaml new file mode 100644 index 000000000..eb75c89cd --- /dev/null +++ b/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/clusterrole.yaml @@ -0,0 +1,22 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: argocd-cert-role +rules: +- apiGroups: + - "" + - batch + - apps + resources: + - pods + - secrets + - cronjobs + - deployments + verbs: + - create + - get + - watch + - list + - delete + - update + - patch \ No newline at end of file diff --git a/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/clusterrolebinding.yaml b/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/clusterrolebinding.yaml new file mode 100644 index 000000000..487d86520 --- /dev/null +++ b/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/clusterrolebinding.yaml @@ -0,0 +1,12 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: argocd-cert-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: argocd-cert-role +subjects: +- kind: ServiceAccount + name: argocd-cert-sa + namespace: {{ $.Values.argocdNamespace| default .Release.Namespace }} diff --git a/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/cronjob.yaml b/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/cronjob.yaml new file mode 100644 index 000000000..9b736b3af --- /dev/null +++ b/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/cronjob.yaml @@ -0,0 +1,39 @@ +{{- if .Capabilities.APIVersions.Has "batch/v1/CronJob" }} +apiVersion: batch/v1 +{{- else -}} +apiVersion: batch/v1beta1 +{{- end }} +kind: CronJob +metadata: + name: argocd-cert-cronjob + namespace: {{ $.Values.argocdNamespace| default .Release.Namespace }} +spec: + schedule: {{ $.Values.cronjob.schedule | quote }} + concurrencyPolicy: Forbid + jobTemplate: + spec: + template: + spec: + {{- if $.Values.podSecurityContext }} + securityContext: +{{ toYaml $.Values.podSecurityContext | indent 12 }} + {{- end }} + serviceAccountName: argocd-cert-sa + serviceAccount: argocd-cert-sa + containers: + - name: argocd-cert-cron + image: {{ $.Values.image }} + env: + - name: devtronNamespace + value: {{ $.Values.devtronNamespace| default .Release.Namespace }} + - name: argocdNamespace + value: {{ $.Values.argocdNamespace| default .Release.Namespace }} + - name: clusterType + value: {{ $.Values.clusterType | default "ENTERPRISE" | quote }} + imagePullPolicy: IfNotPresent + command: ["/bin/bash", "-c", "chmod +x argocd.sh && bash argocd.sh"] + {{- if $.Values.containerSecurityContext }} + securityContext: +{{ toYaml $.Values.containerSecurityContext | indent 14 }} + {{- end}} + restartPolicy: OnFailure \ No newline at end of file diff --git a/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/serviceaccount.yaml b/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/serviceaccount.yaml new file mode 100644 index 000000000..aa53b6ce1 --- /dev/null +++ b/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/serviceaccount.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: argocd-cert-sa + namespace: {{ .Release.Namespace }} + + diff --git a/charts/devtron-utilities/charts/argocd-certificate-refresh/values.yaml b/charts/devtron-utilities/charts/argocd-certificate-refresh/values.yaml new file mode 100644 index 000000000..87054881e --- /dev/null +++ b/charts/devtron-utilities/charts/argocd-certificate-refresh/values.yaml @@ -0,0 +1,45 @@ +# Default values for argocd-certificate-refresh. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + + +# docker image information +image: quay.io/devtron/argocd-cert-refresh:v10 +#accepted values are ENTERPRISE & OSS +# clusterType: ENTERPRISE +# If not namespace is provided then by default it will take in which namespace it will deploy +# devtronNamespace: devtroncd +# argocdNamespace: devtroncd + + + + +# values for cronjob +#currently it will run At 23:59 on 1st day-of-month in every 6th month +cronjob: + schedule: "59 23 1 */6 *" + + + + +#set up this If you need alert for argocd cert expire +alert: + enabled: false + image: quay.io/devtron/argocd-cert-refresh:alert-v9 + discordUrl: "" + #Daily At 07:00AM GMT so it will be 12:30PM in IST + schedule: "0 7 * * *" + # if the certificate will expire after 10 days you will get alert + alertBefore: 10 + # if the next cron will be run after 2 days you will get alert + cronJobRunAfter: 2 + + + +podSecurityContext: {} + # runAsGroup: 1000 + # runAsUser: 1000 +containerSecurityContext: {} + # allowPrivilegeEscalation: false + # runAsUser: 1000 + # runAsNonRoot: true diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/.helmignore b/charts/devtron-utilities/charts/aws-load-balancer-controller/.helmignore new file mode 100644 index 000000000..67263be0a --- /dev/null +++ b/charts/devtron-utilities/charts/aws-load-balancer-controller/.helmignore @@ -0,0 +1,25 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +crds/kustomization.yaml +test.yaml diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/Chart.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/Chart.yaml new file mode 100644 index 000000000..e5823aed9 --- /dev/null +++ b/charts/devtron-utilities/charts/aws-load-balancer-controller/Chart.yaml @@ -0,0 +1,22 @@ +apiVersion: v2 +appVersion: v2.11.0 +description: AWS Load Balancer Controller Helm chart for Kubernetes +home: https://github.com/aws/eks-charts +icon: https://raw.githubusercontent.com/aws/eks-charts/master/docs/logo/aws.png +keywords: +- eks +- alb +- load balancer +- ingress +- nlb +maintainers: +- email: kishorj@users.noreply.github.com + name: kishorj + url: https://github.com/kishorj +- email: m00nf1sh@users.noreply.github.com + name: m00nf1sh + url: https://github.com/m00nf1sh +name: aws-load-balancer-controller +sources: +- https://github.com/aws/eks-charts +version: 1.11.0 diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/README.md b/charts/devtron-utilities/charts/aws-load-balancer-controller/README.md new file mode 100644 index 000000000..180e50c08 --- /dev/null +++ b/charts/devtron-utilities/charts/aws-load-balancer-controller/README.md @@ -0,0 +1,283 @@ +# AWS Load Balancer Controller + +AWS Load Balancer controller Helm chart for Kubernetes + +## TL;DR: +```sh +helm repo add eks https://aws.github.io/eks-charts +# If using IAM Roles for service account install as follows - NOTE: you need to specify both of the chart values `serviceAccount.create=false` and `serviceAccount.name=aws-load-balancer-controller` +helm install aws-load-balancer-controller eks/aws-load-balancer-controller --set clusterName=my-cluster -n kube-system --set serviceAccount.create=false --set serviceAccount.name=aws-load-balancer-controller +# If not using IAM Roles for service account +helm install aws-load-balancer-controller eks/aws-load-balancer-controller --set clusterName=my-cluster -n kube-system +``` + +## Introduction +AWS Load Balancer controller manages the following AWS resources +- Application Load Balancers to satisfy Kubernetes ingress objects +- Network Load Balancers to satisfy Kubernetes service objects of type LoadBalancer with appropriate annotations + +## Security updates +**Note**: Deployed chart does not receive security updates automatically. You need to manually upgrade to a newer chart. +#### Node isolation +As a security best practice, we recommend isolating the controller deployment pods to specific node groups which run critical components. The helm chart provides parameters ```nodeSelector```, ```tolerations``` and ```affinity``` to configure node isolation. For more information, please refer to the guidance [here](https://aws.github.io/aws-eks-best-practices/security/docs/multitenancy/#isolating-tenant-workloads-to-specific-nodes). + +## Prerequisites +- Supported Kubernetes Versions + - Chart version v1.5.0+ requires Kubernetes 1.22+ + - Chart version v1.4.0+ requires Kubernetes 1.19+ + - Chart version v1.2.0 - v1.3.3 supports Kubernetes 1.16-1.21 + - Chart version v1.1.6 and before supports Kubernetes 1.15 +- IAM permissions +- Helm v3 +- Optional dependencies + - cert-manager + - Prometheus Operator + +The controller runs on the worker nodes, so it needs access to the AWS ALB/NLB resources via IAM permissions. The +IAM permissions can either be setup via IAM roles for ServiceAccount or can be attached directly to the worker node IAM roles. + +#### Setup IAM for ServiceAccount +1. Create IAM OIDC provider + ``` + eksctl utils associate-iam-oidc-provider \ + --region \ + --cluster \ + --approve + ``` +1. Download IAM policy for the AWS Load Balancer Controller + ``` + curl -o iam-policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/main/docs/install/iam_policy.json + ``` +1. Create an IAM policy called AWSLoadBalancerControllerIAMPolicy + ``` + aws iam create-policy \ + --policy-name AWSLoadBalancerControllerIAMPolicy \ + --policy-document file://iam-policy.json + ``` + Take note of the policy ARN that is returned + +1. Create a IAM role and ServiceAccount for the Load Balancer controller, use the ARN from the step above + ``` + eksctl create iamserviceaccount \ + --cluster= \ + --namespace=kube-system \ + --name=aws-load-balancer-controller \ + --attach-policy-arn=arn:aws:iam:::policy/AWSLoadBalancerControllerIAMPolicy \ + --approve + ``` +#### Setup IAM manually +If not setting up IAM for ServiceAccount, apply the IAM policies from the following URL at minimum. +``` +https://raw.githubusercontent.com/kubernetes-sigs/aws-alb-ingress-controller/main/docs/install/iam_policy.json +``` + +#### Upgrading from ALB ingress controller +If migrating from ALB ingress controller, grant [additional IAM permissions](https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/main/docs/install/iam_policy_v1_to_v2_additional.json). + +#### Upgrading from AWS Load Balancer controller v2.1.3 and earlier +- Additional IAM permissions required, ensure you have granted the [required IAM permissions](https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/main/docs/install/iam_policy.json). +- CRDs need to be updated as follows +```shell script +kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master" +``` +- you can run helm upgrade without uninstalling the old chart completely + +#### Installing cert-manager + +If you are setting `enableCertManager: true` you need to have installed cert-manager and it's CRDs before installing this chart; to install [cert-manager](https://artifacthub.io/packages/helm/cert-manager/cert-manager) follow the installation guide. + +The controller helm chart requires the cert-manager with apiVersion `cert-manager.io/v1`. + +Set `cluster.dnsDomain` (default: `cluster.local`) to the actual DNS domain of your cluster to include the FQDN in requested TLS certificates. + +#### Installing the Prometheus Operator + +If you are setting `serviceMonitor.enabled: true` you need to have installed the Prometheus Operator ServiceMonitor CRD before installing this chart and have the operator running to collect the metrics. The easiest way to do this is to install the [kube-prometheus-stack](https://artifacthub.io/packages/helm/prometheus-community/kube-prometheus-stack) Helm chart using the installation guide. + +## Installing the Chart +**Note**: You need to uninstall aws-alb-ingress-controller. Please refer to the [upgrade](#Upgrade) section below before you proceed. + +**Note**: Starting chart version 1.4.1, you need to explicitly set `clusterSecretsPermissions.allowAllSecrets` to true to grant the controller permission to access all secrets for OIDC feature. We recommend configuring access to individual secrets resource separately [[link](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/examples/secrets_access/)]. + +**Note**: To ensure compatibility, we recommend installing the AWS Load Balancer controller image version with its compatible Helm chart version. Use the ```helm search repo eks/aws-load-balancer-controller --versions``` command to find the compatible versions. + +Add the EKS repository to Helm: +```shell script +helm repo add eks https://aws.github.io/eks-charts +``` + +Install the TargetGroupBinding CRDs: + +```shell script +kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master" +``` + +Install the AWS Load Balancer controller, if using iamserviceaccount +```shell script +# NOTE: The clusterName value must be set either via the values.yaml or the Helm command line. The in the command +# below should be replaced with name of your k8s cluster before running it. +helm upgrade -i aws-load-balancer-controller eks/aws-load-balancer-controller -n kube-system --set clusterName= --set serviceAccount.create=false --set serviceAccount.name=aws-load-balancer-controller +``` + +Install the AWS Load Balancer controller, if not using iamserviceaccount +```shell script +helm upgrade -i aws-load-balancer-controller eks/aws-load-balancer-controller -n kube-system --set clusterName= +``` + +## Upgrade +The new controller is backwards compatible with the existing ingress objects. However, it will not coexist with the older aws-alb-ingress-controller. +The old controller must be uninstalled completely before installing the new version. +### Kubectl installation +If you had installed the previous version via kubectl, uninstall as follows +```shell script +$ kubectl delete deployment -n kube-system alb-ingress-controller +$ kubectl delete clusterRole alb-ingress-controller +$ kubectl delete ClusterRoleBinding alb-ingress-controller +$ kubectl delete ServiceAccount -n kube-system alb-ingress-controller + +# Alternatively you can find the version of the controller and delete as follows +$ kubectl describe deployment -n kube-system alb-ingress-controller |grep Image + Image: docker.io/amazon/aws-alb-ingress-controller:v1.1.8 +# You can delete the deployment now +$ kubectl delete deployment -n kube-system alb-ingress-controller +# In this case, the version is v1.1.8, the rbac roles can be removed as follows +$ kubectl delete -f https://raw.githubusercontent.com/kubernetes-sigs/aws-alb-ingress-controller/v1.1.8/docs/examples/rbac-role.yaml +``` +### Helm installation +If you had installed the incubator/aws-alb-ingress-controller Helm chart, uninstall as follows +```shell script +# NOTE: If installed under a different chart name and namespace, please specify as appropriate +$ helm delete aws-alb-ingress-controller -n kube-system +``` + +If you had installed the 0.1.x version of eks-charts/aws-load-balancer-controller chart earlier, the upgrade to chart version 1.0.0 will +not work due to incompatibility of the webhook api version, uninstall as follows +```shell script +$ helm delete aws-load-balancer-controller -n kube-system +``` + +## Uninstalling the Chart +```sh +helm delete aws-load-balancer-controller -n kube-system +``` + +If you setup IAM Roles for ServiceAccount, you can cleanup as follows +``` +eksctl delete iamserviceaccount --cluster --namespace kube-system --name aws-load-balancer-controller +``` + +## HA configuration +Chart release v1.2.0 and later enables high availability configuration by default. +- The default number of replicas is 2. You can pass`--set replicaCount=1` flag during chart installation to disable this. Due to leader election, only one controller will actively reconcile resources. +- The default priority class for the controller pods is `system-cluster-critical` +- Soft pod anti-affinity is enabled for controller pods with `topologyKey: kubernetes.io/hostname` if you don't configure custom affinity and set `configureDefaultAffinity` to `true` +- Pod disruption budget (PDB) has not been set by default. If you plan on running at least 2 controller pods, you can pass `--set podDisruptionBudget.maxUnavailable=1` flag during chart installation + +## Configuration + +The following tables lists the configurable parameters of the chart and their default values. +The default values set by the application itself can be confirmed [here](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/deploy/configurations/#controller-configuration-options). + + +| Parameter | Description | Default | +| ---------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- | +| `image.repository` | image repository | `public.ecr.aws/eks/aws-load-balancer-controller` | +| `image.tag` | image tag | `` | +| `image.pullPolicy` | image pull policy | `IfNotPresent` | +| `clusterName` | Kubernetes cluster name | None | +| `cluster.dnsDomain` | DNS domain of the Kubernetes cluster, included in TLS certificate requests | `cluster.local` | +| `securityContext` | Set to security context for pod | `{}` | +| `resources` | Controller pod resource requests & limits | `{}` | +| `priorityClassName` | Controller pod priority class | system-cluster-critical | +| `nodeSelector` | Node labels for controller pod assignment | `{}` | +| `tolerations` | Controller pod toleration for taints | `{}` | +| `affinity` | Affinity for pod assignment | `{}` | +| `configureDefaultAffinity` | Configure soft pod anti-affinity if custom affinity is not configured | `true` | +| `topologySpreadConstraints` | Topology Spread Constraints for pod assignment | `{}` | +| `deploymentAnnotations` | Annotations to add to deployment | `{}` | +| `podAnnotations` | Annotations to add to each pod | `{}` | +| `podLabels` | Labels to add to each pod | `{}` | +| `additionalLabels` | Labels to add to all components | `{}` | +| `rbac.create` | if `true`, create and use RBAC resources | `true` | +| `serviceAccount.annotations` | optional annotations to add to service account | None | +| `serviceAccount.automountServiceAccountToken` | Automount API credentials for a Service Account | `true` | +| `serviceAccount.imagePullSecrets` | List of image pull secrets to add to the Service Account | `[]` | +| `serviceAccount.create` | If `true`, create a new service account | `true` | +| `serviceAccount.name` | Service account to be used | None | +| `terminationGracePeriodSeconds` | Time period for controller pod to do a graceful shutdown | 10 | +| `ingressClass` | The ingress class to satisfy | alb | +| `createIngressClassResource` | Create ingressClass resource | true | +| `ingressClassParams.name` | IngressClassParams resource's name, default to the aws load balancer controller's name | None | +| `ingressClassParams.create` | If `true`, create a new ingressClassParams | true | +| `ingressClassParams.spec` | IngressClassParams defined ingress specifications | {} | +| `region` | The AWS region for the kubernetes cluster | None | +| `vpcId` | The VPC ID for the Kubernetes cluster | None | +| `awsApiEndpoints` | Custom AWS API Endpoints | None | +| `awsApiThrottle` | Custom AWS API throttle settings | None | +| `awsMaxRetries` | Maximum retries for AWS APIs | None | +| `defaultTargetType` | Default target type. Used as the default value of the `alb.ingress.kubernetes.io/target-type` and `service.beta.kubernetes.io/aws-load-balancer-nlb-target-type" annotations.`Possible values are `ip` and `instance`. | `instance` | +| `enablePodReadinessGateInject` | If enabled, targetHealth readiness gate will get injected to the pod spec for the matching endpoint pods | None | +| `enableShield` | Enable Shield addon for ALB | None | +| `enableWaf` | Enable WAF addon for ALB | None | +| `enableWafv2` | Enable WAF V2 addon for ALB | None | +| `ingressMaxConcurrentReconciles` | Maximum number of concurrently running reconcile loops for ingress | None | +| `logLevel` | Set the controller log level - info, debug | None | +| `metricsBindAddr` | The address the metric endpoint binds to | "" | +| `webhookConfig.disableIngressValidation` | Disables the validation of resources of kind Ingress | None | +| `webhookBindPort` | The TCP port the Webhook server binds to | None | +| `webhookTLS.caCert` | TLS CA certificate for webhook (auto-generated if not provided) | "" | +| `webhookTLS.cert` | TLS certificate for webhook (auto-generated if not provided) | "" | +| `webhookTLS.key` | TLS private key for webhook (auto-generated if not provided) | "" | +| `webhookNamespaceSelectors` | Namespace selectors for the wekbook | None | +| `keepTLSSecret` | Reuse existing TLS Secret during chart upgrade | `true` | +| `serviceAnnotations` | Annotations to be added to the provisioned webhook service resource | `{}` | +| `serviceMaxConcurrentReconciles` | Maximum number of concurrently running reconcile loops for service | None | +| `targetgroupbindingMaxConcurrentReconciles` | Maximum number of concurrently running reconcile loops for targetGroupBinding | None | +| `targetgroupbindingMaxExponentialBackoffDelay` | Maximum duration of exponential backoff for targetGroupBinding reconcile failures | None | +| `syncPeriod` | Period at which the controller forces the repopulation of its local object stores | None | +| `watchNamespace` | Namespace the controller watches for updates to Kubernetes objects, If empty, all namespaces are watched | None | +| `disableIngressClassAnnotation` | Disables the usage of kubernetes.io/ingress.class annotation | None | +| `disableIngressGroupNameAnnotation` | Disables the usage of alb.ingress.kubernetes.io/group.name annotation | None | +| `tolerateNonExistentBackendService` | whether to allow rules that reference a backend service that does not exist. (When enabled, it will return 503 error if backend service not exist) | `true` | +| `tolerateNonExistentBackendAction` | whether to allow rules that reference a backend action that does not exist. (When enabled, it will return 503 error if backend action not exist) | `true` | +| `defaultSSLPolicy` | Specifies the default SSL policy to use for HTTPS or TLS listeners | None | +| `externalManagedTags` | Specifies the list of tag keys on AWS resources that are managed externally | `[]` | +| `livenessProbe` | Liveness probe settings for the controller | (see `values.yaml`) | +| `env` | Environment variables to set for aws-load-balancer-controller pod | None | +| `envFrom` | Environment variables to set for aws-load-balancer-controller pod from configMap or Secret | None | +| `envSecretName` | AWS credentials as environment variables from Secret (Secret keys `key_id` and `access_key`). | None | +| `hostNetwork` | If `true`, use hostNetwork | `false` | +| `dnsPolicy` | Set dnsPolicy if required | `ClusterFirst` | +| `extraVolumeMounts` | Extra volume mounts for the pod | `[]` | +| `extraVolumes` | Extra volumes for the pod | `[]` | +| `defaultTags` | Default tags to apply to all AWS resources managed by this controller | `{}` | +| `replicaCount` | Number of controller pods to run, only one will be active due to leader election | `2` | +| `revisionHistoryLimit` | Number of revisions to keep | `10` | +| `podDisruptionBudget` | Limit the disruption for controller pods. Require at least 2 controller replicas and 3 worker nodes | `{}` | +| `updateStrategy` | Defines the update strategy for the deployment | `{}` | +| `enableCertManager` | If enabled, cert-manager issues the webhook certificates instead of the helm template, requires cert-manager and it's CRDs to be installed | `false` | +| `enableEndpointSlices` | If enabled, controller uses k8s EndpointSlices instead of Endpoints for IP targets | `false` | +| `enableBackendSecurityGroup` | If enabled, controller uses shared security group for backend traffic | `true` | +| `backendSecurityGroup` | Backend security group to use instead of auto created one if the feature is enabled | `` | +| `disableRestrictedSecurityGroupRules` | If disabled, controller will not specify port range restriction in the backend security group rules | `false` | +| `objectSelector.matchExpressions` | Webhook configuration to select specific pods by specifying the expression to be matched | None | +| `objectSelector.matchLabels` | Webhook configuration to select specific pods by specifying the key value label pair to be matched | None | +| `serviceMonitor.enabled` | Specifies whether a service monitor should be created, requires the ServiceMonitor CRD to be installed | `false` | +| `serviceMonitor.namespace` | Namespace in which to create the service monitor | None | +| `serviceMonitor.additionalLabels` | Labels to add to the service monitor | `{}` | +| `serviceMonitor.interval` | Prometheus scrape interval | `1m` | +| `serviceMonitor.scrapeTimeout` | Prometheus scrape timeout | `1m` | +| `serviceMonitor.relabelings` | Relabelings to apply to samples before ingestion | `1m` | +| `serviceMonitor.metricRelabelings` | Metric relabelings to apply to samples before ingestion | `1m` | +| `clusterSecretsPermissions.allowAllSecrets` | If `true`, controller has access to all secrets in the cluster. | `false` | +| `controllerConfig.featureGates` | set of `key: value` pairs that describe AWS load balance controller features | `{}` | +| `ingressClassConfig.default` | If `true`, the ingressclass will be the default class of the cluster. | `false` | +| `enableServiceMutatorWebhook` | If `false`, disable the Service Mutator webhook which makes all new services of type LoadBalancer reconciled by the lb controller | `true` | +| `serviceMutatorWebhookConfig.failurePolicy` | Failure policy for the Service Mutator webhook | `Fail` | +| `serviceMutatorWebhookConfig.objectSelector` | Object selector(s) to limit which objects will be mutated by the Service Mutator webhook | `[]` | +| `serviceMutatorWebhookConfig.operations` | List of operations that will trigger the the Service Mutator webhook | `[ CREATE ]` | +| `autoscaling` | If `autoscaling.enabled=true`, enable the HPA on the controller mainly to survive load induced failure by the calls to the `aws-load-balancer-webhook-service`. Please keep in mind that the controller pods have `priorityClassName: system-cluster-critical`, enabling HPA may lead to the eviction of other low-priority pods in the node | `false` | +| `serviceTargetENISGTags` | set of `key=value` pairs of AWS tags in addition to cluster name for finding the target ENI security group to which to add inbound rules from NLBs | None | +| `loadBalancerClass` | Sets the AWS load balancer type to be used when the Kubernetes service requests an external load balancer | `service.k8s.aws/nlb` | +| `creator` | if set to a `value!=helm`, it will disable the addition of default helm labels | `helm` | +| `runtimeClassName` | Runtime class name for the controller pods , such as `gvisor` or `kata`. An unspecified `nil` or empty `""` RuntimeClassName is equivalent to the backwards-compatible default behavior as if the RuntimeClass feature is disabled. | "" | diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/ci/extra_args b/charts/devtron-utilities/charts/aws-load-balancer-controller/ci/extra_args new file mode 100644 index 000000000..c72e0d8bc --- /dev/null +++ b/charts/devtron-utilities/charts/aws-load-balancer-controller/ci/extra_args @@ -0,0 +1 @@ +--set clusterName=k8s-ci-cluster diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/ci/values.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/ci/values.yaml new file mode 100644 index 000000000..4285476fa --- /dev/null +++ b/charts/devtron-utilities/charts/aws-load-balancer-controller/ci/values.yaml @@ -0,0 +1,7 @@ +# CI testing values for aws-load-balancer-controller + +region: us-west-2 +image: + repository: public.ecr.aws/eks/aws-load-balancer-controller + tag: v2.4.5 + pullPolicy: Always diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/crds/crds.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/crds/crds.yaml new file mode 100644 index 000000000..b72e68789 --- /dev/null +++ b/charts/devtron-utilities/charts/aws-load-balancer-controller/crds/crds.yaml @@ -0,0 +1,684 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.14.0 + name: ingressclassparams.elbv2.k8s.aws +spec: + group: elbv2.k8s.aws + names: + kind: IngressClassParams + listKind: IngressClassParamsList + plural: ingressclassparams + singular: ingressclassparams + scope: Cluster + versions: + - additionalPrinterColumns: + - description: The Ingress Group name + jsonPath: .spec.group.name + name: GROUP-NAME + type: string + - description: The AWS Load Balancer scheme + jsonPath: .spec.scheme + name: SCHEME + type: string + - description: The AWS Load Balancer ipAddressType + jsonPath: .spec.ipAddressType + name: IP-ADDRESS-TYPE + type: string + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: IngressClassParams is the Schema for the IngressClassParams API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: IngressClassParamsSpec defines the desired state of IngressClassParams + properties: + certificateArn: + description: CertificateArn specifies the ARN of the certificates + for all Ingresses that belong to IngressClass with this IngressClassParams. + items: + type: string + type: array + group: + description: Group defines the IngressGroup for all Ingresses that + belong to IngressClass with this IngressClassParams. + properties: + name: + description: Name is the name of IngressGroup. + type: string + required: + - name + type: object + inboundCIDRs: + description: InboundCIDRs specifies the CIDRs that are allowed to + access the Ingresses that belong to IngressClass with this IngressClassParams. + items: + type: string + type: array + ipAddressType: + description: IPAddressType defines the ip address type for all Ingresses + that belong to IngressClass with this IngressClassParams. + enum: + - ipv4 + - dualstack + - dualstack-without-public-ipv4 + type: string + listeners: + description: Listeners define a list of listeners with their protocol, + port and attributes. + items: + properties: + listenerAttributes: + description: The attributes of the listener + items: + description: Attributes defines custom attributes on resources. + properties: + key: + description: The key of the attribute. + type: string + value: + description: The value of the attribute. + type: string + required: + - key + - value + type: object + type: array + port: + description: The port of the listener + format: int32 + type: integer + protocol: + description: The protocol of the listener + type: string + type: object + type: array + loadBalancerAttributes: + description: LoadBalancerAttributes define the custom attributes to + LoadBalancers for all Ingress that that belong to IngressClass with + this IngressClassParams. + items: + description: Attributes defines custom attributes on resources. + properties: + key: + description: The key of the attribute. + type: string + value: + description: The value of the attribute. + type: string + required: + - key + - value + type: object + type: array + minimumLoadBalancerCapacity: + description: MinimumLoadBalancerCapacity define the capacity reservation + for LoadBalancers for all Ingress that belong to IngressClass with + this IngressClassParams. + properties: + capacityUnits: + description: The Capacity Units Value. + format: int32 + type: integer + required: + - capacityUnits + type: object + namespaceSelector: + description: |- + NamespaceSelector restrict the namespaces of Ingresses that are allowed to specify the IngressClass with this IngressClassParams. + * if absent or present but empty, it selects all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + scheme: + description: Scheme defines the scheme for all Ingresses that belong + to IngressClass with this IngressClassParams. + enum: + - internal + - internet-facing + type: string + sslPolicy: + description: SSLPolicy specifies the SSL Policy for all Ingresses + that belong to IngressClass with this IngressClassParams. + type: string + subnets: + description: Subnets defines the subnets for all Ingresses that belong + to IngressClass with this IngressClassParams. + properties: + ids: + description: IDs specify the resource IDs of subnets. Exactly + one of this or `tags` must be specified. + items: + description: SubnetID specifies a subnet ID. + pattern: subnet-[0-9a-f]+ + type: string + minItems: 1 + type: array + tags: + additionalProperties: + items: + type: string + type: array + description: |- + Tags specifies subnets in the load balancer's VPC where each + tag specified in the map key contains one of the values in the corresponding + value list. + Exactly one of this or `ids` must be specified. + type: object + type: object + tags: + description: Tags defines list of Tags on AWS resources provisioned + for Ingresses that belong to IngressClass with this IngressClassParams. + items: + description: Tag defines a AWS Tag on resources. + properties: + key: + description: The key of the tag. + type: string + value: + description: The value of the tag. + type: string + required: + - key + - value + type: object + type: array + type: object + type: object + served: true + storage: true + subresources: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.14.0 + name: targetgroupbindings.elbv2.k8s.aws +spec: + group: elbv2.k8s.aws + names: + kind: TargetGroupBinding + listKind: TargetGroupBindingList + plural: targetgroupbindings + singular: targetgroupbinding + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: The Kubernetes Service's name + jsonPath: .spec.serviceRef.name + name: SERVICE-NAME + type: string + - description: The Kubernetes Service's port + jsonPath: .spec.serviceRef.port + name: SERVICE-PORT + type: string + - description: The AWS TargetGroup's TargetType + jsonPath: .spec.targetType + name: TARGET-TYPE + type: string + - description: The AWS TargetGroup's Amazon Resource Name + jsonPath: .spec.targetGroupARN + name: ARN + priority: 1 + type: string + - description: The AWS TargetGroup's Name + jsonPath: .spec.targetGroupName + name: NAME + priority: 2 + type: string + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: TargetGroupBinding is the Schema for the TargetGroupBinding API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TargetGroupBindingSpec defines the desired state of TargetGroupBinding + properties: + multiClusterTargetGroup: + description: MultiClusterTargetGroup Denotes if the TargetGroup is + shared among multiple clusters + type: boolean + networking: + description: networking provides the networking setup for ELBV2 LoadBalancer + to access targets in TargetGroup. + properties: + ingress: + description: List of ingress rules to allow ELBV2 LoadBalancer + to access targets in TargetGroup. + items: + properties: + from: + description: |- + List of peers which should be able to access the targets in TargetGroup. + At least one NetworkingPeer should be specified. + items: + description: NetworkingPeer defines the source/destination + peer for networking rules. + properties: + ipBlock: + description: |- + IPBlock defines an IPBlock peer. + If specified, none of the other fields can be set. + properties: + cidr: + description: |- + CIDR is the network CIDR. + Both IPV4 or IPV6 CIDR are accepted. + type: string + required: + - cidr + type: object + securityGroup: + description: |- + SecurityGroup defines a SecurityGroup peer. + If specified, none of the other fields can be set. + properties: + groupID: + description: GroupID is the EC2 SecurityGroupID. + type: string + required: + - groupID + type: object + type: object + type: array + ports: + description: |- + List of ports which should be made accessible on the targets in TargetGroup. + If ports is empty or unspecified, it defaults to all ports with TCP. + items: + properties: + port: + anyOf: + - type: integer + - type: string + description: |- + The port which traffic must match. + When NodePort endpoints(instance TargetType) is used, this must be a numerical port. + When Port endpoints(ip TargetType) is used, this can be either numerical or named port on pods. + if port is unspecified, it defaults to all ports. + x-kubernetes-int-or-string: true + protocol: + description: |- + The protocol which traffic must match. + If protocol is unspecified, it defaults to TCP. + enum: + - TCP + - UDP + type: string + type: object + type: array + required: + - from + - ports + type: object + type: array + type: object + serviceRef: + description: serviceRef is a reference to a Kubernetes Service and + ServicePort. + properties: + name: + description: Name is the name of the Service. + type: string + port: + anyOf: + - type: integer + - type: string + description: Port is the port of the ServicePort. + x-kubernetes-int-or-string: true + required: + - name + - port + type: object + targetGroupARN: + description: targetGroupARN is the Amazon Resource Name (ARN) for + the TargetGroup. + type: string + targetGroupName: + description: targetGroupName is the Name of the TargetGroup. + type: string + targetType: + description: targetType is the TargetType of TargetGroup. If unspecified, + it will be automatically inferred. + enum: + - instance + - ip + type: string + required: + - serviceRef + type: object + status: + description: TargetGroupBindingStatus defines the observed state of TargetGroupBinding + properties: + observedGeneration: + description: The generation observed by the TargetGroupBinding controller. + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: The Kubernetes Service's name + jsonPath: .spec.serviceRef.name + name: SERVICE-NAME + type: string + - description: The Kubernetes Service's port + jsonPath: .spec.serviceRef.port + name: SERVICE-PORT + type: string + - description: The AWS TargetGroup's TargetType + jsonPath: .spec.targetType + name: TARGET-TYPE + type: string + - description: The AWS TargetGroup's Amazon Resource Name + jsonPath: .spec.targetGroupARN + name: ARN + priority: 1 + type: string + - description: The AWS TargetGroup's Name + jsonPath: .spec.targetGroupName + name: NAME + priority: 2 + type: string + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: TargetGroupBinding is the Schema for the TargetGroupBinding API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TargetGroupBindingSpec defines the desired state of TargetGroupBinding + properties: + ipAddressType: + description: ipAddressType specifies whether the target group is of + type IPv4 or IPv6. If unspecified, it will be automatically inferred. + enum: + - ipv4 + - ipv6 + type: string + multiClusterTargetGroup: + description: MultiClusterTargetGroup Denotes if the TargetGroup is + shared among multiple clusters + type: boolean + networking: + description: networking defines the networking rules to allow ELBV2 + LoadBalancer to access targets in TargetGroup. + properties: + ingress: + description: List of ingress rules to allow ELBV2 LoadBalancer + to access targets in TargetGroup. + items: + description: NetworkingIngressRule defines a particular set + of traffic that is allowed to access TargetGroup's targets. + properties: + from: + description: |- + List of peers which should be able to access the targets in TargetGroup. + At least one NetworkingPeer should be specified. + items: + description: NetworkingPeer defines the source/destination + peer for networking rules. + properties: + ipBlock: + description: |- + IPBlock defines an IPBlock peer. + If specified, none of the other fields can be set. + properties: + cidr: + description: |- + CIDR is the network CIDR. + Both IPV4 or IPV6 CIDR are accepted. + type: string + required: + - cidr + type: object + securityGroup: + description: |- + SecurityGroup defines a SecurityGroup peer. + If specified, none of the other fields can be set. + properties: + groupID: + description: GroupID is the EC2 SecurityGroupID. + type: string + required: + - groupID + type: object + type: object + type: array + ports: + description: |- + List of ports which should be made accessible on the targets in TargetGroup. + If ports is empty or unspecified, it defaults to all ports with TCP. + items: + description: NetworkingPort defines the port and protocol + for networking rules. + properties: + port: + anyOf: + - type: integer + - type: string + description: |- + The port which traffic must match. + When NodePort endpoints(instance TargetType) is used, this must be a numerical port. + When Port endpoints(ip TargetType) is used, this can be either numerical or named port on pods. + if port is unspecified, it defaults to all ports. + x-kubernetes-int-or-string: true + protocol: + description: |- + The protocol which traffic must match. + If protocol is unspecified, it defaults to TCP. + enum: + - TCP + - UDP + type: string + type: object + type: array + required: + - from + - ports + type: object + type: array + type: object + nodeSelector: + description: node selector for instance type target groups to only + register certain nodes + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + serviceRef: + description: serviceRef is a reference to a Kubernetes Service and + ServicePort. + properties: + name: + description: Name is the name of the Service. + type: string + port: + anyOf: + - type: integer + - type: string + description: Port is the port of the ServicePort. + x-kubernetes-int-or-string: true + required: + - name + - port + type: object + targetGroupARN: + description: targetGroupARN is the Amazon Resource Name (ARN) for + the TargetGroup. + type: string + targetGroupName: + description: targetGroupName is the Name of the TargetGroup. + type: string + targetType: + description: targetType is the TargetType of TargetGroup. If unspecified, + it will be automatically inferred. + enum: + - instance + - ip + type: string + vpcID: + description: VpcID is the VPC of the TargetGroup. If unspecified, + it will be automatically inferred. + type: string + required: + - serviceRef + type: object + status: + description: TargetGroupBindingStatus defines the observed state of TargetGroupBinding + properties: + observedGeneration: + description: The generation observed by the TargetGroupBinding controller. + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/NOTES.txt b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/NOTES.txt new file mode 100644 index 000000000..04e98e0a9 --- /dev/null +++ b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/NOTES.txt @@ -0,0 +1 @@ +AWS Load Balancer controller installed! diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/_helpers.tpl b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/_helpers.tpl new file mode 100644 index 000000000..d916b99c4 --- /dev/null +++ b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/_helpers.tpl @@ -0,0 +1,131 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "aws-load-balancer-controller.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "aws-load-balancer-controller.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "aws-load-balancer-controller.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Chart name prefix for resource names +Strip the "-controller" suffix from the default .Chart.Name if the nameOverride is not specified. +This enables using a shorter name for the resources, for example aws-load-balancer-webhook. +*/}} +{{- define "aws-load-balancer-controller.namePrefix" -}} +{{- $defaultNamePrefix := .Chart.Name | trimSuffix "-controller" -}} +{{- default $defaultNamePrefix .Values.nameOverride | trunc 42 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Common labels +*/}} +{{- define "aws-load-balancer-controller.labels" -}} +{{- if eq (default "helm" .Values.creator) "helm" -}} +app.kubernetes.io/managed-by: {{ .Release.Service }} +helm.sh/chart: {{ include "aws-load-balancer-controller.chart" . }} +{{- end }} +{{ include "aws-load-balancer-controller.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +{{- if .Values.additionalLabels }} +{{ toYaml .Values.additionalLabels }} +{{- end -}} +{{- end -}} + +{{/* +Selector labels +*/}} +{{- define "aws-load-balancer-controller.selectorLabels" -}} +app.kubernetes.io/name: {{ include "aws-load-balancer-controller.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "aws-load-balancer-controller.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "aws-load-balancer-controller.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the webhook service +*/}} +{{- define "aws-load-balancer-controller.webhookService" -}} +{{- printf "%s-webhook-service" (include "aws-load-balancer-controller.namePrefix" .) -}} +{{- end -}} + +{{/* +Create the name of the webhook cert secret +*/}} +{{- define "aws-load-balancer-controller.webhookCertSecret" -}} +{{- printf "%s-tls" (include "aws-load-balancer-controller.namePrefix" .) -}} +{{- end -}} + +{{/* +Generate certificates for webhook +*/}} +{{- define "aws-load-balancer-controller.webhookCerts" -}} +{{- $serviceName := (include "aws-load-balancer-controller.webhookService" .) -}} +{{- $secretName := (include "aws-load-balancer-controller.webhookCertSecret" .) -}} +{{- $secret := lookup "v1" "Secret" .Release.Namespace $secretName -}} +{{- if (and .Values.webhookTLS.caCert .Values.webhookTLS.cert .Values.webhookTLS.key) -}} +caCert: {{ .Values.webhookTLS.caCert | b64enc }} +clientCert: {{ .Values.webhookTLS.cert | b64enc }} +clientKey: {{ .Values.webhookTLS.key | b64enc }} +{{- else if and .Values.keepTLSSecret $secret -}} +caCert: {{ index $secret.data "ca.crt" }} +clientCert: {{ index $secret.data "tls.crt" }} +clientKey: {{ index $secret.data "tls.key" }} +{{- else -}} +{{- $altNames := list (printf "%s.%s" $serviceName .Release.Namespace) (printf "%s.%s.svc" $serviceName .Release.Namespace) (printf "%s.%s.svc.%s" $serviceName .Release.Namespace .Values.cluster.dnsDomain) -}} +{{- $ca := genCA "aws-load-balancer-controller-ca" 3650 -}} +{{- $cert := genSignedCert (include "aws-load-balancer-controller.fullname" .) nil $altNames 3650 $ca -}} +caCert: {{ $ca.Cert | b64enc }} +clientCert: {{ $cert.Cert | b64enc }} +clientKey: {{ $cert.Key | b64enc }} +{{- end -}} +{{- end -}} + +{{/* +Convert map to comma separated key=value string +*/}} +{{- define "aws-load-balancer-controller.convertMapToCsv" -}} +{{- range $key, $value := . -}} {{ $key }}={{ $value }}, {{- end -}} +{{- end -}} + +{{/* +Create the name of the ingressClassParams +*/}} +{{- define "aws-load-balancer-controller.ingressClassParamsName" -}} +{{ default .Values.ingressClass .Values.ingressClassParams.name }} +{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/deployment.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/deployment.yaml new file mode 100644 index 000000000..4506d489e --- /dev/null +++ b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/deployment.yaml @@ -0,0 +1,263 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "aws-load-balancer-controller.fullname" . }} + namespace: {{ .Release.Namespace }} + {{- if .Values.deploymentAnnotations }} + annotations: + {{- toYaml .Values.deploymentAnnotations | nindent 4 }} + {{- end }} + labels: + {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} +spec: + replicas: {{ .Values.replicaCount }} + revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} + selector: + matchLabels: + {{- include "aws-load-balancer-controller.selectorLabels" . | nindent 6 }} + {{- with .Values.updateStrategy }} + strategy: + {{ toYaml . | nindent 4 }} + {{- end }} + template: + metadata: + labels: + {{- include "aws-load-balancer-controller.selectorLabels" . | nindent 8 }} + {{- if .Values.podLabels }} + {{- toYaml .Values.podLabels | nindent 8 }} + {{- end }} + annotations: + {{- if not .Values.serviceMonitor.enabled }} + prometheus.io/scrape: "true" + prometheus.io/port: "{{ (split ":" .Values.metricsBindAddr)._1 | default 8080 }}" + {{- end}} + {{- if .Values.podAnnotations }} + {{- toYaml .Values.podAnnotations | nindent 8 }} + {{- end }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.runtimeClassName }} + runtimeClassName: {{ .Values.runtimeClassName }} + {{- end }} + serviceAccountName: {{ include "aws-load-balancer-controller.serviceAccountName" . }} + volumes: + - name: cert + secret: + defaultMode: 420 + secretName: {{ template "aws-load-balancer-controller.webhookCertSecret" . }} + {{- with .Values.extraVolumes }} + {{ toYaml . | nindent 6 }} + {{- end }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + {{- if .Values.hostNetwork }} + hostNetwork: true + {{- end }} + {{- if .Values.dnsPolicy }} + dnsPolicy: {{ .Values.dnsPolicy }} + {{- end }} + containers: + - name: {{ .Chart.Name }} + args: + - --cluster-name={{ required "Chart cannot be installed without a valid clusterName!" (tpl (default "" .Values.clusterName) .) }} + {{- if .Values.ingressClass }} + - --ingress-class={{ .Values.ingressClass }} + {{- end }} + {{- $region := tpl (default "" .Values.region) . }} + {{- if $region }} + - --aws-region={{ .Values.region }} + {{- end }} + {{- $vpcID := tpl (default "" .Values.vpcId) . }} + {{- if $vpcID }} + - --aws-vpc-id={{ $vpcID }} + {{- end }} + {{- if .Values.awsApiEndpoints }} + - --aws-api-endpoints={{ .Values.awsApiEndpoints }} + {{- end }} + {{- if .Values.awsApiThrottle }} + - --aws-api-throttle={{ join "," .Values.awsApiThrottle }} + {{- end }} + {{- if .Values.awsMaxRetries }} + - --aws-max-retries={{ .Values.awsMaxRetries }} + {{- end }} + {{- if kindIs "bool" .Values.enablePodReadinessGateInject }} + - --enable-pod-readiness-gate-inject={{ .Values.enablePodReadinessGateInject }} + {{- end }} + {{- if kindIs "bool" .Values.enableShield }} + - --enable-shield={{ .Values.enableShield }} + {{- end }} + {{- if kindIs "bool" .Values.enableWaf }} + - --enable-waf={{ .Values.enableWaf }} + {{- end }} + {{- if kindIs "bool" .Values.enableWafv2 }} + - --enable-wafv2={{ .Values.enableWafv2 }} + {{- end }} + {{- if .Values.metricsBindAddr }} + - --metrics-bind-addr={{ .Values.metricsBindAddr }} + {{- end }} + {{- if .Values.ingressMaxConcurrentReconciles }} + - --ingress-max-concurrent-reconciles={{ .Values.ingressMaxConcurrentReconciles }} + {{- end }} + {{- if .Values.serviceMaxConcurrentReconciles }} + - --service-max-concurrent-reconciles={{ .Values.serviceMaxConcurrentReconciles }} + {{- end }} + {{- if .Values.targetgroupbindingMaxConcurrentReconciles }} + - --targetgroupbinding-max-concurrent-reconciles={{ .Values.targetgroupbindingMaxConcurrentReconciles }} + {{- end }} + {{- if .Values.targetgroupbindingMaxExponentialBackoffDelay }} + - --targetgroupbinding-max-exponential-backoff-delay={{ .Values.targetgroupbindingMaxExponentialBackoffDelay }} + {{- end }} + {{- if .Values.lbStabilizationMonitorInterval }} + - --lb-stabilization-monitor-interval={{ .Values.lbStabilizationMonitorInterval }} + {{- end }} + {{- if .Values.logLevel }} + - --log-level={{ .Values.logLevel }} + {{- end }} + {{- if .Values.webhookBindPort }} + - --webhook-bind-port={{ .Values.webhookBindPort }} + {{- end }} + {{- if .Values.syncPeriod }} + - --sync-period={{ .Values.syncPeriod }} + {{- end }} + {{- if .Values.watchNamespace }} + - --watch-namespace={{ .Values.watchNamespace }} + {{- end }} + {{- if kindIs "bool" .Values.disableIngressClassAnnotation }} + - --disable-ingress-class-annotation={{ .Values.disableIngressClassAnnotation }} + {{- end }} + {{- if kindIs "bool" .Values.disableIngressGroupNameAnnotation }} + - --disable-ingress-group-name-annotation={{ .Values.disableIngressGroupNameAnnotation }} + {{- end }} + {{- if kindIs "bool" .Values.tolerateNonExistentBackendService }} + - --tolerate-non-existent-backend-service={{ .Values.tolerateNonExistentBackendService }} + {{- end }} + {{- if kindIs "bool" .Values.tolerateNonExistentBackendAction }} + - --tolerate-non-existent-backend-action={{ .Values.tolerateNonExistentBackendAction }} + {{- end }} + {{- if .Values.defaultSSLPolicy }} + - --default-ssl-policy={{ .Values.defaultSSLPolicy }} + {{- end }} + {{- if .Values.externalManagedTags }} + - --external-managed-tags={{ join "," .Values.externalManagedTags }} + {{- end }} + {{- if .Values.defaultTags }} + - --default-tags={{ include "aws-load-balancer-controller.convertMapToCsv" .Values.defaultTags | trimSuffix "," }} + {{- end }} + {{- if kindIs "bool" .Values.enableEndpointSlices }} + - --enable-endpoint-slices={{ .Values.enableEndpointSlices }} + {{- end }} + {{- if kindIs "bool" .Values.enableBackendSecurityGroup }} + - --enable-backend-security-group={{ .Values.enableBackendSecurityGroup }} + {{- end }} + {{- if .Values.backendSecurityGroup }} + - --backend-security-group={{ .Values.backendSecurityGroup }} + {{- end }} + {{- if kindIs "bool" .Values.disableRestrictedSecurityGroupRules }} + - --disable-restricted-sg-rules={{ .Values.disableRestrictedSecurityGroupRules }} + {{- end }} + {{- if .Values.controllerConfig.featureGates }} + - --feature-gates={{ include "aws-load-balancer-controller.convertMapToCsv" .Values.controllerConfig.featureGates | trimSuffix "," }} + {{- end }} + {{- if ne .Values.defaultTargetType "instance" }} + - --default-target-type={{ .Values.defaultTargetType }} + {{- end }} + {{- if .Values.serviceTargetENISGTags }} + - --service-target-eni-security-group-tags={{ .Values.serviceTargetENISGTags }} + {{- end }} + {{- if .Values.certDiscovery.allowedCertificateAuthorityARNs }} + - --allowed-certificate-authority-arns={{ .Values.certDiscovery.allowedCertificateAuthorityARNs }} + {{- end }} + {{- if .Values.loadBalancerClass }} + - --load-balancer-class={{ .Values.loadBalancerClass }} + {{- end }} + {{- if or .Values.env .Values.envSecretName }} + env: + {{- if .Values.env}} + {{- range $key, $value := .Values.env }} + - name: {{ $key }} + value: "{{ $value }}" + {{- end }} + {{- end }} + {{- if .Values.envSecretName }} + - name: AWS_ACCESS_KEY_ID + valueFrom: + secretKeyRef: + name: {{ .Values.envSecretName }} + key: key_id + optional: true + - name: AWS_SECRET_ACCESS_KEY + valueFrom: + secretKeyRef: + name: {{ .Values.envSecretName }} + key: access_key + optional: true + {{- end }} + {{- end }} + {{- if .Values.envFrom }} + envFrom: + {{- toYaml .Values.envFrom | nindent 10 }} + {{- end }} + securityContext: + {{- toYaml .Values.securityContext | nindent 10 }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true + {{- with .Values.extraVolumeMounts }} + {{ toYaml . | nindent 8 }} + {{- end }} + ports: + - name: webhook-server + containerPort: {{ .Values.webhookBindPort | default 9443 }} + protocol: TCP + - name: metrics-server + containerPort: {{ (split ":" .Values.metricsBindAddr)._1 | default 8080 }} + protocol: TCP + resources: + {{- toYaml .Values.resources | nindent 10 }} + {{- with .Values.livenessProbe }} + livenessProbe: + {{- toYaml . | nindent 10 }} + {{- end }} + {{- with .Values.readinessProbe }} + readinessProbe: + {{- toYaml . | nindent 10 }} + {{- end }} + terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.affinity }} + affinity: + {{- toYaml .Values.affinity | nindent 8 }} + {{- else if .Values.configureDefaultAffinity }} + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 100 + podAffinityTerm: + labelSelector: + matchExpressions: + - key: app.kubernetes.io/name + operator: In + values: + - {{ include "aws-load-balancer-controller.name" . }} + topologyKey: kubernetes.io/hostname + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.priorityClassName }} + priorityClassName: {{ .Values.priorityClassName | quote }} + {{- end }} + {{- with .Values.topologySpreadConstraints }} + topologySpreadConstraints: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/hpa.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/hpa.yaml new file mode 100644 index 000000000..68689ba66 --- /dev/null +++ b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/hpa.yaml @@ -0,0 +1,34 @@ +{{- if .Values.autoscaling.enabled }} +{{- if (semverCompare ">=1.23-0" .Capabilities.KubeVersion.Version)}} +apiVersion: autoscaling/v2 +{{- else }} +apiVersion: autoscaling/v2beta2 +{{- end }} +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "aws-load-balancer-controller.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} + annotations: + {{- .Values.annotations | toYaml | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "aws-load-balancer-controller.fullname" . }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + maxReplicas: {{ required "A valid .Values.autoscaling.maxReplicas value is required" .Values.autoscaling.maxReplicas }} + metrics: + {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + target: + averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} + type: Utilization + {{- end }} + {{- if .Values.autoscaling.autoscaleBehavior }} + behavior: {{ toYaml .Values.autoscaling.autoscaleBehavior | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/ingressclass.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/ingressclass.yaml new file mode 100644 index 000000000..feed802d2 --- /dev/null +++ b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/ingressclass.yaml @@ -0,0 +1,41 @@ +{{- /* +[caution] AWSLoadBalancerController <= v2.4.2 expects referenced IngressClassParams to be created before IngressClass. +We use a list here to force Helm create IngressClassParams(if any) before apply any IngressClass changes. +*/}} +{{- if .Values.createIngressClassResource }} +apiVersion: v1 +kind: List +metadata: + name: ingress-class +items: +{{- if .Values.ingressClassParams.create }} +- apiVersion: elbv2.k8s.aws/v1beta1 + kind: IngressClassParams + metadata: + name: {{ include "aws-load-balancer-controller.ingressClassParamsName" . }} + labels: + {{- include "aws-load-balancer-controller.labels" . | nindent 6 }} + {{- with .Values.ingressClassParams.spec }} + spec: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} +- apiVersion: networking.k8s.io/v1 + kind: IngressClass + metadata: + name: {{ .Values.ingressClass }} + labels: + {{- include "aws-load-balancer-controller.labels" . | nindent 6 }} + {{- if .Values.ingressClassConfig.default }} + annotations: + ingressclass.kubernetes.io/is-default-class: "true" + {{- end }} + spec: + controller: ingress.k8s.aws/alb + {{- if or .Values.ingressClassParams.name (and .Values.ingressClassParams.create .Values.ingressClassParams.spec) }} + parameters: + apiGroup: elbv2.k8s.aws + kind: IngressClassParams + name: {{ include "aws-load-balancer-controller.ingressClassParamsName" . }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/pdb.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/pdb.yaml new file mode 100644 index 000000000..f72abaf34 --- /dev/null +++ b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/pdb.yaml @@ -0,0 +1,14 @@ +{{- if and .Values.podDisruptionBudget (gt (int .Values.replicaCount) 1) }} +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: {{ include "aws-load-balancer-controller.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} +spec: + selector: + matchLabels: + {{- include "aws-load-balancer-controller.selectorLabels" . | nindent 6 }} + {{- toYaml .Values.podDisruptionBudget | nindent 2 }} +{{- end }} diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/rbac.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/rbac.yaml new file mode 100644 index 000000000..0dcc68c77 --- /dev/null +++ b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/rbac.yaml @@ -0,0 +1,107 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ template "aws-load-balancer-controller.fullname" . }}-leader-election-role + namespace: {{ .Release.Namespace }} + labels: + {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} +rules: +- apiGroups: [""] + resources: [configmaps] + verbs: [create] +- apiGroups: [""] + resources: [configmaps] + resourceNames: [aws-load-balancer-controller-leader] + verbs: [get, patch, update] +- apiGroups: + - "coordination.k8s.io" + resources: + - leases + verbs: + - create +- apiGroups: + - "coordination.k8s.io" + resources: + - leases + resourceNames: + - aws-load-balancer-controller-leader + verbs: + - get + - update + - patch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ template "aws-load-balancer-controller.fullname" . }}-leader-election-rolebinding + namespace: {{ .Release.Namespace }} + labels: + {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "aws-load-balancer-controller.fullname" . }}-leader-election-role +subjects: +- kind: ServiceAccount + name: {{ template "aws-load-balancer-controller.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "aws-load-balancer-controller.fullname" . }}-role + labels: + {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} +rules: +- apiGroups: ["elbv2.k8s.aws"] + resources: [targetgroupbindings] + verbs: [create, delete, get, list, patch, update, watch] +- apiGroups: ["elbv2.k8s.aws"] + resources: [ingressclassparams] + verbs: [get, list, watch] +- apiGroups: [""] + resources: [events] + verbs: [create, patch] +- apiGroups: [""] + resources: [pods] + verbs: [get, list, watch] +- apiGroups: ["networking.k8s.io"] + resources: [ingressclasses] + verbs: [get, list, watch] +- apiGroups: ["", "extensions", "networking.k8s.io"] + resources: [services, ingresses] + verbs: [get, list, patch, update, watch] +- apiGroups: [""] + resources: [nodes, namespaces, endpoints] + verbs: [get, list, watch] +- apiGroups: [""] + resources: [configmaps] + verbs: [get, delete, create, update] +{{- if .Values.clusterSecretsPermissions.allowAllSecrets }} +- apiGroups: [""] + resources: [secrets] + verbs: [get, list, watch] +{{- end }} +- apiGroups: ["elbv2.k8s.aws", "", "extensions", "networking.k8s.io"] + resources: [targetgroupbindings/status, pods/status, services/status, ingresses/status] + verbs: [update, patch] +- apiGroups: ["discovery.k8s.io"] + resources: [endpointslices] + verbs: [get, list, watch] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "aws-load-balancer-controller.fullname" . }}-rolebinding + labels: + {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "aws-load-balancer-controller.fullname" . }}-role +subjects: +- kind: ServiceAccount + name: {{ template "aws-load-balancer-controller.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/service.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/service.yaml new file mode 100644 index 000000000..aad0044eb --- /dev/null +++ b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/service.yaml @@ -0,0 +1,41 @@ +{{- if.Values.serviceMonitor.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ template "aws-load-balancer-controller.fullname" . }} + namespace: {{ .Release.Namespace }} + {{- with .Values.serviceAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} +spec: + ports: + - port: 8080 + name: metrics-server + targetPort: metrics-server + selector: + {{- include "aws-load-balancer-controller.selectorLabels" . | nindent 4 }} +--- +{{- end }} +apiVersion: v1 +kind: Service +metadata: + name: {{ template "aws-load-balancer-controller.webhookService" . }} + namespace: {{ .Release.Namespace }} + {{- with .Values.serviceAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} + app.kubernetes.io/component: webhook + prometheus.io/service-monitor: "false" +spec: + ports: + - port: 443 + name: webhook-server + targetPort: webhook-server + selector: + {{- include "aws-load-balancer-controller.selectorLabels" . | nindent 4 }} diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/serviceaccount.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/serviceaccount.yaml new file mode 100644 index 000000000..f4cfcac69 --- /dev/null +++ b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/serviceaccount.yaml @@ -0,0 +1,18 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "aws-load-balancer-controller.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} +{{- with .Values.serviceAccount.imagePullSecrets }} +imagePullSecrets: +{{ toYaml . }} +{{- end }} +{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/servicemonitor.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/servicemonitor.yaml new file mode 100644 index 000000000..0454558c2 --- /dev/null +++ b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/servicemonitor.yaml @@ -0,0 +1,43 @@ +{{- if.Values.serviceMonitor.enabled -}} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ include "aws-load-balancer-controller.fullname" . }} + namespace: {{ default .Release.Namespace .Values.serviceMonitor.namespace }} + labels: + {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} + {{- with .Values.serviceMonitor.additionalLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + jobLabel: app.kubernetes.io/instance + namespaceSelector: + matchNames: + - {{ .Release.Namespace }} + selector: + matchLabels: + {{- include "aws-load-balancer-controller.selectorLabels" . | nindent 6 }} + matchExpressions: + - key: prometheus.io/service-monitor + operator: NotIn + values: + - "false" + endpoints: + - port: metrics-server + path: /metrics + scheme: http + {{- with .Values.serviceMonitor.interval }} + interval: {{ . }} + {{- end }} + {{- with .Values.serviceMonitor.scrapeTimeout }} + scrapeTimeout: {{ . }} + {{- end }} + {{- with .Values.serviceMonitor.relabelings }} + relabelings: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.serviceMonitor.metricRelabelings }} + metricRelabelings: + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/webhook.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/webhook.yaml new file mode 100644 index 000000000..504f08ccb --- /dev/null +++ b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/webhook.yaml @@ -0,0 +1,250 @@ +{{ $tls := fromYaml ( include "aws-load-balancer-controller.webhookCerts" . ) }} +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: +{{- if $.Values.enableCertManager }} + annotations: + cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "aws-load-balancer-controller.namePrefix" . }}-serving-cert +{{- end }} + name: {{ include "aws-load-balancer-controller.namePrefix" . }}-webhook + labels: + {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} +webhooks: +- clientConfig: + {{ if not $.Values.enableCertManager -}} + caBundle: {{ $tls.caCert }} + {{ end }} + service: + name: {{ template "aws-load-balancer-controller.webhookService" . }} + namespace: {{ $.Release.Namespace }} + path: /mutate-v1-pod + failurePolicy: Fail + name: mpod.elbv2.k8s.aws + admissionReviewVersions: + - v1beta1 + namespaceSelector: + matchExpressions: + {{ if .Values.webhookNamespaceSelectors }} + {{ toYaml .Values.webhookNamespaceSelectors | nindent 4 }} + {{ else }} + - key: elbv2.k8s.aws/pod-readiness-gate-inject + operator: In + values: + - enabled + {{ end }} + objectSelector: + matchExpressions: + - key: app.kubernetes.io/name + operator: NotIn + values: + - {{ include "aws-load-balancer-controller.name" . }} + {{- if .Values.objectSelector.matchExpressions }} + {{- toYaml .Values.objectSelector.matchExpressions | nindent 4 }} + {{- end }} + {{- if .Values.objectSelector.matchLabels }} + matchLabels: + {{- toYaml .Values.objectSelector.matchLabels | nindent 6 }} + {{- end }} + rules: + - apiGroups: + - "" + apiVersions: + - v1 + operations: + - CREATE + resources: + - pods + sideEffects: None +{{- if .Values.enableServiceMutatorWebhook }} +- clientConfig: + {{ if not $.Values.enableCertManager -}} + caBundle: {{ $tls.caCert }} + {{ end }} + service: + name: {{ template "aws-load-balancer-controller.webhookService" . }} + namespace: {{ $.Release.Namespace }} + path: /mutate-v1-service + failurePolicy: {{ .Values.serviceMutatorWebhookConfig.failurePolicy }} + name: mservice.elbv2.k8s.aws + admissionReviewVersions: + - v1beta1 + objectSelector: + matchExpressions: + - key: app.kubernetes.io/name + operator: NotIn + values: + - {{ include "aws-load-balancer-controller.name" . }} + {{- if .Values.serviceMutatorWebhookConfig.objectSelector.matchExpressions }} + {{- toYaml .Values.serviceMutatorWebhookConfig.objectSelector.matchExpressions | nindent 4 }} + {{- end }} + + {{- if .Values.serviceMutatorWebhookConfig.objectSelector.matchLabels }} + matchLabels: + {{- toYaml .Values.serviceMutatorWebhookConfig.objectSelector.matchLabels | nindent 6 }} + {{- end }} + rules: + - apiGroups: + - "" + apiVersions: + - v1 + operations: + {{- toYaml .Values.serviceMutatorWebhookConfig.operations | nindent 4 }} + resources: + - services + sideEffects: None +{{- end }} +- clientConfig: + {{ if not $.Values.enableCertManager -}} + caBundle: {{ $tls.caCert }} + {{ end }} + service: + name: {{ template "aws-load-balancer-controller.webhookService" . }} + namespace: {{ $.Release.Namespace }} + path: /mutate-elbv2-k8s-aws-v1beta1-targetgroupbinding + failurePolicy: Fail + name: mtargetgroupbinding.elbv2.k8s.aws + admissionReviewVersions: + - v1beta1 + rules: + - apiGroups: + - elbv2.k8s.aws + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - targetgroupbindings + sideEffects: None +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: +{{- if $.Values.enableCertManager }} + annotations: + cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "aws-load-balancer-controller.namePrefix" . }}-serving-cert +{{- end }} + name: {{ include "aws-load-balancer-controller.namePrefix" . }}-webhook + labels: + {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} +webhooks: +- clientConfig: + {{ if not $.Values.enableCertManager -}} + caBundle: {{ $tls.caCert }} + {{ end }} + service: + name: {{ template "aws-load-balancer-controller.webhookService" . }} + namespace: {{ $.Release.Namespace }} + path: /validate-elbv2-k8s-aws-v1beta1-ingressclassparams + failurePolicy: Fail + name: vingressclassparams.elbv2.k8s.aws + admissionReviewVersions: + - v1beta1 + objectSelector: + matchExpressions: + - key: app.kubernetes.io/name + operator: NotIn + values: + - {{ include "aws-load-balancer-controller.name" . }} + rules: + - apiGroups: + - elbv2.k8s.aws + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - ingressclassparams + sideEffects: None +- clientConfig: + {{ if not $.Values.enableCertManager -}} + caBundle: {{ $tls.caCert }} + {{ end }} + service: + name: {{ template "aws-load-balancer-controller.webhookService" . }} + namespace: {{ $.Release.Namespace }} + path: /validate-elbv2-k8s-aws-v1beta1-targetgroupbinding + failurePolicy: Fail + name: vtargetgroupbinding.elbv2.k8s.aws + admissionReviewVersions: + - v1beta1 + rules: + - apiGroups: + - elbv2.k8s.aws + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - targetgroupbindings + sideEffects: None +{{- if not $.Values.webhookConfig.disableIngressValidation }} +- clientConfig: + {{ if not $.Values.enableCertManager -}} + caBundle: {{ $tls.caCert }} + {{ end }} + service: + name: {{ template "aws-load-balancer-controller.webhookService" . }} + namespace: {{ $.Release.Namespace }} + path: /validate-networking-v1-ingress + failurePolicy: Fail + matchPolicy: Equivalent + name: vingress.elbv2.k8s.aws + admissionReviewVersions: + - v1beta1 + rules: + - apiGroups: + - networking.k8s.io + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - ingresses + sideEffects: None +{{- end }} +--- +{{- if not $.Values.enableCertManager }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "aws-load-balancer-controller.webhookCertSecret" . }} + namespace: {{ .Release.Namespace }} + labels: +{{ include "aws-load-balancer-controller.labels" . | indent 4 }} +type: kubernetes.io/tls +data: + ca.crt: {{ $tls.caCert }} + tls.crt: {{ $tls.clientCert }} + tls.key: {{ $tls.clientKey }} +{{- else }} +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: {{ template "aws-load-balancer-controller.namePrefix" . }}-serving-cert + namespace: {{ .Release.Namespace }} + labels: +{{ include "aws-load-balancer-controller.labels" . | indent 4 }} +spec: + dnsNames: + - {{ template "aws-load-balancer-controller.webhookService" . }}.{{ .Release.Namespace }}.svc + - {{ template "aws-load-balancer-controller.webhookService" . }}.{{ .Release.Namespace }}.svc.{{ .Values.cluster.dnsDomain }} + issuerRef: + kind: Issuer + name: {{ template "aws-load-balancer-controller.namePrefix" . }}-selfsigned-issuer + secretName: {{ template "aws-load-balancer-controller.webhookCertSecret" . }} +--- +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: {{ template "aws-load-balancer-controller.namePrefix" . }}-selfsigned-issuer + namespace: {{ .Release.Namespace }} + labels: +{{ include "aws-load-balancer-controller.labels" . | indent 4 }} +spec: + selfSigned: {} +{{- end }} diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/values.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/values.yaml new file mode 100644 index 000000000..c2f465bcd --- /dev/null +++ b/charts/devtron-utilities/charts/aws-load-balancer-controller/values.yaml @@ -0,0 +1,436 @@ +# Default values for aws-load-balancer-controller. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 2 + +revisionHistoryLimit: 10 + +image: + repository: public.ecr.aws/eks/aws-load-balancer-controller + tag: v2.11.0 + pullPolicy: IfNotPresent + +runtimeClassName: "" +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +# AWS LBC only has 1 main working pod, other pods are just standby +# the purpose of enable hpa is to survive load induced failure by the calls to the aws-load-balancer-webhook-service +# since the calls from kube-apiserver are sent round-robin to all replicas, and the failure policy on those webhooks is Fail +# if the pods become overloaded and do not respond within the timeout that could block the creation of pods, targetgroupbindings or ingresses +# Please keep in mind that the controller pods have `priorityClassName: system-cluster-critical`, enabling HPA may lead to the eviction of other low-priority pods in the node +autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 5 + targetCPUUtilizationPercentage: 80 + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: + # Automount API credentials for a Service Account. + automountServiceAccountToken: true + # List of image pull secrets to add to the Service Account. + imagePullSecrets: + # - name: docker + +rbac: + # Specifies whether rbac resources should be created + create: true + +podSecurityContext: + fsGroup: 65534 + +securityContext: + # capabilities: + # drop: + # - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + +# Time period for the controller pod to do a graceful shutdown +terminationGracePeriodSeconds: 10 + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + +# priorityClassName specifies the PriorityClass to indicate the importance of controller pods +# ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass +priorityClassName: system-cluster-critical + +nodeSelector: {} + +tolerations: [] + +# affinity specifies a custom affinity for the controller pods +affinity: {} + +# configureDefaultAffinity specifies whether to configure a default affinity for the controller pods to prevent +# co-location on the same node. This will get ignored if you specify a custom affinity configuration. +configureDefaultAffinity: true + +# topologySpreadConstraints is a stable feature of k8s v1.19 which provides the ability to +# control how Pods are spread across your cluster among failure-domains such as regions, zones, +# nodes, and other user-defined topology domains. +# +# more details here: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ +topologySpreadConstraints: {} + +updateStrategy: {} + # type: RollingUpdate + # rollingUpdate: + # maxSurge: 1 + # maxUnavailable: 1 + +# serviceAnnotations contains annotations to be added to the provisioned webhook service resource +serviceAnnotations: {} + +# deploymentAnnotations contains annotations for the controller deployment +deploymentAnnotations: {} + +podAnnotations: {} + +podLabels: {} + +# additionalLabels -- Labels to add to each object of the chart. +additionalLabels: {} + +# Enable cert-manager +enableCertManager: false + +# The name of the Kubernetes cluster. A non-empty value is required +clusterName: + +# cluster contains configurations specific to the kubernetes cluster +cluster: + # Cluster DNS domain (required for requesting TLS certificates) + dnsDomain: cluster.local + +# The ingress class this controller will satisfy. If not specified, controller will match all +# ingresses without ingress class annotation and ingresses of type alb +ingressClass: alb + +# ingressClassParams specify the IngressCLassParams that enforce settings for a set of Ingresses when using with ingress Controller. +ingressClassParams: + create: true + # The name of ingressClassParams resource will be referred in ingressClass + name: + spec: {} + # Due to dependency issue, the validation webhook ignores this particular ingressClassParams resource. + # We recommend creating ingressClassParams resources separately after installing this chart and the + # controller is functional. + # + # You can set the specifications in the `helm install` command through `--set` or `--set-string` + # If you do want to specify in the values.yaml, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'spec:' + # + # namespaceSelector: + # matchLabels: + # group: + # scheme: + # ipAddressType: + # tags: + # loadBalancerAttributes: + # - key: + # value: + +# To use IngressClass resource instead of annotation, before you need to install the IngressClass resource pointing to controller. +# If specified as true, the IngressClass resource will be created. +createIngressClassResource: true + +# The AWS region for the kubernetes cluster. Set to use KIAM or kube2iam for example. +region: + +# The VPC ID for the Kubernetes cluster. Set this manually when your pods are unable to use the metadata service to determine this automatically +vpcId: + +# Custom AWS API Endpoints (serviceID1=URL1,serviceID2=URL2) +awsApiEndpoints: + +# awsApiThrottle specifies custom AWS API throttle settings (serviceID1:operationRegex1=rate:burst,serviceID2:operationRegex2=rate:burst) +# example: --set awsApiThrottle="{Elastic Load Balancing v2:RegisterTargets|DeregisterTargets=4:20,Elastic Load Balancing v2:.*=10:40}" +awsApiThrottle: + +# Maximum retries for AWS APIs (default 10) +awsMaxRetries: + +# Default target type. Used as the default value of the "alb.ingress.kubernetes.io/target-type" and +# "service.beta.kubernetes.io/aws-load-balancer-nlb-target-type" annotations. +# Possible values are "ip" and "instance" +# The value "ip" should be used for ENI-based CNIs, such as the Amazon VPC CNI, +# Calico with encapsulation disabled, or Cilium with masquerading disabled. +# The value "instance" should be used for overlay-based CNIs, such as Calico in VXLAN or IPIP mode or +# Cilium with masquerading enabled. +defaultTargetType: instance + +# If enabled, targetHealth readiness gate will get injected to the pod spec for the matching endpoint pods (default true) +enablePodReadinessGateInject: + +# Enable Shield addon for ALB (default true) +enableShield: + +# Enable WAF addon for ALB (default true) +enableWaf: + +# Enable WAF V2 addon for ALB (default true) +enableWafv2: + +# Maximum number of concurrently running reconcile loops for ingress (default 3) +ingressMaxConcurrentReconciles: + +# Set the controller log level - info(default), debug (default "info") +logLevel: + +# The address the metric endpoint binds to. (default ":8080") +metricsBindAddr: "" + +webhookConfig: + # disableIngressValidation disables the validation of resources of kind Ingress, false by default + disableIngressValidation: + +# The TCP port the Webhook server binds to. (default 9443) +webhookBindPort: + +# webhookTLS specifies TLS cert/key for the webhook +webhookTLS: + caCert: + cert: + key: + +# array of namespace selectors for the pod mutator webhook +webhookNamespaceSelectors: +# - key: elbv2.k8s.aws/pod-readiness-gate-inject +# operator: In +# values: +# - enabled + +# keepTLSSecret specifies whether to reuse existing TLS secret for chart upgrade +keepTLSSecret: true + +# Maximum number of concurrently running reconcile loops for service (default 3) +serviceMaxConcurrentReconciles: + +# Maximum number of concurrently running reconcile loops for targetGroupBinding +targetgroupbindingMaxConcurrentReconciles: + +# Maximum duration of exponential backoff for targetGroupBinding reconcile failures +targetgroupbindingMaxExponentialBackoffDelay: + +# Interval at which the controller monitors the state of load balancer after creation for stabilization +lbStabilizationMonitorInterval: + +# Period at which the controller forces the repopulation of its local object stores. (default 10h0m0s) +syncPeriod: + +# Namespace the controller watches for updates to Kubernetes objects, If empty, all namespaces are watched. +watchNamespace: + +# disableIngressClassAnnotation disables the usage of kubernetes.io/ingress.class annotation, false by default +disableIngressClassAnnotation: + +# disableIngressGroupNameAnnotation disables the usage of alb.ingress.kubernetes.io/group.name annotation, false by default +disableIngressGroupNameAnnotation: + +# tolerateNonExistentBackendService permits rules which specify backend services that don't exist, true by default (When enabled, it will return 503 error if backend service not exist) +tolerateNonExistentBackendService: + +# tolerateNonExistentBackendAction permits rules which specify backend actions that don't exist, true by default (When enabled, it will return 503 error if backend action not exist) +tolerateNonExistentBackendAction: + +# defaultSSLPolicy specifies the default SSL policy to use for TLS/HTTPS listeners +defaultSSLPolicy: + +# Liveness probe configuration for the controller +livenessProbe: + failureThreshold: 2 + httpGet: + path: /healthz + port: 61779 + scheme: HTTP + initialDelaySeconds: 30 + timeoutSeconds: 10 + +# readiness probe configuration for the controller +readinessProbe: + failureThreshold: 2 + httpGet: + path: /readyz + port: 61779 + scheme: HTTP + successThreshold: 1 + initialDelaySeconds: 10 + timeoutSeconds: 10 + +# Environment variables to set for aws-load-balancer-controller pod. +# We strongly discourage programming access credentials in the controller environment. You should setup IRSA or +# comparable solutions like kube2iam, kiam etc instead. +env: + # ENV_1: "" + # ENV_2: "" + +# Use Environment variables credentials from Secret (aws-secret) for aws-load-balancer-controller pod similarly as The EBS CSI Driver does. +# envSecretName: aws-secret + +# Use envFrom to set environment variables from a Secret or ConfigMap +# envFrom: +# - secretRef: +# name: my-secret + +# Specifies if aws-load-balancer-controller should be started in hostNetwork mode. +# This is required if using a custom CNI where the managed control plane nodes are unable to initiate +# network connections to the pods, for example using Calico CNI plugin on EKS. This is not required or +# recommended if using the Amazon VPC CNI plugin. +hostNetwork: false + +# Specifies the dnsPolicy that should be used for pods in the deployment +# +# This may need to be used to be changed given certain conditions. For instance, if one uses the cilium CNI +# with certain settings, one may need to set `hostNetwork: true` and webhooks won't work unless `dnsPolicy` +# is set to `ClusterFirstWithHostNet`. See https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy +dnsPolicy: + +# extraVolumeMounts are the additional volume mounts. This enables setting up IRSA on non-EKS Kubernetes cluster +extraVolumeMounts: + # - name: aws-iam-token + # mountPath: /var/run/secrets/eks.amazonaws.com/serviceaccount + # readOnly: true + +# extraVolumes for the extraVolumeMounts. Useful to mount a projected service account token for example. +extraVolumes: + # - name: aws-iam-token + # projected: + # defaultMode: 420 + # sources: + # - serviceAccountToken: + # audience: sts.amazonaws.com + # expirationSeconds: 86400 + # path: token + +# defaultTags are the tags to apply to all AWS resources managed by this controller +defaultTags: {} + # default_tag1: value1 + # default_tag2: value2 + +# podDisruptionBudget specifies the disruption budget for the controller pods. +# Disruption budget will be configured only when the replicaCount is greater than 1 +podDisruptionBudget: {} +# maxUnavailable: 1 + +# externalManagedTags is the list of tag keys on AWS resources that will be managed externally +externalManagedTags: [] + +# enableEndpointSlices enables k8s EndpointSlices for IP targets instead of Endpoints (default false) +enableEndpointSlices: + +# enableBackendSecurityGroup enables shared security group for backend traffic (default true) +enableBackendSecurityGroup: + +# backendSecurityGroup specifies backend security group id (default controller auto create backend security group) +backendSecurityGroup: + +# disableRestrictedSecurityGroupRules specifies whether to disable creating port-range restricted security group rules for traffic +disableRestrictedSecurityGroupRules: + +# controllerConfig specifies controller configuration +controllerConfig: + # featureGates set of key: value pairs that describe AWS load balance controller features + featureGates: {} + # ListenerRulesTagging: true + # WeightedTargetGroups: true + # ServiceTypeLoadBalancerOnly: false + # EndpointsFailOpen: true + # EnableServiceController: true + # EnableIPTargetType: true + # SubnetsClusterTagCheck: true + # NLBHealthCheckAdvancedConfig: true + # ALBSingleSubnet: false + # LBCapacityReservation: true + +certDiscovery: + allowedCertificateAuthorityARNs: "" # empty means all CAs are in scope + +# objectSelector for webhook +objectSelector: + matchExpressions: + # - key: + # operator: + # values: + # - + matchLabels: + # key: value + +serviceMonitor: + # Specifies whether a service monitor should be created + enabled: false + # Namespace to create the service monitor in + namespace: + # Labels to add to the service monitor + additionalLabels: {} + # Prometheus scrape interval + interval: 1m + # Prometheus scrape timeout + scrapeTimeout: + # Relabelings to apply to samples before ingestion + relabelings: + # Metric relabelings to apply to samples before ingestion + metricRelabelings: + +# clusterSecretsPermissions lets you configure RBAC permissions for secret resources +# Access to secrets resource is required only if you use the OIDC feature, and instead of +# enabling access to all secrets, we recommend configuring namespaced role/rolebinding. +# This option is for backwards compatibility only, and will potentially be deprecated in future. +clusterSecretsPermissions: + # allowAllSecrets allows the controller to access all secrets in the cluster. + # This is to get backwards compatible behavior, but *NOT* recommended for security reasons + allowAllSecrets: false + +# ingressClassConfig contains configurations specific to the ingress class +ingressClassConfig: + default: false + +# enableServiceMutatorWebhook allows you enable the webhook which makes this controller the default for all new services of type LoadBalancer +enableServiceMutatorWebhook: true + +# serviceMutatorWebhook contains configurations specific to the service mutator webhook +serviceMutatorWebhookConfig: + # whether or not to fail the service creation if the webhook fails + failurePolicy: Fail + # limit webhook to only mutate services matching the objectSelector + objectSelector: + matchExpressions: [] + # - key: + # operator: + # values: + # - + matchLabels: {} + # key: value + # which operations trigger the webhook + operations: + - CREATE + # - UPDATE + +# serviceTargetENISGTags specifies AWS tags, in addition to the cluster tags, for finding the target ENI SG to which to add inbound rules from NLBs. +serviceTargetENISGTags: + +# Specifies the class of load balancer to use for services. This affects how services are provisioned if type LoadBalancer is used (default service.k8s.aws/nlb) +loadBalancerClass: + +# creator will disable helm default labels, so you can only add yours +# creator: "me" diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/.helmignore b/charts/devtron-utilities/charts/aws-node-termination-handler/.helmignore new file mode 100644 index 000000000..69a523141 --- /dev/null +++ b/charts/devtron-utilities/charts/aws-node-termination-handler/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +example-values*.yaml diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/Chart.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/Chart.yaml new file mode 100644 index 000000000..32d2ee981 --- /dev/null +++ b/charts/devtron-utilities/charts/aws-node-termination-handler/Chart.yaml @@ -0,0 +1,25 @@ +apiVersion: v2 +appVersion: 1.19.0 +description: A Helm chart for the AWS Node Termination Handler. +home: https://github.com/aws/eks-charts +icon: https://raw.githubusercontent.com/aws/eks-charts/master/docs/logo/aws.png +keywords: +- aws +- eks +- ec2 +- node-termination +- spot +kubeVersion: '>= 1.16-0' +maintainers: +- email: bwagner5@users.noreply.github.com + name: Brandon Wagner + url: https://github.com/bwagner5 +- email: jillmon@users.noreply.github.com + name: Jillian Kuentz + url: https://github.com/jillmon +name: aws-node-termination-handler +sources: +- https://github.com/aws/aws-node-termination-handler/ +- https://github.com/aws/eks-charts/ +type: application +version: 0.21.0 diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/README.md b/charts/devtron-utilities/charts/aws-node-termination-handler/README.md new file mode 100644 index 000000000..2fe7d3911 --- /dev/null +++ b/charts/devtron-utilities/charts/aws-node-termination-handler/README.md @@ -0,0 +1,176 @@ +# AWS Node Termination Handler + +AWS Node Termination Handler Helm chart for Kubernetes. For more information on this project see the project repo at [github.com/aws/aws-node-termination-handler](https://github.com/aws/aws-node-termination-handler). + +## Prerequisites + +- _Kubernetes_ >= v1.16 + +## Installing the Chart + +Before you can install the chart you will need to add the `aws` repo to [Helm](https://helm.sh/). + +```shell +helm repo add eks https://aws.github.io/eks-charts/ +``` + +After you've installed the repo you can install the chart, the following command will install the chart with the release name `aws-node-termination-handler` and the default configuration to the `kube-system` namespace. + +```shell +helm upgrade --install --namespace kube-system aws-node-termination-handler eks/aws-node-termination-handler +``` + +To install the chart on an EKS cluster where the AWS Node Termination Handler is already installed, you can run the following command. + +```shell +helm upgrade --install --namespace kube-system aws-node-termination-handler eks/aws-node-termination-handler --recreate-pods --force +``` + +If you receive an error similar to the one below simply rerun the above command. + +> Error: release aws-node-termination-handler failed: "aws-node-termination-handler" already exists + +To uninstall the `aws-node-termination-handler` chart installation from the `kube-system` namespace run the following command. + +```shell +helm delete --namespace kube-system aws-node-termination-handler +``` + +## Configuration + +The following tables lists the configurable parameters of the chart and their default values. These values are split up into the [common configuration](#common-configuration) shared by all AWS Node Termination Handler modes, [queue configuration](#queue-processor-mode-configuration) used when AWS Node Termination Handler is in in queue-processor mode, and [IMDS configuration](#imds-mode-configuration) used when AWS Node Termination Handler is in IMDS mode; for more information about the different modes see the project [README](https://github.com/aws/aws-node-termination-handler/blob/main/README.md). + +### Common Configuration + +The configuration in this table applies to all AWS Node Termination Handler modes. + +| Parameter | Description | Default | +| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- | +| `image.repository` | Image repository. | `public.ecr.aws/aws-ec2/aws-node-termination-handler` | +| `image.tag` | Image tag. | `v{{ .Chart.AppVersion}}` | +| `image.pullPolicy` | Image pull policy. | `IfNotPresent` | +| `image.pullSecrets` | Image pull secrets. | `[]` | +| `nameOverride` | Override the `name` of the chart. | `""` | +| `fullnameOverride` | Override the `fullname` of the chart. | `""` | +| `serviceAccount.create` | If `true`, create a new service account. | `true` | +| `serviceAccount.name` | Service account to be used. If not set and `serviceAccount.create` is `true`, a name is generated using the full name template. | `nil` | +| `serviceAccount.annotations` | Annotations to add to the service account. | `{}` | +| `rbac.create` | If `true`, create the RBAC resources. | `true` | +| `rbac.pspEnabled` | If `true`, create a pod security policy resource. Note: `PodSecurityPolicy`s will not be created when Kubernetes version is 1.25 or later. | `true` | +| `customLabels` | Labels to add to all resource metadata. | `{}` | +| `podLabels` | Labels to add to the pod. | `{}` | +| `podAnnotations` | Annotations to add to the pod. | `{}` | +| `podSecurityContext` | Security context for the pod. | _See values.yaml_ | +| `securityContext` | Security context for the _aws-node-termination-handler_ container. | _See values.yaml_ | +| `terminationGracePeriodSeconds` | The termination grace period for the pod. | `nil` | +| `resources` | Resource requests and limits for the _aws-node-termination-handler_ container. | `{}` | +| `nodeSelector` | Expressions to select a node by it's labels for pod assignment. In IMDS mode this has a higher priority than `daemonsetNodeSelector` (for backwards compatibility) but shouldn't be used. | `{}` | +| `affinity` | Affinity settings for pod assignment. In IMDS mode this has a higher priority than `daemonsetAffinity` (for backwards compatibility) but shouldn't be used. | `{}` | +| `tolerations` | Tolerations for pod assignment. In IMDS mode this has a higher priority than `daemonsetTolerations` (for backwards compatibility) but shouldn't be used. | `[]` | +| `extraEnv` | Additional environment variables for the _aws-node-termination-handler_ container. | `[]` | +| `probes` | The Kubernetes liveness probe configuration. | _See values.yaml_ | +| `logLevel` | Sets the log level (`info`,`debug`, or `error`) | `info` | +| `logFormatVersion` | Sets the log format version. Available versions: 1, 2. Version 1 refers to the format that has been used through v1.17.3. Version 2 offers more detail for the "event kind" and "reason", especially when operating in Queue Processor mode. | `1` | +| `jsonLogging` | If `true`, use JSON-formatted logs instead of human readable logs. | `false` | +| `enablePrometheusServer` | If `true`, start an http server exposing `/metrics` endpoint for _Prometheus_. | `false` | +| `prometheusServerPort` | Replaces the default HTTP port for exposing _Prometheus_ metrics. | `9092` | +| `dryRun` | If `true`, only log if a node would be drained. | `false` | +| `cordonOnly` | If `true`, nodes will be cordoned but not drained when an interruption event occurs. | `false` | +| `taintNode` | If `true`, nodes will be tainted when an interruption event occurs. Currently used taint keys are `aws-node-termination-handler/scheduled-maintenance`, `aws-node-termination-handler/spot-itn`, `aws-node-termination-handler/asg-lifecycle-termination` and `aws-node-termination-handler/rebalance-recommendation`. | `false` | +| `excludeFromLoadBalancers` | If `true`, nodes will be marked for exclusion from load balancers before they are cordoned. This applies the `node.kubernetes.io/exclude-from-external-load-balancers` label to enable the ServiceNodeExclusion feature gate. The label will not be modified or removed for nodes that already have it. | `false` | +| `deleteLocalData` | If `true`, continue even if there are pods using local data that will be deleted when the node is drained. | `true` | +| `ignoreDaemonSets` | If `true`, skip terminating daemon set managed pods. | `true` | +| `podTerminationGracePeriod` | The time in seconds given to each pod to terminate gracefully. If negative, the default value specified in the pod will be used, which defaults to 30 seconds if not specified for the pod. | `-1` | +| `nodeTerminationGracePeriod` | Period of time in seconds given to each node to terminate gracefully. Node draining will be scheduled based on this value to optimize the amount of compute time, but still safely drain the node before an event. | `120` | +| `emitKubernetesEvents` | If `true`, Kubernetes events will be emitted when interruption events are received and when actions are taken on Kubernetes nodes. In IMDS Processor mode a default set of annotations with all the node metadata gathered from IMDS will be attached to each event. More information [here](https://github.com/aws/aws-node-termination-handler/blob/main/docs/kubernetes_events.md). | `false` | +| `completeLifecycleActionDelaySeconds` | Pause after draining the node before completing the EC2 Autoscaling lifecycle action. This may be helpful if Pods on the node have Persistent Volume Claims. | -1 | +| `kubernetesEventsExtraAnnotations` | A comma-separated list of `key=value` extra annotations to attach to all emitted Kubernetes events (e.g. `first=annotation,sample.annotation/number=two"`). | `""` | +| `webhookURL` | Posts event data to URL upon instance interruption action. | `""` | +| `webhookURLSecretName` | Pass the webhook URL as a Secret using the key `webhookurl`. | `""` | +| `webhookHeaders` | Replace the default webhook headers (e.g. `{"Content-type":"application/json"}`). | `""` | +| `webhookProxy` | Uses the specified HTTP(S) proxy for sending webhook data. | `""` | +| `webhookTemplate` | Replaces the default webhook message template (e.g. `{"text":"[NTH][Instance Interruption] EventID: {{ .EventID }} - Kind: {{ .Kind }} - Instance: {{ .InstanceID }} - Node: {{ .NodeName }} - Description: {{ .Description }} - Start Time: {{ .StartTime }}"}`). | `""` | +| `webhookTemplateConfigMapName` | Pass the webhook template file as a configmap. | "``" | +| `webhookTemplateConfigMapKey` | Name of the Configmap key storing the template file. | `""` | +| `enableSqsTerminationDraining` | If `true`, this turns on queue-processor mode which drains nodes when an SQS termination event is received. | `false` | + +### Queue-Processor Mode Configuration + +The configuration in this table applies to AWS Node Termination Handler in queue-processor mode. + +| Parameter | Description | Default | +| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------- | +| `replicas` | The number of replicas in the deployment when using queue-processor mode (NOTE: increasing replicas may cause duplicate webhooks since pods are stateless). | `1` | +| `strategy` | Specify the update strategy for the deployment. | `{}` | +| `podDisruptionBudget` | Limit the disruption for controller pods, requires at least 2 controller replicas. | `{}` | +| `serviceMonitor.create` | If `true`, create a ServiceMonitor. This requires `enablePrometheusServer: true`. | `false` | +| `serviceMonitor.namespace` | Override ServiceMonitor _Helm_ release namespace. | `nil` | +| `serviceMonitor.labels` | Additional ServiceMonitor metadata labels. | `{}` | +| `serviceMonitor.interval` | _Prometheus_ scrape interval. | `30s` | +| `serviceMonitor.sampleLimit` | Number of scraped samples accepted. | `5000` | +| `priorityClassName` | Name of the PriorityClass to use for the Deployment. | `system-cluster-critical` | +| `awsRegion` | If specified, use the AWS region for AWS API calls, else NTH will try to find the region through the `AWS_REGION` environment variable, IMDS, or the specified queue URL. | `""` | +| `queueURL` | Listens for messages on the specified SQS queue URL. | `""` | +| `workers` | The maximum amount of parallel event processors to handle concurrent events. | `10` | +| `checkTagBeforeDraining` | If `true`, check that the instance is tagged with the `managedTag` before draining the node. | `true` | +| `managedTag` | The node tag to check if `checkTagBeforeDraining` is `true`. | `aws-node-termination-handler/managed` | +| `checkASGTagBeforeDraining` | [DEPRECATED](Use `checkTagBeforeDraining` instead) If `true`, check that the instance is tagged with the `managedAsgTag` before draining the node. If `false`, disables calls ASG API. | `true` | +| `managedAsgTag` | [DEPRECATED](Use `managedTag` instead) The node tag to check if `checkASGTagBeforeDraining` is `true`. +| `useProviderId` | If `true`, fetch node name through Kubernetes node spec ProviderID instead of AWS event PrivateDnsHostname. | `false` | + +### IMDS Mode Configuration + +The configuration in this table applies to AWS Node Termination Handler in IMDS mode. + +| Parameter | Description | Default | +| -------------------------------- |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------| +| `targetNodeOs` | Space separated list of node OS's to target (e.g. `"linux"`, `"windows"`, `"linux windows"`). Windows support is **EXPERIMENTAL**. | `"linux"` | +| `linuxPodLabels` | Labels to add to each Linux pod. | `{}` | +| `windowsPodLabels` | Labels to add to each Windows pod. | `{}` | +| `linuxPodAnnotations` | Annotations to add to each Linux pod. | `{}` | +| `windowsPodAnnotations` | Annotations to add to each Windows pod. | `{}` | +| `updateStrategy` | Update strategy for the all DaemonSets. | _See values.yaml_ | +| `daemonsetPriorityClassName` | Name of the PriorityClass to use for all DaemonSets. | `system-node-critical` | +| `podMonitor.create` | If `true`, create a PodMonitor. This requires `enablePrometheusServer: true`. | `false` | +| `podMonitor.namespace` | Override PodMonitor _Helm_ release namespace. | `nil` | +| `podMonitor.labels` | Additional PodMonitor metadata labels | `{}` | +| `podMonitor.interval` | _Prometheus_ scrape interval. | `30s` | +| `podMonitor.sampleLimit` | Number of scraped samples accepted. | `5000` | +| `useHostNetwork` | If `true`, enables `hostNetwork` for the Linux DaemonSet. NOTE: setting this to `false` may cause issues accessing IMDSv2 if your account is not configured with an IP hop count of 2 see [Metrics Endpoint Considerations](#metrics-endpoint-considerations) | `true` | +| `dnsPolicy` | If specified, this overrides `linuxDnsPolicy` and `windowsDnsPolicy` with a single policy. | `""` | +| `dnsConfig` | If specified, this sets the dnsConfig: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config | `{}` | +| `linuxDnsPolicy` | DNS policy for the Linux DaemonSet. | `""` | +| `windowsDnsPolicy` | DNS policy for the Windows DaemonSet. | `""` | +| `daemonsetNodeSelector` | Expressions to select a node by it's labels for DaemonSet pod assignment. For backwards compatibility the `nodeSelector` value has priority over this but shouldn't be used. | `{}` | +| `linuxNodeSelector` | Override `daemonsetNodeSelector` for the Linux DaemonSet. | `{}` | +| `windowsNodeSelector` | Override `daemonsetNodeSelector` for the Windows DaemonSet. | `{}` | +| `daemonsetAffinity` | Affinity settings for DaemonSet pod assignment. For backwards compatibility the `affinity` has priority over this but shouldn't be used. | `{}` | +| `linuxAffinity` | Override `daemonsetAffinity` for the Linux DaemonSet. | `{}` | +| `windowsAffinity` | Override `daemonsetAffinity` for the Windows DaemonSet. | `{}` | +| `daemonsetTolerations` | Tolerations for DaemonSet pod assignment. For backwards compatibility the `tolerations` has priority over this but shouldn't be used. | `[]` | +| `linuxTolerations` | Override `daemonsetTolerations` for the Linux DaemonSet. | `[]` | +| `windowsTolerations` | Override `daemonsetTolerations` for the Linux DaemonSet. | `[]` | +| `enableProbesServer` | If `true`, start an http server exposing `/healthz` endpoint for probes. | `false` | +| `metadataTries` | The number of times to try requesting metadata. | `3` | +| `enableSpotInterruptionDraining` | If `true`, drain nodes when the spot interruption termination notice is received. Only used in IMDS mode. | `true` | +| `enableScheduledEventDraining` | If `true`, drain nodes before the maintenance window starts for an EC2 instance scheduled event. Only used in IMDS mode. | `true` | +| `enableRebalanceMonitoring` | If `true`, cordon nodes when the rebalance recommendation notice is received. If you'd like to drain the node in addition to cordoning, then also set `enableRebalanceDraining`. Only used in IMDS mode. | `false` | +| `enableRebalanceDraining` | If `true`, drain nodes when the rebalance recommendation notice is received. Only used in IMDS mode. | `false` | + +### Testing Configuration + +The configuration in this table applies to AWS Node Termination Handler testing and is **NOT RECOMMENDED** FOR PRODUCTION DEPLOYMENTS. + +| Parameter | Description | Default | +| --------------------- | --------------------------------------------------------------------------------- | -------------- | +| `awsEndpoint` | (Used for testing) If specified, use the provided AWS endpoint to make API calls. | `""` | +| `awsSecretAccessKey` | (Used for testing) Pass-thru environment variable. | `nil` | +| `awsAccessKeyID` | (Used for testing) Pass-thru environment variable. | `nil` | +| `instanceMetadataURL` | (Used for testing) If specified, use the provided metadata URL. | `""` | +| `procUptimeFile` | (Used for Testing) Specify the uptime file. | `/proc/uptime` | + +## Metrics Endpoint Considerations + +AWS Node Termination HAndler in IMDS mode runs as a DaemonSet with `useHostNetwork: true` by default. If the Prometheus server is enabled with `enablePrometheusServer: true` nothing else will be able to bind to the configured port (by default `prometheusServerPort: 9092`) in the root network namespace. Therefore, it will need to have a firewall/security group configured on the nodes to block access to the `/metrics` endpoint. + +You can switch NTH in IMDS mode to run w/ `useHostNetwork: false`, but you will need to make sure that IMDSv1 is enabled or IMDSv2 IP hop count will need to be incremented to 2 (see the [IMDSv2 documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html). diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/NOTES.txt b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/NOTES.txt new file mode 100644 index 000000000..d0aaf70c6 --- /dev/null +++ b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/NOTES.txt @@ -0,0 +1,8 @@ +*********************************************************************** +* AWS Node Termination Handler * +*********************************************************************** + Chart version: {{ .Chart.Version }} + App version: {{ .Chart.AppVersion }} + Image tag: {{ include "aws-node-termination-handler.image" . }} + Mode : {{ if .Values.enableSqsTerminationDraining }}Queue Processor{{ else }}IMDS{{ end }} +*********************************************************************** diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/_helpers.tpl b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/_helpers.tpl new file mode 100644 index 000000000..3513d2a97 --- /dev/null +++ b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/_helpers.tpl @@ -0,0 +1,124 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* +Expand the name of the chart. +*/}} +{{- define "aws-node-termination-handler.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "aws-node-termination-handler.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Equivalent to "aws-node-termination-handler.fullname" except that "-win" indicator is appended to the end. +Name will not exceed 63 characters. +*/}} +{{- define "aws-node-termination-handler.fullnameWindows" -}} +{{- include "aws-node-termination-handler.fullname" . | trunc 59 | trimSuffix "-" | printf "%s-win" -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "aws-node-termination-handler.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Common labels +*/}} +{{- define "aws-node-termination-handler.labels" -}} +{{ include "aws-node-termination-handler.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/part-of: {{ .Release.Name }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +helm.sh/chart: {{ include "aws-node-termination-handler.chart" . }} +{{- with .Values.customLabels }} +{{ toYaml . }} +{{- end }} +{{- end -}} + +{{/* +Deployment labels +*/}} +{{- define "aws-node-termination-handler.labelsDeployment" -}} +{{ include "aws-node-termination-handler.labels" . }} +app.kubernetes.io/component: deployment +{{- end -}} + +{{/* +Daemonset labels +*/}} +{{- define "aws-node-termination-handler.labelsDaemonset" -}} +{{ include "aws-node-termination-handler.labels" . }} +app.kubernetes.io/component: daemonset +{{- end -}} + +{{/* +Selector labels +*/}} +{{- define "aws-node-termination-handler.selectorLabels" -}} +app.kubernetes.io/name: {{ include "aws-node-termination-handler.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end -}} + +{{/* +Selector labels for the deployment +*/}} +{{- define "aws-node-termination-handler.selectorLabelsDeployment" -}} +{{ include "aws-node-termination-handler.selectorLabels" . }} +app.kubernetes.io/component: deployment +{{- end -}} + +{{/* +Selector labels for the daemonset +*/}} +{{- define "aws-node-termination-handler.selectorLabelsDaemonset" -}} +{{ include "aws-node-termination-handler.selectorLabels" . }} +app.kubernetes.io/component: daemonset +{{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "aws-node-termination-handler.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "aws-node-termination-handler.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +The image to use +*/}} +{{- define "aws-node-termination-handler.image" -}} +{{- printf "%s:%s" .Values.image.repository (default (printf "v%s" .Chart.AppVersion) .Values.image.tag) }} +{{- end }} + +{{/* Get PodDisruptionBudget API Version */}} +{{- define "aws-node-termination-handler.pdb.apiVersion" -}} + {{- if and (.Capabilities.APIVersions.Has "policy/v1") (semverCompare ">= 1.21-0" .Capabilities.KubeVersion.Version) -}} + {{- print "policy/v1" -}} + {{- else -}} + {{- print "policy/v1beta1" -}} + {{- end -}} +{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/clusterrole.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/clusterrole.yaml new file mode 100644 index 000000000..43c2b030b --- /dev/null +++ b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/clusterrole.yaml @@ -0,0 +1,52 @@ +{{- if .Values.rbac.create -}} +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "aws-node-termination-handler.fullname" . }} + labels: + {{- include "aws-node-termination-handler.labels" . | nindent 4 }} +rules: +- apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - patch + - update +- apiGroups: + - "" + resources: + - pods + verbs: + - list + - get +- apiGroups: + - "" + resources: + - pods/eviction + verbs: + - create +- apiGroups: + - extensions + resources: + - daemonsets + verbs: + - get +- apiGroups: + - apps + resources: + - daemonsets + verbs: + - get +{{- if .Values.emitKubernetesEvents }} +- apiGroups: + - "" + resources: + - events + verbs: + - create + - patch +{{- end }} +{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/clusterrolebinding.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/clusterrolebinding.yaml new file mode 100644 index 000000000..1058df1b1 --- /dev/null +++ b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/clusterrolebinding.yaml @@ -0,0 +1,16 @@ +{{- if .Values.rbac.create -}} +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "aws-node-termination-handler.fullname" . }} + labels: + {{- include "aws-node-termination-handler.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "aws-node-termination-handler.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ template "aws-node-termination-handler.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/daemonset.linux.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/daemonset.linux.yaml new file mode 100644 index 000000000..95e4b50f5 --- /dev/null +++ b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/daemonset.linux.yaml @@ -0,0 +1,210 @@ +{{- if and (not .Values.enableSqsTerminationDraining) (lower .Values.targetNodeOs | contains "linux") -}} +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: {{ include "aws-node-termination-handler.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "aws-node-termination-handler.labelsDaemonset" . | nindent 4 }} +spec: + {{- with .Values.updateStrategy }} + updateStrategy: + {{- toYaml . | nindent 4 }} + {{- end }} + selector: + matchLabels: + {{- include "aws-node-termination-handler.selectorLabelsDaemonset" . | nindent 6 }} + kubernetes.io/os: linux + template: + metadata: + labels: + {{- include "aws-node-termination-handler.selectorLabelsDaemonset" . | nindent 8 }} + kubernetes.io/os: linux + k8s-app: aws-node-termination-handler + {{- with (mergeOverwrite (dict) .Values.podLabels .Values.linuxPodLabels) }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if or .Values.podAnnotations .Values.linuxPodAnnotations }} + annotations: + {{- toYaml (mergeOverwrite (dict) .Values.podAnnotations .Values.linuxPodAnnotations) | nindent 8 }} + {{- end }} + spec: + {{- with .Values.image.pullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "aws-node-termination-handler.serviceAccountName" . }} + {{- with .Values.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.daemonsetPriorityClassName }} + priorityClassName: {{ . }} + {{- end }} + {{- with .Values.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ . }} + {{- end }} + hostNetwork: {{ .Values.useHostNetwork }} + dnsPolicy: {{ default .Values.linuxDnsPolicy .Values.dnsPolicy }} + {{- with .Values.dnsConfig }} + dnsConfig: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: aws-node-termination-handler + {{- with .Values.securityContext }} + securityContext: + {{- toYaml . | nindent 12 }} + {{- end }} + image: {{ include "aws-node-termination-handler.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + env: + - name: NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: ENABLE_PROBES_SERVER + value: {{ .Values.enableProbesServer | quote }} + - name: PROBES_SERVER_PORT + value: {{ .Values.probes.httpGet.port | quote }} + - name: PROBES_SERVER_ENDPOINT + value: {{ .Values.probes.httpGet.path | quote }} + - name: LOG_LEVEL + value: {{ .Values.logLevel | quote }} + - name: JSON_LOGGING + value: {{ .Values.jsonLogging | quote }} + - name: LOG_FORMAT_VERSION + value: {{ .Values.logFormatVersion | quote }} + - name: ENABLE_PROMETHEUS_SERVER + value: {{ .Values.enablePrometheusServer | quote }} + - name: PROMETHEUS_SERVER_PORT + value: {{ .Values.prometheusServerPort | quote }} + {{- with .Values.instanceMetadataURL }} + - name: INSTANCE_METADATA_URL + value: {{ . | quote }} + {{- end }} + - name: METADATA_TRIES + value: {{ .Values.metadataTries | quote }} + - name: DRY_RUN + value: {{ .Values.dryRun | quote }} + - name: CORDON_ONLY + value: {{ .Values.cordonOnly | quote }} + - name: TAINT_NODE + value: {{ .Values.taintNode | quote }} + - name: EXCLUDE_FROM_LOAD_BALANCERS + value: {{ .Values.excludeFromLoadBalancers | quote }} + - name: DELETE_LOCAL_DATA + value: {{ .Values.deleteLocalData | quote }} + - name: IGNORE_DAEMON_SETS + value: {{ .Values.ignoreDaemonSets | quote }} + - name: POD_TERMINATION_GRACE_PERIOD + value: {{ .Values.podTerminationGracePeriod | quote }} + - name: NODE_TERMINATION_GRACE_PERIOD + value: {{ .Values.nodeTerminationGracePeriod | quote }} + - name: EMIT_KUBERNETES_EVENTS + value: {{ .Values.emitKubernetesEvents | quote }} + {{- with .Values.kubernetesEventsExtraAnnotations }} + - name: KUBERNETES_EVENTS_EXTRA_ANNOTATIONS + value: {{ . | quote }} + {{- end }} + {{- if or .Values.webhookURL .Values.webhookURLSecretName }} + - name: WEBHOOK_URL + {{- if .Values.webhookURLSecretName }} + valueFrom: + secretKeyRef: + name: {{ .Values.webhookURLSecretName }} + key: webhookurl + {{- else }} + value: {{ .Values.webhookURL | quote }} + {{- end }} + {{- end }} + {{- with .Values.webhookHeaders }} + - name: WEBHOOK_HEADERS + value: {{ . | quote }} + {{- end }} + {{- with .Values.webhookProxy }} + - name: WEBHOOK_PROXY + value: {{ . | quote }} + {{- end }} + {{- if and .Values.webhookTemplateConfigMapName .Values.webhookTemplateConfigMapKey }} + - name: WEBHOOK_TEMPLATE_FILE + value: {{ print "/config/" .Values.webhookTemplateConfigMapKey | quote }} + {{- else if .Values.webhookTemplate }} + - name: WEBHOOK_TEMPLATE + value: {{ .Values.webhookTemplate | quote }} + {{- end }} + - name: ENABLE_SPOT_INTERRUPTION_DRAINING + value: {{ .Values.enableSpotInterruptionDraining | quote }} + - name: ENABLE_SCHEDULED_EVENT_DRAINING + value: {{ .Values.enableScheduledEventDraining | quote }} + - name: ENABLE_REBALANCE_MONITORING + value: {{ .Values.enableRebalanceMonitoring | quote }} + - name: ENABLE_REBALANCE_DRAINING + value: {{ .Values.enableRebalanceDraining | quote }} + - name: ENABLE_SQS_TERMINATION_DRAINING + value: "false" + - name: UPTIME_FROM_FILE + value: {{ .Values.procUptimeFile | quote }} + {{- with .Values.extraEnv }} + {{- toYaml . | nindent 12 }} + {{- end }} + {{- if or .Values.enablePrometheusServer .Values.enableProbesServer }} + ports: + {{- if .Values.enableProbesServer }} + - name: liveness-probe + protocol: TCP + containerPort: {{ .Values.probes.httpGet.port }} + {{- end }} + {{- if .Values.enablePrometheusServer }} + - name: http-metrics + protocol: TCP + containerPort: {{ .Values.prometheusServerPort }} + {{- end }} + {{- end }} + {{- if .Values.enableProbesServer }} + livenessProbe: + {{- toYaml .Values.probes | nindent 12 }} + {{- end }} + {{- with .Values.resources }} + resources: + {{- toYaml . | nindent 12 }} + {{- end }} + volumeMounts: + - name: uptime + mountPath: {{ .Values.procUptimeFile }} + readOnly: true + {{- if and .Values.webhookTemplateConfigMapName .Values.webhookTemplateConfigMapKey }} + - name: webhook-template + mountPath: /config/ + {{- end }} + volumes: + - name: uptime + hostPath: + path: {{ .Values.procUptimeFile | default "/proc/uptime" }} + {{- if and .Values.webhookTemplateConfigMapName .Values.webhookTemplateConfigMapKey }} + - name: webhook-template + configMap: + name: {{ .Values.webhookTemplateConfigMapName }} + {{- end }} + nodeSelector: + kubernetes.io/os: linux + {{- with default .Values.daemonsetNodeSelector (default .Values.nodeSelector .Values.linuxNodeSelector) }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if or .Values.daemonsetAffinity (or .Values.affinity .Values.linuxAffinity) }} + affinity: + {{- toYaml (default .Values.daemonsetAffinity (default .Values.affinity .Values.linuxAffinity)) | nindent 8 }} + {{- end }} + {{- if or .Values.daemonsetTolerations (or .Values.tolerations .Values.linuxTolerations) }} + tolerations: + {{- toYaml (default .Values.daemonsetTolerations (default .Values.tolerations .Values.linuxTolerations )) | nindent 8 }} + {{- end }} +{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/daemonset.windows.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/daemonset.windows.yaml new file mode 100644 index 000000000..8a9db7bfc --- /dev/null +++ b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/daemonset.windows.yaml @@ -0,0 +1,204 @@ +{{- if and (not .Values.enableSqsTerminationDraining) (lower .Values.targetNodeOs | contains "windows") -}} +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: {{ include "aws-node-termination-handler.fullnameWindows" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "aws-node-termination-handler.labelsDaemonset" . | nindent 4 }} +spec: + {{- with .Values.updateStrategy }} + updateStrategy: + {{- toYaml . | nindent 4 }} + {{- end }} + selector: + matchLabels: + {{- include "aws-node-termination-handler.selectorLabelsDaemonset" . | nindent 6 }} + kubernetes.io/os: windows + template: + metadata: + labels: + {{- include "aws-node-termination-handler.selectorLabelsDaemonset" . | nindent 8 }} + kubernetes.io/os: windows + k8s-app: aws-node-termination-handler + {{- with (mergeOverwrite (dict) .Values.podLabels .Values.windowsPodLabels) }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if or .Values.podAnnotations .Values.windowsPodAnnotations }} + annotations: + {{- toYaml (mergeOverwrite (dict) .Values.podAnnotations .Values.windowsPodAnnotations) | nindent 8 }} + {{- end }} + spec: + {{- with .Values.image.pullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "aws-node-termination-handler.serviceAccountName" . }} + {{- with .Values.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.daemonsetPriorityClassName }} + priorityClassName: {{ . }} + {{- end }} + {{- with .Values.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ . }} + {{- end }} + hostNetwork: false + dnsPolicy: {{ default .Values.windowsDnsPolicy .Values.dnsPolicy }} + {{- with .Values.dnsConfig }} + dnsConfig: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: aws-node-termination-handler + {{- with unset .Values.securityContext "runAsUser" }} + securityContext: + {{- toYaml . | nindent 12 }} + {{- end }} + image: {{ include "aws-node-termination-handler.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + env: + - name: NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: ENABLE_PROBES_SERVER + value: {{ .Values.enableProbesServer | quote }} + - name: PROBES_SERVER_PORT + value: {{ .Values.probes.httpGet.port | quote }} + - name: PROBES_SERVER_ENDPOINT + value: {{ .Values.probes.httpGet.path | quote }} + - name: LOG_LEVEL + value: {{ .Values.logLevel | quote }} + - name: JSON_LOGGING + value: {{ .Values.jsonLogging | quote }} + - name: LOG_FORMAT_VERSION + value: {{ .Values.logFormatVersion | quote }} + - name: ENABLE_PROMETHEUS_SERVER + value: {{ .Values.enablePrometheusServer | quote }} + - name: PROMETHEUS_SERVER_PORT + value: {{ .Values.prometheusServerPort | quote }} + {{- with .Values.instanceMetadataURL }} + - name: INSTANCE_METADATA_URL + value: {{ . | quote }} + {{- end }} + - name: METADATA_TRIES + value: {{ .Values.metadataTries | quote }} + - name: DRY_RUN + value: {{ .Values.dryRun | quote }} + - name: CORDON_ONLY + value: {{ .Values.cordonOnly | quote }} + - name: TAINT_NODE + value: {{ .Values.taintNode | quote }} + - name: EXCLUDE_FROM_LOAD_BALANCERS + value: {{ .Values.excludeFromLoadBalancers | quote }} + - name: DELETE_LOCAL_DATA + value: {{ .Values.deleteLocalData | quote }} + - name: IGNORE_DAEMON_SETS + value: {{ .Values.ignoreDaemonSets | quote }} + - name: POD_TERMINATION_GRACE_PERIOD + value: {{ .Values.podTerminationGracePeriod | quote }} + - name: NODE_TERMINATION_GRACE_PERIOD + value: {{ .Values.nodeTerminationGracePeriod | quote }} + - name: EMIT_KUBERNETES_EVENTS + value: {{ .Values.emitKubernetesEvents | quote }} + {{- with .Values.kubernetesEventsExtraAnnotations }} + - name: KUBERNETES_EVENTS_EXTRA_ANNOTATIONS + value: {{ . | quote }} + {{- end }} + {{- if or .Values.webhookURL .Values.webhookURLSecretName }} + - name: WEBHOOK_URL + {{- if .Values.webhookURLSecretName }} + valueFrom: + secretKeyRef: + name: {{ .Values.webhookURLSecretName }} + key: webhookurl + {{- else }} + value: {{ .Values.webhookURL | quote }} + {{- end }} + {{- end }} + {{- with .Values.webhookHeaders }} + - name: WEBHOOK_HEADERS + value: {{ . | quote }} + {{- end }} + {{- with .Values.webhookProxy }} + - name: WEBHOOK_PROXY + value: {{ . | quote }} + {{- end }} + {{- if and .Values.webhookTemplateConfigMapName .Values.webhookTemplateConfigMapKey }} + - name: WEBHOOK_TEMPLATE_FILE + value: {{ print "/config/" .Values.webhookTemplateConfigMapKey | quote }} + {{- else if .Values.webhookTemplate }} + - name: WEBHOOK_TEMPLATE + value: {{ .Values.webhookTemplate | quote }} + {{- end }} + - name: ENABLE_SPOT_INTERRUPTION_DRAINING + value: {{ .Values.enableSpotInterruptionDraining | quote }} + - name: ENABLE_SCHEDULED_EVENT_DRAINING + value: {{ .Values.enableScheduledEventDraining | quote }} + - name: ENABLE_REBALANCE_MONITORING + value: {{ .Values.enableRebalanceMonitoring | quote }} + - name: ENABLE_REBALANCE_DRAINING + value: {{ .Values.enableRebalanceDraining | quote }} + - name: ENABLE_SQS_TERMINATION_DRAINING + value: "false" + {{- with .Values.extraEnv }} + {{- toYaml . | nindent 12 }} + {{- end }} + {{- if or .Values.enablePrometheusServer .Values.enableProbesServer }} + ports: + {{- if .Values.enableProbesServer }} + - name: liveness-probe + protocol: TCP + containerPort: {{ .Values.probes.httpGet.port }} + hostPort: {{ .Values.probes.httpGet.port }} + {{- end }} + {{- if .Values.enablePrometheusServer }} + - name: http-metrics + protocol: TCP + containerPort: {{ .Values.prometheusServerPort }} + hostPort: {{ .Values.prometheusServerPort }} + {{- end }} + {{- end }} + {{- if .Values.enableProbesServer }} + livenessProbe: + {{- toYaml .Values.probes | nindent 12 }} + {{- end }} + {{- with .Values.resources }} + resources: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- if and .Values.webhookTemplateConfigMapName .Values.webhookTemplateConfigMapKey }} + volumeMounts: + - name: webhook-template + mountPath: /config/ + {{- end }} + {{- if and .Values.webhookTemplateConfigMapName .Values.webhookTemplateConfigMapKey }} + volumes: + - name: webhook-template + configMap: + name: {{ .Values.webhookTemplateConfigMapName }} + {{- end }} + nodeSelector: + kubernetes.io/os: windows + {{- with default .Values.daemonsetNodeSelector (default .Values.nodeSelector .Values.windowsNodeSelector) }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if or .Values.daemonsetAffinity (or .Values.affinity .Values.windowsAffinity) }} + affinity: + {{- toYaml (default .Values.daemonsetAffinity (default .Values.affinity .Values.windowsAffinity )) | nindent 8 }} + {{- end }} + {{- if or .Values.daemonsetTolerations (or .Values.tolerations .Values.windowsTolerations) }} + tolerations: + {{- toYaml (default .Values.daemonsetTolerations (default .Values.tolerations .Values.windowsTolerations )) | nindent 8 }} + {{- end }} +{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/deployment.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/deployment.yaml new file mode 100644 index 000000000..3024e42f5 --- /dev/null +++ b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/deployment.yaml @@ -0,0 +1,211 @@ +{{- if .Values.enableSqsTerminationDraining }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "aws-node-termination-handler.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "aws-node-termination-handler.labelsDeployment" . | nindent 4 }} +spec: + replicas: {{ .Values.replicas }} + {{- with .Values.strategy }} + strategy: + {{- toYaml . | nindent 4 }} + {{- end }} + selector: + matchLabels: + {{- include "aws-node-termination-handler.selectorLabelsDeployment" . | nindent 6 }} + template: + metadata: + labels: + {{- include "aws-node-termination-handler.selectorLabelsDeployment" . | nindent 8 }} + k8s-app: aws-node-termination-handler + {{- with .Values.podLabels }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- with .Values.image.pullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "aws-node-termination-handler.serviceAccountName" . }} + {{- with .Values.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.priorityClassName }} + priorityClassName: {{ . }} + {{- end }} + {{- with .Values.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ . }} + {{- end }} + {{- with .Values.dnsConfig }} + dnsConfig: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: aws-node-termination-handler + {{- with .Values.securityContext }} + securityContext: + {{- toYaml . | nindent 12 }} + {{- end }} + image: {{ include "aws-node-termination-handler.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + env: + - name: NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: ENABLE_PROBES_SERVER + value: "true" + - name: PROBES_SERVER_PORT + value: {{ .Values.probes.httpGet.port | quote }} + - name: PROBES_SERVER_ENDPOINT + value: {{ .Values.probes.httpGet.path | quote }} + - name: LOG_LEVEL + value: {{ .Values.logLevel | quote }} + - name: JSON_LOGGING + value: {{ .Values.jsonLogging | quote }} + - name: LOG_FORMAT_VERSION + value: {{ .Values.logFormatVersion | quote }} + - name: ENABLE_PROMETHEUS_SERVER + value: {{ .Values.enablePrometheusServer | quote }} + - name: PROMETHEUS_SERVER_PORT + value: {{ .Values.prometheusServerPort | quote }} + # [DEPRECATED] Use CHECK_TAG_BEFORE_DRAINING instead + - name: CHECK_ASG_TAG_BEFORE_DRAINING + value: {{ .Values.checkASGTagBeforeDraining | quote }} + - name: CHECK_TAG_BEFORE_DRAINING + value: {{ .Values.checkTagBeforeDraining | quote }} + # [DEPRECATED] Use MANAGED_TAG instead + - name: MANAGED_ASG_TAG + value: {{ .Values.managedAsgTag | quote }} + - name: MANAGED_TAG + value: {{ .Values.managedTag | quote }} + - name: USE_PROVIDER_ID + value: {{ .Values.useProviderId | quote }} + - name: DRY_RUN + value: {{ .Values.dryRun | quote }} + - name: CORDON_ONLY + value: {{ .Values.cordonOnly | quote }} + - name: TAINT_NODE + value: {{ .Values.taintNode | quote }} + - name: EXCLUDE_FROM_LOAD_BALANCERS + value: {{ .Values.excludeFromLoadBalancers | quote }} + - name: DELETE_LOCAL_DATA + value: {{ .Values.deleteLocalData | quote }} + - name: IGNORE_DAEMON_SETS + value: {{ .Values.ignoreDaemonSets | quote }} + - name: POD_TERMINATION_GRACE_PERIOD + value: {{ .Values.podTerminationGracePeriod | quote }} + - name: NODE_TERMINATION_GRACE_PERIOD + value: {{ .Values.nodeTerminationGracePeriod | quote }} + - name: EMIT_KUBERNETES_EVENTS + value: {{ .Values.emitKubernetesEvents | quote }} + - name: COMPLETE_LIFECYCLE_ACTION_DELAY_SECONDS + value: {{ .Values.completeLifecycleActionDelaySeconds | quote }} + {{- with .Values.kubernetesEventsExtraAnnotations }} + - name: KUBERNETES_EVENTS_EXTRA_ANNOTATIONS + value: {{ . | quote }} + {{- end }} + {{- if or .Values.webhookURL .Values.webhookURLSecretName }} + - name: WEBHOOK_URL + {{- if .Values.webhookURLSecretName }} + valueFrom: + secretKeyRef: + name: {{ .Values.webhookURLSecretName }} + key: webhookurl + {{- else }} + value: {{ .Values.webhookURL | quote }} + {{- end }} + {{- end }} + {{- with .Values.webhookHeaders }} + - name: WEBHOOK_HEADERS + value: {{ . | quote }} + {{- end }} + {{- with .Values.webhookProxy }} + - name: WEBHOOK_PROXY + value: {{ . | quote }} + {{- end }} + {{- if and .Values.webhookTemplateConfigMapName .Values.webhookTemplateConfigMapKey }} + - name: WEBHOOK_TEMPLATE_FILE + value: {{ print "/config/" .Values.webhookTemplateConfigMapKey | quote }} + {{- else if .Values.webhookTemplate }} + - name: WEBHOOK_TEMPLATE + value: {{ .Values.webhookTemplate | quote }} + {{- end }} + - name: ENABLE_SQS_TERMINATION_DRAINING + value: "true" + {{- with .Values.awsRegion }} + - name: AWS_REGION + value: {{ . | quote }} + {{- end }} + {{- with .Values.awsEndpoint }} + - name: AWS_ENDPOINT + value: {{ . | quote }} + {{- end }} + {{- if and .Values.awsAccessKeyID .Values.awsSecretAccessKey }} + - name: AWS_ACCESS_KEY_ID + value: {{ .Values.awsAccessKeyID | quote }} + - name: AWS_SECRET_ACCESS_KEY + value: {{ .Values.awsSecretAccessKey | quote }} + {{- end }} + - name: QUEUE_URL + value: {{ .Values.queueURL | quote }} + - name: WORKERS + value: {{ .Values.workers | quote }} + {{- with .Values.extraEnv }} + {{- toYaml . | nindent 12 }} + {{- end }} + ports: + - name: liveness-probe + protocol: TCP + containerPort: {{ .Values.probes.httpGet.port }} + {{- if .Values.enablePrometheusServer }} + - name: http-metrics + protocol: TCP + containerPort: {{ .Values.prometheusServerPort }} + {{- end }} + livenessProbe: + {{- toYaml .Values.probes | nindent 12 }} + {{- with .Values.resources }} + resources: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- if and .Values.webhookTemplateConfigMapName .Values.webhookTemplateConfigMapKey }} + volumeMounts: + - name: webhook-template + mountPath: /config/ + {{- end }} + {{- if and .Values.webhookTemplateConfigMapName .Values.webhookTemplateConfigMapKey }} + volumes: + - name: webhook-template + configMap: + name: {{ .Values.webhookTemplateConfigMapName }} + {{- end }} + nodeSelector: + kubernetes.io/os: linux + {{- with .Values.nodeSelector }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/pdb.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/pdb.yaml new file mode 100644 index 000000000..7f43ab299 --- /dev/null +++ b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/pdb.yaml @@ -0,0 +1,14 @@ +{{- if and .Values.enableSqsTerminationDraining (and .Values.podDisruptionBudget (gt (int .Values.replicas) 1)) }} +apiVersion: {{ include "aws-node-termination-handler.pdb.apiVersion" . }} +kind: PodDisruptionBudget +metadata: + name: {{ include "aws-node-termination-handler.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "aws-node-termination-handler.labels" . | nindent 4 }} +spec: + selector: + matchLabels: + {{- include "aws-node-termination-handler.selectorLabelsDeployment" . | nindent 6 }} + {{- toYaml .Values.podDisruptionBudget | nindent 2 }} +{{- end }} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/podmonitor.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/podmonitor.yaml new file mode 100644 index 000000000..e214d12ca --- /dev/null +++ b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/podmonitor.yaml @@ -0,0 +1,29 @@ +{{- if and (not .Values.enableSqsTerminationDraining) (and .Values.enablePrometheusServer .Values.podMonitor.create) -}} +apiVersion: monitoring.coreos.com/v1 +kind: PodMonitor +metadata: + name: {{ template "aws-node-termination-handler.fullname" . }} + namespace: {{ default .Release.Namespace .Values.podMonitor.namespace }} + labels: + {{- include "aws-node-termination-handler.labels" . | nindent 4 }} + {{- with .Values.podMonitor.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + jobLabel: app.kubernetes.io/name + namespaceSelector: + matchNames: + - {{ .Release.Namespace }} + podMetricsEndpoints: + - port: http-metrics + path: /metrics + {{- with .Values.podMonitor.interval }} + interval: {{ . }} + {{- end }} + {{- with .Values.podMonitor.sampleLimit }} + sampleLimit: {{ . }} + {{- end }} + selector: + matchLabels: + {{- include "aws-node-termination-handler.selectorLabelsDaemonset" . | nindent 6 }} +{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/psp.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/psp.yaml new file mode 100644 index 000000000..c84d69f39 --- /dev/null +++ b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/psp.yaml @@ -0,0 +1,70 @@ +{{- if and (.Values.rbac.pspEnabled) (semverCompare "<1.25-0" .Capabilities.KubeVersion.GitVersion) }} +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ template "aws-node-termination-handler.fullname" . }} + labels: + {{- include "aws-node-termination-handler.labels" . | nindent 4 }} + annotations: + seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' +spec: + privileged: false + hostIPC: false + hostNetwork: {{ .Values.useHostNetwork }} + hostPID: false +{{- if and (and (not .Values.enableSqsTerminationDraining) .Values.useHostNetwork ) (or .Values.enablePrometheusServer .Values.enableProbesServer) }} + hostPorts: +{{- if .Values.enablePrometheusServer }} + - min: {{ .Values.prometheusServerPort }} + max: {{ .Values.prometheusServerPort }} +{{- end }} +{{- if .Values.enableProbesServer }} + - min: {{ .Values.probes.httpGet.port }} + max: {{ .Values.probes.httpGet.port }} +{{- end }} +{{- end }} + readOnlyRootFilesystem: false + allowPrivilegeEscalation: false + allowedCapabilities: + - '*' + fsGroup: + rule: RunAsAny + runAsUser: + rule: RunAsAny + seLinux: + rule: RunAsAny + supplementalGroups: + rule: RunAsAny + volumes: + - '*' +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ template "aws-node-termination-handler.fullname" . }}-psp + namespace: {{ .Release.Namespace }} + labels: + {{- include "aws-node-termination-handler.labels" . | nindent 4 }} +rules: + - apiGroups: ['policy'] + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: + - {{ template "aws-node-termination-handler.fullname" . }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ template "aws-node-termination-handler.fullname" . }}-psp + namespace: {{ .Release.Namespace }} + labels: + {{- include "aws-node-termination-handler.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "aws-node-termination-handler.fullname" . }}-psp +subjects: + - kind: ServiceAccount + name: {{ template "aws-node-termination-handler.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/service.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/service.yaml new file mode 100644 index 000000000..19f7b067b --- /dev/null +++ b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/service.yaml @@ -0,0 +1,18 @@ +{{- if and .Values.enableSqsTerminationDraining .Values.enablePrometheusServer -}} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "aws-node-termination-handler.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "aws-node-termination-handler.labelsDeployment" . | nindent 4 }} +spec: + type: ClusterIP + selector: + {{- include "aws-node-termination-handler.selectorLabelsDeployment" . | nindent 4 }} + ports: + - name: http-metrics + port: {{ .Values.prometheusServerPort }} + targetPort: http-metrics + protocol: TCP +{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/serviceaccount.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/serviceaccount.yaml new file mode 100644 index 000000000..08f3dc5f8 --- /dev/null +++ b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "aws-node-termination-handler.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "aws-node-termination-handler.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/servicemonitor.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/servicemonitor.yaml new file mode 100644 index 000000000..d5fe14795 --- /dev/null +++ b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/servicemonitor.yaml @@ -0,0 +1,29 @@ +{{- if and .Values.enableSqsTerminationDraining (and .Values.enablePrometheusServer .Values.serviceMonitor.create) -}} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ include "aws-node-termination-handler.fullname" . }} + namespace: {{ default .Release.Namespace .Values.serviceMonitor.namespace }} + labels: + {{- include "aws-node-termination-handler.labels" . | nindent 4 }} + {{- with .Values.serviceMonitor.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + jobLabel: app.kubernetes.io/name + namespaceSelector: + matchNames: + - {{ .Release.Namespace }} + endpoints: + - port: http-metrics + path: /metrics + {{- with .Values.serviceMonitor.interval }} + interval: {{ . }} + {{- end }} + {{- with .Values.serviceMonitor.sampleLimit }} + sampleLimit: {{ . }} + {{- end }} + selector: + matchLabels: + {{- include "aws-node-termination-handler.selectorLabelsDeployment" . | nindent 6 }} +{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/values.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/values.yaml new file mode 100644 index 000000000..ea7b7f77d --- /dev/null +++ b/charts/devtron-utilities/charts/aws-node-termination-handler/values.yaml @@ -0,0 +1,295 @@ +# Default values for aws-node-termination-handler. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +image: + repository: public.ecr.aws/aws-ec2/aws-node-termination-handler + # Overrides the image tag whose default is {{ printf "v%s" .Chart.AppVersion }} + tag: "" + pullPolicy: IfNotPresent + pullSecrets: [] + +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + # Specifies whether a service account should be created + create: true + # The name of the service account to use. If namenot set and create is true, a name is generated using fullname template + name: + annotations: {} + # eks.amazonaws.com/role-arn: arn:aws:iam::AWS_ACCOUNT_ID:role/IAM_ROLE_NAME + +rbac: + # Specifies whether RBAC resources should be created + create: true + # Specifies if PodSecurityPolicy resources should be created. PodSecurityPolicy will not be created when Kubernetes version is 1.25 or later. + pspEnabled: true + +customLabels: {} + +podLabels: {} + +podAnnotations: {} + +podSecurityContext: + fsGroup: 1000 + +securityContext: + readOnlyRootFilesystem: true + runAsNonRoot: true + allowPrivilegeEscalation: false + runAsUser: 1000 + runAsGroup: 1000 + +terminationGracePeriodSeconds: + +resources: {} + +nodeSelector: {} + +affinity: {} + +tolerations: [] + +# Extra environment variables +extraEnv: [] + +# Liveness probe settings +probes: + httpGet: + path: /healthz + port: 8080 + initialDelaySeconds: 5 + periodSeconds: 5 + +# Set the log level +logLevel: info + +# Set the log format version +logFormatVersion: 1 + +# Log messages in JSON format +jsonLogging: false + +enablePrometheusServer: false +prometheusServerPort: 9092 + +# dryRun tells node-termination-handler to only log calls to kubernetes control plane +dryRun: false + +# Cordon but do not drain nodes upon spot interruption termination notice. +cordonOnly: false + +# Taint node upon spot interruption termination notice. +taintNode: false + +# Exclude node from load balancer before cordoning via the ServiceNodeExclusion feature gate. +excludeFromLoadBalancers: false + +# deleteLocalData tells kubectl to continue even if there are pods using +# emptyDir (local data that will be deleted when the node is drained). +deleteLocalData: true + +# ignoreDaemonSets causes kubectl to skip Daemon Set managed pods. +ignoreDaemonSets: true + +# podTerminationGracePeriod is time in seconds given to each pod to terminate gracefully. If negative, the default value specified in the pod will be used. +podTerminationGracePeriod: -1 + +# nodeTerminationGracePeriod specifies the period of time in seconds given to each NODE to terminate gracefully. Node draining will be scheduled based on this value to optimize the amount of compute time, but still safely drain the node before an event. +nodeTerminationGracePeriod: 120 + +# emitKubernetesEvents If true, Kubernetes events will be emitted when interruption events are received and when actions are taken on Kubernetes nodes. In IMDS Processor mode a default set of annotations with all the node metadata gathered from IMDS will be attached to each event +emitKubernetesEvents: false + +# completeLifecycleActionDelaySeconds will pause for the configured duration after draining the node before completing the EC2 Autoscaling lifecycle action. This may be helpful if Pods on the node have Persistent Volume Claims. +completeLifecycleActionDelaySeconds: -1 + +# kubernetesEventsExtraAnnotations A comma-separated list of key=value extra annotations to attach to all emitted Kubernetes events +# Example: "first=annotation,sample.annotation/number=two" +kubernetesEventsExtraAnnotations: "" + +# webhookURL if specified, posts event data to URL upon instance interruption action. +webhookURL: "" + +# Webhook URL will be fetched from the secret store using the given name. +webhookURLSecretName: "" + +# webhookHeaders if specified, replaces the default webhook headers. +webhookHeaders: "" + +# webhookProxy if specified, uses this HTTP(S) proxy configuration. +webhookProxy: "" + +# webhookTemplate if specified, replaces the default webhook message template. +webhookTemplate: "" + +# webhook template file will be fetched from given config map name +# if specified, replaces the default webhook message with the content of the template file +webhookTemplateConfigMapName: "" + +# template file name stored in configmap +webhookTemplateConfigMapKey: "" + +# enableSqsTerminationDraining If true, this turns on queue-processor mode which drains nodes when an SQS termination event is received +enableSqsTerminationDraining: false + +# --------------------------------------------------------------------------------------------------------------------- +# Queue Processor Mode +# --------------------------------------------------------------------------------------------------------------------- + +# The number of replicas in the NTH deployment when using queue-processor mode (NOTE: increasing this may cause duplicate webhooks since NTH pods are stateless) +replicas: 1 + +# Specify the update strategy for the deployment +strategy: {} + +# podDisruptionBudget specifies the disruption budget for the controller pods. +# Disruption budget will be configured only when the replicaCount is greater than 1 +podDisruptionBudget: {} +# maxUnavailable: 1 + +serviceMonitor: + # Specifies whether ServiceMonitor should be created + # this needs enableSqsTerminationDraining: true + # and enablePrometheusServer: true + create: false + # Specifies whether the ServiceMonitor should be created in a different namespace than + # the Helm release + namespace: + # Additional labels to add to the metadata + labels: {} + # The Prometheus scrape interval + interval: 30s + # The number of scraped samples that will be accepted + sampleLimit: 5000 + +priorityClassName: system-cluster-critical + +# If specified, use the AWS region for AWS API calls +awsRegion: "" + +# Listens for messages on the specified SQS queue URL +queueURL: "" + +# The maximum amount of parallel event processors to handle concurrent events +workers: 10 + +# [DEPRECATED] Use checkTagBeforeDraining instead +checkASGTagBeforeDraining: true + +# If true, check that the instance is tagged with "aws-node-termination-handler/managed" as the key before draining the node +checkTagBeforeDraining: true + +# [DEPRECATED] Use managedTag instead +managedAsgTag: "aws-node-termination-handler/managed" + +# The tag to ensure is on a node if checkTagBeforeDraining is true +managedTag: "aws-node-termination-handler/managed" + +# If true, fetch node name through Kubernetes node spec ProviderID instead of AWS event PrivateDnsHostname. +useProviderId: false + +# --------------------------------------------------------------------------------------------------------------------- +# IMDS Mode +# --------------------------------------------------------------------------------------------------------------------- + +# Create node OS specific daemonset(s). (e.g. "linux", "windows", "linux windows") +targetNodeOs: linux + +linuxPodLabels: {} +windowsPodLabels: {} + +linuxPodAnnotations: {} +windowsPodAnnotations: {} + +# K8s DaemonSet update strategy. +updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 25% + +daemonsetPriorityClassName: system-node-critical + +podMonitor: + # Specifies whether PodMonitor should be created + # this needs enableSqsTerminationDraining: false + # and enablePrometheusServer: true + create: false + # Specifies whether the PodMonitor should be created in a different namespace than + # the Helm release + namespace: + # Additional labels to add to the metadata + labels: {} + # The Prometheus scrape interval + interval: 30s + # The number of scraped samples that will be accepted + sampleLimit: 5000 + +# Determines if NTH uses host networking for Linux when running the DaemonSet (only IMDS mode; queue-processor never runs with host networking) +# If you have disabled IMDSv1 and are relying on IMDSv2, you'll need to increase the IP hop count to 2 before switching this to false +# https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html +useHostNetwork: true + +# Daemonset DNS policy +dnsPolicy: "" +dnsConfig: {} +linuxDnsPolicy: ClusterFirstWithHostNet +windowsDnsPolicy: ClusterFirst + +daemonsetNodeSelector: {} +linuxNodeSelector: {} +windowsNodeSelector: {} + +daemonsetAffinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: "eks.amazonaws.com/compute-type" + operator: NotIn + values: + - fargate +linuxAffinity: {} +windowsAffinity: {} + +daemonsetTolerations: + - operator: Exists +linuxTolerations: [] +windowsTolerations: [] + +# If the probes server is running. +enableProbesServer: false + +# Total number of times to try making the metadata request before failing. +metadataTries: 3 + +# enableSpotInterruptionDraining If false, do not drain nodes when the spot interruption termination notice is received. Only used in IMDS mode. +enableSpotInterruptionDraining: true + +# enableScheduledEventDraining If false, do not drain nodes before the maintenance window starts for an EC2 instance scheduled event. Only used in IMDS mode. +enableScheduledEventDraining: true + +# enableRebalanceMonitoring If true, cordon nodes when the rebalance recommendation notice is received. Only used in IMDS mode. +enableRebalanceMonitoring: false + +# enableRebalanceDraining If true, drain nodes when the rebalance recommendation notice is received. Only used in IMDS mode. +enableRebalanceDraining: false + +# --------------------------------------------------------------------------------------------------------------------- +# Testing +# --------------------------------------------------------------------------------------------------------------------- + +# (TESTING USE): If specified, use the provided AWS endpoint to make API calls. +awsEndpoint: "" + +# (TESTING USE): These should only be used for testing w/ localstack! +awsAccessKeyID: +awsSecretAccessKey: + +# (TESTING USE): Override the default metadata URL (default: http://169.254.169.254:80) +instanceMetadataURL: "" + +# (TESTING USE): Mount path for uptime file +procUptimeFile: /proc/uptime diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/.helmignore b/charts/devtron-utilities/charts/cluster-autoscaler/.helmignore new file mode 100644 index 000000000..0e8a0eb36 --- /dev/null +++ b/charts/devtron-utilities/charts/cluster-autoscaler/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/Chart.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/Chart.yaml new file mode 100644 index 000000000..309d79e13 --- /dev/null +++ b/charts/devtron-utilities/charts/cluster-autoscaler/Chart.yaml @@ -0,0 +1,13 @@ +apiVersion: v2 +appVersion: 1.32.0 +description: Scales Kubernetes worker nodes within autoscaling groups. +home: https://github.com/kubernetes/autoscaler +icon: https://github.com/kubernetes/kubernetes/raw/master/logo/logo.png +maintainers: +- email: guyjtempleton@googlemail.com + name: gjtempleton +name: cluster-autoscaler +sources: +- https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler +type: application +version: 9.46.0 diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/README.md b/charts/devtron-utilities/charts/cluster-autoscaler/README.md new file mode 100644 index 000000000..400b342f3 --- /dev/null +++ b/charts/devtron-utilities/charts/cluster-autoscaler/README.md @@ -0,0 +1,527 @@ +# cluster-autoscaler + +Scales Kubernetes worker nodes within autoscaling groups. + +## TL;DR + +```console +$ helm repo add autoscaler https://kubernetes.github.io/autoscaler + +# Method 1 - Using Autodiscovery +$ helm install my-release autoscaler/cluster-autoscaler \ + --set 'autoDiscovery.clusterName'= + +# Method 2 - Specifying groups manually +$ helm install my-release autoscaler/cluster-autoscaler \ + --set "autoscalingGroups[0].name=your-asg-name" \ + --set "autoscalingGroups[0].maxSize=10" \ + --set "autoscalingGroups[0].minSize=1" +``` + +## Introduction + +This chart bootstraps a cluster-autoscaler deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + +## Prerequisites + +- Helm 3+ +- Kubernetes 1.8+ + - [Older versions](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler#releases) may work by overriding the `image`. Cluster autoscaler internally simulates the scheduler and bugs between mismatched versions may be subtle. +- Azure AKS specific Prerequisites: + - Kubernetes 1.10+ with RBAC-enabled. + +## Previous Helm Chart + +The previous `cluster-autoscaler` Helm chart hosted at [helm/charts](https://github.com/helm/charts) has been moved to this repository in accordance with the [Deprecation timeline](https://github.com/helm/charts#deprecation-timeline). Note that a few things have changed between this version and the old version: + +- This repository **only** supports Helm chart installations using Helm 3+ since the `apiVersion` on the charts has been marked as `v2`. +- Previous versions of the Helm chart have not been migrated + +## Migration from 1.X to 9.X+ versions of this Chart + +**TL;DR:** +You should choose to use versions >=9.0.0 of the `cluster-autoscaler` chart published from this repository; previous versions, and the `cluster-autoscaler-chart` with versioning 1.X.X published from this repository are deprecated. + +
+ Previous versions of this chart - further details +On initial migration of this chart from the `helm/charts` repository this chart was renamed from `cluster-autoscaler` to `cluster-autoscaler-chart` due to technical limitations. This affected all `1.X` releases of the chart, version 2.0.0 of this chart exists only to mark the [`cluster-autoscaler-chart` chart](https://artifacthub.io/packages/helm/cluster-autoscaler/cluster-autoscaler-chart) as deprecated. + +Releases of the chart from `9.0.0` onwards return the naming of the chart to `cluster-autoscaler` and return to following the versioning established by the chart's previous location at . + +To migrate from a 1.X release of the chart to a `9.0.0` or later release, you should first uninstall your `1.X` install of the `cluster-autoscaler-chart` chart, before performing the installation of the new `cluster-autoscaler` chart. +
+ +## Migration from 9.0 to 9.1 + +Starting from `9.1.0` the `envFromConfigMap` value is expected to contain the name of a ConfigMap that is used as ref for `envFrom`, similar to `envFromSecret`. If you want to keep the previous behaviour of `envFromConfigMap` you must rename it to `extraEnvConfigMaps`. + +## Installing the Chart + +**By default, no deployment is created and nothing will autoscale**. + +You must provide some minimal configuration, either to specify instance groups or enable auto-discovery. It is not recommended to do both. + +Either: + +- Set `autoDiscovery.clusterName` and provide additional autodiscovery options if necessary **or** +- Set static node group configurations for one or more node groups (using `autoscalingGroups` or `autoscalingGroupsnamePrefix`). + +To create a valid configuration, follow instructions for your cloud provider: + +- [AWS](#aws---using-auto-discovery-of-tagged-instance-groups) +- [GCE](#gce) +- [Azure](#azure) +- [OpenStack Magnum](#openstack-magnum) +- [Cluster API](#cluster-api) +- [Exoscale](#exoscale) +- [Hetzner Cloud](#hetzner-cloud) +- [Civo](#civo) + +### Templating the autoDiscovery.clusterName + +The cluster name can be templated in the `autoDiscovery.clusterName` variable. This is useful when the cluster name is dynamically generated based on other values coming from external systems like Argo CD or Flux. This also allows you to use global Helm values to set the cluster name, e.g., `autoDiscovery.clusterName=\{\{ .Values.global.clusterName }}`, so that you don't need to set it in more than 1 location in the values file. + +### AWS - Using auto-discovery of tagged instance groups + +Auto-discovery finds ASGs tags as below and automatically manages them based on the min and max size specified in the ASG. `cloudProvider=aws` only. + +- Tag the ASGs with keys to match `.Values.autoDiscovery.tags`, by default: `k8s.io/cluster-autoscaler/enabled` and `k8s.io/cluster-autoscaler/` +- Verify the [IAM Permissions](#aws---iam) +- Set `autoDiscovery.clusterName=` +- Set `awsRegion=` +- Set (option) `awsAccessKeyID=` and `awsSecretAccessKey=` if you want to [use AWS credentials directly instead of an instance role](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials) + +```console +$ helm install my-release autoscaler/cluster-autoscaler \ + --set autoDiscovery.clusterName= \ + --set awsRegion= +``` + +Alternatively with your own AWS credentials + +```console +$ helm install my-release autoscaler/cluster-autoscaler \ + --set autoDiscovery.clusterName= \ + --set awsRegion= \ + --set awsAccessKeyID= \ + --set awsSecretAccessKey= +``` + +#### Specifying groups manually + +Without autodiscovery, specify an array of elements each containing ASG name, min size, max size. The sizes specified here will be applied to the ASG, assuming IAM permissions are correctly configured. + +- Verify the [IAM Permissions](#aws---iam) +- Either provide a yaml file setting `autoscalingGroups` (see values.yaml) or use `--set` e.g.: + +```console +$ helm install my-release autoscaler/cluster-autoscaler \ + --set "autoscalingGroups[0].name=your-asg-name" \ + --set "autoscalingGroups[0].maxSize=10" \ + --set "autoscalingGroups[0].minSize=1" +``` + +#### Auto-discovery + +For auto-discovery of instances to work, they must be tagged with the keys in `.Values.autoDiscovery.tags`, which by default are `k8s.io/cluster-autoscaler/enabled` and `k8s.io/cluster-autoscaler/`. + +The value of the tag does not matter, only the key. + +An example kops spec excerpt: + +```yaml +apiVersion: kops/v1alpha2 +kind: Cluster +metadata: + name: my.cluster.internal +spec: + additionalPolicies: + node: | + [ + {"Effect":"Allow","Action":["autoscaling:DescribeAutoScalingGroups","autoscaling:DescribeAutoScalingInstances","autoscaling:DescribeLaunchConfigurations","autoscaling:DescribeTags","autoscaling:SetDesiredCapacity","autoscaling:TerminateInstanceInAutoScalingGroup"],"Resource":"*"} + ] + ... +--- +apiVersion: kops/v1alpha2 +kind: InstanceGroup +metadata: + labels: + kops.k8s.io/cluster: my.cluster.internal + name: my-instances +spec: + cloudLabels: + k8s.io/cluster-autoscaler/enabled: "" + k8s.io/cluster-autoscaler/my.cluster.internal: "" + image: kops.io/k8s-1.8-debian-jessie-amd64-hvm-ebs-2018-01-14 + machineType: r4.large + maxSize: 4 + minSize: 0 +``` + +In this example you would need to `--set autoDiscovery.clusterName=my.cluster.internal` when installing. + +It is not recommended to try to mix this with setting `autoscalingGroups`. + +See [autoscaler AWS documentation](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#auto-discovery-setup) for a more discussion of the setup. + +### GCE + +The following parameters are required: + +- `autoDiscovery.clusterName=any-name` +- `cloud-provider=gce` +- `autoscalingGroupsnamePrefix[0].name=your-ig-prefix,autoscalingGroupsnamePrefix[0].maxSize=10,autoscalingGroupsnamePrefix[0].minSize=1` + +To use Managed Instance Group (MIG) auto-discovery, provide a YAML file setting `autoscalingGroupsnamePrefix` (see values.yaml) or use `--set` when installing the Chart - e.g. + +```console +$ helm install my-release autoscaler/cluster-autoscaler \ + --set "autoscalingGroupsnamePrefix[0].name=your-ig-prefix,autoscalingGroupsnamePrefix[0].maxSize=10,autoscalingGroupsnamePrefi[0].minSize=1" \ + --set autoDiscovery.clusterName= \ + --set cloudProvider=gce +``` + +Note that `your-ig-prefix` should be a _prefix_ matching one or more MIGs, and _not_ the full name of the MIG. For example, to match multiple instance groups - `k8s-node-group-a-standard`, `k8s-node-group-b-gpu`, you would use a prefix of `k8s-node-group-`. + +In the event you want to explicitly specify MIGs instead of using auto-discovery, set members of the `autoscalingGroups` array directly - e.g. + +``` +# where 'n' is the index, starting at 0 +--set autoscalingGroups[n].name=https://content.googleapis.com/compute/v1/projects/$PROJECTID/zones/$ZONENAME/instanceGroupManagers/$FULL-MIG-NAME,autoscalingGroups[n].maxSize=$MAXSIZE,autoscalingGroups[n].minSize=$MINSIZE +``` + +### Azure + +The following parameters are required: + +- `cloudProvider=azure` +- `autoscalingGroups[0].name=your-vmss,autoscalingGroups[0].maxSize=10,autoscalingGroups[0].minSize=1` +- `azureClientID: "your-service-principal-app-id"` +- `azureClientSecret: "your-service-principal-client-secret"` +- `azureSubscriptionID: "your-azure-subscription-id"` +- `azureTenantID: "your-azure-tenant-id"` +- `azureResourceGroup: "your-aks-cluster-resource-group-name"` +- `azureVMType: "vmss"` + +### OpenStack Magnum + +`cloudProvider: magnum` must be set, and then one of + +- `magnumClusterName=` and `autoscalingGroups` with the names of node groups and min/max node counts +- or `autoDiscovery.clusterName=` with one or more `autoDiscovery.roles`. + +Additionally, `cloudConfigPath: "/etc/kubernetes/cloud-config"` must be set as this should be the location of the cloud-config file on the host. + +Example values files can be found [here](../../cluster-autoscaler/cloudprovider/magnum/examples). + +Install the chart with + +```console +$ helm install my-release autoscaler/cluster-autoscaler -f myvalues.yaml +``` + +### Cluster-API + +`cloudProvider: clusterapi` must be set, and then one or more of + +- `autoDiscovery.clusterName` +- or `autoDiscovery.namespace` +- or `autoDiscovery.labels` + +See [here](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/clusterapi/README.md#configuring-node-group-auto-discovery) for more details. + +Additional config parameters available, see the `values.yaml` for more details + +- `clusterAPIMode` +- `clusterAPIKubeconfigSecret` +- `clusterAPIWorkloadKubeconfigPath` +- `clusterAPICloudConfigPath` + +### Exoscale + +Create a `values.yaml` file with the following content: +```yaml +cloudProvider: exoscale +autoDiscovery: + clusterName: cluster.local # this value is not used, but must be set +``` + +Optionally, you may specify the minimum and maximum size of a particular nodepool by adding the following to the `values.yaml` file: +```yaml +autoscalingGroups: + - name: your-nodepool-name + maxSize: 10 + minSize: 1 +``` + +Create an Exoscale API key with appropriate permissions as described in [cluster-autoscaler/cloudprovider/exoscale/README.md](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/exoscale/README.md). +A secret of name `-exoscale-cluster-autoscaler` needs to be created, containing the api key and secret, as well as the zone. + +```console +$ kubectl create secret generic my-release-exoscale-cluster-autoscaler \ + --from-literal=api-key="EXOxxxxxxxxxxxxxxxxxxxxxxxx" \ + --from-literal=api-secret="xxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" --from-literal=api-zone="ch-gva-2" +``` + +After creating the secret, the chart may be installed: + +```console +$ helm install my-release autoscaler/cluster-autoscaler -f values.yaml +``` + +Read [cluster-autoscaler/cloudprovider/exoscale/README.md](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/exoscale/README.md) for further information on the setup without helm. + +### Hetzner Cloud + +The following parameters are required: + +- `cloudProvider=hetzner` +- `extraEnv.HCLOUD_TOKEN=...` +- `autoscalingGroups=...` + +Each autoscaling group requires an additional `instanceType` and `region` key to be set. + +Read [cluster-autoscaler/cloudprovider/hetzner/README.md](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/hetzner/README.md) for further information on the setup without helm. + +### Civo + +The following parameters are required: + +- `cloudProvider=civo` +- `autoscalingGroups=...` + +When installing the helm chart to the namespace `kube-system`, you can set `secretKeyRefNameOverride` to `civo-api-access`. +Otherwise specify the following parameters: + +- `civoApiUrl=https://api.civo.com` +- `civoApiKey=...` +- `civoClusterID=...` +- `civoRegion=...` + +Read [cluster-autoscaler/cloudprovider/civo/README.md](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/civo/README.md) for further information on the setup without helm. + +## Uninstalling the Chart + +To uninstall `my-release`: + +```console +$ helm uninstall my-release +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. + +> **Tip**: List all releases using `helm list` or start clean with `helm uninstall my-release` + +## Additional Configuration + +### AWS - IAM + +The worker running the cluster autoscaler will need access to certain resources and actions depending on the version you run and your configuration of it. + +For the up-to-date IAM permissions required, please see the [cluster autoscaler's AWS Cloudprovider Readme](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#iam-policy) and switch to the tag of the cluster autoscaler image you are using. + +### AWS - IAM Roles for Service Accounts (IRSA) + +For Kubernetes clusters that use Amazon EKS, the service account can be configured with an IAM role using [IAM Roles for Service Accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) to avoid needing to grant access to the worker nodes for AWS resources. + +In order to accomplish this, you will first need to create a new IAM role with the above mentions policies. Take care in [configuring the trust relationship](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-technical-overview.html#iam-role-configuration) to restrict access just to the service account used by cluster autoscaler. + +Once you have the IAM role configured, you would then need to `--set rbac.serviceAccount.annotations."eks\.amazonaws\.com/role-arn"=arn:aws:iam::123456789012:role/MyRoleName` when installing. + +### Azure - Using azure workload identity + +You can use the project [Azure workload identity](https://github.com/Azure/azure-workload-identity), to automatically configure the correct setup for your pods to used federated identity with Azure. + +You can also set the correct settings yourself instead of relying on this project. + +For example the following configuration will configure the Autoscaler to use your federated identity: + +```yaml +azureUseWorkloadIdentityExtension: true +extraEnv: + AZURE_CLIENT_ID: USER ASSIGNED IDENTITY CLIENT ID + AZURE_TENANT_ID: USER ASSIGNED IDENTITY TENANT ID + AZURE_FEDERATED_TOKEN_FILE: /var/run/secrets/tokens/azure-identity-token + AZURE_AUTHORITY_HOST: https://login.microsoftonline.com/ +extraVolumes: +- name: azure-identity-token + projected: + defaultMode: 420 + sources: + - serviceAccountToken: + audience: api://AzureADTokenExchange + expirationSeconds: 3600 + path: azure-identity-token +extraVolumeMounts: +- mountPath: /var/run/secrets/tokens + name: azure-identity-token + readOnly: true +``` + +### Custom arguments + +You can use the `customArgs` value to give any argument to cluster autoscaler command. + +Typical use case is to give an environment variable as an argument which will be interpolated at execution time. + +This is helpful when you need to inject values from configmap or secret. + +## Troubleshooting + +The chart will succeed even if the container arguments are incorrect. A few minutes after starting `kubectl logs -l "app=aws-cluster-autoscaler" --tail=50` should loop through something like + +``` +polling_autoscaler.go:111] Poll finished +static_autoscaler.go:97] Starting main loop +utils.go:435] No pod using affinity / antiaffinity found in cluster, disabling affinity predicate for this loop +static_autoscaler.go:230] Filtering out schedulables +``` + +If not, find a pod that the deployment created and `describe` it, paying close attention to the arguments under `Command`. e.g.: + +``` +Containers: + cluster-autoscaler: + Command: + ./cluster-autoscaler + --cloud-provider=aws +# if specifying ASGs manually + --nodes=1:10:your-scaling-group-name +# if using autodiscovery + --node-group-auto-discovery=asg:tag=k8s.io/cluster-autoscaler/enabled,k8s.io/cluster-autoscaler/ + --v=4 +``` + +### PodSecurityPolicy + +Though enough for the majority of installations, the default PodSecurityPolicy _could_ be too restrictive depending on the specifics of your release. Please make sure to check that the template fits with any customizations made or disable it by setting `rbac.pspEnabled` to `false`. + +### VerticalPodAutoscaler + +The CA Helm Chart can install a [`VerticalPodAutoscaler`](https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/README.md) object from Chart version `9.27.0` +onwards for the Cluster Autoscaler Deployment to scale the CA as appropriate, but for that, we +need to install the VPA to the cluster separately. A VPA can help minimize wasted resources +when usage spikes periodically or remediate containers that are being OOMKilled. + +The following example snippet can be used to install VPA that allows scaling down from the default recommendations of the deployment template: + +```yaml +vpa: + enabled: true + containerPolicy: + minAllowed: + cpu: 20m + memory: 50Mi +``` + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| additionalLabels | object | `{}` | Labels to add to each object of the chart. | +| affinity | object | `{}` | Affinity for pod assignment | +| autoDiscovery.clusterName | string | `nil` | Enable autodiscovery for `cloudProvider=aws`, for groups matching `autoDiscovery.tags`. autoDiscovery.clusterName -- Enable autodiscovery for `cloudProvider=azure`, using tags defined in https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/azure/README.md#auto-discovery-setup. Enable autodiscovery for `cloudProvider=clusterapi`, for groups matching `autoDiscovery.labels`. Enable autodiscovery for `cloudProvider=gce`, but no MIG tagging required. Enable autodiscovery for `cloudProvider=magnum`, for groups matching `autoDiscovery.roles`. | +| autoDiscovery.labels | list | `[]` | Cluster-API labels to match https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/clusterapi/README.md#configuring-node-group-auto-discovery | +| autoDiscovery.namespace | string | `nil` | Enable autodiscovery via cluster namespace for for `cloudProvider=clusterapi` | +| autoDiscovery.roles | list | `["worker"]` | Magnum node group roles to match. | +| autoDiscovery.tags | list | `["k8s.io/cluster-autoscaler/enabled","k8s.io/cluster-autoscaler/{{ .Values.autoDiscovery.clusterName }}"]` | ASG tags to match, run through `tpl`. | +| autoscalingGroups | list | `[]` | For AWS, Azure AKS, Exoscale or Magnum. At least one element is required if not using `autoDiscovery`. For example: 
 - name: asg1
   maxSize: 2
   minSize: 1
For Hetzner Cloud, the `instanceType` and `region` keys are also required. 
 - name: mypool
   maxSize: 2
   minSize: 1
   instanceType: CPX21
   region: FSN1
| +| autoscalingGroupsnamePrefix | list | `[]` | For GCE. At least one element is required if not using `autoDiscovery`. For example: 
 - name: ig01
   maxSize: 10
   minSize: 0
| +| awsAccessKeyID | string | `""` | AWS access key ID ([if AWS user keys used](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials)) | +| awsRegion | string | `"us-east-1"` | AWS region (required if `cloudProvider=aws`) | +| awsSecretAccessKey | string | `""` | AWS access secret key ([if AWS user keys used](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials)) | +| azureClientID | string | `""` | Service Principal ClientID with contributor permission to Cluster and Node ResourceGroup. Required if `cloudProvider=azure` | +| azureClientSecret | string | `""` | Service Principal ClientSecret with contributor permission to Cluster and Node ResourceGroup. Required if `cloudProvider=azure` | +| azureEnableForceDelete | bool | `false` | Whether to force delete VMs or VMSS instances when scaling down. | +| azureResourceGroup | string | `""` | Azure resource group that the cluster is located. Required if `cloudProvider=azure` | +| azureSubscriptionID | string | `""` | Azure subscription where the resources are located. Required if `cloudProvider=azure` | +| azureTenantID | string | `""` | Azure tenant where the resources are located. Required if `cloudProvider=azure` | +| azureUseManagedIdentityExtension | bool | `false` | Whether to use Azure's managed identity extension for credentials. If using MSI, ensure subscription ID, resource group, and azure AKS cluster name are set. You can only use one authentication method at a time, either azureUseWorkloadIdentityExtension or azureUseManagedIdentityExtension should be set. | +| azureUseWorkloadIdentityExtension | bool | `false` | Whether to use Azure's workload identity extension for credentials. See the project here: https://github.com/Azure/azure-workload-identity for more details. You can only use one authentication method at a time, either azureUseWorkloadIdentityExtension or azureUseManagedIdentityExtension should be set. | +| azureVMType | string | `"vmss"` | Azure VM type. | +| civoApiKey | string | `""` | API key for the Civo API. Required if `cloudProvider=civo` | +| civoApiUrl | string | `"https://api.civo.com"` | URL for the Civo API. Required if `cloudProvider=civo` | +| civoClusterID | string | `""` | Cluster ID for the Civo cluster. Required if `cloudProvider=civo` | +| civoRegion | string | `""` | Region for the Civo cluster. Required if `cloudProvider=civo` | +| cloudConfigPath | string | `""` | Configuration file for cloud provider. | +| cloudProvider | string | `"aws"` | The cloud provider where the autoscaler runs. Currently only `gce`, `aws`, `azure`, `magnum`, `clusterapi` and `civo` are supported. `aws` supported for AWS. `gce` for GCE. `azure` for Azure AKS. `magnum` for OpenStack Magnum, `clusterapi` for Cluster API. `civo` for Civo Cloud. | +| clusterAPICloudConfigPath | string | `"/etc/kubernetes/mgmt-kubeconfig"` | Path to kubeconfig for connecting to Cluster API Management Cluster, only used if `clusterAPIMode=kubeconfig-kubeconfig or incluster-kubeconfig` | +| clusterAPIConfigMapsNamespace | string | `""` | Namespace on the workload cluster to store Leader election and status configmaps | +| clusterAPIKubeconfigSecret | string | `""` | Secret containing kubeconfig for connecting to Cluster API managed workloadcluster Required if `cloudProvider=clusterapi` and `clusterAPIMode=kubeconfig-kubeconfig,kubeconfig-incluster or incluster-kubeconfig` | +| clusterAPIMode | string | `"incluster-incluster"` | Cluster API mode, see https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/clusterapi/README.md#connecting-cluster-autoscaler-to-cluster-api-management-and-workload-clusters Syntax: workloadClusterMode-ManagementClusterMode for `kubeconfig-kubeconfig`, `incluster-kubeconfig` and `single-kubeconfig` you always must mount the external kubeconfig using either `extraVolumeSecrets` or `extraMounts` and `extraVolumes` if you dont set `clusterAPIKubeconfigSecret`and thus use an in-cluster config or want to use a non capi generated kubeconfig you must do so for the workload kubeconfig as well | +| clusterAPIWorkloadKubeconfigPath | string | `"/etc/kubernetes/value"` | Path to kubeconfig for connecting to Cluster API managed workloadcluster, only used if `clusterAPIMode=kubeconfig-kubeconfig or kubeconfig-incluster` | +| containerSecurityContext | object | `{}` | [Security context for container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| customArgs | list | `[]` | Additional custom container arguments. Refer to https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md#what-are-the-parameters-to-ca for the full list of cluster autoscaler parameters and their default values. List of arguments as strings. | +| deployment.annotations | object | `{}` | Annotations to add to the Deployment object. | +| dnsPolicy | string | `"ClusterFirst"` | Defaults to `ClusterFirst`. Valid values are: `ClusterFirstWithHostNet`, `ClusterFirst`, `Default` or `None`. If autoscaler does not depend on cluster DNS, recommended to set this to `Default`. | +| envFromConfigMap | string | `""` | ConfigMap name to use as envFrom. | +| envFromSecret | string | `""` | Secret name to use as envFrom. | +| expanderPriorities | object | `{}` | The expanderPriorities is used if `extraArgs.expander` contains `priority` and expanderPriorities is also set with the priorities. If `extraArgs.expander` contains `priority`, then expanderPriorities is used to define cluster-autoscaler-priority-expander priorities. See: https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/expander/priority/readme.md | +| extraArgs | object | `{"logtostderr":true,"stderrthreshold":"info","v":4}` | Additional container arguments. Refer to https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md#what-are-the-parameters-to-ca for the full list of cluster autoscaler parameters and their default values. Everything after the first _ will be ignored allowing the use of multi-string arguments. | +| extraEnv | object | `{}` | Additional container environment variables. | +| extraEnvConfigMaps | object | `{}` | Additional container environment variables from ConfigMaps. | +| extraEnvSecrets | object | `{}` | Additional container environment variables from Secrets. | +| extraObjects | list | `[]` | Extra K8s manifests to deploy | +| extraVolumeMounts | list | `[]` | Additional volumes to mount. | +| extraVolumeSecrets | object | `{}` | Additional volumes to mount from Secrets. | +| extraVolumes | list | `[]` | Additional volumes. | +| fullnameOverride | string | `""` | String to fully override `cluster-autoscaler.fullname` template. | +| hostNetwork | bool | `false` | Whether to expose network interfaces of the host machine to pods. | +| image.pullPolicy | string | `"IfNotPresent"` | Image pull policy | +| image.pullSecrets | list | `[]` | Image pull secrets | +| image.repository | string | `"registry.k8s.io/autoscaling/cluster-autoscaler"` | Image repository | +| image.tag | string | `"v1.32.0"` | Image tag | +| initContainers | list | `[]` | Any additional init containers. | +| kubeTargetVersionOverride | string | `""` | Allow overriding the `.Capabilities.KubeVersion.GitVersion` check. Useful for `helm template` commands. | +| kwokConfigMapName | string | `"kwok-provider-config"` | configmap for configuring kwok provider | +| magnumCABundlePath | string | `"/etc/kubernetes/ca-bundle.crt"` | Path to the host's CA bundle, from `ca-file` in the cloud-config file. | +| magnumClusterName | string | `""` | Cluster name or ID in Magnum. Required if `cloudProvider=magnum` and not setting `autoDiscovery.clusterName`. | +| nameOverride | string | `""` | String to partially override `cluster-autoscaler.fullname` template (will maintain the release name) | +| nodeSelector | object | `{}` | Node labels for pod assignment. Ref: https://kubernetes.io/docs/user-guide/node-selection/. | +| podAnnotations | object | `{}` | Annotations to add to each pod. | +| podDisruptionBudget | object | `{"maxUnavailable":1}` | Pod disruption budget. | +| podLabels | object | `{}` | Labels to add to each pod. | +| priorityClassName | string | `"system-cluster-critical"` | priorityClassName | +| priorityConfigMapAnnotations | object | `{}` | Annotations to add to `cluster-autoscaler-priority-expander` ConfigMap. | +| prometheusRule.additionalLabels | object | `{}` | Additional labels to be set in metadata. | +| prometheusRule.enabled | bool | `false` | If true, creates a Prometheus Operator PrometheusRule. | +| prometheusRule.interval | string | `nil` | How often rules in the group are evaluated (falls back to `global.evaluation_interval` if not set). | +| prometheusRule.namespace | string | `"monitoring"` | Namespace which Prometheus is running in. | +| prometheusRule.rules | list | `[]` | Rules spec template (see https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/api.md#rule). | +| rbac.clusterScoped | bool | `true` | if set to false will only provision RBAC to alter resources in the current namespace. Most useful for Cluster-API | +| rbac.create | bool | `true` | If `true`, create and use RBAC resources. | +| rbac.pspEnabled | bool | `false` | If `true`, creates and uses RBAC resources required in the cluster with [Pod Security Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) enabled. Must be used with `rbac.create` set to `true`. | +| rbac.serviceAccount.annotations | object | `{}` | Additional Service Account annotations. | +| rbac.serviceAccount.automountServiceAccountToken | bool | `true` | Automount API credentials for a Service Account. | +| rbac.serviceAccount.create | bool | `true` | If `true` and `rbac.create` is also true, a Service Account will be created. | +| rbac.serviceAccount.name | string | `""` | The name of the ServiceAccount to use. If not set and create is `true`, a name is generated using the fullname template. | +| replicaCount | int | `1` | Desired number of pods | +| resources | object | `{}` | Pod resource requests and limits. | +| revisionHistoryLimit | int | `10` | The number of revisions to keep. | +| secretKeyRefNameOverride | string | `""` | Overrides the name of the Secret to use when loading the secretKeyRef for AWS, Azure and Civo env variables | +| securityContext | object | `{}` | [Security context for pod](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| service.annotations | object | `{}` | Annotations to add to service | +| service.clusterIP | string | `""` | IP address to assign to service | +| service.create | bool | `true` | If `true`, a Service will be created. | +| service.externalIPs | list | `[]` | List of IP addresses at which the service is available. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips. | +| service.labels | object | `{}` | Labels to add to service | +| service.loadBalancerIP | string | `""` | IP address to assign to load balancer (if supported). | +| service.loadBalancerSourceRanges | list | `[]` | List of IP CIDRs allowed access to load balancer (if supported). | +| service.portName | string | `"http"` | Name for service port. | +| service.servicePort | int | `8085` | Service port to expose. | +| service.type | string | `"ClusterIP"` | Type of service to create. | +| serviceMonitor.annotations | object | `{}` | Annotations to add to service monitor | +| serviceMonitor.enabled | bool | `false` | If true, creates a Prometheus Operator ServiceMonitor. | +| serviceMonitor.interval | string | `"10s"` | Interval that Prometheus scrapes Cluster Autoscaler metrics. | +| serviceMonitor.metricRelabelings | object | `{}` | MetricRelabelConfigs to apply to samples before ingestion. | +| serviceMonitor.namespace | string | `"monitoring"` | Namespace which Prometheus is running in. | +| serviceMonitor.path | string | `"/metrics"` | The path to scrape for metrics; autoscaler exposes `/metrics` (this is standard) | +| serviceMonitor.relabelings | object | `{}` | RelabelConfigs to apply to metrics before scraping. | +| serviceMonitor.selector | object | `{"release":"prometheus-operator"}` | Default to kube-prometheus install (CoreOS recommended), but should be set according to Prometheus install. | +| tolerations | list | `[]` | List of node taints to tolerate (requires Kubernetes >= 1.6). | +| topologySpreadConstraints | list | `[]` | You can use topology spread constraints to control how Pods are spread across your cluster among failure-domains such as regions, zones, nodes, and other user-defined topology domains. (requires Kubernetes >= 1.19). | +| updateStrategy | object | `{}` | [Deployment update strategy](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy) | +| vpa | object | `{"containerPolicy":{},"enabled":false,"updateMode":"Auto"}` | Configure a VerticalPodAutoscaler for the cluster-autoscaler Deployment. | +| vpa.containerPolicy | object | `{}` | [ContainerResourcePolicy](https://github.com/kubernetes/autoscaler/blob/vertical-pod-autoscaler/v0.13.0/vertical-pod-autoscaler/pkg/apis/autoscaling.k8s.io/v1/types.go#L159). The containerName is always et to the deployment's container name. This value is required if VPA is enabled. | +| vpa.enabled | bool | `false` | If true, creates a VerticalPodAutoscaler. | +| vpa.updateMode | string | `"Auto"` | [UpdateMode](https://github.com/kubernetes/autoscaler/blob/vertical-pod-autoscaler/v0.13.0/vertical-pod-autoscaler/pkg/apis/autoscaling.k8s.io/v1/types.go#L124) | diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/README.md.gotmpl b/charts/devtron-utilities/charts/cluster-autoscaler/README.md.gotmpl new file mode 100644 index 000000000..8381e8232 --- /dev/null +++ b/charts/devtron-utilities/charts/cluster-autoscaler/README.md.gotmpl @@ -0,0 +1,417 @@ +{{ template "chart.header" . }} + +{{ template "chart.description" . }} + +## TL;DR + +```console +$ helm repo add autoscaler https://kubernetes.github.io/autoscaler + +# Method 1 - Using Autodiscovery +$ helm install my-release autoscaler/cluster-autoscaler \ + --set 'autoDiscovery.clusterName'= + +# Method 2 - Specifying groups manually +$ helm install my-release autoscaler/cluster-autoscaler \ + --set "autoscalingGroups[0].name=your-asg-name" \ + --set "autoscalingGroups[0].maxSize=10" \ + --set "autoscalingGroups[0].minSize=1" +``` + +## Introduction + +This chart bootstraps a cluster-autoscaler deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + +## Prerequisites + +- Helm 3+ +- Kubernetes 1.8+ + - [Older versions](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler#releases) may work by overriding the `image`. Cluster autoscaler internally simulates the scheduler and bugs between mismatched versions may be subtle. +- Azure AKS specific Prerequisites: + - Kubernetes 1.10+ with RBAC-enabled. + +## Previous Helm Chart + +The previous `cluster-autoscaler` Helm chart hosted at [helm/charts](https://github.com/helm/charts) has been moved to this repository in accordance with the [Deprecation timeline](https://github.com/helm/charts#deprecation-timeline). Note that a few things have changed between this version and the old version: + +- This repository **only** supports Helm chart installations using Helm 3+ since the `apiVersion` on the charts has been marked as `v2`. +- Previous versions of the Helm chart have not been migrated + +## Migration from 1.X to 9.X+ versions of this Chart + +**TL;DR:** +You should choose to use versions >=9.0.0 of the `cluster-autoscaler` chart published from this repository; previous versions, and the `cluster-autoscaler-chart` with versioning 1.X.X published from this repository are deprecated. + +
+ Previous versions of this chart - further details +On initial migration of this chart from the `helm/charts` repository this chart was renamed from `cluster-autoscaler` to `cluster-autoscaler-chart` due to technical limitations. This affected all `1.X` releases of the chart, version 2.0.0 of this chart exists only to mark the [`cluster-autoscaler-chart` chart](https://artifacthub.io/packages/helm/cluster-autoscaler/cluster-autoscaler-chart) as deprecated. + +Releases of the chart from `9.0.0` onwards return the naming of the chart to `cluster-autoscaler` and return to following the versioning established by the chart's previous location at . + +To migrate from a 1.X release of the chart to a `9.0.0` or later release, you should first uninstall your `1.X` install of the `cluster-autoscaler-chart` chart, before performing the installation of the new `cluster-autoscaler` chart. +
+ +## Migration from 9.0 to 9.1 + +Starting from `9.1.0` the `envFromConfigMap` value is expected to contain the name of a ConfigMap that is used as ref for `envFrom`, similar to `envFromSecret`. If you want to keep the previous behaviour of `envFromConfigMap` you must rename it to `extraEnvConfigMaps`. + +## Installing the Chart + +**By default, no deployment is created and nothing will autoscale**. + +You must provide some minimal configuration, either to specify instance groups or enable auto-discovery. It is not recommended to do both. + +Either: + +- Set `autoDiscovery.clusterName` and provide additional autodiscovery options if necessary **or** +- Set static node group configurations for one or more node groups (using `autoscalingGroups` or `autoscalingGroupsnamePrefix`). + +To create a valid configuration, follow instructions for your cloud provider: + +- [AWS](#aws---using-auto-discovery-of-tagged-instance-groups) +- [GCE](#gce) +- [Azure](#azure) +- [OpenStack Magnum](#openstack-magnum) +- [Cluster API](#cluster-api) +- [Exoscale](#exoscale) +- [Hetzner Cloud](#hetzner-cloud) +- [Civo](#civo) + +### Templating the autoDiscovery.clusterName + +The cluster name can be templated in the `autoDiscovery.clusterName` variable. This is useful when the cluster name is dynamically generated based on other values coming from external systems like Argo CD or Flux. This also allows you to use global Helm values to set the cluster name, e.g., `autoDiscovery.clusterName=\{\{ .Values.global.clusterName }}`, so that you don't need to set it in more than 1 location in the values file. + +### AWS - Using auto-discovery of tagged instance groups + +Auto-discovery finds ASGs tags as below and automatically manages them based on the min and max size specified in the ASG. `cloudProvider=aws` only. + +- Tag the ASGs with keys to match `.Values.autoDiscovery.tags`, by default: `k8s.io/cluster-autoscaler/enabled` and `k8s.io/cluster-autoscaler/` +- Verify the [IAM Permissions](#aws---iam) +- Set `autoDiscovery.clusterName=` +- Set `awsRegion=` +- Set (option) `awsAccessKeyID=` and `awsSecretAccessKey=` if you want to [use AWS credentials directly instead of an instance role](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials) + +```console +$ helm install my-release autoscaler/cluster-autoscaler \ + --set autoDiscovery.clusterName= \ + --set awsRegion= +``` + +Alternatively with your own AWS credentials + +```console +$ helm install my-release autoscaler/cluster-autoscaler \ + --set autoDiscovery.clusterName= \ + --set awsRegion= \ + --set awsAccessKeyID= \ + --set awsSecretAccessKey= +``` + +#### Specifying groups manually + +Without autodiscovery, specify an array of elements each containing ASG name, min size, max size. The sizes specified here will be applied to the ASG, assuming IAM permissions are correctly configured. + +- Verify the [IAM Permissions](#aws---iam) +- Either provide a yaml file setting `autoscalingGroups` (see values.yaml) or use `--set` e.g.: + +```console +$ helm install my-release autoscaler/cluster-autoscaler \ + --set "autoscalingGroups[0].name=your-asg-name" \ + --set "autoscalingGroups[0].maxSize=10" \ + --set "autoscalingGroups[0].minSize=1" +``` + +#### Auto-discovery + +For auto-discovery of instances to work, they must be tagged with the keys in `.Values.autoDiscovery.tags`, which by default are `k8s.io/cluster-autoscaler/enabled` and `k8s.io/cluster-autoscaler/`. + +The value of the tag does not matter, only the key. + +An example kops spec excerpt: + +```yaml +apiVersion: kops/v1alpha2 +kind: Cluster +metadata: + name: my.cluster.internal +spec: + additionalPolicies: + node: | + [ + {"Effect":"Allow","Action":["autoscaling:DescribeAutoScalingGroups","autoscaling:DescribeAutoScalingInstances","autoscaling:DescribeLaunchConfigurations","autoscaling:DescribeTags","autoscaling:SetDesiredCapacity","autoscaling:TerminateInstanceInAutoScalingGroup"],"Resource":"*"} + ] + ... +--- +apiVersion: kops/v1alpha2 +kind: InstanceGroup +metadata: + labels: + kops.k8s.io/cluster: my.cluster.internal + name: my-instances +spec: + cloudLabels: + k8s.io/cluster-autoscaler/enabled: "" + k8s.io/cluster-autoscaler/my.cluster.internal: "" + image: kops.io/k8s-1.8-debian-jessie-amd64-hvm-ebs-2018-01-14 + machineType: r4.large + maxSize: 4 + minSize: 0 +``` + +In this example you would need to `--set autoDiscovery.clusterName=my.cluster.internal` when installing. + +It is not recommended to try to mix this with setting `autoscalingGroups`. + +See [autoscaler AWS documentation](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#auto-discovery-setup) for a more discussion of the setup. + +### GCE + +The following parameters are required: + +- `autoDiscovery.clusterName=any-name` +- `cloud-provider=gce` +- `autoscalingGroupsnamePrefix[0].name=your-ig-prefix,autoscalingGroupsnamePrefix[0].maxSize=10,autoscalingGroupsnamePrefix[0].minSize=1` + +To use Managed Instance Group (MIG) auto-discovery, provide a YAML file setting `autoscalingGroupsnamePrefix` (see values.yaml) or use `--set` when installing the Chart - e.g. + +```console +$ helm install my-release autoscaler/cluster-autoscaler \ + --set "autoscalingGroupsnamePrefix[0].name=your-ig-prefix,autoscalingGroupsnamePrefix[0].maxSize=10,autoscalingGroupsnamePrefi[0].minSize=1" \ + --set autoDiscovery.clusterName= \ + --set cloudProvider=gce +``` + +Note that `your-ig-prefix` should be a _prefix_ matching one or more MIGs, and _not_ the full name of the MIG. For example, to match multiple instance groups - `k8s-node-group-a-standard`, `k8s-node-group-b-gpu`, you would use a prefix of `k8s-node-group-`. + +In the event you want to explicitly specify MIGs instead of using auto-discovery, set members of the `autoscalingGroups` array directly - e.g. + +``` +# where 'n' is the index, starting at 0 +--set autoscalingGroups[n].name=https://content.googleapis.com/compute/v1/projects/$PROJECTID/zones/$ZONENAME/instanceGroupManagers/$FULL-MIG-NAME,autoscalingGroups[n].maxSize=$MAXSIZE,autoscalingGroups[n].minSize=$MINSIZE +``` + +### Azure + +The following parameters are required: + +- `cloudProvider=azure` +- `autoscalingGroups[0].name=your-vmss,autoscalingGroups[0].maxSize=10,autoscalingGroups[0].minSize=1` +- `azureClientID: "your-service-principal-app-id"` +- `azureClientSecret: "your-service-principal-client-secret"` +- `azureSubscriptionID: "your-azure-subscription-id"` +- `azureTenantID: "your-azure-tenant-id"` +- `azureResourceGroup: "your-aks-cluster-resource-group-name"` +- `azureVMType: "vmss"` + +### OpenStack Magnum + +`cloudProvider: magnum` must be set, and then one of + +- `magnumClusterName=` and `autoscalingGroups` with the names of node groups and min/max node counts +- or `autoDiscovery.clusterName=` with one or more `autoDiscovery.roles`. + +Additionally, `cloudConfigPath: "/etc/kubernetes/cloud-config"` must be set as this should be the location of the cloud-config file on the host. + +Example values files can be found [here](../../cluster-autoscaler/cloudprovider/magnum/examples). + +Install the chart with + +```console +$ helm install my-release autoscaler/cluster-autoscaler -f myvalues.yaml +``` + +### Cluster-API + +`cloudProvider: clusterapi` must be set, and then one or more of + +- `autoDiscovery.clusterName` +- or `autoDiscovery.namespace` +- or `autoDiscovery.labels` + +See [here](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/clusterapi/README.md#configuring-node-group-auto-discovery) for more details. + +Additional config parameters available, see the `values.yaml` for more details + +- `clusterAPIMode` +- `clusterAPIKubeconfigSecret` +- `clusterAPIWorkloadKubeconfigPath` +- `clusterAPICloudConfigPath` + +### Exoscale + +Create a `values.yaml` file with the following content: +```yaml +cloudProvider: exoscale +autoDiscovery: + clusterName: cluster.local # this value is not used, but must be set +``` + +Optionally, you may specify the minimum and maximum size of a particular nodepool by adding the following to the `values.yaml` file: +```yaml +autoscalingGroups: + - name: your-nodepool-name + maxSize: 10 + minSize: 1 +``` + +Create an Exoscale API key with appropriate permissions as described in [cluster-autoscaler/cloudprovider/exoscale/README.md](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/exoscale/README.md). +A secret of name `-exoscale-cluster-autoscaler` needs to be created, containing the api key and secret, as well as the zone. + +```console +$ kubectl create secret generic my-release-exoscale-cluster-autoscaler \ + --from-literal=api-key="EXOxxxxxxxxxxxxxxxxxxxxxxxx" \ + --from-literal=api-secret="xxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" --from-literal=api-zone="ch-gva-2" +``` + +After creating the secret, the chart may be installed: + +```console +$ helm install my-release autoscaler/cluster-autoscaler -f values.yaml +``` + +Read [cluster-autoscaler/cloudprovider/exoscale/README.md](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/exoscale/README.md) for further information on the setup without helm. + +### Hetzner Cloud + +The following parameters are required: + +- `cloudProvider=hetzner` +- `extraEnv.HCLOUD_TOKEN=...` +- `autoscalingGroups=...` + +Each autoscaling group requires an additional `instanceType` and `region` key to be set. + +Read [cluster-autoscaler/cloudprovider/hetzner/README.md](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/hetzner/README.md) for further information on the setup without helm. + +### Civo + +The following parameters are required: + +- `cloudProvider=civo` +- `autoscalingGroups=...` + +When installing the helm chart to the namespace `kube-system`, you can set `secretKeyRefNameOverride` to `civo-api-access`. +Otherwise specify the following parameters: + +- `civoApiUrl=https://api.civo.com` +- `civoApiKey=...` +- `civoClusterID=...` +- `civoRegion=...` + +Read [cluster-autoscaler/cloudprovider/civo/README.md](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/civo/README.md) for further information on the setup without helm. + +## Uninstalling the Chart + +To uninstall `my-release`: + +```console +$ helm uninstall my-release +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. + +> **Tip**: List all releases using `helm list` or start clean with `helm uninstall my-release` + +## Additional Configuration + +### AWS - IAM + +The worker running the cluster autoscaler will need access to certain resources and actions depending on the version you run and your configuration of it. + +For the up-to-date IAM permissions required, please see the [cluster autoscaler's AWS Cloudprovider Readme](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#iam-policy) and switch to the tag of the cluster autoscaler image you are using. + +### AWS - IAM Roles for Service Accounts (IRSA) + +For Kubernetes clusters that use Amazon EKS, the service account can be configured with an IAM role using [IAM Roles for Service Accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) to avoid needing to grant access to the worker nodes for AWS resources. + +In order to accomplish this, you will first need to create a new IAM role with the above mentions policies. Take care in [configuring the trust relationship](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-technical-overview.html#iam-role-configuration) to restrict access just to the service account used by cluster autoscaler. + +Once you have the IAM role configured, you would then need to `--set rbac.serviceAccount.annotations."eks\.amazonaws\.com/role-arn"=arn:aws:iam::123456789012:role/MyRoleName` when installing. + +### Azure - Using azure workload identity + +You can use the project [Azure workload identity](https://github.com/Azure/azure-workload-identity), to automatically configure the correct setup for your pods to used federated identity with Azure. + +You can also set the correct settings yourself instead of relying on this project. + +For example the following configuration will configure the Autoscaler to use your federated identity: + +```yaml +azureUseWorkloadIdentityExtension: true +extraEnv: + AZURE_CLIENT_ID: USER ASSIGNED IDENTITY CLIENT ID + AZURE_TENANT_ID: USER ASSIGNED IDENTITY TENANT ID + AZURE_FEDERATED_TOKEN_FILE: /var/run/secrets/tokens/azure-identity-token + AZURE_AUTHORITY_HOST: https://login.microsoftonline.com/ +extraVolumes: +- name: azure-identity-token + projected: + defaultMode: 420 + sources: + - serviceAccountToken: + audience: api://AzureADTokenExchange + expirationSeconds: 3600 + path: azure-identity-token +extraVolumeMounts: +- mountPath: /var/run/secrets/tokens + name: azure-identity-token + readOnly: true +``` + +### Custom arguments + +You can use the `customArgs` value to give any argument to cluster autoscaler command. + +Typical use case is to give an environment variable as an argument which will be interpolated at execution time. + +This is helpful when you need to inject values from configmap or secret. + +## Troubleshooting + +The chart will succeed even if the container arguments are incorrect. A few minutes after starting `kubectl logs -l "app=aws-cluster-autoscaler" --tail=50` should loop through something like + +``` +polling_autoscaler.go:111] Poll finished +static_autoscaler.go:97] Starting main loop +utils.go:435] No pod using affinity / antiaffinity found in cluster, disabling affinity predicate for this loop +static_autoscaler.go:230] Filtering out schedulables +``` + +If not, find a pod that the deployment created and `describe` it, paying close attention to the arguments under `Command`. e.g.: + +``` +Containers: + cluster-autoscaler: + Command: + ./cluster-autoscaler + --cloud-provider=aws +# if specifying ASGs manually + --nodes=1:10:your-scaling-group-name +# if using autodiscovery + --node-group-auto-discovery=asg:tag=k8s.io/cluster-autoscaler/enabled,k8s.io/cluster-autoscaler/ + --v=4 +``` + +### PodSecurityPolicy + +Though enough for the majority of installations, the default PodSecurityPolicy _could_ be too restrictive depending on the specifics of your release. Please make sure to check that the template fits with any customizations made or disable it by setting `rbac.pspEnabled` to `false`. + +### VerticalPodAutoscaler + +The CA Helm Chart can install a [`VerticalPodAutoscaler`](https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/README.md) object from Chart version `9.27.0` +onwards for the Cluster Autoscaler Deployment to scale the CA as appropriate, but for that, we +need to install the VPA to the cluster separately. A VPA can help minimize wasted resources +when usage spikes periodically or remediate containers that are being OOMKilled. + +The following example snippet can be used to install VPA that allows scaling down from the default recommendations of the deployment template: + +```yaml +vpa: + enabled: true + containerPolicy: + minAllowed: + cpu: 20m + memory: 50Mi +``` + +{{ template "chart.valuesSection" . }} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/NOTES.txt b/charts/devtron-utilities/charts/cluster-autoscaler/templates/NOTES.txt new file mode 100644 index 000000000..1a87a3d10 --- /dev/null +++ b/charts/devtron-utilities/charts/cluster-autoscaler/templates/NOTES.txt @@ -0,0 +1,18 @@ +{{- if or ( or .Values.autoDiscovery.clusterName .Values.autoDiscovery.namespace .Values.autoDiscovery.labels ) .Values.autoscalingGroups }} + +To verify that cluster-autoscaler has started, run: + + kubectl --namespace={{ .Release.Namespace }} get pods -l "app.kubernetes.io/name={{ template "cluster-autoscaler.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" + +{{- else -}} + +############################################################################## +#### ERROR: You must specify values for either #### +#### autoDiscovery or autoscalingGroups[] #### +############################################################################## + +The deployment and pod will not be created and the installation is not functional +See README: + open https://github.com/kubernetes/autoscaler/tree/master/charts/cluster-autoscaler + +{{- end -}} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/_helpers.tpl b/charts/devtron-utilities/charts/cluster-autoscaler/templates/_helpers.tpl new file mode 100644 index 000000000..c7e80f4d8 --- /dev/null +++ b/charts/devtron-utilities/charts/cluster-autoscaler/templates/_helpers.tpl @@ -0,0 +1,160 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "cluster-autoscaler.name" -}} +{{- default (printf "%s-%s" .Values.cloudProvider .Chart.Name) .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "cluster-autoscaler.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default (printf "%s-%s" .Values.cloudProvider .Chart.Name) .Values.nameOverride -}} +{{- if ne $name .Release.Name -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s" $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "cluster-autoscaler.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Return instance and name labels. +*/}} +{{- define "cluster-autoscaler.instance-name" -}} +app.kubernetes.io/instance: {{ .Release.Name | quote }} +app.kubernetes.io/name: {{ include "cluster-autoscaler.name" . | quote }} +{{- end -}} + + +{{/* +Return labels, including instance and name. +*/}} +{{- define "cluster-autoscaler.labels" -}} +{{ include "cluster-autoscaler.instance-name" . }} +app.kubernetes.io/managed-by: {{ .Release.Service | quote }} +helm.sh/chart: {{ include "cluster-autoscaler.chart" . | quote }} +{{- if .Values.additionalLabels }} +{{ toYaml .Values.additionalLabels }} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for deployment. +*/}} +{{- define "deployment.apiVersion" -}} +{{- $kubeTargetVersion := default .Capabilities.KubeVersion.GitVersion .Values.kubeTargetVersionOverride }} +{{- if semverCompare "<1.9-0" $kubeTargetVersion -}} +{{- print "apps/v1beta2" -}} +{{- else -}} +{{- print "apps/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for podsecuritypolicy. +*/}} +{{- define "podsecuritypolicy.apiVersion" -}} +{{- $kubeTargetVersion := default .Capabilities.KubeVersion.GitVersion .Values.kubeTargetVersionOverride }} +{{- if semverCompare "<1.10-0" $kubeTargetVersion -}} +{{- print "extensions/v1beta1" -}} +{{- else -}} +{{- print "policy/v1beta1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for podDisruptionBudget. +*/}} +{{- define "podDisruptionBudget.apiVersion" -}} +{{- $kubeTargetVersion := default .Capabilities.KubeVersion.GitVersion .Values.kubeTargetVersionOverride }} +{{- if semverCompare "<1.21-0" $kubeTargetVersion -}} +{{- print "policy/v1beta1" -}} +{{- else -}} +{{- print "policy/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the service account name used by the pod. +*/}} +{{- define "cluster-autoscaler.serviceAccountName" -}} +{{- if .Values.rbac.serviceAccount.create -}} + {{ default (include "cluster-autoscaler.fullname" .) .Values.rbac.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.rbac.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Return true if the priority expander is enabled +*/}} +{{- define "cluster-autoscaler.priorityExpanderEnabled" -}} +{{- $expanders := splitList "," (default "" .Values.extraArgs.expander) -}} +{{- if has "priority" $expanders -}} +{{- true -}} +{{- end -}} +{{- end -}} + +{{/* +autoDiscovery.clusterName for clusterapi. +*/}} +{{- define "cluster-autoscaler.capiAutodiscovery.clusterName" -}} +{{- print "clusterName=" -}}{{ tpl (.Values.autoDiscovery.clusterName) . }} +{{- end -}} + +{{/* +autoDiscovery.namespace for clusterapi. +*/}} +{{- define "cluster-autoscaler.capiAutodiscovery.namespace" -}} +{{- print "namespace=" }}{{ .Values.autoDiscovery.namespace -}} +{{- end -}} + +{{/* +autoDiscovery.labels for clusterapi. +*/}} +{{- define "cluster-autoscaler.capiAutodiscovery.labels" -}} +{{- range $i, $el := .Values.autoDiscovery.labels -}} +{{- if $i -}}{{- print "," -}}{{- end -}} +{{- range $key, $val := $el -}} +{{- $key -}}{{- print "=" -}}{{- $val -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Return the autodiscoveryparameters for clusterapi. +*/}} +{{- define "cluster-autoscaler.capiAutodiscoveryConfig" -}} +{{- if .Values.autoDiscovery.clusterName -}} +{{ include "cluster-autoscaler.capiAutodiscovery.clusterName" . }} + {{- if .Values.autoDiscovery.namespace }} + {{- print "," -}} + {{ include "cluster-autoscaler.capiAutodiscovery.namespace" . }} + {{- end -}} + {{- if .Values.autoDiscovery.labels }} + {{- print "," -}} + {{ include "cluster-autoscaler.capiAutodiscovery.labels" . }} + {{- end -}} +{{- else if .Values.autoDiscovery.namespace -}} +{{ include "cluster-autoscaler.capiAutodiscovery.namespace" . }} + {{- if .Values.autoDiscovery.labels }} + {{- print "," -}} + {{ include "cluster-autoscaler.capiAutodiscovery.labels" . }} + {{- end -}} +{{- else if .Values.autoDiscovery.labels -}} + {{ include "cluster-autoscaler.capiAutodiscovery.labels" . }} +{{- end -}} +{{- end -}} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/clusterrole.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/clusterrole.yaml new file mode 100644 index 000000000..356b9c08d --- /dev/null +++ b/charts/devtron-utilities/charts/cluster-autoscaler/templates/clusterrole.yaml @@ -0,0 +1,175 @@ +{{- if and .Values.rbac.create .Values.rbac.clusterScoped -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: +{{ include "cluster-autoscaler.labels" . | indent 4 }} + name: {{ template "cluster-autoscaler.fullname" . }} +rules: + - apiGroups: + - "" + resources: + - events + - endpoints + verbs: + - create + - patch + - apiGroups: + - "" + resources: + - pods/eviction + verbs: + - create + - apiGroups: + - "" + resources: + - pods/status + verbs: + - update + - apiGroups: + - "" + resources: + - endpoints + resourceNames: + - cluster-autoscaler + verbs: + - get + - update + - apiGroups: + - "" + resources: + - nodes + verbs: + - watch + - list + - create + - delete + - get + - update + - apiGroups: + - "" + resources: + - namespaces + - pods + - services + - replicationcontrollers + - persistentvolumeclaims + - persistentvolumes + verbs: + - watch + - list + - get + - apiGroups: + - batch + resources: + - jobs + - cronjobs + verbs: + - watch + - list + - get + - apiGroups: + - batch + - extensions + resources: + - jobs + verbs: + - get + - list + - patch + - watch + - apiGroups: + - extensions + resources: + - replicasets + - daemonsets + verbs: + - watch + - list + - get + - apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - watch + - list + - apiGroups: + - apps + resources: + - daemonsets + - replicasets + - statefulsets + verbs: + - watch + - list + - get + - apiGroups: + - storage.k8s.io + resources: + - storageclasses + - csinodes + - csidrivers + - csistoragecapacities + verbs: + - watch + - list + - get + - apiGroups: + - "" + resources: + - configmaps + verbs: + - list + - watch + - get + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create + - apiGroups: + - coordination.k8s.io + resourceNames: + - cluster-autoscaler + resources: + - leases + verbs: + - get + - update +{{- if .Values.rbac.pspEnabled }} + - apiGroups: + - extensions + - policy + resources: + - podsecuritypolicies + resourceNames: + - {{ template "cluster-autoscaler.fullname" . }} + verbs: + - use +{{- end -}} +{{- if and ( and ( eq .Values.cloudProvider "clusterapi" ) ( .Values.rbac.clusterScoped ) ( or ( eq .Values.clusterAPIMode "incluster-incluster" ) ( eq .Values.clusterAPIMode "kubeconfig-incluster" ) ))}} + - apiGroups: + - cluster.x-k8s.io + resources: + - machinedeployments + - machinepools + - machines + - machinesets + verbs: + - get + - list + - update + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - machinedeployments/scale + - machinepools/scale + verbs: + - get + - patch + - update +{{- end }} +{{- end -}} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/clusterrolebinding.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/clusterrolebinding.yaml new file mode 100644 index 000000000..d2384dc62 --- /dev/null +++ b/charts/devtron-utilities/charts/cluster-autoscaler/templates/clusterrolebinding.yaml @@ -0,0 +1,16 @@ +{{- if and .Values.rbac.create .Values.rbac.clusterScoped -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: +{{ include "cluster-autoscaler.labels" . | indent 4 }} + name: {{ template "cluster-autoscaler.fullname" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "cluster-autoscaler.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ template "cluster-autoscaler.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end -}} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/configmap.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/configmap.yaml new file mode 100644 index 000000000..6cd0c4064 --- /dev/null +++ b/charts/devtron-utilities/charts/cluster-autoscaler/templates/configmap.yaml @@ -0,0 +1,416 @@ +{{- if or (eq .Values.cloudProvider "kwok") }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ .Values.kwokConfigMapName | default "kwok-provider-config" }} + namespace: {{ .Release.Namespace }} +data: + config: |- + # if you see '\n' everywhere, remove all the trailing spaces + apiVersion: v1alpha1 + readNodesFrom: configmap # possible values: [cluster,configmap] + nodegroups: + # to specify how to group nodes into a nodegroup + # e.g., you want to treat nodes with same instance type as a nodegroup + # node1: m5.xlarge + # node2: c5.xlarge + # node3: m5.xlarge + # nodegroup1: [node1,node3] + # nodegroup2: [node2] + fromNodeLabelKey: "kwok-nodegroup" + # you can either specify fromNodeLabelKey OR fromNodeAnnotation + # (both are not allowed) + # fromNodeAnnotation: "eks.amazonaws.com/nodegroup" + nodes: + # gpuConfig: + # # to tell kwok provider what label should be considered as GPU label + # gpuLabelKey: "k8s.amazonaws.com/accelerator" + # availableGPUTypes: + # "nvidia-tesla-k80": {} + # "nvidia-tesla-p100": {} + configmap: + name: kwok-provider-templates + kwok: {} # default: fetch latest release of kwok from github and install it + # # you can also manually specify which kwok release you want to install + # # for example: + # kwok: + # release: v0.3.0 + # # you can also disable installing kwok in CA code (and install your own kwok release) + # kwok: + # install: false (true if not specified) +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: kwok-provider-templates + namespace: {{ .Release.Namespace }} +data: + templates: |- + # if you see '\n' everywhere, remove all the trailing spaces + apiVersion: v1 + items: + - apiVersion: v1 + kind: Node + metadata: + annotations: + kubeadm.alpha.kubernetes.io/cri-socket: unix:///run/containerd/containerd.sock + node.alpha.kubernetes.io/ttl: "0" + volumes.kubernetes.io/controller-managed-attach-detach: "true" + creationTimestamp: "2023-05-31T04:39:16Z" + labels: + beta.kubernetes.io/arch: amd64 + beta.kubernetes.io/os: linux + kubernetes.io/arch: amd64 + kubernetes.io/hostname: kind-control-plane + kwok-nodegroup: control-plane + kubernetes.io/os: linux + node-role.kubernetes.io/control-plane: "" + node.kubernetes.io/exclude-from-external-load-balancers: "" + name: kind-control-plane + resourceVersion: "506" + uid: 86716ec7-3071-4091-b055-77b4361d1dca + spec: + podCIDR: 10.244.0.0/24 + podCIDRs: + - 10.244.0.0/24 + providerID: kind://docker/kind/kind-control-plane + taints: + - effect: NoSchedule + key: node-role.kubernetes.io/control-plane + status: + addresses: + - address: 172.18.0.2 + type: InternalIP + - address: kind-control-plane + type: Hostname + allocatable: + cpu: "12" + ephemeral-storage: 959786032Ki + hugepages-1Gi: "0" + hugepages-2Mi: "0" + memory: 32781516Ki + pods: "110" + capacity: + cpu: "12" + ephemeral-storage: 959786032Ki + hugepages-1Gi: "0" + hugepages-2Mi: "0" + memory: 32781516Ki + pods: "110" + conditions: + - lastHeartbeatTime: "2023-05-31T04:39:58Z" + lastTransitionTime: "2023-05-31T04:39:13Z" + message: kubelet has sufficient memory available + reason: KubeletHasSufficientMemory + status: "False" + type: MemoryPressure + - lastHeartbeatTime: "2023-05-31T04:39:58Z" + lastTransitionTime: "2023-05-31T04:39:13Z" + message: kubelet has no disk pressure + reason: KubeletHasNoDiskPressure + status: "False" + type: DiskPressure + - lastHeartbeatTime: "2023-05-31T04:39:58Z" + lastTransitionTime: "2023-05-31T04:39:13Z" + message: kubelet has sufficient PID available + reason: KubeletHasSufficientPID + status: "False" + type: PIDPressure + - lastHeartbeatTime: "2023-05-31T04:39:58Z" + lastTransitionTime: "2023-05-31T04:39:46Z" + message: kubelet is posting ready status + reason: KubeletReady + status: "True" + type: Ready + daemonEndpoints: + kubeletEndpoint: + Port: 10250 + images: + - names: + - registry.k8s.io/etcd:3.5.6-0 + sizeBytes: 102542580 + - names: + - docker.io/library/import-2023-03-30@sha256:ba097b515c8c40689733c0f19de377e9bf8995964b7d7150c2045f3dfd166657 + - registry.k8s.io/kube-apiserver:v1.26.3 + sizeBytes: 80392681 + - names: + - docker.io/library/import-2023-03-30@sha256:8dbb345de79d1c44f59a7895da702a5f71997ae72aea056609445c397b0c10dc + - registry.k8s.io/kube-controller-manager:v1.26.3 + sizeBytes: 68538487 + - names: + - docker.io/library/import-2023-03-30@sha256:44db4d50a5f9c8efbac0d37ea974d1c0419a5928f90748d3d491a041a00c20b5 + - registry.k8s.io/kube-proxy:v1.26.3 + sizeBytes: 67217404 + - names: + - docker.io/library/import-2023-03-30@sha256:3dd2337f70af979c7362b5e52bbdfcb3a5fd39c78d94d02145150cd2db86ba39 + - registry.k8s.io/kube-scheduler:v1.26.3 + sizeBytes: 57761399 + - names: + - docker.io/kindest/kindnetd:v20230330-48f316cd@sha256:c19d6362a6a928139820761475a38c24c0cf84d507b9ddf414a078cf627497af + - docker.io/kindest/kindnetd@sha256:c19d6362a6a928139820761475a38c24c0cf84d507b9ddf414a078cf627497af + sizeBytes: 27726335 + - names: + - docker.io/kindest/local-path-provisioner:v0.0.23-kind.0@sha256:f2d0a02831ff3a03cf51343226670d5060623b43a4cfc4808bd0875b2c4b9501 + sizeBytes: 18664669 + - names: + - registry.k8s.io/coredns/coredns:v1.9.3 + sizeBytes: 14837849 + - names: + - docker.io/kindest/local-path-helper:v20230330-48f316cd@sha256:135203f2441f916fb13dad1561d27f60a6f11f50ec288b01a7d2ee9947c36270 + sizeBytes: 3052037 + - names: + - registry.k8s.io/pause:3.7 + sizeBytes: 311278 + nodeInfo: + architecture: amd64 + bootID: 2d71b318-5d07-4de2-9e61-2da28cf5bbf0 + containerRuntimeVersion: containerd://1.6.19-46-g941215f49 + kernelVersion: 5.15.0-72-generic + kubeProxyVersion: v1.26.3 + kubeletVersion: v1.26.3 + machineID: 96f8c8b8c8ae4600a3654341f207586e + operatingSystem: linux + osImage: Ubuntu 22.04.2 LTS + systemUUID: 111aa932-7f99-4bef-aaf7-36aa7fb9b012 + - apiVersion: v1 + kind: Node + metadata: + annotations: + kubeadm.alpha.kubernetes.io/cri-socket: unix:///run/containerd/containerd.sock + node.alpha.kubernetes.io/ttl: "0" + volumes.kubernetes.io/controller-managed-attach-detach: "true" + creationTimestamp: "2023-05-31T04:39:57Z" + labels: + beta.kubernetes.io/arch: amd64 + beta.kubernetes.io/os: linux + kubernetes.io/arch: amd64 + kubernetes.io/hostname: kind-worker + kwok-nodegroup: kind-worker + kubernetes.io/os: linux + name: kind-worker + resourceVersion: "577" + uid: 2ac0eb71-e5cf-4708-bbbf-476e8f19842b + spec: + podCIDR: 10.244.2.0/24 + podCIDRs: + - 10.244.2.0/24 + providerID: kind://docker/kind/kind-worker + status: + addresses: + - address: 172.18.0.3 + type: InternalIP + - address: kind-worker + type: Hostname + allocatable: + cpu: "12" + ephemeral-storage: 959786032Ki + hugepages-1Gi: "0" + hugepages-2Mi: "0" + memory: 32781516Ki + pods: "110" + capacity: + cpu: "12" + ephemeral-storage: 959786032Ki + hugepages-1Gi: "0" + hugepages-2Mi: "0" + memory: 32781516Ki + pods: "110" + conditions: + - lastHeartbeatTime: "2023-05-31T04:40:17Z" + lastTransitionTime: "2023-05-31T04:39:57Z" + message: kubelet has sufficient memory available + reason: KubeletHasSufficientMemory + status: "False" + type: MemoryPressure + - lastHeartbeatTime: "2023-05-31T04:40:17Z" + lastTransitionTime: "2023-05-31T04:39:57Z" + message: kubelet has no disk pressure + reason: KubeletHasNoDiskPressure + status: "False" + type: DiskPressure + - lastHeartbeatTime: "2023-05-31T04:40:17Z" + lastTransitionTime: "2023-05-31T04:39:57Z" + message: kubelet has sufficient PID available + reason: KubeletHasSufficientPID + status: "False" + type: PIDPressure + - lastHeartbeatTime: "2023-05-31T04:40:17Z" + lastTransitionTime: "2023-05-31T04:40:05Z" + message: kubelet is posting ready status + reason: KubeletReady + status: "True" + type: Ready + daemonEndpoints: + kubeletEndpoint: + Port: 10250 + images: + - names: + - registry.k8s.io/etcd:3.5.6-0 + sizeBytes: 102542580 + - names: + - docker.io/library/import-2023-03-30@sha256:ba097b515c8c40689733c0f19de377e9bf8995964b7d7150c2045f3dfd166657 + - registry.k8s.io/kube-apiserver:v1.26.3 + sizeBytes: 80392681 + - names: + - docker.io/library/import-2023-03-30@sha256:8dbb345de79d1c44f59a7895da702a5f71997ae72aea056609445c397b0c10dc + - registry.k8s.io/kube-controller-manager:v1.26.3 + sizeBytes: 68538487 + - names: + - docker.io/library/import-2023-03-30@sha256:44db4d50a5f9c8efbac0d37ea974d1c0419a5928f90748d3d491a041a00c20b5 + - registry.k8s.io/kube-proxy:v1.26.3 + sizeBytes: 67217404 + - names: + - docker.io/library/import-2023-03-30@sha256:3dd2337f70af979c7362b5e52bbdfcb3a5fd39c78d94d02145150cd2db86ba39 + - registry.k8s.io/kube-scheduler:v1.26.3 + sizeBytes: 57761399 + - names: + - docker.io/kindest/kindnetd:v20230330-48f316cd@sha256:c19d6362a6a928139820761475a38c24c0cf84d507b9ddf414a078cf627497af + - docker.io/kindest/kindnetd@sha256:c19d6362a6a928139820761475a38c24c0cf84d507b9ddf414a078cf627497af + sizeBytes: 27726335 + - names: + - docker.io/kindest/local-path-provisioner:v0.0.23-kind.0@sha256:f2d0a02831ff3a03cf51343226670d5060623b43a4cfc4808bd0875b2c4b9501 + sizeBytes: 18664669 + - names: + - registry.k8s.io/coredns/coredns:v1.9.3 + sizeBytes: 14837849 + - names: + - docker.io/kindest/local-path-helper:v20230330-48f316cd@sha256:135203f2441f916fb13dad1561d27f60a6f11f50ec288b01a7d2ee9947c36270 + sizeBytes: 3052037 + - names: + - registry.k8s.io/pause:3.7 + sizeBytes: 311278 + nodeInfo: + architecture: amd64 + bootID: 2d71b318-5d07-4de2-9e61-2da28cf5bbf0 + containerRuntimeVersion: containerd://1.6.19-46-g941215f49 + kernelVersion: 5.15.0-72-generic + kubeProxyVersion: v1.26.3 + kubeletVersion: v1.26.3 + machineID: a98a13ff474d476294935341f1ba9816 + operatingSystem: linux + osImage: Ubuntu 22.04.2 LTS + systemUUID: 5f3c1af8-a385-4776-85e4-73d7f4252b44 + - apiVersion: v1 + kind: Node + metadata: + annotations: + kubeadm.alpha.kubernetes.io/cri-socket: unix:///run/containerd/containerd.sock + node.alpha.kubernetes.io/ttl: "0" + volumes.kubernetes.io/controller-managed-attach-detach: "true" + creationTimestamp: "2023-05-31T04:39:57Z" + labels: + beta.kubernetes.io/arch: amd64 + beta.kubernetes.io/os: linux + kubernetes.io/arch: amd64 + kubernetes.io/hostname: kind-worker2 + kwok-nodegroup: kind-worker2 + kubernetes.io/os: linux + name: kind-worker2 + resourceVersion: "578" + uid: edc7df38-feb2-4089-9955-780562bdd21e + spec: + podCIDR: 10.244.1.0/24 + podCIDRs: + - 10.244.1.0/24 + providerID: kind://docker/kind/kind-worker2 + status: + addresses: + - address: 172.18.0.4 + type: InternalIP + - address: kind-worker2 + type: Hostname + allocatable: + cpu: "12" + ephemeral-storage: 959786032Ki + hugepages-1Gi: "0" + hugepages-2Mi: "0" + memory: 32781516Ki + pods: "110" + capacity: + cpu: "12" + ephemeral-storage: 959786032Ki + hugepages-1Gi: "0" + hugepages-2Mi: "0" + memory: 32781516Ki + pods: "110" + conditions: + - lastHeartbeatTime: "2023-05-31T04:40:17Z" + lastTransitionTime: "2023-05-31T04:39:57Z" + message: kubelet has sufficient memory available + reason: KubeletHasSufficientMemory + status: "False" + type: MemoryPressure + - lastHeartbeatTime: "2023-05-31T04:40:17Z" + lastTransitionTime: "2023-05-31T04:39:57Z" + message: kubelet has no disk pressure + reason: KubeletHasNoDiskPressure + status: "False" + type: DiskPressure + - lastHeartbeatTime: "2023-05-31T04:40:17Z" + lastTransitionTime: "2023-05-31T04:39:57Z" + message: kubelet has sufficient PID available + reason: KubeletHasSufficientPID + status: "False" + type: PIDPressure + - lastHeartbeatTime: "2023-05-31T04:40:17Z" + lastTransitionTime: "2023-05-31T04:40:08Z" + message: kubelet is posting ready status + reason: KubeletReady + status: "True" + type: Ready + daemonEndpoints: + kubeletEndpoint: + Port: 10250 + images: + - names: + - registry.k8s.io/etcd:3.5.6-0 + sizeBytes: 102542580 + - names: + - docker.io/library/import-2023-03-30@sha256:ba097b515c8c40689733c0f19de377e9bf8995964b7d7150c2045f3dfd166657 + - registry.k8s.io/kube-apiserver:v1.26.3 + sizeBytes: 80392681 + - names: + - docker.io/library/import-2023-03-30@sha256:8dbb345de79d1c44f59a7895da702a5f71997ae72aea056609445c397b0c10dc + - registry.k8s.io/kube-controller-manager:v1.26.3 + sizeBytes: 68538487 + - names: + - docker.io/library/import-2023-03-30@sha256:44db4d50a5f9c8efbac0d37ea974d1c0419a5928f90748d3d491a041a00c20b5 + - registry.k8s.io/kube-proxy:v1.26.3 + sizeBytes: 67217404 + - names: + - docker.io/library/import-2023-03-30@sha256:3dd2337f70af979c7362b5e52bbdfcb3a5fd39c78d94d02145150cd2db86ba39 + - registry.k8s.io/kube-scheduler:v1.26.3 + sizeBytes: 57761399 + - names: + - docker.io/kindest/kindnetd:v20230330-48f316cd@sha256:c19d6362a6a928139820761475a38c24c0cf84d507b9ddf414a078cf627497af + - docker.io/kindest/kindnetd@sha256:c19d6362a6a928139820761475a38c24c0cf84d507b9ddf414a078cf627497af + sizeBytes: 27726335 + - names: + - docker.io/kindest/local-path-provisioner:v0.0.23-kind.0@sha256:f2d0a02831ff3a03cf51343226670d5060623b43a4cfc4808bd0875b2c4b9501 + sizeBytes: 18664669 + - names: + - registry.k8s.io/coredns/coredns:v1.9.3 + sizeBytes: 14837849 + - names: + - docker.io/kindest/local-path-helper:v20230330-48f316cd@sha256:135203f2441f916fb13dad1561d27f60a6f11f50ec288b01a7d2ee9947c36270 + sizeBytes: 3052037 + - names: + - registry.k8s.io/pause:3.7 + sizeBytes: 311278 + nodeInfo: + architecture: amd64 + bootID: 2d71b318-5d07-4de2-9e61-2da28cf5bbf0 + containerRuntimeVersion: containerd://1.6.19-46-g941215f49 + kernelVersion: 5.15.0-72-generic + kubeProxyVersion: v1.26.3 + kubeletVersion: v1.26.3 + machineID: fa9f4cd3b3a743bc867b04e44941dcb2 + operatingSystem: linux + osImage: Ubuntu 22.04.2 LTS + systemUUID: f36c0f00-8ba5-4c8c-88bc-2981c8d377b9 + kind: List + metadata: + resourceVersion: "" + + +{{- end }} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/deployment.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/deployment.yaml new file mode 100644 index 000000000..41297c8c4 --- /dev/null +++ b/charts/devtron-utilities/charts/cluster-autoscaler/templates/deployment.yaml @@ -0,0 +1,367 @@ +{{- if or ( or .Values.autoDiscovery.clusterName .Values.autoDiscovery.namespace .Values.autoDiscovery.labels ) .Values.autoscalingGroups }} +{{/* one of the above is required */}} +apiVersion: {{ template "deployment.apiVersion" . }} +kind: Deployment +metadata: + annotations: +{{ toYaml .Values.deployment.annotations | indent 4 }} + labels: +{{ include "cluster-autoscaler.labels" . | indent 4 }} + name: {{ template "cluster-autoscaler.fullname" . }} + namespace: {{ .Release.Namespace }} +spec: + replicas: {{ .Values.replicaCount }} + revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} + selector: + matchLabels: +{{ include "cluster-autoscaler.instance-name" . | indent 6 }} + {{- if .Values.podLabels }} +{{ toYaml .Values.podLabels | indent 6 }} + {{- end }} +{{- if .Values.updateStrategy }} + strategy: + {{ toYaml .Values.updateStrategy | nindent 4 | trim }} +{{- end }} + template: + metadata: + {{- if .Values.podAnnotations }} + annotations: +{{ toYaml .Values.podAnnotations | indent 8 }} + {{- end }} + labels: +{{ include "cluster-autoscaler.instance-name" . | indent 8 }} + {{- if .Values.additionalLabels }} +{{ toYaml .Values.additionalLabels | indent 8 }} + {{- end }} + {{- if .Values.podLabels }} +{{ toYaml .Values.podLabels | indent 8 }} + {{- end }} + spec: + {{- if .Values.priorityClassName }} + priorityClassName: "{{ .Values.priorityClassName }}" + {{- end }} + {{- if .Values.dnsPolicy }} + dnsPolicy: "{{ .Values.dnsPolicy }}" + {{- end }} + {{- if .Values.hostNetwork }} + hostNetwork: {{ .Values.hostNetwork }} + {{- end }} + {{- with .Values.initContainers }} + initContainers: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: {{ template "cluster-autoscaler.name" . }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: "{{ .Values.image.pullPolicy }}" + command: + - ./cluster-autoscaler + - --cloud-provider={{ .Values.cloudProvider }} + {{- if and (eq .Values.cloudProvider "clusterapi") (eq .Values.clusterAPIMode "kubeconfig-incluster") }} + - --namespace={{ .Values.clusterAPIConfigMapsNamespace | default "kube-system" }} + {{- else }} + - --namespace={{ .Release.Namespace }} + {{- end }} + {{- if .Values.autoscalingGroups }} + {{- range .Values.autoscalingGroups }} + {{- if eq $.Values.cloudProvider "hetzner" }} + - --nodes={{ .minSize }}:{{ .maxSize }}:{{ .instanceType }}:{{ .region }}:{{ .name }} + {{- else }} + - --nodes={{ .minSize }}:{{ .maxSize }}:{{ .name }} + {{- end }} + {{- end }} + {{- end }} + {{- if eq .Values.cloudProvider "rancher" }} + {{- if .Values.cloudConfigPath }} + - --cloud-config={{ .Values.cloudConfigPath }} + {{- end }} + {{- end }} + {{- if eq .Values.cloudProvider "aws" }} + {{- if .Values.autoDiscovery.clusterName }} + - --node-group-auto-discovery=asg:tag={{ tpl (join "," .Values.autoDiscovery.tags) . }} + {{- end }} + {{- if .Values.cloudConfigPath }} + - --cloud-config={{ .Values.cloudConfigPath }} + {{- end }} + {{- else if eq .Values.cloudProvider "gce" }} + {{- if .Values.autoscalingGroupsnamePrefix }} + {{- range .Values.autoscalingGroupsnamePrefix }} + - --node-group-auto-discovery=mig:namePrefix={{ .name }},min={{ .minSize }},max={{ .maxSize }} + {{- end }} + {{- end }} + {{- if eq .Values.cloudProvider "oci" }} + {{- if .Values.cloudConfigPath }} + - --nodes={{ .minSize }}:{{ .maxSize }}:{{ .name }} + - --balance-similar-node-groups + {{- end }} + {{- end }} + {{- else if eq .Values.cloudProvider "magnum" }} + {{- if .Values.autoDiscovery.clusterName }} + - --cluster-name={{ tpl (.Values.autoDiscovery.clusterName) . }} + - --node-group-auto-discovery=magnum:role={{ tpl (join "," .Values.autoDiscovery.roles) . }} + {{- else }} + - --cluster-name={{ tpl (.Values.magnumClusterName) . }} + {{- end }} + {{- else if eq .Values.cloudProvider "clusterapi" }} + {{- if or .Values.autoDiscovery.clusterName .Values.autoDiscovery.labels .Values.autoDiscovery.namespace }} + - --node-group-auto-discovery=clusterapi:{{ template "cluster-autoscaler.capiAutodiscoveryConfig" . }} + {{- end }} + {{- if eq .Values.clusterAPIMode "incluster-kubeconfig"}} + - --cloud-config={{ .Values.clusterAPICloudConfigPath }} + {{- else if eq .Values.clusterAPIMode "kubeconfig-incluster"}} + - --kubeconfig={{ .Values.clusterAPIWorkloadKubeconfigPath }} + - --clusterapi-cloud-config-authoritative + {{- else if eq .Values.clusterAPIMode "kubeconfig-kubeconfig"}} + - --kubeconfig={{ .Values.clusterAPIWorkloadKubeconfigPath }} + - --cloud-config={{ .Values.clusterAPICloudConfigPath }} + {{- else if eq .Values.clusterAPIMode "single-kubeconfig"}} + - --kubeconfig={{ .Values.clusterAPIWorkloadKubeconfigPath }} + {{- end }} + {{- else if eq .Values.cloudProvider "azure" }} + {{- if .Values.autoDiscovery.clusterName }} + - --node-group-auto-discovery=label:cluster-autoscaler-enabled=true,cluster-autoscaler-name={{ tpl (.Values.autoDiscovery.clusterName) . }} + {{- end }} + {{- end }} + {{- if eq .Values.cloudProvider "magnum" }} + - --cloud-config={{ .Values.cloudConfigPath }} + {{- end }} + {{- range $key, $value := .Values.extraArgs }} + {{- if not (kindIs "invalid" $value) }} + - --{{ $key | mustRegexFind "^[^_]+" }}={{ $value }} + {{- else }} + - --{{ $key | mustRegexFind "^[^_]+" }} + {{- end }} + {{- end }} + {{- range .Values.customArgs }} + - {{ . }} + {{- end }} + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: SERVICE_ACCOUNT + valueFrom: + fieldRef: + fieldPath: spec.serviceAccountName + {{- if and (eq .Values.cloudProvider "aws") (ne .Values.awsRegion "") }} + - name: AWS_REGION + value: "{{ .Values.awsRegion }}" + {{- if .Values.awsAccessKeyID }} + - name: AWS_ACCESS_KEY_ID + valueFrom: + secretKeyRef: + key: AwsAccessKeyId + name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} + {{- end }} + {{- if .Values.awsSecretAccessKey }} + - name: AWS_SECRET_ACCESS_KEY + valueFrom: + secretKeyRef: + key: AwsSecretAccessKey + name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} + {{- end }} + {{- else if eq .Values.cloudProvider "azure" }} + - name: ARM_SUBSCRIPTION_ID + valueFrom: + secretKeyRef: + key: SubscriptionID + name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} + - name: ARM_RESOURCE_GROUP + valueFrom: + secretKeyRef: + key: ResourceGroup + name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} + - name: ARM_VM_TYPE + valueFrom: + secretKeyRef: + key: VMType + name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} + - name: AZURE_ENABLE_FORCE_DELETE + value: "{{ .Values.azureEnableForceDelete }}" + {{- if .Values.azureUseWorkloadIdentityExtension }} + - name: ARM_USE_WORKLOAD_IDENTITY_EXTENSION + value: "true" + {{- else if .Values.azureUseManagedIdentityExtension }} + - name: ARM_USE_MANAGED_IDENTITY_EXTENSION + value: "true" + {{- else }} + - name: ARM_TENANT_ID + valueFrom: + secretKeyRef: + key: TenantID + name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} + - name: ARM_CLIENT_ID + valueFrom: + secretKeyRef: + key: ClientID + name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} + - name: ARM_CLIENT_SECRET + valueFrom: + secretKeyRef: + key: ClientSecret + name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} + {{- end }} + {{- else if eq .Values.cloudProvider "exoscale" }} + - name: EXOSCALE_API_KEY + valueFrom: + secretKeyRef: + key: api-key + name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} + - name: EXOSCALE_API_SECRET + valueFrom: + secretKeyRef: + key: api-secret + name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} + - name: EXOSCALE_ZONE + valueFrom: + secretKeyRef: + key: api-zone + name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} + {{- else if eq .Values.cloudProvider "kwok" }} + - name: KWOK_PROVIDER_CONFIGMAP + value: "{{.Values.kwokConfigMapName | default "kwok-provider-config"}}" + {{- else if eq .Values.cloudProvider "civo" }} + - name: CIVO_API_URL + valueFrom: + secretKeyRef: + key: api-url + name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} + - name: CIVO_API_KEY + valueFrom: + secretKeyRef: + key: api-key + name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} + - name: CIVO_CLUSTER_ID + valueFrom: + secretKeyRef: + key: cluster-id + name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} + - name: CIVO_REGION + valueFrom: + secretKeyRef: + key: region + name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} + {{- end }} + {{- range $key, $value := .Values.extraEnv }} + - name: {{ $key }} + value: "{{ $value }}" + {{- end }} + {{- range $key, $value := .Values.extraEnvConfigMaps }} + - name: {{ $key }} + valueFrom: + configMapKeyRef: + name: {{ default (include "cluster-autoscaler.fullname" $) $value.name }} + key: {{ required "Must specify key!" $value.key }} + {{- end }} + {{- range $key, $value := .Values.extraEnvSecrets }} + - name: {{ $key }} + valueFrom: + secretKeyRef: + name: {{ default (include "cluster-autoscaler.fullname" $) $value.name }} + key: {{ required "Must specify key!" $value.key }} + {{- end }} + {{- if or .Values.envFromSecret .Values.envFromConfigMap }} + envFrom: + {{- if .Values.envFromSecret }} + - secretRef: + name: {{ .Values.envFromSecret }} + {{- end }} + {{- if .Values.envFromConfigMap }} + - configMapRef: + name: {{ .Values.envFromConfigMap }} + {{- end }} + {{- end }} + livenessProbe: + httpGet: + path: /health-check + port: 8085 + ports: + - containerPort: 8085 + resources: +{{ toYaml .Values.resources | indent 12 }} + {{- if .Values.containerSecurityContext }} + securityContext: + {{ toYaml .Values.containerSecurityContext | nindent 12 | trim }} + {{- end }} + {{- if or (eq .Values.cloudProvider "magnum") .Values.extraVolumeSecrets .Values.extraVolumeMounts .Values.clusterAPIKubeconfigSecret }} + volumeMounts: + {{- if eq .Values.cloudProvider "magnum" }} + - name: cloudconfig + mountPath: {{ .Values.cloudConfigPath }} + readOnly: true + {{- end }} + {{- if and (eq .Values.cloudProvider "magnum") (.Values.magnumCABundlePath) }} + - name: ca-bundle + mountPath: {{ .Values.magnumCABundlePath }} + readOnly: true + {{- end }} + {{- range $key, $value := .Values.extraVolumeSecrets }} + - name: {{ $key }} + mountPath: {{ required "Must specify mountPath!" $value.mountPath }} + readOnly: true + {{- end }} + {{- if .Values.clusterAPIKubeconfigSecret }} + - name: cluster-api-kubeconfig + mountPath: {{ .Values.clusterAPIWorkloadKubeconfigPath | trimSuffix "/value" }} + {{- end }} + {{- if .Values.extraVolumeMounts }} + {{- toYaml .Values.extraVolumeMounts | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.affinity }} + affinity: +{{ toYaml .Values.affinity | indent 8 }} + {{- end }} + {{- if .Values.nodeSelector }} + nodeSelector: +{{ toYaml .Values.nodeSelector | indent 8 }} + {{- end }} + serviceAccountName: {{ template "cluster-autoscaler.serviceAccountName" . }} + tolerations: +{{ toYaml .Values.tolerations | indent 8 }} + {{- if .Values.topologySpreadConstraints }} + topologySpreadConstraints: +{{ toYaml .Values.topologySpreadConstraints | indent 8 }} + {{- end }} + {{- if .Values.securityContext }} + securityContext: + {{ toYaml .Values.securityContext | nindent 8 | trim }} + {{- end }} + {{- if or (eq .Values.cloudProvider "magnum") .Values.extraVolumeSecrets .Values.extraVolumes .Values.clusterAPIKubeconfigSecret }} + volumes: + {{- if eq .Values.cloudProvider "magnum" }} + - name: cloudconfig + hostPath: + path: {{ .Values.cloudConfigPath }} + {{- end }} + {{- if and (eq .Values.cloudProvider "magnum") (.Values.magnumCABundlePath) }} + - name: ca-bundle + hostPath: + path: {{ .Values.magnumCABundlePath }} + {{- end }} + {{- range $key, $value := .Values.extraVolumeSecrets }} + - name: {{ $key }} + secret: + secretName: {{ default (include "cluster-autoscaler.fullname" $) $value.name }} + {{- if $value.items }} + items: + {{- toYaml $value.items | nindent 14 }} + {{- end }} + {{- end }} + {{- if .Values.extraVolumes }} + {{- toYaml .Values.extraVolumes | nindent 8 }} + {{- end }} + {{- if .Values.clusterAPIKubeconfigSecret }} + - name: cluster-api-kubeconfig + secret: + secretName: {{ .Values.clusterAPIKubeconfigSecret }} + {{- end }} + {{- end }} + {{- if .Values.image.pullSecrets }} + imagePullSecrets: + {{- range .Values.image.pullSecrets }} + - name: {{ . }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/extra-manifests.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/extra-manifests.yaml new file mode 100644 index 000000000..a9bb3b6ba --- /dev/null +++ b/charts/devtron-utilities/charts/cluster-autoscaler/templates/extra-manifests.yaml @@ -0,0 +1,4 @@ +{{ range .Values.extraObjects }} +--- +{{ tpl (toYaml .) $ }} +{{ end }} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/pdb.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/pdb.yaml new file mode 100644 index 000000000..8ad782096 --- /dev/null +++ b/charts/devtron-utilities/charts/cluster-autoscaler/templates/pdb.yaml @@ -0,0 +1,16 @@ +{{- if .Values.podDisruptionBudget -}} +apiVersion: {{ template "podDisruptionBudget.apiVersion" . }} +kind: PodDisruptionBudget +metadata: + labels: +{{ include "cluster-autoscaler.labels" . | indent 4 }} + name: {{ template "cluster-autoscaler.fullname" . }} + namespace: {{ .Release.Namespace }} +spec: + selector: + matchLabels: +{{ include "cluster-autoscaler.instance-name" . | indent 6 }} +{{- if .Values.podDisruptionBudget }} + {{ toYaml .Values.podDisruptionBudget | nindent 2 }} +{{- end }} +{{- end -}} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/podsecuritypolicy.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/podsecuritypolicy.yaml new file mode 100644 index 000000000..e3ce59973 --- /dev/null +++ b/charts/devtron-utilities/charts/cluster-autoscaler/templates/podsecuritypolicy.yaml @@ -0,0 +1,42 @@ +{{- if .Values.rbac.pspEnabled }} +apiVersion: {{ template "podsecuritypolicy.apiVersion" . }} +kind: PodSecurityPolicy +metadata: + name: {{ template "cluster-autoscaler.fullname" . }} + labels: +{{ include "cluster-autoscaler.labels" . | indent 4 }} +spec: + # Prevents running in privileged mode + privileged: false + # Required to prevent escalations to root. + allowPrivilegeEscalation: false + requiredDropCapabilities: + - ALL + volumes: + - 'configMap' + - 'secret' + - 'hostPath' + - 'emptyDir' + - 'projected' + - 'downwardAPI' + hostNetwork: {{ .Values.hostNetwork }} + hostIPC: false + hostPID: false + runAsUser: + rule: RunAsAny + seLinux: + rule: RunAsAny + supplementalGroups: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + readOnlyRootFilesystem: false +{{- end }} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/priority-expander-configmap.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/priority-expander-configmap.yaml new file mode 100644 index 000000000..8259f14ff --- /dev/null +++ b/charts/devtron-utilities/charts/cluster-autoscaler/templates/priority-expander-configmap.yaml @@ -0,0 +1,25 @@ +{{- if hasKey .Values.extraArgs "expander" }} +{{- if and (.Values.expanderPriorities) (include "cluster-autoscaler.priorityExpanderEnabled" .) -}} +apiVersion: v1 +kind: ConfigMap +metadata: + name: cluster-autoscaler-priority-expander + namespace: {{ .Release.Namespace }} + labels: +{{ include "cluster-autoscaler.labels" . | indent 4 }} + {{- if .Values.priorityConfigMapAnnotations }} + annotations: +{{ toYaml .Values.priorityConfigMapAnnotations | indent 4 }} + {{- end }} +data: + priorities: |- +{{- if kindIs "string" .Values.expanderPriorities }} +{{ .Values.expanderPriorities | indent 4 }} +{{- else }} +{{- range $k,$v := .Values.expanderPriorities }} + {{ $k | int }}: + {{- toYaml $v | nindent 6 }} +{{- end -}} +{{- end -}} +{{- end -}} +{{- end -}} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/prometheusrule.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/prometheusrule.yaml new file mode 100644 index 000000000..097c969ef --- /dev/null +++ b/charts/devtron-utilities/charts/cluster-autoscaler/templates/prometheusrule.yaml @@ -0,0 +1,15 @@ +{{- if .Values.prometheusRule.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule +metadata: + name: {{ include "cluster-autoscaler.fullname" . }} + {{- if .Values.prometheusRule.namespace }} + namespace: {{ .Values.prometheusRule.namespace }} + {{- end }} + labels: {{- toYaml .Values.prometheusRule.additionalLabels | nindent 4 }} +spec: + groups: + - name: {{ include "cluster-autoscaler.fullname" . }} + interval: {{ .Values.prometheusRule.interval }} + rules: {{- tpl (toYaml .Values.prometheusRule.rules) . | nindent 8 }} +{{- end }} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/role.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/role.yaml new file mode 100644 index 000000000..44b1678af --- /dev/null +++ b/charts/devtron-utilities/charts/cluster-autoscaler/templates/role.yaml @@ -0,0 +1,87 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: +{{ include "cluster-autoscaler.labels" . | indent 4 }} + name: {{ template "cluster-autoscaler.fullname" . }} + namespace: {{ .Release.Namespace }} +rules: + - apiGroups: + - "" + resources: + - configmaps + verbs: + - create +{{- if (include "cluster-autoscaler.priorityExpanderEnabled" .) }} + - list + - watch +{{- end }} + - apiGroups: + - "" + resources: + - configmaps + resourceNames: + - cluster-autoscaler-status +{{- if (include "cluster-autoscaler.priorityExpanderEnabled" .) }} + - cluster-autoscaler-priority-expander +{{- end }} + verbs: + - delete + - get + - update +{{- if (include "cluster-autoscaler.priorityExpanderEnabled" .) }} + - watch +{{- end }} +{{- if eq (default "" (index .Values.extraArgs "leader-elect-resource-lock")) "configmaps" }} + - apiGroups: + - "" + resources: + - configmaps + resourceNames: + - cluster-autoscaler + verbs: + - get + - update +{{- end }} +{{- if and ( and ( eq .Values.cloudProvider "clusterapi" ) ( not .Values.rbac.clusterScoped ) ( or ( eq .Values.clusterAPIMode "incluster-incluster" ) ( eq .Values.clusterAPIMode "kubeconfig-incluster" ) ))}} + - apiGroups: + - cluster.x-k8s.io + resources: + - machinedeployments + - machinepools + - machines + - machinesets + verbs: + - get + - list + - update + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - machinedeployments/scale + - machinepools/scale + verbs: + - get + - patch + - update +{{- end }} +{{- if ( not .Values.rbac.clusterScoped ) }} + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create + - apiGroups: + - coordination.k8s.io + resourceNames: + - cluster-autoscaler + resources: + - leases + verbs: + - get + - update +{{- end }} +{{- end -}} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/rolebinding.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/rolebinding.yaml new file mode 100644 index 000000000..ba5f03755 --- /dev/null +++ b/charts/devtron-utilities/charts/cluster-autoscaler/templates/rolebinding.yaml @@ -0,0 +1,17 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: +{{ include "cluster-autoscaler.labels" . | indent 4 }} + name: {{ template "cluster-autoscaler.fullname" . }} + namespace: {{ .Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "cluster-autoscaler.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ template "cluster-autoscaler.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end -}} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/secret.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/secret.yaml new file mode 100644 index 000000000..e3b7fff7d --- /dev/null +++ b/charts/devtron-utilities/charts/cluster-autoscaler/templates/secret.yaml @@ -0,0 +1,31 @@ +{{- if not .Values.secretKeyRefNameOverride }} +{{- $isAzure := eq .Values.cloudProvider "azure" }} +{{- $isAws := eq .Values.cloudProvider "aws" }} +{{- $awsCredentialsProvided := and .Values.awsAccessKeyID .Values.awsSecretAccessKey }} +{{- $isCivo := eq .Values.cloudProvider "civo" }} + +{{- if or $isAzure (and $isAws $awsCredentialsProvided) $isCivo }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "cluster-autoscaler.fullname" . }} + namespace: {{ .Release.Namespace }} +data: +{{- if $isAzure }} + ClientID: "{{ .Values.azureClientID | b64enc }}" + ClientSecret: "{{ .Values.azureClientSecret | b64enc }}" + ResourceGroup: "{{ .Values.azureResourceGroup | b64enc }}" + SubscriptionID: "{{ .Values.azureSubscriptionID | b64enc }}" + TenantID: "{{ .Values.azureTenantID | b64enc }}" + VMType: "{{ .Values.azureVMType | b64enc }}" +{{- else if $isAws }} + AwsAccessKeyId: "{{ .Values.awsAccessKeyID | b64enc }}" + AwsSecretAccessKey: "{{ .Values.awsSecretAccessKey | b64enc }}" +{{- else if $isCivo }} + api-url: "{{ .Values.civoApiUrl | b64enc }}" + api-key: "{{ .Values.civoApiKey | b64enc }}" + cluster-id: "{{ .Values.civoClusterID | b64enc }}" + region: "{{ .Values.civoRegion | b64enc }}" +{{- end }} +{{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/service.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/service.yaml new file mode 100644 index 000000000..255aea44b --- /dev/null +++ b/charts/devtron-utilities/charts/cluster-autoscaler/templates/service.yaml @@ -0,0 +1,39 @@ +{{- if .Values.service.create }} +apiVersion: v1 +kind: Service +metadata: +{{- if .Values.service.annotations }} + annotations: +{{ toYaml .Values.service.annotations | indent 4 }} +{{- end }} + labels: +{{ include "cluster-autoscaler.labels" . | indent 4 }} +{{- if .Values.service.labels }} +{{ toYaml .Values.service.labels | indent 4 }} +{{- end }} + name: {{ template "cluster-autoscaler.fullname" . }} + namespace: {{ .Release.Namespace }} +spec: +{{- if .Values.service.clusterIP }} + clusterIP: "{{ .Values.service.clusterIP }}" +{{- end }} +{{- if .Values.service.externalIPs }} + externalIPs: +{{ toYaml .Values.service.externalIPs | indent 4 }} +{{- end }} +{{- if .Values.service.loadBalancerIP }} + loadBalancerIP: "{{ .Values.service.loadBalancerIP }}" +{{- end }} +{{- if .Values.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: +{{ toYaml .Values.service.loadBalancerSourceRanges | indent 4 }} +{{- end }} + ports: + - port: {{ .Values.service.servicePort }} + protocol: TCP + targetPort: 8085 + name: {{ .Values.service.portName }} + selector: +{{ include "cluster-autoscaler.instance-name" . | indent 4 }} + type: "{{ .Values.service.type }}" +{{- end }} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/serviceaccount.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/serviceaccount.yaml new file mode 100644 index 000000000..29c2580c2 --- /dev/null +++ b/charts/devtron-utilities/charts/cluster-autoscaler/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if and .Values.rbac.create .Values.rbac.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: +{{ include "cluster-autoscaler.labels" . | indent 4 }} + name: {{ template "cluster-autoscaler.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- if .Values.rbac.serviceAccount.annotations }} + annotations: {{ toYaml .Values.rbac.serviceAccount.annotations | nindent 4 }} +{{- end }} +automountServiceAccountToken: {{ .Values.rbac.serviceAccount.automountServiceAccountToken }} +{{- end }} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/servicemonitor.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/servicemonitor.yaml new file mode 100644 index 000000000..9ce83a2ef --- /dev/null +++ b/charts/devtron-utilities/charts/cluster-autoscaler/templates/servicemonitor.yaml @@ -0,0 +1,36 @@ +{{ if .Values.serviceMonitor.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ include "cluster-autoscaler.fullname" . }} + {{- if .Values.serviceMonitor.namespace }} + namespace: {{ .Values.serviceMonitor.namespace }} + {{- end }} + {{- if .Values.serviceMonitor.annotations }} + annotations: +{{ toYaml .Values.serviceMonitor.annotations | indent 4 }} + {{- end }} + labels: + {{- range $key, $value := .Values.serviceMonitor.selector }} + {{ $key }}: {{ $value | quote }} + {{- end }} +spec: + selector: + matchLabels: +{{ include "cluster-autoscaler.instance-name" . | indent 6 }} + endpoints: + - port: {{ .Values.service.portName }} + interval: {{ .Values.serviceMonitor.interval }} + path: {{ .Values.serviceMonitor.path }} + {{- if .Values.serviceMonitor.relabelings }} + relabelings: +{{ tpl (toYaml .Values.serviceMonitor.relabelings | indent 6) . }} + {{- end }} + {{- if .Values.serviceMonitor.metricRelabelings }} + metricRelabelings: +{{ tpl (toYaml .Values.serviceMonitor.metricRelabelings | indent 6) . }} + {{- end }} + namespaceSelector: + matchNames: + - {{.Release.Namespace}} +{{ end }} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/vpa.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/vpa.yaml new file mode 100644 index 000000000..b889beac9 --- /dev/null +++ b/charts/devtron-utilities/charts/cluster-autoscaler/templates/vpa.yaml @@ -0,0 +1,20 @@ +{{- if .Values.vpa.enabled -}} +apiVersion: autoscaling.k8s.io/v1 +kind: VerticalPodAutoscaler +metadata: + labels: +{{ include "cluster-autoscaler.labels" . | indent 4 }} + name: {{ template "cluster-autoscaler.fullname" . }} + namespace: {{ .Release.Namespace }} +spec: + targetRef: + apiVersion: {{ template "deployment.apiVersion" . }} + kind: Deployment + name: {{ template "cluster-autoscaler.fullname" . }} + updatePolicy: + updateMode: {{ .Values.vpa.updateMode | quote }} + resourcePolicy: + containerPolicies: + - containerName: {{ template "cluster-autoscaler.name" . }} + {{- .Values.vpa.containerPolicy | toYaml | nindent 6 }} +{{- end -}} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/values.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/values.yaml new file mode 100644 index 000000000..2490a8125 --- /dev/null +++ b/charts/devtron-utilities/charts/cluster-autoscaler/values.yaml @@ -0,0 +1,467 @@ +## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity +# affinity -- Affinity for pod assignment +affinity: {} + +# additionalLabels -- Labels to add to each object of the chart. +additionalLabels: {} + +autoDiscovery: + # cloudProviders `aws`, `gce`, `azure`, `magnum`, `clusterapi` and `oci` are supported by auto-discovery at this time + # AWS: Set tags as described in https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#auto-discovery-setup + + # autoDiscovery.clusterName -- Enable autodiscovery for `cloudProvider=aws`, for groups matching `autoDiscovery.tags`. + # autoDiscovery.clusterName -- Enable autodiscovery for `cloudProvider=azure`, using tags defined in https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/azure/README.md#auto-discovery-setup. + # Enable autodiscovery for `cloudProvider=clusterapi`, for groups matching `autoDiscovery.labels`. + # Enable autodiscovery for `cloudProvider=gce`, but no MIG tagging required. + # Enable autodiscovery for `cloudProvider=magnum`, for groups matching `autoDiscovery.roles`. + clusterName: # cluster.local + + # autoDiscovery.namespace -- Enable autodiscovery via cluster namespace for for `cloudProvider=clusterapi` + namespace: # default + + # autoDiscovery.tags -- ASG tags to match, run through `tpl`. + tags: + - k8s.io/cluster-autoscaler/enabled + - k8s.io/cluster-autoscaler/{{ .Values.autoDiscovery.clusterName }} + # - kubernetes.io/cluster/{{ .Values.autoDiscovery.clusterName }} + + # autoDiscovery.roles -- Magnum node group roles to match. + roles: + - worker + + # autoDiscovery.labels -- Cluster-API labels to match https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/clusterapi/README.md#configuring-node-group-auto-discovery + labels: [] + # - color: green + # - shape: circle +# autoscalingGroups -- For AWS, Azure AKS, Exoscale or Magnum. At least one element is required if not using `autoDiscovery`. For example: +# 
+# - name: asg1

+#   maxSize: 2

+#   minSize: 1
+#
+# For Hetzner Cloud, the `instanceType` and `region` keys are also required. +# 
+# - name: mypool

+#   maxSize: 2

+#   minSize: 1

+#   instanceType: CPX21

+#   region: FSN1
+#
+autoscalingGroups: [] +# - name: asg1 +# maxSize: 2 +# minSize: 1 +# - name: asg2 +# maxSize: 2 +# minSize: 1 + +# autoscalingGroupsnamePrefix -- For GCE. At least one element is required if not using `autoDiscovery`. For example: +# 
+# - name: ig01

+#   maxSize: 10

+#   minSize: 0
+#
+autoscalingGroupsnamePrefix: [] +# - name: ig01 +# maxSize: 10 +# minSize: 0 +# - name: ig02 +# maxSize: 10 +# minSize: 0 + +# awsAccessKeyID -- AWS access key ID ([if AWS user keys used](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials)) +awsAccessKeyID: "" + +# awsRegion -- AWS region (required if `cloudProvider=aws`) +awsRegion: us-east-1 + +# awsSecretAccessKey -- AWS access secret key ([if AWS user keys used](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials)) +awsSecretAccessKey: "" + +# azureClientID -- Service Principal ClientID with contributor permission to Cluster and Node ResourceGroup. +# Required if `cloudProvider=azure` +azureClientID: "" + +# azureClientSecret -- Service Principal ClientSecret with contributor permission to Cluster and Node ResourceGroup. +# Required if `cloudProvider=azure` +azureClientSecret: "" + +# azureResourceGroup -- Azure resource group that the cluster is located. +# Required if `cloudProvider=azure` +azureResourceGroup: "" + +# azureSubscriptionID -- Azure subscription where the resources are located. +# Required if `cloudProvider=azure` +azureSubscriptionID: "" + +# azureTenantID -- Azure tenant where the resources are located. +# Required if `cloudProvider=azure` +azureTenantID: "" + +# azureUseManagedIdentityExtension -- Whether to use Azure's managed identity extension for credentials. If using MSI, ensure subscription ID, resource group, and azure AKS cluster name are set. You can only use one authentication method at a time, either azureUseWorkloadIdentityExtension or azureUseManagedIdentityExtension should be set. +azureUseManagedIdentityExtension: false + +# azureUseWorkloadIdentityExtension -- Whether to use Azure's workload identity extension for credentials. See the project here: https://github.com/Azure/azure-workload-identity for more details. You can only use one authentication method at a time, either azureUseWorkloadIdentityExtension or azureUseManagedIdentityExtension should be set. +azureUseWorkloadIdentityExtension: false + +# azureVMType -- Azure VM type. +azureVMType: "vmss" + +# azureEnableForceDelete -- Whether to force delete VMs or VMSS instances when scaling down. +azureEnableForceDelete: false + +# civoApiUrl -- URL for the Civo API. +# Required if `cloudProvider=civo` +civoApiUrl: "https://api.civo.com" + +# civoApiKey -- API key for the Civo API. +# Required if `cloudProvider=civo` +civoApiKey: "" + +# civoClusterID -- Cluster ID for the Civo cluster. +# Required if `cloudProvider=civo` +civoClusterID: "" + +# civoRegion -- Region for the Civo cluster. +# Required if `cloudProvider=civo` +civoRegion: "" + +# cloudConfigPath -- Configuration file for cloud provider. +cloudConfigPath: "" + +# cloudProvider -- The cloud provider where the autoscaler runs. +# Currently only `gce`, `aws`, `azure`, `magnum`, `clusterapi` and `civo` are supported. +# `aws` supported for AWS. `gce` for GCE. `azure` for Azure AKS. +# `magnum` for OpenStack Magnum, `clusterapi` for Cluster API. +# `civo` for Civo Cloud. +cloudProvider: aws + +# clusterAPICloudConfigPath -- Path to kubeconfig for connecting to Cluster API Management Cluster, only used if `clusterAPIMode=kubeconfig-kubeconfig or incluster-kubeconfig` +clusterAPICloudConfigPath: /etc/kubernetes/mgmt-kubeconfig + +# clusterAPIConfigMapsNamespace -- Namespace on the workload cluster to store Leader election and status configmaps +clusterAPIConfigMapsNamespace: "" + +# clusterAPIKubeconfigSecret -- Secret containing kubeconfig for connecting to Cluster API managed workloadcluster +# Required if `cloudProvider=clusterapi` and `clusterAPIMode=kubeconfig-kubeconfig,kubeconfig-incluster or incluster-kubeconfig` +clusterAPIKubeconfigSecret: "" + +# clusterAPIMode -- Cluster API mode, see https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/clusterapi/README.md#connecting-cluster-autoscaler-to-cluster-api-management-and-workload-clusters +# Syntax: workloadClusterMode-ManagementClusterMode +# for `kubeconfig-kubeconfig`, `incluster-kubeconfig` and `single-kubeconfig` you always must mount the external kubeconfig using either `extraVolumeSecrets` or `extraMounts` and `extraVolumes` +# if you dont set `clusterAPIKubeconfigSecret`and thus use an in-cluster config or want to use a non capi generated kubeconfig you must do so for the workload kubeconfig as well +clusterAPIMode: incluster-incluster # incluster-incluster, incluster-kubeconfig, kubeconfig-incluster, kubeconfig-kubeconfig, single-kubeconfig + +# clusterAPIWorkloadKubeconfigPath -- Path to kubeconfig for connecting to Cluster API managed workloadcluster, only used if `clusterAPIMode=kubeconfig-kubeconfig or kubeconfig-incluster` +clusterAPIWorkloadKubeconfigPath: /etc/kubernetes/value + +# containerSecurityContext -- [Security context for container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) +containerSecurityContext: {} + # allowPrivilegeEscalation: false + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + +deployment: + # deployment.annotations -- Annotations to add to the Deployment object. + annotations: {} + +# dnsPolicy -- Defaults to `ClusterFirst`. Valid values are: +# `ClusterFirstWithHostNet`, `ClusterFirst`, `Default` or `None`. +# If autoscaler does not depend on cluster DNS, recommended to set this to `Default`. +dnsPolicy: ClusterFirst + +# envFromConfigMap -- ConfigMap name to use as envFrom. +envFromConfigMap: "" + +# envFromSecret -- Secret name to use as envFrom. +envFromSecret: "" + +## Priorities Expander +# expanderPriorities -- The expanderPriorities is used if `extraArgs.expander` contains `priority` and expanderPriorities is also set with the priorities. +# If `extraArgs.expander` contains `priority`, then expanderPriorities is used to define cluster-autoscaler-priority-expander priorities. +# See: https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/expander/priority/readme.md +expanderPriorities: {} + +# extraArgs -- Additional container arguments. +# Refer to https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md#what-are-the-parameters-to-ca for the full list of cluster autoscaler +# parameters and their default values. +# Everything after the first _ will be ignored allowing the use of multi-string arguments. +extraArgs: + logtostderr: true + stderrthreshold: info + v: 4 + # write-status-configmap: true + # status-config-map-name: cluster-autoscaler-status + # leader-elect: true + # leader-elect-resource-lock: endpoints + # skip-nodes-with-local-storage: true + # expander: random + # scale-down-enabled: true + # balance-similar-node-groups: true + # min-replica-count: 0 + # scale-down-utilization-threshold: 0.5 + # scale-down-non-empty-candidates-count: 30 + # max-node-provision-time: 15m0s + # scan-interval: 10s + # scale-down-delay-after-add: 10m + # scale-down-delay-after-delete: 0s + # scale-down-delay-after-failure: 3m + # scale-down-unneeded-time: 10m + # node-deletion-delay-timeout: 2m + # node-deletion-batcher-interval: 0s + # skip-nodes-with-system-pods: true + # balancing-ignore-label_1: first-label-to-ignore + # balancing-ignore-label_2: second-label-to-ignore + +# customArgs -- Additional custom container arguments. +# Refer to https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md#what-are-the-parameters-to-ca for the full list of cluster autoscaler +# parameters and their default values. +# List of arguments as strings. +customArgs: [] + +# extraEnv -- Additional container environment variables. +extraEnv: {} + +# extraEnvConfigMaps -- Additional container environment variables from ConfigMaps. +extraEnvConfigMaps: {} + +# extraEnvSecrets -- Additional container environment variables from Secrets. +extraEnvSecrets: {} + +# extraObjects -- Extra K8s manifests to deploy +extraObjects: [] +# - apiVersion: v1 +# kind: ConfigMap +# metadata: +# name: my-configmap +# data: +# key: "value" +# - apiVersion: scheduling.k8s.io/v1 +# kind: PriorityClass +# metadata: +# name: high-priority +# value: 1000000 +# globalDefault: false +# description: "This priority class should be used for XYZ service pods only." + +# extraVolumeMounts -- Additional volumes to mount. +extraVolumeMounts: [] + # - name: ssl-certs + # mountPath: /etc/ssl/certs/ca-certificates.crt + # readOnly: true + +# extraVolumes -- Additional volumes. +extraVolumes: [] + # - name: ssl-certs + # hostPath: + # path: /etc/ssl/certs/ca-bundle.crt + +# extraVolumeSecrets -- Additional volumes to mount from Secrets. +extraVolumeSecrets: {} + # autoscaler-vol: + # mountPath: /data/autoscaler/ + # custom-vol: + # name: custom-secret + # mountPath: /data/custom/ + # items: + # - key: subkey + # path: mypath + +# initContainers -- Any additional init containers. +initContainers: [] + +# fullnameOverride -- String to fully override `cluster-autoscaler.fullname` template. +fullnameOverride: "" + +# hostNetwork -- Whether to expose network interfaces of the host machine to pods. +hostNetwork: false + +image: + # image.repository -- Image repository + repository: registry.k8s.io/autoscaling/cluster-autoscaler + # image.tag -- Image tag + tag: v1.32.0 + # image.pullPolicy -- Image pull policy + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # image.pullSecrets -- Image pull secrets + pullSecrets: [] + # - myRegistrKeySecretName + +# kubeTargetVersionOverride -- Allow overriding the `.Capabilities.KubeVersion.GitVersion` check. Useful for `helm template` commands. +kubeTargetVersionOverride: "" + +# kwokConfigMapName -- configmap for configuring kwok provider +kwokConfigMapName: "kwok-provider-config" + +# magnumCABundlePath -- Path to the host's CA bundle, from `ca-file` in the cloud-config file. +magnumCABundlePath: "/etc/kubernetes/ca-bundle.crt" + +# magnumClusterName -- Cluster name or ID in Magnum. +# Required if `cloudProvider=magnum` and not setting `autoDiscovery.clusterName`. +magnumClusterName: "" + +# nameOverride -- String to partially override `cluster-autoscaler.fullname` template (will maintain the release name) +nameOverride: "" + +# nodeSelector -- Node labels for pod assignment. Ref: https://kubernetes.io/docs/user-guide/node-selection/. +nodeSelector: {} + +# podAnnotations -- Annotations to add to each pod. +podAnnotations: {} + +# podDisruptionBudget -- Pod disruption budget. +podDisruptionBudget: + maxUnavailable: 1 + # minAvailable: 2 + +# podLabels -- Labels to add to each pod. +podLabels: {} + +# priorityClassName -- priorityClassName +priorityClassName: "system-cluster-critical" + +# priorityConfigMapAnnotations -- Annotations to add to `cluster-autoscaler-priority-expander` ConfigMap. +priorityConfigMapAnnotations: {} + # key1: "value1" + # key2: "value2" + +## Custom PrometheusRule to be defined +## The value is evaluated as a template, so, for example, the value can depend on .Release or .Chart +## ref: https://github.com/coreos/prometheus-operator#customresourcedefinitions +prometheusRule: + # prometheusRule.enabled -- If true, creates a Prometheus Operator PrometheusRule. + enabled: false + # prometheusRule.additionalLabels -- Additional labels to be set in metadata. + additionalLabels: {} + # prometheusRule.namespace -- Namespace which Prometheus is running in. + namespace: monitoring + # prometheusRule.interval -- How often rules in the group are evaluated (falls back to `global.evaluation_interval` if not set). + interval: null + # prometheusRule.rules -- Rules spec template (see https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/api.md#rule). + rules: [] + +rbac: + # rbac.create -- If `true`, create and use RBAC resources. + create: true + # rbac.pspEnabled -- If `true`, creates and uses RBAC resources required in the cluster with [Pod Security Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) enabled. + # Must be used with `rbac.create` set to `true`. + pspEnabled: false + # rbac.clusterScoped -- if set to false will only provision RBAC to alter resources in the current namespace. Most useful for Cluster-API + clusterScoped: true + serviceAccount: + # rbac.serviceAccount.annotations -- Additional Service Account annotations. + annotations: {} + # rbac.serviceAccount.create -- If `true` and `rbac.create` is also true, a Service Account will be created. + create: true + # rbac.serviceAccount.name -- The name of the ServiceAccount to use. If not set and create is `true`, a name is generated using the fullname template. + name: "" + # rbac.serviceAccount.automountServiceAccountToken -- Automount API credentials for a Service Account. + automountServiceAccountToken: true + +# replicaCount -- Desired number of pods +replicaCount: 1 + +# resources -- Pod resource requests and limits. +resources: {} + # limits: + # cpu: 100m + # memory: 300Mi + # requests: + # cpu: 100m + # memory: 300Mi + +# revisionHistoryLimit -- The number of revisions to keep. +revisionHistoryLimit: 10 + +# securityContext -- [Security context for pod](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) +securityContext: {} + # runAsNonRoot: true + # runAsUser: 65534 + # runAsGroup: 65534 + # seccompProfile: + # type: RuntimeDefault + +service: + # service.create -- If `true`, a Service will be created. + create: true + # service.annotations -- Annotations to add to service + annotations: {} + # service.labels -- Labels to add to service + labels: {} + # service.externalIPs -- List of IP addresses at which the service is available. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips. + externalIPs: [] + + # service.clusterIP -- IP address to assign to service + clusterIP: "" + + # service.loadBalancerIP -- IP address to assign to load balancer (if supported). + loadBalancerIP: "" + # service.loadBalancerSourceRanges -- List of IP CIDRs allowed access to load balancer (if supported). + loadBalancerSourceRanges: [] + # service.servicePort -- Service port to expose. + servicePort: 8085 + # service.portName -- Name for service port. + portName: http + # service.type -- Type of service to create. + type: ClusterIP + +## Are you using Prometheus Operator? +serviceMonitor: + # serviceMonitor.enabled -- If true, creates a Prometheus Operator ServiceMonitor. + enabled: false + # serviceMonitor.interval -- Interval that Prometheus scrapes Cluster Autoscaler metrics. + interval: 10s + # serviceMonitor.namespace -- Namespace which Prometheus is running in. + namespace: monitoring + ## [Prometheus Selector Label](https://github.com/helm/charts/tree/master/stable/prometheus-operator#prometheus-operator-1) + ## [Kube Prometheus Selector Label](https://github.com/helm/charts/tree/master/stable/prometheus-operator#exporters) + # serviceMonitor.selector -- Default to kube-prometheus install (CoreOS recommended), but should be set according to Prometheus install. + selector: + release: prometheus-operator + # serviceMonitor.path -- The path to scrape for metrics; autoscaler exposes `/metrics` (this is standard) + path: /metrics + # serviceMonitor.annotations -- Annotations to add to service monitor + annotations: {} + ## [RelabelConfig](https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.RelabelConfig) + # serviceMonitor.relabelings -- RelabelConfigs to apply to metrics before scraping. + relabelings: {} + ## [RelabelConfig](https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.RelabelConfig) + # serviceMonitor.metricRelabelings -- MetricRelabelConfigs to apply to samples before ingestion. + metricRelabelings: {} + +# tolerations -- List of node taints to tolerate (requires Kubernetes >= 1.6). +tolerations: [] + +# topologySpreadConstraints -- You can use topology spread constraints to control how Pods are spread across your cluster among failure-domains such as regions, zones, nodes, and other user-defined topology domains. (requires Kubernetes >= 1.19). +topologySpreadConstraints: [] + # - maxSkew: 1 + # topologyKey: topology.kubernetes.io/zone + # whenUnsatisfiable: DoNotSchedule + # labelSelector: + # matchLabels: + # app.kubernetes.io/instance: cluster-autoscaler + +# updateStrategy -- [Deployment update strategy](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy) +updateStrategy: {} + # rollingUpdate: + # maxSurge: 1 + # maxUnavailable: 0 + # type: RollingUpdate + +# vpa -- Configure a VerticalPodAutoscaler for the cluster-autoscaler Deployment. +vpa: + # vpa.enabled -- If true, creates a VerticalPodAutoscaler. + enabled: false + # vpa.updateMode -- [UpdateMode](https://github.com/kubernetes/autoscaler/blob/vertical-pod-autoscaler/v0.13.0/vertical-pod-autoscaler/pkg/apis/autoscaling.k8s.io/v1/types.go#L124) + updateMode: "Auto" + # vpa.containerPolicy -- [ContainerResourcePolicy](https://github.com/kubernetes/autoscaler/blob/vertical-pod-autoscaler/v0.13.0/vertical-pod-autoscaler/pkg/apis/autoscaling.k8s.io/v1/types.go#L159). The containerName is always et to the deployment's container name. This value is required if VPA is enabled. + containerPolicy: {} + +# secretKeyRefNameOverride -- Overrides the name of the Secret to use when loading the secretKeyRef for AWS, Azure and Civo env variables +secretKeyRefNameOverride: "" diff --git a/charts/devtron-utilities/charts/devtron-backups/Chart.yaml b/charts/devtron-utilities/charts/devtron-backups/Chart.yaml new file mode 100644 index 000000000..3203a6991 --- /dev/null +++ b/charts/devtron-utilities/charts/devtron-backups/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v2 +appVersion: "2.0" +description: A Helm chart for Devtron Backups +name: devtron-backups +version: 0.2.5 diff --git a/charts/devtron-utilities/charts/devtron-backups/README.md b/charts/devtron-utilities/charts/devtron-backups/README.md new file mode 100644 index 000000000..acbd30d4a --- /dev/null +++ b/charts/devtron-utilities/charts/devtron-backups/README.md @@ -0,0 +1,55 @@ +# Devtron Backup Chart + +This chart contains configuration files for setting up backup for Devtron stack using different cloud storage providers and persistence options. + +## Introduction + +Devtron Backup chart provides backup configurations for PostgreSQL databases and ArgoCD applications running in the Devtron environment. It supports backup to various cloud storage providers such as Azure Blob Storage, Google Cloud Storage (GCS), S3, as well as backup to persistent volume claims (PVC). + +## Configuration + +The backup configurations are defined in the YAML file, which specifies settings such as schedule, storage options, and encryption. + +### Azure Backup + +Azure backup can be enabled by setting `AZURE.enabled` to `true` in the YAML file. Configure Azure storage account details and encryption settings as required. + +### GCP Backup + +GCP backup can be enabled by setting `GCP.enabled` to `true` in the YAML file. Configure the GCS bucket name, and optionally, provide GCP credentials if the default service account lacks permissions. + +### S3 Backup + +S3 backup can be enabled by setting `S3.enabled` to `true` in the YAML file. Configure the S3 bucket details and encryption settings as required. + +### PVC Backup + +PVC backup can be enabled by setting `PERSISTENCE.enabled` to `true` in the YAML file. Specify PVC settings, including storage class and size. + +Additionally, remember to enable `postgress_backup` or `argocd_backup` according to your requirements in the YAML file. + +## Usage + +Follow the steps below to use the backup chart: + +1. Modify the YAML file according to your backup requirements. +2. Apply the configurations to your Kubernetes cluster. + +### Things to be considered while migrating from v0.1.x to v0.2.x: + +Previously, in v0.1.x, support was available only for the following storage options: +- AWS S3 +- Azure +- GCP +- PVC + +In the updated version (v0.2.x), support for all types of storage options using the S3 protocol has been added, for example, AWS S3, MINIO, etc. +As we have merged the options for AWS and generic S3 into one, we have to consider a few key changes: +- `AWS` changed to `S3` + - Previously, the configurations for AWS used to be set inside the `AWS:` option. Now it has changed to `S3:`, but only the naming has changed, not the functionality. +- `AWS_ACCESS_KEY` changed to `S3_ACCESS_KEY` + - This will continue to accept the ACCESS_KEY of the S3 storage, whether it be AWS S3 or any other storage options supporting the S3 protocol. +- `AWS_SECRET_KEY` changed to `S3_SECRET_KEY` + - This will continue to accept the SECRET_KEY of the S3 storage, whether it be AWS S3 or any other storage options supporting the S3 protocol. +- `S3_ENDPOINT` + - This option can be newly seen in the **v0.2.x**, which accepts the endpoint of the S3 storage service, for example, MINIO (Can be kept empty in the case of AWS S3 Bucket). diff --git a/charts/devtron-utilities/charts/devtron-backups/templates/_helpers.tpl b/charts/devtron-utilities/charts/devtron-backups/templates/_helpers.tpl new file mode 100644 index 000000000..03f69d724 --- /dev/null +++ b/charts/devtron-utilities/charts/devtron-backups/templates/_helpers.tpl @@ -0,0 +1,63 @@ +{{- define "devtron.postgresBackup" -}} + {{- if .Values.global.S3.CA_BUNDLE }} + {{- if .Values.global.S3.S3_ENDPOINT }} + {{- if .Values.global.S3.encryption.enabled }} + set -ex; date1=$(date +%Y%m%d-%H%M); path=$(pwd); echo "$CA_BUNDLE" > /cabundle.pem; export AWS_CA_BUNDLE=/cabundle.pem; gpg -c --batch --passphrase {{ .Values.global.S3.encryption.passphrase }} /postgres/backup.tar; rm -rvf /postgres/backup.tar; mv /postgres/backup.tar.gpg /postgres/backup-$date1.tar.gpg; aws s3 cp /postgres/backup-$date1.tar.gpg s3://$S3_BUCKET/postgres/ --endpoint-url {{ .Values.global.S3.S3_ENDPOINT }} --ca-bundle $AWS_CA_BUNDLE; + {{- else }} + set -ex; date1=$(date +%Y%m%d-%H%M); path=$(pwd); echo "$CA_BUNDLE" > /cabundle.pem; export AWS_CA_BUNDLE=/cabundle.pem; mv /postgres/backup.tar /postgres/backup-$date1.tar; aws s3 cp /postgres/backup-$date1.tar s3://$S3_BUCKET/postgres/ --endpoint-url {{ .Values.global.S3.S3_ENDPOINT }} --ca-bundle $AWS_CA_BUNDLE; + {{- end }} + {{- else}} + {{- if .Values.global.S3.encryption.enabled }} + set -ex; date1=$(date +%Y%m%d-%H%M); path=$(pwd); echo "$CA_BUNDLE" > /cabundle.pem; export AWS_CA_BUNDLE=/cabundle.pem; gpg -c --batch --passphrase {{ .Values.global.S3.encryption.passphrase }} /postgres/backup.tar; rm -rvf /postgres/backup.tar; mv /postgres/backup.tar.gpg /postgres/backup-$date1.tar.gpg; aws s3 cp /postgres/backup-$date1.tar.gpg s3://$S3_BUCKET/postgres/ ; + {{- else}} + set -ex; date1=$(date +%Y%m%d-%H%M); path=$(pwd); echo "$CA_BUNDLE" > /cabundle.pem; export AWS_CA_BUNDLE=/cabundle.pem; mv /postgres/backup.tar /postgres/backup-$date1.tar; aws s3 cp /postgres/backup-$date1.tar s3://$S3_BUCKET/postgres/; + {{- end }} + {{- end }} + {{- else }} + {{- if .Values.global.S3.S3_ENDPOINT }} + {{- if .Values.global.S3.encryption.enabled }} + set -ex; date1=$(date +%Y%m%d-%H%M); gpg -c --batch --passphrase {{ .Values.global.S3.encryption.passphrase }} /postgres/backup.tar; rm -rvf /postgres/backup.tar; mv /postgres/backup.tar.gpg /postgres/backup-$date1.tar.gpg; aws s3 cp /postgres/backup-$date1.tar.gpg s3://$S3_BUCKET/postgres/ --endpoint-url {{ .Values.global.S3.S3_ENDPOINT }}; + {{- else}} + set -ex; date1=$(date +%Y%m%d-%H%M); mv /postgres/backup.tar /postgres/backup-$date1.tar; aws s3 cp /postgres/backup-$date1.tar s3://$S3_BUCKET/postgres/ --endpoint-url {{ .Values.global.S3.S3_ENDPOINT }}; + {{- end }} + {{- else}} + {{- if .Values.global.S3.encryption.enabled }} + set -ex; date1=$(date +%Y%m%d-%H%M); gpg -c --batch --passphrase {{ .Values.global.S3.encryption.passphrase }} /postgres/backup.tar; rm -rvf /postgres/backup.tar; mv /postgres/backup.tar.gpg /postgres/backup-$date1.tar.gpg; aws s3 cp /postgres/backup-$date1.tar.gpg s3://$S3_BUCKET/postgres/; + {{- else}} + set -ex; date1=$(date +%Y%m%d-%H%M); mv /postgres/backup.tar /postgres/backup-$date1.tar; aws s3 cp /postgres/backup-$date1.tar s3://$S3_BUCKET/postgres/; + {{- end }} + {{- end }} + {{- end }} +{{- end -}} + +{{- define "devtron.argocdBackup" -}} + {{- if .Values.global.S3.CA_BUNDLE }} + {{- if .Values.global.S3.S3_ENDPOINT }} + {{- if .Values.global.S3.encryption.enabled }} + set -ex; date1=$(date +%Y%m%d-%H%M); echo "$CA_BUNDLE" > /cabundle.pem; export AWS_CA_BUNDLE=/cabundle.pem; gpg -c --batch --passphrase {{ .Values.global.S3.encryption.passphrase }} /argocd/backup.yaml; rm -rvf /argocd/backup.yaml; mv /argocd/backup.yaml.gpg /argocd/backup-$date1.yaml.gpg; aws s3 cp /argocd/backup-$date1.yaml.gpg s3://$S3_BUCKET/argocd/ --endpoint-url {{ .Values.global.S3.S3_ENDPOINT }}; + {{- else }} + set -ex; date1=$(date +%Y%m%d-%H%M); echo "$CA_BUNDLE" > /cabundle.pem; export AWS_CA_BUNDLE=/cabundle.pem; mv /argocd/backup.yaml /argocd/backup-$date1.yaml; aws s3 cp /argocd/backup-$date1.yaml s3://$S3_BUCKET/argocd/ --endpoint-url {{ .Values.global.S3.S3_ENDPOINT }}; + {{- end }} + {{- else}} + {{- if .Values.global.S3.encryption.enabled }} + set -ex; date1=$(date +%Y%m%d-%H%M); echo "$CA_BUNDLE" > /cabundle.pem; export AWS_CA_BUNDLE=/cabundle.pem; gpg -c --batch --passphrase {{ .Values.global.S3.encryption.passphrase }} /argocd/backup.yaml; rm -rvf /argocd/backup.yaml; mv /argocd/backup.yaml.gpg /argocd/backup-$date1.yaml.gpg; aws s3 cp /argocd/backup-$date1.yaml.gpg s3://$S3_BUCKET/argocd/; + {{- else}} + set -ex; date1=$(date +%Y%m%d-%H%M); echo "$CA_BUNDLE" > /cabundle.pem; export AWS_CA_BUNDLE=/cabundle.pem; mv /argocd/backup.yaml /argocd/backup-$date1.yaml; aws s3 cp /argocd/backup-$date1.yaml s3://$S3_BUCKET/argocd/; + {{- end }} + {{- end }} + {{- else }} + {{- if .Values.global.S3.S3_ENDPOINT }} + {{- if .Values.global.S3.encryption.enabled }} + set -ex; date1=$(date +%Y%m%d-%H%M); gpg -c --batch --passphrase {{ .Values.global.S3.encryption.passphrase }} /argocd/backup.yaml; rm -rvf /argocd/backup.yaml; mv /argocd/backup.yaml.gpg /argocd/backup-$date1.yaml.gpg; aws s3 cp /argocd/backup-$date1.yaml.gpg s3://$S3_BUCKET/argocd/ --endpoint-url {{ .Values.global.S3.S3_ENDPOINT }}; + {{- else }} + set -ex; date1=$(date +%Y%m%d-%H%M); mv /argocd/backup.yaml /argocd/backup-$date1.yaml; aws s3 cp /argocd/backup-$date1.yaml s3://$S3_BUCKET/argocd/ --endpoint-url {{ .Values.global.S3.S3_ENDPOINT }}; + {{- end }} + {{- else}} + {{- if .Values.global.S3.encryption.enabled }} + set -ex; date1=$(date +%Y%m%d-%H%M); gpg -c --batch --passphrase {{ .Values.global.S3.encryption.passphrase }} /argocd/backup.yaml; rm -rvf /argocd/backup.yaml; mv /argocd/backup.yaml.gpg /argocd/backup-$date1.yaml.gpg; aws s3 cp /argocd/backup-$date1.yaml.gpg s3://$S3_BUCKET/argocd/; + {{- else}} + set -ex; date1=$(date +%Y%m%d-%H%M); mv /argocd/backup.yaml /argocd/backup-$date1.yaml; aws s3 cp /argocd/backup-$date1.yaml s3://$S3_BUCKET/argocd/; + {{- end }} + {{- end }} + {{- end }} +{{- end }} \ No newline at end of file diff --git a/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-azure.yaml b/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-azure.yaml new file mode 100644 index 000000000..5d59456f8 --- /dev/null +++ b/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-azure.yaml @@ -0,0 +1,213 @@ +{{- if .Values.global.AZURE.enabled }} +{{- if or .Values.postgres_backup.enabled .Values.argocd_backup.enabled }} +apiVersion: v1 +kind: Secret +metadata: + name: devtron-azure-backup-secret + namespace: devtroncd +type: opaque +data: + AZURE_BLOB_ACCOUNT_NAME: {{ .Values.global.AZURE.AZURE_BLOB_ACCOUNT_NAME | b64enc }} + AZURE_ACCOUNT_KEY: {{ .Values.global.AZURE.AZURE_ACCOUNT_KEY | b64enc }} + AZURE_BLOB_CONTAINER_FOR_POSTGRES: {{ .Values.global.AZURE.AZURE_BLOB_CONTAINER_FOR_POSTGRES | b64enc }} + {{- if .Values.argocd_backup.enabled }} + AZURE_BLOB_CONTAINER_FOR_ARGOCD: {{ .Values.global.AZURE.AZURE_BLOB_CONTAINER_FOR_ARGOCD | b64enc }} + {{- end }} +{{- end }} +--- +{{- if .Values.postgres_backup.enabled }} +{{ if semverCompare ">=1.21-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: batch/v1 +{{ else -}} +apiVersion: batch/v1beta1 +{{ end -}} +kind: CronJob +metadata: + name: postgres-app-backup-cronjob + namespace: devtroncd +spec: + timeZone: {{ .Values.global.timezone | default "UTC" }} + schedule: {{ .Values.global.schedule }} + jobTemplate: + spec: + template: + {{- if or $.Values.postgres_backup.labels $.Values.postgres_backup.annotations }} + metadata: + {{- if $.Values.postgres_backup.labels }} + labels: + {{ toYaml .Values.postgres_backup.labels | indent 4 }} + {{- end }} + {{- if $.Values.postgres_backup.annotations }} + annotations: + {{ toYaml .Values.postgres_backup.annotations | indent 4 }} + {{- end }} + {{- end }} + spec: + initContainers: + - name: postgres-app-backup-cronjob + image: {{ .Values.postgres_backup.postgresImage | default "postgres:12" }} + volumeMounts: + - mountPath: /postgres + name: psql-volume + env: + - name: PGPASSWORD + valueFrom: + secretKeyRef: + key: PG_PASSWORD + name: {{ .Values.postgres_backup.secretName }} + imagePullPolicy: Always + args: + - /bin/bash + - -c + - set -ex ; pg_dumpall -h {{ .Values.postgres_backup.host | default "postgresql-postgresql.devtroncd" }} --exclude-database=clairv4 -p 5432 -U postgres --no-privileges > /postgres/backup.tar; echo $? ; du -sh /postgres/backup.tar + resources: +{{ toYaml .Values.postgres_backup.resources | indent 14 }} + containers: + - name: az-cli-for-upload + image: {{ .Values.global.AZURE.image | default "quay.io/devtron/k8s-utils:az-cli-ubuntu" }} + volumeMounts: + - mountPath: /postgres + name: psql-volume + env: + - name: AZURE_BLOB_ACCOUNT_NAME + valueFrom: + secretKeyRef: + name: devtron-azure-backup-secret + key: AZURE_BLOB_ACCOUNT_NAME + - name: AZURE_ACCOUNT_KEY + valueFrom: + secretKeyRef: + name: devtron-azure-backup-secret + key: AZURE_ACCOUNT_KEY + - name: AZURE_BLOB_CONTAINER_FOR_POSTGRES + valueFrom: + secretKeyRef: + name: devtron-azure-backup-secret + key: AZURE_BLOB_CONTAINER_FOR_POSTGRES + {{- if .Values.argocd_backup.enabled }} + - name: AZURE_BLOB_CONTAINER_FOR_ARGOCD + valueFrom: + secretKeyRef: + name: devtron-azure-backup-secret + key: AZURE_BLOB_CONTAINER_FOR_ARGOCD + {{- end }} + imagePullPolicy: Always + resources: +{{ toYaml .Values.postgres_backup.resources | indent 14 }} + args: + - /bin/bash + - -c + {{- if $.Values.global.AZURE.encryption.enabled }} + - set -ex; date1=$(date +%Y%m%d-%H%M); gpg -c --batch --passphrase {{ .Values.global.AZURE.encryption.passphrase }} /postgres/backup.tar; rm -rvf /postgres/backup.tar; mv /postgres/backup.tar.gpg /postgres/backup-$date1.tar.gpg; az storage blob upload --account-name $AZURE_BLOB_ACCOUNT_NAME --container-name $AZURE_BLOB_CONTAINER_FOR_POSTGRES --file /postgres/backup-$date1.tar.gpg --account-key $AZURE_ACCOUNT_KEY; + {{- else }} + - set -ex; date1=$(date +%Y%m%d-%H%M); mv /postgres/backup.tar /postgres/backup-$date1.tar; az storage blob upload --account-name $AZURE_BLOB_ACCOUNT_NAME --container-name $AZURE_BLOB_CONTAINER_FOR_POSTGRES --file /postgres/backup-$date1.tar --account-key $AZURE_ACCOUNT_KEY; + {{- end }} + volumes: + - name: psql-volume + emptyDir: {} + {{- if $.Values.global.nodeSelector }} + nodeselector: +{{ toYaml .Values.global.nodeSelector | indent 12 }} + {{- end }} + {{- if $.Values.global.tolerations }} + tolerations: +{{ toYaml .Values.global.tolerations | indent 12 }} + {{- end }} + restartPolicy: OnFailure +{{- end }} +--- +{{- if .Values.argocd_backup.enabled }} +{{ if semverCompare ">=1.21-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: batch/v1 +{{ else -}} +apiVersion: batch/v1beta1 +{{ end -}} +kind: CronJob +metadata: + name: argocd-app-backup-cronjob + namespace: devtroncd +spec: + timeZone: {{ .Values.global.timezone | default "UTC" }} + schedule: {{ .Values.global.schedule }} + jobTemplate: + spec: + template: + {{- if or $.Values.postgres_backup.labels $.Values.postgres_backup.annotations }} + metadata: + {{- if $.Values.postgres_backup.labels }} + labels: + {{ toYaml .Values.postgres_backup.labels | indent 4 }} + {{- end }} + {{- if $.Values.postgres_backup.annotations }} + annotations: + {{ toYaml .Values.postgres_backup.annotations | indent 4 }} + {{- end }} + {{- end }} + spec: + initContainers: + - name: argocd-app-backup-job + image: {{ .Values.argocd_backup.argocdImage | default "quay.io/argoproj/argocd:v2.4.0" }} + volumeMounts: + - mountPath: /argocd + name: argocd-volume + env: + imagePullPolicy: Always + args: + - /bin/bash + - -c + - {{ .Values.argocd_backup.args | default "argocd admin export -n devtroncd > /argocd/backup.yaml" }} + resources: +{{ toYaml .Values.argocd_backup.resources | indent 14 }} + containers: + - name: az-cli-for-upload + image: {{ .Values.global.AZURE.image | default "quay.io/devtron/k8s-utils:az-cli-ubuntu" }} + volumeMounts: + - mountPath: /argocd + name: argocd-volume + env: + - name: AZURE_BLOB_ACCOUNT_NAME + valueFrom: + secretKeyRef: + name: devtron-azure-backup-secret + key: AZURE_BLOB_ACCOUNT_NAME + - name: AZURE_ACCOUNT_KEY + valueFrom: + secretKeyRef: + name: devtron-azure-backup-secret + key: AZURE_ACCOUNT_KEY + - name: AZURE_BLOB_CONTAINER_FOR_POSTGRES + valueFrom: + secretKeyRef: + name: devtron-azure-backup-secret + key: AZURE_BLOB_CONTAINER_FOR_POSTGRES + - name: AZURE_BLOB_CONTAINER_FOR_ARGOCD + valueFrom: + secretKeyRef: + name: devtron-azure-backup-secret + key: AZURE_BLOB_CONTAINER_FOR_ARGOCD + imagePullPolicy: Always + resources: +{{ toYaml .Values.argocd_backup.resources | indent 14 }} + args: + - /bin/bash + - -c + {{- if $.Values.global.AZURE.encryption.enabled }} + - set -ex; date1=$(date +%Y%m%d-%H%M); gpg -c --batch --passphrase {{ .Values.global.AZURE.encryption.passphrase }} /argocd/backup.yaml ;rm -rvf /argocd/backup.yaml ;mv /argocd/backup.yaml.gpg /argocd/backup-$date1.yaml.gpg; az storage blob upload --account-name $AZURE_BLOB_ACCOUNT_NAME --container-name $AZURE_BLOB_CONTAINER_FOR_ARGOCD --file /argocd/backup-$date1.yaml.gpg --account-key $AZURE_ACCOUNT_KEY; + {{- else }} + - set -ex; date1=$(date +%Y%m%d-%H%M); mv /argocd/backup.yaml /argocd/backup-$date1.yaml; az storage blob upload --account-name $AZURE_BLOB_ACCOUNT_NAME --container-name $AZURE_BLOB_CONTAINER_FOR_ARGOCD --file /argocd/backup-$date1.yaml --account-key $AZURE_ACCOUNT_KEY; + {{- end }} + volumes: + - name: argocd-volume + emptyDir: {} + {{- if $.Values.global.nodeSelector }} + nodeselector: +{{ toYaml .Values.global.nodeSelector | indent 12 }} + {{- end }} + {{- if $.Values.global.tolerations }} + tolerations: +{{ toYaml .Values.global.tolerations | indent 12 }} + {{- end }} + restartPolicy: OnFailure + serviceAccountName: {{ .Values.argocd_backup.serviceAccountName }} +{{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-gcp.yaml b/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-gcp.yaml new file mode 100644 index 000000000..f961e9b5f --- /dev/null +++ b/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-gcp.yaml @@ -0,0 +1,194 @@ +{{- if .Values.global.GCP.enabled }} +{{- if or .Values.postgres_backup.enabled .Values.argocd_backup.enabled }} +apiVersion: v1 +kind: Secret +metadata: + name: devtron-gcp-backup-secret + namespace: devtroncd +type: opaque +data: + GCS_BUCKET: {{ .Values.global.GCP.GCS_BUCKET_NAME | b64enc }} + {{- if .Values.global.GCP.CREDENTIALS.enabled }} + GOOGLE_APPLICATION_CREDENTIALS: {{ $.Values.global.GCP.CREDENTIALS.GCP_CREDENTIALS_JSON }} + {{- end }} +{{- end }} +--- +{{- if .Values.postgres_backup.enabled }} +{{ if semverCompare ">=1.21-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: batch/v1 +{{ else -}} +apiVersion: batch/v1beta1 +{{ end -}} +kind: CronJob +metadata: + name: postgres-app-backup-cronjob + namespace: devtroncd +spec: + timeZone: {{ .Values.global.timezone | default "UTC" }} + schedule: "{{ .Values.global.schedule }}" + jobTemplate: + spec: + template: + {{- if or $.Values.postgres_backup.labels $.Values.postgres_backup.annotations }} + metadata: + {{- if $.Values.postgres_backup.labels }} + labels: + {{ toYaml .Values.postgres_backup.labels | indent 4 }} + {{- end }} + {{- if $.Values.postgres_backup.annotations }} + annotations: + {{ toYaml .Values.postgres_backup.annotations | indent 4 }} + {{- end }} + {{- end }} + spec: + initContainers: + - name: postgres-app-backup-cronjob + image: {{ .Values.postgres_backup.postgresImage | default "postgres:12" }} + volumeMounts: + - mountPath: /postgres + name: psql-volume + env: + - name: PGPASSWORD + valueFrom: + secretKeyRef: + key: PG_PASSWORD + name: {{ .Values.postgres_backup.secretName }} + imagePullPolicy: Always + args: + - /bin/bash + - -c + - set -ex; pg_dumpall -h {{ .Values.postgres_backup.host | default "postgresql-postgresql.devtroncd" }} --exclude-database=clairv4 -p 5432 -U postgres --no-privileges > /postgres/backup.tar; echo $? ; du -sh /postgres/backup.tar + resources: +{{ toYaml .Values.postgres_backup.resources | indent 14 }} + containers: + - name: gcloud-cli-for-cloud-storage-upload + image: {{ .Values.global.GCP.image | default "google/cloud-sdk:alpine" }} + volumeMounts: + - mountPath: /postgres + name: psql-volume + env: + - name: GCS_BUCKET + valueFrom: + secretKeyRef: + name: devtron-gcp-backup-secret + key: GCS_BUCKET + {{- if .Values.global.GCP.CREDENTIALS.enabled }} + - name: gcp_credentials + valueFrom: + secretKeyRef: + name: devtron-gcp-backup-secret + key: GOOGLE_APPLICATION_CREDENTIALS + {{- end }} + imagePullPolicy: Always + resources: +{{ toYaml .Values.postgres_backup.resources | indent 14 }} + args: + - /bin/bash + - -c + {{- if $.Values.global.GCP.encryption.enabled }} + - set -ex; echo $gcp_credentials > /postgres/gcp_credentials.json ; gcloud auth activate-service-account --key-file=/postgres/gcp_credentials.json ; date1=$(date +%Y%m%d-%H%M); gpg -c --batch --passphrase {{ .Values.global.GCP.encryption.passphrase }} /postgres/backup.tar; rm -rvf /postgres/backup.tar; mv /postgres/backup.tar.gpg /postgres/backup-$date1.tar.gpg; gsutil cp /postgres/backup-$date1.tar.gpg gs://$GCS_BUCKET/postgres/; + {{- else}} + - set -ex; echo $gcp_credentials > /postgres/gcp_credentials.json ; gcloud auth activate-service-account --key-file=/postgres/gcp_credentials.json ; date1=$(date +%Y%m%d-%H%M); mv /postgres/backup.tar /postgres/backup-$date1.tar; gsutil cp /postgres/backup-$date1.tar gs://$GCS_BUCKET/postgres/; + {{- end }} + volumes: + - name: psql-volume + emptyDir: {} + {{- if $.Values.global.nodeSelector }} + nodeselector: +{{ toYaml .Values.global.nodeSelector | indent 12 }} + {{- end }} + {{- if $.Values.global.tolerations }} + tolerations: +{{ toYaml .Values.global.tolerations | indent 12 }} + {{- end }} + restartPolicy: OnFailure + serviceAccountName: {{ .Values.postgres_backup.serviceAccountName | default "default" }} +{{- end }} +--- +{{- if .Values.argocd_backup.enabled }} +{{ if semverCompare ">=1.21-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: batch/v1 +{{ else -}} +apiVersion: batch/v1beta1 +{{ end -}} +kind: CronJob +metadata: + name: argocd-app-backup-cronjob + namespace: devtroncd +spec: + timeZone: {{ .Values.global.timezone | default "UTC" }} + schedule: "{{ .Values.global.schedule }}" + jobTemplate: + spec: + template: + {{- if or $.Values.postgres_backup.labels $.Values.postgres_backup.annotations }} + metadata: + {{- if $.Values.postgres_backup.labels }} + labels: + {{ toYaml .Values.postgres_backup.labels | indent 4 }} + {{- end }} + {{- if $.Values.postgres_backup.annotations }} + annotations: + {{ toYaml .Values.postgres_backup.annotations | indent 4 }} + {{- end }} + {{- end }} + spec: + initContainers: + - name: argocd-app-backup-job + image: {{ .Values.argocd_backup.argocdImage | default "quay.io/argoproj/argocd:v2.4.0" }} + volumeMounts: + - mountPath: /argocd + name: argocd-volume + env: + imagePullPolicy: Always + args: + - /bin/bash + - -c + - {{ .Values.argocd_backup.args | default "argocd admin export -n devtroncd > /argocd/backup.yaml" }} + resources: +{{ toYaml .Values.argocd_backup.resources | indent 14 }} + containers: + - name: gcloud-cli-for-cloud-storage-upload + image: {{ .Values.global.GCP.image | default "google/cloud-sdk:alpine" }} + volumeMounts: + - mountPath: /argocd + name: argocd-volume + env: + - name: GCS_BUCKET + valueFrom: + secretKeyRef: + name: devtron-gcp-backup-secret + key: GCS_BUCKET + {{- if .Values.global.GCP.CREDENTIALS.enabled }} + - name: gcp_credentials + valueFrom: + secretKeyRef: + name: devtron-gcp-backup-secret + key: GOOGLE_APPLICATION_CREDENTIALS + {{- end }} + imagePullPolicy: Always + resources: +{{ toYaml .Values.argocd_backup.resources | indent 14 }} + args: + - /bin/bash + - -c + {{- if $.Values.global.GCP.encryption.enabled }} + - set -ex; echo $gcp_credentials > /argocd/gcp_credentials.json ; gcloud auth activate-service-account --key-file=/argocd/gcp_credentials.json ; date1=$(date +%Y%m%d-%H%M); gpg -c --batch --passphrase {{ .Values.global.GCP.encryption.passphrase }} /argocd/backup.yaml; rm -rvf /argocd/backup.yaml; mv /argocd/backup.yaml.gpg /argocd/backup-$date1.yaml.gpg; gsutil cp /argocd/backup-$date1.yaml.gpg gs://$GCS_BUCKET/argocd/; + {{- else}} + - set -ex; echo $gcp_credentials > /argocd/gcp_credentials.json ; gcloud auth activate-service-account --key-file=/argocd/gcp_credentials.json ; date1=$(date +%Y%m%d-%H%M); mv /argocd/backup.yaml /argocd/backup-$date1.yaml; gsutil cp /argocd/backup-$date1.yaml gs://$GCS_BUCKET/argocd/; + {{- end }} + volumes: + - name: argocd-volume + emptyDir: {} + {{- if $.Values.global.nodeSelector }} + nodeselector: +{{ toYaml .Values.global.nodeSelector | indent 12 }} + {{- end }} + {{- if $.Values.global.tolerations }} + tolerations: +{{ toYaml .Values.global.tolerations | indent 12 }} + {{- end }} + restartPolicy: OnFailure + serviceAccountName: {{ .Values.argocd_backup.serviceAccountName }} +{{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-pvc.yaml b/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-pvc.yaml new file mode 100644 index 000000000..7bebeb58c --- /dev/null +++ b/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-pvc.yaml @@ -0,0 +1,154 @@ +{{- if .Values.global.PERSISTENCE.enabled }} +{{- if .Values.postgres_backup.enabled }} +{{- if semverCompare ">=1.21-0" .Capabilities.KubeVersion.GitVersion }} +apiVersion: batch/v1 +{{- else }} +apiVersion: batch/v1beta1 +{{- end }} +kind: CronJob +metadata: + name: postgres-app-backup-cronjob + namespace: devtroncd +spec: + timeZone: {{ .Values.global.timezone | default "UTC" }} + schedule: {{ .Values.global.schedule }} + jobTemplate: + spec: + template: + {{- if or $.Values.postgres_backup.labels $.Values.postgres_backup.annotations }} + metadata: + {{- if $.Values.postgres_backup.labels }} + labels: + {{ toYaml .Values.postgres_backup.labels | indent 4 }} + {{- end }} + {{- if $.Values.postgres_backup.annotations }} + annotations: + {{ toYaml .Values.postgres_backup.annotations | indent 4 }} + {{- end }} + {{- end }} + spec: + containers: + - name: postgres-app-backup-cronjob + image: {{ .Values.postgres_backup.postgresImage | default "postgres:12" }} + volumeMounts: + - mountPath: /postgres + name: psql-volume + env: + - name: PGPASSWORD + valueFrom: + secretKeyRef: + key: PG_PASSWORD + name: {{ .Values.postgres_backup.secretName }} + imagePullPolicy: Always + args: + - /bin/bash + - -c + {{- if $.Values.global.PERSISTENCE.encryption.enabled }} + - set -ex; mkdir -p /postgres/ ; date1=$(date +%Y%m%d-%H%M); pg_dumpall -h postgresql-postgresql.devtroncd -p 5432 -U postgres --no-privileges > /postgres/backup-$date1.tar ; gpg -c --batch --passphrase {{ .Values.global.PERSISTENCE.encryption.passphrase }} /postgres/backup-$date1.tar ; rm -rvf /postgres/backup-$date1.tar; + {{- else }} + - set -ex; mkdir -p /postgres/ ; date1=$(date +%Y%m%d-%H%M); pg_dumpall -h {{ .Values.postgres_backup.host | default "postgresql-postgresql.devtroncd" }} --exclude-database=clairv4 -p 5432 -U postgres --no-privileges > /postgres/backup-$date1.tar ; + {{- end }} + resources: +{{ toYaml .Values.postgres_backup.resources | indent 12 }} + volumes: + - name: psql-volume + persistentVolumeClaim: + {{- if and .Values.global.PERSISTENCE.enabled .Values.global.PERSISTENCE.existingClaim }} + claimName: {{ .Values.global.PERSISTENCE.existingClaim }} + {{- else }} + claimName: devtron-backup-pvc + {{- end }} + {{- if $.Values.global.nodeSelector }} + nodeselector: +{{ toYaml .Values.global.nodeSelector | indent 12 }} + {{- end }} + {{- if $.Values.global.tolerations }} + tolerations: +{{ toYaml .Values.global.tolerations | indent 12 }} + {{- end }} + restartPolicy: OnFailure +{{- end }} +{{- if and (.Values.global.PERSISTENCE.enabled) (not .Values.global.PERSISTENCE.existingClaim) }} +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: devtron-backup-pvc + namespace: devtroncd +spec: + {{- if .Values.global.PERSISTENCE.storageClass }} + storageClassName: {{ .Values.global.PERSISTENCE.storageClass }} + {{- end }} + accessModes: + - ReadWriteOnce + resources: + requests: + storage: {{ .Values.global.PERSISTENCE.size }} +{{- end }} +{{- if .Values.argocd_backup.enabled }} +--- +{{- if semverCompare ">=1.21-0" .Capabilities.KubeVersion.GitVersion }} +apiVersion: batch/v1 +{{- else }} +apiVersion: batch/v1beta1 +{{- end }} +kind: CronJob +metadata: + name: argocd-app-backup-job + namespace: devtroncd +spec: + timeZone: {{ .Values.global.timezone | default "UTC" }} + schedule: {{ .Values.global.schedule }} + jobTemplate: + spec: + template: + {{- if or $.Values.postgres_backup.labels $.Values.postgres_backup.annotations }} + metadata: + {{- if $.Values.postgres_backup.labels }} + labels: + {{ toYaml .Values.postgres_backup.labels | indent 4 }} + {{- end }} + {{- if $.Values.postgres_backup.annotations }} + annotations: + {{ toYaml .Values.postgres_backup.annotations | indent 4 }} + {{- end }} + {{- end }} + spec: + containers: + - name: argocd-app-backup-job + image: {{ .Values.argocd_backup.argocdImage | default "quay.io/argoproj/argocd:v2.4.0" }} + volumeMounts: + - mountPath: /argo-cd + name: argocd-volume + env: + imagePullPolicy: Always + args: + - /bin/bash + - -c + {{- if $.Values.global.PERSISTENCE.encryption.enabled }} + - set -ex; mkdir -p /argo-cd/ ; date1=$(date +%Y%m%d-%H%M); {{ .Values.argocd_backup.args | default "argocd admin export -n devtroncd" }} > /argo-cd/backup-$date1.tar ; gpg -c --batch --passphrase {{ .Values.global.PERSISTENCE.encryption.passphrase }} /argo-cd/backup-$date1.tar; rm -rvf /argo-cd/backup-$date1.tar; + {{- else }} + - set -ex; mkdir -p /argo-cd/ ; date1=$(date +%Y%m%d-%H%M); {{ .Values.argocd_backup.args | default "argocd admin export -n devtroncd" }} > /argo-cd/backup-$date1.tar ; + {{- end }} + resources: +{{ toYaml .Values.argocd_backup.resources | indent 12 }} + volumes: + - name: argocd-volume + persistentVolumeClaim: + {{- if and .Values.global.PERSISTENCE.enabled .Values.global.PERSISTENCE.existingClaim }} + claimName: {{ .Values.global.PERSISTENCE.existingClaim }} + {{- else }} + claimName: devtron-backup-pvc + {{- end }} + {{- if $.Values.global.nodeSelector }} + nodeselector: +{{ toYaml .Values.global.nodeSelector | indent 12 }} + {{- end }} + {{- if $.Values.global.tolerations }} + tolerations: +{{ toYaml .Values.global.tolerations | indent 12 }} + {{- end }} + restartPolicy: OnFailure + serviceAccountName: argocd-backup +{{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-s3.yaml b/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-s3.yaml new file mode 100644 index 000000000..45f559137 --- /dev/null +++ b/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-s3.yaml @@ -0,0 +1,225 @@ +{{- if .Values.global.S3.enabled }} +{{- if or .Values.postgres_backup.enabled .Values.argocd_backup.enabled }} +apiVersion: v1 +kind: Secret +metadata: + name: devtron-s3-backup-secret + namespace: devtroncd +type: Opaque +data: + S3_BUCKET_NAME: {{ .Values.global.S3.S3_BUCKET_NAME | b64enc }} + {{- if eq .Values.global.S3.NODE_ROLE "false" }} + AWS_ACCESS_KEY: {{ .Values.global.S3.S3_ACCESS_KEY | b64enc }} + AWS_SECRET_KEY: {{ .Values.global.S3.S3_SECRET_KEY | b64enc }} + {{- end }} + {{- if .Values.global.S3.CA_BUNDLE }} + AWS_CA_BUNDLE: {{ .Values.global.S3.CA_BUNDLE | b64enc }} + {{- end }} + AWS_REGION: {{ .Values.global.S3.AWS_REGION | default "us-east-1" | b64enc }} +{{- end }} +--- +{{- if .Values.postgres_backup.enabled }} +{{ if semverCompare ">=1.21-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: batch/v1 +{{ else -}} +apiVersion: batch/v1beta1 +{{ end -}} +kind: CronJob +metadata: + name: postgres-app-backup-cronjob + namespace: devtroncd +spec: + timeZone: {{ .Values.global.timezone | default "UTC" }} + schedule: "{{ .Values.global.schedule }}" + jobTemplate: + spec: + template: + {{- if or $.Values.postgres_backup.labels $.Values.postgres_backup.annotations }} + metadata: + {{- if $.Values.postgres_backup.labels }} + labels: + {{ toYaml .Values.postgres_backup.labels | indent 4 }} + {{- end }} + {{- if $.Values.postgres_backup.annotations }} + annotations: + {{ toYaml .Values.postgres_backup.annotations | indent 4 }} + {{- end }} + {{- end }} + spec: + initContainers: + - name: postgres-app-backup-cronjob + image: {{ .Values.postgres_backup.postgresImage | default "postgres:12" }} + volumeMounts: + - mountPath: /postgres + name: psql-volume + env: + - name: PGPASSWORD + valueFrom: + secretKeyRef: + key: PG_PASSWORD + name: {{ .Values.postgres_backup.secretName }} + imagePullPolicy: Always + args: + - /bin/bash + - -c + - set -ex; pg_dumpall -h {{ .Values.postgres_backup.host | default "postgresql-postgresql.devtroncd" }} --exclude-database=clairv4 -p 5432 -U postgres --no-privileges > /postgres/backup.tar; echo $? ; du -sh /postgres/backup.tar + resources: +{{ toYaml .Values.postgres_backup.resources | indent 14 }} + containers: + - name: aws-cli-for-s3-download + image: {{ .Values.global.S3.image | default "quay.io/devtron/k8s-utils:ubuntu-aws-cli-multi-arch-1" }} + volumeMounts: + - mountPath: /postgres + name: psql-volume + env: + {{- if eq .Values.global.S3.NODE_ROLE "false" }} + - name: AWS_ACCESS_KEY_ID + valueFrom: + secretKeyRef: + name: devtron-s3-backup-secret + key: AWS_ACCESS_KEY + - name: AWS_SECRET_ACCESS_KEY + valueFrom: + secretKeyRef: + name: devtron-s3-backup-secret + key: AWS_SECRET_KEY + {{- end }} + - name: S3_BUCKET + valueFrom: + secretKeyRef: + name: devtron-s3-backup-secret + key: S3_BUCKET_NAME + - name: AWS_DEFAULT_REGION + valueFrom: + secretKeyRef: + name: devtron-s3-backup-secret + key: AWS_REGION + {{- if .Values.global.S3.CA_BUNDLE }} + - name: CA_BUNDLE + valueFrom: + secretKeyRef: + name: devtron-s3-backup-secret + key: AWS_CA_BUNDLE + {{- end }} + imagePullPolicy: Always + resources: +{{ toYaml .Values.postgres_backup.resources | indent 14 }} + args: + - /bin/bash + - -c + - | +{{ include "devtron.postgresBackup" . | indent 6 }} + volumes: + - name: psql-volume + emptyDir: {} + {{- if $.Values.global.nodeSelector }} + nodeselector: +{{ toYaml .Values.global.nodeSelector | indent 12 }} + {{- end }} + {{- if $.Values.global.tolerations }} + tolerations: +{{ toYaml .Values.global.tolerations | indent 12 }} + {{- end }} + restartPolicy: OnFailure +{{- end }} +--- +{{- if .Values.argocd_backup.enabled }} +{{ if semverCompare ">=1.21-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: batch/v1 +{{ else -}} +apiVersion: batch/v1beta1 +{{ end -}} +kind: CronJob +metadata: + name: argocd-app-backup-cronjob + namespace: devtroncd +spec: + timeZone: {{ .Values.global.timezone | default "UTC" }} + schedule: "{{ .Values.global.schedule }}" + jobTemplate: + spec: + template: + {{- if or $.Values.postgres_backup.labels $.Values.postgres_backup.annotations }} + metadata: + {{- if $.Values.postgres_backup.labels }} + labels: + {{ toYaml .Values.postgres_backup.labels | indent 4 }} + {{- end }} + {{- if $.Values.postgres_backup.annotations }} + annotations: + {{ toYaml .Values.postgres_backup.annotations | indent 4 }} + {{- end }} + {{- end }} + spec: + initContainers: + - name: argocd-app-backup-job + image: {{ .Values.argocd_backup.argocdImage | default "quay.io/argoproj/argocd:v2.4.0" }} + volumeMounts: + - mountPath: /argocd + name: argocd-volume + imagePullPolicy: Always + args: + - /bin/bash + - -c + - {{ .Values.argocd_backup.args | default "argocd admin export -n devtroncd > /argocd/backup.yaml" }} + resources: +{{ toYaml .Values.argocd_backup.resources | indent 14 }} + containers: + - name: aws-cli-for-s3-upload + image: {{ .Values.global.S3.image | default "quay.io/devtron/k8s-utils:ubuntu-aws-cli-multi-arch-1" }} + volumeMounts: + - mountPath: /argocd + name: argocd-volume + env: + {{- if eq .Values.global.S3.NODE_ROLE "false" }} + - name: AWS_ACCESS_KEY_ID + valueFrom: + secretKeyRef: + name: devtron-s3-backup-secret + key: AWS_ACCESS_KEY + - name: AWS_SECRET_ACCESS_KEY + valueFrom: + secretKeyRef: + name: devtron-s3-backup-secret + key: AWS_SECRET_KEY + {{- end }} + - name: S3_BUCKET + valueFrom: + secretKeyRef: + name: devtron-s3-backup-secret + key: S3_BUCKET_NAME + - name: AWS_DEFAULT_REGION + valueFrom: + secretKeyRef: + name: devtron-s3-backup-secret + key: AWS_REGION + {{- if .Values.global.S3.CA_BUNDLE }} + - name: CA_BUNDLE + valueFrom: + secretKeyRef: + name: devtron-s3-backup-secret + key: AWS_CA_BUNDLE + {{- end }} + imagePullPolicy: Always + resources: +{{ toYaml .Values.argocd_backup.resources | indent 14 }} + args: + - /bin/bash + - -c + - | +{{ include "devtron.argocdBackup" . | indent 4 }} + volumes: + - name: argocd-volume + emptyDir: {} + {{- if $.Values.global.nodeSelector }} + nodeselector: +{{ toYaml .Values.global.nodeSelector | indent 12 }} + {{- end }} + {{- if $.Values.global.tolerations }} + tolerations: +{{ toYaml .Values.global.tolerations | indent 12 }} + {{- end }} + restartPolicy: OnFailure + serviceAccountName: {{ .Values.argocd_backup.serviceAccountName }} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/charts/devtron-utilities/charts/devtron-backups/templates/serviceaccount.yaml b/charts/devtron-utilities/charts/devtron-backups/templates/serviceaccount.yaml new file mode 100644 index 000000000..427a15f3a --- /dev/null +++ b/charts/devtron-utilities/charts/devtron-backups/templates/serviceaccount.yaml @@ -0,0 +1,51 @@ +{{- if .Values.argocd_backup.enabled }} +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/name: {{ .Values.argocd_backup.serviceAccountName }} + name: {{ .Values.argocd_backup.serviceAccountName }} + namespace: devtroncd +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app.kubernetes.io/name: {{ .Values.argocd_backup.serviceAccountName }} + name: {{ .Values.argocd_backup.serviceAccountName }} + namespace: devtroncd +rules: +- apiGroups: + - "" + resources: + - secrets + - configmaps + verbs: + - get + - list +- apiGroups: + - argoproj.io + resources: + - applications + - appprojects + - applicationsets + verbs: + - get + - list + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app.kubernetes.io/name: {{ .Values.argocd_backup.serviceAccountName }} + name: {{ .Values.argocd_backup.serviceAccountName }} + namespace: devtroncd +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ .Values.argocd_backup.serviceAccountName }} +subjects: +- kind: ServiceAccount + name: {{ .Values.argocd_backup.serviceAccountName }} +{{- end }} \ No newline at end of file diff --git a/charts/devtron-utilities/charts/devtron-backups/values.yaml b/charts/devtron-utilities/charts/devtron-backups/values.yaml new file mode 100644 index 000000000..a897ef0ab --- /dev/null +++ b/charts/devtron-utilities/charts/devtron-backups/values.yaml @@ -0,0 +1,110 @@ +global: + # Twice a day + schedule: "0 */12 * * *" + # devtron-backups + S3: + # give the endpoint in case of non AWS storages with s3 protocol + enabled: false + S3_BUCKET_NAME: "" + S3_ACCESS_KEY: "" + S3_SECRET_KEY: "" + AWS_REGION: "" + S3_ENDPOINT: "" + CA_BUNDLE: "" + # CA_BUNDLE: "-----BEGIN CERTIFICATE-----\nMIIDcDfghjklcvbnm,tryupE+mz30g=\n-----END CERTIFICATE-----" + # set true if node has access of buckets + #defaults to true, set false and specify S3_ACCESS_KEY & S3_SECRET_KEY if node does not have bucket access + NODE_ROLE: "true" + # passphrase used to encrypt/decrypt the file (encryption is done by gpg) + encryption: + enabled: false + passphrase: "" + # image: quay.io/devtron/k8s-utils:ubuntu-aws-cli #default amd + # image: quay.io/devtron/k8s-utils:0b9f5ba5-395-11405 #arm + AZURE: + enabled: false + AZURE_BLOB_ACCOUNT_NAME: "" + AZURE_ACCOUNT_KEY: "" + AZURE_BLOB_CONTAINER_FOR_POSTGRES: "" + AZURE_BLOB_CONTAINER_FOR_ARGOCD: "" + encryption: + enabled: false # Recommended + passphrase: "" # Required if encryption is enabled + + # image: quay.io/devtron/k8s-utils:az-cli-ubuntu #amd + GCP: + enabled: false + GCS_BUCKET_NAME: "" # Required if GCP is enabled + CREDENTIALS: # Optional. Use only if in case node doesn't have permission to push over GCS. + enabled: false + # Only base64 Encoded JSON CREDENTIALS allowed. Example shown below. + # GCP_CREDENTIALS_JSON: "eyJ0eXBlIjogInNlcnZpY2VfYWNjb3VudCIsInByb2plY3RfaWQiOiAiPHlvdXItcHJvamVjdC1pZD4iLCJwcml2YXRlX2tleV9pZCI6ICI8eW91ci1wcml2YXRlLWtleS1pZD4iLCJwcml2YXRlX2tleSI6ICI8eW91ci1wcml2YXRlLWtleT4iLCJjbGllbnRfZW1haWwiOiAiPHlvdXItY2xpZW50LWVtYWlsPiIsImNsaWVudF9pZCI6ICI8eW91ci1jbGllbnQtaWQ+IiwiYXV0aF91cmkiOiAiaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tL28vb2F1dGgyL2F1dGgiLCJ0b2tlbl91cmkiOiAiaHR0cHM6Ly9vYXV0aDIuZ29vZ2xlYXBpcy5jb20vdG9rZW4iLCJhdXRoX3Byb3ZpZGVyX3g1MDlfY2VydF91cmwiOiAiaHR0cHM6Ly93d3cuZ29vZ2xlYXBpcy5jb20vb2F1dGgyL3YxL2NlcnRzIiwiY2xpZW50X3g1MDlfY2VydF91cmwiOiAiPHlvdXItY2xpZW50LWNlcnQtdXJsPiJ9Cg==" + GCP_CREDENTIALS_JSON: "" + + encryption: + enabled: false # Recommended + passphrase: "" # Required if encryption is enabled + # image: google/cloud-sdk:alpine # default amd + + PERSISTENCE: + enabled: false + existingClaim: "" + # size: 30Gi # Required if existingClaim is not used + storageClass: "" # Required if existingClaim is not used + encryption: + enabled: false # Recommended + passphrase: "" # Required if encryption is enabled + + # Taints and tolerations for both backups + tolerations: [] + # - key: "example-key" + # operator: "Equal" + # value: "example-value" + # effect: "NoSchedule" + nodeSelector: {} + # kubernetes.io/hostname: "worker-node-1" + + timezone: "" #Set the timezone for scheduling the cronJob. # default UTC + +argocdversion: v2 + +postgres_backup: + # Reference to secret which as postgresql password in PG_PASSWORD key + secretName: "devtron-secret" + enabled: true + resources: + requests: + cpu: 100m + memory: 100Mi + limits: + cpu: 100m + memory: 100Mi + labels: {} + # key: "example-value" + annotations: {} + # key: "example-value" + + # postgresImage: postgres:14 + # host: "postgresql-custom.devtroncd" + +argocd_backup: + serviceAccountName: "argocd-backup" + enabled: false + resources: + requests: + cpu: 100m + memory: 100Mi + limits: + cpu: 100m + memory: 100Mi + labels: {} + # key: "example-value" + annotations: {} + # key: "example-value" + + # argocdImage: quay.io/argoproj/argocd:v2.4.0 + # args: "argocd admin export -n devtroncd > /argocd/backup.yaml" + + # argocdImage: argoproj/argocd:v1.8.1 #(image for argo-V1) + # args: argocd-util export --namespace devtroncd > /argocd/backup.yaml; #(argo-V1) + diff --git a/charts/devtron-utilities/charts/devtron-generic-helm/Chart.yaml b/charts/devtron-utilities/charts/devtron-generic-helm/Chart.yaml new file mode 100644 index 000000000..a7ae16ac9 --- /dev/null +++ b/charts/devtron-utilities/charts/devtron-generic-helm/Chart.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +appVersion: 0.1.0 +description: Chart to deploy any YAML file +maintainers: +- email: prashant@devtron.ai + name: Prashant +name: devtron-generic-helm +version: 0.10.1 diff --git a/charts/devtron-utilities/charts/devtron-generic-helm/README.md b/charts/devtron-utilities/charts/devtron-generic-helm/README.md new file mode 100644 index 000000000..b2cb286fe --- /dev/null +++ b/charts/devtron-utilities/charts/devtron-generic-helm/README.md @@ -0,0 +1,8 @@ +# Devtron helm chart to deploy any group of resources + +> Helm chart to deploy any resource on the cluster + +## Usage + +**The intended use of this chart is to use deploy group of resources in the cluster +each resource should be entered separately as element of array.** diff --git a/charts/devtron-utilities/charts/devtron-generic-helm/templates/generic.yaml b/charts/devtron-utilities/charts/devtron-generic-helm/templates/generic.yaml new file mode 100644 index 000000000..8c9d6f159 --- /dev/null +++ b/charts/devtron-utilities/charts/devtron-generic-helm/templates/generic.yaml @@ -0,0 +1,4 @@ +{{- range .Values.data }} +--- +{{ toYaml . }} +{{- end -}} diff --git a/charts/devtron-utilities/charts/devtron-generic-helm/values.yaml b/charts/devtron-utilities/charts/devtron-generic-helm/values.yaml new file mode 100644 index 000000000..385bb8e5f --- /dev/null +++ b/charts/devtron-utilities/charts/devtron-generic-helm/values.yaml @@ -0,0 +1,37 @@ +data: +- apiVersion: v1 + kind: Service + metadata: + annotations: + labels: + app: sample-metrics-app + name: sample-metrics-app + namespace: default + spec: + ports: + - name: web + port: 80 + protocol: TCP + targetPort: 8080 + selector: + app: sample-metrics-app + sessionAffinity: None + type: ClusterIP +- apiVersion: v1 + kind: Service + metadata: + annotations: + labels: + app: sample-metrics-app + name: sample-metrics-app + namespace: default + spec: + ports: + - name: web + port: 80 + protocol: TCP + targetPort: 8080 + selector: + app: sample-metrics-app + sessionAffinity: None + type: ClusterIP diff --git a/charts/devtron-utilities/charts/holmes/.helmignore b/charts/devtron-utilities/charts/holmes/.helmignore new file mode 100644 index 000000000..0e8a0eb36 --- /dev/null +++ b/charts/devtron-utilities/charts/holmes/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/devtron-utilities/charts/holmes/Chart.yaml b/charts/devtron-utilities/charts/holmes/Chart.yaml new file mode 100644 index 000000000..aa19ff861 --- /dev/null +++ b/charts/devtron-utilities/charts/holmes/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +appVersion: 0.8.1 +description: HolmesGPT Helm chart for Kubernetes +name: holmes +type: application +version: 0.8.1 diff --git a/charts/devtron-utilities/charts/holmes/templates/holmes.yaml b/charts/devtron-utilities/charts/holmes/templates/holmes.yaml new file mode 100644 index 000000000..1f4b16508 --- /dev/null +++ b/charts/devtron-utilities/charts/holmes/templates/holmes.yaml @@ -0,0 +1,101 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ .Release.Name }}-holmes + namespace: {{ .Release.Namespace }} + labels: + app: holmes +spec: + replicas: 1 + selector: + matchLabels: + app: holmes + template: + metadata: + labels: + app: holmes + spec: + {{- if .Values.customServiceAccountName }} + serviceAccountName: {{ .Values.customServiceAccountName }} + {{ else }} + serviceAccountName: {{ .Release.Name }}-holmes-service-account + {{- end }} + {{- if .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml .Values.imagePullSecrets | nindent 6 }} + {{- end }} + {{- if .Values.affinity }} + affinity: {{ toYaml .Values.affinity | nindent 8 }} + {{- end }} + containers: + - name: holmes + image: "{{ .Values.registry }}/{{ .Values.image }}" + imagePullPolicy: Always + command: ["python3", "-u", "server.py"] + env: + - name: LOG_LEVEL + value: {{ .Values.logLevel }} + {{ if .Values.certificate -}} + - name: CERTIFICATE + value: {{ .Values.certificate }} + {{- end }} + {{ if .Values.enablePostProcessing -}} + - name: HOLMES_POST_PROCESSING_PROMPT + value: {{ .Values.postProcessingPrompt }} + {{- end }} + {{- if .Values.additionalEnvVars -}} + {{ toYaml .Values.additionalEnvVars | nindent 10 }} + {{- end }} + {{- if .Values.additional_env_vars -}} + {{ toYaml .Values.additional_env_vars | nindent 10 }} + {{- end }} + lifecycle: + preStop: + exec: + command: ["bash", "-c", "kill -SIGINT 1"] + volumeMounts: + - name: playbooks-config-secret + mountPath: /etc/robusta/config + - name: custom-toolsets-configmap + mountPath: /etc/holmes/config + {{- if .Values.additionalVolumeMounts -}} + {{ toYaml .Values.additionalVolumeMounts | nindent 10 }} + {{- end }} + resources: + requests: + cpu: {{ .Values.resources.requests.cpu }} + memory: {{ .Values.resources.requests.memory }} + limits: + memory: {{ .Values.resources.limits.memory }} + {{ if .Values.resources.limits.cpu }}cpu: {{ .Values.resources.limits.cpu | quote }}{{ end }} + {{- if .Values.tolerations }} + tolerations: {{ toYaml .Values.tolerations | nindent 8 }} + {{- end }} + volumes: + - name: playbooks-config-secret + secret: + secretName: robusta-playbooks-config-secret + optional: true + - name: custom-toolsets-configmap + configMap: + name: custom-toolsets-configmap + optional: true + {{- if .Values.additionalVolumes -}} + {{ toYaml .Values.additionalVolumes | nindent 8 }} + {{- end }} +--- +apiVersion: v1 +kind: Service +metadata: + name: {{ .Release.Name }}-holmes + namespace: {{ .Release.Namespace }} + labels: + app: holmes +spec: + selector: + app: holmes + ports: + - name: http + protocol: TCP + port: 80 + targetPort: 5050 diff --git a/charts/devtron-utilities/charts/holmes/templates/holmesgpt-service-account.yaml b/charts/devtron-utilities/charts/holmes/templates/holmesgpt-service-account.yaml new file mode 100644 index 000000000..baee4e95f --- /dev/null +++ b/charts/devtron-utilities/charts/holmes/templates/holmesgpt-service-account.yaml @@ -0,0 +1,232 @@ +{{- if .Values.createServiceAccount }} +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ .Release.Name }}-holmes-cluster-role + namespace : {{ .Release.Namespace }} +rules: + {{- if .Values.customClusterRoleRules }} +{{ toYaml .Values.customClusterRoleRules | indent 2 }} + {{- end }} + - apiGroups: + - "storage.k8s.io" + resources: + - storageclasses + verbs: + - list + - get + - watch + - apiGroups: + - "metrics.k8s.io" + resources: + - pods + - nodes + verbs: + - get + - list + - apiGroups: + - "" + resources: + - configmaps + - daemonsets + - deployments + - events + - namespaces + - persistentvolumes + - persistentvolumeclaims + - pods + - pods/status + - pods/log + - replicasets + - replicationcontrollers + - services + - serviceaccounts + - endpoints + verbs: + - get + - list + - watch + + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch + + - apiGroups: + - "apiregistration.k8s.io" + resources: + - apiservices + verbs: + - get + - list + + - apiGroups: + - "rbac.authorization.k8s.io" + resources: + - clusterroles + - clusterrolebindings + verbs: + - get + - list + - watch + - apiGroups: + - "autoscaling" + resources: + - horizontalpodautoscalers + verbs: + - get + - list + - watch + + - apiGroups: + - apps + resources: + - daemonsets + - deployments + - deployments/scale + - replicasets + - replicasets/scale + - statefulsets + verbs: + - get + - list + - watch + + - apiGroups: + - extensions + resources: + - daemonsets + - deployments + - deployments/scale + - ingresses + - replicasets + - replicasets/scale + - replicationcontrollers/scale + verbs: + - get + - list + - watch + + - apiGroups: + - batch + resources: + - cronjobs + - jobs + verbs: + - get + - list + - watch + + - apiGroups: + - "events.k8s.io" + resources: + - events + verbs: + - get + - list + + - apiGroups: + - networking.k8s.io + resources: + - ingresses + - networkpolicies + verbs: + - get + - list + - watch + - apiGroups: + - autoscaling + resources: + - horizontalpodautoscalers + verbs: + - get + - list + - apiGroups: + - "policy" + resources: + - poddisruptionbudgets + - podsecuritypolicies + verbs: + - get + - list + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + - clusterrolebindings + - roles + - rolebindings + verbs: + - get + - list +{{- if .Values.openshift }} + - apiGroups: + - apps.openshift.io + resources: + - deploymentconfigs + verbs: + - get + - list + - watch +{{- end }} + # Prometheus CRDs + - apiGroups: + - monitoring.coreos.com + resources: + - alertmanagers + - alertmanagers/finalizers + - alertmanagers/status + - alertmanagerconfigs + - prometheuses + - prometheuses/finalizers + - prometheuses/status + - prometheusagents + - prometheusagents/finalizers + - prometheusagents/status + - thanosrulers + - thanosrulers/finalizers + - thanosrulers/status + - scrapeconfigs + - servicemonitors + - podmonitors + - probes + - prometheusrules + verbs: + - get + - list + - watch + +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ .Release.Name }}-holmes-service-account + namespace: {{ .Release.Namespace }} + {{- if .Values.serviceAccount.annotations }} + annotations: + {{- with .Values.serviceAccount.annotations }} + {{- toYaml . | nindent 4}} + {{- end }} + {{- end }} +{{- if .Values.serviceAccount.imagePullSecrets }} +imagePullSecrets: +{{- toYaml .Values.serviceAccount.imagePullSecrets | nindent 2}} +{{- end }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ .Release.Name }}-holmes-cluster-role-binding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ .Release.Name }}-holmes-cluster-role +subjects: + - kind: ServiceAccount + name: {{ .Release.Name }}-holmes-service-account + namespace: {{ .Release.Namespace }} +{{- end }} \ No newline at end of file diff --git a/charts/devtron-utilities/charts/holmes/templates/toolset-config.yaml b/charts/devtron-utilities/charts/holmes/templates/toolset-config.yaml new file mode 100644 index 000000000..06875aa01 --- /dev/null +++ b/charts/devtron-utilities/charts/holmes/templates/toolset-config.yaml @@ -0,0 +1,10 @@ +{{- if .Values.toolsets | not | empty }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: custom-toolsets-configmap + namespace: {{ .Release.Namespace }} +data: + custom_toolset.yaml: |- + toolsets: {{ toYaml .Values.toolsets | nindent 6 }} +{{- end }} diff --git a/charts/devtron-utilities/charts/holmes/values.yaml b/charts/devtron-utilities/charts/holmes/values.yaml new file mode 100644 index 000000000..bc062ea01 --- /dev/null +++ b/charts/devtron-utilities/charts/holmes/values.yaml @@ -0,0 +1,50 @@ +certificate: "" # base64 encoded +logLevel: INFO + + +additionalEnvVars: [] +additional_env_vars: [] +imagePullSecrets: [] + +image: holmes:0.8.1 +registry: us-central1-docker.pkg.dev/genuine-flight-317411/devel + +enableAccountsCreate: true + +createServiceAccount: true +customServiceAccountName: "" + +customClusterRoleRules: [] + +enablePostProcessing: false +postProcessingPrompt: "builtin://generic_post_processing.jinja2" +openshift: false + +affinity: {} + +tolerations: [] + +serviceAccount: + imagePullSecrets: [] + annotations: {} + +toolsets: + kubernetes/core: + enabled: true + kubernetes/logs: + enabled: true + robusta: + enabled: true + internet: + enabled: true + + +resources: + requests: + cpu: 100m + memory: 1024Mi + limits: + memory: 1024Mi + +additionalVolumes: [] +additionalVolumeMounts: [] diff --git a/charts/devtron-utilities/charts/ingress-nginx/.helmignore b/charts/devtron-utilities/charts/ingress-nginx/.helmignore new file mode 100644 index 000000000..109b40811 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +__snapshot__ diff --git a/charts/devtron-utilities/charts/ingress-nginx/Chart.yaml b/charts/devtron-utilities/charts/ingress-nginx/Chart.yaml new file mode 100644 index 000000000..11000f43d --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/Chart.yaml @@ -0,0 +1,24 @@ +annotations: + artifacthub.io/changes: | + - 'CI: Fix chart testing. (#12258)' + - Update Ingress-Nginx version controller-v1.12.0 + artifacthub.io/prerelease: "false" +apiVersion: v2 +appVersion: 1.12.0 +description: Ingress controller for Kubernetes using NGINX as a reverse proxy and + load balancer +home: https://github.com/kubernetes/ingress-nginx +icon: https://upload.wikimedia.org/wikipedia/commons/thumb/c/c5/Nginx_logo.svg/500px-Nginx_logo.svg.png +keywords: +- ingress +- nginx +kubeVersion: '>=1.21.0-0' +maintainers: +- name: cpanato +- name: Gacko +- name: strongjz +- name: tao12345666333 +name: ingress-nginx +sources: +- https://github.com/kubernetes/ingress-nginx +version: 4.12.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/OWNERS b/charts/devtron-utilities/charts/ingress-nginx/OWNERS new file mode 100644 index 000000000..428474f63 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/OWNERS @@ -0,0 +1,4 @@ +# See the OWNERS docs: https://www.kubernetes.dev/docs/guide/owners + +labels: +- area/helm diff --git a/charts/devtron-utilities/charts/ingress-nginx/README.md b/charts/devtron-utilities/charts/ingress-nginx/README.md new file mode 100644 index 000000000..04b750fba --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/README.md @@ -0,0 +1,564 @@ +# ingress-nginx + +[ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer + +![Version: 4.12.0](https://img.shields.io/badge/Version-4.12.0-informational?style=flat-square) ![AppVersion: 1.12.0](https://img.shields.io/badge/AppVersion-1.12.0-informational?style=flat-square) + +To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources. + +This chart bootstraps an ingress-nginx deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + +## Requirements + +Kubernetes: `>=1.21.0-0` + +## Get Repo Info + +```console +helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx +helm repo update +``` + +## Install Chart + +**Important:** only helm3 is supported + +```console +helm install [RELEASE_NAME] ingress-nginx/ingress-nginx +``` + +The command deploys ingress-nginx on the Kubernetes cluster in the default configuration. + +_See [configuration](#configuration) below._ + +_See [helm install](https://helm.sh/docs/helm/helm_install/) for command documentation._ + +## Uninstall Chart + +```console +helm uninstall [RELEASE_NAME] +``` + +This removes all the Kubernetes components associated with the chart and deletes the release. + +_See [helm uninstall](https://helm.sh/docs/helm/helm_uninstall/) for command documentation._ + +## Upgrading Chart + +```console +helm upgrade [RELEASE_NAME] [CHART] --install +``` + +_See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documentation._ + +### Migrating from stable/nginx-ingress + +There are two main ways to migrate a release from `stable/nginx-ingress` to `ingress-nginx/ingress-nginx` chart: + +1. For Nginx Ingress controllers used for non-critical services, the easiest method is to [uninstall](#uninstall-chart) the old release and [install](#install-chart) the new one +1. For critical services in production that require zero-downtime, you will want to: + 1. [Install](#install-chart) a second Ingress controller + 1. Redirect your DNS traffic from the old controller to the new controller + 1. Log traffic from both controllers during this changeover + 1. [Uninstall](#uninstall-chart) the old controller once traffic has fully drained from it + +Note that there are some different and upgraded configurations between the two charts, described by Rimas Mocevicius from JFrog in the "Upgrading to ingress-nginx Helm chart" section of [Migrating from Helm chart nginx-ingress to ingress-nginx](https://rimusz.net/migrating-to-ingress-nginx). As the `ingress-nginx/ingress-nginx` chart continues to update, you will want to check current differences by running [helm configuration](#configuration) commands on both charts. + +## Configuration + +See [Customizing the Chart Before Installing](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing). To see all configurable options with detailed comments, visit the chart's [values.yaml](./values.yaml), or run these configuration commands: + +```console +helm show values ingress-nginx/ingress-nginx +``` + +### PodDisruptionBudget + +Note that the PodDisruptionBudget resource will only be defined if the replicaCount is greater than one, +else it would make it impossible to evacuate a node. See [gh issue #7127](https://github.com/helm/charts/issues/7127) for more info. + +### Prometheus Metrics + +The Ingress-Nginx Controller can export Prometheus metrics, by setting `controller.metrics.enabled` to `true`. + +You can add Prometheus annotations to the metrics service using `controller.metrics.service.annotations`. +Alternatively, if you use the Prometheus Operator, you can enable ServiceMonitor creation using `controller.metrics.serviceMonitor.enabled`. And set `controller.metrics.serviceMonitor.additionalLabels.release="prometheus"`. "release=prometheus" should match the label configured in the prometheus servicemonitor ( see `kubectl get servicemonitor prometheus-kube-prom-prometheus -oyaml -n prometheus`) + +### ingress-nginx nginx\_status page/stats server + +Previous versions of this chart had a `controller.stats.*` configuration block, which is now obsolete due to the following changes in Ingress-Nginx Controller: + +- In [0.16.1](https://github.com/kubernetes/ingress-nginx/blob/main/Changelog.md#0161), the vts (virtual host traffic status) dashboard was removed +- In [0.23.0](https://github.com/kubernetes/ingress-nginx/blob/main/Changelog.md#0230), the status page at port 18080 is now a unix socket webserver only available at localhost. + You can use `curl --unix-socket /tmp/nginx-status-server.sock http://localhost/nginx_status` inside the controller container to access it locally, or use the snippet from [nginx-ingress changelog](https://github.com/kubernetes/ingress-nginx/blob/main/Changelog.md#0230) to re-enable the http server + +### ExternalDNS Service Configuration + +Add an [ExternalDNS](https://github.com/kubernetes-sigs/external-dns) annotation to the LoadBalancer service: + +```yaml +controller: + service: + annotations: + external-dns.alpha.kubernetes.io/hostname: kubernetes-example.com. +``` + +### AWS L7 ELB with SSL Termination + +Annotate the controller as shown in the [nginx-ingress l7 patch](https://github.com/kubernetes/ingress-nginx/blob/ab3a789caae65eec4ad6e3b46b19750b481b6bce/deploy/aws/l7/service-l7.yaml): + +```yaml +controller: + service: + targetPorts: + http: http + https: http + annotations: + service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:XX-XXXX-X:XXXXXXXXX:certificate/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX + service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "http" + service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" + service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: '3600' +``` + +### Additional Internal Load Balancer + +This setup is useful when you need both external and internal load balancers but don't want to have multiple ingress controllers and multiple ingress objects per application. + +By default, the ingress object will point to the external load balancer address, but if correctly configured, you can make use of the internal one if the URL you are looking up resolves to the internal load balancer's URL. + +You'll need to set both the following values: + +`controller.service.internal.enabled` +`controller.service.internal.annotations` + +If one of them is missing the internal load balancer will not be deployed. Example you may have `controller.service.internal.enabled=true` but no annotations set, in this case no action will be taken. + +`controller.service.internal.annotations` varies with the cloud service you're using. + +Example for AWS: + +```yaml +controller: + service: + internal: + enabled: true + annotations: + # Create internal NLB + service.beta.kubernetes.io/aws-load-balancer-scheme: "internal" + # Create internal ELB(Deprecated) + # service.beta.kubernetes.io/aws-load-balancer-internal: "true" + # Any other annotation can be declared here. +``` + +Example for GCE: + +```yaml +controller: + service: + internal: + enabled: true + annotations: + # Create internal LB. More information: https://cloud.google.com/kubernetes-engine/docs/how-to/internal-load-balancing + # For GKE versions 1.17 and later + networking.gke.io/load-balancer-type: "Internal" + # For earlier versions + # cloud.google.com/load-balancer-type: "Internal" + + # Any other annotation can be declared here. +``` + +Example for Azure: + +```yaml +controller: + service: + annotations: + # Create internal LB + service.beta.kubernetes.io/azure-load-balancer-internal: "true" + # Any other annotation can be declared here. +``` + +Example for Oracle Cloud Infrastructure: + +```yaml +controller: + service: + annotations: + # Create internal LB + service.beta.kubernetes.io/oci-load-balancer-internal: "true" + # Any other annotation can be declared here. +``` + +The load balancer annotations of more cloud service providers can be found: [Internal load balancer](https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer). + +An use case for this scenario is having a split-view DNS setup where the public zone CNAME records point to the external balancer URL while the private zone CNAME records point to the internal balancer URL. This way, you only need one ingress kubernetes object. + +Optionally you can set `controller.service.loadBalancerIP` if you need a static IP for the resulting `LoadBalancer`. + +### Ingress Admission Webhooks + +With nginx-ingress-controller version 0.25+, the Ingress-Nginx Controller pod exposes an endpoint that will integrate with the `validatingwebhookconfiguration` Kubernetes feature to prevent bad ingress from being added to the cluster. +**This feature is enabled by default since 0.31.0.** + +With nginx-ingress-controller in 0.25.* work only with kubernetes 1.14+, 0.26 fix [this issue](https://github.com/kubernetes/ingress-nginx/pull/4521) + +#### How the Chart Configures the Hooks +A validating and configuration requires the endpoint to which the request is sent to use TLS. It is possible to set up custom certificates to do this, but in most cases, a self-signed certificate is enough. The setup of this component requires some more complex orchestration when using helm. The steps are created to be idempotent and to allow turning the feature on and off without running into helm quirks. + +1. A pre-install hook provisions a certificate into the same namespace using a format compatible with provisioning using end user certificates. If the certificate already exists, the hook exits. +2. The Ingress-Nginx Controller pod is configured to use a TLS proxy container, which will load that certificate. +3. Validating and Mutating webhook configurations are created in the cluster. +4. A post-install hook reads the CA from the secret created by step 1 and patches the Validating and Mutating webhook configurations. This process will allow a custom CA provisioned by some other process to also be patched into the webhook configurations. The chosen failure policy is also patched into the webhook configurations + +#### Alternatives +It should be possible to use [cert-manager/cert-manager](https://github.com/cert-manager/cert-manager) if a more complete solution is required. + +You can enable automatic self-signed TLS certificate provisioning via cert-manager by setting the `controller.admissionWebhooks.certManager.enabled` value to true. + +Please ensure that cert-manager is correctly installed and configured. + +### Helm Error When Upgrading: spec.clusterIP: Invalid value: "" + +If you are upgrading this chart from a version between 0.31.0 and 1.2.2 then you may get an error like this: + +```console +Error: UPGRADE FAILED: Service "?????-controller" is invalid: spec.clusterIP: Invalid value: "": field is immutable +``` + +Detail of how and why are in [this issue](https://github.com/helm/charts/pull/13646) but to resolve this you can set `xxxx.service.omitClusterIP` to `true` where `xxxx` is the service referenced in the error. + +As of version `1.26.0` of this chart, by simply not providing any clusterIP value, `invalid: spec.clusterIP: Invalid value: "": field is immutable` will no longer occur since `clusterIP: ""` will not be rendered. + +### Pod Security Admission + +You can use Pod Security Admission by applying labels to the `ingress-nginx` namespace as instructed by the [documentation](https://kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-namespace-labels). + +Example: + +```yaml +apiVersion: v1 +kind: Namespace +metadata: + name: ingress-nginx + labels: + kubernetes.io/metadata.name: ingress-nginx + name: ingress-nginx + pod-security.kubernetes.io/enforce: restricted + pod-security.kubernetes.io/enforce-version: v1.31 +``` + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| commonLabels | object | `{}` | | +| controller.addHeaders | object | `{}` | Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers | +| controller.admissionWebhooks.annotations | object | `{}` | | +| controller.admissionWebhooks.certManager.admissionCert.duration | string | `""` | | +| controller.admissionWebhooks.certManager.enabled | bool | `false` | | +| controller.admissionWebhooks.certManager.rootCert.duration | string | `""` | | +| controller.admissionWebhooks.certificate | string | `"/usr/local/certificates/cert"` | | +| controller.admissionWebhooks.createSecretJob.name | string | `"create"` | | +| controller.admissionWebhooks.createSecretJob.resources | object | `{}` | | +| controller.admissionWebhooks.createSecretJob.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for secret creation containers | +| controller.admissionWebhooks.enabled | bool | `true` | | +| controller.admissionWebhooks.extraEnvs | list | `[]` | Additional environment variables to set | +| controller.admissionWebhooks.failurePolicy | string | `"Fail"` | Admission Webhook failure policy to use | +| controller.admissionWebhooks.key | string | `"/usr/local/certificates/key"` | | +| controller.admissionWebhooks.labels | object | `{}` | Labels to be added to admission webhooks | +| controller.admissionWebhooks.name | string | `"admission"` | | +| controller.admissionWebhooks.namespaceSelector | object | `{}` | | +| controller.admissionWebhooks.objectSelector | object | `{}` | | +| controller.admissionWebhooks.patch.enabled | bool | `true` | | +| controller.admissionWebhooks.patch.image.digest | string | `"sha256:aaafd456bda110628b2d4ca6296f38731a3aaf0bf7581efae824a41c770a8fc4"` | | +| controller.admissionWebhooks.patch.image.image | string | `"ingress-nginx/kube-webhook-certgen"` | | +| controller.admissionWebhooks.patch.image.pullPolicy | string | `"IfNotPresent"` | | +| controller.admissionWebhooks.patch.image.tag | string | `"v1.5.0"` | | +| controller.admissionWebhooks.patch.labels | object | `{}` | Labels to be added to patch job resources | +| controller.admissionWebhooks.patch.networkPolicy.enabled | bool | `false` | Enable 'networkPolicy' or not | +| controller.admissionWebhooks.patch.nodeSelector."kubernetes.io/os" | string | `"linux"` | | +| controller.admissionWebhooks.patch.podAnnotations | object | `{}` | | +| controller.admissionWebhooks.patch.priorityClassName | string | `""` | Provide a priority class name to the webhook patching job # | +| controller.admissionWebhooks.patch.rbac | object | `{"create":true}` | Admission webhook patch job RBAC | +| controller.admissionWebhooks.patch.rbac.create | bool | `true` | Create RBAC or not | +| controller.admissionWebhooks.patch.securityContext | object | `{}` | Security context for secret creation & webhook patch pods | +| controller.admissionWebhooks.patch.serviceAccount | object | `{"automountServiceAccountToken":true,"create":true,"name":""}` | Admission webhook patch job service account | +| controller.admissionWebhooks.patch.serviceAccount.automountServiceAccountToken | bool | `true` | Auto-mount service account token or not | +| controller.admissionWebhooks.patch.serviceAccount.create | bool | `true` | Create a service account or not | +| controller.admissionWebhooks.patch.serviceAccount.name | string | `""` | Custom service account name | +| controller.admissionWebhooks.patch.tolerations | list | `[]` | | +| controller.admissionWebhooks.patchWebhookJob.name | string | `"patch"` | | +| controller.admissionWebhooks.patchWebhookJob.resources | object | `{}` | | +| controller.admissionWebhooks.patchWebhookJob.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for webhook patch containers | +| controller.admissionWebhooks.port | int | `8443` | | +| controller.admissionWebhooks.service.annotations | object | `{}` | | +| controller.admissionWebhooks.service.externalIPs | list | `[]` | | +| controller.admissionWebhooks.service.loadBalancerSourceRanges | list | `[]` | | +| controller.admissionWebhooks.service.servicePort | int | `443` | | +| controller.admissionWebhooks.service.type | string | `"ClusterIP"` | | +| controller.affinity | object | `{}` | Affinity and anti-affinity rules for server scheduling to nodes # Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity # | +| controller.allowSnippetAnnotations | bool | `false` | This configuration defines if Ingress Controller should allow users to set their own *-snippet annotations, otherwise this is forbidden / dropped when users add those annotations. Global snippets in ConfigMap are still respected | +| controller.annotations | object | `{}` | Annotations to be added to the controller Deployment or DaemonSet # | +| controller.autoscaling.annotations | object | `{}` | | +| controller.autoscaling.behavior | object | `{}` | | +| controller.autoscaling.enabled | bool | `false` | | +| controller.autoscaling.maxReplicas | int | `11` | | +| controller.autoscaling.minReplicas | int | `1` | | +| controller.autoscaling.targetCPUUtilizationPercentage | int | `50` | | +| controller.autoscaling.targetMemoryUtilizationPercentage | int | `50` | | +| controller.autoscalingTemplate | list | `[]` | | +| controller.config | object | `{}` | Global configuration passed to the ConfigMap consumed by the controller. Values may contain Helm templates. Ref.: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/ | +| controller.configAnnotations | object | `{}` | Annotations to be added to the controller config configuration configmap. | +| controller.configMapNamespace | string | `""` | Allows customization of the configmap / nginx-configmap namespace; defaults to $(POD_NAMESPACE) | +| controller.containerName | string | `"controller"` | Configures the controller container name | +| controller.containerPort | object | `{"http":80,"https":443}` | Configures the ports that the nginx-controller listens on | +| controller.containerSecurityContext | object | `{}` | Security context for controller containers | +| controller.customTemplate.configMapKey | string | `""` | | +| controller.customTemplate.configMapName | string | `""` | | +| controller.disableLeaderElection | bool | `false` | This configuration disable Nginx Controller Leader Election | +| controller.dnsConfig | object | `{}` | Optionally customize the pod dnsConfig. | +| controller.dnsPolicy | string | `"ClusterFirst"` | Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'. By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller to keep resolving names inside the k8s network, use ClusterFirstWithHostNet. | +| controller.electionID | string | `""` | Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader' | +| controller.electionTTL | string | `""` | Duration a leader election is valid before it's getting re-elected, e.g. `15s`, `10m` or `1h`. (Default: 30s) | +| controller.enableAnnotationValidations | bool | `true` | | +| controller.enableMimalloc | bool | `true` | Enable mimalloc as a drop-in replacement for malloc. # ref: https://github.com/microsoft/mimalloc # | +| controller.enableTopologyAwareRouting | bool | `false` | This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-mode="auto" Defaults to false | +| controller.extraArgs | object | `{}` | Additional command line arguments to pass to Ingress-Nginx Controller E.g. to specify the default SSL certificate you can use | +| controller.extraContainers | list | `[]` | Additional containers to be added to the controller pod. See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example. | +| controller.extraEnvs | list | `[]` | Additional environment variables to set | +| controller.extraInitContainers | list | `[]` | Containers, which are run before the app containers are started. | +| controller.extraModules | list | `[]` | Modules, which are mounted into the core nginx image. | +| controller.extraVolumeMounts | list | `[]` | Additional volumeMounts to the controller main container. | +| controller.extraVolumes | list | `[]` | Additional volumes to the controller pod. | +| controller.healthCheckHost | string | `""` | Address to bind the health check endpoint. It is better to set this option to the internal node address if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode. | +| controller.healthCheckPath | string | `"/healthz"` | Path of the health check endpoint. All requests received on the port defined by the healthz-port parameter are forwarded internally to this path. | +| controller.hostAliases | list | `[]` | Optionally customize the pod hostAliases. | +| controller.hostNetwork | bool | `false` | Required for use with CNI based kubernetes installations (such as ones set up by kubeadm), since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920 is merged | +| controller.hostPort.enabled | bool | `false` | Enable 'hostPort' or not | +| controller.hostPort.ports.http | int | `80` | 'hostPort' http port | +| controller.hostPort.ports.https | int | `443` | 'hostPort' https port | +| controller.hostname | object | `{}` | Optionally customize the pod hostname. | +| controller.image.allowPrivilegeEscalation | bool | `false` | | +| controller.image.chroot | bool | `false` | | +| controller.image.digest | string | `"sha256:e6b8de175acda6ca913891f0f727bca4527e797d52688cbe9fec9040d6f6b6fa"` | | +| controller.image.digestChroot | string | `"sha256:87c88e1c38a6c8d4483c8f70b69e2cca49853bb3ec3124b9b1be648edf139af3"` | | +| controller.image.image | string | `"ingress-nginx/controller"` | | +| controller.image.pullPolicy | string | `"IfNotPresent"` | | +| controller.image.readOnlyRootFilesystem | bool | `false` | | +| controller.image.runAsGroup | int | `82` | This value must not be changed using the official image. uid=101(www-data) gid=82(www-data) groups=82(www-data) | +| controller.image.runAsNonRoot | bool | `true` | | +| controller.image.runAsUser | int | `101` | This value must not be changed using the official image. uid=101(www-data) gid=82(www-data) groups=82(www-data) | +| controller.image.seccompProfile.type | string | `"RuntimeDefault"` | | +| controller.image.tag | string | `"v1.12.0"` | | +| controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation | +| controller.ingressClassByName | bool | `false` | Process IngressClass per name (additionally as per spec.controller). | +| controller.ingressClassResource | object | `{"aliases":[],"annotations":{},"controllerValue":"k8s.io/ingress-nginx","default":false,"enabled":true,"name":"nginx","parameters":{}}` | This section refers to the creation of the IngressClass resource. IngressClasses are immutable and cannot be changed after creation. We do not support namespaced IngressClasses, yet, so a ClusterRole and a ClusterRoleBinding is required. | +| controller.ingressClassResource.aliases | list | `[]` | Aliases of this IngressClass. Creates copies with identical settings but the respective alias as name. Useful for development environments with only one Ingress Controller but production-like Ingress resources. `default` gets enabled on the original IngressClass only. | +| controller.ingressClassResource.annotations | object | `{}` | Annotations to be added to the IngressClass resource. | +| controller.ingressClassResource.controllerValue | string | `"k8s.io/ingress-nginx"` | Controller of the IngressClass. An Ingress Controller looks for IngressClasses it should reconcile by this value. This value is also being set as the `--controller-class` argument of this Ingress Controller. Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class | +| controller.ingressClassResource.default | bool | `false` | If true, Ingresses without `ingressClassName` get assigned to this IngressClass on creation. Ingress creation gets rejected if there are multiple default IngressClasses. Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#default-ingress-class | +| controller.ingressClassResource.enabled | bool | `true` | Create the IngressClass or not | +| controller.ingressClassResource.name | string | `"nginx"` | Name of the IngressClass | +| controller.ingressClassResource.parameters | object | `{}` | A link to a custom resource containing additional configuration for the controller. This is optional if the controller consuming this IngressClass does not require additional parameters. Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class | +| controller.keda.apiVersion | string | `"keda.sh/v1alpha1"` | | +| controller.keda.behavior | object | `{}` | | +| controller.keda.cooldownPeriod | int | `300` | | +| controller.keda.enabled | bool | `false` | | +| controller.keda.maxReplicas | int | `11` | | +| controller.keda.minReplicas | int | `1` | | +| controller.keda.pollingInterval | int | `30` | | +| controller.keda.restoreToOriginalReplicaCount | bool | `false` | | +| controller.keda.scaledObject.annotations | object | `{}` | | +| controller.keda.triggers | list | `[]` | | +| controller.kind | string | `"Deployment"` | Use a `DaemonSet` or `Deployment` | +| controller.labels | object | `{}` | Labels to be added to the controller Deployment or DaemonSet and other resources that do not have option to specify labels # | +| controller.lifecycle | object | `{"preStop":{"exec":{"command":["/wait-shutdown"]}}}` | Improve connection draining when ingress controller pod is deleted using a lifecycle hook: With this new hook, we increased the default terminationGracePeriodSeconds from 30 seconds to 300, allowing the draining of connections up to five minutes. If the active connections end before that, the pod will terminate gracefully at that time. To effectively take advantage of this feature, the Configmap feature worker-shutdown-timeout new value is 240s instead of 10s. # | +| controller.livenessProbe.failureThreshold | int | `5` | | +| controller.livenessProbe.httpGet.path | string | `"/healthz"` | | +| controller.livenessProbe.httpGet.port | int | `10254` | | +| controller.livenessProbe.httpGet.scheme | string | `"HTTP"` | | +| controller.livenessProbe.initialDelaySeconds | int | `10` | | +| controller.livenessProbe.periodSeconds | int | `10` | | +| controller.livenessProbe.successThreshold | int | `1` | | +| controller.livenessProbe.timeoutSeconds | int | `1` | | +| controller.maxmindLicenseKey | string | `""` | Maxmind license key to download GeoLite2 Databases. # https://blog.maxmind.com/2019/12/significant-changes-to-accessing-and-using-geolite2-databases/ | +| controller.metrics.enabled | bool | `false` | | +| controller.metrics.port | int | `10254` | | +| controller.metrics.portName | string | `"metrics"` | | +| controller.metrics.prometheusRule.additionalLabels | object | `{}` | | +| controller.metrics.prometheusRule.annotations | object | `{}` | Annotations to be added to the PrometheusRule. | +| controller.metrics.prometheusRule.enabled | bool | `false` | | +| controller.metrics.prometheusRule.rules | list | `[]` | | +| controller.metrics.service.annotations | object | `{}` | | +| controller.metrics.service.enabled | bool | `true` | Enable the metrics service or not. | +| controller.metrics.service.externalIPs | list | `[]` | List of IP addresses at which the stats-exporter service is available # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips # | +| controller.metrics.service.labels | object | `{}` | Labels to be added to the metrics service resource | +| controller.metrics.service.loadBalancerSourceRanges | list | `[]` | | +| controller.metrics.service.servicePort | int | `10254` | | +| controller.metrics.service.type | string | `"ClusterIP"` | | +| controller.metrics.serviceMonitor.additionalLabels | object | `{}` | | +| controller.metrics.serviceMonitor.annotations | object | `{}` | Annotations to be added to the ServiceMonitor. | +| controller.metrics.serviceMonitor.enabled | bool | `false` | | +| controller.metrics.serviceMonitor.metricRelabelings | list | `[]` | | +| controller.metrics.serviceMonitor.namespace | string | `""` | | +| controller.metrics.serviceMonitor.namespaceSelector | object | `{}` | | +| controller.metrics.serviceMonitor.relabelings | list | `[]` | | +| controller.metrics.serviceMonitor.scrapeInterval | string | `"30s"` | | +| controller.metrics.serviceMonitor.targetLabels | list | `[]` | | +| controller.minAvailable | int | `1` | Minimum available pods set in PodDisruptionBudget. Define either 'minAvailable' or 'maxUnavailable', never both. | +| controller.minReadySeconds | int | `0` | `minReadySeconds` to avoid killing pods before we are ready # | +| controller.name | string | `"controller"` | | +| controller.networkPolicy.enabled | bool | `false` | Enable 'networkPolicy' or not | +| controller.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for controller pod assignment # Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ # | +| controller.podAnnotations | object | `{}` | Annotations to be added to controller pods # | +| controller.podLabels | object | `{}` | Labels to add to the pod container metadata | +| controller.podSecurityContext | object | `{}` | Security context for controller pods | +| controller.priorityClassName | string | `""` | | +| controller.progressDeadlineSeconds | int | `0` | Specifies the number of seconds you want to wait for the controller deployment to progress before the system reports back that it has failed. Ref.: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#progress-deadline-seconds | +| controller.proxySetHeaders | object | `{}` | Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers | +| controller.publishService | object | `{"enabled":true,"pathOverride":""}` | Allows customization of the source of the IP address or FQDN to report in the ingress status field. By default, it reads the information provided by the service. If disable, the status field reports the IP address of the node or nodes where an ingress controller pod is running. | +| controller.publishService.enabled | bool | `true` | Enable 'publishService' or not | +| controller.publishService.pathOverride | string | `""` | Allows overriding of the publish service to bind to Must be / | +| controller.readinessProbe.failureThreshold | int | `3` | | +| controller.readinessProbe.httpGet.path | string | `"/healthz"` | | +| controller.readinessProbe.httpGet.port | int | `10254` | | +| controller.readinessProbe.httpGet.scheme | string | `"HTTP"` | | +| controller.readinessProbe.initialDelaySeconds | int | `10` | | +| controller.readinessProbe.periodSeconds | int | `10` | | +| controller.readinessProbe.successThreshold | int | `1` | | +| controller.readinessProbe.timeoutSeconds | int | `1` | | +| controller.replicaCount | int | `1` | | +| controller.reportNodeInternalIp | bool | `false` | Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network Ingress status was blank because there is no Service exposing the Ingress-Nginx Controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply | +| controller.resources.requests.cpu | string | `"100m"` | | +| controller.resources.requests.memory | string | `"90Mi"` | | +| controller.scope.enabled | bool | `false` | Enable 'scope' or not | +| controller.scope.namespace | string | `""` | Namespace to limit the controller to; defaults to $(POD_NAMESPACE) | +| controller.scope.namespaceSelector | string | `""` | When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces. | +| controller.service.annotations | object | `{}` | Annotations to be added to the external controller service. See `controller.service.internal.annotations` for annotations to be added to the internal controller service. | +| controller.service.appProtocol | bool | `true` | Declare the app protocol of the external HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol | +| controller.service.clusterIP | string | `""` | Pre-defined cluster internal IP address of the external controller service. Take care of collisions with existing services. This value is immutable. Set once, it can not be changed without deleting and re-creating the service. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address | +| controller.service.enableHttp | bool | `true` | Enable the HTTP listener on both controller services or not. | +| controller.service.enableHttps | bool | `true` | Enable the HTTPS listener on both controller services or not. | +| controller.service.enabled | bool | `true` | Enable controller services or not. This does not influence the creation of either the admission webhook or the metrics service. | +| controller.service.external.enabled | bool | `true` | Enable the external controller service or not. Useful for internal-only deployments. | +| controller.service.externalIPs | list | `[]` | List of node IP addresses at which the external controller service is available. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips | +| controller.service.externalTrafficPolicy | string | `""` | External traffic policy of the external controller service. Set to "Local" to preserve source IP on providers supporting it. Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip | +| controller.service.internal.annotations | object | `{}` | Annotations to be added to the internal controller service. Mandatory for the internal controller service to be created. Varies with the cloud service. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer | +| controller.service.internal.appProtocol | bool | `true` | Declare the app protocol of the internal HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol | +| controller.service.internal.clusterIP | string | `""` | Pre-defined cluster internal IP address of the internal controller service. Take care of collisions with existing services. This value is immutable. Set once, it can not be changed without deleting and re-creating the service. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address | +| controller.service.internal.enabled | bool | `false` | Enable the internal controller service or not. Remember to configure `controller.service.internal.annotations` when enabling this. | +| controller.service.internal.externalIPs | list | `[]` | List of node IP addresses at which the internal controller service is available. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips | +| controller.service.internal.externalTrafficPolicy | string | `""` | External traffic policy of the internal controller service. Set to "Local" to preserve source IP on providers supporting it. Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip | +| controller.service.internal.ipFamilies | list | `["IPv4"]` | List of IP families (e.g. IPv4, IPv6) assigned to the internal controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field. Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services | +| controller.service.internal.ipFamilyPolicy | string | `"SingleStack"` | Represents the dual-stack capabilities of the internal controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack. Fields `ipFamilies` and `clusterIP` depend on the value of this field. Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services | +| controller.service.internal.loadBalancerClass | string | `""` | Load balancer class of the internal controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class | +| controller.service.internal.loadBalancerIP | string | `""` | Deprecated: Pre-defined IP address of the internal controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer | +| controller.service.internal.loadBalancerSourceRanges | list | `[]` | Restrict access to the internal controller service. Values must be CIDRs. Allows any source address by default. | +| controller.service.internal.nodePorts.http | string | `""` | Node port allocated for the internal HTTP listener. If left empty, the service controller allocates one from the configured node port range. | +| controller.service.internal.nodePorts.https | string | `""` | Node port allocated for the internal HTTPS listener. If left empty, the service controller allocates one from the configured node port range. | +| controller.service.internal.nodePorts.tcp | object | `{}` | Node port mapping for internal TCP listeners. If left empty, the service controller allocates them from the configured node port range. Example: tcp: 8080: 30080 | +| controller.service.internal.nodePorts.udp | object | `{}` | Node port mapping for internal UDP listeners. If left empty, the service controller allocates them from the configured node port range. Example: udp: 53: 30053 | +| controller.service.internal.ports | object | `{}` | | +| controller.service.internal.sessionAffinity | string | `""` | Session affinity of the internal controller service. Must be either "None" or "ClientIP" if set. Defaults to "None". Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity | +| controller.service.internal.targetPorts | object | `{}` | | +| controller.service.internal.type | string | `""` | Type of the internal controller service. Defaults to the value of `controller.service.type`. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types | +| controller.service.ipFamilies | list | `["IPv4"]` | List of IP families (e.g. IPv4, IPv6) assigned to the external controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field. Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services | +| controller.service.ipFamilyPolicy | string | `"SingleStack"` | Represents the dual-stack capabilities of the external controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack. Fields `ipFamilies` and `clusterIP` depend on the value of this field. Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services | +| controller.service.labels | object | `{}` | Labels to be added to both controller services. | +| controller.service.loadBalancerClass | string | `""` | Load balancer class of the external controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class | +| controller.service.loadBalancerIP | string | `""` | Deprecated: Pre-defined IP address of the external controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer | +| controller.service.loadBalancerSourceRanges | list | `[]` | Restrict access to the external controller service. Values must be CIDRs. Allows any source address by default. | +| controller.service.nodePorts.http | string | `""` | Node port allocated for the external HTTP listener. If left empty, the service controller allocates one from the configured node port range. | +| controller.service.nodePorts.https | string | `""` | Node port allocated for the external HTTPS listener. If left empty, the service controller allocates one from the configured node port range. | +| controller.service.nodePorts.tcp | object | `{}` | Node port mapping for external TCP listeners. If left empty, the service controller allocates them from the configured node port range. Example: tcp: 8080: 30080 | +| controller.service.nodePorts.udp | object | `{}` | Node port mapping for external UDP listeners. If left empty, the service controller allocates them from the configured node port range. Example: udp: 53: 30053 | +| controller.service.ports.http | int | `80` | Port the external HTTP listener is published with. | +| controller.service.ports.https | int | `443` | Port the external HTTPS listener is published with. | +| controller.service.sessionAffinity | string | `""` | Session affinity of the external controller service. Must be either "None" or "ClientIP" if set. Defaults to "None". Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity | +| controller.service.targetPorts.http | string | `"http"` | Port of the ingress controller the external HTTP listener is mapped to. | +| controller.service.targetPorts.https | string | `"https"` | Port of the ingress controller the external HTTPS listener is mapped to. | +| controller.service.type | string | `"LoadBalancer"` | Type of the external controller service. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types | +| controller.shareProcessNamespace | bool | `false` | | +| controller.sysctls | object | `{}` | sysctls for controller pods # Ref: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ | +| controller.tcp.annotations | object | `{}` | Annotations to be added to the tcp config configmap | +| controller.tcp.configMapNamespace | string | `""` | Allows customization of the tcp-services-configmap; defaults to $(POD_NAMESPACE) | +| controller.terminationGracePeriodSeconds | int | `300` | `terminationGracePeriodSeconds` to avoid killing pods before we are ready # wait up to five minutes for the drain of connections # | +| controller.tolerations | list | `[]` | Node tolerations for server scheduling to nodes with taints # Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ # | +| controller.topologySpreadConstraints | list | `[]` | Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in. # Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ # | +| controller.udp.annotations | object | `{}` | Annotations to be added to the udp config configmap | +| controller.udp.configMapNamespace | string | `""` | Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE) | +| controller.unhealthyPodEvictionPolicy | string | `""` | Eviction policy for unhealthy pods guarded by PodDisruptionBudget. Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/ | +| controller.updateStrategy | object | `{}` | The update strategy to apply to the Deployment or DaemonSet # | +| controller.watchIngressWithoutClass | bool | `false` | Process Ingress objects without ingressClass annotation/ingressClassName field Overrides value for --watch-ingress-without-class flag of the controller binary Defaults to false | +| defaultBackend.affinity | object | `{}` | Affinity and anti-affinity rules for server scheduling to nodes # Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity | +| defaultBackend.autoscaling.annotations | object | `{}` | | +| defaultBackend.autoscaling.enabled | bool | `false` | | +| defaultBackend.autoscaling.maxReplicas | int | `2` | | +| defaultBackend.autoscaling.minReplicas | int | `1` | | +| defaultBackend.autoscaling.targetCPUUtilizationPercentage | int | `50` | | +| defaultBackend.autoscaling.targetMemoryUtilizationPercentage | int | `50` | | +| defaultBackend.containerSecurityContext | object | `{}` | Security context for default backend containers | +| defaultBackend.enabled | bool | `false` | | +| defaultBackend.extraArgs | object | `{}` | | +| defaultBackend.extraConfigMaps | list | `[]` | | +| defaultBackend.extraEnvs | list | `[]` | Additional environment variables to set for defaultBackend pods | +| defaultBackend.extraVolumeMounts | list | `[]` | | +| defaultBackend.extraVolumes | list | `[]` | | +| defaultBackend.image.allowPrivilegeEscalation | bool | `false` | | +| defaultBackend.image.image | string | `"defaultbackend-amd64"` | | +| defaultBackend.image.pullPolicy | string | `"IfNotPresent"` | | +| defaultBackend.image.readOnlyRootFilesystem | bool | `true` | | +| defaultBackend.image.runAsGroup | int | `65534` | | +| defaultBackend.image.runAsNonRoot | bool | `true` | | +| defaultBackend.image.runAsUser | int | `65534` | | +| defaultBackend.image.seccompProfile.type | string | `"RuntimeDefault"` | | +| defaultBackend.image.tag | string | `"1.5"` | | +| defaultBackend.labels | object | `{}` | Labels to be added to the default backend resources | +| defaultBackend.livenessProbe.failureThreshold | int | `3` | | +| defaultBackend.livenessProbe.initialDelaySeconds | int | `30` | | +| defaultBackend.livenessProbe.periodSeconds | int | `10` | | +| defaultBackend.livenessProbe.successThreshold | int | `1` | | +| defaultBackend.livenessProbe.timeoutSeconds | int | `5` | | +| defaultBackend.minAvailable | int | `1` | Minimum available pods set in PodDisruptionBudget. Define either 'minAvailable' or 'maxUnavailable', never both. | +| defaultBackend.minReadySeconds | int | `0` | `minReadySeconds` to avoid killing pods before we are ready # | +| defaultBackend.name | string | `"defaultbackend"` | | +| defaultBackend.networkPolicy.enabled | bool | `false` | Enable 'networkPolicy' or not | +| defaultBackend.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for default backend pod assignment # Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ # | +| defaultBackend.podAnnotations | object | `{}` | Annotations to be added to default backend pods # | +| defaultBackend.podLabels | object | `{}` | Labels to add to the pod container metadata | +| defaultBackend.podSecurityContext | object | `{}` | Security context for default backend pods | +| defaultBackend.port | int | `8080` | | +| defaultBackend.priorityClassName | string | `""` | | +| defaultBackend.readinessProbe.failureThreshold | int | `6` | | +| defaultBackend.readinessProbe.initialDelaySeconds | int | `0` | | +| defaultBackend.readinessProbe.periodSeconds | int | `5` | | +| defaultBackend.readinessProbe.successThreshold | int | `1` | | +| defaultBackend.readinessProbe.timeoutSeconds | int | `5` | | +| defaultBackend.replicaCount | int | `1` | | +| defaultBackend.resources | object | `{}` | | +| defaultBackend.service.annotations | object | `{}` | | +| defaultBackend.service.externalIPs | list | `[]` | List of IP addresses at which the default backend service is available # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips # | +| defaultBackend.service.loadBalancerSourceRanges | list | `[]` | | +| defaultBackend.service.servicePort | int | `80` | | +| defaultBackend.service.type | string | `"ClusterIP"` | | +| defaultBackend.serviceAccount.automountServiceAccountToken | bool | `true` | | +| defaultBackend.serviceAccount.create | bool | `true` | | +| defaultBackend.serviceAccount.name | string | `""` | | +| defaultBackend.tolerations | list | `[]` | Node tolerations for server scheduling to nodes with taints # Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ # | +| defaultBackend.topologySpreadConstraints | list | `[]` | Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in. Ref.: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ | +| defaultBackend.unhealthyPodEvictionPolicy | string | `""` | Eviction policy for unhealthy pods guarded by PodDisruptionBudget. Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/ | +| defaultBackend.updateStrategy | object | `{}` | The update strategy to apply to the Deployment or DaemonSet # | +| dhParam | string | `""` | A base64-encoded Diffie-Hellman parameter. This can be generated with: `openssl dhparam 4096 2> /dev/null | base64` # Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param | +| global.image.registry | string | `"registry.k8s.io"` | Registry host to pull images from. | +| imagePullSecrets | list | `[]` | Optional array of imagePullSecrets containing private registry credentials # Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ | +| namespaceOverride | string | `""` | Override the deployment namespace; defaults to .Release.Namespace | +| portNamePrefix | string | `""` | Prefix for TCP and UDP ports names in ingress controller service # Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration | +| rbac.create | bool | `true` | | +| rbac.scope | bool | `false` | | +| revisionHistoryLimit | int | `10` | Rollback limit # | +| serviceAccount.annotations | object | `{}` | Annotations for the controller service account | +| serviceAccount.automountServiceAccountToken | bool | `true` | | +| serviceAccount.create | bool | `true` | | +| serviceAccount.name | string | `""` | | +| tcp | object | `{}` | TCP service key-value pairs # Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md # | +| udp | object | `{}` | UDP service key-value pairs # Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md # | diff --git a/charts/devtron-utilities/charts/ingress-nginx/README.md.gotmpl b/charts/devtron-utilities/charts/ingress-nginx/README.md.gotmpl new file mode 100644 index 000000000..3cb9d5651 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/README.md.gotmpl @@ -0,0 +1,247 @@ +{{ template "chart.header" . }} +[ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer + +{{ template "chart.versionBadge" . }}{{ template "chart.typeBadge" . }}{{ template "chart.appVersionBadge" . }} + +To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources. + +This chart bootstraps an ingress-nginx deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + +{{ template "chart.requirementsSection" . }} + +## Get Repo Info + +```console +helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx +helm repo update +``` + +## Install Chart + +**Important:** only helm3 is supported + +```console +helm install [RELEASE_NAME] ingress-nginx/ingress-nginx +``` + +The command deploys ingress-nginx on the Kubernetes cluster in the default configuration. + +_See [configuration](#configuration) below._ + +_See [helm install](https://helm.sh/docs/helm/helm_install/) for command documentation._ + +## Uninstall Chart + +```console +helm uninstall [RELEASE_NAME] +``` + +This removes all the Kubernetes components associated with the chart and deletes the release. + +_See [helm uninstall](https://helm.sh/docs/helm/helm_uninstall/) for command documentation._ + +## Upgrading Chart + +```console +helm upgrade [RELEASE_NAME] [CHART] --install +``` + +_See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documentation._ + +### Migrating from stable/nginx-ingress + +There are two main ways to migrate a release from `stable/nginx-ingress` to `ingress-nginx/ingress-nginx` chart: + +1. For Nginx Ingress controllers used for non-critical services, the easiest method is to [uninstall](#uninstall-chart) the old release and [install](#install-chart) the new one +1. For critical services in production that require zero-downtime, you will want to: + 1. [Install](#install-chart) a second Ingress controller + 1. Redirect your DNS traffic from the old controller to the new controller + 1. Log traffic from both controllers during this changeover + 1. [Uninstall](#uninstall-chart) the old controller once traffic has fully drained from it + +Note that there are some different and upgraded configurations between the two charts, described by Rimas Mocevicius from JFrog in the "Upgrading to ingress-nginx Helm chart" section of [Migrating from Helm chart nginx-ingress to ingress-nginx](https://rimusz.net/migrating-to-ingress-nginx). As the `ingress-nginx/ingress-nginx` chart continues to update, you will want to check current differences by running [helm configuration](#configuration) commands on both charts. + +## Configuration + +See [Customizing the Chart Before Installing](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing). To see all configurable options with detailed comments, visit the chart's [values.yaml](./values.yaml), or run these configuration commands: + +```console +helm show values ingress-nginx/ingress-nginx +``` + +### PodDisruptionBudget + +Note that the PodDisruptionBudget resource will only be defined if the replicaCount is greater than one, +else it would make it impossible to evacuate a node. See [gh issue #7127](https://github.com/helm/charts/issues/7127) for more info. + +### Prometheus Metrics + +The Ingress-Nginx Controller can export Prometheus metrics, by setting `controller.metrics.enabled` to `true`. + +You can add Prometheus annotations to the metrics service using `controller.metrics.service.annotations`. +Alternatively, if you use the Prometheus Operator, you can enable ServiceMonitor creation using `controller.metrics.serviceMonitor.enabled`. And set `controller.metrics.serviceMonitor.additionalLabels.release="prometheus"`. "release=prometheus" should match the label configured in the prometheus servicemonitor ( see `kubectl get servicemonitor prometheus-kube-prom-prometheus -oyaml -n prometheus`) + +### ingress-nginx nginx\_status page/stats server + +Previous versions of this chart had a `controller.stats.*` configuration block, which is now obsolete due to the following changes in Ingress-Nginx Controller: + +- In [0.16.1](https://github.com/kubernetes/ingress-nginx/blob/main/Changelog.md#0161), the vts (virtual host traffic status) dashboard was removed +- In [0.23.0](https://github.com/kubernetes/ingress-nginx/blob/main/Changelog.md#0230), the status page at port 18080 is now a unix socket webserver only available at localhost. + You can use `curl --unix-socket /tmp/nginx-status-server.sock http://localhost/nginx_status` inside the controller container to access it locally, or use the snippet from [nginx-ingress changelog](https://github.com/kubernetes/ingress-nginx/blob/main/Changelog.md#0230) to re-enable the http server + +### ExternalDNS Service Configuration + +Add an [ExternalDNS](https://github.com/kubernetes-sigs/external-dns) annotation to the LoadBalancer service: + +```yaml +controller: + service: + annotations: + external-dns.alpha.kubernetes.io/hostname: kubernetes-example.com. +``` + +### AWS L7 ELB with SSL Termination + +Annotate the controller as shown in the [nginx-ingress l7 patch](https://github.com/kubernetes/ingress-nginx/blob/ab3a789caae65eec4ad6e3b46b19750b481b6bce/deploy/aws/l7/service-l7.yaml): + +```yaml +controller: + service: + targetPorts: + http: http + https: http + annotations: + service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:XX-XXXX-X:XXXXXXXXX:certificate/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX + service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "http" + service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" + service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: '3600' +``` + +### Additional Internal Load Balancer + +This setup is useful when you need both external and internal load balancers but don't want to have multiple ingress controllers and multiple ingress objects per application. + +By default, the ingress object will point to the external load balancer address, but if correctly configured, you can make use of the internal one if the URL you are looking up resolves to the internal load balancer's URL. + +You'll need to set both the following values: + +`controller.service.internal.enabled` +`controller.service.internal.annotations` + +If one of them is missing the internal load balancer will not be deployed. Example you may have `controller.service.internal.enabled=true` but no annotations set, in this case no action will be taken. + +`controller.service.internal.annotations` varies with the cloud service you're using. + +Example for AWS: + +```yaml +controller: + service: + internal: + enabled: true + annotations: + # Create internal NLB + service.beta.kubernetes.io/aws-load-balancer-scheme: "internal" + # Create internal ELB(Deprecated) + # service.beta.kubernetes.io/aws-load-balancer-internal: "true" + # Any other annotation can be declared here. +``` + +Example for GCE: + +```yaml +controller: + service: + internal: + enabled: true + annotations: + # Create internal LB. More information: https://cloud.google.com/kubernetes-engine/docs/how-to/internal-load-balancing + # For GKE versions 1.17 and later + networking.gke.io/load-balancer-type: "Internal" + # For earlier versions + # cloud.google.com/load-balancer-type: "Internal" + + # Any other annotation can be declared here. +``` + +Example for Azure: + +```yaml +controller: + service: + annotations: + # Create internal LB + service.beta.kubernetes.io/azure-load-balancer-internal: "true" + # Any other annotation can be declared here. +``` + +Example for Oracle Cloud Infrastructure: + +```yaml +controller: + service: + annotations: + # Create internal LB + service.beta.kubernetes.io/oci-load-balancer-internal: "true" + # Any other annotation can be declared here. +``` + +The load balancer annotations of more cloud service providers can be found: [Internal load balancer](https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer). + +An use case for this scenario is having a split-view DNS setup where the public zone CNAME records point to the external balancer URL while the private zone CNAME records point to the internal balancer URL. This way, you only need one ingress kubernetes object. + +Optionally you can set `controller.service.loadBalancerIP` if you need a static IP for the resulting `LoadBalancer`. + +### Ingress Admission Webhooks + +With nginx-ingress-controller version 0.25+, the Ingress-Nginx Controller pod exposes an endpoint that will integrate with the `validatingwebhookconfiguration` Kubernetes feature to prevent bad ingress from being added to the cluster. +**This feature is enabled by default since 0.31.0.** + +With nginx-ingress-controller in 0.25.* work only with kubernetes 1.14+, 0.26 fix [this issue](https://github.com/kubernetes/ingress-nginx/pull/4521) + +#### How the Chart Configures the Hooks +A validating and configuration requires the endpoint to which the request is sent to use TLS. It is possible to set up custom certificates to do this, but in most cases, a self-signed certificate is enough. The setup of this component requires some more complex orchestration when using helm. The steps are created to be idempotent and to allow turning the feature on and off without running into helm quirks. + +1. A pre-install hook provisions a certificate into the same namespace using a format compatible with provisioning using end user certificates. If the certificate already exists, the hook exits. +2. The Ingress-Nginx Controller pod is configured to use a TLS proxy container, which will load that certificate. +3. Validating and Mutating webhook configurations are created in the cluster. +4. A post-install hook reads the CA from the secret created by step 1 and patches the Validating and Mutating webhook configurations. This process will allow a custom CA provisioned by some other process to also be patched into the webhook configurations. The chosen failure policy is also patched into the webhook configurations + +#### Alternatives +It should be possible to use [cert-manager/cert-manager](https://github.com/cert-manager/cert-manager) if a more complete solution is required. + +You can enable automatic self-signed TLS certificate provisioning via cert-manager by setting the `controller.admissionWebhooks.certManager.enabled` value to true. + +Please ensure that cert-manager is correctly installed and configured. + +### Helm Error When Upgrading: spec.clusterIP: Invalid value: "" + +If you are upgrading this chart from a version between 0.31.0 and 1.2.2 then you may get an error like this: + +```console +Error: UPGRADE FAILED: Service "?????-controller" is invalid: spec.clusterIP: Invalid value: "": field is immutable +``` + +Detail of how and why are in [this issue](https://github.com/helm/charts/pull/13646) but to resolve this you can set `xxxx.service.omitClusterIP` to `true` where `xxxx` is the service referenced in the error. + +As of version `1.26.0` of this chart, by simply not providing any clusterIP value, `invalid: spec.clusterIP: Invalid value: "": field is immutable` will no longer occur since `clusterIP: ""` will not be rendered. + +### Pod Security Admission + +You can use Pod Security Admission by applying labels to the `ingress-nginx` namespace as instructed by the [documentation](https://kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-namespace-labels). + +Example: + +```yaml +apiVersion: v1 +kind: Namespace +metadata: + name: ingress-nginx + labels: + kubernetes.io/metadata.name: ingress-nginx + name: ingress-nginx + pod-security.kubernetes.io/enforce: restricted + pod-security.kubernetes.io/enforce-version: v1.31 +``` + +{{ template "chart.valuesSection" . }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.10.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.10.0.md new file mode 100644 index 000000000..b42d6c28b --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.10.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 2.10.0 + +* [#5843](https://github.com/kubernetes/ingress-nginx/pull/5843) Update jettech/kube-webhook-certgen image + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.9.1...ingress-nginx-2.10.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.0.md new file mode 100644 index 000000000..e549b3867 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.0.md @@ -0,0 +1,10 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 2.11.0 + +* [#5879](https://github.com/kubernetes/ingress-nginx/pull/5879) Update helm chart for v0.34.0 +* [#5671](https://github.com/kubernetes/ingress-nginx/pull/5671) Make liveness probe more fault tolerant than readiness probe + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.10.0...ingress-nginx-2.11.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.1.md new file mode 100644 index 000000000..d910d3bf4 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.1.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 2.11.1 + +* [#5900](https://github.com/kubernetes/ingress-nginx/pull/5900) Release helm chart for v0.34.1 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.11.0...ingress-nginx-2.11.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.2.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.2.md new file mode 100644 index 000000000..9f7821005 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.2.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 2.11.2 + +* [#5951](https://github.com/kubernetes/ingress-nginx/pull/5951) Bump chart patch version + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.11.1...ingress-nginx-2.11.2 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.3.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.3.md new file mode 100644 index 000000000..344769163 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.3.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 2.11.3 + +* [#6038](https://github.com/kubernetes/ingress-nginx/pull/6038) Bump chart version PATCH + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.11.2...ingress-nginx-2.11.3 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.12.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.12.0.md new file mode 100644 index 000000000..5cb3888aa --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.12.0.md @@ -0,0 +1,10 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 2.12.0 + +* [#6039](https://github.com/kubernetes/ingress-nginx/pull/6039) Add configurable serviceMonitor metricRelabelling and targetLabels +* [#6044](https://github.com/kubernetes/ingress-nginx/pull/6044) Fix YAML linting + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.11.3...ingress-nginx-2.12.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.12.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.12.1.md new file mode 100644 index 000000000..94d121db5 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.12.1.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 2.12.1 + +* [#6075](https://github.com/kubernetes/ingress-nginx/pull/6075) Sync helm chart affinity examples + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.12.0...ingress-nginx-2.12.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.13.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.13.0.md new file mode 100644 index 000000000..01fe0b15d --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.13.0.md @@ -0,0 +1,10 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 2.13.0 + +* [#6093](https://github.com/kubernetes/ingress-nginx/pull/6093) Release v0.35.0 +* [#6080](https://github.com/kubernetes/ingress-nginx/pull/6080) Switch images to k8s.gcr.io after Vanity Domain Flip + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.12.1...ingress-nginx-2.13.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.14.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.14.0.md new file mode 100644 index 000000000..2fb7a5a76 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.14.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 2.14.0 + +* [#6104](https://github.com/kubernetes/ingress-nginx/pull/6104) Misc fixes for nginx-ingress chart for better keel and prometheus-operator integration + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.13.0...ingress-nginx-2.14.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.15.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.15.0.md new file mode 100644 index 000000000..543a55927 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.15.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 2.15.0 + +* [#6087](https://github.com/kubernetes/ingress-nginx/pull/6087) Adding parameter for externalTrafficPolicy in internal controller service spec + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.14.0...ingress-nginx-2.15.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.16.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.16.0.md new file mode 100644 index 000000000..996f4489e --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.16.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 2.16.0 + +* [#6154](https://github.com/kubernetes/ingress-nginx/pull/6154) add `topologySpreadConstraint` to controller + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.15.0...ingress-nginx-2.16.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.9.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.9.0.md new file mode 100644 index 000000000..11c5f5fed --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.9.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 2.9.0 + +* [#5795](https://github.com/kubernetes/ingress-nginx/pull/5795) Use fully qualified images to avoid cri-o issues + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-TODO...ingress-nginx-2.9.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.9.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.9.1.md new file mode 100644 index 000000000..7d4314d9c --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.9.1.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 2.9.1 + +* [#5823](https://github.com/kubernetes/ingress-nginx/pull/5823) Add quoting to sysctls because numeric values need to be presented as strings (#5823) + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.9.0...ingress-nginx-2.9.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.0.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.0.0.md new file mode 100644 index 000000000..a7d50ee3a --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.0.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.0.0 + +* [#6167](https://github.com/kubernetes/ingress-nginx/pull/6167) Update chart requirements + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.16.0...ingress-nginx-3.0.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.10.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.10.0.md new file mode 100644 index 000000000..3369bed03 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.10.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.10.0 + +* Fix routing regression introduced in 0.41.0 with PathType Exact + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.9.0...ingress-nginx-3.10.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.10.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.10.1.md new file mode 100644 index 000000000..6ff682e52 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.10.1.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.10.1 + +* Fix regression introduced in 0.41.0 with external authentication + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.10.0...ingress-nginx-3.10.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.11.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.11.0.md new file mode 100644 index 000000000..69ba5506b --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.11.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.11.0 + +* Support Keda Autoscaling + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.10.1...ingress-nginx-3.11.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.11.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.11.1.md new file mode 100644 index 000000000..4e81f4b41 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.11.1.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.11.1 + +* [#6505](https://github.com/kubernetes/ingress-nginx/pull/6505) Reorder HPA resource list to work with GitOps tooling + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.11.0...ingress-nginx-3.11.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.12.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.12.0.md new file mode 100644 index 000000000..41b9744de --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.12.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.12.0 + +* [#6514](https://github.com/kubernetes/ingress-nginx/pull/6514) Remove helm2 support and update docs + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.11.1...ingress-nginx-3.12.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.13.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.13.0.md new file mode 100644 index 000000000..0855a7913 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.13.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.13.0 + +* [#6544](https://github.com/kubernetes/ingress-nginx/pull/6544) Fix default backend HPA name variable + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.12.0...ingress-nginx-3.13.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.14.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.14.0.md new file mode 100644 index 000000000..e07880bf4 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.14.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.14.0 + +* [#6469](https://github.com/kubernetes/ingress-nginx/pull/6469) Allow custom service names for controller and backend + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.13.0...ingress-nginx-3.14.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.15.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.15.0.md new file mode 100644 index 000000000..3053a3548 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.15.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.15.0 + +* [#6586](https://github.com/kubernetes/ingress-nginx/pull/6586) Fix 'maxmindLicenseKey' location in values.yaml + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.14.0...ingress-nginx-3.15.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.15.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.15.1.md new file mode 100644 index 000000000..f11ee0a76 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.15.1.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.15.1 + +* Fix chart-releaser action + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.15.0...ingress-nginx-3.15.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.16.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.16.0.md new file mode 100644 index 000000000..fba30b171 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.16.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.16.0 + +* [#6646](https://github.com/kubernetes/ingress-nginx/pull/6646) Added LoadBalancerIP value for internal service + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.15.1...helm-chart-3.16.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.16.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.16.1.md new file mode 100644 index 000000000..650d1b8fa --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.16.1.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.16.1 + +* Fix chart-releaser action + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.16.0...helm-chart-3.16.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.17.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.17.0.md new file mode 100644 index 000000000..175c7a264 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.17.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.17.0 + +* Update ingress-nginx v0.42.0 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.16.1...helm-chart-3.17.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.18.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.18.0.md new file mode 100644 index 000000000..31b815e4e --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.18.0.md @@ -0,0 +1,10 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.18.0 + +* [#6688](https://github.com/kubernetes/ingress-nginx/pull/6688) Allow volume-type emptyDir in controller podsecuritypolicy +* [#6691](https://github.com/kubernetes/ingress-nginx/pull/6691) Improve parsing of helm parameters + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.17.0...helm-chart-3.18.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.19.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.19.0.md new file mode 100644 index 000000000..0970bf02c --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.19.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.19.0 + +* Update ingress-nginx v0.43.0 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.18.0...helm-chart-3.19.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.20.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.20.0.md new file mode 100644 index 000000000..4b81ae42f --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.20.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.20.0 + +* [#6730](https://github.com/kubernetes/ingress-nginx/pull/6730) Do not create HPA for defaultBackend if not enabled. + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.19.0...helm-chart-3.20.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.20.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.20.1.md new file mode 100644 index 000000000..952bf2bd3 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.20.1.md @@ -0,0 +1,10 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.20.1 + +* Do not create KEDA in case of DaemonSets. +* Fix KEDA v2 definition + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.20.0...helm-chart-3.20.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.21.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.21.0.md new file mode 100644 index 000000000..25edbefd9 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.21.0.md @@ -0,0 +1,12 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.21.0 + +* [#6783](https://github.com/kubernetes/ingress-nginx/pull/6783) Add custom annotations to ScaledObject +* [#6761](https://github.com/kubernetes/ingress-nginx/pull/6761) Adding quotes in the serviceAccount name in Helm values +* [#6767](https://github.com/kubernetes/ingress-nginx/pull/6767) Remove ClusterRole when scope option is enabled +* [#6785](https://github.com/kubernetes/ingress-nginx/pull/6785) Update kube-webhook-certgen image to v1.5.1 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.20.1...helm-chart-3.21.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.22.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.22.0.md new file mode 100644 index 000000000..147d66421 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.22.0.md @@ -0,0 +1,10 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.22.0 + +* [#6802](https://github.com/kubernetes/ingress-nginx/pull/6802) Add value for configuring a custom Diffie-Hellman parameters file +* [#6815](https://github.com/kubernetes/ingress-nginx/pull/6815) Allow use of numeric namespaces in helm chart + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.21.0...helm-chart-3.22.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.23.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.23.0.md new file mode 100644 index 000000000..5dcb50fa8 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.23.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.23.0 + +* Update ingress-nginx v0.44.0 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.22.0...helm-chart-3.23.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.24.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.24.0.md new file mode 100644 index 000000000..d7db808b1 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.24.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.24.0 + +* [#6908](https://github.com/kubernetes/ingress-nginx/pull/6908) Add volumes to default-backend deployment + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.23.0...helm-chart-3.24.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.25.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.25.0.md new file mode 100644 index 000000000..f9679a124 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.25.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.25.0 + +* [#6957](https://github.com/kubernetes/ingress-nginx/pull/6957) Add ability to specify automountServiceAccountToken + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.24.0...helm-chart-3.25.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.26.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.26.0.md new file mode 100644 index 000000000..0c3a1df68 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.26.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.26.0 + +* [#6979](https://github.com/kubernetes/ingress-nginx/pull/6979) Changed servicePort value for metrics + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.25.0...helm-chart-3.26.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.27.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.27.0.md new file mode 100644 index 000000000..8113d7b9b --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.27.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.27.0 + +* Update ingress-nginx v0.45.0 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.26.0...helm-chart-3.27.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.28.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.28.0.md new file mode 100644 index 000000000..eee0ccbec --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.28.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.28.0 + +* [#6900](https://github.com/kubernetes/ingress-nginx/pull/6900) Support existing PSPs + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.27.0...helm-chart-3.28.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.29.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.29.0.md new file mode 100644 index 000000000..f0fabdce1 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.29.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.29.0 + +* [#6945](https://github.com/kubernetes/ingress-nginx/pull/7020) Add option to specify job label for ServiceMonitor + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.28.0...helm-chart-3.29.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.3.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.3.0.md new file mode 100644 index 000000000..09fab3756 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.3.0.md @@ -0,0 +1,12 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.3.0 + +* [#6203](https://github.com/kubernetes/ingress-nginx/pull/6203) Refactor parsing of key values +* [#6162](https://github.com/kubernetes/ingress-nginx/pull/6162) Add helm chart options to expose metrics service as NodePort +* [#6180](https://github.com/kubernetes/ingress-nginx/pull/6180) Fix helm chart admissionReviewVersions regression +* [#6169](https://github.com/kubernetes/ingress-nginx/pull/6169) Fix Typo in example prometheus rules + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.0.0...ingress-nginx-3.3.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.3.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.3.1.md new file mode 100644 index 000000000..81f44fdbd --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.3.1.md @@ -0,0 +1,12 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.3.1 + +* [#6259](https://github.com/kubernetes/ingress-nginx/pull/6259) Release helm chart +* [#6258](https://github.com/kubernetes/ingress-nginx/pull/6258) Fix chart markdown link +* [#6253](https://github.com/kubernetes/ingress-nginx/pull/6253) Release v0.40.0 +* [#6233](https://github.com/kubernetes/ingress-nginx/pull/6233) Add admission controller e2e test + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.3.0...ingress-nginx-3.3.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.30.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.30.0.md new file mode 100644 index 000000000..77ad6b41b --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.30.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.30.0 + +* [#7092](https://github.com/kubernetes/ingress-nginx/pull/7092) Removes the possibility of using localhost in ExternalNames as endpoints + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.29.0...helm-chart-3.30.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.31.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.31.0.md new file mode 100644 index 000000000..bc07fed76 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.31.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.31.0 + +* [7137] https://github.com/kubernetes/ingress-nginx/pull/7137 Add support for custom probes + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.30.0...helm-chart-3.31.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.32.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.32.0.md new file mode 100644 index 000000000..68f7ed6b2 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.32.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.32.0 + +* [7117] https://github.com/kubernetes/ingress-nginx/pull/7117 Add annotations for HPA + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.31.0...helm-chart-3.32.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.33.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.33.0.md new file mode 100644 index 000000000..b56c5fc1e --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.33.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.33.0 + +* [7164] https://github.com/kubernetes/ingress-nginx/pull/7164 Update nginx to v1.20.1 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.32.0...helm-chart-3.33.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.34.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.34.0.md new file mode 100644 index 000000000..a28cd0282 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.34.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.34.0 + +* [7256] https://github.com/kubernetes/ingress-nginx/pull/7256 Add namespace field in the namespace scoped resource templates + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.33.0...helm-chart-3.34.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.4.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.4.0.md new file mode 100644 index 000000000..3b4ca9353 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.4.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.4.0 + +* [#6268](https://github.com/kubernetes/ingress-nginx/pull/6268) Update to 0.40.2 in helm chart #6288 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.3.1...ingress-nginx-3.4.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.5.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.5.0.md new file mode 100644 index 000000000..44991b3bb --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.5.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.5.0 + +* [#6260](https://github.com/kubernetes/ingress-nginx/pull/6260) Allow Helm Chart to customize admission webhook's annotations, timeoutSeconds, namespaceSelector, objectSelector and cert files locations + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.4.0...ingress-nginx-3.5.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.5.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.5.1.md new file mode 100644 index 000000000..740f00c45 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.5.1.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.5.1 + +* [#6299](https://github.com/kubernetes/ingress-nginx/pull/6299) Fix helm chart release + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.5.0...ingress-nginx-3.5.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.6.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.6.0.md new file mode 100644 index 000000000..4af7f11a1 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.6.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.6.0 + +* [#6305](https://github.com/kubernetes/ingress-nginx/pull/6305) Add default linux nodeSelector + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.5.1...ingress-nginx-3.6.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.7.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.7.0.md new file mode 100644 index 000000000..a6b12994b --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.7.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.7.0 + +* [#6316](https://github.com/kubernetes/ingress-nginx/pull/6316) Numerals in podAnnotations in quotes [#6315](https://github.com/kubernetes/ingress-nginx/issues/6315) + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.6.0...ingress-nginx-3.7.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.7.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.7.1.md new file mode 100644 index 000000000..6ba12df91 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.7.1.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.7.1 + +* [#6326](https://github.com/kubernetes/ingress-nginx/pull/6326) Fix liveness and readiness probe path in daemonset chart + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.7.0...ingress-nginx-3.7.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.8.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.8.0.md new file mode 100644 index 000000000..8df250a98 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.8.0.md @@ -0,0 +1,13 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.8.0 + +* [#6395](https://github.com/kubernetes/ingress-nginx/pull/6395) Update jettech/kube-webhook-certgen image +* [#6377](https://github.com/kubernetes/ingress-nginx/pull/6377) Added loadBalancerSourceRanges for internal lbs +* [#6356](https://github.com/kubernetes/ingress-nginx/pull/6356) Add securitycontext settings on defaultbackend +* [#6401](https://github.com/kubernetes/ingress-nginx/pull/6401) Fix controller service annotations +* [#6403](https://github.com/kubernetes/ingress-nginx/pull/6403) Initial helm chart changelog + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.7.1...ingress-nginx-3.8.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.9.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.9.0.md new file mode 100644 index 000000000..e8c9def51 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.9.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 3.9.0 + +* [#6423](https://github.com/kubernetes/ingress-nginx/pull/6423) Add Default backend HPA autoscaling + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.8.0...ingress-nginx-3.9.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.1.md new file mode 100644 index 000000000..7a187b350 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.1.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.0.1 + +* [7535] https://github.com/kubernetes/ingress-nginx/pull/7535 Release v1.0.0 ingress-nginx + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.34.0...helm-chart-4.0.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.10.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.10.md new file mode 100644 index 000000000..c5d651670 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.10.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.0.10 + +* [7964] https://github.com/kubernetes/ingress-nginx/pull/7964 Update controller version to v1.1.0 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.9...helm-chart-4.0.10 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.11.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.11.md new file mode 100644 index 000000000..554182355 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.11.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.0.11 + +* [7873] https://github.com/kubernetes/ingress-nginx/pull/7873 Makes the [appProtocol](https://kubernetes.io/docs/concepts/services-networking/_print/#application-protocol) field optional. + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.10...helm-chart-4.0.11 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.12.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.12.md new file mode 100644 index 000000000..320f6f546 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.12.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.0.12 + +* [7978] https://github.com/kubernetes/ingress-nginx/pull/7979 Support custom annotations in admissions Jobs + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.11...helm-chart-4.0.12 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.13.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.13.md new file mode 100644 index 000000000..edd922814 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.13.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.0.13 + +* [8008] https://github.com/kubernetes/ingress-nginx/pull/8008 Add relabelings in controller-servicemonitor.yaml + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.12...helm-chart-4.0.13 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.14.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.14.md new file mode 100644 index 000000000..e92701039 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.14.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.0.14 + +* [8061] https://github.com/kubernetes/ingress-nginx/pull/8061 Using helm-docs to populate values table in README.md + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.13...helm-chart-4.0.14 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.15.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.15.md new file mode 100644 index 000000000..d3d14a98d --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.15.md @@ -0,0 +1,43 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.0.15 + +* [8120] https://github.com/kubernetes/ingress-nginx/pull/8120 Update go in runner and release v1.1.1 +* [8119] https://github.com/kubernetes/ingress-nginx/pull/8119 Update to go v1.17.6 +* [8118] https://github.com/kubernetes/ingress-nginx/pull/8118 Remove deprecated libraries, update other libs +* [8117] https://github.com/kubernetes/ingress-nginx/pull/8117 Fix codegen errors +* [8115] https://github.com/kubernetes/ingress-nginx/pull/8115 chart/ghaction: set the correct permission to have access to push a release +* [8098] https://github.com/kubernetes/ingress-nginx/pull/8098 generating SHA for CA only certs in backend_ssl.go + comparison of P… +* [8088] https://github.com/kubernetes/ingress-nginx/pull/8088 Fix Edit this page link to use main branch +* [8072] https://github.com/kubernetes/ingress-nginx/pull/8072 Expose GeoIP2 Continent code as variable +* [8061] https://github.com/kubernetes/ingress-nginx/pull/8061 docs(charts): using helm-docs for chart +* [8058] https://github.com/kubernetes/ingress-nginx/pull/8058 Bump github.com/spf13/cobra from 1.2.1 to 1.3.0 +* [8054] https://github.com/kubernetes/ingress-nginx/pull/8054 Bump google.golang.org/grpc from 1.41.0 to 1.43.0 +* [8051] https://github.com/kubernetes/ingress-nginx/pull/8051 align bug report with feature request regarding kind documentation +* [8046] https://github.com/kubernetes/ingress-nginx/pull/8046 Report expired certificates (#8045) +* [8044] https://github.com/kubernetes/ingress-nginx/pull/8044 remove G109 check till gosec resolves issues +* [8042] https://github.com/kubernetes/ingress-nginx/pull/8042 docs_multiple_instances_one_cluster_ticket_7543 +* [8041] https://github.com/kubernetes/ingress-nginx/pull/8041 docs: fix typo'd executable name +* [8035] https://github.com/kubernetes/ingress-nginx/pull/8035 Comment busy owners +* [8029] https://github.com/kubernetes/ingress-nginx/pull/8029 Add stream-snippet as a ConfigMap and Annotation option +* [8023] https://github.com/kubernetes/ingress-nginx/pull/8023 fix nginx compilation flags +* [8021] https://github.com/kubernetes/ingress-nginx/pull/8021 Disable default modsecurity_rules_file if modsecurity-snippet is specified +* [8019] https://github.com/kubernetes/ingress-nginx/pull/8019 Revise main documentation page +* [8018] https://github.com/kubernetes/ingress-nginx/pull/8018 Preserve order of plugin invocation +* [8015] https://github.com/kubernetes/ingress-nginx/pull/8015 Add newline indenting to admission webhook annotations +* [8014] https://github.com/kubernetes/ingress-nginx/pull/8014 Add link to example error page manifest in docs +* [8009] https://github.com/kubernetes/ingress-nginx/pull/8009 Fix spelling in documentation and top-level files +* [8008] https://github.com/kubernetes/ingress-nginx/pull/8008 Add relabelings in controller-servicemonitor.yaml +* [8003] https://github.com/kubernetes/ingress-nginx/pull/8003 Minor improvements (formatting, consistency) in install guide +* [8001] https://github.com/kubernetes/ingress-nginx/pull/8001 fix: go-grpc Dockerfile +* [7999] https://github.com/kubernetes/ingress-nginx/pull/7999 images: use k8s-staging-test-infra/gcb-docker-gcloud +* [7996] https://github.com/kubernetes/ingress-nginx/pull/7996 doc: improvement +* [7983] https://github.com/kubernetes/ingress-nginx/pull/7983 Fix a couple of misspellings in the annotations documentation. +* [7979] https://github.com/kubernetes/ingress-nginx/pull/7979 allow set annotations for admission Jobs +* [7977] https://github.com/kubernetes/ingress-nginx/pull/7977 Add ssl_reject_handshake to default server +* [7975] https://github.com/kubernetes/ingress-nginx/pull/7975 add legacy version update v0.50.0 to main changelog +* [7972] https://github.com/kubernetes/ingress-nginx/pull/7972 updated service upstream definition + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.14...helm-chart-4.0.15 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.18.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.18.md new file mode 100644 index 000000000..30a8f75c1 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.18.md @@ -0,0 +1,40 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.0.18 + +* [8291](https://github.com/kubernetes/ingress-nginx/pull/8291) remove git tag env from cloud build +* [8286](https://github.com/kubernetes/ingress-nginx/pull/8286) Fix OpenTelemetry sidecar image build +* [8277](https://github.com/kubernetes/ingress-nginx/pull/8277) Add OpenSSF Best practices badge +* [8273](https://github.com/kubernetes/ingress-nginx/pull/8273) Issue#8241 +* [8267](https://github.com/kubernetes/ingress-nginx/pull/8267) Add fsGroup value to admission-webhooks/job-patch charts +* [8262](https://github.com/kubernetes/ingress-nginx/pull/8262) Updated confusing error +* [8256](https://github.com/kubernetes/ingress-nginx/pull/8256) fix: deny locations with invalid auth-url annotation +* [8253](https://github.com/kubernetes/ingress-nginx/pull/8253) Add a certificate info metric +* [8236](https://github.com/kubernetes/ingress-nginx/pull/8236) webhook: remove useless code. +* [8227](https://github.com/kubernetes/ingress-nginx/pull/8227) Update libraries in webhook image +* [8225](https://github.com/kubernetes/ingress-nginx/pull/8225) fix inconsistent-label-cardinality for prometheus metrics: nginx_ingress_controller_requests +* [8221](https://github.com/kubernetes/ingress-nginx/pull/8221) Do not validate ingresses with unknown ingress class in admission webhook endpoint +* [8210](https://github.com/kubernetes/ingress-nginx/pull/8210) Bump github.com/prometheus/client_golang from 1.11.0 to 1.12.1 +* [8209](https://github.com/kubernetes/ingress-nginx/pull/8209) Bump google.golang.org/grpc from 1.43.0 to 1.44.0 +* [8204](https://github.com/kubernetes/ingress-nginx/pull/8204) Add Artifact Hub lint +* [8203](https://github.com/kubernetes/ingress-nginx/pull/8203) Fix Indentation of example and link to cert-manager tutorial +* [8201](https://github.com/kubernetes/ingress-nginx/pull/8201) feat(metrics): add path and method labels to requests countera +* [8199](https://github.com/kubernetes/ingress-nginx/pull/8199) use functional options to reduce number of methods creating an EchoDeployment +* [8196](https://github.com/kubernetes/ingress-nginx/pull/8196) docs: fix inconsistent controller annotation +* [8191](https://github.com/kubernetes/ingress-nginx/pull/8191) Using Go install for misspell +* [8186](https://github.com/kubernetes/ingress-nginx/pull/8186) prometheus+grafana using servicemonitor +* [8185](https://github.com/kubernetes/ingress-nginx/pull/8185) Append elements on match, instead of removing for cors-annotations +* [8179](https://github.com/kubernetes/ingress-nginx/pull/8179) Bump github.com/opencontainers/runc from 1.0.3 to 1.1.0 +* [8173](https://github.com/kubernetes/ingress-nginx/pull/8173) Adding annotations to the controller service account +* [8163](https://github.com/kubernetes/ingress-nginx/pull/8163) Update the $req_id placeholder description +* [8162](https://github.com/kubernetes/ingress-nginx/pull/8162) Versioned static manifests +* [8159](https://github.com/kubernetes/ingress-nginx/pull/8159) Adding some geoip variables and default values +* [8155](https://github.com/kubernetes/ingress-nginx/pull/8155) #7271 feat: avoid-pdb-creation-when-default-backend-disabled-and-replicas-gt-1 +* [8151](https://github.com/kubernetes/ingress-nginx/pull/8151) Automatically generate helm docs +* [8143](https://github.com/kubernetes/ingress-nginx/pull/8143) Allow to configure delay before controller exits +* [8136](https://github.com/kubernetes/ingress-nginx/pull/8136) add ingressClass option to helm chart - back compatibility with ingress.class annotations +* [8126](https://github.com/kubernetes/ingress-nginx/pull/8126) Example for JWT + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.15...helm-chart-4.0.18 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.2.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.2.md new file mode 100644 index 000000000..9dbd003a9 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.2.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.0.2 + +* [7681] https://github.com/kubernetes/ingress-nginx/pull/7681 Release v1.0.1 of ingress-nginx + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.1...helm-chart-4.0.2 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.3.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.3.md new file mode 100644 index 000000000..09b89f66c --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.3.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.0.3 + +* [7707] https://github.com/kubernetes/ingress-nginx/pull/7707 Release v1.0.2 of ingress-nginx + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.2...helm-chart-4.0.3 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.5.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.5.md new file mode 100644 index 000000000..be67704ba --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.5.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.0.5 + +* [7740] https://github.com/kubernetes/ingress-nginx/pull/7740 Release v1.0.3 of ingress-nginx + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.3...helm-chart-4.0.5 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.6.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.6.md new file mode 100644 index 000000000..25276e2be --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.6.md @@ -0,0 +1,12 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.0.6 + +* [7804] https://github.com/kubernetes/ingress-nginx/pull/7804 Release v1.0.4 of ingress-nginx +* [7651] https://github.com/kubernetes/ingress-nginx/pull/7651 Support ipFamilyPolicy and ipFamilies fields in Helm Chart +* [7798] https://github.com/kubernetes/ingress-nginx/pull/7798 Exoscale: use HTTP Healthcheck mode +* [7793] https://github.com/kubernetes/ingress-nginx/pull/7793 Update kube-webhook-certgen to v1.1.1 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.5...helm-chart-4.0.6 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.7.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.7.md new file mode 100644 index 000000000..50fd9227c --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.7.md @@ -0,0 +1,10 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.0.7 + +* [7923] https://github.com/kubernetes/ingress-nginx/pull/7923 Release v1.0.5 of ingress-nginx +* [7806] https://github.com/kubernetes/ingress-nginx/pull/7806 Choice option for internal/external loadbalancer type service + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.6...helm-chart-4.0.7 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.9.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.9.md new file mode 100644 index 000000000..f2f725c93 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.9.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.0.9 + +* [6992] https://github.com/kubernetes/ingress-nginx/pull/6992 Add ability to specify labels for all resources + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.7...helm-chart-4.0.9 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.1.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.1.0.md new file mode 100644 index 000000000..24aaf49ae --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.1.0.md @@ -0,0 +1,21 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.1.0 + +* [8481](https://github.com/kubernetes/ingress-nginx/pull/8481) Fix log creation in chroot script +* [8479](https://github.com/kubernetes/ingress-nginx/pull/8479) changed nginx base img tag to img built with alpine3.14.6 +* [8478](https://github.com/kubernetes/ingress-nginx/pull/8478) update base images and protobuf gomod +* [8468](https://github.com/kubernetes/ingress-nginx/pull/8468) Fallback to ngx.var.scheme for redirectScheme with use-forward-headers when X-Forwarded-Proto is empty +* [8456](https://github.com/kubernetes/ingress-nginx/pull/8456) Implement object deep inspector +* [8455](https://github.com/kubernetes/ingress-nginx/pull/8455) Update dependencies +* [8454](https://github.com/kubernetes/ingress-nginx/pull/8454) Update index.md +* [8447](https://github.com/kubernetes/ingress-nginx/pull/8447) typo fixing +* [8446](https://github.com/kubernetes/ingress-nginx/pull/8446) Fix suggested annotation-value-word-blocklist +* [8444](https://github.com/kubernetes/ingress-nginx/pull/8444) replace deprecated topology key in example with current one +* [8443](https://github.com/kubernetes/ingress-nginx/pull/8443) Add dependency review enforcement +* [8434](https://github.com/kubernetes/ingress-nginx/pull/8434) added new auth-tls-match-cn annotation +* [8426](https://github.com/kubernetes/ingress-nginx/pull/8426) Bump github.com/prometheus/common from 0.32.1 to 0.33.0 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.18...helm-chart-4.1.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.1.2.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.1.2.md new file mode 100644 index 000000000..20618557f --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.1.2.md @@ -0,0 +1,11 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.1.2 + +* [8587](https://github.com/kubernetes/ingress-nginx/pull/8587) Add CAP_SYS_CHROOT to DS/PSP when needed +* [8458](https://github.com/kubernetes/ingress-nginx/pull/8458) Add portNamePrefix Helm chart parameter +* [8522](https://github.com/kubernetes/ingress-nginx/pull/8522) Add documentation for controller.service.loadBalancerIP in Helm chart + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.1.0...helm-chart-4.1.2 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.0.md new file mode 100644 index 000000000..a1f1847ec --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.10.0 + +* - "Update Ingress-Nginx version controller-v1.10.0" + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.9.1...helm-chart-4.10.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.1.md new file mode 100644 index 000000000..3a28de00c --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.1.md @@ -0,0 +1,11 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.10.1 + +* - "update post submit helm ci and clean up (#11221)" +* - "refactor helm ci tests part I (#11188)" +* - "Update Ingress-Nginx version controller-v1.10.1" + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.10.0...helm-chart-4.10.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.2.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.2.md new file mode 100644 index 000000000..399bd98d6 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.2.md @@ -0,0 +1,18 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.10.2 + +* Chores: Align security contacts & chart maintainers to actual owners. (#11480) +* Fix helm install on cloud provider admonition block (#11412) +* edited helm-install tips (#11411) +* added info for aws helm install (#11410) +* add workflow to helm release and update ct for branch (#11317) +* Merge pull request #11277 from strongjz/chart-1.10.1 (#11314) +* release helm chart from release branch (#11278) +* update post submit helm ci and clean up (#11221) +* refactor helm ci tests part I (#11188) +* Update Ingress-Nginx version controller-v1.10.2 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.10.1...helm-chart-4.10.2 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.3.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.3.md new file mode 100644 index 000000000..3f77d405b --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.3.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.10.3 + +* Update Ingress-Nginx version controller-v1.10.3 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.10.2...helm-chart-4.10.3 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.4.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.4.md new file mode 100644 index 000000000..661d3c9bb --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.4.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.10.4 + +* Update Ingress-Nginx version controller-v1.10.4 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.10.3...helm-chart-4.10.4 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.0.md new file mode 100644 index 000000000..64108c04e --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.0.md @@ -0,0 +1,18 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.11.0 + +* Chores: Align security contacts & chart maintainers to actual owners. (#11465) +* Merge pull request #11277 from strongjz/chart-1.10.1 (#11415) +* Fix helm install on cloud provider admonition block (#11394) +* edited helm-install tips (#11393) +* added info for aws helm install (#11390) +* add workflow to helm release and update ct for branch (#11378) +* release helm chart from release branch (#11276) +* update post submit helm ci and clean up (#11220) +* refactor helm ci tests part I (#11178) +* Update Ingress-Nginx version controller-v1.11.0 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.10.2...helm-chart-4.11.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.1.md new file mode 100644 index 000000000..281513e5f --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.1.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.11.1 + +* Update Ingress-Nginx version controller-v1.11.1 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.11.0...helm-chart-4.11.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.2.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.2.md new file mode 100644 index 000000000..c7645a5b6 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.2.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.11.2 + +* Update Ingress-Nginx version controller-v1.11.2 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.11.1...helm-chart-4.11.2 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.12.0-beta.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.12.0-beta.0.md new file mode 100644 index 000000000..fa980f1fb --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.12.0-beta.0.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.12.0-beta.0 + +* Update Ingress-Nginx version controller-v1.12.0-beta.0 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.11.0...helm-chart-4.12.0-beta.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.12.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.12.0.md new file mode 100644 index 000000000..f8f36d499 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.12.0.md @@ -0,0 +1,10 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.12.0 + +* CI: Fix chart testing. (#12258) +* Update Ingress-Nginx version controller-v1.12.0 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.11.0...helm-chart-4.12.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.2.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.2.0.md new file mode 100644 index 000000000..2074a0953 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.2.0.md @@ -0,0 +1,47 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.2.0 + +* Support for Kubernetes v1.19.0 was removed +* [8810](https://github.com/kubernetes/ingress-nginx/pull/8810) Prepare for v1.3.0 +* [8808](https://github.com/kubernetes/ingress-nginx/pull/8808) revert arch var name +* [8805](https://github.com/kubernetes/ingress-nginx/pull/8805) Bump k8s.io/klog/v2 from 2.60.1 to 2.70.1 +* [8803](https://github.com/kubernetes/ingress-nginx/pull/8803) Update to nginx base with alpine v3.16 +* [8802](https://github.com/kubernetes/ingress-nginx/pull/8802) chore: start v1.3.0 release process +* [8798](https://github.com/kubernetes/ingress-nginx/pull/8798) Add v1.24.0 to test matrix +* [8796](https://github.com/kubernetes/ingress-nginx/pull/8796) fix: add MAC_OS variable for static-check +* [8793](https://github.com/kubernetes/ingress-nginx/pull/8793) changed to alpine-v3.16 +* [8781](https://github.com/kubernetes/ingress-nginx/pull/8781) Bump github.com/stretchr/testify from 1.7.5 to 1.8.0 +* [8778](https://github.com/kubernetes/ingress-nginx/pull/8778) chore: remove stable.txt from release process +* [8775](https://github.com/kubernetes/ingress-nginx/pull/8775) Remove stable +* [8773](https://github.com/kubernetes/ingress-nginx/pull/8773) Bump github/codeql-action from 2.1.14 to 2.1.15 +* [8772](https://github.com/kubernetes/ingress-nginx/pull/8772) Bump ossf/scorecard-action from 1.1.1 to 1.1.2 +* [8771](https://github.com/kubernetes/ingress-nginx/pull/8771) fix bullet md format +* [8770](https://github.com/kubernetes/ingress-nginx/pull/8770) Add condition for monitoring.coreos.com/v1 API +* [8769](https://github.com/kubernetes/ingress-nginx/pull/8769) Fix typos and add links to developer guide +* [8767](https://github.com/kubernetes/ingress-nginx/pull/8767) change v1.2.0 to v1.2.1 in deploy doc URLs +* [8765](https://github.com/kubernetes/ingress-nginx/pull/8765) Bump github/codeql-action from 1.0.26 to 2.1.14 +* [8752](https://github.com/kubernetes/ingress-nginx/pull/8752) Bump github.com/spf13/cobra from 1.4.0 to 1.5.0 +* [8751](https://github.com/kubernetes/ingress-nginx/pull/8751) Bump github.com/stretchr/testify from 1.7.2 to 1.7.5 +* [8750](https://github.com/kubernetes/ingress-nginx/pull/8750) added announcement +* [8740](https://github.com/kubernetes/ingress-nginx/pull/8740) change sha e2etestrunner and echoserver +* [8738](https://github.com/kubernetes/ingress-nginx/pull/8738) Update docs to make it easier for noobs to follow step by step +* [8737](https://github.com/kubernetes/ingress-nginx/pull/8737) updated baseimage sha +* [8736](https://github.com/kubernetes/ingress-nginx/pull/8736) set ld-musl-path +* [8733](https://github.com/kubernetes/ingress-nginx/pull/8733) feat: migrate leaderelection lock to leases +* [8726](https://github.com/kubernetes/ingress-nginx/pull/8726) prometheus metric: upstream_latency_seconds +* [8720](https://github.com/kubernetes/ingress-nginx/pull/8720) Ci pin deps +* [8719](https://github.com/kubernetes/ingress-nginx/pull/8719) Working OpenTelemetry sidecar (base nginx image) +* [8714](https://github.com/kubernetes/ingress-nginx/pull/8714) Create Openssf scorecard +* [8708](https://github.com/kubernetes/ingress-nginx/pull/8708) Bump github.com/prometheus/common from 0.34.0 to 0.35.0 +* [8703](https://github.com/kubernetes/ingress-nginx/pull/8703) Bump actions/dependency-review-action from 1 to 2 +* [8701](https://github.com/kubernetes/ingress-nginx/pull/8701) Fix several typos +* [8699](https://github.com/kubernetes/ingress-nginx/pull/8699) fix the gosec test and a make target for it +* [8698](https://github.com/kubernetes/ingress-nginx/pull/8698) Bump actions/upload-artifact from 2.3.1 to 3.1.0 +* [8697](https://github.com/kubernetes/ingress-nginx/pull/8697) Bump actions/setup-go from 2.2.0 to 3.2.0 +* [8695](https://github.com/kubernetes/ingress-nginx/pull/8695) Bump actions/download-artifact from 2 to 3 +* [8694](https://github.com/kubernetes/ingress-nginx/pull/8694) Bump crazy-max/ghaction-docker-buildx from 1.6.2 to 3.3.1 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.1.2...helm-chart-4.2.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.2.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.2.1.md new file mode 100644 index 000000000..7965bb1c2 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.2.1.md @@ -0,0 +1,10 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.2.1 + +* The sha of kube-webhook-certgen image & the opentelemetry image, in values file, was changed to new images built on alpine-v3.16.1 +* [8896](https://github.com/kubernetes/ingress-nginx/pull/8896) updated to new images built today + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.2.0...helm-chart-4.2.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.3.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.3.0.md new file mode 100644 index 000000000..f9dca22d9 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.3.0.md @@ -0,0 +1,14 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.3.0 + +* Support for Kubernetes v.1.25.0 was added and support for endpoint slices +* Support for Kubernetes v1.20.0 and v1.21.0 was removed +* [8890](https://github.com/kubernetes/ingress-nginx/pull/8890) migrate to endpointslices +* [9059](https://github.com/kubernetes/ingress-nginx/pull/9059) kubewebhookcertgen sha change after go1191 +* [9046](https://github.com/kubernetes/ingress-nginx/pull/9046) Parameterize metrics port name +* [9104](https://github.com/kubernetes/ingress-nginx/pull/9104) Fix yaml formatting error with multiple annotations + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.2.1...helm-chart-4.3.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.4.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.4.0.md new file mode 100644 index 000000000..20f9e2336 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.4.0.md @@ -0,0 +1,12 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.4.0 + +* Adding support for disabling liveness and readiness probes to the Helm chart by @njegosrailic in https://github.com/kubernetes/ingress-nginx/pull/9238 +* add:(admission-webhooks) ability to set securityContext by @ybelMekk in https://github.com/kubernetes/ingress-nginx/pull/9186 +* #7652 - Updated Helm chart to use the fullname for the electionID if not specified. by @FutureMatt in https://github.com/kubernetes/ingress-nginx/pull/9133 +* Rename controller-wehbooks-networkpolicy.yaml. by @Gacko in https://github.com/kubernetes/ingress-nginx/pull/9123 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.3.0...helm-chart-4.4.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.5.2.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.5.2.md new file mode 100644 index 000000000..b6d8a3b0c --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.5.2.md @@ -0,0 +1,13 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.5.2 + +* add lint on chart before release (#9570) +* ci: remove setup-helm step (#9404) +* feat(helm): Optionally use cert-manager instead admission patch (#9279) +* run helm release on main only and when the chart/value changes only (#9290) +* Update Ingress-Nginx version controller-v1.6.4 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.4.3...helm-chart-4.5.2 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.6.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.6.0.md new file mode 100644 index 000000000..469aaba8c --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.6.0.md @@ -0,0 +1,24 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.5.3 + +* docs(helm): fix value key in readme for enabling certManager (#9640) +* Upgrade alpine 3.17.2 +* Upgrade golang 1.20 +* Drop testing/support for Kubernetes 1.23 +* docs(helm): fix value key in readme for enabling certManager (#9640) +* Update Ingress-Nginx version controller-v1.7.0 +* feat: OpenTelemetry module integration (#9062) +* canary-weight-total annotation ignored in rule backends (#9729) +* fix controller psp's volume config (#9740) +* Fix several Helm YAML issues with extraModules and extraInitContainers (#9709) +* Chart: Drop `controller.headers`, rework DH param secret. (#9659) +* Deployment/DaemonSet: Label pods using `ingress-nginx.labels`. (#9732) +* HPA: autoscaling/v2beta1 deprecated, bump apiVersion to v2 for defaultBackend (#9731) +* Fix incorrect annotation name in upstream hashing configuration (#9617) + +* Update Ingress-Nginx version controller-v1.7.0 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.5.2...helm-chart-4.6.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.6.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.6.1.md new file mode 100644 index 000000000..57d99b8db --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.6.1.md @@ -0,0 +1,11 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.6.1 + +* [helm] Support custom port configuration for internal service (#9846) +* Adding resource type to default HPA configuration to resolve issues with Terraform helm chart usage (#9803) +* Update Ingress-Nginx version controller-v1.7.1 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.6.0...helm-chart-4.6.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.0.md new file mode 100644 index 000000000..9d5407053 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.0.md @@ -0,0 +1,14 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.7.0 + +* helm: Fix opentelemetry module installation for daemonset (#9792) +* Update charts/* to keep project name display aligned (#9931) +* HPA: Use capabilities & align manifests. (#9521) +* PodDisruptionBudget spec logic update (#9904) +* add option for annotations in PodDisruptionBudget (#9843) +* Update Ingress-Nginx version controller-v1.8.0 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.6.1...helm-chart-4.7.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.1.md new file mode 100644 index 000000000..4d69a7117 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.1.md @@ -0,0 +1,12 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.7.1 + +* Added a doc line to the missing helm value service.internal.loadBalancerIP (#9406) +* feat(helm): Add loadBalancerClass (#9562) +* added helmshowvalues example (#10019) +* Update Ingress-Nginx version controller-v1.8.1 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.7.0...helm-chart-4.7.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.2.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.2.md new file mode 100644 index 000000000..57b17b982 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.2.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.7.2 + +* Update Ingress-Nginx version controller-v1.8.2 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.7.1...helm-chart-4.7.2 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.0-beta.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.0-beta.0.md new file mode 100644 index 000000000..9072a75b4 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.0-beta.0.md @@ -0,0 +1,13 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.8.0-beta.0 + +* ci(helm): fix Helm Chart release action 422 error (#10237) +* helm: Use .Release.Namespace as default for ServiceMonitor namespace (#10249) +* [helm] configure allow to configure hostAliases (#10180) +* [helm] pass service annotations through helm tpl engine (#10084) +* Update Ingress-Nginx version controller-v1.9.0-beta.0 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.7.2...helm-chart-4.8.0-beta.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.0.md new file mode 100644 index 000000000..af8f1241f --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.0.md @@ -0,0 +1,13 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.8.0 + +* ci(helm): fix Helm Chart release action 422 error (#10237) +* helm: Use .Release.Namespace as default for ServiceMonitor namespace (#10249) +* [helm] configure allow to configure hostAliases (#10180) +* [helm] pass service annotations through helm tpl engine (#10084) +* Update Ingress-Nginx version controller-v1.9.0 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.7.2...helm-chart-4.8.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.1.md new file mode 100644 index 000000000..53a4493de --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.1.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.8.1 + +* Update Ingress-Nginx version controller-v1.9.1 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.8.0...helm-chart-4.8.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.2.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.2.md new file mode 100644 index 000000000..9957c1a85 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.2.md @@ -0,0 +1,10 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.8.2 + +* update nginx base, httpbun, e2e, helm webhook cert gen (#10506) +* Update Ingress-Nginx version controller-v1.9.3 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.8.1...helm-chart-4.8.2 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.3.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.3.md new file mode 100644 index 000000000..b8d4d56b3 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.3.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.8.3 + +* Update Ingress-Nginx version controller-v1.9.4 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.8.2...helm-chart-4.8.3 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.9.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.9.0.md new file mode 100644 index 000000000..5c7729866 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.9.0.md @@ -0,0 +1,13 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.9.0 + +* - "Add controller.metrics.serviceMonitor.annotations in Helm chart" +* - "fix(labels): use complete labels variable on default-backend deployment" +* - "chart: allow setting allocateLoadBalancerNodePorts (#10693)" +* - "[release-1.9] feat(helm): add documentation about metric args (#10695)" +* - "Update Ingress-Nginx version controller-v1.9.5" + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.8.3...helm-chart-4.9.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.9.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.9.1.md new file mode 100644 index 000000000..c6120e736 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.9.1.md @@ -0,0 +1,10 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.9.1 + +* - "update web hook cert gen to latest release v20231226-1a7112e06" +* - "Update Ingress-Nginx version controller-v1.9.6" + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.9.0...helm-chart-4.9.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart.md.gotmpl b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart.md.gotmpl new file mode 100644 index 000000000..ef5add55d --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart.md.gotmpl @@ -0,0 +1,11 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### {{ .NewHelmChartVersion }} +{{ with .HelmUpdates }} +{{- range . }} +* {{ . }} +{{- end }} +{{ end }} +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-{{ .PreviousHelmChartVersion }}...helm-chart-{{ .NewHelmChartVersion }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/admission-webhooks-cert-manager-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/admission-webhooks-cert-manager-values.yaml new file mode 100644 index 000000000..7eafd0c5b --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/ci/admission-webhooks-cert-manager-values.yaml @@ -0,0 +1,12 @@ +controller: + image: + repository: ingress-controller/controller + tag: 1.0.0-dev + digest: null + + service: + type: ClusterIP + + admissionWebhooks: + certManager: + enabled: true diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-addheaders-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-addheaders-values.yaml new file mode 100644 index 000000000..460a610ba --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-addheaders-values.yaml @@ -0,0 +1,11 @@ +controller: + image: + repository: ingress-controller/controller + tag: 1.0.0-dev + digest: null + + service: + type: ClusterIP + + addHeaders: + X-Frame-Options: deny diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-proxyheaders-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-proxyheaders-values.yaml new file mode 100644 index 000000000..e23a13c0c --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-proxyheaders-values.yaml @@ -0,0 +1,11 @@ +controller: + image: + repository: ingress-controller/controller + tag: 1.0.0-dev + digest: null + + service: + type: ClusterIP + + proxySetHeaders: + X-Forwarded-Proto: https diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-values.yaml new file mode 100644 index 000000000..a7029895c --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-values.yaml @@ -0,0 +1,11 @@ +controller: + image: + repository: ingress-controller/controller + tag: 1.0.0-dev + digest: null + + service: + type: ClusterIP + + config: + use-proxy-protocol: "true" diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-metrics-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-metrics-values.yaml new file mode 100644 index 000000000..7a98580cd --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-metrics-values.yaml @@ -0,0 +1,13 @@ +controller: + image: + repository: ingress-controller/controller + tag: 1.0.0-dev + digest: null + + service: + type: ClusterIP + + kind: DaemonSet + + metrics: + enabled: true diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-podannotations-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-podannotations-values.yaml new file mode 100644 index 000000000..405992ef3 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-podannotations-values.yaml @@ -0,0 +1,16 @@ +controller: + image: + repository: ingress-controller/controller + tag: 1.0.0-dev + digest: null + + service: + type: ClusterIP + + kind: DaemonSet + + podAnnotations: + prometheus.io/scrape: "true" + prometheus.io/port: "10254" + prometheus.io/scheme: http + prometheus.io/path: /metrics diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-values.yaml new file mode 100644 index 000000000..d34025c80 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-values.yaml @@ -0,0 +1,10 @@ +controller: + image: + repository: ingress-controller/controller + tag: 1.0.0-dev + digest: null + + service: + type: ClusterIP + + kind: DaemonSet diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-metrics-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-metrics-values.yaml new file mode 100644 index 000000000..9c95d347c --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-metrics-values.yaml @@ -0,0 +1,13 @@ +controller: + image: + repository: ingress-controller/controller + tag: 1.0.0-dev + digest: null + + service: + type: ClusterIP + + kind: Deployment + + metrics: + enabled: true diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-podannotations-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-podannotations-values.yaml new file mode 100644 index 000000000..cf1f2611e --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-podannotations-values.yaml @@ -0,0 +1,16 @@ +controller: + image: + repository: ingress-controller/controller + tag: 1.0.0-dev + digest: null + + service: + type: ClusterIP + + kind: Deployment + + podAnnotations: + prometheus.io/scrape: "true" + prometheus.io/port: "10254" + prometheus.io/scheme: http + prometheus.io/path: /metrics diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-values.yaml new file mode 100644 index 000000000..1b092dc0c --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-values.yaml @@ -0,0 +1,10 @@ +controller: + image: + repository: ingress-controller/controller + tag: 1.0.0-dev + digest: null + + service: + type: ClusterIP + + kind: Deployment diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-hpa-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-hpa-values.yaml new file mode 100644 index 000000000..54a0d2f75 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-hpa-values.yaml @@ -0,0 +1,18 @@ +controller: + image: + repository: ingress-controller/controller + tag: 1.0.0-dev + digest: null + + service: + type: ClusterIP + + autoscaling: + enabled: true + behavior: + scaleDown: + stabilizationWindowSeconds: 300 + policies: + - type: Pods + value: 1 + periodSeconds: 180 diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-ingressclass-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-ingressclass-values.yaml new file mode 100644 index 000000000..c06429f97 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-ingressclass-values.yaml @@ -0,0 +1,15 @@ +controller: + image: + repository: ingress-controller/controller + tag: 1.0.0-dev + digest: null + + service: + type: ClusterIP + + ingressClassResource: + name: custom-nginx + default: true + controllerValue: k8s.io/custom-nginx + + watchIngressWithoutClass: true diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-service-internal-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-service-internal-values.yaml new file mode 100644 index 000000000..11108fbce --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-service-internal-values.yaml @@ -0,0 +1,13 @@ +controller: + image: + repository: ingress-controller/controller + tag: 1.0.0-dev + digest: null + + service: + type: ClusterIP + + internal: + enabled: true + annotations: + service.beta.kubernetes.io/aws-load-balancer-internal: "true" diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-service-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-service-values.yaml new file mode 100644 index 000000000..9039368c2 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-service-values.yaml @@ -0,0 +1,22 @@ +controller: + image: + repository: ingress-controller/controller + tag: 1.0.0-dev + digest: null + + service: + type: NodePort + + nodePorts: + tcp: + 9000: 30090 + udp: + 9001: 30091 + +portNamePrefix: port + +tcp: + 9000: default/test:8080 + +udp: + 9001: default/test:8080 diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/NOTES.txt b/charts/devtron-utilities/charts/ingress-nginx/templates/NOTES.txt new file mode 100644 index 000000000..f4923007e --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/NOTES.txt @@ -0,0 +1,73 @@ +The ingress-nginx controller has been installed. + +{{- if contains "NodePort" .Values.controller.service.type }} +Get the application URL by running these commands: + +{{- if (not (empty .Values.controller.service.nodePorts.http)) }} + export HTTP_NODE_PORT={{ .Values.controller.service.nodePorts.http }} +{{- else }} + export HTTP_NODE_PORT=$(kubectl get service --namespace {{ include "ingress-nginx.namespace" . }} {{ include "ingress-nginx.controller.fullname" . }} --output jsonpath="{.spec.ports[0].nodePort}") +{{- end }} +{{- if (not (empty .Values.controller.service.nodePorts.https)) }} + export HTTPS_NODE_PORT={{ .Values.controller.service.nodePorts.https }} +{{- else }} + export HTTPS_NODE_PORT=$(kubectl get service --namespace {{ include "ingress-nginx.namespace" . }} {{ include "ingress-nginx.controller.fullname" . }} --output jsonpath="{.spec.ports[1].nodePort}") +{{- end }} + export NODE_IP="$(kubectl get nodes --output jsonpath="{.items[0].status.addresses[1].address}")" + + echo "Visit http://${NODE_IP}:${HTTP_NODE_PORT} to access your application via HTTP." + echo "Visit https://${NODE_IP}:${HTTPS_NODE_PORT} to access your application via HTTPS." +{{- else if contains "LoadBalancer" .Values.controller.service.type }} +It may take a few minutes for the load balancer IP to be available. +You can watch the status by running 'kubectl get service --namespace {{ include "ingress-nginx.namespace" . }} {{ include "ingress-nginx.controller.fullname" . }} --output wide --watch' +{{- else if contains "ClusterIP" .Values.controller.service.type }} +Get the application URL by running these commands: + export POD_NAME="$(kubectl get pods --namespace {{ include "ingress-nginx.namespace" . }} --selector app.kubernetes.io/name={{ include "ingress-nginx.name" . }},app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=controller --output jsonpath="{.items[0].metadata.name}")" + kubectl port-forward --namespace {{ include "ingress-nginx.namespace" . }} "${POD_NAME}" 8080:80 + echo "Visit http://127.0.0.1:8080 to access your application." +{{- end }} + +An example Ingress that makes use of the controller: + +{{- $isV1 := semverCompare ">=1" .Chart.AppVersion}} + apiVersion: networking.k8s.io/v1 + kind: Ingress + metadata: + name: example + namespace: foo + {{- if eq $isV1 false }} + annotations: + kubernetes.io/ingress.class: {{ .Values.controller.ingressClass }} + {{- end }} + spec: + {{- if $isV1 }} + ingressClassName: {{ .Values.controller.ingressClassResource.name }} + {{- end }} + rules: + - host: www.example.com + http: + paths: + - pathType: Prefix + backend: + service: + name: exampleService + port: + number: 80 + path: / + # This section is only required if TLS is to be enabled for the Ingress + tls: + - hosts: + - www.example.com + secretName: example-tls + +If TLS is enabled for the Ingress, a Secret containing the certificate and key must also be provided: + + apiVersion: v1 + kind: Secret + metadata: + name: example-tls + namespace: foo + data: + tls.crt: + tls.key: + type: kubernetes.io/tls diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/_helpers.tpl b/charts/devtron-utilities/charts/ingress-nginx/templates/_helpers.tpl new file mode 100644 index 000000000..6cbda2d4d --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/_helpers.tpl @@ -0,0 +1,263 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "ingress-nginx.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "ingress-nginx.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "ingress-nginx.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Expand the namespace of the release. +Allows overriding it for multi-namespace deployments in combined charts. +*/}} +{{- define "ingress-nginx.namespace" -}} +{{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Controller container security context. +*/}} +{{- define "ingress-nginx.controller.containerSecurityContext" -}} +{{- if .Values.controller.containerSecurityContext -}} +{{- toYaml .Values.controller.containerSecurityContext -}} +{{- else -}} +runAsNonRoot: {{ .Values.controller.image.runAsNonRoot }} +runAsUser: {{ .Values.controller.image.runAsUser }} +runAsGroup: {{ .Values.controller.image.runAsGroup }} +allowPrivilegeEscalation: {{ or .Values.controller.image.allowPrivilegeEscalation .Values.controller.image.chroot }} +{{- if .Values.controller.image.seccompProfile }} +seccompProfile: {{ toYaml .Values.controller.image.seccompProfile | nindent 2 }} +{{- end }} +capabilities: + drop: + - ALL + add: + - NET_BIND_SERVICE + {{- if .Values.controller.image.chroot }} + {{- if .Values.controller.image.seccompProfile }} + - SYS_ADMIN + {{- end }} + - SYS_CHROOT + {{- end }} +readOnlyRootFilesystem: {{ .Values.controller.image.readOnlyRootFilesystem }} +{{- end -}} +{{- end -}} + +{{/* +Get specific image +*/}} +{{- define "ingress-nginx.image" -}} +{{- if .chroot -}} +{{- printf "%s-chroot" .image -}} +{{- else -}} +{{- printf "%s" .image -}} +{{- end }} +{{- end -}} + +{{/* +Get specific image digest +*/}} +{{- define "ingress-nginx.imageDigest" -}} +{{- if .chroot -}} +{{- if .digestChroot -}} +{{- printf "@%s" .digestChroot -}} +{{- end }} +{{- else -}} +{{ if .digest -}} +{{- printf "@%s" .digest -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create a default fully qualified controller name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "ingress-nginx.controller.fullname" -}} +{{- printf "%s-%s" (include "ingress-nginx.fullname" .) .Values.controller.name | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Construct a unique electionID. +Users can provide an override for an explicit electionID if they want via `.Values.controller.electionID` +*/}} +{{- define "ingress-nginx.controller.electionID" -}} +{{- $defElectionID := printf "%s-leader" (include "ingress-nginx.fullname" .) -}} +{{- $electionID := default $defElectionID .Values.controller.electionID -}} +{{- print $electionID -}} +{{- end -}} + +{{/* +Construct the path for the publish-service. + +By convention this will simply use the / to match the name of the +service generated. + +Users can provide an override for an explicit service they want bound via `.Values.controller.publishService.pathOverride` +*/}} +{{- define "ingress-nginx.controller.publishServicePath" -}} +{{- $defServiceName := printf "%s/%s" "$(POD_NAMESPACE)" (include "ingress-nginx.controller.fullname" .) -}} +{{- $servicePath := default $defServiceName .Values.controller.publishService.pathOverride }} +{{- print $servicePath | trimSuffix "-" -}} +{{- end -}} + +{{/* +Common labels +*/}} +{{- define "ingress-nginx.labels" -}} +helm.sh/chart: {{ include "ingress-nginx.chart" . }} +{{ include "ingress-nginx.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/part-of: {{ template "ingress-nginx.name" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- if .Values.commonLabels}} +{{ toYaml .Values.commonLabels }} +{{- end }} +{{- end -}} + +{{/* +Selector labels +*/}} +{{- define "ingress-nginx.selectorLabels" -}} +app.kubernetes.io/name: {{ include "ingress-nginx.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end -}} + +{{/* +Create the name of the controller service account to use +*/}} +{{- define "ingress-nginx.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "ingress-nginx.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Create a default fully qualified admission webhook name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "ingress-nginx.admissionWebhooks.fullname" -}} +{{- printf "%s-%s" (include "ingress-nginx.fullname" .) .Values.controller.admissionWebhooks.name | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create the name of the admission webhook patch job service account to use +*/}} +{{- define "ingress-nginx.admissionWebhooks.patch.serviceAccountName" -}} +{{- if .Values.controller.admissionWebhooks.patch.serviceAccount.create -}} + {{ default (include "ingress-nginx.admissionWebhooks.fullname" .) .Values.controller.admissionWebhooks.patch.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.controller.admissionWebhooks.patch.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Create a default fully qualified admission webhook secret creation job name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "ingress-nginx.admissionWebhooks.createSecretJob.fullname" -}} +{{- printf "%s-%s" (include "ingress-nginx.admissionWebhooks.fullname" .) .Values.controller.admissionWebhooks.createSecretJob.name | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified admission webhook patch job name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "ingress-nginx.admissionWebhooks.patchWebhookJob.fullname" -}} +{{- printf "%s-%s" (include "ingress-nginx.admissionWebhooks.fullname" .) .Values.controller.admissionWebhooks.patchWebhookJob.name | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified default backend name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "ingress-nginx.defaultBackend.fullname" -}} +{{- printf "%s-%s" (include "ingress-nginx.fullname" .) .Values.defaultBackend.name | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create the name of the default backend service account to use +*/}} +{{- define "ingress-nginx.defaultBackend.serviceAccountName" -}} +{{- if .Values.defaultBackend.serviceAccount.create -}} + {{ default (printf "%s-backend" (include "ingress-nginx.fullname" .)) .Values.defaultBackend.serviceAccount.name }} +{{- else -}} + {{ default "default-backend" .Values.defaultBackend.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Default backend container security context. +*/}} +{{- define "ingress-nginx.defaultBackend.containerSecurityContext" -}} +{{- if .Values.defaultBackend.containerSecurityContext -}} +{{- toYaml .Values.defaultBackend.containerSecurityContext -}} +{{- else -}} +runAsNonRoot: {{ .Values.defaultBackend.image.runAsNonRoot }} +runAsUser: {{ .Values.defaultBackend.image.runAsUser }} +runAsGroup: {{ .Values.defaultBackend.image.runAsGroup }} +allowPrivilegeEscalation: {{ .Values.defaultBackend.image.allowPrivilegeEscalation }} +{{- if .Values.defaultBackend.image.seccompProfile }} +seccompProfile: {{ toYaml .Values.defaultBackend.image.seccompProfile | nindent 2 }} +{{- end }} +capabilities: + drop: + - ALL +readOnlyRootFilesystem: {{ .Values.defaultBackend.image.readOnlyRootFilesystem }} +{{- end -}} +{{- end -}} + +{{/* +Extra modules. +*/}} +{{- define "extraModules" -}} +- name: {{ .name }} + {{- with .image }} + image: {{ if .repository }}{{ .repository }}{{ else }}{{ .registry }}/{{ .image }}{{ end }}:{{ .tag }}{{ if .digest }}@{{ .digest }}{{ end }} + command: + {{- if .distroless }} + - /init_module + {{- else }} + - sh + - -c + - /usr/local/bin/init_module.sh + {{- end }} + {{- end }} + {{- if .containerSecurityContext }} + securityContext: {{ toYaml .containerSecurityContext | nindent 4 }} + {{- end }} + {{- if .resources }} + resources: {{ toYaml .resources | nindent 4 }} + {{- end }} + volumeMounts: + - name: modules + mountPath: /modules_mount +{{- end -}} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/_params.tpl b/charts/devtron-utilities/charts/ingress-nginx/templates/_params.tpl new file mode 100644 index 000000000..0051dc9c0 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/_params.tpl @@ -0,0 +1,77 @@ +{{- define "ingress-nginx.params" -}} +- /nginx-ingress-controller +{{- if not .Values.controller.enableAnnotationValidations }} +- --enable-annotation-validation=false +{{- end }} +{{- if .Values.defaultBackend.enabled }} +- --default-backend-service=$(POD_NAMESPACE)/{{ include "ingress-nginx.defaultBackend.fullname" . }} +{{- end }} +{{- if and .Values.controller.publishService.enabled .Values.controller.service.enabled }} +{{- if .Values.controller.service.external.enabled }} +- --publish-service={{ template "ingress-nginx.controller.publishServicePath" . }} +{{- else if .Values.controller.service.internal.enabled }} +- --publish-service={{ template "ingress-nginx.controller.publishServicePath" . }}-internal +{{- end }} +{{- end }} +- --election-id={{ include "ingress-nginx.controller.electionID" . }} +- --controller-class={{ .Values.controller.ingressClassResource.controllerValue }} +{{- if .Values.controller.ingressClass }} +- --ingress-class={{ .Values.controller.ingressClass }} +{{- end }} +- --configmap={{ default "$(POD_NAMESPACE)" .Values.controller.configMapNamespace }}/{{ include "ingress-nginx.controller.fullname" . }} +{{- if .Values.tcp }} +- --tcp-services-configmap={{ default "$(POD_NAMESPACE)" .Values.controller.tcp.configMapNamespace }}/{{ include "ingress-nginx.fullname" . }}-tcp +{{- end }} +{{- if .Values.udp }} +- --udp-services-configmap={{ default "$(POD_NAMESPACE)" .Values.controller.udp.configMapNamespace }}/{{ include "ingress-nginx.fullname" . }}-udp +{{- end }} +{{- if .Values.controller.scope.enabled }} +- --watch-namespace={{ default "$(POD_NAMESPACE)" .Values.controller.scope.namespace }} +{{- end }} +{{- if and (not .Values.controller.scope.enabled) .Values.controller.scope.namespaceSelector }} +- --watch-namespace-selector={{ .Values.controller.scope.namespaceSelector }} +{{- end }} +{{- if and .Values.controller.reportNodeInternalIp .Values.controller.hostNetwork }} +- --report-node-internal-ip-address={{ .Values.controller.reportNodeInternalIp }} +{{- end }} +{{- if .Values.controller.admissionWebhooks.enabled }} +- --validating-webhook=:{{ .Values.controller.admissionWebhooks.port }} +- --validating-webhook-certificate={{ .Values.controller.admissionWebhooks.certificate }} +- --validating-webhook-key={{ .Values.controller.admissionWebhooks.key }} +{{- end }} +{{- if .Values.controller.maxmindLicenseKey }} +- --maxmind-license-key={{ .Values.controller.maxmindLicenseKey }} +{{- end }} +{{- if .Values.controller.healthCheckHost }} +- --healthz-host={{ .Values.controller.healthCheckHost }} +{{- end }} +{{- if not (eq .Values.controller.healthCheckPath "/healthz") }} +- --health-check-path={{ .Values.controller.healthCheckPath }} +{{- end }} +{{- if .Values.controller.ingressClassByName }} +- --ingress-class-by-name=true +{{- end }} +{{- if .Values.controller.watchIngressWithoutClass }} +- --watch-ingress-without-class=true +{{- end }} +{{- if .Values.controller.metrics.enabled }} +- --enable-metrics={{ .Values.controller.metrics.enabled }} +{{- end }} +{{- if .Values.controller.enableTopologyAwareRouting }} +- --enable-topology-aware-routing=true +{{- end }} +{{- if .Values.controller.disableLeaderElection }} +- --disable-leader-election=true +{{- end }} +{{- if .Values.controller.electionTTL }} +- --election-ttl={{ .Values.controller.electionTTL }} +{{- end }} +{{- range $key, $value := .Values.controller.extraArgs }} +{{- /* Accept keys without values or with false as value */}} +{{- if eq ($value | quote | len) 2 }} +- --{{ $key }} +{{- else }} +- --{{ $key }}={{ $value }} +{{- end }} +{{- end }} +{{- end -}} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/cert-manager.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/cert-manager.yaml new file mode 100644 index 000000000..db2946c3d --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/cert-manager.yaml @@ -0,0 +1,63 @@ +{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.certManager.enabled -}} +{{- if not .Values.controller.admissionWebhooks.certManager.issuerRef -}} +# Create a selfsigned Issuer, in order to create a root CA certificate for +# signing webhook serving certificates +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: {{ include "ingress-nginx.fullname" . }}-self-signed-issuer + namespace: {{ include "ingress-nginx.namespace" . }} +spec: + selfSigned: {} +--- +# Generate a CA Certificate used to sign certificates for the webhook +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: {{ include "ingress-nginx.fullname" . }}-root-cert + namespace: {{ include "ingress-nginx.namespace" . }} +spec: + secretName: {{ include "ingress-nginx.fullname" . }}-root-cert + duration: {{ .Values.controller.admissionWebhooks.certManager.rootCert.duration | default "43800h0m0s" | quote }} + issuerRef: + name: {{ include "ingress-nginx.fullname" . }}-self-signed-issuer + commonName: "ca.webhook.ingress-nginx" + isCA: true + subject: + organizations: + - ingress-nginx +--- +# Create an Issuer that uses the above generated CA certificate to issue certs +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: {{ include "ingress-nginx.fullname" . }}-root-issuer + namespace: {{ include "ingress-nginx.namespace" . }} +spec: + ca: + secretName: {{ include "ingress-nginx.fullname" . }}-root-cert +{{- end }} +--- +# generate a server certificate for the apiservices to use +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} + namespace: {{ include "ingress-nginx.namespace" . }} +spec: + secretName: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} + duration: {{ .Values.controller.admissionWebhooks.certManager.admissionCert.duration | default "8760h0m0s" | quote }} + issuerRef: + {{- if .Values.controller.admissionWebhooks.certManager.issuerRef }} + {{- toYaml .Values.controller.admissionWebhooks.certManager.issuerRef | nindent 4 }} + {{- else }} + name: {{ include "ingress-nginx.fullname" . }}-root-issuer + {{- end }} + dnsNames: + - {{ include "ingress-nginx.controller.fullname" . }}-admission + - {{ include "ingress-nginx.controller.fullname" . }}-admission.{{ include "ingress-nginx.namespace" . }} + - {{ include "ingress-nginx.controller.fullname" . }}-admission.{{ include "ingress-nginx.namespace" . }}.svc + subject: + organizations: + - ingress-nginx-admission +{{- end -}} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml new file mode 100644 index 000000000..54af7abb6 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml @@ -0,0 +1,23 @@ +{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled .Values.controller.admissionWebhooks.patch.rbac.create (not .Values.controller.admissionWebhooks.certManager.enabled) -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} + annotations: + "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: admission-webhook + {{- with .Values.controller.admissionWebhooks.patch.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} +rules: + - apiGroups: + - admissionregistration.k8s.io + resources: + - validatingwebhookconfigurations + verbs: + - get + - update +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml new file mode 100644 index 000000000..b89388433 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml @@ -0,0 +1,23 @@ +{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled .Values.controller.admissionWebhooks.patch.rbac.create (not .Values.controller.admissionWebhooks.certManager.enabled) -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} + annotations: + "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: admission-webhook + {{- with .Values.controller.admissionWebhooks.patch.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ include "ingress-nginx.admissionWebhooks.patch.serviceAccountName" . }} + namespace: {{ include "ingress-nginx.namespace" . }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml new file mode 100644 index 000000000..af3ea12a3 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml @@ -0,0 +1,79 @@ +{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled (not .Values.controller.admissionWebhooks.certManager.enabled) -}} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "ingress-nginx.admissionWebhooks.createSecretJob.fullname" . }} + namespace: {{ include "ingress-nginx.namespace" . }} + annotations: + "helm.sh/hook": pre-install,pre-upgrade + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + {{- with .Values.controller.admissionWebhooks.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: admission-webhook + {{- with .Values.controller.admissionWebhooks.patch.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: +{{- if .Capabilities.APIVersions.Has "batch/v1alpha1" }} + # Alpha feature since k8s 1.12 + ttlSecondsAfterFinished: 0 +{{- end }} + template: + metadata: + name: {{ include "ingress-nginx.admissionWebhooks.createSecretJob.fullname" . }} + {{- if .Values.controller.admissionWebhooks.patch.podAnnotations }} + annotations: {{ toYaml .Values.controller.admissionWebhooks.patch.podAnnotations | nindent 8 }} + {{- end }} + labels: + {{- include "ingress-nginx.labels" . | nindent 8 }} + app.kubernetes.io/component: admission-webhook + {{- with .Values.controller.admissionWebhooks.patch.labels }} + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- if .Values.controller.admissionWebhooks.patch.priorityClassName }} + priorityClassName: {{ .Values.controller.admissionWebhooks.patch.priorityClassName }} + {{- end }} + {{- if .Values.imagePullSecrets }} + imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 8 }} + {{- end }} + containers: + - name: create + {{- with (merge .Values.controller.admissionWebhooks.patch.image .Values.global.image) }} + image: {{ if .repository }}{{ .repository }}{{ else }}{{ .registry }}/{{ .image }}{{ end }}:{{ .tag }}{{ if .digest }}@{{ .digest }}{{ end }} + {{- end }} + imagePullPolicy: {{ .Values.controller.admissionWebhooks.patch.image.pullPolicy }} + args: + - create + - --host={{ include "ingress-nginx.controller.fullname" . }}-admission,{{ include "ingress-nginx.controller.fullname" . }}-admission.$(POD_NAMESPACE).svc + - --namespace=$(POD_NAMESPACE) + - --secret-name={{ include "ingress-nginx.admissionWebhooks.fullname" . }} + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- if .Values.controller.admissionWebhooks.extraEnvs }} + {{- toYaml .Values.controller.admissionWebhooks.extraEnvs | nindent 12 }} + {{- end }} + {{- if .Values.controller.admissionWebhooks.createSecretJob.securityContext }} + securityContext: {{ toYaml .Values.controller.admissionWebhooks.createSecretJob.securityContext | nindent 12 }} + {{- end }} + {{- if .Values.controller.admissionWebhooks.createSecretJob.resources }} + resources: {{ toYaml .Values.controller.admissionWebhooks.createSecretJob.resources | nindent 12 }} + {{- end }} + restartPolicy: OnFailure + serviceAccountName: {{ include "ingress-nginx.admissionWebhooks.patch.serviceAccountName" . }} + {{- if .Values.controller.admissionWebhooks.patch.nodeSelector }} + nodeSelector: {{ toYaml .Values.controller.admissionWebhooks.patch.nodeSelector | nindent 8 }} + {{- end }} + {{- if .Values.controller.admissionWebhooks.patch.tolerations }} + tolerations: {{ toYaml .Values.controller.admissionWebhooks.patch.tolerations | nindent 8 }} + {{- end }} + {{- if .Values.controller.admissionWebhooks.patch.securityContext }} + securityContext: {{ toYaml .Values.controller.admissionWebhooks.patch.securityContext | nindent 8 }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml new file mode 100644 index 000000000..87dd2c251 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml @@ -0,0 +1,81 @@ +{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled (not .Values.controller.admissionWebhooks.certManager.enabled) -}} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "ingress-nginx.admissionWebhooks.patchWebhookJob.fullname" . }} + namespace: {{ include "ingress-nginx.namespace" . }} + annotations: + "helm.sh/hook": post-install,post-upgrade + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + {{- with .Values.controller.admissionWebhooks.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: admission-webhook + {{- with .Values.controller.admissionWebhooks.patch.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: +{{- if .Capabilities.APIVersions.Has "batch/v1alpha1" }} + # Alpha feature since k8s 1.12 + ttlSecondsAfterFinished: 0 +{{- end }} + template: + metadata: + name: {{ include "ingress-nginx.admissionWebhooks.patchWebhookJob.fullname" . }} + {{- if .Values.controller.admissionWebhooks.patch.podAnnotations }} + annotations: {{ toYaml .Values.controller.admissionWebhooks.patch.podAnnotations | nindent 8 }} + {{- end }} + labels: + {{- include "ingress-nginx.labels" . | nindent 8 }} + app.kubernetes.io/component: admission-webhook + {{- with .Values.controller.admissionWebhooks.patch.labels }} + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- if .Values.controller.admissionWebhooks.patch.priorityClassName }} + priorityClassName: {{ .Values.controller.admissionWebhooks.patch.priorityClassName }} + {{- end }} + {{- if .Values.imagePullSecrets }} + imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 8 }} + {{- end }} + containers: + - name: patch + {{- with (merge .Values.controller.admissionWebhooks.patch.image .Values.global.image) }} + image: {{ if .repository }}{{ .repository }}{{ else }}{{ .registry }}/{{ .image }}{{ end }}:{{ .tag }}{{ if .digest }}@{{ .digest }}{{ end }} + {{- end }} + imagePullPolicy: {{ .Values.controller.admissionWebhooks.patch.image.pullPolicy }} + args: + - patch + - --webhook-name={{ include "ingress-nginx.admissionWebhooks.fullname" . }} + - --namespace=$(POD_NAMESPACE) + - --patch-mutating=false + - --secret-name={{ include "ingress-nginx.admissionWebhooks.fullname" . }} + - --patch-failure-policy={{ .Values.controller.admissionWebhooks.failurePolicy }} + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- if .Values.controller.admissionWebhooks.extraEnvs }} + {{- toYaml .Values.controller.admissionWebhooks.extraEnvs | nindent 12 }} + {{- end }} + {{- if .Values.controller.admissionWebhooks.patchWebhookJob.securityContext }} + securityContext: {{ toYaml .Values.controller.admissionWebhooks.patchWebhookJob.securityContext | nindent 12 }} + {{- end }} + {{- if .Values.controller.admissionWebhooks.patchWebhookJob.resources }} + resources: {{ toYaml .Values.controller.admissionWebhooks.patchWebhookJob.resources | nindent 12 }} + {{- end }} + restartPolicy: OnFailure + serviceAccountName: {{ include "ingress-nginx.admissionWebhooks.patch.serviceAccountName" . }} + {{- if .Values.controller.admissionWebhooks.patch.nodeSelector }} + nodeSelector: {{ toYaml .Values.controller.admissionWebhooks.patch.nodeSelector | nindent 8 }} + {{- end }} + {{- if .Values.controller.admissionWebhooks.patch.tolerations }} + tolerations: {{ toYaml .Values.controller.admissionWebhooks.patch.tolerations | nindent 8 }} + {{- end }} + {{- if .Values.controller.admissionWebhooks.patch.securityContext }} + securityContext: {{ toYaml .Values.controller.admissionWebhooks.patch.securityContext | nindent 8 }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/networkpolicy.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/networkpolicy.yaml new file mode 100644 index 000000000..a8f38df96 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/networkpolicy.yaml @@ -0,0 +1,26 @@ +{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled .Values.controller.admissionWebhooks.patch.networkPolicy.enabled (not .Values.controller.admissionWebhooks.certManager.enabled) -}} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} + namespace: {{ include "ingress-nginx.namespace" . }} + annotations: + "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: admission-webhook + {{- with .Values.controller.admissionWebhooks.patch.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: + {{- include "ingress-nginx.selectorLabels" . | nindent 6 }} + app.kubernetes.io/component: admission-webhook + policyTypes: + - Ingress + - Egress + egress: + - {} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/role.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/role.yaml new file mode 100644 index 000000000..c4b23aa08 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/role.yaml @@ -0,0 +1,24 @@ +{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled .Values.controller.admissionWebhooks.patch.rbac.create (not .Values.controller.admissionWebhooks.certManager.enabled) -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} + namespace: {{ include "ingress-nginx.namespace" . }} + annotations: + "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: admission-webhook + {{- with .Values.controller.admissionWebhooks.patch.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} +rules: + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - create +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml new file mode 100644 index 000000000..425e8d821 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml @@ -0,0 +1,24 @@ +{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled .Values.controller.admissionWebhooks.patch.rbac.create (not .Values.controller.admissionWebhooks.certManager.enabled) -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} + namespace: {{ include "ingress-nginx.namespace" . }} + annotations: + "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: admission-webhook + {{- with .Values.controller.admissionWebhooks.patch.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ include "ingress-nginx.admissionWebhooks.patch.serviceAccountName" . }} + namespace: {{ include "ingress-nginx.namespace" . }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml new file mode 100644 index 000000000..52f94dcce --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml @@ -0,0 +1,17 @@ +{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled .Values.controller.admissionWebhooks.patch.serviceAccount.create (not .Values.controller.admissionWebhooks.certManager.enabled) -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "ingress-nginx.admissionWebhooks.patch.serviceAccountName" . }} + namespace: {{ include "ingress-nginx.namespace" . }} + annotations: + "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: admission-webhook + {{- with .Values.controller.admissionWebhooks.patch.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.controller.admissionWebhooks.patch.serviceAccount.automountServiceAccountToken }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/validating-webhook.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/validating-webhook.yaml new file mode 100644 index 000000000..0949cea75 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/validating-webhook.yaml @@ -0,0 +1,54 @@ +{{- if .Values.controller.admissionWebhooks.enabled -}} +# before changing this value, check the required kubernetes version +# https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#prerequisites +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + annotations: + {{- if .Values.controller.admissionWebhooks.certManager.enabled }} + certmanager.k8s.io/inject-ca-from: {{ printf "%s/%s" (include "ingress-nginx.namespace" .) (include "ingress-nginx.admissionWebhooks.fullname" .) | quote }} + cert-manager.io/inject-ca-from: {{ printf "%s/%s" (include "ingress-nginx.namespace" .) (include "ingress-nginx.admissionWebhooks.fullname" .) | quote }} + {{- end }} + {{- if .Values.controller.admissionWebhooks.annotations }} + {{- toYaml .Values.controller.admissionWebhooks.annotations | nindent 4 }} + {{- end }} + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: admission-webhook + {{- with .Values.controller.admissionWebhooks.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} +webhooks: + - name: validate.nginx.ingress.kubernetes.io + matchPolicy: Equivalent + rules: + - apiGroups: + - networking.k8s.io + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - ingresses + failurePolicy: {{ .Values.controller.admissionWebhooks.failurePolicy | default "Fail" }} + sideEffects: None + admissionReviewVersions: + - v1 + clientConfig: + service: + name: {{ include "ingress-nginx.controller.fullname" . }}-admission + namespace: {{ include "ingress-nginx.namespace" . }} + port: {{ .Values.controller.admissionWebhooks.service.servicePort }} + path: /networking/v1/ingresses + {{- if .Values.controller.admissionWebhooks.timeoutSeconds }} + timeoutSeconds: {{ .Values.controller.admissionWebhooks.timeoutSeconds }} + {{- end }} + {{- if .Values.controller.admissionWebhooks.namespaceSelector }} + namespaceSelector: {{ toYaml .Values.controller.admissionWebhooks.namespaceSelector | nindent 6 }} + {{- end }} + {{- if .Values.controller.admissionWebhooks.objectSelector }} + objectSelector: {{ toYaml .Values.controller.admissionWebhooks.objectSelector | nindent 6 }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/clusterrole.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/clusterrole.yaml new file mode 100644 index 000000000..51bc5002c --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/clusterrole.yaml @@ -0,0 +1,102 @@ +{{- if .Values.rbac.create }} + +{{- if and .Values.rbac.scope (not .Values.controller.scope.enabled) -}} + {{ required "Invalid configuration: 'rbac.scope' should be equal to 'controller.scope.enabled' (true/false)." (index (dict) ".") }} +{{- end }} + +{{- if not .Values.rbac.scope -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + {{- with .Values.controller.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.fullname" . }} +rules: + - apiGroups: + - "" + resources: + - configmaps + - endpoints + - nodes + - pods + - secrets +{{- if not .Values.controller.scope.enabled }} + - namespaces +{{- end}} + verbs: + - list + - watch + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - list + - watch +{{- if and .Values.controller.scope.enabled .Values.controller.scope.namespace }} + - apiGroups: + - "" + resources: + - namespaces + resourceNames: + - "{{ .Values.controller.scope.namespace }}" + verbs: + - get +{{- end }} + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - apiGroups: + - "" + resources: + - services + verbs: + - get + - list + - watch + - apiGroups: + - networking.k8s.io + resources: + - ingresses + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + - apiGroups: + - networking.k8s.io + resources: + - ingresses/status + verbs: + - update + - apiGroups: + - networking.k8s.io + resources: + - ingressclasses + verbs: + - get + - list + - watch + - apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - list + - watch + - get +{{- end }} + +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/clusterrolebinding.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/clusterrolebinding.yaml new file mode 100644 index 000000000..8f91aac80 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/clusterrolebinding.yaml @@ -0,0 +1,19 @@ +{{- if and .Values.rbac.create (not .Values.rbac.scope) -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + {{- with .Values.controller.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.fullname" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "ingress-nginx.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ template "ingress-nginx.serviceAccountName" . }} + namespace: {{ include "ingress-nginx.namespace" . }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-addheaders.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-addheaders.yaml new file mode 100644 index 000000000..4e4bd1310 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-addheaders.yaml @@ -0,0 +1,14 @@ +{{- if .Values.controller.addHeaders -}} +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- with .Values.controller.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.fullname" . }}-custom-add-headers + namespace: {{ include "ingress-nginx.namespace" . }} +data: {{ toYaml .Values.controller.addHeaders | nindent 2 }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-proxyheaders.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-proxyheaders.yaml new file mode 100644 index 000000000..0a22600db --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-proxyheaders.yaml @@ -0,0 +1,14 @@ +{{- if .Values.controller.proxySetHeaders -}} +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- with .Values.controller.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.fullname" . }}-custom-proxy-headers + namespace: {{ include "ingress-nginx.namespace" . }} +data: {{ toYaml .Values.controller.proxySetHeaders | nindent 2 }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-tcp.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-tcp.yaml new file mode 100644 index 000000000..131a9ad51 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-tcp.yaml @@ -0,0 +1,17 @@ +{{- if .Values.tcp -}} +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- with .Values.controller.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} +{{- if .Values.controller.tcp.annotations }} + annotations: {{ toYaml .Values.controller.tcp.annotations | nindent 4 }} +{{- end }} + name: {{ include "ingress-nginx.fullname" . }}-tcp + namespace: {{ include "ingress-nginx.namespace" . }} +data: {{ tpl (toYaml .Values.tcp) . | nindent 2 }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-udp.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-udp.yaml new file mode 100644 index 000000000..7137da9ad --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-udp.yaml @@ -0,0 +1,17 @@ +{{- if .Values.udp -}} +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- with .Values.controller.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} +{{- if .Values.controller.udp.annotations }} + annotations: {{ toYaml .Values.controller.udp.annotations | nindent 4 }} +{{- end }} + name: {{ include "ingress-nginx.fullname" . }}-udp + namespace: {{ include "ingress-nginx.namespace" . }} +data: {{ tpl (toYaml .Values.udp) . | nindent 2 }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap.yaml new file mode 100644 index 000000000..b73cdc2d0 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap.yaml @@ -0,0 +1,30 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- with .Values.controller.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} +{{- if .Values.controller.configAnnotations }} + annotations: {{ toYaml .Values.controller.configAnnotations | nindent 4 }} +{{- end }} + name: {{ include "ingress-nginx.controller.fullname" . }} + namespace: {{ include "ingress-nginx.namespace" . }} +data: +{{- if .Values.controller.allowSnippetAnnotations }} + allow-snippet-annotations: "true" +{{- end }} +{{- if .Values.controller.addHeaders }} + add-headers: {{ include "ingress-nginx.namespace" . }}/{{ include "ingress-nginx.fullname" . }}-custom-add-headers +{{- end }} +{{- if .Values.controller.proxySetHeaders }} + proxy-set-headers: {{ include "ingress-nginx.namespace" . }}/{{ include "ingress-nginx.fullname" . }}-custom-proxy-headers +{{- end }} +{{- if .Values.dhParam }} + ssl-dh-param: {{ include "ingress-nginx.namespace" . }}/{{ include "ingress-nginx.controller.fullname" . }} +{{- end }} +{{- range $key, $value := .Values.controller.config }} + {{- $key | nindent 2 }}: {{ tpl (toString $value) $ | quote }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-daemonset.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-daemonset.yaml new file mode 100644 index 000000000..fd1b13284 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-daemonset.yaml @@ -0,0 +1,236 @@ +{{- if eq .Values.controller.kind "DaemonSet" -}} +apiVersion: apps/v1 +kind: DaemonSet +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- with .Values.controller.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.controller.fullname" . }} + namespace: {{ include "ingress-nginx.namespace" . }} + {{- if .Values.controller.annotations }} + annotations: {{ toYaml .Values.controller.annotations | nindent 4 }} + {{- end }} +spec: + selector: + matchLabels: + {{- include "ingress-nginx.selectorLabels" . | nindent 6 }} + app.kubernetes.io/component: controller + revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} + {{- if .Values.controller.updateStrategy }} + updateStrategy: {{ toYaml .Values.controller.updateStrategy | nindent 4 }} + {{- end }} + minReadySeconds: {{ .Values.controller.minReadySeconds }} + template: + metadata: + {{- if .Values.controller.podAnnotations }} + annotations: + {{- range $key, $value := .Values.controller.podAnnotations }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- end }} + labels: + {{- include "ingress-nginx.labels" . | nindent 8 }} + app.kubernetes.io/component: controller + {{- with .Values.controller.labels }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.controller.podLabels }} + {{- toYaml .Values.controller.podLabels | nindent 8 }} + {{- end }} + spec: + {{- if .Values.controller.dnsConfig }} + dnsConfig: {{ toYaml .Values.controller.dnsConfig | nindent 8 }} + {{- end }} + {{- if .Values.controller.hostAliases }} + hostAliases: {{ tpl (toYaml .Values.controller.hostAliases) $ | nindent 8 }} + {{- end }} + {{- if .Values.controller.hostname }} + hostname: {{ toYaml .Values.controller.hostname | nindent 8 }} + {{- end }} + dnsPolicy: {{ .Values.controller.dnsPolicy }} + {{- if .Values.imagePullSecrets }} + imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 8 }} + {{- end }} + {{- if .Values.controller.priorityClassName }} + priorityClassName: {{ .Values.controller.priorityClassName | quote }} + {{- end }} + {{- if or .Values.controller.podSecurityContext .Values.controller.sysctls }} + securityContext: + {{- if .Values.controller.podSecurityContext }} + {{- toYaml .Values.controller.podSecurityContext | nindent 8 }} + {{- end }} + {{- if .Values.controller.sysctls }} + sysctls: + {{- range $sysctl, $value := .Values.controller.sysctls }} + - name: {{ $sysctl | quote }} + value: {{ $value | quote }} + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.controller.shareProcessNamespace }} + shareProcessNamespace: {{ .Values.controller.shareProcessNamespace }} + {{- end }} + containers: + - name: {{ .Values.controller.containerName }} + {{- with (merge .Values.controller.image .Values.global.image) }} + image: {{ if .repository }}{{ .repository }}{{ else }}{{ .registry }}/{{ include "ingress-nginx.image" . }}{{ end }}:{{ .tag }}{{ include "ingress-nginx.imageDigest" . }} + {{- end }} + imagePullPolicy: {{ .Values.controller.image.pullPolicy }} + {{- if .Values.controller.lifecycle }} + lifecycle: {{ toYaml .Values.controller.lifecycle | nindent 12 }} + {{- end }} + args: {{ include "ingress-nginx.params" . | nindent 12 }} + securityContext: {{ include "ingress-nginx.controller.containerSecurityContext" . | nindent 12 }} + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- if .Values.controller.enableMimalloc }} + - name: LD_PRELOAD + value: /usr/local/lib/libmimalloc.so + {{- end }} + {{- if .Values.controller.extraEnvs }} + {{- toYaml .Values.controller.extraEnvs | nindent 12 }} + {{- end }} + {{- if .Values.controller.startupProbe }} + startupProbe: {{ toYaml .Values.controller.startupProbe | nindent 12 }} + {{- end }} + {{- if .Values.controller.livenessProbe }} + livenessProbe: {{ toYaml .Values.controller.livenessProbe | nindent 12 }} + {{- end }} + {{- if .Values.controller.readinessProbe }} + readinessProbe: {{ toYaml .Values.controller.readinessProbe | nindent 12 }} + {{- end }} + ports: + {{- range $key, $value := .Values.controller.containerPort }} + - name: {{ $key }} + containerPort: {{ $value }} + protocol: TCP + {{- if $.Values.controller.hostPort.enabled }} + hostPort: {{ index $.Values.controller.hostPort.ports $key | default $value }} + {{- end }} + {{- end }} + {{- if .Values.controller.metrics.enabled }} + - name: {{ .Values.controller.metrics.portName }} + containerPort: {{ .Values.controller.metrics.port }} + protocol: TCP + {{- end }} + {{- if .Values.controller.admissionWebhooks.enabled }} + - name: webhook + containerPort: {{ .Values.controller.admissionWebhooks.port }} + protocol: TCP + {{- end }} + {{- range $key, $value := .Values.tcp }} + - name: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-tcp + containerPort: {{ $key }} + protocol: TCP + {{- if $.Values.controller.hostPort.enabled }} + hostPort: {{ $key }} + {{- end }} + {{- end }} + {{- range $key, $value := .Values.udp }} + - name: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-udp + containerPort: {{ $key }} + protocol: UDP + {{- if $.Values.controller.hostPort.enabled }} + hostPort: {{ $key }} + {{- end }} + {{- end }} + {{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraModules) }} + volumeMounts: + {{- if .Values.controller.extraModules }} + - name: modules + {{- if .Values.controller.image.chroot }} + mountPath: /chroot/modules_mount + {{- else }} + mountPath: /modules_mount + {{- end }} + {{- end }} + {{- if .Values.controller.customTemplate.configMapName }} + - mountPath: /etc/nginx/template + name: nginx-template-volume + readOnly: true + {{- end }} + {{- if .Values.controller.admissionWebhooks.enabled }} + - name: webhook-cert + mountPath: /usr/local/certificates/ + readOnly: true + {{- end }} + {{- if .Values.controller.extraVolumeMounts }} + {{- toYaml .Values.controller.extraVolumeMounts | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.controller.resources }} + resources: {{ toYaml .Values.controller.resources | nindent 12 }} + {{- end }} + {{- if .Values.controller.extraContainers }} + {{- toYaml .Values.controller.extraContainers | nindent 8 }} + {{- end }} + {{- if (or .Values.controller.extraInitContainers .Values.controller.extraModules) }} + initContainers: + {{- if .Values.controller.extraInitContainers }} + {{- toYaml .Values.controller.extraInitContainers | nindent 8 }} + {{- end }} + {{- if .Values.controller.extraModules }} + {{- range .Values.controller.extraModules }} + {{- $containerSecurityContext := .containerSecurityContext | default $.Values.controller.containerSecurityContext }} + {{- include "extraModules" (dict "name" .name "image" (merge .image $.Values.global.image) "containerSecurityContext" $containerSecurityContext "resources" .resources) | nindent 8 }} + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.controller.hostNetwork }} + hostNetwork: {{ .Values.controller.hostNetwork }} + {{- end }} + {{- if .Values.controller.nodeSelector }} + nodeSelector: {{ toYaml .Values.controller.nodeSelector | nindent 8 }} + {{- end }} + {{- if .Values.controller.tolerations }} + tolerations: {{ toYaml .Values.controller.tolerations | nindent 8 }} + {{- end }} + {{- if .Values.controller.affinity }} + affinity: {{ tpl (toYaml .Values.controller.affinity) $ | nindent 8 }} + {{- end }} + {{- if .Values.controller.topologySpreadConstraints }} + topologySpreadConstraints: {{ tpl (toYaml .Values.controller.topologySpreadConstraints) $ | nindent 8 }} + {{- end }} + serviceAccountName: {{ template "ingress-nginx.serviceAccountName" . }} + terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }} + {{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraVolumes .Values.controller.extraModules) }} + volumes: + {{- if .Values.controller.extraModules }} + - name: modules + emptyDir: {} + {{- end }} + {{- if .Values.controller.customTemplate.configMapName }} + - name: nginx-template-volume + configMap: + name: {{ .Values.controller.customTemplate.configMapName }} + items: + - key: {{ .Values.controller.customTemplate.configMapKey }} + path: nginx.tmpl + {{- end }} + {{- if .Values.controller.admissionWebhooks.enabled }} + - name: webhook-cert + secret: + secretName: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} + {{- if .Values.controller.admissionWebhooks.certManager.enabled }} + items: + - key: tls.crt + path: cert + - key: tls.key + path: key + {{- end }} + {{- end }} + {{- if .Values.controller.extraVolumes }} + {{ toYaml .Values.controller.extraVolumes | nindent 8 }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-deployment.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-deployment.yaml new file mode 100644 index 000000000..cc41bfbc7 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-deployment.yaml @@ -0,0 +1,242 @@ +{{- if eq .Values.controller.kind "Deployment" -}} +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- with .Values.controller.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.controller.fullname" . }} + namespace: {{ include "ingress-nginx.namespace" . }} + {{- if .Values.controller.annotations }} + annotations: {{ toYaml .Values.controller.annotations | nindent 4 }} + {{- end }} +spec: + selector: + matchLabels: + {{- include "ingress-nginx.selectorLabels" . | nindent 6 }} + app.kubernetes.io/component: controller + {{- if eq .Values.controller.autoscaling.enabled .Values.controller.keda.enabled }} + replicas: {{ .Values.controller.replicaCount }} + {{- end }} + revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} + {{- if .Values.controller.progressDeadlineSeconds }} + progressDeadlineSeconds: {{ .Values.controller.progressDeadlineSeconds }} + {{- end }} + {{- if .Values.controller.updateStrategy }} + strategy: {{ toYaml .Values.controller.updateStrategy | nindent 4 }} + {{- end }} + minReadySeconds: {{ .Values.controller.minReadySeconds }} + template: + metadata: + {{- if .Values.controller.podAnnotations }} + annotations: + {{- range $key, $value := .Values.controller.podAnnotations }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- end }} + labels: + {{- include "ingress-nginx.labels" . | nindent 8 }} + app.kubernetes.io/component: controller + {{- with .Values.controller.labels }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.controller.podLabels }} + {{- toYaml .Values.controller.podLabels | nindent 8 }} + {{- end }} + spec: + {{- if .Values.controller.dnsConfig }} + dnsConfig: {{ toYaml .Values.controller.dnsConfig | nindent 8 }} + {{- end }} + {{- if .Values.controller.hostAliases }} + hostAliases: {{ tpl (toYaml .Values.controller.hostAliases) $ | nindent 8 }} + {{- end }} + {{- if .Values.controller.hostname }} + hostname: {{ toYaml .Values.controller.hostname | nindent 8 }} + {{- end }} + dnsPolicy: {{ .Values.controller.dnsPolicy }} + {{- if .Values.imagePullSecrets }} + imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 8 }} + {{- end }} + {{- if .Values.controller.priorityClassName }} + priorityClassName: {{ .Values.controller.priorityClassName | quote }} + {{- end }} + {{- if or .Values.controller.podSecurityContext .Values.controller.sysctls }} + securityContext: + {{- if .Values.controller.podSecurityContext }} + {{- toYaml .Values.controller.podSecurityContext | nindent 8 }} + {{- end }} + {{- if .Values.controller.sysctls }} + sysctls: + {{- range $sysctl, $value := .Values.controller.sysctls }} + - name: {{ $sysctl | quote }} + value: {{ $value | quote }} + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.controller.shareProcessNamespace }} + shareProcessNamespace: {{ .Values.controller.shareProcessNamespace }} + {{- end }} + containers: + - name: {{ .Values.controller.containerName }} + {{- with (merge .Values.controller.image .Values.global.image) }} + image: {{ if .repository }}{{ .repository }}{{ else }}{{ .registry }}/{{ include "ingress-nginx.image" . }}{{ end }}:{{ .tag }}{{ include "ingress-nginx.imageDigest" . }} + {{- end }} + imagePullPolicy: {{ .Values.controller.image.pullPolicy }} + {{- if .Values.controller.lifecycle }} + lifecycle: {{ toYaml .Values.controller.lifecycle | nindent 12 }} + {{- end }} + args: {{ include "ingress-nginx.params" . | nindent 12 }} + securityContext: {{ include "ingress-nginx.controller.containerSecurityContext" . | nindent 12 }} + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- if .Values.controller.enableMimalloc }} + - name: LD_PRELOAD + value: /usr/local/lib/libmimalloc.so + {{- end }} + {{- if .Values.controller.extraEnvs }} + {{- toYaml .Values.controller.extraEnvs | nindent 12 }} + {{- end }} + {{- if .Values.controller.startupProbe }} + startupProbe: {{ toYaml .Values.controller.startupProbe | nindent 12 }} + {{- end }} + {{- if .Values.controller.livenessProbe }} + livenessProbe: {{ toYaml .Values.controller.livenessProbe | nindent 12 }} + {{- end }} + {{- if .Values.controller.readinessProbe }} + readinessProbe: {{ toYaml .Values.controller.readinessProbe | nindent 12 }} + {{- end }} + ports: + {{- range $key, $value := .Values.controller.containerPort }} + - name: {{ $key }} + containerPort: {{ $value }} + protocol: TCP + {{- if $.Values.controller.hostPort.enabled }} + hostPort: {{ index $.Values.controller.hostPort.ports $key | default $value }} + {{- end }} + {{- end }} + {{- if .Values.controller.metrics.enabled }} + - name: {{ .Values.controller.metrics.portName }} + containerPort: {{ .Values.controller.metrics.port }} + protocol: TCP + {{- end }} + {{- if .Values.controller.admissionWebhooks.enabled }} + - name: webhook + containerPort: {{ .Values.controller.admissionWebhooks.port }} + protocol: TCP + {{- end }} + {{- range $key, $value := .Values.tcp }} + - name: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-tcp + containerPort: {{ $key }} + protocol: TCP + {{- if $.Values.controller.hostPort.enabled }} + hostPort: {{ $key }} + {{- end }} + {{- end }} + {{- range $key, $value := .Values.udp }} + - name: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-udp + containerPort: {{ $key }} + protocol: UDP + {{- if $.Values.controller.hostPort.enabled }} + hostPort: {{ $key }} + {{- end }} + {{- end }} + {{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraModules) }} + volumeMounts: + {{- if .Values.controller.extraModules }} + - name: modules + {{- if .Values.controller.image.chroot }} + mountPath: /chroot/modules_mount + {{- else }} + mountPath: /modules_mount + {{- end }} + {{- end }} + {{- if .Values.controller.customTemplate.configMapName }} + - mountPath: /etc/nginx/template + name: nginx-template-volume + readOnly: true + {{- end }} + {{- if .Values.controller.admissionWebhooks.enabled }} + - name: webhook-cert + mountPath: /usr/local/certificates/ + readOnly: true + {{- end }} + {{- if .Values.controller.extraVolumeMounts }} + {{- toYaml .Values.controller.extraVolumeMounts | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.controller.resources }} + resources: {{ toYaml .Values.controller.resources | nindent 12 }} + {{- end }} + {{- if .Values.controller.extraContainers }} + {{- toYaml .Values.controller.extraContainers | nindent 8 }} + {{- end }} + {{- if (or .Values.controller.extraInitContainers .Values.controller.extraModules) }} + initContainers: + {{- if .Values.controller.extraInitContainers }} + {{- toYaml .Values.controller.extraInitContainers | nindent 8 }} + {{- end }} + {{- if .Values.controller.extraModules }} + {{- range .Values.controller.extraModules }} + {{- $containerSecurityContext := .containerSecurityContext | default $.Values.controller.containerSecurityContext }} + {{- include "extraModules" (dict "name" .name "image" (merge .image $.Values.global.image) "containerSecurityContext" $containerSecurityContext "resources" .resources) | nindent 8 }} + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.controller.hostNetwork }} + hostNetwork: {{ .Values.controller.hostNetwork }} + {{- end }} + {{- if .Values.controller.nodeSelector }} + nodeSelector: {{ toYaml .Values.controller.nodeSelector | nindent 8 }} + {{- end }} + {{- if .Values.controller.tolerations }} + tolerations: {{ toYaml .Values.controller.tolerations | nindent 8 }} + {{- end }} + {{- if .Values.controller.affinity }} + affinity: {{ tpl (toYaml .Values.controller.affinity) $ | nindent 8 }} + {{- end }} + {{- if .Values.controller.topologySpreadConstraints }} + topologySpreadConstraints: {{ tpl (toYaml .Values.controller.topologySpreadConstraints) $ | nindent 8 }} + {{- end }} + serviceAccountName: {{ template "ingress-nginx.serviceAccountName" . }} + terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }} + {{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraVolumes .Values.controller.extraModules) }} + volumes: + {{- if .Values.controller.extraModules }} + - name: modules + emptyDir: {} + {{- end }} + {{- if .Values.controller.customTemplate.configMapName }} + - name: nginx-template-volume + configMap: + name: {{ .Values.controller.customTemplate.configMapName }} + items: + - key: {{ .Values.controller.customTemplate.configMapKey }} + path: nginx.tmpl + {{- end }} + {{- if .Values.controller.admissionWebhooks.enabled }} + - name: webhook-cert + secret: + secretName: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} + {{- if .Values.controller.admissionWebhooks.certManager.enabled }} + items: + - key: tls.crt + path: cert + - key: tls.key + path: key + {{- end }} + {{- end }} + {{- if .Values.controller.extraVolumes }} + {{ toYaml .Values.controller.extraVolumes | nindent 8 }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-hpa.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-hpa.yaml new file mode 100644 index 000000000..ec9ad7380 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-hpa.yaml @@ -0,0 +1,47 @@ +{{- if and (eq .Values.controller.kind "Deployment") .Values.controller.autoscaling.enabled (not .Values.controller.keda.enabled) -}} +apiVersion: {{ ternary "autoscaling/v2" "autoscaling/v2beta2" (.Capabilities.APIVersions.Has "autoscaling/v2") }} +kind: HorizontalPodAutoscaler +metadata: + {{- with .Values.controller.autoscaling.annotations }} + annotations: {{ toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- with .Values.controller.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.controller.fullname" . }} + namespace: {{ include "ingress-nginx.namespace" . }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "ingress-nginx.controller.fullname" . }} + minReplicas: {{ .Values.controller.autoscaling.minReplicas }} + maxReplicas: {{ .Values.controller.autoscaling.maxReplicas }} + metrics: + {{- with .Values.controller.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: {{ . }} + {{- end }} + {{- with .Values.controller.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: {{ . }} + {{- end }} + {{- with .Values.controller.autoscalingTemplate }} + {{- toYaml . | nindent 2 }} + {{- end }} + {{- with .Values.controller.autoscaling.behavior }} + behavior: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-ingressclass-aliases.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-ingressclass-aliases.yaml new file mode 100644 index 000000000..ffe22310c --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-ingressclass-aliases.yaml @@ -0,0 +1,23 @@ +{{- if .Values.controller.ingressClassResource.enabled -}} +{{- range .Values.controller.ingressClassResource.aliases }} +--- +apiVersion: networking.k8s.io/v1 +kind: IngressClass +metadata: + labels: + {{- include "ingress-nginx.labels" $ | nindent 4 }} + app.kubernetes.io/component: controller + {{- with $.Values.controller.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ . }} + {{- if $.Values.controller.ingressClassResource.annotations }} + annotations: {{ toYaml $.Values.controller.ingressClassResource.annotations | nindent 4 }} + {{- end }} +spec: + controller: {{ $.Values.controller.ingressClassResource.controllerValue }} + {{- with $.Values.controller.ingressClassResource.parameters }} + parameters: {{ toYaml . | nindent 4 }} + {{- end }} +{{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-ingressclass.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-ingressclass.yaml new file mode 100644 index 000000000..98479a529 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-ingressclass.yaml @@ -0,0 +1,26 @@ +{{- if .Values.controller.ingressClassResource.enabled -}} +apiVersion: networking.k8s.io/v1 +kind: IngressClass +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- with .Values.controller.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ .Values.controller.ingressClassResource.name }} + {{- if or .Values.controller.ingressClassResource.default .Values.controller.ingressClassResource.annotations }} + annotations: + {{- if .Values.controller.ingressClassResource.default }} + ingressclass.kubernetes.io/is-default-class: "true" + {{- end }} + {{- if .Values.controller.ingressClassResource.annotations }} + {{- toYaml .Values.controller.ingressClassResource.annotations | nindent 4 }} + {{- end }} + {{- end }} +spec: + controller: {{ .Values.controller.ingressClassResource.controllerValue }} + {{- with .Values.controller.ingressClassResource.parameters }} + parameters: {{ toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-keda.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-keda.yaml new file mode 100644 index 000000000..24d30fa0a --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-keda.yaml @@ -0,0 +1,46 @@ +{{- if and (eq .Values.controller.kind "Deployment") .Values.controller.keda.enabled (not .Values.controller.autoscaling.enabled) -}} +apiVersion: {{ .Values.controller.keda.apiVersion }} +kind: ScaledObject +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- with .Values.controller.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.controller.fullname" . }} + namespace: {{ include "ingress-nginx.namespace" . }} + {{- if .Values.controller.keda.scaledObject.annotations }} + annotations: {{ toYaml .Values.controller.keda.scaledObject.annotations | nindent 4 }} + {{- end }} +spec: + scaleTargetRef: +{{- if eq .Values.controller.keda.apiVersion "keda.k8s.io/v1alpha1" }} + deploymentName: {{ include "ingress-nginx.controller.fullname" . }} +{{- else if eq .Values.controller.keda.apiVersion "keda.sh/v1alpha1" }} + name: {{ include "ingress-nginx.controller.fullname" . }} +{{- end }} + pollingInterval: {{ .Values.controller.keda.pollingInterval }} + cooldownPeriod: {{ .Values.controller.keda.cooldownPeriod }} + minReplicaCount: {{ .Values.controller.keda.minReplicas }} + maxReplicaCount: {{ .Values.controller.keda.maxReplicas }} +{{- with .Values.controller.keda.fallback }} + fallback: + failureThreshold: {{ .failureThreshold | default 3 }} + replicas: {{ .replicas | default $.Values.controller.keda.maxReplicas }} +{{- end }} + triggers: +{{- with .Values.controller.keda.triggers }} +{{ toYaml . | indent 2 }} +{{ end }} + advanced: + restoreToOriginalReplicaCount: {{ .Values.controller.keda.restoreToOriginalReplicaCount }} +{{- if .Values.controller.keda.behavior }} + horizontalPodAutoscalerConfig: + behavior: +{{ with .Values.controller.keda.behavior -}} +{{ toYaml . | indent 8 }} +{{ end }} + +{{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-networkpolicy.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-networkpolicy.yaml new file mode 100644 index 000000000..e68f9916d --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-networkpolicy.yaml @@ -0,0 +1,45 @@ +{{- if .Values.controller.networkPolicy.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- with .Values.controller.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.controller.fullname" . }} + namespace: {{ include "ingress-nginx.namespace" . }} +spec: + podSelector: + matchLabels: + {{- include "ingress-nginx.selectorLabels" . | nindent 6 }} + app.kubernetes.io/component: controller + policyTypes: + - Ingress + - Egress + ingress: + - ports: + {{- range $key, $value := .Values.controller.containerPort }} + - protocol: TCP + port: {{ $value }} + {{- end }} + {{- if .Values.controller.metrics.enabled }} + - protocol: TCP + port: {{ .Values.controller.metrics.port }} + {{- end }} + {{- if .Values.controller.admissionWebhooks.enabled }} + - protocol: TCP + port: {{ .Values.controller.admissionWebhooks.port }} + {{- end }} + {{- range $key, $value := .Values.tcp }} + - protocol: TCP + port: {{ $key }} + {{- end }} + {{- range $key, $value := .Values.udp }} + - protocol: UDP + port: {{ $key }} + {{- end }} + egress: + - {} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-poddisruptionbudget.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-poddisruptionbudget.yaml new file mode 100644 index 000000000..a1f5fbba2 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-poddisruptionbudget.yaml @@ -0,0 +1,39 @@ +# PDB is not supported for DaemonSets. +# https://github.com/kubernetes/kubernetes/issues/108124 +{{- if eq .Values.controller.kind "Deployment" }} +{{- $replicas := .Values.controller.replicaCount }} +{{- if and .Values.controller.autoscaling.enabled (not .Values.controller.keda.enabled) }} +{{- $replicas = .Values.controller.autoscaling.minReplicas }} +{{- else if and .Values.controller.keda.enabled (not .Values.controller.autoscaling.enabled) }} +{{- $replicas = .Values.controller.keda.minReplicas }} +{{- end }} +{{- if gt ($replicas | int) 1 }} +apiVersion: {{ ternary "policy/v1" "policy/v1beta1" (semverCompare ">=1.21.0-0" .Capabilities.KubeVersion.Version) }} +kind: PodDisruptionBudget +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- with .Values.controller.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.controller.fullname" . }} + namespace: {{ include "ingress-nginx.namespace" . }} + {{- if .Values.controller.annotations }} + annotations: {{ toYaml .Values.controller.annotations | nindent 4 }} + {{- end }} +spec: + selector: + matchLabels: + {{- include "ingress-nginx.selectorLabels" . | nindent 6 }} + app.kubernetes.io/component: controller + {{- if and .Values.controller.minAvailable (not (hasKey .Values.controller "maxUnavailable")) }} + minAvailable: {{ .Values.controller.minAvailable }} + {{- else if .Values.controller.maxUnavailable }} + maxUnavailable: {{ .Values.controller.maxUnavailable }} + {{- end }} + {{- if .Values.controller.unhealthyPodEvictionPolicy }} + unhealthyPodEvictionPolicy: {{ .Values.controller.unhealthyPodEvictionPolicy }} + {{- end }} +{{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-prometheusrule.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-prometheusrule.yaml new file mode 100644 index 000000000..4a9357f71 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-prometheusrule.yaml @@ -0,0 +1,26 @@ +{{- if and .Values.controller.metrics.enabled .Values.controller.metrics.prometheusRule.enabled -}} +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule +metadata: + name: {{ include "ingress-nginx.controller.fullname" . }} +{{- if .Values.controller.metrics.prometheusRule.namespace }} + namespace: {{ .Values.controller.metrics.prometheusRule.namespace }} +{{- else }} + namespace: {{ include "ingress-nginx.namespace" . }} +{{- end }} + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- if .Values.controller.metrics.prometheusRule.additionalLabels }} + {{- toYaml .Values.controller.metrics.prometheusRule.additionalLabels | nindent 4 }} + {{- end }} + {{- if .Values.controller.metrics.prometheusRule.annotations }} + annotations: {{ toYaml .Values.controller.metrics.prometheusRule.annotations | nindent 4 }} + {{- end }} +spec: +{{- if .Values.controller.metrics.prometheusRule.rules }} + groups: + - name: {{ template "ingress-nginx.name" . }} + rules: {{- toYaml .Values.controller.metrics.prometheusRule.rules | nindent 4 }} +{{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-role.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-role.yaml new file mode 100644 index 000000000..127b368c4 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-role.yaml @@ -0,0 +1,94 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- with .Values.controller.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.fullname" . }} + namespace: {{ include "ingress-nginx.namespace" . }} +rules: + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - apiGroups: + - "" + resources: + - configmaps + - pods + - secrets + - endpoints + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - services + verbs: + - get + - list + - watch + - apiGroups: + - networking.k8s.io + resources: + - ingresses + verbs: + - get + - list + - watch + # Omit Ingress status permissions if `--update-status` is disabled. + {{- if ne (index .Values.controller.extraArgs "update-status") "false" }} + - apiGroups: + - networking.k8s.io + resources: + - ingresses/status + verbs: + - update + {{- end }} + - apiGroups: + - networking.k8s.io + resources: + - ingressclasses + verbs: + - get + - list + - watch + - apiGroups: + - coordination.k8s.io + resources: + - leases + resourceNames: + - {{ include "ingress-nginx.controller.electionID" . }} + verbs: + - get + - update + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + - apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - list + - watch + - get +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-rolebinding.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-rolebinding.yaml new file mode 100644 index 000000000..153430aa2 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-rolebinding.yaml @@ -0,0 +1,21 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- with .Values.controller.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.fullname" . }} + namespace: {{ include "ingress-nginx.namespace" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "ingress-nginx.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ template "ingress-nginx.serviceAccountName" . }} + namespace: {{ include "ingress-nginx.namespace" . }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-secret.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-secret.yaml new file mode 100644 index 000000000..f20f53469 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-secret.yaml @@ -0,0 +1,15 @@ +{{- if .Values.dhParam -}} +apiVersion: v1 +kind: Secret +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- with .Values.controller.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.controller.fullname" . }} + namespace: {{ include "ingress-nginx.namespace" . }} +data: + dhparam.pem: {{ .Values.dhParam }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-internal.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-internal.yaml new file mode 100644 index 000000000..6d0b47caf --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-internal.yaml @@ -0,0 +1,105 @@ +{{- if and .Values.controller.service.enabled .Values.controller.service.internal.enabled .Values.controller.service.internal.annotations -}} +apiVersion: v1 +kind: Service +metadata: + annotations: + {{- range $key, $value := .Values.controller.service.internal.annotations }} + {{ $key }}: {{ tpl ($value | toString) $ | quote }} + {{- end }} + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- if .Values.controller.service.labels }} + {{- toYaml .Values.controller.service.labels | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.controller.fullname" . }}-internal + namespace: {{ include "ingress-nginx.namespace" . }} +spec: + type: {{ .Values.controller.service.internal.type | default .Values.controller.service.type }} +{{- if .Values.controller.service.internal.clusterIP }} + clusterIP: {{ .Values.controller.service.internal.clusterIP }} +{{- end }} +{{- if .Values.controller.service.internal.externalIPs }} + externalIPs: {{ toYaml .Values.controller.service.internal.externalIPs | nindent 4 }} +{{- end }} +{{- if .Values.controller.service.internal.loadBalancerIP }} + loadBalancerIP: {{ .Values.controller.service.internal.loadBalancerIP }} +{{- end }} +{{- if .Values.controller.service.internal.loadBalancerSourceRanges }} + loadBalancerSourceRanges: {{ toYaml .Values.controller.service.internal.loadBalancerSourceRanges | nindent 4 }} +{{- end }} +{{- if .Values.controller.service.internal.loadBalancerClass }} + loadBalancerClass: {{ .Values.controller.service.internal.loadBalancerClass }} +{{- end }} +{{- if hasKey .Values.controller.service.internal "allocateLoadBalancerNodePorts" }} + allocateLoadBalancerNodePorts: {{ .Values.controller.service.internal.allocateLoadBalancerNodePorts }} +{{- end }} +{{- if .Values.controller.service.internal.externalTrafficPolicy }} + externalTrafficPolicy: {{ .Values.controller.service.internal.externalTrafficPolicy }} +{{- end }} +{{- if .Values.controller.service.internal.sessionAffinity }} + sessionAffinity: {{ .Values.controller.service.internal.sessionAffinity }} +{{- end }} +{{- if .Values.controller.service.internal.healthCheckNodePort }} + healthCheckNodePort: {{ .Values.controller.service.internal.healthCheckNodePort }} +{{- end }} +{{- if semverCompare ">=1.21.0-0" .Capabilities.KubeVersion.Version -}} +{{- if .Values.controller.service.internal.ipFamilyPolicy }} + ipFamilyPolicy: {{ .Values.controller.service.internal.ipFamilyPolicy }} +{{- end }} +{{- if .Values.controller.service.internal.ipFamilies }} + ipFamilies: {{ toYaml .Values.controller.service.internal.ipFamilies | nindent 4 }} +{{- end }} +{{- end }} + ports: + {{- $setNodePorts := (or (eq .Values.controller.service.type "NodePort") (eq .Values.controller.service.type "LoadBalancer")) }} + {{- if .Values.controller.service.enableHttp }} + - name: http + port: {{ .Values.controller.service.internal.ports.http | default .Values.controller.service.ports.http }} + protocol: TCP + targetPort: {{ .Values.controller.service.internal.targetPorts.http | default .Values.controller.service.targetPorts.http }} + {{- if and (semverCompare ">=1.20.0-0" .Capabilities.KubeVersion.Version) (.Values.controller.service.internal.appProtocol) }} + appProtocol: http + {{- end }} + {{- if (and $setNodePorts (not (empty .Values.controller.service.internal.nodePorts.http))) }} + nodePort: {{ .Values.controller.service.internal.nodePorts.http }} + {{- end }} + {{- end }} + {{- if .Values.controller.service.enableHttps }} + - name: https + port: {{ .Values.controller.service.internal.ports.https | default .Values.controller.service.ports.https }} + protocol: TCP + targetPort: {{ .Values.controller.service.internal.targetPorts.https | default .Values.controller.service.targetPorts.https }} + {{- if and (semverCompare ">=1.20.0-0" .Capabilities.KubeVersion.Version) (.Values.controller.service.internal.appProtocol) }} + appProtocol: https + {{- end }} + {{- if (and $setNodePorts (not (empty .Values.controller.service.internal.nodePorts.https))) }} + nodePort: {{ .Values.controller.service.internal.nodePorts.https }} + {{- end }} + {{- end }} + {{- range $key, $value := .Values.tcp }} + - name: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-tcp + port: {{ $key }} + protocol: TCP + targetPort: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-tcp + {{- if $.Values.controller.service.internal.nodePorts.tcp }} + {{- if index $.Values.controller.service.internal.nodePorts.tcp $key }} + nodePort: {{ index $.Values.controller.service.internal.nodePorts.tcp $key }} + {{- end }} + {{- end }} + {{- end }} + {{- range $key, $value := .Values.udp }} + - name: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-udp + port: {{ $key }} + protocol: UDP + targetPort: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-udp + {{- if $.Values.controller.service.internal.nodePorts.udp }} + {{- if index $.Values.controller.service.internal.nodePorts.udp $key }} + nodePort: {{ index $.Values.controller.service.internal.nodePorts.udp $key }} + {{- end }} + {{- end }} + {{- end }} + selector: + {{- include "ingress-nginx.selectorLabels" . | nindent 4 }} + app.kubernetes.io/component: controller +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-metrics.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-metrics.yaml new file mode 100644 index 000000000..4b25a840e --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-metrics.yaml @@ -0,0 +1,45 @@ +{{- if and .Values.controller.metrics.enabled .Values.controller.metrics.service.enabled -}} +apiVersion: v1 +kind: Service +metadata: +{{- if .Values.controller.metrics.service.annotations }} + annotations: {{ toYaml .Values.controller.metrics.service.annotations | nindent 4 }} +{{- end }} + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- if .Values.controller.metrics.service.labels }} + {{- toYaml .Values.controller.metrics.service.labels | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.controller.fullname" . }}-metrics + namespace: {{ include "ingress-nginx.namespace" . }} +spec: + type: {{ .Values.controller.metrics.service.type }} +{{- if .Values.controller.metrics.service.clusterIP }} + clusterIP: {{ .Values.controller.metrics.service.clusterIP }} +{{- end }} +{{- if .Values.controller.metrics.service.externalIPs }} + externalIPs: {{ toYaml .Values.controller.metrics.service.externalIPs | nindent 4 }} +{{- end }} +{{- if .Values.controller.metrics.service.loadBalancerIP }} + loadBalancerIP: {{ .Values.controller.metrics.service.loadBalancerIP }} +{{- end }} +{{- if .Values.controller.metrics.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: {{ toYaml .Values.controller.metrics.service.loadBalancerSourceRanges | nindent 4 }} +{{- end }} +{{- if .Values.controller.metrics.service.externalTrafficPolicy }} + externalTrafficPolicy: {{ .Values.controller.metrics.service.externalTrafficPolicy }} +{{- end }} + ports: + - name: {{ .Values.controller.metrics.portName }} + port: {{ .Values.controller.metrics.service.servicePort }} + protocol: TCP + targetPort: {{ .Values.controller.metrics.portName }} + {{- $setNodePorts := (or (eq .Values.controller.metrics.service.type "NodePort") (eq .Values.controller.metrics.service.type "LoadBalancer")) }} + {{- if (and $setNodePorts (not (empty .Values.controller.metrics.service.nodePort))) }} + nodePort: {{ .Values.controller.metrics.service.nodePort }} + {{- end }} + selector: + {{- include "ingress-nginx.selectorLabels" . | nindent 4 }} + app.kubernetes.io/component: controller +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-webhook.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-webhook.yaml new file mode 100644 index 000000000..67aac0d9a --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-webhook.yaml @@ -0,0 +1,40 @@ +{{- if .Values.controller.admissionWebhooks.enabled -}} +apiVersion: v1 +kind: Service +metadata: +{{- if .Values.controller.admissionWebhooks.service.annotations }} + annotations: {{ toYaml .Values.controller.admissionWebhooks.service.annotations | nindent 4 }} +{{- end }} + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- with .Values.controller.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.controller.fullname" . }}-admission + namespace: {{ include "ingress-nginx.namespace" . }} +spec: + type: {{ .Values.controller.admissionWebhooks.service.type }} +{{- if .Values.controller.admissionWebhooks.service.clusterIP }} + clusterIP: {{ .Values.controller.admissionWebhooks.service.clusterIP }} +{{- end }} +{{- if .Values.controller.admissionWebhooks.service.externalIPs }} + externalIPs: {{ toYaml .Values.controller.admissionWebhooks.service.externalIPs | nindent 4 }} +{{- end }} +{{- if .Values.controller.admissionWebhooks.service.loadBalancerIP }} + loadBalancerIP: {{ .Values.controller.admissionWebhooks.service.loadBalancerIP }} +{{- end }} +{{- if .Values.controller.admissionWebhooks.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: {{ toYaml .Values.controller.admissionWebhooks.service.loadBalancerSourceRanges | nindent 4 }} +{{- end }} + ports: + - name: https-webhook + port: {{ .Values.controller.admissionWebhooks.service.servicePort }} + targetPort: webhook + {{- if semverCompare ">=1.20.0-0" .Capabilities.KubeVersion.Version }} + appProtocol: https + {{- end }} + selector: + {{- include "ingress-nginx.selectorLabels" . | nindent 4 }} + app.kubernetes.io/component: controller +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service.yaml new file mode 100644 index 000000000..cb78a7035 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service.yaml @@ -0,0 +1,105 @@ +{{- if and .Values.controller.service.enabled .Values.controller.service.external.enabled -}} +apiVersion: v1 +kind: Service +metadata: + annotations: + {{- range $key, $value := .Values.controller.service.annotations }} + {{ $key }}: {{ tpl ($value | toString) $ | quote }} + {{- end }} + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- if .Values.controller.service.labels }} + {{- toYaml .Values.controller.service.labels | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.controller.fullname" . }} + namespace: {{ include "ingress-nginx.namespace" . }} +spec: + type: {{ .Values.controller.service.type }} +{{- if .Values.controller.service.clusterIP }} + clusterIP: {{ .Values.controller.service.clusterIP }} +{{- end }} +{{- if .Values.controller.service.externalIPs }} + externalIPs: {{ toYaml .Values.controller.service.externalIPs | nindent 4 }} +{{- end }} +{{- if .Values.controller.service.loadBalancerIP }} + loadBalancerIP: {{ .Values.controller.service.loadBalancerIP }} +{{- end }} +{{- if .Values.controller.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: {{ toYaml .Values.controller.service.loadBalancerSourceRanges | nindent 4 }} +{{- end }} +{{- if .Values.controller.service.loadBalancerClass }} + loadBalancerClass: {{ .Values.controller.service.loadBalancerClass }} +{{- end }} +{{- if hasKey .Values.controller.service "allocateLoadBalancerNodePorts" }} + allocateLoadBalancerNodePorts: {{ .Values.controller.service.allocateLoadBalancerNodePorts }} +{{- end }} +{{- if .Values.controller.service.externalTrafficPolicy }} + externalTrafficPolicy: {{ .Values.controller.service.externalTrafficPolicy }} +{{- end }} +{{- if .Values.controller.service.sessionAffinity }} + sessionAffinity: {{ .Values.controller.service.sessionAffinity }} +{{- end }} +{{- if .Values.controller.service.healthCheckNodePort }} + healthCheckNodePort: {{ .Values.controller.service.healthCheckNodePort }} +{{- end }} +{{- if semverCompare ">=1.21.0-0" .Capabilities.KubeVersion.Version -}} +{{- if .Values.controller.service.ipFamilyPolicy }} + ipFamilyPolicy: {{ .Values.controller.service.ipFamilyPolicy }} +{{- end }} +{{- if .Values.controller.service.ipFamilies }} + ipFamilies: {{ toYaml .Values.controller.service.ipFamilies | nindent 4 }} +{{- end }} +{{- end }} + ports: + {{- $setNodePorts := (or (eq .Values.controller.service.type "NodePort") (eq .Values.controller.service.type "LoadBalancer")) }} + {{- if .Values.controller.service.enableHttp }} + - name: http + port: {{ .Values.controller.service.ports.http }} + protocol: TCP + targetPort: {{ .Values.controller.service.targetPorts.http }} + {{- if and (semverCompare ">=1.20.0-0" .Capabilities.KubeVersion.Version) (.Values.controller.service.appProtocol) }} + appProtocol: http + {{- end }} + {{- if (and $setNodePorts (not (empty .Values.controller.service.nodePorts.http))) }} + nodePort: {{ .Values.controller.service.nodePorts.http }} + {{- end }} + {{- end }} + {{- if .Values.controller.service.enableHttps }} + - name: https + port: {{ .Values.controller.service.ports.https }} + protocol: TCP + targetPort: {{ .Values.controller.service.targetPorts.https }} + {{- if and (semverCompare ">=1.20.0-0" .Capabilities.KubeVersion.Version) (.Values.controller.service.appProtocol) }} + appProtocol: https + {{- end }} + {{- if (and $setNodePorts (not (empty .Values.controller.service.nodePorts.https))) }} + nodePort: {{ .Values.controller.service.nodePorts.https }} + {{- end }} + {{- end }} + {{- range $key, $value := .Values.tcp }} + - name: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-tcp + port: {{ $key }} + protocol: TCP + targetPort: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-tcp + {{- if $.Values.controller.service.nodePorts.tcp }} + {{- if index $.Values.controller.service.nodePorts.tcp $key }} + nodePort: {{ index $.Values.controller.service.nodePorts.tcp $key }} + {{- end }} + {{- end }} + {{- end }} + {{- range $key, $value := .Values.udp }} + - name: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-udp + port: {{ $key }} + protocol: UDP + targetPort: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-udp + {{- if $.Values.controller.service.nodePorts.udp }} + {{- if index $.Values.controller.service.nodePorts.udp $key }} + nodePort: {{ index $.Values.controller.service.nodePorts.udp $key }} + {{- end }} + {{- end }} + {{- end }} + selector: + {{- include "ingress-nginx.selectorLabels" . | nindent 4 }} + app.kubernetes.io/component: controller +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-serviceaccount.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-serviceaccount.yaml new file mode 100644 index 000000000..df83de3d0 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-serviceaccount.yaml @@ -0,0 +1,17 @@ +{{- if or .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- with .Values.controller.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ template "ingress-nginx.serviceAccountName" . }} + namespace: {{ include "ingress-nginx.namespace" . }} + {{- if .Values.serviceAccount.annotations }} + annotations: {{ toYaml .Values.serviceAccount.annotations | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-servicemonitor.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-servicemonitor.yaml new file mode 100644 index 000000000..93ab4d242 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-servicemonitor.yaml @@ -0,0 +1,50 @@ +{{- if and .Values.controller.metrics.enabled .Values.controller.metrics.serviceMonitor.enabled -}} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ include "ingress-nginx.controller.fullname" . }} + {{- if .Values.controller.metrics.serviceMonitor.namespace }} + namespace: {{ .Values.controller.metrics.serviceMonitor.namespace }} + {{- else }} + namespace: {{ include "ingress-nginx.namespace" . }} + {{- end }} + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- if .Values.controller.metrics.serviceMonitor.additionalLabels }} + {{- toYaml .Values.controller.metrics.serviceMonitor.additionalLabels | nindent 4 }} + {{- end }} + {{- if .Values.controller.metrics.serviceMonitor.annotations }} + annotations: {{ toYaml .Values.controller.metrics.serviceMonitor.annotations | nindent 4 }} + {{- end }} +spec: + {{- if .Values.controller.metrics.serviceMonitor.namespaceSelector }} + namespaceSelector: {{ toYaml .Values.controller.metrics.serviceMonitor.namespaceSelector | nindent 4 }} + {{- else }} + namespaceSelector: + matchNames: + - {{ include "ingress-nginx.namespace" . }} + {{- end }} + selector: + matchLabels: + {{- include "ingress-nginx.selectorLabels" . | nindent 6 }} + app.kubernetes.io/component: controller + endpoints: + - port: {{ .Values.controller.metrics.portName }} + interval: {{ .Values.controller.metrics.serviceMonitor.scrapeInterval }} + {{- if .Values.controller.metrics.serviceMonitor.honorLabels }} + honorLabels: true + {{- end }} + {{- if .Values.controller.metrics.serviceMonitor.relabelings }} + relabelings: {{ toYaml .Values.controller.metrics.serviceMonitor.relabelings | nindent 4 }} + {{- end }} + {{- if .Values.controller.metrics.serviceMonitor.metricRelabelings }} + metricRelabelings: {{ toYaml .Values.controller.metrics.serviceMonitor.metricRelabelings | nindent 4 }} + {{- end }} + {{- if .Values.controller.metrics.serviceMonitor.jobLabel }} + jobLabel: {{ .Values.controller.metrics.serviceMonitor.jobLabel | quote }} + {{- end }} + {{- if .Values.controller.metrics.serviceMonitor.targetLabels }} + targetLabels: {{ toYaml .Values.controller.metrics.serviceMonitor.targetLabels | nindent 2 }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-deployment.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-deployment.yaml new file mode 100644 index 000000000..f7d9de121 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-deployment.yaml @@ -0,0 +1,119 @@ +{{- if .Values.defaultBackend.enabled -}} +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: default-backend + {{- with .Values.defaultBackend.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.defaultBackend.fullname" . }} + namespace: {{ include "ingress-nginx.namespace" . }} +spec: + selector: + matchLabels: + {{- include "ingress-nginx.selectorLabels" . | nindent 6 }} + app.kubernetes.io/component: default-backend +{{- if not .Values.defaultBackend.autoscaling.enabled }} + replicas: {{ .Values.defaultBackend.replicaCount }} +{{- end }} + revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} + {{- if .Values.defaultBackend.updateStrategy }} + strategy: + {{ toYaml .Values.defaultBackend.updateStrategy | nindent 4 }} + {{- end }} + minReadySeconds: {{ .Values.defaultBackend.minReadySeconds }} + template: + metadata: + {{- if .Values.defaultBackend.podAnnotations }} + annotations: {{ toYaml .Values.defaultBackend.podAnnotations | nindent 8 }} + {{- end }} + labels: + {{- include "ingress-nginx.labels" . | nindent 8 }} + app.kubernetes.io/component: default-backend + {{- with .Values.defaultBackend.labels }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.defaultBackend.podLabels }} + {{- toYaml .Values.defaultBackend.podLabels | nindent 8 }} + {{- end }} + spec: + {{- if .Values.imagePullSecrets }} + imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 8 }} + {{- end }} + {{- if .Values.defaultBackend.priorityClassName }} + priorityClassName: {{ .Values.defaultBackend.priorityClassName }} + {{- end }} + {{- if .Values.defaultBackend.podSecurityContext }} + securityContext: {{ toYaml .Values.defaultBackend.podSecurityContext | nindent 8 }} + {{- end }} + containers: + - name: {{ template "ingress-nginx.name" . }}-default-backend + {{- with (merge .Values.defaultBackend.image .Values.global.image) }} + image: {{ if .repository }}{{ .repository }}{{ else }}{{ .registry }}/{{ .image }}{{ end }}:{{ .tag }}{{ if .digest }}@{{ .digest }}{{ end }} + {{- end }} + imagePullPolicy: {{ .Values.defaultBackend.image.pullPolicy }} + {{- if .Values.defaultBackend.extraArgs }} + args: + {{- range $key, $value := .Values.defaultBackend.extraArgs }} + {{- /* Accept keys without values or with false as value */}} + {{- if eq ($value | quote | len) 2 }} + - --{{ $key }} + {{- else }} + - --{{ $key }}={{ $value }} + {{- end }} + {{- end }} + {{- end }} + securityContext: {{ include "ingress-nginx.defaultBackend.containerSecurityContext" . | nindent 12 }} + {{- if .Values.defaultBackend.extraEnvs }} + env: {{ toYaml .Values.defaultBackend.extraEnvs | nindent 12 }} + {{- end }} + livenessProbe: + httpGet: + path: /healthz + port: {{ .Values.defaultBackend.port }} + scheme: HTTP + initialDelaySeconds: {{ .Values.defaultBackend.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.defaultBackend.livenessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.defaultBackend.livenessProbe.timeoutSeconds }} + successThreshold: {{ .Values.defaultBackend.livenessProbe.successThreshold }} + failureThreshold: {{ .Values.defaultBackend.livenessProbe.failureThreshold }} + readinessProbe: + httpGet: + path: /healthz + port: {{ .Values.defaultBackend.port }} + scheme: HTTP + initialDelaySeconds: {{ .Values.defaultBackend.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.defaultBackend.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.defaultBackend.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.defaultBackend.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.defaultBackend.readinessProbe.failureThreshold }} + ports: + - name: http + containerPort: {{ .Values.defaultBackend.port }} + protocol: TCP + {{- if .Values.defaultBackend.extraVolumeMounts }} + volumeMounts: {{- toYaml .Values.defaultBackend.extraVolumeMounts | nindent 12 }} + {{- end }} + {{- if .Values.defaultBackend.resources }} + resources: {{ toYaml .Values.defaultBackend.resources | nindent 12 }} + {{- end }} + {{- if .Values.defaultBackend.nodeSelector }} + nodeSelector: {{ toYaml .Values.defaultBackend.nodeSelector | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "ingress-nginx.defaultBackend.serviceAccountName" . }} + {{- if .Values.defaultBackend.tolerations }} + tolerations: {{ toYaml .Values.defaultBackend.tolerations | nindent 8 }} + {{- end }} + {{- if .Values.defaultBackend.affinity }} + affinity: {{ tpl (toYaml .Values.defaultBackend.affinity) $ | nindent 8 }} + {{- end }} + {{- if .Values.defaultBackend.topologySpreadConstraints }} + topologySpreadConstraints: {{ tpl (toYaml .Values.defaultBackend.topologySpreadConstraints) $ | nindent 8 }} + {{- end }} + terminationGracePeriodSeconds: 60 + {{- if .Values.defaultBackend.extraVolumes }} + volumes: {{ toYaml .Values.defaultBackend.extraVolumes | nindent 8 }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-extra-configmaps.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-extra-configmaps.yaml new file mode 100644 index 000000000..9af56cf38 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-extra-configmaps.yaml @@ -0,0 +1,23 @@ +{{- if .Values.defaultBackend.enabled }} +{{- range .Values.defaultBackend.extraConfigMaps }} +--- +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + {{- include "ingress-nginx.labels" $ | nindent 4 }} + app.kubernetes.io/component: default-backend + {{- with $.Values.defaultBackend.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ .name }} + namespace: {{ include "ingress-nginx.namespace" $ }} +data: + {{- with .data }} + {{- toYaml . | nindent 2 }} + {{- end }} +{{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-hpa.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-hpa.yaml new file mode 100644 index 000000000..49bcdcfdc --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-hpa.yaml @@ -0,0 +1,40 @@ +{{- if and .Values.defaultBackend.enabled .Values.defaultBackend.autoscaling.enabled }} +apiVersion: {{ ternary "autoscaling/v2" "autoscaling/v2beta2" (.Capabilities.APIVersions.Has "autoscaling/v2") }} +kind: HorizontalPodAutoscaler +metadata: + {{- with .Values.defaultBackend.autoscaling.annotations }} + annotations: {{ toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: default-backend + {{- with .Values.defaultBackend.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.defaultBackend.fullname" . }} + namespace: {{ include "ingress-nginx.namespace" . }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "ingress-nginx.defaultBackend.fullname" . }} + minReplicas: {{ .Values.defaultBackend.autoscaling.minReplicas }} + maxReplicas: {{ .Values.defaultBackend.autoscaling.maxReplicas }} + metrics: + {{- with .Values.defaultBackend.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: {{ . }} + {{- end }} + {{- with .Values.defaultBackend.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: {{ . }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-networkpolicy.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-networkpolicy.yaml new file mode 100644 index 000000000..90b3c2ba0 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-networkpolicy.yaml @@ -0,0 +1,25 @@ +{{- if and .Values.defaultBackend.enabled .Values.defaultBackend.networkPolicy.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: default-backend + {{- with .Values.defaultBackend.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.defaultBackend.fullname" . }} + namespace: {{ include "ingress-nginx.namespace" . }} +spec: + podSelector: + matchLabels: + {{- include "ingress-nginx.selectorLabels" . | nindent 6 }} + app.kubernetes.io/component: default-backend + policyTypes: + - Ingress + - Egress + ingress: + - ports: + - protocol: TCP + port: {{ .Values.defaultBackend.port }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-poddisruptionbudget.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-poddisruptionbudget.yaml new file mode 100644 index 000000000..e399ea8a4 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-poddisruptionbudget.yaml @@ -0,0 +1,32 @@ +{{- if .Values.defaultBackend.enabled -}} +{{- $replicas := .Values.defaultBackend.replicaCount }} +{{- if .Values.defaultBackend.autoscaling.enabled }} +{{- $replicas = .Values.defaultBackend.autoscaling.minReplicas }} +{{- end }} +{{- if gt ($replicas | int) 1 }} +apiVersion: {{ ternary "policy/v1" "policy/v1beta1" (semverCompare ">=1.21.0-0" .Capabilities.KubeVersion.Version) }} +kind: PodDisruptionBudget +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: default-backend + {{- with .Values.defaultBackend.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.defaultBackend.fullname" . }} + namespace: {{ include "ingress-nginx.namespace" . }} +spec: + selector: + matchLabels: + {{- include "ingress-nginx.selectorLabels" . | nindent 6 }} + app.kubernetes.io/component: default-backend + {{- if and .Values.defaultBackend.minAvailable (not (hasKey .Values.defaultBackend "maxUnavailable")) }} + minAvailable: {{ .Values.defaultBackend.minAvailable }} + {{- else if .Values.defaultBackend.maxUnavailable }} + maxUnavailable: {{ .Values.defaultBackend.maxUnavailable }} + {{- end }} + {{- if .Values.defaultBackend.unhealthyPodEvictionPolicy }} + unhealthyPodEvictionPolicy: {{ .Values.defaultBackend.unhealthyPodEvictionPolicy }} + {{- end }} +{{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-service.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-service.yaml new file mode 100644 index 000000000..65b6b8362 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-service.yaml @@ -0,0 +1,41 @@ +{{- if .Values.defaultBackend.enabled -}} +apiVersion: v1 +kind: Service +metadata: +{{- if .Values.defaultBackend.service.annotations }} + annotations: {{ toYaml .Values.defaultBackend.service.annotations | nindent 4 }} +{{- end }} + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: default-backend + {{- with .Values.defaultBackend.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.defaultBackend.fullname" . }} + namespace: {{ include "ingress-nginx.namespace" . }} +spec: + type: {{ .Values.defaultBackend.service.type }} +{{- if .Values.defaultBackend.service.clusterIP }} + clusterIP: {{ .Values.defaultBackend.service.clusterIP }} +{{- end }} +{{- if .Values.defaultBackend.service.externalIPs }} + externalIPs: {{ toYaml .Values.defaultBackend.service.externalIPs | nindent 4 }} +{{- end }} +{{- if .Values.defaultBackend.service.loadBalancerIP }} + loadBalancerIP: {{ .Values.defaultBackend.service.loadBalancerIP }} +{{- end }} +{{- if .Values.defaultBackend.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: {{ toYaml .Values.defaultBackend.service.loadBalancerSourceRanges | nindent 4 }} +{{- end }} + ports: + - name: http + port: {{ .Values.defaultBackend.service.servicePort }} + protocol: TCP + targetPort: http + {{- if semverCompare ">=1.20.0-0" .Capabilities.KubeVersion.Version }} + appProtocol: http + {{- end }} + selector: + {{- include "ingress-nginx.selectorLabels" . | nindent 4 }} + app.kubernetes.io/component: default-backend +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-serviceaccount.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-serviceaccount.yaml new file mode 100644 index 000000000..6fd2d6234 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-serviceaccount.yaml @@ -0,0 +1,14 @@ +{{- if and .Values.defaultBackend.enabled .Values.defaultBackend.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: default-backend + {{- with .Values.defaultBackend.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.defaultBackend.serviceAccountName" . }} + namespace: {{ include "ingress-nginx.namespace" . }} +automountServiceAccountToken: {{ .Values.defaultBackend.serviceAccount.automountServiceAccountToken }} +{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/clusterrole_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/clusterrole_test.yaml new file mode 100644 index 000000000..d7a8b8852 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/clusterrole_test.yaml @@ -0,0 +1,11 @@ +suite: Admission Webhooks > Patch Job > ClusterRole +templates: + - admission-webhooks/job-patch/clusterrole.yaml + +tests: + - it: should not create a ClusterRole if `controller.admissionWebhooks.patch.rbac.create` is false + set: + controller.admissionWebhooks.patch.rbac.create: false + asserts: + - hasDocuments: + count: 0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/clusterrolebinding_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/clusterrolebinding_test.yaml new file mode 100644 index 000000000..d7c3266d2 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/clusterrolebinding_test.yaml @@ -0,0 +1,11 @@ +suite: Admission Webhooks > Patch Job > ClusterRoleBinding +templates: + - admission-webhooks/job-patch/clusterrolebinding.yaml + +tests: + - it: should not create a ClusterRoleBinding if `controller.admissionWebhooks.patch.rbac.create` is false + set: + controller.admissionWebhooks.patch.rbac.create: false + asserts: + - hasDocuments: + count: 0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/role_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/role_test.yaml new file mode 100644 index 000000000..a236f3d7b --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/role_test.yaml @@ -0,0 +1,11 @@ +suite: Admission Webhooks > Patch Job > Role +templates: + - admission-webhooks/job-patch/role.yaml + +tests: + - it: should not create a Role if `controller.admissionWebhooks.patch.rbac.create` is false + set: + controller.admissionWebhooks.patch.rbac.create: false + asserts: + - hasDocuments: + count: 0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/rolebinding_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/rolebinding_test.yaml new file mode 100644 index 000000000..74abaa163 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/rolebinding_test.yaml @@ -0,0 +1,11 @@ +suite: Admission Webhooks > Patch Job > RoleBinding +templates: + - admission-webhooks/job-patch/rolebinding.yaml + +tests: + - it: should not create a RoleBinding if `controller.admissionWebhooks.patch.rbac.create` is false + set: + controller.admissionWebhooks.patch.rbac.create: false + asserts: + - hasDocuments: + count: 0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/serviceaccount_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/serviceaccount_test.yaml new file mode 100644 index 000000000..f72bc4383 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/serviceaccount_test.yaml @@ -0,0 +1,47 @@ +suite: Admission Webhooks > Patch Job > ServiceAccount +templates: + - admission-webhooks/job-patch/serviceaccount.yaml + +tests: + - it: should not create a ServiceAccount if `controller.admissionWebhooks.patch.serviceAccount.create` is false + set: + controller.admissionWebhooks.patch.serviceAccount.create: false + asserts: + - hasDocuments: + count: 0 + + - it: should create a ServiceAccount if `controller.admissionWebhooks.patch.serviceAccount.create` is true + set: + controller.admissionWebhooks.patch.serviceAccount.create: true + asserts: + - hasDocuments: + count: 1 + - isKind: + of: ServiceAccount + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-admission + + - it: should create a ServiceAccount with specified name if `controller.admissionWebhooks.patch.serviceAccount.name` is set + set: + controller.admissionWebhooks.patch.serviceAccount.name: ingress-nginx-admission-test-sa + asserts: + - hasDocuments: + count: 1 + - isKind: + of: ServiceAccount + - equal: + path: metadata.name + value: ingress-nginx-admission-test-sa + + - it: should create a ServiceAccount with token auto-mounting disabled if `controller.admissionWebhooks.patch.serviceAccount.automountServiceAccountToken` is false + set: + controller.admissionWebhooks.patch.serviceAccount.automountServiceAccountToken: false + asserts: + - hasDocuments: + count: 1 + - isKind: + of: ServiceAccount + - equal: + path: automountServiceAccountToken + value: false diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/validating-webhook_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/validating-webhook_test.yaml new file mode 100644 index 000000000..47b6b6873 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/validating-webhook_test.yaml @@ -0,0 +1,32 @@ +suite: Admission Webhooks > ValidatingWebhookConfiguration +templates: + - admission-webhooks/validating-webhook.yaml + +tests: + - it: should not create a ValidatingWebhookConfiguration if `controller.admissionWebhooks.enabled` is false + set: + controller.admissionWebhooks.enabled: false + asserts: + - hasDocuments: + count: 0 + + - it: should create a ValidatingWebhookConfiguration if `controller.admissionWebhooks.enabled` is true + set: + controller.admissionWebhooks.enabled: true + asserts: + - hasDocuments: + count: 1 + - isKind: + of: ValidatingWebhookConfiguration + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-admission + + - it: should create a ValidatingWebhookConfiguration with a custom port if `controller.admissionWebhooks.service.servicePort` is set + set: + controller.admissionWebhooks.enabled: true + controller.admissionWebhooks.service.servicePort: 9443 + asserts: + - equal: + path: webhooks[0].clientConfig.service.port + value: 9443 diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap-addheaders_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap-addheaders_test.yaml new file mode 100644 index 000000000..e831d50c0 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap-addheaders_test.yaml @@ -0,0 +1,27 @@ +suite: Controller > ConfigMap > Add Headers +templates: + - controller-configmap-addheaders.yaml + +tests: + - it: should not create a ConfigMap if `controller.addHeaders` is not set + set: + controller.addHeaders: null + asserts: + - hasDocuments: + count: 0 + + - it: should create a ConfigMap if `controller.addHeaders` is set + set: + controller.addHeaders: + X-Another-Custom-Header: Value + asserts: + - hasDocuments: + count: 1 + - isKind: + of: ConfigMap + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-custom-add-headers + - equal: + path: data.X-Another-Custom-Header + value: Value diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap-proxyheaders_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap-proxyheaders_test.yaml new file mode 100644 index 000000000..0634a3739 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap-proxyheaders_test.yaml @@ -0,0 +1,27 @@ +suite: Controller > ConfigMap > Proxy Headers +templates: + - controller-configmap-proxyheaders.yaml + +tests: + - it: should not create a ConfigMap if `controller.proxySetHeaders` is not set + set: + controller.proxySetHeaders: null + asserts: + - hasDocuments: + count: 0 + + - it: should create a ConfigMap if `controller.proxySetHeaders` is set + set: + controller.proxySetHeaders: + X-Custom-Header: Value + asserts: + - hasDocuments: + count: 1 + - isKind: + of: ConfigMap + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-custom-proxy-headers + - equal: + path: data.X-Custom-Header + value: Value diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap_test.yaml new file mode 100644 index 000000000..168b657d6 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap_test.yaml @@ -0,0 +1,31 @@ +suite: Controller > ConfigMap +templates: + - controller-configmap.yaml + +tests: + - it: should create a ConfigMap + asserts: + - hasDocuments: + count: 1 + - isKind: + of: ConfigMap + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-controller + + - it: should create a ConfigMap with templated values if `controller.config` contains templates + set: + controller.config: + template: "test.{{ .Release.Namespace }}.svc.kubernetes.local" + integer: 12345 + boolean: true + asserts: + - equal: + path: data.template + value: test.NAMESPACE.svc.kubernetes.local + - equal: + path: data.integer + value: "12345" + - equal: + path: data.boolean + value: "true" diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-daemonset_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-daemonset_test.yaml new file mode 100644 index 000000000..d2d77befb --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-daemonset_test.yaml @@ -0,0 +1,192 @@ +suite: Controller > DaemonSet +templates: + - controller-daemonset.yaml + +tests: + - it: should create a DaemonSet if `controller.kind` is "DaemonSet" + set: + controller.kind: DaemonSet + asserts: + - hasDocuments: + count: 1 + - isKind: + of: DaemonSet + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-controller + + - it: should create a DaemonSet with argument `--enable-metrics=true` if `controller.metrics.enabled` is true + set: + controller.kind: DaemonSet + controller.metrics.enabled: true + asserts: + - contains: + path: spec.template.spec.containers[0].args + content: --enable-metrics=true + + - it: should create a DaemonSet without argument `--enable-metrics=true` if `controller.metrics.enabled` is false + set: + controller.kind: DaemonSet + controller.metrics.enabled: false + asserts: + - notContains: + path: spec.template.spec.containers[0].args + content: --enable-metrics=true + + - it: should create a DaemonSet with argument `--controller-class=k8s.io/ingress-nginx-internal` if `controller.ingressClassResource.controllerValue` is "k8s.io/ingress-nginx-internal" + set: + controller.kind: DaemonSet + controller.ingressClassResource.controllerValue: k8s.io/ingress-nginx-internal + asserts: + - contains: + path: spec.template.spec.containers[0].args + content: --controller-class=k8s.io/ingress-nginx-internal + + - it: should create a DaemonSet with resource limits if `controller.resources.limits` is set + set: + controller.kind: DaemonSet + controller.resources.limits.cpu: 500m + controller.resources.limits.memory: 512Mi + asserts: + - equal: + path: spec.template.spec.containers[0].resources.limits.cpu + value: 500m + - equal: + path: spec.template.spec.containers[0].resources.limits.memory + value: 512Mi + + - it: should create a DaemonSet with topology spread constraints if `controller.topologySpreadConstraints` is set + set: + controller.kind: DaemonSet + controller.topologySpreadConstraints: + - labelSelector: + matchLabels: + app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}' + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/component: controller + topologyKey: topology.kubernetes.io/zone + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + - labelSelector: + matchLabels: + app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}' + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/component: controller + topologyKey: kubernetes.io/hostname + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + asserts: + - equal: + path: spec.template.spec.topologySpreadConstraints + value: + - labelSelector: + matchLabels: + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/instance: RELEASE-NAME + app.kubernetes.io/component: controller + topologyKey: topology.kubernetes.io/zone + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + - labelSelector: + matchLabels: + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/instance: RELEASE-NAME + app.kubernetes.io/component: controller + topologyKey: kubernetes.io/hostname + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + + - it: should create a DaemonSet with affinity if `controller.affinity` is set + set: + controller.kind: DaemonSet + controller.affinity: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: app.kubernetes.io/name + operator: In + values: + - '{{ include "ingress-nginx.name" . }}' + - key: app.kubernetes.io/instance + operator: In + values: + - '{{ .Release.Name }}' + - key: app.kubernetes.io/component + operator: In + values: + - controller + topologyKey: kubernetes.io/hostname + asserts: + - equal: + path: spec.template.spec.affinity + value: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: app.kubernetes.io/name + operator: In + values: + - ingress-nginx + - key: app.kubernetes.io/instance + operator: In + values: + - RELEASE-NAME + - key: app.kubernetes.io/component + operator: In + values: + - controller + topologyKey: kubernetes.io/hostname + + - it: should create a DaemonSet with `runAsGroup` if `controller.image.runAsGroup` is set + set: + controller.kind: DaemonSet + controller.image.runAsGroup: 1000 + asserts: + - equal: + path: spec.template.spec.containers[0].securityContext.runAsGroup + value: 1000 + + - it: should create a DaemonSet with a custom registry if `global.image.registry` is set + set: + global.image.registry: custom.registry.io + controller.kind: DaemonSet + controller.image.tag: v1.0.0-dev + controller.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd + asserts: + - equal: + path: spec.template.spec.containers[0].image + value: custom.registry.io/ingress-nginx/controller:v1.0.0-dev@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd + + - it: should create a DaemonSet with a custom registry if `controller.image.registry` is set + set: + controller.kind: DaemonSet + controller.image.registry: custom.registry.io + controller.image.tag: v1.0.0-dev + controller.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd + asserts: + - equal: + path: spec.template.spec.containers[0].image + value: custom.registry.io/ingress-nginx/controller:v1.0.0-dev@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd + + - it: should create a DaemonSet with a custom image if `controller.image.image` is set + set: + controller.kind: DaemonSet + controller.image.image: custom-repo/custom-image + controller.image.tag: v1.0.0-dev + controller.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd + asserts: + - equal: + path: spec.template.spec.containers[0].image + value: registry.k8s.io/custom-repo/custom-image:v1.0.0-dev@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd + + - it: should create a DaemonSet with a custom tag if `controller.image.tag` is set + set: + controller.kind: DaemonSet + controller.image.tag: custom-tag + controller.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd + asserts: + - equal: + path: spec.template.spec.containers[0].image + value: registry.k8s.io/ingress-nginx/controller:custom-tag@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-deployment_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-deployment_test.yaml new file mode 100644 index 000000000..1cc9c9325 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-deployment_test.yaml @@ -0,0 +1,217 @@ +suite: Controller > Deployment +templates: + - controller-deployment.yaml + +tests: + - it: should create a Deployment + asserts: + - hasDocuments: + count: 1 + - isKind: + of: Deployment + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-controller + + - it: should create a Deployment with 3 replicas if `controller.replicaCount` is 3 + set: + controller.replicaCount: 3 + asserts: + - equal: + path: spec.replicas + value: 3 + + - it: should create a Deployment without replicas if `controller.autoscaling.enabled` is true + set: + controller.autoscaling.enabled: true + asserts: + - notExists: + path: spec.replicas + + - it: should create a Deployment without replicas if `controller.keda.enabled` is true + set: + controller.keda.enabled: true + asserts: + - notExists: + path: spec.replicas + + - it: should create a Deployment with replicas if `controller.autoscaling.enabled` is true and `controller.keda.enabled` is true + set: + controller.autoscaling.enabled: true + controller.keda.enabled: true + asserts: + - exists: + path: spec.replicas + + - it: should create a Deployment with argument `--enable-metrics=true` if `controller.metrics.enabled` is true + set: + controller.metrics.enabled: true + asserts: + - contains: + path: spec.template.spec.containers[0].args + content: --enable-metrics=true + + - it: should create a Deployment without argument `--enable-metrics=true` if `controller.metrics.enabled` is false + set: + controller.metrics.enabled: false + asserts: + - notContains: + path: spec.template.spec.containers[0].args + content: --enable-metrics=true + + - it: should create a Deployment with argument `--controller-class=k8s.io/ingress-nginx-internal` if `controller.ingressClassResource.controllerValue` is "k8s.io/ingress-nginx-internal" + set: + controller.ingressClassResource.controllerValue: k8s.io/ingress-nginx-internal + asserts: + - contains: + path: spec.template.spec.containers[0].args + content: --controller-class=k8s.io/ingress-nginx-internal + + - it: should create a Deployment with resource limits if `controller.resources.limits` is set + set: + controller.resources.limits.cpu: 500m + controller.resources.limits.memory: 512Mi + asserts: + - equal: + path: spec.template.spec.containers[0].resources.limits.cpu + value: 500m + - equal: + path: spec.template.spec.containers[0].resources.limits.memory + value: 512Mi + + - it: should create a Deployment with topology spread constraints if `controller.topologySpreadConstraints` is set + set: + controller.topologySpreadConstraints: + - labelSelector: + matchLabels: + app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}' + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/component: controller + topologyKey: topology.kubernetes.io/zone + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + - labelSelector: + matchLabels: + app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}' + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/component: controller + topologyKey: kubernetes.io/hostname + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + asserts: + - equal: + path: spec.template.spec.topologySpreadConstraints + value: + - labelSelector: + matchLabels: + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/instance: RELEASE-NAME + app.kubernetes.io/component: controller + topologyKey: topology.kubernetes.io/zone + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + - labelSelector: + matchLabels: + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/instance: RELEASE-NAME + app.kubernetes.io/component: controller + topologyKey: kubernetes.io/hostname + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + + - it: should create a Deployment with affinity if `controller.affinity` is set + set: + controller.affinity: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: app.kubernetes.io/name + operator: In + values: + - '{{ include "ingress-nginx.name" . }}' + - key: app.kubernetes.io/instance + operator: In + values: + - '{{ .Release.Name }}' + - key: app.kubernetes.io/component + operator: In + values: + - controller + topologyKey: kubernetes.io/hostname + asserts: + - equal: + path: spec.template.spec.affinity + value: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: app.kubernetes.io/name + operator: In + values: + - ingress-nginx + - key: app.kubernetes.io/instance + operator: In + values: + - RELEASE-NAME + - key: app.kubernetes.io/component + operator: In + values: + - controller + topologyKey: kubernetes.io/hostname + + - it: should create a Deployment with `runAsGroup` if `controller.image.runAsGroup` is set + set: + controller.image.runAsGroup: 1000 + asserts: + - equal: + path: spec.template.spec.containers[0].securityContext.runAsGroup + value: 1000 + + - it: should create a Deployment with a custom registry if `global.image.registry` is set + set: + global.image.registry: custom.registry.io + controller.image.tag: v1.0.0-dev + controller.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd + asserts: + - equal: + path: spec.template.spec.containers[0].image + value: custom.registry.io/ingress-nginx/controller:v1.0.0-dev@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd + + - it: should create a Deployment with a custom registry if `controller.image.registry` is set + set: + controller.image.registry: custom.registry.io + controller.image.tag: v1.0.0-dev + controller.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd + asserts: + - equal: + path: spec.template.spec.containers[0].image + value: custom.registry.io/ingress-nginx/controller:v1.0.0-dev@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd + + - it: should create a Deployment with a custom image if `controller.image.image` is set + set: + controller.image.image: custom-repo/custom-image + controller.image.tag: v1.0.0-dev + controller.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd + asserts: + - equal: + path: spec.template.spec.containers[0].image + value: registry.k8s.io/custom-repo/custom-image:v1.0.0-dev@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd + + - it: should create a Deployment with a custom tag if `controller.image.tag` is set + set: + controller.image.tag: custom-tag + controller.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd + asserts: + - equal: + path: spec.template.spec.containers[0].image + value: registry.k8s.io/ingress-nginx/controller:custom-tag@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd + + - it: should create a Deployment with `progressDeadlineSeconds` if `controller.progressDeadlineSeconds` is set + set: + controller.progressDeadlineSeconds: 111 + asserts: + - equal: + path: spec.progressDeadlineSeconds + value: 111 diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-hpa_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-hpa_test.yaml new file mode 100644 index 000000000..869d3a690 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-hpa_test.yaml @@ -0,0 +1,31 @@ +suite: Controller > HPA +templates: + - controller-hpa.yaml + +tests: + - it: should create an HPA if `controller.autoscaling.enabled` is true + set: + controller.autoscaling.enabled: true + asserts: + - hasDocuments: + count: 1 + - isKind: + of: HorizontalPodAutoscaler + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-controller + + - it: should not create an HPA if `controller.autoscaling.enabled` is true and `controller.keda.enabled` is true + set: + controller.autoscaling.enabled: true + controller.keda.enabled: true + asserts: + - hasDocuments: + count: 0 + + - it: should not create an HPA if `controller.kind` is "DaemonSet" + set: + controller.kind: DaemonSet + asserts: + - hasDocuments: + count: 0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-ingressclass-aliases_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-ingressclass-aliases_test.yaml new file mode 100644 index 000000000..9a4a576b7 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-ingressclass-aliases_test.yaml @@ -0,0 +1,110 @@ +suite: Controller > IngressClass > Aliases +templates: + - controller-ingressclass-aliases.yaml + +tests: + - it: should not create IngressClass aliases + asserts: + - hasDocuments: + count: 0 + + - it: should create an IngressClass alias with name "nginx-alias" if `controller.ingressClassResource.aliases` is set + set: + controller.ingressClassResource.aliases: + - nginx-alias + asserts: + - hasDocuments: + count: 1 + - isKind: + of: IngressClass + - equal: + path: metadata.name + value: nginx-alias + + - it: should create an IngressClass alias without annotation `ingressclass.kubernetes.io/is-default-class` if `controller.ingressClassResource.default` is true + set: + controller.ingressClassResource.aliases: + - nginx-alias + controller.ingressClassResource.default: true + asserts: + - hasDocuments: + count: 1 + - isKind: + of: IngressClass + - equal: + path: metadata.name + value: nginx-alias + - notExists: + path: metadata.annotations["ingressclass.kubernetes.io/is-default-class"] + + - it: should create an IngressClass alias with annotations if `controller.ingressClassResource.annotations` is set + set: + controller.ingressClassResource.aliases: + - nginx-alias + controller.ingressClassResource.annotations: + my-fancy-annotation: has-a-value + asserts: + - hasDocuments: + count: 1 + - isKind: + of: IngressClass + - equal: + path: metadata.name + value: nginx-alias + - equal: + path: metadata.annotations.my-fancy-annotation + value: has-a-value + + - it: should create an IngressClass alias with controller "k8s.io/ingress-nginx-internal" if `controller.ingressClassResource.controllerValue` is "k8s.io/ingress-nginx-internal" + set: + controller.ingressClassResource.aliases: + - nginx-alias + controller.ingressClassResource.controllerValue: k8s.io/ingress-nginx-internal + asserts: + - hasDocuments: + count: 1 + - isKind: + of: IngressClass + - equal: + path: metadata.name + value: nginx-alias + - equal: + path: spec.controller + value: k8s.io/ingress-nginx-internal + + - it: should create an IngressClass alias with parameters if `controller.ingressClassResource.parameters` is set + set: + controller.ingressClassResource.aliases: + - nginx-alias + controller.ingressClassResource.parameters: + apiGroup: k8s.example.com + kind: IngressParameters + name: external-lb + asserts: + - hasDocuments: + count: 1 + - isKind: + of: IngressClass + - equal: + path: metadata.name + value: nginx-alias + - equal: + path: spec.parameters + value: + apiGroup: k8s.example.com + kind: IngressParameters + name: external-lb + + - it: should create two IngressClass aliases if `controller.ingressClassResource.aliases` has two elements + set: + controller.ingressClassResource.aliases: + - nginx-alias-1 + - nginx-alias-2 + asserts: + - hasDocuments: + count: 2 + - isKind: + of: IngressClass + - matchRegex: + path: metadata.name + pattern: nginx-alias-(1|2) diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-ingressclass_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-ingressclass_test.yaml new file mode 100644 index 000000000..b3384af32 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-ingressclass_test.yaml @@ -0,0 +1,93 @@ +suite: Controller > IngressClass +templates: + - controller-ingressclass.yaml + +tests: + - it: should create an IngressClass + asserts: + - hasDocuments: + count: 1 + - isKind: + of: IngressClass + - equal: + path: metadata.name + value: nginx + + - it: should create an IngressClass with name "nginx-internal" if `controller.ingressClassResource.name` is "nginx-internal" + set: + controller.ingressClassResource.name: nginx-internal + asserts: + - hasDocuments: + count: 1 + - isKind: + of: IngressClass + - equal: + path: metadata.name + value: nginx-internal + + - it: "should create an IngressClass with annotation `ingressclass.kubernetes.io/is-default-class: \"true\"` if `controller.ingressClassResource.default` is true" + set: + controller.ingressClassResource.default: true + asserts: + - hasDocuments: + count: 1 + - isKind: + of: IngressClass + - equal: + path: metadata.name + value: nginx + - equal: + path: metadata.annotations["ingressclass.kubernetes.io/is-default-class"] + value: "true" + + - it: should create an IngressClass with annotations if `controller.ingressClassResource.annotations` is set + set: + controller.ingressClassResource.annotations: + my-fancy-annotation: has-a-value + asserts: + - hasDocuments: + count: 1 + - isKind: + of: IngressClass + - equal: + path: metadata.name + value: nginx + - equal: + path: metadata.annotations.my-fancy-annotation + value: has-a-value + + - it: should create an IngressClass with controller "k8s.io/ingress-nginx-internal" if `controller.ingressClassResource.controllerValue` is "k8s.io/ingress-nginx-internal" + set: + controller.ingressClassResource.controllerValue: k8s.io/ingress-nginx-internal + asserts: + - hasDocuments: + count: 1 + - isKind: + of: IngressClass + - equal: + path: metadata.name + value: nginx + - equal: + path: spec.controller + value: k8s.io/ingress-nginx-internal + + - it: should create an IngressClass with parameters if `controller.ingressClassResource.parameters` is set + set: + controller.ingressClassResource.parameters: + apiGroup: k8s.example.com + kind: IngressParameters + name: external-lb + asserts: + - hasDocuments: + count: 1 + - isKind: + of: IngressClass + - equal: + path: metadata.name + value: nginx + - equal: + path: spec.parameters + value: + apiGroup: k8s.example.com + kind: IngressParameters + name: external-lb diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-keda_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-keda_test.yaml new file mode 100644 index 000000000..800283483 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-keda_test.yaml @@ -0,0 +1,31 @@ +suite: Controller > KEDA +templates: + - controller-keda.yaml + +tests: + - it: should create a ScaledObject if `controller.keda.enabled` is true + set: + controller.keda.enabled: true + asserts: + - hasDocuments: + count: 1 + - isKind: + of: ScaledObject + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-controller + + - it: should not create a ScaledObject if `controller.keda.enabled` is true and `controller.autoscaling.enabled` is true + set: + controller.keda.enabled: true + controller.autoscaling.enabled: true + asserts: + - hasDocuments: + count: 0 + + - it: should not create a ScaledObject if `controller.kind` is "DaemonSet" + set: + controller.kind: DaemonSet + asserts: + - hasDocuments: + count: 0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-networkpolicy_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-networkpolicy_test.yaml new file mode 100644 index 000000000..5de12e9c4 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-networkpolicy_test.yaml @@ -0,0 +1,23 @@ +suite: Controller > NetworkPolicy +templates: + - controller-networkpolicy.yaml + +tests: + - it: should not create a NetworkPolicy if `controller.networkPolicy.enabled` is false + set: + controller.networkPolicy.enabled: false + asserts: + - hasDocuments: + count: 0 + + - it: should create a NetworkPolicy if `controller.networkPolicy.enabled` is true + set: + controller.networkPolicy.enabled: true + asserts: + - hasDocuments: + count: 1 + - isKind: + of: NetworkPolicy + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-controller diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-poddisruptionbudget_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-poddisruptionbudget_test.yaml new file mode 100644 index 000000000..5ac986fc7 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-poddisruptionbudget_test.yaml @@ -0,0 +1,102 @@ +suite: Controller > PodDisruptionBudget +templates: + - controller-poddisruptionbudget.yaml + +tests: + - it: should create a PodDisruptionBudget if `controller.replicaCount` is greater than 1 + set: + controller.replicaCount: 2 + asserts: + - hasDocuments: + count: 1 + - isKind: + of: PodDisruptionBudget + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-controller + + - it: should not create a PodDisruptionBudget if `controller.replicaCount` is less than or equal 1 + set: + controller.replicaCount: 1 + asserts: + - hasDocuments: + count: 0 + + - it: should create a PodDisruptionBudget if `controller.autoscaling.enabled` is true and `controller.autoscaling.minReplicas` is greater than 1 + set: + controller.autoscaling.enabled: true + controller.autoscaling.minReplicas: 2 + asserts: + - hasDocuments: + count: 1 + - isKind: + of: PodDisruptionBudget + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-controller + + - it: should not create a PodDisruptionBudget if `controller.autoscaling.enabled` is true and `controller.autoscaling.minReplicas` is less than or equal 1 + set: + controller.autoscaling.enabled: true + controller.autoscaling.minReplicas: 1 + asserts: + - hasDocuments: + count: 0 + + - it: should create a PodDisruptionBudget if `controller.keda.enabled` is true and `controller.keda.minReplicas` is greater than 1 + set: + controller.keda.enabled: true + controller.keda.minReplicas: 2 + asserts: + - hasDocuments: + count: 1 + - isKind: + of: PodDisruptionBudget + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-controller + + - it: should not create a PodDisruptionBudget if `controller.keda.enabled` is true and `controller.keda.minReplicas` is less than or equal 1 + set: + controller.keda.enabled: true + controller.keda.minReplicas: 1 + asserts: + - hasDocuments: + count: 0 + + - it: should not create a PodDisruptionBudget if `controller.autoscaling.enabled` is true and `controller.keda.enabled` is true + set: + controller.autoscaling.enabled: true + controller.keda.enabled: true + asserts: + - hasDocuments: + count: 0 + + - it: should create a PodDisruptionBudget without `minAvailable` and with `maxUnavailable` if `controller.minAvailable` and `controller.maxUnavailable` are set + set: + controller.replicaCount: 2 + controller.minAvailable: 1 + controller.maxUnavailable: 1 + asserts: + - hasDocuments: + count: 1 + - isKind: + of: PodDisruptionBudget + - notExists: + path: spec.minAvailable + - equal: + path: spec.maxUnavailable + value: 1 + + - it: should create a PodDisruptionBudget with `unhealthyPodEvictionPolicy` if `controller.unhealthyPodEvictionPolicy` is set + set: + controller.replicaCount: 2 + controller.unhealthyPodEvictionPolicy: IfHealthyBudget + asserts: + - hasDocuments: + count: 1 + - isKind: + of: PodDisruptionBudget + - equal: + path: spec.unhealthyPodEvictionPolicy + value: IfHealthyBudget diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-prometheusrule_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-prometheusrule_test.yaml new file mode 100644 index 000000000..2d330919d --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-prometheusrule_test.yaml @@ -0,0 +1,29 @@ +suite: Controller > PrometheusRule +templates: + - controller-prometheusrule.yaml + +tests: + - it: should create a PrometheusRule if `controller.metrics.prometheusRule.enabled` is true + set: + controller.metrics.enabled: true + controller.metrics.prometheusRule.enabled: true + asserts: + - hasDocuments: + count: 1 + - isKind: + of: PrometheusRule + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-controller + + - it: should create a PrometheusRule with annotations if `controller.metrics.prometheusRule.annotations` is set + set: + controller.metrics.enabled: true + controller.metrics.prometheusRule.enabled: true + controller.metrics.prometheusRule.annotations: + my-little-annotation: test-value + asserts: + - equal: + path: metadata.annotations + value: + my-little-annotation: test-value diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-internal_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-internal_test.yaml new file mode 100644 index 000000000..5465e1a2b --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-internal_test.yaml @@ -0,0 +1,25 @@ +suite: Controller > Service > Internal +templates: + - controller-service-internal.yaml + +tests: + - it: should not create an internal Service if `controller.service.internal.enabled` is false + set: + controller.service.internal.enabled: false + asserts: + - hasDocuments: + count: 0 + + - it: should create an internal Service if `controller.service.internal.enabled` is true and `controller.service.internal.annotations` are set + set: + controller.service.internal.enabled: true + controller.service.internal.annotations: + test.annotation: "true" + asserts: + - hasDocuments: + count: 1 + - isKind: + of: Service + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-controller-internal diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-metrics_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-metrics_test.yaml new file mode 100644 index 000000000..ddb412e5b --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-metrics_test.yaml @@ -0,0 +1,41 @@ +suite: Controller > Service > Metrics +templates: + - controller-service-metrics.yaml + +tests: + - it: should not create a metrics Service if `controller.metrics.enabled` is false and `controller.metrics.service.enabled` is false + set: + controller.metrics.enabled: false + controller.metrics.service.enabled: false + asserts: + - hasDocuments: + count: 0 + + - it: should not create a metrics Service if `controller.metrics.enabled` is false and `controller.metrics.service.enabled` is true + set: + controller.metrics.enabled: false + controller.metrics.service.enabled: true + asserts: + - hasDocuments: + count: 0 + + - it: should not create a metrics Service if `controller.metrics.enabled` is true and `controller.metrics.service.enabled` is false + set: + controller.metrics.enabled: true + controller.metrics.service.enabled: false + asserts: + - hasDocuments: + count: 0 + + - it: should create a metrics Service if `controller.metrics.enabled` is true and `controller.metrics.service.enabled` is true + set: + controller.metrics.enabled: true + controller.metrics.service.enabled: true + asserts: + - hasDocuments: + count: 1 + - isKind: + of: Service + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-controller-metrics diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-webhook_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-webhook_test.yaml new file mode 100644 index 000000000..1c759edbe --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-webhook_test.yaml @@ -0,0 +1,32 @@ +suite: Controller > Service > Webhook +templates: + - controller-service-webhook.yaml + +tests: + - it: should not create a webhook Service if `controller.admissionWebhooks.enabled` is false + set: + controller.admissionWebhooks.enabled: false + asserts: + - hasDocuments: + count: 0 + + - it: should create a webhook Service if `controller.admissionWebhooks.enabled` is true + set: + controller.admissionWebhooks.enabled: true + asserts: + - hasDocuments: + count: 1 + - isKind: + of: Service + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-controller-admission + + - it: should create a webhook Service with a custom port if `controller.admissionWebhooks.service.servicePort` is set + set: + controller.admissionWebhooks.enabled: true + controller.admissionWebhooks.service.servicePort: 9443 + asserts: + - equal: + path: spec.ports[0].port + value: 9443 diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service_test.yaml new file mode 100644 index 000000000..10574f227 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service_test.yaml @@ -0,0 +1,32 @@ +suite: Controller > Service +templates: + - controller-service.yaml + +tests: + - it: should not create a Service if `controller.service.external.enabled` is false + set: + controller.service.external.enabled: false + asserts: + - hasDocuments: + count: 0 + + - it: should create a Service if `controller.service.external.enabled` is true + set: + controller.service.external.enabled: true + asserts: + - hasDocuments: + count: 1 + - isKind: + of: Service + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-controller + + - it: should create a Service of type "NodePort" if `controller.service.external.enabled` is true and `controller.service.type` is "NodePort" + set: + controller.service.external.enabled: true + controller.service.type: NodePort + asserts: + - equal: + path: spec.type + value: NodePort diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-serviceaccount_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-serviceaccount_test.yaml new file mode 100644 index 000000000..928e53772 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-serviceaccount_test.yaml @@ -0,0 +1,47 @@ +suite: Controller > ServiceAccount +templates: + - controller-serviceaccount.yaml + +tests: + - it: should not create a ServiceAccount if `serviceAccount.create` is false + set: + serviceAccount.create: false + asserts: + - hasDocuments: + count: 0 + + - it: should create a ServiceAccount if `serviceAccount.create` is true + set: + serviceAccount.create: true + asserts: + - hasDocuments: + count: 1 + - isKind: + of: ServiceAccount + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx + + - it: should create a ServiceAccount with specified name if `serviceAccount.name` is set + set: + serviceAccount.name: ingress-nginx-admission-test-sa + asserts: + - hasDocuments: + count: 1 + - isKind: + of: ServiceAccount + - equal: + path: metadata.name + value: ingress-nginx-admission-test-sa + + - it: should create a ServiceAccount with token auto-mounting disabled if `serviceAccount.automountServiceAccountToken` is false + set: + serviceAccount.automountServiceAccountToken: false + asserts: + - hasDocuments: + count: 1 + - isKind: + of: ServiceAccount + - equal: + path: automountServiceAccountToken + value: false diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-servicemonitor_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-servicemonitor_test.yaml new file mode 100644 index 000000000..310097c1a --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-servicemonitor_test.yaml @@ -0,0 +1,29 @@ +suite: Controller > ServiceMonitor +templates: + - controller-servicemonitor.yaml + +tests: + - it: should create a ServiceMonitor if `controller.metrics.serviceMonitor.enabled` is true + set: + controller.metrics.enabled: true + controller.metrics.serviceMonitor.enabled: true + asserts: + - hasDocuments: + count: 1 + - isKind: + of: ServiceMonitor + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-controller + + - it: should create a ServiceMonitor with annotations if `controller.metrics.serviceMonitor.annotations` is set + set: + controller.metrics.enabled: true + controller.metrics.serviceMonitor.enabled: true + controller.metrics.serviceMonitor.annotations: + my-little-annotation: test-value + asserts: + - equal: + path: metadata.annotations + value: + my-little-annotation: test-value diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-deployment_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-deployment_test.yaml new file mode 100644 index 000000000..c3fa33968 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-deployment_test.yaml @@ -0,0 +1,189 @@ +suite: Default Backend > Deployment +templates: + - default-backend-deployment.yaml + +tests: + - it: should not create a Deployment if `defaultBackend.enabled` is false + set: + defaultBackend.enabled: false + asserts: + - hasDocuments: + count: 0 + + - it: should create a Deployment if `defaultBackend.enabled` is true + set: + defaultBackend.enabled: true + asserts: + - hasDocuments: + count: 1 + - isKind: + of: Deployment + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-defaultbackend + + - it: should create a Deployment with 3 replicas if `defaultBackend.replicaCount` is 3 + set: + defaultBackend.enabled: true + defaultBackend.replicaCount: 3 + asserts: + - equal: + path: spec.replicas + value: 3 + + - it: should create a Deployment without replicas if `defaultBackend.autoscaling.enabled` is true + set: + defaultBackend.enabled: true + defaultBackend.autoscaling.enabled: true + asserts: + - notExists: + path: spec.replicas + + - it: should create a Deployment with resource limits if `defaultBackend.resources.limits` is set + set: + defaultBackend.enabled: true + defaultBackend.resources.limits.cpu: 500m + defaultBackend.resources.limits.memory: 512Mi + asserts: + - equal: + path: spec.template.spec.containers[0].resources.limits.cpu + value: 500m + - equal: + path: spec.template.spec.containers[0].resources.limits.memory + value: 512Mi + + - it: should create a Deployment with topology spread constraints if `defaultBackend.topologySpreadConstraints` is set + set: + defaultBackend.enabled: true + defaultBackend.topologySpreadConstraints: + - labelSelector: + matchLabels: + app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}' + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/component: default-backend + topologyKey: topology.kubernetes.io/zone + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + - labelSelector: + matchLabels: + app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}' + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/component: default-backend + topologyKey: kubernetes.io/hostname + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + asserts: + - equal: + path: spec.template.spec.topologySpreadConstraints + value: + - labelSelector: + matchLabels: + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/instance: RELEASE-NAME + app.kubernetes.io/component: default-backend + topologyKey: topology.kubernetes.io/zone + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + - labelSelector: + matchLabels: + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/instance: RELEASE-NAME + app.kubernetes.io/component: default-backend + topologyKey: kubernetes.io/hostname + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + + - it: should create a Deployment with affinity if `defaultBackend.affinity` is set + set: + defaultBackend.enabled: true + defaultBackend.affinity: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: app.kubernetes.io/name + operator: In + values: + - '{{ include "ingress-nginx.name" . }}' + - key: app.kubernetes.io/instance + operator: In + values: + - '{{ .Release.Name }}' + - key: app.kubernetes.io/component + operator: In + values: + - default-backend + topologyKey: kubernetes.io/hostname + asserts: + - equal: + path: spec.template.spec.affinity + value: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: app.kubernetes.io/name + operator: In + values: + - ingress-nginx + - key: app.kubernetes.io/instance + operator: In + values: + - RELEASE-NAME + - key: app.kubernetes.io/component + operator: In + values: + - default-backend + topologyKey: kubernetes.io/hostname + + - it: should create a Deployment with `runAsGroup` if `defaultBackend.image.runAsGroup` is set + set: + defaultBackend.enabled: true + defaultBackend.image.runAsGroup: 1000 + asserts: + - equal: + path: spec.template.spec.containers[0].securityContext.runAsGroup + value: 1000 + + - it: should create a Deployment with a custom registry if `global.image.registry` is set + set: + global.image.registry: custom.registry.io + defaultBackend.enabled: true + defaultBackend.image.tag: v1.0.0-dev + defaultBackend.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd + asserts: + - equal: + path: spec.template.spec.containers[0].image + value: custom.registry.io/defaultbackend-amd64:v1.0.0-dev@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd + + - it: should create a Deployment with a custom registry if `defaultBackend.image.registry` is set + set: + defaultBackend.enabled: true + defaultBackend.image.registry: custom.registry.io + defaultBackend.image.tag: v1.0.0-dev + defaultBackend.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd + asserts: + - equal: + path: spec.template.spec.containers[0].image + value: custom.registry.io/defaultbackend-amd64:v1.0.0-dev@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd + + - it: should create a Deployment with a custom image if `defaultBackend.image.image` is set + set: + defaultBackend.enabled: true + defaultBackend.image.image: custom-repo/custom-image + defaultBackend.image.tag: v1.0.0-dev + defaultBackend.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd + asserts: + - equal: + path: spec.template.spec.containers[0].image + value: registry.k8s.io/custom-repo/custom-image:v1.0.0-dev@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd + + - it: should create a Deployment with a custom tag if `defaultBackend.image.tag` is set + set: + defaultBackend.enabled: true + defaultBackend.image.tag: custom-tag + defaultBackend.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd + asserts: + - equal: + path: spec.template.spec.containers[0].image + value: registry.k8s.io/defaultbackend-amd64:custom-tag@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-extra-configmaps_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-extra-configmaps_test.yaml new file mode 100644 index 000000000..aa600e749 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-extra-configmaps_test.yaml @@ -0,0 +1,50 @@ +suite: Default Backend > Extra ConfigMaps +templates: + - default-backend-extra-configmaps.yaml + +tests: + - it: should not create a ConfigMap if `defaultBackend.extraConfigMaps` is empty + set: + defaultBackend.enabled: true + defaultBackend.extraConfigMaps: [] + asserts: + - hasDocuments: + count: 0 + + - it: should create one ConfigMap if `defaultBackend.extraConfigMaps` has one element + set: + defaultBackend.enabled: true + defaultBackend.extraConfigMaps: + - name: my-configmap-1 + data: + key1: value1 + asserts: + - hasDocuments: + count: 1 + - isKind: + of: ConfigMap + - equal: + path: metadata.name + value: my-configmap-1 + - equal: + path: data.key1 + value: value1 + + - it: should create two ConfigMaps if `defaultBackend.extraConfigMaps` has two elements + set: + defaultBackend.enabled: true + defaultBackend.extraConfigMaps: + - name: my-configmap-1 + data: + key1: value1 + - name: my-configmap-2 + data: + key2: value2 + asserts: + - hasDocuments: + count: 2 + - isKind: + of: ConfigMap + - matchRegex: + path: metadata.name + pattern: my-configmap-(1|2) diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-poddisruptionbudget_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-poddisruptionbudget_test.yaml new file mode 100644 index 000000000..bfe98e883 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-poddisruptionbudget_test.yaml @@ -0,0 +1,79 @@ +suite: Default Backend > PodDisruptionBudget +templates: + - default-backend-poddisruptionbudget.yaml + +tests: + - it: should create a PodDisruptionBudget if `defaultBackend.replicaCount` is greater than 1 + set: + defaultBackend.enabled: true + defaultBackend.replicaCount: 2 + asserts: + - hasDocuments: + count: 1 + - isKind: + of: PodDisruptionBudget + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-defaultbackend + + - it: should not create a PodDisruptionBudget if `defaultBackend.replicaCount` is less than or equal 1 + set: + defaultBackend.enabled: true + defaultBackend.replicaCount: 1 + asserts: + - hasDocuments: + count: 0 + + - it: should create a PodDisruptionBudget if `defaultBackend.autoscaling.enabled` is true and `defaultBackend.autoscaling.minReplicas` is greater than 1 + set: + defaultBackend.enabled: true + defaultBackend.autoscaling.enabled: true + defaultBackend.autoscaling.minReplicas: 2 + asserts: + - hasDocuments: + count: 1 + - isKind: + of: PodDisruptionBudget + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-defaultbackend + + - it: should not create a PodDisruptionBudget if `defaultBackend.autoscaling.enabled` is true and `defaultBackend.autoscaling.minReplicas` is less than or equal 1 + set: + defaultBackend.enabled: true + defaultBackend.autoscaling.enabled: true + defaultBackend.autoscaling.minReplicas: 1 + asserts: + - hasDocuments: + count: 0 + + - it: should create a PodDisruptionBudget without `minAvailable` and with `maxUnavailable` if `defaultBackend.minAvailable` and `defaultBackend.maxUnavailable` are set + set: + defaultBackend.enabled: true + defaultBackend.replicaCount: 2 + defaultBackend.minAvailable: 1 + defaultBackend.maxUnavailable: 1 + asserts: + - hasDocuments: + count: 1 + - isKind: + of: PodDisruptionBudget + - notExists: + path: spec.minAvailable + - equal: + path: spec.maxUnavailable + value: 1 + + - it: should create a PodDisruptionBudget with `unhealthyPodEvictionPolicy` if `defaultBackend.unhealthyPodEvictionPolicy` is set + set: + defaultBackend.enabled: true + defaultBackend.replicaCount: 2 + defaultBackend.unhealthyPodEvictionPolicy: IfHealthyBudget + asserts: + - hasDocuments: + count: 1 + - isKind: + of: PodDisruptionBudget + - equal: + path: spec.unhealthyPodEvictionPolicy + value: IfHealthyBudget diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-service_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-service_test.yaml new file mode 100644 index 000000000..f16904f9f --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-service_test.yaml @@ -0,0 +1,32 @@ +suite: Default Backend > Service +templates: + - default-backend-service.yaml + +tests: + - it: should not create a Service if `defaultBackend.enabled` is false + set: + defaultBackend.enabled: false + asserts: + - hasDocuments: + count: 0 + + - it: should create a Service if `defaultBackend.enabled` is true + set: + defaultBackend.enabled: true + asserts: + - hasDocuments: + count: 1 + - isKind: + of: Service + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-defaultbackend + + - it: should create a Service with port 80 if `defaultBackend.service.port` is 80 + set: + defaultBackend.enabled: true + defaultBackend.service.port: 80 + asserts: + - equal: + path: spec.ports[0].port + value: 80 diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-serviceaccount_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-serviceaccount_test.yaml new file mode 100644 index 000000000..05a815d0a --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-serviceaccount_test.yaml @@ -0,0 +1,51 @@ +suite: Default Backend > ServiceAccount +templates: + - default-backend-serviceaccount.yaml + +tests: + - it: should not create a ServiceAccount if `defaultBackend.serviceAccount.create` is false + set: + defaultBackend.enabled: true + defaultBackend.serviceAccount.create: false + asserts: + - hasDocuments: + count: 0 + + - it: should create a ServiceAccount if `defaultBackend.serviceAccount.create` is true + set: + defaultBackend.enabled: true + defaultBackend.serviceAccount.create: true + asserts: + - hasDocuments: + count: 1 + - isKind: + of: ServiceAccount + - equal: + path: metadata.name + value: RELEASE-NAME-ingress-nginx-backend + + - it: should create a ServiceAccount with specified name if `defaultBackend.serviceAccount.name` is set + set: + defaultBackend.enabled: true + defaultBackend.serviceAccount.name: ingress-nginx-admission-test-sa + asserts: + - hasDocuments: + count: 1 + - isKind: + of: ServiceAccount + - equal: + path: metadata.name + value: ingress-nginx-admission-test-sa + + - it: should create a ServiceAccount with token auto-mounting disabled if `defaultBackend.serviceAccount.automountServiceAccountToken` is false + set: + defaultBackend.enabled: true + defaultBackend.serviceAccount.automountServiceAccountToken: false + asserts: + - hasDocuments: + count: 1 + - isKind: + of: ServiceAccount + - equal: + path: automountServiceAccountToken + value: false diff --git a/charts/devtron-utilities/charts/ingress-nginx/values.yaml b/charts/devtron-utilities/charts/ingress-nginx/values.yaml new file mode 100644 index 000000000..0c1a0ca24 --- /dev/null +++ b/charts/devtron-utilities/charts/ingress-nginx/values.yaml @@ -0,0 +1,1193 @@ +## nginx configuration +## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/index.md +## + +global: + image: + # -- Registry host to pull images from. + registry: registry.k8s.io +## Overrides for generated resource names +# See templates/_helpers.tpl +# nameOverride: +# fullnameOverride: + +# -- Override the deployment namespace; defaults to .Release.Namespace +namespaceOverride: "" +## Labels to apply to all resources +## +commonLabels: {} +# scmhash: abc123 +# myLabel: aakkmd + +controller: + name: controller + enableAnnotationValidations: true + image: + ## Keep false as default for now! + chroot: false + # registry: registry.k8s.io + image: ingress-nginx/controller + ## for backwards compatibility consider setting the full image url via the repository value below + ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail + ## repository: + tag: "v1.12.0" + digest: sha256:e6b8de175acda6ca913891f0f727bca4527e797d52688cbe9fec9040d6f6b6fa + digestChroot: sha256:87c88e1c38a6c8d4483c8f70b69e2cca49853bb3ec3124b9b1be648edf139af3 + pullPolicy: IfNotPresent + runAsNonRoot: true + # -- This value must not be changed using the official image. + # uid=101(www-data) gid=82(www-data) groups=82(www-data) + runAsUser: 101 + # -- This value must not be changed using the official image. + # uid=101(www-data) gid=82(www-data) groups=82(www-data) + runAsGroup: 82 + allowPrivilegeEscalation: false + seccompProfile: + type: RuntimeDefault + readOnlyRootFilesystem: false + # -- Configures the controller container name + containerName: controller + # -- Configures the ports that the nginx-controller listens on + containerPort: + http: 80 + https: 443 + # -- Global configuration passed to the ConfigMap consumed by the controller. Values may contain Helm templates. + # Ref.: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/ + config: {} + # -- Annotations to be added to the controller config configuration configmap. + configAnnotations: {} + # -- Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers + proxySetHeaders: {} + # -- Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers + addHeaders: {} + # -- Optionally customize the pod dnsConfig. + dnsConfig: {} + # -- Optionally customize the pod hostAliases. + hostAliases: [] + # - ip: 127.0.0.1 + # hostnames: + # - foo.local + # - bar.local + # - ip: 10.1.2.3 + # hostnames: + # - foo.remote + # - bar.remote + # -- Optionally customize the pod hostname. + hostname: {} + # -- Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'. + # By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller + # to keep resolving names inside the k8s network, use ClusterFirstWithHostNet. + dnsPolicy: ClusterFirst + # -- Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network + # Ingress status was blank because there is no Service exposing the Ingress-Nginx Controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply + reportNodeInternalIp: false + # -- Process Ingress objects without ingressClass annotation/ingressClassName field + # Overrides value for --watch-ingress-without-class flag of the controller binary + # Defaults to false + watchIngressWithoutClass: false + # -- Process IngressClass per name (additionally as per spec.controller). + ingressClassByName: false + # -- This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-mode="auto" + # Defaults to false + enableTopologyAwareRouting: false + # -- This configuration disable Nginx Controller Leader Election + disableLeaderElection: false + # -- Duration a leader election is valid before it's getting re-elected, e.g. `15s`, `10m` or `1h`. (Default: 30s) + electionTTL: "" + # -- This configuration defines if Ingress Controller should allow users to set + # their own *-snippet annotations, otherwise this is forbidden / dropped + # when users add those annotations. + # Global snippets in ConfigMap are still respected + allowSnippetAnnotations: false + # -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm), + # since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920 + # is merged + hostNetwork: false + ## Use host ports 80 and 443 + ## Disabled by default + hostPort: + # -- Enable 'hostPort' or not + enabled: false + ports: + # -- 'hostPort' http port + http: 80 + # -- 'hostPort' https port + https: 443 + # NetworkPolicy for controller component. + networkPolicy: + # -- Enable 'networkPolicy' or not + enabled: false + # -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader' + electionID: "" + # -- This section refers to the creation of the IngressClass resource. + # IngressClasses are immutable and cannot be changed after creation. + # We do not support namespaced IngressClasses, yet, so a ClusterRole and a ClusterRoleBinding is required. + ingressClassResource: + # -- Name of the IngressClass + name: nginx + # -- Create the IngressClass or not + enabled: true + # -- If true, Ingresses without `ingressClassName` get assigned to this IngressClass on creation. + # Ingress creation gets rejected if there are multiple default IngressClasses. + # Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#default-ingress-class + default: false + # -- Annotations to be added to the IngressClass resource. + annotations: {} + # -- Controller of the IngressClass. An Ingress Controller looks for IngressClasses it should reconcile by this value. + # This value is also being set as the `--controller-class` argument of this Ingress Controller. + # Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class + controllerValue: k8s.io/ingress-nginx + # -- Aliases of this IngressClass. Creates copies with identical settings but the respective alias as name. + # Useful for development environments with only one Ingress Controller but production-like Ingress resources. + # `default` gets enabled on the original IngressClass only. + aliases: [] + # aliases: + # - nginx-alias-1 + # - nginx-alias-2 + # -- A link to a custom resource containing additional configuration for the controller. + # This is optional if the controller consuming this IngressClass does not require additional parameters. + # Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class + parameters: {} + # parameters: + # apiGroup: k8s.example.com + # kind: IngressParameters + # name: external-lb + # -- For backwards compatibility with ingress.class annotation, use ingressClass. + # Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation + ingressClass: nginx + # -- Labels to add to the pod container metadata + podLabels: {} + # key: value + + # -- Security context for controller pods + podSecurityContext: {} + # -- sysctls for controller pods + ## Ref: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ + sysctls: {} + # sysctls: + # "net.core.somaxconn": "8192" + # -- Security context for controller containers + containerSecurityContext: {} + # -- Allows customization of the source of the IP address or FQDN to report + # in the ingress status field. By default, it reads the information provided + # by the service. If disable, the status field reports the IP address of the + # node or nodes where an ingress controller pod is running. + publishService: + # -- Enable 'publishService' or not + enabled: true + # -- Allows overriding of the publish service to bind to + # Must be / + pathOverride: "" + # Limit the scope of the controller to a specific namespace + scope: + # -- Enable 'scope' or not + enabled: false + # -- Namespace to limit the controller to; defaults to $(POD_NAMESPACE) + namespace: "" + # -- When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels + # only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces. + namespaceSelector: "" + # -- Allows customization of the configmap / nginx-configmap namespace; defaults to $(POD_NAMESPACE) + configMapNamespace: "" + tcp: + # -- Allows customization of the tcp-services-configmap; defaults to $(POD_NAMESPACE) + configMapNamespace: "" + # -- Annotations to be added to the tcp config configmap + annotations: {} + udp: + # -- Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE) + configMapNamespace: "" + # -- Annotations to be added to the udp config configmap + annotations: {} + # -- Maxmind license key to download GeoLite2 Databases. + ## https://blog.maxmind.com/2019/12/significant-changes-to-accessing-and-using-geolite2-databases/ + maxmindLicenseKey: "" + # -- Additional command line arguments to pass to Ingress-Nginx Controller + # E.g. to specify the default SSL certificate you can use + extraArgs: {} + ## extraArgs: + ## default-ssl-certificate: "/" + ## time-buckets: "0.005,0.01,0.025,0.05,0.1,0.25,0.5,1,2.5,5,10" + ## length-buckets: "10,20,30,40,50,60,70,80,90,100" + ## size-buckets: "10,100,1000,10000,100000,1e+06,1e+07" + + # -- Additional environment variables to set + extraEnvs: [] + # extraEnvs: + # - name: FOO + # valueFrom: + # secretKeyRef: + # key: FOO + # name: secret-resource + + # -- Use a `DaemonSet` or `Deployment` + kind: Deployment + # -- Annotations to be added to the controller Deployment or DaemonSet + ## + annotations: {} + # keel.sh/pollSchedule: "@every 60m" + + # -- Labels to be added to the controller Deployment or DaemonSet and other resources that do not have option to specify labels + ## + labels: {} + # keel.sh/policy: patch + # keel.sh/trigger: poll + + # -- The update strategy to apply to the Deployment or DaemonSet + ## + updateStrategy: {} + # rollingUpdate: + # maxUnavailable: 1 + # type: RollingUpdate + + # -- Specifies the number of seconds you want to wait for the controller deployment to progress before the system reports back that it has failed. + # Ref.: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#progress-deadline-seconds + progressDeadlineSeconds: 0 + # -- `minReadySeconds` to avoid killing pods before we are ready + ## + minReadySeconds: 0 + # -- Node tolerations for server scheduling to nodes with taints + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + ## + tolerations: [] + # - key: "key" + # operator: "Equal|Exists" + # value: "value" + # effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)" + + # -- Affinity and anti-affinity rules for server scheduling to nodes + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## + affinity: {} + # # An example of preferred pod anti-affinity, weight is in the range 1-100 + # podAntiAffinity: + # preferredDuringSchedulingIgnoredDuringExecution: + # - weight: 100 + # podAffinityTerm: + # labelSelector: + # matchExpressions: + # - key: app.kubernetes.io/name + # operator: In + # values: + # - '{{ include "ingress-nginx.name" . }}' + # - key: app.kubernetes.io/instance + # operator: In + # values: + # - '{{ .Release.Name }}' + # - key: app.kubernetes.io/component + # operator: In + # values: + # - controller + # topologyKey: kubernetes.io/hostname + + # # An example of required pod anti-affinity + # podAntiAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # - labelSelector: + # matchExpressions: + # - key: app.kubernetes.io/name + # operator: In + # values: + # - '{{ include "ingress-nginx.name" . }}' + # - key: app.kubernetes.io/instance + # operator: In + # values: + # - '{{ .Release.Name }}' + # - key: app.kubernetes.io/component + # operator: In + # values: + # - controller + # topologyKey: kubernetes.io/hostname + + # -- Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in. + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + ## + topologySpreadConstraints: [] + # - labelSelector: + # matchLabels: + # app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}' + # app.kubernetes.io/instance: '{{ .Release.Name }}' + # app.kubernetes.io/component: controller + # matchLabelKeys: + # - pod-template-hash + # topologyKey: topology.kubernetes.io/zone + # maxSkew: 1 + # whenUnsatisfiable: ScheduleAnyway + # - labelSelector: + # matchLabels: + # app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}' + # app.kubernetes.io/instance: '{{ .Release.Name }}' + # app.kubernetes.io/component: controller + # matchLabelKeys: + # - pod-template-hash + # topologyKey: kubernetes.io/hostname + # maxSkew: 1 + # whenUnsatisfiable: ScheduleAnyway + + # -- `terminationGracePeriodSeconds` to avoid killing pods before we are ready + ## wait up to five minutes for the drain of connections + ## + terminationGracePeriodSeconds: 300 + # -- Node labels for controller pod assignment + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: + kubernetes.io/os: linux + ## Liveness and readiness probe values + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + ## + ## startupProbe: + ## httpGet: + ## # should match container.healthCheckPath + ## path: "/healthz" + ## port: 10254 + ## scheme: HTTP + ## initialDelaySeconds: 5 + ## periodSeconds: 5 + ## timeoutSeconds: 2 + ## successThreshold: 1 + ## failureThreshold: 5 + livenessProbe: + httpGet: + # should match container.healthCheckPath + path: "/healthz" + port: 10254 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 5 + readinessProbe: + httpGet: + # should match container.healthCheckPath + path: "/healthz" + port: 10254 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 3 + # -- Path of the health check endpoint. All requests received on the port defined by + # the healthz-port parameter are forwarded internally to this path. + healthCheckPath: "/healthz" + # -- Address to bind the health check endpoint. + # It is better to set this option to the internal node address + # if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode. + healthCheckHost: "" + # -- Annotations to be added to controller pods + ## + podAnnotations: {} + replicaCount: 1 + # -- Minimum available pods set in PodDisruptionBudget. + # Define either 'minAvailable' or 'maxUnavailable', never both. + minAvailable: 1 + # -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored. + # maxUnavailable: 1 + # -- Eviction policy for unhealthy pods guarded by PodDisruptionBudget. + # Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/ + unhealthyPodEvictionPolicy: "" + ## Define requests resources to avoid probe issues due to CPU utilization in busy nodes + ## ref: https://github.com/kubernetes/ingress-nginx/issues/4735#issuecomment-551204903 + ## Ideally, there should be no limits. + ## https://engineering.indeedblog.com/blog/2019/12/cpu-throttling-regression-fix/ + resources: + ## limits: + ## cpu: 100m + ## memory: 90Mi + requests: + cpu: 100m + memory: 90Mi + # Mutually exclusive with keda autoscaling + autoscaling: + enabled: false + annotations: {} + minReplicas: 1 + maxReplicas: 11 + targetCPUUtilizationPercentage: 50 + targetMemoryUtilizationPercentage: 50 + behavior: {} + # scaleDown: + # stabilizationWindowSeconds: 300 + # policies: + # - type: Pods + # value: 1 + # periodSeconds: 180 + # scaleUp: + # stabilizationWindowSeconds: 300 + # policies: + # - type: Pods + # value: 2 + # periodSeconds: 60 + autoscalingTemplate: [] + # Custom or additional autoscaling metrics + # ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics + # - type: Pods + # pods: + # metric: + # name: nginx_ingress_controller_nginx_process_requests_total + # target: + # type: AverageValue + # averageValue: 10000m + + # Mutually exclusive with hpa autoscaling + keda: + apiVersion: "keda.sh/v1alpha1" + ## apiVersion changes with keda 1.x vs 2.x + ## 2.x = keda.sh/v1alpha1 + ## 1.x = keda.k8s.io/v1alpha1 + enabled: false + minReplicas: 1 + maxReplicas: 11 + pollingInterval: 30 + cooldownPeriod: 300 + # fallback: + # failureThreshold: 3 + # replicas: 11 + restoreToOriginalReplicaCount: false + scaledObject: + annotations: {} + # Custom annotations for ScaledObject resource + # annotations: + # key: value + triggers: [] + # - type: prometheus + # metadata: + # serverAddress: http://:9090 + # metricName: http_requests_total + # threshold: '100' + # query: sum(rate(http_requests_total{deployment="my-deployment"}[2m])) + + behavior: {} + # scaleDown: + # stabilizationWindowSeconds: 300 + # policies: + # - type: Pods + # value: 1 + # periodSeconds: 180 + # scaleUp: + # stabilizationWindowSeconds: 300 + # policies: + # - type: Pods + # value: 2 + # periodSeconds: 60 + # -- Enable mimalloc as a drop-in replacement for malloc. + ## ref: https://github.com/microsoft/mimalloc + ## + enableMimalloc: true + ## Override NGINX template + customTemplate: + configMapName: "" + configMapKey: "" + service: + # -- Enable controller services or not. This does not influence the creation of either the admission webhook or the metrics service. + enabled: true + external: + # -- Enable the external controller service or not. Useful for internal-only deployments. + enabled: true + # -- Annotations to be added to the external controller service. See `controller.service.internal.annotations` for annotations to be added to the internal controller service. + annotations: {} + # -- Labels to be added to both controller services. + labels: {} + # -- Type of the external controller service. + # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: LoadBalancer + # -- Pre-defined cluster internal IP address of the external controller service. Take care of collisions with existing services. + # This value is immutable. Set once, it can not be changed without deleting and re-creating the service. + # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address + clusterIP: "" + # -- List of node IP addresses at which the external controller service is available. + # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips + externalIPs: [] + # -- Deprecated: Pre-defined IP address of the external controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP. + # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer + loadBalancerIP: "" + # -- Restrict access to the external controller service. Values must be CIDRs. Allows any source address by default. + loadBalancerSourceRanges: [] + # -- Load balancer class of the external controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default. + # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class + loadBalancerClass: "" + # -- Enable node port allocation for the external controller service or not. Applies to type `LoadBalancer` only. + # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation + # allocateLoadBalancerNodePorts: true + + # -- External traffic policy of the external controller service. Set to "Local" to preserve source IP on providers supporting it. + # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + externalTrafficPolicy: "" + # -- Session affinity of the external controller service. Must be either "None" or "ClientIP" if set. Defaults to "None". + # Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity + sessionAffinity: "" + # -- Specifies the health check node port (numeric port number) for the external controller service. + # If not specified, the service controller allocates a port from your cluster's node port range. + # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + # healthCheckNodePort: 0 + + # -- Represents the dual-stack capabilities of the external controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack. + # Fields `ipFamilies` and `clusterIP` depend on the value of this field. + # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services + ipFamilyPolicy: SingleStack + # -- List of IP families (e.g. IPv4, IPv6) assigned to the external controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field. + # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services + ipFamilies: + - IPv4 + # -- Enable the HTTP listener on both controller services or not. + enableHttp: true + # -- Enable the HTTPS listener on both controller services or not. + enableHttps: true + ports: + # -- Port the external HTTP listener is published with. + http: 80 + # -- Port the external HTTPS listener is published with. + https: 443 + targetPorts: + # -- Port of the ingress controller the external HTTP listener is mapped to. + http: http + # -- Port of the ingress controller the external HTTPS listener is mapped to. + https: https + # -- Declare the app protocol of the external HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol. + # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol + appProtocol: true + nodePorts: + # -- Node port allocated for the external HTTP listener. If left empty, the service controller allocates one from the configured node port range. + http: "" + # -- Node port allocated for the external HTTPS listener. If left empty, the service controller allocates one from the configured node port range. + https: "" + # -- Node port mapping for external TCP listeners. If left empty, the service controller allocates them from the configured node port range. + # Example: + # tcp: + # 8080: 30080 + tcp: {} + # -- Node port mapping for external UDP listeners. If left empty, the service controller allocates them from the configured node port range. + # Example: + # udp: + # 53: 30053 + udp: {} + internal: + # -- Enable the internal controller service or not. Remember to configure `controller.service.internal.annotations` when enabling this. + enabled: false + # -- Annotations to be added to the internal controller service. Mandatory for the internal controller service to be created. Varies with the cloud service. + # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + annotations: {} + # -- Type of the internal controller service. + # Defaults to the value of `controller.service.type`. + # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: "" + # -- Pre-defined cluster internal IP address of the internal controller service. Take care of collisions with existing services. + # This value is immutable. Set once, it can not be changed without deleting and re-creating the service. + # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address + clusterIP: "" + # -- List of node IP addresses at which the internal controller service is available. + # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips + externalIPs: [] + # -- Deprecated: Pre-defined IP address of the internal controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP. + # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer + loadBalancerIP: "" + # -- Restrict access to the internal controller service. Values must be CIDRs. Allows any source address by default. + loadBalancerSourceRanges: [] + # -- Load balancer class of the internal controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default. + # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class + loadBalancerClass: "" + # -- Enable node port allocation for the internal controller service or not. Applies to type `LoadBalancer` only. + # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation + # allocateLoadBalancerNodePorts: true + + # -- External traffic policy of the internal controller service. Set to "Local" to preserve source IP on providers supporting it. + # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + externalTrafficPolicy: "" + # -- Session affinity of the internal controller service. Must be either "None" or "ClientIP" if set. Defaults to "None". + # Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity + sessionAffinity: "" + # -- Specifies the health check node port (numeric port number) for the internal controller service. + # If not specified, the service controller allocates a port from your cluster's node port range. + # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + # healthCheckNodePort: 0 + + # -- Represents the dual-stack capabilities of the internal controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack. + # Fields `ipFamilies` and `clusterIP` depend on the value of this field. + # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services + ipFamilyPolicy: SingleStack + # -- List of IP families (e.g. IPv4, IPv6) assigned to the internal controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field. + # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services + ipFamilies: + - IPv4 + ports: {} + # -- Port the internal HTTP listener is published with. + # Defaults to the value of `controller.service.ports.http`. + # http: 80 + # -- Port the internal HTTPS listener is published with. + # Defaults to the value of `controller.service.ports.https`. + # https: 443 + + targetPorts: {} + # -- Port of the ingress controller the internal HTTP listener is mapped to. + # Defaults to the value of `controller.service.targetPorts.http`. + # http: http + # -- Port of the ingress controller the internal HTTPS listener is mapped to. + # Defaults to the value of `controller.service.targetPorts.https`. + # https: https + + # -- Declare the app protocol of the internal HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol. + # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol + appProtocol: true + nodePorts: + # -- Node port allocated for the internal HTTP listener. If left empty, the service controller allocates one from the configured node port range. + http: "" + # -- Node port allocated for the internal HTTPS listener. If left empty, the service controller allocates one from the configured node port range. + https: "" + # -- Node port mapping for internal TCP listeners. If left empty, the service controller allocates them from the configured node port range. + # Example: + # tcp: + # 8080: 30080 + tcp: {} + # -- Node port mapping for internal UDP listeners. If left empty, the service controller allocates them from the configured node port range. + # Example: + # udp: + # 53: 30053 + udp: {} + # shareProcessNamespace enables process namespace sharing within the pod. + # This can be used for example to signal log rotation using `kill -USR1` from a sidecar. + shareProcessNamespace: false + # -- Additional containers to be added to the controller pod. + # See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example. + extraContainers: [] + # - name: my-sidecar + # image: nginx:latest + # - name: lemonldap-ng-controller + # image: lemonldapng/lemonldap-ng-controller:0.2.0 + # args: + # - /lemonldap-ng-controller + # - --alsologtostderr + # - --configmap=$(POD_NAMESPACE)/lemonldap-ng-configuration + # env: + # - name: POD_NAME + # valueFrom: + # fieldRef: + # fieldPath: metadata.name + # - name: POD_NAMESPACE + # valueFrom: + # fieldRef: + # fieldPath: metadata.namespace + # volumeMounts: + # - name: copy-portal-skins + # mountPath: /srv/var/lib/lemonldap-ng/portal/skins + + # -- Additional volumeMounts to the controller main container. + extraVolumeMounts: [] + # - name: copy-portal-skins + # mountPath: /var/lib/lemonldap-ng/portal/skins + + # -- Additional volumes to the controller pod. + extraVolumes: [] + # - name: copy-portal-skins + # emptyDir: {} + + # -- Containers, which are run before the app containers are started. + extraInitContainers: [] + # - name: init-myservice + # image: busybox + # command: ['sh', '-c', 'until nslookup myservice; do echo waiting for myservice; sleep 2; done;'] + + # -- Modules, which are mounted into the core nginx image. + extraModules: [] + # - name: mytestmodule + # image: + # # registry: registry.k8s.io + # image: ingress-nginx/mytestmodule + # ## for backwards compatibility consider setting the full image url via the repository value below + # ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail + # ## repository: + # tag: "v1.0.0" + # digest: "" + # distroless: false + # containerSecurityContext: + # runAsNonRoot: true + # runAsUser: + # runAsGroup: + # allowPrivilegeEscalation: false + # seccompProfile: + # type: RuntimeDefault + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # resources: {} + # + # The image must contain a `/usr/local/bin/init_module.sh` executable, which + # will be executed as initContainers, to move its config files within the + # mounted volume. + + admissionWebhooks: + name: admission + annotations: {} + # ignore-check.kube-linter.io/no-read-only-rootfs: "This deployment needs write access to root filesystem". + + ## Additional annotations to the admission webhooks. + ## These annotations will be added to the ValidatingWebhookConfiguration and + ## the Jobs Spec of the admission webhooks. + enabled: true + # -- Additional environment variables to set + extraEnvs: [] + # extraEnvs: + # - name: FOO + # valueFrom: + # secretKeyRef: + # key: FOO + # name: secret-resource + # -- Admission Webhook failure policy to use + failurePolicy: Fail + # timeoutSeconds: 10 + port: 8443 + certificate: "/usr/local/certificates/cert" + key: "/usr/local/certificates/key" + namespaceSelector: {} + objectSelector: {} + # -- Labels to be added to admission webhooks + labels: {} + service: + annotations: {} + # clusterIP: "" + externalIPs: [] + # loadBalancerIP: "" + loadBalancerSourceRanges: [] + servicePort: 443 + type: ClusterIP + createSecretJob: + name: create + # -- Security context for secret creation containers + securityContext: + runAsNonRoot: true + runAsUser: 65532 + runAsGroup: 65532 + allowPrivilegeEscalation: false + seccompProfile: + type: RuntimeDefault + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + resources: {} + # limits: + # cpu: 10m + # memory: 20Mi + # requests: + # cpu: 10m + # memory: 20Mi + patchWebhookJob: + name: patch + # -- Security context for webhook patch containers + securityContext: + runAsNonRoot: true + runAsUser: 65532 + runAsGroup: 65532 + allowPrivilegeEscalation: false + seccompProfile: + type: RuntimeDefault + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + resources: {} + patch: + enabled: true + image: + # registry: registry.k8s.io + image: ingress-nginx/kube-webhook-certgen + ## for backwards compatibility consider setting the full image url via the repository value below + ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail + ## repository: + tag: v1.5.0 + digest: sha256:aaafd456bda110628b2d4ca6296f38731a3aaf0bf7581efae824a41c770a8fc4 + pullPolicy: IfNotPresent + # -- Provide a priority class name to the webhook patching job + ## + priorityClassName: "" + podAnnotations: {} + # NetworkPolicy for webhook patch + networkPolicy: + # -- Enable 'networkPolicy' or not + enabled: false + nodeSelector: + kubernetes.io/os: linux + tolerations: [] + # -- Labels to be added to patch job resources + labels: {} + # -- Security context for secret creation & webhook patch pods + securityContext: {} + # -- Admission webhook patch job RBAC + rbac: + # -- Create RBAC or not + create: true + # -- Admission webhook patch job service account + serviceAccount: + # -- Create a service account or not + create: true + # -- Custom service account name + name: "" + # -- Auto-mount service account token or not + automountServiceAccountToken: true + # Use certmanager to generate webhook certs + certManager: + enabled: false + # self-signed root certificate + rootCert: + # default to be 5y + duration: "" + admissionCert: + # default to be 1y + duration: "" + # issuerRef: + # name: "issuer" + # kind: "ClusterIssuer" + metrics: + port: 10254 + portName: metrics + # if this port is changed, change healthz-port: in extraArgs: accordingly + enabled: false + service: + # -- Enable the metrics service or not. + enabled: true + annotations: {} + # prometheus.io/scrape: "true" + # prometheus.io/port: "10254" + # -- Labels to be added to the metrics service resource + labels: {} + # clusterIP: "" + + # -- List of IP addresses at which the stats-exporter service is available + ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips + ## + externalIPs: [] + # loadBalancerIP: "" + loadBalancerSourceRanges: [] + servicePort: 10254 + type: ClusterIP + # externalTrafficPolicy: "" + # nodePort: "" + serviceMonitor: + enabled: false + additionalLabels: {} + # -- Annotations to be added to the ServiceMonitor. + annotations: {} + ## The label to use to retrieve the job name from. + ## jobLabel: "app.kubernetes.io/name" + namespace: "" + namespaceSelector: {} + ## Default: scrape .Release.Namespace or namespaceOverride only + ## To scrape all, use the following: + ## namespaceSelector: + ## any: true + scrapeInterval: 30s + # honorLabels: true + targetLabels: [] + relabelings: [] + metricRelabelings: [] + prometheusRule: + enabled: false + additionalLabels: {} + # -- Annotations to be added to the PrometheusRule. + annotations: {} + # namespace: "" + rules: [] + # # These are just examples rules, please adapt them to your needs + # - alert: NGINXConfigFailed + # expr: count(nginx_ingress_controller_config_last_reload_successful == 0) > 0 + # for: 1s + # labels: + # severity: critical + # annotations: + # description: bad ingress config - nginx config test failed + # summary: uninstall the latest ingress changes to allow config reloads to resume + # # By default a fake self-signed certificate is generated as default and + # # it is fine if it expires. If `--default-ssl-certificate` flag is used + # # and a valid certificate passed please do not filter for `host` label! + # # (i.e. delete `{host!="_"}` so also the default SSL certificate is + # # checked for expiration) + # - alert: NGINXCertificateExpiry + # expr: (avg(nginx_ingress_controller_ssl_expire_time_seconds{host!="_"}) by (host) - time()) < 604800 + # for: 1s + # labels: + # severity: critical + # annotations: + # description: ssl certificate(s) will expire in less then a week + # summary: renew expiring certificates to avoid downtime + # - alert: NGINXTooMany500s + # expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"5.+"} ) / sum(nginx_ingress_controller_requests) ) > 5 + # for: 1m + # labels: + # severity: warning + # annotations: + # description: Too many 5XXs + # summary: More than 5% of all requests returned 5XX, this requires your attention + # - alert: NGINXTooMany400s + # expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"4.+"} ) / sum(nginx_ingress_controller_requests) ) > 5 + # for: 1m + # labels: + # severity: warning + # annotations: + # description: Too many 4XXs + # summary: More than 5% of all requests returned 4XX, this requires your attention + # -- Improve connection draining when ingress controller pod is deleted using a lifecycle hook: + # With this new hook, we increased the default terminationGracePeriodSeconds from 30 seconds + # to 300, allowing the draining of connections up to five minutes. + # If the active connections end before that, the pod will terminate gracefully at that time. + # To effectively take advantage of this feature, the Configmap feature + # worker-shutdown-timeout new value is 240s instead of 10s. + ## + lifecycle: + preStop: + exec: + command: + - /wait-shutdown + priorityClassName: "" +# -- Rollback limit +## +revisionHistoryLimit: 10 +## Default 404 backend +## +defaultBackend: + ## + enabled: false + name: defaultbackend + image: + # registry: registry.k8s.io + image: defaultbackend-amd64 + ## for backwards compatibility consider setting the full image url via the repository value below + ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail + ## repository: + tag: "1.5" + pullPolicy: IfNotPresent + runAsNonRoot: true + # nobody user -> uid 65534 + runAsUser: 65534 + runAsGroup: 65534 + allowPrivilegeEscalation: false + seccompProfile: + type: RuntimeDefault + readOnlyRootFilesystem: true + extraArgs: {} + serviceAccount: + create: true + name: "" + automountServiceAccountToken: true + # -- Additional environment variables to set for defaultBackend pods + extraEnvs: [] + port: 8080 + ## Readiness and liveness probes for default backend + ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ + ## + livenessProbe: + failureThreshold: 3 + initialDelaySeconds: 30 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 5 + readinessProbe: + failureThreshold: 6 + initialDelaySeconds: 0 + periodSeconds: 5 + successThreshold: 1 + timeoutSeconds: 5 + # -- The update strategy to apply to the Deployment or DaemonSet + ## + updateStrategy: {} + # rollingUpdate: + # maxUnavailable: 1 + # type: RollingUpdate + + # -- `minReadySeconds` to avoid killing pods before we are ready + ## + minReadySeconds: 0 + # -- Node tolerations for server scheduling to nodes with taints + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + ## + tolerations: [] + # - key: "key" + # operator: "Equal|Exists" + # value: "value" + # effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)" + + # -- Affinity and anti-affinity rules for server scheduling to nodes + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + affinity: {} + # # An example of preferred pod anti-affinity, weight is in the range 1-100 + # podAntiAffinity: + # preferredDuringSchedulingIgnoredDuringExecution: + # - weight: 100 + # podAffinityTerm: + # labelSelector: + # matchExpressions: + # - key: app.kubernetes.io/name + # operator: In + # values: + # - '{{ include "ingress-nginx.name" . }}' + # - key: app.kubernetes.io/instance + # operator: In + # values: + # - '{{ .Release.Name }}' + # - key: app.kubernetes.io/component + # operator: In + # values: + # - default-backend + # topologyKey: kubernetes.io/hostname + + # # An example of required pod anti-affinity + # podAntiAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # - labelSelector: + # matchExpressions: + # - key: app.kubernetes.io/name + # operator: In + # values: + # - '{{ include "ingress-nginx.name" . }}' + # - key: app.kubernetes.io/instance + # operator: In + # values: + # - '{{ .Release.Name }}' + # - key: app.kubernetes.io/component + # operator: In + # values: + # - default-backend + # topologyKey: kubernetes.io/hostname + + # -- Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in. + # Ref.: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + topologySpreadConstraints: [] + # - labelSelector: + # matchLabels: + # app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}' + # app.kubernetes.io/instance: '{{ .Release.Name }}' + # app.kubernetes.io/component: default-backend + # matchLabelKeys: + # - pod-template-hash + # topologyKey: topology.kubernetes.io/zone + # maxSkew: 1 + # whenUnsatisfiable: ScheduleAnyway + # - labelSelector: + # matchLabels: + # app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}' + # app.kubernetes.io/instance: '{{ .Release.Name }}' + # app.kubernetes.io/component: default-backend + # matchLabelKeys: + # - pod-template-hash + # topologyKey: kubernetes.io/hostname + # maxSkew: 1 + # whenUnsatisfiable: ScheduleAnyway + # -- Security context for default backend pods + podSecurityContext: {} + # -- Security context for default backend containers + containerSecurityContext: {} + # -- Labels to add to the pod container metadata + podLabels: {} + # key: value + + # -- Node labels for default backend pod assignment + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: + kubernetes.io/os: linux + # -- Annotations to be added to default backend pods + ## + podAnnotations: {} + replicaCount: 1 + # -- Minimum available pods set in PodDisruptionBudget. + # Define either 'minAvailable' or 'maxUnavailable', never both. + minAvailable: 1 + # -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored. + # maxUnavailable: 1 + # -- Eviction policy for unhealthy pods guarded by PodDisruptionBudget. + # Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/ + unhealthyPodEvictionPolicy: "" + resources: {} + # limits: + # cpu: 10m + # memory: 20Mi + # requests: + # cpu: 10m + # memory: 20Mi + + extraVolumeMounts: [] + ## Additional volumeMounts to the default backend container. + # - name: copy-portal-skins + # mountPath: /var/lib/lemonldap-ng/portal/skins + + extraVolumes: [] + ## Additional volumes to the default backend pod. + # - name: copy-portal-skins + # emptyDir: {} + + extraConfigMaps: [] + ## Additional configmaps to the default backend pod. + # - name: my-extra-configmap-1 + # labels: + # type: config-1 + # data: + # extra_file_1.html: | + # + # - name: my-extra-configmap-2 + # labels: + # type: config-2 + # data: + # extra_file_2.html: | + # + + autoscaling: + annotations: {} + enabled: false + minReplicas: 1 + maxReplicas: 2 + targetCPUUtilizationPercentage: 50 + targetMemoryUtilizationPercentage: 50 + # NetworkPolicy for default backend component. + networkPolicy: + # -- Enable 'networkPolicy' or not + enabled: false + service: + annotations: {} + # clusterIP: "" + + # -- List of IP addresses at which the default backend service is available + ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips + ## + externalIPs: [] + # loadBalancerIP: "" + loadBalancerSourceRanges: [] + servicePort: 80 + type: ClusterIP + priorityClassName: "" + # -- Labels to be added to the default backend resources + labels: {} +## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266 +rbac: + create: true + scope: false +serviceAccount: + create: true + name: "" + automountServiceAccountToken: true + # -- Annotations for the controller service account + annotations: {} +# -- Optional array of imagePullSecrets containing private registry credentials +## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ +imagePullSecrets: [] +# - name: secretName + +# -- TCP service key-value pairs +## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md +## +tcp: {} +# "8080": "default/example-tcp-svc:9000" + +# -- UDP service key-value pairs +## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md +## +udp: {} +# "53": "kube-system/kube-dns:53" + +# -- Prefix for TCP and UDP ports names in ingress controller service +## Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration +portNamePrefix: "" +# -- (string) A base64-encoded Diffie-Hellman parameter. +# This can be generated with: `openssl dhparam 4096 2> /dev/null | base64` +## Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param +dhParam: "" diff --git a/charts/devtron-utilities/charts/k8s-shield/.helmignore b/charts/devtron-utilities/charts/k8s-shield/.helmignore new file mode 100644 index 000000000..0e8a0eb36 --- /dev/null +++ b/charts/devtron-utilities/charts/k8s-shield/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/devtron-utilities/charts/k8s-shield/Chart.yaml b/charts/devtron-utilities/charts/k8s-shield/Chart.yaml new file mode 100644 index 000000000..af8dd2a09 --- /dev/null +++ b/charts/devtron-utilities/charts/k8s-shield/Chart.yaml @@ -0,0 +1,20 @@ +apiVersion: v2 +appVersion: 1.0.0 +description: A Helm chart for Kubernetes admission policies +icon: https://cdn.devtron.ai/images/Devtron_K8s_Shield.png +keywords: +- Devtron +- Kubernetes +- validatingAdmissionPolicy +- k8s-policy +- Policies +- DevSecOps +- Security +maintainers: +- email: devops@devtron.ai + name: Devtron Devops Team +- email: neha.sharma@devtron.ai + name: Neha Sharma +name: k8s-shield +type: application +version: 0.1.0 diff --git a/charts/devtron-utilities/charts/k8s-shield/Readme.md b/charts/devtron-utilities/charts/k8s-shield/Readme.md new file mode 100644 index 000000000..c6e55416c --- /dev/null +++ b/charts/devtron-utilities/charts/k8s-shield/Readme.md @@ -0,0 +1,72 @@ +## Kubernetes Security Policies + +This document describes the configuration options for various Kubernetes security policies implemented through a ```values.yaml``` file. These policies help enforce security best practices and resource constraints in your Kubernetes cluster. + +The following sections describe the policies that are defined in the values.yaml file. + +## Table of Contents + +1. Exclude Label +2. PVC Creation Policy +3. Namespace Deletion Policy +4. Load Balancer Creation Policy +5. Application Deletion Policy +6. Resource Policies + - Without Resource Policy + - Limit Resource Policy +7. Admin Cluster Role Creation +8. ClusterRole Binding Creation +9. Readiness and Liveness Policy +10. Pod Security Policy +11. Container Security Policy +12. Extra Validating Policy + +## Exclude Label + +The ```excludeLabel``` Resources will be excluded from the scope of the policy if these labels are present. + +## PVC Creation Policy + +The ```pvcCreationPolicy``` restricts the creation of Persistent Volume Claims (PVCs). When enabled, this policy prevents the creation of PVCs in specified namespaces. + +## Namespace Deletion Policy + +The ```namespaceDeletionPolicy``` restricts the deletion of namespaces. It applies only to the namespaces listed in the configuration. + +## Load Balancer Creation Policy + +The ```loadBalancerCreationPolicy``` prevents the creation of LoadBalancer type services in specified namespaces. + +## Application Deletion Policy + +The ```appDeletionPolicy``` prevents the deletion of applications within specified namespaces. + +## Resource Policies + ## Without Resource Policy +The ```WithoutResource policy``` enforces the specification of resource requests and limits for deployments, statefulsets, and other resources. If this policy is enabled, it denies the creation or update of resources that do not specify resource requests or limits. + ## Limit Resource Policy +The ```limitResourcePolicy``` enforces a maximum CPU and memory limit for the specified resources (pods, deployments, statefulsets, etc.). If the resources do not meet the specified limits, the operation is denied. + +## Admin Cluster Role Creation + + The ```adminClusterRoleCreationpolicy``` prevents the creation of new roles or cluster roles with admin-level permissions. + +## ClusterRole Binding Creation + + The ```clusterRoleBindingCreationpolicy``` restricts the creation of clusterRoleBindings with cluster-admin access. + +## Readiness and Liveness Policy + + The ```readinessAndLivenessPolicy``` ensures that all deployments, statefulsets, or rollouts define readiness and liveness probes for their containers. These probes ensure that pods are considered healthy only when they pass the defined checks. + +## Pod Security Policy + + The ```podSecurityPolicy``` defines security best practices for Kubernetes Pods. It prevents containers from running as root, ensures that the root file system is not writable, and disables privileged containers. + +## Container Security Policy + + The ```containerSecurityPolicy``` defines additional security policies that apply to containers within pods. It ensures that containers adhere to security best practices, including non-root execution and restrictions on filesystem access and privilege escalation. + +## Extra Validating Policy + + The ```extraValidatingPolicy``` section allows you to define additional custom validation policies beyond the default set. These policies can be used to enforce specific rules for your Kubernetes resources. \ No newline at end of file diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/_helpers.tpl b/charts/devtron-utilities/charts/k8s-shield/templates/_helpers.tpl new file mode 100644 index 000000000..fd2ec1af4 --- /dev/null +++ b/charts/devtron-utilities/charts/k8s-shield/templates/_helpers.tpl @@ -0,0 +1,16 @@ +{{- define "k8s-shield.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{- define "k8s-shield.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/container-security-context-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/container-security-context-policy.yaml new file mode 100644 index 000000000..71ace2bec --- /dev/null +++ b/charts/devtron-utilities/charts/k8s-shield/templates/container-security-context-policy.yaml @@ -0,0 +1,68 @@ +{{- if and $.Values.defaultPolicies.create $.Values.defaultPolicies.policies.containerSecurityPolicy }} +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicy +metadata: + name: "{{ include "k8s-shield.fullname" . }}-container-security" +spec: + failurePolicy: Fail + matchConstraints: + resourceRules: + - apiGroups: + {{- range $.Values.policyDefinitions.containerSecurityPolicy.apiGroups }} + - {{ . | quote }} + {{- end }} + apiVersions: + - v1 + operations: + {{- range $.Values.policyDefinitions.containerSecurityPolicy.operations }} + - {{ . | quote }} + {{- end }} + resources: + {{- range $.Values.policyDefinitions.containerSecurityPolicy.resources }} + - {{ . | quote }} + {{- end }} + scope: '*' + validations: + - expression: "object.kind != 'Pod' || has(object.metadata.labels) && object.metadata.labels['business-unit'] == 'finance'" + message: "Pods must have a 'business-unit: finance' label" + - expression: "object.kind != 'Pod' || object.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.runAsNonRoot) && c.securityContext.runAsNonRoot == {{ .Values.policyDefinitions.containerSecurityPolicy.allowrunAsNonRoot }})" + message: "All containers must set runAsNonRoot to {{ .Values.policyDefinitions.containerSecurityPolicy.allowrunAsNonRoot }}" + - expression: "object.kind != 'Pod' || object.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.readOnlyRootFilesystem) && c.securityContext.readOnlyRootFilesystem == {{ .Values.policyDefinitions.containerSecurityPolicy.allowreadOnlyRootFilesystem }})" + message: "All containers must set readOnlyRootFilesystem to {{ .Values.policyDefinitions.containerSecurityPolicy.allowreadOnlyRootFilesystem }}" + - expression: "object.kind != 'Pod' || object.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.allowPrivilegeEscalation) || c.securityContext.allowPrivilegeEscalation == {{ .Values.policyDefinitions.containerSecurityPolicy.allowPrivilegeEscalation }})" + message: "All containers must set allowPrivilegeEscalation to {{ .Values.policyDefinitions.containerSecurityPolicy.allowPrivilegeEscalation }}" + - expression: "object.kind != 'Pod' || object.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged == {{ .Values.policyDefinitions.containerSecurityPolicy.allowprivileged }})" + message: "All containers must set privileged to {{ .Values.policyDefinitions.containerSecurityPolicy.allowprivileged }}" + - expression: "['Deployment', 'ReplicaSet', 'DaemonSet', 'StatefulSet', 'Job'].all(kind, object.kind != kind) || has(object.metadata.labels) && object.metadata.labels['business-unit'] == 'finance'" + message: "Workload resources must have a 'business-unit: finance' label" + - expression: "['Deployment', 'ReplicaSet', 'DaemonSet', 'StatefulSet', 'Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.runAsNonRoot) && c.securityContext.runAsNonRoot == {{ .Values.policyDefinitions.containerSecurityPolicy.allowrunAsNonRoot }})" + message: "All workload containers must set runAsNonRoot to {{ .Values.policyDefinitions.containerSecurityPolicy.allowrunAsNonRoot }}" + - expression: "['Deployment', 'ReplicaSet', 'DaemonSet', 'StatefulSet', 'Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.readOnlyRootFilesystem) && c.securityContext.readOnlyRootFilesystem == {{ .Values.policyDefinitions.containerSecurityPolicy.allowreadOnlyRootFilesystem }})" + message: "All workload containers must set readOnlyRootFilesystem to {{ .Values.policyDefinitions.containerSecurityPolicy.allowreadOnlyRootFilesystem }}" + - expression: "['Deployment', 'ReplicaSet', 'DaemonSet', 'StatefulSet', 'Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.allowPrivilegeEscalation) || c.securityContext.allowPrivilegeEscalation == {{ .Values.policyDefinitions.containerSecurityPolicy.allowPrivilegeEscalation }})" + message: "All workload containers must set allowPrivilegeEscalation to {{ .Values.policyDefinitions.containerSecurityPolicy.allowPrivilegeEscalation }}" + - expression: "['Deployment', 'ReplicaSet', 'DaemonSet', 'StatefulSet', 'Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged == {{ .Values.policyDefinitions.containerSecurityPolicy.allowprivileged }})" + message: "All workload containers must set privileged to {{ .Values.policyDefinitions.containerSecurityPolicy.allowprivileged }}" + - expression: "object.kind != 'CronJob' || has(object.metadata.labels) && object.metadata.labels['business-unit'] == 'finance'" + message: "CronJobs must have a 'business-unit: finance' label" + - expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.runAsNonRoot) && c.securityContext.runAsNonRoot == {{ .Values.policyDefinitions.containerSecurityPolicy.allowrunAsNonRoot }})" + message: "All CronJob containers must set runAsNonRoot to {{ .Values.policyDefinitions.containerSecurityPolicy.allowrunAsNonRoot }}" + - expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.readOnlyRootFilesystem) && c.securityContext.readOnlyRootFilesystem == {{ .Values.policyDefinitions.containerSecurityPolicy.allowreadOnlyRootFilesystem }})" + message: "All CronJob containers must set readOnlyRootFilesystem to {{ .Values.policyDefinitions.containerSecurityPolicy.allowreadOnlyRootFilesystem }}" + - expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.allowPrivilegeEscalation) || c.securityContext.allowPrivilegeEscalation == {{ .Values.policyDefinitions.containerSecurityPolicy.allowPrivilegeEscalation }})" + message: "All CronJob containers must set allowPrivilegeEscalation to {{ .Values.policyDefinitions.containerSecurityPolicy.allowPrivilegeEscalation }}" + - expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged == {{ .Values.policyDefinitions.containerSecurityPolicy.allowprivileged }})" + message: "All CronJob containers must set privileged to {{ .Values.policyDefinitions.containerSecurityPolicy.allowprivileged }}" +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicyBinding +metadata: + name: {{ include "k8s-shield.fullname" . }}-container-security +spec: + policyName: {{ include "k8s-shield.fullname" . }}-container-security + validationActions: + {{- range .Values.policyDefinitions.containerSecurityPolicy.validationActions }} + - {{ . }} + {{- end }} +{{- end }} + diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/extraValidating-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/extraValidating-policy.yaml new file mode 100644 index 000000000..c68785aec --- /dev/null +++ b/charts/devtron-utilities/charts/k8s-shield/templates/extraValidating-policy.yaml @@ -0,0 +1,4 @@ +{{- range .Values.extraValidatingPolicy }} +--- +{{ toYaml . }} +{{- end -}} \ No newline at end of file diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/pod-security-context-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/pod-security-context-policy.yaml new file mode 100644 index 000000000..9fe5c71fb --- /dev/null +++ b/charts/devtron-utilities/charts/k8s-shield/templates/pod-security-context-policy.yaml @@ -0,0 +1,61 @@ +{{- if and $.Values.defaultPolicies.create $.Values.defaultPolicies.policies.podSecurityPolicy }} +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicy +metadata: + name: "{{ include "k8s-shield.fullname" . }}-pod-security" +spec: + failurePolicy: Fail + matchConstraints: + resourceRules: + - apiGroups: + {{- range $.Values.policyDefinitions.podSecurityPolicy.apiGroups }} + - {{ . | quote }} + {{- end }} + apiVersions: + - v1 + operations: + {{- range $.Values.policyDefinitions.podSecurityPolicy.operations }} + - {{ . | quote }} + {{- end }} + resources: + {{- range $.Values.policyDefinitions.podSecurityPolicy.resources }} + - {{ . | quote }} + {{- end }} + scope: '*' + validations: + - expression: "object.kind != 'Pod' || object.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.runAsNonRoot) && c.securityContext.runAsNonRoot == {{ .Values.policyDefinitions.podSecurityPolicy.allowrunAsNonRoot }})" + message: "All containers must set runAsNonRoot to {{ .Values.policyDefinitions.podSecurityPolicy.allowrunAsNonRoot }}" + - expression: "object.kind != 'Pod' || object.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.readOnlyRootFilesystem) && c.securityContext.readOnlyRootFilesystem == {{ .Values.policyDefinitions.podSecurityPolicy.allowreadOnlyRootFilesystem }})" + message: "All containers must set readOnlyRootFilesystem to {{ .Values.policyDefinitions.podSecurityPolicy.allowreadOnlyRootFilesystem }}" + - expression: "object.kind != 'Pod' || object.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.allowPrivilegeEscalation) || c.securityContext.allowPrivilegeEscalation == {{ .Values.policyDefinitions.podSecurityPolicy.allowPrivilegeEscalation }})" + message: "All containers must set allowPrivilegeEscalation to {{ .Values.policyDefinitions.podSecurityPolicy.allowPrivilegeEscalation }}" + - expression: "object.kind != 'Pod' || object.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged == {{ .Values.policyDefinitions.podSecurityPolicy.allowprivileged }})" + message: "All containers must set privileged to {{ .Values.policyDefinitions.podSecurityPolicy.allowprivileged }}" + - expression: "['Deployment', 'ReplicaSet', 'DaemonSet', 'StatefulSet', 'Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.runAsNonRoot) && c.securityContext.runAsNonRoot == {{ .Values.policyDefinitions.podSecurityPolicy.allowrunAsNonRoot }})" + message: "All workload containers must set runAsNonRoot to {{ .Values.policyDefinitions.podSecurityPolicy.allowrunAsNonRoot }}" + - expression: "['Deployment', 'ReplicaSet', 'DaemonSet', 'StatefulSet', 'Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.readOnlyRootFilesystem) && c.securityContext.readOnlyRootFilesystem == {{ .Values.policyDefinitions.podSecurityPolicy.allowreadOnlyRootFilesystem }})" + message: "All workload containers must set readOnlyRootFilesystem to {{ .Values.policyDefinitions.podSecurityPolicy.allowreadOnlyRootFilesystem }}" + - expression: "['Deployment', 'ReplicaSet', 'DaemonSet', 'StatefulSet', 'Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.allowPrivilegeEscalation) || c.securityContext.allowPrivilegeEscalation == {{ .Values.policyDefinitions.podSecurityPolicy.allowPrivilegeEscalation }})" + message: "All workload containers must set allowPrivilegeEscalation to {{ .Values.policyDefinitions.podSecurityPolicy.allowPrivilegeEscalation }}" + - expression: "['Deployment', 'ReplicaSet', 'DaemonSet', 'StatefulSet', 'Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged == {{ .Values.policyDefinitions.podSecurityPolicy.allowprivileged }})" + message: "All workload containers must set privileged to {{ .Values.policyDefinitions.podSecurityPolicy.allowprivileged }}" + - expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.runAsNonRoot) && c.securityContext.runAsNonRoot == {{ .Values.policyDefinitions.podSecurityPolicy.allowrunAsNonRoot }})" + message: "All CronJob containers must set runAsNonRoot to {{ .Values.policyDefinitions.podSecurityPolicy.allowrunAsNonRoot }}" + - expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.readOnlyRootFilesystem) && c.securityContext.readOnlyRootFilesystem == {{ .Values.policyDefinitions.podSecurityPolicy.allowreadOnlyRootFilesystem }})" + message: "All CronJob containers must set readOnlyRootFilesystem to {{ .Values.policyDefinitions.podSecurityPolicy.allowreadOnlyRootFilesystem }}" + - expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.allowPrivilegeEscalation) || c.securityContext.allowPrivilegeEscalation == {{ .Values.policyDefinitions.podSecurityPolicy.allowPrivilegeEscalation }})" + message: "All CronJob containers must set allowPrivilegeEscalation to {{ .Values.policyDefinitions.podSecurityPolicy.allowPrivilegeEscalation }}" + - expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged == {{ .Values.policyDefinitions.podSecurityPolicy.allowprivileged }})" + message: "All CronJob containers must set privileged to {{ .Values.policyDefinitions.podSecurityPolicy.allowprivileged }}" +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicyBinding +metadata: + name: {{ include "k8s-shield.fullname" . }}-pod-security +spec: + policyName: {{ include "k8s-shield.fullname" . }}-pod-security + validationActions: + {{- range .Values.policyDefinitions.podSecurityPolicy.validationActions }} + - {{ . }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-admin-cluster-role-creation-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-admin-cluster-role-creation-policy.yaml new file mode 100644 index 000000000..1bd680549 --- /dev/null +++ b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-admin-cluster-role-creation-policy.yaml @@ -0,0 +1,58 @@ +{{- if and $.Values.defaultPolicies.create $.Values.defaultPolicies.policies.adminClusterRoleCreation }} +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicy +metadata: + name: {{ include "k8s-shield.fullname" . }}-restrict-admin-cluster-role-creation +spec: + failurePolicy: Fail + matchConstraints: + matchPolicy: Equivalent + namespaceSelector: {} + objectSelector: {} + resourceRules: + - apiGroups: + - rbac.authorization.k8s.io + apiVersions: + - "*" + operations: + - CREATE + - UPDATE + resources: + - clusterroles + scope: '*' + validations: + {{- if and .Values.excludeLabel.key .Values.excludeLabel.value }} + - expression: "(has(object.metadata.labels) && object.metadata.labels.exists(l, l == '{{ .Values.excludeLabel.key }}') && object.metadata.labels['{{ .Values.excludeLabel.key }}'] == '{{ .Values.excludeLabel.value }}') || !has(object.rules) || object.rules.all(rule, + !(rule.apiGroups.exists(g, g == '*') && + rule.resources.exists(r, r == '*') && + rule.verbs.exists(v, v == '*')) && + !(rule.nonResourceURLs.exists(u, u == '*') && + rule.verbs.exists(v, v == '*')) + )" + message: "Creation of ClusterRole with admin access is denied, set label {{ .Values.excludeLabel.key }}: {{ .Values.excludeLabel.value }} to allow." + {{- else }} + - expression: "!has(object.rules) || object.rules.all(rule, + !(rule.apiGroups.exists(g, g == '*') && + rule.resources.exists(r, r == '*') && + rule.verbs.exists(v, v == '*')) && + !(rule.nonResourceURLs.exists(u, u == '*') && + rule.verbs.exists(v, v == '*'))" + message: "Creation of ClusterRole with admin access is denied" + {{- end }} + +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicyBinding +metadata: + name: {{ include "k8s-shield.fullname" . }}-restrict-admin-cluster-role-creation +spec: + matchResources: + matchPolicy: Equivalent + namespaceSelector: {} + objectSelector: {} + policyName: {{ include "k8s-shield.fullname" . }}-deny-admin-cluster-role-creation + validationActions: + {{- range .Values.policyDefinitions.adminClusterRoleCreation.validationActions }} + - {{ . }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-application-deletion-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-application-deletion-policy.yaml new file mode 100644 index 000000000..b67bd4da9 --- /dev/null +++ b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-application-deletion-policy.yaml @@ -0,0 +1,51 @@ +{{- if and $.Values.defaultPolicies.create $.Values.defaultPolicies.policies.appDeletionPolicy }} +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicy +metadata: + name: {{ include "k8s-shield.fullname" . }}-prevent-app-deletion +spec: + failurePolicy: Fail + {{- if and .Values.policyDefinitions.appDeletionPolicy.namespaces }} + matchConstraints: + matchPolicy: Equivalent + namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + {{- range .Values.policyDefinitions.appDeletionPolicy.namespaces }} + - {{ . | quote }} + {{- end }} + {{- else }} + matchConstraints: {} + {{- end }} + objectSelector: {} + resourceRules: + - apiGroups: + - argoproj.io + apiVersions: + - v1alpha1 + operations: + - DELETE + resources: + - applications + scope: Namespaced + validations: + - expression: "false" + message: Deletion of application is not allowed. +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicyBinding +metadata: + name: {{ include "k8s-shield.fullname" . }}-prevent-app-deletion +spec: + matchResources: + matchPolicy: Equivalent + namespaceSelector: {} + objectSelector: {} + policyName: {{ include "k8s-shield.fullname" . }}-prevent-app-deletion + validationActions: + {{- range .Values.policyDefinitions.appDeletionPolicy.validationActions }} + - {{ . }} + {{- end }} +{{- end }} \ No newline at end of file diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-cluster-rolebinding-with-cluster-admin-creation-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-cluster-rolebinding-with-cluster-admin-creation-policy.yaml new file mode 100644 index 000000000..fd56fdb69 --- /dev/null +++ b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-cluster-rolebinding-with-cluster-admin-creation-policy.yaml @@ -0,0 +1,42 @@ +{{- if and $.Values.defaultPolicies.create $.Values.defaultPolicies.policies.cLusterRoleBindingCreation }} +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicy +metadata: + name: {{ include "k8s-shield.fullname" . }}-restrict-cluster-role-binding-creation +spec: + failurePolicy: Fail + matchConstraints: + matchPolicy: Equivalent + namespaceSelector: {} + objectSelector: {} + resourceRules: + - apiGroups: + - rbac.authorization.k8s.io + apiVersions: + - "*" + operations: + - CREATE + - UPDATE + resources: + - clusterrolebindings + scope: '*' + validations: + {{- if and .Values.excludeLabel.key .Values.excludeLabel.value }} + - expression: "(has(object.metadata.labels) && object.metadata.labels.exists(l, l == '{{ .Values.excludeLabel.key }}') && object.metadata.labels['{{ .Values.excludeLabel.key }}'] == '{{ .Values.excludeLabel.value }}') || !(object.roleRef.apiGroup == 'rbac.authorization.k8s.io' && object.roleRef.kind == 'ClusterRole' && object.roleRef.name == 'cluster-admin')" + message: "Binding to the cluster-admin ClusterRole is excludeed by security policy, set label {{ .Values.excludeLabel.key }}: {{ .Values.excludeLabel.value }} allow" + {{- else }} + - expression: "!(object.roleRef.apiGroup == 'rbac.authorization.k8s.io' && object.roleRef.kind == 'ClusterRole' && object.roleRef.name == 'cluster-admin')" + message: "Binding to the cluster-admin ClusterRole is not allowed" + {{- end }} +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicyBinding +metadata: + name: {{ include "k8s-shield.fullname" . }}-restrict-cluster-role-binding-creation +spec: + policyName: {{ include "k8s-shield.fullname" . }}-restrict-cluster-role-binding-creation + validationActions: + {{- range .Values.policyDefinitions.cLusterRoleBindingCreation.validationActions }} + - {{ . }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-limit-resource-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-limit-resource-policy.yaml new file mode 100644 index 000000000..1346d32a8 --- /dev/null +++ b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-limit-resource-policy.yaml @@ -0,0 +1,97 @@ +{{- if and $.Values.defaultPolicies.create $.Values.defaultPolicies.policies.limitResourcePolicy }} +{{- $maxCPU := .Values.policyDefinitions.resourcePolicies.limitResourcePolicy.maxCPULimit | default "1000m" }} +{{- $maxMemory := .Values.policyDefinitions.resourcePolicies.limitResourcePolicy.maxMemoryLimit | default "2Gi" }} +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicy +metadata: + name: {{ include "k8s-shield.fullname" . }}-restrict-resource-limits +spec: + failurePolicy: Fail + {{- if and .Values.policyDefinitions.resourcePolicies.limitResourcePolicy.namespaces }} + matchConstraints: + matchPolicy: Equivalent + namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + {{- range .Values.policyDefinitions.resourcePolicies.limitResourcePolicy.namespaces }} + - {{ . | quote }} + {{- end }} + {{- else }} + matchConstraints: {} + {{- end }} + objectSelector: {} + resourceRules: + - apiGroups: + {{- range $.Values.policyDefinitions.resourcePolicies.limitResourcePolicy.apiGroups }} + - {{ . | quote }} + {{- end }} + apiVersions: + - v1 + operations: + {{- range .Values.policyDefinitions.resourcePolicies.limitResourcePolicy.operations }} + - {{ . | quote }} + {{- end }} + resources: + {{- range .Values.policyDefinitions.resourcePolicies.limitResourcePolicy.resources }} + - {{ . | quote }} + {{- end }} + scope: Namespaced + validations: + {{- if and .Values.excludeLabel.key .Values.excludeLabel.value }} + - expression: |- + (has(object.metadata.labels) && object.metadata.labels['{{ .Values.excludeLabel.key }}'] == '{{ .Values.excludeLabel.value }}') + || ( + has(object.spec.template) ? + ( + !has(object.spec.template.spec.containers[0].resources.limits) || ( + (!has(object.spec.template.spec.containers[0].resources.limits.cpu) || + quantity(object.spec.template.spec.containers[0].resources.limits.cpu).compareTo(quantity('{{ $maxCPU }}')) <= 0) && + (!has(object.spec.template.spec.containers[0].resources.limits.memory) || + quantity(object.spec.template.spec.containers[0].resources.limits.memory).compareTo(quantity('{{ $maxMemory }}')) <= 0) + ) + ) : + ( + !has(object.spec.containers[0].resources.limits) || ( + (!has(object.spec.containers[0].resources.limits.cpu) || + quantity(object.spec.containers[0].resources.limits.cpu).compareTo(quantity('{{ $maxCPU }}')) <= 0) && + (!has(object.spec.containers[0].resources.limits.memory) || + quantity(object.spec.containers[0].resources.limits.memory).compareTo(quantity('{{ $maxMemory }}')) <= 0) + ) + ) + ) + message: "Resource limits exceed the maximum allowed: CPU <= {{ $maxCPU }} and memory <= {{ $maxMemory }}, set label {{ .Values.excludeLabel.key }}: {{ .Values.excludeLabel.value }} to allow" + {{- else }} + - expression: |- + has(object.spec.template) ? + ( + !has(object.spec.template.spec.containers[0].resources.limits) || ( + (!has(object.spec.template.spec.containers[0].resources.limits.cpu) || + quantity(object.spec.template.spec.containers[0].resources.limits.cpu).compareTo(quantity('{{ $maxCPU }}')) <= 0) && + (!has(object.spec.template.spec.containers[0].resources.limits.memory) || + quantity(object.spec.template.spec.containers[0].resources.limits.memory).compareTo(quantity('{{ $maxMemory }}')) <= 0) + ) + ) : + ( + !has(object.spec.containers[0].resources.limits) || ( + (!has(object.spec.containers[0].resources.limits.cpu) || + quantity(object.spec.containers[0].resources.limits.cpu).compareTo(quantity('{{ $maxCPU }}')) <= 0) && + (!has(object.spec.containers[0].resources.limits.memory) || + quantity(object.spec.containers[0].resources.limits.memory).compareTo(quantity('{{ $maxMemory }}')) <= 0) + ) + ) + message: "Resource limits exceed the maximum allowed: CPU <= {{ $maxCPU }} and memory <= {{ $maxMemory }}." + {{- end }} +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicyBinding +metadata: + name: {{ include "k8s-shield.fullname" . }}-restrict-resource-limits +spec: + policyName: {{ include "k8s-shield.fullname" . }}-restrict-resource-limits + validationActions: + {{- range .Values.policyDefinitions.resourcePolicies.limitResourcePolicy.validationActions }} + - {{ . }} + {{- end }} +{{- end }} \ No newline at end of file diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-loadbalance-creation-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-loadbalance-creation-policy.yaml new file mode 100644 index 000000000..6c415cfbb --- /dev/null +++ b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-loadbalance-creation-policy.yaml @@ -0,0 +1,56 @@ +{{- if and $.Values.defaultPolicies.create $.Values.defaultPolicies.policies.loadBalancerCreationPolicy }} +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicy +metadata: + name: {{ include "k8s-shield.fullname" . }}-restrict-loadbalancer-creation +spec: + failurePolicy: Fail + {{- if and .Values.policyDefinitions.loadBalancerCreationPolicy.namespaces }} + matchConstraints: + matchPolicy: Equivalent + namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + {{- range .Values.policyDefinitions.loadBalancerCreationPolicy.namespaces }} + - {{ . | quote }} + {{- end }} + {{- else }} + matchConstraints: {} + {{- end }} + objectSelector: {} + resourceRules: + - apiGroups: + - "" + apiVersions: + - v1 + operations: + - CREATE + resources: + - services + scope: Namespaced + validations: + {{- if and .Values.excludeLabel.key .Values.excludeLabel.value }} + - expression: "object.spec.type == 'LoadBalancer' && has(object.metadata.labels) && object.metadata.labels['{{ .Values.excludeLabel.key }}'] == '{{ .Values.excludeLabel.value }}'" + message: "Creation of Services with type LoadBalancer is not allowed, set label {{ .Values.excludeLabel.key }}: {{ .Values.excludeLabel.value }} to allow." + {{- else }} + - expression: "object.spec.type == 'LoadBalancer'" + message: "Creation of Services with type LoadBalancer is not allowed." + {{- end }} +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicyBinding +metadata: + name: {{ include "k8s-shield.fullname" . }}-restrict-loadbalancer-creation +spec: + matchResources: + matchPolicy: Equivalent + namespaceSelector: {} + objectSelector: {} + policyName: {{ include "k8s-shield.fullname" . }}-restrict-loadbalancer-creation + validationActions: + {{- range .Values.policyDefinitions.loadBalancerCreationPolicy.validationActions }} + - {{ . }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-namespace-deletion-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-namespace-deletion-policy.yaml new file mode 100644 index 000000000..f2175c8a2 --- /dev/null +++ b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-namespace-deletion-policy.yaml @@ -0,0 +1,44 @@ +{{- if and $.Values.defaultPolicies.create $.Values.defaultPolicies.policies.namespaceDeletionPolicy }} +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicy +metadata: + name: {{ include "k8s-shield.fullname" . }}-restrict-namespace-deletion +spec: + failurePolicy: Fail + matchConstraints: + matchPolicy: Equivalent + namespaceSelector: {} + objectSelector: {} + resourceRules: + - apiGroups: + - "" + apiVersions: + - v1 + operations: + - DELETE + resourceNames: + {{- range $.Values.policyDefinitions.namespaceDeletionPolicy.namespaces }} + - {{ . }} + {{- end }} + resources: + - namespaces + scope: "*" + validations: + - expression: "false" + message: Deletion of namespace is not allowed. +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicyBinding +metadata: + name: {{ include "k8s-shield.fullname" . }}-restrict-namespace-deletion +spec: + matchResources: + matchPolicy: Equivalent + namespaceSelector: {} + objectSelector: {} + policyName: {{ include "k8s-shield.fullname" . }}-restrict-namespace-deletion + validationActions: + {{- range .Values.policyDefinitions.namespaceDeletionPolicy.validationActions }} + - {{ . }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-pvc-creation-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-pvc-creation-policy.yaml new file mode 100644 index 000000000..ab2b6b6b9 --- /dev/null +++ b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-pvc-creation-policy.yaml @@ -0,0 +1,52 @@ +{{- if and $.Values.defaultPolicies.create $.Values.defaultPolicies.policies.pvcCreationPolicy }} +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicy +metadata: + name: {{ include "k8s-shield.fullname" . }}-restrict-pvc-creation +spec: + failurePolicy: Fail + {{- if and .Values.policyDefinitions.pvcCreationPolicy.namespaces }} + matchConstraints: + matchPolicy: Equivalent + namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + {{- range .Values.policyDefinitions.pvcCreationPolicy.namespaces }} + - {{ . | quote }} + {{- end }} + {{- else }} + matchConstraints: {} + {{- end }} + objectSelector: {} + resourceRules: + - apiGroups: [""] + apiVersions: ["v1"] + operations: ["CREATE", "UPDATE"] + scope: Namespaced + resources: ["persistentvolumeclaims"] + validations: + {{- if and .Values.excludeLabel.key .Values.excludeLabel.value }} + - expression: "has(object.metadata.labels) && object.metadata.labels['{{ .Values.excludeLabel.key }}'] == '{{ .Values.excludeLabel.value }}'" + message: "Creation of PersistentVolumeClaims is not allowed, set label {{ .Values.excludeLabel.key }}: {{ .Values.excludeLabel.value }} to allow" + {{- else }} + - expression: "false" + message: "Creation of PersistentVolumeClaims is not allowed." + {{- end }} +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicyBinding +metadata: + name: {{ include "k8s-shield.fullname" . }}-restrict-pvc-creation +spec: + matchResources: + matchPolicy: Equivalent + namespaceSelector: {} + objectSelector: {} + policyName: {{ include "k8s-shield.fullname" . }}-restrict-pvc-creation + validationActions: + {{- range .Values.policyDefinitions.pvcCreationPolicy.validationActions }} + - {{ . }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-without-readiness-liveness-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-without-readiness-liveness-policy.yaml new file mode 100644 index 000000000..b95a770c3 --- /dev/null +++ b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-without-readiness-liveness-policy.yaml @@ -0,0 +1,64 @@ +{{- if and $.Values.defaultPolicies.create $.Values.defaultPolicies.policies.readinessAndLivenessPolicy }} +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicy +metadata: + name: {{ .Chart.Name }}-restrict-without-readiness-liveness +spec: + failurePolicy: Fail + {{- if and .Values.policyDefinitions.readinessAndLivenessPolicy.namespaces }} + matchConstraints: + matchPolicy: Equivalent + namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + {{- range $.Values.policyDefinitions.readinessAndLivenessPolicy.namespaces }} + - {{ . | quote }} + {{- end }} + {{- else }} + matchConstraints: {} + {{- end }} + objectSelector: {} + resourceRules: + - apiGroups: + {{- range $.Values.policyDefinitions.readinessAndLivenessPolicy.apiGroups }} + - {{ . | quote }} + {{- end }} + apiVersions: ["v1"] + operations: + {{- range $.Values.policyDefinitions.readinessAndLivenessPolicy.operations }} + - {{ . | quote }} + {{- end }} + resources: + {{- range $.Values.policyDefinitions.readinessAndLivenessPolicy.resources }} + - {{ . | quote }} + {{- end }} + scope: Namespaced + validations: + {{- if and .Values.excludeLabel.key .Values.excludeLabel.value }} + - expression: > + (has(object.metadata.labels) && + object.metadata.labels['{{ .Values.excludeLabel.key }}'] == '{{ .Values.excludeLabel.value }}') || + object.spec.template.spec.containers.all(container, + has(container.readinessProbe) && + has(container.livenessProbe) + ) + message: "Deployments without readiness and liveness probes are only allowed for '{{ .Values.excludeLabel.key }}: {{ .Values.excludeLabel.value }}'." + {{- else }} + - expression: object.spec.template.spec.containers.all(container, + has(container.readinessProbe) && has(container.livenessProbe)) + message: "Deployments without readiness and liveness probes are not allowed" + {{- end }} +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicyBinding +metadata: + name: {{ .Chart.Name }}-restrict-without-readiness-liveness +spec: + policyName: {{ .Chart.Name }}-restrict-without-readiness-liveness + validationActions: + {{- range $.Values.policyDefinitions.readinessAndLivenessPolicy.validationActions }} + - {{ . }} + {{- end }} +{{- end }} \ No newline at end of file diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-without-resource-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-without-resource-policy.yaml new file mode 100644 index 000000000..e160d9396 --- /dev/null +++ b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-without-resource-policy.yaml @@ -0,0 +1,60 @@ +{{- if and $.Values.defaultPolicies.create $.Values.defaultPolicies.policies.WithoutResource }} +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicy +metadata: + name: {{ include "k8s-shield.fullname" . }}-restrict-without-resources +spec: + failurePolicy: Fail + {{- if and .Values.policyDefinitions.resourcePolicies.WithoutResource.namespaces }} + matchConstraints: + matchPolicy: Equivalent + namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + {{- range $.Values.policyDefinitions.resourcePolicies.WithoutResource.namespaces }} + - {{ . | quote }} + {{- end }} + {{- else }} + matchConstraints: {} + {{- end }} + resourceRules: + - apiGroups: + {{- range $.Values.policyDefinitions.resourcePolicies.WithoutResource.apiGroups }} + - {{ . | quote }} + {{- end }} + apiVersions: + - v1 + operations: + {{- range $.Values.policyDefinitions.resourcePolicies.WithoutResource.operations }} + - {{ . | quote }} + {{- end }} + resources: + {{- range $.Values.policyDefinitions.resourcePolicies.WithoutResource.resources }} + - {{ . | quote }} + {{- end }} + scope: Namespaced + validations: + {{- if and .Values.excludeLabel.key .Values.excludeLabel.value }} + - expression: "(has(object.metadata.labels) && object.metadata.labels['{{ .Values.excludeLabel.key }}'] == '{{ .Values.excludeLabel.value }}') || object.spec.template.spec.containers.all(c, has(c.resources) && has(c.resources.requests) && has(c.resources.limits) && has(c.resources.requests.cpu) && has(c.resources.requests.memory) && has(c.resources.limits.cpu) && has(c.resources.limits.memory))" + message: "All Containers without CPU and memory's requests and limits are only allowed for '{{ .Values.excludeLabel.key }}: {{ .Values.excludeLabel.value }}'." + {{- else }} +cd message: "All Containers without CPU and memory's requests and limits are not allowed." + {{- end }} +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingAdmissionPolicyBinding +metadata: + name: {{ include "k8s-shield.fullname" . }}-restrict-without-resources +spec: + matchResources: + matchPolicy: Equivalent + namespaceSelector: {} + objectSelector: {} + policyName: {{ include "k8s-shield.fullname" . }}-restrict-without-resources + validationActions: + {{- range $.Values.policyDefinitions.resourcePolicies.WithoutResource.validationActions }} + - {{ . }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/k8s-shield/values.yaml b/charts/devtron-utilities/charts/k8s-shield/values.yaml new file mode 100644 index 000000000..d9879ec87 --- /dev/null +++ b/charts/devtron-utilities/charts/k8s-shield/values.yaml @@ -0,0 +1,164 @@ +#excludeLabel Resources will be excluded from the scope of the policy if these labels are present. +excludeLabel: + key: "" + value: "" + +defaultPolicies: + create: true + policies: + pvcCreationPolicy: true + namespaceDeletionPolicy: true + loadBalancerCreationPolicy: true + appDeletionPolicy: true + WithoutResource: true + limitResourcePolicy: true + adminClusterRoleCreation: true + cLusterRoleBindingCreation: true + readinessAndLivenessPolicy: true + podSecurityPolicy: true + containerSecurityPolicy: true + + +policyDefinitions: + # pvcCreationPolicy controls the creation of Persistent Volume Claims (PVCs). + # If enabled, it restricts PVC creation in specified namespaces. + pvcCreationPolicy: + namespaces: [] # List of namespaces where the policy applies. + validationActions: + - Deny + + # namespaceDeletionPolicy restricts the deletion of namespaces. + # When enabled, it prevents deletion of namespaces in specified namespaces. + namespaceDeletionPolicy: + namespaces: # List of namespaces that you want to protect from deletion + - kube-system + validationActions: + - Deny + + # loadBalancerCreationPolicy restricts the creation of LoadBalancer type services. + # This policy prevents creating LoadBalancer services in the specified namespaces. + loadBalancerCreationPolicy: + namespaces: [] # List of namespaces where the policy applies. + validationActions: + - Deny + + # appDeletionPolicy prevents the deletion of applications within specified namespaces. + # If enabled, applications cannot be deleted in the listed namespaces. + appDeletionPolicy: + namespaces: [] # List of namespaces where the policy applies. + validationActions: + - Deny + + # resourcePolicies enforce the specification of resource requests and limits for deployments, statefulsets, etc. + resourcePolicies: + WithoutResource: + namespaces: [] # List of namespaces where the policy applies. + validationActions: + - Deny + operations: + - CREATE + - UPDATE + resources: + - pods + - deployments + - statefulsets + - rollouts + apiGroups: + - apps + - rollout.k8s.io + + limitResourcePolicy: + apiGroups: # API groups where the policy applies. + - "" + - apps + - argoproj.io + namespaces: [] # List of namespaces where the policy applies. + operations: + - CREATE + - UPDATE + resources: + - pods + - deployments + - statefulsets + - rollouts + maxCPULimit: "1000m" # Maximum CPU limit if not specified. Default is 1000m. + maxMemoryLimit: "2Gi" # Maximum memory limit if not specified. Default is 2Gi. + validationActions: + - Deny + + # adminClusterRoleCreation prevents the creation of new roles and cluster roles with admin access in the cluster. + adminClusterRoleCreation: + validationActions: + - Deny + + # cLusterRoleBindingCreation prevents the creation of clusterRoleBindings with cluster-admin access. + cLusterRoleBindingCreation: + validationActions: # Defines the actions when the policy is violated. Default is DENY. + - Deny + + # readinessAndLivenessPolicy ensures that readiness and liveness probes are defined for containers. + # This ensures that pods are only considered healthy when they pass the defined probes. + readinessAndLivenessPolicy: + namespaces: [] # List of namespaces where the policy applies. + operations: + - CREATE + - UPDATE + resources: + - deployments + - statefulsets + - rollouts + apiGroups: + - apps + - argoproj.io + validationActions: + - Deny + + # podSecurityPolicy ensures that security-related best practices are followed for Pods. + # For example, it restricts the use of privileged containers and ensures read-only file systems. + podSecurityPolicy: + allowrunAsNonRoot: false # Prevent containers from running as root. + allowreadOnlyRootFilesystem: false # Ensure the root filesystem is not writable. + allowPrivilegeEscalation: false # Prevent processes from gaining more privileges than their parent. + allowprivileged: false # Disables privileged mode for containers. + validationActions: # Defines the actions when the policy is violated. Default is DENY. + - Deny + operations: + - CREATE + - UPDATE + resources: + - pods + - deployments + - statefulsets + - rollouts + - cronjobs + apiGroups: + - "" + - apps + - batch + - rollout.k8s.io + + # containerSecurityPolicy defines security best practices for containers within Pods. + # It ensures that containers adhere to security policies for non-root execution, file system access, and privilege escalation. + containerSecurityPolicy: + allowrunAsNonRoot: false # Prevent containers from running as root. + allowreadOnlyRootFilesystem: false # Ensure the root filesystem is not writable. + allowPrivilegeEscalation: false # Prevent processes from gaining more privileges than their parent. + allowprivileged: false # Disable privileged mode to limit container capabilities on the host. + validationActions: # Defines the actions when the policy is violated. Default is DENY. + - Deny + operations: + - CREATE + - UPDATE + resources: + - pods + - deployments + - statefulsets + - rollouts + - cronjobs + apiGroups: + - "" + - apps + - batch + - rollout.k8s.io + +extraValidatingPolicy: [] \ No newline at end of file diff --git a/charts/devtron-utilities/charts/karpenter/.helmignore b/charts/devtron-utilities/charts/karpenter/.helmignore new file mode 100644 index 000000000..0e8a0eb36 --- /dev/null +++ b/charts/devtron-utilities/charts/karpenter/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/devtron-utilities/charts/karpenter/Chart.lock b/charts/devtron-utilities/charts/karpenter/Chart.lock new file mode 100644 index 000000000..6454ce923 --- /dev/null +++ b/charts/devtron-utilities/charts/karpenter/Chart.lock @@ -0,0 +1,3 @@ +dependencies: [] +digest: sha256:5595919ac269b4105dd65d20eb27cb271b8976c1d10903e0b504d349df30f017 +generated: "2020-12-02T11:48:25.741819-08:00" diff --git a/charts/devtron-utilities/charts/karpenter/Chart.yaml b/charts/devtron-utilities/charts/karpenter/Chart.yaml new file mode 100644 index 000000000..c6e8dcabe --- /dev/null +++ b/charts/devtron-utilities/charts/karpenter/Chart.yaml @@ -0,0 +1,35 @@ +annotations: + artifacthub.io/alternativeName: karpenter-provider-aws + artifacthub.io/crds: | + - kind: EC2NodeClass + version: v1beta1 + name: ec2nodeclasses.karpenter.k8s.aws + displayName: EC2NodeClass + description: EC2NodeClass is the Schema for the EC2NodeClass API. + - kind: NodeClaim + version: v1beta1 + name: nodeclaims.karpenter.sh + displayName: NodeClaim + description: NodeClaim is the Schema for the NodeClaims API. + - kind: NodePool + version: v1beta1 + name: nodepools.karpenter.sh + displayName: NodePool + description: NodePool is the Schema for the NodePools API. +apiVersion: v2 +appVersion: 1.2.1 +description: A Helm chart for Karpenter, an open-source node provisioning project + built for Kubernetes. +home: https://karpenter.sh/ +icon: https://repository-images.githubusercontent.com/278480393/dab059c8-caa1-4b55-aaa7-3d30e47a5616 +keywords: +- cluster +- node +- scheduler +- autoscaling +- lifecycle +name: karpenter +sources: +- https://github.com/aws/karpenter-provider-aws/ +type: application +version: 1.2.1 diff --git a/charts/devtron-utilities/charts/karpenter/README.md b/charts/devtron-utilities/charts/karpenter/README.md new file mode 100644 index 000000000..8bfb1ca95 --- /dev/null +++ b/charts/devtron-utilities/charts/karpenter/README.md @@ -0,0 +1,108 @@ +# karpenter + +A Helm chart for Karpenter, an open-source node provisioning project built for Kubernetes. + +![Version: 1.1.2](https://img.shields.io/badge/Version-1.1.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.1.2](https://img.shields.io/badge/AppVersion-1.1.2-informational?style=flat-square) + +## Documentation + +For full Karpenter documentation please checkout [https://karpenter.sh](https://karpenter.sh/docs/). + +## Installing the Chart + +You can follow the detailed installation instruction in the [documentation](https://karpenter.sh/docs/getting-started/getting-started-with-karpenter) which covers the Karpenter prerequisites and installation options. The outcome of these instructions should result in something like the following command. + +```bash +helm upgrade --install --namespace karpenter --create-namespace \ + karpenter oci://public.ecr.aws/karpenter/karpenter \ + --version 1.1.2 \ + --set "serviceAccount.annotations.eks\.amazonaws\.com/role-arn=${KARPENTER_IAM_ROLE_ARN}" \ + --set settings.clusterName=${CLUSTER_NAME} \ + --set settings.interruptionQueue=${CLUSTER_NAME} \ + --wait +``` + +### Verification + +As the OCI Helm chart is signed by [Cosign](https://github.com/sigstore/cosign) as part of the release process you can verify the chart before installing it by running the following command. + +```shell +cosign verify public.ecr.aws/karpenter/karpenter:1.1.2 \ + --certificate-oidc-issuer=https://token.actions.githubusercontent.com \ + --certificate-identity-regexp='https://github\.com/aws/karpenter-provider-aws/\.github/workflows/release\.yaml@.+' \ + --certificate-github-workflow-repository=aws/karpenter-provider-aws \ + --certificate-github-workflow-name=Release \ + --certificate-github-workflow-ref=refs/tags/v1.1.2 \ + --annotations version=1.1.2 +``` + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| additionalAnnotations | object | `{}` | Additional annotations to add into metadata. | +| additionalClusterRoleRules | list | `[]` | Specifies additional rules for the core ClusterRole. | +| additionalLabels | object | `{}` | Additional labels to add into metadata. | +| affinity | object | `{"nodeAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":{"nodeSelectorTerms":[{"matchExpressions":[{"key":"karpenter.sh/nodepool","operator":"DoesNotExist"}]}]}},"podAntiAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"topologyKey":"kubernetes.io/hostname"}]}}` | Affinity rules for scheduling the pod. If an explicit label selector is not provided for pod affinity or pod anti-affinity one will be created from the pod selector labels. | +| controller.containerName | string | `"controller"` | Distinguishing container name (containerName: karpenter-controller). | +| controller.env | list | `[]` | Additional environment variables for the controller pod. | +| controller.envFrom | list | `[]` | | +| controller.extraVolumeMounts | list | `[]` | Additional volumeMounts for the controller pod. | +| controller.healthProbe.port | int | `8081` | The container port to use for http health probe. | +| controller.image.digest | string | `"sha256:fe383abf1dbc79f164d1cbcfd8edaaf7ce97a43fbd6cb70176011ff99ce57523"` | SHA256 digest of the controller image. | +| controller.image.repository | string | `"public.ecr.aws/karpenter/controller"` | Repository path to the controller image. | +| controller.image.tag | string | `"1.1.2"` | Tag of the controller image. | +| controller.metrics.port | int | `8080` | The container port to use for metrics. | +| controller.resources | object | `{}` | Resources for the controller pod. | +| controller.sidecarContainer | list | `[]` | Additional sidecarContainer config | +| controller.sidecarVolumeMounts | list | `[]` | Additional volumeMounts for the sidecar - this will be added to the volume mounts on top of extraVolumeMounts | +| dnsConfig | object | `{}` | Configure DNS Config for the pod | +| dnsPolicy | string | `"ClusterFirst"` | Configure the DNS Policy for the pod | +| extraVolumes | list | `[]` | Additional volumes for the pod. | +| fullnameOverride | string | `""` | Overrides the chart's computed fullname. | +| hostNetwork | bool | `false` | Bind the pod to the host network. This is required when using a custom CNI. | +| imagePullPolicy | string | `"IfNotPresent"` | Image pull policy for Docker images. | +| imagePullSecrets | list | `[]` | Image pull secrets for Docker images. | +| logErrorOutputPaths | list | `["stderr"]` | Log errorOutputPaths - defaults to stderr only | +| logLevel | string | `"info"` | Global log level, defaults to 'info' | +| logOutputPaths | list | `["stdout"]` | Log outputPaths - defaults to stdout only | +| nameOverride | string | `""` | Overrides the chart's name. | +| nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node selectors to schedule the pod to nodes with labels. | +| podAnnotations | object | `{}` | Additional annotations for the pod. | +| podDisruptionBudget.maxUnavailable | int | `1` | | +| podDisruptionBudget.name | string | `"karpenter"` | | +| podLabels | object | `{}` | Additional labels for the pod. | +| podSecurityContext | object | `{"fsGroup":65532}` | SecurityContext for the pod. | +| priorityClassName | string | `"system-cluster-critical"` | PriorityClass name for the pod. | +| replicas | int | `2` | Number of replicas. | +| revisionHistoryLimit | int | `10` | The number of old ReplicaSets to retain to allow rollback. | +| schedulerName | string | `"default-scheduler"` | Specify which Kubernetes scheduler should dispatch the pod. | +| service.annotations | object | `{}` | Additional annotations for the Service. | +| serviceAccount.annotations | object | `{}` | Additional annotations for the ServiceAccount. | +| serviceAccount.create | bool | `true` | Specifies if a ServiceAccount should be created. | +| serviceAccount.name | string | `""` | The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template. | +| serviceMonitor.additionalLabels | object | `{}` | Additional labels for the ServiceMonitor. | +| serviceMonitor.enabled | bool | `false` | Specifies whether a ServiceMonitor should be created. | +| serviceMonitor.endpointConfig | object | `{}` | Configuration on `http-metrics` endpoint for the ServiceMonitor. Not to be used to add additional endpoints. See the Prometheus operator documentation for configurable fields https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#endpoint | +| settings | object | `{"batchIdleDuration":"1s","batchMaxDuration":"10s","clusterCABundle":"","clusterEndpoint":"","clusterName":"","eksControlPlane":false,"featureGates":{"nodeRepair":false,"spotToSpotConsolidation":false},"interruptionQueue":"","isolatedVPC":false,"reservedENIs":"0","vmMemoryOverheadPercent":0.075}` | Global Settings to configure Karpenter | +| settings.batchIdleDuration | string | `"1s"` | The maximum amount of time with no new ending pods that if exceeded ends the current batching window. If pods arrive faster than this time, the batching window will be extended up to the maxDuration. If they arrive slower, the pods will be batched separately. | +| settings.batchMaxDuration | string | `"10s"` | The maximum length of a batch window. The longer this is, the more pods we can consider for provisioning at one time which usually results in fewer but larger nodes. | +| settings.clusterCABundle | string | `""` | Cluster CA bundle for TLS configuration of provisioned nodes. If not set, this is taken from the controller's TLS configuration for the API server. | +| settings.clusterEndpoint | string | `""` | Cluster endpoint. If not set, will be discovered during startup (EKS only) | +| settings.clusterName | string | `""` | Cluster name. | +| settings.eksControlPlane | bool | `false` | Marking this true means that your cluster is running with an EKS control plane and Karpenter should attempt to discover cluster details from the DescribeCluster API | +| settings.featureGates | object | `{"nodeRepair":false,"spotToSpotConsolidation":false}` | Feature Gate configuration values. Feature Gates will follow the same graduation process and requirements as feature gates in Kubernetes. More information here https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/#feature-gates-for-alpha-or-beta-features | +| settings.featureGates.nodeRepair | bool | `false` | nodeRepair is ALPHA and is disabled by default. Setting this to true will enable node repair. | +| settings.featureGates.spotToSpotConsolidation | bool | `false` | spotToSpotConsolidation is ALPHA and is disabled by default. Setting this to true will enable spot replacement consolidation for both single and multi-node consolidation. | +| settings.interruptionQueue | string | `""` | Interruption queue is the name of the SQS queue used for processing interruption events from EC2 Interruption handling is disabled if not specified. Enabling interruption handling may require additional permissions on the controller service account. Additional permissions are outlined in the docs. | +| settings.isolatedVPC | bool | `false` | If true then assume we can't reach AWS services which don't have a VPC endpoint This also has the effect of disabling look-ups to the AWS pricing endpoint | +| settings.reservedENIs | string | `"0"` | Reserved ENIs are not included in the calculations for max-pods or kube-reserved This is most often used in the VPC CNI custom networking setup https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html | +| settings.vmMemoryOverheadPercent | float | `0.075` | The VM memory overhead as a percent that will be subtracted from the total memory for all instance types. The value of `0.075` equals to 7.5%. | +| strategy | object | `{"rollingUpdate":{"maxUnavailable":1}}` | Strategy for updating the pod. | +| terminationGracePeriodSeconds | string | `nil` | Override the default termination grace period for the pod. | +| tolerations | list | `[{"key":"CriticalAddonsOnly","operator":"Exists"}]` | Tolerations to allow the pod to be scheduled to nodes with taints. | +| topologySpreadConstraints | list | `[{"maxSkew":1,"topologyKey":"topology.kubernetes.io/zone","whenUnsatisfiable":"DoNotSchedule"}]` | Topology spread constraints to increase the controller resilience by distributing pods across the cluster zones. If an explicit label selector is not provided one will be created from the pod selector labels. | + +---------------------------------------------- + +Autogenerated from chart metadata using [helm-docs](https://github.com/norwoodj/helm-docs/). diff --git a/charts/devtron-utilities/charts/karpenter/README.md.gotmpl b/charts/devtron-utilities/charts/karpenter/README.md.gotmpl new file mode 100644 index 000000000..ee4c8d1e4 --- /dev/null +++ b/charts/devtron-utilities/charts/karpenter/README.md.gotmpl @@ -0,0 +1,44 @@ +{{ template "chart.header" . }} +{{ template "chart.description" . }} + +{{ template "chart.versionBadge" . }}{{ template "chart.typeBadge" . }}{{ template "chart.appVersionBadge" . }} + +## Documentation + +For full Karpenter documentation please checkout [https://karpenter.sh](https://karpenter.sh/docs/). + +## Installing the Chart + +You can follow the detailed installation instruction in the [documentation](https://karpenter.sh/docs/getting-started/getting-started-with-karpenter) which covers the Karpenter prerequisites and installation options. The outcome of these instructions should result in something like the following command. + +```bash +helm upgrade --install --namespace karpenter --create-namespace \ + karpenter oci://public.ecr.aws/karpenter/{{ template "chart.name" . }} \ + --version {{ template "chart.version" . }} \ + --set "serviceAccount.annotations.eks\.amazonaws\.com/role-arn=${KARPENTER_IAM_ROLE_ARN}" \ + --set settings.clusterName=${CLUSTER_NAME} \ + --set settings.interruptionQueue=${CLUSTER_NAME} \ + --wait +``` + +### Verification + +As the OCI Helm chart is signed by [Cosign](https://github.com/sigstore/cosign) as part of the release process you can verify the chart before installing it by running the following command. + +```shell +cosign verify public.ecr.aws/karpenter/karpenter:{{ template "chart.version" . }} \ + --certificate-oidc-issuer=https://token.actions.githubusercontent.com \ + --certificate-identity-regexp='https://github\.com/aws/karpenter-provider-aws/\.github/workflows/release\.yaml@.+' \ + --certificate-github-workflow-repository=aws/karpenter-provider-aws \ + --certificate-github-workflow-name=Release \ + --certificate-github-workflow-ref=refs/tags/v{{ template "chart.version" . }} \ + --annotations version={{ template "chart.version" . }} +``` + +{{ template "chart.requirementsSection" . }} + +{{ template "chart.valuesSection" . }} + +---------------------------------------------- + +Autogenerated from chart metadata using [helm-docs](https://github.com/norwoodj/helm-docs/). diff --git a/charts/devtron-utilities/charts/karpenter/artifacthub-repo.yaml b/charts/devtron-utilities/charts/karpenter/artifacthub-repo.yaml new file mode 100644 index 000000000..48d9ca7ce --- /dev/null +++ b/charts/devtron-utilities/charts/karpenter/artifacthub-repo.yaml @@ -0,0 +1,7 @@ +repositoryID: 356cb63f-9ee3-4956-9c20-003e416715c7 +owners: [] +# - name: awsadmin1 +# email: artifacthub1@aws.com +ignore: + - name: karpenter + version: (?:^\d+$)|(?:^v?0\.0\.0)|(?:^v?\d+\-) diff --git a/charts/devtron-utilities/charts/karpenter/crds/karpenter.k8s.aws_ec2nodeclasses.yaml b/charts/devtron-utilities/charts/karpenter/crds/karpenter.k8s.aws_ec2nodeclasses.yaml new file mode 100644 index 000000000..a2444bfcd --- /dev/null +++ b/charts/devtron-utilities/charts/karpenter/crds/karpenter.k8s.aws_ec2nodeclasses.yaml @@ -0,0 +1,742 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: ec2nodeclasses.karpenter.k8s.aws +spec: + group: karpenter.k8s.aws + names: + categories: + - karpenter + kind: EC2NodeClass + listKind: EC2NodeClassList + plural: ec2nodeclasses + shortNames: + - ec2nc + - ec2ncs + singular: ec2nodeclass + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .spec.role + name: Role + priority: 1 + type: string + name: v1 + schema: + openAPIV3Schema: + description: EC2NodeClass is the Schema for the EC2NodeClass API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + EC2NodeClassSpec is the top level specification for the AWS Karpenter Provider. + This will contain configuration necessary to launch instances in AWS. + properties: + amiFamily: + description: |- + AMIFamily dictates the UserData format and default BlockDeviceMappings used when generating launch templates. + This field is optional when using an alias amiSelectorTerm, and the value will be inferred from the alias' + family. When an alias is specified, this field may only be set to its corresponding family or 'Custom'. If no + alias is specified, this field is required. + NOTE: We ignore the AMIFamily for hashing here because we hash the AMIFamily dynamically by using the alias using + the AMIFamily() helper function + enum: + - AL2 + - AL2023 + - Bottlerocket + - Custom + - Windows2019 + - Windows2022 + type: string + amiSelectorTerms: + description: AMISelectorTerms is a list of or ami selector terms. The terms are ORed. + items: + description: |- + AMISelectorTerm defines selection logic for an ami used by Karpenter to launch nodes. + If multiple fields are used for selection, the requirements are ANDed. + properties: + alias: + description: |- + Alias specifies which EKS optimized AMI to select. + Each alias consists of a family and an AMI version, specified as "family@version". + Valid families include: al2, al2023, bottlerocket, windows2019, and windows2022. + The version can either be pinned to a specific AMI release, with that AMIs version format (ex: "al2023@v20240625" or "bottlerocket@v1.10.0"). + The version can also be set to "latest" for any family. Setting the version to latest will result in drift when a new AMI is released. This is **not** recommended for production environments. + Note: The Windows families do **not** support version pinning, and only latest may be used. + maxLength: 30 + type: string + x-kubernetes-validations: + - message: '''alias'' is improperly formatted, must match the format ''family@version''' + rule: self.matches('^[a-zA-Z0-9]+@.+$') + - message: 'family is not supported, must be one of the following: ''al2'', ''al2023'', ''bottlerocket'', ''windows2019'', ''windows2022''' + rule: self.split('@')[0] in ['al2','al2023','bottlerocket','windows2019','windows2022'] + - message: windows families may only specify version 'latest' + rule: 'self.split(''@'')[0] in [''windows2019'',''windows2022''] ? self.split(''@'')[1] == ''latest'' : true' + id: + description: ID is the ami id in EC2 + pattern: ami-[0-9a-z]+ + type: string + name: + description: |- + Name is the ami name in EC2. + This value is the name field, which is different from the name tag. + type: string + owner: + description: |- + Owner is the owner for the ami. + You can specify a combination of AWS account IDs, "self", "amazon", and "aws-marketplace" + type: string + tags: + additionalProperties: + type: string + description: |- + Tags is a map of key/value tags used to select amis. + Specifying '*' for a value selects all values for a given tag key. + maxProperties: 20 + type: object + x-kubernetes-validations: + - message: empty tag keys or values aren't supported + rule: self.all(k, k != '' && self[k] != '') + type: object + maxItems: 30 + minItems: 1 + type: array + x-kubernetes-validations: + - message: expected at least one, got none, ['tags', 'id', 'name', 'alias'] + rule: self.all(x, has(x.tags) || has(x.id) || has(x.name) || has(x.alias)) + - message: '''id'' is mutually exclusive, cannot be set with a combination of other fields in amiSelectorTerms' + rule: '!self.exists(x, has(x.id) && (has(x.alias) || has(x.tags) || has(x.name) || has(x.owner)))' + - message: '''alias'' is mutually exclusive, cannot be set with a combination of other fields in amiSelectorTerms' + rule: '!self.exists(x, has(x.alias) && (has(x.id) || has(x.tags) || has(x.name) || has(x.owner)))' + - message: '''alias'' is mutually exclusive, cannot be set with a combination of other amiSelectorTerms' + rule: '!(self.exists(x, has(x.alias)) && self.size() != 1)' + associatePublicIPAddress: + description: AssociatePublicIPAddress controls if public IP addresses are assigned to instances that are launched with the nodeclass. + type: boolean + blockDeviceMappings: + description: BlockDeviceMappings to be applied to provisioned nodes. + items: + properties: + deviceName: + description: The device name (for example, /dev/sdh or xvdh). + type: string + ebs: + description: EBS contains parameters used to automatically set up EBS volumes when an instance is launched. + properties: + deleteOnTermination: + description: DeleteOnTermination indicates whether the EBS volume is deleted on instance termination. + type: boolean + encrypted: + description: |- + Encrypted indicates whether the EBS volume is encrypted. Encrypted volumes can only + be attached to instances that support Amazon EBS encryption. If you are creating + a volume from a snapshot, you can't specify an encryption value. + type: boolean + iops: + description: |- + IOPS is the number of I/O operations per second (IOPS). For gp3, io1, and io2 volumes, + this represents the number of IOPS that are provisioned for the volume. For + gp2 volumes, this represents the baseline performance of the volume and the + rate at which the volume accumulates I/O credits for bursting. + + The following are the supported values for each volume type: + + * gp3: 3,000-16,000 IOPS + + * io1: 100-64,000 IOPS + + * io2: 100-64,000 IOPS + + For io1 and io2 volumes, we guarantee 64,000 IOPS only for Instances built + on the Nitro System (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html#ec2-nitro-instances). + Other instance families guarantee performance up to 32,000 IOPS. + + This parameter is supported for io1, io2, and gp3 volumes only. This parameter + is not supported for gp2, st1, sc1, or standard volumes. + format: int64 + type: integer + kmsKeyID: + description: KMSKeyID (ARN) of the symmetric Key Management Service (KMS) CMK used for encryption. + type: string + snapshotID: + description: SnapshotID is the ID of an EBS snapshot + type: string + throughput: + description: |- + Throughput to provision for a gp3 volume, with a maximum of 1,000 MiB/s. + Valid Range: Minimum value of 125. Maximum value of 1000. + format: int64 + type: integer + volumeSize: + description: |- + VolumeSize in `Gi`, `G`, `Ti`, or `T`. You must specify either a snapshot ID or + a volume size. The following are the supported volumes sizes for each volume + type: + + * gp2 and gp3: 1-16,384 + + * io1 and io2: 4-16,384 + + * st1 and sc1: 125-16,384 + + * standard: 1-1,024 + pattern: ^((?:[1-9][0-9]{0,3}|[1-4][0-9]{4}|[5][0-8][0-9]{3}|59000)Gi|(?:[1-9][0-9]{0,3}|[1-5][0-9]{4}|[6][0-3][0-9]{3}|64000)G|([1-9]||[1-5][0-7]|58)Ti|([1-9]||[1-5][0-9]|6[0-3]|64)T)$ + type: string + volumeType: + description: |- + VolumeType of the block device. + For more information, see Amazon EBS volume types (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html) + in the Amazon Elastic Compute Cloud User Guide. + enum: + - standard + - io1 + - io2 + - gp2 + - sc1 + - st1 + - gp3 + type: string + type: object + x-kubernetes-validations: + - message: snapshotID or volumeSize must be defined + rule: has(self.snapshotID) || has(self.volumeSize) + rootVolume: + description: |- + RootVolume is a flag indicating if this device is mounted as kubelet root dir. You can + configure at most one root volume in BlockDeviceMappings. + type: boolean + type: object + maxItems: 50 + type: array + x-kubernetes-validations: + - message: must have only one blockDeviceMappings with rootVolume + rule: self.filter(x, has(x.rootVolume)?x.rootVolume==true:false).size() <= 1 + context: + description: |- + Context is a Reserved field in EC2 APIs + https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFleet.html + type: string + detailedMonitoring: + description: DetailedMonitoring controls if detailed monitoring is enabled for instances that are launched + type: boolean + instanceProfile: + description: |- + InstanceProfile is the AWS entity that instances use. + This field is mutually exclusive from role. + The instance profile should already have a role assigned to it that Karpenter + has PassRole permission on for instance launch using this instanceProfile to succeed. + type: string + x-kubernetes-validations: + - message: instanceProfile cannot be empty + rule: self != '' + instanceStorePolicy: + description: InstanceStorePolicy specifies how to handle instance-store disks. + enum: + - RAID0 + type: string + kubelet: + description: |- + Kubelet defines args to be used when configuring kubelet on provisioned nodes. + They are a subset of the upstream types, recognizing not all options may be supported. + Wherever possible, the types and names should reflect the upstream kubelet types. + properties: + clusterDNS: + description: |- + clusterDNS is a list of IP addresses for the cluster DNS server. + Note that not all providers may use all addresses. + items: + type: string + type: array + cpuCFSQuota: + description: CPUCFSQuota enables CPU CFS quota enforcement for containers that specify CPU limits. + type: boolean + evictionHard: + additionalProperties: + type: string + pattern: ^((\d{1,2}(\.\d{1,2})?|100(\.0{1,2})?)%||(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?)$ + description: EvictionHard is the map of signal names to quantities that define hard eviction thresholds + type: object + x-kubernetes-validations: + - message: valid keys for evictionHard are ['memory.available','nodefs.available','nodefs.inodesFree','imagefs.available','imagefs.inodesFree','pid.available'] + rule: self.all(x, x in ['memory.available','nodefs.available','nodefs.inodesFree','imagefs.available','imagefs.inodesFree','pid.available']) + evictionMaxPodGracePeriod: + description: |- + EvictionMaxPodGracePeriod is the maximum allowed grace period (in seconds) to use when terminating pods in + response to soft eviction thresholds being met. + format: int32 + type: integer + evictionSoft: + additionalProperties: + type: string + pattern: ^((\d{1,2}(\.\d{1,2})?|100(\.0{1,2})?)%||(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?)$ + description: EvictionSoft is the map of signal names to quantities that define soft eviction thresholds + type: object + x-kubernetes-validations: + - message: valid keys for evictionSoft are ['memory.available','nodefs.available','nodefs.inodesFree','imagefs.available','imagefs.inodesFree','pid.available'] + rule: self.all(x, x in ['memory.available','nodefs.available','nodefs.inodesFree','imagefs.available','imagefs.inodesFree','pid.available']) + evictionSoftGracePeriod: + additionalProperties: + type: string + description: EvictionSoftGracePeriod is the map of signal names to quantities that define grace periods for each eviction signal + type: object + x-kubernetes-validations: + - message: valid keys for evictionSoftGracePeriod are ['memory.available','nodefs.available','nodefs.inodesFree','imagefs.available','imagefs.inodesFree','pid.available'] + rule: self.all(x, x in ['memory.available','nodefs.available','nodefs.inodesFree','imagefs.available','imagefs.inodesFree','pid.available']) + imageGCHighThresholdPercent: + description: |- + ImageGCHighThresholdPercent is the percent of disk usage after which image + garbage collection is always run. The percent is calculated by dividing this + field value by 100, so this field must be between 0 and 100, inclusive. + When specified, the value must be greater than ImageGCLowThresholdPercent. + format: int32 + maximum: 100 + minimum: 0 + type: integer + imageGCLowThresholdPercent: + description: |- + ImageGCLowThresholdPercent is the percent of disk usage before which image + garbage collection is never run. Lowest disk usage to garbage collect to. + The percent is calculated by dividing this field value by 100, + so the field value must be between 0 and 100, inclusive. + When specified, the value must be less than imageGCHighThresholdPercent + format: int32 + maximum: 100 + minimum: 0 + type: integer + kubeReserved: + additionalProperties: + type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + description: KubeReserved contains resources reserved for Kubernetes system components. + type: object + x-kubernetes-validations: + - message: valid keys for kubeReserved are ['cpu','memory','ephemeral-storage','pid'] + rule: self.all(x, x=='cpu' || x=='memory' || x=='ephemeral-storage' || x=='pid') + - message: kubeReserved value cannot be a negative resource quantity + rule: self.all(x, !self[x].startsWith('-')) + maxPods: + description: |- + MaxPods is an override for the maximum number of pods that can run on + a worker node instance. + format: int32 + minimum: 0 + type: integer + podsPerCore: + description: |- + PodsPerCore is an override for the number of pods that can run on a worker node + instance based on the number of cpu cores. This value cannot exceed MaxPods, so, if + MaxPods is a lower value, that value will be used. + format: int32 + minimum: 0 + type: integer + systemReserved: + additionalProperties: + type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + description: SystemReserved contains resources reserved for OS system daemons and kernel memory. + type: object + x-kubernetes-validations: + - message: valid keys for systemReserved are ['cpu','memory','ephemeral-storage','pid'] + rule: self.all(x, x=='cpu' || x=='memory' || x=='ephemeral-storage' || x=='pid') + - message: systemReserved value cannot be a negative resource quantity + rule: self.all(x, !self[x].startsWith('-')) + type: object + x-kubernetes-validations: + - message: imageGCHighThresholdPercent must be greater than imageGCLowThresholdPercent + rule: 'has(self.imageGCHighThresholdPercent) && has(self.imageGCLowThresholdPercent) ? self.imageGCHighThresholdPercent > self.imageGCLowThresholdPercent : true' + - message: evictionSoft OwnerKey does not have a matching evictionSoftGracePeriod + rule: has(self.evictionSoft) ? self.evictionSoft.all(e, (e in self.evictionSoftGracePeriod)):true + - message: evictionSoftGracePeriod OwnerKey does not have a matching evictionSoft + rule: has(self.evictionSoftGracePeriod) ? self.evictionSoftGracePeriod.all(e, (e in self.evictionSoft)):true + metadataOptions: + default: + httpEndpoint: enabled + httpProtocolIPv6: disabled + httpPutResponseHopLimit: 1 + httpTokens: required + description: |- + MetadataOptions for the generated launch template of provisioned nodes. + + This specifies the exposure of the Instance Metadata Service to + provisioned EC2 nodes. For more information, + see Instance Metadata and User Data + (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html) + in the Amazon Elastic Compute Cloud User Guide. + + Refer to recommended, security best practices + (https://aws.github.io/aws-eks-best-practices/security/docs/iam/#restrict-access-to-the-instance-profile-assigned-to-the-worker-node) + for limiting exposure of Instance Metadata and User Data to pods. + If omitted, defaults to httpEndpoint enabled, with httpProtocolIPv6 + disabled, with httpPutResponseLimit of 1, and with httpTokens + required. + properties: + httpEndpoint: + default: enabled + description: |- + HTTPEndpoint enables or disables the HTTP metadata endpoint on provisioned + nodes. If metadata options is non-nil, but this parameter is not specified, + the default state is "enabled". + + If you specify a value of "disabled", instance metadata will not be accessible + on the node. + enum: + - enabled + - disabled + type: string + httpProtocolIPv6: + default: disabled + description: |- + HTTPProtocolIPv6 enables or disables the IPv6 endpoint for the instance metadata + service on provisioned nodes. If metadata options is non-nil, but this parameter + is not specified, the default state is "disabled". + enum: + - enabled + - disabled + type: string + httpPutResponseHopLimit: + default: 1 + description: |- + HTTPPutResponseHopLimit is the desired HTTP PUT response hop limit for + instance metadata requests. The larger the number, the further instance + metadata requests can travel. Possible values are integers from 1 to 64. + If metadata options is non-nil, but this parameter is not specified, the + default value is 1. + format: int64 + maximum: 64 + minimum: 1 + type: integer + httpTokens: + default: required + description: |- + HTTPTokens determines the state of token usage for instance metadata + requests. If metadata options is non-nil, but this parameter is not + specified, the default state is "required". + + If the state is optional, one can choose to retrieve instance metadata with + or without a signed token header on the request. If one retrieves the IAM + role credentials without a token, the version 1.0 role credentials are + returned. If one retrieves the IAM role credentials using a valid signed + token, the version 2.0 role credentials are returned. + + If the state is "required", one must send a signed token header with any + instance metadata retrieval requests. In this state, retrieving the IAM + role credentials always returns the version 2.0 credentials; the version + 1.0 credentials are not available. + enum: + - required + - optional + type: string + type: object + role: + description: |- + Role is the AWS identity that nodes use. This field is immutable. + This field is mutually exclusive from instanceProfile. + Marking this field as immutable avoids concerns around terminating managed instance profiles from running instances. + This field may be made mutable in the future, assuming the correct garbage collection and drift handling is implemented + for the old instance profiles on an update. + type: string + x-kubernetes-validations: + - message: role cannot be empty + rule: self != '' + - message: immutable field changed + rule: self == oldSelf + securityGroupSelectorTerms: + description: SecurityGroupSelectorTerms is a list of or security group selector terms. The terms are ORed. + items: + description: |- + SecurityGroupSelectorTerm defines selection logic for a security group used by Karpenter to launch nodes. + If multiple fields are used for selection, the requirements are ANDed. + properties: + id: + description: ID is the security group id in EC2 + pattern: sg-[0-9a-z]+ + type: string + name: + description: |- + Name is the security group name in EC2. + This value is the name field, which is different from the name tag. + type: string + tags: + additionalProperties: + type: string + description: |- + Tags is a map of key/value tags used to select security groups. + Specifying '*' for a value selects all values for a given tag key. + maxProperties: 20 + type: object + x-kubernetes-validations: + - message: empty tag keys or values aren't supported + rule: self.all(k, k != '' && self[k] != '') + type: object + maxItems: 30 + type: array + x-kubernetes-validations: + - message: securityGroupSelectorTerms cannot be empty + rule: self.size() != 0 + - message: expected at least one, got none, ['tags', 'id', 'name'] + rule: self.all(x, has(x.tags) || has(x.id) || has(x.name)) + - message: '''id'' is mutually exclusive, cannot be set with a combination of other fields in securityGroupSelectorTerms' + rule: '!self.all(x, has(x.id) && (has(x.tags) || has(x.name)))' + - message: '''name'' is mutually exclusive, cannot be set with a combination of other fields in securityGroupSelectorTerms' + rule: '!self.all(x, has(x.name) && (has(x.tags) || has(x.id)))' + subnetSelectorTerms: + description: SubnetSelectorTerms is a list of or subnet selector terms. The terms are ORed. + items: + description: |- + SubnetSelectorTerm defines selection logic for a subnet used by Karpenter to launch nodes. + If multiple fields are used for selection, the requirements are ANDed. + properties: + id: + description: ID is the subnet id in EC2 + pattern: subnet-[0-9a-z]+ + type: string + tags: + additionalProperties: + type: string + description: |- + Tags is a map of key/value tags used to select subnets + Specifying '*' for a value selects all values for a given tag key. + maxProperties: 20 + type: object + x-kubernetes-validations: + - message: empty tag keys or values aren't supported + rule: self.all(k, k != '' && self[k] != '') + type: object + maxItems: 30 + type: array + x-kubernetes-validations: + - message: subnetSelectorTerms cannot be empty + rule: self.size() != 0 + - message: expected at least one, got none, ['tags', 'id'] + rule: self.all(x, has(x.tags) || has(x.id)) + - message: '''id'' is mutually exclusive, cannot be set with a combination of other fields in subnetSelectorTerms' + rule: '!self.all(x, has(x.id) && has(x.tags))' + tags: + additionalProperties: + type: string + description: Tags to be applied on ec2 resources like instances and launch templates. + type: object + x-kubernetes-validations: + - message: empty tag keys aren't supported + rule: self.all(k, k != '') + - message: tag contains a restricted tag matching eks:eks-cluster-name + rule: self.all(k, k !='eks:eks-cluster-name') + - message: tag contains a restricted tag matching kubernetes.io/cluster/ + rule: self.all(k, !k.startsWith('kubernetes.io/cluster') ) + - message: tag contains a restricted tag matching karpenter.sh/nodepool + rule: self.all(k, k != 'karpenter.sh/nodepool') + - message: tag contains a restricted tag matching karpenter.sh/nodeclaim + rule: self.all(k, k !='karpenter.sh/nodeclaim') + - message: tag contains a restricted tag matching karpenter.k8s.aws/ec2nodeclass + rule: self.all(k, k !='karpenter.k8s.aws/ec2nodeclass') + userData: + description: |- + UserData to be applied to the provisioned nodes. + It must be in the appropriate format based on the AMIFamily in use. Karpenter will merge certain fields into + this UserData to ensure nodes are being provisioned with the correct configuration. + type: string + required: + - amiSelectorTerms + - securityGroupSelectorTerms + - subnetSelectorTerms + type: object + x-kubernetes-validations: + - message: must specify exactly one of ['role', 'instanceProfile'] + rule: (has(self.role) && !has(self.instanceProfile)) || (!has(self.role) && has(self.instanceProfile)) + - message: changing from 'instanceProfile' to 'role' is not supported. You must delete and recreate this node class if you want to change this. + rule: (has(oldSelf.role) && has(self.role)) || (has(oldSelf.instanceProfile) && has(self.instanceProfile)) + - message: if set, amiFamily must be 'AL2' or 'Custom' when using an AL2 alias + rule: '!has(self.amiFamily) || (self.amiSelectorTerms.exists(x, has(x.alias) && x.alias.find(''^[^@]+'') == ''al2'') ? (self.amiFamily == ''Custom'' || self.amiFamily == ''AL2'') : true)' + - message: if set, amiFamily must be 'AL2023' or 'Custom' when using an AL2023 alias + rule: '!has(self.amiFamily) || (self.amiSelectorTerms.exists(x, has(x.alias) && x.alias.find(''^[^@]+'') == ''al2023'') ? (self.amiFamily == ''Custom'' || self.amiFamily == ''AL2023'') : true)' + - message: if set, amiFamily must be 'Bottlerocket' or 'Custom' when using a Bottlerocket alias + rule: '!has(self.amiFamily) || (self.amiSelectorTerms.exists(x, has(x.alias) && x.alias.find(''^[^@]+'') == ''bottlerocket'') ? (self.amiFamily == ''Custom'' || self.amiFamily == ''Bottlerocket'') : true)' + - message: if set, amiFamily must be 'Windows2019' or 'Custom' when using a Windows2019 alias + rule: '!has(self.amiFamily) || (self.amiSelectorTerms.exists(x, has(x.alias) && x.alias.find(''^[^@]+'') == ''windows2019'') ? (self.amiFamily == ''Custom'' || self.amiFamily == ''Windows2019'') : true)' + - message: if set, amiFamily must be 'Windows2022' or 'Custom' when using a Windows2022 alias + rule: '!has(self.amiFamily) || (self.amiSelectorTerms.exists(x, has(x.alias) && x.alias.find(''^[^@]+'') == ''windows2022'') ? (self.amiFamily == ''Custom'' || self.amiFamily == ''Windows2022'') : true)' + - message: must specify amiFamily if amiSelectorTerms does not contain an alias + rule: 'self.amiSelectorTerms.exists(x, has(x.alias)) ? true : has(self.amiFamily)' + status: + description: EC2NodeClassStatus contains the resolved state of the EC2NodeClass + properties: + amis: + description: |- + AMI contains the current AMI values that are available to the + cluster under the AMI selectors. + items: + description: AMI contains resolved AMI selector values utilized for node launch + properties: + deprecated: + description: Deprecation status of the AMI + type: boolean + id: + description: ID of the AMI + type: string + name: + description: Name of the AMI + type: string + requirements: + description: Requirements of the AMI to be utilized on an instance type + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + required: + - id + - requirements + type: object + type: array + conditions: + description: Conditions contains signals for health and readiness + items: + description: Condition aliases the upstream type and adds additional helper methods + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + instanceProfile: + description: InstanceProfile contains the resolved instance profile for the role + type: string + securityGroups: + description: |- + SecurityGroups contains the current security group values that are available to the + cluster under the SecurityGroups selectors. + items: + description: SecurityGroup contains resolved SecurityGroup selector values utilized for node launch + properties: + id: + description: ID of the security group + type: string + name: + description: Name of the security group + type: string + required: + - id + type: object + type: array + subnets: + description: |- + Subnets contains the current subnet values that are available to the + cluster under the subnet selectors. + items: + description: Subnet contains resolved Subnet selector values utilized for node launch + properties: + id: + description: ID of the subnet + type: string + zone: + description: The associated availability zone + type: string + zoneID: + description: The associated availability zone ID + type: string + required: + - id + - zone + type: object + type: array + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/charts/devtron-utilities/charts/karpenter/crds/karpenter.sh_nodeclaims.yaml b/charts/devtron-utilities/charts/karpenter/crds/karpenter.sh_nodeclaims.yaml new file mode 100644 index 000000000..e5b4aeae3 --- /dev/null +++ b/charts/devtron-utilities/charts/karpenter/crds/karpenter.sh_nodeclaims.yaml @@ -0,0 +1,395 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: nodeclaims.karpenter.sh +spec: + group: karpenter.sh + names: + categories: + - karpenter + kind: NodeClaim + listKind: NodeClaimList + plural: nodeclaims + singular: nodeclaim + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.labels.node\.kubernetes\.io/instance-type + name: Type + type: string + - jsonPath: .metadata.labels.karpenter\.sh/capacity-type + name: Capacity + type: string + - jsonPath: .metadata.labels.topology\.kubernetes\.io/zone + name: Zone + type: string + - jsonPath: .status.nodeName + name: Node + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.imageID + name: ImageID + priority: 1 + type: string + - jsonPath: .status.providerID + name: ID + priority: 1 + type: string + - jsonPath: .metadata.labels.karpenter\.sh/nodepool + name: NodePool + priority: 1 + type: string + - jsonPath: .spec.nodeClassRef.name + name: NodeClass + priority: 1 + type: string + name: v1 + schema: + openAPIV3Schema: + description: NodeClaim is the Schema for the NodeClaims API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: NodeClaimSpec describes the desired state of the NodeClaim + properties: + expireAfter: + default: 720h + description: |- + ExpireAfter is the duration the controller will wait + before terminating a node, measured from when the node is created. This + is useful to implement features like eventually consistent node upgrade, + memory leak protection, and disruption testing. + pattern: ^(([0-9]+(s|m|h))+)|(Never)$ + type: string + nodeClassRef: + description: NodeClassRef is a reference to an object that defines provider specific configuration + properties: + group: + description: API version of the referent + pattern: ^[^/]*$ + type: string + x-kubernetes-validations: + - message: group may not be empty + rule: self != '' + kind: + description: 'Kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"' + type: string + x-kubernetes-validations: + - message: kind may not be empty + rule: self != '' + name: + description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' + type: string + x-kubernetes-validations: + - message: name may not be empty + rule: self != '' + required: + - group + - kind + - name + type: object + requirements: + description: Requirements are layered with GetLabels and applied to every node. + items: + description: |- + A node selector requirement with min values is a selector that contains values, a key, an operator that relates the key and values + and minValues that represent the requirement to have at least that many values. + properties: + key: + description: The label key that the selector applies to. + type: string + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$ + x-kubernetes-validations: + - message: label domain "kubernetes.io" is restricted + rule: self in ["beta.kubernetes.io/instance-type", "failure-domain.beta.kubernetes.io/region", "beta.kubernetes.io/os", "beta.kubernetes.io/arch", "failure-domain.beta.kubernetes.io/zone", "topology.kubernetes.io/zone", "topology.kubernetes.io/region", "node.kubernetes.io/instance-type", "kubernetes.io/arch", "kubernetes.io/os", "node.kubernetes.io/windows-build"] || self.find("^([^/]+)").endsWith("node.kubernetes.io") || self.find("^([^/]+)").endsWith("node-restriction.kubernetes.io") || !self.find("^([^/]+)").endsWith("kubernetes.io") + - message: label domain "k8s.io" is restricted + rule: self.find("^([^/]+)").endsWith("kops.k8s.io") || !self.find("^([^/]+)").endsWith("k8s.io") + - message: label domain "karpenter.sh" is restricted + rule: self in ["karpenter.sh/capacity-type", "karpenter.sh/nodepool"] || !self.find("^([^/]+)").endsWith("karpenter.sh") + - message: label "kubernetes.io/hostname" is restricted + rule: self != "kubernetes.io/hostname" + - message: label domain "karpenter.k8s.aws" is restricted + rule: self in ["karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count"] || !self.find("^([^/]+)").endsWith("karpenter.k8s.aws") + minValues: + description: |- + This field is ALPHA and can be dropped or replaced at any time + MinValues is the minimum number of unique values required to define the flexibility of the specific requirement. + maximum: 50 + minimum: 1 + type: integer + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + enum: + - In + - NotIn + - Exists + - DoesNotExist + - Gt + - Lt + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + maxLength: 63 + pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$ + required: + - key + - operator + type: object + maxItems: 100 + type: array + x-kubernetes-validations: + - message: requirements with operator 'In' must have a value defined + rule: 'self.all(x, x.operator == ''In'' ? x.values.size() != 0 : true)' + - message: requirements operator 'Gt' or 'Lt' must have a single positive integer value + rule: 'self.all(x, (x.operator == ''Gt'' || x.operator == ''Lt'') ? (x.values.size() == 1 && int(x.values[0]) >= 0) : true)' + - message: requirements with 'minValues' must have at least that many values specified in the 'values' field + rule: 'self.all(x, (x.operator == ''In'' && has(x.minValues)) ? x.values.size() >= x.minValues : true)' + resources: + description: Resources models the resource requirements for the NodeClaim to launch + properties: + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: Requests describes the minimum required resources for the NodeClaim to launch + type: object + type: object + startupTaints: + description: |- + StartupTaints are taints that are applied to nodes upon startup which are expected to be removed automatically + within a short period of time, typically by a DaemonSet that tolerates the taint. These are commonly used by + daemonsets to allow initialization and enforce startup ordering. StartupTaints are ignored for provisioning + purposes in that pods are not required to tolerate a StartupTaint in order to have nodes provisioned for them. + items: + description: |- + The node this Taint is attached to has the "effect" on + any pod that does not tolerate the Taint. + properties: + effect: + description: |- + Required. The effect of the taint on pods + that do not tolerate the taint. + Valid effects are NoSchedule, PreferNoSchedule and NoExecute. + type: string + enum: + - NoSchedule + - PreferNoSchedule + - NoExecute + key: + description: Required. The taint key to be applied to a node. + type: string + minLength: 1 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$ + timeAdded: + description: |- + TimeAdded represents the time at which the taint was added. + It is only written for NoExecute taints. + format: date-time + type: string + value: + description: The taint value corresponding to the taint key. + type: string + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$ + required: + - effect + - key + type: object + type: array + taints: + description: Taints will be applied to the NodeClaim's node. + items: + description: |- + The node this Taint is attached to has the "effect" on + any pod that does not tolerate the Taint. + properties: + effect: + description: |- + Required. The effect of the taint on pods + that do not tolerate the taint. + Valid effects are NoSchedule, PreferNoSchedule and NoExecute. + type: string + enum: + - NoSchedule + - PreferNoSchedule + - NoExecute + key: + description: Required. The taint key to be applied to a node. + type: string + minLength: 1 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$ + timeAdded: + description: |- + TimeAdded represents the time at which the taint was added. + It is only written for NoExecute taints. + format: date-time + type: string + value: + description: The taint value corresponding to the taint key. + type: string + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$ + required: + - effect + - key + type: object + type: array + terminationGracePeriod: + description: |- + TerminationGracePeriod is the maximum duration the controller will wait before forcefully deleting the pods on a node, measured from when deletion is first initiated. + + Warning: this feature takes precedence over a Pod's terminationGracePeriodSeconds value, and bypasses any blocked PDBs or the karpenter.sh/do-not-disrupt annotation. + + This field is intended to be used by cluster administrators to enforce that nodes can be cycled within a given time period. + When set, drifted nodes will begin draining even if there are pods blocking eviction. Draining will respect PDBs and the do-not-disrupt annotation until the TGP is reached. + + Karpenter will preemptively delete pods so their terminationGracePeriodSeconds align with the node's terminationGracePeriod. + If a pod would be terminated without being granted its full terminationGracePeriodSeconds prior to the node timeout, + that pod will be deleted at T = node timeout - pod terminationGracePeriodSeconds. + + The feature can also be used to allow maximum time limits for long-running jobs which can delay node termination with preStop hooks. + If left undefined, the controller will wait indefinitely for pods to be drained. + pattern: ^([0-9]+(s|m|h))+$ + type: string + required: + - nodeClassRef + - requirements + type: object + x-kubernetes-validations: + - message: spec is immutable + rule: self == oldSelf + status: + description: NodeClaimStatus defines the observed state of NodeClaim + properties: + allocatable: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: Allocatable is the estimated allocatable capacity of the node + type: object + capacity: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: Capacity is the estimated full capacity of the node + type: object + conditions: + description: Conditions contains signals for health and readiness + items: + description: Condition aliases the upstream type and adds additional helper methods + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + pattern: ^([A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?|)$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + imageID: + description: ImageID is an identifier for the image that runs on the node + type: string + lastPodEventTime: + description: |- + LastPodEventTime is updated with the last time a pod was scheduled + or removed from the node. A pod going terminal or terminating + is also considered as removed. + format: date-time + type: string + nodeName: + description: NodeName is the name of the corresponding node object + type: string + providerID: + description: ProviderID of the corresponding node object + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/charts/devtron-utilities/charts/karpenter/crds/karpenter.sh_nodepools.yaml b/charts/devtron-utilities/charts/karpenter/crds/karpenter.sh_nodepools.yaml new file mode 100644 index 000000000..06e232756 --- /dev/null +++ b/charts/devtron-utilities/charts/karpenter/crds/karpenter.sh_nodepools.yaml @@ -0,0 +1,519 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: nodepools.karpenter.sh +spec: + group: karpenter.sh + names: + categories: + - karpenter + kind: NodePool + listKind: NodePoolList + plural: nodepools + singular: nodepool + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .spec.template.spec.nodeClassRef.name + name: NodeClass + type: string + - jsonPath: .status.resources.nodes + name: Nodes + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .spec.weight + name: Weight + priority: 1 + type: integer + - jsonPath: .status.resources.cpu + name: CPU + priority: 1 + type: string + - jsonPath: .status.resources.memory + name: Memory + priority: 1 + type: string + name: v1 + schema: + openAPIV3Schema: + description: NodePool is the Schema for the NodePools API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + NodePoolSpec is the top level nodepool specification. Nodepools + launch nodes in response to pods that are unschedulable. A single nodepool + is capable of managing a diverse set of nodes. Node properties are determined + from a combination of nodepool and pod scheduling constraints. + properties: + disruption: + default: + consolidateAfter: 0s + description: Disruption contains the parameters that relate to Karpenter's disruption logic + properties: + budgets: + default: + - nodes: 10% + description: |- + Budgets is a list of Budgets. + If there are multiple active budgets, Karpenter uses + the most restrictive value. If left undefined, + this will default to one budget with a value to 10%. + items: + description: |- + Budget defines when Karpenter will restrict the + number of Node Claims that can be terminating simultaneously. + properties: + duration: + description: |- + Duration determines how long a Budget is active since each Schedule hit. + Only minutes and hours are accepted, as cron does not work in seconds. + If omitted, the budget is always active. + This is required if Schedule is set. + This regex has an optional 0s at the end since the duration.String() always adds + a 0s at the end. + pattern: ^((([0-9]+(h|m))|([0-9]+h[0-9]+m))(0s)?)$ + type: string + nodes: + default: 10% + description: |- + Nodes dictates the maximum number of NodeClaims owned by this NodePool + that can be terminating at once. This is calculated by counting nodes that + have a deletion timestamp set, or are actively being deleted by Karpenter. + This field is required when specifying a budget. + This cannot be of type intstr.IntOrString since kubebuilder doesn't support pattern + checking for int nodes for IntOrString nodes. + Ref: https://github.com/kubernetes-sigs/controller-tools/blob/55efe4be40394a288216dab63156b0a64fb82929/pkg/crd/markers/validation.go#L379-L388 + pattern: ^((100|[0-9]{1,2})%|[0-9]+)$ + type: string + reasons: + description: |- + Reasons is a list of disruption methods that this budget applies to. If Reasons is not set, this budget applies to all methods. + Otherwise, this will apply to each reason defined. + allowed reasons are Underutilized, Empty, and Drifted. + items: + description: DisruptionReason defines valid reasons for disruption budgets. + enum: + - Underutilized + - Empty + - Drifted + type: string + type: array + schedule: + description: |- + Schedule specifies when a budget begins being active, following + the upstream cronjob syntax. If omitted, the budget is always active. + Timezones are not supported. + This field is required if Duration is set. + pattern: ^(@(annually|yearly|monthly|weekly|daily|midnight|hourly))|((.+)\s(.+)\s(.+)\s(.+)\s(.+))$ + type: string + required: + - nodes + type: object + maxItems: 50 + type: array + x-kubernetes-validations: + - message: '''schedule'' must be set with ''duration''' + rule: self.all(x, has(x.schedule) == has(x.duration)) + consolidateAfter: + description: |- + ConsolidateAfter is the duration the controller will wait + before attempting to terminate nodes that are underutilized. + Refer to ConsolidationPolicy for how underutilization is considered. + pattern: ^(([0-9]+(s|m|h))+)|(Never)$ + type: string + consolidationPolicy: + default: WhenEmptyOrUnderutilized + description: |- + ConsolidationPolicy describes which nodes Karpenter can disrupt through its consolidation + algorithm. This policy defaults to "WhenEmptyOrUnderutilized" if not specified + enum: + - WhenEmpty + - WhenEmptyOrUnderutilized + type: string + required: + - consolidateAfter + type: object + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: Limits define a set of bounds for provisioning capacity. + type: object + template: + description: |- + Template contains the template of possibilities for the provisioning logic to launch a NodeClaim with. + NodeClaims launched from this NodePool will often be further constrained than the template specifies. + properties: + metadata: + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + maxLength: 63 + pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$ + description: |- + Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + maxProperties: 100 + x-kubernetes-validations: + - message: label domain "kubernetes.io" is restricted + rule: self.all(x, x in ["beta.kubernetes.io/instance-type", "failure-domain.beta.kubernetes.io/region", "beta.kubernetes.io/os", "beta.kubernetes.io/arch", "failure-domain.beta.kubernetes.io/zone", "topology.kubernetes.io/zone", "topology.kubernetes.io/region", "kubernetes.io/arch", "kubernetes.io/os", "node.kubernetes.io/windows-build"] || x.find("^([^/]+)").endsWith("node.kubernetes.io") || x.find("^([^/]+)").endsWith("node-restriction.kubernetes.io") || !x.find("^([^/]+)").endsWith("kubernetes.io")) + - message: label domain "k8s.io" is restricted + rule: self.all(x, x.find("^([^/]+)").endsWith("kops.k8s.io") || !x.find("^([^/]+)").endsWith("k8s.io")) + - message: label domain "karpenter.sh" is restricted + rule: self.all(x, x in ["karpenter.sh/capacity-type", "karpenter.sh/nodepool"] || !x.find("^([^/]+)").endsWith("karpenter.sh")) + - message: label "karpenter.sh/nodepool" is restricted + rule: self.all(x, x != "karpenter.sh/nodepool") + - message: label "kubernetes.io/hostname" is restricted + rule: self.all(x, x != "kubernetes.io/hostname") + - message: label domain "karpenter.k8s.aws" is restricted + rule: self.all(x, x in ["karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count"] || !x.find("^([^/]+)").endsWith("karpenter.k8s.aws")) + type: object + spec: + description: |- + NodeClaimTemplateSpec describes the desired state of the NodeClaim in the Nodepool + NodeClaimTemplateSpec is used in the NodePool's NodeClaimTemplate, with the resource requests omitted since + users are not able to set resource requests in the NodePool. + properties: + expireAfter: + default: 720h + description: |- + ExpireAfter is the duration the controller will wait + before terminating a node, measured from when the node is created. This + is useful to implement features like eventually consistent node upgrade, + memory leak protection, and disruption testing. + pattern: ^(([0-9]+(s|m|h))+)|(Never)$ + type: string + nodeClassRef: + description: NodeClassRef is a reference to an object that defines provider specific configuration + properties: + group: + description: API version of the referent + pattern: ^[^/]*$ + type: string + x-kubernetes-validations: + - message: group may not be empty + rule: self != '' + kind: + description: 'Kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"' + type: string + x-kubernetes-validations: + - message: kind may not be empty + rule: self != '' + name: + description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' + type: string + x-kubernetes-validations: + - message: name may not be empty + rule: self != '' + required: + - group + - kind + - name + type: object + x-kubernetes-validations: + - message: nodeClassRef.group is immutable + rule: self.group == oldSelf.group + - message: nodeClassRef.kind is immutable + rule: self.kind == oldSelf.kind + requirements: + description: Requirements are layered with GetLabels and applied to every node. + items: + description: |- + A node selector requirement with min values is a selector that contains values, a key, an operator that relates the key and values + and minValues that represent the requirement to have at least that many values. + properties: + key: + description: The label key that the selector applies to. + type: string + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$ + x-kubernetes-validations: + - message: label domain "kubernetes.io" is restricted + rule: self in ["beta.kubernetes.io/instance-type", "failure-domain.beta.kubernetes.io/region", "beta.kubernetes.io/os", "beta.kubernetes.io/arch", "failure-domain.beta.kubernetes.io/zone", "topology.kubernetes.io/zone", "topology.kubernetes.io/region", "node.kubernetes.io/instance-type", "kubernetes.io/arch", "kubernetes.io/os", "node.kubernetes.io/windows-build"] || self.find("^([^/]+)").endsWith("node.kubernetes.io") || self.find("^([^/]+)").endsWith("node-restriction.kubernetes.io") || !self.find("^([^/]+)").endsWith("kubernetes.io") + - message: label domain "k8s.io" is restricted + rule: self.find("^([^/]+)").endsWith("kops.k8s.io") || !self.find("^([^/]+)").endsWith("k8s.io") + - message: label domain "karpenter.sh" is restricted + rule: self in ["karpenter.sh/capacity-type", "karpenter.sh/nodepool"] || !self.find("^([^/]+)").endsWith("karpenter.sh") + - message: label "karpenter.sh/nodepool" is restricted + rule: self != "karpenter.sh/nodepool" + - message: label "kubernetes.io/hostname" is restricted + rule: self != "kubernetes.io/hostname" + - message: label domain "karpenter.k8s.aws" is restricted + rule: self in ["karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count"] || !self.find("^([^/]+)").endsWith("karpenter.k8s.aws") + minValues: + description: |- + This field is ALPHA and can be dropped or replaced at any time + MinValues is the minimum number of unique values required to define the flexibility of the specific requirement. + maximum: 50 + minimum: 1 + type: integer + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + enum: + - In + - NotIn + - Exists + - DoesNotExist + - Gt + - Lt + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + maxLength: 63 + pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$ + required: + - key + - operator + type: object + maxItems: 100 + type: array + x-kubernetes-validations: + - message: requirements with operator 'In' must have a value defined + rule: 'self.all(x, x.operator == ''In'' ? x.values.size() != 0 : true)' + - message: requirements operator 'Gt' or 'Lt' must have a single positive integer value + rule: 'self.all(x, (x.operator == ''Gt'' || x.operator == ''Lt'') ? (x.values.size() == 1 && int(x.values[0]) >= 0) : true)' + - message: requirements with 'minValues' must have at least that many values specified in the 'values' field + rule: 'self.all(x, (x.operator == ''In'' && has(x.minValues)) ? x.values.size() >= x.minValues : true)' + startupTaints: + description: |- + StartupTaints are taints that are applied to nodes upon startup which are expected to be removed automatically + within a short period of time, typically by a DaemonSet that tolerates the taint. These are commonly used by + daemonsets to allow initialization and enforce startup ordering. StartupTaints are ignored for provisioning + purposes in that pods are not required to tolerate a StartupTaint in order to have nodes provisioned for them. + items: + description: |- + The node this Taint is attached to has the "effect" on + any pod that does not tolerate the Taint. + properties: + effect: + description: |- + Required. The effect of the taint on pods + that do not tolerate the taint. + Valid effects are NoSchedule, PreferNoSchedule and NoExecute. + type: string + enum: + - NoSchedule + - PreferNoSchedule + - NoExecute + key: + description: Required. The taint key to be applied to a node. + type: string + minLength: 1 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$ + timeAdded: + description: |- + TimeAdded represents the time at which the taint was added. + It is only written for NoExecute taints. + format: date-time + type: string + value: + description: The taint value corresponding to the taint key. + type: string + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$ + required: + - effect + - key + type: object + type: array + taints: + description: Taints will be applied to the NodeClaim's node. + items: + description: |- + The node this Taint is attached to has the "effect" on + any pod that does not tolerate the Taint. + properties: + effect: + description: |- + Required. The effect of the taint on pods + that do not tolerate the taint. + Valid effects are NoSchedule, PreferNoSchedule and NoExecute. + type: string + enum: + - NoSchedule + - PreferNoSchedule + - NoExecute + key: + description: Required. The taint key to be applied to a node. + type: string + minLength: 1 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$ + timeAdded: + description: |- + TimeAdded represents the time at which the taint was added. + It is only written for NoExecute taints. + format: date-time + type: string + value: + description: The taint value corresponding to the taint key. + type: string + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$ + required: + - effect + - key + type: object + type: array + terminationGracePeriod: + description: |- + TerminationGracePeriod is the maximum duration the controller will wait before forcefully deleting the pods on a node, measured from when deletion is first initiated. + + Warning: this feature takes precedence over a Pod's terminationGracePeriodSeconds value, and bypasses any blocked PDBs or the karpenter.sh/do-not-disrupt annotation. + + This field is intended to be used by cluster administrators to enforce that nodes can be cycled within a given time period. + When set, drifted nodes will begin draining even if there are pods blocking eviction. Draining will respect PDBs and the do-not-disrupt annotation until the TGP is reached. + + Karpenter will preemptively delete pods so their terminationGracePeriodSeconds align with the node's terminationGracePeriod. + If a pod would be terminated without being granted its full terminationGracePeriodSeconds prior to the node timeout, + that pod will be deleted at T = node timeout - pod terminationGracePeriodSeconds. + + The feature can also be used to allow maximum time limits for long-running jobs which can delay node termination with preStop hooks. + If left undefined, the controller will wait indefinitely for pods to be drained. + pattern: ^([0-9]+(s|m|h))+$ + type: string + required: + - nodeClassRef + - requirements + type: object + required: + - spec + type: object + weight: + description: |- + Weight is the priority given to the nodepool during scheduling. A higher + numerical weight indicates that this nodepool will be ordered + ahead of other nodepools with lower weights. A nodepool with no weight + will be treated as if it is a nodepool with a weight of 0. + format: int32 + maximum: 100 + minimum: 1 + type: integer + required: + - template + type: object + status: + description: NodePoolStatus defines the observed state of NodePool + properties: + conditions: + description: Conditions contains signals for health and readiness + items: + description: Condition aliases the upstream type and adds additional helper methods + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + resources: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: Resources is the list of resources that have been provisioned. + type: object + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/charts/devtron-utilities/charts/karpenter/templates/_helpers.tpl b/charts/devtron-utilities/charts/karpenter/templates/_helpers.tpl new file mode 100644 index 000000000..212f599b1 --- /dev/null +++ b/charts/devtron-utilities/charts/karpenter/templates/_helpers.tpl @@ -0,0 +1,142 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "karpenter.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "karpenter.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "karpenter.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "karpenter.labels" -}} +helm.sh/chart: {{ include "karpenter.chart" . }} +{{ include "karpenter.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- with .Values.additionalLabels }} +{{ toYaml . }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "karpenter.selectorLabels" -}} +app.kubernetes.io/name: {{ include "karpenter.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "karpenter.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "karpenter.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{/* +Karpenter image to use +*/}} +{{- define "karpenter.controller.image" -}} +{{- if .Values.controller.image.digest }} +{{- printf "%s:%s@%s" .Values.controller.image.repository (default (printf "%s" .Chart.AppVersion) .Values.controller.image.tag) .Values.controller.image.digest }} +{{- else }} +{{- printf "%s:%s" .Values.controller.image.repository (default (printf "%s" .Chart.AppVersion) .Values.controller.image.tag) }} +{{- end }} +{{- end }} + + +{{/* Get PodDisruptionBudget API Version */}} +{{- define "karpenter.pdb.apiVersion" -}} +{{- if and (.Capabilities.APIVersions.Has "policy/v1") (semverCompare ">= 1.21-0" .Capabilities.KubeVersion.Version) -}} +{{- print "policy/v1" -}} +{{- else -}} +{{- print "policy/v1beta1" -}} +{{- end -}} +{{- end -}} + +{{/* +Patch the label selector on an object +This template will add a labelSelector using matchLabels to the object referenced at _target if there is no labelSelector specified. +The matchLabels are created with the selectorLabels template. +This works because Helm treats dictionaries as mutable objects and allows passing them by reference. +*/}} +{{- define "karpenter.patchLabelSelector" -}} +{{- if not (hasKey ._target "labelSelector") }} +{{- $selectorLabels := (include "karpenter.selectorLabels" .) | fromYaml }} +{{- $_ := set ._target "labelSelector" (dict "matchLabels" $selectorLabels) }} +{{- end }} +{{- end }} + +{{/* +Patch pod affinity +This template uses the patchLabelSelector template to add a labelSelector to pod affinity objects if there is no labelSelector specified. +This works because Helm treats dictionaries as mutable objects and allows passing them by reference. +*/}} +{{- define "karpenter.patchPodAffinity" -}} +{{- if (hasKey ._podAffinity "requiredDuringSchedulingIgnoredDuringExecution") }} +{{- range $term := ._podAffinity.requiredDuringSchedulingIgnoredDuringExecution }} +{{- include "karpenter.patchLabelSelector" (merge (dict "_target" $term) $) }} +{{- end }} +{{- end }} +{{- if (hasKey ._podAffinity "preferredDuringSchedulingIgnoredDuringExecution") }} +{{- range $weightedTerm := ._podAffinity.preferredDuringSchedulingIgnoredDuringExecution }} +{{- include "karpenter.patchLabelSelector" (merge (dict "_target" $weightedTerm.podAffinityTerm) $) }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Patch affinity +This template uses patchPodAffinity template to add a labelSelector to podAffinity & podAntiAffinity if one isn't specified. +This works because Helm treats dictionaries as mutable objects and allows passing them by reference. +*/}} +{{- define "karpenter.patchAffinity" -}} +{{- if (hasKey .Values.affinity "podAffinity") }} +{{- include "karpenter.patchPodAffinity" (merge (dict "_podAffinity" .Values.affinity.podAffinity) .) }} +{{- end }} +{{- if (hasKey .Values.affinity "podAntiAffinity") }} +{{- include "karpenter.patchPodAffinity" (merge (dict "_podAffinity" .Values.affinity.podAntiAffinity) .) }} +{{- end }} +{{- end }} + +{{/* +Patch topology spread constraints +This template uses the patchLabelSelector template to add a labelSelector to topologySpreadConstraints if one isn't specified. +This works because Helm treats dictionaries as mutable objects and allows passing them by reference. +*/}} +{{- define "karpenter.patchTopologySpreadConstraints" -}} +{{- range $constraint := .Values.topologySpreadConstraints }} +{{- include "karpenter.patchLabelSelector" (merge (dict "_target" $constraint) $) }} +{{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/karpenter/templates/aggregate-clusterrole.yaml b/charts/devtron-utilities/charts/karpenter/templates/aggregate-clusterrole.yaml new file mode 100644 index 000000000..038aa1351 --- /dev/null +++ b/charts/devtron-utilities/charts/karpenter/templates/aggregate-clusterrole.yaml @@ -0,0 +1,18 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "karpenter.fullname" . }}-admin + labels: + rbac.authorization.k8s.io/aggregate-to-admin: "true" + {{- include "karpenter.labels" . | nindent 4 }} + {{- with .Values.additionalAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +rules: + - apiGroups: ["karpenter.sh"] + resources: ["nodepools", "nodepools/status", "nodeclaims", "nodeclaims/status"] + verbs: ["get", "list", "watch", "create", "delete", "patch"] + - apiGroups: ["karpenter.k8s.aws"] + resources: ["ec2nodeclasses"] + verbs: ["get", "list", "watch", "create", "delete", "patch"] diff --git a/charts/devtron-utilities/charts/karpenter/templates/clusterrole-core.yaml b/charts/devtron-utilities/charts/karpenter/templates/clusterrole-core.yaml new file mode 100644 index 000000000..bc12a8a70 --- /dev/null +++ b/charts/devtron-utilities/charts/karpenter/templates/clusterrole-core.yaml @@ -0,0 +1,71 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "karpenter.fullname" . }}-core + labels: + {{- include "karpenter.labels" . | nindent 4 }} + {{- with .Values.additionalAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "karpenter.fullname" . }}-core +subjects: + - kind: ServiceAccount + name: {{ template "karpenter.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "karpenter.fullname" . }}-core + labels: + {{- include "karpenter.labels" . | nindent 4 }} + {{- with .Values.additionalAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +rules: + # Read + - apiGroups: ["karpenter.sh"] + resources: ["nodepools", "nodepools/status", "nodeclaims", "nodeclaims/status"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["pods", "nodes", "persistentvolumes", "persistentvolumeclaims", "replicationcontrollers", "namespaces"] + verbs: ["get", "list", "watch"] + - apiGroups: ["storage.k8s.io"] + resources: ["storageclasses", "csinodes", "volumeattachments"] + verbs: ["get", "watch", "list"] + - apiGroups: ["apps"] + resources: ["daemonsets", "deployments", "replicasets", "statefulsets"] + verbs: ["list", "watch"] + - apiGroups: ["policy"] + resources: ["poddisruptionbudgets"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["events"] + verbs: ["get", list, "watch"] + # Write + - apiGroups: ["karpenter.sh"] + resources: ["nodeclaims", "nodeclaims/status"] + verbs: ["create", "delete", "update", "patch"] + - apiGroups: ["karpenter.sh"] + resources: ["nodepools", "nodepools/status"] + verbs: ["update", "patch"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "patch"] + - apiGroups: [""] + resources: ["nodes"] + verbs: ["patch", "delete", "update"] + - apiGroups: [""] + resources: ["pods/eviction"] + verbs: ["create"] + - apiGroups: [""] + resources: ["pods"] + verbs: ["delete"] + {{- with .Values.additionalClusterRoleRules -}} + {{ toYaml . | nindent 2 }} + {{- end -}} diff --git a/charts/devtron-utilities/charts/karpenter/templates/clusterrole.yaml b/charts/devtron-utilities/charts/karpenter/templates/clusterrole.yaml new file mode 100644 index 000000000..769a343d0 --- /dev/null +++ b/charts/devtron-utilities/charts/karpenter/templates/clusterrole.yaml @@ -0,0 +1,38 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "karpenter.fullname" . }} + labels: + {{- include "karpenter.labels" . | nindent 4 }} + {{- with .Values.additionalAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "karpenter.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ template "karpenter.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "karpenter.fullname" . }} + labels: + {{- include "karpenter.labels" . | nindent 4 }} + {{- with .Values.additionalAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +rules: + # Read + - apiGroups: ["karpenter.k8s.aws"] + resources: ["ec2nodeclasses"] + verbs: ["get", "list", "watch"] + # Write + - apiGroups: ["karpenter.k8s.aws"] + resources: ["ec2nodeclasses", "ec2nodeclasses/status"] + verbs: ["patch", "update"] \ No newline at end of file diff --git a/charts/devtron-utilities/charts/karpenter/templates/deployment.yaml b/charts/devtron-utilities/charts/karpenter/templates/deployment.yaml new file mode 100644 index 000000000..990ce4862 --- /dev/null +++ b/charts/devtron-utilities/charts/karpenter/templates/deployment.yaml @@ -0,0 +1,223 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "karpenter.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "karpenter.labels" . | nindent 4 }} + {{- with .Values.additionalAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + replicas: {{ .Values.replicas }} + revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} + {{- with .Values.strategy }} + strategy: + {{- toYaml . | nindent 4 }} + {{- end }} + selector: + matchLabels: + {{- include "karpenter.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + {{- include "karpenter.selectorLabels" . | nindent 8 }} + {{- with .Values.podLabels }} + {{- toYaml . | nindent 8 }} + {{- end }} + annotations: + {{- with .Values.podAnnotations }} + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "karpenter.serviceAccountName" . }} + {{- with .Values.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.priorityClassName }} + priorityClassName: {{ . | quote }} + {{- end }} + {{- with .Values.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ . }} + {{- end }} + {{- with .Values.dnsPolicy }} + dnsPolicy: {{ . }} + {{- end }} + {{- with .Values.dnsConfig }} + dnsConfig: + {{- toYaml . | nindent 8}} + {{- end }} + {{- if .Values.hostNetwork }} + hostNetwork: true + {{- end }} + {{- with .Values.schedulerName }} + schedulerName: {{ . | quote }} + {{- end }} + containers: + - name: {{ .Values.controller.containerName | default "controller" }} + securityContext: + runAsUser: 65532 + runAsGroup: 65532 + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + image: {{ include "karpenter.controller.image" . }} + imagePullPolicy: {{ .Values.imagePullPolicy }} + env: + - name: KUBERNETES_MIN_VERSION + value: "1.19.0-0" + - name: KARPENTER_SERVICE + value: {{ include "karpenter.fullname" . }} + {{- with .Values.logLevel }} + - name: LOG_LEVEL + value: "{{ . }}" + {{- end }} + {{- with .Values.logOutputPaths }} + - name: LOG_OUTPUT_PATHS + value: "{{ join "," . }}" + {{- end }} + {{- with .Values.logErrorOutputPaths }} + - name: LOG_ERROR_OUTPUT_PATHS + value: "{{ join "," . }}" + {{- end }} + - name: METRICS_PORT + value: "{{ .Values.controller.metrics.port }}" + - name: HEALTH_PROBE_PORT + value: "{{ .Values.controller.healthProbe.port }}" + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: MEMORY_LIMIT + valueFrom: + resourceFieldRef: + containerName: controller + divisor: "0" + resource: limits.memory + - name: FEATURE_GATES + value: "SpotToSpotConsolidation={{ .Values.settings.featureGates.spotToSpotConsolidation }},NodeRepair={{ .Values.settings.featureGates.nodeRepair }}" + {{- with .Values.settings.batchMaxDuration }} + - name: BATCH_MAX_DURATION + value: "{{ . }}" + {{- end }} + {{- with .Values.settings.batchIdleDuration }} + - name: BATCH_IDLE_DURATION + value: "{{ . }}" + {{- end }} + {{- with .Values.settings.clusterCABundle }} + - name: CLUSTER_CA_BUNDLE + value: "{{ . }}" + {{- end }} + {{- with .Values.settings.clusterName }} + - name: CLUSTER_NAME + value: "{{ . }}" + {{- end }} + {{- with .Values.settings.clusterEndpoint }} + - name: CLUSTER_ENDPOINT + value: "{{ . }}" + {{- end }} + {{- with .Values.settings.isolatedVPC }} + - name: ISOLATED_VPC + value: "{{ . }}" + {{- end }} + {{- with .Values.settings.eksControlPlane }} + - name: EKS_CONTROL_PLANE + value: "{{ . }}" + {{- end }} + {{- with .Values.settings.vmMemoryOverheadPercent }} + - name: VM_MEMORY_OVERHEAD_PERCENT + value: "{{ . }}" + {{- end }} + {{- with .Values.settings.interruptionQueue }} + - name: INTERRUPTION_QUEUE + value: "{{ . }}" + {{- end }} + {{- with .Values.settings.reservedENIs }} + - name: RESERVED_ENIS + value: "{{ . }}" + {{- end }} + {{- with .Values.controller.env }} + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.controller.envFrom }} + envFrom: + {{- toYaml . | nindent 12 }} + {{- end }} + ports: + - name: http-metrics + containerPort: {{ .Values.controller.metrics.port }} + protocol: TCP + - name: http + containerPort: {{ .Values.controller.healthProbe.port }} + protocol: TCP + livenessProbe: + initialDelaySeconds: 30 + timeoutSeconds: 30 + httpGet: + path: /healthz + port: http + readinessProbe: + initialDelaySeconds: 5 + timeoutSeconds: 30 + httpGet: + path: /readyz + port: http + {{- with .Values.controller.resources }} + resources: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- if .Values.controller.extraVolumeMounts }} + volumeMounts: + {{- with .Values.controller.extraVolumeMounts }} + {{- toYaml . | nindent 12 }} + {{- end }} + {{- end }} + {{- with .Values.controller.sidecarContainer }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if and (.Values.controller.sidecarContainer) (or .Values.controller.extraVolumeMounts .Values.controller.sidecarVolumeMounts) }} + volumeMounts: + {{- with .Values.controller.extraVolumeMounts }} + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.controller.sidecarVolumeMounts }} + {{- toYaml . | nindent 12 }} + {{- end }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + # The template below patches the .Values.affinity to add a default label selector where not specificed + {{- $_ := include "karpenter.patchAffinity" $ }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.topologySpreadConstraints }} + # The template below patches the .Values.topologySpreadConstraints to add a default label selector where not specificed + {{- $_ := include "karpenter.patchTopologySpreadConstraints" $ }} + topologySpreadConstraints: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.extraVolumes }} + volumes: + {{- with .Values.extraVolumes }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- end }} diff --git a/charts/devtron-utilities/charts/karpenter/templates/poddisruptionbudget.yaml b/charts/devtron-utilities/charts/karpenter/templates/poddisruptionbudget.yaml new file mode 100644 index 000000000..a5a55cadf --- /dev/null +++ b/charts/devtron-utilities/charts/karpenter/templates/poddisruptionbudget.yaml @@ -0,0 +1,16 @@ +apiVersion: {{ include "karpenter.pdb.apiVersion" . }} +kind: PodDisruptionBudget +metadata: + name: {{ .Values.podDisruptionBudget.name }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "karpenter.labels" . | nindent 4 }} + {{- with .Values.additionalAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }} + selector: + matchLabels: + {{- include "karpenter.selectorLabels" . | nindent 6 }} diff --git a/charts/devtron-utilities/charts/karpenter/templates/role.yaml b/charts/devtron-utilities/charts/karpenter/templates/role.yaml new file mode 100644 index 000000000..2be091815 --- /dev/null +++ b/charts/devtron-utilities/charts/karpenter/templates/role.yaml @@ -0,0 +1,45 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "karpenter.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "karpenter.labels" . | nindent 4 }} + {{- with .Values.additionalAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +rules: + # Read + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "watch"] + # Write + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["patch", "update"] + resourceNames: + - "karpenter-leader-election" + # Cannot specify resourceNames on create + # https://kubernetes.io/docs/reference/access-authn-authz/rbac/#referring-to-resources + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["create"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "karpenter.fullname" . }}-dns + namespace: kube-system + labels: + {{- include "karpenter.labels" . | nindent 4 }} + {{- with .Values.additionalAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +rules: + # Read + - apiGroups: [""] + resources: ["services"] + resourceNames: ["kube-dns"] + verbs: ["get"] diff --git a/charts/devtron-utilities/charts/karpenter/templates/rolebinding.yaml b/charts/devtron-utilities/charts/karpenter/templates/rolebinding.yaml new file mode 100644 index 000000000..ba54e1830 --- /dev/null +++ b/charts/devtron-utilities/charts/karpenter/templates/rolebinding.yaml @@ -0,0 +1,39 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "karpenter.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "karpenter.labels" . | nindent 4 }} + {{- with .Values.additionalAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "karpenter.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ template "karpenter.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "karpenter.fullname" . }}-dns + namespace: kube-system + labels: + {{- include "karpenter.labels" . | nindent 4 }} + {{- with .Values.additionalAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "karpenter.fullname" . }}-dns +subjects: + - kind: ServiceAccount + name: {{ template "karpenter.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} \ No newline at end of file diff --git a/charts/devtron-utilities/charts/karpenter/templates/service.yaml b/charts/devtron-utilities/charts/karpenter/templates/service.yaml new file mode 100644 index 000000000..694265c89 --- /dev/null +++ b/charts/devtron-utilities/charts/karpenter/templates/service.yaml @@ -0,0 +1,25 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "karpenter.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "karpenter.labels" . | nindent 4 }} + {{- if or .Values.additionalAnnotations .Values.service.annotations }} + annotations: + {{- with .Values.additionalAnnotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.service.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +spec: + type: ClusterIP + ports: + - name: http-metrics + port: {{ .Values.controller.metrics.port }} + targetPort: http-metrics + protocol: TCP + selector: + {{- include "karpenter.selectorLabels" . | nindent 4 }} diff --git a/charts/devtron-utilities/charts/karpenter/templates/serviceaccount.yaml b/charts/devtron-utilities/charts/karpenter/templates/serviceaccount.yaml new file mode 100644 index 000000000..0141afc29 --- /dev/null +++ b/charts/devtron-utilities/charts/karpenter/templates/serviceaccount.yaml @@ -0,0 +1,18 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "karpenter.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "karpenter.labels" . | nindent 4 }} + {{- if or .Values.additionalAnnotations .Values.serviceAccount.annotations }} + annotations: + {{- with .Values.additionalAnnotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.serviceAccount.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +{{- end -}} diff --git a/charts/devtron-utilities/charts/karpenter/templates/servicemonitor.yaml b/charts/devtron-utilities/charts/karpenter/templates/servicemonitor.yaml new file mode 100644 index 000000000..70f07608f --- /dev/null +++ b/charts/devtron-utilities/charts/karpenter/templates/servicemonitor.yaml @@ -0,0 +1,29 @@ +{{- if.Values.serviceMonitor.enabled -}} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ include "karpenter.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "karpenter.labels" . | nindent 4 }} + {{- with .Values.serviceMonitor.additionalLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.additionalAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + namespaceSelector: + matchNames: + - {{ .Release.Namespace }} + selector: + matchLabels: + {{- include "karpenter.selectorLabels" . | nindent 6 }} + endpoints: + - port: http-metrics + path: /metrics + {{- with .Values.serviceMonitor.endpointConfig }} + {{- toYaml . | nindent 6 }} + {{- end }} +{{- end -}} diff --git a/charts/devtron-utilities/charts/karpenter/values.yaml b/charts/devtron-utilities/charts/karpenter/values.yaml new file mode 100644 index 000000000..b16c3b1ee --- /dev/null +++ b/charts/devtron-utilities/charts/karpenter/values.yaml @@ -0,0 +1,192 @@ +# -- Overrides the chart's name. +nameOverride: "" +# -- Overrides the chart's computed fullname. +fullnameOverride: "" +# -- Additional labels to add into metadata. +additionalLabels: {} +# app: karpenter + +# -- Additional annotations to add into metadata. +additionalAnnotations: {} +# -- Image pull policy for Docker images. +imagePullPolicy: IfNotPresent +# -- Image pull secrets for Docker images. +imagePullSecrets: [] +service: + # -- Additional annotations for the Service. + annotations: {} +serviceAccount: + # -- Specifies if a ServiceAccount should be created. + create: true + # -- The name of the ServiceAccount to use. + # If not set and create is true, a name is generated using the fullname template. + name: "" + # -- Additional annotations for the ServiceAccount. + annotations: {} +# -- Specifies additional rules for the core ClusterRole. +additionalClusterRoleRules: [] +serviceMonitor: + # -- Specifies whether a ServiceMonitor should be created. + enabled: false + # -- Additional labels for the ServiceMonitor. + additionalLabels: {} + # -- Configuration on `http-metrics` endpoint for the ServiceMonitor. + # Not to be used to add additional endpoints. + # See the Prometheus operator documentation for configurable fields https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#endpoint + endpointConfig: {} +# -- Number of replicas. +replicas: 2 +# -- The number of old ReplicaSets to retain to allow rollback. +revisionHistoryLimit: 10 +# -- Strategy for updating the pod. +strategy: + rollingUpdate: + maxUnavailable: 1 +# -- Additional labels for the pod. +podLabels: {} +# -- Additional annotations for the pod. +podAnnotations: {} +podDisruptionBudget: + name: karpenter + maxUnavailable: 1 +# -- SecurityContext for the pod. +podSecurityContext: + fsGroup: 65532 +# -- PriorityClass name for the pod. +priorityClassName: system-cluster-critical +# -- Override the default termination grace period for the pod. +terminationGracePeriodSeconds: +# -- Bind the pod to the host network. +# This is required when using a custom CNI. +hostNetwork: false +# -- Specify which Kubernetes scheduler should dispatch the pod. +schedulerName: default-scheduler +# -- Configure the DNS Policy for the pod +dnsPolicy: ClusterFirst +# -- Configure DNS Config for the pod +dnsConfig: {} +# options: +# - name: ndots +# value: "1" +# -- Node selectors to schedule the pod to nodes with labels. +nodeSelector: + kubernetes.io/os: linux +# -- Affinity rules for scheduling the pod. If an explicit label selector is not provided for pod affinity or pod anti-affinity one will be created from the pod selector labels. +affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: karpenter.sh/nodepool + operator: DoesNotExist + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - topologyKey: "kubernetes.io/hostname" +# -- Topology spread constraints to increase the controller resilience by distributing pods across the cluster zones. If an explicit label selector is not provided one will be created from the pod selector labels. +topologySpreadConstraints: + - maxSkew: 1 + topologyKey: topology.kubernetes.io/zone + whenUnsatisfiable: DoNotSchedule +# -- Tolerations to allow the pod to be scheduled to nodes with taints. +tolerations: + - key: CriticalAddonsOnly + operator: Exists +# -- Additional volumes for the pod. +extraVolumes: [] +# - name: aws-iam-token +# projected: +# defaultMode: 420 +# sources: +# - serviceAccountToken: +# audience: sts.amazonaws.com +# expirationSeconds: 86400 +# path: token +controller: + # -- Distinguishing container name (containerName: karpenter-controller). + containerName: controller + image: + # -- Repository path to the controller image. + repository: public.ecr.aws/karpenter/controller + # -- Tag of the controller image. + tag: 1.2.1 + # -- SHA256 digest of the controller image. + digest: sha256:6d771157293958fdf58ea64613e6fb5f3854ed5bebe68fdb457259e29ee68b43 + # -- Additional environment variables for the controller pod. + env: [] + # - name: AWS_REGION + # value: eu-west-1 + envFrom: [] + # -- Resources for the controller pod. + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 1 + # memory: 1Gi + # limits: + # cpu: 1 + # memory: 1Gi + + # -- Additional volumeMounts for the controller pod. + extraVolumeMounts: [] + # - name: aws-iam-token + # mountPath: /var/run/secrets/eks.amazonaws.com/serviceaccount + # readOnly: true + # -- Additional sidecarContainer config + sidecarContainer: [] + # -- Additional volumeMounts for the sidecar - this will be added to the volume mounts on top of extraVolumeMounts + sidecarVolumeMounts: [] + metrics: + # -- The container port to use for metrics. + port: 8080 + healthProbe: + # -- The container port to use for http health probe. + port: 8081 +# -- Global log level, defaults to 'info' +logLevel: info +# -- Log outputPaths - defaults to stdout only +logOutputPaths: + - stdout +# -- Log errorOutputPaths - defaults to stderr only +logErrorOutputPaths: + - stderr +# -- Global Settings to configure Karpenter +settings: + # -- The maximum length of a batch window. The longer this is, the more pods we can consider for provisioning at one + # time which usually results in fewer but larger nodes. + batchMaxDuration: 10s + # -- The maximum amount of time with no new ending pods that if exceeded ends the current batching window. If pods arrive + # faster than this time, the batching window will be extended up to the maxDuration. If they arrive slower, the pods + # will be batched separately. + batchIdleDuration: 1s + # -- Cluster CA bundle for TLS configuration of provisioned nodes. If not set, this is taken from the controller's TLS configuration for the API server. + clusterCABundle: "" + # -- Cluster name. + clusterName: "" + # -- Cluster endpoint. If not set, will be discovered during startup (EKS only) + clusterEndpoint: "" + # -- If true then assume we can't reach AWS services which don't have a VPC endpoint + # This also has the effect of disabling look-ups to the AWS pricing endpoint + isolatedVPC: false + # Marking this true means that your cluster is running with an EKS control plane and Karpenter should attempt to discover cluster details from the DescribeCluster API + eksControlPlane: false + # -- The VM memory overhead as a percent that will be subtracted from the total memory for all instance types. The value of `0.075` equals to 7.5%. + vmMemoryOverheadPercent: 0.075 + # -- Interruption queue is the name of the SQS queue used for processing interruption events from EC2 + # Interruption handling is disabled if not specified. Enabling interruption handling may + # require additional permissions on the controller service account. Additional permissions are outlined in the docs. + interruptionQueue: "" + # -- Reserved ENIs are not included in the calculations for max-pods or kube-reserved + # This is most often used in the VPC CNI custom networking setup https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html + reservedENIs: "0" + # -- Feature Gate configuration values. Feature Gates will follow the same graduation process and requirements as feature gates + # in Kubernetes. More information here https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/#feature-gates-for-alpha-or-beta-features + featureGates: + # -- spotToSpotConsolidation is ALPHA and is disabled by default. + # Setting this to true will enable spot replacement consolidation for both single and multi-node consolidation. + spotToSpotConsolidation: false + # -- nodeRepair is ALPHA and is disabled by default. + # Setting this to true will enable node repair. + nodeRepair: false diff --git a/charts/devtron-utilities/charts/kcert/Chart.yaml b/charts/devtron-utilities/charts/kcert/Chart.yaml new file mode 100644 index 000000000..3f0b76080 --- /dev/null +++ b/charts/devtron-utilities/charts/kcert/Chart.yaml @@ -0,0 +1,14 @@ +apiVersion: v2 +appVersion: 1.2.0 +description: Deploys KCert for issuing Let's Encrypt certificates +keywords: +- kubernetes +- letsencrypt +- ssl +maintainers: +- name: Nabeel Sulieman + url: https://nabeel.dev +name: kcert +sources: +- https://github.com/nabsul/kcert +version: 1.0.7 diff --git a/charts/devtron-utilities/charts/kcert/templates/020-ServiceAccount.yaml b/charts/devtron-utilities/charts/kcert/templates/020-ServiceAccount.yaml new file mode 100644 index 000000000..86b8b9420 --- /dev/null +++ b/charts/devtron-utilities/charts/kcert/templates/020-ServiceAccount.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ required "names.serviceAccount is required" .Values.names.serviceAccount }} + namespace: {{ .Release.Namespace | default "default" }} +{{- if .Values.forHelm }} + labels: + app.kubernetes.io/name: {{ .Chart.Name }} + helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} diff --git a/charts/devtron-utilities/charts/kcert/templates/030-ClusterRole.yaml b/charts/devtron-utilities/charts/kcert/templates/030-ClusterRole.yaml new file mode 100644 index 000000000..be55dd811 --- /dev/null +++ b/charts/devtron-utilities/charts/kcert/templates/030-ClusterRole.yaml @@ -0,0 +1,22 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ required "names.clusterRole is required" .Values.names.clusterRole }} +{{- if .Values.forHelm }} + labels: + app.kubernetes.io/name: {{ .Chart.Name }} + helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} +rules: +- apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "create", "update", "patch"] +- apiGroups: ["networking.k8s.io"] + resources: ["ingresses"] + verbs: ["get", "list", "watch"] +- apiGroups: [""] + resources: ["configmaps"] + verbs: ["get", "list", "watch"] diff --git a/charts/devtron-utilities/charts/kcert/templates/040-ClusterRoleBinding.yaml b/charts/devtron-utilities/charts/kcert/templates/040-ClusterRoleBinding.yaml new file mode 100644 index 000000000..be1eb859c --- /dev/null +++ b/charts/devtron-utilities/charts/kcert/templates/040-ClusterRoleBinding.yaml @@ -0,0 +1,20 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ required "names.clusterRoleBinding is required" .Values.names.clusterRoleBinding }} +{{- if .Values.forHelm }} + labels: + app.kubernetes.io/name: {{ .Chart.Name }} + helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} +subjects: +- kind: ServiceAccount + name: {{ required "names.serviceAccount is required" .Values.names.serviceAccount }} + namespace: {{ .Release.Namespace | default "kcert" }} +roleRef: + kind: ClusterRole + name: {{ required "names.clusterRole is required" .Values.names.clusterRole }} + apiGroup: rbac.authorization.k8s.io diff --git a/charts/devtron-utilities/charts/kcert/templates/050-Role.yaml b/charts/devtron-utilities/charts/kcert/templates/050-Role.yaml new file mode 100644 index 000000000..c14c727fc --- /dev/null +++ b/charts/devtron-utilities/charts/kcert/templates/050-Role.yaml @@ -0,0 +1,17 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ required "names.role is required" .Values.names.role }} + namespace: {{ .Release.Namespace | default "default" }} +{{- if .Values.forHelm }} + labels: + app.kubernetes.io/name: {{ .Chart.Name }} + helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} +rules: +- apiGroups: ["networking.k8s.io"] + resources: ["ingresses"] + verbs: ["get", "list", "create", "delete", "update", "patch"] diff --git a/charts/devtron-utilities/charts/kcert/templates/060-RoleBinding.yaml b/charts/devtron-utilities/charts/kcert/templates/060-RoleBinding.yaml new file mode 100644 index 000000000..666da36a1 --- /dev/null +++ b/charts/devtron-utilities/charts/kcert/templates/060-RoleBinding.yaml @@ -0,0 +1,21 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ required "names.role is required" .Values.names.role }} + namespace: {{ .Release.Namespace | default "default" }} +{{- if .Values.forHelm }} + labels: + app.kubernetes.io/name: {{ .Chart.Name }} + helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} +subjects: +- kind: ServiceAccount + name: {{ required "names.serviceAccount is required" .Values.names.serviceAccount }} + namespace: {{ .Release.Namespace | default "default" }} +roleRef: + kind: Role + name: {{ required "names.role is required" .Values.names.role }} + apiGroup: rbac.authorization.k8s.io diff --git a/charts/devtron-utilities/charts/kcert/templates/065-Secret.yaml b/charts/devtron-utilities/charts/kcert/templates/065-Secret.yaml new file mode 100644 index 000000000..86114779d --- /dev/null +++ b/charts/devtron-utilities/charts/kcert/templates/065-Secret.yaml @@ -0,0 +1,18 @@ +{{- if .Values.smtp.host }} +apiVersion: v1 +kind: Secret +type: Opaque +metadata: + name: {{ required "names.secret is required" .Values.names.secret }} + namespace: {{ .Release.Namespace | default "default" }} +{{- if .Values.forHelm }} + labels: + app.kubernetes.io/name: {{ .Chart.Name }} + helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} +stringData: + password: {{ required "smtp.pass is required" .Values.smtp.pass }} +{{- end }} diff --git a/charts/devtron-utilities/charts/kcert/templates/070-Deployment.yaml b/charts/devtron-utilities/charts/kcert/templates/070-Deployment.yaml new file mode 100644 index 000000000..9d116dd4d --- /dev/null +++ b/charts/devtron-utilities/charts/kcert/templates/070-Deployment.yaml @@ -0,0 +1,83 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ required "names.deployment is required" .Values.names.deployment }} + namespace: {{ .Release.Namespace | default "default" }} + labels: + app: {{ required "names.app is required" .Values.names.app }} +{{- if .Values.forHelm }} + app.kubernetes.io/name: {{ .Chart.Name }} + helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} +spec: + replicas: 1 + selector: + matchLabels: + app: {{ required "names.app is required" .Values.names.app }} + template: + metadata: + labels: + app: {{ required "names.app is required" .Values.names.app }} + spec: + serviceAccountName: {{ required "names.serviceAccount is required" .Values.names.serviceAccount }} + containers: + - name: kcert + image: {{ required "kcertImage is required" .Values.kcertImage }} + ports: + - containerPort: 80 + name: http + - containerPort: 8080 + name: http-admin + {{- if .Values.resources }} + resources: + {{- toYaml .Values.resources | nindent 10 }} + {{- end }} + env: + - name: KCERT__NAMESPACE + value: {{ .Release.Namespace | default "default" }} + - name: ACME__DIRURL + # https://acme-staging-v02.api.letsencrypt.org/directory or https://acme-v02.api.letsencrypt.org/directory + value: {{ required "acmeDirUrl is required" .Values.acmeDirUrl }} + - name: ACME__TERMSACCEPTED + # You must set this to "true" to indicate your acceptance of Let's Encrypt's terms of service (https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf) + value: {{ required "acmeTermsAccepted is required" .Values.acmeTermsAccepted | quote }} + - name: ACME__EMAIL + # Your email address for Let's Encrypt and email notifications + value: {{ required "acmeEmail is required" .Values.acmeEmail }} +{{- if .Values.smtp.host }} + - name: SMTP__EMAILFROM + value: {{ required "smtp.email is required" .Values.smtp.email }} + - name: SMTP__HOST + value: {{ required "smtp.email is required" .Values.smtp.host }} + - name: SMTP__PORT + value: "{{ required "smtp.email is required" .Values.smtp.port }}" + - name: SMTP__USER + value: {{ required "smtp.email is required" .Values.smtp.user }} + - name: SMTP__PASS + valueFrom: + secretKeyRef: + name: {{ .Values.names.secret }} + key: password +{{- end }} +{{- if .Values.acmeKey.secretName }} + - name: ACME__KEY + valueFrom: + secretKeyRef: + name: "{{ .Values.acmeKey.secretName }}" + key: "{{ .Values.acmeKey.keyName }}" +{{- end }} +{{- if .Values.showRenewButton }} + - name: KCERT__SHOWRENEWBUTTON + value: "{{ .Values.showRenewButton }}" +{{- end }} +{{- range $key, $value := .Values.env }} + - name: "{{ $key }}" + value: "{{ $value }}" +{{- end }} + + + + diff --git a/charts/devtron-utilities/charts/kcert/templates/080-Service.yaml b/charts/devtron-utilities/charts/kcert/templates/080-Service.yaml new file mode 100644 index 000000000..a4aa48568 --- /dev/null +++ b/charts/devtron-utilities/charts/kcert/templates/080-Service.yaml @@ -0,0 +1,26 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ required "names.service is required" .Values.names.service }} + namespace: {{ .Release.Namespace | default "default" }} + labels: + app: kcert +{{- if .Values.forHelm }} + app.kubernetes.io/name: {{ .Chart.Name }} + helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} +spec: + ports: + - name: http + protocol: TCP + port: 80 + targetPort: 80 + - name: http-admin + protocol: TCP + port: 8080 + targetPort: 8080 + selector: + app: {{ required "names.app is required" .Values.names.app }} diff --git a/charts/devtron-utilities/charts/kcert/templates/NOTES.txt b/charts/devtron-utilities/charts/kcert/templates/NOTES.txt new file mode 100644 index 000000000..60e518b05 --- /dev/null +++ b/charts/devtron-utilities/charts/kcert/templates/NOTES.txt @@ -0,0 +1,4 @@ +Congratulations! kcert should now be setup and running in your cluster. + +You can check out the dashboard by running `kubectl -n {{ .Release.Namespace | default "default" }} port-forward svc/{{ .Values.names.service }} 8080` +and then opening http://localhost:8080 in your browser. diff --git a/charts/devtron-utilities/charts/kcert/values.yaml b/charts/devtron-utilities/charts/kcert/values.yaml new file mode 100644 index 000000000..0f9b23e44 --- /dev/null +++ b/charts/devtron-utilities/charts/kcert/values.yaml @@ -0,0 +1,35 @@ +acmeDirUrl: https://acme-staging-v02.api.letsencrypt.org/directory +acmeEmail: null +acmeTermsAccepted: false +kcertImage: nabsul/kcert:v1.2.0 + +env: {} + +acmeKey: + secretName: null + keyName: key + +showRenewButton: null + +smtp: + email: null + host: null + port: null + user: null + pass: null + +names: + serviceAccount: kcert + clusterRole: kcert + clusterRoleBinding: kcert + role: kcert + roleBinding: kcert + secret: kcert-smtp + deployment: kcert + service: kcert + app: kcert + +resources: {} + +# Set this to false in order to generate a plain yaml template without the Helm custom labels +forHelm: true diff --git a/charts/devtron-utilities/charts/minio/.helmignore b/charts/devtron-utilities/charts/minio/.helmignore new file mode 100644 index 000000000..a9fe72788 --- /dev/null +++ b/charts/devtron-utilities/charts/minio/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +# OWNERS file for Kubernetes +OWNERS \ No newline at end of file diff --git a/charts/devtron-utilities/charts/minio/Chart.yaml b/charts/devtron-utilities/charts/minio/Chart.yaml new file mode 100644 index 000000000..827787ea7 --- /dev/null +++ b/charts/devtron-utilities/charts/minio/Chart.yaml @@ -0,0 +1,18 @@ +apiVersion: v1 +appVersion: RELEASE.2024-12-18T13-15-44Z +description: High Performance Object Storage +home: https://min.io +icon: https://min.io/resources/img/logo/MINIO_wordmark.png +keywords: +- minio +- storage +- object-storage +- s3 +- cluster +maintainers: +- email: dev@minio.io + name: MinIO, Inc +name: minio +sources: +- https://github.com/minio/minio +version: 5.4.0 diff --git a/charts/devtron-utilities/charts/minio/README.md b/charts/devtron-utilities/charts/minio/README.md new file mode 100644 index 000000000..a1d5c99f8 --- /dev/null +++ b/charts/devtron-utilities/charts/minio/README.md @@ -0,0 +1,264 @@ +# MinIO Community Helm Chart + +[![Slack](https://slack.min.io/slack?type=svg)](https://slack.min.io) [![license](https://img.shields.io/badge/license-AGPL%20V3-blue)](https://github.com/minio/minio/blob/master/LICENSE) + +MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. It is API compatible with Amazon S3 cloud storage service. Use MinIO to build high performance infrastructure for machine learning, analytics and application data workloads. + +| IMPORTANT | +| -------------------------- | +| This Helm chart is community built, maintained, and supported. MinIO does not guarantee support for any given bug, feature request, or update referencing this chart.

MinIO publishes a separate [MinIO Kubernetes Operator and Tenant Helm Chart](https://github.com/minio/operator/tree/master/helm) that is officially maintained and supported. MinIO strongly recommends using the MinIO Kubernetes Operator for production deployments. See [Deploy Operator With Helm](https://min.io/docs/minio/kubernetes/upstream/operations/install-deploy-manage/deploy-operator-helm.html?ref=github) for additional documentation. | + +## Introduction + +This chart bootstraps MinIO Cluster on [Kubernetes](http://kubernetes.io) using the [Helm](https://helm.sh) package manager. + +## Prerequisites + +- Helm cli with Kubernetes cluster configured. +- PV provisioner support in the underlying infrastructure. (We recommend using ) +- Use Kubernetes version v1.19 and later for best experience. + +## Configure MinIO Helm repo + +```bash +helm repo add minio https://charts.min.io/ +``` + +### Installing the Chart + +Install this chart using: + +```bash +helm install --namespace minio --set rootUser=rootuser,rootPassword=rootpass123 --generate-name minio/minio +``` + +The command deploys MinIO on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation. + +### Installing the Chart (toy-setup) + +Minimal toy setup for testing purposes can be deployed using: + +```bash +helm install --set resources.requests.memory=512Mi --set replicas=1 --set persistence.enabled=false --set mode=standalone --set rootUser=rootuser,rootPassword=rootpass123 --generate-name minio/minio +``` + +### Upgrading the Chart + +You can use Helm to update MinIO version in a live release. Assuming your release is named as `my-release`, get the values using the command: + +```bash +helm get values my-release > old_values.yaml +``` + +Then change the field `image.tag` in `old_values.yaml` file with MinIO image tag you want to use. Now update the chart using + +```bash +helm upgrade -f old_values.yaml my-release minio/minio +``` + +Default upgrade strategies are specified in the `values.yaml` file. Update these fields if you'd like to use a different strategy. + +### Configuration + +Refer the [Values file](./values.yaml) for all the possible config fields. + +You can specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, + +```bash +helm install --name my-release --set persistence.size=1Ti minio/minio +``` + +The above command deploys MinIO server with a 1Ti backing persistent volume. + +Alternately, you can provide a YAML file that specifies parameter values while installing the chart. For example, + +```bash +helm install --name my-release -f values.yaml minio/minio +``` + +### Persistence + +This chart provisions a PersistentVolumeClaim and mounts corresponding persistent volume to default location `/export`. You'll need physical storage available in the Kubernetes cluster for this to work. If you'd rather use `emptyDir`, disable PersistentVolumeClaim by: + +```bash +helm install --set persistence.enabled=false minio/minio +``` + +> *"An emptyDir volume is first created when a Pod is assigned to a Node, and exists as long as that Pod is running on that node. When a Pod is removed from a node for any reason, the data in the emptyDir is deleted forever."* + +### Existing PersistentVolumeClaim + +If a Persistent Volume Claim already exists, specify it during installation. + +1. Create the PersistentVolume +2. Create the PersistentVolumeClaim +3. Install the chart + +```bash +helm install --set persistence.existingClaim=PVC_NAME minio/minio +``` + +### NetworkPolicy + +To enable network policy for MinIO, +install [a networking plugin that implements the Kubernetes +NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin), +and set `networkPolicy.enabled` to `true`. + +For Kubernetes v1.5 & v1.6, you must also turn on NetworkPolicy by setting +the DefaultDeny namespace annotation. Note: this will enforce policy for *all* pods in the namespace: + +``` +kubectl annotate namespace default "net.beta.kubernetes.io/network-policy={\"ingress\":{\"isolation\":\"DefaultDeny\"}}" +``` + +When using `Cilium` as a CNI in your cluster, please edit the `flavor` field to `cilium`. + +With NetworkPolicy enabled, traffic will be limited to just port 9000. + +For more precise policy, set `networkPolicy.allowExternal=true`. This will +only allow pods with the generated client label to connect to MinIO. +This label will be displayed in the output of a successful install. + +### Existing secret + +Instead of having this chart create the secret for you, you can supply a preexisting secret, much +like an existing PersistentVolumeClaim. + +First, create the secret: + +```bash +kubectl create secret generic my-minio-secret --from-literal=rootUser=foobarbaz --from-literal=rootPassword=foobarbazqux +``` + +Then install the chart, specifying that you want to use an existing secret: + +```bash +helm install --set existingSecret=my-minio-secret minio/minio +``` + +The following fields are expected in the secret: + +| .data.\ in Secret | Corresponding variable | Description | Required | +|:------------------------|:-----------------------|:---------------|:---------| +| `rootUser` | `rootUser` | Root user. | yes | +| `rootPassword` | `rootPassword` | Root password. | yes | + +All corresponding variables will be ignored in values file. + +### Configure TLS + +To enable TLS for MinIO containers, acquire TLS certificates from a CA or create self-signed certificates. While creating / acquiring certificates ensure the corresponding domain names are set as per the standard [DNS naming conventions](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-identity) in a Kubernetes StatefulSet (for a distributed MinIO setup). Then create a secret using + +```bash +kubectl create secret generic tls-ssl-minio --from-file=path/to/private.key --from-file=path/to/public.crt +``` + +Then install the chart, specifying that you want to use the TLS secret: + +```bash +helm install --set tls.enabled=true,tls.certSecret=tls-ssl-minio minio/minio +``` + +### Installing certificates from third party CAs + +MinIO can connect to other servers, including MinIO nodes or other server types such as NATs and Redis. If these servers use certificates that were not registered with a known CA, add trust for these certificates to MinIO Server by bundling these certificates into a Kubernetes secret and providing it to Helm via the `trustedCertsSecret` value. If `.Values.tls.enabled` is `true` and you're installing certificates for third party CAs, remember to include MinIO's own certificate with key `public.crt`, if it also needs to be trusted. + +For instance, given that TLS is enabled and you need to add trust for MinIO's own CA and for the CA of a Keycloak server, a Kubernetes secret can be created from the certificate files using `kubectl`: + +``` +kubectl -n minio create secret generic minio-trusted-certs --from-file=public.crt --from-file=keycloak.crt +``` + +If TLS is not enabled, you would need only the third party CA: + +``` +kubectl -n minio create secret generic minio-trusted-certs --from-file=keycloak.crt +``` + +The name of the generated secret can then be passed to Helm using a values file or the `--set` parameter: + +``` +trustedCertsSecret: "minio-trusted-certs" + +or + +--set trustedCertsSecret=minio-trusted-certs +``` + +### Create buckets after install + +Install the chart, specifying the buckets you want to create after install: + +```bash +helm install --set buckets[0].name=bucket1,buckets[0].policy=none,buckets[0].purge=false minio/minio +``` + +Description of the configuration parameters used above - + +- `buckets[].name` - name of the bucket to create, must be a string with length > 0 +- `buckets[].policy` - can be one of none|download|upload|public +- `buckets[].purge` - purge if bucket exists already + +### Create policies after install + +Install the chart, specifying the policies you want to create after install: + +```bash +helm install --set policies[0].name=mypolicy,policies[0].statements[0].resources[0]='arn:aws:s3:::bucket1',policies[0].statements[0].actions[0]='s3:ListBucket',policies[0].statements[0].actions[1]='s3:GetObject' minio/minio +``` + +Description of the configuration parameters used above - + +- `policies[].name` - name of the policy to create, must be a string with length > 0 +- `policies[].statements[]` - list of statements, includes actions and resources +- `policies[].statements[].resources[]` - list of resources that applies the statement +- `policies[].statements[].actions[]` - list of actions granted + +### Create user after install + +Install the chart, specifying the users you want to create after install: + +```bash +helm install --set users[0].accessKey=accessKey,users[0].secretKey=secretKey,users[0].policy=none,users[1].accessKey=accessKey2,users[1].secretRef=existingSecret,users[1].secretKey=password,users[1].policy=none minio/minio +``` + +Description of the configuration parameters used above - + +- `users[].accessKey` - accessKey of user +- `users[].secretKey` - secretKey of usersecretRef +- `users[].existingSecret` - secret name that contains the secretKey of user +- `users[].existingSecretKey` - data key in existingSecret secret containing the secretKey +- `users[].policy` - name of the policy to assign to user + +### Create service account after install + +Install the chart, specifying the service accounts you want to create after install: + +```bash +helm install --set svcaccts[0].accessKey=accessKey,svcaccts[0].secretKey=secretKey,svcaccts[0].user=parentUser,svcaccts[1].accessKey=accessKey2,svcaccts[1].secretRef=existingSecret,svcaccts[1].secretKey=password,svcaccts[1].user=parentUser2 minio/minio +``` + +Description of the configuration parameters used above - + +- `svcaccts[].accessKey` - accessKey of service account +- `svcaccts[].secretKey` - secretKey of svcacctsecretRef +- `svcaccts[].existingSecret` - secret name that contains the secretKey of service account +- `svcaccts[].existingSecretKey` - data key in existingSecret secret containing the secretKey +- `svcaccts[].user` - name of the parent user to assign to service account + +## Uninstalling the Chart + +Assuming your release is named as `my-release`, delete it using the command: + +```bash +helm delete my-release +``` + +or + +```bash +helm uninstall my-release +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. diff --git a/charts/devtron-utilities/charts/minio/templates/NOTES.txt b/charts/devtron-utilities/charts/minio/templates/NOTES.txt new file mode 100644 index 000000000..ba51b4c6c --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/NOTES.txt @@ -0,0 +1,43 @@ +{{- if eq .Values.service.type "ClusterIP" "NodePort" }} +MinIO can be accessed via port {{ .Values.service.port }} on the following DNS name from within your cluster: +{{ template "minio.fullname" . }}.{{ .Release.Namespace }}.{{ .Values.clusterDomain }} + +To access MinIO from localhost, run the below commands: + + 1. export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + + 2. kubectl port-forward $POD_NAME 9000 --namespace {{ .Release.Namespace }} + +Read more about port forwarding here: http://kubernetes.io/docs/user-guide/kubectl/kubectl_port-forward/ + +You can now access MinIO server on http://localhost:9000. Follow the below steps to connect to MinIO server with mc client: + + 1. Download the MinIO mc client - https://min.io/docs/minio/linux/reference/minio-mc.html#quickstart + + 2. export MC_HOST_{{ template "minio.fullname" . }}-local=http://$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "minio.secretName" . }} -o jsonpath="{.data.rootUser}" | base64 --decode):$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "minio.secretName" . }} -o jsonpath="{.data.rootPassword}" | base64 --decode)@localhost:{{ .Values.service.port }} + + 3. mc ls {{ template "minio.fullname" . }}-local + +{{- end }} +{{- if eq .Values.service.type "LoadBalancer" }} +MinIO can be accessed via port {{ .Values.service.port }} on an external IP address. Get the service external IP address by: +kubectl get svc --namespace {{ .Release.Namespace }} -l app={{ template "minio.fullname" . }} + +Note that the public IP may take a couple of minutes to be available. + +You can now access MinIO server on http://:9000. Follow the below steps to connect to MinIO server with mc client: + + 1. Download the MinIO mc client - https://min.io/docs/minio/linux/reference/minio-mc.html#quickstart + + 2. export MC_HOST_{{ template "minio.fullname" . }}-local=http://$(kubectl get secret {{ template "minio.secretName" . }} --namespace {{ .Release.Namespace }} -o jsonpath="{.data.rootUser}" | base64 --decode):$(kubectl get secret {{ template "minio.secretName" . }} -o jsonpath="{.data.rootPassword}" | base64 --decode)@:{{ .Values.service.port }} + + 3. mc ls {{ template "minio.fullname" . }} + +Alternately, you can use your browser or the MinIO SDK to access the server - https://min.io/docs/minio/linux/reference/minio-server/minio-server.html +{{- end }} + +{{ if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }} +Note: Since NetworkPolicy is enabled, only pods with label +{{ template "minio.fullname" . }}-client=true" +will be able to connect to this minio cluster. +{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/_helper_create_bucket.txt b/charts/devtron-utilities/charts/minio/templates/_helper_create_bucket.txt new file mode 100644 index 000000000..83b8dcb2d --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/_helper_create_bucket.txt @@ -0,0 +1,122 @@ +#!/bin/sh +set -e # Have script exit in the event of a failed command. + +{{- if .Values.configPathmc }} +MC_CONFIG_DIR="{{ .Values.configPathmc }}" +MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}" +{{- else }} +MC="/usr/bin/mc --insecure" +{{- end }} + +# connectToMinio +# Use a check-sleep-check loop to wait for MinIO service to be available +connectToMinio() { + SCHEME=$1 + ATTEMPTS=0 + LIMIT=29 # Allow 30 attempts + set -e # fail if we can't read the keys. + ACCESS=$(cat /config/rootUser) + SECRET=$(cat /config/rootPassword) + set +e # The connections to minio are allowed to fail. + echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" + MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" + $MC_COMMAND + STATUS=$? + until [ $STATUS = 0 ]; do + ATTEMPTS=$(expr $ATTEMPTS + 1) + echo \"Failed attempts: $ATTEMPTS\" + if [ $ATTEMPTS -gt $LIMIT ]; then + exit 1 + fi + sleep 2 # 1 second intervals between attempts + $MC_COMMAND + STATUS=$? + done + set -e # reset `e` as active + return 0 +} + +# checkBucketExists ($bucket) +# Check if the bucket exists, by using the exit code of `mc ls` +checkBucketExists() { + BUCKET=$1 + CMD=$(${MC} stat myminio/$BUCKET >/dev/null 2>&1) + return $? +} + +# createBucket ($bucket, $policy, $purge) +# Ensure bucket exists, purging if asked to +createBucket() { + BUCKET=$1 + POLICY=$2 + PURGE=$3 + VERSIONING=$4 + OBJECTLOCKING=$5 + + # Purge the bucket, if set & exists + # Since PURGE is user input, check explicitly for `true` + if [ $PURGE = true ]; then + if checkBucketExists $BUCKET; then + echo "Purging bucket '$BUCKET'." + set +e # don't exit if this fails + ${MC} rm -r --force myminio/$BUCKET + set -e # reset `e` as active + else + echo "Bucket '$BUCKET' does not exist, skipping purge." + fi + fi + + # Create the bucket if it does not exist and set objectlocking if enabled (NOTE: versioning will be not changed if OBJECTLOCKING is set because it enables versioning to the Buckets created) + if ! checkBucketExists $BUCKET; then + if [ ! -z $OBJECTLOCKING ]; then + if [ $OBJECTLOCKING = true ]; then + echo "Creating bucket with OBJECTLOCKING '$BUCKET'" + ${MC} mb --with-lock myminio/$BUCKET + elif [ $OBJECTLOCKING = false ]; then + echo "Creating bucket '$BUCKET'" + ${MC} mb myminio/$BUCKET + fi + elif [ -z $OBJECTLOCKING ]; then + echo "Creating bucket '$BUCKET'" + ${MC} mb myminio/$BUCKET + else + echo "Bucket '$BUCKET' already exists." + fi + fi + + # set versioning for bucket if objectlocking is disabled or not set + if [ $OBJECTLOCKING = false ]; then + if [ ! -z $VERSIONING ]; then + if [ $VERSIONING = true ]; then + echo "Enabling versioning for '$BUCKET'" + ${MC} version enable myminio/$BUCKET + elif [ $VERSIONING = false ]; then + echo "Suspending versioning for '$BUCKET'" + ${MC} version suspend myminio/$BUCKET + fi + fi + else + echo "Bucket '$BUCKET' versioning unchanged." + fi + + # At this point, the bucket should exist, skip checking for existence + # Set policy on the bucket + echo "Setting policy of bucket '$BUCKET' to '$POLICY'." + ${MC} anonymous set $POLICY myminio/$BUCKET +} + +# Try connecting to MinIO instance +{{- if .Values.tls.enabled }} +scheme=https +{{- else }} +scheme=http +{{- end }} +connectToMinio $scheme + +{{ if .Values.buckets }} +{{ $global := . }} +# Create the buckets +{{- range .Values.buckets }} +createBucket {{ tpl .name $global }} {{ .policy | default "none" | quote }} {{ .purge | default false }} {{ .versioning | default false }} {{ .objectlocking | default false }} +{{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/_helper_create_policy.txt b/charts/devtron-utilities/charts/minio/templates/_helper_create_policy.txt new file mode 100644 index 000000000..aa584952f --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/_helper_create_policy.txt @@ -0,0 +1,75 @@ +#!/bin/sh +set -e ; # Have script exit in the event of a failed command. + +{{- if .Values.configPathmc }} +MC_CONFIG_DIR="{{ .Values.configPathmc }}" +MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}" +{{- else }} +MC="/usr/bin/mc --insecure" +{{- end }} + +# connectToMinio +# Use a check-sleep-check loop to wait for MinIO service to be available +connectToMinio() { + SCHEME=$1 + ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts + set -e ; # fail if we can't read the keys. + ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ; + set +e ; # The connections to minio are allowed to fail. + echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ; + MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ; + $MC_COMMAND ; + STATUS=$? ; + until [ $STATUS = 0 ] + do + ATTEMPTS=`expr $ATTEMPTS + 1` ; + echo \"Failed attempts: $ATTEMPTS\" ; + if [ $ATTEMPTS -gt $LIMIT ]; then + exit 1 ; + fi ; + sleep 2 ; # 1 second intervals between attempts + $MC_COMMAND ; + STATUS=$? ; + done ; + set -e ; # reset `e` as active + return 0 +} + +# checkPolicyExists ($policy) +# Check if the policy exists, by using the exit code of `mc admin policy info` +checkPolicyExists() { + POLICY=$1 + CMD=$(${MC} admin policy info myminio $POLICY > /dev/null 2>&1) + return $? +} + +# createPolicy($name, $filename) +createPolicy () { + NAME=$1 + FILENAME=$2 + + # Create the name if it does not exist + echo "Checking policy: $NAME (in /config/$FILENAME.json)" + if ! checkPolicyExists $NAME ; then + echo "Creating policy '$NAME'" + else + echo "Policy '$NAME' already exists." + fi + ${MC} admin policy create myminio $NAME /config/$FILENAME.json + +} + +# Try connecting to MinIO instance +{{- if .Values.tls.enabled }} +scheme=https +{{- else }} +scheme=http +{{- end }} +connectToMinio $scheme + +{{ if .Values.policies }} +# Create the policies +{{- range $idx, $policy := .Values.policies }} +createPolicy {{ $policy.name }} policy_{{ $idx }} +{{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/_helper_create_svcacct.txt b/charts/devtron-utilities/charts/minio/templates/_helper_create_svcacct.txt new file mode 100644 index 000000000..5c8aec4f0 --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/_helper_create_svcacct.txt @@ -0,0 +1,106 @@ +#!/bin/sh +set -e ; # Have script exit in the event of a failed command. + +{{- if .Values.configPathmc }} +MC_CONFIG_DIR="{{ .Values.configPathmc }}" +MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}" +{{- else }} +MC="/usr/bin/mc --insecure" +{{- end }} + +# AccessKey and secretkey credentials file are added to prevent shell execution errors caused by special characters. +# Special characters for example : ',",<,>,{,} +MINIO_ACCESSKEY_SECRETKEY_TMP="/tmp/accessKey_and_secretKey_svcacct_tmp" + +# connectToMinio +# Use a check-sleep-check loop to wait for MinIO service to be available +connectToMinio() { + SCHEME=$1 + ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts + set -e ; # fail if we can't read the keys. + ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ; + set +e ; # The connections to minio are allowed to fail. + echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ; + MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ; + $MC_COMMAND ; + STATUS=$? ; + until [ $STATUS = 0 ] + do + ATTEMPTS=`expr $ATTEMPTS + 1` ; + echo \"Failed attempts: $ATTEMPTS\" ; + if [ $ATTEMPTS -gt $LIMIT ]; then + exit 1 ; + fi ; + sleep 2 ; # 2 second intervals between attempts + $MC_COMMAND ; + STATUS=$? ; + done ; + set -e ; # reset `e` as active + return 0 +} + +# checkSvcacctExists () +# Check if the svcacct exists, by using the exit code of `mc admin user svcacct info` +checkSvcacctExists() { + CMD=$(${MC} admin user svcacct info myminio $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) > /dev/null 2>&1) + return $? +} + +# createSvcacct ($user) +createSvcacct () { + USER=$1 + FILENAME=$2 + #check accessKey_and_secretKey_tmp file + if [[ ! -f $MINIO_ACCESSKEY_SECRETKEY_TMP ]];then + echo "credentials file does not exist" + return 1 + fi + if [[ $(cat $MINIO_ACCESSKEY_SECRETKEY_TMP|wc -l) -ne 2 ]];then + echo "credentials file is invalid" + rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP + return 1 + fi + SVCACCT=$(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) + # Create the svcacct if it does not exist + if ! checkSvcacctExists ; then + echo "Creating svcacct '$SVCACCT'" + # Check if policy file is define + if [ -z $FILENAME ]; then + ${MC} admin user svcacct add --access-key $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --secret-key $(tail -n1 $MINIO_ACCESSKEY_SECRETKEY_TMP) myminio $USER + else + ${MC} admin user svcacct add --access-key $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --secret-key $(tail -n1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --policy /config/$FILENAME.json myminio $USER + fi + else + echo "Svcacct '$SVCACCT' already exists." + fi + #clean up credentials files. + rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP +} + +# Try connecting to MinIO instance +{{- if .Values.tls.enabled }} +scheme=https +{{- else }} +scheme=http +{{- end }} +connectToMinio $scheme + +{{ if .Values.svcaccts }} +{{ $global := . }} +# Create the svcaccts +{{- range $idx, $svc := .Values.svcaccts }} +echo {{ tpl .accessKey $global }} > $MINIO_ACCESSKEY_SECRETKEY_TMP +{{- if .existingSecret }} +cat /config/secrets-svc/{{ tpl .existingSecret $global }}/{{ tpl .existingSecretKey $global }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP +# Add a new line if it doesn't exist +echo >> $MINIO_ACCESSKEY_SECRETKEY_TMP +{{ else }} +echo {{ .secretKey }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP +{{- end }} +{{- if $svc.policy}} +createSvcacct {{ .user }} svc_policy_{{ $idx }} +{{ else }} +createSvcacct {{ .user }} +{{- end }} +{{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/_helper_create_user.txt b/charts/devtron-utilities/charts/minio/templates/_helper_create_user.txt new file mode 100644 index 000000000..bfb79bee5 --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/_helper_create_user.txt @@ -0,0 +1,107 @@ +#!/bin/sh +set -e ; # Have script exit in the event of a failed command. + +{{- if .Values.configPathmc }} +MC_CONFIG_DIR="{{ .Values.configPathmc }}" +MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}" +{{- else }} +MC="/usr/bin/mc --insecure" +{{- end }} + +# AccessKey and secretkey credentials file are added to prevent shell execution errors caused by special characters. +# Special characters for example : ',",<,>,{,} +MINIO_ACCESSKEY_SECRETKEY_TMP="/tmp/accessKey_and_secretKey_tmp" + +# connectToMinio +# Use a check-sleep-check loop to wait for MinIO service to be available +connectToMinio() { + SCHEME=$1 + ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts + set -e ; # fail if we can't read the keys. + ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ; + set +e ; # The connections to minio are allowed to fail. + echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ; + MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ; + $MC_COMMAND ; + STATUS=$? ; + until [ $STATUS = 0 ] + do + ATTEMPTS=`expr $ATTEMPTS + 1` ; + echo \"Failed attempts: $ATTEMPTS\" ; + if [ $ATTEMPTS -gt $LIMIT ]; then + exit 1 ; + fi ; + sleep 2 ; # 1 second intervals between attempts + $MC_COMMAND ; + STATUS=$? ; + done ; + set -e ; # reset `e` as active + return 0 +} + +# checkUserExists () +# Check if the user exists, by using the exit code of `mc admin user info` +checkUserExists() { + CMD=$(${MC} admin user info myminio $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) > /dev/null 2>&1) + return $? +} + +# createUser ($policy) +createUser() { + POLICY=$1 + #check accessKey_and_secretKey_tmp file + if [[ ! -f $MINIO_ACCESSKEY_SECRETKEY_TMP ]];then + echo "credentials file does not exist" + return 1 + fi + if [[ $(cat $MINIO_ACCESSKEY_SECRETKEY_TMP|wc -l) -ne 2 ]];then + echo "credentials file is invalid" + rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP + return 1 + fi + USER=$(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) + # Create the user if it does not exist + if ! checkUserExists ; then + echo "Creating user '$USER'" + cat $MINIO_ACCESSKEY_SECRETKEY_TMP | ${MC} admin user add myminio + else + echo "User '$USER' already exists." + fi + #clean up credentials files. + rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP + + # set policy for user + if [ ! -z $POLICY -a $POLICY != " " ] ; then + echo "Adding policy '$POLICY' for '$USER'" + set +e ; # policy already attach errors out, allow it. + ${MC} admin policy attach myminio $POLICY --user=$USER + set -e + else + echo "User '$USER' has no policy attached." + fi +} + +# Try connecting to MinIO instance +{{- if .Values.tls.enabled }} +scheme=https +{{- else }} +scheme=http +{{- end }} +connectToMinio $scheme + +{{ if .Values.users }} +{{ $global := . }} +# Create the users +{{- range .Values.users }} +echo {{ tpl .accessKey $global }} > $MINIO_ACCESSKEY_SECRETKEY_TMP +{{- if .existingSecret }} +cat /config/secrets/{{ tpl .existingSecret $global }}/{{ tpl .existingSecretKey $global }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP +# Add a new line if it doesn't exist +echo >> $MINIO_ACCESSKEY_SECRETKEY_TMP +createUser {{ .policy }} +{{ else }} +echo {{ .secretKey }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP +createUser {{ .policy }} +{{- end }} +{{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/_helper_custom_command.txt b/charts/devtron-utilities/charts/minio/templates/_helper_custom_command.txt new file mode 100644 index 000000000..b583a7782 --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/_helper_custom_command.txt @@ -0,0 +1,58 @@ +#!/bin/sh +set -e ; # Have script exit in the event of a failed command. + +{{- if .Values.configPathmc }} +MC_CONFIG_DIR="{{ .Values.configPathmc }}" +MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}" +{{- else }} +MC="/usr/bin/mc --insecure" +{{- end }} + +# connectToMinio +# Use a check-sleep-check loop to wait for MinIO service to be available +connectToMinio() { + SCHEME=$1 + ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts + set -e ; # fail if we can't read the keys. + ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ; + set +e ; # The connections to minio are allowed to fail. + echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ; + MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ; + $MC_COMMAND ; + STATUS=$? ; + until [ $STATUS = 0 ] + do + ATTEMPTS=`expr $ATTEMPTS + 1` ; + echo \"Failed attempts: $ATTEMPTS\" ; + if [ $ATTEMPTS -gt $LIMIT ]; then + exit 1 ; + fi ; + sleep 2 ; # 1 second intervals between attempts + $MC_COMMAND ; + STATUS=$? ; + done ; + set -e ; # reset `e` as active + return 0 +} + +# runCommand ($@) +# Run custom mc command +runCommand() { + ${MC} "$@" + return $? +} + +# Try connecting to MinIO instance +{{- if .Values.tls.enabled }} +scheme=https +{{- else }} +scheme=http +{{- end }} +connectToMinio $scheme + +{{ if .Values.customCommands }} +# Run custom commands +{{- range .Values.customCommands }} +runCommand {{ .command }} +{{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/_helper_policy.tpl b/charts/devtron-utilities/charts/minio/templates/_helper_policy.tpl new file mode 100644 index 000000000..8be998e5d --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/_helper_policy.tpl @@ -0,0 +1,28 @@ +{{- $statements_length := len .statements -}} +{{- $statements_length := sub $statements_length 1 -}} +{ + "Version": "2012-10-17", + "Statement": [ +{{- range $i, $statement := .statements }} + { + "Effect": "{{ $statement.effect | default "Allow" }}", + "Action": [ +"{{ $statement.actions | join "\",\n\"" }}" + ]{{ if $statement.resources }}, + "Resource": [ +"{{ $statement.resources | join "\",\n\"" }}" + ]{{ end }} +{{- if $statement.conditions }} +{{- $condition_len := len $statement.conditions }} +{{- $condition_len := sub $condition_len 1 }} + , + "Condition": { + {{- range $k,$v := $statement.conditions }} + {{- range $operator,$object := $v }} + "{{ $operator }}": { {{ $object }} }{{- if lt $k $condition_len }},{{- end }} + {{- end }}{{- end }} + }{{- end }} + }{{ if lt $i $statements_length }},{{end }} +{{- end }} + ] +} diff --git a/charts/devtron-utilities/charts/minio/templates/_helpers.tpl b/charts/devtron-utilities/charts/minio/templates/_helpers.tpl new file mode 100644 index 000000000..1cb209e5e --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/_helpers.tpl @@ -0,0 +1,218 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "minio.name" -}} + {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "minio.fullname" -}} + {{- if .Values.fullnameOverride -}} + {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} + {{- else -}} + {{- $name := default .Chart.Name .Values.nameOverride -}} + {{- if contains $name .Release.Name -}} + {{- .Release.Name | trunc 63 | trimSuffix "-" -}} + {{- else -}} + {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} + {{- end -}} + {{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "minio.chart" -}} + {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for networkpolicy. +*/}} +{{- define "minio.networkPolicy.apiVersion" -}} + {{- if semverCompare ">=1.4-0, <1.7-0" .Capabilities.KubeVersion.Version -}} + {{- print "extensions/v1beta1" -}} + {{- else if semverCompare ">=1.7-0, <1.16-0" .Capabilities.KubeVersion.Version -}} + {{- print "networking.k8s.io/v1beta1" -}} + {{- else if semverCompare "^1.16-0" .Capabilities.KubeVersion.Version -}} + {{- print "networking.k8s.io/v1" -}} + {{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for deployment. +*/}} +{{- define "minio.deployment.apiVersion" -}} + {{- if semverCompare "<1.9-0" .Capabilities.KubeVersion.Version -}} + {{- print "apps/v1beta2" -}} + {{- else -}} + {{- print "apps/v1" -}} + {{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for statefulset. +*/}} +{{- define "minio.statefulset.apiVersion" -}} + {{- if semverCompare "<1.16-0" .Capabilities.KubeVersion.Version -}} + {{- print "apps/v1beta2" -}} + {{- else -}} + {{- print "apps/v1" -}} + {{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for ingress. +*/}} +{{- define "minio.ingress.apiVersion" -}} + {{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}} + {{- print "extensions/v1beta1" -}} + {{- else if semverCompare "<1.19-0" .Capabilities.KubeVersion.GitVersion -}} + {{- print "networking.k8s.io/v1beta1" -}} + {{- else -}} + {{- print "networking.k8s.io/v1" -}} + {{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for console ingress. +*/}} +{{- define "minio.consoleIngress.apiVersion" -}} + {{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}} + {{- print "extensions/v1beta1" -}} + {{- else if semverCompare "<1.19-0" .Capabilities.KubeVersion.GitVersion -}} + {{- print "networking.k8s.io/v1beta1" -}} + {{- else -}} + {{- print "networking.k8s.io/v1" -}} + {{- end -}} +{{- end -}} + +{{/* +Determine secret name. +*/}} +{{- define "minio.secretName" -}} + {{- if .Values.existingSecret -}} + {{- .Values.existingSecret }} + {{- else -}} + {{- include "minio.fullname" . -}} + {{- end -}} +{{- end -}} + +{{/* +Determine name for scc role and rolebinding +*/}} +{{- define "minio.sccRoleName" -}} + {{- printf "%s-%s" "scc" (include "minio.fullname" .) | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Properly format optional additional arguments to MinIO binary +*/}} +{{- define "minio.extraArgs" -}} +{{- range .Values.extraArgs -}} +{{ " " }}{{ . }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names +*/}} +{{- define "minio.imagePullSecrets" -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic. +Also, we can not use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} +{{- if .Values.global.imagePullSecrets }} +imagePullSecrets: +{{- range .Values.global.imagePullSecrets }} + - name: {{ . }} +{{- end }} +{{- else if .Values.imagePullSecrets }} +imagePullSecrets: + {{ toYaml .Values.imagePullSecrets }} +{{- end -}} +{{- else if .Values.imagePullSecrets }} +imagePullSecrets: + {{ toYaml .Values.imagePullSecrets }} +{{- end -}} +{{- end -}} + +{{/* +Formats volumeMount for MinIO TLS keys and trusted certs +*/}} +{{- define "minio.tlsKeysVolumeMount" -}} +{{- if .Values.tls.enabled }} +- name: cert-secret-volume + mountPath: {{ .Values.certsPath }} +{{- end }} +{{- if or .Values.tls.enabled (ne .Values.trustedCertsSecret "") }} +{{- $casPath := printf "%s/CAs" .Values.certsPath | clean }} +- name: trusted-cert-secret-volume + mountPath: {{ $casPath }} +{{- end }} +{{- end -}} + +{{/* +Formats volume for MinIO TLS keys and trusted certs +*/}} +{{- define "minio.tlsKeysVolume" -}} +{{- if .Values.tls.enabled }} +- name: cert-secret-volume + secret: + secretName: {{ tpl .Values.tls.certSecret $ }} + items: + - key: {{ .Values.tls.publicCrt }} + path: public.crt + - key: {{ .Values.tls.privateKey }} + path: private.key +{{- end }} +{{- if or .Values.tls.enabled (ne .Values.trustedCertsSecret "") }} +{{- $certSecret := eq .Values.trustedCertsSecret "" | ternary .Values.tls.certSecret .Values.trustedCertsSecret }} +{{- $publicCrt := eq .Values.trustedCertsSecret "" | ternary .Values.tls.publicCrt "" }} +- name: trusted-cert-secret-volume + secret: + secretName: {{ $certSecret }} + {{- if ne $publicCrt "" }} + items: + - key: {{ $publicCrt }} + path: public.crt + {{- end }} +{{- end }} +{{- end -}} + +{{/* +Returns the available value for certain key in an existing secret (if it exists), +otherwise it generates a random value. +*/}} +{{- define "minio.getValueFromSecret" }} + {{- $len := (default 16 .Length) | int -}} + {{- $obj := (lookup "v1" "Secret" .Namespace .Name).data -}} + {{- if $obj }} + {{- index $obj .Key | b64dec -}} + {{- else -}} + {{- randAlphaNum $len -}} + {{- end -}} +{{- end }} + +{{- define "minio.root.username" -}} + {{- if .Values.rootUser }} + {{- .Values.rootUser | toString }} + {{- else }} + {{- include "minio.getValueFromSecret" (dict "Namespace" .Release.Namespace "Name" (include "minio.fullname" .) "Length" 20 "Key" "rootUser") }} + {{- end }} +{{- end -}} + +{{- define "minio.root.password" -}} + {{- if .Values.rootPassword }} + {{- .Values.rootPassword | toString }} + {{- else }} + {{- include "minio.getValueFromSecret" (dict "Namespace" .Release.Namespace "Name" (include "minio.fullname" .) "Length" 40 "Key" "rootPassword") }} + {{- end }} +{{- end -}} diff --git a/charts/devtron-utilities/charts/minio/templates/ciliumnetworkpolicy.yaml b/charts/devtron-utilities/charts/minio/templates/ciliumnetworkpolicy.yaml new file mode 100644 index 000000000..1dc91bcf2 --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/ciliumnetworkpolicy.yaml @@ -0,0 +1,33 @@ +{{- if and (.Values.networkPolicy.enabled) (eq .Values.networkPolicy.flavor "cilium") }} +kind: CiliumNetworkPolicy +apiVersion: cilium.io/v2 +metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + endpointSelector: + matchLabels: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} + ingress: + - toPorts: + - ports: + - port: "{{ .Values.minioAPIPort }}" + protocol: TCP + - port: "{{ .Values.minioConsolePort }}" + protocol: TCP + {{- if not .Values.networkPolicy.allowExternal }} + fromEndpoints: + - matchLabels: + {{ template "minio.name" . }}-client: "true" + {{- end }} + egress: + {{- range $entity := .Values.networkPolicy.egressEntities }} + - toEntities: + - {{ $entity }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/configmap.yaml b/charts/devtron-utilities/charts/minio/templates/configmap.yaml new file mode 100644 index 000000000..47f64cc23 --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/configmap.yaml @@ -0,0 +1,32 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +data: + initialize: |- + {{- include (print $.Template.BasePath "/_helper_create_bucket.txt") . | nindent 4 }} + add-user: |- + {{- include (print $.Template.BasePath "/_helper_create_user.txt") . | nindent 4 }} + add-policy: |- + {{- include (print $.Template.BasePath "/_helper_create_policy.txt") . | nindent 4 }} + {{- range $idx, $policy := .Values.policies }} + # Policy: {{ $policy.name }} + policy_{{ $idx }}.json: |- + {{- include (print $.Template.BasePath "/_helper_policy.tpl") . | nindent 4 }} + {{ end }} + {{- range $idx, $svc := .Values.svcaccts }} + {{- if $svc.policy }} + # SVC: {{ $svc.accessKey }} + svc_policy_{{ $idx }}.json: |- + {{- include (print $.Template.BasePath "/_helper_policy.tpl") .policy | nindent 4 }} + {{- end }} + {{- end }} + add-svcacct: |- + {{- include (print $.Template.BasePath "/_helper_create_svcacct.txt") . | nindent 4 }} + custom-command: |- + {{- include (print $.Template.BasePath "/_helper_custom_command.txt") . | nindent 4 }} diff --git a/charts/devtron-utilities/charts/minio/templates/console-ingress.yaml b/charts/devtron-utilities/charts/minio/templates/console-ingress.yaml new file mode 100644 index 000000000..79a2b1b58 --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/console-ingress.yaml @@ -0,0 +1,55 @@ +{{- if .Values.consoleIngress.enabled -}} +{{- $fullName := printf "%s-console" (include "minio.fullname" .) -}} +{{- $servicePort := .Values.consoleService.port -}} +{{- $ingressPath := .Values.consoleIngress.path -}} +apiVersion: {{ template "minio.consoleIngress.apiVersion" . }} +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- with .Values.consoleIngress.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.consoleIngress.annotations }} + annotations: {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if .Values.consoleIngress.ingressClassName }} + ingressClassName: {{ .Values.consoleIngress.ingressClassName }} + {{- end }} + {{- if .Values.consoleIngress.tls }} + tls: + {{- range .Values.consoleIngress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.consoleIngress.hosts }} + - http: + paths: + - path: {{ $ingressPath }} + {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} + pathType: Prefix + backend: + service: + name: {{ $fullName }} + port: + number: {{ $servicePort }} + {{- else }} + backend: + serviceName: {{ $fullName }} + servicePort: {{ $servicePort }} + {{- end }} + {{- if . }} + host: {{ tpl . $ | quote }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/console-service.yaml b/charts/devtron-utilities/charts/minio/templates/console-service.yaml new file mode 100644 index 000000000..f09e3f3c6 --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/console-service.yaml @@ -0,0 +1,45 @@ +{{ $scheme := .Values.tls.enabled | ternary "https" "http" }} +apiVersion: v1 +kind: Service +metadata: + name: {{ template "minio.fullname" . }}-console + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.consoleService.annotations }} + annotations: {{- toYaml .Values.consoleService.annotations | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.consoleService.type }} + {{- if and (eq .Values.consoleService.type "ClusterIP") .Values.consoleService.clusterIP }} + clusterIP: {{ .Values.consoleService.clusterIP }} + {{- end }} + {{- if or (eq .Values.consoleService.type "LoadBalancer") (eq .Values.consoleService.type "NodePort") }} + externalTrafficPolicy: {{ .Values.consoleService.externalTrafficPolicy | quote }} + {{- end }} + {{- if and (eq .Values.consoleService.type "LoadBalancer") .Values.consoleService.loadBalancerSourceRanges }} + loadBalancerSourceRanges: {{ .Values.consoleService.loadBalancerSourceRanges }} + {{ end }} + {{- if and (eq .Values.consoleService.type "LoadBalancer") (not (empty .Values.consoleService.loadBalancerIP)) }} + loadBalancerIP: {{ .Values.consoleService.loadBalancerIP }} + {{- end }} + ports: + - name: {{ $scheme }} + port: {{ .Values.consoleService.port }} + protocol: TCP + {{- if (and (eq .Values.consoleService.type "NodePort") ( .Values.consoleService.nodePort)) }} + nodePort: {{ .Values.consoleService.nodePort }} + {{- else }} + targetPort: {{ .Values.minioConsolePort }} + {{- end }} + {{- if .Values.consoleService.externalIPs }} + externalIPs: + {{- range $i , $ip := .Values.consoleService.externalIPs }} + - {{ $ip }} + {{- end }} + {{- end }} + selector: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} diff --git a/charts/devtron-utilities/charts/minio/templates/deployment.yaml b/charts/devtron-utilities/charts/minio/templates/deployment.yaml new file mode 100644 index 000000000..4c57010fd --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/deployment.yaml @@ -0,0 +1,213 @@ +{{- if eq .Values.mode "standalone" }} +{{ $scheme := .Values.tls.enabled | ternary "https" "http" }} +{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }} +apiVersion: {{ template "minio.deployment.apiVersion" . }} +kind: Deployment +metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.additionalLabels }} + {{- toYaml .Values.additionalLabels | nindent 4 }} + {{- end }} + {{- if .Values.additionalAnnotations }} + annotations: {{- toYaml .Values.additionalAnnotations | nindent 4 }} + {{- end }} +spec: + strategy: + type: {{ .Values.deploymentUpdate.type }} + {{- if eq .Values.deploymentUpdate.type "RollingUpdate" }} + rollingUpdate: + maxSurge: {{ .Values.deploymentUpdate.maxSurge }} + maxUnavailable: {{ .Values.deploymentUpdate.maxUnavailable }} + {{- end }} + replicas: 1 + selector: + matchLabels: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} + template: + metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} + {{- if .Values.podLabels }} + {{- toYaml .Values.podLabels | nindent 8 }} + {{- end }} + annotations: + {{- if not .Values.ignoreChartChecksums }} + checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} + checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + {{- end }} + {{- if .Values.podAnnotations }} + {{- toYaml .Values.podAnnotations | trimSuffix "\n" | nindent 8 }} + {{- end }} + spec: + {{- if .Values.priorityClassName }} + priorityClassName: "{{ .Values.priorityClassName }}" + {{- end }} + {{- if .Values.runtimeClassName }} + runtimeClassName: "{{ .Values.runtimeClassName }}" + {{- end }} + {{- if and .Values.securityContext.enabled .Values.persistence.enabled }} + securityContext: + {{ omit .Values.securityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + {{ if .Values.serviceAccount.create }} + serviceAccountName: {{ .Values.serviceAccount.name }} + {{- end }} + containers: + - name: {{ .Chart.Name }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + command: + - "/bin/sh" + - "-ce" + - "/usr/bin/docker-entrypoint.sh minio server {{ $bucketRoot }} -S {{ .Values.certsPath }} --address :{{ .Values.minioAPIPort }} --console-address :{{ .Values.minioConsolePort }} {{- template "minio.extraArgs" . }}" + volumeMounts: + - name: minio-user + mountPath: "/tmp/credentials" + readOnly: true + - name: export + mountPath: {{ .Values.mountPath }} + {{- if and .Values.persistence.enabled .Values.persistence.subPath }} + subPath: "{{ .Values.persistence.subPath }}" + {{- end }} + {{- if .Values.extraSecret }} + - name: extra-secret + mountPath: "/tmp/minio-config-env" + {{- end }} + {{- include "minio.tlsKeysVolumeMount" . | indent 12 }} + {{- if .Values.extraVolumeMounts }} + {{- toYaml .Values.extraVolumeMounts | nindent 12 }} + {{- end }} + ports: + - name: {{ $scheme }} + containerPort: {{ .Values.minioAPIPort }} + - name: {{ $scheme }}-console + containerPort: {{ .Values.minioConsolePort }} + env: + - name: MINIO_ROOT_USER + valueFrom: + secretKeyRef: + name: {{ template "minio.secretName" . }} + key: rootUser + - name: MINIO_ROOT_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "minio.secretName" . }} + key: rootPassword + {{- if .Values.extraSecret }} + - name: MINIO_CONFIG_ENV_FILE + value: "/tmp/minio-config-env/config.env" + {{- end }} + {{- if .Values.metrics.serviceMonitor.public }} + - name: MINIO_PROMETHEUS_AUTH_TYPE + value: "public" + {{- end }} + {{- if .Values.oidc.enabled }} + - name: MINIO_IDENTITY_OPENID_CONFIG_URL + value: {{ .Values.oidc.configUrl }} + - name: MINIO_IDENTITY_OPENID_CLIENT_ID + {{- if and .Values.oidc.existingClientSecretName .Values.oidc.existingClientIdKey }} + valueFrom: + secretKeyRef: + name: {{ .Values.oidc.existingClientSecretName }} + key: {{ .Values.oidc.existingClientIdKey }} + {{- else }} + value: {{ .Values.oidc.clientId }} + {{- end }} + - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET + {{- if and .Values.oidc.existingClientSecretName .Values.oidc.existingClientSecretKey }} + valueFrom: + secretKeyRef: + name: {{ .Values.oidc.existingClientSecretName }} + key: {{ .Values.oidc.existingClientSecretKey }} + {{- else }} + value: {{ .Values.oidc.clientSecret }} + {{- end }} + - name: MINIO_IDENTITY_OPENID_CLAIM_NAME + value: {{ .Values.oidc.claimName }} + - name: MINIO_IDENTITY_OPENID_CLAIM_PREFIX + value: {{ .Values.oidc.claimPrefix }} + - name: MINIO_IDENTITY_OPENID_SCOPES + value: {{ .Values.oidc.scopes }} + - name: MINIO_IDENTITY_OPENID_COMMENT + value: {{ .Values.oidc.comment }} + - name: MINIO_IDENTITY_OPENID_REDIRECT_URI + value: {{ .Values.oidc.redirectUri }} + - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME + value: {{ .Values.oidc.displayName }} + {{- end }} + {{- if .Values.etcd.endpoints }} + - name: MINIO_ETCD_ENDPOINTS + value: {{ join "," .Values.etcd.endpoints | quote }} + {{- if .Values.etcd.clientCert }} + - name: MINIO_ETCD_CLIENT_CERT + value: "/tmp/credentials/etcd_client_cert.pem" + {{- end }} + {{- if .Values.etcd.clientCertKey }} + - name: MINIO_ETCD_CLIENT_CERT_KEY + value: "/tmp/credentials/etcd_client_cert_key.pem" + {{- end }} + {{- if .Values.etcd.pathPrefix }} + - name: MINIO_ETCD_PATH_PREFIX + value: {{ .Values.etcd.pathPrefix }} + {{- end }} + {{- if .Values.etcd.corednsPathPrefix }} + - name: MINIO_ETCD_COREDNS_PATH + value: {{ .Values.etcd.corednsPathPrefix }} + {{- end }} + {{- end }} + {{- range $key, $val := .Values.environment }} + - name: {{ $key }} + value: {{ tpl $val $ | quote }} + {{- end }} + resources: {{- toYaml .Values.resources | nindent 12 }} + {{- if and .Values.securityContext.enabled .Values.persistence.enabled }} + {{- with .Values.containerSecurityContext }} + securityContext: {{ toYaml . | nindent 12}} + {{- end }} + {{- end }} + {{- with .Values.extraContainers }} + {{- if eq (typeOf .) "string" }} + {{- tpl . $ | nindent 8 }} + {{- else }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: {{- toYaml . | nindent 8 }} + {{- end }} + {{- include "minio.imagePullSecrets" . | indent 6 }} + {{- with .Values.affinity }} + affinity: {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: {{- toYaml . | nindent 8 }} + {{- end }} + volumes: + - name: export + {{- if .Values.persistence.enabled }} + persistentVolumeClaim: + claimName: {{ .Values.persistence.existingClaim | default (include "minio.fullname" .) }} + {{- else }} + emptyDir: {} + {{- end }} + {{- if .Values.extraSecret }} + - name: extra-secret + secret: + secretName: {{ .Values.extraSecret }} + {{- end }} + - name: minio-user + secret: + secretName: {{ template "minio.secretName" . }} + {{- include "minio.tlsKeysVolume" . | indent 8 }} + {{- if .Values.extraVolumes }} + {{ toYaml .Values.extraVolumes | nindent 8 }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/ingress.yaml b/charts/devtron-utilities/charts/minio/templates/ingress.yaml new file mode 100644 index 000000000..1a564c6bc --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/ingress.yaml @@ -0,0 +1,55 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "minio.fullname" . -}} +{{- $servicePort := .Values.service.port -}} +{{- $ingressPath := .Values.ingress.path -}} +apiVersion: {{ template "minio.ingress.apiVersion" . }} +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- with .Values.ingress.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.ingress.annotations }} + annotations: {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if .Values.ingress.ingressClassName }} + ingressClassName: {{ .Values.ingress.ingressClassName }} + {{- end }} + {{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.ingress.hosts }} + - http: + paths: + - path: {{ $ingressPath }} + {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} + pathType: Prefix + backend: + service: + name: {{ $fullName }} + port: + number: {{ $servicePort }} + {{- else }} + backend: + serviceName: {{ $fullName }} + servicePort: {{ $servicePort }} + {{- end }} + {{- if . }} + host: {{ tpl . $ | quote }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/networkpolicy.yaml b/charts/devtron-utilities/charts/minio/templates/networkpolicy.yaml new file mode 100644 index 000000000..b9c077171 --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/networkpolicy.yaml @@ -0,0 +1,26 @@ +{{- if and (.Values.networkPolicy.enabled) (eq .Values.networkPolicy.flavor "kubernetes") }} +kind: NetworkPolicy +apiVersion: {{ template "minio.networkPolicy.apiVersion" . }} +metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + podSelector: + matchLabels: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} + ingress: + - ports: + - port: {{ .Values.minioAPIPort }} + - port: {{ .Values.minioConsolePort }} + {{- if not .Values.networkPolicy.allowExternal }} + from: + - podSelector: + matchLabels: + {{ template "minio.name" . }}-client: "true" + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/poddisruptionbudget.yaml b/charts/devtron-utilities/charts/minio/templates/poddisruptionbudget.yaml new file mode 100644 index 000000000..a5f90a080 --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/poddisruptionbudget.yaml @@ -0,0 +1,17 @@ +{{- if .Values.podDisruptionBudget.enabled }} +{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodDisruptionBudget" }} +apiVersion: policy/v1beta1 +{{- else }} +apiVersion: policy/v1 +{{- end }} +kind: PodDisruptionBudget +metadata: + name: minio + labels: + app: {{ template "minio.name" . }} +spec: + maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }} + selector: + matchLabels: + app: {{ template "minio.name" . }} +{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/post-job.yaml b/charts/devtron-utilities/charts/minio/templates/post-job.yaml new file mode 100644 index 000000000..955d6558c --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/post-job.yaml @@ -0,0 +1,258 @@ +{{- if or .Values.buckets .Values.users .Values.policies .Values.customCommands .Values.svcaccts }} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ template "minio.fullname" . }}-post-job + labels: + app: {{ template "minio.name" . }}-post-job + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + annotations: + "helm.sh/hook": post-install,post-upgrade + "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation + {{- with .Values.postJob.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + template: + metadata: + labels: + app: {{ template "minio.name" . }}-job + release: {{ .Release.Name }} + {{- if .Values.podLabels }} + {{- toYaml .Values.podLabels | nindent 8 }} + {{- end }} + {{- if .Values.postJob.podAnnotations }} + annotations: {{- toYaml .Values.postJob.podAnnotations | nindent 8 }} + {{- end }} + spec: + restartPolicy: OnFailure + {{- include "minio.imagePullSecrets" . | indent 6 }} + {{- if .Values.nodeSelector }} + nodeSelector: {{- toYaml .Values.postJob.nodeSelector | nindent 8 }} + {{- end }} + {{- with .Values.postJob.affinity }} + affinity: {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.postJob.tolerations }} + tolerations: {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.postJob.securityContext.enabled }} + securityContext: {{ omit .Values.postJob.securityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + volumes: + - name: etc-path + emptyDir: {} + - name: tmp + emptyDir: {} + - name: minio-configuration + projected: + sources: + - configMap: + name: {{ template "minio.fullname" . }} + - secret: + name: {{ template "minio.secretName" . }} + {{- range (concat .Values.users (default (list) .Values.svcaccts)) }} + {{- if .existingSecret }} + - secret: + name: {{ tpl .existingSecret $ }} + items: + - key: {{ .existingSecretKey }} + path: secrets/{{ tpl .existingSecret $ }}/{{ tpl .existingSecretKey $ }} + {{- end }} + {{- end }} + {{- range ( default list .Values.svcaccts ) }} + {{- if .existingSecret }} + - secret: + name: {{ tpl .existingSecret $ }} + items: + - key: {{ .existingSecretKey }} + path: secrets-svc/{{ tpl .existingSecret $ }}/{{ tpl .existingSecretKey $ }} + {{- end }} + {{- end }} + {{- if .Values.tls.enabled }} + - name: cert-secret-volume-mc + secret: + secretName: {{ .Values.tls.certSecret }} + items: + - key: {{ .Values.tls.publicCrt }} + path: CAs/public.crt + {{- end }} + {{- if .Values.customCommandJob.extraVolumes }} + {{- toYaml .Values.customCommandJob.extraVolumes | nindent 8 }} + {{- end }} + {{- if .Values.serviceAccount.create }} + serviceAccountName: {{ .Values.serviceAccount.name }} + {{- end }} + {{- if .Values.policies }} + initContainers: + - name: minio-make-policy + image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" + {{- if .Values.makePolicyJob.securityContext.enabled }} + {{- with .Values.makePolicyJob.containerSecurityContext }} + securityContext: {{ toYaml . | nindent 12 }} + {{- end }} + {{- end }} + imagePullPolicy: {{ .Values.mcImage.pullPolicy }} + {{- if .Values.makePolicyJob.exitCommand }} + command: [ "/bin/sh", "-c" ] + args: [ "/bin/sh /config/add-policy; EV=$?; {{ .Values.makePolicyJob.exitCommand }} && exit $EV" ] + {{- else }} + command: [ "/bin/sh", "/config/add-policy" ] + {{- end }} + env: + - name: MINIO_ENDPOINT + value: {{ template "minio.fullname" . }} + - name: MINIO_PORT + value: {{ .Values.service.port | quote }} + volumeMounts: + - name: etc-path + mountPath: /etc/minio/mc + - name: tmp + mountPath: /tmp + - name: minio-configuration + mountPath: /config + {{- if .Values.tls.enabled }} + - name: cert-secret-volume-mc + mountPath: {{ .Values.configPathmc }}certs + {{- end }} + resources: {{- toYaml .Values.makePolicyJob.resources | nindent 12 }} + {{- end }} + containers: + {{- if .Values.buckets }} + - name: minio-make-bucket + image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" + {{- if .Values.makeBucketJob.securityContext.enabled }} + {{- with .Values.makeBucketJob.containerSecurityContext }} + securityContext: {{ toYaml . | nindent 12 }} + {{- end }} + {{- end }} + imagePullPolicy: {{ .Values.mcImage.pullPolicy }} + {{- if .Values.makeBucketJob.exitCommand }} + command: [ "/bin/sh", "-c" ] + args: [ "/bin/sh /config/initialize; EV=$?; {{ .Values.makeBucketJob.exitCommand }} && exit $EV" ] + {{- else }} + command: [ "/bin/sh", "/config/initialize" ] + {{- end }} + env: + - name: MINIO_ENDPOINT + value: {{ template "minio.fullname" . }} + - name: MINIO_PORT + value: {{ .Values.service.port | quote }} + volumeMounts: + - name: etc-path + mountPath: /etc/minio/mc + - name: tmp + mountPath: /tmp + - name: minio-configuration + mountPath: /config + {{- if .Values.tls.enabled }} + - name: cert-secret-volume-mc + mountPath: {{ .Values.configPathmc }}certs + {{- end }} + resources: {{- toYaml .Values.makeBucketJob.resources | nindent 12 }} + {{- end }} + {{- if .Values.users }} + - name: minio-make-user + image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" + {{- if .Values.makeUserJob.securityContext.enabled }} + {{- with .Values.makeUserJob.containerSecurityContext }} + securityContext: {{ toYaml . | nindent 12 }} + {{- end }} + {{- end }} + imagePullPolicy: {{ .Values.mcImage.pullPolicy }} + {{- if .Values.makeUserJob.exitCommand }} + command: [ "/bin/sh", "-c" ] + args: [ "/bin/sh /config/add-user; EV=$?; {{ .Values.makeUserJob.exitCommand }} && exit $EV" ] + {{- else }} + command: [ "/bin/sh", "/config/add-user" ] + {{- end }} + env: + - name: MINIO_ENDPOINT + value: {{ template "minio.fullname" . }} + - name: MINIO_PORT + value: {{ .Values.service.port | quote }} + volumeMounts: + - name: etc-path + mountPath: /etc/minio/mc + - name: tmp + mountPath: /tmp + - name: minio-configuration + mountPath: /config + {{- if .Values.tls.enabled }} + - name: cert-secret-volume-mc + mountPath: {{ .Values.configPathmc }}certs + {{- end }} + resources: {{- toYaml .Values.makeUserJob.resources | nindent 12 }} + {{- end }} + {{- if .Values.customCommands }} + - name: minio-custom-command + image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" + {{- if .Values.customCommandJob.securityContext.enabled }} + {{- with .Values.customCommandJob.containerSecurityContext }} + securityContext: {{ toYaml . | nindent 12 }} + {{- end }} + {{- end }} + imagePullPolicy: {{ .Values.mcImage.pullPolicy }} + {{- if .Values.customCommandJob.exitCommand }} + command: [ "/bin/sh", "-c" ] + args: [ "/bin/sh /config/custom-command; EV=$?; {{ .Values.customCommandJob.exitCommand }} && exit $EV" ] + {{- else }} + command: [ "/bin/sh", "/config/custom-command" ] + {{- end }} + env: + - name: MINIO_ENDPOINT + value: {{ template "minio.fullname" . }} + - name: MINIO_PORT + value: {{ .Values.service.port | quote }} + volumeMounts: + - name: etc-path + mountPath: /etc/minio/mc + - name: tmp + mountPath: /tmp + - name: minio-configuration + mountPath: /config + {{- if .Values.tls.enabled }} + - name: cert-secret-volume-mc + mountPath: {{ .Values.configPathmc }}certs + {{- end }} + {{- if .Values.customCommandJob.extraVolumeMounts }} + {{- toYaml .Values.customCommandJob.extraVolumeMounts | nindent 12 }} + {{- end }} + resources: {{- toYaml .Values.customCommandJob.resources | nindent 12 }} + {{- end }} + {{- if .Values.svcaccts }} + - name: minio-make-svcacct + image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" + {{- if .Values.makeServiceAccountJob.securityContext.enabled }} + {{- with .Values.makeServiceAccountJob.containerSecurityContext }} + securityContext: {{ toYaml . | nindent 12 }} + {{- end }} + {{- end }} + imagePullPolicy: {{ .Values.mcImage.pullPolicy }} + {{- if .Values.makeServiceAccountJob.exitCommand }} + command: [ "/bin/sh", "-c" ] + args: ["/bin/sh /config/add-svcacct; EV=$?; {{ .Values.makeServiceAccountJob.exitCommand }} && exit $EV" ] + {{- else }} + command: ["/bin/sh", "/config/add-svcacct"] + {{- end }} + env: + - name: MINIO_ENDPOINT + value: {{ template "minio.fullname" . }} + - name: MINIO_PORT + value: {{ .Values.service.port | quote }} + volumeMounts: + - name: etc-path + mountPath: /etc/minio/mc + - name: tmp + mountPath: /tmp + - name: minio-configuration + mountPath: /config + {{- if .Values.tls.enabled }} + - name: cert-secret-volume-mc + mountPath: {{ .Values.configPathmc }}certs + {{- end }} + resources: {{- toYaml .Values.makeServiceAccountJob.resources | nindent 12 }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/pvc.yaml b/charts/devtron-utilities/charts/minio/templates/pvc.yaml new file mode 100644 index 000000000..60f5267b0 --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/pvc.yaml @@ -0,0 +1,32 @@ +{{- if eq .Values.mode "standalone" }} +{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }} +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.persistence.annotations }} + annotations: {{- toYaml .Values.persistence.annotations | nindent 4 }} + {{- end }} +spec: + accessModes: + - {{ .Values.persistence.accessMode | quote }} + resources: + requests: + storage: {{ .Values.persistence.size | quote }} + {{- if .Values.persistence.storageClass }} + {{- if (eq "-" .Values.persistence.storageClass) }} + storageClassName: "" + {{- else }} + storageClassName: "{{ .Values.persistence.storageClass }}" + {{- end }} + {{- end }} + {{- if .Values.persistence.volumeName }} + volumeName: "{{ .Values.persistence.volumeName }}" + {{- end }} +{{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/secrets.yaml b/charts/devtron-utilities/charts/minio/templates/secrets.yaml new file mode 100644 index 000000000..476c3da51 --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/secrets.yaml @@ -0,0 +1,21 @@ +{{- if not .Values.existingSecret }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "minio.secretName" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +type: Opaque +data: + rootUser: {{ include "minio.root.username" . | b64enc | quote }} + rootPassword: {{ include "minio.root.password" . | b64enc | quote }} + {{- if .Values.etcd.clientCert }} + etcd_client.crt: {{ .Values.etcd.clientCert | toString | b64enc | quote }} + {{- end }} + {{- if .Values.etcd.clientCertKey }} + etcd_client.key: {{ .Values.etcd.clientCertKey | toString | b64enc | quote }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/securitycontextconstraints.yaml b/charts/devtron-utilities/charts/minio/templates/securitycontextconstraints.yaml new file mode 100644 index 000000000..4bac7e372 --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/securitycontextconstraints.yaml @@ -0,0 +1,45 @@ +{{- if and .Values.securityContext.enabled .Values.persistence.enabled (.Capabilities.APIVersions.Has "security.openshift.io/v1") }} +apiVersion: security.openshift.io/v1 +kind: SecurityContextConstraints +metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +allowHostDirVolumePlugin: false +allowHostIPC: false +allowHostNetwork: false +allowHostPID: false +allowHostPorts: false +allowPrivilegeEscalation: true +allowPrivilegedContainer: false +allowedCapabilities: [] +readOnlyRootFilesystem: false +defaultAddCapabilities: [] +requiredDropCapabilities: +- KILL +- MKNOD +- SETUID +- SETGID +fsGroup: + type: MustRunAs + ranges: + - max: {{ .Values.securityContext.fsGroup }} + min: {{ .Values.securityContext.fsGroup }} +runAsUser: + type: MustRunAs + uid: {{ .Values.securityContext.runAsUser }} +seLinuxContext: + type: MustRunAs +supplementalGroups: + type: RunAsAny +volumes: +- configMap +- downwardAPI +- emptyDir +- persistentVolumeClaim +- projected +- secret +{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/service.yaml b/charts/devtron-utilities/charts/minio/templates/service.yaml new file mode 100644 index 000000000..d872cd07a --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/service.yaml @@ -0,0 +1,46 @@ +{{ $scheme := .Values.tls.enabled | ternary "https" "http" }} +apiVersion: v1 +kind: Service +metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + monitoring: "true" + {{- if .Values.service.annotations }} + annotations: {{- toYaml .Values.service.annotations | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.service.type }} + {{- if and (eq .Values.service.type "ClusterIP") .Values.service.clusterIP }} + clusterIP: {{ .Values.service.clusterIP }} + {{- end }} + {{- if or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "NodePort") }} + externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy | quote }} + {{- end }} + {{- if and (eq .Values.service.type "LoadBalancer") .Values.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: {{ .Values.service.loadBalancerSourceRanges }} + {{ end }} + {{- if and (eq .Values.service.type "LoadBalancer") (not (empty .Values.service.loadBalancerIP)) }} + loadBalancerIP: {{ default "" .Values.service.loadBalancerIP | quote }} + {{- end }} + ports: + - name: {{ $scheme }} + port: {{ .Values.service.port }} + protocol: TCP + {{- if (and (eq .Values.service.type "NodePort") ( .Values.service.nodePort)) }} + nodePort: {{ .Values.service.nodePort }} + {{- else }} + targetPort: {{ .Values.minioAPIPort }} + {{- end }} + {{- if .Values.service.externalIPs }} + externalIPs: + {{- range $i , $ip := .Values.service.externalIPs }} + - {{ $ip }} + {{- end }} + {{- end }} + selector: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} diff --git a/charts/devtron-utilities/charts/minio/templates/serviceaccount.yaml b/charts/devtron-utilities/charts/minio/templates/serviceaccount.yaml new file mode 100644 index 000000000..07840153d --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/serviceaccount.yaml @@ -0,0 +1,6 @@ +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ .Values.serviceAccount.name | quote }} +{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/servicemonitor.yaml b/charts/devtron-utilities/charts/minio/templates/servicemonitor.yaml new file mode 100644 index 000000000..f875a850e --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/servicemonitor.yaml @@ -0,0 +1,112 @@ +{{- if and .Values.metrics.serviceMonitor.enabled .Values.metrics.serviceMonitor.includeNode }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ template "minio.fullname" . }} + {{- if .Values.metrics.serviceMonitor.namespace }} + namespace: {{ .Values.metrics.serviceMonitor.namespace }} + {{- end }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.metrics.serviceMonitor.additionalLabels }} + {{- toYaml .Values.metrics.serviceMonitor.additionalLabels | nindent 4 }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.annotations }} + annotations: {{- toYaml .Values.metrics.serviceMonitor.annotations | nindent 4 }} + {{- end }} +spec: + endpoints: + {{- if .Values.tls.enabled }} + - port: https + scheme: https + tlsConfig: + ca: + secret: + name: {{ .Values.tls.certSecret }} + key: {{ .Values.tls.publicCrt }} + serverName: {{ template "minio.fullname" . }} + {{- else }} + - port: http + scheme: http + {{- end }} + path: /minio/v2/metrics/node + {{- if .Values.metrics.serviceMonitor.interval }} + interval: {{ .Values.metrics.serviceMonitor.interval }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} + scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.relabelConfigs }} + {{- toYaml .Values.metrics.serviceMonitor.relabelConfigs | nindent 6 }} + {{- end }} + {{- if not .Values.metrics.serviceMonitor.public }} + bearerTokenSecret: + name: {{ template "minio.fullname" . }}-prometheus + key: token + {{- end }} + namespaceSelector: + matchNames: + - {{ .Release.Namespace | quote }} + selector: + matchLabels: + app: {{ include "minio.name" . }} + release: {{ .Release.Name }} + monitoring: "true" +{{- end }} +{{- if .Values.metrics.serviceMonitor.enabled }} +--- +apiVersion: monitoring.coreos.com/v1 +kind: Probe +metadata: + name: {{ template "minio.fullname" . }}-cluster + {{- if .Values.metrics.serviceMonitor.namespace }} + namespace: {{ .Values.metrics.serviceMonitor.namespace }} + {{- end }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.metrics.serviceMonitor.additionalLabels }} + {{- toYaml .Values.metrics.serviceMonitor.additionalLabels | nindent 4 }} + {{- end }} +spec: + jobName: {{ template "minio.fullname" . }} + {{- if .Values.tls.enabled }} + tlsConfig: + ca: + secret: + name: {{ .Values.tls.certSecret }} + key: {{ .Values.tls.publicCrt }} + serverName: {{ template "minio.fullname" . }} + {{- end }} + prober: + url: {{ template "minio.fullname" . }}.{{ .Release.Namespace }}:{{ .Values.service.port }} + path: /minio/v2/metrics/cluster + {{- if .Values.tls.enabled }} + scheme: https + {{- else }} + scheme: http + {{- end }} + {{- if .Values.metrics.serviceMonitor.relabelConfigsCluster }} + {{- toYaml .Values.metrics.serviceMonitor.relabelConfigsCluster | nindent 2 }} + {{- end }} + targets: + staticConfig: + static: + - {{ template "minio.fullname" . }}.{{ .Release.Namespace }} + {{- if not .Values.metrics.serviceMonitor.public }} + {{- if .Values.metrics.serviceMonitor.interval }} + interval: {{ .Values.metrics.serviceMonitor.interval }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} + scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} + {{- end }} + bearerTokenSecret: + name: {{ template "minio.fullname" . }}-prometheus + key: token + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/statefulset.yaml b/charts/devtron-utilities/charts/minio/templates/statefulset.yaml new file mode 100644 index 000000000..d671eaaf4 --- /dev/null +++ b/charts/devtron-utilities/charts/minio/templates/statefulset.yaml @@ -0,0 +1,267 @@ +{{- if eq .Values.mode "distributed" }} +{{ $poolCount := .Values.pools | int }} +{{ $nodeCount := .Values.replicas | int }} +{{ $replicas := mul $poolCount $nodeCount }} +{{ $drivesPerNode := .Values.drivesPerNode | int }} +{{ $scheme := .Values.tls.enabled | ternary "https" "http" }} +{{ $mountPath := .Values.mountPath }} +{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }} +{{ $subPath := .Values.persistence.subPath }} +{{ $penabled := .Values.persistence.enabled }} +{{ $accessMode := .Values.persistence.accessMode }} +{{ $storageClass := .Values.persistence.storageClass }} +{{ $psize := .Values.persistence.size }} +apiVersion: v1 +kind: Service +metadata: + name: {{ template "minio.fullname" . }}-svc + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + publishNotReadyAddresses: true + clusterIP: None + ports: + - name: {{ $scheme }} + port: {{ .Values.service.port }} + protocol: TCP + targetPort: {{ .Values.minioAPIPort }} + selector: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} +--- +apiVersion: {{ template "minio.statefulset.apiVersion" . }} +kind: StatefulSet +metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.additionalLabels }} + {{- toYaml .Values.additionalLabels | nindent 4 }} + {{- end }} + {{- if .Values.additionalAnnotations }} + annotations: {{- toYaml .Values.additionalAnnotations | nindent 4 }} + {{- end }} +spec: + updateStrategy: + type: {{ .Values.statefulSetUpdate.updateStrategy }} + podManagementPolicy: "Parallel" + serviceName: {{ template "minio.fullname" . }}-svc + replicas: {{ $replicas }} + selector: + matchLabels: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} + template: + metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} + {{- if .Values.podLabels }} + {{- toYaml .Values.podLabels | nindent 8 }} + {{- end }} + annotations: + {{- if not .Values.ignoreChartChecksums }} + checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} + checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + {{- end }} + {{- if .Values.podAnnotations }} + {{- toYaml .Values.podAnnotations | nindent 8 }} + {{- end }} + spec: + {{- if .Values.priorityClassName }} + priorityClassName: "{{ .Values.priorityClassName }}" + {{- end }} + {{- if .Values.runtimeClassName }} + runtimeClassName: "{{ .Values.runtimeClassName }}" + {{- end }} + {{- if and .Values.securityContext.enabled .Values.persistence.enabled }} + securityContext: + {{- omit .Values.securityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + {{- if .Values.serviceAccount.create }} + serviceAccountName: {{ .Values.serviceAccount.name }} + {{- end }} + containers: + - name: {{ .Chart.Name }} + image: {{ .Values.image.repository }}:{{ .Values.image.tag }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + command: [ + "/bin/sh", + "-ce", + "/usr/bin/docker-entrypoint.sh minio server {{- range $i := until $poolCount }}{{ $factor := mul $i $nodeCount }}{{ $endIndex := add $factor $nodeCount }}{{ $beginIndex := mul $i $nodeCount }} {{ $scheme }}://{{ template `minio.fullname` $ }}-{{ `{` }}{{ $beginIndex }}...{{ sub $endIndex 1 }}{{ `}`}}.{{ template `minio.fullname` $ }}-svc.{{ $.Release.Namespace }}.svc{{if (gt $drivesPerNode 1)}}{{ $bucketRoot }}-{{ `{` }}0...{{ sub $drivesPerNode 1 }}{{ `}` }}{{ else }}{{ $bucketRoot }}{{end }}{{- end }} -S {{ .Values.certsPath }} --address :{{ .Values.minioAPIPort }} --console-address :{{ .Values.minioConsolePort }} {{- template `minio.extraArgs` . }}" + ] + volumeMounts: + {{- if $penabled }} + {{- if (gt $drivesPerNode 1) }} + {{- range $i := until $drivesPerNode }} + - name: export-{{ $i }} + mountPath: {{ $mountPath }}-{{ $i }} + {{- if and $penabled $subPath }} + subPath: {{ $subPath }} + {{- end }} + {{- end }} + {{- else }} + - name: export + mountPath: {{ $mountPath }} + {{- if and $penabled $subPath }} + subPath: {{ $subPath }} + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.extraSecret }} + - name: extra-secret + mountPath: "/tmp/minio-config-env" + {{- end }} + {{- include "minio.tlsKeysVolumeMount" . | indent 12 }} + {{- if .Values.extraVolumeMounts }} + {{- toYaml .Values.extraVolumeMounts | nindent 12 }} + {{- end }} + ports: + - name: {{ $scheme }} + containerPort: {{ .Values.minioAPIPort }} + - name: {{ $scheme }}-console + containerPort: {{ .Values.minioConsolePort }} + env: + - name: MINIO_ROOT_USER + valueFrom: + secretKeyRef: + name: {{ template "minio.secretName" . }} + key: rootUser + - name: MINIO_ROOT_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "minio.secretName" . }} + key: rootPassword + {{- if .Values.extraSecret }} + - name: MINIO_CONFIG_ENV_FILE + value: "/tmp/minio-config-env/config.env" + {{- end }} + {{- if .Values.metrics.serviceMonitor.public }} + - name: MINIO_PROMETHEUS_AUTH_TYPE + value: "public" + {{- end }} + {{- if .Values.oidc.enabled }} + - name: MINIO_IDENTITY_OPENID_CONFIG_URL + value: {{ .Values.oidc.configUrl }} + - name: MINIO_IDENTITY_OPENID_CLIENT_ID + {{- if and .Values.oidc.existingClientSecretName .Values.oidc.existingClientIdKey }} + valueFrom: + secretKeyRef: + name: {{ .Values.oidc.existingClientSecretName }} + key: {{ .Values.oidc.existingClientIdKey }} + {{- else }} + value: {{ .Values.oidc.clientId }} + {{- end }} + - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET + {{- if and .Values.oidc.existingClientSecretName .Values.oidc.existingClientSecretKey }} + valueFrom: + secretKeyRef: + name: {{ .Values.oidc.existingClientSecretName }} + key: {{ .Values.oidc.existingClientSecretKey }} + {{- else }} + value: {{ .Values.oidc.clientSecret }} + {{- end }} + - name: MINIO_IDENTITY_OPENID_CLAIM_NAME + value: {{ .Values.oidc.claimName }} + - name: MINIO_IDENTITY_OPENID_CLAIM_PREFIX + value: {{ .Values.oidc.claimPrefix }} + - name: MINIO_IDENTITY_OPENID_SCOPES + value: {{ .Values.oidc.scopes }} + - name: MINIO_IDENTITY_OPENID_COMMENT + value: {{ .Values.oidc.comment }} + - name: MINIO_IDENTITY_OPENID_REDIRECT_URI + value: {{ .Values.oidc.redirectUri }} + - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME + value: {{ .Values.oidc.displayName }} + {{- end }} + {{- range $key, $val := .Values.environment }} + - name: {{ $key }} + value: {{ tpl $val $ | quote }} + {{- end }} + resources: {{- toYaml .Values.resources | nindent 12 }} + {{- if and .Values.securityContext.enabled .Values.persistence.enabled }} + {{- with .Values.containerSecurityContext }} + securityContext: {{ toYaml . | nindent 12}} + {{- end }} + {{- end }} + {{- with .Values.extraContainers }} + {{- if eq (typeOf .) "string" }} + {{- tpl . $ | nindent 8 }} + {{- else }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: {{- toYaml . | nindent 8 }} + {{- end }} + {{- include "minio.imagePullSecrets" . | indent 6 }} + {{- with .Values.affinity }} + affinity: {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: {{- toYaml . | nindent 8 }} + {{- end }} + {{- if and (gt $replicas 1) (ge .Capabilities.KubeVersion.Major "1") (ge .Capabilities.KubeVersion.Minor "19") }} + {{- with .Values.topologySpreadConstraints }} + topologySpreadConstraints: {{- toYaml . | nindent 8 }} + {{- end }} + {{- end }} + volumes: + - name: minio-user + secret: + secretName: {{ template "minio.secretName" . }} + {{- if .Values.extraSecret }} + - name: extra-secret + secret: + secretName: {{ .Values.extraSecret }} + {{- end }} + {{- include "minio.tlsKeysVolume" . | indent 8 }} + {{- if .Values.extraVolumes }} + {{- toYaml .Values.extraVolumes | nindent 8 }} + {{- end }} + {{- if .Values.persistence.enabled }} + volumeClaimTemplates: + {{- if gt $drivesPerNode 1 }} + {{- range $diskId := until $drivesPerNode}} + - apiVersion: v1 + kind: PersistentVolumeClaim + metadata: + name: export-{{ $diskId }} + {{- if $.Values.persistence.annotations }} + annotations: {{- toYaml $.Values.persistence.annotations | nindent 10 }} + {{- end }} + spec: + accessModes: [ {{ $accessMode | quote }} ] + {{- if $storageClass }} + storageClassName: {{ $storageClass }} + {{- end }} + resources: + requests: + storage: {{ $psize }} + {{- end }} + {{- else }} + - apiVersion: v1 + kind: PersistentVolumeClaim + metadata: + name: export + {{- if $.Values.persistence.annotations }} + annotations: {{- toYaml $.Values.persistence.annotations | nindent 10 }} + {{- end }} + spec: + accessModes: [ {{ $accessMode | quote }} ] + {{- if $storageClass }} + storageClassName: {{ $storageClass }} + {{- end }} + resources: + requests: + storage: {{ $psize }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/devtron-utilities/charts/minio/values.yaml b/charts/devtron-utilities/charts/minio/values.yaml new file mode 100644 index 000000000..4c9714ea9 --- /dev/null +++ b/charts/devtron-utilities/charts/minio/values.yaml @@ -0,0 +1,593 @@ +## Provide a name in place of minio for `app:` labels +## +nameOverride: "" + +## Provide a name to substitute for the full names of resources +## +fullnameOverride: "" + +## set kubernetes cluster domain where minio is running +## +clusterDomain: cluster.local + +## Set default image, imageTag, and imagePullPolicy. mode is used to indicate the +## +image: + repository: quay.io/minio/minio + tag: RELEASE.2024-12-18T13-15-44Z + pullPolicy: IfNotPresent + +imagePullSecrets: [] +# - name: "image-pull-secret" + +## Set default image, imageTag, and imagePullPolicy for the `mc` (the minio +## client used to create a default bucket). +## +mcImage: + repository: quay.io/minio/mc + tag: RELEASE.2024-11-21T17-21-54Z + pullPolicy: IfNotPresent + +## minio mode, i.e. standalone or distributed +mode: distributed ## other supported values are "standalone" + +## Additional labels to include with deployment or statefulset +additionalLabels: {} + +## Additional annotations to include with deployment or statefulset +additionalAnnotations: {} + +## Typically the deployment/statefulset includes checksums of secrets/config, +## So that when these change on a subsequent helm install, the deployment/statefulset +## is restarted. This can result in unnecessary restarts under GitOps tooling such as +## flux, so set to "true" to disable this behaviour. +ignoreChartChecksums: false + +## Additional arguments to pass to minio binary +extraArgs: [] +# example for enabling FTP: +# - --ftp=\"address=:8021\" +# - --ftp=\"passive-port-range=10000-10010\" + +## Additional volumes to minio container +extraVolumes: [] + +## Additional volumeMounts to minio container +extraVolumeMounts: [] + +## Additional sidecar containers +extraContainers: [] + +## Internal port number for MinIO S3 API container +## Change service.port to change external port number +minioAPIPort: "9000" + +## Internal port number for MinIO Browser Console container +## Change consoleService.port to change external port number +minioConsolePort: "9001" + +## Update strategy for Deployments +deploymentUpdate: + type: RollingUpdate + maxUnavailable: 0 + maxSurge: 100% + +## Update strategy for StatefulSets +statefulSetUpdate: + updateStrategy: RollingUpdate + +## Pod priority settings +## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ +## +priorityClassName: "" + +## Pod runtime class name +## ref https://kubernetes.io/docs/concepts/containers/runtime-class/ +## +runtimeClassName: "" + +## Set default rootUser, rootPassword +## rootUser and rootPassword is generated when not set +## Distributed MinIO ref: https://min.io/docs/minio/linux/operations/install-deploy-manage/deploy-minio-multi-node-multi-drive.html +## +rootUser: "" +rootPassword: "" + +## Use existing Secret that store following variables: +## +## | Chart var | .data. in Secret | +## |:----------------------|:-------------------------| +## | rootUser | rootUser | +## | rootPassword | rootPassword | +## +## All mentioned variables will be ignored in values file. +## .data.rootUser and .data.rootPassword are mandatory, +## others depend on enabled status of corresponding sections. +existingSecret: "" + +## Directory on the MinIO pof +certsPath: "/etc/minio/certs/" +configPathmc: "/etc/minio/mc/" + +## Path where PV would be mounted on the MinIO Pod +mountPath: "/export" +## Override the root directory which the minio server should serve from. +## If left empty, it defaults to the value of {{ .Values.mountPath }} +## If defined, it must be a sub-directory of the path specified in {{ .Values.mountPath }} +## +bucketRoot: "" + +# Number of drives attached to a node +drivesPerNode: 1 +# Number of MinIO containers running +replicas: 16 +# Number of expanded MinIO clusters +pools: 1 + +## TLS Settings for MinIO +tls: + enabled: false + ## Create a secret with private.key and public.crt files and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret + certSecret: "" + publicCrt: public.crt + privateKey: private.key + +## Trusted Certificates Settings for MinIO. Ref: https://min.io/docs/minio/linux/operations/network-encryption.html#third-party-certificate-authorities +## Bundle multiple trusted certificates into one secret and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret +## When using self-signed certificates, remember to include MinIO's own certificate in the bundle with key public.crt. +## If certSecret is left empty and tls is enabled, this chart installs the public certificate from .Values.tls.certSecret. +trustedCertsSecret: "" + +## Enable persistence using Persistent Volume Claims +## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ +## +persistence: + enabled: true + annotations: {} + + ## A manually managed Persistent Volume and Claim + ## Requires persistence.enabled: true + ## If defined, PVC must be created manually before volume will be bound + existingClaim: "" + + ## minio data Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + ## Storage class of PV to bind. By default it looks for standard storage class. + ## If the PV uses a different storage class, specify that here. + storageClass: "" + volumeName: "" + accessMode: ReadWriteOnce + size: 500Gi + + ## If subPath is set mount a sub folder of a volume instead of the root of the volume. + ## This is especially handy for volume plugins that don't natively support sub mounting (like glusterfs). + ## + subPath: "" + +## Expose the MinIO service to be accessed from outside the cluster (LoadBalancer service). +## or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it. +## ref: http://kubernetes.io/docs/user-guide/services/ +## +service: + type: ClusterIP + clusterIP: ~ + port: "9000" + nodePort: 32000 + loadBalancerIP: ~ + externalIPs: [] + annotations: {} + + ## service.loadBalancerSourceRanges Addresses that are allowed when service is LoadBalancer + ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service + ## + #loadBalancerSourceRanges: + # - 10.10.10.0/24 + loadBalancerSourceRanges: [] + + ## service.externalTrafficPolicy minio service external traffic policy + ## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## + externalTrafficPolicy: Cluster + +## Configure Ingress based on the documentation here: https://kubernetes.io/docs/concepts/services-networking/ingress/ +## + +ingress: + enabled: false + ingressClassName: ~ + labels: {} + # node-role.kubernetes.io/ingress: platform + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + # kubernetes.io/ingress.allow-http: "false" + # kubernetes.io/ingress.global-static-ip-name: "" + # nginx.ingress.kubernetes.io/secure-backends: "true" + # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" + # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0 + path: / + hosts: + - minio-example.local + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +consoleService: + type: ClusterIP + clusterIP: ~ + port: "9001" + nodePort: 32001 + loadBalancerIP: ~ + externalIPs: [] + annotations: {} + ## consoleService.loadBalancerSourceRanges Addresses that are allowed when service is LoadBalancer + ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service + ## + #loadBalancerSourceRanges: + # - 10.10.10.0/24 + loadBalancerSourceRanges: [] + + ## servconsoleServiceice.externalTrafficPolicy minio service external traffic policy + ## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## + externalTrafficPolicy: Cluster + +consoleIngress: + enabled: false + ingressClassName: ~ + labels: {} + # node-role.kubernetes.io/ingress: platform + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + # kubernetes.io/ingress.allow-http: "false" + # kubernetes.io/ingress.global-static-ip-name: "" + # nginx.ingress.kubernetes.io/secure-backends: "true" + # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" + # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0 + path: / + hosts: + - console.minio-example.local + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +## Node labels for pod assignment +## Ref: https://kubernetes.io/docs/user-guide/node-selection/ +## +nodeSelector: {} +tolerations: [] +affinity: {} +topologySpreadConstraints: [] + +## Add stateful containers to have security context, if enabled MinIO will run as this +## user and group NOTE: securityContext is only enabled if persistence.enabled=true +securityContext: + enabled: true + runAsUser: 1000 + runAsGroup: 1000 + fsGroup: 1000 + fsGroupChangePolicy: "OnRootMismatch" + +containerSecurityContext: + readOnlyRootFilesystem: false + +# Additational pod annotations +podAnnotations: {} + +# Additional pod labels +podLabels: {} + +## Configure resource requests and limits +## ref: http://kubernetes.io/docs/user-guide/compute-resources/ +## +resources: + requests: + memory: 16Gi + +## List of policies to be created after minio install +## +## In addition to default policies [readonly|readwrite|writeonly|consoleAdmin|diagnostics] +## you can define additional policies with custom supported actions and resources +policies: [] +## writeexamplepolicy policy grants creation or deletion of buckets with name +## starting with example. In addition, grants objects write permissions on buckets starting with +## example. +# - name: writeexamplepolicy +# statements: +# - effect: Allow # this is the default +# resources: +# - 'arn:aws:s3:::example*/*' +# actions: +# - "s3:AbortMultipartUpload" +# - "s3:GetObject" +# - "s3:DeleteObject" +# - "s3:PutObject" +# - "s3:ListMultipartUploadParts" +# - resources: +# - 'arn:aws:s3:::example*' +# actions: +# - "s3:CreateBucket" +# - "s3:DeleteBucket" +# - "s3:GetBucketLocation" +# - "s3:ListBucket" +# - "s3:ListBucketMultipartUploads" +## readonlyexamplepolicy policy grants access to buckets with name starting with example. +## In addition, grants objects read permissions on buckets starting with example. +# - name: readonlyexamplepolicy +# statements: +# - resources: +# - 'arn:aws:s3:::example*/*' +# actions: +# - "s3:GetObject" +# - resources: +# - 'arn:aws:s3:::example*' +# actions: +# - "s3:GetBucketLocation" +# - "s3:ListBucket" +# - "s3:ListBucketMultipartUploads" +## conditionsexample policy creates all access to example bucket with aws:username="johndoe" and source ip range 10.0.0.0/8 and 192.168.0.0/24 only +# - name: conditionsexample +# statements: +# - resources: +# - 'arn:aws:s3:::example/*' +# actions: +# - 's3:*' +# conditions: +# - StringEquals: '"aws:username": "johndoe"' +# - IpAddress: | +# "aws:SourceIp": [ +# "10.0.0.0/8", +# "192.168.0.0/24" +# ] +# +## Additional Annotations for the Kubernetes Job makePolicyJob +makePolicyJob: + securityContext: + enabled: false + runAsUser: 1000 + runAsGroup: 1000 + resources: + requests: + memory: 128Mi + # Command to run after the main command on exit + exitCommand: "" + +## List of users to be created after minio install +## +users: + ## Username, password and policy to be assigned to the user + ## Default policies are [readonly|readwrite|writeonly|consoleAdmin|diagnostics] + ## Add new policies as explained here https://min.io/docs/minio/kubernetes/upstream/administration/identity-access-management.html#access-management + ## NOTE: this will fail if LDAP is enabled in your MinIO deployment + ## make sure to disable this if you are using LDAP. + - accessKey: console + secretKey: console123 + policy: consoleAdmin + # Or you can refer to specific secret + #- accessKey: externalSecret + # existingSecret: my-secret + # existingSecretKey: password + # policy: readonly + +## Additional Annotations for the Kubernetes Job makeUserJob +makeUserJob: + securityContext: + enabled: false + runAsUser: 1000 + runAsGroup: 1000 + resources: + requests: + memory: 128Mi + # Command to run after the main command on exit + exitCommand: "" + +## List of service accounts to be created after minio install +## +svcaccts: [] + ## accessKey, secretKey and parent user to be assigned to the service accounts + ## Add new service accounts as explained here https://min.io/docs/minio/kubernetes/upstream/administration/identity-access-management/minio-user-management.html#service-accounts + # - accessKey: console-svcacct + # secretKey: console123 + # user: console + ## Or you can refer to specific secret + # - accessKey: externalSecret + # existingSecret: my-secret + # existingSecretKey: password + # user: console + ## You also can pass custom policy + # - accessKey: console-svcacct + # secretKey: console123 + # user: console + # policy: + # statements: + # - resources: + # - 'arn:aws:s3:::example*/*' + # actions: + # - "s3:AbortMultipartUpload" + # - "s3:GetObject" + # - "s3:DeleteObject" + # - "s3:PutObject" + # - "s3:ListMultipartUploadParts" + +makeServiceAccountJob: + securityContext: + enabled: false + runAsUser: 1000 + runAsGroup: 1000 + resources: + requests: + memory: 128Mi + # Command to run after the main command on exit + exitCommand: "" + +## List of buckets to be created after minio install +## +buckets: [] + # # Name of the bucket + # - name: bucket1 + # # Policy to be set on the + # # bucket [none|download|upload|public] + # policy: none + # # Purge if bucket exists already + # purge: false + # # set versioning for + # # bucket [true|false] + # versioning: false # remove this key if you do not want versioning feature + # # set objectlocking for + # # bucket [true|false] NOTE: versioning is enabled by default if you use locking + # objectlocking: false + # - name: bucket2 + # policy: none + # purge: false + # versioning: true + # # set objectlocking for + # # bucket [true|false] NOTE: versioning is enabled by default if you use locking + # objectlocking: false + +## Additional Annotations for the Kubernetes Job makeBucketJob +makeBucketJob: + securityContext: + enabled: false + runAsUser: 1000 + runAsGroup: 1000 + resources: + requests: + memory: 128Mi + # Command to run after the main command on exit + exitCommand: "" + +## List of command to run after minio install +## NOTE: the mc command TARGET is always "myminio" +customCommands: + # - command: "admin policy attach myminio consoleAdmin --group='cn=ops,cn=groups,dc=example,dc=com'" + +## Additional Annotations for the Kubernetes Job customCommandJob +customCommandJob: + securityContext: + enabled: false + runAsUser: 1000 + runAsGroup: 1000 + resources: + requests: + memory: 128Mi + ## Additional volumes to add to the post-job. + extraVolumes: [] + # - name: extra-policies + # configMap: + # name: my-extra-policies-cm + ## Additional volumeMounts to add to the custom commands container when + ## running the post-job. + extraVolumeMounts: [] + # - name: extra-policies + # mountPath: /mnt/extras/ + # Command to run after the main command on exit + exitCommand: "" + +## Merge jobs +postJob: + podAnnotations: {} + annotations: {} + securityContext: + enabled: false + runAsUser: 1000 + runAsGroup: 1000 + fsGroup: 1000 + nodeSelector: {} + tolerations: [] + affinity: {} + +## Use this field to add environment variables relevant to MinIO server. These fields will be passed on to MinIO container(s) +## when Chart is deployed +environment: + ## Please refer for comprehensive list https://min.io/docs/minio/linux/reference/minio-server/minio-server.html + ## MINIO_SUBNET_LICENSE: "License key obtained from https://subnet.min.io" + ## MINIO_BROWSER: "off" + +## The name of a secret in the same kubernetes namespace which contain secret values +## This can be useful for LDAP password, etc +## The key in the secret must be 'config.env' +## +extraSecret: ~ + +## OpenID Identity Management +## The following section documents environment variables for enabling external identity management using an OpenID Connect (OIDC)-compatible provider. +## See https://min.io/docs/minio/linux/operations/external-iam/configure-openid-external-identity-management.html for a tutorial on using these variables. +oidc: + enabled: false + configUrl: "https://identity-provider-url/.well-known/openid-configuration" + clientId: "minio" + clientSecret: "" + # Provide existing client secret from the Kubernetes Secret resource, existing secret will have priority over `clientId` and/or `clientSecret`` + existingClientSecretName: "" + existingClientIdKey: "" + existingClientSecretKey: "" + claimName: "policy" + scopes: "openid,profile,email" + redirectUri: "https://console-endpoint-url/oauth_callback" + # Can leave empty + claimPrefix: "" + comment: "" + displayName: "" + +networkPolicy: + enabled: false + # Specifies whether the policies created will be standard Network Policies (flavor: kubernetes) + # or Cilium Network Policies (flavor: cilium) + flavor: kubernetes + allowExternal: true + # only when using flavor: cilium + egressEntities: + - kube-apiserver + +## PodDisruptionBudget settings +## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ +## +podDisruptionBudget: + enabled: false + maxUnavailable: 1 + +## Specify the service account to use for the MinIO pods. If 'create' is set to 'false' +## and 'name' is left unspecified, the account 'default' will be used. +serviceAccount: + create: true + ## The name of the service account to use. If 'create' is 'true', a service account with that name + ## will be created. + name: "minio-sa" + +metrics: + serviceMonitor: + enabled: false + # scrape each node/pod individually for additional metrics + includeNode: false + public: true + additionalLabels: {} + annotations: {} + # for node metrics + relabelConfigs: {} + # for cluster metrics + relabelConfigsCluster: {} + # metricRelabelings: + # - regex: (server|pod) + # action: labeldrop + namespace: ~ + # Scrape interval, for example `interval: 30s` + interval: ~ + # Scrape timeout, for example `scrapeTimeout: 10s` + scrapeTimeout: ~ + +## ETCD settings: https://github.com/minio/minio/blob/master/docs/sts/etcd.md +## Define endpoints to enable this section. +etcd: + endpoints: [] + pathPrefix: "" + corednsPathPrefix: "" + clientCert: "" + clientCertKey: "" diff --git a/charts/devtron-utilities/templates/_helpers.tpl b/charts/devtron-utilities/templates/_helpers.tpl new file mode 100644 index 000000000..6d1f9eca9 --- /dev/null +++ b/charts/devtron-utilities/templates/_helpers.tpl @@ -0,0 +1,9 @@ +{{- define "aws-load-balancer-controller.selectorLabels" -}} + +{{- if .Values.customSelectorLabels }} +{{- toYaml .Values.customSelectorLabels }} +{{- else }} +app.kubernetes.io/name: {{ include "aws-load-balancer-controller.name" .}} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} +{{- end -}} diff --git a/charts/devtron-utilities/values.yaml b/charts/devtron-utilities/values.yaml index 83bc19159..fea9bdbfa 100644 --- a/charts/devtron-utilities/values.yaml +++ b/charts/devtron-utilities/values.yaml @@ -1,12 +1,13 @@ # Default values for aws-load-balancer-controller. aws-load-balancer-controller: - enabled: false + enabled: true resources: {} clusterName: "" region: "" vpcId: "" ingressClass: alb defaultTargetType: instance + customSelectorLabels: {} # Default values for nginx configuration ingress-nginx: From 7ee1c7408f6433541c9b5ee6de16d5db06f9a6ab Mon Sep 17 00:00:00 2001 From: Yashasvi17 <155513200+YashasviDevtron@users.noreply.github.com> Date: Thu, 25 Sep 2025 16:02:51 +0530 Subject: [PATCH 2/7] Update argo-cert-expire-alert-job.yaml --- .../templates/argo-cert-expire-alert-job.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/argo-cert-expire-alert-job.yaml b/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/argo-cert-expire-alert-job.yaml index b17b8d931..37d1d7f55 100644 --- a/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/argo-cert-expire-alert-job.yaml +++ b/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/argo-cert-expire-alert-job.yaml @@ -41,4 +41,4 @@ spec: {{ toYaml $.Values.containerSecurityContext | indent 14 }} {{- end}} restartPolicy: OnFailure -{{- end }} \ No newline at end of file +{{- end }} From 372c1e67f497d4b126f8f0cf72bd44e6742cf49f Mon Sep 17 00:00:00 2001 From: Yashasvi17 <155513200+YashasviDevtron@users.noreply.github.com> Date: Thu, 25 Sep 2025 16:03:15 +0530 Subject: [PATCH 3/7] Update clusterrole.yaml --- .../argocd-certificate-refresh/templates/clusterrole.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/clusterrole.yaml b/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/clusterrole.yaml index eb75c89cd..9117f7398 100644 --- a/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/clusterrole.yaml +++ b/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/clusterrole.yaml @@ -19,4 +19,4 @@ rules: - list - delete - update - - patch \ No newline at end of file + - patch From b30c57ed22fa26e31fe181ac1b8ad2f23d66a1f4 Mon Sep 17 00:00:00 2001 From: Yashasvi17 <155513200+YashasviDevtron@users.noreply.github.com> Date: Thu, 25 Sep 2025 16:03:41 +0530 Subject: [PATCH 4/7] Update cronjob.yaml --- .../charts/argocd-certificate-refresh/templates/cronjob.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/cronjob.yaml b/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/cronjob.yaml index 9b736b3af..e856f1cb1 100644 --- a/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/cronjob.yaml +++ b/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/cronjob.yaml @@ -36,4 +36,5 @@ spec: securityContext: {{ toYaml $.Values.containerSecurityContext | indent 14 }} {{- end}} - restartPolicy: OnFailure \ No newline at end of file + restartPolicy: OnFailure + From 72181a5c1d8a390268fc2f7e15f9d9f2afe5ad1c Mon Sep 17 00:00:00 2001 From: Yashasvi17 <155513200+YashasviDevtron@users.noreply.github.com> Date: Thu, 25 Sep 2025 16:13:41 +0530 Subject: [PATCH 5/7] Delete charts/devtron-utilities/charts directory --- .../argocd-certificate-refresh/Chart.yaml | 10 - .../argocd-certificate-refresh/README.md | 3 - .../templates/argo-cert-expire-alert-job.yaml | 44 - .../templates/clusterrole.yaml | 22 - .../templates/clusterrolebinding.yaml | 12 - .../templates/cronjob.yaml | 40 - .../templates/serviceaccount.yaml | 7 - .../argocd-certificate-refresh/values.yaml | 45 - .../aws-load-balancer-controller/.helmignore | 25 - .../aws-load-balancer-controller/Chart.yaml | 22 - .../aws-load-balancer-controller/README.md | 283 ---- .../ci/extra_args | 1 - .../ci/values.yaml | 7 - .../crds/crds.yaml | 684 ---------- .../templates/NOTES.txt | 1 - .../templates/_helpers.tpl | 131 -- .../templates/deployment.yaml | 263 ---- .../templates/hpa.yaml | 34 - .../templates/ingressclass.yaml | 41 - .../templates/pdb.yaml | 14 - .../templates/rbac.yaml | 107 -- .../templates/service.yaml | 41 - .../templates/serviceaccount.yaml | 18 - .../templates/servicemonitor.yaml | 43 - .../templates/webhook.yaml | 250 ---- .../aws-load-balancer-controller/values.yaml | 436 ------ .../aws-node-termination-handler/.helmignore | 23 - .../aws-node-termination-handler/Chart.yaml | 25 - .../aws-node-termination-handler/README.md | 176 --- .../templates/NOTES.txt | 8 - .../templates/_helpers.tpl | 124 -- .../templates/clusterrole.yaml | 52 - .../templates/clusterrolebinding.yaml | 16 - .../templates/daemonset.linux.yaml | 210 --- .../templates/daemonset.windows.yaml | 204 --- .../templates/deployment.yaml | 211 --- .../templates/pdb.yaml | 14 - .../templates/podmonitor.yaml | 29 - .../templates/psp.yaml | 70 - .../templates/service.yaml | 18 - .../templates/serviceaccount.yaml | 13 - .../templates/servicemonitor.yaml | 29 - .../aws-node-termination-handler/values.yaml | 295 ---- .../charts/cluster-autoscaler/.helmignore | 23 - .../charts/cluster-autoscaler/Chart.yaml | 13 - .../charts/cluster-autoscaler/README.md | 527 -------- .../cluster-autoscaler/README.md.gotmpl | 417 ------ .../cluster-autoscaler/templates/NOTES.txt | 18 - .../cluster-autoscaler/templates/_helpers.tpl | 160 --- .../templates/clusterrole.yaml | 175 --- .../templates/clusterrolebinding.yaml | 16 - .../templates/configmap.yaml | 416 ------ .../templates/deployment.yaml | 367 ----- .../templates/extra-manifests.yaml | 4 - .../cluster-autoscaler/templates/pdb.yaml | 16 - .../templates/podsecuritypolicy.yaml | 42 - .../priority-expander-configmap.yaml | 25 - .../templates/prometheusrule.yaml | 15 - .../cluster-autoscaler/templates/role.yaml | 87 -- .../templates/rolebinding.yaml | 17 - .../cluster-autoscaler/templates/secret.yaml | 31 - .../cluster-autoscaler/templates/service.yaml | 39 - .../templates/serviceaccount.yaml | 13 - .../templates/servicemonitor.yaml | 36 - .../cluster-autoscaler/templates/vpa.yaml | 20 - .../charts/cluster-autoscaler/values.yaml | 467 ------- .../charts/devtron-backups/Chart.yaml | 5 - .../charts/devtron-backups/README.md | 55 - .../devtron-backups/templates/_helpers.tpl | 63 - .../templates/backup-on-azure.yaml | 213 --- .../templates/backup-on-gcp.yaml | 194 --- .../templates/backup-on-pvc.yaml | 154 --- .../templates/backup-on-s3.yaml | 225 ---- .../templates/serviceaccount.yaml | 51 - .../charts/devtron-backups/values.yaml | 110 -- .../charts/devtron-generic-helm/Chart.yaml | 8 - .../charts/devtron-generic-helm/README.md | 8 - .../templates/generic.yaml | 4 - .../charts/devtron-generic-helm/values.yaml | 37 - .../charts/holmes/.helmignore | 23 - .../charts/holmes/Chart.yaml | 6 - .../charts/holmes/templates/holmes.yaml | 101 -- .../templates/holmesgpt-service-account.yaml | 232 ---- .../holmes/templates/toolset-config.yaml | 10 - .../charts/holmes/values.yaml | 50 - .../charts/ingress-nginx/.helmignore | 23 - .../charts/ingress-nginx/Chart.yaml | 24 - .../charts/ingress-nginx/OWNERS | 4 - .../charts/ingress-nginx/README.md | 564 -------- .../charts/ingress-nginx/README.md.gotmpl | 247 ---- .../changelog/helm-chart-2.10.0.md | 9 - .../changelog/helm-chart-2.11.0.md | 10 - .../changelog/helm-chart-2.11.1.md | 9 - .../changelog/helm-chart-2.11.2.md | 9 - .../changelog/helm-chart-2.11.3.md | 9 - .../changelog/helm-chart-2.12.0.md | 10 - .../changelog/helm-chart-2.12.1.md | 9 - .../changelog/helm-chart-2.13.0.md | 10 - .../changelog/helm-chart-2.14.0.md | 9 - .../changelog/helm-chart-2.15.0.md | 9 - .../changelog/helm-chart-2.16.0.md | 9 - .../changelog/helm-chart-2.9.0.md | 9 - .../changelog/helm-chart-2.9.1.md | 9 - .../changelog/helm-chart-3.0.0.md | 9 - .../changelog/helm-chart-3.10.0.md | 9 - .../changelog/helm-chart-3.10.1.md | 9 - .../changelog/helm-chart-3.11.0.md | 9 - .../changelog/helm-chart-3.11.1.md | 9 - .../changelog/helm-chart-3.12.0.md | 9 - .../changelog/helm-chart-3.13.0.md | 9 - .../changelog/helm-chart-3.14.0.md | 9 - .../changelog/helm-chart-3.15.0.md | 9 - .../changelog/helm-chart-3.15.1.md | 9 - .../changelog/helm-chart-3.16.0.md | 9 - .../changelog/helm-chart-3.16.1.md | 9 - .../changelog/helm-chart-3.17.0.md | 9 - .../changelog/helm-chart-3.18.0.md | 10 - .../changelog/helm-chart-3.19.0.md | 9 - .../changelog/helm-chart-3.20.0.md | 9 - .../changelog/helm-chart-3.20.1.md | 10 - .../changelog/helm-chart-3.21.0.md | 12 - .../changelog/helm-chart-3.22.0.md | 10 - .../changelog/helm-chart-3.23.0.md | 9 - .../changelog/helm-chart-3.24.0.md | 9 - .../changelog/helm-chart-3.25.0.md | 9 - .../changelog/helm-chart-3.26.0.md | 9 - .../changelog/helm-chart-3.27.0.md | 9 - .../changelog/helm-chart-3.28.0.md | 9 - .../changelog/helm-chart-3.29.0.md | 9 - .../changelog/helm-chart-3.3.0.md | 12 - .../changelog/helm-chart-3.3.1.md | 12 - .../changelog/helm-chart-3.30.0.md | 9 - .../changelog/helm-chart-3.31.0.md | 9 - .../changelog/helm-chart-3.32.0.md | 9 - .../changelog/helm-chart-3.33.0.md | 9 - .../changelog/helm-chart-3.34.0.md | 9 - .../changelog/helm-chart-3.4.0.md | 9 - .../changelog/helm-chart-3.5.0.md | 9 - .../changelog/helm-chart-3.5.1.md | 9 - .../changelog/helm-chart-3.6.0.md | 9 - .../changelog/helm-chart-3.7.0.md | 9 - .../changelog/helm-chart-3.7.1.md | 9 - .../changelog/helm-chart-3.8.0.md | 13 - .../changelog/helm-chart-3.9.0.md | 9 - .../changelog/helm-chart-4.0.1.md | 9 - .../changelog/helm-chart-4.0.10.md | 9 - .../changelog/helm-chart-4.0.11.md | 9 - .../changelog/helm-chart-4.0.12.md | 9 - .../changelog/helm-chart-4.0.13.md | 9 - .../changelog/helm-chart-4.0.14.md | 9 - .../changelog/helm-chart-4.0.15.md | 43 - .../changelog/helm-chart-4.0.18.md | 40 - .../changelog/helm-chart-4.0.2.md | 9 - .../changelog/helm-chart-4.0.3.md | 9 - .../changelog/helm-chart-4.0.5.md | 9 - .../changelog/helm-chart-4.0.6.md | 12 - .../changelog/helm-chart-4.0.7.md | 10 - .../changelog/helm-chart-4.0.9.md | 9 - .../changelog/helm-chart-4.1.0.md | 21 - .../changelog/helm-chart-4.1.2.md | 11 - .../changelog/helm-chart-4.10.0.md | 9 - .../changelog/helm-chart-4.10.1.md | 11 - .../changelog/helm-chart-4.10.2.md | 18 - .../changelog/helm-chart-4.10.3.md | 9 - .../changelog/helm-chart-4.10.4.md | 9 - .../changelog/helm-chart-4.11.0.md | 18 - .../changelog/helm-chart-4.11.1.md | 9 - .../changelog/helm-chart-4.11.2.md | 9 - .../changelog/helm-chart-4.12.0-beta.0.md | 9 - .../changelog/helm-chart-4.12.0.md | 10 - .../changelog/helm-chart-4.2.0.md | 47 - .../changelog/helm-chart-4.2.1.md | 10 - .../changelog/helm-chart-4.3.0.md | 14 - .../changelog/helm-chart-4.4.0.md | 12 - .../changelog/helm-chart-4.5.2.md | 13 - .../changelog/helm-chart-4.6.0.md | 24 - .../changelog/helm-chart-4.6.1.md | 11 - .../changelog/helm-chart-4.7.0.md | 14 - .../changelog/helm-chart-4.7.1.md | 12 - .../changelog/helm-chart-4.7.2.md | 9 - .../changelog/helm-chart-4.8.0-beta.0.md | 13 - .../changelog/helm-chart-4.8.0.md | 13 - .../changelog/helm-chart-4.8.1.md | 9 - .../changelog/helm-chart-4.8.2.md | 10 - .../changelog/helm-chart-4.8.3.md | 9 - .../changelog/helm-chart-4.9.0.md | 13 - .../changelog/helm-chart-4.9.1.md | 10 - .../changelog/helm-chart.md.gotmpl | 11 - ...dmission-webhooks-cert-manager-values.yaml | 12 - ...ontroller-configmap-addheaders-values.yaml | 11 - ...troller-configmap-proxyheaders-values.yaml | 11 - .../ci/controller-configmap-values.yaml | 11 - .../controller-daemonset-metrics-values.yaml | 13 - ...oller-daemonset-podannotations-values.yaml | 16 - .../ci/controller-daemonset-values.yaml | 10 - .../controller-deployment-metrics-values.yaml | 13 - ...ller-deployment-podannotations-values.yaml | 16 - .../ci/controller-deployment-values.yaml | 10 - .../ci/controller-hpa-values.yaml | 18 - .../ci/controller-ingressclass-values.yaml | 15 - .../controller-service-internal-values.yaml | 13 - .../ci/controller-service-values.yaml | 22 - .../charts/ingress-nginx/templates/NOTES.txt | 73 - .../ingress-nginx/templates/_helpers.tpl | 263 ---- .../ingress-nginx/templates/_params.tpl | 77 -- .../admission-webhooks/cert-manager.yaml | 63 - .../job-patch/clusterrole.yaml | 23 - .../job-patch/clusterrolebinding.yaml | 23 - .../job-patch/job-createSecret.yaml | 79 -- .../job-patch/job-patchWebhook.yaml | 81 -- .../job-patch/networkpolicy.yaml | 26 - .../admission-webhooks/job-patch/role.yaml | 24 - .../job-patch/rolebinding.yaml | 24 - .../job-patch/serviceaccount.yaml | 17 - .../validating-webhook.yaml | 54 - .../ingress-nginx/templates/clusterrole.yaml | 102 -- .../templates/clusterrolebinding.yaml | 19 - .../controller-configmap-addheaders.yaml | 14 - .../controller-configmap-proxyheaders.yaml | 14 - .../templates/controller-configmap-tcp.yaml | 17 - .../templates/controller-configmap-udp.yaml | 17 - .../templates/controller-configmap.yaml | 30 - .../templates/controller-daemonset.yaml | 236 ---- .../templates/controller-deployment.yaml | 242 ---- .../templates/controller-hpa.yaml | 47 - .../controller-ingressclass-aliases.yaml | 23 - .../templates/controller-ingressclass.yaml | 26 - .../templates/controller-keda.yaml | 46 - .../templates/controller-networkpolicy.yaml | 45 - .../controller-poddisruptionbudget.yaml | 39 - .../templates/controller-prometheusrule.yaml | 26 - .../templates/controller-role.yaml | 94 -- .../templates/controller-rolebinding.yaml | 21 - .../templates/controller-secret.yaml | 15 - .../controller-service-internal.yaml | 105 -- .../templates/controller-service-metrics.yaml | 45 - .../templates/controller-service-webhook.yaml | 40 - .../templates/controller-service.yaml | 105 -- .../templates/controller-serviceaccount.yaml | 17 - .../templates/controller-servicemonitor.yaml | 50 - .../templates/default-backend-deployment.yaml | 119 -- .../default-backend-extra-configmaps.yaml | 23 - .../templates/default-backend-hpa.yaml | 40 - .../default-backend-networkpolicy.yaml | 25 - .../default-backend-poddisruptionbudget.yaml | 32 - .../templates/default-backend-service.yaml | 41 - .../default-backend-serviceaccount.yaml | 14 - .../job-patch/clusterrole_test.yaml | 11 - .../job-patch/clusterrolebinding_test.yaml | 11 - .../job-patch/role_test.yaml | 11 - .../job-patch/rolebinding_test.yaml | 11 - .../job-patch/serviceaccount_test.yaml | 47 - .../validating-webhook_test.yaml | 32 - .../controller-configmap-addheaders_test.yaml | 27 - ...ontroller-configmap-proxyheaders_test.yaml | 27 - .../tests/controller-configmap_test.yaml | 31 - .../tests/controller-daemonset_test.yaml | 192 --- .../tests/controller-deployment_test.yaml | 217 --- .../tests/controller-hpa_test.yaml | 31 - .../controller-ingressclass-aliases_test.yaml | 110 -- .../tests/controller-ingressclass_test.yaml | 93 -- .../tests/controller-keda_test.yaml | 31 - .../tests/controller-networkpolicy_test.yaml | 23 - .../controller-poddisruptionbudget_test.yaml | 102 -- .../tests/controller-prometheusrule_test.yaml | 29 - .../controller-service-internal_test.yaml | 25 - .../controller-service-metrics_test.yaml | 41 - .../controller-service-webhook_test.yaml | 32 - .../tests/controller-service_test.yaml | 32 - .../tests/controller-serviceaccount_test.yaml | 47 - .../tests/controller-servicemonitor_test.yaml | 29 - .../default-backend-deployment_test.yaml | 189 --- ...default-backend-extra-configmaps_test.yaml | 50 - ...ault-backend-poddisruptionbudget_test.yaml | 79 -- .../tests/default-backend-service_test.yaml | 32 - .../default-backend-serviceaccount_test.yaml | 51 - .../charts/ingress-nginx/values.yaml | 1193 ----------------- .../charts/k8s-shield/.helmignore | 23 - .../charts/k8s-shield/Chart.yaml | 20 - .../charts/k8s-shield/Readme.md | 72 - .../charts/k8s-shield/templates/_helpers.tpl | 16 - .../container-security-context-policy.yaml | 68 - .../templates/extraValidating-policy.yaml | 4 - .../pod-security-context-policy.yaml | 61 - ...ct-admin-cluster-role-creation-policy.yaml | 58 - .../restrict-application-deletion-policy.yaml | 51 - ...ng-with-cluster-admin-creation-policy.yaml | 42 - .../restrict-limit-resource-policy.yaml | 97 -- .../restrict-loadbalance-creation-policy.yaml | 56 - .../restrict-namespace-deletion-policy.yaml | 44 - .../restrict-pvc-creation-policy.yaml | 52 - ...ict-without-readiness-liveness-policy.yaml | 64 - .../restrict-without-resource-policy.yaml | 60 - .../charts/k8s-shield/values.yaml | 164 --- .../charts/karpenter/.helmignore | 23 - .../charts/karpenter/Chart.lock | 3 - .../charts/karpenter/Chart.yaml | 35 - .../charts/karpenter/README.md | 108 -- .../charts/karpenter/README.md.gotmpl | 44 - .../charts/karpenter/artifacthub-repo.yaml | 7 - .../karpenter.k8s.aws_ec2nodeclasses.yaml | 742 ---------- .../crds/karpenter.sh_nodeclaims.yaml | 395 ------ .../crds/karpenter.sh_nodepools.yaml | 519 ------- .../charts/karpenter/templates/_helpers.tpl | 142 -- .../templates/aggregate-clusterrole.yaml | 18 - .../karpenter/templates/clusterrole-core.yaml | 71 - .../karpenter/templates/clusterrole.yaml | 38 - .../karpenter/templates/deployment.yaml | 223 --- .../templates/poddisruptionbudget.yaml | 16 - .../charts/karpenter/templates/role.yaml | 45 - .../karpenter/templates/rolebinding.yaml | 39 - .../charts/karpenter/templates/service.yaml | 25 - .../karpenter/templates/serviceaccount.yaml | 18 - .../karpenter/templates/servicemonitor.yaml | 29 - .../charts/karpenter/values.yaml | 192 --- .../devtron-utilities/charts/kcert/Chart.yaml | 14 - .../kcert/templates/020-ServiceAccount.yaml | 13 - .../kcert/templates/030-ClusterRole.yaml | 22 - .../templates/040-ClusterRoleBinding.yaml | 20 - .../charts/kcert/templates/050-Role.yaml | 17 - .../kcert/templates/060-RoleBinding.yaml | 21 - .../charts/kcert/templates/065-Secret.yaml | 18 - .../kcert/templates/070-Deployment.yaml | 83 -- .../charts/kcert/templates/080-Service.yaml | 26 - .../charts/kcert/templates/NOTES.txt | 4 - .../charts/kcert/values.yaml | 35 - .../charts/minio/.helmignore | 23 - .../devtron-utilities/charts/minio/Chart.yaml | 18 - .../devtron-utilities/charts/minio/README.md | 264 ---- .../charts/minio/templates/NOTES.txt | 43 - .../minio/templates/_helper_create_bucket.txt | 122 -- .../minio/templates/_helper_create_policy.txt | 75 -- .../templates/_helper_create_svcacct.txt | 106 -- .../minio/templates/_helper_create_user.txt | 107 -- .../templates/_helper_custom_command.txt | 58 - .../charts/minio/templates/_helper_policy.tpl | 28 - .../charts/minio/templates/_helpers.tpl | 218 --- .../minio/templates/ciliumnetworkpolicy.yaml | 33 - .../charts/minio/templates/configmap.yaml | 32 - .../minio/templates/console-ingress.yaml | 55 - .../minio/templates/console-service.yaml | 45 - .../charts/minio/templates/deployment.yaml | 213 --- .../charts/minio/templates/ingress.yaml | 55 - .../charts/minio/templates/networkpolicy.yaml | 26 - .../minio/templates/poddisruptionbudget.yaml | 17 - .../charts/minio/templates/post-job.yaml | 258 ---- .../charts/minio/templates/pvc.yaml | 32 - .../charts/minio/templates/secrets.yaml | 21 - .../templates/securitycontextconstraints.yaml | 45 - .../charts/minio/templates/service.yaml | 46 - .../minio/templates/serviceaccount.yaml | 6 - .../minio/templates/servicemonitor.yaml | 112 -- .../charts/minio/templates/statefulset.yaml | 267 ---- .../charts/minio/values.yaml | 593 -------- 354 files changed, 23011 deletions(-) delete mode 100644 charts/devtron-utilities/charts/argocd-certificate-refresh/Chart.yaml delete mode 100644 charts/devtron-utilities/charts/argocd-certificate-refresh/README.md delete mode 100644 charts/devtron-utilities/charts/argocd-certificate-refresh/templates/argo-cert-expire-alert-job.yaml delete mode 100644 charts/devtron-utilities/charts/argocd-certificate-refresh/templates/clusterrole.yaml delete mode 100644 charts/devtron-utilities/charts/argocd-certificate-refresh/templates/clusterrolebinding.yaml delete mode 100644 charts/devtron-utilities/charts/argocd-certificate-refresh/templates/cronjob.yaml delete mode 100644 charts/devtron-utilities/charts/argocd-certificate-refresh/templates/serviceaccount.yaml delete mode 100644 charts/devtron-utilities/charts/argocd-certificate-refresh/values.yaml delete mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/.helmignore delete mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/Chart.yaml delete mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/README.md delete mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/ci/extra_args delete mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/ci/values.yaml delete mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/crds/crds.yaml delete mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/templates/NOTES.txt delete mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/templates/_helpers.tpl delete mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/templates/deployment.yaml delete mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/templates/hpa.yaml delete mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/templates/ingressclass.yaml delete mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/templates/pdb.yaml delete mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/templates/rbac.yaml delete mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/templates/service.yaml delete mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/templates/serviceaccount.yaml delete mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/templates/servicemonitor.yaml delete mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/templates/webhook.yaml delete mode 100644 charts/devtron-utilities/charts/aws-load-balancer-controller/values.yaml delete mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/.helmignore delete mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/Chart.yaml delete mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/README.md delete mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/NOTES.txt delete mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/_helpers.tpl delete mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/clusterrole.yaml delete mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/clusterrolebinding.yaml delete mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/daemonset.linux.yaml delete mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/daemonset.windows.yaml delete mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/deployment.yaml delete mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/pdb.yaml delete mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/podmonitor.yaml delete mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/psp.yaml delete mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/service.yaml delete mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/serviceaccount.yaml delete mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/templates/servicemonitor.yaml delete mode 100644 charts/devtron-utilities/charts/aws-node-termination-handler/values.yaml delete mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/.helmignore delete mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/Chart.yaml delete mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/README.md delete mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/README.md.gotmpl delete mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/NOTES.txt delete mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/_helpers.tpl delete mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/clusterrole.yaml delete mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/clusterrolebinding.yaml delete mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/configmap.yaml delete mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/deployment.yaml delete mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/extra-manifests.yaml delete mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/pdb.yaml delete mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/podsecuritypolicy.yaml delete mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/priority-expander-configmap.yaml delete mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/prometheusrule.yaml delete mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/role.yaml delete mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/rolebinding.yaml delete mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/secret.yaml delete mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/service.yaml delete mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/serviceaccount.yaml delete mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/servicemonitor.yaml delete mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/templates/vpa.yaml delete mode 100644 charts/devtron-utilities/charts/cluster-autoscaler/values.yaml delete mode 100644 charts/devtron-utilities/charts/devtron-backups/Chart.yaml delete mode 100644 charts/devtron-utilities/charts/devtron-backups/README.md delete mode 100644 charts/devtron-utilities/charts/devtron-backups/templates/_helpers.tpl delete mode 100644 charts/devtron-utilities/charts/devtron-backups/templates/backup-on-azure.yaml delete mode 100644 charts/devtron-utilities/charts/devtron-backups/templates/backup-on-gcp.yaml delete mode 100644 charts/devtron-utilities/charts/devtron-backups/templates/backup-on-pvc.yaml delete mode 100644 charts/devtron-utilities/charts/devtron-backups/templates/backup-on-s3.yaml delete mode 100644 charts/devtron-utilities/charts/devtron-backups/templates/serviceaccount.yaml delete mode 100644 charts/devtron-utilities/charts/devtron-backups/values.yaml delete mode 100644 charts/devtron-utilities/charts/devtron-generic-helm/Chart.yaml delete mode 100644 charts/devtron-utilities/charts/devtron-generic-helm/README.md delete mode 100644 charts/devtron-utilities/charts/devtron-generic-helm/templates/generic.yaml delete mode 100644 charts/devtron-utilities/charts/devtron-generic-helm/values.yaml delete mode 100644 charts/devtron-utilities/charts/holmes/.helmignore delete mode 100644 charts/devtron-utilities/charts/holmes/Chart.yaml delete mode 100644 charts/devtron-utilities/charts/holmes/templates/holmes.yaml delete mode 100644 charts/devtron-utilities/charts/holmes/templates/holmesgpt-service-account.yaml delete mode 100644 charts/devtron-utilities/charts/holmes/templates/toolset-config.yaml delete mode 100644 charts/devtron-utilities/charts/holmes/values.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/.helmignore delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/Chart.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/OWNERS delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/README.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/README.md.gotmpl delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.10.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.1.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.2.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.3.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.12.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.12.1.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.13.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.14.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.15.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.16.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.9.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.9.1.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.0.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.10.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.10.1.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.11.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.11.1.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.12.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.13.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.14.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.15.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.15.1.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.16.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.16.1.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.17.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.18.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.19.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.20.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.20.1.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.21.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.22.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.23.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.24.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.25.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.26.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.27.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.28.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.29.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.3.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.3.1.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.30.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.31.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.32.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.33.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.34.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.4.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.5.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.5.1.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.6.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.7.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.7.1.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.8.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.9.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.1.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.10.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.11.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.12.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.13.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.14.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.15.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.18.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.2.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.3.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.5.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.6.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.7.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.9.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.1.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.1.2.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.1.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.2.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.3.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.4.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.1.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.2.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.12.0-beta.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.12.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.2.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.2.1.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.3.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.4.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.5.2.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.6.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.6.1.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.1.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.2.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.0-beta.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.1.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.2.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.3.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.9.0.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.9.1.md delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart.md.gotmpl delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/admission-webhooks-cert-manager-values.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-addheaders-values.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-proxyheaders-values.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-values.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-metrics-values.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-podannotations-values.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-values.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-metrics-values.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-podannotations-values.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-values.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-hpa-values.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-ingressclass-values.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-service-internal-values.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/ci/controller-service-values.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/NOTES.txt delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/_helpers.tpl delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/_params.tpl delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/cert-manager.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/networkpolicy.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/role.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/validating-webhook.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/clusterrole.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/clusterrolebinding.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-addheaders.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-proxyheaders.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-tcp.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-udp.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-daemonset.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-deployment.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-hpa.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-ingressclass-aliases.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-ingressclass.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-keda.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-networkpolicy.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-poddisruptionbudget.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-prometheusrule.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-role.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-rolebinding.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-secret.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-internal.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-metrics.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-webhook.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-service.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-serviceaccount.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/controller-servicemonitor.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-deployment.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-extra-configmaps.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-hpa.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-networkpolicy.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-poddisruptionbudget.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-service.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-serviceaccount.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/clusterrole_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/clusterrolebinding_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/role_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/rolebinding_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/serviceaccount_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/validating-webhook_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap-addheaders_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap-proxyheaders_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-daemonset_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-deployment_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-hpa_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-ingressclass-aliases_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-ingressclass_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-keda_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-networkpolicy_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-poddisruptionbudget_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-prometheusrule_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-internal_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-metrics_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-webhook_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-service_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-serviceaccount_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/controller-servicemonitor_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-deployment_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-extra-configmaps_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-poddisruptionbudget_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-service_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-serviceaccount_test.yaml delete mode 100644 charts/devtron-utilities/charts/ingress-nginx/values.yaml delete mode 100644 charts/devtron-utilities/charts/k8s-shield/.helmignore delete mode 100644 charts/devtron-utilities/charts/k8s-shield/Chart.yaml delete mode 100644 charts/devtron-utilities/charts/k8s-shield/Readme.md delete mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/_helpers.tpl delete mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/container-security-context-policy.yaml delete mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/extraValidating-policy.yaml delete mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/pod-security-context-policy.yaml delete mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/restrict-admin-cluster-role-creation-policy.yaml delete mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/restrict-application-deletion-policy.yaml delete mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/restrict-cluster-rolebinding-with-cluster-admin-creation-policy.yaml delete mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/restrict-limit-resource-policy.yaml delete mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/restrict-loadbalance-creation-policy.yaml delete mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/restrict-namespace-deletion-policy.yaml delete mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/restrict-pvc-creation-policy.yaml delete mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/restrict-without-readiness-liveness-policy.yaml delete mode 100644 charts/devtron-utilities/charts/k8s-shield/templates/restrict-without-resource-policy.yaml delete mode 100644 charts/devtron-utilities/charts/k8s-shield/values.yaml delete mode 100644 charts/devtron-utilities/charts/karpenter/.helmignore delete mode 100644 charts/devtron-utilities/charts/karpenter/Chart.lock delete mode 100644 charts/devtron-utilities/charts/karpenter/Chart.yaml delete mode 100644 charts/devtron-utilities/charts/karpenter/README.md delete mode 100644 charts/devtron-utilities/charts/karpenter/README.md.gotmpl delete mode 100644 charts/devtron-utilities/charts/karpenter/artifacthub-repo.yaml delete mode 100644 charts/devtron-utilities/charts/karpenter/crds/karpenter.k8s.aws_ec2nodeclasses.yaml delete mode 100644 charts/devtron-utilities/charts/karpenter/crds/karpenter.sh_nodeclaims.yaml delete mode 100644 charts/devtron-utilities/charts/karpenter/crds/karpenter.sh_nodepools.yaml delete mode 100644 charts/devtron-utilities/charts/karpenter/templates/_helpers.tpl delete mode 100644 charts/devtron-utilities/charts/karpenter/templates/aggregate-clusterrole.yaml delete mode 100644 charts/devtron-utilities/charts/karpenter/templates/clusterrole-core.yaml delete mode 100644 charts/devtron-utilities/charts/karpenter/templates/clusterrole.yaml delete mode 100644 charts/devtron-utilities/charts/karpenter/templates/deployment.yaml delete mode 100644 charts/devtron-utilities/charts/karpenter/templates/poddisruptionbudget.yaml delete mode 100644 charts/devtron-utilities/charts/karpenter/templates/role.yaml delete mode 100644 charts/devtron-utilities/charts/karpenter/templates/rolebinding.yaml delete mode 100644 charts/devtron-utilities/charts/karpenter/templates/service.yaml delete mode 100644 charts/devtron-utilities/charts/karpenter/templates/serviceaccount.yaml delete mode 100644 charts/devtron-utilities/charts/karpenter/templates/servicemonitor.yaml delete mode 100644 charts/devtron-utilities/charts/karpenter/values.yaml delete mode 100644 charts/devtron-utilities/charts/kcert/Chart.yaml delete mode 100644 charts/devtron-utilities/charts/kcert/templates/020-ServiceAccount.yaml delete mode 100644 charts/devtron-utilities/charts/kcert/templates/030-ClusterRole.yaml delete mode 100644 charts/devtron-utilities/charts/kcert/templates/040-ClusterRoleBinding.yaml delete mode 100644 charts/devtron-utilities/charts/kcert/templates/050-Role.yaml delete mode 100644 charts/devtron-utilities/charts/kcert/templates/060-RoleBinding.yaml delete mode 100644 charts/devtron-utilities/charts/kcert/templates/065-Secret.yaml delete mode 100644 charts/devtron-utilities/charts/kcert/templates/070-Deployment.yaml delete mode 100644 charts/devtron-utilities/charts/kcert/templates/080-Service.yaml delete mode 100644 charts/devtron-utilities/charts/kcert/templates/NOTES.txt delete mode 100644 charts/devtron-utilities/charts/kcert/values.yaml delete mode 100644 charts/devtron-utilities/charts/minio/.helmignore delete mode 100644 charts/devtron-utilities/charts/minio/Chart.yaml delete mode 100644 charts/devtron-utilities/charts/minio/README.md delete mode 100644 charts/devtron-utilities/charts/minio/templates/NOTES.txt delete mode 100644 charts/devtron-utilities/charts/minio/templates/_helper_create_bucket.txt delete mode 100644 charts/devtron-utilities/charts/minio/templates/_helper_create_policy.txt delete mode 100644 charts/devtron-utilities/charts/minio/templates/_helper_create_svcacct.txt delete mode 100644 charts/devtron-utilities/charts/minio/templates/_helper_create_user.txt delete mode 100644 charts/devtron-utilities/charts/minio/templates/_helper_custom_command.txt delete mode 100644 charts/devtron-utilities/charts/minio/templates/_helper_policy.tpl delete mode 100644 charts/devtron-utilities/charts/minio/templates/_helpers.tpl delete mode 100644 charts/devtron-utilities/charts/minio/templates/ciliumnetworkpolicy.yaml delete mode 100644 charts/devtron-utilities/charts/minio/templates/configmap.yaml delete mode 100644 charts/devtron-utilities/charts/minio/templates/console-ingress.yaml delete mode 100644 charts/devtron-utilities/charts/minio/templates/console-service.yaml delete mode 100644 charts/devtron-utilities/charts/minio/templates/deployment.yaml delete mode 100644 charts/devtron-utilities/charts/minio/templates/ingress.yaml delete mode 100644 charts/devtron-utilities/charts/minio/templates/networkpolicy.yaml delete mode 100644 charts/devtron-utilities/charts/minio/templates/poddisruptionbudget.yaml delete mode 100644 charts/devtron-utilities/charts/minio/templates/post-job.yaml delete mode 100644 charts/devtron-utilities/charts/minio/templates/pvc.yaml delete mode 100644 charts/devtron-utilities/charts/minio/templates/secrets.yaml delete mode 100644 charts/devtron-utilities/charts/minio/templates/securitycontextconstraints.yaml delete mode 100644 charts/devtron-utilities/charts/minio/templates/service.yaml delete mode 100644 charts/devtron-utilities/charts/minio/templates/serviceaccount.yaml delete mode 100644 charts/devtron-utilities/charts/minio/templates/servicemonitor.yaml delete mode 100644 charts/devtron-utilities/charts/minio/templates/statefulset.yaml delete mode 100644 charts/devtron-utilities/charts/minio/values.yaml diff --git a/charts/devtron-utilities/charts/argocd-certificate-refresh/Chart.yaml b/charts/devtron-utilities/charts/argocd-certificate-refresh/Chart.yaml deleted file mode 100644 index c0169517d..000000000 --- a/charts/devtron-utilities/charts/argocd-certificate-refresh/Chart.yaml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: v1 -appVersion: 0.1.0 -description: Helm chart to deploy argocd certificate refresh CronJob. -maintainers: -- email: ajay@devtron.ai - name: Ajay -- email: badal@devtron.ai - name: Badal Kumar -name: argocd-certificate-refresh -version: 0.10.8 diff --git a/charts/devtron-utilities/charts/argocd-certificate-refresh/README.md b/charts/devtron-utilities/charts/argocd-certificate-refresh/README.md deleted file mode 100644 index f9c4c1d14..000000000 --- a/charts/devtron-utilities/charts/argocd-certificate-refresh/README.md +++ /dev/null @@ -1,3 +0,0 @@ -# Devtron helm chart to deploy argocd certificate refresh cronjob - -To get the script, please follow this link-: https://github.com/devtron-labs/devtron-utilities/tree/main/scripts/argo-cert-refresh diff --git a/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/argo-cert-expire-alert-job.yaml b/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/argo-cert-expire-alert-job.yaml deleted file mode 100644 index 37d1d7f55..000000000 --- a/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/argo-cert-expire-alert-job.yaml +++ /dev/null @@ -1,44 +0,0 @@ -{{- if $.Values.alert.enabled -}} -{{- if .Capabilities.APIVersions.Has "batch/v1/CronJob" }} -apiVersion: batch/v1 -{{- else -}} -apiVersion: batch/v1beta1 -{{- end }} -kind: CronJob -metadata: - name: argocd-cert-alert - namespace: {{ $.Values.argocdNamespace| default .Release.Namespace }} -spec: - schedule: {{ $.Values.alert.schedule | quote }} - concurrencyPolicy: Forbid - jobTemplate: - spec: - template: - spec: - {{- if $.Values.podSecurityContext }} - securityContext: -{{ toYaml $.Values.podSecurityContext | indent 12 }} - {{- end }} - serviceAccountName: argocd-cert-sa - serviceAccount: argocd-cert-sa - containers: - - name: argocd-alert-container - image: {{ $.Values.alert.image }} - imagePullPolicy: IfNotPresent - env: - - name: devtronNamespace - value: {{ $.Values.devtronNamespace| default .Release.Namespace }} - - name: argocdNamespace - value: {{ $.Values.argocdNamespace| default .Release.Namespace }} - - name: discordUrl - value: {{ $.Values.alert.discordUrl | quote }} - - name: alertBefore - value: {{ $.Values.alert.alertBefore | quote }} - - name: cronJobRunAfter - value: {{ $.Values.alert.cronJobRunAfter | quote }} - {{- if $.Values.containerSecurityContext }} - securityContext: -{{ toYaml $.Values.containerSecurityContext | indent 14 }} - {{- end}} - restartPolicy: OnFailure -{{- end }} diff --git a/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/clusterrole.yaml b/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/clusterrole.yaml deleted file mode 100644 index 9117f7398..000000000 --- a/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/clusterrole.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: argocd-cert-role -rules: -- apiGroups: - - "" - - batch - - apps - resources: - - pods - - secrets - - cronjobs - - deployments - verbs: - - create - - get - - watch - - list - - delete - - update - - patch diff --git a/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/clusterrolebinding.yaml b/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/clusterrolebinding.yaml deleted file mode 100644 index 487d86520..000000000 --- a/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/clusterrolebinding.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: argocd-cert-rolebinding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: argocd-cert-role -subjects: -- kind: ServiceAccount - name: argocd-cert-sa - namespace: {{ $.Values.argocdNamespace| default .Release.Namespace }} diff --git a/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/cronjob.yaml b/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/cronjob.yaml deleted file mode 100644 index e856f1cb1..000000000 --- a/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/cronjob.yaml +++ /dev/null @@ -1,40 +0,0 @@ -{{- if .Capabilities.APIVersions.Has "batch/v1/CronJob" }} -apiVersion: batch/v1 -{{- else -}} -apiVersion: batch/v1beta1 -{{- end }} -kind: CronJob -metadata: - name: argocd-cert-cronjob - namespace: {{ $.Values.argocdNamespace| default .Release.Namespace }} -spec: - schedule: {{ $.Values.cronjob.schedule | quote }} - concurrencyPolicy: Forbid - jobTemplate: - spec: - template: - spec: - {{- if $.Values.podSecurityContext }} - securityContext: -{{ toYaml $.Values.podSecurityContext | indent 12 }} - {{- end }} - serviceAccountName: argocd-cert-sa - serviceAccount: argocd-cert-sa - containers: - - name: argocd-cert-cron - image: {{ $.Values.image }} - env: - - name: devtronNamespace - value: {{ $.Values.devtronNamespace| default .Release.Namespace }} - - name: argocdNamespace - value: {{ $.Values.argocdNamespace| default .Release.Namespace }} - - name: clusterType - value: {{ $.Values.clusterType | default "ENTERPRISE" | quote }} - imagePullPolicy: IfNotPresent - command: ["/bin/bash", "-c", "chmod +x argocd.sh && bash argocd.sh"] - {{- if $.Values.containerSecurityContext }} - securityContext: -{{ toYaml $.Values.containerSecurityContext | indent 14 }} - {{- end}} - restartPolicy: OnFailure - diff --git a/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/serviceaccount.yaml b/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/serviceaccount.yaml deleted file mode 100644 index aa53b6ce1..000000000 --- a/charts/devtron-utilities/charts/argocd-certificate-refresh/templates/serviceaccount.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: argocd-cert-sa - namespace: {{ .Release.Namespace }} - - diff --git a/charts/devtron-utilities/charts/argocd-certificate-refresh/values.yaml b/charts/devtron-utilities/charts/argocd-certificate-refresh/values.yaml deleted file mode 100644 index 87054881e..000000000 --- a/charts/devtron-utilities/charts/argocd-certificate-refresh/values.yaml +++ /dev/null @@ -1,45 +0,0 @@ -# Default values for argocd-certificate-refresh. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. - - -# docker image information -image: quay.io/devtron/argocd-cert-refresh:v10 -#accepted values are ENTERPRISE & OSS -# clusterType: ENTERPRISE -# If not namespace is provided then by default it will take in which namespace it will deploy -# devtronNamespace: devtroncd -# argocdNamespace: devtroncd - - - - -# values for cronjob -#currently it will run At 23:59 on 1st day-of-month in every 6th month -cronjob: - schedule: "59 23 1 */6 *" - - - - -#set up this If you need alert for argocd cert expire -alert: - enabled: false - image: quay.io/devtron/argocd-cert-refresh:alert-v9 - discordUrl: "" - #Daily At 07:00AM GMT so it will be 12:30PM in IST - schedule: "0 7 * * *" - # if the certificate will expire after 10 days you will get alert - alertBefore: 10 - # if the next cron will be run after 2 days you will get alert - cronJobRunAfter: 2 - - - -podSecurityContext: {} - # runAsGroup: 1000 - # runAsUser: 1000 -containerSecurityContext: {} - # allowPrivilegeEscalation: false - # runAsUser: 1000 - # runAsNonRoot: true diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/.helmignore b/charts/devtron-utilities/charts/aws-load-balancer-controller/.helmignore deleted file mode 100644 index 67263be0a..000000000 --- a/charts/devtron-utilities/charts/aws-load-balancer-controller/.helmignore +++ /dev/null @@ -1,25 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*.orig -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ -crds/kustomization.yaml -test.yaml diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/Chart.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/Chart.yaml deleted file mode 100644 index e5823aed9..000000000 --- a/charts/devtron-utilities/charts/aws-load-balancer-controller/Chart.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: v2 -appVersion: v2.11.0 -description: AWS Load Balancer Controller Helm chart for Kubernetes -home: https://github.com/aws/eks-charts -icon: https://raw.githubusercontent.com/aws/eks-charts/master/docs/logo/aws.png -keywords: -- eks -- alb -- load balancer -- ingress -- nlb -maintainers: -- email: kishorj@users.noreply.github.com - name: kishorj - url: https://github.com/kishorj -- email: m00nf1sh@users.noreply.github.com - name: m00nf1sh - url: https://github.com/m00nf1sh -name: aws-load-balancer-controller -sources: -- https://github.com/aws/eks-charts -version: 1.11.0 diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/README.md b/charts/devtron-utilities/charts/aws-load-balancer-controller/README.md deleted file mode 100644 index 180e50c08..000000000 --- a/charts/devtron-utilities/charts/aws-load-balancer-controller/README.md +++ /dev/null @@ -1,283 +0,0 @@ -# AWS Load Balancer Controller - -AWS Load Balancer controller Helm chart for Kubernetes - -## TL;DR: -```sh -helm repo add eks https://aws.github.io/eks-charts -# If using IAM Roles for service account install as follows - NOTE: you need to specify both of the chart values `serviceAccount.create=false` and `serviceAccount.name=aws-load-balancer-controller` -helm install aws-load-balancer-controller eks/aws-load-balancer-controller --set clusterName=my-cluster -n kube-system --set serviceAccount.create=false --set serviceAccount.name=aws-load-balancer-controller -# If not using IAM Roles for service account -helm install aws-load-balancer-controller eks/aws-load-balancer-controller --set clusterName=my-cluster -n kube-system -``` - -## Introduction -AWS Load Balancer controller manages the following AWS resources -- Application Load Balancers to satisfy Kubernetes ingress objects -- Network Load Balancers to satisfy Kubernetes service objects of type LoadBalancer with appropriate annotations - -## Security updates -**Note**: Deployed chart does not receive security updates automatically. You need to manually upgrade to a newer chart. -#### Node isolation -As a security best practice, we recommend isolating the controller deployment pods to specific node groups which run critical components. The helm chart provides parameters ```nodeSelector```, ```tolerations``` and ```affinity``` to configure node isolation. For more information, please refer to the guidance [here](https://aws.github.io/aws-eks-best-practices/security/docs/multitenancy/#isolating-tenant-workloads-to-specific-nodes). - -## Prerequisites -- Supported Kubernetes Versions - - Chart version v1.5.0+ requires Kubernetes 1.22+ - - Chart version v1.4.0+ requires Kubernetes 1.19+ - - Chart version v1.2.0 - v1.3.3 supports Kubernetes 1.16-1.21 - - Chart version v1.1.6 and before supports Kubernetes 1.15 -- IAM permissions -- Helm v3 -- Optional dependencies - - cert-manager - - Prometheus Operator - -The controller runs on the worker nodes, so it needs access to the AWS ALB/NLB resources via IAM permissions. The -IAM permissions can either be setup via IAM roles for ServiceAccount or can be attached directly to the worker node IAM roles. - -#### Setup IAM for ServiceAccount -1. Create IAM OIDC provider - ``` - eksctl utils associate-iam-oidc-provider \ - --region \ - --cluster \ - --approve - ``` -1. Download IAM policy for the AWS Load Balancer Controller - ``` - curl -o iam-policy.json https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/main/docs/install/iam_policy.json - ``` -1. Create an IAM policy called AWSLoadBalancerControllerIAMPolicy - ``` - aws iam create-policy \ - --policy-name AWSLoadBalancerControllerIAMPolicy \ - --policy-document file://iam-policy.json - ``` - Take note of the policy ARN that is returned - -1. Create a IAM role and ServiceAccount for the Load Balancer controller, use the ARN from the step above - ``` - eksctl create iamserviceaccount \ - --cluster= \ - --namespace=kube-system \ - --name=aws-load-balancer-controller \ - --attach-policy-arn=arn:aws:iam:::policy/AWSLoadBalancerControllerIAMPolicy \ - --approve - ``` -#### Setup IAM manually -If not setting up IAM for ServiceAccount, apply the IAM policies from the following URL at minimum. -``` -https://raw.githubusercontent.com/kubernetes-sigs/aws-alb-ingress-controller/main/docs/install/iam_policy.json -``` - -#### Upgrading from ALB ingress controller -If migrating from ALB ingress controller, grant [additional IAM permissions](https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/main/docs/install/iam_policy_v1_to_v2_additional.json). - -#### Upgrading from AWS Load Balancer controller v2.1.3 and earlier -- Additional IAM permissions required, ensure you have granted the [required IAM permissions](https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/main/docs/install/iam_policy.json). -- CRDs need to be updated as follows -```shell script -kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master" -``` -- you can run helm upgrade without uninstalling the old chart completely - -#### Installing cert-manager - -If you are setting `enableCertManager: true` you need to have installed cert-manager and it's CRDs before installing this chart; to install [cert-manager](https://artifacthub.io/packages/helm/cert-manager/cert-manager) follow the installation guide. - -The controller helm chart requires the cert-manager with apiVersion `cert-manager.io/v1`. - -Set `cluster.dnsDomain` (default: `cluster.local`) to the actual DNS domain of your cluster to include the FQDN in requested TLS certificates. - -#### Installing the Prometheus Operator - -If you are setting `serviceMonitor.enabled: true` you need to have installed the Prometheus Operator ServiceMonitor CRD before installing this chart and have the operator running to collect the metrics. The easiest way to do this is to install the [kube-prometheus-stack](https://artifacthub.io/packages/helm/prometheus-community/kube-prometheus-stack) Helm chart using the installation guide. - -## Installing the Chart -**Note**: You need to uninstall aws-alb-ingress-controller. Please refer to the [upgrade](#Upgrade) section below before you proceed. - -**Note**: Starting chart version 1.4.1, you need to explicitly set `clusterSecretsPermissions.allowAllSecrets` to true to grant the controller permission to access all secrets for OIDC feature. We recommend configuring access to individual secrets resource separately [[link](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/examples/secrets_access/)]. - -**Note**: To ensure compatibility, we recommend installing the AWS Load Balancer controller image version with its compatible Helm chart version. Use the ```helm search repo eks/aws-load-balancer-controller --versions``` command to find the compatible versions. - -Add the EKS repository to Helm: -```shell script -helm repo add eks https://aws.github.io/eks-charts -``` - -Install the TargetGroupBinding CRDs: - -```shell script -kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master" -``` - -Install the AWS Load Balancer controller, if using iamserviceaccount -```shell script -# NOTE: The clusterName value must be set either via the values.yaml or the Helm command line. The in the command -# below should be replaced with name of your k8s cluster before running it. -helm upgrade -i aws-load-balancer-controller eks/aws-load-balancer-controller -n kube-system --set clusterName= --set serviceAccount.create=false --set serviceAccount.name=aws-load-balancer-controller -``` - -Install the AWS Load Balancer controller, if not using iamserviceaccount -```shell script -helm upgrade -i aws-load-balancer-controller eks/aws-load-balancer-controller -n kube-system --set clusterName= -``` - -## Upgrade -The new controller is backwards compatible with the existing ingress objects. However, it will not coexist with the older aws-alb-ingress-controller. -The old controller must be uninstalled completely before installing the new version. -### Kubectl installation -If you had installed the previous version via kubectl, uninstall as follows -```shell script -$ kubectl delete deployment -n kube-system alb-ingress-controller -$ kubectl delete clusterRole alb-ingress-controller -$ kubectl delete ClusterRoleBinding alb-ingress-controller -$ kubectl delete ServiceAccount -n kube-system alb-ingress-controller - -# Alternatively you can find the version of the controller and delete as follows -$ kubectl describe deployment -n kube-system alb-ingress-controller |grep Image - Image: docker.io/amazon/aws-alb-ingress-controller:v1.1.8 -# You can delete the deployment now -$ kubectl delete deployment -n kube-system alb-ingress-controller -# In this case, the version is v1.1.8, the rbac roles can be removed as follows -$ kubectl delete -f https://raw.githubusercontent.com/kubernetes-sigs/aws-alb-ingress-controller/v1.1.8/docs/examples/rbac-role.yaml -``` -### Helm installation -If you had installed the incubator/aws-alb-ingress-controller Helm chart, uninstall as follows -```shell script -# NOTE: If installed under a different chart name and namespace, please specify as appropriate -$ helm delete aws-alb-ingress-controller -n kube-system -``` - -If you had installed the 0.1.x version of eks-charts/aws-load-balancer-controller chart earlier, the upgrade to chart version 1.0.0 will -not work due to incompatibility of the webhook api version, uninstall as follows -```shell script -$ helm delete aws-load-balancer-controller -n kube-system -``` - -## Uninstalling the Chart -```sh -helm delete aws-load-balancer-controller -n kube-system -``` - -If you setup IAM Roles for ServiceAccount, you can cleanup as follows -``` -eksctl delete iamserviceaccount --cluster --namespace kube-system --name aws-load-balancer-controller -``` - -## HA configuration -Chart release v1.2.0 and later enables high availability configuration by default. -- The default number of replicas is 2. You can pass`--set replicaCount=1` flag during chart installation to disable this. Due to leader election, only one controller will actively reconcile resources. -- The default priority class for the controller pods is `system-cluster-critical` -- Soft pod anti-affinity is enabled for controller pods with `topologyKey: kubernetes.io/hostname` if you don't configure custom affinity and set `configureDefaultAffinity` to `true` -- Pod disruption budget (PDB) has not been set by default. If you plan on running at least 2 controller pods, you can pass `--set podDisruptionBudget.maxUnavailable=1` flag during chart installation - -## Configuration - -The following tables lists the configurable parameters of the chart and their default values. -The default values set by the application itself can be confirmed [here](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/deploy/configurations/#controller-configuration-options). - - -| Parameter | Description | Default | -| ---------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- | -| `image.repository` | image repository | `public.ecr.aws/eks/aws-load-balancer-controller` | -| `image.tag` | image tag | `` | -| `image.pullPolicy` | image pull policy | `IfNotPresent` | -| `clusterName` | Kubernetes cluster name | None | -| `cluster.dnsDomain` | DNS domain of the Kubernetes cluster, included in TLS certificate requests | `cluster.local` | -| `securityContext` | Set to security context for pod | `{}` | -| `resources` | Controller pod resource requests & limits | `{}` | -| `priorityClassName` | Controller pod priority class | system-cluster-critical | -| `nodeSelector` | Node labels for controller pod assignment | `{}` | -| `tolerations` | Controller pod toleration for taints | `{}` | -| `affinity` | Affinity for pod assignment | `{}` | -| `configureDefaultAffinity` | Configure soft pod anti-affinity if custom affinity is not configured | `true` | -| `topologySpreadConstraints` | Topology Spread Constraints for pod assignment | `{}` | -| `deploymentAnnotations` | Annotations to add to deployment | `{}` | -| `podAnnotations` | Annotations to add to each pod | `{}` | -| `podLabels` | Labels to add to each pod | `{}` | -| `additionalLabels` | Labels to add to all components | `{}` | -| `rbac.create` | if `true`, create and use RBAC resources | `true` | -| `serviceAccount.annotations` | optional annotations to add to service account | None | -| `serviceAccount.automountServiceAccountToken` | Automount API credentials for a Service Account | `true` | -| `serviceAccount.imagePullSecrets` | List of image pull secrets to add to the Service Account | `[]` | -| `serviceAccount.create` | If `true`, create a new service account | `true` | -| `serviceAccount.name` | Service account to be used | None | -| `terminationGracePeriodSeconds` | Time period for controller pod to do a graceful shutdown | 10 | -| `ingressClass` | The ingress class to satisfy | alb | -| `createIngressClassResource` | Create ingressClass resource | true | -| `ingressClassParams.name` | IngressClassParams resource's name, default to the aws load balancer controller's name | None | -| `ingressClassParams.create` | If `true`, create a new ingressClassParams | true | -| `ingressClassParams.spec` | IngressClassParams defined ingress specifications | {} | -| `region` | The AWS region for the kubernetes cluster | None | -| `vpcId` | The VPC ID for the Kubernetes cluster | None | -| `awsApiEndpoints` | Custom AWS API Endpoints | None | -| `awsApiThrottle` | Custom AWS API throttle settings | None | -| `awsMaxRetries` | Maximum retries for AWS APIs | None | -| `defaultTargetType` | Default target type. Used as the default value of the `alb.ingress.kubernetes.io/target-type` and `service.beta.kubernetes.io/aws-load-balancer-nlb-target-type" annotations.`Possible values are `ip` and `instance`. | `instance` | -| `enablePodReadinessGateInject` | If enabled, targetHealth readiness gate will get injected to the pod spec for the matching endpoint pods | None | -| `enableShield` | Enable Shield addon for ALB | None | -| `enableWaf` | Enable WAF addon for ALB | None | -| `enableWafv2` | Enable WAF V2 addon for ALB | None | -| `ingressMaxConcurrentReconciles` | Maximum number of concurrently running reconcile loops for ingress | None | -| `logLevel` | Set the controller log level - info, debug | None | -| `metricsBindAddr` | The address the metric endpoint binds to | "" | -| `webhookConfig.disableIngressValidation` | Disables the validation of resources of kind Ingress | None | -| `webhookBindPort` | The TCP port the Webhook server binds to | None | -| `webhookTLS.caCert` | TLS CA certificate for webhook (auto-generated if not provided) | "" | -| `webhookTLS.cert` | TLS certificate for webhook (auto-generated if not provided) | "" | -| `webhookTLS.key` | TLS private key for webhook (auto-generated if not provided) | "" | -| `webhookNamespaceSelectors` | Namespace selectors for the wekbook | None | -| `keepTLSSecret` | Reuse existing TLS Secret during chart upgrade | `true` | -| `serviceAnnotations` | Annotations to be added to the provisioned webhook service resource | `{}` | -| `serviceMaxConcurrentReconciles` | Maximum number of concurrently running reconcile loops for service | None | -| `targetgroupbindingMaxConcurrentReconciles` | Maximum number of concurrently running reconcile loops for targetGroupBinding | None | -| `targetgroupbindingMaxExponentialBackoffDelay` | Maximum duration of exponential backoff for targetGroupBinding reconcile failures | None | -| `syncPeriod` | Period at which the controller forces the repopulation of its local object stores | None | -| `watchNamespace` | Namespace the controller watches for updates to Kubernetes objects, If empty, all namespaces are watched | None | -| `disableIngressClassAnnotation` | Disables the usage of kubernetes.io/ingress.class annotation | None | -| `disableIngressGroupNameAnnotation` | Disables the usage of alb.ingress.kubernetes.io/group.name annotation | None | -| `tolerateNonExistentBackendService` | whether to allow rules that reference a backend service that does not exist. (When enabled, it will return 503 error if backend service not exist) | `true` | -| `tolerateNonExistentBackendAction` | whether to allow rules that reference a backend action that does not exist. (When enabled, it will return 503 error if backend action not exist) | `true` | -| `defaultSSLPolicy` | Specifies the default SSL policy to use for HTTPS or TLS listeners | None | -| `externalManagedTags` | Specifies the list of tag keys on AWS resources that are managed externally | `[]` | -| `livenessProbe` | Liveness probe settings for the controller | (see `values.yaml`) | -| `env` | Environment variables to set for aws-load-balancer-controller pod | None | -| `envFrom` | Environment variables to set for aws-load-balancer-controller pod from configMap or Secret | None | -| `envSecretName` | AWS credentials as environment variables from Secret (Secret keys `key_id` and `access_key`). | None | -| `hostNetwork` | If `true`, use hostNetwork | `false` | -| `dnsPolicy` | Set dnsPolicy if required | `ClusterFirst` | -| `extraVolumeMounts` | Extra volume mounts for the pod | `[]` | -| `extraVolumes` | Extra volumes for the pod | `[]` | -| `defaultTags` | Default tags to apply to all AWS resources managed by this controller | `{}` | -| `replicaCount` | Number of controller pods to run, only one will be active due to leader election | `2` | -| `revisionHistoryLimit` | Number of revisions to keep | `10` | -| `podDisruptionBudget` | Limit the disruption for controller pods. Require at least 2 controller replicas and 3 worker nodes | `{}` | -| `updateStrategy` | Defines the update strategy for the deployment | `{}` | -| `enableCertManager` | If enabled, cert-manager issues the webhook certificates instead of the helm template, requires cert-manager and it's CRDs to be installed | `false` | -| `enableEndpointSlices` | If enabled, controller uses k8s EndpointSlices instead of Endpoints for IP targets | `false` | -| `enableBackendSecurityGroup` | If enabled, controller uses shared security group for backend traffic | `true` | -| `backendSecurityGroup` | Backend security group to use instead of auto created one if the feature is enabled | `` | -| `disableRestrictedSecurityGroupRules` | If disabled, controller will not specify port range restriction in the backend security group rules | `false` | -| `objectSelector.matchExpressions` | Webhook configuration to select specific pods by specifying the expression to be matched | None | -| `objectSelector.matchLabels` | Webhook configuration to select specific pods by specifying the key value label pair to be matched | None | -| `serviceMonitor.enabled` | Specifies whether a service monitor should be created, requires the ServiceMonitor CRD to be installed | `false` | -| `serviceMonitor.namespace` | Namespace in which to create the service monitor | None | -| `serviceMonitor.additionalLabels` | Labels to add to the service monitor | `{}` | -| `serviceMonitor.interval` | Prometheus scrape interval | `1m` | -| `serviceMonitor.scrapeTimeout` | Prometheus scrape timeout | `1m` | -| `serviceMonitor.relabelings` | Relabelings to apply to samples before ingestion | `1m` | -| `serviceMonitor.metricRelabelings` | Metric relabelings to apply to samples before ingestion | `1m` | -| `clusterSecretsPermissions.allowAllSecrets` | If `true`, controller has access to all secrets in the cluster. | `false` | -| `controllerConfig.featureGates` | set of `key: value` pairs that describe AWS load balance controller features | `{}` | -| `ingressClassConfig.default` | If `true`, the ingressclass will be the default class of the cluster. | `false` | -| `enableServiceMutatorWebhook` | If `false`, disable the Service Mutator webhook which makes all new services of type LoadBalancer reconciled by the lb controller | `true` | -| `serviceMutatorWebhookConfig.failurePolicy` | Failure policy for the Service Mutator webhook | `Fail` | -| `serviceMutatorWebhookConfig.objectSelector` | Object selector(s) to limit which objects will be mutated by the Service Mutator webhook | `[]` | -| `serviceMutatorWebhookConfig.operations` | List of operations that will trigger the the Service Mutator webhook | `[ CREATE ]` | -| `autoscaling` | If `autoscaling.enabled=true`, enable the HPA on the controller mainly to survive load induced failure by the calls to the `aws-load-balancer-webhook-service`. Please keep in mind that the controller pods have `priorityClassName: system-cluster-critical`, enabling HPA may lead to the eviction of other low-priority pods in the node | `false` | -| `serviceTargetENISGTags` | set of `key=value` pairs of AWS tags in addition to cluster name for finding the target ENI security group to which to add inbound rules from NLBs | None | -| `loadBalancerClass` | Sets the AWS load balancer type to be used when the Kubernetes service requests an external load balancer | `service.k8s.aws/nlb` | -| `creator` | if set to a `value!=helm`, it will disable the addition of default helm labels | `helm` | -| `runtimeClassName` | Runtime class name for the controller pods , such as `gvisor` or `kata`. An unspecified `nil` or empty `""` RuntimeClassName is equivalent to the backwards-compatible default behavior as if the RuntimeClass feature is disabled. | "" | diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/ci/extra_args b/charts/devtron-utilities/charts/aws-load-balancer-controller/ci/extra_args deleted file mode 100644 index c72e0d8bc..000000000 --- a/charts/devtron-utilities/charts/aws-load-balancer-controller/ci/extra_args +++ /dev/null @@ -1 +0,0 @@ ---set clusterName=k8s-ci-cluster diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/ci/values.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/ci/values.yaml deleted file mode 100644 index 4285476fa..000000000 --- a/charts/devtron-utilities/charts/aws-load-balancer-controller/ci/values.yaml +++ /dev/null @@ -1,7 +0,0 @@ -# CI testing values for aws-load-balancer-controller - -region: us-west-2 -image: - repository: public.ecr.aws/eks/aws-load-balancer-controller - tag: v2.4.5 - pullPolicy: Always diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/crds/crds.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/crds/crds.yaml deleted file mode 100644 index b72e68789..000000000 --- a/charts/devtron-utilities/charts/aws-load-balancer-controller/crds/crds.yaml +++ /dev/null @@ -1,684 +0,0 @@ -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.14.0 - name: ingressclassparams.elbv2.k8s.aws -spec: - group: elbv2.k8s.aws - names: - kind: IngressClassParams - listKind: IngressClassParamsList - plural: ingressclassparams - singular: ingressclassparams - scope: Cluster - versions: - - additionalPrinterColumns: - - description: The Ingress Group name - jsonPath: .spec.group.name - name: GROUP-NAME - type: string - - description: The AWS Load Balancer scheme - jsonPath: .spec.scheme - name: SCHEME - type: string - - description: The AWS Load Balancer ipAddressType - jsonPath: .spec.ipAddressType - name: IP-ADDRESS-TYPE - type: string - - jsonPath: .metadata.creationTimestamp - name: AGE - type: date - name: v1beta1 - schema: - openAPIV3Schema: - description: IngressClassParams is the Schema for the IngressClassParams API - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: IngressClassParamsSpec defines the desired state of IngressClassParams - properties: - certificateArn: - description: CertificateArn specifies the ARN of the certificates - for all Ingresses that belong to IngressClass with this IngressClassParams. - items: - type: string - type: array - group: - description: Group defines the IngressGroup for all Ingresses that - belong to IngressClass with this IngressClassParams. - properties: - name: - description: Name is the name of IngressGroup. - type: string - required: - - name - type: object - inboundCIDRs: - description: InboundCIDRs specifies the CIDRs that are allowed to - access the Ingresses that belong to IngressClass with this IngressClassParams. - items: - type: string - type: array - ipAddressType: - description: IPAddressType defines the ip address type for all Ingresses - that belong to IngressClass with this IngressClassParams. - enum: - - ipv4 - - dualstack - - dualstack-without-public-ipv4 - type: string - listeners: - description: Listeners define a list of listeners with their protocol, - port and attributes. - items: - properties: - listenerAttributes: - description: The attributes of the listener - items: - description: Attributes defines custom attributes on resources. - properties: - key: - description: The key of the attribute. - type: string - value: - description: The value of the attribute. - type: string - required: - - key - - value - type: object - type: array - port: - description: The port of the listener - format: int32 - type: integer - protocol: - description: The protocol of the listener - type: string - type: object - type: array - loadBalancerAttributes: - description: LoadBalancerAttributes define the custom attributes to - LoadBalancers for all Ingress that that belong to IngressClass with - this IngressClassParams. - items: - description: Attributes defines custom attributes on resources. - properties: - key: - description: The key of the attribute. - type: string - value: - description: The value of the attribute. - type: string - required: - - key - - value - type: object - type: array - minimumLoadBalancerCapacity: - description: MinimumLoadBalancerCapacity define the capacity reservation - for LoadBalancers for all Ingress that belong to IngressClass with - this IngressClassParams. - properties: - capacityUnits: - description: The Capacity Units Value. - format: int32 - type: integer - required: - - capacityUnits - type: object - namespaceSelector: - description: |- - NamespaceSelector restrict the namespaces of Ingresses that are allowed to specify the IngressClass with this IngressClassParams. - * if absent or present but empty, it selects all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. - The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies - to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - scheme: - description: Scheme defines the scheme for all Ingresses that belong - to IngressClass with this IngressClassParams. - enum: - - internal - - internet-facing - type: string - sslPolicy: - description: SSLPolicy specifies the SSL Policy for all Ingresses - that belong to IngressClass with this IngressClassParams. - type: string - subnets: - description: Subnets defines the subnets for all Ingresses that belong - to IngressClass with this IngressClassParams. - properties: - ids: - description: IDs specify the resource IDs of subnets. Exactly - one of this or `tags` must be specified. - items: - description: SubnetID specifies a subnet ID. - pattern: subnet-[0-9a-f]+ - type: string - minItems: 1 - type: array - tags: - additionalProperties: - items: - type: string - type: array - description: |- - Tags specifies subnets in the load balancer's VPC where each - tag specified in the map key contains one of the values in the corresponding - value list. - Exactly one of this or `ids` must be specified. - type: object - type: object - tags: - description: Tags defines list of Tags on AWS resources provisioned - for Ingresses that belong to IngressClass with this IngressClassParams. - items: - description: Tag defines a AWS Tag on resources. - properties: - key: - description: The key of the tag. - type: string - value: - description: The value of the tag. - type: string - required: - - key - - value - type: object - type: array - type: object - type: object - served: true - storage: true - subresources: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.14.0 - name: targetgroupbindings.elbv2.k8s.aws -spec: - group: elbv2.k8s.aws - names: - kind: TargetGroupBinding - listKind: TargetGroupBindingList - plural: targetgroupbindings - singular: targetgroupbinding - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: The Kubernetes Service's name - jsonPath: .spec.serviceRef.name - name: SERVICE-NAME - type: string - - description: The Kubernetes Service's port - jsonPath: .spec.serviceRef.port - name: SERVICE-PORT - type: string - - description: The AWS TargetGroup's TargetType - jsonPath: .spec.targetType - name: TARGET-TYPE - type: string - - description: The AWS TargetGroup's Amazon Resource Name - jsonPath: .spec.targetGroupARN - name: ARN - priority: 1 - type: string - - description: The AWS TargetGroup's Name - jsonPath: .spec.targetGroupName - name: NAME - priority: 2 - type: string - - jsonPath: .metadata.creationTimestamp - name: AGE - type: date - name: v1alpha1 - schema: - openAPIV3Schema: - description: TargetGroupBinding is the Schema for the TargetGroupBinding API - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: TargetGroupBindingSpec defines the desired state of TargetGroupBinding - properties: - multiClusterTargetGroup: - description: MultiClusterTargetGroup Denotes if the TargetGroup is - shared among multiple clusters - type: boolean - networking: - description: networking provides the networking setup for ELBV2 LoadBalancer - to access targets in TargetGroup. - properties: - ingress: - description: List of ingress rules to allow ELBV2 LoadBalancer - to access targets in TargetGroup. - items: - properties: - from: - description: |- - List of peers which should be able to access the targets in TargetGroup. - At least one NetworkingPeer should be specified. - items: - description: NetworkingPeer defines the source/destination - peer for networking rules. - properties: - ipBlock: - description: |- - IPBlock defines an IPBlock peer. - If specified, none of the other fields can be set. - properties: - cidr: - description: |- - CIDR is the network CIDR. - Both IPV4 or IPV6 CIDR are accepted. - type: string - required: - - cidr - type: object - securityGroup: - description: |- - SecurityGroup defines a SecurityGroup peer. - If specified, none of the other fields can be set. - properties: - groupID: - description: GroupID is the EC2 SecurityGroupID. - type: string - required: - - groupID - type: object - type: object - type: array - ports: - description: |- - List of ports which should be made accessible on the targets in TargetGroup. - If ports is empty or unspecified, it defaults to all ports with TCP. - items: - properties: - port: - anyOf: - - type: integer - - type: string - description: |- - The port which traffic must match. - When NodePort endpoints(instance TargetType) is used, this must be a numerical port. - When Port endpoints(ip TargetType) is used, this can be either numerical or named port on pods. - if port is unspecified, it defaults to all ports. - x-kubernetes-int-or-string: true - protocol: - description: |- - The protocol which traffic must match. - If protocol is unspecified, it defaults to TCP. - enum: - - TCP - - UDP - type: string - type: object - type: array - required: - - from - - ports - type: object - type: array - type: object - serviceRef: - description: serviceRef is a reference to a Kubernetes Service and - ServicePort. - properties: - name: - description: Name is the name of the Service. - type: string - port: - anyOf: - - type: integer - - type: string - description: Port is the port of the ServicePort. - x-kubernetes-int-or-string: true - required: - - name - - port - type: object - targetGroupARN: - description: targetGroupARN is the Amazon Resource Name (ARN) for - the TargetGroup. - type: string - targetGroupName: - description: targetGroupName is the Name of the TargetGroup. - type: string - targetType: - description: targetType is the TargetType of TargetGroup. If unspecified, - it will be automatically inferred. - enum: - - instance - - ip - type: string - required: - - serviceRef - type: object - status: - description: TargetGroupBindingStatus defines the observed state of TargetGroupBinding - properties: - observedGeneration: - description: The generation observed by the TargetGroupBinding controller. - format: int64 - type: integer - type: object - type: object - served: true - storage: false - subresources: - status: {} - - additionalPrinterColumns: - - description: The Kubernetes Service's name - jsonPath: .spec.serviceRef.name - name: SERVICE-NAME - type: string - - description: The Kubernetes Service's port - jsonPath: .spec.serviceRef.port - name: SERVICE-PORT - type: string - - description: The AWS TargetGroup's TargetType - jsonPath: .spec.targetType - name: TARGET-TYPE - type: string - - description: The AWS TargetGroup's Amazon Resource Name - jsonPath: .spec.targetGroupARN - name: ARN - priority: 1 - type: string - - description: The AWS TargetGroup's Name - jsonPath: .spec.targetGroupName - name: NAME - priority: 2 - type: string - - jsonPath: .metadata.creationTimestamp - name: AGE - type: date - name: v1beta1 - schema: - openAPIV3Schema: - description: TargetGroupBinding is the Schema for the TargetGroupBinding API - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: TargetGroupBindingSpec defines the desired state of TargetGroupBinding - properties: - ipAddressType: - description: ipAddressType specifies whether the target group is of - type IPv4 or IPv6. If unspecified, it will be automatically inferred. - enum: - - ipv4 - - ipv6 - type: string - multiClusterTargetGroup: - description: MultiClusterTargetGroup Denotes if the TargetGroup is - shared among multiple clusters - type: boolean - networking: - description: networking defines the networking rules to allow ELBV2 - LoadBalancer to access targets in TargetGroup. - properties: - ingress: - description: List of ingress rules to allow ELBV2 LoadBalancer - to access targets in TargetGroup. - items: - description: NetworkingIngressRule defines a particular set - of traffic that is allowed to access TargetGroup's targets. - properties: - from: - description: |- - List of peers which should be able to access the targets in TargetGroup. - At least one NetworkingPeer should be specified. - items: - description: NetworkingPeer defines the source/destination - peer for networking rules. - properties: - ipBlock: - description: |- - IPBlock defines an IPBlock peer. - If specified, none of the other fields can be set. - properties: - cidr: - description: |- - CIDR is the network CIDR. - Both IPV4 or IPV6 CIDR are accepted. - type: string - required: - - cidr - type: object - securityGroup: - description: |- - SecurityGroup defines a SecurityGroup peer. - If specified, none of the other fields can be set. - properties: - groupID: - description: GroupID is the EC2 SecurityGroupID. - type: string - required: - - groupID - type: object - type: object - type: array - ports: - description: |- - List of ports which should be made accessible on the targets in TargetGroup. - If ports is empty or unspecified, it defaults to all ports with TCP. - items: - description: NetworkingPort defines the port and protocol - for networking rules. - properties: - port: - anyOf: - - type: integer - - type: string - description: |- - The port which traffic must match. - When NodePort endpoints(instance TargetType) is used, this must be a numerical port. - When Port endpoints(ip TargetType) is used, this can be either numerical or named port on pods. - if port is unspecified, it defaults to all ports. - x-kubernetes-int-or-string: true - protocol: - description: |- - The protocol which traffic must match. - If protocol is unspecified, it defaults to TCP. - enum: - - TCP - - UDP - type: string - type: object - type: array - required: - - from - - ports - type: object - type: array - type: object - nodeSelector: - description: node selector for instance type target groups to only - register certain nodes - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. - The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies - to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - serviceRef: - description: serviceRef is a reference to a Kubernetes Service and - ServicePort. - properties: - name: - description: Name is the name of the Service. - type: string - port: - anyOf: - - type: integer - - type: string - description: Port is the port of the ServicePort. - x-kubernetes-int-or-string: true - required: - - name - - port - type: object - targetGroupARN: - description: targetGroupARN is the Amazon Resource Name (ARN) for - the TargetGroup. - type: string - targetGroupName: - description: targetGroupName is the Name of the TargetGroup. - type: string - targetType: - description: targetType is the TargetType of TargetGroup. If unspecified, - it will be automatically inferred. - enum: - - instance - - ip - type: string - vpcID: - description: VpcID is the VPC of the TargetGroup. If unspecified, - it will be automatically inferred. - type: string - required: - - serviceRef - type: object - status: - description: TargetGroupBindingStatus defines the observed state of TargetGroupBinding - properties: - observedGeneration: - description: The generation observed by the TargetGroupBinding controller. - format: int64 - type: integer - type: object - type: object - served: true - storage: true - subresources: - status: {} diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/NOTES.txt b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/NOTES.txt deleted file mode 100644 index 04e98e0a9..000000000 --- a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/NOTES.txt +++ /dev/null @@ -1 +0,0 @@ -AWS Load Balancer controller installed! diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/_helpers.tpl b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/_helpers.tpl deleted file mode 100644 index d916b99c4..000000000 --- a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/_helpers.tpl +++ /dev/null @@ -1,131 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "aws-load-balancer-controller.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "aws-load-balancer-controller.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "aws-load-balancer-controller.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Chart name prefix for resource names -Strip the "-controller" suffix from the default .Chart.Name if the nameOverride is not specified. -This enables using a shorter name for the resources, for example aws-load-balancer-webhook. -*/}} -{{- define "aws-load-balancer-controller.namePrefix" -}} -{{- $defaultNamePrefix := .Chart.Name | trimSuffix "-controller" -}} -{{- default $defaultNamePrefix .Values.nameOverride | trunc 42 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Common labels -*/}} -{{- define "aws-load-balancer-controller.labels" -}} -{{- if eq (default "helm" .Values.creator) "helm" -}} -app.kubernetes.io/managed-by: {{ .Release.Service }} -helm.sh/chart: {{ include "aws-load-balancer-controller.chart" . }} -{{- end }} -{{ include "aws-load-balancer-controller.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels }} -{{- end -}} -{{- end -}} - -{{/* -Selector labels -*/}} -{{- define "aws-load-balancer-controller.selectorLabels" -}} -app.kubernetes.io/name: {{ include "aws-load-balancer-controller.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end -}} - -{{/* -Create the name of the service account to use -*/}} -{{- define "aws-load-balancer-controller.serviceAccountName" -}} -{{- if .Values.serviceAccount.create -}} - {{ default (include "aws-load-balancer-controller.fullname" .) .Values.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Create the name of the webhook service -*/}} -{{- define "aws-load-balancer-controller.webhookService" -}} -{{- printf "%s-webhook-service" (include "aws-load-balancer-controller.namePrefix" .) -}} -{{- end -}} - -{{/* -Create the name of the webhook cert secret -*/}} -{{- define "aws-load-balancer-controller.webhookCertSecret" -}} -{{- printf "%s-tls" (include "aws-load-balancer-controller.namePrefix" .) -}} -{{- end -}} - -{{/* -Generate certificates for webhook -*/}} -{{- define "aws-load-balancer-controller.webhookCerts" -}} -{{- $serviceName := (include "aws-load-balancer-controller.webhookService" .) -}} -{{- $secretName := (include "aws-load-balancer-controller.webhookCertSecret" .) -}} -{{- $secret := lookup "v1" "Secret" .Release.Namespace $secretName -}} -{{- if (and .Values.webhookTLS.caCert .Values.webhookTLS.cert .Values.webhookTLS.key) -}} -caCert: {{ .Values.webhookTLS.caCert | b64enc }} -clientCert: {{ .Values.webhookTLS.cert | b64enc }} -clientKey: {{ .Values.webhookTLS.key | b64enc }} -{{- else if and .Values.keepTLSSecret $secret -}} -caCert: {{ index $secret.data "ca.crt" }} -clientCert: {{ index $secret.data "tls.crt" }} -clientKey: {{ index $secret.data "tls.key" }} -{{- else -}} -{{- $altNames := list (printf "%s.%s" $serviceName .Release.Namespace) (printf "%s.%s.svc" $serviceName .Release.Namespace) (printf "%s.%s.svc.%s" $serviceName .Release.Namespace .Values.cluster.dnsDomain) -}} -{{- $ca := genCA "aws-load-balancer-controller-ca" 3650 -}} -{{- $cert := genSignedCert (include "aws-load-balancer-controller.fullname" .) nil $altNames 3650 $ca -}} -caCert: {{ $ca.Cert | b64enc }} -clientCert: {{ $cert.Cert | b64enc }} -clientKey: {{ $cert.Key | b64enc }} -{{- end -}} -{{- end -}} - -{{/* -Convert map to comma separated key=value string -*/}} -{{- define "aws-load-balancer-controller.convertMapToCsv" -}} -{{- range $key, $value := . -}} {{ $key }}={{ $value }}, {{- end -}} -{{- end -}} - -{{/* -Create the name of the ingressClassParams -*/}} -{{- define "aws-load-balancer-controller.ingressClassParamsName" -}} -{{ default .Values.ingressClass .Values.ingressClassParams.name }} -{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/deployment.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/deployment.yaml deleted file mode 100644 index 4506d489e..000000000 --- a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/deployment.yaml +++ /dev/null @@ -1,263 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "aws-load-balancer-controller.fullname" . }} - namespace: {{ .Release.Namespace }} - {{- if .Values.deploymentAnnotations }} - annotations: - {{- toYaml .Values.deploymentAnnotations | nindent 4 }} - {{- end }} - labels: - {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} -spec: - replicas: {{ .Values.replicaCount }} - revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} - selector: - matchLabels: - {{- include "aws-load-balancer-controller.selectorLabels" . | nindent 6 }} - {{- with .Values.updateStrategy }} - strategy: - {{ toYaml . | nindent 4 }} - {{- end }} - template: - metadata: - labels: - {{- include "aws-load-balancer-controller.selectorLabels" . | nindent 8 }} - {{- if .Values.podLabels }} - {{- toYaml .Values.podLabels | nindent 8 }} - {{- end }} - annotations: - {{- if not .Values.serviceMonitor.enabled }} - prometheus.io/scrape: "true" - prometheus.io/port: "{{ (split ":" .Values.metricsBindAddr)._1 | default 8080 }}" - {{- end}} - {{- if .Values.podAnnotations }} - {{- toYaml .Values.podAnnotations | nindent 8 }} - {{- end }} - spec: - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.runtimeClassName }} - runtimeClassName: {{ .Values.runtimeClassName }} - {{- end }} - serviceAccountName: {{ include "aws-load-balancer-controller.serviceAccountName" . }} - volumes: - - name: cert - secret: - defaultMode: 420 - secretName: {{ template "aws-load-balancer-controller.webhookCertSecret" . }} - {{- with .Values.extraVolumes }} - {{ toYaml . | nindent 6 }} - {{- end }} - securityContext: - {{- toYaml .Values.podSecurityContext | nindent 8 }} - {{- if .Values.hostNetwork }} - hostNetwork: true - {{- end }} - {{- if .Values.dnsPolicy }} - dnsPolicy: {{ .Values.dnsPolicy }} - {{- end }} - containers: - - name: {{ .Chart.Name }} - args: - - --cluster-name={{ required "Chart cannot be installed without a valid clusterName!" (tpl (default "" .Values.clusterName) .) }} - {{- if .Values.ingressClass }} - - --ingress-class={{ .Values.ingressClass }} - {{- end }} - {{- $region := tpl (default "" .Values.region) . }} - {{- if $region }} - - --aws-region={{ .Values.region }} - {{- end }} - {{- $vpcID := tpl (default "" .Values.vpcId) . }} - {{- if $vpcID }} - - --aws-vpc-id={{ $vpcID }} - {{- end }} - {{- if .Values.awsApiEndpoints }} - - --aws-api-endpoints={{ .Values.awsApiEndpoints }} - {{- end }} - {{- if .Values.awsApiThrottle }} - - --aws-api-throttle={{ join "," .Values.awsApiThrottle }} - {{- end }} - {{- if .Values.awsMaxRetries }} - - --aws-max-retries={{ .Values.awsMaxRetries }} - {{- end }} - {{- if kindIs "bool" .Values.enablePodReadinessGateInject }} - - --enable-pod-readiness-gate-inject={{ .Values.enablePodReadinessGateInject }} - {{- end }} - {{- if kindIs "bool" .Values.enableShield }} - - --enable-shield={{ .Values.enableShield }} - {{- end }} - {{- if kindIs "bool" .Values.enableWaf }} - - --enable-waf={{ .Values.enableWaf }} - {{- end }} - {{- if kindIs "bool" .Values.enableWafv2 }} - - --enable-wafv2={{ .Values.enableWafv2 }} - {{- end }} - {{- if .Values.metricsBindAddr }} - - --metrics-bind-addr={{ .Values.metricsBindAddr }} - {{- end }} - {{- if .Values.ingressMaxConcurrentReconciles }} - - --ingress-max-concurrent-reconciles={{ .Values.ingressMaxConcurrentReconciles }} - {{- end }} - {{- if .Values.serviceMaxConcurrentReconciles }} - - --service-max-concurrent-reconciles={{ .Values.serviceMaxConcurrentReconciles }} - {{- end }} - {{- if .Values.targetgroupbindingMaxConcurrentReconciles }} - - --targetgroupbinding-max-concurrent-reconciles={{ .Values.targetgroupbindingMaxConcurrentReconciles }} - {{- end }} - {{- if .Values.targetgroupbindingMaxExponentialBackoffDelay }} - - --targetgroupbinding-max-exponential-backoff-delay={{ .Values.targetgroupbindingMaxExponentialBackoffDelay }} - {{- end }} - {{- if .Values.lbStabilizationMonitorInterval }} - - --lb-stabilization-monitor-interval={{ .Values.lbStabilizationMonitorInterval }} - {{- end }} - {{- if .Values.logLevel }} - - --log-level={{ .Values.logLevel }} - {{- end }} - {{- if .Values.webhookBindPort }} - - --webhook-bind-port={{ .Values.webhookBindPort }} - {{- end }} - {{- if .Values.syncPeriod }} - - --sync-period={{ .Values.syncPeriod }} - {{- end }} - {{- if .Values.watchNamespace }} - - --watch-namespace={{ .Values.watchNamespace }} - {{- end }} - {{- if kindIs "bool" .Values.disableIngressClassAnnotation }} - - --disable-ingress-class-annotation={{ .Values.disableIngressClassAnnotation }} - {{- end }} - {{- if kindIs "bool" .Values.disableIngressGroupNameAnnotation }} - - --disable-ingress-group-name-annotation={{ .Values.disableIngressGroupNameAnnotation }} - {{- end }} - {{- if kindIs "bool" .Values.tolerateNonExistentBackendService }} - - --tolerate-non-existent-backend-service={{ .Values.tolerateNonExistentBackendService }} - {{- end }} - {{- if kindIs "bool" .Values.tolerateNonExistentBackendAction }} - - --tolerate-non-existent-backend-action={{ .Values.tolerateNonExistentBackendAction }} - {{- end }} - {{- if .Values.defaultSSLPolicy }} - - --default-ssl-policy={{ .Values.defaultSSLPolicy }} - {{- end }} - {{- if .Values.externalManagedTags }} - - --external-managed-tags={{ join "," .Values.externalManagedTags }} - {{- end }} - {{- if .Values.defaultTags }} - - --default-tags={{ include "aws-load-balancer-controller.convertMapToCsv" .Values.defaultTags | trimSuffix "," }} - {{- end }} - {{- if kindIs "bool" .Values.enableEndpointSlices }} - - --enable-endpoint-slices={{ .Values.enableEndpointSlices }} - {{- end }} - {{- if kindIs "bool" .Values.enableBackendSecurityGroup }} - - --enable-backend-security-group={{ .Values.enableBackendSecurityGroup }} - {{- end }} - {{- if .Values.backendSecurityGroup }} - - --backend-security-group={{ .Values.backendSecurityGroup }} - {{- end }} - {{- if kindIs "bool" .Values.disableRestrictedSecurityGroupRules }} - - --disable-restricted-sg-rules={{ .Values.disableRestrictedSecurityGroupRules }} - {{- end }} - {{- if .Values.controllerConfig.featureGates }} - - --feature-gates={{ include "aws-load-balancer-controller.convertMapToCsv" .Values.controllerConfig.featureGates | trimSuffix "," }} - {{- end }} - {{- if ne .Values.defaultTargetType "instance" }} - - --default-target-type={{ .Values.defaultTargetType }} - {{- end }} - {{- if .Values.serviceTargetENISGTags }} - - --service-target-eni-security-group-tags={{ .Values.serviceTargetENISGTags }} - {{- end }} - {{- if .Values.certDiscovery.allowedCertificateAuthorityARNs }} - - --allowed-certificate-authority-arns={{ .Values.certDiscovery.allowedCertificateAuthorityARNs }} - {{- end }} - {{- if .Values.loadBalancerClass }} - - --load-balancer-class={{ .Values.loadBalancerClass }} - {{- end }} - {{- if or .Values.env .Values.envSecretName }} - env: - {{- if .Values.env}} - {{- range $key, $value := .Values.env }} - - name: {{ $key }} - value: "{{ $value }}" - {{- end }} - {{- end }} - {{- if .Values.envSecretName }} - - name: AWS_ACCESS_KEY_ID - valueFrom: - secretKeyRef: - name: {{ .Values.envSecretName }} - key: key_id - optional: true - - name: AWS_SECRET_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ .Values.envSecretName }} - key: access_key - optional: true - {{- end }} - {{- end }} - {{- if .Values.envFrom }} - envFrom: - {{- toYaml .Values.envFrom | nindent 10 }} - {{- end }} - securityContext: - {{- toYaml .Values.securityContext | nindent 10 }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" - imagePullPolicy: {{ .Values.image.pullPolicy }} - volumeMounts: - - mountPath: /tmp/k8s-webhook-server/serving-certs - name: cert - readOnly: true - {{- with .Values.extraVolumeMounts }} - {{ toYaml . | nindent 8 }} - {{- end }} - ports: - - name: webhook-server - containerPort: {{ .Values.webhookBindPort | default 9443 }} - protocol: TCP - - name: metrics-server - containerPort: {{ (split ":" .Values.metricsBindAddr)._1 | default 8080 }} - protocol: TCP - resources: - {{- toYaml .Values.resources | nindent 10 }} - {{- with .Values.livenessProbe }} - livenessProbe: - {{- toYaml . | nindent 10 }} - {{- end }} - {{- with .Values.readinessProbe }} - readinessProbe: - {{- toYaml . | nindent 10 }} - {{- end }} - terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }} - {{- with .Values.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- if .Values.affinity }} - affinity: - {{- toYaml .Values.affinity | nindent 8 }} - {{- else if .Values.configureDefaultAffinity }} - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 - podAffinityTerm: - labelSelector: - matchExpressions: - - key: app.kubernetes.io/name - operator: In - values: - - {{ include "aws-load-balancer-controller.name" . }} - topologyKey: kubernetes.io/hostname - {{- end }} - {{- with .Values.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- if .Values.priorityClassName }} - priorityClassName: {{ .Values.priorityClassName | quote }} - {{- end }} - {{- with .Values.topologySpreadConstraints }} - topologySpreadConstraints: - {{- toYaml . | nindent 8 }} - {{- end }} diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/hpa.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/hpa.yaml deleted file mode 100644 index 68689ba66..000000000 --- a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/hpa.yaml +++ /dev/null @@ -1,34 +0,0 @@ -{{- if .Values.autoscaling.enabled }} -{{- if (semverCompare ">=1.23-0" .Capabilities.KubeVersion.Version)}} -apiVersion: autoscaling/v2 -{{- else }} -apiVersion: autoscaling/v2beta2 -{{- end }} -kind: HorizontalPodAutoscaler -metadata: - name: {{ include "aws-load-balancer-controller.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} - annotations: - {{- .Values.annotations | toYaml | nindent 4 }} -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: {{ include "aws-load-balancer-controller.fullname" . }} - minReplicas: {{ .Values.autoscaling.minReplicas }} - maxReplicas: {{ required "A valid .Values.autoscaling.maxReplicas value is required" .Values.autoscaling.maxReplicas }} - metrics: - {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} - - type: Resource - resource: - name: cpu - target: - averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} - type: Utilization - {{- end }} - {{- if .Values.autoscaling.autoscaleBehavior }} - behavior: {{ toYaml .Values.autoscaling.autoscaleBehavior | nindent 4 }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/ingressclass.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/ingressclass.yaml deleted file mode 100644 index feed802d2..000000000 --- a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/ingressclass.yaml +++ /dev/null @@ -1,41 +0,0 @@ -{{- /* -[caution] AWSLoadBalancerController <= v2.4.2 expects referenced IngressClassParams to be created before IngressClass. -We use a list here to force Helm create IngressClassParams(if any) before apply any IngressClass changes. -*/}} -{{- if .Values.createIngressClassResource }} -apiVersion: v1 -kind: List -metadata: - name: ingress-class -items: -{{- if .Values.ingressClassParams.create }} -- apiVersion: elbv2.k8s.aws/v1beta1 - kind: IngressClassParams - metadata: - name: {{ include "aws-load-balancer-controller.ingressClassParamsName" . }} - labels: - {{- include "aws-load-balancer-controller.labels" . | nindent 6 }} - {{- with .Values.ingressClassParams.spec }} - spec: - {{- toYaml . | nindent 4 }} - {{- end }} -{{- end }} -- apiVersion: networking.k8s.io/v1 - kind: IngressClass - metadata: - name: {{ .Values.ingressClass }} - labels: - {{- include "aws-load-balancer-controller.labels" . | nindent 6 }} - {{- if .Values.ingressClassConfig.default }} - annotations: - ingressclass.kubernetes.io/is-default-class: "true" - {{- end }} - spec: - controller: ingress.k8s.aws/alb - {{- if or .Values.ingressClassParams.name (and .Values.ingressClassParams.create .Values.ingressClassParams.spec) }} - parameters: - apiGroup: elbv2.k8s.aws - kind: IngressClassParams - name: {{ include "aws-load-balancer-controller.ingressClassParamsName" . }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/pdb.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/pdb.yaml deleted file mode 100644 index f72abaf34..000000000 --- a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/pdb.yaml +++ /dev/null @@ -1,14 +0,0 @@ -{{- if and .Values.podDisruptionBudget (gt (int .Values.replicaCount) 1) }} -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: {{ include "aws-load-balancer-controller.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} -spec: - selector: - matchLabels: - {{- include "aws-load-balancer-controller.selectorLabels" . | nindent 6 }} - {{- toYaml .Values.podDisruptionBudget | nindent 2 }} -{{- end }} diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/rbac.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/rbac.yaml deleted file mode 100644 index 0dcc68c77..000000000 --- a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/rbac.yaml +++ /dev/null @@ -1,107 +0,0 @@ -{{- if .Values.rbac.create }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ template "aws-load-balancer-controller.fullname" . }}-leader-election-role - namespace: {{ .Release.Namespace }} - labels: - {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} -rules: -- apiGroups: [""] - resources: [configmaps] - verbs: [create] -- apiGroups: [""] - resources: [configmaps] - resourceNames: [aws-load-balancer-controller-leader] - verbs: [get, patch, update] -- apiGroups: - - "coordination.k8s.io" - resources: - - leases - verbs: - - create -- apiGroups: - - "coordination.k8s.io" - resources: - - leases - resourceNames: - - aws-load-balancer-controller-leader - verbs: - - get - - update - - patch ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ template "aws-load-balancer-controller.fullname" . }}-leader-election-rolebinding - namespace: {{ .Release.Namespace }} - labels: - {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ template "aws-load-balancer-controller.fullname" . }}-leader-election-role -subjects: -- kind: ServiceAccount - name: {{ template "aws-load-balancer-controller.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ template "aws-load-balancer-controller.fullname" . }}-role - labels: - {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} -rules: -- apiGroups: ["elbv2.k8s.aws"] - resources: [targetgroupbindings] - verbs: [create, delete, get, list, patch, update, watch] -- apiGroups: ["elbv2.k8s.aws"] - resources: [ingressclassparams] - verbs: [get, list, watch] -- apiGroups: [""] - resources: [events] - verbs: [create, patch] -- apiGroups: [""] - resources: [pods] - verbs: [get, list, watch] -- apiGroups: ["networking.k8s.io"] - resources: [ingressclasses] - verbs: [get, list, watch] -- apiGroups: ["", "extensions", "networking.k8s.io"] - resources: [services, ingresses] - verbs: [get, list, patch, update, watch] -- apiGroups: [""] - resources: [nodes, namespaces, endpoints] - verbs: [get, list, watch] -- apiGroups: [""] - resources: [configmaps] - verbs: [get, delete, create, update] -{{- if .Values.clusterSecretsPermissions.allowAllSecrets }} -- apiGroups: [""] - resources: [secrets] - verbs: [get, list, watch] -{{- end }} -- apiGroups: ["elbv2.k8s.aws", "", "extensions", "networking.k8s.io"] - resources: [targetgroupbindings/status, pods/status, services/status, ingresses/status] - verbs: [update, patch] -- apiGroups: ["discovery.k8s.io"] - resources: [endpointslices] - verbs: [get, list, watch] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ template "aws-load-balancer-controller.fullname" . }}-rolebinding - labels: - {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ template "aws-load-balancer-controller.fullname" . }}-role -subjects: -- kind: ServiceAccount - name: {{ template "aws-load-balancer-controller.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} -{{- end }} diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/service.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/service.yaml deleted file mode 100644 index aad0044eb..000000000 --- a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/service.yaml +++ /dev/null @@ -1,41 +0,0 @@ -{{- if.Values.serviceMonitor.enabled }} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "aws-load-balancer-controller.fullname" . }} - namespace: {{ .Release.Namespace }} - {{- with .Values.serviceAnnotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} - labels: - {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} -spec: - ports: - - port: 8080 - name: metrics-server - targetPort: metrics-server - selector: - {{- include "aws-load-balancer-controller.selectorLabels" . | nindent 4 }} ---- -{{- end }} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "aws-load-balancer-controller.webhookService" . }} - namespace: {{ .Release.Namespace }} - {{- with .Values.serviceAnnotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} - labels: - {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} - app.kubernetes.io/component: webhook - prometheus.io/service-monitor: "false" -spec: - ports: - - port: 443 - name: webhook-server - targetPort: webhook-server - selector: - {{- include "aws-load-balancer-controller.selectorLabels" . | nindent 4 }} diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/serviceaccount.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/serviceaccount.yaml deleted file mode 100644 index f4cfcac69..000000000 --- a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/serviceaccount.yaml +++ /dev/null @@ -1,18 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "aws-load-balancer-controller.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} - {{- with .Values.serviceAccount.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} -{{- with .Values.serviceAccount.imagePullSecrets }} -imagePullSecrets: -{{ toYaml . }} -{{- end }} -{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/servicemonitor.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/servicemonitor.yaml deleted file mode 100644 index 0454558c2..000000000 --- a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/servicemonitor.yaml +++ /dev/null @@ -1,43 +0,0 @@ -{{- if.Values.serviceMonitor.enabled -}} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ include "aws-load-balancer-controller.fullname" . }} - namespace: {{ default .Release.Namespace .Values.serviceMonitor.namespace }} - labels: - {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} - {{- with .Values.serviceMonitor.additionalLabels }} - {{- toYaml . | nindent 4 }} - {{- end }} -spec: - jobLabel: app.kubernetes.io/instance - namespaceSelector: - matchNames: - - {{ .Release.Namespace }} - selector: - matchLabels: - {{- include "aws-load-balancer-controller.selectorLabels" . | nindent 6 }} - matchExpressions: - - key: prometheus.io/service-monitor - operator: NotIn - values: - - "false" - endpoints: - - port: metrics-server - path: /metrics - scheme: http - {{- with .Values.serviceMonitor.interval }} - interval: {{ . }} - {{- end }} - {{- with .Values.serviceMonitor.scrapeTimeout }} - scrapeTimeout: {{ . }} - {{- end }} - {{- with .Values.serviceMonitor.relabelings }} - relabelings: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.serviceMonitor.metricRelabelings }} - metricRelabelings: - {{- toYaml . | nindent 8 }} - {{- end }} -{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/webhook.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/webhook.yaml deleted file mode 100644 index 504f08ccb..000000000 --- a/charts/devtron-utilities/charts/aws-load-balancer-controller/templates/webhook.yaml +++ /dev/null @@ -1,250 +0,0 @@ -{{ $tls := fromYaml ( include "aws-load-balancer-controller.webhookCerts" . ) }} ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: MutatingWebhookConfiguration -metadata: -{{- if $.Values.enableCertManager }} - annotations: - cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "aws-load-balancer-controller.namePrefix" . }}-serving-cert -{{- end }} - name: {{ include "aws-load-balancer-controller.namePrefix" . }}-webhook - labels: - {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} -webhooks: -- clientConfig: - {{ if not $.Values.enableCertManager -}} - caBundle: {{ $tls.caCert }} - {{ end }} - service: - name: {{ template "aws-load-balancer-controller.webhookService" . }} - namespace: {{ $.Release.Namespace }} - path: /mutate-v1-pod - failurePolicy: Fail - name: mpod.elbv2.k8s.aws - admissionReviewVersions: - - v1beta1 - namespaceSelector: - matchExpressions: - {{ if .Values.webhookNamespaceSelectors }} - {{ toYaml .Values.webhookNamespaceSelectors | nindent 4 }} - {{ else }} - - key: elbv2.k8s.aws/pod-readiness-gate-inject - operator: In - values: - - enabled - {{ end }} - objectSelector: - matchExpressions: - - key: app.kubernetes.io/name - operator: NotIn - values: - - {{ include "aws-load-balancer-controller.name" . }} - {{- if .Values.objectSelector.matchExpressions }} - {{- toYaml .Values.objectSelector.matchExpressions | nindent 4 }} - {{- end }} - {{- if .Values.objectSelector.matchLabels }} - matchLabels: - {{- toYaml .Values.objectSelector.matchLabels | nindent 6 }} - {{- end }} - rules: - - apiGroups: - - "" - apiVersions: - - v1 - operations: - - CREATE - resources: - - pods - sideEffects: None -{{- if .Values.enableServiceMutatorWebhook }} -- clientConfig: - {{ if not $.Values.enableCertManager -}} - caBundle: {{ $tls.caCert }} - {{ end }} - service: - name: {{ template "aws-load-balancer-controller.webhookService" . }} - namespace: {{ $.Release.Namespace }} - path: /mutate-v1-service - failurePolicy: {{ .Values.serviceMutatorWebhookConfig.failurePolicy }} - name: mservice.elbv2.k8s.aws - admissionReviewVersions: - - v1beta1 - objectSelector: - matchExpressions: - - key: app.kubernetes.io/name - operator: NotIn - values: - - {{ include "aws-load-balancer-controller.name" . }} - {{- if .Values.serviceMutatorWebhookConfig.objectSelector.matchExpressions }} - {{- toYaml .Values.serviceMutatorWebhookConfig.objectSelector.matchExpressions | nindent 4 }} - {{- end }} - - {{- if .Values.serviceMutatorWebhookConfig.objectSelector.matchLabels }} - matchLabels: - {{- toYaml .Values.serviceMutatorWebhookConfig.objectSelector.matchLabels | nindent 6 }} - {{- end }} - rules: - - apiGroups: - - "" - apiVersions: - - v1 - operations: - {{- toYaml .Values.serviceMutatorWebhookConfig.operations | nindent 4 }} - resources: - - services - sideEffects: None -{{- end }} -- clientConfig: - {{ if not $.Values.enableCertManager -}} - caBundle: {{ $tls.caCert }} - {{ end }} - service: - name: {{ template "aws-load-balancer-controller.webhookService" . }} - namespace: {{ $.Release.Namespace }} - path: /mutate-elbv2-k8s-aws-v1beta1-targetgroupbinding - failurePolicy: Fail - name: mtargetgroupbinding.elbv2.k8s.aws - admissionReviewVersions: - - v1beta1 - rules: - - apiGroups: - - elbv2.k8s.aws - apiVersions: - - v1beta1 - operations: - - CREATE - - UPDATE - resources: - - targetgroupbindings - sideEffects: None ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingWebhookConfiguration -metadata: -{{- if $.Values.enableCertManager }} - annotations: - cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "aws-load-balancer-controller.namePrefix" . }}-serving-cert -{{- end }} - name: {{ include "aws-load-balancer-controller.namePrefix" . }}-webhook - labels: - {{- include "aws-load-balancer-controller.labels" . | nindent 4 }} -webhooks: -- clientConfig: - {{ if not $.Values.enableCertManager -}} - caBundle: {{ $tls.caCert }} - {{ end }} - service: - name: {{ template "aws-load-balancer-controller.webhookService" . }} - namespace: {{ $.Release.Namespace }} - path: /validate-elbv2-k8s-aws-v1beta1-ingressclassparams - failurePolicy: Fail - name: vingressclassparams.elbv2.k8s.aws - admissionReviewVersions: - - v1beta1 - objectSelector: - matchExpressions: - - key: app.kubernetes.io/name - operator: NotIn - values: - - {{ include "aws-load-balancer-controller.name" . }} - rules: - - apiGroups: - - elbv2.k8s.aws - apiVersions: - - v1beta1 - operations: - - CREATE - - UPDATE - resources: - - ingressclassparams - sideEffects: None -- clientConfig: - {{ if not $.Values.enableCertManager -}} - caBundle: {{ $tls.caCert }} - {{ end }} - service: - name: {{ template "aws-load-balancer-controller.webhookService" . }} - namespace: {{ $.Release.Namespace }} - path: /validate-elbv2-k8s-aws-v1beta1-targetgroupbinding - failurePolicy: Fail - name: vtargetgroupbinding.elbv2.k8s.aws - admissionReviewVersions: - - v1beta1 - rules: - - apiGroups: - - elbv2.k8s.aws - apiVersions: - - v1beta1 - operations: - - CREATE - - UPDATE - resources: - - targetgroupbindings - sideEffects: None -{{- if not $.Values.webhookConfig.disableIngressValidation }} -- clientConfig: - {{ if not $.Values.enableCertManager -}} - caBundle: {{ $tls.caCert }} - {{ end }} - service: - name: {{ template "aws-load-balancer-controller.webhookService" . }} - namespace: {{ $.Release.Namespace }} - path: /validate-networking-v1-ingress - failurePolicy: Fail - matchPolicy: Equivalent - name: vingress.elbv2.k8s.aws - admissionReviewVersions: - - v1beta1 - rules: - - apiGroups: - - networking.k8s.io - apiVersions: - - v1 - operations: - - CREATE - - UPDATE - resources: - - ingresses - sideEffects: None -{{- end }} ---- -{{- if not $.Values.enableCertManager }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "aws-load-balancer-controller.webhookCertSecret" . }} - namespace: {{ .Release.Namespace }} - labels: -{{ include "aws-load-balancer-controller.labels" . | indent 4 }} -type: kubernetes.io/tls -data: - ca.crt: {{ $tls.caCert }} - tls.crt: {{ $tls.clientCert }} - tls.key: {{ $tls.clientKey }} -{{- else }} -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: {{ template "aws-load-balancer-controller.namePrefix" . }}-serving-cert - namespace: {{ .Release.Namespace }} - labels: -{{ include "aws-load-balancer-controller.labels" . | indent 4 }} -spec: - dnsNames: - - {{ template "aws-load-balancer-controller.webhookService" . }}.{{ .Release.Namespace }}.svc - - {{ template "aws-load-balancer-controller.webhookService" . }}.{{ .Release.Namespace }}.svc.{{ .Values.cluster.dnsDomain }} - issuerRef: - kind: Issuer - name: {{ template "aws-load-balancer-controller.namePrefix" . }}-selfsigned-issuer - secretName: {{ template "aws-load-balancer-controller.webhookCertSecret" . }} ---- -apiVersion: cert-manager.io/v1 -kind: Issuer -metadata: - name: {{ template "aws-load-balancer-controller.namePrefix" . }}-selfsigned-issuer - namespace: {{ .Release.Namespace }} - labels: -{{ include "aws-load-balancer-controller.labels" . | indent 4 }} -spec: - selfSigned: {} -{{- end }} diff --git a/charts/devtron-utilities/charts/aws-load-balancer-controller/values.yaml b/charts/devtron-utilities/charts/aws-load-balancer-controller/values.yaml deleted file mode 100644 index c2f465bcd..000000000 --- a/charts/devtron-utilities/charts/aws-load-balancer-controller/values.yaml +++ /dev/null @@ -1,436 +0,0 @@ -# Default values for aws-load-balancer-controller. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. - -replicaCount: 2 - -revisionHistoryLimit: 10 - -image: - repository: public.ecr.aws/eks/aws-load-balancer-controller - tag: v2.11.0 - pullPolicy: IfNotPresent - -runtimeClassName: "" -imagePullSecrets: [] -nameOverride: "" -fullnameOverride: "" - -# AWS LBC only has 1 main working pod, other pods are just standby -# the purpose of enable hpa is to survive load induced failure by the calls to the aws-load-balancer-webhook-service -# since the calls from kube-apiserver are sent round-robin to all replicas, and the failure policy on those webhooks is Fail -# if the pods become overloaded and do not respond within the timeout that could block the creation of pods, targetgroupbindings or ingresses -# Please keep in mind that the controller pods have `priorityClassName: system-cluster-critical`, enabling HPA may lead to the eviction of other low-priority pods in the node -autoscaling: - enabled: false - minReplicas: 1 - maxReplicas: 5 - targetCPUUtilizationPercentage: 80 - -serviceAccount: - # Specifies whether a service account should be created - create: true - # Annotations to add to the service account - annotations: {} - # The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template - name: - # Automount API credentials for a Service Account. - automountServiceAccountToken: true - # List of image pull secrets to add to the Service Account. - imagePullSecrets: - # - name: docker - -rbac: - # Specifies whether rbac resources should be created - create: true - -podSecurityContext: - fsGroup: 65534 - -securityContext: - # capabilities: - # drop: - # - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - allowPrivilegeEscalation: false - -# Time period for the controller pod to do a graceful shutdown -terminationGracePeriodSeconds: 10 - -resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - -# priorityClassName specifies the PriorityClass to indicate the importance of controller pods -# ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass -priorityClassName: system-cluster-critical - -nodeSelector: {} - -tolerations: [] - -# affinity specifies a custom affinity for the controller pods -affinity: {} - -# configureDefaultAffinity specifies whether to configure a default affinity for the controller pods to prevent -# co-location on the same node. This will get ignored if you specify a custom affinity configuration. -configureDefaultAffinity: true - -# topologySpreadConstraints is a stable feature of k8s v1.19 which provides the ability to -# control how Pods are spread across your cluster among failure-domains such as regions, zones, -# nodes, and other user-defined topology domains. -# -# more details here: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ -topologySpreadConstraints: {} - -updateStrategy: {} - # type: RollingUpdate - # rollingUpdate: - # maxSurge: 1 - # maxUnavailable: 1 - -# serviceAnnotations contains annotations to be added to the provisioned webhook service resource -serviceAnnotations: {} - -# deploymentAnnotations contains annotations for the controller deployment -deploymentAnnotations: {} - -podAnnotations: {} - -podLabels: {} - -# additionalLabels -- Labels to add to each object of the chart. -additionalLabels: {} - -# Enable cert-manager -enableCertManager: false - -# The name of the Kubernetes cluster. A non-empty value is required -clusterName: - -# cluster contains configurations specific to the kubernetes cluster -cluster: - # Cluster DNS domain (required for requesting TLS certificates) - dnsDomain: cluster.local - -# The ingress class this controller will satisfy. If not specified, controller will match all -# ingresses without ingress class annotation and ingresses of type alb -ingressClass: alb - -# ingressClassParams specify the IngressCLassParams that enforce settings for a set of Ingresses when using with ingress Controller. -ingressClassParams: - create: true - # The name of ingressClassParams resource will be referred in ingressClass - name: - spec: {} - # Due to dependency issue, the validation webhook ignores this particular ingressClassParams resource. - # We recommend creating ingressClassParams resources separately after installing this chart and the - # controller is functional. - # - # You can set the specifications in the `helm install` command through `--set` or `--set-string` - # If you do want to specify in the values.yaml, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'spec:' - # - # namespaceSelector: - # matchLabels: - # group: - # scheme: - # ipAddressType: - # tags: - # loadBalancerAttributes: - # - key: - # value: - -# To use IngressClass resource instead of annotation, before you need to install the IngressClass resource pointing to controller. -# If specified as true, the IngressClass resource will be created. -createIngressClassResource: true - -# The AWS region for the kubernetes cluster. Set to use KIAM or kube2iam for example. -region: - -# The VPC ID for the Kubernetes cluster. Set this manually when your pods are unable to use the metadata service to determine this automatically -vpcId: - -# Custom AWS API Endpoints (serviceID1=URL1,serviceID2=URL2) -awsApiEndpoints: - -# awsApiThrottle specifies custom AWS API throttle settings (serviceID1:operationRegex1=rate:burst,serviceID2:operationRegex2=rate:burst) -# example: --set awsApiThrottle="{Elastic Load Balancing v2:RegisterTargets|DeregisterTargets=4:20,Elastic Load Balancing v2:.*=10:40}" -awsApiThrottle: - -# Maximum retries for AWS APIs (default 10) -awsMaxRetries: - -# Default target type. Used as the default value of the "alb.ingress.kubernetes.io/target-type" and -# "service.beta.kubernetes.io/aws-load-balancer-nlb-target-type" annotations. -# Possible values are "ip" and "instance" -# The value "ip" should be used for ENI-based CNIs, such as the Amazon VPC CNI, -# Calico with encapsulation disabled, or Cilium with masquerading disabled. -# The value "instance" should be used for overlay-based CNIs, such as Calico in VXLAN or IPIP mode or -# Cilium with masquerading enabled. -defaultTargetType: instance - -# If enabled, targetHealth readiness gate will get injected to the pod spec for the matching endpoint pods (default true) -enablePodReadinessGateInject: - -# Enable Shield addon for ALB (default true) -enableShield: - -# Enable WAF addon for ALB (default true) -enableWaf: - -# Enable WAF V2 addon for ALB (default true) -enableWafv2: - -# Maximum number of concurrently running reconcile loops for ingress (default 3) -ingressMaxConcurrentReconciles: - -# Set the controller log level - info(default), debug (default "info") -logLevel: - -# The address the metric endpoint binds to. (default ":8080") -metricsBindAddr: "" - -webhookConfig: - # disableIngressValidation disables the validation of resources of kind Ingress, false by default - disableIngressValidation: - -# The TCP port the Webhook server binds to. (default 9443) -webhookBindPort: - -# webhookTLS specifies TLS cert/key for the webhook -webhookTLS: - caCert: - cert: - key: - -# array of namespace selectors for the pod mutator webhook -webhookNamespaceSelectors: -# - key: elbv2.k8s.aws/pod-readiness-gate-inject -# operator: In -# values: -# - enabled - -# keepTLSSecret specifies whether to reuse existing TLS secret for chart upgrade -keepTLSSecret: true - -# Maximum number of concurrently running reconcile loops for service (default 3) -serviceMaxConcurrentReconciles: - -# Maximum number of concurrently running reconcile loops for targetGroupBinding -targetgroupbindingMaxConcurrentReconciles: - -# Maximum duration of exponential backoff for targetGroupBinding reconcile failures -targetgroupbindingMaxExponentialBackoffDelay: - -# Interval at which the controller monitors the state of load balancer after creation for stabilization -lbStabilizationMonitorInterval: - -# Period at which the controller forces the repopulation of its local object stores. (default 10h0m0s) -syncPeriod: - -# Namespace the controller watches for updates to Kubernetes objects, If empty, all namespaces are watched. -watchNamespace: - -# disableIngressClassAnnotation disables the usage of kubernetes.io/ingress.class annotation, false by default -disableIngressClassAnnotation: - -# disableIngressGroupNameAnnotation disables the usage of alb.ingress.kubernetes.io/group.name annotation, false by default -disableIngressGroupNameAnnotation: - -# tolerateNonExistentBackendService permits rules which specify backend services that don't exist, true by default (When enabled, it will return 503 error if backend service not exist) -tolerateNonExistentBackendService: - -# tolerateNonExistentBackendAction permits rules which specify backend actions that don't exist, true by default (When enabled, it will return 503 error if backend action not exist) -tolerateNonExistentBackendAction: - -# defaultSSLPolicy specifies the default SSL policy to use for TLS/HTTPS listeners -defaultSSLPolicy: - -# Liveness probe configuration for the controller -livenessProbe: - failureThreshold: 2 - httpGet: - path: /healthz - port: 61779 - scheme: HTTP - initialDelaySeconds: 30 - timeoutSeconds: 10 - -# readiness probe configuration for the controller -readinessProbe: - failureThreshold: 2 - httpGet: - path: /readyz - port: 61779 - scheme: HTTP - successThreshold: 1 - initialDelaySeconds: 10 - timeoutSeconds: 10 - -# Environment variables to set for aws-load-balancer-controller pod. -# We strongly discourage programming access credentials in the controller environment. You should setup IRSA or -# comparable solutions like kube2iam, kiam etc instead. -env: - # ENV_1: "" - # ENV_2: "" - -# Use Environment variables credentials from Secret (aws-secret) for aws-load-balancer-controller pod similarly as The EBS CSI Driver does. -# envSecretName: aws-secret - -# Use envFrom to set environment variables from a Secret or ConfigMap -# envFrom: -# - secretRef: -# name: my-secret - -# Specifies if aws-load-balancer-controller should be started in hostNetwork mode. -# This is required if using a custom CNI where the managed control plane nodes are unable to initiate -# network connections to the pods, for example using Calico CNI plugin on EKS. This is not required or -# recommended if using the Amazon VPC CNI plugin. -hostNetwork: false - -# Specifies the dnsPolicy that should be used for pods in the deployment -# -# This may need to be used to be changed given certain conditions. For instance, if one uses the cilium CNI -# with certain settings, one may need to set `hostNetwork: true` and webhooks won't work unless `dnsPolicy` -# is set to `ClusterFirstWithHostNet`. See https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy -dnsPolicy: - -# extraVolumeMounts are the additional volume mounts. This enables setting up IRSA on non-EKS Kubernetes cluster -extraVolumeMounts: - # - name: aws-iam-token - # mountPath: /var/run/secrets/eks.amazonaws.com/serviceaccount - # readOnly: true - -# extraVolumes for the extraVolumeMounts. Useful to mount a projected service account token for example. -extraVolumes: - # - name: aws-iam-token - # projected: - # defaultMode: 420 - # sources: - # - serviceAccountToken: - # audience: sts.amazonaws.com - # expirationSeconds: 86400 - # path: token - -# defaultTags are the tags to apply to all AWS resources managed by this controller -defaultTags: {} - # default_tag1: value1 - # default_tag2: value2 - -# podDisruptionBudget specifies the disruption budget for the controller pods. -# Disruption budget will be configured only when the replicaCount is greater than 1 -podDisruptionBudget: {} -# maxUnavailable: 1 - -# externalManagedTags is the list of tag keys on AWS resources that will be managed externally -externalManagedTags: [] - -# enableEndpointSlices enables k8s EndpointSlices for IP targets instead of Endpoints (default false) -enableEndpointSlices: - -# enableBackendSecurityGroup enables shared security group for backend traffic (default true) -enableBackendSecurityGroup: - -# backendSecurityGroup specifies backend security group id (default controller auto create backend security group) -backendSecurityGroup: - -# disableRestrictedSecurityGroupRules specifies whether to disable creating port-range restricted security group rules for traffic -disableRestrictedSecurityGroupRules: - -# controllerConfig specifies controller configuration -controllerConfig: - # featureGates set of key: value pairs that describe AWS load balance controller features - featureGates: {} - # ListenerRulesTagging: true - # WeightedTargetGroups: true - # ServiceTypeLoadBalancerOnly: false - # EndpointsFailOpen: true - # EnableServiceController: true - # EnableIPTargetType: true - # SubnetsClusterTagCheck: true - # NLBHealthCheckAdvancedConfig: true - # ALBSingleSubnet: false - # LBCapacityReservation: true - -certDiscovery: - allowedCertificateAuthorityARNs: "" # empty means all CAs are in scope - -# objectSelector for webhook -objectSelector: - matchExpressions: - # - key: - # operator: - # values: - # - - matchLabels: - # key: value - -serviceMonitor: - # Specifies whether a service monitor should be created - enabled: false - # Namespace to create the service monitor in - namespace: - # Labels to add to the service monitor - additionalLabels: {} - # Prometheus scrape interval - interval: 1m - # Prometheus scrape timeout - scrapeTimeout: - # Relabelings to apply to samples before ingestion - relabelings: - # Metric relabelings to apply to samples before ingestion - metricRelabelings: - -# clusterSecretsPermissions lets you configure RBAC permissions for secret resources -# Access to secrets resource is required only if you use the OIDC feature, and instead of -# enabling access to all secrets, we recommend configuring namespaced role/rolebinding. -# This option is for backwards compatibility only, and will potentially be deprecated in future. -clusterSecretsPermissions: - # allowAllSecrets allows the controller to access all secrets in the cluster. - # This is to get backwards compatible behavior, but *NOT* recommended for security reasons - allowAllSecrets: false - -# ingressClassConfig contains configurations specific to the ingress class -ingressClassConfig: - default: false - -# enableServiceMutatorWebhook allows you enable the webhook which makes this controller the default for all new services of type LoadBalancer -enableServiceMutatorWebhook: true - -# serviceMutatorWebhook contains configurations specific to the service mutator webhook -serviceMutatorWebhookConfig: - # whether or not to fail the service creation if the webhook fails - failurePolicy: Fail - # limit webhook to only mutate services matching the objectSelector - objectSelector: - matchExpressions: [] - # - key: - # operator: - # values: - # - - matchLabels: {} - # key: value - # which operations trigger the webhook - operations: - - CREATE - # - UPDATE - -# serviceTargetENISGTags specifies AWS tags, in addition to the cluster tags, for finding the target ENI SG to which to add inbound rules from NLBs. -serviceTargetENISGTags: - -# Specifies the class of load balancer to use for services. This affects how services are provisioned if type LoadBalancer is used (default service.k8s.aws/nlb) -loadBalancerClass: - -# creator will disable helm default labels, so you can only add yours -# creator: "me" diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/.helmignore b/charts/devtron-utilities/charts/aws-node-termination-handler/.helmignore deleted file mode 100644 index 69a523141..000000000 --- a/charts/devtron-utilities/charts/aws-node-termination-handler/.helmignore +++ /dev/null @@ -1,23 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ -example-values*.yaml diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/Chart.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/Chart.yaml deleted file mode 100644 index 32d2ee981..000000000 --- a/charts/devtron-utilities/charts/aws-node-termination-handler/Chart.yaml +++ /dev/null @@ -1,25 +0,0 @@ -apiVersion: v2 -appVersion: 1.19.0 -description: A Helm chart for the AWS Node Termination Handler. -home: https://github.com/aws/eks-charts -icon: https://raw.githubusercontent.com/aws/eks-charts/master/docs/logo/aws.png -keywords: -- aws -- eks -- ec2 -- node-termination -- spot -kubeVersion: '>= 1.16-0' -maintainers: -- email: bwagner5@users.noreply.github.com - name: Brandon Wagner - url: https://github.com/bwagner5 -- email: jillmon@users.noreply.github.com - name: Jillian Kuentz - url: https://github.com/jillmon -name: aws-node-termination-handler -sources: -- https://github.com/aws/aws-node-termination-handler/ -- https://github.com/aws/eks-charts/ -type: application -version: 0.21.0 diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/README.md b/charts/devtron-utilities/charts/aws-node-termination-handler/README.md deleted file mode 100644 index 2fe7d3911..000000000 --- a/charts/devtron-utilities/charts/aws-node-termination-handler/README.md +++ /dev/null @@ -1,176 +0,0 @@ -# AWS Node Termination Handler - -AWS Node Termination Handler Helm chart for Kubernetes. For more information on this project see the project repo at [github.com/aws/aws-node-termination-handler](https://github.com/aws/aws-node-termination-handler). - -## Prerequisites - -- _Kubernetes_ >= v1.16 - -## Installing the Chart - -Before you can install the chart you will need to add the `aws` repo to [Helm](https://helm.sh/). - -```shell -helm repo add eks https://aws.github.io/eks-charts/ -``` - -After you've installed the repo you can install the chart, the following command will install the chart with the release name `aws-node-termination-handler` and the default configuration to the `kube-system` namespace. - -```shell -helm upgrade --install --namespace kube-system aws-node-termination-handler eks/aws-node-termination-handler -``` - -To install the chart on an EKS cluster where the AWS Node Termination Handler is already installed, you can run the following command. - -```shell -helm upgrade --install --namespace kube-system aws-node-termination-handler eks/aws-node-termination-handler --recreate-pods --force -``` - -If you receive an error similar to the one below simply rerun the above command. - -> Error: release aws-node-termination-handler failed: "aws-node-termination-handler" already exists - -To uninstall the `aws-node-termination-handler` chart installation from the `kube-system` namespace run the following command. - -```shell -helm delete --namespace kube-system aws-node-termination-handler -``` - -## Configuration - -The following tables lists the configurable parameters of the chart and their default values. These values are split up into the [common configuration](#common-configuration) shared by all AWS Node Termination Handler modes, [queue configuration](#queue-processor-mode-configuration) used when AWS Node Termination Handler is in in queue-processor mode, and [IMDS configuration](#imds-mode-configuration) used when AWS Node Termination Handler is in IMDS mode; for more information about the different modes see the project [README](https://github.com/aws/aws-node-termination-handler/blob/main/README.md). - -### Common Configuration - -The configuration in this table applies to all AWS Node Termination Handler modes. - -| Parameter | Description | Default | -| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- | -| `image.repository` | Image repository. | `public.ecr.aws/aws-ec2/aws-node-termination-handler` | -| `image.tag` | Image tag. | `v{{ .Chart.AppVersion}}` | -| `image.pullPolicy` | Image pull policy. | `IfNotPresent` | -| `image.pullSecrets` | Image pull secrets. | `[]` | -| `nameOverride` | Override the `name` of the chart. | `""` | -| `fullnameOverride` | Override the `fullname` of the chart. | `""` | -| `serviceAccount.create` | If `true`, create a new service account. | `true` | -| `serviceAccount.name` | Service account to be used. If not set and `serviceAccount.create` is `true`, a name is generated using the full name template. | `nil` | -| `serviceAccount.annotations` | Annotations to add to the service account. | `{}` | -| `rbac.create` | If `true`, create the RBAC resources. | `true` | -| `rbac.pspEnabled` | If `true`, create a pod security policy resource. Note: `PodSecurityPolicy`s will not be created when Kubernetes version is 1.25 or later. | `true` | -| `customLabels` | Labels to add to all resource metadata. | `{}` | -| `podLabels` | Labels to add to the pod. | `{}` | -| `podAnnotations` | Annotations to add to the pod. | `{}` | -| `podSecurityContext` | Security context for the pod. | _See values.yaml_ | -| `securityContext` | Security context for the _aws-node-termination-handler_ container. | _See values.yaml_ | -| `terminationGracePeriodSeconds` | The termination grace period for the pod. | `nil` | -| `resources` | Resource requests and limits for the _aws-node-termination-handler_ container. | `{}` | -| `nodeSelector` | Expressions to select a node by it's labels for pod assignment. In IMDS mode this has a higher priority than `daemonsetNodeSelector` (for backwards compatibility) but shouldn't be used. | `{}` | -| `affinity` | Affinity settings for pod assignment. In IMDS mode this has a higher priority than `daemonsetAffinity` (for backwards compatibility) but shouldn't be used. | `{}` | -| `tolerations` | Tolerations for pod assignment. In IMDS mode this has a higher priority than `daemonsetTolerations` (for backwards compatibility) but shouldn't be used. | `[]` | -| `extraEnv` | Additional environment variables for the _aws-node-termination-handler_ container. | `[]` | -| `probes` | The Kubernetes liveness probe configuration. | _See values.yaml_ | -| `logLevel` | Sets the log level (`info`,`debug`, or `error`) | `info` | -| `logFormatVersion` | Sets the log format version. Available versions: 1, 2. Version 1 refers to the format that has been used through v1.17.3. Version 2 offers more detail for the "event kind" and "reason", especially when operating in Queue Processor mode. | `1` | -| `jsonLogging` | If `true`, use JSON-formatted logs instead of human readable logs. | `false` | -| `enablePrometheusServer` | If `true`, start an http server exposing `/metrics` endpoint for _Prometheus_. | `false` | -| `prometheusServerPort` | Replaces the default HTTP port for exposing _Prometheus_ metrics. | `9092` | -| `dryRun` | If `true`, only log if a node would be drained. | `false` | -| `cordonOnly` | If `true`, nodes will be cordoned but not drained when an interruption event occurs. | `false` | -| `taintNode` | If `true`, nodes will be tainted when an interruption event occurs. Currently used taint keys are `aws-node-termination-handler/scheduled-maintenance`, `aws-node-termination-handler/spot-itn`, `aws-node-termination-handler/asg-lifecycle-termination` and `aws-node-termination-handler/rebalance-recommendation`. | `false` | -| `excludeFromLoadBalancers` | If `true`, nodes will be marked for exclusion from load balancers before they are cordoned. This applies the `node.kubernetes.io/exclude-from-external-load-balancers` label to enable the ServiceNodeExclusion feature gate. The label will not be modified or removed for nodes that already have it. | `false` | -| `deleteLocalData` | If `true`, continue even if there are pods using local data that will be deleted when the node is drained. | `true` | -| `ignoreDaemonSets` | If `true`, skip terminating daemon set managed pods. | `true` | -| `podTerminationGracePeriod` | The time in seconds given to each pod to terminate gracefully. If negative, the default value specified in the pod will be used, which defaults to 30 seconds if not specified for the pod. | `-1` | -| `nodeTerminationGracePeriod` | Period of time in seconds given to each node to terminate gracefully. Node draining will be scheduled based on this value to optimize the amount of compute time, but still safely drain the node before an event. | `120` | -| `emitKubernetesEvents` | If `true`, Kubernetes events will be emitted when interruption events are received and when actions are taken on Kubernetes nodes. In IMDS Processor mode a default set of annotations with all the node metadata gathered from IMDS will be attached to each event. More information [here](https://github.com/aws/aws-node-termination-handler/blob/main/docs/kubernetes_events.md). | `false` | -| `completeLifecycleActionDelaySeconds` | Pause after draining the node before completing the EC2 Autoscaling lifecycle action. This may be helpful if Pods on the node have Persistent Volume Claims. | -1 | -| `kubernetesEventsExtraAnnotations` | A comma-separated list of `key=value` extra annotations to attach to all emitted Kubernetes events (e.g. `first=annotation,sample.annotation/number=two"`). | `""` | -| `webhookURL` | Posts event data to URL upon instance interruption action. | `""` | -| `webhookURLSecretName` | Pass the webhook URL as a Secret using the key `webhookurl`. | `""` | -| `webhookHeaders` | Replace the default webhook headers (e.g. `{"Content-type":"application/json"}`). | `""` | -| `webhookProxy` | Uses the specified HTTP(S) proxy for sending webhook data. | `""` | -| `webhookTemplate` | Replaces the default webhook message template (e.g. `{"text":"[NTH][Instance Interruption] EventID: {{ .EventID }} - Kind: {{ .Kind }} - Instance: {{ .InstanceID }} - Node: {{ .NodeName }} - Description: {{ .Description }} - Start Time: {{ .StartTime }}"}`). | `""` | -| `webhookTemplateConfigMapName` | Pass the webhook template file as a configmap. | "``" | -| `webhookTemplateConfigMapKey` | Name of the Configmap key storing the template file. | `""` | -| `enableSqsTerminationDraining` | If `true`, this turns on queue-processor mode which drains nodes when an SQS termination event is received. | `false` | - -### Queue-Processor Mode Configuration - -The configuration in this table applies to AWS Node Termination Handler in queue-processor mode. - -| Parameter | Description | Default | -| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------- | -| `replicas` | The number of replicas in the deployment when using queue-processor mode (NOTE: increasing replicas may cause duplicate webhooks since pods are stateless). | `1` | -| `strategy` | Specify the update strategy for the deployment. | `{}` | -| `podDisruptionBudget` | Limit the disruption for controller pods, requires at least 2 controller replicas. | `{}` | -| `serviceMonitor.create` | If `true`, create a ServiceMonitor. This requires `enablePrometheusServer: true`. | `false` | -| `serviceMonitor.namespace` | Override ServiceMonitor _Helm_ release namespace. | `nil` | -| `serviceMonitor.labels` | Additional ServiceMonitor metadata labels. | `{}` | -| `serviceMonitor.interval` | _Prometheus_ scrape interval. | `30s` | -| `serviceMonitor.sampleLimit` | Number of scraped samples accepted. | `5000` | -| `priorityClassName` | Name of the PriorityClass to use for the Deployment. | `system-cluster-critical` | -| `awsRegion` | If specified, use the AWS region for AWS API calls, else NTH will try to find the region through the `AWS_REGION` environment variable, IMDS, or the specified queue URL. | `""` | -| `queueURL` | Listens for messages on the specified SQS queue URL. | `""` | -| `workers` | The maximum amount of parallel event processors to handle concurrent events. | `10` | -| `checkTagBeforeDraining` | If `true`, check that the instance is tagged with the `managedTag` before draining the node. | `true` | -| `managedTag` | The node tag to check if `checkTagBeforeDraining` is `true`. | `aws-node-termination-handler/managed` | -| `checkASGTagBeforeDraining` | [DEPRECATED](Use `checkTagBeforeDraining` instead) If `true`, check that the instance is tagged with the `managedAsgTag` before draining the node. If `false`, disables calls ASG API. | `true` | -| `managedAsgTag` | [DEPRECATED](Use `managedTag` instead) The node tag to check if `checkASGTagBeforeDraining` is `true`. -| `useProviderId` | If `true`, fetch node name through Kubernetes node spec ProviderID instead of AWS event PrivateDnsHostname. | `false` | - -### IMDS Mode Configuration - -The configuration in this table applies to AWS Node Termination Handler in IMDS mode. - -| Parameter | Description | Default | -| -------------------------------- |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------| -| `targetNodeOs` | Space separated list of node OS's to target (e.g. `"linux"`, `"windows"`, `"linux windows"`). Windows support is **EXPERIMENTAL**. | `"linux"` | -| `linuxPodLabels` | Labels to add to each Linux pod. | `{}` | -| `windowsPodLabels` | Labels to add to each Windows pod. | `{}` | -| `linuxPodAnnotations` | Annotations to add to each Linux pod. | `{}` | -| `windowsPodAnnotations` | Annotations to add to each Windows pod. | `{}` | -| `updateStrategy` | Update strategy for the all DaemonSets. | _See values.yaml_ | -| `daemonsetPriorityClassName` | Name of the PriorityClass to use for all DaemonSets. | `system-node-critical` | -| `podMonitor.create` | If `true`, create a PodMonitor. This requires `enablePrometheusServer: true`. | `false` | -| `podMonitor.namespace` | Override PodMonitor _Helm_ release namespace. | `nil` | -| `podMonitor.labels` | Additional PodMonitor metadata labels | `{}` | -| `podMonitor.interval` | _Prometheus_ scrape interval. | `30s` | -| `podMonitor.sampleLimit` | Number of scraped samples accepted. | `5000` | -| `useHostNetwork` | If `true`, enables `hostNetwork` for the Linux DaemonSet. NOTE: setting this to `false` may cause issues accessing IMDSv2 if your account is not configured with an IP hop count of 2 see [Metrics Endpoint Considerations](#metrics-endpoint-considerations) | `true` | -| `dnsPolicy` | If specified, this overrides `linuxDnsPolicy` and `windowsDnsPolicy` with a single policy. | `""` | -| `dnsConfig` | If specified, this sets the dnsConfig: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config | `{}` | -| `linuxDnsPolicy` | DNS policy for the Linux DaemonSet. | `""` | -| `windowsDnsPolicy` | DNS policy for the Windows DaemonSet. | `""` | -| `daemonsetNodeSelector` | Expressions to select a node by it's labels for DaemonSet pod assignment. For backwards compatibility the `nodeSelector` value has priority over this but shouldn't be used. | `{}` | -| `linuxNodeSelector` | Override `daemonsetNodeSelector` for the Linux DaemonSet. | `{}` | -| `windowsNodeSelector` | Override `daemonsetNodeSelector` for the Windows DaemonSet. | `{}` | -| `daemonsetAffinity` | Affinity settings for DaemonSet pod assignment. For backwards compatibility the `affinity` has priority over this but shouldn't be used. | `{}` | -| `linuxAffinity` | Override `daemonsetAffinity` for the Linux DaemonSet. | `{}` | -| `windowsAffinity` | Override `daemonsetAffinity` for the Windows DaemonSet. | `{}` | -| `daemonsetTolerations` | Tolerations for DaemonSet pod assignment. For backwards compatibility the `tolerations` has priority over this but shouldn't be used. | `[]` | -| `linuxTolerations` | Override `daemonsetTolerations` for the Linux DaemonSet. | `[]` | -| `windowsTolerations` | Override `daemonsetTolerations` for the Linux DaemonSet. | `[]` | -| `enableProbesServer` | If `true`, start an http server exposing `/healthz` endpoint for probes. | `false` | -| `metadataTries` | The number of times to try requesting metadata. | `3` | -| `enableSpotInterruptionDraining` | If `true`, drain nodes when the spot interruption termination notice is received. Only used in IMDS mode. | `true` | -| `enableScheduledEventDraining` | If `true`, drain nodes before the maintenance window starts for an EC2 instance scheduled event. Only used in IMDS mode. | `true` | -| `enableRebalanceMonitoring` | If `true`, cordon nodes when the rebalance recommendation notice is received. If you'd like to drain the node in addition to cordoning, then also set `enableRebalanceDraining`. Only used in IMDS mode. | `false` | -| `enableRebalanceDraining` | If `true`, drain nodes when the rebalance recommendation notice is received. Only used in IMDS mode. | `false` | - -### Testing Configuration - -The configuration in this table applies to AWS Node Termination Handler testing and is **NOT RECOMMENDED** FOR PRODUCTION DEPLOYMENTS. - -| Parameter | Description | Default | -| --------------------- | --------------------------------------------------------------------------------- | -------------- | -| `awsEndpoint` | (Used for testing) If specified, use the provided AWS endpoint to make API calls. | `""` | -| `awsSecretAccessKey` | (Used for testing) Pass-thru environment variable. | `nil` | -| `awsAccessKeyID` | (Used for testing) Pass-thru environment variable. | `nil` | -| `instanceMetadataURL` | (Used for testing) If specified, use the provided metadata URL. | `""` | -| `procUptimeFile` | (Used for Testing) Specify the uptime file. | `/proc/uptime` | - -## Metrics Endpoint Considerations - -AWS Node Termination HAndler in IMDS mode runs as a DaemonSet with `useHostNetwork: true` by default. If the Prometheus server is enabled with `enablePrometheusServer: true` nothing else will be able to bind to the configured port (by default `prometheusServerPort: 9092`) in the root network namespace. Therefore, it will need to have a firewall/security group configured on the nodes to block access to the `/metrics` endpoint. - -You can switch NTH in IMDS mode to run w/ `useHostNetwork: false`, but you will need to make sure that IMDSv1 is enabled or IMDSv2 IP hop count will need to be incremented to 2 (see the [IMDSv2 documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html). diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/NOTES.txt b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/NOTES.txt deleted file mode 100644 index d0aaf70c6..000000000 --- a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/NOTES.txt +++ /dev/null @@ -1,8 +0,0 @@ -*********************************************************************** -* AWS Node Termination Handler * -*********************************************************************** - Chart version: {{ .Chart.Version }} - App version: {{ .Chart.AppVersion }} - Image tag: {{ include "aws-node-termination-handler.image" . }} - Mode : {{ if .Values.enableSqsTerminationDraining }}Queue Processor{{ else }}IMDS{{ end }} -*********************************************************************** diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/_helpers.tpl b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/_helpers.tpl deleted file mode 100644 index 3513d2a97..000000000 --- a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/_helpers.tpl +++ /dev/null @@ -1,124 +0,0 @@ -{{/* vim: set filetype=mustache: */}} - -{{/* -Expand the name of the chart. -*/}} -{{- define "aws-node-termination-handler.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "aws-node-termination-handler.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Equivalent to "aws-node-termination-handler.fullname" except that "-win" indicator is appended to the end. -Name will not exceed 63 characters. -*/}} -{{- define "aws-node-termination-handler.fullnameWindows" -}} -{{- include "aws-node-termination-handler.fullname" . | trunc 59 | trimSuffix "-" | printf "%s-win" -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "aws-node-termination-handler.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Common labels -*/}} -{{- define "aws-node-termination-handler.labels" -}} -{{ include "aws-node-termination-handler.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/part-of: {{ .Release.Name }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -helm.sh/chart: {{ include "aws-node-termination-handler.chart" . }} -{{- with .Values.customLabels }} -{{ toYaml . }} -{{- end }} -{{- end -}} - -{{/* -Deployment labels -*/}} -{{- define "aws-node-termination-handler.labelsDeployment" -}} -{{ include "aws-node-termination-handler.labels" . }} -app.kubernetes.io/component: deployment -{{- end -}} - -{{/* -Daemonset labels -*/}} -{{- define "aws-node-termination-handler.labelsDaemonset" -}} -{{ include "aws-node-termination-handler.labels" . }} -app.kubernetes.io/component: daemonset -{{- end -}} - -{{/* -Selector labels -*/}} -{{- define "aws-node-termination-handler.selectorLabels" -}} -app.kubernetes.io/name: {{ include "aws-node-termination-handler.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end -}} - -{{/* -Selector labels for the deployment -*/}} -{{- define "aws-node-termination-handler.selectorLabelsDeployment" -}} -{{ include "aws-node-termination-handler.selectorLabels" . }} -app.kubernetes.io/component: deployment -{{- end -}} - -{{/* -Selector labels for the daemonset -*/}} -{{- define "aws-node-termination-handler.selectorLabelsDaemonset" -}} -{{ include "aws-node-termination-handler.selectorLabels" . }} -app.kubernetes.io/component: daemonset -{{- end -}} - -{{/* -Create the name of the service account to use -*/}} -{{- define "aws-node-termination-handler.serviceAccountName" -}} -{{- if .Values.serviceAccount.create -}} - {{ default (include "aws-node-termination-handler.fullname" .) .Values.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -The image to use -*/}} -{{- define "aws-node-termination-handler.image" -}} -{{- printf "%s:%s" .Values.image.repository (default (printf "v%s" .Chart.AppVersion) .Values.image.tag) }} -{{- end }} - -{{/* Get PodDisruptionBudget API Version */}} -{{- define "aws-node-termination-handler.pdb.apiVersion" -}} - {{- if and (.Capabilities.APIVersions.Has "policy/v1") (semverCompare ">= 1.21-0" .Capabilities.KubeVersion.Version) -}} - {{- print "policy/v1" -}} - {{- else -}} - {{- print "policy/v1beta1" -}} - {{- end -}} -{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/clusterrole.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/clusterrole.yaml deleted file mode 100644 index 43c2b030b..000000000 --- a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/clusterrole.yaml +++ /dev/null @@ -1,52 +0,0 @@ -{{- if .Values.rbac.create -}} -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ include "aws-node-termination-handler.fullname" . }} - labels: - {{- include "aws-node-termination-handler.labels" . | nindent 4 }} -rules: -- apiGroups: - - "" - resources: - - nodes - verbs: - - get - - list - - patch - - update -- apiGroups: - - "" - resources: - - pods - verbs: - - list - - get -- apiGroups: - - "" - resources: - - pods/eviction - verbs: - - create -- apiGroups: - - extensions - resources: - - daemonsets - verbs: - - get -- apiGroups: - - apps - resources: - - daemonsets - verbs: - - get -{{- if .Values.emitKubernetesEvents }} -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch -{{- end }} -{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/clusterrolebinding.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/clusterrolebinding.yaml deleted file mode 100644 index 1058df1b1..000000000 --- a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/clusterrolebinding.yaml +++ /dev/null @@ -1,16 +0,0 @@ -{{- if .Values.rbac.create -}} -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ include "aws-node-termination-handler.fullname" . }} - labels: - {{- include "aws-node-termination-handler.labels" . | nindent 4 }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ include "aws-node-termination-handler.fullname" . }} -subjects: - - kind: ServiceAccount - name: {{ template "aws-node-termination-handler.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} -{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/daemonset.linux.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/daemonset.linux.yaml deleted file mode 100644 index 95e4b50f5..000000000 --- a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/daemonset.linux.yaml +++ /dev/null @@ -1,210 +0,0 @@ -{{- if and (not .Values.enableSqsTerminationDraining) (lower .Values.targetNodeOs | contains "linux") -}} -apiVersion: apps/v1 -kind: DaemonSet -metadata: - name: {{ include "aws-node-termination-handler.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "aws-node-termination-handler.labelsDaemonset" . | nindent 4 }} -spec: - {{- with .Values.updateStrategy }} - updateStrategy: - {{- toYaml . | nindent 4 }} - {{- end }} - selector: - matchLabels: - {{- include "aws-node-termination-handler.selectorLabelsDaemonset" . | nindent 6 }} - kubernetes.io/os: linux - template: - metadata: - labels: - {{- include "aws-node-termination-handler.selectorLabelsDaemonset" . | nindent 8 }} - kubernetes.io/os: linux - k8s-app: aws-node-termination-handler - {{- with (mergeOverwrite (dict) .Values.podLabels .Values.linuxPodLabels) }} - {{- toYaml . | nindent 8 }} - {{- end }} - {{- if or .Values.podAnnotations .Values.linuxPodAnnotations }} - annotations: - {{- toYaml (mergeOverwrite (dict) .Values.podAnnotations .Values.linuxPodAnnotations) | nindent 8 }} - {{- end }} - spec: - {{- with .Values.image.pullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - serviceAccountName: {{ include "aws-node-termination-handler.serviceAccountName" . }} - {{- with .Values.podSecurityContext }} - securityContext: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.daemonsetPriorityClassName }} - priorityClassName: {{ . }} - {{- end }} - {{- with .Values.terminationGracePeriodSeconds }} - terminationGracePeriodSeconds: {{ . }} - {{- end }} - hostNetwork: {{ .Values.useHostNetwork }} - dnsPolicy: {{ default .Values.linuxDnsPolicy .Values.dnsPolicy }} - {{- with .Values.dnsConfig }} - dnsConfig: - {{- toYaml . | nindent 8 }} - {{- end }} - containers: - - name: aws-node-termination-handler - {{- with .Values.securityContext }} - securityContext: - {{- toYaml . | nindent 12 }} - {{- end }} - image: {{ include "aws-node-termination-handler.image" . }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - env: - - name: NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: ENABLE_PROBES_SERVER - value: {{ .Values.enableProbesServer | quote }} - - name: PROBES_SERVER_PORT - value: {{ .Values.probes.httpGet.port | quote }} - - name: PROBES_SERVER_ENDPOINT - value: {{ .Values.probes.httpGet.path | quote }} - - name: LOG_LEVEL - value: {{ .Values.logLevel | quote }} - - name: JSON_LOGGING - value: {{ .Values.jsonLogging | quote }} - - name: LOG_FORMAT_VERSION - value: {{ .Values.logFormatVersion | quote }} - - name: ENABLE_PROMETHEUS_SERVER - value: {{ .Values.enablePrometheusServer | quote }} - - name: PROMETHEUS_SERVER_PORT - value: {{ .Values.prometheusServerPort | quote }} - {{- with .Values.instanceMetadataURL }} - - name: INSTANCE_METADATA_URL - value: {{ . | quote }} - {{- end }} - - name: METADATA_TRIES - value: {{ .Values.metadataTries | quote }} - - name: DRY_RUN - value: {{ .Values.dryRun | quote }} - - name: CORDON_ONLY - value: {{ .Values.cordonOnly | quote }} - - name: TAINT_NODE - value: {{ .Values.taintNode | quote }} - - name: EXCLUDE_FROM_LOAD_BALANCERS - value: {{ .Values.excludeFromLoadBalancers | quote }} - - name: DELETE_LOCAL_DATA - value: {{ .Values.deleteLocalData | quote }} - - name: IGNORE_DAEMON_SETS - value: {{ .Values.ignoreDaemonSets | quote }} - - name: POD_TERMINATION_GRACE_PERIOD - value: {{ .Values.podTerminationGracePeriod | quote }} - - name: NODE_TERMINATION_GRACE_PERIOD - value: {{ .Values.nodeTerminationGracePeriod | quote }} - - name: EMIT_KUBERNETES_EVENTS - value: {{ .Values.emitKubernetesEvents | quote }} - {{- with .Values.kubernetesEventsExtraAnnotations }} - - name: KUBERNETES_EVENTS_EXTRA_ANNOTATIONS - value: {{ . | quote }} - {{- end }} - {{- if or .Values.webhookURL .Values.webhookURLSecretName }} - - name: WEBHOOK_URL - {{- if .Values.webhookURLSecretName }} - valueFrom: - secretKeyRef: - name: {{ .Values.webhookURLSecretName }} - key: webhookurl - {{- else }} - value: {{ .Values.webhookURL | quote }} - {{- end }} - {{- end }} - {{- with .Values.webhookHeaders }} - - name: WEBHOOK_HEADERS - value: {{ . | quote }} - {{- end }} - {{- with .Values.webhookProxy }} - - name: WEBHOOK_PROXY - value: {{ . | quote }} - {{- end }} - {{- if and .Values.webhookTemplateConfigMapName .Values.webhookTemplateConfigMapKey }} - - name: WEBHOOK_TEMPLATE_FILE - value: {{ print "/config/" .Values.webhookTemplateConfigMapKey | quote }} - {{- else if .Values.webhookTemplate }} - - name: WEBHOOK_TEMPLATE - value: {{ .Values.webhookTemplate | quote }} - {{- end }} - - name: ENABLE_SPOT_INTERRUPTION_DRAINING - value: {{ .Values.enableSpotInterruptionDraining | quote }} - - name: ENABLE_SCHEDULED_EVENT_DRAINING - value: {{ .Values.enableScheduledEventDraining | quote }} - - name: ENABLE_REBALANCE_MONITORING - value: {{ .Values.enableRebalanceMonitoring | quote }} - - name: ENABLE_REBALANCE_DRAINING - value: {{ .Values.enableRebalanceDraining | quote }} - - name: ENABLE_SQS_TERMINATION_DRAINING - value: "false" - - name: UPTIME_FROM_FILE - value: {{ .Values.procUptimeFile | quote }} - {{- with .Values.extraEnv }} - {{- toYaml . | nindent 12 }} - {{- end }} - {{- if or .Values.enablePrometheusServer .Values.enableProbesServer }} - ports: - {{- if .Values.enableProbesServer }} - - name: liveness-probe - protocol: TCP - containerPort: {{ .Values.probes.httpGet.port }} - {{- end }} - {{- if .Values.enablePrometheusServer }} - - name: http-metrics - protocol: TCP - containerPort: {{ .Values.prometheusServerPort }} - {{- end }} - {{- end }} - {{- if .Values.enableProbesServer }} - livenessProbe: - {{- toYaml .Values.probes | nindent 12 }} - {{- end }} - {{- with .Values.resources }} - resources: - {{- toYaml . | nindent 12 }} - {{- end }} - volumeMounts: - - name: uptime - mountPath: {{ .Values.procUptimeFile }} - readOnly: true - {{- if and .Values.webhookTemplateConfigMapName .Values.webhookTemplateConfigMapKey }} - - name: webhook-template - mountPath: /config/ - {{- end }} - volumes: - - name: uptime - hostPath: - path: {{ .Values.procUptimeFile | default "/proc/uptime" }} - {{- if and .Values.webhookTemplateConfigMapName .Values.webhookTemplateConfigMapKey }} - - name: webhook-template - configMap: - name: {{ .Values.webhookTemplateConfigMapName }} - {{- end }} - nodeSelector: - kubernetes.io/os: linux - {{- with default .Values.daemonsetNodeSelector (default .Values.nodeSelector .Values.linuxNodeSelector) }} - {{- toYaml . | nindent 8 }} - {{- end }} - {{- if or .Values.daemonsetAffinity (or .Values.affinity .Values.linuxAffinity) }} - affinity: - {{- toYaml (default .Values.daemonsetAffinity (default .Values.affinity .Values.linuxAffinity)) | nindent 8 }} - {{- end }} - {{- if or .Values.daemonsetTolerations (or .Values.tolerations .Values.linuxTolerations) }} - tolerations: - {{- toYaml (default .Values.daemonsetTolerations (default .Values.tolerations .Values.linuxTolerations )) | nindent 8 }} - {{- end }} -{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/daemonset.windows.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/daemonset.windows.yaml deleted file mode 100644 index 8a9db7bfc..000000000 --- a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/daemonset.windows.yaml +++ /dev/null @@ -1,204 +0,0 @@ -{{- if and (not .Values.enableSqsTerminationDraining) (lower .Values.targetNodeOs | contains "windows") -}} -apiVersion: apps/v1 -kind: DaemonSet -metadata: - name: {{ include "aws-node-termination-handler.fullnameWindows" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "aws-node-termination-handler.labelsDaemonset" . | nindent 4 }} -spec: - {{- with .Values.updateStrategy }} - updateStrategy: - {{- toYaml . | nindent 4 }} - {{- end }} - selector: - matchLabels: - {{- include "aws-node-termination-handler.selectorLabelsDaemonset" . | nindent 6 }} - kubernetes.io/os: windows - template: - metadata: - labels: - {{- include "aws-node-termination-handler.selectorLabelsDaemonset" . | nindent 8 }} - kubernetes.io/os: windows - k8s-app: aws-node-termination-handler - {{- with (mergeOverwrite (dict) .Values.podLabels .Values.windowsPodLabels) }} - {{- toYaml . | nindent 8 }} - {{- end }} - {{- if or .Values.podAnnotations .Values.windowsPodAnnotations }} - annotations: - {{- toYaml (mergeOverwrite (dict) .Values.podAnnotations .Values.windowsPodAnnotations) | nindent 8 }} - {{- end }} - spec: - {{- with .Values.image.pullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - serviceAccountName: {{ include "aws-node-termination-handler.serviceAccountName" . }} - {{- with .Values.podSecurityContext }} - securityContext: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.daemonsetPriorityClassName }} - priorityClassName: {{ . }} - {{- end }} - {{- with .Values.terminationGracePeriodSeconds }} - terminationGracePeriodSeconds: {{ . }} - {{- end }} - hostNetwork: false - dnsPolicy: {{ default .Values.windowsDnsPolicy .Values.dnsPolicy }} - {{- with .Values.dnsConfig }} - dnsConfig: - {{- toYaml . | nindent 8 }} - {{- end }} - containers: - - name: aws-node-termination-handler - {{- with unset .Values.securityContext "runAsUser" }} - securityContext: - {{- toYaml . | nindent 12 }} - {{- end }} - image: {{ include "aws-node-termination-handler.image" . }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - env: - - name: NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: ENABLE_PROBES_SERVER - value: {{ .Values.enableProbesServer | quote }} - - name: PROBES_SERVER_PORT - value: {{ .Values.probes.httpGet.port | quote }} - - name: PROBES_SERVER_ENDPOINT - value: {{ .Values.probes.httpGet.path | quote }} - - name: LOG_LEVEL - value: {{ .Values.logLevel | quote }} - - name: JSON_LOGGING - value: {{ .Values.jsonLogging | quote }} - - name: LOG_FORMAT_VERSION - value: {{ .Values.logFormatVersion | quote }} - - name: ENABLE_PROMETHEUS_SERVER - value: {{ .Values.enablePrometheusServer | quote }} - - name: PROMETHEUS_SERVER_PORT - value: {{ .Values.prometheusServerPort | quote }} - {{- with .Values.instanceMetadataURL }} - - name: INSTANCE_METADATA_URL - value: {{ . | quote }} - {{- end }} - - name: METADATA_TRIES - value: {{ .Values.metadataTries | quote }} - - name: DRY_RUN - value: {{ .Values.dryRun | quote }} - - name: CORDON_ONLY - value: {{ .Values.cordonOnly | quote }} - - name: TAINT_NODE - value: {{ .Values.taintNode | quote }} - - name: EXCLUDE_FROM_LOAD_BALANCERS - value: {{ .Values.excludeFromLoadBalancers | quote }} - - name: DELETE_LOCAL_DATA - value: {{ .Values.deleteLocalData | quote }} - - name: IGNORE_DAEMON_SETS - value: {{ .Values.ignoreDaemonSets | quote }} - - name: POD_TERMINATION_GRACE_PERIOD - value: {{ .Values.podTerminationGracePeriod | quote }} - - name: NODE_TERMINATION_GRACE_PERIOD - value: {{ .Values.nodeTerminationGracePeriod | quote }} - - name: EMIT_KUBERNETES_EVENTS - value: {{ .Values.emitKubernetesEvents | quote }} - {{- with .Values.kubernetesEventsExtraAnnotations }} - - name: KUBERNETES_EVENTS_EXTRA_ANNOTATIONS - value: {{ . | quote }} - {{- end }} - {{- if or .Values.webhookURL .Values.webhookURLSecretName }} - - name: WEBHOOK_URL - {{- if .Values.webhookURLSecretName }} - valueFrom: - secretKeyRef: - name: {{ .Values.webhookURLSecretName }} - key: webhookurl - {{- else }} - value: {{ .Values.webhookURL | quote }} - {{- end }} - {{- end }} - {{- with .Values.webhookHeaders }} - - name: WEBHOOK_HEADERS - value: {{ . | quote }} - {{- end }} - {{- with .Values.webhookProxy }} - - name: WEBHOOK_PROXY - value: {{ . | quote }} - {{- end }} - {{- if and .Values.webhookTemplateConfigMapName .Values.webhookTemplateConfigMapKey }} - - name: WEBHOOK_TEMPLATE_FILE - value: {{ print "/config/" .Values.webhookTemplateConfigMapKey | quote }} - {{- else if .Values.webhookTemplate }} - - name: WEBHOOK_TEMPLATE - value: {{ .Values.webhookTemplate | quote }} - {{- end }} - - name: ENABLE_SPOT_INTERRUPTION_DRAINING - value: {{ .Values.enableSpotInterruptionDraining | quote }} - - name: ENABLE_SCHEDULED_EVENT_DRAINING - value: {{ .Values.enableScheduledEventDraining | quote }} - - name: ENABLE_REBALANCE_MONITORING - value: {{ .Values.enableRebalanceMonitoring | quote }} - - name: ENABLE_REBALANCE_DRAINING - value: {{ .Values.enableRebalanceDraining | quote }} - - name: ENABLE_SQS_TERMINATION_DRAINING - value: "false" - {{- with .Values.extraEnv }} - {{- toYaml . | nindent 12 }} - {{- end }} - {{- if or .Values.enablePrometheusServer .Values.enableProbesServer }} - ports: - {{- if .Values.enableProbesServer }} - - name: liveness-probe - protocol: TCP - containerPort: {{ .Values.probes.httpGet.port }} - hostPort: {{ .Values.probes.httpGet.port }} - {{- end }} - {{- if .Values.enablePrometheusServer }} - - name: http-metrics - protocol: TCP - containerPort: {{ .Values.prometheusServerPort }} - hostPort: {{ .Values.prometheusServerPort }} - {{- end }} - {{- end }} - {{- if .Values.enableProbesServer }} - livenessProbe: - {{- toYaml .Values.probes | nindent 12 }} - {{- end }} - {{- with .Values.resources }} - resources: - {{- toYaml . | nindent 12 }} - {{- end }} - {{- if and .Values.webhookTemplateConfigMapName .Values.webhookTemplateConfigMapKey }} - volumeMounts: - - name: webhook-template - mountPath: /config/ - {{- end }} - {{- if and .Values.webhookTemplateConfigMapName .Values.webhookTemplateConfigMapKey }} - volumes: - - name: webhook-template - configMap: - name: {{ .Values.webhookTemplateConfigMapName }} - {{- end }} - nodeSelector: - kubernetes.io/os: windows - {{- with default .Values.daemonsetNodeSelector (default .Values.nodeSelector .Values.windowsNodeSelector) }} - {{- toYaml . | nindent 8 }} - {{- end }} - {{- if or .Values.daemonsetAffinity (or .Values.affinity .Values.windowsAffinity) }} - affinity: - {{- toYaml (default .Values.daemonsetAffinity (default .Values.affinity .Values.windowsAffinity )) | nindent 8 }} - {{- end }} - {{- if or .Values.daemonsetTolerations (or .Values.tolerations .Values.windowsTolerations) }} - tolerations: - {{- toYaml (default .Values.daemonsetTolerations (default .Values.tolerations .Values.windowsTolerations )) | nindent 8 }} - {{- end }} -{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/deployment.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/deployment.yaml deleted file mode 100644 index 3024e42f5..000000000 --- a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/deployment.yaml +++ /dev/null @@ -1,211 +0,0 @@ -{{- if .Values.enableSqsTerminationDraining }} -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "aws-node-termination-handler.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "aws-node-termination-handler.labelsDeployment" . | nindent 4 }} -spec: - replicas: {{ .Values.replicas }} - {{- with .Values.strategy }} - strategy: - {{- toYaml . | nindent 4 }} - {{- end }} - selector: - matchLabels: - {{- include "aws-node-termination-handler.selectorLabelsDeployment" . | nindent 6 }} - template: - metadata: - labels: - {{- include "aws-node-termination-handler.selectorLabelsDeployment" . | nindent 8 }} - k8s-app: aws-node-termination-handler - {{- with .Values.podLabels }} - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.podAnnotations }} - annotations: - {{- toYaml . | nindent 8 }} - {{- end }} - spec: - {{- with .Values.image.pullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - serviceAccountName: {{ include "aws-node-termination-handler.serviceAccountName" . }} - {{- with .Values.podSecurityContext }} - securityContext: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.priorityClassName }} - priorityClassName: {{ . }} - {{- end }} - {{- with .Values.terminationGracePeriodSeconds }} - terminationGracePeriodSeconds: {{ . }} - {{- end }} - {{- with .Values.dnsConfig }} - dnsConfig: - {{- toYaml . | nindent 8 }} - {{- end }} - containers: - - name: aws-node-termination-handler - {{- with .Values.securityContext }} - securityContext: - {{- toYaml . | nindent 12 }} - {{- end }} - image: {{ include "aws-node-termination-handler.image" . }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - env: - - name: NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: ENABLE_PROBES_SERVER - value: "true" - - name: PROBES_SERVER_PORT - value: {{ .Values.probes.httpGet.port | quote }} - - name: PROBES_SERVER_ENDPOINT - value: {{ .Values.probes.httpGet.path | quote }} - - name: LOG_LEVEL - value: {{ .Values.logLevel | quote }} - - name: JSON_LOGGING - value: {{ .Values.jsonLogging | quote }} - - name: LOG_FORMAT_VERSION - value: {{ .Values.logFormatVersion | quote }} - - name: ENABLE_PROMETHEUS_SERVER - value: {{ .Values.enablePrometheusServer | quote }} - - name: PROMETHEUS_SERVER_PORT - value: {{ .Values.prometheusServerPort | quote }} - # [DEPRECATED] Use CHECK_TAG_BEFORE_DRAINING instead - - name: CHECK_ASG_TAG_BEFORE_DRAINING - value: {{ .Values.checkASGTagBeforeDraining | quote }} - - name: CHECK_TAG_BEFORE_DRAINING - value: {{ .Values.checkTagBeforeDraining | quote }} - # [DEPRECATED] Use MANAGED_TAG instead - - name: MANAGED_ASG_TAG - value: {{ .Values.managedAsgTag | quote }} - - name: MANAGED_TAG - value: {{ .Values.managedTag | quote }} - - name: USE_PROVIDER_ID - value: {{ .Values.useProviderId | quote }} - - name: DRY_RUN - value: {{ .Values.dryRun | quote }} - - name: CORDON_ONLY - value: {{ .Values.cordonOnly | quote }} - - name: TAINT_NODE - value: {{ .Values.taintNode | quote }} - - name: EXCLUDE_FROM_LOAD_BALANCERS - value: {{ .Values.excludeFromLoadBalancers | quote }} - - name: DELETE_LOCAL_DATA - value: {{ .Values.deleteLocalData | quote }} - - name: IGNORE_DAEMON_SETS - value: {{ .Values.ignoreDaemonSets | quote }} - - name: POD_TERMINATION_GRACE_PERIOD - value: {{ .Values.podTerminationGracePeriod | quote }} - - name: NODE_TERMINATION_GRACE_PERIOD - value: {{ .Values.nodeTerminationGracePeriod | quote }} - - name: EMIT_KUBERNETES_EVENTS - value: {{ .Values.emitKubernetesEvents | quote }} - - name: COMPLETE_LIFECYCLE_ACTION_DELAY_SECONDS - value: {{ .Values.completeLifecycleActionDelaySeconds | quote }} - {{- with .Values.kubernetesEventsExtraAnnotations }} - - name: KUBERNETES_EVENTS_EXTRA_ANNOTATIONS - value: {{ . | quote }} - {{- end }} - {{- if or .Values.webhookURL .Values.webhookURLSecretName }} - - name: WEBHOOK_URL - {{- if .Values.webhookURLSecretName }} - valueFrom: - secretKeyRef: - name: {{ .Values.webhookURLSecretName }} - key: webhookurl - {{- else }} - value: {{ .Values.webhookURL | quote }} - {{- end }} - {{- end }} - {{- with .Values.webhookHeaders }} - - name: WEBHOOK_HEADERS - value: {{ . | quote }} - {{- end }} - {{- with .Values.webhookProxy }} - - name: WEBHOOK_PROXY - value: {{ . | quote }} - {{- end }} - {{- if and .Values.webhookTemplateConfigMapName .Values.webhookTemplateConfigMapKey }} - - name: WEBHOOK_TEMPLATE_FILE - value: {{ print "/config/" .Values.webhookTemplateConfigMapKey | quote }} - {{- else if .Values.webhookTemplate }} - - name: WEBHOOK_TEMPLATE - value: {{ .Values.webhookTemplate | quote }} - {{- end }} - - name: ENABLE_SQS_TERMINATION_DRAINING - value: "true" - {{- with .Values.awsRegion }} - - name: AWS_REGION - value: {{ . | quote }} - {{- end }} - {{- with .Values.awsEndpoint }} - - name: AWS_ENDPOINT - value: {{ . | quote }} - {{- end }} - {{- if and .Values.awsAccessKeyID .Values.awsSecretAccessKey }} - - name: AWS_ACCESS_KEY_ID - value: {{ .Values.awsAccessKeyID | quote }} - - name: AWS_SECRET_ACCESS_KEY - value: {{ .Values.awsSecretAccessKey | quote }} - {{- end }} - - name: QUEUE_URL - value: {{ .Values.queueURL | quote }} - - name: WORKERS - value: {{ .Values.workers | quote }} - {{- with .Values.extraEnv }} - {{- toYaml . | nindent 12 }} - {{- end }} - ports: - - name: liveness-probe - protocol: TCP - containerPort: {{ .Values.probes.httpGet.port }} - {{- if .Values.enablePrometheusServer }} - - name: http-metrics - protocol: TCP - containerPort: {{ .Values.prometheusServerPort }} - {{- end }} - livenessProbe: - {{- toYaml .Values.probes | nindent 12 }} - {{- with .Values.resources }} - resources: - {{- toYaml . | nindent 12 }} - {{- end }} - {{- if and .Values.webhookTemplateConfigMapName .Values.webhookTemplateConfigMapKey }} - volumeMounts: - - name: webhook-template - mountPath: /config/ - {{- end }} - {{- if and .Values.webhookTemplateConfigMapName .Values.webhookTemplateConfigMapKey }} - volumes: - - name: webhook-template - configMap: - name: {{ .Values.webhookTemplateConfigMapName }} - {{- end }} - nodeSelector: - kubernetes.io/os: linux - {{- with .Values.nodeSelector }} - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/pdb.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/pdb.yaml deleted file mode 100644 index 7f43ab299..000000000 --- a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/pdb.yaml +++ /dev/null @@ -1,14 +0,0 @@ -{{- if and .Values.enableSqsTerminationDraining (and .Values.podDisruptionBudget (gt (int .Values.replicas) 1)) }} -apiVersion: {{ include "aws-node-termination-handler.pdb.apiVersion" . }} -kind: PodDisruptionBudget -metadata: - name: {{ include "aws-node-termination-handler.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "aws-node-termination-handler.labels" . | nindent 4 }} -spec: - selector: - matchLabels: - {{- include "aws-node-termination-handler.selectorLabelsDeployment" . | nindent 6 }} - {{- toYaml .Values.podDisruptionBudget | nindent 2 }} -{{- end }} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/podmonitor.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/podmonitor.yaml deleted file mode 100644 index e214d12ca..000000000 --- a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/podmonitor.yaml +++ /dev/null @@ -1,29 +0,0 @@ -{{- if and (not .Values.enableSqsTerminationDraining) (and .Values.enablePrometheusServer .Values.podMonitor.create) -}} -apiVersion: monitoring.coreos.com/v1 -kind: PodMonitor -metadata: - name: {{ template "aws-node-termination-handler.fullname" . }} - namespace: {{ default .Release.Namespace .Values.podMonitor.namespace }} - labels: - {{- include "aws-node-termination-handler.labels" . | nindent 4 }} - {{- with .Values.podMonitor.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} -spec: - jobLabel: app.kubernetes.io/name - namespaceSelector: - matchNames: - - {{ .Release.Namespace }} - podMetricsEndpoints: - - port: http-metrics - path: /metrics - {{- with .Values.podMonitor.interval }} - interval: {{ . }} - {{- end }} - {{- with .Values.podMonitor.sampleLimit }} - sampleLimit: {{ . }} - {{- end }} - selector: - matchLabels: - {{- include "aws-node-termination-handler.selectorLabelsDaemonset" . | nindent 6 }} -{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/psp.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/psp.yaml deleted file mode 100644 index c84d69f39..000000000 --- a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/psp.yaml +++ /dev/null @@ -1,70 +0,0 @@ -{{- if and (.Values.rbac.pspEnabled) (semverCompare "<1.25-0" .Capabilities.KubeVersion.GitVersion) }} -apiVersion: policy/v1beta1 -kind: PodSecurityPolicy -metadata: - name: {{ template "aws-node-termination-handler.fullname" . }} - labels: - {{- include "aws-node-termination-handler.labels" . | nindent 4 }} - annotations: - seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' -spec: - privileged: false - hostIPC: false - hostNetwork: {{ .Values.useHostNetwork }} - hostPID: false -{{- if and (and (not .Values.enableSqsTerminationDraining) .Values.useHostNetwork ) (or .Values.enablePrometheusServer .Values.enableProbesServer) }} - hostPorts: -{{- if .Values.enablePrometheusServer }} - - min: {{ .Values.prometheusServerPort }} - max: {{ .Values.prometheusServerPort }} -{{- end }} -{{- if .Values.enableProbesServer }} - - min: {{ .Values.probes.httpGet.port }} - max: {{ .Values.probes.httpGet.port }} -{{- end }} -{{- end }} - readOnlyRootFilesystem: false - allowPrivilegeEscalation: false - allowedCapabilities: - - '*' - fsGroup: - rule: RunAsAny - runAsUser: - rule: RunAsAny - seLinux: - rule: RunAsAny - supplementalGroups: - rule: RunAsAny - volumes: - - '*' ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ template "aws-node-termination-handler.fullname" . }}-psp - namespace: {{ .Release.Namespace }} - labels: - {{- include "aws-node-termination-handler.labels" . | nindent 4 }} -rules: - - apiGroups: ['policy'] - resources: ['podsecuritypolicies'] - verbs: ['use'] - resourceNames: - - {{ template "aws-node-termination-handler.fullname" . }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ template "aws-node-termination-handler.fullname" . }}-psp - namespace: {{ .Release.Namespace }} - labels: - {{- include "aws-node-termination-handler.labels" . | nindent 4 }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ template "aws-node-termination-handler.fullname" . }}-psp -subjects: - - kind: ServiceAccount - name: {{ template "aws-node-termination-handler.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} -{{- end }} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/service.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/service.yaml deleted file mode 100644 index 19f7b067b..000000000 --- a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/service.yaml +++ /dev/null @@ -1,18 +0,0 @@ -{{- if and .Values.enableSqsTerminationDraining .Values.enablePrometheusServer -}} -apiVersion: v1 -kind: Service -metadata: - name: {{ include "aws-node-termination-handler.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "aws-node-termination-handler.labelsDeployment" . | nindent 4 }} -spec: - type: ClusterIP - selector: - {{- include "aws-node-termination-handler.selectorLabelsDeployment" . | nindent 4 }} - ports: - - name: http-metrics - port: {{ .Values.prometheusServerPort }} - targetPort: http-metrics - protocol: TCP -{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/serviceaccount.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/serviceaccount.yaml deleted file mode 100644 index 08f3dc5f8..000000000 --- a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/serviceaccount.yaml +++ /dev/null @@ -1,13 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ template "aws-node-termination-handler.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "aws-node-termination-handler.labels" . | nindent 4 }} - {{- with .Values.serviceAccount.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/servicemonitor.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/templates/servicemonitor.yaml deleted file mode 100644 index d5fe14795..000000000 --- a/charts/devtron-utilities/charts/aws-node-termination-handler/templates/servicemonitor.yaml +++ /dev/null @@ -1,29 +0,0 @@ -{{- if and .Values.enableSqsTerminationDraining (and .Values.enablePrometheusServer .Values.serviceMonitor.create) -}} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ include "aws-node-termination-handler.fullname" . }} - namespace: {{ default .Release.Namespace .Values.serviceMonitor.namespace }} - labels: - {{- include "aws-node-termination-handler.labels" . | nindent 4 }} - {{- with .Values.serviceMonitor.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} -spec: - jobLabel: app.kubernetes.io/name - namespaceSelector: - matchNames: - - {{ .Release.Namespace }} - endpoints: - - port: http-metrics - path: /metrics - {{- with .Values.serviceMonitor.interval }} - interval: {{ . }} - {{- end }} - {{- with .Values.serviceMonitor.sampleLimit }} - sampleLimit: {{ . }} - {{- end }} - selector: - matchLabels: - {{- include "aws-node-termination-handler.selectorLabelsDeployment" . | nindent 6 }} -{{- end -}} diff --git a/charts/devtron-utilities/charts/aws-node-termination-handler/values.yaml b/charts/devtron-utilities/charts/aws-node-termination-handler/values.yaml deleted file mode 100644 index ea7b7f77d..000000000 --- a/charts/devtron-utilities/charts/aws-node-termination-handler/values.yaml +++ /dev/null @@ -1,295 +0,0 @@ -# Default values for aws-node-termination-handler. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. - -image: - repository: public.ecr.aws/aws-ec2/aws-node-termination-handler - # Overrides the image tag whose default is {{ printf "v%s" .Chart.AppVersion }} - tag: "" - pullPolicy: IfNotPresent - pullSecrets: [] - -nameOverride: "" -fullnameOverride: "" - -serviceAccount: - # Specifies whether a service account should be created - create: true - # The name of the service account to use. If namenot set and create is true, a name is generated using fullname template - name: - annotations: {} - # eks.amazonaws.com/role-arn: arn:aws:iam::AWS_ACCOUNT_ID:role/IAM_ROLE_NAME - -rbac: - # Specifies whether RBAC resources should be created - create: true - # Specifies if PodSecurityPolicy resources should be created. PodSecurityPolicy will not be created when Kubernetes version is 1.25 or later. - pspEnabled: true - -customLabels: {} - -podLabels: {} - -podAnnotations: {} - -podSecurityContext: - fsGroup: 1000 - -securityContext: - readOnlyRootFilesystem: true - runAsNonRoot: true - allowPrivilegeEscalation: false - runAsUser: 1000 - runAsGroup: 1000 - -terminationGracePeriodSeconds: - -resources: {} - -nodeSelector: {} - -affinity: {} - -tolerations: [] - -# Extra environment variables -extraEnv: [] - -# Liveness probe settings -probes: - httpGet: - path: /healthz - port: 8080 - initialDelaySeconds: 5 - periodSeconds: 5 - -# Set the log level -logLevel: info - -# Set the log format version -logFormatVersion: 1 - -# Log messages in JSON format -jsonLogging: false - -enablePrometheusServer: false -prometheusServerPort: 9092 - -# dryRun tells node-termination-handler to only log calls to kubernetes control plane -dryRun: false - -# Cordon but do not drain nodes upon spot interruption termination notice. -cordonOnly: false - -# Taint node upon spot interruption termination notice. -taintNode: false - -# Exclude node from load balancer before cordoning via the ServiceNodeExclusion feature gate. -excludeFromLoadBalancers: false - -# deleteLocalData tells kubectl to continue even if there are pods using -# emptyDir (local data that will be deleted when the node is drained). -deleteLocalData: true - -# ignoreDaemonSets causes kubectl to skip Daemon Set managed pods. -ignoreDaemonSets: true - -# podTerminationGracePeriod is time in seconds given to each pod to terminate gracefully. If negative, the default value specified in the pod will be used. -podTerminationGracePeriod: -1 - -# nodeTerminationGracePeriod specifies the period of time in seconds given to each NODE to terminate gracefully. Node draining will be scheduled based on this value to optimize the amount of compute time, but still safely drain the node before an event. -nodeTerminationGracePeriod: 120 - -# emitKubernetesEvents If true, Kubernetes events will be emitted when interruption events are received and when actions are taken on Kubernetes nodes. In IMDS Processor mode a default set of annotations with all the node metadata gathered from IMDS will be attached to each event -emitKubernetesEvents: false - -# completeLifecycleActionDelaySeconds will pause for the configured duration after draining the node before completing the EC2 Autoscaling lifecycle action. This may be helpful if Pods on the node have Persistent Volume Claims. -completeLifecycleActionDelaySeconds: -1 - -# kubernetesEventsExtraAnnotations A comma-separated list of key=value extra annotations to attach to all emitted Kubernetes events -# Example: "first=annotation,sample.annotation/number=two" -kubernetesEventsExtraAnnotations: "" - -# webhookURL if specified, posts event data to URL upon instance interruption action. -webhookURL: "" - -# Webhook URL will be fetched from the secret store using the given name. -webhookURLSecretName: "" - -# webhookHeaders if specified, replaces the default webhook headers. -webhookHeaders: "" - -# webhookProxy if specified, uses this HTTP(S) proxy configuration. -webhookProxy: "" - -# webhookTemplate if specified, replaces the default webhook message template. -webhookTemplate: "" - -# webhook template file will be fetched from given config map name -# if specified, replaces the default webhook message with the content of the template file -webhookTemplateConfigMapName: "" - -# template file name stored in configmap -webhookTemplateConfigMapKey: "" - -# enableSqsTerminationDraining If true, this turns on queue-processor mode which drains nodes when an SQS termination event is received -enableSqsTerminationDraining: false - -# --------------------------------------------------------------------------------------------------------------------- -# Queue Processor Mode -# --------------------------------------------------------------------------------------------------------------------- - -# The number of replicas in the NTH deployment when using queue-processor mode (NOTE: increasing this may cause duplicate webhooks since NTH pods are stateless) -replicas: 1 - -# Specify the update strategy for the deployment -strategy: {} - -# podDisruptionBudget specifies the disruption budget for the controller pods. -# Disruption budget will be configured only when the replicaCount is greater than 1 -podDisruptionBudget: {} -# maxUnavailable: 1 - -serviceMonitor: - # Specifies whether ServiceMonitor should be created - # this needs enableSqsTerminationDraining: true - # and enablePrometheusServer: true - create: false - # Specifies whether the ServiceMonitor should be created in a different namespace than - # the Helm release - namespace: - # Additional labels to add to the metadata - labels: {} - # The Prometheus scrape interval - interval: 30s - # The number of scraped samples that will be accepted - sampleLimit: 5000 - -priorityClassName: system-cluster-critical - -# If specified, use the AWS region for AWS API calls -awsRegion: "" - -# Listens for messages on the specified SQS queue URL -queueURL: "" - -# The maximum amount of parallel event processors to handle concurrent events -workers: 10 - -# [DEPRECATED] Use checkTagBeforeDraining instead -checkASGTagBeforeDraining: true - -# If true, check that the instance is tagged with "aws-node-termination-handler/managed" as the key before draining the node -checkTagBeforeDraining: true - -# [DEPRECATED] Use managedTag instead -managedAsgTag: "aws-node-termination-handler/managed" - -# The tag to ensure is on a node if checkTagBeforeDraining is true -managedTag: "aws-node-termination-handler/managed" - -# If true, fetch node name through Kubernetes node spec ProviderID instead of AWS event PrivateDnsHostname. -useProviderId: false - -# --------------------------------------------------------------------------------------------------------------------- -# IMDS Mode -# --------------------------------------------------------------------------------------------------------------------- - -# Create node OS specific daemonset(s). (e.g. "linux", "windows", "linux windows") -targetNodeOs: linux - -linuxPodLabels: {} -windowsPodLabels: {} - -linuxPodAnnotations: {} -windowsPodAnnotations: {} - -# K8s DaemonSet update strategy. -updateStrategy: - type: RollingUpdate - rollingUpdate: - maxUnavailable: 25% - -daemonsetPriorityClassName: system-node-critical - -podMonitor: - # Specifies whether PodMonitor should be created - # this needs enableSqsTerminationDraining: false - # and enablePrometheusServer: true - create: false - # Specifies whether the PodMonitor should be created in a different namespace than - # the Helm release - namespace: - # Additional labels to add to the metadata - labels: {} - # The Prometheus scrape interval - interval: 30s - # The number of scraped samples that will be accepted - sampleLimit: 5000 - -# Determines if NTH uses host networking for Linux when running the DaemonSet (only IMDS mode; queue-processor never runs with host networking) -# If you have disabled IMDSv1 and are relying on IMDSv2, you'll need to increase the IP hop count to 2 before switching this to false -# https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html -useHostNetwork: true - -# Daemonset DNS policy -dnsPolicy: "" -dnsConfig: {} -linuxDnsPolicy: ClusterFirstWithHostNet -windowsDnsPolicy: ClusterFirst - -daemonsetNodeSelector: {} -linuxNodeSelector: {} -windowsNodeSelector: {} - -daemonsetAffinity: - nodeAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - nodeSelectorTerms: - - matchExpressions: - - key: "eks.amazonaws.com/compute-type" - operator: NotIn - values: - - fargate -linuxAffinity: {} -windowsAffinity: {} - -daemonsetTolerations: - - operator: Exists -linuxTolerations: [] -windowsTolerations: [] - -# If the probes server is running. -enableProbesServer: false - -# Total number of times to try making the metadata request before failing. -metadataTries: 3 - -# enableSpotInterruptionDraining If false, do not drain nodes when the spot interruption termination notice is received. Only used in IMDS mode. -enableSpotInterruptionDraining: true - -# enableScheduledEventDraining If false, do not drain nodes before the maintenance window starts for an EC2 instance scheduled event. Only used in IMDS mode. -enableScheduledEventDraining: true - -# enableRebalanceMonitoring If true, cordon nodes when the rebalance recommendation notice is received. Only used in IMDS mode. -enableRebalanceMonitoring: false - -# enableRebalanceDraining If true, drain nodes when the rebalance recommendation notice is received. Only used in IMDS mode. -enableRebalanceDraining: false - -# --------------------------------------------------------------------------------------------------------------------- -# Testing -# --------------------------------------------------------------------------------------------------------------------- - -# (TESTING USE): If specified, use the provided AWS endpoint to make API calls. -awsEndpoint: "" - -# (TESTING USE): These should only be used for testing w/ localstack! -awsAccessKeyID: -awsSecretAccessKey: - -# (TESTING USE): Override the default metadata URL (default: http://169.254.169.254:80) -instanceMetadataURL: "" - -# (TESTING USE): Mount path for uptime file -procUptimeFile: /proc/uptime diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/.helmignore b/charts/devtron-utilities/charts/cluster-autoscaler/.helmignore deleted file mode 100644 index 0e8a0eb36..000000000 --- a/charts/devtron-utilities/charts/cluster-autoscaler/.helmignore +++ /dev/null @@ -1,23 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*.orig -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/Chart.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/Chart.yaml deleted file mode 100644 index 309d79e13..000000000 --- a/charts/devtron-utilities/charts/cluster-autoscaler/Chart.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v2 -appVersion: 1.32.0 -description: Scales Kubernetes worker nodes within autoscaling groups. -home: https://github.com/kubernetes/autoscaler -icon: https://github.com/kubernetes/kubernetes/raw/master/logo/logo.png -maintainers: -- email: guyjtempleton@googlemail.com - name: gjtempleton -name: cluster-autoscaler -sources: -- https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler -type: application -version: 9.46.0 diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/README.md b/charts/devtron-utilities/charts/cluster-autoscaler/README.md deleted file mode 100644 index 400b342f3..000000000 --- a/charts/devtron-utilities/charts/cluster-autoscaler/README.md +++ /dev/null @@ -1,527 +0,0 @@ -# cluster-autoscaler - -Scales Kubernetes worker nodes within autoscaling groups. - -## TL;DR - -```console -$ helm repo add autoscaler https://kubernetes.github.io/autoscaler - -# Method 1 - Using Autodiscovery -$ helm install my-release autoscaler/cluster-autoscaler \ - --set 'autoDiscovery.clusterName'= - -# Method 2 - Specifying groups manually -$ helm install my-release autoscaler/cluster-autoscaler \ - --set "autoscalingGroups[0].name=your-asg-name" \ - --set "autoscalingGroups[0].maxSize=10" \ - --set "autoscalingGroups[0].minSize=1" -``` - -## Introduction - -This chart bootstraps a cluster-autoscaler deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. - -## Prerequisites - -- Helm 3+ -- Kubernetes 1.8+ - - [Older versions](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler#releases) may work by overriding the `image`. Cluster autoscaler internally simulates the scheduler and bugs between mismatched versions may be subtle. -- Azure AKS specific Prerequisites: - - Kubernetes 1.10+ with RBAC-enabled. - -## Previous Helm Chart - -The previous `cluster-autoscaler` Helm chart hosted at [helm/charts](https://github.com/helm/charts) has been moved to this repository in accordance with the [Deprecation timeline](https://github.com/helm/charts#deprecation-timeline). Note that a few things have changed between this version and the old version: - -- This repository **only** supports Helm chart installations using Helm 3+ since the `apiVersion` on the charts has been marked as `v2`. -- Previous versions of the Helm chart have not been migrated - -## Migration from 1.X to 9.X+ versions of this Chart - -**TL;DR:** -You should choose to use versions >=9.0.0 of the `cluster-autoscaler` chart published from this repository; previous versions, and the `cluster-autoscaler-chart` with versioning 1.X.X published from this repository are deprecated. - -
- Previous versions of this chart - further details -On initial migration of this chart from the `helm/charts` repository this chart was renamed from `cluster-autoscaler` to `cluster-autoscaler-chart` due to technical limitations. This affected all `1.X` releases of the chart, version 2.0.0 of this chart exists only to mark the [`cluster-autoscaler-chart` chart](https://artifacthub.io/packages/helm/cluster-autoscaler/cluster-autoscaler-chart) as deprecated. - -Releases of the chart from `9.0.0` onwards return the naming of the chart to `cluster-autoscaler` and return to following the versioning established by the chart's previous location at . - -To migrate from a 1.X release of the chart to a `9.0.0` or later release, you should first uninstall your `1.X` install of the `cluster-autoscaler-chart` chart, before performing the installation of the new `cluster-autoscaler` chart. -
- -## Migration from 9.0 to 9.1 - -Starting from `9.1.0` the `envFromConfigMap` value is expected to contain the name of a ConfigMap that is used as ref for `envFrom`, similar to `envFromSecret`. If you want to keep the previous behaviour of `envFromConfigMap` you must rename it to `extraEnvConfigMaps`. - -## Installing the Chart - -**By default, no deployment is created and nothing will autoscale**. - -You must provide some minimal configuration, either to specify instance groups or enable auto-discovery. It is not recommended to do both. - -Either: - -- Set `autoDiscovery.clusterName` and provide additional autodiscovery options if necessary **or** -- Set static node group configurations for one or more node groups (using `autoscalingGroups` or `autoscalingGroupsnamePrefix`). - -To create a valid configuration, follow instructions for your cloud provider: - -- [AWS](#aws---using-auto-discovery-of-tagged-instance-groups) -- [GCE](#gce) -- [Azure](#azure) -- [OpenStack Magnum](#openstack-magnum) -- [Cluster API](#cluster-api) -- [Exoscale](#exoscale) -- [Hetzner Cloud](#hetzner-cloud) -- [Civo](#civo) - -### Templating the autoDiscovery.clusterName - -The cluster name can be templated in the `autoDiscovery.clusterName` variable. This is useful when the cluster name is dynamically generated based on other values coming from external systems like Argo CD or Flux. This also allows you to use global Helm values to set the cluster name, e.g., `autoDiscovery.clusterName=\{\{ .Values.global.clusterName }}`, so that you don't need to set it in more than 1 location in the values file. - -### AWS - Using auto-discovery of tagged instance groups - -Auto-discovery finds ASGs tags as below and automatically manages them based on the min and max size specified in the ASG. `cloudProvider=aws` only. - -- Tag the ASGs with keys to match `.Values.autoDiscovery.tags`, by default: `k8s.io/cluster-autoscaler/enabled` and `k8s.io/cluster-autoscaler/` -- Verify the [IAM Permissions](#aws---iam) -- Set `autoDiscovery.clusterName=` -- Set `awsRegion=` -- Set (option) `awsAccessKeyID=` and `awsSecretAccessKey=` if you want to [use AWS credentials directly instead of an instance role](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials) - -```console -$ helm install my-release autoscaler/cluster-autoscaler \ - --set autoDiscovery.clusterName= \ - --set awsRegion= -``` - -Alternatively with your own AWS credentials - -```console -$ helm install my-release autoscaler/cluster-autoscaler \ - --set autoDiscovery.clusterName= \ - --set awsRegion= \ - --set awsAccessKeyID= \ - --set awsSecretAccessKey= -``` - -#### Specifying groups manually - -Without autodiscovery, specify an array of elements each containing ASG name, min size, max size. The sizes specified here will be applied to the ASG, assuming IAM permissions are correctly configured. - -- Verify the [IAM Permissions](#aws---iam) -- Either provide a yaml file setting `autoscalingGroups` (see values.yaml) or use `--set` e.g.: - -```console -$ helm install my-release autoscaler/cluster-autoscaler \ - --set "autoscalingGroups[0].name=your-asg-name" \ - --set "autoscalingGroups[0].maxSize=10" \ - --set "autoscalingGroups[0].minSize=1" -``` - -#### Auto-discovery - -For auto-discovery of instances to work, they must be tagged with the keys in `.Values.autoDiscovery.tags`, which by default are `k8s.io/cluster-autoscaler/enabled` and `k8s.io/cluster-autoscaler/`. - -The value of the tag does not matter, only the key. - -An example kops spec excerpt: - -```yaml -apiVersion: kops/v1alpha2 -kind: Cluster -metadata: - name: my.cluster.internal -spec: - additionalPolicies: - node: | - [ - {"Effect":"Allow","Action":["autoscaling:DescribeAutoScalingGroups","autoscaling:DescribeAutoScalingInstances","autoscaling:DescribeLaunchConfigurations","autoscaling:DescribeTags","autoscaling:SetDesiredCapacity","autoscaling:TerminateInstanceInAutoScalingGroup"],"Resource":"*"} - ] - ... ---- -apiVersion: kops/v1alpha2 -kind: InstanceGroup -metadata: - labels: - kops.k8s.io/cluster: my.cluster.internal - name: my-instances -spec: - cloudLabels: - k8s.io/cluster-autoscaler/enabled: "" - k8s.io/cluster-autoscaler/my.cluster.internal: "" - image: kops.io/k8s-1.8-debian-jessie-amd64-hvm-ebs-2018-01-14 - machineType: r4.large - maxSize: 4 - minSize: 0 -``` - -In this example you would need to `--set autoDiscovery.clusterName=my.cluster.internal` when installing. - -It is not recommended to try to mix this with setting `autoscalingGroups`. - -See [autoscaler AWS documentation](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#auto-discovery-setup) for a more discussion of the setup. - -### GCE - -The following parameters are required: - -- `autoDiscovery.clusterName=any-name` -- `cloud-provider=gce` -- `autoscalingGroupsnamePrefix[0].name=your-ig-prefix,autoscalingGroupsnamePrefix[0].maxSize=10,autoscalingGroupsnamePrefix[0].minSize=1` - -To use Managed Instance Group (MIG) auto-discovery, provide a YAML file setting `autoscalingGroupsnamePrefix` (see values.yaml) or use `--set` when installing the Chart - e.g. - -```console -$ helm install my-release autoscaler/cluster-autoscaler \ - --set "autoscalingGroupsnamePrefix[0].name=your-ig-prefix,autoscalingGroupsnamePrefix[0].maxSize=10,autoscalingGroupsnamePrefi[0].minSize=1" \ - --set autoDiscovery.clusterName= \ - --set cloudProvider=gce -``` - -Note that `your-ig-prefix` should be a _prefix_ matching one or more MIGs, and _not_ the full name of the MIG. For example, to match multiple instance groups - `k8s-node-group-a-standard`, `k8s-node-group-b-gpu`, you would use a prefix of `k8s-node-group-`. - -In the event you want to explicitly specify MIGs instead of using auto-discovery, set members of the `autoscalingGroups` array directly - e.g. - -``` -# where 'n' is the index, starting at 0 ---set autoscalingGroups[n].name=https://content.googleapis.com/compute/v1/projects/$PROJECTID/zones/$ZONENAME/instanceGroupManagers/$FULL-MIG-NAME,autoscalingGroups[n].maxSize=$MAXSIZE,autoscalingGroups[n].minSize=$MINSIZE -``` - -### Azure - -The following parameters are required: - -- `cloudProvider=azure` -- `autoscalingGroups[0].name=your-vmss,autoscalingGroups[0].maxSize=10,autoscalingGroups[0].minSize=1` -- `azureClientID: "your-service-principal-app-id"` -- `azureClientSecret: "your-service-principal-client-secret"` -- `azureSubscriptionID: "your-azure-subscription-id"` -- `azureTenantID: "your-azure-tenant-id"` -- `azureResourceGroup: "your-aks-cluster-resource-group-name"` -- `azureVMType: "vmss"` - -### OpenStack Magnum - -`cloudProvider: magnum` must be set, and then one of - -- `magnumClusterName=` and `autoscalingGroups` with the names of node groups and min/max node counts -- or `autoDiscovery.clusterName=` with one or more `autoDiscovery.roles`. - -Additionally, `cloudConfigPath: "/etc/kubernetes/cloud-config"` must be set as this should be the location of the cloud-config file on the host. - -Example values files can be found [here](../../cluster-autoscaler/cloudprovider/magnum/examples). - -Install the chart with - -```console -$ helm install my-release autoscaler/cluster-autoscaler -f myvalues.yaml -``` - -### Cluster-API - -`cloudProvider: clusterapi` must be set, and then one or more of - -- `autoDiscovery.clusterName` -- or `autoDiscovery.namespace` -- or `autoDiscovery.labels` - -See [here](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/clusterapi/README.md#configuring-node-group-auto-discovery) for more details. - -Additional config parameters available, see the `values.yaml` for more details - -- `clusterAPIMode` -- `clusterAPIKubeconfigSecret` -- `clusterAPIWorkloadKubeconfigPath` -- `clusterAPICloudConfigPath` - -### Exoscale - -Create a `values.yaml` file with the following content: -```yaml -cloudProvider: exoscale -autoDiscovery: - clusterName: cluster.local # this value is not used, but must be set -``` - -Optionally, you may specify the minimum and maximum size of a particular nodepool by adding the following to the `values.yaml` file: -```yaml -autoscalingGroups: - - name: your-nodepool-name - maxSize: 10 - minSize: 1 -``` - -Create an Exoscale API key with appropriate permissions as described in [cluster-autoscaler/cloudprovider/exoscale/README.md](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/exoscale/README.md). -A secret of name `-exoscale-cluster-autoscaler` needs to be created, containing the api key and secret, as well as the zone. - -```console -$ kubectl create secret generic my-release-exoscale-cluster-autoscaler \ - --from-literal=api-key="EXOxxxxxxxxxxxxxxxxxxxxxxxx" \ - --from-literal=api-secret="xxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" --from-literal=api-zone="ch-gva-2" -``` - -After creating the secret, the chart may be installed: - -```console -$ helm install my-release autoscaler/cluster-autoscaler -f values.yaml -``` - -Read [cluster-autoscaler/cloudprovider/exoscale/README.md](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/exoscale/README.md) for further information on the setup without helm. - -### Hetzner Cloud - -The following parameters are required: - -- `cloudProvider=hetzner` -- `extraEnv.HCLOUD_TOKEN=...` -- `autoscalingGroups=...` - -Each autoscaling group requires an additional `instanceType` and `region` key to be set. - -Read [cluster-autoscaler/cloudprovider/hetzner/README.md](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/hetzner/README.md) for further information on the setup without helm. - -### Civo - -The following parameters are required: - -- `cloudProvider=civo` -- `autoscalingGroups=...` - -When installing the helm chart to the namespace `kube-system`, you can set `secretKeyRefNameOverride` to `civo-api-access`. -Otherwise specify the following parameters: - -- `civoApiUrl=https://api.civo.com` -- `civoApiKey=...` -- `civoClusterID=...` -- `civoRegion=...` - -Read [cluster-autoscaler/cloudprovider/civo/README.md](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/civo/README.md) for further information on the setup without helm. - -## Uninstalling the Chart - -To uninstall `my-release`: - -```console -$ helm uninstall my-release -``` - -The command removes all the Kubernetes components associated with the chart and deletes the release. - -> **Tip**: List all releases using `helm list` or start clean with `helm uninstall my-release` - -## Additional Configuration - -### AWS - IAM - -The worker running the cluster autoscaler will need access to certain resources and actions depending on the version you run and your configuration of it. - -For the up-to-date IAM permissions required, please see the [cluster autoscaler's AWS Cloudprovider Readme](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#iam-policy) and switch to the tag of the cluster autoscaler image you are using. - -### AWS - IAM Roles for Service Accounts (IRSA) - -For Kubernetes clusters that use Amazon EKS, the service account can be configured with an IAM role using [IAM Roles for Service Accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) to avoid needing to grant access to the worker nodes for AWS resources. - -In order to accomplish this, you will first need to create a new IAM role with the above mentions policies. Take care in [configuring the trust relationship](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-technical-overview.html#iam-role-configuration) to restrict access just to the service account used by cluster autoscaler. - -Once you have the IAM role configured, you would then need to `--set rbac.serviceAccount.annotations."eks\.amazonaws\.com/role-arn"=arn:aws:iam::123456789012:role/MyRoleName` when installing. - -### Azure - Using azure workload identity - -You can use the project [Azure workload identity](https://github.com/Azure/azure-workload-identity), to automatically configure the correct setup for your pods to used federated identity with Azure. - -You can also set the correct settings yourself instead of relying on this project. - -For example the following configuration will configure the Autoscaler to use your federated identity: - -```yaml -azureUseWorkloadIdentityExtension: true -extraEnv: - AZURE_CLIENT_ID: USER ASSIGNED IDENTITY CLIENT ID - AZURE_TENANT_ID: USER ASSIGNED IDENTITY TENANT ID - AZURE_FEDERATED_TOKEN_FILE: /var/run/secrets/tokens/azure-identity-token - AZURE_AUTHORITY_HOST: https://login.microsoftonline.com/ -extraVolumes: -- name: azure-identity-token - projected: - defaultMode: 420 - sources: - - serviceAccountToken: - audience: api://AzureADTokenExchange - expirationSeconds: 3600 - path: azure-identity-token -extraVolumeMounts: -- mountPath: /var/run/secrets/tokens - name: azure-identity-token - readOnly: true -``` - -### Custom arguments - -You can use the `customArgs` value to give any argument to cluster autoscaler command. - -Typical use case is to give an environment variable as an argument which will be interpolated at execution time. - -This is helpful when you need to inject values from configmap or secret. - -## Troubleshooting - -The chart will succeed even if the container arguments are incorrect. A few minutes after starting `kubectl logs -l "app=aws-cluster-autoscaler" --tail=50` should loop through something like - -``` -polling_autoscaler.go:111] Poll finished -static_autoscaler.go:97] Starting main loop -utils.go:435] No pod using affinity / antiaffinity found in cluster, disabling affinity predicate for this loop -static_autoscaler.go:230] Filtering out schedulables -``` - -If not, find a pod that the deployment created and `describe` it, paying close attention to the arguments under `Command`. e.g.: - -``` -Containers: - cluster-autoscaler: - Command: - ./cluster-autoscaler - --cloud-provider=aws -# if specifying ASGs manually - --nodes=1:10:your-scaling-group-name -# if using autodiscovery - --node-group-auto-discovery=asg:tag=k8s.io/cluster-autoscaler/enabled,k8s.io/cluster-autoscaler/ - --v=4 -``` - -### PodSecurityPolicy - -Though enough for the majority of installations, the default PodSecurityPolicy _could_ be too restrictive depending on the specifics of your release. Please make sure to check that the template fits with any customizations made or disable it by setting `rbac.pspEnabled` to `false`. - -### VerticalPodAutoscaler - -The CA Helm Chart can install a [`VerticalPodAutoscaler`](https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/README.md) object from Chart version `9.27.0` -onwards for the Cluster Autoscaler Deployment to scale the CA as appropriate, but for that, we -need to install the VPA to the cluster separately. A VPA can help minimize wasted resources -when usage spikes periodically or remediate containers that are being OOMKilled. - -The following example snippet can be used to install VPA that allows scaling down from the default recommendations of the deployment template: - -```yaml -vpa: - enabled: true - containerPolicy: - minAllowed: - cpu: 20m - memory: 50Mi -``` - -## Values - -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| additionalLabels | object | `{}` | Labels to add to each object of the chart. | -| affinity | object | `{}` | Affinity for pod assignment | -| autoDiscovery.clusterName | string | `nil` | Enable autodiscovery for `cloudProvider=aws`, for groups matching `autoDiscovery.tags`. autoDiscovery.clusterName -- Enable autodiscovery for `cloudProvider=azure`, using tags defined in https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/azure/README.md#auto-discovery-setup. Enable autodiscovery for `cloudProvider=clusterapi`, for groups matching `autoDiscovery.labels`. Enable autodiscovery for `cloudProvider=gce`, but no MIG tagging required. Enable autodiscovery for `cloudProvider=magnum`, for groups matching `autoDiscovery.roles`. | -| autoDiscovery.labels | list | `[]` | Cluster-API labels to match https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/clusterapi/README.md#configuring-node-group-auto-discovery | -| autoDiscovery.namespace | string | `nil` | Enable autodiscovery via cluster namespace for for `cloudProvider=clusterapi` | -| autoDiscovery.roles | list | `["worker"]` | Magnum node group roles to match. | -| autoDiscovery.tags | list | `["k8s.io/cluster-autoscaler/enabled","k8s.io/cluster-autoscaler/{{ .Values.autoDiscovery.clusterName }}"]` | ASG tags to match, run through `tpl`. | -| autoscalingGroups | list | `[]` | For AWS, Azure AKS, Exoscale or Magnum. At least one element is required if not using `autoDiscovery`. For example: 
 - name: asg1
   maxSize: 2
   minSize: 1
For Hetzner Cloud, the `instanceType` and `region` keys are also required. 
 - name: mypool
   maxSize: 2
   minSize: 1
   instanceType: CPX21
   region: FSN1
| -| autoscalingGroupsnamePrefix | list | `[]` | For GCE. At least one element is required if not using `autoDiscovery`. For example: 
 - name: ig01
   maxSize: 10
   minSize: 0
| -| awsAccessKeyID | string | `""` | AWS access key ID ([if AWS user keys used](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials)) | -| awsRegion | string | `"us-east-1"` | AWS region (required if `cloudProvider=aws`) | -| awsSecretAccessKey | string | `""` | AWS access secret key ([if AWS user keys used](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials)) | -| azureClientID | string | `""` | Service Principal ClientID with contributor permission to Cluster and Node ResourceGroup. Required if `cloudProvider=azure` | -| azureClientSecret | string | `""` | Service Principal ClientSecret with contributor permission to Cluster and Node ResourceGroup. Required if `cloudProvider=azure` | -| azureEnableForceDelete | bool | `false` | Whether to force delete VMs or VMSS instances when scaling down. | -| azureResourceGroup | string | `""` | Azure resource group that the cluster is located. Required if `cloudProvider=azure` | -| azureSubscriptionID | string | `""` | Azure subscription where the resources are located. Required if `cloudProvider=azure` | -| azureTenantID | string | `""` | Azure tenant where the resources are located. Required if `cloudProvider=azure` | -| azureUseManagedIdentityExtension | bool | `false` | Whether to use Azure's managed identity extension for credentials. If using MSI, ensure subscription ID, resource group, and azure AKS cluster name are set. You can only use one authentication method at a time, either azureUseWorkloadIdentityExtension or azureUseManagedIdentityExtension should be set. | -| azureUseWorkloadIdentityExtension | bool | `false` | Whether to use Azure's workload identity extension for credentials. See the project here: https://github.com/Azure/azure-workload-identity for more details. You can only use one authentication method at a time, either azureUseWorkloadIdentityExtension or azureUseManagedIdentityExtension should be set. | -| azureVMType | string | `"vmss"` | Azure VM type. | -| civoApiKey | string | `""` | API key for the Civo API. Required if `cloudProvider=civo` | -| civoApiUrl | string | `"https://api.civo.com"` | URL for the Civo API. Required if `cloudProvider=civo` | -| civoClusterID | string | `""` | Cluster ID for the Civo cluster. Required if `cloudProvider=civo` | -| civoRegion | string | `""` | Region for the Civo cluster. Required if `cloudProvider=civo` | -| cloudConfigPath | string | `""` | Configuration file for cloud provider. | -| cloudProvider | string | `"aws"` | The cloud provider where the autoscaler runs. Currently only `gce`, `aws`, `azure`, `magnum`, `clusterapi` and `civo` are supported. `aws` supported for AWS. `gce` for GCE. `azure` for Azure AKS. `magnum` for OpenStack Magnum, `clusterapi` for Cluster API. `civo` for Civo Cloud. | -| clusterAPICloudConfigPath | string | `"/etc/kubernetes/mgmt-kubeconfig"` | Path to kubeconfig for connecting to Cluster API Management Cluster, only used if `clusterAPIMode=kubeconfig-kubeconfig or incluster-kubeconfig` | -| clusterAPIConfigMapsNamespace | string | `""` | Namespace on the workload cluster to store Leader election and status configmaps | -| clusterAPIKubeconfigSecret | string | `""` | Secret containing kubeconfig for connecting to Cluster API managed workloadcluster Required if `cloudProvider=clusterapi` and `clusterAPIMode=kubeconfig-kubeconfig,kubeconfig-incluster or incluster-kubeconfig` | -| clusterAPIMode | string | `"incluster-incluster"` | Cluster API mode, see https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/clusterapi/README.md#connecting-cluster-autoscaler-to-cluster-api-management-and-workload-clusters Syntax: workloadClusterMode-ManagementClusterMode for `kubeconfig-kubeconfig`, `incluster-kubeconfig` and `single-kubeconfig` you always must mount the external kubeconfig using either `extraVolumeSecrets` or `extraMounts` and `extraVolumes` if you dont set `clusterAPIKubeconfigSecret`and thus use an in-cluster config or want to use a non capi generated kubeconfig you must do so for the workload kubeconfig as well | -| clusterAPIWorkloadKubeconfigPath | string | `"/etc/kubernetes/value"` | Path to kubeconfig for connecting to Cluster API managed workloadcluster, only used if `clusterAPIMode=kubeconfig-kubeconfig or kubeconfig-incluster` | -| containerSecurityContext | object | `{}` | [Security context for container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | -| customArgs | list | `[]` | Additional custom container arguments. Refer to https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md#what-are-the-parameters-to-ca for the full list of cluster autoscaler parameters and their default values. List of arguments as strings. | -| deployment.annotations | object | `{}` | Annotations to add to the Deployment object. | -| dnsPolicy | string | `"ClusterFirst"` | Defaults to `ClusterFirst`. Valid values are: `ClusterFirstWithHostNet`, `ClusterFirst`, `Default` or `None`. If autoscaler does not depend on cluster DNS, recommended to set this to `Default`. | -| envFromConfigMap | string | `""` | ConfigMap name to use as envFrom. | -| envFromSecret | string | `""` | Secret name to use as envFrom. | -| expanderPriorities | object | `{}` | The expanderPriorities is used if `extraArgs.expander` contains `priority` and expanderPriorities is also set with the priorities. If `extraArgs.expander` contains `priority`, then expanderPriorities is used to define cluster-autoscaler-priority-expander priorities. See: https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/expander/priority/readme.md | -| extraArgs | object | `{"logtostderr":true,"stderrthreshold":"info","v":4}` | Additional container arguments. Refer to https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md#what-are-the-parameters-to-ca for the full list of cluster autoscaler parameters and their default values. Everything after the first _ will be ignored allowing the use of multi-string arguments. | -| extraEnv | object | `{}` | Additional container environment variables. | -| extraEnvConfigMaps | object | `{}` | Additional container environment variables from ConfigMaps. | -| extraEnvSecrets | object | `{}` | Additional container environment variables from Secrets. | -| extraObjects | list | `[]` | Extra K8s manifests to deploy | -| extraVolumeMounts | list | `[]` | Additional volumes to mount. | -| extraVolumeSecrets | object | `{}` | Additional volumes to mount from Secrets. | -| extraVolumes | list | `[]` | Additional volumes. | -| fullnameOverride | string | `""` | String to fully override `cluster-autoscaler.fullname` template. | -| hostNetwork | bool | `false` | Whether to expose network interfaces of the host machine to pods. | -| image.pullPolicy | string | `"IfNotPresent"` | Image pull policy | -| image.pullSecrets | list | `[]` | Image pull secrets | -| image.repository | string | `"registry.k8s.io/autoscaling/cluster-autoscaler"` | Image repository | -| image.tag | string | `"v1.32.0"` | Image tag | -| initContainers | list | `[]` | Any additional init containers. | -| kubeTargetVersionOverride | string | `""` | Allow overriding the `.Capabilities.KubeVersion.GitVersion` check. Useful for `helm template` commands. | -| kwokConfigMapName | string | `"kwok-provider-config"` | configmap for configuring kwok provider | -| magnumCABundlePath | string | `"/etc/kubernetes/ca-bundle.crt"` | Path to the host's CA bundle, from `ca-file` in the cloud-config file. | -| magnumClusterName | string | `""` | Cluster name or ID in Magnum. Required if `cloudProvider=magnum` and not setting `autoDiscovery.clusterName`. | -| nameOverride | string | `""` | String to partially override `cluster-autoscaler.fullname` template (will maintain the release name) | -| nodeSelector | object | `{}` | Node labels for pod assignment. Ref: https://kubernetes.io/docs/user-guide/node-selection/. | -| podAnnotations | object | `{}` | Annotations to add to each pod. | -| podDisruptionBudget | object | `{"maxUnavailable":1}` | Pod disruption budget. | -| podLabels | object | `{}` | Labels to add to each pod. | -| priorityClassName | string | `"system-cluster-critical"` | priorityClassName | -| priorityConfigMapAnnotations | object | `{}` | Annotations to add to `cluster-autoscaler-priority-expander` ConfigMap. | -| prometheusRule.additionalLabels | object | `{}` | Additional labels to be set in metadata. | -| prometheusRule.enabled | bool | `false` | If true, creates a Prometheus Operator PrometheusRule. | -| prometheusRule.interval | string | `nil` | How often rules in the group are evaluated (falls back to `global.evaluation_interval` if not set). | -| prometheusRule.namespace | string | `"monitoring"` | Namespace which Prometheus is running in. | -| prometheusRule.rules | list | `[]` | Rules spec template (see https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/api.md#rule). | -| rbac.clusterScoped | bool | `true` | if set to false will only provision RBAC to alter resources in the current namespace. Most useful for Cluster-API | -| rbac.create | bool | `true` | If `true`, create and use RBAC resources. | -| rbac.pspEnabled | bool | `false` | If `true`, creates and uses RBAC resources required in the cluster with [Pod Security Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) enabled. Must be used with `rbac.create` set to `true`. | -| rbac.serviceAccount.annotations | object | `{}` | Additional Service Account annotations. | -| rbac.serviceAccount.automountServiceAccountToken | bool | `true` | Automount API credentials for a Service Account. | -| rbac.serviceAccount.create | bool | `true` | If `true` and `rbac.create` is also true, a Service Account will be created. | -| rbac.serviceAccount.name | string | `""` | The name of the ServiceAccount to use. If not set and create is `true`, a name is generated using the fullname template. | -| replicaCount | int | `1` | Desired number of pods | -| resources | object | `{}` | Pod resource requests and limits. | -| revisionHistoryLimit | int | `10` | The number of revisions to keep. | -| secretKeyRefNameOverride | string | `""` | Overrides the name of the Secret to use when loading the secretKeyRef for AWS, Azure and Civo env variables | -| securityContext | object | `{}` | [Security context for pod](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | -| service.annotations | object | `{}` | Annotations to add to service | -| service.clusterIP | string | `""` | IP address to assign to service | -| service.create | bool | `true` | If `true`, a Service will be created. | -| service.externalIPs | list | `[]` | List of IP addresses at which the service is available. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips. | -| service.labels | object | `{}` | Labels to add to service | -| service.loadBalancerIP | string | `""` | IP address to assign to load balancer (if supported). | -| service.loadBalancerSourceRanges | list | `[]` | List of IP CIDRs allowed access to load balancer (if supported). | -| service.portName | string | `"http"` | Name for service port. | -| service.servicePort | int | `8085` | Service port to expose. | -| service.type | string | `"ClusterIP"` | Type of service to create. | -| serviceMonitor.annotations | object | `{}` | Annotations to add to service monitor | -| serviceMonitor.enabled | bool | `false` | If true, creates a Prometheus Operator ServiceMonitor. | -| serviceMonitor.interval | string | `"10s"` | Interval that Prometheus scrapes Cluster Autoscaler metrics. | -| serviceMonitor.metricRelabelings | object | `{}` | MetricRelabelConfigs to apply to samples before ingestion. | -| serviceMonitor.namespace | string | `"monitoring"` | Namespace which Prometheus is running in. | -| serviceMonitor.path | string | `"/metrics"` | The path to scrape for metrics; autoscaler exposes `/metrics` (this is standard) | -| serviceMonitor.relabelings | object | `{}` | RelabelConfigs to apply to metrics before scraping. | -| serviceMonitor.selector | object | `{"release":"prometheus-operator"}` | Default to kube-prometheus install (CoreOS recommended), but should be set according to Prometheus install. | -| tolerations | list | `[]` | List of node taints to tolerate (requires Kubernetes >= 1.6). | -| topologySpreadConstraints | list | `[]` | You can use topology spread constraints to control how Pods are spread across your cluster among failure-domains such as regions, zones, nodes, and other user-defined topology domains. (requires Kubernetes >= 1.19). | -| updateStrategy | object | `{}` | [Deployment update strategy](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy) | -| vpa | object | `{"containerPolicy":{},"enabled":false,"updateMode":"Auto"}` | Configure a VerticalPodAutoscaler for the cluster-autoscaler Deployment. | -| vpa.containerPolicy | object | `{}` | [ContainerResourcePolicy](https://github.com/kubernetes/autoscaler/blob/vertical-pod-autoscaler/v0.13.0/vertical-pod-autoscaler/pkg/apis/autoscaling.k8s.io/v1/types.go#L159). The containerName is always et to the deployment's container name. This value is required if VPA is enabled. | -| vpa.enabled | bool | `false` | If true, creates a VerticalPodAutoscaler. | -| vpa.updateMode | string | `"Auto"` | [UpdateMode](https://github.com/kubernetes/autoscaler/blob/vertical-pod-autoscaler/v0.13.0/vertical-pod-autoscaler/pkg/apis/autoscaling.k8s.io/v1/types.go#L124) | diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/README.md.gotmpl b/charts/devtron-utilities/charts/cluster-autoscaler/README.md.gotmpl deleted file mode 100644 index 8381e8232..000000000 --- a/charts/devtron-utilities/charts/cluster-autoscaler/README.md.gotmpl +++ /dev/null @@ -1,417 +0,0 @@ -{{ template "chart.header" . }} - -{{ template "chart.description" . }} - -## TL;DR - -```console -$ helm repo add autoscaler https://kubernetes.github.io/autoscaler - -# Method 1 - Using Autodiscovery -$ helm install my-release autoscaler/cluster-autoscaler \ - --set 'autoDiscovery.clusterName'= - -# Method 2 - Specifying groups manually -$ helm install my-release autoscaler/cluster-autoscaler \ - --set "autoscalingGroups[0].name=your-asg-name" \ - --set "autoscalingGroups[0].maxSize=10" \ - --set "autoscalingGroups[0].minSize=1" -``` - -## Introduction - -This chart bootstraps a cluster-autoscaler deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. - -## Prerequisites - -- Helm 3+ -- Kubernetes 1.8+ - - [Older versions](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler#releases) may work by overriding the `image`. Cluster autoscaler internally simulates the scheduler and bugs between mismatched versions may be subtle. -- Azure AKS specific Prerequisites: - - Kubernetes 1.10+ with RBAC-enabled. - -## Previous Helm Chart - -The previous `cluster-autoscaler` Helm chart hosted at [helm/charts](https://github.com/helm/charts) has been moved to this repository in accordance with the [Deprecation timeline](https://github.com/helm/charts#deprecation-timeline). Note that a few things have changed between this version and the old version: - -- This repository **only** supports Helm chart installations using Helm 3+ since the `apiVersion` on the charts has been marked as `v2`. -- Previous versions of the Helm chart have not been migrated - -## Migration from 1.X to 9.X+ versions of this Chart - -**TL;DR:** -You should choose to use versions >=9.0.0 of the `cluster-autoscaler` chart published from this repository; previous versions, and the `cluster-autoscaler-chart` with versioning 1.X.X published from this repository are deprecated. - -
- Previous versions of this chart - further details -On initial migration of this chart from the `helm/charts` repository this chart was renamed from `cluster-autoscaler` to `cluster-autoscaler-chart` due to technical limitations. This affected all `1.X` releases of the chart, version 2.0.0 of this chart exists only to mark the [`cluster-autoscaler-chart` chart](https://artifacthub.io/packages/helm/cluster-autoscaler/cluster-autoscaler-chart) as deprecated. - -Releases of the chart from `9.0.0` onwards return the naming of the chart to `cluster-autoscaler` and return to following the versioning established by the chart's previous location at . - -To migrate from a 1.X release of the chart to a `9.0.0` or later release, you should first uninstall your `1.X` install of the `cluster-autoscaler-chart` chart, before performing the installation of the new `cluster-autoscaler` chart. -
- -## Migration from 9.0 to 9.1 - -Starting from `9.1.0` the `envFromConfigMap` value is expected to contain the name of a ConfigMap that is used as ref for `envFrom`, similar to `envFromSecret`. If you want to keep the previous behaviour of `envFromConfigMap` you must rename it to `extraEnvConfigMaps`. - -## Installing the Chart - -**By default, no deployment is created and nothing will autoscale**. - -You must provide some minimal configuration, either to specify instance groups or enable auto-discovery. It is not recommended to do both. - -Either: - -- Set `autoDiscovery.clusterName` and provide additional autodiscovery options if necessary **or** -- Set static node group configurations for one or more node groups (using `autoscalingGroups` or `autoscalingGroupsnamePrefix`). - -To create a valid configuration, follow instructions for your cloud provider: - -- [AWS](#aws---using-auto-discovery-of-tagged-instance-groups) -- [GCE](#gce) -- [Azure](#azure) -- [OpenStack Magnum](#openstack-magnum) -- [Cluster API](#cluster-api) -- [Exoscale](#exoscale) -- [Hetzner Cloud](#hetzner-cloud) -- [Civo](#civo) - -### Templating the autoDiscovery.clusterName - -The cluster name can be templated in the `autoDiscovery.clusterName` variable. This is useful when the cluster name is dynamically generated based on other values coming from external systems like Argo CD or Flux. This also allows you to use global Helm values to set the cluster name, e.g., `autoDiscovery.clusterName=\{\{ .Values.global.clusterName }}`, so that you don't need to set it in more than 1 location in the values file. - -### AWS - Using auto-discovery of tagged instance groups - -Auto-discovery finds ASGs tags as below and automatically manages them based on the min and max size specified in the ASG. `cloudProvider=aws` only. - -- Tag the ASGs with keys to match `.Values.autoDiscovery.tags`, by default: `k8s.io/cluster-autoscaler/enabled` and `k8s.io/cluster-autoscaler/` -- Verify the [IAM Permissions](#aws---iam) -- Set `autoDiscovery.clusterName=` -- Set `awsRegion=` -- Set (option) `awsAccessKeyID=` and `awsSecretAccessKey=` if you want to [use AWS credentials directly instead of an instance role](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials) - -```console -$ helm install my-release autoscaler/cluster-autoscaler \ - --set autoDiscovery.clusterName= \ - --set awsRegion= -``` - -Alternatively with your own AWS credentials - -```console -$ helm install my-release autoscaler/cluster-autoscaler \ - --set autoDiscovery.clusterName= \ - --set awsRegion= \ - --set awsAccessKeyID= \ - --set awsSecretAccessKey= -``` - -#### Specifying groups manually - -Without autodiscovery, specify an array of elements each containing ASG name, min size, max size. The sizes specified here will be applied to the ASG, assuming IAM permissions are correctly configured. - -- Verify the [IAM Permissions](#aws---iam) -- Either provide a yaml file setting `autoscalingGroups` (see values.yaml) or use `--set` e.g.: - -```console -$ helm install my-release autoscaler/cluster-autoscaler \ - --set "autoscalingGroups[0].name=your-asg-name" \ - --set "autoscalingGroups[0].maxSize=10" \ - --set "autoscalingGroups[0].minSize=1" -``` - -#### Auto-discovery - -For auto-discovery of instances to work, they must be tagged with the keys in `.Values.autoDiscovery.tags`, which by default are `k8s.io/cluster-autoscaler/enabled` and `k8s.io/cluster-autoscaler/`. - -The value of the tag does not matter, only the key. - -An example kops spec excerpt: - -```yaml -apiVersion: kops/v1alpha2 -kind: Cluster -metadata: - name: my.cluster.internal -spec: - additionalPolicies: - node: | - [ - {"Effect":"Allow","Action":["autoscaling:DescribeAutoScalingGroups","autoscaling:DescribeAutoScalingInstances","autoscaling:DescribeLaunchConfigurations","autoscaling:DescribeTags","autoscaling:SetDesiredCapacity","autoscaling:TerminateInstanceInAutoScalingGroup"],"Resource":"*"} - ] - ... ---- -apiVersion: kops/v1alpha2 -kind: InstanceGroup -metadata: - labels: - kops.k8s.io/cluster: my.cluster.internal - name: my-instances -spec: - cloudLabels: - k8s.io/cluster-autoscaler/enabled: "" - k8s.io/cluster-autoscaler/my.cluster.internal: "" - image: kops.io/k8s-1.8-debian-jessie-amd64-hvm-ebs-2018-01-14 - machineType: r4.large - maxSize: 4 - minSize: 0 -``` - -In this example you would need to `--set autoDiscovery.clusterName=my.cluster.internal` when installing. - -It is not recommended to try to mix this with setting `autoscalingGroups`. - -See [autoscaler AWS documentation](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#auto-discovery-setup) for a more discussion of the setup. - -### GCE - -The following parameters are required: - -- `autoDiscovery.clusterName=any-name` -- `cloud-provider=gce` -- `autoscalingGroupsnamePrefix[0].name=your-ig-prefix,autoscalingGroupsnamePrefix[0].maxSize=10,autoscalingGroupsnamePrefix[0].minSize=1` - -To use Managed Instance Group (MIG) auto-discovery, provide a YAML file setting `autoscalingGroupsnamePrefix` (see values.yaml) or use `--set` when installing the Chart - e.g. - -```console -$ helm install my-release autoscaler/cluster-autoscaler \ - --set "autoscalingGroupsnamePrefix[0].name=your-ig-prefix,autoscalingGroupsnamePrefix[0].maxSize=10,autoscalingGroupsnamePrefi[0].minSize=1" \ - --set autoDiscovery.clusterName= \ - --set cloudProvider=gce -``` - -Note that `your-ig-prefix` should be a _prefix_ matching one or more MIGs, and _not_ the full name of the MIG. For example, to match multiple instance groups - `k8s-node-group-a-standard`, `k8s-node-group-b-gpu`, you would use a prefix of `k8s-node-group-`. - -In the event you want to explicitly specify MIGs instead of using auto-discovery, set members of the `autoscalingGroups` array directly - e.g. - -``` -# where 'n' is the index, starting at 0 ---set autoscalingGroups[n].name=https://content.googleapis.com/compute/v1/projects/$PROJECTID/zones/$ZONENAME/instanceGroupManagers/$FULL-MIG-NAME,autoscalingGroups[n].maxSize=$MAXSIZE,autoscalingGroups[n].minSize=$MINSIZE -``` - -### Azure - -The following parameters are required: - -- `cloudProvider=azure` -- `autoscalingGroups[0].name=your-vmss,autoscalingGroups[0].maxSize=10,autoscalingGroups[0].minSize=1` -- `azureClientID: "your-service-principal-app-id"` -- `azureClientSecret: "your-service-principal-client-secret"` -- `azureSubscriptionID: "your-azure-subscription-id"` -- `azureTenantID: "your-azure-tenant-id"` -- `azureResourceGroup: "your-aks-cluster-resource-group-name"` -- `azureVMType: "vmss"` - -### OpenStack Magnum - -`cloudProvider: magnum` must be set, and then one of - -- `magnumClusterName=` and `autoscalingGroups` with the names of node groups and min/max node counts -- or `autoDiscovery.clusterName=` with one or more `autoDiscovery.roles`. - -Additionally, `cloudConfigPath: "/etc/kubernetes/cloud-config"` must be set as this should be the location of the cloud-config file on the host. - -Example values files can be found [here](../../cluster-autoscaler/cloudprovider/magnum/examples). - -Install the chart with - -```console -$ helm install my-release autoscaler/cluster-autoscaler -f myvalues.yaml -``` - -### Cluster-API - -`cloudProvider: clusterapi` must be set, and then one or more of - -- `autoDiscovery.clusterName` -- or `autoDiscovery.namespace` -- or `autoDiscovery.labels` - -See [here](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/clusterapi/README.md#configuring-node-group-auto-discovery) for more details. - -Additional config parameters available, see the `values.yaml` for more details - -- `clusterAPIMode` -- `clusterAPIKubeconfigSecret` -- `clusterAPIWorkloadKubeconfigPath` -- `clusterAPICloudConfigPath` - -### Exoscale - -Create a `values.yaml` file with the following content: -```yaml -cloudProvider: exoscale -autoDiscovery: - clusterName: cluster.local # this value is not used, but must be set -``` - -Optionally, you may specify the minimum and maximum size of a particular nodepool by adding the following to the `values.yaml` file: -```yaml -autoscalingGroups: - - name: your-nodepool-name - maxSize: 10 - minSize: 1 -``` - -Create an Exoscale API key with appropriate permissions as described in [cluster-autoscaler/cloudprovider/exoscale/README.md](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/exoscale/README.md). -A secret of name `-exoscale-cluster-autoscaler` needs to be created, containing the api key and secret, as well as the zone. - -```console -$ kubectl create secret generic my-release-exoscale-cluster-autoscaler \ - --from-literal=api-key="EXOxxxxxxxxxxxxxxxxxxxxxxxx" \ - --from-literal=api-secret="xxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" --from-literal=api-zone="ch-gva-2" -``` - -After creating the secret, the chart may be installed: - -```console -$ helm install my-release autoscaler/cluster-autoscaler -f values.yaml -``` - -Read [cluster-autoscaler/cloudprovider/exoscale/README.md](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/exoscale/README.md) for further information on the setup without helm. - -### Hetzner Cloud - -The following parameters are required: - -- `cloudProvider=hetzner` -- `extraEnv.HCLOUD_TOKEN=...` -- `autoscalingGroups=...` - -Each autoscaling group requires an additional `instanceType` and `region` key to be set. - -Read [cluster-autoscaler/cloudprovider/hetzner/README.md](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/hetzner/README.md) for further information on the setup without helm. - -### Civo - -The following parameters are required: - -- `cloudProvider=civo` -- `autoscalingGroups=...` - -When installing the helm chart to the namespace `kube-system`, you can set `secretKeyRefNameOverride` to `civo-api-access`. -Otherwise specify the following parameters: - -- `civoApiUrl=https://api.civo.com` -- `civoApiKey=...` -- `civoClusterID=...` -- `civoRegion=...` - -Read [cluster-autoscaler/cloudprovider/civo/README.md](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/civo/README.md) for further information on the setup without helm. - -## Uninstalling the Chart - -To uninstall `my-release`: - -```console -$ helm uninstall my-release -``` - -The command removes all the Kubernetes components associated with the chart and deletes the release. - -> **Tip**: List all releases using `helm list` or start clean with `helm uninstall my-release` - -## Additional Configuration - -### AWS - IAM - -The worker running the cluster autoscaler will need access to certain resources and actions depending on the version you run and your configuration of it. - -For the up-to-date IAM permissions required, please see the [cluster autoscaler's AWS Cloudprovider Readme](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#iam-policy) and switch to the tag of the cluster autoscaler image you are using. - -### AWS - IAM Roles for Service Accounts (IRSA) - -For Kubernetes clusters that use Amazon EKS, the service account can be configured with an IAM role using [IAM Roles for Service Accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) to avoid needing to grant access to the worker nodes for AWS resources. - -In order to accomplish this, you will first need to create a new IAM role with the above mentions policies. Take care in [configuring the trust relationship](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-technical-overview.html#iam-role-configuration) to restrict access just to the service account used by cluster autoscaler. - -Once you have the IAM role configured, you would then need to `--set rbac.serviceAccount.annotations."eks\.amazonaws\.com/role-arn"=arn:aws:iam::123456789012:role/MyRoleName` when installing. - -### Azure - Using azure workload identity - -You can use the project [Azure workload identity](https://github.com/Azure/azure-workload-identity), to automatically configure the correct setup for your pods to used federated identity with Azure. - -You can also set the correct settings yourself instead of relying on this project. - -For example the following configuration will configure the Autoscaler to use your federated identity: - -```yaml -azureUseWorkloadIdentityExtension: true -extraEnv: - AZURE_CLIENT_ID: USER ASSIGNED IDENTITY CLIENT ID - AZURE_TENANT_ID: USER ASSIGNED IDENTITY TENANT ID - AZURE_FEDERATED_TOKEN_FILE: /var/run/secrets/tokens/azure-identity-token - AZURE_AUTHORITY_HOST: https://login.microsoftonline.com/ -extraVolumes: -- name: azure-identity-token - projected: - defaultMode: 420 - sources: - - serviceAccountToken: - audience: api://AzureADTokenExchange - expirationSeconds: 3600 - path: azure-identity-token -extraVolumeMounts: -- mountPath: /var/run/secrets/tokens - name: azure-identity-token - readOnly: true -``` - -### Custom arguments - -You can use the `customArgs` value to give any argument to cluster autoscaler command. - -Typical use case is to give an environment variable as an argument which will be interpolated at execution time. - -This is helpful when you need to inject values from configmap or secret. - -## Troubleshooting - -The chart will succeed even if the container arguments are incorrect. A few minutes after starting `kubectl logs -l "app=aws-cluster-autoscaler" --tail=50` should loop through something like - -``` -polling_autoscaler.go:111] Poll finished -static_autoscaler.go:97] Starting main loop -utils.go:435] No pod using affinity / antiaffinity found in cluster, disabling affinity predicate for this loop -static_autoscaler.go:230] Filtering out schedulables -``` - -If not, find a pod that the deployment created and `describe` it, paying close attention to the arguments under `Command`. e.g.: - -``` -Containers: - cluster-autoscaler: - Command: - ./cluster-autoscaler - --cloud-provider=aws -# if specifying ASGs manually - --nodes=1:10:your-scaling-group-name -# if using autodiscovery - --node-group-auto-discovery=asg:tag=k8s.io/cluster-autoscaler/enabled,k8s.io/cluster-autoscaler/ - --v=4 -``` - -### PodSecurityPolicy - -Though enough for the majority of installations, the default PodSecurityPolicy _could_ be too restrictive depending on the specifics of your release. Please make sure to check that the template fits with any customizations made or disable it by setting `rbac.pspEnabled` to `false`. - -### VerticalPodAutoscaler - -The CA Helm Chart can install a [`VerticalPodAutoscaler`](https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/README.md) object from Chart version `9.27.0` -onwards for the Cluster Autoscaler Deployment to scale the CA as appropriate, but for that, we -need to install the VPA to the cluster separately. A VPA can help minimize wasted resources -when usage spikes periodically or remediate containers that are being OOMKilled. - -The following example snippet can be used to install VPA that allows scaling down from the default recommendations of the deployment template: - -```yaml -vpa: - enabled: true - containerPolicy: - minAllowed: - cpu: 20m - memory: 50Mi -``` - -{{ template "chart.valuesSection" . }} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/NOTES.txt b/charts/devtron-utilities/charts/cluster-autoscaler/templates/NOTES.txt deleted file mode 100644 index 1a87a3d10..000000000 --- a/charts/devtron-utilities/charts/cluster-autoscaler/templates/NOTES.txt +++ /dev/null @@ -1,18 +0,0 @@ -{{- if or ( or .Values.autoDiscovery.clusterName .Values.autoDiscovery.namespace .Values.autoDiscovery.labels ) .Values.autoscalingGroups }} - -To verify that cluster-autoscaler has started, run: - - kubectl --namespace={{ .Release.Namespace }} get pods -l "app.kubernetes.io/name={{ template "cluster-autoscaler.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" - -{{- else -}} - -############################################################################## -#### ERROR: You must specify values for either #### -#### autoDiscovery or autoscalingGroups[] #### -############################################################################## - -The deployment and pod will not be created and the installation is not functional -See README: - open https://github.com/kubernetes/autoscaler/tree/master/charts/cluster-autoscaler - -{{- end -}} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/_helpers.tpl b/charts/devtron-utilities/charts/cluster-autoscaler/templates/_helpers.tpl deleted file mode 100644 index c7e80f4d8..000000000 --- a/charts/devtron-utilities/charts/cluster-autoscaler/templates/_helpers.tpl +++ /dev/null @@ -1,160 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "cluster-autoscaler.name" -}} -{{- default (printf "%s-%s" .Values.cloudProvider .Chart.Name) .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -*/}} -{{- define "cluster-autoscaler.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default (printf "%s-%s" .Values.cloudProvider .Chart.Name) .Values.nameOverride -}} -{{- if ne $name .Release.Name -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s" $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "cluster-autoscaler.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Return instance and name labels. -*/}} -{{- define "cluster-autoscaler.instance-name" -}} -app.kubernetes.io/instance: {{ .Release.Name | quote }} -app.kubernetes.io/name: {{ include "cluster-autoscaler.name" . | quote }} -{{- end -}} - - -{{/* -Return labels, including instance and name. -*/}} -{{- define "cluster-autoscaler.labels" -}} -{{ include "cluster-autoscaler.instance-name" . }} -app.kubernetes.io/managed-by: {{ .Release.Service | quote }} -helm.sh/chart: {{ include "cluster-autoscaler.chart" . | quote }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels }} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for deployment. -*/}} -{{- define "deployment.apiVersion" -}} -{{- $kubeTargetVersion := default .Capabilities.KubeVersion.GitVersion .Values.kubeTargetVersionOverride }} -{{- if semverCompare "<1.9-0" $kubeTargetVersion -}} -{{- print "apps/v1beta2" -}} -{{- else -}} -{{- print "apps/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for podsecuritypolicy. -*/}} -{{- define "podsecuritypolicy.apiVersion" -}} -{{- $kubeTargetVersion := default .Capabilities.KubeVersion.GitVersion .Values.kubeTargetVersionOverride }} -{{- if semverCompare "<1.10-0" $kubeTargetVersion -}} -{{- print "extensions/v1beta1" -}} -{{- else -}} -{{- print "policy/v1beta1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for podDisruptionBudget. -*/}} -{{- define "podDisruptionBudget.apiVersion" -}} -{{- $kubeTargetVersion := default .Capabilities.KubeVersion.GitVersion .Values.kubeTargetVersionOverride }} -{{- if semverCompare "<1.21-0" $kubeTargetVersion -}} -{{- print "policy/v1beta1" -}} -{{- else -}} -{{- print "policy/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the service account name used by the pod. -*/}} -{{- define "cluster-autoscaler.serviceAccountName" -}} -{{- if .Values.rbac.serviceAccount.create -}} - {{ default (include "cluster-autoscaler.fullname" .) .Values.rbac.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.rbac.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Return true if the priority expander is enabled -*/}} -{{- define "cluster-autoscaler.priorityExpanderEnabled" -}} -{{- $expanders := splitList "," (default "" .Values.extraArgs.expander) -}} -{{- if has "priority" $expanders -}} -{{- true -}} -{{- end -}} -{{- end -}} - -{{/* -autoDiscovery.clusterName for clusterapi. -*/}} -{{- define "cluster-autoscaler.capiAutodiscovery.clusterName" -}} -{{- print "clusterName=" -}}{{ tpl (.Values.autoDiscovery.clusterName) . }} -{{- end -}} - -{{/* -autoDiscovery.namespace for clusterapi. -*/}} -{{- define "cluster-autoscaler.capiAutodiscovery.namespace" -}} -{{- print "namespace=" }}{{ .Values.autoDiscovery.namespace -}} -{{- end -}} - -{{/* -autoDiscovery.labels for clusterapi. -*/}} -{{- define "cluster-autoscaler.capiAutodiscovery.labels" -}} -{{- range $i, $el := .Values.autoDiscovery.labels -}} -{{- if $i -}}{{- print "," -}}{{- end -}} -{{- range $key, $val := $el -}} -{{- $key -}}{{- print "=" -}}{{- $val -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Return the autodiscoveryparameters for clusterapi. -*/}} -{{- define "cluster-autoscaler.capiAutodiscoveryConfig" -}} -{{- if .Values.autoDiscovery.clusterName -}} -{{ include "cluster-autoscaler.capiAutodiscovery.clusterName" . }} - {{- if .Values.autoDiscovery.namespace }} - {{- print "," -}} - {{ include "cluster-autoscaler.capiAutodiscovery.namespace" . }} - {{- end -}} - {{- if .Values.autoDiscovery.labels }} - {{- print "," -}} - {{ include "cluster-autoscaler.capiAutodiscovery.labels" . }} - {{- end -}} -{{- else if .Values.autoDiscovery.namespace -}} -{{ include "cluster-autoscaler.capiAutodiscovery.namespace" . }} - {{- if .Values.autoDiscovery.labels }} - {{- print "," -}} - {{ include "cluster-autoscaler.capiAutodiscovery.labels" . }} - {{- end -}} -{{- else if .Values.autoDiscovery.labels -}} - {{ include "cluster-autoscaler.capiAutodiscovery.labels" . }} -{{- end -}} -{{- end -}} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/clusterrole.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/clusterrole.yaml deleted file mode 100644 index 356b9c08d..000000000 --- a/charts/devtron-utilities/charts/cluster-autoscaler/templates/clusterrole.yaml +++ /dev/null @@ -1,175 +0,0 @@ -{{- if and .Values.rbac.create .Values.rbac.clusterScoped -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: -{{ include "cluster-autoscaler.labels" . | indent 4 }} - name: {{ template "cluster-autoscaler.fullname" . }} -rules: - - apiGroups: - - "" - resources: - - events - - endpoints - verbs: - - create - - patch - - apiGroups: - - "" - resources: - - pods/eviction - verbs: - - create - - apiGroups: - - "" - resources: - - pods/status - verbs: - - update - - apiGroups: - - "" - resources: - - endpoints - resourceNames: - - cluster-autoscaler - verbs: - - get - - update - - apiGroups: - - "" - resources: - - nodes - verbs: - - watch - - list - - create - - delete - - get - - update - - apiGroups: - - "" - resources: - - namespaces - - pods - - services - - replicationcontrollers - - persistentvolumeclaims - - persistentvolumes - verbs: - - watch - - list - - get - - apiGroups: - - batch - resources: - - jobs - - cronjobs - verbs: - - watch - - list - - get - - apiGroups: - - batch - - extensions - resources: - - jobs - verbs: - - get - - list - - patch - - watch - - apiGroups: - - extensions - resources: - - replicasets - - daemonsets - verbs: - - watch - - list - - get - - apiGroups: - - policy - resources: - - poddisruptionbudgets - verbs: - - watch - - list - - apiGroups: - - apps - resources: - - daemonsets - - replicasets - - statefulsets - verbs: - - watch - - list - - get - - apiGroups: - - storage.k8s.io - resources: - - storageclasses - - csinodes - - csidrivers - - csistoragecapacities - verbs: - - watch - - list - - get - - apiGroups: - - "" - resources: - - configmaps - verbs: - - list - - watch - - get - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - create - - apiGroups: - - coordination.k8s.io - resourceNames: - - cluster-autoscaler - resources: - - leases - verbs: - - get - - update -{{- if .Values.rbac.pspEnabled }} - - apiGroups: - - extensions - - policy - resources: - - podsecuritypolicies - resourceNames: - - {{ template "cluster-autoscaler.fullname" . }} - verbs: - - use -{{- end -}} -{{- if and ( and ( eq .Values.cloudProvider "clusterapi" ) ( .Values.rbac.clusterScoped ) ( or ( eq .Values.clusterAPIMode "incluster-incluster" ) ( eq .Values.clusterAPIMode "kubeconfig-incluster" ) ))}} - - apiGroups: - - cluster.x-k8s.io - resources: - - machinedeployments - - machinepools - - machines - - machinesets - verbs: - - get - - list - - update - - watch - - apiGroups: - - cluster.x-k8s.io - resources: - - machinedeployments/scale - - machinepools/scale - verbs: - - get - - patch - - update -{{- end }} -{{- end -}} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/clusterrolebinding.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/clusterrolebinding.yaml deleted file mode 100644 index d2384dc62..000000000 --- a/charts/devtron-utilities/charts/cluster-autoscaler/templates/clusterrolebinding.yaml +++ /dev/null @@ -1,16 +0,0 @@ -{{- if and .Values.rbac.create .Values.rbac.clusterScoped -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - labels: -{{ include "cluster-autoscaler.labels" . | indent 4 }} - name: {{ template "cluster-autoscaler.fullname" . }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ template "cluster-autoscaler.fullname" . }} -subjects: - - kind: ServiceAccount - name: {{ template "cluster-autoscaler.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} -{{- end -}} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/configmap.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/configmap.yaml deleted file mode 100644 index 6cd0c4064..000000000 --- a/charts/devtron-utilities/charts/cluster-autoscaler/templates/configmap.yaml +++ /dev/null @@ -1,416 +0,0 @@ -{{- if or (eq .Values.cloudProvider "kwok") }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ .Values.kwokConfigMapName | default "kwok-provider-config" }} - namespace: {{ .Release.Namespace }} -data: - config: |- - # if you see '\n' everywhere, remove all the trailing spaces - apiVersion: v1alpha1 - readNodesFrom: configmap # possible values: [cluster,configmap] - nodegroups: - # to specify how to group nodes into a nodegroup - # e.g., you want to treat nodes with same instance type as a nodegroup - # node1: m5.xlarge - # node2: c5.xlarge - # node3: m5.xlarge - # nodegroup1: [node1,node3] - # nodegroup2: [node2] - fromNodeLabelKey: "kwok-nodegroup" - # you can either specify fromNodeLabelKey OR fromNodeAnnotation - # (both are not allowed) - # fromNodeAnnotation: "eks.amazonaws.com/nodegroup" - nodes: - # gpuConfig: - # # to tell kwok provider what label should be considered as GPU label - # gpuLabelKey: "k8s.amazonaws.com/accelerator" - # availableGPUTypes: - # "nvidia-tesla-k80": {} - # "nvidia-tesla-p100": {} - configmap: - name: kwok-provider-templates - kwok: {} # default: fetch latest release of kwok from github and install it - # # you can also manually specify which kwok release you want to install - # # for example: - # kwok: - # release: v0.3.0 - # # you can also disable installing kwok in CA code (and install your own kwok release) - # kwok: - # install: false (true if not specified) ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: kwok-provider-templates - namespace: {{ .Release.Namespace }} -data: - templates: |- - # if you see '\n' everywhere, remove all the trailing spaces - apiVersion: v1 - items: - - apiVersion: v1 - kind: Node - metadata: - annotations: - kubeadm.alpha.kubernetes.io/cri-socket: unix:///run/containerd/containerd.sock - node.alpha.kubernetes.io/ttl: "0" - volumes.kubernetes.io/controller-managed-attach-detach: "true" - creationTimestamp: "2023-05-31T04:39:16Z" - labels: - beta.kubernetes.io/arch: amd64 - beta.kubernetes.io/os: linux - kubernetes.io/arch: amd64 - kubernetes.io/hostname: kind-control-plane - kwok-nodegroup: control-plane - kubernetes.io/os: linux - node-role.kubernetes.io/control-plane: "" - node.kubernetes.io/exclude-from-external-load-balancers: "" - name: kind-control-plane - resourceVersion: "506" - uid: 86716ec7-3071-4091-b055-77b4361d1dca - spec: - podCIDR: 10.244.0.0/24 - podCIDRs: - - 10.244.0.0/24 - providerID: kind://docker/kind/kind-control-plane - taints: - - effect: NoSchedule - key: node-role.kubernetes.io/control-plane - status: - addresses: - - address: 172.18.0.2 - type: InternalIP - - address: kind-control-plane - type: Hostname - allocatable: - cpu: "12" - ephemeral-storage: 959786032Ki - hugepages-1Gi: "0" - hugepages-2Mi: "0" - memory: 32781516Ki - pods: "110" - capacity: - cpu: "12" - ephemeral-storage: 959786032Ki - hugepages-1Gi: "0" - hugepages-2Mi: "0" - memory: 32781516Ki - pods: "110" - conditions: - - lastHeartbeatTime: "2023-05-31T04:39:58Z" - lastTransitionTime: "2023-05-31T04:39:13Z" - message: kubelet has sufficient memory available - reason: KubeletHasSufficientMemory - status: "False" - type: MemoryPressure - - lastHeartbeatTime: "2023-05-31T04:39:58Z" - lastTransitionTime: "2023-05-31T04:39:13Z" - message: kubelet has no disk pressure - reason: KubeletHasNoDiskPressure - status: "False" - type: DiskPressure - - lastHeartbeatTime: "2023-05-31T04:39:58Z" - lastTransitionTime: "2023-05-31T04:39:13Z" - message: kubelet has sufficient PID available - reason: KubeletHasSufficientPID - status: "False" - type: PIDPressure - - lastHeartbeatTime: "2023-05-31T04:39:58Z" - lastTransitionTime: "2023-05-31T04:39:46Z" - message: kubelet is posting ready status - reason: KubeletReady - status: "True" - type: Ready - daemonEndpoints: - kubeletEndpoint: - Port: 10250 - images: - - names: - - registry.k8s.io/etcd:3.5.6-0 - sizeBytes: 102542580 - - names: - - docker.io/library/import-2023-03-30@sha256:ba097b515c8c40689733c0f19de377e9bf8995964b7d7150c2045f3dfd166657 - - registry.k8s.io/kube-apiserver:v1.26.3 - sizeBytes: 80392681 - - names: - - docker.io/library/import-2023-03-30@sha256:8dbb345de79d1c44f59a7895da702a5f71997ae72aea056609445c397b0c10dc - - registry.k8s.io/kube-controller-manager:v1.26.3 - sizeBytes: 68538487 - - names: - - docker.io/library/import-2023-03-30@sha256:44db4d50a5f9c8efbac0d37ea974d1c0419a5928f90748d3d491a041a00c20b5 - - registry.k8s.io/kube-proxy:v1.26.3 - sizeBytes: 67217404 - - names: - - docker.io/library/import-2023-03-30@sha256:3dd2337f70af979c7362b5e52bbdfcb3a5fd39c78d94d02145150cd2db86ba39 - - registry.k8s.io/kube-scheduler:v1.26.3 - sizeBytes: 57761399 - - names: - - docker.io/kindest/kindnetd:v20230330-48f316cd@sha256:c19d6362a6a928139820761475a38c24c0cf84d507b9ddf414a078cf627497af - - docker.io/kindest/kindnetd@sha256:c19d6362a6a928139820761475a38c24c0cf84d507b9ddf414a078cf627497af - sizeBytes: 27726335 - - names: - - docker.io/kindest/local-path-provisioner:v0.0.23-kind.0@sha256:f2d0a02831ff3a03cf51343226670d5060623b43a4cfc4808bd0875b2c4b9501 - sizeBytes: 18664669 - - names: - - registry.k8s.io/coredns/coredns:v1.9.3 - sizeBytes: 14837849 - - names: - - docker.io/kindest/local-path-helper:v20230330-48f316cd@sha256:135203f2441f916fb13dad1561d27f60a6f11f50ec288b01a7d2ee9947c36270 - sizeBytes: 3052037 - - names: - - registry.k8s.io/pause:3.7 - sizeBytes: 311278 - nodeInfo: - architecture: amd64 - bootID: 2d71b318-5d07-4de2-9e61-2da28cf5bbf0 - containerRuntimeVersion: containerd://1.6.19-46-g941215f49 - kernelVersion: 5.15.0-72-generic - kubeProxyVersion: v1.26.3 - kubeletVersion: v1.26.3 - machineID: 96f8c8b8c8ae4600a3654341f207586e - operatingSystem: linux - osImage: Ubuntu 22.04.2 LTS - systemUUID: 111aa932-7f99-4bef-aaf7-36aa7fb9b012 - - apiVersion: v1 - kind: Node - metadata: - annotations: - kubeadm.alpha.kubernetes.io/cri-socket: unix:///run/containerd/containerd.sock - node.alpha.kubernetes.io/ttl: "0" - volumes.kubernetes.io/controller-managed-attach-detach: "true" - creationTimestamp: "2023-05-31T04:39:57Z" - labels: - beta.kubernetes.io/arch: amd64 - beta.kubernetes.io/os: linux - kubernetes.io/arch: amd64 - kubernetes.io/hostname: kind-worker - kwok-nodegroup: kind-worker - kubernetes.io/os: linux - name: kind-worker - resourceVersion: "577" - uid: 2ac0eb71-e5cf-4708-bbbf-476e8f19842b - spec: - podCIDR: 10.244.2.0/24 - podCIDRs: - - 10.244.2.0/24 - providerID: kind://docker/kind/kind-worker - status: - addresses: - - address: 172.18.0.3 - type: InternalIP - - address: kind-worker - type: Hostname - allocatable: - cpu: "12" - ephemeral-storage: 959786032Ki - hugepages-1Gi: "0" - hugepages-2Mi: "0" - memory: 32781516Ki - pods: "110" - capacity: - cpu: "12" - ephemeral-storage: 959786032Ki - hugepages-1Gi: "0" - hugepages-2Mi: "0" - memory: 32781516Ki - pods: "110" - conditions: - - lastHeartbeatTime: "2023-05-31T04:40:17Z" - lastTransitionTime: "2023-05-31T04:39:57Z" - message: kubelet has sufficient memory available - reason: KubeletHasSufficientMemory - status: "False" - type: MemoryPressure - - lastHeartbeatTime: "2023-05-31T04:40:17Z" - lastTransitionTime: "2023-05-31T04:39:57Z" - message: kubelet has no disk pressure - reason: KubeletHasNoDiskPressure - status: "False" - type: DiskPressure - - lastHeartbeatTime: "2023-05-31T04:40:17Z" - lastTransitionTime: "2023-05-31T04:39:57Z" - message: kubelet has sufficient PID available - reason: KubeletHasSufficientPID - status: "False" - type: PIDPressure - - lastHeartbeatTime: "2023-05-31T04:40:17Z" - lastTransitionTime: "2023-05-31T04:40:05Z" - message: kubelet is posting ready status - reason: KubeletReady - status: "True" - type: Ready - daemonEndpoints: - kubeletEndpoint: - Port: 10250 - images: - - names: - - registry.k8s.io/etcd:3.5.6-0 - sizeBytes: 102542580 - - names: - - docker.io/library/import-2023-03-30@sha256:ba097b515c8c40689733c0f19de377e9bf8995964b7d7150c2045f3dfd166657 - - registry.k8s.io/kube-apiserver:v1.26.3 - sizeBytes: 80392681 - - names: - - docker.io/library/import-2023-03-30@sha256:8dbb345de79d1c44f59a7895da702a5f71997ae72aea056609445c397b0c10dc - - registry.k8s.io/kube-controller-manager:v1.26.3 - sizeBytes: 68538487 - - names: - - docker.io/library/import-2023-03-30@sha256:44db4d50a5f9c8efbac0d37ea974d1c0419a5928f90748d3d491a041a00c20b5 - - registry.k8s.io/kube-proxy:v1.26.3 - sizeBytes: 67217404 - - names: - - docker.io/library/import-2023-03-30@sha256:3dd2337f70af979c7362b5e52bbdfcb3a5fd39c78d94d02145150cd2db86ba39 - - registry.k8s.io/kube-scheduler:v1.26.3 - sizeBytes: 57761399 - - names: - - docker.io/kindest/kindnetd:v20230330-48f316cd@sha256:c19d6362a6a928139820761475a38c24c0cf84d507b9ddf414a078cf627497af - - docker.io/kindest/kindnetd@sha256:c19d6362a6a928139820761475a38c24c0cf84d507b9ddf414a078cf627497af - sizeBytes: 27726335 - - names: - - docker.io/kindest/local-path-provisioner:v0.0.23-kind.0@sha256:f2d0a02831ff3a03cf51343226670d5060623b43a4cfc4808bd0875b2c4b9501 - sizeBytes: 18664669 - - names: - - registry.k8s.io/coredns/coredns:v1.9.3 - sizeBytes: 14837849 - - names: - - docker.io/kindest/local-path-helper:v20230330-48f316cd@sha256:135203f2441f916fb13dad1561d27f60a6f11f50ec288b01a7d2ee9947c36270 - sizeBytes: 3052037 - - names: - - registry.k8s.io/pause:3.7 - sizeBytes: 311278 - nodeInfo: - architecture: amd64 - bootID: 2d71b318-5d07-4de2-9e61-2da28cf5bbf0 - containerRuntimeVersion: containerd://1.6.19-46-g941215f49 - kernelVersion: 5.15.0-72-generic - kubeProxyVersion: v1.26.3 - kubeletVersion: v1.26.3 - machineID: a98a13ff474d476294935341f1ba9816 - operatingSystem: linux - osImage: Ubuntu 22.04.2 LTS - systemUUID: 5f3c1af8-a385-4776-85e4-73d7f4252b44 - - apiVersion: v1 - kind: Node - metadata: - annotations: - kubeadm.alpha.kubernetes.io/cri-socket: unix:///run/containerd/containerd.sock - node.alpha.kubernetes.io/ttl: "0" - volumes.kubernetes.io/controller-managed-attach-detach: "true" - creationTimestamp: "2023-05-31T04:39:57Z" - labels: - beta.kubernetes.io/arch: amd64 - beta.kubernetes.io/os: linux - kubernetes.io/arch: amd64 - kubernetes.io/hostname: kind-worker2 - kwok-nodegroup: kind-worker2 - kubernetes.io/os: linux - name: kind-worker2 - resourceVersion: "578" - uid: edc7df38-feb2-4089-9955-780562bdd21e - spec: - podCIDR: 10.244.1.0/24 - podCIDRs: - - 10.244.1.0/24 - providerID: kind://docker/kind/kind-worker2 - status: - addresses: - - address: 172.18.0.4 - type: InternalIP - - address: kind-worker2 - type: Hostname - allocatable: - cpu: "12" - ephemeral-storage: 959786032Ki - hugepages-1Gi: "0" - hugepages-2Mi: "0" - memory: 32781516Ki - pods: "110" - capacity: - cpu: "12" - ephemeral-storage: 959786032Ki - hugepages-1Gi: "0" - hugepages-2Mi: "0" - memory: 32781516Ki - pods: "110" - conditions: - - lastHeartbeatTime: "2023-05-31T04:40:17Z" - lastTransitionTime: "2023-05-31T04:39:57Z" - message: kubelet has sufficient memory available - reason: KubeletHasSufficientMemory - status: "False" - type: MemoryPressure - - lastHeartbeatTime: "2023-05-31T04:40:17Z" - lastTransitionTime: "2023-05-31T04:39:57Z" - message: kubelet has no disk pressure - reason: KubeletHasNoDiskPressure - status: "False" - type: DiskPressure - - lastHeartbeatTime: "2023-05-31T04:40:17Z" - lastTransitionTime: "2023-05-31T04:39:57Z" - message: kubelet has sufficient PID available - reason: KubeletHasSufficientPID - status: "False" - type: PIDPressure - - lastHeartbeatTime: "2023-05-31T04:40:17Z" - lastTransitionTime: "2023-05-31T04:40:08Z" - message: kubelet is posting ready status - reason: KubeletReady - status: "True" - type: Ready - daemonEndpoints: - kubeletEndpoint: - Port: 10250 - images: - - names: - - registry.k8s.io/etcd:3.5.6-0 - sizeBytes: 102542580 - - names: - - docker.io/library/import-2023-03-30@sha256:ba097b515c8c40689733c0f19de377e9bf8995964b7d7150c2045f3dfd166657 - - registry.k8s.io/kube-apiserver:v1.26.3 - sizeBytes: 80392681 - - names: - - docker.io/library/import-2023-03-30@sha256:8dbb345de79d1c44f59a7895da702a5f71997ae72aea056609445c397b0c10dc - - registry.k8s.io/kube-controller-manager:v1.26.3 - sizeBytes: 68538487 - - names: - - docker.io/library/import-2023-03-30@sha256:44db4d50a5f9c8efbac0d37ea974d1c0419a5928f90748d3d491a041a00c20b5 - - registry.k8s.io/kube-proxy:v1.26.3 - sizeBytes: 67217404 - - names: - - docker.io/library/import-2023-03-30@sha256:3dd2337f70af979c7362b5e52bbdfcb3a5fd39c78d94d02145150cd2db86ba39 - - registry.k8s.io/kube-scheduler:v1.26.3 - sizeBytes: 57761399 - - names: - - docker.io/kindest/kindnetd:v20230330-48f316cd@sha256:c19d6362a6a928139820761475a38c24c0cf84d507b9ddf414a078cf627497af - - docker.io/kindest/kindnetd@sha256:c19d6362a6a928139820761475a38c24c0cf84d507b9ddf414a078cf627497af - sizeBytes: 27726335 - - names: - - docker.io/kindest/local-path-provisioner:v0.0.23-kind.0@sha256:f2d0a02831ff3a03cf51343226670d5060623b43a4cfc4808bd0875b2c4b9501 - sizeBytes: 18664669 - - names: - - registry.k8s.io/coredns/coredns:v1.9.3 - sizeBytes: 14837849 - - names: - - docker.io/kindest/local-path-helper:v20230330-48f316cd@sha256:135203f2441f916fb13dad1561d27f60a6f11f50ec288b01a7d2ee9947c36270 - sizeBytes: 3052037 - - names: - - registry.k8s.io/pause:3.7 - sizeBytes: 311278 - nodeInfo: - architecture: amd64 - bootID: 2d71b318-5d07-4de2-9e61-2da28cf5bbf0 - containerRuntimeVersion: containerd://1.6.19-46-g941215f49 - kernelVersion: 5.15.0-72-generic - kubeProxyVersion: v1.26.3 - kubeletVersion: v1.26.3 - machineID: fa9f4cd3b3a743bc867b04e44941dcb2 - operatingSystem: linux - osImage: Ubuntu 22.04.2 LTS - systemUUID: f36c0f00-8ba5-4c8c-88bc-2981c8d377b9 - kind: List - metadata: - resourceVersion: "" - - -{{- end }} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/deployment.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/deployment.yaml deleted file mode 100644 index 41297c8c4..000000000 --- a/charts/devtron-utilities/charts/cluster-autoscaler/templates/deployment.yaml +++ /dev/null @@ -1,367 +0,0 @@ -{{- if or ( or .Values.autoDiscovery.clusterName .Values.autoDiscovery.namespace .Values.autoDiscovery.labels ) .Values.autoscalingGroups }} -{{/* one of the above is required */}} -apiVersion: {{ template "deployment.apiVersion" . }} -kind: Deployment -metadata: - annotations: -{{ toYaml .Values.deployment.annotations | indent 4 }} - labels: -{{ include "cluster-autoscaler.labels" . | indent 4 }} - name: {{ template "cluster-autoscaler.fullname" . }} - namespace: {{ .Release.Namespace }} -spec: - replicas: {{ .Values.replicaCount }} - revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} - selector: - matchLabels: -{{ include "cluster-autoscaler.instance-name" . | indent 6 }} - {{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 6 }} - {{- end }} -{{- if .Values.updateStrategy }} - strategy: - {{ toYaml .Values.updateStrategy | nindent 4 | trim }} -{{- end }} - template: - metadata: - {{- if .Values.podAnnotations }} - annotations: -{{ toYaml .Values.podAnnotations | indent 8 }} - {{- end }} - labels: -{{ include "cluster-autoscaler.instance-name" . | indent 8 }} - {{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 8 }} - {{- end }} - {{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} - {{- end }} - spec: - {{- if .Values.priorityClassName }} - priorityClassName: "{{ .Values.priorityClassName }}" - {{- end }} - {{- if .Values.dnsPolicy }} - dnsPolicy: "{{ .Values.dnsPolicy }}" - {{- end }} - {{- if .Values.hostNetwork }} - hostNetwork: {{ .Values.hostNetwork }} - {{- end }} - {{- with .Values.initContainers }} - initContainers: - {{- toYaml . | nindent 8 }} - {{- end }} - containers: - - name: {{ template "cluster-autoscaler.name" . }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" - imagePullPolicy: "{{ .Values.image.pullPolicy }}" - command: - - ./cluster-autoscaler - - --cloud-provider={{ .Values.cloudProvider }} - {{- if and (eq .Values.cloudProvider "clusterapi") (eq .Values.clusterAPIMode "kubeconfig-incluster") }} - - --namespace={{ .Values.clusterAPIConfigMapsNamespace | default "kube-system" }} - {{- else }} - - --namespace={{ .Release.Namespace }} - {{- end }} - {{- if .Values.autoscalingGroups }} - {{- range .Values.autoscalingGroups }} - {{- if eq $.Values.cloudProvider "hetzner" }} - - --nodes={{ .minSize }}:{{ .maxSize }}:{{ .instanceType }}:{{ .region }}:{{ .name }} - {{- else }} - - --nodes={{ .minSize }}:{{ .maxSize }}:{{ .name }} - {{- end }} - {{- end }} - {{- end }} - {{- if eq .Values.cloudProvider "rancher" }} - {{- if .Values.cloudConfigPath }} - - --cloud-config={{ .Values.cloudConfigPath }} - {{- end }} - {{- end }} - {{- if eq .Values.cloudProvider "aws" }} - {{- if .Values.autoDiscovery.clusterName }} - - --node-group-auto-discovery=asg:tag={{ tpl (join "," .Values.autoDiscovery.tags) . }} - {{- end }} - {{- if .Values.cloudConfigPath }} - - --cloud-config={{ .Values.cloudConfigPath }} - {{- end }} - {{- else if eq .Values.cloudProvider "gce" }} - {{- if .Values.autoscalingGroupsnamePrefix }} - {{- range .Values.autoscalingGroupsnamePrefix }} - - --node-group-auto-discovery=mig:namePrefix={{ .name }},min={{ .minSize }},max={{ .maxSize }} - {{- end }} - {{- end }} - {{- if eq .Values.cloudProvider "oci" }} - {{- if .Values.cloudConfigPath }} - - --nodes={{ .minSize }}:{{ .maxSize }}:{{ .name }} - - --balance-similar-node-groups - {{- end }} - {{- end }} - {{- else if eq .Values.cloudProvider "magnum" }} - {{- if .Values.autoDiscovery.clusterName }} - - --cluster-name={{ tpl (.Values.autoDiscovery.clusterName) . }} - - --node-group-auto-discovery=magnum:role={{ tpl (join "," .Values.autoDiscovery.roles) . }} - {{- else }} - - --cluster-name={{ tpl (.Values.magnumClusterName) . }} - {{- end }} - {{- else if eq .Values.cloudProvider "clusterapi" }} - {{- if or .Values.autoDiscovery.clusterName .Values.autoDiscovery.labels .Values.autoDiscovery.namespace }} - - --node-group-auto-discovery=clusterapi:{{ template "cluster-autoscaler.capiAutodiscoveryConfig" . }} - {{- end }} - {{- if eq .Values.clusterAPIMode "incluster-kubeconfig"}} - - --cloud-config={{ .Values.clusterAPICloudConfigPath }} - {{- else if eq .Values.clusterAPIMode "kubeconfig-incluster"}} - - --kubeconfig={{ .Values.clusterAPIWorkloadKubeconfigPath }} - - --clusterapi-cloud-config-authoritative - {{- else if eq .Values.clusterAPIMode "kubeconfig-kubeconfig"}} - - --kubeconfig={{ .Values.clusterAPIWorkloadKubeconfigPath }} - - --cloud-config={{ .Values.clusterAPICloudConfigPath }} - {{- else if eq .Values.clusterAPIMode "single-kubeconfig"}} - - --kubeconfig={{ .Values.clusterAPIWorkloadKubeconfigPath }} - {{- end }} - {{- else if eq .Values.cloudProvider "azure" }} - {{- if .Values.autoDiscovery.clusterName }} - - --node-group-auto-discovery=label:cluster-autoscaler-enabled=true,cluster-autoscaler-name={{ tpl (.Values.autoDiscovery.clusterName) . }} - {{- end }} - {{- end }} - {{- if eq .Values.cloudProvider "magnum" }} - - --cloud-config={{ .Values.cloudConfigPath }} - {{- end }} - {{- range $key, $value := .Values.extraArgs }} - {{- if not (kindIs "invalid" $value) }} - - --{{ $key | mustRegexFind "^[^_]+" }}={{ $value }} - {{- else }} - - --{{ $key | mustRegexFind "^[^_]+" }} - {{- end }} - {{- end }} - {{- range .Values.customArgs }} - - {{ . }} - {{- end }} - env: - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: SERVICE_ACCOUNT - valueFrom: - fieldRef: - fieldPath: spec.serviceAccountName - {{- if and (eq .Values.cloudProvider "aws") (ne .Values.awsRegion "") }} - - name: AWS_REGION - value: "{{ .Values.awsRegion }}" - {{- if .Values.awsAccessKeyID }} - - name: AWS_ACCESS_KEY_ID - valueFrom: - secretKeyRef: - key: AwsAccessKeyId - name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} - {{- end }} - {{- if .Values.awsSecretAccessKey }} - - name: AWS_SECRET_ACCESS_KEY - valueFrom: - secretKeyRef: - key: AwsSecretAccessKey - name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} - {{- end }} - {{- else if eq .Values.cloudProvider "azure" }} - - name: ARM_SUBSCRIPTION_ID - valueFrom: - secretKeyRef: - key: SubscriptionID - name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} - - name: ARM_RESOURCE_GROUP - valueFrom: - secretKeyRef: - key: ResourceGroup - name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} - - name: ARM_VM_TYPE - valueFrom: - secretKeyRef: - key: VMType - name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} - - name: AZURE_ENABLE_FORCE_DELETE - value: "{{ .Values.azureEnableForceDelete }}" - {{- if .Values.azureUseWorkloadIdentityExtension }} - - name: ARM_USE_WORKLOAD_IDENTITY_EXTENSION - value: "true" - {{- else if .Values.azureUseManagedIdentityExtension }} - - name: ARM_USE_MANAGED_IDENTITY_EXTENSION - value: "true" - {{- else }} - - name: ARM_TENANT_ID - valueFrom: - secretKeyRef: - key: TenantID - name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} - - name: ARM_CLIENT_ID - valueFrom: - secretKeyRef: - key: ClientID - name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} - - name: ARM_CLIENT_SECRET - valueFrom: - secretKeyRef: - key: ClientSecret - name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} - {{- end }} - {{- else if eq .Values.cloudProvider "exoscale" }} - - name: EXOSCALE_API_KEY - valueFrom: - secretKeyRef: - key: api-key - name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} - - name: EXOSCALE_API_SECRET - valueFrom: - secretKeyRef: - key: api-secret - name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} - - name: EXOSCALE_ZONE - valueFrom: - secretKeyRef: - key: api-zone - name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} - {{- else if eq .Values.cloudProvider "kwok" }} - - name: KWOK_PROVIDER_CONFIGMAP - value: "{{.Values.kwokConfigMapName | default "kwok-provider-config"}}" - {{- else if eq .Values.cloudProvider "civo" }} - - name: CIVO_API_URL - valueFrom: - secretKeyRef: - key: api-url - name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} - - name: CIVO_API_KEY - valueFrom: - secretKeyRef: - key: api-key - name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} - - name: CIVO_CLUSTER_ID - valueFrom: - secretKeyRef: - key: cluster-id - name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} - - name: CIVO_REGION - valueFrom: - secretKeyRef: - key: region - name: {{ default (include "cluster-autoscaler.fullname" .) .Values.secretKeyRefNameOverride }} - {{- end }} - {{- range $key, $value := .Values.extraEnv }} - - name: {{ $key }} - value: "{{ $value }}" - {{- end }} - {{- range $key, $value := .Values.extraEnvConfigMaps }} - - name: {{ $key }} - valueFrom: - configMapKeyRef: - name: {{ default (include "cluster-autoscaler.fullname" $) $value.name }} - key: {{ required "Must specify key!" $value.key }} - {{- end }} - {{- range $key, $value := .Values.extraEnvSecrets }} - - name: {{ $key }} - valueFrom: - secretKeyRef: - name: {{ default (include "cluster-autoscaler.fullname" $) $value.name }} - key: {{ required "Must specify key!" $value.key }} - {{- end }} - {{- if or .Values.envFromSecret .Values.envFromConfigMap }} - envFrom: - {{- if .Values.envFromSecret }} - - secretRef: - name: {{ .Values.envFromSecret }} - {{- end }} - {{- if .Values.envFromConfigMap }} - - configMapRef: - name: {{ .Values.envFromConfigMap }} - {{- end }} - {{- end }} - livenessProbe: - httpGet: - path: /health-check - port: 8085 - ports: - - containerPort: 8085 - resources: -{{ toYaml .Values.resources | indent 12 }} - {{- if .Values.containerSecurityContext }} - securityContext: - {{ toYaml .Values.containerSecurityContext | nindent 12 | trim }} - {{- end }} - {{- if or (eq .Values.cloudProvider "magnum") .Values.extraVolumeSecrets .Values.extraVolumeMounts .Values.clusterAPIKubeconfigSecret }} - volumeMounts: - {{- if eq .Values.cloudProvider "magnum" }} - - name: cloudconfig - mountPath: {{ .Values.cloudConfigPath }} - readOnly: true - {{- end }} - {{- if and (eq .Values.cloudProvider "magnum") (.Values.magnumCABundlePath) }} - - name: ca-bundle - mountPath: {{ .Values.magnumCABundlePath }} - readOnly: true - {{- end }} - {{- range $key, $value := .Values.extraVolumeSecrets }} - - name: {{ $key }} - mountPath: {{ required "Must specify mountPath!" $value.mountPath }} - readOnly: true - {{- end }} - {{- if .Values.clusterAPIKubeconfigSecret }} - - name: cluster-api-kubeconfig - mountPath: {{ .Values.clusterAPIWorkloadKubeconfigPath | trimSuffix "/value" }} - {{- end }} - {{- if .Values.extraVolumeMounts }} - {{- toYaml .Values.extraVolumeMounts | nindent 12 }} - {{- end }} - {{- end }} - {{- if .Values.affinity }} - affinity: -{{ toYaml .Values.affinity | indent 8 }} - {{- end }} - {{- if .Values.nodeSelector }} - nodeSelector: -{{ toYaml .Values.nodeSelector | indent 8 }} - {{- end }} - serviceAccountName: {{ template "cluster-autoscaler.serviceAccountName" . }} - tolerations: -{{ toYaml .Values.tolerations | indent 8 }} - {{- if .Values.topologySpreadConstraints }} - topologySpreadConstraints: -{{ toYaml .Values.topologySpreadConstraints | indent 8 }} - {{- end }} - {{- if .Values.securityContext }} - securityContext: - {{ toYaml .Values.securityContext | nindent 8 | trim }} - {{- end }} - {{- if or (eq .Values.cloudProvider "magnum") .Values.extraVolumeSecrets .Values.extraVolumes .Values.clusterAPIKubeconfigSecret }} - volumes: - {{- if eq .Values.cloudProvider "magnum" }} - - name: cloudconfig - hostPath: - path: {{ .Values.cloudConfigPath }} - {{- end }} - {{- if and (eq .Values.cloudProvider "magnum") (.Values.magnumCABundlePath) }} - - name: ca-bundle - hostPath: - path: {{ .Values.magnumCABundlePath }} - {{- end }} - {{- range $key, $value := .Values.extraVolumeSecrets }} - - name: {{ $key }} - secret: - secretName: {{ default (include "cluster-autoscaler.fullname" $) $value.name }} - {{- if $value.items }} - items: - {{- toYaml $value.items | nindent 14 }} - {{- end }} - {{- end }} - {{- if .Values.extraVolumes }} - {{- toYaml .Values.extraVolumes | nindent 8 }} - {{- end }} - {{- if .Values.clusterAPIKubeconfigSecret }} - - name: cluster-api-kubeconfig - secret: - secretName: {{ .Values.clusterAPIKubeconfigSecret }} - {{- end }} - {{- end }} - {{- if .Values.image.pullSecrets }} - imagePullSecrets: - {{- range .Values.image.pullSecrets }} - - name: {{ . }} - {{- end }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/extra-manifests.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/extra-manifests.yaml deleted file mode 100644 index a9bb3b6ba..000000000 --- a/charts/devtron-utilities/charts/cluster-autoscaler/templates/extra-manifests.yaml +++ /dev/null @@ -1,4 +0,0 @@ -{{ range .Values.extraObjects }} ---- -{{ tpl (toYaml .) $ }} -{{ end }} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/pdb.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/pdb.yaml deleted file mode 100644 index 8ad782096..000000000 --- a/charts/devtron-utilities/charts/cluster-autoscaler/templates/pdb.yaml +++ /dev/null @@ -1,16 +0,0 @@ -{{- if .Values.podDisruptionBudget -}} -apiVersion: {{ template "podDisruptionBudget.apiVersion" . }} -kind: PodDisruptionBudget -metadata: - labels: -{{ include "cluster-autoscaler.labels" . | indent 4 }} - name: {{ template "cluster-autoscaler.fullname" . }} - namespace: {{ .Release.Namespace }} -spec: - selector: - matchLabels: -{{ include "cluster-autoscaler.instance-name" . | indent 6 }} -{{- if .Values.podDisruptionBudget }} - {{ toYaml .Values.podDisruptionBudget | nindent 2 }} -{{- end }} -{{- end -}} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/podsecuritypolicy.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/podsecuritypolicy.yaml deleted file mode 100644 index e3ce59973..000000000 --- a/charts/devtron-utilities/charts/cluster-autoscaler/templates/podsecuritypolicy.yaml +++ /dev/null @@ -1,42 +0,0 @@ -{{- if .Values.rbac.pspEnabled }} -apiVersion: {{ template "podsecuritypolicy.apiVersion" . }} -kind: PodSecurityPolicy -metadata: - name: {{ template "cluster-autoscaler.fullname" . }} - labels: -{{ include "cluster-autoscaler.labels" . | indent 4 }} -spec: - # Prevents running in privileged mode - privileged: false - # Required to prevent escalations to root. - allowPrivilegeEscalation: false - requiredDropCapabilities: - - ALL - volumes: - - 'configMap' - - 'secret' - - 'hostPath' - - 'emptyDir' - - 'projected' - - 'downwardAPI' - hostNetwork: {{ .Values.hostNetwork }} - hostIPC: false - hostPID: false - runAsUser: - rule: RunAsAny - seLinux: - rule: RunAsAny - supplementalGroups: - rule: 'MustRunAs' - ranges: - # Forbid adding the root group. - - min: 1 - max: 65535 - fsGroup: - rule: 'MustRunAs' - ranges: - # Forbid adding the root group. - - min: 1 - max: 65535 - readOnlyRootFilesystem: false -{{- end }} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/priority-expander-configmap.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/priority-expander-configmap.yaml deleted file mode 100644 index 8259f14ff..000000000 --- a/charts/devtron-utilities/charts/cluster-autoscaler/templates/priority-expander-configmap.yaml +++ /dev/null @@ -1,25 +0,0 @@ -{{- if hasKey .Values.extraArgs "expander" }} -{{- if and (.Values.expanderPriorities) (include "cluster-autoscaler.priorityExpanderEnabled" .) -}} -apiVersion: v1 -kind: ConfigMap -metadata: - name: cluster-autoscaler-priority-expander - namespace: {{ .Release.Namespace }} - labels: -{{ include "cluster-autoscaler.labels" . | indent 4 }} - {{- if .Values.priorityConfigMapAnnotations }} - annotations: -{{ toYaml .Values.priorityConfigMapAnnotations | indent 4 }} - {{- end }} -data: - priorities: |- -{{- if kindIs "string" .Values.expanderPriorities }} -{{ .Values.expanderPriorities | indent 4 }} -{{- else }} -{{- range $k,$v := .Values.expanderPriorities }} - {{ $k | int }}: - {{- toYaml $v | nindent 6 }} -{{- end -}} -{{- end -}} -{{- end -}} -{{- end -}} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/prometheusrule.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/prometheusrule.yaml deleted file mode 100644 index 097c969ef..000000000 --- a/charts/devtron-utilities/charts/cluster-autoscaler/templates/prometheusrule.yaml +++ /dev/null @@ -1,15 +0,0 @@ -{{- if .Values.prometheusRule.enabled }} -apiVersion: monitoring.coreos.com/v1 -kind: PrometheusRule -metadata: - name: {{ include "cluster-autoscaler.fullname" . }} - {{- if .Values.prometheusRule.namespace }} - namespace: {{ .Values.prometheusRule.namespace }} - {{- end }} - labels: {{- toYaml .Values.prometheusRule.additionalLabels | nindent 4 }} -spec: - groups: - - name: {{ include "cluster-autoscaler.fullname" . }} - interval: {{ .Values.prometheusRule.interval }} - rules: {{- tpl (toYaml .Values.prometheusRule.rules) . | nindent 8 }} -{{- end }} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/role.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/role.yaml deleted file mode 100644 index 44b1678af..000000000 --- a/charts/devtron-utilities/charts/cluster-autoscaler/templates/role.yaml +++ /dev/null @@ -1,87 +0,0 @@ -{{- if .Values.rbac.create -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - labels: -{{ include "cluster-autoscaler.labels" . | indent 4 }} - name: {{ template "cluster-autoscaler.fullname" . }} - namespace: {{ .Release.Namespace }} -rules: - - apiGroups: - - "" - resources: - - configmaps - verbs: - - create -{{- if (include "cluster-autoscaler.priorityExpanderEnabled" .) }} - - list - - watch -{{- end }} - - apiGroups: - - "" - resources: - - configmaps - resourceNames: - - cluster-autoscaler-status -{{- if (include "cluster-autoscaler.priorityExpanderEnabled" .) }} - - cluster-autoscaler-priority-expander -{{- end }} - verbs: - - delete - - get - - update -{{- if (include "cluster-autoscaler.priorityExpanderEnabled" .) }} - - watch -{{- end }} -{{- if eq (default "" (index .Values.extraArgs "leader-elect-resource-lock")) "configmaps" }} - - apiGroups: - - "" - resources: - - configmaps - resourceNames: - - cluster-autoscaler - verbs: - - get - - update -{{- end }} -{{- if and ( and ( eq .Values.cloudProvider "clusterapi" ) ( not .Values.rbac.clusterScoped ) ( or ( eq .Values.clusterAPIMode "incluster-incluster" ) ( eq .Values.clusterAPIMode "kubeconfig-incluster" ) ))}} - - apiGroups: - - cluster.x-k8s.io - resources: - - machinedeployments - - machinepools - - machines - - machinesets - verbs: - - get - - list - - update - - watch - - apiGroups: - - cluster.x-k8s.io - resources: - - machinedeployments/scale - - machinepools/scale - verbs: - - get - - patch - - update -{{- end }} -{{- if ( not .Values.rbac.clusterScoped ) }} - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - create - - apiGroups: - - coordination.k8s.io - resourceNames: - - cluster-autoscaler - resources: - - leases - verbs: - - get - - update -{{- end }} -{{- end -}} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/rolebinding.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/rolebinding.yaml deleted file mode 100644 index ba5f03755..000000000 --- a/charts/devtron-utilities/charts/cluster-autoscaler/templates/rolebinding.yaml +++ /dev/null @@ -1,17 +0,0 @@ -{{- if .Values.rbac.create -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - labels: -{{ include "cluster-autoscaler.labels" . | indent 4 }} - name: {{ template "cluster-autoscaler.fullname" . }} - namespace: {{ .Release.Namespace }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ template "cluster-autoscaler.fullname" . }} -subjects: - - kind: ServiceAccount - name: {{ template "cluster-autoscaler.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} -{{- end -}} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/secret.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/secret.yaml deleted file mode 100644 index e3b7fff7d..000000000 --- a/charts/devtron-utilities/charts/cluster-autoscaler/templates/secret.yaml +++ /dev/null @@ -1,31 +0,0 @@ -{{- if not .Values.secretKeyRefNameOverride }} -{{- $isAzure := eq .Values.cloudProvider "azure" }} -{{- $isAws := eq .Values.cloudProvider "aws" }} -{{- $awsCredentialsProvided := and .Values.awsAccessKeyID .Values.awsSecretAccessKey }} -{{- $isCivo := eq .Values.cloudProvider "civo" }} - -{{- if or $isAzure (and $isAws $awsCredentialsProvided) $isCivo }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "cluster-autoscaler.fullname" . }} - namespace: {{ .Release.Namespace }} -data: -{{- if $isAzure }} - ClientID: "{{ .Values.azureClientID | b64enc }}" - ClientSecret: "{{ .Values.azureClientSecret | b64enc }}" - ResourceGroup: "{{ .Values.azureResourceGroup | b64enc }}" - SubscriptionID: "{{ .Values.azureSubscriptionID | b64enc }}" - TenantID: "{{ .Values.azureTenantID | b64enc }}" - VMType: "{{ .Values.azureVMType | b64enc }}" -{{- else if $isAws }} - AwsAccessKeyId: "{{ .Values.awsAccessKeyID | b64enc }}" - AwsSecretAccessKey: "{{ .Values.awsSecretAccessKey | b64enc }}" -{{- else if $isCivo }} - api-url: "{{ .Values.civoApiUrl | b64enc }}" - api-key: "{{ .Values.civoApiKey | b64enc }}" - cluster-id: "{{ .Values.civoClusterID | b64enc }}" - region: "{{ .Values.civoRegion | b64enc }}" -{{- end }} -{{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/service.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/service.yaml deleted file mode 100644 index 255aea44b..000000000 --- a/charts/devtron-utilities/charts/cluster-autoscaler/templates/service.yaml +++ /dev/null @@ -1,39 +0,0 @@ -{{- if .Values.service.create }} -apiVersion: v1 -kind: Service -metadata: -{{- if .Values.service.annotations }} - annotations: -{{ toYaml .Values.service.annotations | indent 4 }} -{{- end }} - labels: -{{ include "cluster-autoscaler.labels" . | indent 4 }} -{{- if .Values.service.labels }} -{{ toYaml .Values.service.labels | indent 4 }} -{{- end }} - name: {{ template "cluster-autoscaler.fullname" . }} - namespace: {{ .Release.Namespace }} -spec: -{{- if .Values.service.clusterIP }} - clusterIP: "{{ .Values.service.clusterIP }}" -{{- end }} -{{- if .Values.service.externalIPs }} - externalIPs: -{{ toYaml .Values.service.externalIPs | indent 4 }} -{{- end }} -{{- if .Values.service.loadBalancerIP }} - loadBalancerIP: "{{ .Values.service.loadBalancerIP }}" -{{- end }} -{{- if .Values.service.loadBalancerSourceRanges }} - loadBalancerSourceRanges: -{{ toYaml .Values.service.loadBalancerSourceRanges | indent 4 }} -{{- end }} - ports: - - port: {{ .Values.service.servicePort }} - protocol: TCP - targetPort: 8085 - name: {{ .Values.service.portName }} - selector: -{{ include "cluster-autoscaler.instance-name" . | indent 4 }} - type: "{{ .Values.service.type }}" -{{- end }} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/serviceaccount.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/serviceaccount.yaml deleted file mode 100644 index 29c2580c2..000000000 --- a/charts/devtron-utilities/charts/cluster-autoscaler/templates/serviceaccount.yaml +++ /dev/null @@ -1,13 +0,0 @@ -{{- if and .Values.rbac.create .Values.rbac.serviceAccount.create }} -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: -{{ include "cluster-autoscaler.labels" . | indent 4 }} - name: {{ template "cluster-autoscaler.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} -{{- if .Values.rbac.serviceAccount.annotations }} - annotations: {{ toYaml .Values.rbac.serviceAccount.annotations | nindent 4 }} -{{- end }} -automountServiceAccountToken: {{ .Values.rbac.serviceAccount.automountServiceAccountToken }} -{{- end }} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/servicemonitor.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/servicemonitor.yaml deleted file mode 100644 index 9ce83a2ef..000000000 --- a/charts/devtron-utilities/charts/cluster-autoscaler/templates/servicemonitor.yaml +++ /dev/null @@ -1,36 +0,0 @@ -{{ if .Values.serviceMonitor.enabled }} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ include "cluster-autoscaler.fullname" . }} - {{- if .Values.serviceMonitor.namespace }} - namespace: {{ .Values.serviceMonitor.namespace }} - {{- end }} - {{- if .Values.serviceMonitor.annotations }} - annotations: -{{ toYaml .Values.serviceMonitor.annotations | indent 4 }} - {{- end }} - labels: - {{- range $key, $value := .Values.serviceMonitor.selector }} - {{ $key }}: {{ $value | quote }} - {{- end }} -spec: - selector: - matchLabels: -{{ include "cluster-autoscaler.instance-name" . | indent 6 }} - endpoints: - - port: {{ .Values.service.portName }} - interval: {{ .Values.serviceMonitor.interval }} - path: {{ .Values.serviceMonitor.path }} - {{- if .Values.serviceMonitor.relabelings }} - relabelings: -{{ tpl (toYaml .Values.serviceMonitor.relabelings | indent 6) . }} - {{- end }} - {{- if .Values.serviceMonitor.metricRelabelings }} - metricRelabelings: -{{ tpl (toYaml .Values.serviceMonitor.metricRelabelings | indent 6) . }} - {{- end }} - namespaceSelector: - matchNames: - - {{.Release.Namespace}} -{{ end }} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/templates/vpa.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/templates/vpa.yaml deleted file mode 100644 index b889beac9..000000000 --- a/charts/devtron-utilities/charts/cluster-autoscaler/templates/vpa.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if .Values.vpa.enabled -}} -apiVersion: autoscaling.k8s.io/v1 -kind: VerticalPodAutoscaler -metadata: - labels: -{{ include "cluster-autoscaler.labels" . | indent 4 }} - name: {{ template "cluster-autoscaler.fullname" . }} - namespace: {{ .Release.Namespace }} -spec: - targetRef: - apiVersion: {{ template "deployment.apiVersion" . }} - kind: Deployment - name: {{ template "cluster-autoscaler.fullname" . }} - updatePolicy: - updateMode: {{ .Values.vpa.updateMode | quote }} - resourcePolicy: - containerPolicies: - - containerName: {{ template "cluster-autoscaler.name" . }} - {{- .Values.vpa.containerPolicy | toYaml | nindent 6 }} -{{- end -}} diff --git a/charts/devtron-utilities/charts/cluster-autoscaler/values.yaml b/charts/devtron-utilities/charts/cluster-autoscaler/values.yaml deleted file mode 100644 index 2490a8125..000000000 --- a/charts/devtron-utilities/charts/cluster-autoscaler/values.yaml +++ /dev/null @@ -1,467 +0,0 @@ -## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity -# affinity -- Affinity for pod assignment -affinity: {} - -# additionalLabels -- Labels to add to each object of the chart. -additionalLabels: {} - -autoDiscovery: - # cloudProviders `aws`, `gce`, `azure`, `magnum`, `clusterapi` and `oci` are supported by auto-discovery at this time - # AWS: Set tags as described in https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#auto-discovery-setup - - # autoDiscovery.clusterName -- Enable autodiscovery for `cloudProvider=aws`, for groups matching `autoDiscovery.tags`. - # autoDiscovery.clusterName -- Enable autodiscovery for `cloudProvider=azure`, using tags defined in https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/azure/README.md#auto-discovery-setup. - # Enable autodiscovery for `cloudProvider=clusterapi`, for groups matching `autoDiscovery.labels`. - # Enable autodiscovery for `cloudProvider=gce`, but no MIG tagging required. - # Enable autodiscovery for `cloudProvider=magnum`, for groups matching `autoDiscovery.roles`. - clusterName: # cluster.local - - # autoDiscovery.namespace -- Enable autodiscovery via cluster namespace for for `cloudProvider=clusterapi` - namespace: # default - - # autoDiscovery.tags -- ASG tags to match, run through `tpl`. - tags: - - k8s.io/cluster-autoscaler/enabled - - k8s.io/cluster-autoscaler/{{ .Values.autoDiscovery.clusterName }} - # - kubernetes.io/cluster/{{ .Values.autoDiscovery.clusterName }} - - # autoDiscovery.roles -- Magnum node group roles to match. - roles: - - worker - - # autoDiscovery.labels -- Cluster-API labels to match https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/clusterapi/README.md#configuring-node-group-auto-discovery - labels: [] - # - color: green - # - shape: circle -# autoscalingGroups -- For AWS, Azure AKS, Exoscale or Magnum. At least one element is required if not using `autoDiscovery`. For example: -# 
-# - name: asg1

-#   maxSize: 2

-#   minSize: 1
-#
-# For Hetzner Cloud, the `instanceType` and `region` keys are also required. -# 
-# - name: mypool

-#   maxSize: 2

-#   minSize: 1

-#   instanceType: CPX21

-#   region: FSN1
-#
-autoscalingGroups: [] -# - name: asg1 -# maxSize: 2 -# minSize: 1 -# - name: asg2 -# maxSize: 2 -# minSize: 1 - -# autoscalingGroupsnamePrefix -- For GCE. At least one element is required if not using `autoDiscovery`. For example: -# 
-# - name: ig01

-#   maxSize: 10

-#   minSize: 0
-#
-autoscalingGroupsnamePrefix: [] -# - name: ig01 -# maxSize: 10 -# minSize: 0 -# - name: ig02 -# maxSize: 10 -# minSize: 0 - -# awsAccessKeyID -- AWS access key ID ([if AWS user keys used](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials)) -awsAccessKeyID: "" - -# awsRegion -- AWS region (required if `cloudProvider=aws`) -awsRegion: us-east-1 - -# awsSecretAccessKey -- AWS access secret key ([if AWS user keys used](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials)) -awsSecretAccessKey: "" - -# azureClientID -- Service Principal ClientID with contributor permission to Cluster and Node ResourceGroup. -# Required if `cloudProvider=azure` -azureClientID: "" - -# azureClientSecret -- Service Principal ClientSecret with contributor permission to Cluster and Node ResourceGroup. -# Required if `cloudProvider=azure` -azureClientSecret: "" - -# azureResourceGroup -- Azure resource group that the cluster is located. -# Required if `cloudProvider=azure` -azureResourceGroup: "" - -# azureSubscriptionID -- Azure subscription where the resources are located. -# Required if `cloudProvider=azure` -azureSubscriptionID: "" - -# azureTenantID -- Azure tenant where the resources are located. -# Required if `cloudProvider=azure` -azureTenantID: "" - -# azureUseManagedIdentityExtension -- Whether to use Azure's managed identity extension for credentials. If using MSI, ensure subscription ID, resource group, and azure AKS cluster name are set. You can only use one authentication method at a time, either azureUseWorkloadIdentityExtension or azureUseManagedIdentityExtension should be set. -azureUseManagedIdentityExtension: false - -# azureUseWorkloadIdentityExtension -- Whether to use Azure's workload identity extension for credentials. See the project here: https://github.com/Azure/azure-workload-identity for more details. You can only use one authentication method at a time, either azureUseWorkloadIdentityExtension or azureUseManagedIdentityExtension should be set. -azureUseWorkloadIdentityExtension: false - -# azureVMType -- Azure VM type. -azureVMType: "vmss" - -# azureEnableForceDelete -- Whether to force delete VMs or VMSS instances when scaling down. -azureEnableForceDelete: false - -# civoApiUrl -- URL for the Civo API. -# Required if `cloudProvider=civo` -civoApiUrl: "https://api.civo.com" - -# civoApiKey -- API key for the Civo API. -# Required if `cloudProvider=civo` -civoApiKey: "" - -# civoClusterID -- Cluster ID for the Civo cluster. -# Required if `cloudProvider=civo` -civoClusterID: "" - -# civoRegion -- Region for the Civo cluster. -# Required if `cloudProvider=civo` -civoRegion: "" - -# cloudConfigPath -- Configuration file for cloud provider. -cloudConfigPath: "" - -# cloudProvider -- The cloud provider where the autoscaler runs. -# Currently only `gce`, `aws`, `azure`, `magnum`, `clusterapi` and `civo` are supported. -# `aws` supported for AWS. `gce` for GCE. `azure` for Azure AKS. -# `magnum` for OpenStack Magnum, `clusterapi` for Cluster API. -# `civo` for Civo Cloud. -cloudProvider: aws - -# clusterAPICloudConfigPath -- Path to kubeconfig for connecting to Cluster API Management Cluster, only used if `clusterAPIMode=kubeconfig-kubeconfig or incluster-kubeconfig` -clusterAPICloudConfigPath: /etc/kubernetes/mgmt-kubeconfig - -# clusterAPIConfigMapsNamespace -- Namespace on the workload cluster to store Leader election and status configmaps -clusterAPIConfigMapsNamespace: "" - -# clusterAPIKubeconfigSecret -- Secret containing kubeconfig for connecting to Cluster API managed workloadcluster -# Required if `cloudProvider=clusterapi` and `clusterAPIMode=kubeconfig-kubeconfig,kubeconfig-incluster or incluster-kubeconfig` -clusterAPIKubeconfigSecret: "" - -# clusterAPIMode -- Cluster API mode, see https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/clusterapi/README.md#connecting-cluster-autoscaler-to-cluster-api-management-and-workload-clusters -# Syntax: workloadClusterMode-ManagementClusterMode -# for `kubeconfig-kubeconfig`, `incluster-kubeconfig` and `single-kubeconfig` you always must mount the external kubeconfig using either `extraVolumeSecrets` or `extraMounts` and `extraVolumes` -# if you dont set `clusterAPIKubeconfigSecret`and thus use an in-cluster config or want to use a non capi generated kubeconfig you must do so for the workload kubeconfig as well -clusterAPIMode: incluster-incluster # incluster-incluster, incluster-kubeconfig, kubeconfig-incluster, kubeconfig-kubeconfig, single-kubeconfig - -# clusterAPIWorkloadKubeconfigPath -- Path to kubeconfig for connecting to Cluster API managed workloadcluster, only used if `clusterAPIMode=kubeconfig-kubeconfig or kubeconfig-incluster` -clusterAPIWorkloadKubeconfigPath: /etc/kubernetes/value - -# containerSecurityContext -- [Security context for container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) -containerSecurityContext: {} - # allowPrivilegeEscalation: false - # capabilities: - # drop: - # - ALL - # readOnlyRootFilesystem: true - -deployment: - # deployment.annotations -- Annotations to add to the Deployment object. - annotations: {} - -# dnsPolicy -- Defaults to `ClusterFirst`. Valid values are: -# `ClusterFirstWithHostNet`, `ClusterFirst`, `Default` or `None`. -# If autoscaler does not depend on cluster DNS, recommended to set this to `Default`. -dnsPolicy: ClusterFirst - -# envFromConfigMap -- ConfigMap name to use as envFrom. -envFromConfigMap: "" - -# envFromSecret -- Secret name to use as envFrom. -envFromSecret: "" - -## Priorities Expander -# expanderPriorities -- The expanderPriorities is used if `extraArgs.expander` contains `priority` and expanderPriorities is also set with the priorities. -# If `extraArgs.expander` contains `priority`, then expanderPriorities is used to define cluster-autoscaler-priority-expander priorities. -# See: https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/expander/priority/readme.md -expanderPriorities: {} - -# extraArgs -- Additional container arguments. -# Refer to https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md#what-are-the-parameters-to-ca for the full list of cluster autoscaler -# parameters and their default values. -# Everything after the first _ will be ignored allowing the use of multi-string arguments. -extraArgs: - logtostderr: true - stderrthreshold: info - v: 4 - # write-status-configmap: true - # status-config-map-name: cluster-autoscaler-status - # leader-elect: true - # leader-elect-resource-lock: endpoints - # skip-nodes-with-local-storage: true - # expander: random - # scale-down-enabled: true - # balance-similar-node-groups: true - # min-replica-count: 0 - # scale-down-utilization-threshold: 0.5 - # scale-down-non-empty-candidates-count: 30 - # max-node-provision-time: 15m0s - # scan-interval: 10s - # scale-down-delay-after-add: 10m - # scale-down-delay-after-delete: 0s - # scale-down-delay-after-failure: 3m - # scale-down-unneeded-time: 10m - # node-deletion-delay-timeout: 2m - # node-deletion-batcher-interval: 0s - # skip-nodes-with-system-pods: true - # balancing-ignore-label_1: first-label-to-ignore - # balancing-ignore-label_2: second-label-to-ignore - -# customArgs -- Additional custom container arguments. -# Refer to https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md#what-are-the-parameters-to-ca for the full list of cluster autoscaler -# parameters and their default values. -# List of arguments as strings. -customArgs: [] - -# extraEnv -- Additional container environment variables. -extraEnv: {} - -# extraEnvConfigMaps -- Additional container environment variables from ConfigMaps. -extraEnvConfigMaps: {} - -# extraEnvSecrets -- Additional container environment variables from Secrets. -extraEnvSecrets: {} - -# extraObjects -- Extra K8s manifests to deploy -extraObjects: [] -# - apiVersion: v1 -# kind: ConfigMap -# metadata: -# name: my-configmap -# data: -# key: "value" -# - apiVersion: scheduling.k8s.io/v1 -# kind: PriorityClass -# metadata: -# name: high-priority -# value: 1000000 -# globalDefault: false -# description: "This priority class should be used for XYZ service pods only." - -# extraVolumeMounts -- Additional volumes to mount. -extraVolumeMounts: [] - # - name: ssl-certs - # mountPath: /etc/ssl/certs/ca-certificates.crt - # readOnly: true - -# extraVolumes -- Additional volumes. -extraVolumes: [] - # - name: ssl-certs - # hostPath: - # path: /etc/ssl/certs/ca-bundle.crt - -# extraVolumeSecrets -- Additional volumes to mount from Secrets. -extraVolumeSecrets: {} - # autoscaler-vol: - # mountPath: /data/autoscaler/ - # custom-vol: - # name: custom-secret - # mountPath: /data/custom/ - # items: - # - key: subkey - # path: mypath - -# initContainers -- Any additional init containers. -initContainers: [] - -# fullnameOverride -- String to fully override `cluster-autoscaler.fullname` template. -fullnameOverride: "" - -# hostNetwork -- Whether to expose network interfaces of the host machine to pods. -hostNetwork: false - -image: - # image.repository -- Image repository - repository: registry.k8s.io/autoscaling/cluster-autoscaler - # image.tag -- Image tag - tag: v1.32.0 - # image.pullPolicy -- Image pull policy - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## - # image.pullSecrets -- Image pull secrets - pullSecrets: [] - # - myRegistrKeySecretName - -# kubeTargetVersionOverride -- Allow overriding the `.Capabilities.KubeVersion.GitVersion` check. Useful for `helm template` commands. -kubeTargetVersionOverride: "" - -# kwokConfigMapName -- configmap for configuring kwok provider -kwokConfigMapName: "kwok-provider-config" - -# magnumCABundlePath -- Path to the host's CA bundle, from `ca-file` in the cloud-config file. -magnumCABundlePath: "/etc/kubernetes/ca-bundle.crt" - -# magnumClusterName -- Cluster name or ID in Magnum. -# Required if `cloudProvider=magnum` and not setting `autoDiscovery.clusterName`. -magnumClusterName: "" - -# nameOverride -- String to partially override `cluster-autoscaler.fullname` template (will maintain the release name) -nameOverride: "" - -# nodeSelector -- Node labels for pod assignment. Ref: https://kubernetes.io/docs/user-guide/node-selection/. -nodeSelector: {} - -# podAnnotations -- Annotations to add to each pod. -podAnnotations: {} - -# podDisruptionBudget -- Pod disruption budget. -podDisruptionBudget: - maxUnavailable: 1 - # minAvailable: 2 - -# podLabels -- Labels to add to each pod. -podLabels: {} - -# priorityClassName -- priorityClassName -priorityClassName: "system-cluster-critical" - -# priorityConfigMapAnnotations -- Annotations to add to `cluster-autoscaler-priority-expander` ConfigMap. -priorityConfigMapAnnotations: {} - # key1: "value1" - # key2: "value2" - -## Custom PrometheusRule to be defined -## The value is evaluated as a template, so, for example, the value can depend on .Release or .Chart -## ref: https://github.com/coreos/prometheus-operator#customresourcedefinitions -prometheusRule: - # prometheusRule.enabled -- If true, creates a Prometheus Operator PrometheusRule. - enabled: false - # prometheusRule.additionalLabels -- Additional labels to be set in metadata. - additionalLabels: {} - # prometheusRule.namespace -- Namespace which Prometheus is running in. - namespace: monitoring - # prometheusRule.interval -- How often rules in the group are evaluated (falls back to `global.evaluation_interval` if not set). - interval: null - # prometheusRule.rules -- Rules spec template (see https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/api.md#rule). - rules: [] - -rbac: - # rbac.create -- If `true`, create and use RBAC resources. - create: true - # rbac.pspEnabled -- If `true`, creates and uses RBAC resources required in the cluster with [Pod Security Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) enabled. - # Must be used with `rbac.create` set to `true`. - pspEnabled: false - # rbac.clusterScoped -- if set to false will only provision RBAC to alter resources in the current namespace. Most useful for Cluster-API - clusterScoped: true - serviceAccount: - # rbac.serviceAccount.annotations -- Additional Service Account annotations. - annotations: {} - # rbac.serviceAccount.create -- If `true` and `rbac.create` is also true, a Service Account will be created. - create: true - # rbac.serviceAccount.name -- The name of the ServiceAccount to use. If not set and create is `true`, a name is generated using the fullname template. - name: "" - # rbac.serviceAccount.automountServiceAccountToken -- Automount API credentials for a Service Account. - automountServiceAccountToken: true - -# replicaCount -- Desired number of pods -replicaCount: 1 - -# resources -- Pod resource requests and limits. -resources: {} - # limits: - # cpu: 100m - # memory: 300Mi - # requests: - # cpu: 100m - # memory: 300Mi - -# revisionHistoryLimit -- The number of revisions to keep. -revisionHistoryLimit: 10 - -# securityContext -- [Security context for pod](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) -securityContext: {} - # runAsNonRoot: true - # runAsUser: 65534 - # runAsGroup: 65534 - # seccompProfile: - # type: RuntimeDefault - -service: - # service.create -- If `true`, a Service will be created. - create: true - # service.annotations -- Annotations to add to service - annotations: {} - # service.labels -- Labels to add to service - labels: {} - # service.externalIPs -- List of IP addresses at which the service is available. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips. - externalIPs: [] - - # service.clusterIP -- IP address to assign to service - clusterIP: "" - - # service.loadBalancerIP -- IP address to assign to load balancer (if supported). - loadBalancerIP: "" - # service.loadBalancerSourceRanges -- List of IP CIDRs allowed access to load balancer (if supported). - loadBalancerSourceRanges: [] - # service.servicePort -- Service port to expose. - servicePort: 8085 - # service.portName -- Name for service port. - portName: http - # service.type -- Type of service to create. - type: ClusterIP - -## Are you using Prometheus Operator? -serviceMonitor: - # serviceMonitor.enabled -- If true, creates a Prometheus Operator ServiceMonitor. - enabled: false - # serviceMonitor.interval -- Interval that Prometheus scrapes Cluster Autoscaler metrics. - interval: 10s - # serviceMonitor.namespace -- Namespace which Prometheus is running in. - namespace: monitoring - ## [Prometheus Selector Label](https://github.com/helm/charts/tree/master/stable/prometheus-operator#prometheus-operator-1) - ## [Kube Prometheus Selector Label](https://github.com/helm/charts/tree/master/stable/prometheus-operator#exporters) - # serviceMonitor.selector -- Default to kube-prometheus install (CoreOS recommended), but should be set according to Prometheus install. - selector: - release: prometheus-operator - # serviceMonitor.path -- The path to scrape for metrics; autoscaler exposes `/metrics` (this is standard) - path: /metrics - # serviceMonitor.annotations -- Annotations to add to service monitor - annotations: {} - ## [RelabelConfig](https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.RelabelConfig) - # serviceMonitor.relabelings -- RelabelConfigs to apply to metrics before scraping. - relabelings: {} - ## [RelabelConfig](https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.RelabelConfig) - # serviceMonitor.metricRelabelings -- MetricRelabelConfigs to apply to samples before ingestion. - metricRelabelings: {} - -# tolerations -- List of node taints to tolerate (requires Kubernetes >= 1.6). -tolerations: [] - -# topologySpreadConstraints -- You can use topology spread constraints to control how Pods are spread across your cluster among failure-domains such as regions, zones, nodes, and other user-defined topology domains. (requires Kubernetes >= 1.19). -topologySpreadConstraints: [] - # - maxSkew: 1 - # topologyKey: topology.kubernetes.io/zone - # whenUnsatisfiable: DoNotSchedule - # labelSelector: - # matchLabels: - # app.kubernetes.io/instance: cluster-autoscaler - -# updateStrategy -- [Deployment update strategy](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy) -updateStrategy: {} - # rollingUpdate: - # maxSurge: 1 - # maxUnavailable: 0 - # type: RollingUpdate - -# vpa -- Configure a VerticalPodAutoscaler for the cluster-autoscaler Deployment. -vpa: - # vpa.enabled -- If true, creates a VerticalPodAutoscaler. - enabled: false - # vpa.updateMode -- [UpdateMode](https://github.com/kubernetes/autoscaler/blob/vertical-pod-autoscaler/v0.13.0/vertical-pod-autoscaler/pkg/apis/autoscaling.k8s.io/v1/types.go#L124) - updateMode: "Auto" - # vpa.containerPolicy -- [ContainerResourcePolicy](https://github.com/kubernetes/autoscaler/blob/vertical-pod-autoscaler/v0.13.0/vertical-pod-autoscaler/pkg/apis/autoscaling.k8s.io/v1/types.go#L159). The containerName is always et to the deployment's container name. This value is required if VPA is enabled. - containerPolicy: {} - -# secretKeyRefNameOverride -- Overrides the name of the Secret to use when loading the secretKeyRef for AWS, Azure and Civo env variables -secretKeyRefNameOverride: "" diff --git a/charts/devtron-utilities/charts/devtron-backups/Chart.yaml b/charts/devtron-utilities/charts/devtron-backups/Chart.yaml deleted file mode 100644 index 3203a6991..000000000 --- a/charts/devtron-utilities/charts/devtron-backups/Chart.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v2 -appVersion: "2.0" -description: A Helm chart for Devtron Backups -name: devtron-backups -version: 0.2.5 diff --git a/charts/devtron-utilities/charts/devtron-backups/README.md b/charts/devtron-utilities/charts/devtron-backups/README.md deleted file mode 100644 index acbd30d4a..000000000 --- a/charts/devtron-utilities/charts/devtron-backups/README.md +++ /dev/null @@ -1,55 +0,0 @@ -# Devtron Backup Chart - -This chart contains configuration files for setting up backup for Devtron stack using different cloud storage providers and persistence options. - -## Introduction - -Devtron Backup chart provides backup configurations for PostgreSQL databases and ArgoCD applications running in the Devtron environment. It supports backup to various cloud storage providers such as Azure Blob Storage, Google Cloud Storage (GCS), S3, as well as backup to persistent volume claims (PVC). - -## Configuration - -The backup configurations are defined in the YAML file, which specifies settings such as schedule, storage options, and encryption. - -### Azure Backup - -Azure backup can be enabled by setting `AZURE.enabled` to `true` in the YAML file. Configure Azure storage account details and encryption settings as required. - -### GCP Backup - -GCP backup can be enabled by setting `GCP.enabled` to `true` in the YAML file. Configure the GCS bucket name, and optionally, provide GCP credentials if the default service account lacks permissions. - -### S3 Backup - -S3 backup can be enabled by setting `S3.enabled` to `true` in the YAML file. Configure the S3 bucket details and encryption settings as required. - -### PVC Backup - -PVC backup can be enabled by setting `PERSISTENCE.enabled` to `true` in the YAML file. Specify PVC settings, including storage class and size. - -Additionally, remember to enable `postgress_backup` or `argocd_backup` according to your requirements in the YAML file. - -## Usage - -Follow the steps below to use the backup chart: - -1. Modify the YAML file according to your backup requirements. -2. Apply the configurations to your Kubernetes cluster. - -### Things to be considered while migrating from v0.1.x to v0.2.x: - -Previously, in v0.1.x, support was available only for the following storage options: -- AWS S3 -- Azure -- GCP -- PVC - -In the updated version (v0.2.x), support for all types of storage options using the S3 protocol has been added, for example, AWS S3, MINIO, etc. -As we have merged the options for AWS and generic S3 into one, we have to consider a few key changes: -- `AWS` changed to `S3` - - Previously, the configurations for AWS used to be set inside the `AWS:` option. Now it has changed to `S3:`, but only the naming has changed, not the functionality. -- `AWS_ACCESS_KEY` changed to `S3_ACCESS_KEY` - - This will continue to accept the ACCESS_KEY of the S3 storage, whether it be AWS S3 or any other storage options supporting the S3 protocol. -- `AWS_SECRET_KEY` changed to `S3_SECRET_KEY` - - This will continue to accept the SECRET_KEY of the S3 storage, whether it be AWS S3 or any other storage options supporting the S3 protocol. -- `S3_ENDPOINT` - - This option can be newly seen in the **v0.2.x**, which accepts the endpoint of the S3 storage service, for example, MINIO (Can be kept empty in the case of AWS S3 Bucket). diff --git a/charts/devtron-utilities/charts/devtron-backups/templates/_helpers.tpl b/charts/devtron-utilities/charts/devtron-backups/templates/_helpers.tpl deleted file mode 100644 index 03f69d724..000000000 --- a/charts/devtron-utilities/charts/devtron-backups/templates/_helpers.tpl +++ /dev/null @@ -1,63 +0,0 @@ -{{- define "devtron.postgresBackup" -}} - {{- if .Values.global.S3.CA_BUNDLE }} - {{- if .Values.global.S3.S3_ENDPOINT }} - {{- if .Values.global.S3.encryption.enabled }} - set -ex; date1=$(date +%Y%m%d-%H%M); path=$(pwd); echo "$CA_BUNDLE" > /cabundle.pem; export AWS_CA_BUNDLE=/cabundle.pem; gpg -c --batch --passphrase {{ .Values.global.S3.encryption.passphrase }} /postgres/backup.tar; rm -rvf /postgres/backup.tar; mv /postgres/backup.tar.gpg /postgres/backup-$date1.tar.gpg; aws s3 cp /postgres/backup-$date1.tar.gpg s3://$S3_BUCKET/postgres/ --endpoint-url {{ .Values.global.S3.S3_ENDPOINT }} --ca-bundle $AWS_CA_BUNDLE; - {{- else }} - set -ex; date1=$(date +%Y%m%d-%H%M); path=$(pwd); echo "$CA_BUNDLE" > /cabundle.pem; export AWS_CA_BUNDLE=/cabundle.pem; mv /postgres/backup.tar /postgres/backup-$date1.tar; aws s3 cp /postgres/backup-$date1.tar s3://$S3_BUCKET/postgres/ --endpoint-url {{ .Values.global.S3.S3_ENDPOINT }} --ca-bundle $AWS_CA_BUNDLE; - {{- end }} - {{- else}} - {{- if .Values.global.S3.encryption.enabled }} - set -ex; date1=$(date +%Y%m%d-%H%M); path=$(pwd); echo "$CA_BUNDLE" > /cabundle.pem; export AWS_CA_BUNDLE=/cabundle.pem; gpg -c --batch --passphrase {{ .Values.global.S3.encryption.passphrase }} /postgres/backup.tar; rm -rvf /postgres/backup.tar; mv /postgres/backup.tar.gpg /postgres/backup-$date1.tar.gpg; aws s3 cp /postgres/backup-$date1.tar.gpg s3://$S3_BUCKET/postgres/ ; - {{- else}} - set -ex; date1=$(date +%Y%m%d-%H%M); path=$(pwd); echo "$CA_BUNDLE" > /cabundle.pem; export AWS_CA_BUNDLE=/cabundle.pem; mv /postgres/backup.tar /postgres/backup-$date1.tar; aws s3 cp /postgres/backup-$date1.tar s3://$S3_BUCKET/postgres/; - {{- end }} - {{- end }} - {{- else }} - {{- if .Values.global.S3.S3_ENDPOINT }} - {{- if .Values.global.S3.encryption.enabled }} - set -ex; date1=$(date +%Y%m%d-%H%M); gpg -c --batch --passphrase {{ .Values.global.S3.encryption.passphrase }} /postgres/backup.tar; rm -rvf /postgres/backup.tar; mv /postgres/backup.tar.gpg /postgres/backup-$date1.tar.gpg; aws s3 cp /postgres/backup-$date1.tar.gpg s3://$S3_BUCKET/postgres/ --endpoint-url {{ .Values.global.S3.S3_ENDPOINT }}; - {{- else}} - set -ex; date1=$(date +%Y%m%d-%H%M); mv /postgres/backup.tar /postgres/backup-$date1.tar; aws s3 cp /postgres/backup-$date1.tar s3://$S3_BUCKET/postgres/ --endpoint-url {{ .Values.global.S3.S3_ENDPOINT }}; - {{- end }} - {{- else}} - {{- if .Values.global.S3.encryption.enabled }} - set -ex; date1=$(date +%Y%m%d-%H%M); gpg -c --batch --passphrase {{ .Values.global.S3.encryption.passphrase }} /postgres/backup.tar; rm -rvf /postgres/backup.tar; mv /postgres/backup.tar.gpg /postgres/backup-$date1.tar.gpg; aws s3 cp /postgres/backup-$date1.tar.gpg s3://$S3_BUCKET/postgres/; - {{- else}} - set -ex; date1=$(date +%Y%m%d-%H%M); mv /postgres/backup.tar /postgres/backup-$date1.tar; aws s3 cp /postgres/backup-$date1.tar s3://$S3_BUCKET/postgres/; - {{- end }} - {{- end }} - {{- end }} -{{- end -}} - -{{- define "devtron.argocdBackup" -}} - {{- if .Values.global.S3.CA_BUNDLE }} - {{- if .Values.global.S3.S3_ENDPOINT }} - {{- if .Values.global.S3.encryption.enabled }} - set -ex; date1=$(date +%Y%m%d-%H%M); echo "$CA_BUNDLE" > /cabundle.pem; export AWS_CA_BUNDLE=/cabundle.pem; gpg -c --batch --passphrase {{ .Values.global.S3.encryption.passphrase }} /argocd/backup.yaml; rm -rvf /argocd/backup.yaml; mv /argocd/backup.yaml.gpg /argocd/backup-$date1.yaml.gpg; aws s3 cp /argocd/backup-$date1.yaml.gpg s3://$S3_BUCKET/argocd/ --endpoint-url {{ .Values.global.S3.S3_ENDPOINT }}; - {{- else }} - set -ex; date1=$(date +%Y%m%d-%H%M); echo "$CA_BUNDLE" > /cabundle.pem; export AWS_CA_BUNDLE=/cabundle.pem; mv /argocd/backup.yaml /argocd/backup-$date1.yaml; aws s3 cp /argocd/backup-$date1.yaml s3://$S3_BUCKET/argocd/ --endpoint-url {{ .Values.global.S3.S3_ENDPOINT }}; - {{- end }} - {{- else}} - {{- if .Values.global.S3.encryption.enabled }} - set -ex; date1=$(date +%Y%m%d-%H%M); echo "$CA_BUNDLE" > /cabundle.pem; export AWS_CA_BUNDLE=/cabundle.pem; gpg -c --batch --passphrase {{ .Values.global.S3.encryption.passphrase }} /argocd/backup.yaml; rm -rvf /argocd/backup.yaml; mv /argocd/backup.yaml.gpg /argocd/backup-$date1.yaml.gpg; aws s3 cp /argocd/backup-$date1.yaml.gpg s3://$S3_BUCKET/argocd/; - {{- else}} - set -ex; date1=$(date +%Y%m%d-%H%M); echo "$CA_BUNDLE" > /cabundle.pem; export AWS_CA_BUNDLE=/cabundle.pem; mv /argocd/backup.yaml /argocd/backup-$date1.yaml; aws s3 cp /argocd/backup-$date1.yaml s3://$S3_BUCKET/argocd/; - {{- end }} - {{- end }} - {{- else }} - {{- if .Values.global.S3.S3_ENDPOINT }} - {{- if .Values.global.S3.encryption.enabled }} - set -ex; date1=$(date +%Y%m%d-%H%M); gpg -c --batch --passphrase {{ .Values.global.S3.encryption.passphrase }} /argocd/backup.yaml; rm -rvf /argocd/backup.yaml; mv /argocd/backup.yaml.gpg /argocd/backup-$date1.yaml.gpg; aws s3 cp /argocd/backup-$date1.yaml.gpg s3://$S3_BUCKET/argocd/ --endpoint-url {{ .Values.global.S3.S3_ENDPOINT }}; - {{- else }} - set -ex; date1=$(date +%Y%m%d-%H%M); mv /argocd/backup.yaml /argocd/backup-$date1.yaml; aws s3 cp /argocd/backup-$date1.yaml s3://$S3_BUCKET/argocd/ --endpoint-url {{ .Values.global.S3.S3_ENDPOINT }}; - {{- end }} - {{- else}} - {{- if .Values.global.S3.encryption.enabled }} - set -ex; date1=$(date +%Y%m%d-%H%M); gpg -c --batch --passphrase {{ .Values.global.S3.encryption.passphrase }} /argocd/backup.yaml; rm -rvf /argocd/backup.yaml; mv /argocd/backup.yaml.gpg /argocd/backup-$date1.yaml.gpg; aws s3 cp /argocd/backup-$date1.yaml.gpg s3://$S3_BUCKET/argocd/; - {{- else}} - set -ex; date1=$(date +%Y%m%d-%H%M); mv /argocd/backup.yaml /argocd/backup-$date1.yaml; aws s3 cp /argocd/backup-$date1.yaml s3://$S3_BUCKET/argocd/; - {{- end }} - {{- end }} - {{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-azure.yaml b/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-azure.yaml deleted file mode 100644 index 5d59456f8..000000000 --- a/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-azure.yaml +++ /dev/null @@ -1,213 +0,0 @@ -{{- if .Values.global.AZURE.enabled }} -{{- if or .Values.postgres_backup.enabled .Values.argocd_backup.enabled }} -apiVersion: v1 -kind: Secret -metadata: - name: devtron-azure-backup-secret - namespace: devtroncd -type: opaque -data: - AZURE_BLOB_ACCOUNT_NAME: {{ .Values.global.AZURE.AZURE_BLOB_ACCOUNT_NAME | b64enc }} - AZURE_ACCOUNT_KEY: {{ .Values.global.AZURE.AZURE_ACCOUNT_KEY | b64enc }} - AZURE_BLOB_CONTAINER_FOR_POSTGRES: {{ .Values.global.AZURE.AZURE_BLOB_CONTAINER_FOR_POSTGRES | b64enc }} - {{- if .Values.argocd_backup.enabled }} - AZURE_BLOB_CONTAINER_FOR_ARGOCD: {{ .Values.global.AZURE.AZURE_BLOB_CONTAINER_FOR_ARGOCD | b64enc }} - {{- end }} -{{- end }} ---- -{{- if .Values.postgres_backup.enabled }} -{{ if semverCompare ">=1.21-0" .Capabilities.KubeVersion.GitVersion -}} -apiVersion: batch/v1 -{{ else -}} -apiVersion: batch/v1beta1 -{{ end -}} -kind: CronJob -metadata: - name: postgres-app-backup-cronjob - namespace: devtroncd -spec: - timeZone: {{ .Values.global.timezone | default "UTC" }} - schedule: {{ .Values.global.schedule }} - jobTemplate: - spec: - template: - {{- if or $.Values.postgres_backup.labels $.Values.postgres_backup.annotations }} - metadata: - {{- if $.Values.postgres_backup.labels }} - labels: - {{ toYaml .Values.postgres_backup.labels | indent 4 }} - {{- end }} - {{- if $.Values.postgres_backup.annotations }} - annotations: - {{ toYaml .Values.postgres_backup.annotations | indent 4 }} - {{- end }} - {{- end }} - spec: - initContainers: - - name: postgres-app-backup-cronjob - image: {{ .Values.postgres_backup.postgresImage | default "postgres:12" }} - volumeMounts: - - mountPath: /postgres - name: psql-volume - env: - - name: PGPASSWORD - valueFrom: - secretKeyRef: - key: PG_PASSWORD - name: {{ .Values.postgres_backup.secretName }} - imagePullPolicy: Always - args: - - /bin/bash - - -c - - set -ex ; pg_dumpall -h {{ .Values.postgres_backup.host | default "postgresql-postgresql.devtroncd" }} --exclude-database=clairv4 -p 5432 -U postgres --no-privileges > /postgres/backup.tar; echo $? ; du -sh /postgres/backup.tar - resources: -{{ toYaml .Values.postgres_backup.resources | indent 14 }} - containers: - - name: az-cli-for-upload - image: {{ .Values.global.AZURE.image | default "quay.io/devtron/k8s-utils:az-cli-ubuntu" }} - volumeMounts: - - mountPath: /postgres - name: psql-volume - env: - - name: AZURE_BLOB_ACCOUNT_NAME - valueFrom: - secretKeyRef: - name: devtron-azure-backup-secret - key: AZURE_BLOB_ACCOUNT_NAME - - name: AZURE_ACCOUNT_KEY - valueFrom: - secretKeyRef: - name: devtron-azure-backup-secret - key: AZURE_ACCOUNT_KEY - - name: AZURE_BLOB_CONTAINER_FOR_POSTGRES - valueFrom: - secretKeyRef: - name: devtron-azure-backup-secret - key: AZURE_BLOB_CONTAINER_FOR_POSTGRES - {{- if .Values.argocd_backup.enabled }} - - name: AZURE_BLOB_CONTAINER_FOR_ARGOCD - valueFrom: - secretKeyRef: - name: devtron-azure-backup-secret - key: AZURE_BLOB_CONTAINER_FOR_ARGOCD - {{- end }} - imagePullPolicy: Always - resources: -{{ toYaml .Values.postgres_backup.resources | indent 14 }} - args: - - /bin/bash - - -c - {{- if $.Values.global.AZURE.encryption.enabled }} - - set -ex; date1=$(date +%Y%m%d-%H%M); gpg -c --batch --passphrase {{ .Values.global.AZURE.encryption.passphrase }} /postgres/backup.tar; rm -rvf /postgres/backup.tar; mv /postgres/backup.tar.gpg /postgres/backup-$date1.tar.gpg; az storage blob upload --account-name $AZURE_BLOB_ACCOUNT_NAME --container-name $AZURE_BLOB_CONTAINER_FOR_POSTGRES --file /postgres/backup-$date1.tar.gpg --account-key $AZURE_ACCOUNT_KEY; - {{- else }} - - set -ex; date1=$(date +%Y%m%d-%H%M); mv /postgres/backup.tar /postgres/backup-$date1.tar; az storage blob upload --account-name $AZURE_BLOB_ACCOUNT_NAME --container-name $AZURE_BLOB_CONTAINER_FOR_POSTGRES --file /postgres/backup-$date1.tar --account-key $AZURE_ACCOUNT_KEY; - {{- end }} - volumes: - - name: psql-volume - emptyDir: {} - {{- if $.Values.global.nodeSelector }} - nodeselector: -{{ toYaml .Values.global.nodeSelector | indent 12 }} - {{- end }} - {{- if $.Values.global.tolerations }} - tolerations: -{{ toYaml .Values.global.tolerations | indent 12 }} - {{- end }} - restartPolicy: OnFailure -{{- end }} ---- -{{- if .Values.argocd_backup.enabled }} -{{ if semverCompare ">=1.21-0" .Capabilities.KubeVersion.GitVersion -}} -apiVersion: batch/v1 -{{ else -}} -apiVersion: batch/v1beta1 -{{ end -}} -kind: CronJob -metadata: - name: argocd-app-backup-cronjob - namespace: devtroncd -spec: - timeZone: {{ .Values.global.timezone | default "UTC" }} - schedule: {{ .Values.global.schedule }} - jobTemplate: - spec: - template: - {{- if or $.Values.postgres_backup.labels $.Values.postgres_backup.annotations }} - metadata: - {{- if $.Values.postgres_backup.labels }} - labels: - {{ toYaml .Values.postgres_backup.labels | indent 4 }} - {{- end }} - {{- if $.Values.postgres_backup.annotations }} - annotations: - {{ toYaml .Values.postgres_backup.annotations | indent 4 }} - {{- end }} - {{- end }} - spec: - initContainers: - - name: argocd-app-backup-job - image: {{ .Values.argocd_backup.argocdImage | default "quay.io/argoproj/argocd:v2.4.0" }} - volumeMounts: - - mountPath: /argocd - name: argocd-volume - env: - imagePullPolicy: Always - args: - - /bin/bash - - -c - - {{ .Values.argocd_backup.args | default "argocd admin export -n devtroncd > /argocd/backup.yaml" }} - resources: -{{ toYaml .Values.argocd_backup.resources | indent 14 }} - containers: - - name: az-cli-for-upload - image: {{ .Values.global.AZURE.image | default "quay.io/devtron/k8s-utils:az-cli-ubuntu" }} - volumeMounts: - - mountPath: /argocd - name: argocd-volume - env: - - name: AZURE_BLOB_ACCOUNT_NAME - valueFrom: - secretKeyRef: - name: devtron-azure-backup-secret - key: AZURE_BLOB_ACCOUNT_NAME - - name: AZURE_ACCOUNT_KEY - valueFrom: - secretKeyRef: - name: devtron-azure-backup-secret - key: AZURE_ACCOUNT_KEY - - name: AZURE_BLOB_CONTAINER_FOR_POSTGRES - valueFrom: - secretKeyRef: - name: devtron-azure-backup-secret - key: AZURE_BLOB_CONTAINER_FOR_POSTGRES - - name: AZURE_BLOB_CONTAINER_FOR_ARGOCD - valueFrom: - secretKeyRef: - name: devtron-azure-backup-secret - key: AZURE_BLOB_CONTAINER_FOR_ARGOCD - imagePullPolicy: Always - resources: -{{ toYaml .Values.argocd_backup.resources | indent 14 }} - args: - - /bin/bash - - -c - {{- if $.Values.global.AZURE.encryption.enabled }} - - set -ex; date1=$(date +%Y%m%d-%H%M); gpg -c --batch --passphrase {{ .Values.global.AZURE.encryption.passphrase }} /argocd/backup.yaml ;rm -rvf /argocd/backup.yaml ;mv /argocd/backup.yaml.gpg /argocd/backup-$date1.yaml.gpg; az storage blob upload --account-name $AZURE_BLOB_ACCOUNT_NAME --container-name $AZURE_BLOB_CONTAINER_FOR_ARGOCD --file /argocd/backup-$date1.yaml.gpg --account-key $AZURE_ACCOUNT_KEY; - {{- else }} - - set -ex; date1=$(date +%Y%m%d-%H%M); mv /argocd/backup.yaml /argocd/backup-$date1.yaml; az storage blob upload --account-name $AZURE_BLOB_ACCOUNT_NAME --container-name $AZURE_BLOB_CONTAINER_FOR_ARGOCD --file /argocd/backup-$date1.yaml --account-key $AZURE_ACCOUNT_KEY; - {{- end }} - volumes: - - name: argocd-volume - emptyDir: {} - {{- if $.Values.global.nodeSelector }} - nodeselector: -{{ toYaml .Values.global.nodeSelector | indent 12 }} - {{- end }} - {{- if $.Values.global.tolerations }} - tolerations: -{{ toYaml .Values.global.tolerations | indent 12 }} - {{- end }} - restartPolicy: OnFailure - serviceAccountName: {{ .Values.argocd_backup.serviceAccountName }} -{{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-gcp.yaml b/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-gcp.yaml deleted file mode 100644 index f961e9b5f..000000000 --- a/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-gcp.yaml +++ /dev/null @@ -1,194 +0,0 @@ -{{- if .Values.global.GCP.enabled }} -{{- if or .Values.postgres_backup.enabled .Values.argocd_backup.enabled }} -apiVersion: v1 -kind: Secret -metadata: - name: devtron-gcp-backup-secret - namespace: devtroncd -type: opaque -data: - GCS_BUCKET: {{ .Values.global.GCP.GCS_BUCKET_NAME | b64enc }} - {{- if .Values.global.GCP.CREDENTIALS.enabled }} - GOOGLE_APPLICATION_CREDENTIALS: {{ $.Values.global.GCP.CREDENTIALS.GCP_CREDENTIALS_JSON }} - {{- end }} -{{- end }} ---- -{{- if .Values.postgres_backup.enabled }} -{{ if semverCompare ">=1.21-0" .Capabilities.KubeVersion.GitVersion -}} -apiVersion: batch/v1 -{{ else -}} -apiVersion: batch/v1beta1 -{{ end -}} -kind: CronJob -metadata: - name: postgres-app-backup-cronjob - namespace: devtroncd -spec: - timeZone: {{ .Values.global.timezone | default "UTC" }} - schedule: "{{ .Values.global.schedule }}" - jobTemplate: - spec: - template: - {{- if or $.Values.postgres_backup.labels $.Values.postgres_backup.annotations }} - metadata: - {{- if $.Values.postgres_backup.labels }} - labels: - {{ toYaml .Values.postgres_backup.labels | indent 4 }} - {{- end }} - {{- if $.Values.postgres_backup.annotations }} - annotations: - {{ toYaml .Values.postgres_backup.annotations | indent 4 }} - {{- end }} - {{- end }} - spec: - initContainers: - - name: postgres-app-backup-cronjob - image: {{ .Values.postgres_backup.postgresImage | default "postgres:12" }} - volumeMounts: - - mountPath: /postgres - name: psql-volume - env: - - name: PGPASSWORD - valueFrom: - secretKeyRef: - key: PG_PASSWORD - name: {{ .Values.postgres_backup.secretName }} - imagePullPolicy: Always - args: - - /bin/bash - - -c - - set -ex; pg_dumpall -h {{ .Values.postgres_backup.host | default "postgresql-postgresql.devtroncd" }} --exclude-database=clairv4 -p 5432 -U postgres --no-privileges > /postgres/backup.tar; echo $? ; du -sh /postgres/backup.tar - resources: -{{ toYaml .Values.postgres_backup.resources | indent 14 }} - containers: - - name: gcloud-cli-for-cloud-storage-upload - image: {{ .Values.global.GCP.image | default "google/cloud-sdk:alpine" }} - volumeMounts: - - mountPath: /postgres - name: psql-volume - env: - - name: GCS_BUCKET - valueFrom: - secretKeyRef: - name: devtron-gcp-backup-secret - key: GCS_BUCKET - {{- if .Values.global.GCP.CREDENTIALS.enabled }} - - name: gcp_credentials - valueFrom: - secretKeyRef: - name: devtron-gcp-backup-secret - key: GOOGLE_APPLICATION_CREDENTIALS - {{- end }} - imagePullPolicy: Always - resources: -{{ toYaml .Values.postgres_backup.resources | indent 14 }} - args: - - /bin/bash - - -c - {{- if $.Values.global.GCP.encryption.enabled }} - - set -ex; echo $gcp_credentials > /postgres/gcp_credentials.json ; gcloud auth activate-service-account --key-file=/postgres/gcp_credentials.json ; date1=$(date +%Y%m%d-%H%M); gpg -c --batch --passphrase {{ .Values.global.GCP.encryption.passphrase }} /postgres/backup.tar; rm -rvf /postgres/backup.tar; mv /postgres/backup.tar.gpg /postgres/backup-$date1.tar.gpg; gsutil cp /postgres/backup-$date1.tar.gpg gs://$GCS_BUCKET/postgres/; - {{- else}} - - set -ex; echo $gcp_credentials > /postgres/gcp_credentials.json ; gcloud auth activate-service-account --key-file=/postgres/gcp_credentials.json ; date1=$(date +%Y%m%d-%H%M); mv /postgres/backup.tar /postgres/backup-$date1.tar; gsutil cp /postgres/backup-$date1.tar gs://$GCS_BUCKET/postgres/; - {{- end }} - volumes: - - name: psql-volume - emptyDir: {} - {{- if $.Values.global.nodeSelector }} - nodeselector: -{{ toYaml .Values.global.nodeSelector | indent 12 }} - {{- end }} - {{- if $.Values.global.tolerations }} - tolerations: -{{ toYaml .Values.global.tolerations | indent 12 }} - {{- end }} - restartPolicy: OnFailure - serviceAccountName: {{ .Values.postgres_backup.serviceAccountName | default "default" }} -{{- end }} ---- -{{- if .Values.argocd_backup.enabled }} -{{ if semverCompare ">=1.21-0" .Capabilities.KubeVersion.GitVersion -}} -apiVersion: batch/v1 -{{ else -}} -apiVersion: batch/v1beta1 -{{ end -}} -kind: CronJob -metadata: - name: argocd-app-backup-cronjob - namespace: devtroncd -spec: - timeZone: {{ .Values.global.timezone | default "UTC" }} - schedule: "{{ .Values.global.schedule }}" - jobTemplate: - spec: - template: - {{- if or $.Values.postgres_backup.labels $.Values.postgres_backup.annotations }} - metadata: - {{- if $.Values.postgres_backup.labels }} - labels: - {{ toYaml .Values.postgres_backup.labels | indent 4 }} - {{- end }} - {{- if $.Values.postgres_backup.annotations }} - annotations: - {{ toYaml .Values.postgres_backup.annotations | indent 4 }} - {{- end }} - {{- end }} - spec: - initContainers: - - name: argocd-app-backup-job - image: {{ .Values.argocd_backup.argocdImage | default "quay.io/argoproj/argocd:v2.4.0" }} - volumeMounts: - - mountPath: /argocd - name: argocd-volume - env: - imagePullPolicy: Always - args: - - /bin/bash - - -c - - {{ .Values.argocd_backup.args | default "argocd admin export -n devtroncd > /argocd/backup.yaml" }} - resources: -{{ toYaml .Values.argocd_backup.resources | indent 14 }} - containers: - - name: gcloud-cli-for-cloud-storage-upload - image: {{ .Values.global.GCP.image | default "google/cloud-sdk:alpine" }} - volumeMounts: - - mountPath: /argocd - name: argocd-volume - env: - - name: GCS_BUCKET - valueFrom: - secretKeyRef: - name: devtron-gcp-backup-secret - key: GCS_BUCKET - {{- if .Values.global.GCP.CREDENTIALS.enabled }} - - name: gcp_credentials - valueFrom: - secretKeyRef: - name: devtron-gcp-backup-secret - key: GOOGLE_APPLICATION_CREDENTIALS - {{- end }} - imagePullPolicy: Always - resources: -{{ toYaml .Values.argocd_backup.resources | indent 14 }} - args: - - /bin/bash - - -c - {{- if $.Values.global.GCP.encryption.enabled }} - - set -ex; echo $gcp_credentials > /argocd/gcp_credentials.json ; gcloud auth activate-service-account --key-file=/argocd/gcp_credentials.json ; date1=$(date +%Y%m%d-%H%M); gpg -c --batch --passphrase {{ .Values.global.GCP.encryption.passphrase }} /argocd/backup.yaml; rm -rvf /argocd/backup.yaml; mv /argocd/backup.yaml.gpg /argocd/backup-$date1.yaml.gpg; gsutil cp /argocd/backup-$date1.yaml.gpg gs://$GCS_BUCKET/argocd/; - {{- else}} - - set -ex; echo $gcp_credentials > /argocd/gcp_credentials.json ; gcloud auth activate-service-account --key-file=/argocd/gcp_credentials.json ; date1=$(date +%Y%m%d-%H%M); mv /argocd/backup.yaml /argocd/backup-$date1.yaml; gsutil cp /argocd/backup-$date1.yaml gs://$GCS_BUCKET/argocd/; - {{- end }} - volumes: - - name: argocd-volume - emptyDir: {} - {{- if $.Values.global.nodeSelector }} - nodeselector: -{{ toYaml .Values.global.nodeSelector | indent 12 }} - {{- end }} - {{- if $.Values.global.tolerations }} - tolerations: -{{ toYaml .Values.global.tolerations | indent 12 }} - {{- end }} - restartPolicy: OnFailure - serviceAccountName: {{ .Values.argocd_backup.serviceAccountName }} -{{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-pvc.yaml b/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-pvc.yaml deleted file mode 100644 index 7bebeb58c..000000000 --- a/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-pvc.yaml +++ /dev/null @@ -1,154 +0,0 @@ -{{- if .Values.global.PERSISTENCE.enabled }} -{{- if .Values.postgres_backup.enabled }} -{{- if semverCompare ">=1.21-0" .Capabilities.KubeVersion.GitVersion }} -apiVersion: batch/v1 -{{- else }} -apiVersion: batch/v1beta1 -{{- end }} -kind: CronJob -metadata: - name: postgres-app-backup-cronjob - namespace: devtroncd -spec: - timeZone: {{ .Values.global.timezone | default "UTC" }} - schedule: {{ .Values.global.schedule }} - jobTemplate: - spec: - template: - {{- if or $.Values.postgres_backup.labels $.Values.postgres_backup.annotations }} - metadata: - {{- if $.Values.postgres_backup.labels }} - labels: - {{ toYaml .Values.postgres_backup.labels | indent 4 }} - {{- end }} - {{- if $.Values.postgres_backup.annotations }} - annotations: - {{ toYaml .Values.postgres_backup.annotations | indent 4 }} - {{- end }} - {{- end }} - spec: - containers: - - name: postgres-app-backup-cronjob - image: {{ .Values.postgres_backup.postgresImage | default "postgres:12" }} - volumeMounts: - - mountPath: /postgres - name: psql-volume - env: - - name: PGPASSWORD - valueFrom: - secretKeyRef: - key: PG_PASSWORD - name: {{ .Values.postgres_backup.secretName }} - imagePullPolicy: Always - args: - - /bin/bash - - -c - {{- if $.Values.global.PERSISTENCE.encryption.enabled }} - - set -ex; mkdir -p /postgres/ ; date1=$(date +%Y%m%d-%H%M); pg_dumpall -h postgresql-postgresql.devtroncd -p 5432 -U postgres --no-privileges > /postgres/backup-$date1.tar ; gpg -c --batch --passphrase {{ .Values.global.PERSISTENCE.encryption.passphrase }} /postgres/backup-$date1.tar ; rm -rvf /postgres/backup-$date1.tar; - {{- else }} - - set -ex; mkdir -p /postgres/ ; date1=$(date +%Y%m%d-%H%M); pg_dumpall -h {{ .Values.postgres_backup.host | default "postgresql-postgresql.devtroncd" }} --exclude-database=clairv4 -p 5432 -U postgres --no-privileges > /postgres/backup-$date1.tar ; - {{- end }} - resources: -{{ toYaml .Values.postgres_backup.resources | indent 12 }} - volumes: - - name: psql-volume - persistentVolumeClaim: - {{- if and .Values.global.PERSISTENCE.enabled .Values.global.PERSISTENCE.existingClaim }} - claimName: {{ .Values.global.PERSISTENCE.existingClaim }} - {{- else }} - claimName: devtron-backup-pvc - {{- end }} - {{- if $.Values.global.nodeSelector }} - nodeselector: -{{ toYaml .Values.global.nodeSelector | indent 12 }} - {{- end }} - {{- if $.Values.global.tolerations }} - tolerations: -{{ toYaml .Values.global.tolerations | indent 12 }} - {{- end }} - restartPolicy: OnFailure -{{- end }} -{{- if and (.Values.global.PERSISTENCE.enabled) (not .Values.global.PERSISTENCE.existingClaim) }} ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: devtron-backup-pvc - namespace: devtroncd -spec: - {{- if .Values.global.PERSISTENCE.storageClass }} - storageClassName: {{ .Values.global.PERSISTENCE.storageClass }} - {{- end }} - accessModes: - - ReadWriteOnce - resources: - requests: - storage: {{ .Values.global.PERSISTENCE.size }} -{{- end }} -{{- if .Values.argocd_backup.enabled }} ---- -{{- if semverCompare ">=1.21-0" .Capabilities.KubeVersion.GitVersion }} -apiVersion: batch/v1 -{{- else }} -apiVersion: batch/v1beta1 -{{- end }} -kind: CronJob -metadata: - name: argocd-app-backup-job - namespace: devtroncd -spec: - timeZone: {{ .Values.global.timezone | default "UTC" }} - schedule: {{ .Values.global.schedule }} - jobTemplate: - spec: - template: - {{- if or $.Values.postgres_backup.labels $.Values.postgres_backup.annotations }} - metadata: - {{- if $.Values.postgres_backup.labels }} - labels: - {{ toYaml .Values.postgres_backup.labels | indent 4 }} - {{- end }} - {{- if $.Values.postgres_backup.annotations }} - annotations: - {{ toYaml .Values.postgres_backup.annotations | indent 4 }} - {{- end }} - {{- end }} - spec: - containers: - - name: argocd-app-backup-job - image: {{ .Values.argocd_backup.argocdImage | default "quay.io/argoproj/argocd:v2.4.0" }} - volumeMounts: - - mountPath: /argo-cd - name: argocd-volume - env: - imagePullPolicy: Always - args: - - /bin/bash - - -c - {{- if $.Values.global.PERSISTENCE.encryption.enabled }} - - set -ex; mkdir -p /argo-cd/ ; date1=$(date +%Y%m%d-%H%M); {{ .Values.argocd_backup.args | default "argocd admin export -n devtroncd" }} > /argo-cd/backup-$date1.tar ; gpg -c --batch --passphrase {{ .Values.global.PERSISTENCE.encryption.passphrase }} /argo-cd/backup-$date1.tar; rm -rvf /argo-cd/backup-$date1.tar; - {{- else }} - - set -ex; mkdir -p /argo-cd/ ; date1=$(date +%Y%m%d-%H%M); {{ .Values.argocd_backup.args | default "argocd admin export -n devtroncd" }} > /argo-cd/backup-$date1.tar ; - {{- end }} - resources: -{{ toYaml .Values.argocd_backup.resources | indent 12 }} - volumes: - - name: argocd-volume - persistentVolumeClaim: - {{- if and .Values.global.PERSISTENCE.enabled .Values.global.PERSISTENCE.existingClaim }} - claimName: {{ .Values.global.PERSISTENCE.existingClaim }} - {{- else }} - claimName: devtron-backup-pvc - {{- end }} - {{- if $.Values.global.nodeSelector }} - nodeselector: -{{ toYaml .Values.global.nodeSelector | indent 12 }} - {{- end }} - {{- if $.Values.global.tolerations }} - tolerations: -{{ toYaml .Values.global.tolerations | indent 12 }} - {{- end }} - restartPolicy: OnFailure - serviceAccountName: argocd-backup -{{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-s3.yaml b/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-s3.yaml deleted file mode 100644 index 45f559137..000000000 --- a/charts/devtron-utilities/charts/devtron-backups/templates/backup-on-s3.yaml +++ /dev/null @@ -1,225 +0,0 @@ -{{- if .Values.global.S3.enabled }} -{{- if or .Values.postgres_backup.enabled .Values.argocd_backup.enabled }} -apiVersion: v1 -kind: Secret -metadata: - name: devtron-s3-backup-secret - namespace: devtroncd -type: Opaque -data: - S3_BUCKET_NAME: {{ .Values.global.S3.S3_BUCKET_NAME | b64enc }} - {{- if eq .Values.global.S3.NODE_ROLE "false" }} - AWS_ACCESS_KEY: {{ .Values.global.S3.S3_ACCESS_KEY | b64enc }} - AWS_SECRET_KEY: {{ .Values.global.S3.S3_SECRET_KEY | b64enc }} - {{- end }} - {{- if .Values.global.S3.CA_BUNDLE }} - AWS_CA_BUNDLE: {{ .Values.global.S3.CA_BUNDLE | b64enc }} - {{- end }} - AWS_REGION: {{ .Values.global.S3.AWS_REGION | default "us-east-1" | b64enc }} -{{- end }} ---- -{{- if .Values.postgres_backup.enabled }} -{{ if semverCompare ">=1.21-0" .Capabilities.KubeVersion.GitVersion -}} -apiVersion: batch/v1 -{{ else -}} -apiVersion: batch/v1beta1 -{{ end -}} -kind: CronJob -metadata: - name: postgres-app-backup-cronjob - namespace: devtroncd -spec: - timeZone: {{ .Values.global.timezone | default "UTC" }} - schedule: "{{ .Values.global.schedule }}" - jobTemplate: - spec: - template: - {{- if or $.Values.postgres_backup.labels $.Values.postgres_backup.annotations }} - metadata: - {{- if $.Values.postgres_backup.labels }} - labels: - {{ toYaml .Values.postgres_backup.labels | indent 4 }} - {{- end }} - {{- if $.Values.postgres_backup.annotations }} - annotations: - {{ toYaml .Values.postgres_backup.annotations | indent 4 }} - {{- end }} - {{- end }} - spec: - initContainers: - - name: postgres-app-backup-cronjob - image: {{ .Values.postgres_backup.postgresImage | default "postgres:12" }} - volumeMounts: - - mountPath: /postgres - name: psql-volume - env: - - name: PGPASSWORD - valueFrom: - secretKeyRef: - key: PG_PASSWORD - name: {{ .Values.postgres_backup.secretName }} - imagePullPolicy: Always - args: - - /bin/bash - - -c - - set -ex; pg_dumpall -h {{ .Values.postgres_backup.host | default "postgresql-postgresql.devtroncd" }} --exclude-database=clairv4 -p 5432 -U postgres --no-privileges > /postgres/backup.tar; echo $? ; du -sh /postgres/backup.tar - resources: -{{ toYaml .Values.postgres_backup.resources | indent 14 }} - containers: - - name: aws-cli-for-s3-download - image: {{ .Values.global.S3.image | default "quay.io/devtron/k8s-utils:ubuntu-aws-cli-multi-arch-1" }} - volumeMounts: - - mountPath: /postgres - name: psql-volume - env: - {{- if eq .Values.global.S3.NODE_ROLE "false" }} - - name: AWS_ACCESS_KEY_ID - valueFrom: - secretKeyRef: - name: devtron-s3-backup-secret - key: AWS_ACCESS_KEY - - name: AWS_SECRET_ACCESS_KEY - valueFrom: - secretKeyRef: - name: devtron-s3-backup-secret - key: AWS_SECRET_KEY - {{- end }} - - name: S3_BUCKET - valueFrom: - secretKeyRef: - name: devtron-s3-backup-secret - key: S3_BUCKET_NAME - - name: AWS_DEFAULT_REGION - valueFrom: - secretKeyRef: - name: devtron-s3-backup-secret - key: AWS_REGION - {{- if .Values.global.S3.CA_BUNDLE }} - - name: CA_BUNDLE - valueFrom: - secretKeyRef: - name: devtron-s3-backup-secret - key: AWS_CA_BUNDLE - {{- end }} - imagePullPolicy: Always - resources: -{{ toYaml .Values.postgres_backup.resources | indent 14 }} - args: - - /bin/bash - - -c - - | -{{ include "devtron.postgresBackup" . | indent 6 }} - volumes: - - name: psql-volume - emptyDir: {} - {{- if $.Values.global.nodeSelector }} - nodeselector: -{{ toYaml .Values.global.nodeSelector | indent 12 }} - {{- end }} - {{- if $.Values.global.tolerations }} - tolerations: -{{ toYaml .Values.global.tolerations | indent 12 }} - {{- end }} - restartPolicy: OnFailure -{{- end }} ---- -{{- if .Values.argocd_backup.enabled }} -{{ if semverCompare ">=1.21-0" .Capabilities.KubeVersion.GitVersion -}} -apiVersion: batch/v1 -{{ else -}} -apiVersion: batch/v1beta1 -{{ end -}} -kind: CronJob -metadata: - name: argocd-app-backup-cronjob - namespace: devtroncd -spec: - timeZone: {{ .Values.global.timezone | default "UTC" }} - schedule: "{{ .Values.global.schedule }}" - jobTemplate: - spec: - template: - {{- if or $.Values.postgres_backup.labels $.Values.postgres_backup.annotations }} - metadata: - {{- if $.Values.postgres_backup.labels }} - labels: - {{ toYaml .Values.postgres_backup.labels | indent 4 }} - {{- end }} - {{- if $.Values.postgres_backup.annotations }} - annotations: - {{ toYaml .Values.postgres_backup.annotations | indent 4 }} - {{- end }} - {{- end }} - spec: - initContainers: - - name: argocd-app-backup-job - image: {{ .Values.argocd_backup.argocdImage | default "quay.io/argoproj/argocd:v2.4.0" }} - volumeMounts: - - mountPath: /argocd - name: argocd-volume - imagePullPolicy: Always - args: - - /bin/bash - - -c - - {{ .Values.argocd_backup.args | default "argocd admin export -n devtroncd > /argocd/backup.yaml" }} - resources: -{{ toYaml .Values.argocd_backup.resources | indent 14 }} - containers: - - name: aws-cli-for-s3-upload - image: {{ .Values.global.S3.image | default "quay.io/devtron/k8s-utils:ubuntu-aws-cli-multi-arch-1" }} - volumeMounts: - - mountPath: /argocd - name: argocd-volume - env: - {{- if eq .Values.global.S3.NODE_ROLE "false" }} - - name: AWS_ACCESS_KEY_ID - valueFrom: - secretKeyRef: - name: devtron-s3-backup-secret - key: AWS_ACCESS_KEY - - name: AWS_SECRET_ACCESS_KEY - valueFrom: - secretKeyRef: - name: devtron-s3-backup-secret - key: AWS_SECRET_KEY - {{- end }} - - name: S3_BUCKET - valueFrom: - secretKeyRef: - name: devtron-s3-backup-secret - key: S3_BUCKET_NAME - - name: AWS_DEFAULT_REGION - valueFrom: - secretKeyRef: - name: devtron-s3-backup-secret - key: AWS_REGION - {{- if .Values.global.S3.CA_BUNDLE }} - - name: CA_BUNDLE - valueFrom: - secretKeyRef: - name: devtron-s3-backup-secret - key: AWS_CA_BUNDLE - {{- end }} - imagePullPolicy: Always - resources: -{{ toYaml .Values.argocd_backup.resources | indent 14 }} - args: - - /bin/bash - - -c - - | -{{ include "devtron.argocdBackup" . | indent 4 }} - volumes: - - name: argocd-volume - emptyDir: {} - {{- if $.Values.global.nodeSelector }} - nodeselector: -{{ toYaml .Values.global.nodeSelector | indent 12 }} - {{- end }} - {{- if $.Values.global.tolerations }} - tolerations: -{{ toYaml .Values.global.tolerations | indent 12 }} - {{- end }} - restartPolicy: OnFailure - serviceAccountName: {{ .Values.argocd_backup.serviceAccountName }} -{{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/devtron-utilities/charts/devtron-backups/templates/serviceaccount.yaml b/charts/devtron-utilities/charts/devtron-backups/templates/serviceaccount.yaml deleted file mode 100644 index 427a15f3a..000000000 --- a/charts/devtron-utilities/charts/devtron-backups/templates/serviceaccount.yaml +++ /dev/null @@ -1,51 +0,0 @@ -{{- if .Values.argocd_backup.enabled }} -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - app.kubernetes.io/name: {{ .Values.argocd_backup.serviceAccountName }} - name: {{ .Values.argocd_backup.serviceAccountName }} - namespace: devtroncd ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - labels: - app.kubernetes.io/name: {{ .Values.argocd_backup.serviceAccountName }} - name: {{ .Values.argocd_backup.serviceAccountName }} - namespace: devtroncd -rules: -- apiGroups: - - "" - resources: - - secrets - - configmaps - verbs: - - get - - list -- apiGroups: - - argoproj.io - resources: - - applications - - appprojects - - applicationsets - verbs: - - get - - list - - watch ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - labels: - app.kubernetes.io/name: {{ .Values.argocd_backup.serviceAccountName }} - name: {{ .Values.argocd_backup.serviceAccountName }} - namespace: devtroncd -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ .Values.argocd_backup.serviceAccountName }} -subjects: -- kind: ServiceAccount - name: {{ .Values.argocd_backup.serviceAccountName }} -{{- end }} \ No newline at end of file diff --git a/charts/devtron-utilities/charts/devtron-backups/values.yaml b/charts/devtron-utilities/charts/devtron-backups/values.yaml deleted file mode 100644 index a897ef0ab..000000000 --- a/charts/devtron-utilities/charts/devtron-backups/values.yaml +++ /dev/null @@ -1,110 +0,0 @@ -global: - # Twice a day - schedule: "0 */12 * * *" - # devtron-backups - S3: - # give the endpoint in case of non AWS storages with s3 protocol - enabled: false - S3_BUCKET_NAME: "" - S3_ACCESS_KEY: "" - S3_SECRET_KEY: "" - AWS_REGION: "" - S3_ENDPOINT: "" - CA_BUNDLE: "" - # CA_BUNDLE: "-----BEGIN CERTIFICATE-----\nMIIDcDfghjklcvbnm,tryupE+mz30g=\n-----END CERTIFICATE-----" - # set true if node has access of buckets - #defaults to true, set false and specify S3_ACCESS_KEY & S3_SECRET_KEY if node does not have bucket access - NODE_ROLE: "true" - # passphrase used to encrypt/decrypt the file (encryption is done by gpg) - encryption: - enabled: false - passphrase: "" - # image: quay.io/devtron/k8s-utils:ubuntu-aws-cli #default amd - # image: quay.io/devtron/k8s-utils:0b9f5ba5-395-11405 #arm - AZURE: - enabled: false - AZURE_BLOB_ACCOUNT_NAME: "" - AZURE_ACCOUNT_KEY: "" - AZURE_BLOB_CONTAINER_FOR_POSTGRES: "" - AZURE_BLOB_CONTAINER_FOR_ARGOCD: "" - encryption: - enabled: false # Recommended - passphrase: "" # Required if encryption is enabled - - # image: quay.io/devtron/k8s-utils:az-cli-ubuntu #amd - GCP: - enabled: false - GCS_BUCKET_NAME: "" # Required if GCP is enabled - CREDENTIALS: # Optional. Use only if in case node doesn't have permission to push over GCS. - enabled: false - # Only base64 Encoded JSON CREDENTIALS allowed. Example shown below. - # GCP_CREDENTIALS_JSON: "eyJ0eXBlIjogInNlcnZpY2VfYWNjb3VudCIsInByb2plY3RfaWQiOiAiPHlvdXItcHJvamVjdC1pZD4iLCJwcml2YXRlX2tleV9pZCI6ICI8eW91ci1wcml2YXRlLWtleS1pZD4iLCJwcml2YXRlX2tleSI6ICI8eW91ci1wcml2YXRlLWtleT4iLCJjbGllbnRfZW1haWwiOiAiPHlvdXItY2xpZW50LWVtYWlsPiIsImNsaWVudF9pZCI6ICI8eW91ci1jbGllbnQtaWQ+IiwiYXV0aF91cmkiOiAiaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tL28vb2F1dGgyL2F1dGgiLCJ0b2tlbl91cmkiOiAiaHR0cHM6Ly9vYXV0aDIuZ29vZ2xlYXBpcy5jb20vdG9rZW4iLCJhdXRoX3Byb3ZpZGVyX3g1MDlfY2VydF91cmwiOiAiaHR0cHM6Ly93d3cuZ29vZ2xlYXBpcy5jb20vb2F1dGgyL3YxL2NlcnRzIiwiY2xpZW50X3g1MDlfY2VydF91cmwiOiAiPHlvdXItY2xpZW50LWNlcnQtdXJsPiJ9Cg==" - GCP_CREDENTIALS_JSON: "" - - encryption: - enabled: false # Recommended - passphrase: "" # Required if encryption is enabled - # image: google/cloud-sdk:alpine # default amd - - PERSISTENCE: - enabled: false - existingClaim: "" - # size: 30Gi # Required if existingClaim is not used - storageClass: "" # Required if existingClaim is not used - encryption: - enabled: false # Recommended - passphrase: "" # Required if encryption is enabled - - # Taints and tolerations for both backups - tolerations: [] - # - key: "example-key" - # operator: "Equal" - # value: "example-value" - # effect: "NoSchedule" - nodeSelector: {} - # kubernetes.io/hostname: "worker-node-1" - - timezone: "" #Set the timezone for scheduling the cronJob. # default UTC - -argocdversion: v2 - -postgres_backup: - # Reference to secret which as postgresql password in PG_PASSWORD key - secretName: "devtron-secret" - enabled: true - resources: - requests: - cpu: 100m - memory: 100Mi - limits: - cpu: 100m - memory: 100Mi - labels: {} - # key: "example-value" - annotations: {} - # key: "example-value" - - # postgresImage: postgres:14 - # host: "postgresql-custom.devtroncd" - -argocd_backup: - serviceAccountName: "argocd-backup" - enabled: false - resources: - requests: - cpu: 100m - memory: 100Mi - limits: - cpu: 100m - memory: 100Mi - labels: {} - # key: "example-value" - annotations: {} - # key: "example-value" - - # argocdImage: quay.io/argoproj/argocd:v2.4.0 - # args: "argocd admin export -n devtroncd > /argocd/backup.yaml" - - # argocdImage: argoproj/argocd:v1.8.1 #(image for argo-V1) - # args: argocd-util export --namespace devtroncd > /argocd/backup.yaml; #(argo-V1) - diff --git a/charts/devtron-utilities/charts/devtron-generic-helm/Chart.yaml b/charts/devtron-utilities/charts/devtron-generic-helm/Chart.yaml deleted file mode 100644 index a7ae16ac9..000000000 --- a/charts/devtron-utilities/charts/devtron-generic-helm/Chart.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: v1 -appVersion: 0.1.0 -description: Chart to deploy any YAML file -maintainers: -- email: prashant@devtron.ai - name: Prashant -name: devtron-generic-helm -version: 0.10.1 diff --git a/charts/devtron-utilities/charts/devtron-generic-helm/README.md b/charts/devtron-utilities/charts/devtron-generic-helm/README.md deleted file mode 100644 index b2cb286fe..000000000 --- a/charts/devtron-utilities/charts/devtron-generic-helm/README.md +++ /dev/null @@ -1,8 +0,0 @@ -# Devtron helm chart to deploy any group of resources - -> Helm chart to deploy any resource on the cluster - -## Usage - -**The intended use of this chart is to use deploy group of resources in the cluster -each resource should be entered separately as element of array.** diff --git a/charts/devtron-utilities/charts/devtron-generic-helm/templates/generic.yaml b/charts/devtron-utilities/charts/devtron-generic-helm/templates/generic.yaml deleted file mode 100644 index 8c9d6f159..000000000 --- a/charts/devtron-utilities/charts/devtron-generic-helm/templates/generic.yaml +++ /dev/null @@ -1,4 +0,0 @@ -{{- range .Values.data }} ---- -{{ toYaml . }} -{{- end -}} diff --git a/charts/devtron-utilities/charts/devtron-generic-helm/values.yaml b/charts/devtron-utilities/charts/devtron-generic-helm/values.yaml deleted file mode 100644 index 385bb8e5f..000000000 --- a/charts/devtron-utilities/charts/devtron-generic-helm/values.yaml +++ /dev/null @@ -1,37 +0,0 @@ -data: -- apiVersion: v1 - kind: Service - metadata: - annotations: - labels: - app: sample-metrics-app - name: sample-metrics-app - namespace: default - spec: - ports: - - name: web - port: 80 - protocol: TCP - targetPort: 8080 - selector: - app: sample-metrics-app - sessionAffinity: None - type: ClusterIP -- apiVersion: v1 - kind: Service - metadata: - annotations: - labels: - app: sample-metrics-app - name: sample-metrics-app - namespace: default - spec: - ports: - - name: web - port: 80 - protocol: TCP - targetPort: 8080 - selector: - app: sample-metrics-app - sessionAffinity: None - type: ClusterIP diff --git a/charts/devtron-utilities/charts/holmes/.helmignore b/charts/devtron-utilities/charts/holmes/.helmignore deleted file mode 100644 index 0e8a0eb36..000000000 --- a/charts/devtron-utilities/charts/holmes/.helmignore +++ /dev/null @@ -1,23 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*.orig -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/charts/devtron-utilities/charts/holmes/Chart.yaml b/charts/devtron-utilities/charts/holmes/Chart.yaml deleted file mode 100644 index aa19ff861..000000000 --- a/charts/devtron-utilities/charts/holmes/Chart.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: v2 -appVersion: 0.8.1 -description: HolmesGPT Helm chart for Kubernetes -name: holmes -type: application -version: 0.8.1 diff --git a/charts/devtron-utilities/charts/holmes/templates/holmes.yaml b/charts/devtron-utilities/charts/holmes/templates/holmes.yaml deleted file mode 100644 index 1f4b16508..000000000 --- a/charts/devtron-utilities/charts/holmes/templates/holmes.yaml +++ /dev/null @@ -1,101 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ .Release.Name }}-holmes - namespace: {{ .Release.Namespace }} - labels: - app: holmes -spec: - replicas: 1 - selector: - matchLabels: - app: holmes - template: - metadata: - labels: - app: holmes - spec: - {{- if .Values.customServiceAccountName }} - serviceAccountName: {{ .Values.customServiceAccountName }} - {{ else }} - serviceAccountName: {{ .Release.Name }}-holmes-service-account - {{- end }} - {{- if .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml .Values.imagePullSecrets | nindent 6 }} - {{- end }} - {{- if .Values.affinity }} - affinity: {{ toYaml .Values.affinity | nindent 8 }} - {{- end }} - containers: - - name: holmes - image: "{{ .Values.registry }}/{{ .Values.image }}" - imagePullPolicy: Always - command: ["python3", "-u", "server.py"] - env: - - name: LOG_LEVEL - value: {{ .Values.logLevel }} - {{ if .Values.certificate -}} - - name: CERTIFICATE - value: {{ .Values.certificate }} - {{- end }} - {{ if .Values.enablePostProcessing -}} - - name: HOLMES_POST_PROCESSING_PROMPT - value: {{ .Values.postProcessingPrompt }} - {{- end }} - {{- if .Values.additionalEnvVars -}} - {{ toYaml .Values.additionalEnvVars | nindent 10 }} - {{- end }} - {{- if .Values.additional_env_vars -}} - {{ toYaml .Values.additional_env_vars | nindent 10 }} - {{- end }} - lifecycle: - preStop: - exec: - command: ["bash", "-c", "kill -SIGINT 1"] - volumeMounts: - - name: playbooks-config-secret - mountPath: /etc/robusta/config - - name: custom-toolsets-configmap - mountPath: /etc/holmes/config - {{- if .Values.additionalVolumeMounts -}} - {{ toYaml .Values.additionalVolumeMounts | nindent 10 }} - {{- end }} - resources: - requests: - cpu: {{ .Values.resources.requests.cpu }} - memory: {{ .Values.resources.requests.memory }} - limits: - memory: {{ .Values.resources.limits.memory }} - {{ if .Values.resources.limits.cpu }}cpu: {{ .Values.resources.limits.cpu | quote }}{{ end }} - {{- if .Values.tolerations }} - tolerations: {{ toYaml .Values.tolerations | nindent 8 }} - {{- end }} - volumes: - - name: playbooks-config-secret - secret: - secretName: robusta-playbooks-config-secret - optional: true - - name: custom-toolsets-configmap - configMap: - name: custom-toolsets-configmap - optional: true - {{- if .Values.additionalVolumes -}} - {{ toYaml .Values.additionalVolumes | nindent 8 }} - {{- end }} ---- -apiVersion: v1 -kind: Service -metadata: - name: {{ .Release.Name }}-holmes - namespace: {{ .Release.Namespace }} - labels: - app: holmes -spec: - selector: - app: holmes - ports: - - name: http - protocol: TCP - port: 80 - targetPort: 5050 diff --git a/charts/devtron-utilities/charts/holmes/templates/holmesgpt-service-account.yaml b/charts/devtron-utilities/charts/holmes/templates/holmesgpt-service-account.yaml deleted file mode 100644 index baee4e95f..000000000 --- a/charts/devtron-utilities/charts/holmes/templates/holmesgpt-service-account.yaml +++ /dev/null @@ -1,232 +0,0 @@ -{{- if .Values.createServiceAccount }} -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ .Release.Name }}-holmes-cluster-role - namespace : {{ .Release.Namespace }} -rules: - {{- if .Values.customClusterRoleRules }} -{{ toYaml .Values.customClusterRoleRules | indent 2 }} - {{- end }} - - apiGroups: - - "storage.k8s.io" - resources: - - storageclasses - verbs: - - list - - get - - watch - - apiGroups: - - "metrics.k8s.io" - resources: - - pods - - nodes - verbs: - - get - - list - - apiGroups: - - "" - resources: - - configmaps - - daemonsets - - deployments - - events - - namespaces - - persistentvolumes - - persistentvolumeclaims - - pods - - pods/status - - pods/log - - replicasets - - replicationcontrollers - - services - - serviceaccounts - - endpoints - verbs: - - get - - list - - watch - - - apiGroups: - - "" - resources: - - nodes - verbs: - - get - - list - - watch - - - apiGroups: - - "apiregistration.k8s.io" - resources: - - apiservices - verbs: - - get - - list - - - apiGroups: - - "rbac.authorization.k8s.io" - resources: - - clusterroles - - clusterrolebindings - verbs: - - get - - list - - watch - - apiGroups: - - "autoscaling" - resources: - - horizontalpodautoscalers - verbs: - - get - - list - - watch - - - apiGroups: - - apps - resources: - - daemonsets - - deployments - - deployments/scale - - replicasets - - replicasets/scale - - statefulsets - verbs: - - get - - list - - watch - - - apiGroups: - - extensions - resources: - - daemonsets - - deployments - - deployments/scale - - ingresses - - replicasets - - replicasets/scale - - replicationcontrollers/scale - verbs: - - get - - list - - watch - - - apiGroups: - - batch - resources: - - cronjobs - - jobs - verbs: - - get - - list - - watch - - - apiGroups: - - "events.k8s.io" - resources: - - events - verbs: - - get - - list - - - apiGroups: - - networking.k8s.io - resources: - - ingresses - - networkpolicies - verbs: - - get - - list - - watch - - apiGroups: - - autoscaling - resources: - - horizontalpodautoscalers - verbs: - - get - - list - - apiGroups: - - "policy" - resources: - - poddisruptionbudgets - - podsecuritypolicies - verbs: - - get - - list - - apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - - roles - - rolebindings - verbs: - - get - - list -{{- if .Values.openshift }} - - apiGroups: - - apps.openshift.io - resources: - - deploymentconfigs - verbs: - - get - - list - - watch -{{- end }} - # Prometheus CRDs - - apiGroups: - - monitoring.coreos.com - resources: - - alertmanagers - - alertmanagers/finalizers - - alertmanagers/status - - alertmanagerconfigs - - prometheuses - - prometheuses/finalizers - - prometheuses/status - - prometheusagents - - prometheusagents/finalizers - - prometheusagents/status - - thanosrulers - - thanosrulers/finalizers - - thanosrulers/status - - scrapeconfigs - - servicemonitors - - podmonitors - - probes - - prometheusrules - verbs: - - get - - list - - watch - ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ .Release.Name }}-holmes-service-account - namespace: {{ .Release.Namespace }} - {{- if .Values.serviceAccount.annotations }} - annotations: - {{- with .Values.serviceAccount.annotations }} - {{- toYaml . | nindent 4}} - {{- end }} - {{- end }} -{{- if .Values.serviceAccount.imagePullSecrets }} -imagePullSecrets: -{{- toYaml .Values.serviceAccount.imagePullSecrets | nindent 2}} -{{- end }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ .Release.Name }}-holmes-cluster-role-binding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ .Release.Name }}-holmes-cluster-role -subjects: - - kind: ServiceAccount - name: {{ .Release.Name }}-holmes-service-account - namespace: {{ .Release.Namespace }} -{{- end }} \ No newline at end of file diff --git a/charts/devtron-utilities/charts/holmes/templates/toolset-config.yaml b/charts/devtron-utilities/charts/holmes/templates/toolset-config.yaml deleted file mode 100644 index 06875aa01..000000000 --- a/charts/devtron-utilities/charts/holmes/templates/toolset-config.yaml +++ /dev/null @@ -1,10 +0,0 @@ -{{- if .Values.toolsets | not | empty }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: custom-toolsets-configmap - namespace: {{ .Release.Namespace }} -data: - custom_toolset.yaml: |- - toolsets: {{ toYaml .Values.toolsets | nindent 6 }} -{{- end }} diff --git a/charts/devtron-utilities/charts/holmes/values.yaml b/charts/devtron-utilities/charts/holmes/values.yaml deleted file mode 100644 index bc062ea01..000000000 --- a/charts/devtron-utilities/charts/holmes/values.yaml +++ /dev/null @@ -1,50 +0,0 @@ -certificate: "" # base64 encoded -logLevel: INFO - - -additionalEnvVars: [] -additional_env_vars: [] -imagePullSecrets: [] - -image: holmes:0.8.1 -registry: us-central1-docker.pkg.dev/genuine-flight-317411/devel - -enableAccountsCreate: true - -createServiceAccount: true -customServiceAccountName: "" - -customClusterRoleRules: [] - -enablePostProcessing: false -postProcessingPrompt: "builtin://generic_post_processing.jinja2" -openshift: false - -affinity: {} - -tolerations: [] - -serviceAccount: - imagePullSecrets: [] - annotations: {} - -toolsets: - kubernetes/core: - enabled: true - kubernetes/logs: - enabled: true - robusta: - enabled: true - internet: - enabled: true - - -resources: - requests: - cpu: 100m - memory: 1024Mi - limits: - memory: 1024Mi - -additionalVolumes: [] -additionalVolumeMounts: [] diff --git a/charts/devtron-utilities/charts/ingress-nginx/.helmignore b/charts/devtron-utilities/charts/ingress-nginx/.helmignore deleted file mode 100644 index 109b40811..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/.helmignore +++ /dev/null @@ -1,23 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ -__snapshot__ diff --git a/charts/devtron-utilities/charts/ingress-nginx/Chart.yaml b/charts/devtron-utilities/charts/ingress-nginx/Chart.yaml deleted file mode 100644 index 11000f43d..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/Chart.yaml +++ /dev/null @@ -1,24 +0,0 @@ -annotations: - artifacthub.io/changes: | - - 'CI: Fix chart testing. (#12258)' - - Update Ingress-Nginx version controller-v1.12.0 - artifacthub.io/prerelease: "false" -apiVersion: v2 -appVersion: 1.12.0 -description: Ingress controller for Kubernetes using NGINX as a reverse proxy and - load balancer -home: https://github.com/kubernetes/ingress-nginx -icon: https://upload.wikimedia.org/wikipedia/commons/thumb/c/c5/Nginx_logo.svg/500px-Nginx_logo.svg.png -keywords: -- ingress -- nginx -kubeVersion: '>=1.21.0-0' -maintainers: -- name: cpanato -- name: Gacko -- name: strongjz -- name: tao12345666333 -name: ingress-nginx -sources: -- https://github.com/kubernetes/ingress-nginx -version: 4.12.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/OWNERS b/charts/devtron-utilities/charts/ingress-nginx/OWNERS deleted file mode 100644 index 428474f63..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/OWNERS +++ /dev/null @@ -1,4 +0,0 @@ -# See the OWNERS docs: https://www.kubernetes.dev/docs/guide/owners - -labels: -- area/helm diff --git a/charts/devtron-utilities/charts/ingress-nginx/README.md b/charts/devtron-utilities/charts/ingress-nginx/README.md deleted file mode 100644 index 04b750fba..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/README.md +++ /dev/null @@ -1,564 +0,0 @@ -# ingress-nginx - -[ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer - -![Version: 4.12.0](https://img.shields.io/badge/Version-4.12.0-informational?style=flat-square) ![AppVersion: 1.12.0](https://img.shields.io/badge/AppVersion-1.12.0-informational?style=flat-square) - -To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources. - -This chart bootstraps an ingress-nginx deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. - -## Requirements - -Kubernetes: `>=1.21.0-0` - -## Get Repo Info - -```console -helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx -helm repo update -``` - -## Install Chart - -**Important:** only helm3 is supported - -```console -helm install [RELEASE_NAME] ingress-nginx/ingress-nginx -``` - -The command deploys ingress-nginx on the Kubernetes cluster in the default configuration. - -_See [configuration](#configuration) below._ - -_See [helm install](https://helm.sh/docs/helm/helm_install/) for command documentation._ - -## Uninstall Chart - -```console -helm uninstall [RELEASE_NAME] -``` - -This removes all the Kubernetes components associated with the chart and deletes the release. - -_See [helm uninstall](https://helm.sh/docs/helm/helm_uninstall/) for command documentation._ - -## Upgrading Chart - -```console -helm upgrade [RELEASE_NAME] [CHART] --install -``` - -_See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documentation._ - -### Migrating from stable/nginx-ingress - -There are two main ways to migrate a release from `stable/nginx-ingress` to `ingress-nginx/ingress-nginx` chart: - -1. For Nginx Ingress controllers used for non-critical services, the easiest method is to [uninstall](#uninstall-chart) the old release and [install](#install-chart) the new one -1. For critical services in production that require zero-downtime, you will want to: - 1. [Install](#install-chart) a second Ingress controller - 1. Redirect your DNS traffic from the old controller to the new controller - 1. Log traffic from both controllers during this changeover - 1. [Uninstall](#uninstall-chart) the old controller once traffic has fully drained from it - -Note that there are some different and upgraded configurations between the two charts, described by Rimas Mocevicius from JFrog in the "Upgrading to ingress-nginx Helm chart" section of [Migrating from Helm chart nginx-ingress to ingress-nginx](https://rimusz.net/migrating-to-ingress-nginx). As the `ingress-nginx/ingress-nginx` chart continues to update, you will want to check current differences by running [helm configuration](#configuration) commands on both charts. - -## Configuration - -See [Customizing the Chart Before Installing](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing). To see all configurable options with detailed comments, visit the chart's [values.yaml](./values.yaml), or run these configuration commands: - -```console -helm show values ingress-nginx/ingress-nginx -``` - -### PodDisruptionBudget - -Note that the PodDisruptionBudget resource will only be defined if the replicaCount is greater than one, -else it would make it impossible to evacuate a node. See [gh issue #7127](https://github.com/helm/charts/issues/7127) for more info. - -### Prometheus Metrics - -The Ingress-Nginx Controller can export Prometheus metrics, by setting `controller.metrics.enabled` to `true`. - -You can add Prometheus annotations to the metrics service using `controller.metrics.service.annotations`. -Alternatively, if you use the Prometheus Operator, you can enable ServiceMonitor creation using `controller.metrics.serviceMonitor.enabled`. And set `controller.metrics.serviceMonitor.additionalLabels.release="prometheus"`. "release=prometheus" should match the label configured in the prometheus servicemonitor ( see `kubectl get servicemonitor prometheus-kube-prom-prometheus -oyaml -n prometheus`) - -### ingress-nginx nginx\_status page/stats server - -Previous versions of this chart had a `controller.stats.*` configuration block, which is now obsolete due to the following changes in Ingress-Nginx Controller: - -- In [0.16.1](https://github.com/kubernetes/ingress-nginx/blob/main/Changelog.md#0161), the vts (virtual host traffic status) dashboard was removed -- In [0.23.0](https://github.com/kubernetes/ingress-nginx/blob/main/Changelog.md#0230), the status page at port 18080 is now a unix socket webserver only available at localhost. - You can use `curl --unix-socket /tmp/nginx-status-server.sock http://localhost/nginx_status` inside the controller container to access it locally, or use the snippet from [nginx-ingress changelog](https://github.com/kubernetes/ingress-nginx/blob/main/Changelog.md#0230) to re-enable the http server - -### ExternalDNS Service Configuration - -Add an [ExternalDNS](https://github.com/kubernetes-sigs/external-dns) annotation to the LoadBalancer service: - -```yaml -controller: - service: - annotations: - external-dns.alpha.kubernetes.io/hostname: kubernetes-example.com. -``` - -### AWS L7 ELB with SSL Termination - -Annotate the controller as shown in the [nginx-ingress l7 patch](https://github.com/kubernetes/ingress-nginx/blob/ab3a789caae65eec4ad6e3b46b19750b481b6bce/deploy/aws/l7/service-l7.yaml): - -```yaml -controller: - service: - targetPorts: - http: http - https: http - annotations: - service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:XX-XXXX-X:XXXXXXXXX:certificate/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX - service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "http" - service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" - service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: '3600' -``` - -### Additional Internal Load Balancer - -This setup is useful when you need both external and internal load balancers but don't want to have multiple ingress controllers and multiple ingress objects per application. - -By default, the ingress object will point to the external load balancer address, but if correctly configured, you can make use of the internal one if the URL you are looking up resolves to the internal load balancer's URL. - -You'll need to set both the following values: - -`controller.service.internal.enabled` -`controller.service.internal.annotations` - -If one of them is missing the internal load balancer will not be deployed. Example you may have `controller.service.internal.enabled=true` but no annotations set, in this case no action will be taken. - -`controller.service.internal.annotations` varies with the cloud service you're using. - -Example for AWS: - -```yaml -controller: - service: - internal: - enabled: true - annotations: - # Create internal NLB - service.beta.kubernetes.io/aws-load-balancer-scheme: "internal" - # Create internal ELB(Deprecated) - # service.beta.kubernetes.io/aws-load-balancer-internal: "true" - # Any other annotation can be declared here. -``` - -Example for GCE: - -```yaml -controller: - service: - internal: - enabled: true - annotations: - # Create internal LB. More information: https://cloud.google.com/kubernetes-engine/docs/how-to/internal-load-balancing - # For GKE versions 1.17 and later - networking.gke.io/load-balancer-type: "Internal" - # For earlier versions - # cloud.google.com/load-balancer-type: "Internal" - - # Any other annotation can be declared here. -``` - -Example for Azure: - -```yaml -controller: - service: - annotations: - # Create internal LB - service.beta.kubernetes.io/azure-load-balancer-internal: "true" - # Any other annotation can be declared here. -``` - -Example for Oracle Cloud Infrastructure: - -```yaml -controller: - service: - annotations: - # Create internal LB - service.beta.kubernetes.io/oci-load-balancer-internal: "true" - # Any other annotation can be declared here. -``` - -The load balancer annotations of more cloud service providers can be found: [Internal load balancer](https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer). - -An use case for this scenario is having a split-view DNS setup where the public zone CNAME records point to the external balancer URL while the private zone CNAME records point to the internal balancer URL. This way, you only need one ingress kubernetes object. - -Optionally you can set `controller.service.loadBalancerIP` if you need a static IP for the resulting `LoadBalancer`. - -### Ingress Admission Webhooks - -With nginx-ingress-controller version 0.25+, the Ingress-Nginx Controller pod exposes an endpoint that will integrate with the `validatingwebhookconfiguration` Kubernetes feature to prevent bad ingress from being added to the cluster. -**This feature is enabled by default since 0.31.0.** - -With nginx-ingress-controller in 0.25.* work only with kubernetes 1.14+, 0.26 fix [this issue](https://github.com/kubernetes/ingress-nginx/pull/4521) - -#### How the Chart Configures the Hooks -A validating and configuration requires the endpoint to which the request is sent to use TLS. It is possible to set up custom certificates to do this, but in most cases, a self-signed certificate is enough. The setup of this component requires some more complex orchestration when using helm. The steps are created to be idempotent and to allow turning the feature on and off without running into helm quirks. - -1. A pre-install hook provisions a certificate into the same namespace using a format compatible with provisioning using end user certificates. If the certificate already exists, the hook exits. -2. The Ingress-Nginx Controller pod is configured to use a TLS proxy container, which will load that certificate. -3. Validating and Mutating webhook configurations are created in the cluster. -4. A post-install hook reads the CA from the secret created by step 1 and patches the Validating and Mutating webhook configurations. This process will allow a custom CA provisioned by some other process to also be patched into the webhook configurations. The chosen failure policy is also patched into the webhook configurations - -#### Alternatives -It should be possible to use [cert-manager/cert-manager](https://github.com/cert-manager/cert-manager) if a more complete solution is required. - -You can enable automatic self-signed TLS certificate provisioning via cert-manager by setting the `controller.admissionWebhooks.certManager.enabled` value to true. - -Please ensure that cert-manager is correctly installed and configured. - -### Helm Error When Upgrading: spec.clusterIP: Invalid value: "" - -If you are upgrading this chart from a version between 0.31.0 and 1.2.2 then you may get an error like this: - -```console -Error: UPGRADE FAILED: Service "?????-controller" is invalid: spec.clusterIP: Invalid value: "": field is immutable -``` - -Detail of how and why are in [this issue](https://github.com/helm/charts/pull/13646) but to resolve this you can set `xxxx.service.omitClusterIP` to `true` where `xxxx` is the service referenced in the error. - -As of version `1.26.0` of this chart, by simply not providing any clusterIP value, `invalid: spec.clusterIP: Invalid value: "": field is immutable` will no longer occur since `clusterIP: ""` will not be rendered. - -### Pod Security Admission - -You can use Pod Security Admission by applying labels to the `ingress-nginx` namespace as instructed by the [documentation](https://kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-namespace-labels). - -Example: - -```yaml -apiVersion: v1 -kind: Namespace -metadata: - name: ingress-nginx - labels: - kubernetes.io/metadata.name: ingress-nginx - name: ingress-nginx - pod-security.kubernetes.io/enforce: restricted - pod-security.kubernetes.io/enforce-version: v1.31 -``` - -## Values - -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| commonLabels | object | `{}` | | -| controller.addHeaders | object | `{}` | Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers | -| controller.admissionWebhooks.annotations | object | `{}` | | -| controller.admissionWebhooks.certManager.admissionCert.duration | string | `""` | | -| controller.admissionWebhooks.certManager.enabled | bool | `false` | | -| controller.admissionWebhooks.certManager.rootCert.duration | string | `""` | | -| controller.admissionWebhooks.certificate | string | `"/usr/local/certificates/cert"` | | -| controller.admissionWebhooks.createSecretJob.name | string | `"create"` | | -| controller.admissionWebhooks.createSecretJob.resources | object | `{}` | | -| controller.admissionWebhooks.createSecretJob.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for secret creation containers | -| controller.admissionWebhooks.enabled | bool | `true` | | -| controller.admissionWebhooks.extraEnvs | list | `[]` | Additional environment variables to set | -| controller.admissionWebhooks.failurePolicy | string | `"Fail"` | Admission Webhook failure policy to use | -| controller.admissionWebhooks.key | string | `"/usr/local/certificates/key"` | | -| controller.admissionWebhooks.labels | object | `{}` | Labels to be added to admission webhooks | -| controller.admissionWebhooks.name | string | `"admission"` | | -| controller.admissionWebhooks.namespaceSelector | object | `{}` | | -| controller.admissionWebhooks.objectSelector | object | `{}` | | -| controller.admissionWebhooks.patch.enabled | bool | `true` | | -| controller.admissionWebhooks.patch.image.digest | string | `"sha256:aaafd456bda110628b2d4ca6296f38731a3aaf0bf7581efae824a41c770a8fc4"` | | -| controller.admissionWebhooks.patch.image.image | string | `"ingress-nginx/kube-webhook-certgen"` | | -| controller.admissionWebhooks.patch.image.pullPolicy | string | `"IfNotPresent"` | | -| controller.admissionWebhooks.patch.image.tag | string | `"v1.5.0"` | | -| controller.admissionWebhooks.patch.labels | object | `{}` | Labels to be added to patch job resources | -| controller.admissionWebhooks.patch.networkPolicy.enabled | bool | `false` | Enable 'networkPolicy' or not | -| controller.admissionWebhooks.patch.nodeSelector."kubernetes.io/os" | string | `"linux"` | | -| controller.admissionWebhooks.patch.podAnnotations | object | `{}` | | -| controller.admissionWebhooks.patch.priorityClassName | string | `""` | Provide a priority class name to the webhook patching job # | -| controller.admissionWebhooks.patch.rbac | object | `{"create":true}` | Admission webhook patch job RBAC | -| controller.admissionWebhooks.patch.rbac.create | bool | `true` | Create RBAC or not | -| controller.admissionWebhooks.patch.securityContext | object | `{}` | Security context for secret creation & webhook patch pods | -| controller.admissionWebhooks.patch.serviceAccount | object | `{"automountServiceAccountToken":true,"create":true,"name":""}` | Admission webhook patch job service account | -| controller.admissionWebhooks.patch.serviceAccount.automountServiceAccountToken | bool | `true` | Auto-mount service account token or not | -| controller.admissionWebhooks.patch.serviceAccount.create | bool | `true` | Create a service account or not | -| controller.admissionWebhooks.patch.serviceAccount.name | string | `""` | Custom service account name | -| controller.admissionWebhooks.patch.tolerations | list | `[]` | | -| controller.admissionWebhooks.patchWebhookJob.name | string | `"patch"` | | -| controller.admissionWebhooks.patchWebhookJob.resources | object | `{}` | | -| controller.admissionWebhooks.patchWebhookJob.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for webhook patch containers | -| controller.admissionWebhooks.port | int | `8443` | | -| controller.admissionWebhooks.service.annotations | object | `{}` | | -| controller.admissionWebhooks.service.externalIPs | list | `[]` | | -| controller.admissionWebhooks.service.loadBalancerSourceRanges | list | `[]` | | -| controller.admissionWebhooks.service.servicePort | int | `443` | | -| controller.admissionWebhooks.service.type | string | `"ClusterIP"` | | -| controller.affinity | object | `{}` | Affinity and anti-affinity rules for server scheduling to nodes # Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity # | -| controller.allowSnippetAnnotations | bool | `false` | This configuration defines if Ingress Controller should allow users to set their own *-snippet annotations, otherwise this is forbidden / dropped when users add those annotations. Global snippets in ConfigMap are still respected | -| controller.annotations | object | `{}` | Annotations to be added to the controller Deployment or DaemonSet # | -| controller.autoscaling.annotations | object | `{}` | | -| controller.autoscaling.behavior | object | `{}` | | -| controller.autoscaling.enabled | bool | `false` | | -| controller.autoscaling.maxReplicas | int | `11` | | -| controller.autoscaling.minReplicas | int | `1` | | -| controller.autoscaling.targetCPUUtilizationPercentage | int | `50` | | -| controller.autoscaling.targetMemoryUtilizationPercentage | int | `50` | | -| controller.autoscalingTemplate | list | `[]` | | -| controller.config | object | `{}` | Global configuration passed to the ConfigMap consumed by the controller. Values may contain Helm templates. Ref.: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/ | -| controller.configAnnotations | object | `{}` | Annotations to be added to the controller config configuration configmap. | -| controller.configMapNamespace | string | `""` | Allows customization of the configmap / nginx-configmap namespace; defaults to $(POD_NAMESPACE) | -| controller.containerName | string | `"controller"` | Configures the controller container name | -| controller.containerPort | object | `{"http":80,"https":443}` | Configures the ports that the nginx-controller listens on | -| controller.containerSecurityContext | object | `{}` | Security context for controller containers | -| controller.customTemplate.configMapKey | string | `""` | | -| controller.customTemplate.configMapName | string | `""` | | -| controller.disableLeaderElection | bool | `false` | This configuration disable Nginx Controller Leader Election | -| controller.dnsConfig | object | `{}` | Optionally customize the pod dnsConfig. | -| controller.dnsPolicy | string | `"ClusterFirst"` | Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'. By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller to keep resolving names inside the k8s network, use ClusterFirstWithHostNet. | -| controller.electionID | string | `""` | Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader' | -| controller.electionTTL | string | `""` | Duration a leader election is valid before it's getting re-elected, e.g. `15s`, `10m` or `1h`. (Default: 30s) | -| controller.enableAnnotationValidations | bool | `true` | | -| controller.enableMimalloc | bool | `true` | Enable mimalloc as a drop-in replacement for malloc. # ref: https://github.com/microsoft/mimalloc # | -| controller.enableTopologyAwareRouting | bool | `false` | This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-mode="auto" Defaults to false | -| controller.extraArgs | object | `{}` | Additional command line arguments to pass to Ingress-Nginx Controller E.g. to specify the default SSL certificate you can use | -| controller.extraContainers | list | `[]` | Additional containers to be added to the controller pod. See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example. | -| controller.extraEnvs | list | `[]` | Additional environment variables to set | -| controller.extraInitContainers | list | `[]` | Containers, which are run before the app containers are started. | -| controller.extraModules | list | `[]` | Modules, which are mounted into the core nginx image. | -| controller.extraVolumeMounts | list | `[]` | Additional volumeMounts to the controller main container. | -| controller.extraVolumes | list | `[]` | Additional volumes to the controller pod. | -| controller.healthCheckHost | string | `""` | Address to bind the health check endpoint. It is better to set this option to the internal node address if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode. | -| controller.healthCheckPath | string | `"/healthz"` | Path of the health check endpoint. All requests received on the port defined by the healthz-port parameter are forwarded internally to this path. | -| controller.hostAliases | list | `[]` | Optionally customize the pod hostAliases. | -| controller.hostNetwork | bool | `false` | Required for use with CNI based kubernetes installations (such as ones set up by kubeadm), since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920 is merged | -| controller.hostPort.enabled | bool | `false` | Enable 'hostPort' or not | -| controller.hostPort.ports.http | int | `80` | 'hostPort' http port | -| controller.hostPort.ports.https | int | `443` | 'hostPort' https port | -| controller.hostname | object | `{}` | Optionally customize the pod hostname. | -| controller.image.allowPrivilegeEscalation | bool | `false` | | -| controller.image.chroot | bool | `false` | | -| controller.image.digest | string | `"sha256:e6b8de175acda6ca913891f0f727bca4527e797d52688cbe9fec9040d6f6b6fa"` | | -| controller.image.digestChroot | string | `"sha256:87c88e1c38a6c8d4483c8f70b69e2cca49853bb3ec3124b9b1be648edf139af3"` | | -| controller.image.image | string | `"ingress-nginx/controller"` | | -| controller.image.pullPolicy | string | `"IfNotPresent"` | | -| controller.image.readOnlyRootFilesystem | bool | `false` | | -| controller.image.runAsGroup | int | `82` | This value must not be changed using the official image. uid=101(www-data) gid=82(www-data) groups=82(www-data) | -| controller.image.runAsNonRoot | bool | `true` | | -| controller.image.runAsUser | int | `101` | This value must not be changed using the official image. uid=101(www-data) gid=82(www-data) groups=82(www-data) | -| controller.image.seccompProfile.type | string | `"RuntimeDefault"` | | -| controller.image.tag | string | `"v1.12.0"` | | -| controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation | -| controller.ingressClassByName | bool | `false` | Process IngressClass per name (additionally as per spec.controller). | -| controller.ingressClassResource | object | `{"aliases":[],"annotations":{},"controllerValue":"k8s.io/ingress-nginx","default":false,"enabled":true,"name":"nginx","parameters":{}}` | This section refers to the creation of the IngressClass resource. IngressClasses are immutable and cannot be changed after creation. We do not support namespaced IngressClasses, yet, so a ClusterRole and a ClusterRoleBinding is required. | -| controller.ingressClassResource.aliases | list | `[]` | Aliases of this IngressClass. Creates copies with identical settings but the respective alias as name. Useful for development environments with only one Ingress Controller but production-like Ingress resources. `default` gets enabled on the original IngressClass only. | -| controller.ingressClassResource.annotations | object | `{}` | Annotations to be added to the IngressClass resource. | -| controller.ingressClassResource.controllerValue | string | `"k8s.io/ingress-nginx"` | Controller of the IngressClass. An Ingress Controller looks for IngressClasses it should reconcile by this value. This value is also being set as the `--controller-class` argument of this Ingress Controller. Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class | -| controller.ingressClassResource.default | bool | `false` | If true, Ingresses without `ingressClassName` get assigned to this IngressClass on creation. Ingress creation gets rejected if there are multiple default IngressClasses. Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#default-ingress-class | -| controller.ingressClassResource.enabled | bool | `true` | Create the IngressClass or not | -| controller.ingressClassResource.name | string | `"nginx"` | Name of the IngressClass | -| controller.ingressClassResource.parameters | object | `{}` | A link to a custom resource containing additional configuration for the controller. This is optional if the controller consuming this IngressClass does not require additional parameters. Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class | -| controller.keda.apiVersion | string | `"keda.sh/v1alpha1"` | | -| controller.keda.behavior | object | `{}` | | -| controller.keda.cooldownPeriod | int | `300` | | -| controller.keda.enabled | bool | `false` | | -| controller.keda.maxReplicas | int | `11` | | -| controller.keda.minReplicas | int | `1` | | -| controller.keda.pollingInterval | int | `30` | | -| controller.keda.restoreToOriginalReplicaCount | bool | `false` | | -| controller.keda.scaledObject.annotations | object | `{}` | | -| controller.keda.triggers | list | `[]` | | -| controller.kind | string | `"Deployment"` | Use a `DaemonSet` or `Deployment` | -| controller.labels | object | `{}` | Labels to be added to the controller Deployment or DaemonSet and other resources that do not have option to specify labels # | -| controller.lifecycle | object | `{"preStop":{"exec":{"command":["/wait-shutdown"]}}}` | Improve connection draining when ingress controller pod is deleted using a lifecycle hook: With this new hook, we increased the default terminationGracePeriodSeconds from 30 seconds to 300, allowing the draining of connections up to five minutes. If the active connections end before that, the pod will terminate gracefully at that time. To effectively take advantage of this feature, the Configmap feature worker-shutdown-timeout new value is 240s instead of 10s. # | -| controller.livenessProbe.failureThreshold | int | `5` | | -| controller.livenessProbe.httpGet.path | string | `"/healthz"` | | -| controller.livenessProbe.httpGet.port | int | `10254` | | -| controller.livenessProbe.httpGet.scheme | string | `"HTTP"` | | -| controller.livenessProbe.initialDelaySeconds | int | `10` | | -| controller.livenessProbe.periodSeconds | int | `10` | | -| controller.livenessProbe.successThreshold | int | `1` | | -| controller.livenessProbe.timeoutSeconds | int | `1` | | -| controller.maxmindLicenseKey | string | `""` | Maxmind license key to download GeoLite2 Databases. # https://blog.maxmind.com/2019/12/significant-changes-to-accessing-and-using-geolite2-databases/ | -| controller.metrics.enabled | bool | `false` | | -| controller.metrics.port | int | `10254` | | -| controller.metrics.portName | string | `"metrics"` | | -| controller.metrics.prometheusRule.additionalLabels | object | `{}` | | -| controller.metrics.prometheusRule.annotations | object | `{}` | Annotations to be added to the PrometheusRule. | -| controller.metrics.prometheusRule.enabled | bool | `false` | | -| controller.metrics.prometheusRule.rules | list | `[]` | | -| controller.metrics.service.annotations | object | `{}` | | -| controller.metrics.service.enabled | bool | `true` | Enable the metrics service or not. | -| controller.metrics.service.externalIPs | list | `[]` | List of IP addresses at which the stats-exporter service is available # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips # | -| controller.metrics.service.labels | object | `{}` | Labels to be added to the metrics service resource | -| controller.metrics.service.loadBalancerSourceRanges | list | `[]` | | -| controller.metrics.service.servicePort | int | `10254` | | -| controller.metrics.service.type | string | `"ClusterIP"` | | -| controller.metrics.serviceMonitor.additionalLabels | object | `{}` | | -| controller.metrics.serviceMonitor.annotations | object | `{}` | Annotations to be added to the ServiceMonitor. | -| controller.metrics.serviceMonitor.enabled | bool | `false` | | -| controller.metrics.serviceMonitor.metricRelabelings | list | `[]` | | -| controller.metrics.serviceMonitor.namespace | string | `""` | | -| controller.metrics.serviceMonitor.namespaceSelector | object | `{}` | | -| controller.metrics.serviceMonitor.relabelings | list | `[]` | | -| controller.metrics.serviceMonitor.scrapeInterval | string | `"30s"` | | -| controller.metrics.serviceMonitor.targetLabels | list | `[]` | | -| controller.minAvailable | int | `1` | Minimum available pods set in PodDisruptionBudget. Define either 'minAvailable' or 'maxUnavailable', never both. | -| controller.minReadySeconds | int | `0` | `minReadySeconds` to avoid killing pods before we are ready # | -| controller.name | string | `"controller"` | | -| controller.networkPolicy.enabled | bool | `false` | Enable 'networkPolicy' or not | -| controller.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for controller pod assignment # Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ # | -| controller.podAnnotations | object | `{}` | Annotations to be added to controller pods # | -| controller.podLabels | object | `{}` | Labels to add to the pod container metadata | -| controller.podSecurityContext | object | `{}` | Security context for controller pods | -| controller.priorityClassName | string | `""` | | -| controller.progressDeadlineSeconds | int | `0` | Specifies the number of seconds you want to wait for the controller deployment to progress before the system reports back that it has failed. Ref.: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#progress-deadline-seconds | -| controller.proxySetHeaders | object | `{}` | Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers | -| controller.publishService | object | `{"enabled":true,"pathOverride":""}` | Allows customization of the source of the IP address or FQDN to report in the ingress status field. By default, it reads the information provided by the service. If disable, the status field reports the IP address of the node or nodes where an ingress controller pod is running. | -| controller.publishService.enabled | bool | `true` | Enable 'publishService' or not | -| controller.publishService.pathOverride | string | `""` | Allows overriding of the publish service to bind to Must be / | -| controller.readinessProbe.failureThreshold | int | `3` | | -| controller.readinessProbe.httpGet.path | string | `"/healthz"` | | -| controller.readinessProbe.httpGet.port | int | `10254` | | -| controller.readinessProbe.httpGet.scheme | string | `"HTTP"` | | -| controller.readinessProbe.initialDelaySeconds | int | `10` | | -| controller.readinessProbe.periodSeconds | int | `10` | | -| controller.readinessProbe.successThreshold | int | `1` | | -| controller.readinessProbe.timeoutSeconds | int | `1` | | -| controller.replicaCount | int | `1` | | -| controller.reportNodeInternalIp | bool | `false` | Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network Ingress status was blank because there is no Service exposing the Ingress-Nginx Controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply | -| controller.resources.requests.cpu | string | `"100m"` | | -| controller.resources.requests.memory | string | `"90Mi"` | | -| controller.scope.enabled | bool | `false` | Enable 'scope' or not | -| controller.scope.namespace | string | `""` | Namespace to limit the controller to; defaults to $(POD_NAMESPACE) | -| controller.scope.namespaceSelector | string | `""` | When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces. | -| controller.service.annotations | object | `{}` | Annotations to be added to the external controller service. See `controller.service.internal.annotations` for annotations to be added to the internal controller service. | -| controller.service.appProtocol | bool | `true` | Declare the app protocol of the external HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol | -| controller.service.clusterIP | string | `""` | Pre-defined cluster internal IP address of the external controller service. Take care of collisions with existing services. This value is immutable. Set once, it can not be changed without deleting and re-creating the service. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address | -| controller.service.enableHttp | bool | `true` | Enable the HTTP listener on both controller services or not. | -| controller.service.enableHttps | bool | `true` | Enable the HTTPS listener on both controller services or not. | -| controller.service.enabled | bool | `true` | Enable controller services or not. This does not influence the creation of either the admission webhook or the metrics service. | -| controller.service.external.enabled | bool | `true` | Enable the external controller service or not. Useful for internal-only deployments. | -| controller.service.externalIPs | list | `[]` | List of node IP addresses at which the external controller service is available. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips | -| controller.service.externalTrafficPolicy | string | `""` | External traffic policy of the external controller service. Set to "Local" to preserve source IP on providers supporting it. Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip | -| controller.service.internal.annotations | object | `{}` | Annotations to be added to the internal controller service. Mandatory for the internal controller service to be created. Varies with the cloud service. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer | -| controller.service.internal.appProtocol | bool | `true` | Declare the app protocol of the internal HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol | -| controller.service.internal.clusterIP | string | `""` | Pre-defined cluster internal IP address of the internal controller service. Take care of collisions with existing services. This value is immutable. Set once, it can not be changed without deleting and re-creating the service. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address | -| controller.service.internal.enabled | bool | `false` | Enable the internal controller service or not. Remember to configure `controller.service.internal.annotations` when enabling this. | -| controller.service.internal.externalIPs | list | `[]` | List of node IP addresses at which the internal controller service is available. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips | -| controller.service.internal.externalTrafficPolicy | string | `""` | External traffic policy of the internal controller service. Set to "Local" to preserve source IP on providers supporting it. Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip | -| controller.service.internal.ipFamilies | list | `["IPv4"]` | List of IP families (e.g. IPv4, IPv6) assigned to the internal controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field. Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services | -| controller.service.internal.ipFamilyPolicy | string | `"SingleStack"` | Represents the dual-stack capabilities of the internal controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack. Fields `ipFamilies` and `clusterIP` depend on the value of this field. Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services | -| controller.service.internal.loadBalancerClass | string | `""` | Load balancer class of the internal controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class | -| controller.service.internal.loadBalancerIP | string | `""` | Deprecated: Pre-defined IP address of the internal controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer | -| controller.service.internal.loadBalancerSourceRanges | list | `[]` | Restrict access to the internal controller service. Values must be CIDRs. Allows any source address by default. | -| controller.service.internal.nodePorts.http | string | `""` | Node port allocated for the internal HTTP listener. If left empty, the service controller allocates one from the configured node port range. | -| controller.service.internal.nodePorts.https | string | `""` | Node port allocated for the internal HTTPS listener. If left empty, the service controller allocates one from the configured node port range. | -| controller.service.internal.nodePorts.tcp | object | `{}` | Node port mapping for internal TCP listeners. If left empty, the service controller allocates them from the configured node port range. Example: tcp: 8080: 30080 | -| controller.service.internal.nodePorts.udp | object | `{}` | Node port mapping for internal UDP listeners. If left empty, the service controller allocates them from the configured node port range. Example: udp: 53: 30053 | -| controller.service.internal.ports | object | `{}` | | -| controller.service.internal.sessionAffinity | string | `""` | Session affinity of the internal controller service. Must be either "None" or "ClientIP" if set. Defaults to "None". Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity | -| controller.service.internal.targetPorts | object | `{}` | | -| controller.service.internal.type | string | `""` | Type of the internal controller service. Defaults to the value of `controller.service.type`. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types | -| controller.service.ipFamilies | list | `["IPv4"]` | List of IP families (e.g. IPv4, IPv6) assigned to the external controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field. Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services | -| controller.service.ipFamilyPolicy | string | `"SingleStack"` | Represents the dual-stack capabilities of the external controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack. Fields `ipFamilies` and `clusterIP` depend on the value of this field. Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services | -| controller.service.labels | object | `{}` | Labels to be added to both controller services. | -| controller.service.loadBalancerClass | string | `""` | Load balancer class of the external controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class | -| controller.service.loadBalancerIP | string | `""` | Deprecated: Pre-defined IP address of the external controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer | -| controller.service.loadBalancerSourceRanges | list | `[]` | Restrict access to the external controller service. Values must be CIDRs. Allows any source address by default. | -| controller.service.nodePorts.http | string | `""` | Node port allocated for the external HTTP listener. If left empty, the service controller allocates one from the configured node port range. | -| controller.service.nodePorts.https | string | `""` | Node port allocated for the external HTTPS listener. If left empty, the service controller allocates one from the configured node port range. | -| controller.service.nodePorts.tcp | object | `{}` | Node port mapping for external TCP listeners. If left empty, the service controller allocates them from the configured node port range. Example: tcp: 8080: 30080 | -| controller.service.nodePorts.udp | object | `{}` | Node port mapping for external UDP listeners. If left empty, the service controller allocates them from the configured node port range. Example: udp: 53: 30053 | -| controller.service.ports.http | int | `80` | Port the external HTTP listener is published with. | -| controller.service.ports.https | int | `443` | Port the external HTTPS listener is published with. | -| controller.service.sessionAffinity | string | `""` | Session affinity of the external controller service. Must be either "None" or "ClientIP" if set. Defaults to "None". Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity | -| controller.service.targetPorts.http | string | `"http"` | Port of the ingress controller the external HTTP listener is mapped to. | -| controller.service.targetPorts.https | string | `"https"` | Port of the ingress controller the external HTTPS listener is mapped to. | -| controller.service.type | string | `"LoadBalancer"` | Type of the external controller service. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types | -| controller.shareProcessNamespace | bool | `false` | | -| controller.sysctls | object | `{}` | sysctls for controller pods # Ref: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ | -| controller.tcp.annotations | object | `{}` | Annotations to be added to the tcp config configmap | -| controller.tcp.configMapNamespace | string | `""` | Allows customization of the tcp-services-configmap; defaults to $(POD_NAMESPACE) | -| controller.terminationGracePeriodSeconds | int | `300` | `terminationGracePeriodSeconds` to avoid killing pods before we are ready # wait up to five minutes for the drain of connections # | -| controller.tolerations | list | `[]` | Node tolerations for server scheduling to nodes with taints # Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ # | -| controller.topologySpreadConstraints | list | `[]` | Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in. # Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ # | -| controller.udp.annotations | object | `{}` | Annotations to be added to the udp config configmap | -| controller.udp.configMapNamespace | string | `""` | Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE) | -| controller.unhealthyPodEvictionPolicy | string | `""` | Eviction policy for unhealthy pods guarded by PodDisruptionBudget. Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/ | -| controller.updateStrategy | object | `{}` | The update strategy to apply to the Deployment or DaemonSet # | -| controller.watchIngressWithoutClass | bool | `false` | Process Ingress objects without ingressClass annotation/ingressClassName field Overrides value for --watch-ingress-without-class flag of the controller binary Defaults to false | -| defaultBackend.affinity | object | `{}` | Affinity and anti-affinity rules for server scheduling to nodes # Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity | -| defaultBackend.autoscaling.annotations | object | `{}` | | -| defaultBackend.autoscaling.enabled | bool | `false` | | -| defaultBackend.autoscaling.maxReplicas | int | `2` | | -| defaultBackend.autoscaling.minReplicas | int | `1` | | -| defaultBackend.autoscaling.targetCPUUtilizationPercentage | int | `50` | | -| defaultBackend.autoscaling.targetMemoryUtilizationPercentage | int | `50` | | -| defaultBackend.containerSecurityContext | object | `{}` | Security context for default backend containers | -| defaultBackend.enabled | bool | `false` | | -| defaultBackend.extraArgs | object | `{}` | | -| defaultBackend.extraConfigMaps | list | `[]` | | -| defaultBackend.extraEnvs | list | `[]` | Additional environment variables to set for defaultBackend pods | -| defaultBackend.extraVolumeMounts | list | `[]` | | -| defaultBackend.extraVolumes | list | `[]` | | -| defaultBackend.image.allowPrivilegeEscalation | bool | `false` | | -| defaultBackend.image.image | string | `"defaultbackend-amd64"` | | -| defaultBackend.image.pullPolicy | string | `"IfNotPresent"` | | -| defaultBackend.image.readOnlyRootFilesystem | bool | `true` | | -| defaultBackend.image.runAsGroup | int | `65534` | | -| defaultBackend.image.runAsNonRoot | bool | `true` | | -| defaultBackend.image.runAsUser | int | `65534` | | -| defaultBackend.image.seccompProfile.type | string | `"RuntimeDefault"` | | -| defaultBackend.image.tag | string | `"1.5"` | | -| defaultBackend.labels | object | `{}` | Labels to be added to the default backend resources | -| defaultBackend.livenessProbe.failureThreshold | int | `3` | | -| defaultBackend.livenessProbe.initialDelaySeconds | int | `30` | | -| defaultBackend.livenessProbe.periodSeconds | int | `10` | | -| defaultBackend.livenessProbe.successThreshold | int | `1` | | -| defaultBackend.livenessProbe.timeoutSeconds | int | `5` | | -| defaultBackend.minAvailable | int | `1` | Minimum available pods set in PodDisruptionBudget. Define either 'minAvailable' or 'maxUnavailable', never both. | -| defaultBackend.minReadySeconds | int | `0` | `minReadySeconds` to avoid killing pods before we are ready # | -| defaultBackend.name | string | `"defaultbackend"` | | -| defaultBackend.networkPolicy.enabled | bool | `false` | Enable 'networkPolicy' or not | -| defaultBackend.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for default backend pod assignment # Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ # | -| defaultBackend.podAnnotations | object | `{}` | Annotations to be added to default backend pods # | -| defaultBackend.podLabels | object | `{}` | Labels to add to the pod container metadata | -| defaultBackend.podSecurityContext | object | `{}` | Security context for default backend pods | -| defaultBackend.port | int | `8080` | | -| defaultBackend.priorityClassName | string | `""` | | -| defaultBackend.readinessProbe.failureThreshold | int | `6` | | -| defaultBackend.readinessProbe.initialDelaySeconds | int | `0` | | -| defaultBackend.readinessProbe.periodSeconds | int | `5` | | -| defaultBackend.readinessProbe.successThreshold | int | `1` | | -| defaultBackend.readinessProbe.timeoutSeconds | int | `5` | | -| defaultBackend.replicaCount | int | `1` | | -| defaultBackend.resources | object | `{}` | | -| defaultBackend.service.annotations | object | `{}` | | -| defaultBackend.service.externalIPs | list | `[]` | List of IP addresses at which the default backend service is available # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips # | -| defaultBackend.service.loadBalancerSourceRanges | list | `[]` | | -| defaultBackend.service.servicePort | int | `80` | | -| defaultBackend.service.type | string | `"ClusterIP"` | | -| defaultBackend.serviceAccount.automountServiceAccountToken | bool | `true` | | -| defaultBackend.serviceAccount.create | bool | `true` | | -| defaultBackend.serviceAccount.name | string | `""` | | -| defaultBackend.tolerations | list | `[]` | Node tolerations for server scheduling to nodes with taints # Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ # | -| defaultBackend.topologySpreadConstraints | list | `[]` | Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in. Ref.: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ | -| defaultBackend.unhealthyPodEvictionPolicy | string | `""` | Eviction policy for unhealthy pods guarded by PodDisruptionBudget. Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/ | -| defaultBackend.updateStrategy | object | `{}` | The update strategy to apply to the Deployment or DaemonSet # | -| dhParam | string | `""` | A base64-encoded Diffie-Hellman parameter. This can be generated with: `openssl dhparam 4096 2> /dev/null | base64` # Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param | -| global.image.registry | string | `"registry.k8s.io"` | Registry host to pull images from. | -| imagePullSecrets | list | `[]` | Optional array of imagePullSecrets containing private registry credentials # Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ | -| namespaceOverride | string | `""` | Override the deployment namespace; defaults to .Release.Namespace | -| portNamePrefix | string | `""` | Prefix for TCP and UDP ports names in ingress controller service # Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration | -| rbac.create | bool | `true` | | -| rbac.scope | bool | `false` | | -| revisionHistoryLimit | int | `10` | Rollback limit # | -| serviceAccount.annotations | object | `{}` | Annotations for the controller service account | -| serviceAccount.automountServiceAccountToken | bool | `true` | | -| serviceAccount.create | bool | `true` | | -| serviceAccount.name | string | `""` | | -| tcp | object | `{}` | TCP service key-value pairs # Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md # | -| udp | object | `{}` | UDP service key-value pairs # Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md # | diff --git a/charts/devtron-utilities/charts/ingress-nginx/README.md.gotmpl b/charts/devtron-utilities/charts/ingress-nginx/README.md.gotmpl deleted file mode 100644 index 3cb9d5651..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/README.md.gotmpl +++ /dev/null @@ -1,247 +0,0 @@ -{{ template "chart.header" . }} -[ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer - -{{ template "chart.versionBadge" . }}{{ template "chart.typeBadge" . }}{{ template "chart.appVersionBadge" . }} - -To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources. - -This chart bootstraps an ingress-nginx deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. - -{{ template "chart.requirementsSection" . }} - -## Get Repo Info - -```console -helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx -helm repo update -``` - -## Install Chart - -**Important:** only helm3 is supported - -```console -helm install [RELEASE_NAME] ingress-nginx/ingress-nginx -``` - -The command deploys ingress-nginx on the Kubernetes cluster in the default configuration. - -_See [configuration](#configuration) below._ - -_See [helm install](https://helm.sh/docs/helm/helm_install/) for command documentation._ - -## Uninstall Chart - -```console -helm uninstall [RELEASE_NAME] -``` - -This removes all the Kubernetes components associated with the chart and deletes the release. - -_See [helm uninstall](https://helm.sh/docs/helm/helm_uninstall/) for command documentation._ - -## Upgrading Chart - -```console -helm upgrade [RELEASE_NAME] [CHART] --install -``` - -_See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documentation._ - -### Migrating from stable/nginx-ingress - -There are two main ways to migrate a release from `stable/nginx-ingress` to `ingress-nginx/ingress-nginx` chart: - -1. For Nginx Ingress controllers used for non-critical services, the easiest method is to [uninstall](#uninstall-chart) the old release and [install](#install-chart) the new one -1. For critical services in production that require zero-downtime, you will want to: - 1. [Install](#install-chart) a second Ingress controller - 1. Redirect your DNS traffic from the old controller to the new controller - 1. Log traffic from both controllers during this changeover - 1. [Uninstall](#uninstall-chart) the old controller once traffic has fully drained from it - -Note that there are some different and upgraded configurations between the two charts, described by Rimas Mocevicius from JFrog in the "Upgrading to ingress-nginx Helm chart" section of [Migrating from Helm chart nginx-ingress to ingress-nginx](https://rimusz.net/migrating-to-ingress-nginx). As the `ingress-nginx/ingress-nginx` chart continues to update, you will want to check current differences by running [helm configuration](#configuration) commands on both charts. - -## Configuration - -See [Customizing the Chart Before Installing](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing). To see all configurable options with detailed comments, visit the chart's [values.yaml](./values.yaml), or run these configuration commands: - -```console -helm show values ingress-nginx/ingress-nginx -``` - -### PodDisruptionBudget - -Note that the PodDisruptionBudget resource will only be defined if the replicaCount is greater than one, -else it would make it impossible to evacuate a node. See [gh issue #7127](https://github.com/helm/charts/issues/7127) for more info. - -### Prometheus Metrics - -The Ingress-Nginx Controller can export Prometheus metrics, by setting `controller.metrics.enabled` to `true`. - -You can add Prometheus annotations to the metrics service using `controller.metrics.service.annotations`. -Alternatively, if you use the Prometheus Operator, you can enable ServiceMonitor creation using `controller.metrics.serviceMonitor.enabled`. And set `controller.metrics.serviceMonitor.additionalLabels.release="prometheus"`. "release=prometheus" should match the label configured in the prometheus servicemonitor ( see `kubectl get servicemonitor prometheus-kube-prom-prometheus -oyaml -n prometheus`) - -### ingress-nginx nginx\_status page/stats server - -Previous versions of this chart had a `controller.stats.*` configuration block, which is now obsolete due to the following changes in Ingress-Nginx Controller: - -- In [0.16.1](https://github.com/kubernetes/ingress-nginx/blob/main/Changelog.md#0161), the vts (virtual host traffic status) dashboard was removed -- In [0.23.0](https://github.com/kubernetes/ingress-nginx/blob/main/Changelog.md#0230), the status page at port 18080 is now a unix socket webserver only available at localhost. - You can use `curl --unix-socket /tmp/nginx-status-server.sock http://localhost/nginx_status` inside the controller container to access it locally, or use the snippet from [nginx-ingress changelog](https://github.com/kubernetes/ingress-nginx/blob/main/Changelog.md#0230) to re-enable the http server - -### ExternalDNS Service Configuration - -Add an [ExternalDNS](https://github.com/kubernetes-sigs/external-dns) annotation to the LoadBalancer service: - -```yaml -controller: - service: - annotations: - external-dns.alpha.kubernetes.io/hostname: kubernetes-example.com. -``` - -### AWS L7 ELB with SSL Termination - -Annotate the controller as shown in the [nginx-ingress l7 patch](https://github.com/kubernetes/ingress-nginx/blob/ab3a789caae65eec4ad6e3b46b19750b481b6bce/deploy/aws/l7/service-l7.yaml): - -```yaml -controller: - service: - targetPorts: - http: http - https: http - annotations: - service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:XX-XXXX-X:XXXXXXXXX:certificate/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX - service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "http" - service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" - service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: '3600' -``` - -### Additional Internal Load Balancer - -This setup is useful when you need both external and internal load balancers but don't want to have multiple ingress controllers and multiple ingress objects per application. - -By default, the ingress object will point to the external load balancer address, but if correctly configured, you can make use of the internal one if the URL you are looking up resolves to the internal load balancer's URL. - -You'll need to set both the following values: - -`controller.service.internal.enabled` -`controller.service.internal.annotations` - -If one of them is missing the internal load balancer will not be deployed. Example you may have `controller.service.internal.enabled=true` but no annotations set, in this case no action will be taken. - -`controller.service.internal.annotations` varies with the cloud service you're using. - -Example for AWS: - -```yaml -controller: - service: - internal: - enabled: true - annotations: - # Create internal NLB - service.beta.kubernetes.io/aws-load-balancer-scheme: "internal" - # Create internal ELB(Deprecated) - # service.beta.kubernetes.io/aws-load-balancer-internal: "true" - # Any other annotation can be declared here. -``` - -Example for GCE: - -```yaml -controller: - service: - internal: - enabled: true - annotations: - # Create internal LB. More information: https://cloud.google.com/kubernetes-engine/docs/how-to/internal-load-balancing - # For GKE versions 1.17 and later - networking.gke.io/load-balancer-type: "Internal" - # For earlier versions - # cloud.google.com/load-balancer-type: "Internal" - - # Any other annotation can be declared here. -``` - -Example for Azure: - -```yaml -controller: - service: - annotations: - # Create internal LB - service.beta.kubernetes.io/azure-load-balancer-internal: "true" - # Any other annotation can be declared here. -``` - -Example for Oracle Cloud Infrastructure: - -```yaml -controller: - service: - annotations: - # Create internal LB - service.beta.kubernetes.io/oci-load-balancer-internal: "true" - # Any other annotation can be declared here. -``` - -The load balancer annotations of more cloud service providers can be found: [Internal load balancer](https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer). - -An use case for this scenario is having a split-view DNS setup where the public zone CNAME records point to the external balancer URL while the private zone CNAME records point to the internal balancer URL. This way, you only need one ingress kubernetes object. - -Optionally you can set `controller.service.loadBalancerIP` if you need a static IP for the resulting `LoadBalancer`. - -### Ingress Admission Webhooks - -With nginx-ingress-controller version 0.25+, the Ingress-Nginx Controller pod exposes an endpoint that will integrate with the `validatingwebhookconfiguration` Kubernetes feature to prevent bad ingress from being added to the cluster. -**This feature is enabled by default since 0.31.0.** - -With nginx-ingress-controller in 0.25.* work only with kubernetes 1.14+, 0.26 fix [this issue](https://github.com/kubernetes/ingress-nginx/pull/4521) - -#### How the Chart Configures the Hooks -A validating and configuration requires the endpoint to which the request is sent to use TLS. It is possible to set up custom certificates to do this, but in most cases, a self-signed certificate is enough. The setup of this component requires some more complex orchestration when using helm. The steps are created to be idempotent and to allow turning the feature on and off without running into helm quirks. - -1. A pre-install hook provisions a certificate into the same namespace using a format compatible with provisioning using end user certificates. If the certificate already exists, the hook exits. -2. The Ingress-Nginx Controller pod is configured to use a TLS proxy container, which will load that certificate. -3. Validating and Mutating webhook configurations are created in the cluster. -4. A post-install hook reads the CA from the secret created by step 1 and patches the Validating and Mutating webhook configurations. This process will allow a custom CA provisioned by some other process to also be patched into the webhook configurations. The chosen failure policy is also patched into the webhook configurations - -#### Alternatives -It should be possible to use [cert-manager/cert-manager](https://github.com/cert-manager/cert-manager) if a more complete solution is required. - -You can enable automatic self-signed TLS certificate provisioning via cert-manager by setting the `controller.admissionWebhooks.certManager.enabled` value to true. - -Please ensure that cert-manager is correctly installed and configured. - -### Helm Error When Upgrading: spec.clusterIP: Invalid value: "" - -If you are upgrading this chart from a version between 0.31.0 and 1.2.2 then you may get an error like this: - -```console -Error: UPGRADE FAILED: Service "?????-controller" is invalid: spec.clusterIP: Invalid value: "": field is immutable -``` - -Detail of how and why are in [this issue](https://github.com/helm/charts/pull/13646) but to resolve this you can set `xxxx.service.omitClusterIP` to `true` where `xxxx` is the service referenced in the error. - -As of version `1.26.0` of this chart, by simply not providing any clusterIP value, `invalid: spec.clusterIP: Invalid value: "": field is immutable` will no longer occur since `clusterIP: ""` will not be rendered. - -### Pod Security Admission - -You can use Pod Security Admission by applying labels to the `ingress-nginx` namespace as instructed by the [documentation](https://kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-namespace-labels). - -Example: - -```yaml -apiVersion: v1 -kind: Namespace -metadata: - name: ingress-nginx - labels: - kubernetes.io/metadata.name: ingress-nginx - name: ingress-nginx - pod-security.kubernetes.io/enforce: restricted - pod-security.kubernetes.io/enforce-version: v1.31 -``` - -{{ template "chart.valuesSection" . }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.10.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.10.0.md deleted file mode 100644 index b42d6c28b..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.10.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 2.10.0 - -* [#5843](https://github.com/kubernetes/ingress-nginx/pull/5843) Update jettech/kube-webhook-certgen image - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.9.1...ingress-nginx-2.10.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.0.md deleted file mode 100644 index e549b3867..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.0.md +++ /dev/null @@ -1,10 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 2.11.0 - -* [#5879](https://github.com/kubernetes/ingress-nginx/pull/5879) Update helm chart for v0.34.0 -* [#5671](https://github.com/kubernetes/ingress-nginx/pull/5671) Make liveness probe more fault tolerant than readiness probe - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.10.0...ingress-nginx-2.11.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.1.md deleted file mode 100644 index d910d3bf4..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.1.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 2.11.1 - -* [#5900](https://github.com/kubernetes/ingress-nginx/pull/5900) Release helm chart for v0.34.1 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.11.0...ingress-nginx-2.11.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.2.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.2.md deleted file mode 100644 index 9f7821005..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.2.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 2.11.2 - -* [#5951](https://github.com/kubernetes/ingress-nginx/pull/5951) Bump chart patch version - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.11.1...ingress-nginx-2.11.2 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.3.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.3.md deleted file mode 100644 index 344769163..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.11.3.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 2.11.3 - -* [#6038](https://github.com/kubernetes/ingress-nginx/pull/6038) Bump chart version PATCH - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.11.2...ingress-nginx-2.11.3 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.12.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.12.0.md deleted file mode 100644 index 5cb3888aa..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.12.0.md +++ /dev/null @@ -1,10 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 2.12.0 - -* [#6039](https://github.com/kubernetes/ingress-nginx/pull/6039) Add configurable serviceMonitor metricRelabelling and targetLabels -* [#6044](https://github.com/kubernetes/ingress-nginx/pull/6044) Fix YAML linting - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.11.3...ingress-nginx-2.12.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.12.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.12.1.md deleted file mode 100644 index 94d121db5..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.12.1.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 2.12.1 - -* [#6075](https://github.com/kubernetes/ingress-nginx/pull/6075) Sync helm chart affinity examples - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.12.0...ingress-nginx-2.12.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.13.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.13.0.md deleted file mode 100644 index 01fe0b15d..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.13.0.md +++ /dev/null @@ -1,10 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 2.13.0 - -* [#6093](https://github.com/kubernetes/ingress-nginx/pull/6093) Release v0.35.0 -* [#6080](https://github.com/kubernetes/ingress-nginx/pull/6080) Switch images to k8s.gcr.io after Vanity Domain Flip - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.12.1...ingress-nginx-2.13.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.14.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.14.0.md deleted file mode 100644 index 2fb7a5a76..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.14.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 2.14.0 - -* [#6104](https://github.com/kubernetes/ingress-nginx/pull/6104) Misc fixes for nginx-ingress chart for better keel and prometheus-operator integration - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.13.0...ingress-nginx-2.14.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.15.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.15.0.md deleted file mode 100644 index 543a55927..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.15.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 2.15.0 - -* [#6087](https://github.com/kubernetes/ingress-nginx/pull/6087) Adding parameter for externalTrafficPolicy in internal controller service spec - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.14.0...ingress-nginx-2.15.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.16.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.16.0.md deleted file mode 100644 index 996f4489e..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.16.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 2.16.0 - -* [#6154](https://github.com/kubernetes/ingress-nginx/pull/6154) add `topologySpreadConstraint` to controller - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.15.0...ingress-nginx-2.16.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.9.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.9.0.md deleted file mode 100644 index 11c5f5fed..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.9.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 2.9.0 - -* [#5795](https://github.com/kubernetes/ingress-nginx/pull/5795) Use fully qualified images to avoid cri-o issues - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-TODO...ingress-nginx-2.9.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.9.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.9.1.md deleted file mode 100644 index 7d4314d9c..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-2.9.1.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 2.9.1 - -* [#5823](https://github.com/kubernetes/ingress-nginx/pull/5823) Add quoting to sysctls because numeric values need to be presented as strings (#5823) - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.9.0...ingress-nginx-2.9.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.0.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.0.0.md deleted file mode 100644 index a7d50ee3a..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.0.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.0.0 - -* [#6167](https://github.com/kubernetes/ingress-nginx/pull/6167) Update chart requirements - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-2.16.0...ingress-nginx-3.0.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.10.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.10.0.md deleted file mode 100644 index 3369bed03..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.10.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.10.0 - -* Fix routing regression introduced in 0.41.0 with PathType Exact - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.9.0...ingress-nginx-3.10.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.10.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.10.1.md deleted file mode 100644 index 6ff682e52..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.10.1.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.10.1 - -* Fix regression introduced in 0.41.0 with external authentication - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.10.0...ingress-nginx-3.10.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.11.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.11.0.md deleted file mode 100644 index 69ba5506b..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.11.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.11.0 - -* Support Keda Autoscaling - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.10.1...ingress-nginx-3.11.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.11.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.11.1.md deleted file mode 100644 index 4e81f4b41..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.11.1.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.11.1 - -* [#6505](https://github.com/kubernetes/ingress-nginx/pull/6505) Reorder HPA resource list to work with GitOps tooling - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.11.0...ingress-nginx-3.11.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.12.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.12.0.md deleted file mode 100644 index 41b9744de..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.12.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.12.0 - -* [#6514](https://github.com/kubernetes/ingress-nginx/pull/6514) Remove helm2 support and update docs - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.11.1...ingress-nginx-3.12.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.13.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.13.0.md deleted file mode 100644 index 0855a7913..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.13.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.13.0 - -* [#6544](https://github.com/kubernetes/ingress-nginx/pull/6544) Fix default backend HPA name variable - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.12.0...ingress-nginx-3.13.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.14.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.14.0.md deleted file mode 100644 index e07880bf4..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.14.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.14.0 - -* [#6469](https://github.com/kubernetes/ingress-nginx/pull/6469) Allow custom service names for controller and backend - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.13.0...ingress-nginx-3.14.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.15.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.15.0.md deleted file mode 100644 index 3053a3548..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.15.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.15.0 - -* [#6586](https://github.com/kubernetes/ingress-nginx/pull/6586) Fix 'maxmindLicenseKey' location in values.yaml - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.14.0...ingress-nginx-3.15.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.15.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.15.1.md deleted file mode 100644 index f11ee0a76..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.15.1.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.15.1 - -* Fix chart-releaser action - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.15.0...ingress-nginx-3.15.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.16.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.16.0.md deleted file mode 100644 index fba30b171..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.16.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.16.0 - -* [#6646](https://github.com/kubernetes/ingress-nginx/pull/6646) Added LoadBalancerIP value for internal service - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.15.1...helm-chart-3.16.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.16.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.16.1.md deleted file mode 100644 index 650d1b8fa..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.16.1.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.16.1 - -* Fix chart-releaser action - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.16.0...helm-chart-3.16.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.17.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.17.0.md deleted file mode 100644 index 175c7a264..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.17.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.17.0 - -* Update ingress-nginx v0.42.0 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.16.1...helm-chart-3.17.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.18.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.18.0.md deleted file mode 100644 index 31b815e4e..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.18.0.md +++ /dev/null @@ -1,10 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.18.0 - -* [#6688](https://github.com/kubernetes/ingress-nginx/pull/6688) Allow volume-type emptyDir in controller podsecuritypolicy -* [#6691](https://github.com/kubernetes/ingress-nginx/pull/6691) Improve parsing of helm parameters - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.17.0...helm-chart-3.18.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.19.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.19.0.md deleted file mode 100644 index 0970bf02c..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.19.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.19.0 - -* Update ingress-nginx v0.43.0 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.18.0...helm-chart-3.19.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.20.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.20.0.md deleted file mode 100644 index 4b81ae42f..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.20.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.20.0 - -* [#6730](https://github.com/kubernetes/ingress-nginx/pull/6730) Do not create HPA for defaultBackend if not enabled. - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.19.0...helm-chart-3.20.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.20.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.20.1.md deleted file mode 100644 index 952bf2bd3..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.20.1.md +++ /dev/null @@ -1,10 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.20.1 - -* Do not create KEDA in case of DaemonSets. -* Fix KEDA v2 definition - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.20.0...helm-chart-3.20.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.21.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.21.0.md deleted file mode 100644 index 25edbefd9..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.21.0.md +++ /dev/null @@ -1,12 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.21.0 - -* [#6783](https://github.com/kubernetes/ingress-nginx/pull/6783) Add custom annotations to ScaledObject -* [#6761](https://github.com/kubernetes/ingress-nginx/pull/6761) Adding quotes in the serviceAccount name in Helm values -* [#6767](https://github.com/kubernetes/ingress-nginx/pull/6767) Remove ClusterRole when scope option is enabled -* [#6785](https://github.com/kubernetes/ingress-nginx/pull/6785) Update kube-webhook-certgen image to v1.5.1 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.20.1...helm-chart-3.21.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.22.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.22.0.md deleted file mode 100644 index 147d66421..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.22.0.md +++ /dev/null @@ -1,10 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.22.0 - -* [#6802](https://github.com/kubernetes/ingress-nginx/pull/6802) Add value for configuring a custom Diffie-Hellman parameters file -* [#6815](https://github.com/kubernetes/ingress-nginx/pull/6815) Allow use of numeric namespaces in helm chart - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.21.0...helm-chart-3.22.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.23.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.23.0.md deleted file mode 100644 index 5dcb50fa8..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.23.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.23.0 - -* Update ingress-nginx v0.44.0 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.22.0...helm-chart-3.23.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.24.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.24.0.md deleted file mode 100644 index d7db808b1..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.24.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.24.0 - -* [#6908](https://github.com/kubernetes/ingress-nginx/pull/6908) Add volumes to default-backend deployment - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.23.0...helm-chart-3.24.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.25.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.25.0.md deleted file mode 100644 index f9679a124..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.25.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.25.0 - -* [#6957](https://github.com/kubernetes/ingress-nginx/pull/6957) Add ability to specify automountServiceAccountToken - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.24.0...helm-chart-3.25.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.26.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.26.0.md deleted file mode 100644 index 0c3a1df68..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.26.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.26.0 - -* [#6979](https://github.com/kubernetes/ingress-nginx/pull/6979) Changed servicePort value for metrics - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.25.0...helm-chart-3.26.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.27.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.27.0.md deleted file mode 100644 index 8113d7b9b..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.27.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.27.0 - -* Update ingress-nginx v0.45.0 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.26.0...helm-chart-3.27.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.28.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.28.0.md deleted file mode 100644 index eee0ccbec..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.28.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.28.0 - -* [#6900](https://github.com/kubernetes/ingress-nginx/pull/6900) Support existing PSPs - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.27.0...helm-chart-3.28.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.29.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.29.0.md deleted file mode 100644 index f0fabdce1..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.29.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.29.0 - -* [#6945](https://github.com/kubernetes/ingress-nginx/pull/7020) Add option to specify job label for ServiceMonitor - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.28.0...helm-chart-3.29.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.3.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.3.0.md deleted file mode 100644 index 09fab3756..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.3.0.md +++ /dev/null @@ -1,12 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.3.0 - -* [#6203](https://github.com/kubernetes/ingress-nginx/pull/6203) Refactor parsing of key values -* [#6162](https://github.com/kubernetes/ingress-nginx/pull/6162) Add helm chart options to expose metrics service as NodePort -* [#6180](https://github.com/kubernetes/ingress-nginx/pull/6180) Fix helm chart admissionReviewVersions regression -* [#6169](https://github.com/kubernetes/ingress-nginx/pull/6169) Fix Typo in example prometheus rules - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.0.0...ingress-nginx-3.3.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.3.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.3.1.md deleted file mode 100644 index 81f44fdbd..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.3.1.md +++ /dev/null @@ -1,12 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.3.1 - -* [#6259](https://github.com/kubernetes/ingress-nginx/pull/6259) Release helm chart -* [#6258](https://github.com/kubernetes/ingress-nginx/pull/6258) Fix chart markdown link -* [#6253](https://github.com/kubernetes/ingress-nginx/pull/6253) Release v0.40.0 -* [#6233](https://github.com/kubernetes/ingress-nginx/pull/6233) Add admission controller e2e test - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.3.0...ingress-nginx-3.3.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.30.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.30.0.md deleted file mode 100644 index 77ad6b41b..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.30.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.30.0 - -* [#7092](https://github.com/kubernetes/ingress-nginx/pull/7092) Removes the possibility of using localhost in ExternalNames as endpoints - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.29.0...helm-chart-3.30.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.31.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.31.0.md deleted file mode 100644 index bc07fed76..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.31.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.31.0 - -* [7137] https://github.com/kubernetes/ingress-nginx/pull/7137 Add support for custom probes - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.30.0...helm-chart-3.31.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.32.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.32.0.md deleted file mode 100644 index 68f7ed6b2..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.32.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.32.0 - -* [7117] https://github.com/kubernetes/ingress-nginx/pull/7117 Add annotations for HPA - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.31.0...helm-chart-3.32.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.33.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.33.0.md deleted file mode 100644 index b56c5fc1e..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.33.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.33.0 - -* [7164] https://github.com/kubernetes/ingress-nginx/pull/7164 Update nginx to v1.20.1 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.32.0...helm-chart-3.33.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.34.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.34.0.md deleted file mode 100644 index a28cd0282..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.34.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.34.0 - -* [7256] https://github.com/kubernetes/ingress-nginx/pull/7256 Add namespace field in the namespace scoped resource templates - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.33.0...helm-chart-3.34.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.4.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.4.0.md deleted file mode 100644 index 3b4ca9353..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.4.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.4.0 - -* [#6268](https://github.com/kubernetes/ingress-nginx/pull/6268) Update to 0.40.2 in helm chart #6288 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.3.1...ingress-nginx-3.4.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.5.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.5.0.md deleted file mode 100644 index 44991b3bb..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.5.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.5.0 - -* [#6260](https://github.com/kubernetes/ingress-nginx/pull/6260) Allow Helm Chart to customize admission webhook's annotations, timeoutSeconds, namespaceSelector, objectSelector and cert files locations - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.4.0...ingress-nginx-3.5.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.5.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.5.1.md deleted file mode 100644 index 740f00c45..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.5.1.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.5.1 - -* [#6299](https://github.com/kubernetes/ingress-nginx/pull/6299) Fix helm chart release - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.5.0...ingress-nginx-3.5.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.6.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.6.0.md deleted file mode 100644 index 4af7f11a1..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.6.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.6.0 - -* [#6305](https://github.com/kubernetes/ingress-nginx/pull/6305) Add default linux nodeSelector - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.5.1...ingress-nginx-3.6.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.7.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.7.0.md deleted file mode 100644 index a6b12994b..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.7.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.7.0 - -* [#6316](https://github.com/kubernetes/ingress-nginx/pull/6316) Numerals in podAnnotations in quotes [#6315](https://github.com/kubernetes/ingress-nginx/issues/6315) - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.6.0...ingress-nginx-3.7.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.7.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.7.1.md deleted file mode 100644 index 6ba12df91..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.7.1.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.7.1 - -* [#6326](https://github.com/kubernetes/ingress-nginx/pull/6326) Fix liveness and readiness probe path in daemonset chart - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.7.0...ingress-nginx-3.7.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.8.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.8.0.md deleted file mode 100644 index 8df250a98..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.8.0.md +++ /dev/null @@ -1,13 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.8.0 - -* [#6395](https://github.com/kubernetes/ingress-nginx/pull/6395) Update jettech/kube-webhook-certgen image -* [#6377](https://github.com/kubernetes/ingress-nginx/pull/6377) Added loadBalancerSourceRanges for internal lbs -* [#6356](https://github.com/kubernetes/ingress-nginx/pull/6356) Add securitycontext settings on defaultbackend -* [#6401](https://github.com/kubernetes/ingress-nginx/pull/6401) Fix controller service annotations -* [#6403](https://github.com/kubernetes/ingress-nginx/pull/6403) Initial helm chart changelog - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.7.1...ingress-nginx-3.8.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.9.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.9.0.md deleted file mode 100644 index e8c9def51..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-3.9.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 3.9.0 - -* [#6423](https://github.com/kubernetes/ingress-nginx/pull/6423) Add Default backend HPA autoscaling - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/ingress-nginx-3.8.0...ingress-nginx-3.9.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.1.md deleted file mode 100644 index 7a187b350..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.1.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.0.1 - -* [7535] https://github.com/kubernetes/ingress-nginx/pull/7535 Release v1.0.0 ingress-nginx - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-3.34.0...helm-chart-4.0.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.10.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.10.md deleted file mode 100644 index c5d651670..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.10.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.0.10 - -* [7964] https://github.com/kubernetes/ingress-nginx/pull/7964 Update controller version to v1.1.0 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.9...helm-chart-4.0.10 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.11.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.11.md deleted file mode 100644 index 554182355..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.11.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.0.11 - -* [7873] https://github.com/kubernetes/ingress-nginx/pull/7873 Makes the [appProtocol](https://kubernetes.io/docs/concepts/services-networking/_print/#application-protocol) field optional. - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.10...helm-chart-4.0.11 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.12.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.12.md deleted file mode 100644 index 320f6f546..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.12.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.0.12 - -* [7978] https://github.com/kubernetes/ingress-nginx/pull/7979 Support custom annotations in admissions Jobs - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.11...helm-chart-4.0.12 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.13.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.13.md deleted file mode 100644 index edd922814..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.13.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.0.13 - -* [8008] https://github.com/kubernetes/ingress-nginx/pull/8008 Add relabelings in controller-servicemonitor.yaml - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.12...helm-chart-4.0.13 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.14.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.14.md deleted file mode 100644 index e92701039..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.14.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.0.14 - -* [8061] https://github.com/kubernetes/ingress-nginx/pull/8061 Using helm-docs to populate values table in README.md - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.13...helm-chart-4.0.14 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.15.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.15.md deleted file mode 100644 index d3d14a98d..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.15.md +++ /dev/null @@ -1,43 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.0.15 - -* [8120] https://github.com/kubernetes/ingress-nginx/pull/8120 Update go in runner and release v1.1.1 -* [8119] https://github.com/kubernetes/ingress-nginx/pull/8119 Update to go v1.17.6 -* [8118] https://github.com/kubernetes/ingress-nginx/pull/8118 Remove deprecated libraries, update other libs -* [8117] https://github.com/kubernetes/ingress-nginx/pull/8117 Fix codegen errors -* [8115] https://github.com/kubernetes/ingress-nginx/pull/8115 chart/ghaction: set the correct permission to have access to push a release -* [8098] https://github.com/kubernetes/ingress-nginx/pull/8098 generating SHA for CA only certs in backend_ssl.go + comparison of P… -* [8088] https://github.com/kubernetes/ingress-nginx/pull/8088 Fix Edit this page link to use main branch -* [8072] https://github.com/kubernetes/ingress-nginx/pull/8072 Expose GeoIP2 Continent code as variable -* [8061] https://github.com/kubernetes/ingress-nginx/pull/8061 docs(charts): using helm-docs for chart -* [8058] https://github.com/kubernetes/ingress-nginx/pull/8058 Bump github.com/spf13/cobra from 1.2.1 to 1.3.0 -* [8054] https://github.com/kubernetes/ingress-nginx/pull/8054 Bump google.golang.org/grpc from 1.41.0 to 1.43.0 -* [8051] https://github.com/kubernetes/ingress-nginx/pull/8051 align bug report with feature request regarding kind documentation -* [8046] https://github.com/kubernetes/ingress-nginx/pull/8046 Report expired certificates (#8045) -* [8044] https://github.com/kubernetes/ingress-nginx/pull/8044 remove G109 check till gosec resolves issues -* [8042] https://github.com/kubernetes/ingress-nginx/pull/8042 docs_multiple_instances_one_cluster_ticket_7543 -* [8041] https://github.com/kubernetes/ingress-nginx/pull/8041 docs: fix typo'd executable name -* [8035] https://github.com/kubernetes/ingress-nginx/pull/8035 Comment busy owners -* [8029] https://github.com/kubernetes/ingress-nginx/pull/8029 Add stream-snippet as a ConfigMap and Annotation option -* [8023] https://github.com/kubernetes/ingress-nginx/pull/8023 fix nginx compilation flags -* [8021] https://github.com/kubernetes/ingress-nginx/pull/8021 Disable default modsecurity_rules_file if modsecurity-snippet is specified -* [8019] https://github.com/kubernetes/ingress-nginx/pull/8019 Revise main documentation page -* [8018] https://github.com/kubernetes/ingress-nginx/pull/8018 Preserve order of plugin invocation -* [8015] https://github.com/kubernetes/ingress-nginx/pull/8015 Add newline indenting to admission webhook annotations -* [8014] https://github.com/kubernetes/ingress-nginx/pull/8014 Add link to example error page manifest in docs -* [8009] https://github.com/kubernetes/ingress-nginx/pull/8009 Fix spelling in documentation and top-level files -* [8008] https://github.com/kubernetes/ingress-nginx/pull/8008 Add relabelings in controller-servicemonitor.yaml -* [8003] https://github.com/kubernetes/ingress-nginx/pull/8003 Minor improvements (formatting, consistency) in install guide -* [8001] https://github.com/kubernetes/ingress-nginx/pull/8001 fix: go-grpc Dockerfile -* [7999] https://github.com/kubernetes/ingress-nginx/pull/7999 images: use k8s-staging-test-infra/gcb-docker-gcloud -* [7996] https://github.com/kubernetes/ingress-nginx/pull/7996 doc: improvement -* [7983] https://github.com/kubernetes/ingress-nginx/pull/7983 Fix a couple of misspellings in the annotations documentation. -* [7979] https://github.com/kubernetes/ingress-nginx/pull/7979 allow set annotations for admission Jobs -* [7977] https://github.com/kubernetes/ingress-nginx/pull/7977 Add ssl_reject_handshake to default server -* [7975] https://github.com/kubernetes/ingress-nginx/pull/7975 add legacy version update v0.50.0 to main changelog -* [7972] https://github.com/kubernetes/ingress-nginx/pull/7972 updated service upstream definition - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.14...helm-chart-4.0.15 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.18.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.18.md deleted file mode 100644 index 30a8f75c1..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.18.md +++ /dev/null @@ -1,40 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.0.18 - -* [8291](https://github.com/kubernetes/ingress-nginx/pull/8291) remove git tag env from cloud build -* [8286](https://github.com/kubernetes/ingress-nginx/pull/8286) Fix OpenTelemetry sidecar image build -* [8277](https://github.com/kubernetes/ingress-nginx/pull/8277) Add OpenSSF Best practices badge -* [8273](https://github.com/kubernetes/ingress-nginx/pull/8273) Issue#8241 -* [8267](https://github.com/kubernetes/ingress-nginx/pull/8267) Add fsGroup value to admission-webhooks/job-patch charts -* [8262](https://github.com/kubernetes/ingress-nginx/pull/8262) Updated confusing error -* [8256](https://github.com/kubernetes/ingress-nginx/pull/8256) fix: deny locations with invalid auth-url annotation -* [8253](https://github.com/kubernetes/ingress-nginx/pull/8253) Add a certificate info metric -* [8236](https://github.com/kubernetes/ingress-nginx/pull/8236) webhook: remove useless code. -* [8227](https://github.com/kubernetes/ingress-nginx/pull/8227) Update libraries in webhook image -* [8225](https://github.com/kubernetes/ingress-nginx/pull/8225) fix inconsistent-label-cardinality for prometheus metrics: nginx_ingress_controller_requests -* [8221](https://github.com/kubernetes/ingress-nginx/pull/8221) Do not validate ingresses with unknown ingress class in admission webhook endpoint -* [8210](https://github.com/kubernetes/ingress-nginx/pull/8210) Bump github.com/prometheus/client_golang from 1.11.0 to 1.12.1 -* [8209](https://github.com/kubernetes/ingress-nginx/pull/8209) Bump google.golang.org/grpc from 1.43.0 to 1.44.0 -* [8204](https://github.com/kubernetes/ingress-nginx/pull/8204) Add Artifact Hub lint -* [8203](https://github.com/kubernetes/ingress-nginx/pull/8203) Fix Indentation of example and link to cert-manager tutorial -* [8201](https://github.com/kubernetes/ingress-nginx/pull/8201) feat(metrics): add path and method labels to requests countera -* [8199](https://github.com/kubernetes/ingress-nginx/pull/8199) use functional options to reduce number of methods creating an EchoDeployment -* [8196](https://github.com/kubernetes/ingress-nginx/pull/8196) docs: fix inconsistent controller annotation -* [8191](https://github.com/kubernetes/ingress-nginx/pull/8191) Using Go install for misspell -* [8186](https://github.com/kubernetes/ingress-nginx/pull/8186) prometheus+grafana using servicemonitor -* [8185](https://github.com/kubernetes/ingress-nginx/pull/8185) Append elements on match, instead of removing for cors-annotations -* [8179](https://github.com/kubernetes/ingress-nginx/pull/8179) Bump github.com/opencontainers/runc from 1.0.3 to 1.1.0 -* [8173](https://github.com/kubernetes/ingress-nginx/pull/8173) Adding annotations to the controller service account -* [8163](https://github.com/kubernetes/ingress-nginx/pull/8163) Update the $req_id placeholder description -* [8162](https://github.com/kubernetes/ingress-nginx/pull/8162) Versioned static manifests -* [8159](https://github.com/kubernetes/ingress-nginx/pull/8159) Adding some geoip variables and default values -* [8155](https://github.com/kubernetes/ingress-nginx/pull/8155) #7271 feat: avoid-pdb-creation-when-default-backend-disabled-and-replicas-gt-1 -* [8151](https://github.com/kubernetes/ingress-nginx/pull/8151) Automatically generate helm docs -* [8143](https://github.com/kubernetes/ingress-nginx/pull/8143) Allow to configure delay before controller exits -* [8136](https://github.com/kubernetes/ingress-nginx/pull/8136) add ingressClass option to helm chart - back compatibility with ingress.class annotations -* [8126](https://github.com/kubernetes/ingress-nginx/pull/8126) Example for JWT - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.15...helm-chart-4.0.18 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.2.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.2.md deleted file mode 100644 index 9dbd003a9..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.2.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.0.2 - -* [7681] https://github.com/kubernetes/ingress-nginx/pull/7681 Release v1.0.1 of ingress-nginx - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.1...helm-chart-4.0.2 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.3.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.3.md deleted file mode 100644 index 09b89f66c..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.3.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.0.3 - -* [7707] https://github.com/kubernetes/ingress-nginx/pull/7707 Release v1.0.2 of ingress-nginx - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.2...helm-chart-4.0.3 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.5.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.5.md deleted file mode 100644 index be67704ba..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.5.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.0.5 - -* [7740] https://github.com/kubernetes/ingress-nginx/pull/7740 Release v1.0.3 of ingress-nginx - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.3...helm-chart-4.0.5 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.6.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.6.md deleted file mode 100644 index 25276e2be..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.6.md +++ /dev/null @@ -1,12 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.0.6 - -* [7804] https://github.com/kubernetes/ingress-nginx/pull/7804 Release v1.0.4 of ingress-nginx -* [7651] https://github.com/kubernetes/ingress-nginx/pull/7651 Support ipFamilyPolicy and ipFamilies fields in Helm Chart -* [7798] https://github.com/kubernetes/ingress-nginx/pull/7798 Exoscale: use HTTP Healthcheck mode -* [7793] https://github.com/kubernetes/ingress-nginx/pull/7793 Update kube-webhook-certgen to v1.1.1 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.5...helm-chart-4.0.6 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.7.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.7.md deleted file mode 100644 index 50fd9227c..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.7.md +++ /dev/null @@ -1,10 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.0.7 - -* [7923] https://github.com/kubernetes/ingress-nginx/pull/7923 Release v1.0.5 of ingress-nginx -* [7806] https://github.com/kubernetes/ingress-nginx/pull/7806 Choice option for internal/external loadbalancer type service - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.6...helm-chart-4.0.7 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.9.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.9.md deleted file mode 100644 index f2f725c93..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.0.9.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.0.9 - -* [6992] https://github.com/kubernetes/ingress-nginx/pull/6992 Add ability to specify labels for all resources - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.7...helm-chart-4.0.9 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.1.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.1.0.md deleted file mode 100644 index 24aaf49ae..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.1.0.md +++ /dev/null @@ -1,21 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.1.0 - -* [8481](https://github.com/kubernetes/ingress-nginx/pull/8481) Fix log creation in chroot script -* [8479](https://github.com/kubernetes/ingress-nginx/pull/8479) changed nginx base img tag to img built with alpine3.14.6 -* [8478](https://github.com/kubernetes/ingress-nginx/pull/8478) update base images and protobuf gomod -* [8468](https://github.com/kubernetes/ingress-nginx/pull/8468) Fallback to ngx.var.scheme for redirectScheme with use-forward-headers when X-Forwarded-Proto is empty -* [8456](https://github.com/kubernetes/ingress-nginx/pull/8456) Implement object deep inspector -* [8455](https://github.com/kubernetes/ingress-nginx/pull/8455) Update dependencies -* [8454](https://github.com/kubernetes/ingress-nginx/pull/8454) Update index.md -* [8447](https://github.com/kubernetes/ingress-nginx/pull/8447) typo fixing -* [8446](https://github.com/kubernetes/ingress-nginx/pull/8446) Fix suggested annotation-value-word-blocklist -* [8444](https://github.com/kubernetes/ingress-nginx/pull/8444) replace deprecated topology key in example with current one -* [8443](https://github.com/kubernetes/ingress-nginx/pull/8443) Add dependency review enforcement -* [8434](https://github.com/kubernetes/ingress-nginx/pull/8434) added new auth-tls-match-cn annotation -* [8426](https://github.com/kubernetes/ingress-nginx/pull/8426) Bump github.com/prometheus/common from 0.32.1 to 0.33.0 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.0.18...helm-chart-4.1.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.1.2.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.1.2.md deleted file mode 100644 index 20618557f..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.1.2.md +++ /dev/null @@ -1,11 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.1.2 - -* [8587](https://github.com/kubernetes/ingress-nginx/pull/8587) Add CAP_SYS_CHROOT to DS/PSP when needed -* [8458](https://github.com/kubernetes/ingress-nginx/pull/8458) Add portNamePrefix Helm chart parameter -* [8522](https://github.com/kubernetes/ingress-nginx/pull/8522) Add documentation for controller.service.loadBalancerIP in Helm chart - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.1.0...helm-chart-4.1.2 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.0.md deleted file mode 100644 index a1f1847ec..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.10.0 - -* - "Update Ingress-Nginx version controller-v1.10.0" - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.9.1...helm-chart-4.10.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.1.md deleted file mode 100644 index 3a28de00c..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.1.md +++ /dev/null @@ -1,11 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.10.1 - -* - "update post submit helm ci and clean up (#11221)" -* - "refactor helm ci tests part I (#11188)" -* - "Update Ingress-Nginx version controller-v1.10.1" - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.10.0...helm-chart-4.10.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.2.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.2.md deleted file mode 100644 index 399bd98d6..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.2.md +++ /dev/null @@ -1,18 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.10.2 - -* Chores: Align security contacts & chart maintainers to actual owners. (#11480) -* Fix helm install on cloud provider admonition block (#11412) -* edited helm-install tips (#11411) -* added info for aws helm install (#11410) -* add workflow to helm release and update ct for branch (#11317) -* Merge pull request #11277 from strongjz/chart-1.10.1 (#11314) -* release helm chart from release branch (#11278) -* update post submit helm ci and clean up (#11221) -* refactor helm ci tests part I (#11188) -* Update Ingress-Nginx version controller-v1.10.2 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.10.1...helm-chart-4.10.2 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.3.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.3.md deleted file mode 100644 index 3f77d405b..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.3.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.10.3 - -* Update Ingress-Nginx version controller-v1.10.3 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.10.2...helm-chart-4.10.3 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.4.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.4.md deleted file mode 100644 index 661d3c9bb..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.10.4.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.10.4 - -* Update Ingress-Nginx version controller-v1.10.4 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.10.3...helm-chart-4.10.4 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.0.md deleted file mode 100644 index 64108c04e..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.0.md +++ /dev/null @@ -1,18 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.11.0 - -* Chores: Align security contacts & chart maintainers to actual owners. (#11465) -* Merge pull request #11277 from strongjz/chart-1.10.1 (#11415) -* Fix helm install on cloud provider admonition block (#11394) -* edited helm-install tips (#11393) -* added info for aws helm install (#11390) -* add workflow to helm release and update ct for branch (#11378) -* release helm chart from release branch (#11276) -* update post submit helm ci and clean up (#11220) -* refactor helm ci tests part I (#11178) -* Update Ingress-Nginx version controller-v1.11.0 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.10.2...helm-chart-4.11.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.1.md deleted file mode 100644 index 281513e5f..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.1.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.11.1 - -* Update Ingress-Nginx version controller-v1.11.1 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.11.0...helm-chart-4.11.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.2.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.2.md deleted file mode 100644 index c7645a5b6..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.11.2.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.11.2 - -* Update Ingress-Nginx version controller-v1.11.2 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.11.1...helm-chart-4.11.2 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.12.0-beta.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.12.0-beta.0.md deleted file mode 100644 index fa980f1fb..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.12.0-beta.0.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.12.0-beta.0 - -* Update Ingress-Nginx version controller-v1.12.0-beta.0 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.11.0...helm-chart-4.12.0-beta.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.12.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.12.0.md deleted file mode 100644 index f8f36d499..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.12.0.md +++ /dev/null @@ -1,10 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.12.0 - -* CI: Fix chart testing. (#12258) -* Update Ingress-Nginx version controller-v1.12.0 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.11.0...helm-chart-4.12.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.2.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.2.0.md deleted file mode 100644 index 2074a0953..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.2.0.md +++ /dev/null @@ -1,47 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.2.0 - -* Support for Kubernetes v1.19.0 was removed -* [8810](https://github.com/kubernetes/ingress-nginx/pull/8810) Prepare for v1.3.0 -* [8808](https://github.com/kubernetes/ingress-nginx/pull/8808) revert arch var name -* [8805](https://github.com/kubernetes/ingress-nginx/pull/8805) Bump k8s.io/klog/v2 from 2.60.1 to 2.70.1 -* [8803](https://github.com/kubernetes/ingress-nginx/pull/8803) Update to nginx base with alpine v3.16 -* [8802](https://github.com/kubernetes/ingress-nginx/pull/8802) chore: start v1.3.0 release process -* [8798](https://github.com/kubernetes/ingress-nginx/pull/8798) Add v1.24.0 to test matrix -* [8796](https://github.com/kubernetes/ingress-nginx/pull/8796) fix: add MAC_OS variable for static-check -* [8793](https://github.com/kubernetes/ingress-nginx/pull/8793) changed to alpine-v3.16 -* [8781](https://github.com/kubernetes/ingress-nginx/pull/8781) Bump github.com/stretchr/testify from 1.7.5 to 1.8.0 -* [8778](https://github.com/kubernetes/ingress-nginx/pull/8778) chore: remove stable.txt from release process -* [8775](https://github.com/kubernetes/ingress-nginx/pull/8775) Remove stable -* [8773](https://github.com/kubernetes/ingress-nginx/pull/8773) Bump github/codeql-action from 2.1.14 to 2.1.15 -* [8772](https://github.com/kubernetes/ingress-nginx/pull/8772) Bump ossf/scorecard-action from 1.1.1 to 1.1.2 -* [8771](https://github.com/kubernetes/ingress-nginx/pull/8771) fix bullet md format -* [8770](https://github.com/kubernetes/ingress-nginx/pull/8770) Add condition for monitoring.coreos.com/v1 API -* [8769](https://github.com/kubernetes/ingress-nginx/pull/8769) Fix typos and add links to developer guide -* [8767](https://github.com/kubernetes/ingress-nginx/pull/8767) change v1.2.0 to v1.2.1 in deploy doc URLs -* [8765](https://github.com/kubernetes/ingress-nginx/pull/8765) Bump github/codeql-action from 1.0.26 to 2.1.14 -* [8752](https://github.com/kubernetes/ingress-nginx/pull/8752) Bump github.com/spf13/cobra from 1.4.0 to 1.5.0 -* [8751](https://github.com/kubernetes/ingress-nginx/pull/8751) Bump github.com/stretchr/testify from 1.7.2 to 1.7.5 -* [8750](https://github.com/kubernetes/ingress-nginx/pull/8750) added announcement -* [8740](https://github.com/kubernetes/ingress-nginx/pull/8740) change sha e2etestrunner and echoserver -* [8738](https://github.com/kubernetes/ingress-nginx/pull/8738) Update docs to make it easier for noobs to follow step by step -* [8737](https://github.com/kubernetes/ingress-nginx/pull/8737) updated baseimage sha -* [8736](https://github.com/kubernetes/ingress-nginx/pull/8736) set ld-musl-path -* [8733](https://github.com/kubernetes/ingress-nginx/pull/8733) feat: migrate leaderelection lock to leases -* [8726](https://github.com/kubernetes/ingress-nginx/pull/8726) prometheus metric: upstream_latency_seconds -* [8720](https://github.com/kubernetes/ingress-nginx/pull/8720) Ci pin deps -* [8719](https://github.com/kubernetes/ingress-nginx/pull/8719) Working OpenTelemetry sidecar (base nginx image) -* [8714](https://github.com/kubernetes/ingress-nginx/pull/8714) Create Openssf scorecard -* [8708](https://github.com/kubernetes/ingress-nginx/pull/8708) Bump github.com/prometheus/common from 0.34.0 to 0.35.0 -* [8703](https://github.com/kubernetes/ingress-nginx/pull/8703) Bump actions/dependency-review-action from 1 to 2 -* [8701](https://github.com/kubernetes/ingress-nginx/pull/8701) Fix several typos -* [8699](https://github.com/kubernetes/ingress-nginx/pull/8699) fix the gosec test and a make target for it -* [8698](https://github.com/kubernetes/ingress-nginx/pull/8698) Bump actions/upload-artifact from 2.3.1 to 3.1.0 -* [8697](https://github.com/kubernetes/ingress-nginx/pull/8697) Bump actions/setup-go from 2.2.0 to 3.2.0 -* [8695](https://github.com/kubernetes/ingress-nginx/pull/8695) Bump actions/download-artifact from 2 to 3 -* [8694](https://github.com/kubernetes/ingress-nginx/pull/8694) Bump crazy-max/ghaction-docker-buildx from 1.6.2 to 3.3.1 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.1.2...helm-chart-4.2.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.2.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.2.1.md deleted file mode 100644 index 7965bb1c2..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.2.1.md +++ /dev/null @@ -1,10 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.2.1 - -* The sha of kube-webhook-certgen image & the opentelemetry image, in values file, was changed to new images built on alpine-v3.16.1 -* [8896](https://github.com/kubernetes/ingress-nginx/pull/8896) updated to new images built today - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.2.0...helm-chart-4.2.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.3.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.3.0.md deleted file mode 100644 index f9dca22d9..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.3.0.md +++ /dev/null @@ -1,14 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.3.0 - -* Support for Kubernetes v.1.25.0 was added and support for endpoint slices -* Support for Kubernetes v1.20.0 and v1.21.0 was removed -* [8890](https://github.com/kubernetes/ingress-nginx/pull/8890) migrate to endpointslices -* [9059](https://github.com/kubernetes/ingress-nginx/pull/9059) kubewebhookcertgen sha change after go1191 -* [9046](https://github.com/kubernetes/ingress-nginx/pull/9046) Parameterize metrics port name -* [9104](https://github.com/kubernetes/ingress-nginx/pull/9104) Fix yaml formatting error with multiple annotations - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.2.1...helm-chart-4.3.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.4.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.4.0.md deleted file mode 100644 index 20f9e2336..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.4.0.md +++ /dev/null @@ -1,12 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.4.0 - -* Adding support for disabling liveness and readiness probes to the Helm chart by @njegosrailic in https://github.com/kubernetes/ingress-nginx/pull/9238 -* add:(admission-webhooks) ability to set securityContext by @ybelMekk in https://github.com/kubernetes/ingress-nginx/pull/9186 -* #7652 - Updated Helm chart to use the fullname for the electionID if not specified. by @FutureMatt in https://github.com/kubernetes/ingress-nginx/pull/9133 -* Rename controller-wehbooks-networkpolicy.yaml. by @Gacko in https://github.com/kubernetes/ingress-nginx/pull/9123 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.3.0...helm-chart-4.4.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.5.2.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.5.2.md deleted file mode 100644 index b6d8a3b0c..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.5.2.md +++ /dev/null @@ -1,13 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.5.2 - -* add lint on chart before release (#9570) -* ci: remove setup-helm step (#9404) -* feat(helm): Optionally use cert-manager instead admission patch (#9279) -* run helm release on main only and when the chart/value changes only (#9290) -* Update Ingress-Nginx version controller-v1.6.4 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.4.3...helm-chart-4.5.2 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.6.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.6.0.md deleted file mode 100644 index 469aaba8c..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.6.0.md +++ /dev/null @@ -1,24 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.5.3 - -* docs(helm): fix value key in readme for enabling certManager (#9640) -* Upgrade alpine 3.17.2 -* Upgrade golang 1.20 -* Drop testing/support for Kubernetes 1.23 -* docs(helm): fix value key in readme for enabling certManager (#9640) -* Update Ingress-Nginx version controller-v1.7.0 -* feat: OpenTelemetry module integration (#9062) -* canary-weight-total annotation ignored in rule backends (#9729) -* fix controller psp's volume config (#9740) -* Fix several Helm YAML issues with extraModules and extraInitContainers (#9709) -* Chart: Drop `controller.headers`, rework DH param secret. (#9659) -* Deployment/DaemonSet: Label pods using `ingress-nginx.labels`. (#9732) -* HPA: autoscaling/v2beta1 deprecated, bump apiVersion to v2 for defaultBackend (#9731) -* Fix incorrect annotation name in upstream hashing configuration (#9617) - -* Update Ingress-Nginx version controller-v1.7.0 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.5.2...helm-chart-4.6.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.6.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.6.1.md deleted file mode 100644 index 57d99b8db..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.6.1.md +++ /dev/null @@ -1,11 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.6.1 - -* [helm] Support custom port configuration for internal service (#9846) -* Adding resource type to default HPA configuration to resolve issues with Terraform helm chart usage (#9803) -* Update Ingress-Nginx version controller-v1.7.1 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.6.0...helm-chart-4.6.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.0.md deleted file mode 100644 index 9d5407053..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.0.md +++ /dev/null @@ -1,14 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.7.0 - -* helm: Fix opentelemetry module installation for daemonset (#9792) -* Update charts/* to keep project name display aligned (#9931) -* HPA: Use capabilities & align manifests. (#9521) -* PodDisruptionBudget spec logic update (#9904) -* add option for annotations in PodDisruptionBudget (#9843) -* Update Ingress-Nginx version controller-v1.8.0 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.6.1...helm-chart-4.7.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.1.md deleted file mode 100644 index 4d69a7117..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.1.md +++ /dev/null @@ -1,12 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.7.1 - -* Added a doc line to the missing helm value service.internal.loadBalancerIP (#9406) -* feat(helm): Add loadBalancerClass (#9562) -* added helmshowvalues example (#10019) -* Update Ingress-Nginx version controller-v1.8.1 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.7.0...helm-chart-4.7.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.2.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.2.md deleted file mode 100644 index 57b17b982..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.7.2.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.7.2 - -* Update Ingress-Nginx version controller-v1.8.2 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.7.1...helm-chart-4.7.2 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.0-beta.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.0-beta.0.md deleted file mode 100644 index 9072a75b4..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.0-beta.0.md +++ /dev/null @@ -1,13 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.8.0-beta.0 - -* ci(helm): fix Helm Chart release action 422 error (#10237) -* helm: Use .Release.Namespace as default for ServiceMonitor namespace (#10249) -* [helm] configure allow to configure hostAliases (#10180) -* [helm] pass service annotations through helm tpl engine (#10084) -* Update Ingress-Nginx version controller-v1.9.0-beta.0 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.7.2...helm-chart-4.8.0-beta.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.0.md deleted file mode 100644 index af8f1241f..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.0.md +++ /dev/null @@ -1,13 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.8.0 - -* ci(helm): fix Helm Chart release action 422 error (#10237) -* helm: Use .Release.Namespace as default for ServiceMonitor namespace (#10249) -* [helm] configure allow to configure hostAliases (#10180) -* [helm] pass service annotations through helm tpl engine (#10084) -* Update Ingress-Nginx version controller-v1.9.0 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.7.2...helm-chart-4.8.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.1.md deleted file mode 100644 index 53a4493de..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.1.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.8.1 - -* Update Ingress-Nginx version controller-v1.9.1 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.8.0...helm-chart-4.8.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.2.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.2.md deleted file mode 100644 index 9957c1a85..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.2.md +++ /dev/null @@ -1,10 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.8.2 - -* update nginx base, httpbun, e2e, helm webhook cert gen (#10506) -* Update Ingress-Nginx version controller-v1.9.3 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.8.1...helm-chart-4.8.2 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.3.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.3.md deleted file mode 100644 index b8d4d56b3..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.8.3.md +++ /dev/null @@ -1,9 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.8.3 - -* Update Ingress-Nginx version controller-v1.9.4 - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.8.2...helm-chart-4.8.3 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.9.0.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.9.0.md deleted file mode 100644 index 5c7729866..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.9.0.md +++ /dev/null @@ -1,13 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.9.0 - -* - "Add controller.metrics.serviceMonitor.annotations in Helm chart" -* - "fix(labels): use complete labels variable on default-backend deployment" -* - "chart: allow setting allocateLoadBalancerNodePorts (#10693)" -* - "[release-1.9] feat(helm): add documentation about metric args (#10695)" -* - "Update Ingress-Nginx version controller-v1.9.5" - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.8.3...helm-chart-4.9.0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.9.1.md b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.9.1.md deleted file mode 100644 index c6120e736..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart-4.9.1.md +++ /dev/null @@ -1,10 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### 4.9.1 - -* - "update web hook cert gen to latest release v20231226-1a7112e06" -* - "Update Ingress-Nginx version controller-v1.9.6" - -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.9.0...helm-chart-4.9.1 diff --git a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart.md.gotmpl b/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart.md.gotmpl deleted file mode 100644 index ef5add55d..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/changelog/helm-chart.md.gotmpl +++ /dev/null @@ -1,11 +0,0 @@ -# Changelog - -This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). - -### {{ .NewHelmChartVersion }} -{{ with .HelmUpdates }} -{{- range . }} -* {{ . }} -{{- end }} -{{ end }} -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-{{ .PreviousHelmChartVersion }}...helm-chart-{{ .NewHelmChartVersion }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/admission-webhooks-cert-manager-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/admission-webhooks-cert-manager-values.yaml deleted file mode 100644 index 7eafd0c5b..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/ci/admission-webhooks-cert-manager-values.yaml +++ /dev/null @@ -1,12 +0,0 @@ -controller: - image: - repository: ingress-controller/controller - tag: 1.0.0-dev - digest: null - - service: - type: ClusterIP - - admissionWebhooks: - certManager: - enabled: true diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-addheaders-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-addheaders-values.yaml deleted file mode 100644 index 460a610ba..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-addheaders-values.yaml +++ /dev/null @@ -1,11 +0,0 @@ -controller: - image: - repository: ingress-controller/controller - tag: 1.0.0-dev - digest: null - - service: - type: ClusterIP - - addHeaders: - X-Frame-Options: deny diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-proxyheaders-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-proxyheaders-values.yaml deleted file mode 100644 index e23a13c0c..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-proxyheaders-values.yaml +++ /dev/null @@ -1,11 +0,0 @@ -controller: - image: - repository: ingress-controller/controller - tag: 1.0.0-dev - digest: null - - service: - type: ClusterIP - - proxySetHeaders: - X-Forwarded-Proto: https diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-values.yaml deleted file mode 100644 index a7029895c..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-configmap-values.yaml +++ /dev/null @@ -1,11 +0,0 @@ -controller: - image: - repository: ingress-controller/controller - tag: 1.0.0-dev - digest: null - - service: - type: ClusterIP - - config: - use-proxy-protocol: "true" diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-metrics-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-metrics-values.yaml deleted file mode 100644 index 7a98580cd..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-metrics-values.yaml +++ /dev/null @@ -1,13 +0,0 @@ -controller: - image: - repository: ingress-controller/controller - tag: 1.0.0-dev - digest: null - - service: - type: ClusterIP - - kind: DaemonSet - - metrics: - enabled: true diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-podannotations-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-podannotations-values.yaml deleted file mode 100644 index 405992ef3..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-podannotations-values.yaml +++ /dev/null @@ -1,16 +0,0 @@ -controller: - image: - repository: ingress-controller/controller - tag: 1.0.0-dev - digest: null - - service: - type: ClusterIP - - kind: DaemonSet - - podAnnotations: - prometheus.io/scrape: "true" - prometheus.io/port: "10254" - prometheus.io/scheme: http - prometheus.io/path: /metrics diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-values.yaml deleted file mode 100644 index d34025c80..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-daemonset-values.yaml +++ /dev/null @@ -1,10 +0,0 @@ -controller: - image: - repository: ingress-controller/controller - tag: 1.0.0-dev - digest: null - - service: - type: ClusterIP - - kind: DaemonSet diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-metrics-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-metrics-values.yaml deleted file mode 100644 index 9c95d347c..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-metrics-values.yaml +++ /dev/null @@ -1,13 +0,0 @@ -controller: - image: - repository: ingress-controller/controller - tag: 1.0.0-dev - digest: null - - service: - type: ClusterIP - - kind: Deployment - - metrics: - enabled: true diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-podannotations-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-podannotations-values.yaml deleted file mode 100644 index cf1f2611e..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-podannotations-values.yaml +++ /dev/null @@ -1,16 +0,0 @@ -controller: - image: - repository: ingress-controller/controller - tag: 1.0.0-dev - digest: null - - service: - type: ClusterIP - - kind: Deployment - - podAnnotations: - prometheus.io/scrape: "true" - prometheus.io/port: "10254" - prometheus.io/scheme: http - prometheus.io/path: /metrics diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-values.yaml deleted file mode 100644 index 1b092dc0c..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-deployment-values.yaml +++ /dev/null @@ -1,10 +0,0 @@ -controller: - image: - repository: ingress-controller/controller - tag: 1.0.0-dev - digest: null - - service: - type: ClusterIP - - kind: Deployment diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-hpa-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-hpa-values.yaml deleted file mode 100644 index 54a0d2f75..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-hpa-values.yaml +++ /dev/null @@ -1,18 +0,0 @@ -controller: - image: - repository: ingress-controller/controller - tag: 1.0.0-dev - digest: null - - service: - type: ClusterIP - - autoscaling: - enabled: true - behavior: - scaleDown: - stabilizationWindowSeconds: 300 - policies: - - type: Pods - value: 1 - periodSeconds: 180 diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-ingressclass-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-ingressclass-values.yaml deleted file mode 100644 index c06429f97..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-ingressclass-values.yaml +++ /dev/null @@ -1,15 +0,0 @@ -controller: - image: - repository: ingress-controller/controller - tag: 1.0.0-dev - digest: null - - service: - type: ClusterIP - - ingressClassResource: - name: custom-nginx - default: true - controllerValue: k8s.io/custom-nginx - - watchIngressWithoutClass: true diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-service-internal-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-service-internal-values.yaml deleted file mode 100644 index 11108fbce..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-service-internal-values.yaml +++ /dev/null @@ -1,13 +0,0 @@ -controller: - image: - repository: ingress-controller/controller - tag: 1.0.0-dev - digest: null - - service: - type: ClusterIP - - internal: - enabled: true - annotations: - service.beta.kubernetes.io/aws-load-balancer-internal: "true" diff --git a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-service-values.yaml b/charts/devtron-utilities/charts/ingress-nginx/ci/controller-service-values.yaml deleted file mode 100644 index 9039368c2..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/ci/controller-service-values.yaml +++ /dev/null @@ -1,22 +0,0 @@ -controller: - image: - repository: ingress-controller/controller - tag: 1.0.0-dev - digest: null - - service: - type: NodePort - - nodePorts: - tcp: - 9000: 30090 - udp: - 9001: 30091 - -portNamePrefix: port - -tcp: - 9000: default/test:8080 - -udp: - 9001: default/test:8080 diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/NOTES.txt b/charts/devtron-utilities/charts/ingress-nginx/templates/NOTES.txt deleted file mode 100644 index f4923007e..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/NOTES.txt +++ /dev/null @@ -1,73 +0,0 @@ -The ingress-nginx controller has been installed. - -{{- if contains "NodePort" .Values.controller.service.type }} -Get the application URL by running these commands: - -{{- if (not (empty .Values.controller.service.nodePorts.http)) }} - export HTTP_NODE_PORT={{ .Values.controller.service.nodePorts.http }} -{{- else }} - export HTTP_NODE_PORT=$(kubectl get service --namespace {{ include "ingress-nginx.namespace" . }} {{ include "ingress-nginx.controller.fullname" . }} --output jsonpath="{.spec.ports[0].nodePort}") -{{- end }} -{{- if (not (empty .Values.controller.service.nodePorts.https)) }} - export HTTPS_NODE_PORT={{ .Values.controller.service.nodePorts.https }} -{{- else }} - export HTTPS_NODE_PORT=$(kubectl get service --namespace {{ include "ingress-nginx.namespace" . }} {{ include "ingress-nginx.controller.fullname" . }} --output jsonpath="{.spec.ports[1].nodePort}") -{{- end }} - export NODE_IP="$(kubectl get nodes --output jsonpath="{.items[0].status.addresses[1].address}")" - - echo "Visit http://${NODE_IP}:${HTTP_NODE_PORT} to access your application via HTTP." - echo "Visit https://${NODE_IP}:${HTTPS_NODE_PORT} to access your application via HTTPS." -{{- else if contains "LoadBalancer" .Values.controller.service.type }} -It may take a few minutes for the load balancer IP to be available. -You can watch the status by running 'kubectl get service --namespace {{ include "ingress-nginx.namespace" . }} {{ include "ingress-nginx.controller.fullname" . }} --output wide --watch' -{{- else if contains "ClusterIP" .Values.controller.service.type }} -Get the application URL by running these commands: - export POD_NAME="$(kubectl get pods --namespace {{ include "ingress-nginx.namespace" . }} --selector app.kubernetes.io/name={{ include "ingress-nginx.name" . }},app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=controller --output jsonpath="{.items[0].metadata.name}")" - kubectl port-forward --namespace {{ include "ingress-nginx.namespace" . }} "${POD_NAME}" 8080:80 - echo "Visit http://127.0.0.1:8080 to access your application." -{{- end }} - -An example Ingress that makes use of the controller: - -{{- $isV1 := semverCompare ">=1" .Chart.AppVersion}} - apiVersion: networking.k8s.io/v1 - kind: Ingress - metadata: - name: example - namespace: foo - {{- if eq $isV1 false }} - annotations: - kubernetes.io/ingress.class: {{ .Values.controller.ingressClass }} - {{- end }} - spec: - {{- if $isV1 }} - ingressClassName: {{ .Values.controller.ingressClassResource.name }} - {{- end }} - rules: - - host: www.example.com - http: - paths: - - pathType: Prefix - backend: - service: - name: exampleService - port: - number: 80 - path: / - # This section is only required if TLS is to be enabled for the Ingress - tls: - - hosts: - - www.example.com - secretName: example-tls - -If TLS is enabled for the Ingress, a Secret containing the certificate and key must also be provided: - - apiVersion: v1 - kind: Secret - metadata: - name: example-tls - namespace: foo - data: - tls.crt: - tls.key: - type: kubernetes.io/tls diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/_helpers.tpl b/charts/devtron-utilities/charts/ingress-nginx/templates/_helpers.tpl deleted file mode 100644 index 6cbda2d4d..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/_helpers.tpl +++ /dev/null @@ -1,263 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "ingress-nginx.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "ingress-nginx.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -*/}} -{{- define "ingress-nginx.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Expand the namespace of the release. -Allows overriding it for multi-namespace deployments in combined charts. -*/}} -{{- define "ingress-nginx.namespace" -}} -{{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Controller container security context. -*/}} -{{- define "ingress-nginx.controller.containerSecurityContext" -}} -{{- if .Values.controller.containerSecurityContext -}} -{{- toYaml .Values.controller.containerSecurityContext -}} -{{- else -}} -runAsNonRoot: {{ .Values.controller.image.runAsNonRoot }} -runAsUser: {{ .Values.controller.image.runAsUser }} -runAsGroup: {{ .Values.controller.image.runAsGroup }} -allowPrivilegeEscalation: {{ or .Values.controller.image.allowPrivilegeEscalation .Values.controller.image.chroot }} -{{- if .Values.controller.image.seccompProfile }} -seccompProfile: {{ toYaml .Values.controller.image.seccompProfile | nindent 2 }} -{{- end }} -capabilities: - drop: - - ALL - add: - - NET_BIND_SERVICE - {{- if .Values.controller.image.chroot }} - {{- if .Values.controller.image.seccompProfile }} - - SYS_ADMIN - {{- end }} - - SYS_CHROOT - {{- end }} -readOnlyRootFilesystem: {{ .Values.controller.image.readOnlyRootFilesystem }} -{{- end -}} -{{- end -}} - -{{/* -Get specific image -*/}} -{{- define "ingress-nginx.image" -}} -{{- if .chroot -}} -{{- printf "%s-chroot" .image -}} -{{- else -}} -{{- printf "%s" .image -}} -{{- end }} -{{- end -}} - -{{/* -Get specific image digest -*/}} -{{- define "ingress-nginx.imageDigest" -}} -{{- if .chroot -}} -{{- if .digestChroot -}} -{{- printf "@%s" .digestChroot -}} -{{- end }} -{{- else -}} -{{ if .digest -}} -{{- printf "@%s" .digest -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create a default fully qualified controller name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -*/}} -{{- define "ingress-nginx.controller.fullname" -}} -{{- printf "%s-%s" (include "ingress-nginx.fullname" .) .Values.controller.name | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Construct a unique electionID. -Users can provide an override for an explicit electionID if they want via `.Values.controller.electionID` -*/}} -{{- define "ingress-nginx.controller.electionID" -}} -{{- $defElectionID := printf "%s-leader" (include "ingress-nginx.fullname" .) -}} -{{- $electionID := default $defElectionID .Values.controller.electionID -}} -{{- print $electionID -}} -{{- end -}} - -{{/* -Construct the path for the publish-service. - -By convention this will simply use the / to match the name of the -service generated. - -Users can provide an override for an explicit service they want bound via `.Values.controller.publishService.pathOverride` -*/}} -{{- define "ingress-nginx.controller.publishServicePath" -}} -{{- $defServiceName := printf "%s/%s" "$(POD_NAMESPACE)" (include "ingress-nginx.controller.fullname" .) -}} -{{- $servicePath := default $defServiceName .Values.controller.publishService.pathOverride }} -{{- print $servicePath | trimSuffix "-" -}} -{{- end -}} - -{{/* -Common labels -*/}} -{{- define "ingress-nginx.labels" -}} -helm.sh/chart: {{ include "ingress-nginx.chart" . }} -{{ include "ingress-nginx.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/part-of: {{ template "ingress-nginx.name" . }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- if .Values.commonLabels}} -{{ toYaml .Values.commonLabels }} -{{- end }} -{{- end -}} - -{{/* -Selector labels -*/}} -{{- define "ingress-nginx.selectorLabels" -}} -app.kubernetes.io/name: {{ include "ingress-nginx.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end -}} - -{{/* -Create the name of the controller service account to use -*/}} -{{- define "ingress-nginx.serviceAccountName" -}} -{{- if .Values.serviceAccount.create -}} - {{ default (include "ingress-nginx.fullname" .) .Values.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Create a default fully qualified admission webhook name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -*/}} -{{- define "ingress-nginx.admissionWebhooks.fullname" -}} -{{- printf "%s-%s" (include "ingress-nginx.fullname" .) .Values.controller.admissionWebhooks.name | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create the name of the admission webhook patch job service account to use -*/}} -{{- define "ingress-nginx.admissionWebhooks.patch.serviceAccountName" -}} -{{- if .Values.controller.admissionWebhooks.patch.serviceAccount.create -}} - {{ default (include "ingress-nginx.admissionWebhooks.fullname" .) .Values.controller.admissionWebhooks.patch.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.controller.admissionWebhooks.patch.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Create a default fully qualified admission webhook secret creation job name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -*/}} -{{- define "ingress-nginx.admissionWebhooks.createSecretJob.fullname" -}} -{{- printf "%s-%s" (include "ingress-nginx.admissionWebhooks.fullname" .) .Values.controller.admissionWebhooks.createSecretJob.name | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified admission webhook patch job name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -*/}} -{{- define "ingress-nginx.admissionWebhooks.patchWebhookJob.fullname" -}} -{{- printf "%s-%s" (include "ingress-nginx.admissionWebhooks.fullname" .) .Values.controller.admissionWebhooks.patchWebhookJob.name | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified default backend name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -*/}} -{{- define "ingress-nginx.defaultBackend.fullname" -}} -{{- printf "%s-%s" (include "ingress-nginx.fullname" .) .Values.defaultBackend.name | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create the name of the default backend service account to use -*/}} -{{- define "ingress-nginx.defaultBackend.serviceAccountName" -}} -{{- if .Values.defaultBackend.serviceAccount.create -}} - {{ default (printf "%s-backend" (include "ingress-nginx.fullname" .)) .Values.defaultBackend.serviceAccount.name }} -{{- else -}} - {{ default "default-backend" .Values.defaultBackend.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Default backend container security context. -*/}} -{{- define "ingress-nginx.defaultBackend.containerSecurityContext" -}} -{{- if .Values.defaultBackend.containerSecurityContext -}} -{{- toYaml .Values.defaultBackend.containerSecurityContext -}} -{{- else -}} -runAsNonRoot: {{ .Values.defaultBackend.image.runAsNonRoot }} -runAsUser: {{ .Values.defaultBackend.image.runAsUser }} -runAsGroup: {{ .Values.defaultBackend.image.runAsGroup }} -allowPrivilegeEscalation: {{ .Values.defaultBackend.image.allowPrivilegeEscalation }} -{{- if .Values.defaultBackend.image.seccompProfile }} -seccompProfile: {{ toYaml .Values.defaultBackend.image.seccompProfile | nindent 2 }} -{{- end }} -capabilities: - drop: - - ALL -readOnlyRootFilesystem: {{ .Values.defaultBackend.image.readOnlyRootFilesystem }} -{{- end -}} -{{- end -}} - -{{/* -Extra modules. -*/}} -{{- define "extraModules" -}} -- name: {{ .name }} - {{- with .image }} - image: {{ if .repository }}{{ .repository }}{{ else }}{{ .registry }}/{{ .image }}{{ end }}:{{ .tag }}{{ if .digest }}@{{ .digest }}{{ end }} - command: - {{- if .distroless }} - - /init_module - {{- else }} - - sh - - -c - - /usr/local/bin/init_module.sh - {{- end }} - {{- end }} - {{- if .containerSecurityContext }} - securityContext: {{ toYaml .containerSecurityContext | nindent 4 }} - {{- end }} - {{- if .resources }} - resources: {{ toYaml .resources | nindent 4 }} - {{- end }} - volumeMounts: - - name: modules - mountPath: /modules_mount -{{- end -}} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/_params.tpl b/charts/devtron-utilities/charts/ingress-nginx/templates/_params.tpl deleted file mode 100644 index 0051dc9c0..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/_params.tpl +++ /dev/null @@ -1,77 +0,0 @@ -{{- define "ingress-nginx.params" -}} -- /nginx-ingress-controller -{{- if not .Values.controller.enableAnnotationValidations }} -- --enable-annotation-validation=false -{{- end }} -{{- if .Values.defaultBackend.enabled }} -- --default-backend-service=$(POD_NAMESPACE)/{{ include "ingress-nginx.defaultBackend.fullname" . }} -{{- end }} -{{- if and .Values.controller.publishService.enabled .Values.controller.service.enabled }} -{{- if .Values.controller.service.external.enabled }} -- --publish-service={{ template "ingress-nginx.controller.publishServicePath" . }} -{{- else if .Values.controller.service.internal.enabled }} -- --publish-service={{ template "ingress-nginx.controller.publishServicePath" . }}-internal -{{- end }} -{{- end }} -- --election-id={{ include "ingress-nginx.controller.electionID" . }} -- --controller-class={{ .Values.controller.ingressClassResource.controllerValue }} -{{- if .Values.controller.ingressClass }} -- --ingress-class={{ .Values.controller.ingressClass }} -{{- end }} -- --configmap={{ default "$(POD_NAMESPACE)" .Values.controller.configMapNamespace }}/{{ include "ingress-nginx.controller.fullname" . }} -{{- if .Values.tcp }} -- --tcp-services-configmap={{ default "$(POD_NAMESPACE)" .Values.controller.tcp.configMapNamespace }}/{{ include "ingress-nginx.fullname" . }}-tcp -{{- end }} -{{- if .Values.udp }} -- --udp-services-configmap={{ default "$(POD_NAMESPACE)" .Values.controller.udp.configMapNamespace }}/{{ include "ingress-nginx.fullname" . }}-udp -{{- end }} -{{- if .Values.controller.scope.enabled }} -- --watch-namespace={{ default "$(POD_NAMESPACE)" .Values.controller.scope.namespace }} -{{- end }} -{{- if and (not .Values.controller.scope.enabled) .Values.controller.scope.namespaceSelector }} -- --watch-namespace-selector={{ .Values.controller.scope.namespaceSelector }} -{{- end }} -{{- if and .Values.controller.reportNodeInternalIp .Values.controller.hostNetwork }} -- --report-node-internal-ip-address={{ .Values.controller.reportNodeInternalIp }} -{{- end }} -{{- if .Values.controller.admissionWebhooks.enabled }} -- --validating-webhook=:{{ .Values.controller.admissionWebhooks.port }} -- --validating-webhook-certificate={{ .Values.controller.admissionWebhooks.certificate }} -- --validating-webhook-key={{ .Values.controller.admissionWebhooks.key }} -{{- end }} -{{- if .Values.controller.maxmindLicenseKey }} -- --maxmind-license-key={{ .Values.controller.maxmindLicenseKey }} -{{- end }} -{{- if .Values.controller.healthCheckHost }} -- --healthz-host={{ .Values.controller.healthCheckHost }} -{{- end }} -{{- if not (eq .Values.controller.healthCheckPath "/healthz") }} -- --health-check-path={{ .Values.controller.healthCheckPath }} -{{- end }} -{{- if .Values.controller.ingressClassByName }} -- --ingress-class-by-name=true -{{- end }} -{{- if .Values.controller.watchIngressWithoutClass }} -- --watch-ingress-without-class=true -{{- end }} -{{- if .Values.controller.metrics.enabled }} -- --enable-metrics={{ .Values.controller.metrics.enabled }} -{{- end }} -{{- if .Values.controller.enableTopologyAwareRouting }} -- --enable-topology-aware-routing=true -{{- end }} -{{- if .Values.controller.disableLeaderElection }} -- --disable-leader-election=true -{{- end }} -{{- if .Values.controller.electionTTL }} -- --election-ttl={{ .Values.controller.electionTTL }} -{{- end }} -{{- range $key, $value := .Values.controller.extraArgs }} -{{- /* Accept keys without values or with false as value */}} -{{- if eq ($value | quote | len) 2 }} -- --{{ $key }} -{{- else }} -- --{{ $key }}={{ $value }} -{{- end }} -{{- end }} -{{- end -}} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/cert-manager.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/cert-manager.yaml deleted file mode 100644 index db2946c3d..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/cert-manager.yaml +++ /dev/null @@ -1,63 +0,0 @@ -{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.certManager.enabled -}} -{{- if not .Values.controller.admissionWebhooks.certManager.issuerRef -}} -# Create a selfsigned Issuer, in order to create a root CA certificate for -# signing webhook serving certificates -apiVersion: cert-manager.io/v1 -kind: Issuer -metadata: - name: {{ include "ingress-nginx.fullname" . }}-self-signed-issuer - namespace: {{ include "ingress-nginx.namespace" . }} -spec: - selfSigned: {} ---- -# Generate a CA Certificate used to sign certificates for the webhook -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: {{ include "ingress-nginx.fullname" . }}-root-cert - namespace: {{ include "ingress-nginx.namespace" . }} -spec: - secretName: {{ include "ingress-nginx.fullname" . }}-root-cert - duration: {{ .Values.controller.admissionWebhooks.certManager.rootCert.duration | default "43800h0m0s" | quote }} - issuerRef: - name: {{ include "ingress-nginx.fullname" . }}-self-signed-issuer - commonName: "ca.webhook.ingress-nginx" - isCA: true - subject: - organizations: - - ingress-nginx ---- -# Create an Issuer that uses the above generated CA certificate to issue certs -apiVersion: cert-manager.io/v1 -kind: Issuer -metadata: - name: {{ include "ingress-nginx.fullname" . }}-root-issuer - namespace: {{ include "ingress-nginx.namespace" . }} -spec: - ca: - secretName: {{ include "ingress-nginx.fullname" . }}-root-cert -{{- end }} ---- -# generate a server certificate for the apiservices to use -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} - namespace: {{ include "ingress-nginx.namespace" . }} -spec: - secretName: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} - duration: {{ .Values.controller.admissionWebhooks.certManager.admissionCert.duration | default "8760h0m0s" | quote }} - issuerRef: - {{- if .Values.controller.admissionWebhooks.certManager.issuerRef }} - {{- toYaml .Values.controller.admissionWebhooks.certManager.issuerRef | nindent 4 }} - {{- else }} - name: {{ include "ingress-nginx.fullname" . }}-root-issuer - {{- end }} - dnsNames: - - {{ include "ingress-nginx.controller.fullname" . }}-admission - - {{ include "ingress-nginx.controller.fullname" . }}-admission.{{ include "ingress-nginx.namespace" . }} - - {{ include "ingress-nginx.controller.fullname" . }}-admission.{{ include "ingress-nginx.namespace" . }}.svc - subject: - organizations: - - ingress-nginx-admission -{{- end -}} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml deleted file mode 100644 index 54af7abb6..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml +++ /dev/null @@ -1,23 +0,0 @@ -{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled .Values.controller.admissionWebhooks.patch.rbac.create (not .Values.controller.admissionWebhooks.certManager.enabled) -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} - annotations: - "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: admission-webhook - {{- with .Values.controller.admissionWebhooks.patch.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} -rules: - - apiGroups: - - admissionregistration.k8s.io - resources: - - validatingwebhookconfigurations - verbs: - - get - - update -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml deleted file mode 100644 index b89388433..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml +++ /dev/null @@ -1,23 +0,0 @@ -{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled .Values.controller.admissionWebhooks.patch.rbac.create (not .Values.controller.admissionWebhooks.certManager.enabled) -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} - annotations: - "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: admission-webhook - {{- with .Values.controller.admissionWebhooks.patch.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} -subjects: - - kind: ServiceAccount - name: {{ include "ingress-nginx.admissionWebhooks.patch.serviceAccountName" . }} - namespace: {{ include "ingress-nginx.namespace" . }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml deleted file mode 100644 index af3ea12a3..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml +++ /dev/null @@ -1,79 +0,0 @@ -{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled (not .Values.controller.admissionWebhooks.certManager.enabled) -}} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ include "ingress-nginx.admissionWebhooks.createSecretJob.fullname" . }} - namespace: {{ include "ingress-nginx.namespace" . }} - annotations: - "helm.sh/hook": pre-install,pre-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - {{- with .Values.controller.admissionWebhooks.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: admission-webhook - {{- with .Values.controller.admissionWebhooks.patch.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} -spec: -{{- if .Capabilities.APIVersions.Has "batch/v1alpha1" }} - # Alpha feature since k8s 1.12 - ttlSecondsAfterFinished: 0 -{{- end }} - template: - metadata: - name: {{ include "ingress-nginx.admissionWebhooks.createSecretJob.fullname" . }} - {{- if .Values.controller.admissionWebhooks.patch.podAnnotations }} - annotations: {{ toYaml .Values.controller.admissionWebhooks.patch.podAnnotations | nindent 8 }} - {{- end }} - labels: - {{- include "ingress-nginx.labels" . | nindent 8 }} - app.kubernetes.io/component: admission-webhook - {{- with .Values.controller.admissionWebhooks.patch.labels }} - {{- toYaml . | nindent 8 }} - {{- end }} - spec: - {{- if .Values.controller.admissionWebhooks.patch.priorityClassName }} - priorityClassName: {{ .Values.controller.admissionWebhooks.patch.priorityClassName }} - {{- end }} - {{- if .Values.imagePullSecrets }} - imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 8 }} - {{- end }} - containers: - - name: create - {{- with (merge .Values.controller.admissionWebhooks.patch.image .Values.global.image) }} - image: {{ if .repository }}{{ .repository }}{{ else }}{{ .registry }}/{{ .image }}{{ end }}:{{ .tag }}{{ if .digest }}@{{ .digest }}{{ end }} - {{- end }} - imagePullPolicy: {{ .Values.controller.admissionWebhooks.patch.image.pullPolicy }} - args: - - create - - --host={{ include "ingress-nginx.controller.fullname" . }}-admission,{{ include "ingress-nginx.controller.fullname" . }}-admission.$(POD_NAMESPACE).svc - - --namespace=$(POD_NAMESPACE) - - --secret-name={{ include "ingress-nginx.admissionWebhooks.fullname" . }} - env: - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - {{- if .Values.controller.admissionWebhooks.extraEnvs }} - {{- toYaml .Values.controller.admissionWebhooks.extraEnvs | nindent 12 }} - {{- end }} - {{- if .Values.controller.admissionWebhooks.createSecretJob.securityContext }} - securityContext: {{ toYaml .Values.controller.admissionWebhooks.createSecretJob.securityContext | nindent 12 }} - {{- end }} - {{- if .Values.controller.admissionWebhooks.createSecretJob.resources }} - resources: {{ toYaml .Values.controller.admissionWebhooks.createSecretJob.resources | nindent 12 }} - {{- end }} - restartPolicy: OnFailure - serviceAccountName: {{ include "ingress-nginx.admissionWebhooks.patch.serviceAccountName" . }} - {{- if .Values.controller.admissionWebhooks.patch.nodeSelector }} - nodeSelector: {{ toYaml .Values.controller.admissionWebhooks.patch.nodeSelector | nindent 8 }} - {{- end }} - {{- if .Values.controller.admissionWebhooks.patch.tolerations }} - tolerations: {{ toYaml .Values.controller.admissionWebhooks.patch.tolerations | nindent 8 }} - {{- end }} - {{- if .Values.controller.admissionWebhooks.patch.securityContext }} - securityContext: {{ toYaml .Values.controller.admissionWebhooks.patch.securityContext | nindent 8 }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml deleted file mode 100644 index 87dd2c251..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml +++ /dev/null @@ -1,81 +0,0 @@ -{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled (not .Values.controller.admissionWebhooks.certManager.enabled) -}} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ include "ingress-nginx.admissionWebhooks.patchWebhookJob.fullname" . }} - namespace: {{ include "ingress-nginx.namespace" . }} - annotations: - "helm.sh/hook": post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - {{- with .Values.controller.admissionWebhooks.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: admission-webhook - {{- with .Values.controller.admissionWebhooks.patch.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} -spec: -{{- if .Capabilities.APIVersions.Has "batch/v1alpha1" }} - # Alpha feature since k8s 1.12 - ttlSecondsAfterFinished: 0 -{{- end }} - template: - metadata: - name: {{ include "ingress-nginx.admissionWebhooks.patchWebhookJob.fullname" . }} - {{- if .Values.controller.admissionWebhooks.patch.podAnnotations }} - annotations: {{ toYaml .Values.controller.admissionWebhooks.patch.podAnnotations | nindent 8 }} - {{- end }} - labels: - {{- include "ingress-nginx.labels" . | nindent 8 }} - app.kubernetes.io/component: admission-webhook - {{- with .Values.controller.admissionWebhooks.patch.labels }} - {{- toYaml . | nindent 8 }} - {{- end }} - spec: - {{- if .Values.controller.admissionWebhooks.patch.priorityClassName }} - priorityClassName: {{ .Values.controller.admissionWebhooks.patch.priorityClassName }} - {{- end }} - {{- if .Values.imagePullSecrets }} - imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 8 }} - {{- end }} - containers: - - name: patch - {{- with (merge .Values.controller.admissionWebhooks.patch.image .Values.global.image) }} - image: {{ if .repository }}{{ .repository }}{{ else }}{{ .registry }}/{{ .image }}{{ end }}:{{ .tag }}{{ if .digest }}@{{ .digest }}{{ end }} - {{- end }} - imagePullPolicy: {{ .Values.controller.admissionWebhooks.patch.image.pullPolicy }} - args: - - patch - - --webhook-name={{ include "ingress-nginx.admissionWebhooks.fullname" . }} - - --namespace=$(POD_NAMESPACE) - - --patch-mutating=false - - --secret-name={{ include "ingress-nginx.admissionWebhooks.fullname" . }} - - --patch-failure-policy={{ .Values.controller.admissionWebhooks.failurePolicy }} - env: - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - {{- if .Values.controller.admissionWebhooks.extraEnvs }} - {{- toYaml .Values.controller.admissionWebhooks.extraEnvs | nindent 12 }} - {{- end }} - {{- if .Values.controller.admissionWebhooks.patchWebhookJob.securityContext }} - securityContext: {{ toYaml .Values.controller.admissionWebhooks.patchWebhookJob.securityContext | nindent 12 }} - {{- end }} - {{- if .Values.controller.admissionWebhooks.patchWebhookJob.resources }} - resources: {{ toYaml .Values.controller.admissionWebhooks.patchWebhookJob.resources | nindent 12 }} - {{- end }} - restartPolicy: OnFailure - serviceAccountName: {{ include "ingress-nginx.admissionWebhooks.patch.serviceAccountName" . }} - {{- if .Values.controller.admissionWebhooks.patch.nodeSelector }} - nodeSelector: {{ toYaml .Values.controller.admissionWebhooks.patch.nodeSelector | nindent 8 }} - {{- end }} - {{- if .Values.controller.admissionWebhooks.patch.tolerations }} - tolerations: {{ toYaml .Values.controller.admissionWebhooks.patch.tolerations | nindent 8 }} - {{- end }} - {{- if .Values.controller.admissionWebhooks.patch.securityContext }} - securityContext: {{ toYaml .Values.controller.admissionWebhooks.patch.securityContext | nindent 8 }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/networkpolicy.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/networkpolicy.yaml deleted file mode 100644 index a8f38df96..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/networkpolicy.yaml +++ /dev/null @@ -1,26 +0,0 @@ -{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled .Values.controller.admissionWebhooks.patch.networkPolicy.enabled (not .Values.controller.admissionWebhooks.certManager.enabled) -}} -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} - namespace: {{ include "ingress-nginx.namespace" . }} - annotations: - "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: admission-webhook - {{- with .Values.controller.admissionWebhooks.patch.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} -spec: - podSelector: - matchLabels: - {{- include "ingress-nginx.selectorLabels" . | nindent 6 }} - app.kubernetes.io/component: admission-webhook - policyTypes: - - Ingress - - Egress - egress: - - {} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/role.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/role.yaml deleted file mode 100644 index c4b23aa08..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/role.yaml +++ /dev/null @@ -1,24 +0,0 @@ -{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled .Values.controller.admissionWebhooks.patch.rbac.create (not .Values.controller.admissionWebhooks.certManager.enabled) -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} - namespace: {{ include "ingress-nginx.namespace" . }} - annotations: - "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: admission-webhook - {{- with .Values.controller.admissionWebhooks.patch.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} -rules: - - apiGroups: - - "" - resources: - - secrets - verbs: - - get - - create -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml deleted file mode 100644 index 425e8d821..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml +++ /dev/null @@ -1,24 +0,0 @@ -{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled .Values.controller.admissionWebhooks.patch.rbac.create (not .Values.controller.admissionWebhooks.certManager.enabled) -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} - namespace: {{ include "ingress-nginx.namespace" . }} - annotations: - "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: admission-webhook - {{- with .Values.controller.admissionWebhooks.patch.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} -subjects: - - kind: ServiceAccount - name: {{ include "ingress-nginx.admissionWebhooks.patch.serviceAccountName" . }} - namespace: {{ include "ingress-nginx.namespace" . }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml deleted file mode 100644 index 52f94dcce..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml +++ /dev/null @@ -1,17 +0,0 @@ -{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled .Values.controller.admissionWebhooks.patch.serviceAccount.create (not .Values.controller.admissionWebhooks.certManager.enabled) -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "ingress-nginx.admissionWebhooks.patch.serviceAccountName" . }} - namespace: {{ include "ingress-nginx.namespace" . }} - annotations: - "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: admission-webhook - {{- with .Values.controller.admissionWebhooks.patch.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} -automountServiceAccountToken: {{ .Values.controller.admissionWebhooks.patch.serviceAccount.automountServiceAccountToken }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/validating-webhook.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/validating-webhook.yaml deleted file mode 100644 index 0949cea75..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/admission-webhooks/validating-webhook.yaml +++ /dev/null @@ -1,54 +0,0 @@ -{{- if .Values.controller.admissionWebhooks.enabled -}} -# before changing this value, check the required kubernetes version -# https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#prerequisites -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingWebhookConfiguration -metadata: - annotations: - {{- if .Values.controller.admissionWebhooks.certManager.enabled }} - certmanager.k8s.io/inject-ca-from: {{ printf "%s/%s" (include "ingress-nginx.namespace" .) (include "ingress-nginx.admissionWebhooks.fullname" .) | quote }} - cert-manager.io/inject-ca-from: {{ printf "%s/%s" (include "ingress-nginx.namespace" .) (include "ingress-nginx.admissionWebhooks.fullname" .) | quote }} - {{- end }} - {{- if .Values.controller.admissionWebhooks.annotations }} - {{- toYaml .Values.controller.admissionWebhooks.annotations | nindent 4 }} - {{- end }} - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: admission-webhook - {{- with .Values.controller.admissionWebhooks.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} -webhooks: - - name: validate.nginx.ingress.kubernetes.io - matchPolicy: Equivalent - rules: - - apiGroups: - - networking.k8s.io - apiVersions: - - v1 - operations: - - CREATE - - UPDATE - resources: - - ingresses - failurePolicy: {{ .Values.controller.admissionWebhooks.failurePolicy | default "Fail" }} - sideEffects: None - admissionReviewVersions: - - v1 - clientConfig: - service: - name: {{ include "ingress-nginx.controller.fullname" . }}-admission - namespace: {{ include "ingress-nginx.namespace" . }} - port: {{ .Values.controller.admissionWebhooks.service.servicePort }} - path: /networking/v1/ingresses - {{- if .Values.controller.admissionWebhooks.timeoutSeconds }} - timeoutSeconds: {{ .Values.controller.admissionWebhooks.timeoutSeconds }} - {{- end }} - {{- if .Values.controller.admissionWebhooks.namespaceSelector }} - namespaceSelector: {{ toYaml .Values.controller.admissionWebhooks.namespaceSelector | nindent 6 }} - {{- end }} - {{- if .Values.controller.admissionWebhooks.objectSelector }} - objectSelector: {{ toYaml .Values.controller.admissionWebhooks.objectSelector | nindent 6 }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/clusterrole.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/clusterrole.yaml deleted file mode 100644 index 51bc5002c..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/clusterrole.yaml +++ /dev/null @@ -1,102 +0,0 @@ -{{- if .Values.rbac.create }} - -{{- if and .Values.rbac.scope (not .Values.controller.scope.enabled) -}} - {{ required "Invalid configuration: 'rbac.scope' should be equal to 'controller.scope.enabled' (true/false)." (index (dict) ".") }} -{{- end }} - -{{- if not .Values.rbac.scope -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - {{- with .Values.controller.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.fullname" . }} -rules: - - apiGroups: - - "" - resources: - - configmaps - - endpoints - - nodes - - pods - - secrets -{{- if not .Values.controller.scope.enabled }} - - namespaces -{{- end}} - verbs: - - list - - watch - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - list - - watch -{{- if and .Values.controller.scope.enabled .Values.controller.scope.namespace }} - - apiGroups: - - "" - resources: - - namespaces - resourceNames: - - "{{ .Values.controller.scope.namespace }}" - verbs: - - get -{{- end }} - - apiGroups: - - "" - resources: - - nodes - verbs: - - get - - apiGroups: - - "" - resources: - - services - verbs: - - get - - list - - watch - - apiGroups: - - networking.k8s.io - resources: - - ingresses - verbs: - - get - - list - - watch - - apiGroups: - - "" - resources: - - events - verbs: - - create - - patch - - apiGroups: - - networking.k8s.io - resources: - - ingresses/status - verbs: - - update - - apiGroups: - - networking.k8s.io - resources: - - ingressclasses - verbs: - - get - - list - - watch - - apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - list - - watch - - get -{{- end }} - -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/clusterrolebinding.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/clusterrolebinding.yaml deleted file mode 100644 index 8f91aac80..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/clusterrolebinding.yaml +++ /dev/null @@ -1,19 +0,0 @@ -{{- if and .Values.rbac.create (not .Values.rbac.scope) -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - {{- with .Values.controller.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.fullname" . }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ include "ingress-nginx.fullname" . }} -subjects: - - kind: ServiceAccount - name: {{ template "ingress-nginx.serviceAccountName" . }} - namespace: {{ include "ingress-nginx.namespace" . }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-addheaders.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-addheaders.yaml deleted file mode 100644 index 4e4bd1310..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-addheaders.yaml +++ /dev/null @@ -1,14 +0,0 @@ -{{- if .Values.controller.addHeaders -}} -apiVersion: v1 -kind: ConfigMap -metadata: - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: controller - {{- with .Values.controller.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.fullname" . }}-custom-add-headers - namespace: {{ include "ingress-nginx.namespace" . }} -data: {{ toYaml .Values.controller.addHeaders | nindent 2 }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-proxyheaders.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-proxyheaders.yaml deleted file mode 100644 index 0a22600db..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-proxyheaders.yaml +++ /dev/null @@ -1,14 +0,0 @@ -{{- if .Values.controller.proxySetHeaders -}} -apiVersion: v1 -kind: ConfigMap -metadata: - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: controller - {{- with .Values.controller.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.fullname" . }}-custom-proxy-headers - namespace: {{ include "ingress-nginx.namespace" . }} -data: {{ toYaml .Values.controller.proxySetHeaders | nindent 2 }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-tcp.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-tcp.yaml deleted file mode 100644 index 131a9ad51..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-tcp.yaml +++ /dev/null @@ -1,17 +0,0 @@ -{{- if .Values.tcp -}} -apiVersion: v1 -kind: ConfigMap -metadata: - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: controller - {{- with .Values.controller.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} -{{- if .Values.controller.tcp.annotations }} - annotations: {{ toYaml .Values.controller.tcp.annotations | nindent 4 }} -{{- end }} - name: {{ include "ingress-nginx.fullname" . }}-tcp - namespace: {{ include "ingress-nginx.namespace" . }} -data: {{ tpl (toYaml .Values.tcp) . | nindent 2 }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-udp.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-udp.yaml deleted file mode 100644 index 7137da9ad..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap-udp.yaml +++ /dev/null @@ -1,17 +0,0 @@ -{{- if .Values.udp -}} -apiVersion: v1 -kind: ConfigMap -metadata: - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: controller - {{- with .Values.controller.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} -{{- if .Values.controller.udp.annotations }} - annotations: {{ toYaml .Values.controller.udp.annotations | nindent 4 }} -{{- end }} - name: {{ include "ingress-nginx.fullname" . }}-udp - namespace: {{ include "ingress-nginx.namespace" . }} -data: {{ tpl (toYaml .Values.udp) . | nindent 2 }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap.yaml deleted file mode 100644 index b73cdc2d0..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-configmap.yaml +++ /dev/null @@ -1,30 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: controller - {{- with .Values.controller.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} -{{- if .Values.controller.configAnnotations }} - annotations: {{ toYaml .Values.controller.configAnnotations | nindent 4 }} -{{- end }} - name: {{ include "ingress-nginx.controller.fullname" . }} - namespace: {{ include "ingress-nginx.namespace" . }} -data: -{{- if .Values.controller.allowSnippetAnnotations }} - allow-snippet-annotations: "true" -{{- end }} -{{- if .Values.controller.addHeaders }} - add-headers: {{ include "ingress-nginx.namespace" . }}/{{ include "ingress-nginx.fullname" . }}-custom-add-headers -{{- end }} -{{- if .Values.controller.proxySetHeaders }} - proxy-set-headers: {{ include "ingress-nginx.namespace" . }}/{{ include "ingress-nginx.fullname" . }}-custom-proxy-headers -{{- end }} -{{- if .Values.dhParam }} - ssl-dh-param: {{ include "ingress-nginx.namespace" . }}/{{ include "ingress-nginx.controller.fullname" . }} -{{- end }} -{{- range $key, $value := .Values.controller.config }} - {{- $key | nindent 2 }}: {{ tpl (toString $value) $ | quote }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-daemonset.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-daemonset.yaml deleted file mode 100644 index fd1b13284..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-daemonset.yaml +++ /dev/null @@ -1,236 +0,0 @@ -{{- if eq .Values.controller.kind "DaemonSet" -}} -apiVersion: apps/v1 -kind: DaemonSet -metadata: - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: controller - {{- with .Values.controller.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.controller.fullname" . }} - namespace: {{ include "ingress-nginx.namespace" . }} - {{- if .Values.controller.annotations }} - annotations: {{ toYaml .Values.controller.annotations | nindent 4 }} - {{- end }} -spec: - selector: - matchLabels: - {{- include "ingress-nginx.selectorLabels" . | nindent 6 }} - app.kubernetes.io/component: controller - revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} - {{- if .Values.controller.updateStrategy }} - updateStrategy: {{ toYaml .Values.controller.updateStrategy | nindent 4 }} - {{- end }} - minReadySeconds: {{ .Values.controller.minReadySeconds }} - template: - metadata: - {{- if .Values.controller.podAnnotations }} - annotations: - {{- range $key, $value := .Values.controller.podAnnotations }} - {{ $key }}: {{ $value | quote }} - {{- end }} - {{- end }} - labels: - {{- include "ingress-nginx.labels" . | nindent 8 }} - app.kubernetes.io/component: controller - {{- with .Values.controller.labels }} - {{- toYaml . | nindent 8 }} - {{- end }} - {{- if .Values.controller.podLabels }} - {{- toYaml .Values.controller.podLabels | nindent 8 }} - {{- end }} - spec: - {{- if .Values.controller.dnsConfig }} - dnsConfig: {{ toYaml .Values.controller.dnsConfig | nindent 8 }} - {{- end }} - {{- if .Values.controller.hostAliases }} - hostAliases: {{ tpl (toYaml .Values.controller.hostAliases) $ | nindent 8 }} - {{- end }} - {{- if .Values.controller.hostname }} - hostname: {{ toYaml .Values.controller.hostname | nindent 8 }} - {{- end }} - dnsPolicy: {{ .Values.controller.dnsPolicy }} - {{- if .Values.imagePullSecrets }} - imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 8 }} - {{- end }} - {{- if .Values.controller.priorityClassName }} - priorityClassName: {{ .Values.controller.priorityClassName | quote }} - {{- end }} - {{- if or .Values.controller.podSecurityContext .Values.controller.sysctls }} - securityContext: - {{- if .Values.controller.podSecurityContext }} - {{- toYaml .Values.controller.podSecurityContext | nindent 8 }} - {{- end }} - {{- if .Values.controller.sysctls }} - sysctls: - {{- range $sysctl, $value := .Values.controller.sysctls }} - - name: {{ $sysctl | quote }} - value: {{ $value | quote }} - {{- end }} - {{- end }} - {{- end }} - {{- if .Values.controller.shareProcessNamespace }} - shareProcessNamespace: {{ .Values.controller.shareProcessNamespace }} - {{- end }} - containers: - - name: {{ .Values.controller.containerName }} - {{- with (merge .Values.controller.image .Values.global.image) }} - image: {{ if .repository }}{{ .repository }}{{ else }}{{ .registry }}/{{ include "ingress-nginx.image" . }}{{ end }}:{{ .tag }}{{ include "ingress-nginx.imageDigest" . }} - {{- end }} - imagePullPolicy: {{ .Values.controller.image.pullPolicy }} - {{- if .Values.controller.lifecycle }} - lifecycle: {{ toYaml .Values.controller.lifecycle | nindent 12 }} - {{- end }} - args: {{ include "ingress-nginx.params" . | nindent 12 }} - securityContext: {{ include "ingress-nginx.controller.containerSecurityContext" . | nindent 12 }} - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - {{- if .Values.controller.enableMimalloc }} - - name: LD_PRELOAD - value: /usr/local/lib/libmimalloc.so - {{- end }} - {{- if .Values.controller.extraEnvs }} - {{- toYaml .Values.controller.extraEnvs | nindent 12 }} - {{- end }} - {{- if .Values.controller.startupProbe }} - startupProbe: {{ toYaml .Values.controller.startupProbe | nindent 12 }} - {{- end }} - {{- if .Values.controller.livenessProbe }} - livenessProbe: {{ toYaml .Values.controller.livenessProbe | nindent 12 }} - {{- end }} - {{- if .Values.controller.readinessProbe }} - readinessProbe: {{ toYaml .Values.controller.readinessProbe | nindent 12 }} - {{- end }} - ports: - {{- range $key, $value := .Values.controller.containerPort }} - - name: {{ $key }} - containerPort: {{ $value }} - protocol: TCP - {{- if $.Values.controller.hostPort.enabled }} - hostPort: {{ index $.Values.controller.hostPort.ports $key | default $value }} - {{- end }} - {{- end }} - {{- if .Values.controller.metrics.enabled }} - - name: {{ .Values.controller.metrics.portName }} - containerPort: {{ .Values.controller.metrics.port }} - protocol: TCP - {{- end }} - {{- if .Values.controller.admissionWebhooks.enabled }} - - name: webhook - containerPort: {{ .Values.controller.admissionWebhooks.port }} - protocol: TCP - {{- end }} - {{- range $key, $value := .Values.tcp }} - - name: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-tcp - containerPort: {{ $key }} - protocol: TCP - {{- if $.Values.controller.hostPort.enabled }} - hostPort: {{ $key }} - {{- end }} - {{- end }} - {{- range $key, $value := .Values.udp }} - - name: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-udp - containerPort: {{ $key }} - protocol: UDP - {{- if $.Values.controller.hostPort.enabled }} - hostPort: {{ $key }} - {{- end }} - {{- end }} - {{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraModules) }} - volumeMounts: - {{- if .Values.controller.extraModules }} - - name: modules - {{- if .Values.controller.image.chroot }} - mountPath: /chroot/modules_mount - {{- else }} - mountPath: /modules_mount - {{- end }} - {{- end }} - {{- if .Values.controller.customTemplate.configMapName }} - - mountPath: /etc/nginx/template - name: nginx-template-volume - readOnly: true - {{- end }} - {{- if .Values.controller.admissionWebhooks.enabled }} - - name: webhook-cert - mountPath: /usr/local/certificates/ - readOnly: true - {{- end }} - {{- if .Values.controller.extraVolumeMounts }} - {{- toYaml .Values.controller.extraVolumeMounts | nindent 12 }} - {{- end }} - {{- end }} - {{- if .Values.controller.resources }} - resources: {{ toYaml .Values.controller.resources | nindent 12 }} - {{- end }} - {{- if .Values.controller.extraContainers }} - {{- toYaml .Values.controller.extraContainers | nindent 8 }} - {{- end }} - {{- if (or .Values.controller.extraInitContainers .Values.controller.extraModules) }} - initContainers: - {{- if .Values.controller.extraInitContainers }} - {{- toYaml .Values.controller.extraInitContainers | nindent 8 }} - {{- end }} - {{- if .Values.controller.extraModules }} - {{- range .Values.controller.extraModules }} - {{- $containerSecurityContext := .containerSecurityContext | default $.Values.controller.containerSecurityContext }} - {{- include "extraModules" (dict "name" .name "image" (merge .image $.Values.global.image) "containerSecurityContext" $containerSecurityContext "resources" .resources) | nindent 8 }} - {{- end }} - {{- end }} - {{- end }} - {{- if .Values.controller.hostNetwork }} - hostNetwork: {{ .Values.controller.hostNetwork }} - {{- end }} - {{- if .Values.controller.nodeSelector }} - nodeSelector: {{ toYaml .Values.controller.nodeSelector | nindent 8 }} - {{- end }} - {{- if .Values.controller.tolerations }} - tolerations: {{ toYaml .Values.controller.tolerations | nindent 8 }} - {{- end }} - {{- if .Values.controller.affinity }} - affinity: {{ tpl (toYaml .Values.controller.affinity) $ | nindent 8 }} - {{- end }} - {{- if .Values.controller.topologySpreadConstraints }} - topologySpreadConstraints: {{ tpl (toYaml .Values.controller.topologySpreadConstraints) $ | nindent 8 }} - {{- end }} - serviceAccountName: {{ template "ingress-nginx.serviceAccountName" . }} - terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }} - {{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraVolumes .Values.controller.extraModules) }} - volumes: - {{- if .Values.controller.extraModules }} - - name: modules - emptyDir: {} - {{- end }} - {{- if .Values.controller.customTemplate.configMapName }} - - name: nginx-template-volume - configMap: - name: {{ .Values.controller.customTemplate.configMapName }} - items: - - key: {{ .Values.controller.customTemplate.configMapKey }} - path: nginx.tmpl - {{- end }} - {{- if .Values.controller.admissionWebhooks.enabled }} - - name: webhook-cert - secret: - secretName: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} - {{- if .Values.controller.admissionWebhooks.certManager.enabled }} - items: - - key: tls.crt - path: cert - - key: tls.key - path: key - {{- end }} - {{- end }} - {{- if .Values.controller.extraVolumes }} - {{ toYaml .Values.controller.extraVolumes | nindent 8 }} - {{- end }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-deployment.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-deployment.yaml deleted file mode 100644 index cc41bfbc7..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-deployment.yaml +++ /dev/null @@ -1,242 +0,0 @@ -{{- if eq .Values.controller.kind "Deployment" -}} -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: controller - {{- with .Values.controller.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.controller.fullname" . }} - namespace: {{ include "ingress-nginx.namespace" . }} - {{- if .Values.controller.annotations }} - annotations: {{ toYaml .Values.controller.annotations | nindent 4 }} - {{- end }} -spec: - selector: - matchLabels: - {{- include "ingress-nginx.selectorLabels" . | nindent 6 }} - app.kubernetes.io/component: controller - {{- if eq .Values.controller.autoscaling.enabled .Values.controller.keda.enabled }} - replicas: {{ .Values.controller.replicaCount }} - {{- end }} - revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} - {{- if .Values.controller.progressDeadlineSeconds }} - progressDeadlineSeconds: {{ .Values.controller.progressDeadlineSeconds }} - {{- end }} - {{- if .Values.controller.updateStrategy }} - strategy: {{ toYaml .Values.controller.updateStrategy | nindent 4 }} - {{- end }} - minReadySeconds: {{ .Values.controller.minReadySeconds }} - template: - metadata: - {{- if .Values.controller.podAnnotations }} - annotations: - {{- range $key, $value := .Values.controller.podAnnotations }} - {{ $key }}: {{ $value | quote }} - {{- end }} - {{- end }} - labels: - {{- include "ingress-nginx.labels" . | nindent 8 }} - app.kubernetes.io/component: controller - {{- with .Values.controller.labels }} - {{- toYaml . | nindent 8 }} - {{- end }} - {{- if .Values.controller.podLabels }} - {{- toYaml .Values.controller.podLabels | nindent 8 }} - {{- end }} - spec: - {{- if .Values.controller.dnsConfig }} - dnsConfig: {{ toYaml .Values.controller.dnsConfig | nindent 8 }} - {{- end }} - {{- if .Values.controller.hostAliases }} - hostAliases: {{ tpl (toYaml .Values.controller.hostAliases) $ | nindent 8 }} - {{- end }} - {{- if .Values.controller.hostname }} - hostname: {{ toYaml .Values.controller.hostname | nindent 8 }} - {{- end }} - dnsPolicy: {{ .Values.controller.dnsPolicy }} - {{- if .Values.imagePullSecrets }} - imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 8 }} - {{- end }} - {{- if .Values.controller.priorityClassName }} - priorityClassName: {{ .Values.controller.priorityClassName | quote }} - {{- end }} - {{- if or .Values.controller.podSecurityContext .Values.controller.sysctls }} - securityContext: - {{- if .Values.controller.podSecurityContext }} - {{- toYaml .Values.controller.podSecurityContext | nindent 8 }} - {{- end }} - {{- if .Values.controller.sysctls }} - sysctls: - {{- range $sysctl, $value := .Values.controller.sysctls }} - - name: {{ $sysctl | quote }} - value: {{ $value | quote }} - {{- end }} - {{- end }} - {{- end }} - {{- if .Values.controller.shareProcessNamespace }} - shareProcessNamespace: {{ .Values.controller.shareProcessNamespace }} - {{- end }} - containers: - - name: {{ .Values.controller.containerName }} - {{- with (merge .Values.controller.image .Values.global.image) }} - image: {{ if .repository }}{{ .repository }}{{ else }}{{ .registry }}/{{ include "ingress-nginx.image" . }}{{ end }}:{{ .tag }}{{ include "ingress-nginx.imageDigest" . }} - {{- end }} - imagePullPolicy: {{ .Values.controller.image.pullPolicy }} - {{- if .Values.controller.lifecycle }} - lifecycle: {{ toYaml .Values.controller.lifecycle | nindent 12 }} - {{- end }} - args: {{ include "ingress-nginx.params" . | nindent 12 }} - securityContext: {{ include "ingress-nginx.controller.containerSecurityContext" . | nindent 12 }} - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - {{- if .Values.controller.enableMimalloc }} - - name: LD_PRELOAD - value: /usr/local/lib/libmimalloc.so - {{- end }} - {{- if .Values.controller.extraEnvs }} - {{- toYaml .Values.controller.extraEnvs | nindent 12 }} - {{- end }} - {{- if .Values.controller.startupProbe }} - startupProbe: {{ toYaml .Values.controller.startupProbe | nindent 12 }} - {{- end }} - {{- if .Values.controller.livenessProbe }} - livenessProbe: {{ toYaml .Values.controller.livenessProbe | nindent 12 }} - {{- end }} - {{- if .Values.controller.readinessProbe }} - readinessProbe: {{ toYaml .Values.controller.readinessProbe | nindent 12 }} - {{- end }} - ports: - {{- range $key, $value := .Values.controller.containerPort }} - - name: {{ $key }} - containerPort: {{ $value }} - protocol: TCP - {{- if $.Values.controller.hostPort.enabled }} - hostPort: {{ index $.Values.controller.hostPort.ports $key | default $value }} - {{- end }} - {{- end }} - {{- if .Values.controller.metrics.enabled }} - - name: {{ .Values.controller.metrics.portName }} - containerPort: {{ .Values.controller.metrics.port }} - protocol: TCP - {{- end }} - {{- if .Values.controller.admissionWebhooks.enabled }} - - name: webhook - containerPort: {{ .Values.controller.admissionWebhooks.port }} - protocol: TCP - {{- end }} - {{- range $key, $value := .Values.tcp }} - - name: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-tcp - containerPort: {{ $key }} - protocol: TCP - {{- if $.Values.controller.hostPort.enabled }} - hostPort: {{ $key }} - {{- end }} - {{- end }} - {{- range $key, $value := .Values.udp }} - - name: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-udp - containerPort: {{ $key }} - protocol: UDP - {{- if $.Values.controller.hostPort.enabled }} - hostPort: {{ $key }} - {{- end }} - {{- end }} - {{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraModules) }} - volumeMounts: - {{- if .Values.controller.extraModules }} - - name: modules - {{- if .Values.controller.image.chroot }} - mountPath: /chroot/modules_mount - {{- else }} - mountPath: /modules_mount - {{- end }} - {{- end }} - {{- if .Values.controller.customTemplate.configMapName }} - - mountPath: /etc/nginx/template - name: nginx-template-volume - readOnly: true - {{- end }} - {{- if .Values.controller.admissionWebhooks.enabled }} - - name: webhook-cert - mountPath: /usr/local/certificates/ - readOnly: true - {{- end }} - {{- if .Values.controller.extraVolumeMounts }} - {{- toYaml .Values.controller.extraVolumeMounts | nindent 12 }} - {{- end }} - {{- end }} - {{- if .Values.controller.resources }} - resources: {{ toYaml .Values.controller.resources | nindent 12 }} - {{- end }} - {{- if .Values.controller.extraContainers }} - {{- toYaml .Values.controller.extraContainers | nindent 8 }} - {{- end }} - {{- if (or .Values.controller.extraInitContainers .Values.controller.extraModules) }} - initContainers: - {{- if .Values.controller.extraInitContainers }} - {{- toYaml .Values.controller.extraInitContainers | nindent 8 }} - {{- end }} - {{- if .Values.controller.extraModules }} - {{- range .Values.controller.extraModules }} - {{- $containerSecurityContext := .containerSecurityContext | default $.Values.controller.containerSecurityContext }} - {{- include "extraModules" (dict "name" .name "image" (merge .image $.Values.global.image) "containerSecurityContext" $containerSecurityContext "resources" .resources) | nindent 8 }} - {{- end }} - {{- end }} - {{- end }} - {{- if .Values.controller.hostNetwork }} - hostNetwork: {{ .Values.controller.hostNetwork }} - {{- end }} - {{- if .Values.controller.nodeSelector }} - nodeSelector: {{ toYaml .Values.controller.nodeSelector | nindent 8 }} - {{- end }} - {{- if .Values.controller.tolerations }} - tolerations: {{ toYaml .Values.controller.tolerations | nindent 8 }} - {{- end }} - {{- if .Values.controller.affinity }} - affinity: {{ tpl (toYaml .Values.controller.affinity) $ | nindent 8 }} - {{- end }} - {{- if .Values.controller.topologySpreadConstraints }} - topologySpreadConstraints: {{ tpl (toYaml .Values.controller.topologySpreadConstraints) $ | nindent 8 }} - {{- end }} - serviceAccountName: {{ template "ingress-nginx.serviceAccountName" . }} - terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }} - {{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraVolumes .Values.controller.extraModules) }} - volumes: - {{- if .Values.controller.extraModules }} - - name: modules - emptyDir: {} - {{- end }} - {{- if .Values.controller.customTemplate.configMapName }} - - name: nginx-template-volume - configMap: - name: {{ .Values.controller.customTemplate.configMapName }} - items: - - key: {{ .Values.controller.customTemplate.configMapKey }} - path: nginx.tmpl - {{- end }} - {{- if .Values.controller.admissionWebhooks.enabled }} - - name: webhook-cert - secret: - secretName: {{ include "ingress-nginx.admissionWebhooks.fullname" . }} - {{- if .Values.controller.admissionWebhooks.certManager.enabled }} - items: - - key: tls.crt - path: cert - - key: tls.key - path: key - {{- end }} - {{- end }} - {{- if .Values.controller.extraVolumes }} - {{ toYaml .Values.controller.extraVolumes | nindent 8 }} - {{- end }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-hpa.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-hpa.yaml deleted file mode 100644 index ec9ad7380..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-hpa.yaml +++ /dev/null @@ -1,47 +0,0 @@ -{{- if and (eq .Values.controller.kind "Deployment") .Values.controller.autoscaling.enabled (not .Values.controller.keda.enabled) -}} -apiVersion: {{ ternary "autoscaling/v2" "autoscaling/v2beta2" (.Capabilities.APIVersions.Has "autoscaling/v2") }} -kind: HorizontalPodAutoscaler -metadata: - {{- with .Values.controller.autoscaling.annotations }} - annotations: {{ toYaml . | nindent 4 }} - {{- end }} - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: controller - {{- with .Values.controller.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.controller.fullname" . }} - namespace: {{ include "ingress-nginx.namespace" . }} -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: {{ include "ingress-nginx.controller.fullname" . }} - minReplicas: {{ .Values.controller.autoscaling.minReplicas }} - maxReplicas: {{ .Values.controller.autoscaling.maxReplicas }} - metrics: - {{- with .Values.controller.autoscaling.targetMemoryUtilizationPercentage }} - - type: Resource - resource: - name: memory - target: - type: Utilization - averageUtilization: {{ . }} - {{- end }} - {{- with .Values.controller.autoscaling.targetCPUUtilizationPercentage }} - - type: Resource - resource: - name: cpu - target: - type: Utilization - averageUtilization: {{ . }} - {{- end }} - {{- with .Values.controller.autoscalingTemplate }} - {{- toYaml . | nindent 2 }} - {{- end }} - {{- with .Values.controller.autoscaling.behavior }} - behavior: - {{- toYaml . | nindent 4 }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-ingressclass-aliases.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-ingressclass-aliases.yaml deleted file mode 100644 index ffe22310c..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-ingressclass-aliases.yaml +++ /dev/null @@ -1,23 +0,0 @@ -{{- if .Values.controller.ingressClassResource.enabled -}} -{{- range .Values.controller.ingressClassResource.aliases }} ---- -apiVersion: networking.k8s.io/v1 -kind: IngressClass -metadata: - labels: - {{- include "ingress-nginx.labels" $ | nindent 4 }} - app.kubernetes.io/component: controller - {{- with $.Values.controller.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ . }} - {{- if $.Values.controller.ingressClassResource.annotations }} - annotations: {{ toYaml $.Values.controller.ingressClassResource.annotations | nindent 4 }} - {{- end }} -spec: - controller: {{ $.Values.controller.ingressClassResource.controllerValue }} - {{- with $.Values.controller.ingressClassResource.parameters }} - parameters: {{ toYaml . | nindent 4 }} - {{- end }} -{{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-ingressclass.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-ingressclass.yaml deleted file mode 100644 index 98479a529..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-ingressclass.yaml +++ /dev/null @@ -1,26 +0,0 @@ -{{- if .Values.controller.ingressClassResource.enabled -}} -apiVersion: networking.k8s.io/v1 -kind: IngressClass -metadata: - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: controller - {{- with .Values.controller.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ .Values.controller.ingressClassResource.name }} - {{- if or .Values.controller.ingressClassResource.default .Values.controller.ingressClassResource.annotations }} - annotations: - {{- if .Values.controller.ingressClassResource.default }} - ingressclass.kubernetes.io/is-default-class: "true" - {{- end }} - {{- if .Values.controller.ingressClassResource.annotations }} - {{- toYaml .Values.controller.ingressClassResource.annotations | nindent 4 }} - {{- end }} - {{- end }} -spec: - controller: {{ .Values.controller.ingressClassResource.controllerValue }} - {{- with .Values.controller.ingressClassResource.parameters }} - parameters: {{ toYaml . | nindent 4 }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-keda.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-keda.yaml deleted file mode 100644 index 24d30fa0a..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-keda.yaml +++ /dev/null @@ -1,46 +0,0 @@ -{{- if and (eq .Values.controller.kind "Deployment") .Values.controller.keda.enabled (not .Values.controller.autoscaling.enabled) -}} -apiVersion: {{ .Values.controller.keda.apiVersion }} -kind: ScaledObject -metadata: - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: controller - {{- with .Values.controller.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.controller.fullname" . }} - namespace: {{ include "ingress-nginx.namespace" . }} - {{- if .Values.controller.keda.scaledObject.annotations }} - annotations: {{ toYaml .Values.controller.keda.scaledObject.annotations | nindent 4 }} - {{- end }} -spec: - scaleTargetRef: -{{- if eq .Values.controller.keda.apiVersion "keda.k8s.io/v1alpha1" }} - deploymentName: {{ include "ingress-nginx.controller.fullname" . }} -{{- else if eq .Values.controller.keda.apiVersion "keda.sh/v1alpha1" }} - name: {{ include "ingress-nginx.controller.fullname" . }} -{{- end }} - pollingInterval: {{ .Values.controller.keda.pollingInterval }} - cooldownPeriod: {{ .Values.controller.keda.cooldownPeriod }} - minReplicaCount: {{ .Values.controller.keda.minReplicas }} - maxReplicaCount: {{ .Values.controller.keda.maxReplicas }} -{{- with .Values.controller.keda.fallback }} - fallback: - failureThreshold: {{ .failureThreshold | default 3 }} - replicas: {{ .replicas | default $.Values.controller.keda.maxReplicas }} -{{- end }} - triggers: -{{- with .Values.controller.keda.triggers }} -{{ toYaml . | indent 2 }} -{{ end }} - advanced: - restoreToOriginalReplicaCount: {{ .Values.controller.keda.restoreToOriginalReplicaCount }} -{{- if .Values.controller.keda.behavior }} - horizontalPodAutoscalerConfig: - behavior: -{{ with .Values.controller.keda.behavior -}} -{{ toYaml . | indent 8 }} -{{ end }} - -{{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-networkpolicy.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-networkpolicy.yaml deleted file mode 100644 index e68f9916d..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-networkpolicy.yaml +++ /dev/null @@ -1,45 +0,0 @@ -{{- if .Values.controller.networkPolicy.enabled }} -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: controller - {{- with .Values.controller.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.controller.fullname" . }} - namespace: {{ include "ingress-nginx.namespace" . }} -spec: - podSelector: - matchLabels: - {{- include "ingress-nginx.selectorLabels" . | nindent 6 }} - app.kubernetes.io/component: controller - policyTypes: - - Ingress - - Egress - ingress: - - ports: - {{- range $key, $value := .Values.controller.containerPort }} - - protocol: TCP - port: {{ $value }} - {{- end }} - {{- if .Values.controller.metrics.enabled }} - - protocol: TCP - port: {{ .Values.controller.metrics.port }} - {{- end }} - {{- if .Values.controller.admissionWebhooks.enabled }} - - protocol: TCP - port: {{ .Values.controller.admissionWebhooks.port }} - {{- end }} - {{- range $key, $value := .Values.tcp }} - - protocol: TCP - port: {{ $key }} - {{- end }} - {{- range $key, $value := .Values.udp }} - - protocol: UDP - port: {{ $key }} - {{- end }} - egress: - - {} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-poddisruptionbudget.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-poddisruptionbudget.yaml deleted file mode 100644 index a1f5fbba2..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-poddisruptionbudget.yaml +++ /dev/null @@ -1,39 +0,0 @@ -# PDB is not supported for DaemonSets. -# https://github.com/kubernetes/kubernetes/issues/108124 -{{- if eq .Values.controller.kind "Deployment" }} -{{- $replicas := .Values.controller.replicaCount }} -{{- if and .Values.controller.autoscaling.enabled (not .Values.controller.keda.enabled) }} -{{- $replicas = .Values.controller.autoscaling.minReplicas }} -{{- else if and .Values.controller.keda.enabled (not .Values.controller.autoscaling.enabled) }} -{{- $replicas = .Values.controller.keda.minReplicas }} -{{- end }} -{{- if gt ($replicas | int) 1 }} -apiVersion: {{ ternary "policy/v1" "policy/v1beta1" (semverCompare ">=1.21.0-0" .Capabilities.KubeVersion.Version) }} -kind: PodDisruptionBudget -metadata: - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: controller - {{- with .Values.controller.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.controller.fullname" . }} - namespace: {{ include "ingress-nginx.namespace" . }} - {{- if .Values.controller.annotations }} - annotations: {{ toYaml .Values.controller.annotations | nindent 4 }} - {{- end }} -spec: - selector: - matchLabels: - {{- include "ingress-nginx.selectorLabels" . | nindent 6 }} - app.kubernetes.io/component: controller - {{- if and .Values.controller.minAvailable (not (hasKey .Values.controller "maxUnavailable")) }} - minAvailable: {{ .Values.controller.minAvailable }} - {{- else if .Values.controller.maxUnavailable }} - maxUnavailable: {{ .Values.controller.maxUnavailable }} - {{- end }} - {{- if .Values.controller.unhealthyPodEvictionPolicy }} - unhealthyPodEvictionPolicy: {{ .Values.controller.unhealthyPodEvictionPolicy }} - {{- end }} -{{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-prometheusrule.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-prometheusrule.yaml deleted file mode 100644 index 4a9357f71..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-prometheusrule.yaml +++ /dev/null @@ -1,26 +0,0 @@ -{{- if and .Values.controller.metrics.enabled .Values.controller.metrics.prometheusRule.enabled -}} -apiVersion: monitoring.coreos.com/v1 -kind: PrometheusRule -metadata: - name: {{ include "ingress-nginx.controller.fullname" . }} -{{- if .Values.controller.metrics.prometheusRule.namespace }} - namespace: {{ .Values.controller.metrics.prometheusRule.namespace }} -{{- else }} - namespace: {{ include "ingress-nginx.namespace" . }} -{{- end }} - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: controller - {{- if .Values.controller.metrics.prometheusRule.additionalLabels }} - {{- toYaml .Values.controller.metrics.prometheusRule.additionalLabels | nindent 4 }} - {{- end }} - {{- if .Values.controller.metrics.prometheusRule.annotations }} - annotations: {{ toYaml .Values.controller.metrics.prometheusRule.annotations | nindent 4 }} - {{- end }} -spec: -{{- if .Values.controller.metrics.prometheusRule.rules }} - groups: - - name: {{ template "ingress-nginx.name" . }} - rules: {{- toYaml .Values.controller.metrics.prometheusRule.rules | nindent 4 }} -{{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-role.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-role.yaml deleted file mode 100644 index 127b368c4..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-role.yaml +++ /dev/null @@ -1,94 +0,0 @@ -{{- if .Values.rbac.create -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: controller - {{- with .Values.controller.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.fullname" . }} - namespace: {{ include "ingress-nginx.namespace" . }} -rules: - - apiGroups: - - "" - resources: - - namespaces - verbs: - - get - - apiGroups: - - "" - resources: - - configmaps - - pods - - secrets - - endpoints - verbs: - - get - - list - - watch - - apiGroups: - - "" - resources: - - services - verbs: - - get - - list - - watch - - apiGroups: - - networking.k8s.io - resources: - - ingresses - verbs: - - get - - list - - watch - # Omit Ingress status permissions if `--update-status` is disabled. - {{- if ne (index .Values.controller.extraArgs "update-status") "false" }} - - apiGroups: - - networking.k8s.io - resources: - - ingresses/status - verbs: - - update - {{- end }} - - apiGroups: - - networking.k8s.io - resources: - - ingressclasses - verbs: - - get - - list - - watch - - apiGroups: - - coordination.k8s.io - resources: - - leases - resourceNames: - - {{ include "ingress-nginx.controller.electionID" . }} - verbs: - - get - - update - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - create - - apiGroups: - - "" - resources: - - events - verbs: - - create - - patch - - apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - list - - watch - - get -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-rolebinding.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-rolebinding.yaml deleted file mode 100644 index 153430aa2..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-rolebinding.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{- if .Values.rbac.create -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: controller - {{- with .Values.controller.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.fullname" . }} - namespace: {{ include "ingress-nginx.namespace" . }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ include "ingress-nginx.fullname" . }} -subjects: - - kind: ServiceAccount - name: {{ template "ingress-nginx.serviceAccountName" . }} - namespace: {{ include "ingress-nginx.namespace" . }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-secret.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-secret.yaml deleted file mode 100644 index f20f53469..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-secret.yaml +++ /dev/null @@ -1,15 +0,0 @@ -{{- if .Values.dhParam -}} -apiVersion: v1 -kind: Secret -metadata: - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: controller - {{- with .Values.controller.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.controller.fullname" . }} - namespace: {{ include "ingress-nginx.namespace" . }} -data: - dhparam.pem: {{ .Values.dhParam }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-internal.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-internal.yaml deleted file mode 100644 index 6d0b47caf..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-internal.yaml +++ /dev/null @@ -1,105 +0,0 @@ -{{- if and .Values.controller.service.enabled .Values.controller.service.internal.enabled .Values.controller.service.internal.annotations -}} -apiVersion: v1 -kind: Service -metadata: - annotations: - {{- range $key, $value := .Values.controller.service.internal.annotations }} - {{ $key }}: {{ tpl ($value | toString) $ | quote }} - {{- end }} - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: controller - {{- if .Values.controller.service.labels }} - {{- toYaml .Values.controller.service.labels | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.controller.fullname" . }}-internal - namespace: {{ include "ingress-nginx.namespace" . }} -spec: - type: {{ .Values.controller.service.internal.type | default .Values.controller.service.type }} -{{- if .Values.controller.service.internal.clusterIP }} - clusterIP: {{ .Values.controller.service.internal.clusterIP }} -{{- end }} -{{- if .Values.controller.service.internal.externalIPs }} - externalIPs: {{ toYaml .Values.controller.service.internal.externalIPs | nindent 4 }} -{{- end }} -{{- if .Values.controller.service.internal.loadBalancerIP }} - loadBalancerIP: {{ .Values.controller.service.internal.loadBalancerIP }} -{{- end }} -{{- if .Values.controller.service.internal.loadBalancerSourceRanges }} - loadBalancerSourceRanges: {{ toYaml .Values.controller.service.internal.loadBalancerSourceRanges | nindent 4 }} -{{- end }} -{{- if .Values.controller.service.internal.loadBalancerClass }} - loadBalancerClass: {{ .Values.controller.service.internal.loadBalancerClass }} -{{- end }} -{{- if hasKey .Values.controller.service.internal "allocateLoadBalancerNodePorts" }} - allocateLoadBalancerNodePorts: {{ .Values.controller.service.internal.allocateLoadBalancerNodePorts }} -{{- end }} -{{- if .Values.controller.service.internal.externalTrafficPolicy }} - externalTrafficPolicy: {{ .Values.controller.service.internal.externalTrafficPolicy }} -{{- end }} -{{- if .Values.controller.service.internal.sessionAffinity }} - sessionAffinity: {{ .Values.controller.service.internal.sessionAffinity }} -{{- end }} -{{- if .Values.controller.service.internal.healthCheckNodePort }} - healthCheckNodePort: {{ .Values.controller.service.internal.healthCheckNodePort }} -{{- end }} -{{- if semverCompare ">=1.21.0-0" .Capabilities.KubeVersion.Version -}} -{{- if .Values.controller.service.internal.ipFamilyPolicy }} - ipFamilyPolicy: {{ .Values.controller.service.internal.ipFamilyPolicy }} -{{- end }} -{{- if .Values.controller.service.internal.ipFamilies }} - ipFamilies: {{ toYaml .Values.controller.service.internal.ipFamilies | nindent 4 }} -{{- end }} -{{- end }} - ports: - {{- $setNodePorts := (or (eq .Values.controller.service.type "NodePort") (eq .Values.controller.service.type "LoadBalancer")) }} - {{- if .Values.controller.service.enableHttp }} - - name: http - port: {{ .Values.controller.service.internal.ports.http | default .Values.controller.service.ports.http }} - protocol: TCP - targetPort: {{ .Values.controller.service.internal.targetPorts.http | default .Values.controller.service.targetPorts.http }} - {{- if and (semverCompare ">=1.20.0-0" .Capabilities.KubeVersion.Version) (.Values.controller.service.internal.appProtocol) }} - appProtocol: http - {{- end }} - {{- if (and $setNodePorts (not (empty .Values.controller.service.internal.nodePorts.http))) }} - nodePort: {{ .Values.controller.service.internal.nodePorts.http }} - {{- end }} - {{- end }} - {{- if .Values.controller.service.enableHttps }} - - name: https - port: {{ .Values.controller.service.internal.ports.https | default .Values.controller.service.ports.https }} - protocol: TCP - targetPort: {{ .Values.controller.service.internal.targetPorts.https | default .Values.controller.service.targetPorts.https }} - {{- if and (semverCompare ">=1.20.0-0" .Capabilities.KubeVersion.Version) (.Values.controller.service.internal.appProtocol) }} - appProtocol: https - {{- end }} - {{- if (and $setNodePorts (not (empty .Values.controller.service.internal.nodePorts.https))) }} - nodePort: {{ .Values.controller.service.internal.nodePorts.https }} - {{- end }} - {{- end }} - {{- range $key, $value := .Values.tcp }} - - name: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-tcp - port: {{ $key }} - protocol: TCP - targetPort: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-tcp - {{- if $.Values.controller.service.internal.nodePorts.tcp }} - {{- if index $.Values.controller.service.internal.nodePorts.tcp $key }} - nodePort: {{ index $.Values.controller.service.internal.nodePorts.tcp $key }} - {{- end }} - {{- end }} - {{- end }} - {{- range $key, $value := .Values.udp }} - - name: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-udp - port: {{ $key }} - protocol: UDP - targetPort: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-udp - {{- if $.Values.controller.service.internal.nodePorts.udp }} - {{- if index $.Values.controller.service.internal.nodePorts.udp $key }} - nodePort: {{ index $.Values.controller.service.internal.nodePorts.udp $key }} - {{- end }} - {{- end }} - {{- end }} - selector: - {{- include "ingress-nginx.selectorLabels" . | nindent 4 }} - app.kubernetes.io/component: controller -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-metrics.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-metrics.yaml deleted file mode 100644 index 4b25a840e..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-metrics.yaml +++ /dev/null @@ -1,45 +0,0 @@ -{{- if and .Values.controller.metrics.enabled .Values.controller.metrics.service.enabled -}} -apiVersion: v1 -kind: Service -metadata: -{{- if .Values.controller.metrics.service.annotations }} - annotations: {{ toYaml .Values.controller.metrics.service.annotations | nindent 4 }} -{{- end }} - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: controller - {{- if .Values.controller.metrics.service.labels }} - {{- toYaml .Values.controller.metrics.service.labels | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.controller.fullname" . }}-metrics - namespace: {{ include "ingress-nginx.namespace" . }} -spec: - type: {{ .Values.controller.metrics.service.type }} -{{- if .Values.controller.metrics.service.clusterIP }} - clusterIP: {{ .Values.controller.metrics.service.clusterIP }} -{{- end }} -{{- if .Values.controller.metrics.service.externalIPs }} - externalIPs: {{ toYaml .Values.controller.metrics.service.externalIPs | nindent 4 }} -{{- end }} -{{- if .Values.controller.metrics.service.loadBalancerIP }} - loadBalancerIP: {{ .Values.controller.metrics.service.loadBalancerIP }} -{{- end }} -{{- if .Values.controller.metrics.service.loadBalancerSourceRanges }} - loadBalancerSourceRanges: {{ toYaml .Values.controller.metrics.service.loadBalancerSourceRanges | nindent 4 }} -{{- end }} -{{- if .Values.controller.metrics.service.externalTrafficPolicy }} - externalTrafficPolicy: {{ .Values.controller.metrics.service.externalTrafficPolicy }} -{{- end }} - ports: - - name: {{ .Values.controller.metrics.portName }} - port: {{ .Values.controller.metrics.service.servicePort }} - protocol: TCP - targetPort: {{ .Values.controller.metrics.portName }} - {{- $setNodePorts := (or (eq .Values.controller.metrics.service.type "NodePort") (eq .Values.controller.metrics.service.type "LoadBalancer")) }} - {{- if (and $setNodePorts (not (empty .Values.controller.metrics.service.nodePort))) }} - nodePort: {{ .Values.controller.metrics.service.nodePort }} - {{- end }} - selector: - {{- include "ingress-nginx.selectorLabels" . | nindent 4 }} - app.kubernetes.io/component: controller -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-webhook.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-webhook.yaml deleted file mode 100644 index 67aac0d9a..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service-webhook.yaml +++ /dev/null @@ -1,40 +0,0 @@ -{{- if .Values.controller.admissionWebhooks.enabled -}} -apiVersion: v1 -kind: Service -metadata: -{{- if .Values.controller.admissionWebhooks.service.annotations }} - annotations: {{ toYaml .Values.controller.admissionWebhooks.service.annotations | nindent 4 }} -{{- end }} - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: controller - {{- with .Values.controller.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.controller.fullname" . }}-admission - namespace: {{ include "ingress-nginx.namespace" . }} -spec: - type: {{ .Values.controller.admissionWebhooks.service.type }} -{{- if .Values.controller.admissionWebhooks.service.clusterIP }} - clusterIP: {{ .Values.controller.admissionWebhooks.service.clusterIP }} -{{- end }} -{{- if .Values.controller.admissionWebhooks.service.externalIPs }} - externalIPs: {{ toYaml .Values.controller.admissionWebhooks.service.externalIPs | nindent 4 }} -{{- end }} -{{- if .Values.controller.admissionWebhooks.service.loadBalancerIP }} - loadBalancerIP: {{ .Values.controller.admissionWebhooks.service.loadBalancerIP }} -{{- end }} -{{- if .Values.controller.admissionWebhooks.service.loadBalancerSourceRanges }} - loadBalancerSourceRanges: {{ toYaml .Values.controller.admissionWebhooks.service.loadBalancerSourceRanges | nindent 4 }} -{{- end }} - ports: - - name: https-webhook - port: {{ .Values.controller.admissionWebhooks.service.servicePort }} - targetPort: webhook - {{- if semverCompare ">=1.20.0-0" .Capabilities.KubeVersion.Version }} - appProtocol: https - {{- end }} - selector: - {{- include "ingress-nginx.selectorLabels" . | nindent 4 }} - app.kubernetes.io/component: controller -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service.yaml deleted file mode 100644 index cb78a7035..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-service.yaml +++ /dev/null @@ -1,105 +0,0 @@ -{{- if and .Values.controller.service.enabled .Values.controller.service.external.enabled -}} -apiVersion: v1 -kind: Service -metadata: - annotations: - {{- range $key, $value := .Values.controller.service.annotations }} - {{ $key }}: {{ tpl ($value | toString) $ | quote }} - {{- end }} - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: controller - {{- if .Values.controller.service.labels }} - {{- toYaml .Values.controller.service.labels | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.controller.fullname" . }} - namespace: {{ include "ingress-nginx.namespace" . }} -spec: - type: {{ .Values.controller.service.type }} -{{- if .Values.controller.service.clusterIP }} - clusterIP: {{ .Values.controller.service.clusterIP }} -{{- end }} -{{- if .Values.controller.service.externalIPs }} - externalIPs: {{ toYaml .Values.controller.service.externalIPs | nindent 4 }} -{{- end }} -{{- if .Values.controller.service.loadBalancerIP }} - loadBalancerIP: {{ .Values.controller.service.loadBalancerIP }} -{{- end }} -{{- if .Values.controller.service.loadBalancerSourceRanges }} - loadBalancerSourceRanges: {{ toYaml .Values.controller.service.loadBalancerSourceRanges | nindent 4 }} -{{- end }} -{{- if .Values.controller.service.loadBalancerClass }} - loadBalancerClass: {{ .Values.controller.service.loadBalancerClass }} -{{- end }} -{{- if hasKey .Values.controller.service "allocateLoadBalancerNodePorts" }} - allocateLoadBalancerNodePorts: {{ .Values.controller.service.allocateLoadBalancerNodePorts }} -{{- end }} -{{- if .Values.controller.service.externalTrafficPolicy }} - externalTrafficPolicy: {{ .Values.controller.service.externalTrafficPolicy }} -{{- end }} -{{- if .Values.controller.service.sessionAffinity }} - sessionAffinity: {{ .Values.controller.service.sessionAffinity }} -{{- end }} -{{- if .Values.controller.service.healthCheckNodePort }} - healthCheckNodePort: {{ .Values.controller.service.healthCheckNodePort }} -{{- end }} -{{- if semverCompare ">=1.21.0-0" .Capabilities.KubeVersion.Version -}} -{{- if .Values.controller.service.ipFamilyPolicy }} - ipFamilyPolicy: {{ .Values.controller.service.ipFamilyPolicy }} -{{- end }} -{{- if .Values.controller.service.ipFamilies }} - ipFamilies: {{ toYaml .Values.controller.service.ipFamilies | nindent 4 }} -{{- end }} -{{- end }} - ports: - {{- $setNodePorts := (or (eq .Values.controller.service.type "NodePort") (eq .Values.controller.service.type "LoadBalancer")) }} - {{- if .Values.controller.service.enableHttp }} - - name: http - port: {{ .Values.controller.service.ports.http }} - protocol: TCP - targetPort: {{ .Values.controller.service.targetPorts.http }} - {{- if and (semverCompare ">=1.20.0-0" .Capabilities.KubeVersion.Version) (.Values.controller.service.appProtocol) }} - appProtocol: http - {{- end }} - {{- if (and $setNodePorts (not (empty .Values.controller.service.nodePorts.http))) }} - nodePort: {{ .Values.controller.service.nodePorts.http }} - {{- end }} - {{- end }} - {{- if .Values.controller.service.enableHttps }} - - name: https - port: {{ .Values.controller.service.ports.https }} - protocol: TCP - targetPort: {{ .Values.controller.service.targetPorts.https }} - {{- if and (semverCompare ">=1.20.0-0" .Capabilities.KubeVersion.Version) (.Values.controller.service.appProtocol) }} - appProtocol: https - {{- end }} - {{- if (and $setNodePorts (not (empty .Values.controller.service.nodePorts.https))) }} - nodePort: {{ .Values.controller.service.nodePorts.https }} - {{- end }} - {{- end }} - {{- range $key, $value := .Values.tcp }} - - name: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-tcp - port: {{ $key }} - protocol: TCP - targetPort: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-tcp - {{- if $.Values.controller.service.nodePorts.tcp }} - {{- if index $.Values.controller.service.nodePorts.tcp $key }} - nodePort: {{ index $.Values.controller.service.nodePorts.tcp $key }} - {{- end }} - {{- end }} - {{- end }} - {{- range $key, $value := .Values.udp }} - - name: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-udp - port: {{ $key }} - protocol: UDP - targetPort: {{ if $.Values.portNamePrefix }}{{ $.Values.portNamePrefix }}-{{ end }}{{ $key }}-udp - {{- if $.Values.controller.service.nodePorts.udp }} - {{- if index $.Values.controller.service.nodePorts.udp $key }} - nodePort: {{ index $.Values.controller.service.nodePorts.udp $key }} - {{- end }} - {{- end }} - {{- end }} - selector: - {{- include "ingress-nginx.selectorLabels" . | nindent 4 }} - app.kubernetes.io/component: controller -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-serviceaccount.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-serviceaccount.yaml deleted file mode 100644 index df83de3d0..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-serviceaccount.yaml +++ /dev/null @@ -1,17 +0,0 @@ -{{- if or .Values.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: controller - {{- with .Values.controller.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ template "ingress-nginx.serviceAccountName" . }} - namespace: {{ include "ingress-nginx.namespace" . }} - {{- if .Values.serviceAccount.annotations }} - annotations: {{ toYaml .Values.serviceAccount.annotations | nindent 4 }} - {{- end }} -automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-servicemonitor.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/controller-servicemonitor.yaml deleted file mode 100644 index 93ab4d242..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/controller-servicemonitor.yaml +++ /dev/null @@ -1,50 +0,0 @@ -{{- if and .Values.controller.metrics.enabled .Values.controller.metrics.serviceMonitor.enabled -}} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ include "ingress-nginx.controller.fullname" . }} - {{- if .Values.controller.metrics.serviceMonitor.namespace }} - namespace: {{ .Values.controller.metrics.serviceMonitor.namespace }} - {{- else }} - namespace: {{ include "ingress-nginx.namespace" . }} - {{- end }} - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: controller - {{- if .Values.controller.metrics.serviceMonitor.additionalLabels }} - {{- toYaml .Values.controller.metrics.serviceMonitor.additionalLabels | nindent 4 }} - {{- end }} - {{- if .Values.controller.metrics.serviceMonitor.annotations }} - annotations: {{ toYaml .Values.controller.metrics.serviceMonitor.annotations | nindent 4 }} - {{- end }} -spec: - {{- if .Values.controller.metrics.serviceMonitor.namespaceSelector }} - namespaceSelector: {{ toYaml .Values.controller.metrics.serviceMonitor.namespaceSelector | nindent 4 }} - {{- else }} - namespaceSelector: - matchNames: - - {{ include "ingress-nginx.namespace" . }} - {{- end }} - selector: - matchLabels: - {{- include "ingress-nginx.selectorLabels" . | nindent 6 }} - app.kubernetes.io/component: controller - endpoints: - - port: {{ .Values.controller.metrics.portName }} - interval: {{ .Values.controller.metrics.serviceMonitor.scrapeInterval }} - {{- if .Values.controller.metrics.serviceMonitor.honorLabels }} - honorLabels: true - {{- end }} - {{- if .Values.controller.metrics.serviceMonitor.relabelings }} - relabelings: {{ toYaml .Values.controller.metrics.serviceMonitor.relabelings | nindent 4 }} - {{- end }} - {{- if .Values.controller.metrics.serviceMonitor.metricRelabelings }} - metricRelabelings: {{ toYaml .Values.controller.metrics.serviceMonitor.metricRelabelings | nindent 4 }} - {{- end }} - {{- if .Values.controller.metrics.serviceMonitor.jobLabel }} - jobLabel: {{ .Values.controller.metrics.serviceMonitor.jobLabel | quote }} - {{- end }} - {{- if .Values.controller.metrics.serviceMonitor.targetLabels }} - targetLabels: {{ toYaml .Values.controller.metrics.serviceMonitor.targetLabels | nindent 2 }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-deployment.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-deployment.yaml deleted file mode 100644 index f7d9de121..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-deployment.yaml +++ /dev/null @@ -1,119 +0,0 @@ -{{- if .Values.defaultBackend.enabled -}} -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: default-backend - {{- with .Values.defaultBackend.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.defaultBackend.fullname" . }} - namespace: {{ include "ingress-nginx.namespace" . }} -spec: - selector: - matchLabels: - {{- include "ingress-nginx.selectorLabels" . | nindent 6 }} - app.kubernetes.io/component: default-backend -{{- if not .Values.defaultBackend.autoscaling.enabled }} - replicas: {{ .Values.defaultBackend.replicaCount }} -{{- end }} - revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} - {{- if .Values.defaultBackend.updateStrategy }} - strategy: - {{ toYaml .Values.defaultBackend.updateStrategy | nindent 4 }} - {{- end }} - minReadySeconds: {{ .Values.defaultBackend.minReadySeconds }} - template: - metadata: - {{- if .Values.defaultBackend.podAnnotations }} - annotations: {{ toYaml .Values.defaultBackend.podAnnotations | nindent 8 }} - {{- end }} - labels: - {{- include "ingress-nginx.labels" . | nindent 8 }} - app.kubernetes.io/component: default-backend - {{- with .Values.defaultBackend.labels }} - {{- toYaml . | nindent 8 }} - {{- end }} - {{- if .Values.defaultBackend.podLabels }} - {{- toYaml .Values.defaultBackend.podLabels | nindent 8 }} - {{- end }} - spec: - {{- if .Values.imagePullSecrets }} - imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 8 }} - {{- end }} - {{- if .Values.defaultBackend.priorityClassName }} - priorityClassName: {{ .Values.defaultBackend.priorityClassName }} - {{- end }} - {{- if .Values.defaultBackend.podSecurityContext }} - securityContext: {{ toYaml .Values.defaultBackend.podSecurityContext | nindent 8 }} - {{- end }} - containers: - - name: {{ template "ingress-nginx.name" . }}-default-backend - {{- with (merge .Values.defaultBackend.image .Values.global.image) }} - image: {{ if .repository }}{{ .repository }}{{ else }}{{ .registry }}/{{ .image }}{{ end }}:{{ .tag }}{{ if .digest }}@{{ .digest }}{{ end }} - {{- end }} - imagePullPolicy: {{ .Values.defaultBackend.image.pullPolicy }} - {{- if .Values.defaultBackend.extraArgs }} - args: - {{- range $key, $value := .Values.defaultBackend.extraArgs }} - {{- /* Accept keys without values or with false as value */}} - {{- if eq ($value | quote | len) 2 }} - - --{{ $key }} - {{- else }} - - --{{ $key }}={{ $value }} - {{- end }} - {{- end }} - {{- end }} - securityContext: {{ include "ingress-nginx.defaultBackend.containerSecurityContext" . | nindent 12 }} - {{- if .Values.defaultBackend.extraEnvs }} - env: {{ toYaml .Values.defaultBackend.extraEnvs | nindent 12 }} - {{- end }} - livenessProbe: - httpGet: - path: /healthz - port: {{ .Values.defaultBackend.port }} - scheme: HTTP - initialDelaySeconds: {{ .Values.defaultBackend.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.defaultBackend.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.defaultBackend.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.defaultBackend.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.defaultBackend.livenessProbe.failureThreshold }} - readinessProbe: - httpGet: - path: /healthz - port: {{ .Values.defaultBackend.port }} - scheme: HTTP - initialDelaySeconds: {{ .Values.defaultBackend.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.defaultBackend.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.defaultBackend.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.defaultBackend.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.defaultBackend.readinessProbe.failureThreshold }} - ports: - - name: http - containerPort: {{ .Values.defaultBackend.port }} - protocol: TCP - {{- if .Values.defaultBackend.extraVolumeMounts }} - volumeMounts: {{- toYaml .Values.defaultBackend.extraVolumeMounts | nindent 12 }} - {{- end }} - {{- if .Values.defaultBackend.resources }} - resources: {{ toYaml .Values.defaultBackend.resources | nindent 12 }} - {{- end }} - {{- if .Values.defaultBackend.nodeSelector }} - nodeSelector: {{ toYaml .Values.defaultBackend.nodeSelector | nindent 8 }} - {{- end }} - serviceAccountName: {{ include "ingress-nginx.defaultBackend.serviceAccountName" . }} - {{- if .Values.defaultBackend.tolerations }} - tolerations: {{ toYaml .Values.defaultBackend.tolerations | nindent 8 }} - {{- end }} - {{- if .Values.defaultBackend.affinity }} - affinity: {{ tpl (toYaml .Values.defaultBackend.affinity) $ | nindent 8 }} - {{- end }} - {{- if .Values.defaultBackend.topologySpreadConstraints }} - topologySpreadConstraints: {{ tpl (toYaml .Values.defaultBackend.topologySpreadConstraints) $ | nindent 8 }} - {{- end }} - terminationGracePeriodSeconds: 60 - {{- if .Values.defaultBackend.extraVolumes }} - volumes: {{ toYaml .Values.defaultBackend.extraVolumes | nindent 8 }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-extra-configmaps.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-extra-configmaps.yaml deleted file mode 100644 index 9af56cf38..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-extra-configmaps.yaml +++ /dev/null @@ -1,23 +0,0 @@ -{{- if .Values.defaultBackend.enabled }} -{{- range .Values.defaultBackend.extraConfigMaps }} ---- -apiVersion: v1 -kind: ConfigMap -metadata: - labels: - {{- include "ingress-nginx.labels" $ | nindent 4 }} - app.kubernetes.io/component: default-backend - {{- with $.Values.defaultBackend.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ .name }} - namespace: {{ include "ingress-nginx.namespace" $ }} -data: - {{- with .data }} - {{- toYaml . | nindent 2 }} - {{- end }} -{{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-hpa.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-hpa.yaml deleted file mode 100644 index 49bcdcfdc..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-hpa.yaml +++ /dev/null @@ -1,40 +0,0 @@ -{{- if and .Values.defaultBackend.enabled .Values.defaultBackend.autoscaling.enabled }} -apiVersion: {{ ternary "autoscaling/v2" "autoscaling/v2beta2" (.Capabilities.APIVersions.Has "autoscaling/v2") }} -kind: HorizontalPodAutoscaler -metadata: - {{- with .Values.defaultBackend.autoscaling.annotations }} - annotations: {{ toYaml . | nindent 4 }} - {{- end }} - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: default-backend - {{- with .Values.defaultBackend.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.defaultBackend.fullname" . }} - namespace: {{ include "ingress-nginx.namespace" . }} -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: {{ include "ingress-nginx.defaultBackend.fullname" . }} - minReplicas: {{ .Values.defaultBackend.autoscaling.minReplicas }} - maxReplicas: {{ .Values.defaultBackend.autoscaling.maxReplicas }} - metrics: - {{- with .Values.defaultBackend.autoscaling.targetMemoryUtilizationPercentage }} - - type: Resource - resource: - name: memory - target: - type: Utilization - averageUtilization: {{ . }} - {{- end }} - {{- with .Values.defaultBackend.autoscaling.targetCPUUtilizationPercentage }} - - type: Resource - resource: - name: cpu - target: - type: Utilization - averageUtilization: {{ . }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-networkpolicy.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-networkpolicy.yaml deleted file mode 100644 index 90b3c2ba0..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-networkpolicy.yaml +++ /dev/null @@ -1,25 +0,0 @@ -{{- if and .Values.defaultBackend.enabled .Values.defaultBackend.networkPolicy.enabled }} -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: default-backend - {{- with .Values.defaultBackend.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.defaultBackend.fullname" . }} - namespace: {{ include "ingress-nginx.namespace" . }} -spec: - podSelector: - matchLabels: - {{- include "ingress-nginx.selectorLabels" . | nindent 6 }} - app.kubernetes.io/component: default-backend - policyTypes: - - Ingress - - Egress - ingress: - - ports: - - protocol: TCP - port: {{ .Values.defaultBackend.port }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-poddisruptionbudget.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-poddisruptionbudget.yaml deleted file mode 100644 index e399ea8a4..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-poddisruptionbudget.yaml +++ /dev/null @@ -1,32 +0,0 @@ -{{- if .Values.defaultBackend.enabled -}} -{{- $replicas := .Values.defaultBackend.replicaCount }} -{{- if .Values.defaultBackend.autoscaling.enabled }} -{{- $replicas = .Values.defaultBackend.autoscaling.minReplicas }} -{{- end }} -{{- if gt ($replicas | int) 1 }} -apiVersion: {{ ternary "policy/v1" "policy/v1beta1" (semverCompare ">=1.21.0-0" .Capabilities.KubeVersion.Version) }} -kind: PodDisruptionBudget -metadata: - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: default-backend - {{- with .Values.defaultBackend.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.defaultBackend.fullname" . }} - namespace: {{ include "ingress-nginx.namespace" . }} -spec: - selector: - matchLabels: - {{- include "ingress-nginx.selectorLabels" . | nindent 6 }} - app.kubernetes.io/component: default-backend - {{- if and .Values.defaultBackend.minAvailable (not (hasKey .Values.defaultBackend "maxUnavailable")) }} - minAvailable: {{ .Values.defaultBackend.minAvailable }} - {{- else if .Values.defaultBackend.maxUnavailable }} - maxUnavailable: {{ .Values.defaultBackend.maxUnavailable }} - {{- end }} - {{- if .Values.defaultBackend.unhealthyPodEvictionPolicy }} - unhealthyPodEvictionPolicy: {{ .Values.defaultBackend.unhealthyPodEvictionPolicy }} - {{- end }} -{{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-service.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-service.yaml deleted file mode 100644 index 65b6b8362..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-service.yaml +++ /dev/null @@ -1,41 +0,0 @@ -{{- if .Values.defaultBackend.enabled -}} -apiVersion: v1 -kind: Service -metadata: -{{- if .Values.defaultBackend.service.annotations }} - annotations: {{ toYaml .Values.defaultBackend.service.annotations | nindent 4 }} -{{- end }} - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: default-backend - {{- with .Values.defaultBackend.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.defaultBackend.fullname" . }} - namespace: {{ include "ingress-nginx.namespace" . }} -spec: - type: {{ .Values.defaultBackend.service.type }} -{{- if .Values.defaultBackend.service.clusterIP }} - clusterIP: {{ .Values.defaultBackend.service.clusterIP }} -{{- end }} -{{- if .Values.defaultBackend.service.externalIPs }} - externalIPs: {{ toYaml .Values.defaultBackend.service.externalIPs | nindent 4 }} -{{- end }} -{{- if .Values.defaultBackend.service.loadBalancerIP }} - loadBalancerIP: {{ .Values.defaultBackend.service.loadBalancerIP }} -{{- end }} -{{- if .Values.defaultBackend.service.loadBalancerSourceRanges }} - loadBalancerSourceRanges: {{ toYaml .Values.defaultBackend.service.loadBalancerSourceRanges | nindent 4 }} -{{- end }} - ports: - - name: http - port: {{ .Values.defaultBackend.service.servicePort }} - protocol: TCP - targetPort: http - {{- if semverCompare ">=1.20.0-0" .Capabilities.KubeVersion.Version }} - appProtocol: http - {{- end }} - selector: - {{- include "ingress-nginx.selectorLabels" . | nindent 4 }} - app.kubernetes.io/component: default-backend -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-serviceaccount.yaml b/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-serviceaccount.yaml deleted file mode 100644 index 6fd2d6234..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/templates/default-backend-serviceaccount.yaml +++ /dev/null @@ -1,14 +0,0 @@ -{{- if and .Values.defaultBackend.enabled .Values.defaultBackend.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - {{- include "ingress-nginx.labels" . | nindent 4 }} - app.kubernetes.io/component: default-backend - {{- with .Values.defaultBackend.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - name: {{ include "ingress-nginx.defaultBackend.serviceAccountName" . }} - namespace: {{ include "ingress-nginx.namespace" . }} -automountServiceAccountToken: {{ .Values.defaultBackend.serviceAccount.automountServiceAccountToken }} -{{- end }} diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/clusterrole_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/clusterrole_test.yaml deleted file mode 100644 index d7a8b8852..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/clusterrole_test.yaml +++ /dev/null @@ -1,11 +0,0 @@ -suite: Admission Webhooks > Patch Job > ClusterRole -templates: - - admission-webhooks/job-patch/clusterrole.yaml - -tests: - - it: should not create a ClusterRole if `controller.admissionWebhooks.patch.rbac.create` is false - set: - controller.admissionWebhooks.patch.rbac.create: false - asserts: - - hasDocuments: - count: 0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/clusterrolebinding_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/clusterrolebinding_test.yaml deleted file mode 100644 index d7c3266d2..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/clusterrolebinding_test.yaml +++ /dev/null @@ -1,11 +0,0 @@ -suite: Admission Webhooks > Patch Job > ClusterRoleBinding -templates: - - admission-webhooks/job-patch/clusterrolebinding.yaml - -tests: - - it: should not create a ClusterRoleBinding if `controller.admissionWebhooks.patch.rbac.create` is false - set: - controller.admissionWebhooks.patch.rbac.create: false - asserts: - - hasDocuments: - count: 0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/role_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/role_test.yaml deleted file mode 100644 index a236f3d7b..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/role_test.yaml +++ /dev/null @@ -1,11 +0,0 @@ -suite: Admission Webhooks > Patch Job > Role -templates: - - admission-webhooks/job-patch/role.yaml - -tests: - - it: should not create a Role if `controller.admissionWebhooks.patch.rbac.create` is false - set: - controller.admissionWebhooks.patch.rbac.create: false - asserts: - - hasDocuments: - count: 0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/rolebinding_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/rolebinding_test.yaml deleted file mode 100644 index 74abaa163..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/rolebinding_test.yaml +++ /dev/null @@ -1,11 +0,0 @@ -suite: Admission Webhooks > Patch Job > RoleBinding -templates: - - admission-webhooks/job-patch/rolebinding.yaml - -tests: - - it: should not create a RoleBinding if `controller.admissionWebhooks.patch.rbac.create` is false - set: - controller.admissionWebhooks.patch.rbac.create: false - asserts: - - hasDocuments: - count: 0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/serviceaccount_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/serviceaccount_test.yaml deleted file mode 100644 index f72bc4383..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/job-patch/serviceaccount_test.yaml +++ /dev/null @@ -1,47 +0,0 @@ -suite: Admission Webhooks > Patch Job > ServiceAccount -templates: - - admission-webhooks/job-patch/serviceaccount.yaml - -tests: - - it: should not create a ServiceAccount if `controller.admissionWebhooks.patch.serviceAccount.create` is false - set: - controller.admissionWebhooks.patch.serviceAccount.create: false - asserts: - - hasDocuments: - count: 0 - - - it: should create a ServiceAccount if `controller.admissionWebhooks.patch.serviceAccount.create` is true - set: - controller.admissionWebhooks.patch.serviceAccount.create: true - asserts: - - hasDocuments: - count: 1 - - isKind: - of: ServiceAccount - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-admission - - - it: should create a ServiceAccount with specified name if `controller.admissionWebhooks.patch.serviceAccount.name` is set - set: - controller.admissionWebhooks.patch.serviceAccount.name: ingress-nginx-admission-test-sa - asserts: - - hasDocuments: - count: 1 - - isKind: - of: ServiceAccount - - equal: - path: metadata.name - value: ingress-nginx-admission-test-sa - - - it: should create a ServiceAccount with token auto-mounting disabled if `controller.admissionWebhooks.patch.serviceAccount.automountServiceAccountToken` is false - set: - controller.admissionWebhooks.patch.serviceAccount.automountServiceAccountToken: false - asserts: - - hasDocuments: - count: 1 - - isKind: - of: ServiceAccount - - equal: - path: automountServiceAccountToken - value: false diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/validating-webhook_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/validating-webhook_test.yaml deleted file mode 100644 index 47b6b6873..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/admission-webhooks/validating-webhook_test.yaml +++ /dev/null @@ -1,32 +0,0 @@ -suite: Admission Webhooks > ValidatingWebhookConfiguration -templates: - - admission-webhooks/validating-webhook.yaml - -tests: - - it: should not create a ValidatingWebhookConfiguration if `controller.admissionWebhooks.enabled` is false - set: - controller.admissionWebhooks.enabled: false - asserts: - - hasDocuments: - count: 0 - - - it: should create a ValidatingWebhookConfiguration if `controller.admissionWebhooks.enabled` is true - set: - controller.admissionWebhooks.enabled: true - asserts: - - hasDocuments: - count: 1 - - isKind: - of: ValidatingWebhookConfiguration - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-admission - - - it: should create a ValidatingWebhookConfiguration with a custom port if `controller.admissionWebhooks.service.servicePort` is set - set: - controller.admissionWebhooks.enabled: true - controller.admissionWebhooks.service.servicePort: 9443 - asserts: - - equal: - path: webhooks[0].clientConfig.service.port - value: 9443 diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap-addheaders_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap-addheaders_test.yaml deleted file mode 100644 index e831d50c0..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap-addheaders_test.yaml +++ /dev/null @@ -1,27 +0,0 @@ -suite: Controller > ConfigMap > Add Headers -templates: - - controller-configmap-addheaders.yaml - -tests: - - it: should not create a ConfigMap if `controller.addHeaders` is not set - set: - controller.addHeaders: null - asserts: - - hasDocuments: - count: 0 - - - it: should create a ConfigMap if `controller.addHeaders` is set - set: - controller.addHeaders: - X-Another-Custom-Header: Value - asserts: - - hasDocuments: - count: 1 - - isKind: - of: ConfigMap - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-custom-add-headers - - equal: - path: data.X-Another-Custom-Header - value: Value diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap-proxyheaders_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap-proxyheaders_test.yaml deleted file mode 100644 index 0634a3739..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap-proxyheaders_test.yaml +++ /dev/null @@ -1,27 +0,0 @@ -suite: Controller > ConfigMap > Proxy Headers -templates: - - controller-configmap-proxyheaders.yaml - -tests: - - it: should not create a ConfigMap if `controller.proxySetHeaders` is not set - set: - controller.proxySetHeaders: null - asserts: - - hasDocuments: - count: 0 - - - it: should create a ConfigMap if `controller.proxySetHeaders` is set - set: - controller.proxySetHeaders: - X-Custom-Header: Value - asserts: - - hasDocuments: - count: 1 - - isKind: - of: ConfigMap - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-custom-proxy-headers - - equal: - path: data.X-Custom-Header - value: Value diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap_test.yaml deleted file mode 100644 index 168b657d6..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-configmap_test.yaml +++ /dev/null @@ -1,31 +0,0 @@ -suite: Controller > ConfigMap -templates: - - controller-configmap.yaml - -tests: - - it: should create a ConfigMap - asserts: - - hasDocuments: - count: 1 - - isKind: - of: ConfigMap - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-controller - - - it: should create a ConfigMap with templated values if `controller.config` contains templates - set: - controller.config: - template: "test.{{ .Release.Namespace }}.svc.kubernetes.local" - integer: 12345 - boolean: true - asserts: - - equal: - path: data.template - value: test.NAMESPACE.svc.kubernetes.local - - equal: - path: data.integer - value: "12345" - - equal: - path: data.boolean - value: "true" diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-daemonset_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-daemonset_test.yaml deleted file mode 100644 index d2d77befb..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-daemonset_test.yaml +++ /dev/null @@ -1,192 +0,0 @@ -suite: Controller > DaemonSet -templates: - - controller-daemonset.yaml - -tests: - - it: should create a DaemonSet if `controller.kind` is "DaemonSet" - set: - controller.kind: DaemonSet - asserts: - - hasDocuments: - count: 1 - - isKind: - of: DaemonSet - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-controller - - - it: should create a DaemonSet with argument `--enable-metrics=true` if `controller.metrics.enabled` is true - set: - controller.kind: DaemonSet - controller.metrics.enabled: true - asserts: - - contains: - path: spec.template.spec.containers[0].args - content: --enable-metrics=true - - - it: should create a DaemonSet without argument `--enable-metrics=true` if `controller.metrics.enabled` is false - set: - controller.kind: DaemonSet - controller.metrics.enabled: false - asserts: - - notContains: - path: spec.template.spec.containers[0].args - content: --enable-metrics=true - - - it: should create a DaemonSet with argument `--controller-class=k8s.io/ingress-nginx-internal` if `controller.ingressClassResource.controllerValue` is "k8s.io/ingress-nginx-internal" - set: - controller.kind: DaemonSet - controller.ingressClassResource.controllerValue: k8s.io/ingress-nginx-internal - asserts: - - contains: - path: spec.template.spec.containers[0].args - content: --controller-class=k8s.io/ingress-nginx-internal - - - it: should create a DaemonSet with resource limits if `controller.resources.limits` is set - set: - controller.kind: DaemonSet - controller.resources.limits.cpu: 500m - controller.resources.limits.memory: 512Mi - asserts: - - equal: - path: spec.template.spec.containers[0].resources.limits.cpu - value: 500m - - equal: - path: spec.template.spec.containers[0].resources.limits.memory - value: 512Mi - - - it: should create a DaemonSet with topology spread constraints if `controller.topologySpreadConstraints` is set - set: - controller.kind: DaemonSet - controller.topologySpreadConstraints: - - labelSelector: - matchLabels: - app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}' - app.kubernetes.io/instance: '{{ .Release.Name }}' - app.kubernetes.io/component: controller - topologyKey: topology.kubernetes.io/zone - maxSkew: 1 - whenUnsatisfiable: ScheduleAnyway - - labelSelector: - matchLabels: - app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}' - app.kubernetes.io/instance: '{{ .Release.Name }}' - app.kubernetes.io/component: controller - topologyKey: kubernetes.io/hostname - maxSkew: 1 - whenUnsatisfiable: ScheduleAnyway - asserts: - - equal: - path: spec.template.spec.topologySpreadConstraints - value: - - labelSelector: - matchLabels: - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: RELEASE-NAME - app.kubernetes.io/component: controller - topologyKey: topology.kubernetes.io/zone - maxSkew: 1 - whenUnsatisfiable: ScheduleAnyway - - labelSelector: - matchLabels: - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: RELEASE-NAME - app.kubernetes.io/component: controller - topologyKey: kubernetes.io/hostname - maxSkew: 1 - whenUnsatisfiable: ScheduleAnyway - - - it: should create a DaemonSet with affinity if `controller.affinity` is set - set: - controller.kind: DaemonSet - controller.affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchExpressions: - - key: app.kubernetes.io/name - operator: In - values: - - '{{ include "ingress-nginx.name" . }}' - - key: app.kubernetes.io/instance - operator: In - values: - - '{{ .Release.Name }}' - - key: app.kubernetes.io/component - operator: In - values: - - controller - topologyKey: kubernetes.io/hostname - asserts: - - equal: - path: spec.template.spec.affinity - value: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchExpressions: - - key: app.kubernetes.io/name - operator: In - values: - - ingress-nginx - - key: app.kubernetes.io/instance - operator: In - values: - - RELEASE-NAME - - key: app.kubernetes.io/component - operator: In - values: - - controller - topologyKey: kubernetes.io/hostname - - - it: should create a DaemonSet with `runAsGroup` if `controller.image.runAsGroup` is set - set: - controller.kind: DaemonSet - controller.image.runAsGroup: 1000 - asserts: - - equal: - path: spec.template.spec.containers[0].securityContext.runAsGroup - value: 1000 - - - it: should create a DaemonSet with a custom registry if `global.image.registry` is set - set: - global.image.registry: custom.registry.io - controller.kind: DaemonSet - controller.image.tag: v1.0.0-dev - controller.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd - asserts: - - equal: - path: spec.template.spec.containers[0].image - value: custom.registry.io/ingress-nginx/controller:v1.0.0-dev@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd - - - it: should create a DaemonSet with a custom registry if `controller.image.registry` is set - set: - controller.kind: DaemonSet - controller.image.registry: custom.registry.io - controller.image.tag: v1.0.0-dev - controller.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd - asserts: - - equal: - path: spec.template.spec.containers[0].image - value: custom.registry.io/ingress-nginx/controller:v1.0.0-dev@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd - - - it: should create a DaemonSet with a custom image if `controller.image.image` is set - set: - controller.kind: DaemonSet - controller.image.image: custom-repo/custom-image - controller.image.tag: v1.0.0-dev - controller.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd - asserts: - - equal: - path: spec.template.spec.containers[0].image - value: registry.k8s.io/custom-repo/custom-image:v1.0.0-dev@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd - - - it: should create a DaemonSet with a custom tag if `controller.image.tag` is set - set: - controller.kind: DaemonSet - controller.image.tag: custom-tag - controller.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd - asserts: - - equal: - path: spec.template.spec.containers[0].image - value: registry.k8s.io/ingress-nginx/controller:custom-tag@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-deployment_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-deployment_test.yaml deleted file mode 100644 index 1cc9c9325..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-deployment_test.yaml +++ /dev/null @@ -1,217 +0,0 @@ -suite: Controller > Deployment -templates: - - controller-deployment.yaml - -tests: - - it: should create a Deployment - asserts: - - hasDocuments: - count: 1 - - isKind: - of: Deployment - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-controller - - - it: should create a Deployment with 3 replicas if `controller.replicaCount` is 3 - set: - controller.replicaCount: 3 - asserts: - - equal: - path: spec.replicas - value: 3 - - - it: should create a Deployment without replicas if `controller.autoscaling.enabled` is true - set: - controller.autoscaling.enabled: true - asserts: - - notExists: - path: spec.replicas - - - it: should create a Deployment without replicas if `controller.keda.enabled` is true - set: - controller.keda.enabled: true - asserts: - - notExists: - path: spec.replicas - - - it: should create a Deployment with replicas if `controller.autoscaling.enabled` is true and `controller.keda.enabled` is true - set: - controller.autoscaling.enabled: true - controller.keda.enabled: true - asserts: - - exists: - path: spec.replicas - - - it: should create a Deployment with argument `--enable-metrics=true` if `controller.metrics.enabled` is true - set: - controller.metrics.enabled: true - asserts: - - contains: - path: spec.template.spec.containers[0].args - content: --enable-metrics=true - - - it: should create a Deployment without argument `--enable-metrics=true` if `controller.metrics.enabled` is false - set: - controller.metrics.enabled: false - asserts: - - notContains: - path: spec.template.spec.containers[0].args - content: --enable-metrics=true - - - it: should create a Deployment with argument `--controller-class=k8s.io/ingress-nginx-internal` if `controller.ingressClassResource.controllerValue` is "k8s.io/ingress-nginx-internal" - set: - controller.ingressClassResource.controllerValue: k8s.io/ingress-nginx-internal - asserts: - - contains: - path: spec.template.spec.containers[0].args - content: --controller-class=k8s.io/ingress-nginx-internal - - - it: should create a Deployment with resource limits if `controller.resources.limits` is set - set: - controller.resources.limits.cpu: 500m - controller.resources.limits.memory: 512Mi - asserts: - - equal: - path: spec.template.spec.containers[0].resources.limits.cpu - value: 500m - - equal: - path: spec.template.spec.containers[0].resources.limits.memory - value: 512Mi - - - it: should create a Deployment with topology spread constraints if `controller.topologySpreadConstraints` is set - set: - controller.topologySpreadConstraints: - - labelSelector: - matchLabels: - app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}' - app.kubernetes.io/instance: '{{ .Release.Name }}' - app.kubernetes.io/component: controller - topologyKey: topology.kubernetes.io/zone - maxSkew: 1 - whenUnsatisfiable: ScheduleAnyway - - labelSelector: - matchLabels: - app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}' - app.kubernetes.io/instance: '{{ .Release.Name }}' - app.kubernetes.io/component: controller - topologyKey: kubernetes.io/hostname - maxSkew: 1 - whenUnsatisfiable: ScheduleAnyway - asserts: - - equal: - path: spec.template.spec.topologySpreadConstraints - value: - - labelSelector: - matchLabels: - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: RELEASE-NAME - app.kubernetes.io/component: controller - topologyKey: topology.kubernetes.io/zone - maxSkew: 1 - whenUnsatisfiable: ScheduleAnyway - - labelSelector: - matchLabels: - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: RELEASE-NAME - app.kubernetes.io/component: controller - topologyKey: kubernetes.io/hostname - maxSkew: 1 - whenUnsatisfiable: ScheduleAnyway - - - it: should create a Deployment with affinity if `controller.affinity` is set - set: - controller.affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchExpressions: - - key: app.kubernetes.io/name - operator: In - values: - - '{{ include "ingress-nginx.name" . }}' - - key: app.kubernetes.io/instance - operator: In - values: - - '{{ .Release.Name }}' - - key: app.kubernetes.io/component - operator: In - values: - - controller - topologyKey: kubernetes.io/hostname - asserts: - - equal: - path: spec.template.spec.affinity - value: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchExpressions: - - key: app.kubernetes.io/name - operator: In - values: - - ingress-nginx - - key: app.kubernetes.io/instance - operator: In - values: - - RELEASE-NAME - - key: app.kubernetes.io/component - operator: In - values: - - controller - topologyKey: kubernetes.io/hostname - - - it: should create a Deployment with `runAsGroup` if `controller.image.runAsGroup` is set - set: - controller.image.runAsGroup: 1000 - asserts: - - equal: - path: spec.template.spec.containers[0].securityContext.runAsGroup - value: 1000 - - - it: should create a Deployment with a custom registry if `global.image.registry` is set - set: - global.image.registry: custom.registry.io - controller.image.tag: v1.0.0-dev - controller.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd - asserts: - - equal: - path: spec.template.spec.containers[0].image - value: custom.registry.io/ingress-nginx/controller:v1.0.0-dev@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd - - - it: should create a Deployment with a custom registry if `controller.image.registry` is set - set: - controller.image.registry: custom.registry.io - controller.image.tag: v1.0.0-dev - controller.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd - asserts: - - equal: - path: spec.template.spec.containers[0].image - value: custom.registry.io/ingress-nginx/controller:v1.0.0-dev@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd - - - it: should create a Deployment with a custom image if `controller.image.image` is set - set: - controller.image.image: custom-repo/custom-image - controller.image.tag: v1.0.0-dev - controller.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd - asserts: - - equal: - path: spec.template.spec.containers[0].image - value: registry.k8s.io/custom-repo/custom-image:v1.0.0-dev@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd - - - it: should create a Deployment with a custom tag if `controller.image.tag` is set - set: - controller.image.tag: custom-tag - controller.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd - asserts: - - equal: - path: spec.template.spec.containers[0].image - value: registry.k8s.io/ingress-nginx/controller:custom-tag@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd - - - it: should create a Deployment with `progressDeadlineSeconds` if `controller.progressDeadlineSeconds` is set - set: - controller.progressDeadlineSeconds: 111 - asserts: - - equal: - path: spec.progressDeadlineSeconds - value: 111 diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-hpa_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-hpa_test.yaml deleted file mode 100644 index 869d3a690..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-hpa_test.yaml +++ /dev/null @@ -1,31 +0,0 @@ -suite: Controller > HPA -templates: - - controller-hpa.yaml - -tests: - - it: should create an HPA if `controller.autoscaling.enabled` is true - set: - controller.autoscaling.enabled: true - asserts: - - hasDocuments: - count: 1 - - isKind: - of: HorizontalPodAutoscaler - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-controller - - - it: should not create an HPA if `controller.autoscaling.enabled` is true and `controller.keda.enabled` is true - set: - controller.autoscaling.enabled: true - controller.keda.enabled: true - asserts: - - hasDocuments: - count: 0 - - - it: should not create an HPA if `controller.kind` is "DaemonSet" - set: - controller.kind: DaemonSet - asserts: - - hasDocuments: - count: 0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-ingressclass-aliases_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-ingressclass-aliases_test.yaml deleted file mode 100644 index 9a4a576b7..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-ingressclass-aliases_test.yaml +++ /dev/null @@ -1,110 +0,0 @@ -suite: Controller > IngressClass > Aliases -templates: - - controller-ingressclass-aliases.yaml - -tests: - - it: should not create IngressClass aliases - asserts: - - hasDocuments: - count: 0 - - - it: should create an IngressClass alias with name "nginx-alias" if `controller.ingressClassResource.aliases` is set - set: - controller.ingressClassResource.aliases: - - nginx-alias - asserts: - - hasDocuments: - count: 1 - - isKind: - of: IngressClass - - equal: - path: metadata.name - value: nginx-alias - - - it: should create an IngressClass alias without annotation `ingressclass.kubernetes.io/is-default-class` if `controller.ingressClassResource.default` is true - set: - controller.ingressClassResource.aliases: - - nginx-alias - controller.ingressClassResource.default: true - asserts: - - hasDocuments: - count: 1 - - isKind: - of: IngressClass - - equal: - path: metadata.name - value: nginx-alias - - notExists: - path: metadata.annotations["ingressclass.kubernetes.io/is-default-class"] - - - it: should create an IngressClass alias with annotations if `controller.ingressClassResource.annotations` is set - set: - controller.ingressClassResource.aliases: - - nginx-alias - controller.ingressClassResource.annotations: - my-fancy-annotation: has-a-value - asserts: - - hasDocuments: - count: 1 - - isKind: - of: IngressClass - - equal: - path: metadata.name - value: nginx-alias - - equal: - path: metadata.annotations.my-fancy-annotation - value: has-a-value - - - it: should create an IngressClass alias with controller "k8s.io/ingress-nginx-internal" if `controller.ingressClassResource.controllerValue` is "k8s.io/ingress-nginx-internal" - set: - controller.ingressClassResource.aliases: - - nginx-alias - controller.ingressClassResource.controllerValue: k8s.io/ingress-nginx-internal - asserts: - - hasDocuments: - count: 1 - - isKind: - of: IngressClass - - equal: - path: metadata.name - value: nginx-alias - - equal: - path: spec.controller - value: k8s.io/ingress-nginx-internal - - - it: should create an IngressClass alias with parameters if `controller.ingressClassResource.parameters` is set - set: - controller.ingressClassResource.aliases: - - nginx-alias - controller.ingressClassResource.parameters: - apiGroup: k8s.example.com - kind: IngressParameters - name: external-lb - asserts: - - hasDocuments: - count: 1 - - isKind: - of: IngressClass - - equal: - path: metadata.name - value: nginx-alias - - equal: - path: spec.parameters - value: - apiGroup: k8s.example.com - kind: IngressParameters - name: external-lb - - - it: should create two IngressClass aliases if `controller.ingressClassResource.aliases` has two elements - set: - controller.ingressClassResource.aliases: - - nginx-alias-1 - - nginx-alias-2 - asserts: - - hasDocuments: - count: 2 - - isKind: - of: IngressClass - - matchRegex: - path: metadata.name - pattern: nginx-alias-(1|2) diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-ingressclass_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-ingressclass_test.yaml deleted file mode 100644 index b3384af32..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-ingressclass_test.yaml +++ /dev/null @@ -1,93 +0,0 @@ -suite: Controller > IngressClass -templates: - - controller-ingressclass.yaml - -tests: - - it: should create an IngressClass - asserts: - - hasDocuments: - count: 1 - - isKind: - of: IngressClass - - equal: - path: metadata.name - value: nginx - - - it: should create an IngressClass with name "nginx-internal" if `controller.ingressClassResource.name` is "nginx-internal" - set: - controller.ingressClassResource.name: nginx-internal - asserts: - - hasDocuments: - count: 1 - - isKind: - of: IngressClass - - equal: - path: metadata.name - value: nginx-internal - - - it: "should create an IngressClass with annotation `ingressclass.kubernetes.io/is-default-class: \"true\"` if `controller.ingressClassResource.default` is true" - set: - controller.ingressClassResource.default: true - asserts: - - hasDocuments: - count: 1 - - isKind: - of: IngressClass - - equal: - path: metadata.name - value: nginx - - equal: - path: metadata.annotations["ingressclass.kubernetes.io/is-default-class"] - value: "true" - - - it: should create an IngressClass with annotations if `controller.ingressClassResource.annotations` is set - set: - controller.ingressClassResource.annotations: - my-fancy-annotation: has-a-value - asserts: - - hasDocuments: - count: 1 - - isKind: - of: IngressClass - - equal: - path: metadata.name - value: nginx - - equal: - path: metadata.annotations.my-fancy-annotation - value: has-a-value - - - it: should create an IngressClass with controller "k8s.io/ingress-nginx-internal" if `controller.ingressClassResource.controllerValue` is "k8s.io/ingress-nginx-internal" - set: - controller.ingressClassResource.controllerValue: k8s.io/ingress-nginx-internal - asserts: - - hasDocuments: - count: 1 - - isKind: - of: IngressClass - - equal: - path: metadata.name - value: nginx - - equal: - path: spec.controller - value: k8s.io/ingress-nginx-internal - - - it: should create an IngressClass with parameters if `controller.ingressClassResource.parameters` is set - set: - controller.ingressClassResource.parameters: - apiGroup: k8s.example.com - kind: IngressParameters - name: external-lb - asserts: - - hasDocuments: - count: 1 - - isKind: - of: IngressClass - - equal: - path: metadata.name - value: nginx - - equal: - path: spec.parameters - value: - apiGroup: k8s.example.com - kind: IngressParameters - name: external-lb diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-keda_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-keda_test.yaml deleted file mode 100644 index 800283483..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-keda_test.yaml +++ /dev/null @@ -1,31 +0,0 @@ -suite: Controller > KEDA -templates: - - controller-keda.yaml - -tests: - - it: should create a ScaledObject if `controller.keda.enabled` is true - set: - controller.keda.enabled: true - asserts: - - hasDocuments: - count: 1 - - isKind: - of: ScaledObject - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-controller - - - it: should not create a ScaledObject if `controller.keda.enabled` is true and `controller.autoscaling.enabled` is true - set: - controller.keda.enabled: true - controller.autoscaling.enabled: true - asserts: - - hasDocuments: - count: 0 - - - it: should not create a ScaledObject if `controller.kind` is "DaemonSet" - set: - controller.kind: DaemonSet - asserts: - - hasDocuments: - count: 0 diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-networkpolicy_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-networkpolicy_test.yaml deleted file mode 100644 index 5de12e9c4..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-networkpolicy_test.yaml +++ /dev/null @@ -1,23 +0,0 @@ -suite: Controller > NetworkPolicy -templates: - - controller-networkpolicy.yaml - -tests: - - it: should not create a NetworkPolicy if `controller.networkPolicy.enabled` is false - set: - controller.networkPolicy.enabled: false - asserts: - - hasDocuments: - count: 0 - - - it: should create a NetworkPolicy if `controller.networkPolicy.enabled` is true - set: - controller.networkPolicy.enabled: true - asserts: - - hasDocuments: - count: 1 - - isKind: - of: NetworkPolicy - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-controller diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-poddisruptionbudget_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-poddisruptionbudget_test.yaml deleted file mode 100644 index 5ac986fc7..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-poddisruptionbudget_test.yaml +++ /dev/null @@ -1,102 +0,0 @@ -suite: Controller > PodDisruptionBudget -templates: - - controller-poddisruptionbudget.yaml - -tests: - - it: should create a PodDisruptionBudget if `controller.replicaCount` is greater than 1 - set: - controller.replicaCount: 2 - asserts: - - hasDocuments: - count: 1 - - isKind: - of: PodDisruptionBudget - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-controller - - - it: should not create a PodDisruptionBudget if `controller.replicaCount` is less than or equal 1 - set: - controller.replicaCount: 1 - asserts: - - hasDocuments: - count: 0 - - - it: should create a PodDisruptionBudget if `controller.autoscaling.enabled` is true and `controller.autoscaling.minReplicas` is greater than 1 - set: - controller.autoscaling.enabled: true - controller.autoscaling.minReplicas: 2 - asserts: - - hasDocuments: - count: 1 - - isKind: - of: PodDisruptionBudget - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-controller - - - it: should not create a PodDisruptionBudget if `controller.autoscaling.enabled` is true and `controller.autoscaling.minReplicas` is less than or equal 1 - set: - controller.autoscaling.enabled: true - controller.autoscaling.minReplicas: 1 - asserts: - - hasDocuments: - count: 0 - - - it: should create a PodDisruptionBudget if `controller.keda.enabled` is true and `controller.keda.minReplicas` is greater than 1 - set: - controller.keda.enabled: true - controller.keda.minReplicas: 2 - asserts: - - hasDocuments: - count: 1 - - isKind: - of: PodDisruptionBudget - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-controller - - - it: should not create a PodDisruptionBudget if `controller.keda.enabled` is true and `controller.keda.minReplicas` is less than or equal 1 - set: - controller.keda.enabled: true - controller.keda.minReplicas: 1 - asserts: - - hasDocuments: - count: 0 - - - it: should not create a PodDisruptionBudget if `controller.autoscaling.enabled` is true and `controller.keda.enabled` is true - set: - controller.autoscaling.enabled: true - controller.keda.enabled: true - asserts: - - hasDocuments: - count: 0 - - - it: should create a PodDisruptionBudget without `minAvailable` and with `maxUnavailable` if `controller.minAvailable` and `controller.maxUnavailable` are set - set: - controller.replicaCount: 2 - controller.minAvailable: 1 - controller.maxUnavailable: 1 - asserts: - - hasDocuments: - count: 1 - - isKind: - of: PodDisruptionBudget - - notExists: - path: spec.minAvailable - - equal: - path: spec.maxUnavailable - value: 1 - - - it: should create a PodDisruptionBudget with `unhealthyPodEvictionPolicy` if `controller.unhealthyPodEvictionPolicy` is set - set: - controller.replicaCount: 2 - controller.unhealthyPodEvictionPolicy: IfHealthyBudget - asserts: - - hasDocuments: - count: 1 - - isKind: - of: PodDisruptionBudget - - equal: - path: spec.unhealthyPodEvictionPolicy - value: IfHealthyBudget diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-prometheusrule_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-prometheusrule_test.yaml deleted file mode 100644 index 2d330919d..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-prometheusrule_test.yaml +++ /dev/null @@ -1,29 +0,0 @@ -suite: Controller > PrometheusRule -templates: - - controller-prometheusrule.yaml - -tests: - - it: should create a PrometheusRule if `controller.metrics.prometheusRule.enabled` is true - set: - controller.metrics.enabled: true - controller.metrics.prometheusRule.enabled: true - asserts: - - hasDocuments: - count: 1 - - isKind: - of: PrometheusRule - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-controller - - - it: should create a PrometheusRule with annotations if `controller.metrics.prometheusRule.annotations` is set - set: - controller.metrics.enabled: true - controller.metrics.prometheusRule.enabled: true - controller.metrics.prometheusRule.annotations: - my-little-annotation: test-value - asserts: - - equal: - path: metadata.annotations - value: - my-little-annotation: test-value diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-internal_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-internal_test.yaml deleted file mode 100644 index 5465e1a2b..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-internal_test.yaml +++ /dev/null @@ -1,25 +0,0 @@ -suite: Controller > Service > Internal -templates: - - controller-service-internal.yaml - -tests: - - it: should not create an internal Service if `controller.service.internal.enabled` is false - set: - controller.service.internal.enabled: false - asserts: - - hasDocuments: - count: 0 - - - it: should create an internal Service if `controller.service.internal.enabled` is true and `controller.service.internal.annotations` are set - set: - controller.service.internal.enabled: true - controller.service.internal.annotations: - test.annotation: "true" - asserts: - - hasDocuments: - count: 1 - - isKind: - of: Service - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-controller-internal diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-metrics_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-metrics_test.yaml deleted file mode 100644 index ddb412e5b..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-metrics_test.yaml +++ /dev/null @@ -1,41 +0,0 @@ -suite: Controller > Service > Metrics -templates: - - controller-service-metrics.yaml - -tests: - - it: should not create a metrics Service if `controller.metrics.enabled` is false and `controller.metrics.service.enabled` is false - set: - controller.metrics.enabled: false - controller.metrics.service.enabled: false - asserts: - - hasDocuments: - count: 0 - - - it: should not create a metrics Service if `controller.metrics.enabled` is false and `controller.metrics.service.enabled` is true - set: - controller.metrics.enabled: false - controller.metrics.service.enabled: true - asserts: - - hasDocuments: - count: 0 - - - it: should not create a metrics Service if `controller.metrics.enabled` is true and `controller.metrics.service.enabled` is false - set: - controller.metrics.enabled: true - controller.metrics.service.enabled: false - asserts: - - hasDocuments: - count: 0 - - - it: should create a metrics Service if `controller.metrics.enabled` is true and `controller.metrics.service.enabled` is true - set: - controller.metrics.enabled: true - controller.metrics.service.enabled: true - asserts: - - hasDocuments: - count: 1 - - isKind: - of: Service - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-controller-metrics diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-webhook_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-webhook_test.yaml deleted file mode 100644 index 1c759edbe..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service-webhook_test.yaml +++ /dev/null @@ -1,32 +0,0 @@ -suite: Controller > Service > Webhook -templates: - - controller-service-webhook.yaml - -tests: - - it: should not create a webhook Service if `controller.admissionWebhooks.enabled` is false - set: - controller.admissionWebhooks.enabled: false - asserts: - - hasDocuments: - count: 0 - - - it: should create a webhook Service if `controller.admissionWebhooks.enabled` is true - set: - controller.admissionWebhooks.enabled: true - asserts: - - hasDocuments: - count: 1 - - isKind: - of: Service - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-controller-admission - - - it: should create a webhook Service with a custom port if `controller.admissionWebhooks.service.servicePort` is set - set: - controller.admissionWebhooks.enabled: true - controller.admissionWebhooks.service.servicePort: 9443 - asserts: - - equal: - path: spec.ports[0].port - value: 9443 diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service_test.yaml deleted file mode 100644 index 10574f227..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-service_test.yaml +++ /dev/null @@ -1,32 +0,0 @@ -suite: Controller > Service -templates: - - controller-service.yaml - -tests: - - it: should not create a Service if `controller.service.external.enabled` is false - set: - controller.service.external.enabled: false - asserts: - - hasDocuments: - count: 0 - - - it: should create a Service if `controller.service.external.enabled` is true - set: - controller.service.external.enabled: true - asserts: - - hasDocuments: - count: 1 - - isKind: - of: Service - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-controller - - - it: should create a Service of type "NodePort" if `controller.service.external.enabled` is true and `controller.service.type` is "NodePort" - set: - controller.service.external.enabled: true - controller.service.type: NodePort - asserts: - - equal: - path: spec.type - value: NodePort diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-serviceaccount_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-serviceaccount_test.yaml deleted file mode 100644 index 928e53772..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-serviceaccount_test.yaml +++ /dev/null @@ -1,47 +0,0 @@ -suite: Controller > ServiceAccount -templates: - - controller-serviceaccount.yaml - -tests: - - it: should not create a ServiceAccount if `serviceAccount.create` is false - set: - serviceAccount.create: false - asserts: - - hasDocuments: - count: 0 - - - it: should create a ServiceAccount if `serviceAccount.create` is true - set: - serviceAccount.create: true - asserts: - - hasDocuments: - count: 1 - - isKind: - of: ServiceAccount - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx - - - it: should create a ServiceAccount with specified name if `serviceAccount.name` is set - set: - serviceAccount.name: ingress-nginx-admission-test-sa - asserts: - - hasDocuments: - count: 1 - - isKind: - of: ServiceAccount - - equal: - path: metadata.name - value: ingress-nginx-admission-test-sa - - - it: should create a ServiceAccount with token auto-mounting disabled if `serviceAccount.automountServiceAccountToken` is false - set: - serviceAccount.automountServiceAccountToken: false - asserts: - - hasDocuments: - count: 1 - - isKind: - of: ServiceAccount - - equal: - path: automountServiceAccountToken - value: false diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-servicemonitor_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/controller-servicemonitor_test.yaml deleted file mode 100644 index 310097c1a..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/controller-servicemonitor_test.yaml +++ /dev/null @@ -1,29 +0,0 @@ -suite: Controller > ServiceMonitor -templates: - - controller-servicemonitor.yaml - -tests: - - it: should create a ServiceMonitor if `controller.metrics.serviceMonitor.enabled` is true - set: - controller.metrics.enabled: true - controller.metrics.serviceMonitor.enabled: true - asserts: - - hasDocuments: - count: 1 - - isKind: - of: ServiceMonitor - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-controller - - - it: should create a ServiceMonitor with annotations if `controller.metrics.serviceMonitor.annotations` is set - set: - controller.metrics.enabled: true - controller.metrics.serviceMonitor.enabled: true - controller.metrics.serviceMonitor.annotations: - my-little-annotation: test-value - asserts: - - equal: - path: metadata.annotations - value: - my-little-annotation: test-value diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-deployment_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-deployment_test.yaml deleted file mode 100644 index c3fa33968..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-deployment_test.yaml +++ /dev/null @@ -1,189 +0,0 @@ -suite: Default Backend > Deployment -templates: - - default-backend-deployment.yaml - -tests: - - it: should not create a Deployment if `defaultBackend.enabled` is false - set: - defaultBackend.enabled: false - asserts: - - hasDocuments: - count: 0 - - - it: should create a Deployment if `defaultBackend.enabled` is true - set: - defaultBackend.enabled: true - asserts: - - hasDocuments: - count: 1 - - isKind: - of: Deployment - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-defaultbackend - - - it: should create a Deployment with 3 replicas if `defaultBackend.replicaCount` is 3 - set: - defaultBackend.enabled: true - defaultBackend.replicaCount: 3 - asserts: - - equal: - path: spec.replicas - value: 3 - - - it: should create a Deployment without replicas if `defaultBackend.autoscaling.enabled` is true - set: - defaultBackend.enabled: true - defaultBackend.autoscaling.enabled: true - asserts: - - notExists: - path: spec.replicas - - - it: should create a Deployment with resource limits if `defaultBackend.resources.limits` is set - set: - defaultBackend.enabled: true - defaultBackend.resources.limits.cpu: 500m - defaultBackend.resources.limits.memory: 512Mi - asserts: - - equal: - path: spec.template.spec.containers[0].resources.limits.cpu - value: 500m - - equal: - path: spec.template.spec.containers[0].resources.limits.memory - value: 512Mi - - - it: should create a Deployment with topology spread constraints if `defaultBackend.topologySpreadConstraints` is set - set: - defaultBackend.enabled: true - defaultBackend.topologySpreadConstraints: - - labelSelector: - matchLabels: - app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}' - app.kubernetes.io/instance: '{{ .Release.Name }}' - app.kubernetes.io/component: default-backend - topologyKey: topology.kubernetes.io/zone - maxSkew: 1 - whenUnsatisfiable: ScheduleAnyway - - labelSelector: - matchLabels: - app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}' - app.kubernetes.io/instance: '{{ .Release.Name }}' - app.kubernetes.io/component: default-backend - topologyKey: kubernetes.io/hostname - maxSkew: 1 - whenUnsatisfiable: ScheduleAnyway - asserts: - - equal: - path: spec.template.spec.topologySpreadConstraints - value: - - labelSelector: - matchLabels: - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: RELEASE-NAME - app.kubernetes.io/component: default-backend - topologyKey: topology.kubernetes.io/zone - maxSkew: 1 - whenUnsatisfiable: ScheduleAnyway - - labelSelector: - matchLabels: - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: RELEASE-NAME - app.kubernetes.io/component: default-backend - topologyKey: kubernetes.io/hostname - maxSkew: 1 - whenUnsatisfiable: ScheduleAnyway - - - it: should create a Deployment with affinity if `defaultBackend.affinity` is set - set: - defaultBackend.enabled: true - defaultBackend.affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchExpressions: - - key: app.kubernetes.io/name - operator: In - values: - - '{{ include "ingress-nginx.name" . }}' - - key: app.kubernetes.io/instance - operator: In - values: - - '{{ .Release.Name }}' - - key: app.kubernetes.io/component - operator: In - values: - - default-backend - topologyKey: kubernetes.io/hostname - asserts: - - equal: - path: spec.template.spec.affinity - value: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchExpressions: - - key: app.kubernetes.io/name - operator: In - values: - - ingress-nginx - - key: app.kubernetes.io/instance - operator: In - values: - - RELEASE-NAME - - key: app.kubernetes.io/component - operator: In - values: - - default-backend - topologyKey: kubernetes.io/hostname - - - it: should create a Deployment with `runAsGroup` if `defaultBackend.image.runAsGroup` is set - set: - defaultBackend.enabled: true - defaultBackend.image.runAsGroup: 1000 - asserts: - - equal: - path: spec.template.spec.containers[0].securityContext.runAsGroup - value: 1000 - - - it: should create a Deployment with a custom registry if `global.image.registry` is set - set: - global.image.registry: custom.registry.io - defaultBackend.enabled: true - defaultBackend.image.tag: v1.0.0-dev - defaultBackend.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd - asserts: - - equal: - path: spec.template.spec.containers[0].image - value: custom.registry.io/defaultbackend-amd64:v1.0.0-dev@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd - - - it: should create a Deployment with a custom registry if `defaultBackend.image.registry` is set - set: - defaultBackend.enabled: true - defaultBackend.image.registry: custom.registry.io - defaultBackend.image.tag: v1.0.0-dev - defaultBackend.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd - asserts: - - equal: - path: spec.template.spec.containers[0].image - value: custom.registry.io/defaultbackend-amd64:v1.0.0-dev@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd - - - it: should create a Deployment with a custom image if `defaultBackend.image.image` is set - set: - defaultBackend.enabled: true - defaultBackend.image.image: custom-repo/custom-image - defaultBackend.image.tag: v1.0.0-dev - defaultBackend.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd - asserts: - - equal: - path: spec.template.spec.containers[0].image - value: registry.k8s.io/custom-repo/custom-image:v1.0.0-dev@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd - - - it: should create a Deployment with a custom tag if `defaultBackend.image.tag` is set - set: - defaultBackend.enabled: true - defaultBackend.image.tag: custom-tag - defaultBackend.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd - asserts: - - equal: - path: spec.template.spec.containers[0].image - value: registry.k8s.io/defaultbackend-amd64:custom-tag@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-extra-configmaps_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-extra-configmaps_test.yaml deleted file mode 100644 index aa600e749..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-extra-configmaps_test.yaml +++ /dev/null @@ -1,50 +0,0 @@ -suite: Default Backend > Extra ConfigMaps -templates: - - default-backend-extra-configmaps.yaml - -tests: - - it: should not create a ConfigMap if `defaultBackend.extraConfigMaps` is empty - set: - defaultBackend.enabled: true - defaultBackend.extraConfigMaps: [] - asserts: - - hasDocuments: - count: 0 - - - it: should create one ConfigMap if `defaultBackend.extraConfigMaps` has one element - set: - defaultBackend.enabled: true - defaultBackend.extraConfigMaps: - - name: my-configmap-1 - data: - key1: value1 - asserts: - - hasDocuments: - count: 1 - - isKind: - of: ConfigMap - - equal: - path: metadata.name - value: my-configmap-1 - - equal: - path: data.key1 - value: value1 - - - it: should create two ConfigMaps if `defaultBackend.extraConfigMaps` has two elements - set: - defaultBackend.enabled: true - defaultBackend.extraConfigMaps: - - name: my-configmap-1 - data: - key1: value1 - - name: my-configmap-2 - data: - key2: value2 - asserts: - - hasDocuments: - count: 2 - - isKind: - of: ConfigMap - - matchRegex: - path: metadata.name - pattern: my-configmap-(1|2) diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-poddisruptionbudget_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-poddisruptionbudget_test.yaml deleted file mode 100644 index bfe98e883..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-poddisruptionbudget_test.yaml +++ /dev/null @@ -1,79 +0,0 @@ -suite: Default Backend > PodDisruptionBudget -templates: - - default-backend-poddisruptionbudget.yaml - -tests: - - it: should create a PodDisruptionBudget if `defaultBackend.replicaCount` is greater than 1 - set: - defaultBackend.enabled: true - defaultBackend.replicaCount: 2 - asserts: - - hasDocuments: - count: 1 - - isKind: - of: PodDisruptionBudget - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-defaultbackend - - - it: should not create a PodDisruptionBudget if `defaultBackend.replicaCount` is less than or equal 1 - set: - defaultBackend.enabled: true - defaultBackend.replicaCount: 1 - asserts: - - hasDocuments: - count: 0 - - - it: should create a PodDisruptionBudget if `defaultBackend.autoscaling.enabled` is true and `defaultBackend.autoscaling.minReplicas` is greater than 1 - set: - defaultBackend.enabled: true - defaultBackend.autoscaling.enabled: true - defaultBackend.autoscaling.minReplicas: 2 - asserts: - - hasDocuments: - count: 1 - - isKind: - of: PodDisruptionBudget - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-defaultbackend - - - it: should not create a PodDisruptionBudget if `defaultBackend.autoscaling.enabled` is true and `defaultBackend.autoscaling.minReplicas` is less than or equal 1 - set: - defaultBackend.enabled: true - defaultBackend.autoscaling.enabled: true - defaultBackend.autoscaling.minReplicas: 1 - asserts: - - hasDocuments: - count: 0 - - - it: should create a PodDisruptionBudget without `minAvailable` and with `maxUnavailable` if `defaultBackend.minAvailable` and `defaultBackend.maxUnavailable` are set - set: - defaultBackend.enabled: true - defaultBackend.replicaCount: 2 - defaultBackend.minAvailable: 1 - defaultBackend.maxUnavailable: 1 - asserts: - - hasDocuments: - count: 1 - - isKind: - of: PodDisruptionBudget - - notExists: - path: spec.minAvailable - - equal: - path: spec.maxUnavailable - value: 1 - - - it: should create a PodDisruptionBudget with `unhealthyPodEvictionPolicy` if `defaultBackend.unhealthyPodEvictionPolicy` is set - set: - defaultBackend.enabled: true - defaultBackend.replicaCount: 2 - defaultBackend.unhealthyPodEvictionPolicy: IfHealthyBudget - asserts: - - hasDocuments: - count: 1 - - isKind: - of: PodDisruptionBudget - - equal: - path: spec.unhealthyPodEvictionPolicy - value: IfHealthyBudget diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-service_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-service_test.yaml deleted file mode 100644 index f16904f9f..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-service_test.yaml +++ /dev/null @@ -1,32 +0,0 @@ -suite: Default Backend > Service -templates: - - default-backend-service.yaml - -tests: - - it: should not create a Service if `defaultBackend.enabled` is false - set: - defaultBackend.enabled: false - asserts: - - hasDocuments: - count: 0 - - - it: should create a Service if `defaultBackend.enabled` is true - set: - defaultBackend.enabled: true - asserts: - - hasDocuments: - count: 1 - - isKind: - of: Service - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-defaultbackend - - - it: should create a Service with port 80 if `defaultBackend.service.port` is 80 - set: - defaultBackend.enabled: true - defaultBackend.service.port: 80 - asserts: - - equal: - path: spec.ports[0].port - value: 80 diff --git a/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-serviceaccount_test.yaml b/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-serviceaccount_test.yaml deleted file mode 100644 index 05a815d0a..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/tests/default-backend-serviceaccount_test.yaml +++ /dev/null @@ -1,51 +0,0 @@ -suite: Default Backend > ServiceAccount -templates: - - default-backend-serviceaccount.yaml - -tests: - - it: should not create a ServiceAccount if `defaultBackend.serviceAccount.create` is false - set: - defaultBackend.enabled: true - defaultBackend.serviceAccount.create: false - asserts: - - hasDocuments: - count: 0 - - - it: should create a ServiceAccount if `defaultBackend.serviceAccount.create` is true - set: - defaultBackend.enabled: true - defaultBackend.serviceAccount.create: true - asserts: - - hasDocuments: - count: 1 - - isKind: - of: ServiceAccount - - equal: - path: metadata.name - value: RELEASE-NAME-ingress-nginx-backend - - - it: should create a ServiceAccount with specified name if `defaultBackend.serviceAccount.name` is set - set: - defaultBackend.enabled: true - defaultBackend.serviceAccount.name: ingress-nginx-admission-test-sa - asserts: - - hasDocuments: - count: 1 - - isKind: - of: ServiceAccount - - equal: - path: metadata.name - value: ingress-nginx-admission-test-sa - - - it: should create a ServiceAccount with token auto-mounting disabled if `defaultBackend.serviceAccount.automountServiceAccountToken` is false - set: - defaultBackend.enabled: true - defaultBackend.serviceAccount.automountServiceAccountToken: false - asserts: - - hasDocuments: - count: 1 - - isKind: - of: ServiceAccount - - equal: - path: automountServiceAccountToken - value: false diff --git a/charts/devtron-utilities/charts/ingress-nginx/values.yaml b/charts/devtron-utilities/charts/ingress-nginx/values.yaml deleted file mode 100644 index 0c1a0ca24..000000000 --- a/charts/devtron-utilities/charts/ingress-nginx/values.yaml +++ /dev/null @@ -1,1193 +0,0 @@ -## nginx configuration -## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/index.md -## - -global: - image: - # -- Registry host to pull images from. - registry: registry.k8s.io -## Overrides for generated resource names -# See templates/_helpers.tpl -# nameOverride: -# fullnameOverride: - -# -- Override the deployment namespace; defaults to .Release.Namespace -namespaceOverride: "" -## Labels to apply to all resources -## -commonLabels: {} -# scmhash: abc123 -# myLabel: aakkmd - -controller: - name: controller - enableAnnotationValidations: true - image: - ## Keep false as default for now! - chroot: false - # registry: registry.k8s.io - image: ingress-nginx/controller - ## for backwards compatibility consider setting the full image url via the repository value below - ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail - ## repository: - tag: "v1.12.0" - digest: sha256:e6b8de175acda6ca913891f0f727bca4527e797d52688cbe9fec9040d6f6b6fa - digestChroot: sha256:87c88e1c38a6c8d4483c8f70b69e2cca49853bb3ec3124b9b1be648edf139af3 - pullPolicy: IfNotPresent - runAsNonRoot: true - # -- This value must not be changed using the official image. - # uid=101(www-data) gid=82(www-data) groups=82(www-data) - runAsUser: 101 - # -- This value must not be changed using the official image. - # uid=101(www-data) gid=82(www-data) groups=82(www-data) - runAsGroup: 82 - allowPrivilegeEscalation: false - seccompProfile: - type: RuntimeDefault - readOnlyRootFilesystem: false - # -- Configures the controller container name - containerName: controller - # -- Configures the ports that the nginx-controller listens on - containerPort: - http: 80 - https: 443 - # -- Global configuration passed to the ConfigMap consumed by the controller. Values may contain Helm templates. - # Ref.: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/ - config: {} - # -- Annotations to be added to the controller config configuration configmap. - configAnnotations: {} - # -- Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers - proxySetHeaders: {} - # -- Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers - addHeaders: {} - # -- Optionally customize the pod dnsConfig. - dnsConfig: {} - # -- Optionally customize the pod hostAliases. - hostAliases: [] - # - ip: 127.0.0.1 - # hostnames: - # - foo.local - # - bar.local - # - ip: 10.1.2.3 - # hostnames: - # - foo.remote - # - bar.remote - # -- Optionally customize the pod hostname. - hostname: {} - # -- Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'. - # By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller - # to keep resolving names inside the k8s network, use ClusterFirstWithHostNet. - dnsPolicy: ClusterFirst - # -- Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network - # Ingress status was blank because there is no Service exposing the Ingress-Nginx Controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply - reportNodeInternalIp: false - # -- Process Ingress objects without ingressClass annotation/ingressClassName field - # Overrides value for --watch-ingress-without-class flag of the controller binary - # Defaults to false - watchIngressWithoutClass: false - # -- Process IngressClass per name (additionally as per spec.controller). - ingressClassByName: false - # -- This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-mode="auto" - # Defaults to false - enableTopologyAwareRouting: false - # -- This configuration disable Nginx Controller Leader Election - disableLeaderElection: false - # -- Duration a leader election is valid before it's getting re-elected, e.g. `15s`, `10m` or `1h`. (Default: 30s) - electionTTL: "" - # -- This configuration defines if Ingress Controller should allow users to set - # their own *-snippet annotations, otherwise this is forbidden / dropped - # when users add those annotations. - # Global snippets in ConfigMap are still respected - allowSnippetAnnotations: false - # -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm), - # since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920 - # is merged - hostNetwork: false - ## Use host ports 80 and 443 - ## Disabled by default - hostPort: - # -- Enable 'hostPort' or not - enabled: false - ports: - # -- 'hostPort' http port - http: 80 - # -- 'hostPort' https port - https: 443 - # NetworkPolicy for controller component. - networkPolicy: - # -- Enable 'networkPolicy' or not - enabled: false - # -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader' - electionID: "" - # -- This section refers to the creation of the IngressClass resource. - # IngressClasses are immutable and cannot be changed after creation. - # We do not support namespaced IngressClasses, yet, so a ClusterRole and a ClusterRoleBinding is required. - ingressClassResource: - # -- Name of the IngressClass - name: nginx - # -- Create the IngressClass or not - enabled: true - # -- If true, Ingresses without `ingressClassName` get assigned to this IngressClass on creation. - # Ingress creation gets rejected if there are multiple default IngressClasses. - # Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#default-ingress-class - default: false - # -- Annotations to be added to the IngressClass resource. - annotations: {} - # -- Controller of the IngressClass. An Ingress Controller looks for IngressClasses it should reconcile by this value. - # This value is also being set as the `--controller-class` argument of this Ingress Controller. - # Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class - controllerValue: k8s.io/ingress-nginx - # -- Aliases of this IngressClass. Creates copies with identical settings but the respective alias as name. - # Useful for development environments with only one Ingress Controller but production-like Ingress resources. - # `default` gets enabled on the original IngressClass only. - aliases: [] - # aliases: - # - nginx-alias-1 - # - nginx-alias-2 - # -- A link to a custom resource containing additional configuration for the controller. - # This is optional if the controller consuming this IngressClass does not require additional parameters. - # Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class - parameters: {} - # parameters: - # apiGroup: k8s.example.com - # kind: IngressParameters - # name: external-lb - # -- For backwards compatibility with ingress.class annotation, use ingressClass. - # Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation - ingressClass: nginx - # -- Labels to add to the pod container metadata - podLabels: {} - # key: value - - # -- Security context for controller pods - podSecurityContext: {} - # -- sysctls for controller pods - ## Ref: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ - sysctls: {} - # sysctls: - # "net.core.somaxconn": "8192" - # -- Security context for controller containers - containerSecurityContext: {} - # -- Allows customization of the source of the IP address or FQDN to report - # in the ingress status field. By default, it reads the information provided - # by the service. If disable, the status field reports the IP address of the - # node or nodes where an ingress controller pod is running. - publishService: - # -- Enable 'publishService' or not - enabled: true - # -- Allows overriding of the publish service to bind to - # Must be / - pathOverride: "" - # Limit the scope of the controller to a specific namespace - scope: - # -- Enable 'scope' or not - enabled: false - # -- Namespace to limit the controller to; defaults to $(POD_NAMESPACE) - namespace: "" - # -- When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels - # only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces. - namespaceSelector: "" - # -- Allows customization of the configmap / nginx-configmap namespace; defaults to $(POD_NAMESPACE) - configMapNamespace: "" - tcp: - # -- Allows customization of the tcp-services-configmap; defaults to $(POD_NAMESPACE) - configMapNamespace: "" - # -- Annotations to be added to the tcp config configmap - annotations: {} - udp: - # -- Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE) - configMapNamespace: "" - # -- Annotations to be added to the udp config configmap - annotations: {} - # -- Maxmind license key to download GeoLite2 Databases. - ## https://blog.maxmind.com/2019/12/significant-changes-to-accessing-and-using-geolite2-databases/ - maxmindLicenseKey: "" - # -- Additional command line arguments to pass to Ingress-Nginx Controller - # E.g. to specify the default SSL certificate you can use - extraArgs: {} - ## extraArgs: - ## default-ssl-certificate: "/" - ## time-buckets: "0.005,0.01,0.025,0.05,0.1,0.25,0.5,1,2.5,5,10" - ## length-buckets: "10,20,30,40,50,60,70,80,90,100" - ## size-buckets: "10,100,1000,10000,100000,1e+06,1e+07" - - # -- Additional environment variables to set - extraEnvs: [] - # extraEnvs: - # - name: FOO - # valueFrom: - # secretKeyRef: - # key: FOO - # name: secret-resource - - # -- Use a `DaemonSet` or `Deployment` - kind: Deployment - # -- Annotations to be added to the controller Deployment or DaemonSet - ## - annotations: {} - # keel.sh/pollSchedule: "@every 60m" - - # -- Labels to be added to the controller Deployment or DaemonSet and other resources that do not have option to specify labels - ## - labels: {} - # keel.sh/policy: patch - # keel.sh/trigger: poll - - # -- The update strategy to apply to the Deployment or DaemonSet - ## - updateStrategy: {} - # rollingUpdate: - # maxUnavailable: 1 - # type: RollingUpdate - - # -- Specifies the number of seconds you want to wait for the controller deployment to progress before the system reports back that it has failed. - # Ref.: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#progress-deadline-seconds - progressDeadlineSeconds: 0 - # -- `minReadySeconds` to avoid killing pods before we are ready - ## - minReadySeconds: 0 - # -- Node tolerations for server scheduling to nodes with taints - ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ - ## - tolerations: [] - # - key: "key" - # operator: "Equal|Exists" - # value: "value" - # effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)" - - # -- Affinity and anti-affinity rules for server scheduling to nodes - ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## - affinity: {} - # # An example of preferred pod anti-affinity, weight is in the range 1-100 - # podAntiAffinity: - # preferredDuringSchedulingIgnoredDuringExecution: - # - weight: 100 - # podAffinityTerm: - # labelSelector: - # matchExpressions: - # - key: app.kubernetes.io/name - # operator: In - # values: - # - '{{ include "ingress-nginx.name" . }}' - # - key: app.kubernetes.io/instance - # operator: In - # values: - # - '{{ .Release.Name }}' - # - key: app.kubernetes.io/component - # operator: In - # values: - # - controller - # topologyKey: kubernetes.io/hostname - - # # An example of required pod anti-affinity - # podAntiAffinity: - # requiredDuringSchedulingIgnoredDuringExecution: - # - labelSelector: - # matchExpressions: - # - key: app.kubernetes.io/name - # operator: In - # values: - # - '{{ include "ingress-nginx.name" . }}' - # - key: app.kubernetes.io/instance - # operator: In - # values: - # - '{{ .Release.Name }}' - # - key: app.kubernetes.io/component - # operator: In - # values: - # - controller - # topologyKey: kubernetes.io/hostname - - # -- Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in. - ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ - ## - topologySpreadConstraints: [] - # - labelSelector: - # matchLabels: - # app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}' - # app.kubernetes.io/instance: '{{ .Release.Name }}' - # app.kubernetes.io/component: controller - # matchLabelKeys: - # - pod-template-hash - # topologyKey: topology.kubernetes.io/zone - # maxSkew: 1 - # whenUnsatisfiable: ScheduleAnyway - # - labelSelector: - # matchLabels: - # app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}' - # app.kubernetes.io/instance: '{{ .Release.Name }}' - # app.kubernetes.io/component: controller - # matchLabelKeys: - # - pod-template-hash - # topologyKey: kubernetes.io/hostname - # maxSkew: 1 - # whenUnsatisfiable: ScheduleAnyway - - # -- `terminationGracePeriodSeconds` to avoid killing pods before we are ready - ## wait up to five minutes for the drain of connections - ## - terminationGracePeriodSeconds: 300 - # -- Node labels for controller pod assignment - ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ - ## - nodeSelector: - kubernetes.io/os: linux - ## Liveness and readiness probe values - ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## - ## startupProbe: - ## httpGet: - ## # should match container.healthCheckPath - ## path: "/healthz" - ## port: 10254 - ## scheme: HTTP - ## initialDelaySeconds: 5 - ## periodSeconds: 5 - ## timeoutSeconds: 2 - ## successThreshold: 1 - ## failureThreshold: 5 - livenessProbe: - httpGet: - # should match container.healthCheckPath - path: "/healthz" - port: 10254 - scheme: HTTP - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 1 - successThreshold: 1 - failureThreshold: 5 - readinessProbe: - httpGet: - # should match container.healthCheckPath - path: "/healthz" - port: 10254 - scheme: HTTP - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 1 - successThreshold: 1 - failureThreshold: 3 - # -- Path of the health check endpoint. All requests received on the port defined by - # the healthz-port parameter are forwarded internally to this path. - healthCheckPath: "/healthz" - # -- Address to bind the health check endpoint. - # It is better to set this option to the internal node address - # if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode. - healthCheckHost: "" - # -- Annotations to be added to controller pods - ## - podAnnotations: {} - replicaCount: 1 - # -- Minimum available pods set in PodDisruptionBudget. - # Define either 'minAvailable' or 'maxUnavailable', never both. - minAvailable: 1 - # -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored. - # maxUnavailable: 1 - # -- Eviction policy for unhealthy pods guarded by PodDisruptionBudget. - # Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/ - unhealthyPodEvictionPolicy: "" - ## Define requests resources to avoid probe issues due to CPU utilization in busy nodes - ## ref: https://github.com/kubernetes/ingress-nginx/issues/4735#issuecomment-551204903 - ## Ideally, there should be no limits. - ## https://engineering.indeedblog.com/blog/2019/12/cpu-throttling-regression-fix/ - resources: - ## limits: - ## cpu: 100m - ## memory: 90Mi - requests: - cpu: 100m - memory: 90Mi - # Mutually exclusive with keda autoscaling - autoscaling: - enabled: false - annotations: {} - minReplicas: 1 - maxReplicas: 11 - targetCPUUtilizationPercentage: 50 - targetMemoryUtilizationPercentage: 50 - behavior: {} - # scaleDown: - # stabilizationWindowSeconds: 300 - # policies: - # - type: Pods - # value: 1 - # periodSeconds: 180 - # scaleUp: - # stabilizationWindowSeconds: 300 - # policies: - # - type: Pods - # value: 2 - # periodSeconds: 60 - autoscalingTemplate: [] - # Custom or additional autoscaling metrics - # ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics - # - type: Pods - # pods: - # metric: - # name: nginx_ingress_controller_nginx_process_requests_total - # target: - # type: AverageValue - # averageValue: 10000m - - # Mutually exclusive with hpa autoscaling - keda: - apiVersion: "keda.sh/v1alpha1" - ## apiVersion changes with keda 1.x vs 2.x - ## 2.x = keda.sh/v1alpha1 - ## 1.x = keda.k8s.io/v1alpha1 - enabled: false - minReplicas: 1 - maxReplicas: 11 - pollingInterval: 30 - cooldownPeriod: 300 - # fallback: - # failureThreshold: 3 - # replicas: 11 - restoreToOriginalReplicaCount: false - scaledObject: - annotations: {} - # Custom annotations for ScaledObject resource - # annotations: - # key: value - triggers: [] - # - type: prometheus - # metadata: - # serverAddress: http://:9090 - # metricName: http_requests_total - # threshold: '100' - # query: sum(rate(http_requests_total{deployment="my-deployment"}[2m])) - - behavior: {} - # scaleDown: - # stabilizationWindowSeconds: 300 - # policies: - # - type: Pods - # value: 1 - # periodSeconds: 180 - # scaleUp: - # stabilizationWindowSeconds: 300 - # policies: - # - type: Pods - # value: 2 - # periodSeconds: 60 - # -- Enable mimalloc as a drop-in replacement for malloc. - ## ref: https://github.com/microsoft/mimalloc - ## - enableMimalloc: true - ## Override NGINX template - customTemplate: - configMapName: "" - configMapKey: "" - service: - # -- Enable controller services or not. This does not influence the creation of either the admission webhook or the metrics service. - enabled: true - external: - # -- Enable the external controller service or not. Useful for internal-only deployments. - enabled: true - # -- Annotations to be added to the external controller service. See `controller.service.internal.annotations` for annotations to be added to the internal controller service. - annotations: {} - # -- Labels to be added to both controller services. - labels: {} - # -- Type of the external controller service. - # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types - type: LoadBalancer - # -- Pre-defined cluster internal IP address of the external controller service. Take care of collisions with existing services. - # This value is immutable. Set once, it can not be changed without deleting and re-creating the service. - # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address - clusterIP: "" - # -- List of node IP addresses at which the external controller service is available. - # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips - externalIPs: [] - # -- Deprecated: Pre-defined IP address of the external controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP. - # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer - loadBalancerIP: "" - # -- Restrict access to the external controller service. Values must be CIDRs. Allows any source address by default. - loadBalancerSourceRanges: [] - # -- Load balancer class of the external controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default. - # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class - loadBalancerClass: "" - # -- Enable node port allocation for the external controller service or not. Applies to type `LoadBalancer` only. - # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation - # allocateLoadBalancerNodePorts: true - - # -- External traffic policy of the external controller service. Set to "Local" to preserve source IP on providers supporting it. - # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip - externalTrafficPolicy: "" - # -- Session affinity of the external controller service. Must be either "None" or "ClientIP" if set. Defaults to "None". - # Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity - sessionAffinity: "" - # -- Specifies the health check node port (numeric port number) for the external controller service. - # If not specified, the service controller allocates a port from your cluster's node port range. - # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip - # healthCheckNodePort: 0 - - # -- Represents the dual-stack capabilities of the external controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack. - # Fields `ipFamilies` and `clusterIP` depend on the value of this field. - # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services - ipFamilyPolicy: SingleStack - # -- List of IP families (e.g. IPv4, IPv6) assigned to the external controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field. - # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services - ipFamilies: - - IPv4 - # -- Enable the HTTP listener on both controller services or not. - enableHttp: true - # -- Enable the HTTPS listener on both controller services or not. - enableHttps: true - ports: - # -- Port the external HTTP listener is published with. - http: 80 - # -- Port the external HTTPS listener is published with. - https: 443 - targetPorts: - # -- Port of the ingress controller the external HTTP listener is mapped to. - http: http - # -- Port of the ingress controller the external HTTPS listener is mapped to. - https: https - # -- Declare the app protocol of the external HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol. - # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol - appProtocol: true - nodePorts: - # -- Node port allocated for the external HTTP listener. If left empty, the service controller allocates one from the configured node port range. - http: "" - # -- Node port allocated for the external HTTPS listener. If left empty, the service controller allocates one from the configured node port range. - https: "" - # -- Node port mapping for external TCP listeners. If left empty, the service controller allocates them from the configured node port range. - # Example: - # tcp: - # 8080: 30080 - tcp: {} - # -- Node port mapping for external UDP listeners. If left empty, the service controller allocates them from the configured node port range. - # Example: - # udp: - # 53: 30053 - udp: {} - internal: - # -- Enable the internal controller service or not. Remember to configure `controller.service.internal.annotations` when enabling this. - enabled: false - # -- Annotations to be added to the internal controller service. Mandatory for the internal controller service to be created. Varies with the cloud service. - # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer - annotations: {} - # -- Type of the internal controller service. - # Defaults to the value of `controller.service.type`. - # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types - type: "" - # -- Pre-defined cluster internal IP address of the internal controller service. Take care of collisions with existing services. - # This value is immutable. Set once, it can not be changed without deleting and re-creating the service. - # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address - clusterIP: "" - # -- List of node IP addresses at which the internal controller service is available. - # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips - externalIPs: [] - # -- Deprecated: Pre-defined IP address of the internal controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP. - # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer - loadBalancerIP: "" - # -- Restrict access to the internal controller service. Values must be CIDRs. Allows any source address by default. - loadBalancerSourceRanges: [] - # -- Load balancer class of the internal controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default. - # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class - loadBalancerClass: "" - # -- Enable node port allocation for the internal controller service or not. Applies to type `LoadBalancer` only. - # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation - # allocateLoadBalancerNodePorts: true - - # -- External traffic policy of the internal controller service. Set to "Local" to preserve source IP on providers supporting it. - # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip - externalTrafficPolicy: "" - # -- Session affinity of the internal controller service. Must be either "None" or "ClientIP" if set. Defaults to "None". - # Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity - sessionAffinity: "" - # -- Specifies the health check node port (numeric port number) for the internal controller service. - # If not specified, the service controller allocates a port from your cluster's node port range. - # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip - # healthCheckNodePort: 0 - - # -- Represents the dual-stack capabilities of the internal controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack. - # Fields `ipFamilies` and `clusterIP` depend on the value of this field. - # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services - ipFamilyPolicy: SingleStack - # -- List of IP families (e.g. IPv4, IPv6) assigned to the internal controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field. - # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services - ipFamilies: - - IPv4 - ports: {} - # -- Port the internal HTTP listener is published with. - # Defaults to the value of `controller.service.ports.http`. - # http: 80 - # -- Port the internal HTTPS listener is published with. - # Defaults to the value of `controller.service.ports.https`. - # https: 443 - - targetPorts: {} - # -- Port of the ingress controller the internal HTTP listener is mapped to. - # Defaults to the value of `controller.service.targetPorts.http`. - # http: http - # -- Port of the ingress controller the internal HTTPS listener is mapped to. - # Defaults to the value of `controller.service.targetPorts.https`. - # https: https - - # -- Declare the app protocol of the internal HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol. - # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol - appProtocol: true - nodePorts: - # -- Node port allocated for the internal HTTP listener. If left empty, the service controller allocates one from the configured node port range. - http: "" - # -- Node port allocated for the internal HTTPS listener. If left empty, the service controller allocates one from the configured node port range. - https: "" - # -- Node port mapping for internal TCP listeners. If left empty, the service controller allocates them from the configured node port range. - # Example: - # tcp: - # 8080: 30080 - tcp: {} - # -- Node port mapping for internal UDP listeners. If left empty, the service controller allocates them from the configured node port range. - # Example: - # udp: - # 53: 30053 - udp: {} - # shareProcessNamespace enables process namespace sharing within the pod. - # This can be used for example to signal log rotation using `kill -USR1` from a sidecar. - shareProcessNamespace: false - # -- Additional containers to be added to the controller pod. - # See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example. - extraContainers: [] - # - name: my-sidecar - # image: nginx:latest - # - name: lemonldap-ng-controller - # image: lemonldapng/lemonldap-ng-controller:0.2.0 - # args: - # - /lemonldap-ng-controller - # - --alsologtostderr - # - --configmap=$(POD_NAMESPACE)/lemonldap-ng-configuration - # env: - # - name: POD_NAME - # valueFrom: - # fieldRef: - # fieldPath: metadata.name - # - name: POD_NAMESPACE - # valueFrom: - # fieldRef: - # fieldPath: metadata.namespace - # volumeMounts: - # - name: copy-portal-skins - # mountPath: /srv/var/lib/lemonldap-ng/portal/skins - - # -- Additional volumeMounts to the controller main container. - extraVolumeMounts: [] - # - name: copy-portal-skins - # mountPath: /var/lib/lemonldap-ng/portal/skins - - # -- Additional volumes to the controller pod. - extraVolumes: [] - # - name: copy-portal-skins - # emptyDir: {} - - # -- Containers, which are run before the app containers are started. - extraInitContainers: [] - # - name: init-myservice - # image: busybox - # command: ['sh', '-c', 'until nslookup myservice; do echo waiting for myservice; sleep 2; done;'] - - # -- Modules, which are mounted into the core nginx image. - extraModules: [] - # - name: mytestmodule - # image: - # # registry: registry.k8s.io - # image: ingress-nginx/mytestmodule - # ## for backwards compatibility consider setting the full image url via the repository value below - # ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail - # ## repository: - # tag: "v1.0.0" - # digest: "" - # distroless: false - # containerSecurityContext: - # runAsNonRoot: true - # runAsUser: - # runAsGroup: - # allowPrivilegeEscalation: false - # seccompProfile: - # type: RuntimeDefault - # capabilities: - # drop: - # - ALL - # readOnlyRootFilesystem: true - # resources: {} - # - # The image must contain a `/usr/local/bin/init_module.sh` executable, which - # will be executed as initContainers, to move its config files within the - # mounted volume. - - admissionWebhooks: - name: admission - annotations: {} - # ignore-check.kube-linter.io/no-read-only-rootfs: "This deployment needs write access to root filesystem". - - ## Additional annotations to the admission webhooks. - ## These annotations will be added to the ValidatingWebhookConfiguration and - ## the Jobs Spec of the admission webhooks. - enabled: true - # -- Additional environment variables to set - extraEnvs: [] - # extraEnvs: - # - name: FOO - # valueFrom: - # secretKeyRef: - # key: FOO - # name: secret-resource - # -- Admission Webhook failure policy to use - failurePolicy: Fail - # timeoutSeconds: 10 - port: 8443 - certificate: "/usr/local/certificates/cert" - key: "/usr/local/certificates/key" - namespaceSelector: {} - objectSelector: {} - # -- Labels to be added to admission webhooks - labels: {} - service: - annotations: {} - # clusterIP: "" - externalIPs: [] - # loadBalancerIP: "" - loadBalancerSourceRanges: [] - servicePort: 443 - type: ClusterIP - createSecretJob: - name: create - # -- Security context for secret creation containers - securityContext: - runAsNonRoot: true - runAsUser: 65532 - runAsGroup: 65532 - allowPrivilegeEscalation: false - seccompProfile: - type: RuntimeDefault - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - resources: {} - # limits: - # cpu: 10m - # memory: 20Mi - # requests: - # cpu: 10m - # memory: 20Mi - patchWebhookJob: - name: patch - # -- Security context for webhook patch containers - securityContext: - runAsNonRoot: true - runAsUser: 65532 - runAsGroup: 65532 - allowPrivilegeEscalation: false - seccompProfile: - type: RuntimeDefault - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - resources: {} - patch: - enabled: true - image: - # registry: registry.k8s.io - image: ingress-nginx/kube-webhook-certgen - ## for backwards compatibility consider setting the full image url via the repository value below - ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail - ## repository: - tag: v1.5.0 - digest: sha256:aaafd456bda110628b2d4ca6296f38731a3aaf0bf7581efae824a41c770a8fc4 - pullPolicy: IfNotPresent - # -- Provide a priority class name to the webhook patching job - ## - priorityClassName: "" - podAnnotations: {} - # NetworkPolicy for webhook patch - networkPolicy: - # -- Enable 'networkPolicy' or not - enabled: false - nodeSelector: - kubernetes.io/os: linux - tolerations: [] - # -- Labels to be added to patch job resources - labels: {} - # -- Security context for secret creation & webhook patch pods - securityContext: {} - # -- Admission webhook patch job RBAC - rbac: - # -- Create RBAC or not - create: true - # -- Admission webhook patch job service account - serviceAccount: - # -- Create a service account or not - create: true - # -- Custom service account name - name: "" - # -- Auto-mount service account token or not - automountServiceAccountToken: true - # Use certmanager to generate webhook certs - certManager: - enabled: false - # self-signed root certificate - rootCert: - # default to be 5y - duration: "" - admissionCert: - # default to be 1y - duration: "" - # issuerRef: - # name: "issuer" - # kind: "ClusterIssuer" - metrics: - port: 10254 - portName: metrics - # if this port is changed, change healthz-port: in extraArgs: accordingly - enabled: false - service: - # -- Enable the metrics service or not. - enabled: true - annotations: {} - # prometheus.io/scrape: "true" - # prometheus.io/port: "10254" - # -- Labels to be added to the metrics service resource - labels: {} - # clusterIP: "" - - # -- List of IP addresses at which the stats-exporter service is available - ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips - ## - externalIPs: [] - # loadBalancerIP: "" - loadBalancerSourceRanges: [] - servicePort: 10254 - type: ClusterIP - # externalTrafficPolicy: "" - # nodePort: "" - serviceMonitor: - enabled: false - additionalLabels: {} - # -- Annotations to be added to the ServiceMonitor. - annotations: {} - ## The label to use to retrieve the job name from. - ## jobLabel: "app.kubernetes.io/name" - namespace: "" - namespaceSelector: {} - ## Default: scrape .Release.Namespace or namespaceOverride only - ## To scrape all, use the following: - ## namespaceSelector: - ## any: true - scrapeInterval: 30s - # honorLabels: true - targetLabels: [] - relabelings: [] - metricRelabelings: [] - prometheusRule: - enabled: false - additionalLabels: {} - # -- Annotations to be added to the PrometheusRule. - annotations: {} - # namespace: "" - rules: [] - # # These are just examples rules, please adapt them to your needs - # - alert: NGINXConfigFailed - # expr: count(nginx_ingress_controller_config_last_reload_successful == 0) > 0 - # for: 1s - # labels: - # severity: critical - # annotations: - # description: bad ingress config - nginx config test failed - # summary: uninstall the latest ingress changes to allow config reloads to resume - # # By default a fake self-signed certificate is generated as default and - # # it is fine if it expires. If `--default-ssl-certificate` flag is used - # # and a valid certificate passed please do not filter for `host` label! - # # (i.e. delete `{host!="_"}` so also the default SSL certificate is - # # checked for expiration) - # - alert: NGINXCertificateExpiry - # expr: (avg(nginx_ingress_controller_ssl_expire_time_seconds{host!="_"}) by (host) - time()) < 604800 - # for: 1s - # labels: - # severity: critical - # annotations: - # description: ssl certificate(s) will expire in less then a week - # summary: renew expiring certificates to avoid downtime - # - alert: NGINXTooMany500s - # expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"5.+"} ) / sum(nginx_ingress_controller_requests) ) > 5 - # for: 1m - # labels: - # severity: warning - # annotations: - # description: Too many 5XXs - # summary: More than 5% of all requests returned 5XX, this requires your attention - # - alert: NGINXTooMany400s - # expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"4.+"} ) / sum(nginx_ingress_controller_requests) ) > 5 - # for: 1m - # labels: - # severity: warning - # annotations: - # description: Too many 4XXs - # summary: More than 5% of all requests returned 4XX, this requires your attention - # -- Improve connection draining when ingress controller pod is deleted using a lifecycle hook: - # With this new hook, we increased the default terminationGracePeriodSeconds from 30 seconds - # to 300, allowing the draining of connections up to five minutes. - # If the active connections end before that, the pod will terminate gracefully at that time. - # To effectively take advantage of this feature, the Configmap feature - # worker-shutdown-timeout new value is 240s instead of 10s. - ## - lifecycle: - preStop: - exec: - command: - - /wait-shutdown - priorityClassName: "" -# -- Rollback limit -## -revisionHistoryLimit: 10 -## Default 404 backend -## -defaultBackend: - ## - enabled: false - name: defaultbackend - image: - # registry: registry.k8s.io - image: defaultbackend-amd64 - ## for backwards compatibility consider setting the full image url via the repository value below - ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail - ## repository: - tag: "1.5" - pullPolicy: IfNotPresent - runAsNonRoot: true - # nobody user -> uid 65534 - runAsUser: 65534 - runAsGroup: 65534 - allowPrivilegeEscalation: false - seccompProfile: - type: RuntimeDefault - readOnlyRootFilesystem: true - extraArgs: {} - serviceAccount: - create: true - name: "" - automountServiceAccountToken: true - # -- Additional environment variables to set for defaultBackend pods - extraEnvs: [] - port: 8080 - ## Readiness and liveness probes for default backend - ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ - ## - livenessProbe: - failureThreshold: 3 - initialDelaySeconds: 30 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 5 - readinessProbe: - failureThreshold: 6 - initialDelaySeconds: 0 - periodSeconds: 5 - successThreshold: 1 - timeoutSeconds: 5 - # -- The update strategy to apply to the Deployment or DaemonSet - ## - updateStrategy: {} - # rollingUpdate: - # maxUnavailable: 1 - # type: RollingUpdate - - # -- `minReadySeconds` to avoid killing pods before we are ready - ## - minReadySeconds: 0 - # -- Node tolerations for server scheduling to nodes with taints - ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ - ## - tolerations: [] - # - key: "key" - # operator: "Equal|Exists" - # value: "value" - # effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)" - - # -- Affinity and anti-affinity rules for server scheduling to nodes - ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - affinity: {} - # # An example of preferred pod anti-affinity, weight is in the range 1-100 - # podAntiAffinity: - # preferredDuringSchedulingIgnoredDuringExecution: - # - weight: 100 - # podAffinityTerm: - # labelSelector: - # matchExpressions: - # - key: app.kubernetes.io/name - # operator: In - # values: - # - '{{ include "ingress-nginx.name" . }}' - # - key: app.kubernetes.io/instance - # operator: In - # values: - # - '{{ .Release.Name }}' - # - key: app.kubernetes.io/component - # operator: In - # values: - # - default-backend - # topologyKey: kubernetes.io/hostname - - # # An example of required pod anti-affinity - # podAntiAffinity: - # requiredDuringSchedulingIgnoredDuringExecution: - # - labelSelector: - # matchExpressions: - # - key: app.kubernetes.io/name - # operator: In - # values: - # - '{{ include "ingress-nginx.name" . }}' - # - key: app.kubernetes.io/instance - # operator: In - # values: - # - '{{ .Release.Name }}' - # - key: app.kubernetes.io/component - # operator: In - # values: - # - default-backend - # topologyKey: kubernetes.io/hostname - - # -- Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in. - # Ref.: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ - topologySpreadConstraints: [] - # - labelSelector: - # matchLabels: - # app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}' - # app.kubernetes.io/instance: '{{ .Release.Name }}' - # app.kubernetes.io/component: default-backend - # matchLabelKeys: - # - pod-template-hash - # topologyKey: topology.kubernetes.io/zone - # maxSkew: 1 - # whenUnsatisfiable: ScheduleAnyway - # - labelSelector: - # matchLabels: - # app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}' - # app.kubernetes.io/instance: '{{ .Release.Name }}' - # app.kubernetes.io/component: default-backend - # matchLabelKeys: - # - pod-template-hash - # topologyKey: kubernetes.io/hostname - # maxSkew: 1 - # whenUnsatisfiable: ScheduleAnyway - # -- Security context for default backend pods - podSecurityContext: {} - # -- Security context for default backend containers - containerSecurityContext: {} - # -- Labels to add to the pod container metadata - podLabels: {} - # key: value - - # -- Node labels for default backend pod assignment - ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ - ## - nodeSelector: - kubernetes.io/os: linux - # -- Annotations to be added to default backend pods - ## - podAnnotations: {} - replicaCount: 1 - # -- Minimum available pods set in PodDisruptionBudget. - # Define either 'minAvailable' or 'maxUnavailable', never both. - minAvailable: 1 - # -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored. - # maxUnavailable: 1 - # -- Eviction policy for unhealthy pods guarded by PodDisruptionBudget. - # Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/ - unhealthyPodEvictionPolicy: "" - resources: {} - # limits: - # cpu: 10m - # memory: 20Mi - # requests: - # cpu: 10m - # memory: 20Mi - - extraVolumeMounts: [] - ## Additional volumeMounts to the default backend container. - # - name: copy-portal-skins - # mountPath: /var/lib/lemonldap-ng/portal/skins - - extraVolumes: [] - ## Additional volumes to the default backend pod. - # - name: copy-portal-skins - # emptyDir: {} - - extraConfigMaps: [] - ## Additional configmaps to the default backend pod. - # - name: my-extra-configmap-1 - # labels: - # type: config-1 - # data: - # extra_file_1.html: | - # - # - name: my-extra-configmap-2 - # labels: - # type: config-2 - # data: - # extra_file_2.html: | - # - - autoscaling: - annotations: {} - enabled: false - minReplicas: 1 - maxReplicas: 2 - targetCPUUtilizationPercentage: 50 - targetMemoryUtilizationPercentage: 50 - # NetworkPolicy for default backend component. - networkPolicy: - # -- Enable 'networkPolicy' or not - enabled: false - service: - annotations: {} - # clusterIP: "" - - # -- List of IP addresses at which the default backend service is available - ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips - ## - externalIPs: [] - # loadBalancerIP: "" - loadBalancerSourceRanges: [] - servicePort: 80 - type: ClusterIP - priorityClassName: "" - # -- Labels to be added to the default backend resources - labels: {} -## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266 -rbac: - create: true - scope: false -serviceAccount: - create: true - name: "" - automountServiceAccountToken: true - # -- Annotations for the controller service account - annotations: {} -# -- Optional array of imagePullSecrets containing private registry credentials -## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ -imagePullSecrets: [] -# - name: secretName - -# -- TCP service key-value pairs -## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md -## -tcp: {} -# "8080": "default/example-tcp-svc:9000" - -# -- UDP service key-value pairs -## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md -## -udp: {} -# "53": "kube-system/kube-dns:53" - -# -- Prefix for TCP and UDP ports names in ingress controller service -## Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration -portNamePrefix: "" -# -- (string) A base64-encoded Diffie-Hellman parameter. -# This can be generated with: `openssl dhparam 4096 2> /dev/null | base64` -## Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param -dhParam: "" diff --git a/charts/devtron-utilities/charts/k8s-shield/.helmignore b/charts/devtron-utilities/charts/k8s-shield/.helmignore deleted file mode 100644 index 0e8a0eb36..000000000 --- a/charts/devtron-utilities/charts/k8s-shield/.helmignore +++ /dev/null @@ -1,23 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*.orig -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/charts/devtron-utilities/charts/k8s-shield/Chart.yaml b/charts/devtron-utilities/charts/k8s-shield/Chart.yaml deleted file mode 100644 index af8dd2a09..000000000 --- a/charts/devtron-utilities/charts/k8s-shield/Chart.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: v2 -appVersion: 1.0.0 -description: A Helm chart for Kubernetes admission policies -icon: https://cdn.devtron.ai/images/Devtron_K8s_Shield.png -keywords: -- Devtron -- Kubernetes -- validatingAdmissionPolicy -- k8s-policy -- Policies -- DevSecOps -- Security -maintainers: -- email: devops@devtron.ai - name: Devtron Devops Team -- email: neha.sharma@devtron.ai - name: Neha Sharma -name: k8s-shield -type: application -version: 0.1.0 diff --git a/charts/devtron-utilities/charts/k8s-shield/Readme.md b/charts/devtron-utilities/charts/k8s-shield/Readme.md deleted file mode 100644 index c6e55416c..000000000 --- a/charts/devtron-utilities/charts/k8s-shield/Readme.md +++ /dev/null @@ -1,72 +0,0 @@ -## Kubernetes Security Policies - -This document describes the configuration options for various Kubernetes security policies implemented through a ```values.yaml``` file. These policies help enforce security best practices and resource constraints in your Kubernetes cluster. - -The following sections describe the policies that are defined in the values.yaml file. - -## Table of Contents - -1. Exclude Label -2. PVC Creation Policy -3. Namespace Deletion Policy -4. Load Balancer Creation Policy -5. Application Deletion Policy -6. Resource Policies - - Without Resource Policy - - Limit Resource Policy -7. Admin Cluster Role Creation -8. ClusterRole Binding Creation -9. Readiness and Liveness Policy -10. Pod Security Policy -11. Container Security Policy -12. Extra Validating Policy - -## Exclude Label - -The ```excludeLabel``` Resources will be excluded from the scope of the policy if these labels are present. - -## PVC Creation Policy - -The ```pvcCreationPolicy``` restricts the creation of Persistent Volume Claims (PVCs). When enabled, this policy prevents the creation of PVCs in specified namespaces. - -## Namespace Deletion Policy - -The ```namespaceDeletionPolicy``` restricts the deletion of namespaces. It applies only to the namespaces listed in the configuration. - -## Load Balancer Creation Policy - -The ```loadBalancerCreationPolicy``` prevents the creation of LoadBalancer type services in specified namespaces. - -## Application Deletion Policy - -The ```appDeletionPolicy``` prevents the deletion of applications within specified namespaces. - -## Resource Policies - ## Without Resource Policy -The ```WithoutResource policy``` enforces the specification of resource requests and limits for deployments, statefulsets, and other resources. If this policy is enabled, it denies the creation or update of resources that do not specify resource requests or limits. - ## Limit Resource Policy -The ```limitResourcePolicy``` enforces a maximum CPU and memory limit for the specified resources (pods, deployments, statefulsets, etc.). If the resources do not meet the specified limits, the operation is denied. - -## Admin Cluster Role Creation - - The ```adminClusterRoleCreationpolicy``` prevents the creation of new roles or cluster roles with admin-level permissions. - -## ClusterRole Binding Creation - - The ```clusterRoleBindingCreationpolicy``` restricts the creation of clusterRoleBindings with cluster-admin access. - -## Readiness and Liveness Policy - - The ```readinessAndLivenessPolicy``` ensures that all deployments, statefulsets, or rollouts define readiness and liveness probes for their containers. These probes ensure that pods are considered healthy only when they pass the defined checks. - -## Pod Security Policy - - The ```podSecurityPolicy``` defines security best practices for Kubernetes Pods. It prevents containers from running as root, ensures that the root file system is not writable, and disables privileged containers. - -## Container Security Policy - - The ```containerSecurityPolicy``` defines additional security policies that apply to containers within pods. It ensures that containers adhere to security best practices, including non-root execution and restrictions on filesystem access and privilege escalation. - -## Extra Validating Policy - - The ```extraValidatingPolicy``` section allows you to define additional custom validation policies beyond the default set. These policies can be used to enforce specific rules for your Kubernetes resources. \ No newline at end of file diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/_helpers.tpl b/charts/devtron-utilities/charts/k8s-shield/templates/_helpers.tpl deleted file mode 100644 index fd2ec1af4..000000000 --- a/charts/devtron-utilities/charts/k8s-shield/templates/_helpers.tpl +++ /dev/null @@ -1,16 +0,0 @@ -{{- define "k8s-shield.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{- define "k8s-shield.fullname" -}} -{{- if .Values.fullnameOverride }} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- $name := default .Chart.Name .Values.nameOverride }} -{{- if contains $name .Release.Name }} -{{- .Release.Name | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} -{{- end }} -{{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/container-security-context-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/container-security-context-policy.yaml deleted file mode 100644 index 71ace2bec..000000000 --- a/charts/devtron-utilities/charts/k8s-shield/templates/container-security-context-policy.yaml +++ /dev/null @@ -1,68 +0,0 @@ -{{- if and $.Values.defaultPolicies.create $.Values.defaultPolicies.policies.containerSecurityPolicy }} -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicy -metadata: - name: "{{ include "k8s-shield.fullname" . }}-container-security" -spec: - failurePolicy: Fail - matchConstraints: - resourceRules: - - apiGroups: - {{- range $.Values.policyDefinitions.containerSecurityPolicy.apiGroups }} - - {{ . | quote }} - {{- end }} - apiVersions: - - v1 - operations: - {{- range $.Values.policyDefinitions.containerSecurityPolicy.operations }} - - {{ . | quote }} - {{- end }} - resources: - {{- range $.Values.policyDefinitions.containerSecurityPolicy.resources }} - - {{ . | quote }} - {{- end }} - scope: '*' - validations: - - expression: "object.kind != 'Pod' || has(object.metadata.labels) && object.metadata.labels['business-unit'] == 'finance'" - message: "Pods must have a 'business-unit: finance' label" - - expression: "object.kind != 'Pod' || object.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.runAsNonRoot) && c.securityContext.runAsNonRoot == {{ .Values.policyDefinitions.containerSecurityPolicy.allowrunAsNonRoot }})" - message: "All containers must set runAsNonRoot to {{ .Values.policyDefinitions.containerSecurityPolicy.allowrunAsNonRoot }}" - - expression: "object.kind != 'Pod' || object.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.readOnlyRootFilesystem) && c.securityContext.readOnlyRootFilesystem == {{ .Values.policyDefinitions.containerSecurityPolicy.allowreadOnlyRootFilesystem }})" - message: "All containers must set readOnlyRootFilesystem to {{ .Values.policyDefinitions.containerSecurityPolicy.allowreadOnlyRootFilesystem }}" - - expression: "object.kind != 'Pod' || object.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.allowPrivilegeEscalation) || c.securityContext.allowPrivilegeEscalation == {{ .Values.policyDefinitions.containerSecurityPolicy.allowPrivilegeEscalation }})" - message: "All containers must set allowPrivilegeEscalation to {{ .Values.policyDefinitions.containerSecurityPolicy.allowPrivilegeEscalation }}" - - expression: "object.kind != 'Pod' || object.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged == {{ .Values.policyDefinitions.containerSecurityPolicy.allowprivileged }})" - message: "All containers must set privileged to {{ .Values.policyDefinitions.containerSecurityPolicy.allowprivileged }}" - - expression: "['Deployment', 'ReplicaSet', 'DaemonSet', 'StatefulSet', 'Job'].all(kind, object.kind != kind) || has(object.metadata.labels) && object.metadata.labels['business-unit'] == 'finance'" - message: "Workload resources must have a 'business-unit: finance' label" - - expression: "['Deployment', 'ReplicaSet', 'DaemonSet', 'StatefulSet', 'Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.runAsNonRoot) && c.securityContext.runAsNonRoot == {{ .Values.policyDefinitions.containerSecurityPolicy.allowrunAsNonRoot }})" - message: "All workload containers must set runAsNonRoot to {{ .Values.policyDefinitions.containerSecurityPolicy.allowrunAsNonRoot }}" - - expression: "['Deployment', 'ReplicaSet', 'DaemonSet', 'StatefulSet', 'Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.readOnlyRootFilesystem) && c.securityContext.readOnlyRootFilesystem == {{ .Values.policyDefinitions.containerSecurityPolicy.allowreadOnlyRootFilesystem }})" - message: "All workload containers must set readOnlyRootFilesystem to {{ .Values.policyDefinitions.containerSecurityPolicy.allowreadOnlyRootFilesystem }}" - - expression: "['Deployment', 'ReplicaSet', 'DaemonSet', 'StatefulSet', 'Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.allowPrivilegeEscalation) || c.securityContext.allowPrivilegeEscalation == {{ .Values.policyDefinitions.containerSecurityPolicy.allowPrivilegeEscalation }})" - message: "All workload containers must set allowPrivilegeEscalation to {{ .Values.policyDefinitions.containerSecurityPolicy.allowPrivilegeEscalation }}" - - expression: "['Deployment', 'ReplicaSet', 'DaemonSet', 'StatefulSet', 'Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged == {{ .Values.policyDefinitions.containerSecurityPolicy.allowprivileged }})" - message: "All workload containers must set privileged to {{ .Values.policyDefinitions.containerSecurityPolicy.allowprivileged }}" - - expression: "object.kind != 'CronJob' || has(object.metadata.labels) && object.metadata.labels['business-unit'] == 'finance'" - message: "CronJobs must have a 'business-unit: finance' label" - - expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.runAsNonRoot) && c.securityContext.runAsNonRoot == {{ .Values.policyDefinitions.containerSecurityPolicy.allowrunAsNonRoot }})" - message: "All CronJob containers must set runAsNonRoot to {{ .Values.policyDefinitions.containerSecurityPolicy.allowrunAsNonRoot }}" - - expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.readOnlyRootFilesystem) && c.securityContext.readOnlyRootFilesystem == {{ .Values.policyDefinitions.containerSecurityPolicy.allowreadOnlyRootFilesystem }})" - message: "All CronJob containers must set readOnlyRootFilesystem to {{ .Values.policyDefinitions.containerSecurityPolicy.allowreadOnlyRootFilesystem }}" - - expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.allowPrivilegeEscalation) || c.securityContext.allowPrivilegeEscalation == {{ .Values.policyDefinitions.containerSecurityPolicy.allowPrivilegeEscalation }})" - message: "All CronJob containers must set allowPrivilegeEscalation to {{ .Values.policyDefinitions.containerSecurityPolicy.allowPrivilegeEscalation }}" - - expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged == {{ .Values.policyDefinitions.containerSecurityPolicy.allowprivileged }})" - message: "All CronJob containers must set privileged to {{ .Values.policyDefinitions.containerSecurityPolicy.allowprivileged }}" ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicyBinding -metadata: - name: {{ include "k8s-shield.fullname" . }}-container-security -spec: - policyName: {{ include "k8s-shield.fullname" . }}-container-security - validationActions: - {{- range .Values.policyDefinitions.containerSecurityPolicy.validationActions }} - - {{ . }} - {{- end }} -{{- end }} - diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/extraValidating-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/extraValidating-policy.yaml deleted file mode 100644 index c68785aec..000000000 --- a/charts/devtron-utilities/charts/k8s-shield/templates/extraValidating-policy.yaml +++ /dev/null @@ -1,4 +0,0 @@ -{{- range .Values.extraValidatingPolicy }} ---- -{{ toYaml . }} -{{- end -}} \ No newline at end of file diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/pod-security-context-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/pod-security-context-policy.yaml deleted file mode 100644 index 9fe5c71fb..000000000 --- a/charts/devtron-utilities/charts/k8s-shield/templates/pod-security-context-policy.yaml +++ /dev/null @@ -1,61 +0,0 @@ -{{- if and $.Values.defaultPolicies.create $.Values.defaultPolicies.policies.podSecurityPolicy }} -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicy -metadata: - name: "{{ include "k8s-shield.fullname" . }}-pod-security" -spec: - failurePolicy: Fail - matchConstraints: - resourceRules: - - apiGroups: - {{- range $.Values.policyDefinitions.podSecurityPolicy.apiGroups }} - - {{ . | quote }} - {{- end }} - apiVersions: - - v1 - operations: - {{- range $.Values.policyDefinitions.podSecurityPolicy.operations }} - - {{ . | quote }} - {{- end }} - resources: - {{- range $.Values.policyDefinitions.podSecurityPolicy.resources }} - - {{ . | quote }} - {{- end }} - scope: '*' - validations: - - expression: "object.kind != 'Pod' || object.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.runAsNonRoot) && c.securityContext.runAsNonRoot == {{ .Values.policyDefinitions.podSecurityPolicy.allowrunAsNonRoot }})" - message: "All containers must set runAsNonRoot to {{ .Values.policyDefinitions.podSecurityPolicy.allowrunAsNonRoot }}" - - expression: "object.kind != 'Pod' || object.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.readOnlyRootFilesystem) && c.securityContext.readOnlyRootFilesystem == {{ .Values.policyDefinitions.podSecurityPolicy.allowreadOnlyRootFilesystem }})" - message: "All containers must set readOnlyRootFilesystem to {{ .Values.policyDefinitions.podSecurityPolicy.allowreadOnlyRootFilesystem }}" - - expression: "object.kind != 'Pod' || object.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.allowPrivilegeEscalation) || c.securityContext.allowPrivilegeEscalation == {{ .Values.policyDefinitions.podSecurityPolicy.allowPrivilegeEscalation }})" - message: "All containers must set allowPrivilegeEscalation to {{ .Values.policyDefinitions.podSecurityPolicy.allowPrivilegeEscalation }}" - - expression: "object.kind != 'Pod' || object.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged == {{ .Values.policyDefinitions.podSecurityPolicy.allowprivileged }})" - message: "All containers must set privileged to {{ .Values.policyDefinitions.podSecurityPolicy.allowprivileged }}" - - expression: "['Deployment', 'ReplicaSet', 'DaemonSet', 'StatefulSet', 'Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.runAsNonRoot) && c.securityContext.runAsNonRoot == {{ .Values.policyDefinitions.podSecurityPolicy.allowrunAsNonRoot }})" - message: "All workload containers must set runAsNonRoot to {{ .Values.policyDefinitions.podSecurityPolicy.allowrunAsNonRoot }}" - - expression: "['Deployment', 'ReplicaSet', 'DaemonSet', 'StatefulSet', 'Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.readOnlyRootFilesystem) && c.securityContext.readOnlyRootFilesystem == {{ .Values.policyDefinitions.podSecurityPolicy.allowreadOnlyRootFilesystem }})" - message: "All workload containers must set readOnlyRootFilesystem to {{ .Values.policyDefinitions.podSecurityPolicy.allowreadOnlyRootFilesystem }}" - - expression: "['Deployment', 'ReplicaSet', 'DaemonSet', 'StatefulSet', 'Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.allowPrivilegeEscalation) || c.securityContext.allowPrivilegeEscalation == {{ .Values.policyDefinitions.podSecurityPolicy.allowPrivilegeEscalation }})" - message: "All workload containers must set allowPrivilegeEscalation to {{ .Values.policyDefinitions.podSecurityPolicy.allowPrivilegeEscalation }}" - - expression: "['Deployment', 'ReplicaSet', 'DaemonSet', 'StatefulSet', 'Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged == {{ .Values.policyDefinitions.podSecurityPolicy.allowprivileged }})" - message: "All workload containers must set privileged to {{ .Values.policyDefinitions.podSecurityPolicy.allowprivileged }}" - - expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.runAsNonRoot) && c.securityContext.runAsNonRoot == {{ .Values.policyDefinitions.podSecurityPolicy.allowrunAsNonRoot }})" - message: "All CronJob containers must set runAsNonRoot to {{ .Values.policyDefinitions.podSecurityPolicy.allowrunAsNonRoot }}" - - expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(c, has(c.securityContext) && has(c.securityContext.readOnlyRootFilesystem) && c.securityContext.readOnlyRootFilesystem == {{ .Values.policyDefinitions.podSecurityPolicy.allowreadOnlyRootFilesystem }})" - message: "All CronJob containers must set readOnlyRootFilesystem to {{ .Values.policyDefinitions.podSecurityPolicy.allowreadOnlyRootFilesystem }}" - - expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.allowPrivilegeEscalation) || c.securityContext.allowPrivilegeEscalation == {{ .Values.policyDefinitions.podSecurityPolicy.allowPrivilegeEscalation }})" - message: "All CronJob containers must set allowPrivilegeEscalation to {{ .Values.policyDefinitions.podSecurityPolicy.allowPrivilegeEscalation }}" - - expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.template.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged == {{ .Values.policyDefinitions.podSecurityPolicy.allowprivileged }})" - message: "All CronJob containers must set privileged to {{ .Values.policyDefinitions.podSecurityPolicy.allowprivileged }}" ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicyBinding -metadata: - name: {{ include "k8s-shield.fullname" . }}-pod-security -spec: - policyName: {{ include "k8s-shield.fullname" . }}-pod-security - validationActions: - {{- range .Values.policyDefinitions.podSecurityPolicy.validationActions }} - - {{ . }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-admin-cluster-role-creation-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-admin-cluster-role-creation-policy.yaml deleted file mode 100644 index 1bd680549..000000000 --- a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-admin-cluster-role-creation-policy.yaml +++ /dev/null @@ -1,58 +0,0 @@ -{{- if and $.Values.defaultPolicies.create $.Values.defaultPolicies.policies.adminClusterRoleCreation }} -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicy -metadata: - name: {{ include "k8s-shield.fullname" . }}-restrict-admin-cluster-role-creation -spec: - failurePolicy: Fail - matchConstraints: - matchPolicy: Equivalent - namespaceSelector: {} - objectSelector: {} - resourceRules: - - apiGroups: - - rbac.authorization.k8s.io - apiVersions: - - "*" - operations: - - CREATE - - UPDATE - resources: - - clusterroles - scope: '*' - validations: - {{- if and .Values.excludeLabel.key .Values.excludeLabel.value }} - - expression: "(has(object.metadata.labels) && object.metadata.labels.exists(l, l == '{{ .Values.excludeLabel.key }}') && object.metadata.labels['{{ .Values.excludeLabel.key }}'] == '{{ .Values.excludeLabel.value }}') || !has(object.rules) || object.rules.all(rule, - !(rule.apiGroups.exists(g, g == '*') && - rule.resources.exists(r, r == '*') && - rule.verbs.exists(v, v == '*')) && - !(rule.nonResourceURLs.exists(u, u == '*') && - rule.verbs.exists(v, v == '*')) - )" - message: "Creation of ClusterRole with admin access is denied, set label {{ .Values.excludeLabel.key }}: {{ .Values.excludeLabel.value }} to allow." - {{- else }} - - expression: "!has(object.rules) || object.rules.all(rule, - !(rule.apiGroups.exists(g, g == '*') && - rule.resources.exists(r, r == '*') && - rule.verbs.exists(v, v == '*')) && - !(rule.nonResourceURLs.exists(u, u == '*') && - rule.verbs.exists(v, v == '*'))" - message: "Creation of ClusterRole with admin access is denied" - {{- end }} - ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicyBinding -metadata: - name: {{ include "k8s-shield.fullname" . }}-restrict-admin-cluster-role-creation -spec: - matchResources: - matchPolicy: Equivalent - namespaceSelector: {} - objectSelector: {} - policyName: {{ include "k8s-shield.fullname" . }}-deny-admin-cluster-role-creation - validationActions: - {{- range .Values.policyDefinitions.adminClusterRoleCreation.validationActions }} - - {{ . }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-application-deletion-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-application-deletion-policy.yaml deleted file mode 100644 index b67bd4da9..000000000 --- a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-application-deletion-policy.yaml +++ /dev/null @@ -1,51 +0,0 @@ -{{- if and $.Values.defaultPolicies.create $.Values.defaultPolicies.policies.appDeletionPolicy }} -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicy -metadata: - name: {{ include "k8s-shield.fullname" . }}-prevent-app-deletion -spec: - failurePolicy: Fail - {{- if and .Values.policyDefinitions.appDeletionPolicy.namespaces }} - matchConstraints: - matchPolicy: Equivalent - namespaceSelector: - matchExpressions: - - key: kubernetes.io/metadata.name - operator: In - values: - {{- range .Values.policyDefinitions.appDeletionPolicy.namespaces }} - - {{ . | quote }} - {{- end }} - {{- else }} - matchConstraints: {} - {{- end }} - objectSelector: {} - resourceRules: - - apiGroups: - - argoproj.io - apiVersions: - - v1alpha1 - operations: - - DELETE - resources: - - applications - scope: Namespaced - validations: - - expression: "false" - message: Deletion of application is not allowed. ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicyBinding -metadata: - name: {{ include "k8s-shield.fullname" . }}-prevent-app-deletion -spec: - matchResources: - matchPolicy: Equivalent - namespaceSelector: {} - objectSelector: {} - policyName: {{ include "k8s-shield.fullname" . }}-prevent-app-deletion - validationActions: - {{- range .Values.policyDefinitions.appDeletionPolicy.validationActions }} - - {{ . }} - {{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-cluster-rolebinding-with-cluster-admin-creation-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-cluster-rolebinding-with-cluster-admin-creation-policy.yaml deleted file mode 100644 index fd56fdb69..000000000 --- a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-cluster-rolebinding-with-cluster-admin-creation-policy.yaml +++ /dev/null @@ -1,42 +0,0 @@ -{{- if and $.Values.defaultPolicies.create $.Values.defaultPolicies.policies.cLusterRoleBindingCreation }} -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicy -metadata: - name: {{ include "k8s-shield.fullname" . }}-restrict-cluster-role-binding-creation -spec: - failurePolicy: Fail - matchConstraints: - matchPolicy: Equivalent - namespaceSelector: {} - objectSelector: {} - resourceRules: - - apiGroups: - - rbac.authorization.k8s.io - apiVersions: - - "*" - operations: - - CREATE - - UPDATE - resources: - - clusterrolebindings - scope: '*' - validations: - {{- if and .Values.excludeLabel.key .Values.excludeLabel.value }} - - expression: "(has(object.metadata.labels) && object.metadata.labels.exists(l, l == '{{ .Values.excludeLabel.key }}') && object.metadata.labels['{{ .Values.excludeLabel.key }}'] == '{{ .Values.excludeLabel.value }}') || !(object.roleRef.apiGroup == 'rbac.authorization.k8s.io' && object.roleRef.kind == 'ClusterRole' && object.roleRef.name == 'cluster-admin')" - message: "Binding to the cluster-admin ClusterRole is excludeed by security policy, set label {{ .Values.excludeLabel.key }}: {{ .Values.excludeLabel.value }} allow" - {{- else }} - - expression: "!(object.roleRef.apiGroup == 'rbac.authorization.k8s.io' && object.roleRef.kind == 'ClusterRole' && object.roleRef.name == 'cluster-admin')" - message: "Binding to the cluster-admin ClusterRole is not allowed" - {{- end }} ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicyBinding -metadata: - name: {{ include "k8s-shield.fullname" . }}-restrict-cluster-role-binding-creation -spec: - policyName: {{ include "k8s-shield.fullname" . }}-restrict-cluster-role-binding-creation - validationActions: - {{- range .Values.policyDefinitions.cLusterRoleBindingCreation.validationActions }} - - {{ . }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-limit-resource-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-limit-resource-policy.yaml deleted file mode 100644 index 1346d32a8..000000000 --- a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-limit-resource-policy.yaml +++ /dev/null @@ -1,97 +0,0 @@ -{{- if and $.Values.defaultPolicies.create $.Values.defaultPolicies.policies.limitResourcePolicy }} -{{- $maxCPU := .Values.policyDefinitions.resourcePolicies.limitResourcePolicy.maxCPULimit | default "1000m" }} -{{- $maxMemory := .Values.policyDefinitions.resourcePolicies.limitResourcePolicy.maxMemoryLimit | default "2Gi" }} -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicy -metadata: - name: {{ include "k8s-shield.fullname" . }}-restrict-resource-limits -spec: - failurePolicy: Fail - {{- if and .Values.policyDefinitions.resourcePolicies.limitResourcePolicy.namespaces }} - matchConstraints: - matchPolicy: Equivalent - namespaceSelector: - matchExpressions: - - key: kubernetes.io/metadata.name - operator: In - values: - {{- range .Values.policyDefinitions.resourcePolicies.limitResourcePolicy.namespaces }} - - {{ . | quote }} - {{- end }} - {{- else }} - matchConstraints: {} - {{- end }} - objectSelector: {} - resourceRules: - - apiGroups: - {{- range $.Values.policyDefinitions.resourcePolicies.limitResourcePolicy.apiGroups }} - - {{ . | quote }} - {{- end }} - apiVersions: - - v1 - operations: - {{- range .Values.policyDefinitions.resourcePolicies.limitResourcePolicy.operations }} - - {{ . | quote }} - {{- end }} - resources: - {{- range .Values.policyDefinitions.resourcePolicies.limitResourcePolicy.resources }} - - {{ . | quote }} - {{- end }} - scope: Namespaced - validations: - {{- if and .Values.excludeLabel.key .Values.excludeLabel.value }} - - expression: |- - (has(object.metadata.labels) && object.metadata.labels['{{ .Values.excludeLabel.key }}'] == '{{ .Values.excludeLabel.value }}') - || ( - has(object.spec.template) ? - ( - !has(object.spec.template.spec.containers[0].resources.limits) || ( - (!has(object.spec.template.spec.containers[0].resources.limits.cpu) || - quantity(object.spec.template.spec.containers[0].resources.limits.cpu).compareTo(quantity('{{ $maxCPU }}')) <= 0) && - (!has(object.spec.template.spec.containers[0].resources.limits.memory) || - quantity(object.spec.template.spec.containers[0].resources.limits.memory).compareTo(quantity('{{ $maxMemory }}')) <= 0) - ) - ) : - ( - !has(object.spec.containers[0].resources.limits) || ( - (!has(object.spec.containers[0].resources.limits.cpu) || - quantity(object.spec.containers[0].resources.limits.cpu).compareTo(quantity('{{ $maxCPU }}')) <= 0) && - (!has(object.spec.containers[0].resources.limits.memory) || - quantity(object.spec.containers[0].resources.limits.memory).compareTo(quantity('{{ $maxMemory }}')) <= 0) - ) - ) - ) - message: "Resource limits exceed the maximum allowed: CPU <= {{ $maxCPU }} and memory <= {{ $maxMemory }}, set label {{ .Values.excludeLabel.key }}: {{ .Values.excludeLabel.value }} to allow" - {{- else }} - - expression: |- - has(object.spec.template) ? - ( - !has(object.spec.template.spec.containers[0].resources.limits) || ( - (!has(object.spec.template.spec.containers[0].resources.limits.cpu) || - quantity(object.spec.template.spec.containers[0].resources.limits.cpu).compareTo(quantity('{{ $maxCPU }}')) <= 0) && - (!has(object.spec.template.spec.containers[0].resources.limits.memory) || - quantity(object.spec.template.spec.containers[0].resources.limits.memory).compareTo(quantity('{{ $maxMemory }}')) <= 0) - ) - ) : - ( - !has(object.spec.containers[0].resources.limits) || ( - (!has(object.spec.containers[0].resources.limits.cpu) || - quantity(object.spec.containers[0].resources.limits.cpu).compareTo(quantity('{{ $maxCPU }}')) <= 0) && - (!has(object.spec.containers[0].resources.limits.memory) || - quantity(object.spec.containers[0].resources.limits.memory).compareTo(quantity('{{ $maxMemory }}')) <= 0) - ) - ) - message: "Resource limits exceed the maximum allowed: CPU <= {{ $maxCPU }} and memory <= {{ $maxMemory }}." - {{- end }} ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicyBinding -metadata: - name: {{ include "k8s-shield.fullname" . }}-restrict-resource-limits -spec: - policyName: {{ include "k8s-shield.fullname" . }}-restrict-resource-limits - validationActions: - {{- range .Values.policyDefinitions.resourcePolicies.limitResourcePolicy.validationActions }} - - {{ . }} - {{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-loadbalance-creation-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-loadbalance-creation-policy.yaml deleted file mode 100644 index 6c415cfbb..000000000 --- a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-loadbalance-creation-policy.yaml +++ /dev/null @@ -1,56 +0,0 @@ -{{- if and $.Values.defaultPolicies.create $.Values.defaultPolicies.policies.loadBalancerCreationPolicy }} -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicy -metadata: - name: {{ include "k8s-shield.fullname" . }}-restrict-loadbalancer-creation -spec: - failurePolicy: Fail - {{- if and .Values.policyDefinitions.loadBalancerCreationPolicy.namespaces }} - matchConstraints: - matchPolicy: Equivalent - namespaceSelector: - matchExpressions: - - key: kubernetes.io/metadata.name - operator: In - values: - {{- range .Values.policyDefinitions.loadBalancerCreationPolicy.namespaces }} - - {{ . | quote }} - {{- end }} - {{- else }} - matchConstraints: {} - {{- end }} - objectSelector: {} - resourceRules: - - apiGroups: - - "" - apiVersions: - - v1 - operations: - - CREATE - resources: - - services - scope: Namespaced - validations: - {{- if and .Values.excludeLabel.key .Values.excludeLabel.value }} - - expression: "object.spec.type == 'LoadBalancer' && has(object.metadata.labels) && object.metadata.labels['{{ .Values.excludeLabel.key }}'] == '{{ .Values.excludeLabel.value }}'" - message: "Creation of Services with type LoadBalancer is not allowed, set label {{ .Values.excludeLabel.key }}: {{ .Values.excludeLabel.value }} to allow." - {{- else }} - - expression: "object.spec.type == 'LoadBalancer'" - message: "Creation of Services with type LoadBalancer is not allowed." - {{- end }} ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicyBinding -metadata: - name: {{ include "k8s-shield.fullname" . }}-restrict-loadbalancer-creation -spec: - matchResources: - matchPolicy: Equivalent - namespaceSelector: {} - objectSelector: {} - policyName: {{ include "k8s-shield.fullname" . }}-restrict-loadbalancer-creation - validationActions: - {{- range .Values.policyDefinitions.loadBalancerCreationPolicy.validationActions }} - - {{ . }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-namespace-deletion-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-namespace-deletion-policy.yaml deleted file mode 100644 index f2175c8a2..000000000 --- a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-namespace-deletion-policy.yaml +++ /dev/null @@ -1,44 +0,0 @@ -{{- if and $.Values.defaultPolicies.create $.Values.defaultPolicies.policies.namespaceDeletionPolicy }} -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicy -metadata: - name: {{ include "k8s-shield.fullname" . }}-restrict-namespace-deletion -spec: - failurePolicy: Fail - matchConstraints: - matchPolicy: Equivalent - namespaceSelector: {} - objectSelector: {} - resourceRules: - - apiGroups: - - "" - apiVersions: - - v1 - operations: - - DELETE - resourceNames: - {{- range $.Values.policyDefinitions.namespaceDeletionPolicy.namespaces }} - - {{ . }} - {{- end }} - resources: - - namespaces - scope: "*" - validations: - - expression: "false" - message: Deletion of namespace is not allowed. ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicyBinding -metadata: - name: {{ include "k8s-shield.fullname" . }}-restrict-namespace-deletion -spec: - matchResources: - matchPolicy: Equivalent - namespaceSelector: {} - objectSelector: {} - policyName: {{ include "k8s-shield.fullname" . }}-restrict-namespace-deletion - validationActions: - {{- range .Values.policyDefinitions.namespaceDeletionPolicy.validationActions }} - - {{ . }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-pvc-creation-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-pvc-creation-policy.yaml deleted file mode 100644 index ab2b6b6b9..000000000 --- a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-pvc-creation-policy.yaml +++ /dev/null @@ -1,52 +0,0 @@ -{{- if and $.Values.defaultPolicies.create $.Values.defaultPolicies.policies.pvcCreationPolicy }} -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicy -metadata: - name: {{ include "k8s-shield.fullname" . }}-restrict-pvc-creation -spec: - failurePolicy: Fail - {{- if and .Values.policyDefinitions.pvcCreationPolicy.namespaces }} - matchConstraints: - matchPolicy: Equivalent - namespaceSelector: - matchExpressions: - - key: kubernetes.io/metadata.name - operator: In - values: - {{- range .Values.policyDefinitions.pvcCreationPolicy.namespaces }} - - {{ . | quote }} - {{- end }} - {{- else }} - matchConstraints: {} - {{- end }} - objectSelector: {} - resourceRules: - - apiGroups: [""] - apiVersions: ["v1"] - operations: ["CREATE", "UPDATE"] - scope: Namespaced - resources: ["persistentvolumeclaims"] - validations: - {{- if and .Values.excludeLabel.key .Values.excludeLabel.value }} - - expression: "has(object.metadata.labels) && object.metadata.labels['{{ .Values.excludeLabel.key }}'] == '{{ .Values.excludeLabel.value }}'" - message: "Creation of PersistentVolumeClaims is not allowed, set label {{ .Values.excludeLabel.key }}: {{ .Values.excludeLabel.value }} to allow" - {{- else }} - - expression: "false" - message: "Creation of PersistentVolumeClaims is not allowed." - {{- end }} ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicyBinding -metadata: - name: {{ include "k8s-shield.fullname" . }}-restrict-pvc-creation -spec: - matchResources: - matchPolicy: Equivalent - namespaceSelector: {} - objectSelector: {} - policyName: {{ include "k8s-shield.fullname" . }}-restrict-pvc-creation - validationActions: - {{- range .Values.policyDefinitions.pvcCreationPolicy.validationActions }} - - {{ . }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-without-readiness-liveness-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-without-readiness-liveness-policy.yaml deleted file mode 100644 index b95a770c3..000000000 --- a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-without-readiness-liveness-policy.yaml +++ /dev/null @@ -1,64 +0,0 @@ -{{- if and $.Values.defaultPolicies.create $.Values.defaultPolicies.policies.readinessAndLivenessPolicy }} -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicy -metadata: - name: {{ .Chart.Name }}-restrict-without-readiness-liveness -spec: - failurePolicy: Fail - {{- if and .Values.policyDefinitions.readinessAndLivenessPolicy.namespaces }} - matchConstraints: - matchPolicy: Equivalent - namespaceSelector: - matchExpressions: - - key: kubernetes.io/metadata.name - operator: In - values: - {{- range $.Values.policyDefinitions.readinessAndLivenessPolicy.namespaces }} - - {{ . | quote }} - {{- end }} - {{- else }} - matchConstraints: {} - {{- end }} - objectSelector: {} - resourceRules: - - apiGroups: - {{- range $.Values.policyDefinitions.readinessAndLivenessPolicy.apiGroups }} - - {{ . | quote }} - {{- end }} - apiVersions: ["v1"] - operations: - {{- range $.Values.policyDefinitions.readinessAndLivenessPolicy.operations }} - - {{ . | quote }} - {{- end }} - resources: - {{- range $.Values.policyDefinitions.readinessAndLivenessPolicy.resources }} - - {{ . | quote }} - {{- end }} - scope: Namespaced - validations: - {{- if and .Values.excludeLabel.key .Values.excludeLabel.value }} - - expression: > - (has(object.metadata.labels) && - object.metadata.labels['{{ .Values.excludeLabel.key }}'] == '{{ .Values.excludeLabel.value }}') || - object.spec.template.spec.containers.all(container, - has(container.readinessProbe) && - has(container.livenessProbe) - ) - message: "Deployments without readiness and liveness probes are only allowed for '{{ .Values.excludeLabel.key }}: {{ .Values.excludeLabel.value }}'." - {{- else }} - - expression: object.spec.template.spec.containers.all(container, - has(container.readinessProbe) && has(container.livenessProbe)) - message: "Deployments without readiness and liveness probes are not allowed" - {{- end }} ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicyBinding -metadata: - name: {{ .Chart.Name }}-restrict-without-readiness-liveness -spec: - policyName: {{ .Chart.Name }}-restrict-without-readiness-liveness - validationActions: - {{- range $.Values.policyDefinitions.readinessAndLivenessPolicy.validationActions }} - - {{ . }} - {{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-without-resource-policy.yaml b/charts/devtron-utilities/charts/k8s-shield/templates/restrict-without-resource-policy.yaml deleted file mode 100644 index e160d9396..000000000 --- a/charts/devtron-utilities/charts/k8s-shield/templates/restrict-without-resource-policy.yaml +++ /dev/null @@ -1,60 +0,0 @@ -{{- if and $.Values.defaultPolicies.create $.Values.defaultPolicies.policies.WithoutResource }} -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicy -metadata: - name: {{ include "k8s-shield.fullname" . }}-restrict-without-resources -spec: - failurePolicy: Fail - {{- if and .Values.policyDefinitions.resourcePolicies.WithoutResource.namespaces }} - matchConstraints: - matchPolicy: Equivalent - namespaceSelector: - matchExpressions: - - key: kubernetes.io/metadata.name - operator: In - values: - {{- range $.Values.policyDefinitions.resourcePolicies.WithoutResource.namespaces }} - - {{ . | quote }} - {{- end }} - {{- else }} - matchConstraints: {} - {{- end }} - resourceRules: - - apiGroups: - {{- range $.Values.policyDefinitions.resourcePolicies.WithoutResource.apiGroups }} - - {{ . | quote }} - {{- end }} - apiVersions: - - v1 - operations: - {{- range $.Values.policyDefinitions.resourcePolicies.WithoutResource.operations }} - - {{ . | quote }} - {{- end }} - resources: - {{- range $.Values.policyDefinitions.resourcePolicies.WithoutResource.resources }} - - {{ . | quote }} - {{- end }} - scope: Namespaced - validations: - {{- if and .Values.excludeLabel.key .Values.excludeLabel.value }} - - expression: "(has(object.metadata.labels) && object.metadata.labels['{{ .Values.excludeLabel.key }}'] == '{{ .Values.excludeLabel.value }}') || object.spec.template.spec.containers.all(c, has(c.resources) && has(c.resources.requests) && has(c.resources.limits) && has(c.resources.requests.cpu) && has(c.resources.requests.memory) && has(c.resources.limits.cpu) && has(c.resources.limits.memory))" - message: "All Containers without CPU and memory's requests and limits are only allowed for '{{ .Values.excludeLabel.key }}: {{ .Values.excludeLabel.value }}'." - {{- else }} -cd message: "All Containers without CPU and memory's requests and limits are not allowed." - {{- end }} ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicyBinding -metadata: - name: {{ include "k8s-shield.fullname" . }}-restrict-without-resources -spec: - matchResources: - matchPolicy: Equivalent - namespaceSelector: {} - objectSelector: {} - policyName: {{ include "k8s-shield.fullname" . }}-restrict-without-resources - validationActions: - {{- range $.Values.policyDefinitions.resourcePolicies.WithoutResource.validationActions }} - - {{ . }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/k8s-shield/values.yaml b/charts/devtron-utilities/charts/k8s-shield/values.yaml deleted file mode 100644 index d9879ec87..000000000 --- a/charts/devtron-utilities/charts/k8s-shield/values.yaml +++ /dev/null @@ -1,164 +0,0 @@ -#excludeLabel Resources will be excluded from the scope of the policy if these labels are present. -excludeLabel: - key: "" - value: "" - -defaultPolicies: - create: true - policies: - pvcCreationPolicy: true - namespaceDeletionPolicy: true - loadBalancerCreationPolicy: true - appDeletionPolicy: true - WithoutResource: true - limitResourcePolicy: true - adminClusterRoleCreation: true - cLusterRoleBindingCreation: true - readinessAndLivenessPolicy: true - podSecurityPolicy: true - containerSecurityPolicy: true - - -policyDefinitions: - # pvcCreationPolicy controls the creation of Persistent Volume Claims (PVCs). - # If enabled, it restricts PVC creation in specified namespaces. - pvcCreationPolicy: - namespaces: [] # List of namespaces where the policy applies. - validationActions: - - Deny - - # namespaceDeletionPolicy restricts the deletion of namespaces. - # When enabled, it prevents deletion of namespaces in specified namespaces. - namespaceDeletionPolicy: - namespaces: # List of namespaces that you want to protect from deletion - - kube-system - validationActions: - - Deny - - # loadBalancerCreationPolicy restricts the creation of LoadBalancer type services. - # This policy prevents creating LoadBalancer services in the specified namespaces. - loadBalancerCreationPolicy: - namespaces: [] # List of namespaces where the policy applies. - validationActions: - - Deny - - # appDeletionPolicy prevents the deletion of applications within specified namespaces. - # If enabled, applications cannot be deleted in the listed namespaces. - appDeletionPolicy: - namespaces: [] # List of namespaces where the policy applies. - validationActions: - - Deny - - # resourcePolicies enforce the specification of resource requests and limits for deployments, statefulsets, etc. - resourcePolicies: - WithoutResource: - namespaces: [] # List of namespaces where the policy applies. - validationActions: - - Deny - operations: - - CREATE - - UPDATE - resources: - - pods - - deployments - - statefulsets - - rollouts - apiGroups: - - apps - - rollout.k8s.io - - limitResourcePolicy: - apiGroups: # API groups where the policy applies. - - "" - - apps - - argoproj.io - namespaces: [] # List of namespaces where the policy applies. - operations: - - CREATE - - UPDATE - resources: - - pods - - deployments - - statefulsets - - rollouts - maxCPULimit: "1000m" # Maximum CPU limit if not specified. Default is 1000m. - maxMemoryLimit: "2Gi" # Maximum memory limit if not specified. Default is 2Gi. - validationActions: - - Deny - - # adminClusterRoleCreation prevents the creation of new roles and cluster roles with admin access in the cluster. - adminClusterRoleCreation: - validationActions: - - Deny - - # cLusterRoleBindingCreation prevents the creation of clusterRoleBindings with cluster-admin access. - cLusterRoleBindingCreation: - validationActions: # Defines the actions when the policy is violated. Default is DENY. - - Deny - - # readinessAndLivenessPolicy ensures that readiness and liveness probes are defined for containers. - # This ensures that pods are only considered healthy when they pass the defined probes. - readinessAndLivenessPolicy: - namespaces: [] # List of namespaces where the policy applies. - operations: - - CREATE - - UPDATE - resources: - - deployments - - statefulsets - - rollouts - apiGroups: - - apps - - argoproj.io - validationActions: - - Deny - - # podSecurityPolicy ensures that security-related best practices are followed for Pods. - # For example, it restricts the use of privileged containers and ensures read-only file systems. - podSecurityPolicy: - allowrunAsNonRoot: false # Prevent containers from running as root. - allowreadOnlyRootFilesystem: false # Ensure the root filesystem is not writable. - allowPrivilegeEscalation: false # Prevent processes from gaining more privileges than their parent. - allowprivileged: false # Disables privileged mode for containers. - validationActions: # Defines the actions when the policy is violated. Default is DENY. - - Deny - operations: - - CREATE - - UPDATE - resources: - - pods - - deployments - - statefulsets - - rollouts - - cronjobs - apiGroups: - - "" - - apps - - batch - - rollout.k8s.io - - # containerSecurityPolicy defines security best practices for containers within Pods. - # It ensures that containers adhere to security policies for non-root execution, file system access, and privilege escalation. - containerSecurityPolicy: - allowrunAsNonRoot: false # Prevent containers from running as root. - allowreadOnlyRootFilesystem: false # Ensure the root filesystem is not writable. - allowPrivilegeEscalation: false # Prevent processes from gaining more privileges than their parent. - allowprivileged: false # Disable privileged mode to limit container capabilities on the host. - validationActions: # Defines the actions when the policy is violated. Default is DENY. - - Deny - operations: - - CREATE - - UPDATE - resources: - - pods - - deployments - - statefulsets - - rollouts - - cronjobs - apiGroups: - - "" - - apps - - batch - - rollout.k8s.io - -extraValidatingPolicy: [] \ No newline at end of file diff --git a/charts/devtron-utilities/charts/karpenter/.helmignore b/charts/devtron-utilities/charts/karpenter/.helmignore deleted file mode 100644 index 0e8a0eb36..000000000 --- a/charts/devtron-utilities/charts/karpenter/.helmignore +++ /dev/null @@ -1,23 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*.orig -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/charts/devtron-utilities/charts/karpenter/Chart.lock b/charts/devtron-utilities/charts/karpenter/Chart.lock deleted file mode 100644 index 6454ce923..000000000 --- a/charts/devtron-utilities/charts/karpenter/Chart.lock +++ /dev/null @@ -1,3 +0,0 @@ -dependencies: [] -digest: sha256:5595919ac269b4105dd65d20eb27cb271b8976c1d10903e0b504d349df30f017 -generated: "2020-12-02T11:48:25.741819-08:00" diff --git a/charts/devtron-utilities/charts/karpenter/Chart.yaml b/charts/devtron-utilities/charts/karpenter/Chart.yaml deleted file mode 100644 index c6e8dcabe..000000000 --- a/charts/devtron-utilities/charts/karpenter/Chart.yaml +++ /dev/null @@ -1,35 +0,0 @@ -annotations: - artifacthub.io/alternativeName: karpenter-provider-aws - artifacthub.io/crds: | - - kind: EC2NodeClass - version: v1beta1 - name: ec2nodeclasses.karpenter.k8s.aws - displayName: EC2NodeClass - description: EC2NodeClass is the Schema for the EC2NodeClass API. - - kind: NodeClaim - version: v1beta1 - name: nodeclaims.karpenter.sh - displayName: NodeClaim - description: NodeClaim is the Schema for the NodeClaims API. - - kind: NodePool - version: v1beta1 - name: nodepools.karpenter.sh - displayName: NodePool - description: NodePool is the Schema for the NodePools API. -apiVersion: v2 -appVersion: 1.2.1 -description: A Helm chart for Karpenter, an open-source node provisioning project - built for Kubernetes. -home: https://karpenter.sh/ -icon: https://repository-images.githubusercontent.com/278480393/dab059c8-caa1-4b55-aaa7-3d30e47a5616 -keywords: -- cluster -- node -- scheduler -- autoscaling -- lifecycle -name: karpenter -sources: -- https://github.com/aws/karpenter-provider-aws/ -type: application -version: 1.2.1 diff --git a/charts/devtron-utilities/charts/karpenter/README.md b/charts/devtron-utilities/charts/karpenter/README.md deleted file mode 100644 index 8bfb1ca95..000000000 --- a/charts/devtron-utilities/charts/karpenter/README.md +++ /dev/null @@ -1,108 +0,0 @@ -# karpenter - -A Helm chart for Karpenter, an open-source node provisioning project built for Kubernetes. - -![Version: 1.1.2](https://img.shields.io/badge/Version-1.1.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.1.2](https://img.shields.io/badge/AppVersion-1.1.2-informational?style=flat-square) - -## Documentation - -For full Karpenter documentation please checkout [https://karpenter.sh](https://karpenter.sh/docs/). - -## Installing the Chart - -You can follow the detailed installation instruction in the [documentation](https://karpenter.sh/docs/getting-started/getting-started-with-karpenter) which covers the Karpenter prerequisites and installation options. The outcome of these instructions should result in something like the following command. - -```bash -helm upgrade --install --namespace karpenter --create-namespace \ - karpenter oci://public.ecr.aws/karpenter/karpenter \ - --version 1.1.2 \ - --set "serviceAccount.annotations.eks\.amazonaws\.com/role-arn=${KARPENTER_IAM_ROLE_ARN}" \ - --set settings.clusterName=${CLUSTER_NAME} \ - --set settings.interruptionQueue=${CLUSTER_NAME} \ - --wait -``` - -### Verification - -As the OCI Helm chart is signed by [Cosign](https://github.com/sigstore/cosign) as part of the release process you can verify the chart before installing it by running the following command. - -```shell -cosign verify public.ecr.aws/karpenter/karpenter:1.1.2 \ - --certificate-oidc-issuer=https://token.actions.githubusercontent.com \ - --certificate-identity-regexp='https://github\.com/aws/karpenter-provider-aws/\.github/workflows/release\.yaml@.+' \ - --certificate-github-workflow-repository=aws/karpenter-provider-aws \ - --certificate-github-workflow-name=Release \ - --certificate-github-workflow-ref=refs/tags/v1.1.2 \ - --annotations version=1.1.2 -``` - -## Values - -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| additionalAnnotations | object | `{}` | Additional annotations to add into metadata. | -| additionalClusterRoleRules | list | `[]` | Specifies additional rules for the core ClusterRole. | -| additionalLabels | object | `{}` | Additional labels to add into metadata. | -| affinity | object | `{"nodeAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":{"nodeSelectorTerms":[{"matchExpressions":[{"key":"karpenter.sh/nodepool","operator":"DoesNotExist"}]}]}},"podAntiAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"topologyKey":"kubernetes.io/hostname"}]}}` | Affinity rules for scheduling the pod. If an explicit label selector is not provided for pod affinity or pod anti-affinity one will be created from the pod selector labels. | -| controller.containerName | string | `"controller"` | Distinguishing container name (containerName: karpenter-controller). | -| controller.env | list | `[]` | Additional environment variables for the controller pod. | -| controller.envFrom | list | `[]` | | -| controller.extraVolumeMounts | list | `[]` | Additional volumeMounts for the controller pod. | -| controller.healthProbe.port | int | `8081` | The container port to use for http health probe. | -| controller.image.digest | string | `"sha256:fe383abf1dbc79f164d1cbcfd8edaaf7ce97a43fbd6cb70176011ff99ce57523"` | SHA256 digest of the controller image. | -| controller.image.repository | string | `"public.ecr.aws/karpenter/controller"` | Repository path to the controller image. | -| controller.image.tag | string | `"1.1.2"` | Tag of the controller image. | -| controller.metrics.port | int | `8080` | The container port to use for metrics. | -| controller.resources | object | `{}` | Resources for the controller pod. | -| controller.sidecarContainer | list | `[]` | Additional sidecarContainer config | -| controller.sidecarVolumeMounts | list | `[]` | Additional volumeMounts for the sidecar - this will be added to the volume mounts on top of extraVolumeMounts | -| dnsConfig | object | `{}` | Configure DNS Config for the pod | -| dnsPolicy | string | `"ClusterFirst"` | Configure the DNS Policy for the pod | -| extraVolumes | list | `[]` | Additional volumes for the pod. | -| fullnameOverride | string | `""` | Overrides the chart's computed fullname. | -| hostNetwork | bool | `false` | Bind the pod to the host network. This is required when using a custom CNI. | -| imagePullPolicy | string | `"IfNotPresent"` | Image pull policy for Docker images. | -| imagePullSecrets | list | `[]` | Image pull secrets for Docker images. | -| logErrorOutputPaths | list | `["stderr"]` | Log errorOutputPaths - defaults to stderr only | -| logLevel | string | `"info"` | Global log level, defaults to 'info' | -| logOutputPaths | list | `["stdout"]` | Log outputPaths - defaults to stdout only | -| nameOverride | string | `""` | Overrides the chart's name. | -| nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node selectors to schedule the pod to nodes with labels. | -| podAnnotations | object | `{}` | Additional annotations for the pod. | -| podDisruptionBudget.maxUnavailable | int | `1` | | -| podDisruptionBudget.name | string | `"karpenter"` | | -| podLabels | object | `{}` | Additional labels for the pod. | -| podSecurityContext | object | `{"fsGroup":65532}` | SecurityContext for the pod. | -| priorityClassName | string | `"system-cluster-critical"` | PriorityClass name for the pod. | -| replicas | int | `2` | Number of replicas. | -| revisionHistoryLimit | int | `10` | The number of old ReplicaSets to retain to allow rollback. | -| schedulerName | string | `"default-scheduler"` | Specify which Kubernetes scheduler should dispatch the pod. | -| service.annotations | object | `{}` | Additional annotations for the Service. | -| serviceAccount.annotations | object | `{}` | Additional annotations for the ServiceAccount. | -| serviceAccount.create | bool | `true` | Specifies if a ServiceAccount should be created. | -| serviceAccount.name | string | `""` | The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template. | -| serviceMonitor.additionalLabels | object | `{}` | Additional labels for the ServiceMonitor. | -| serviceMonitor.enabled | bool | `false` | Specifies whether a ServiceMonitor should be created. | -| serviceMonitor.endpointConfig | object | `{}` | Configuration on `http-metrics` endpoint for the ServiceMonitor. Not to be used to add additional endpoints. See the Prometheus operator documentation for configurable fields https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#endpoint | -| settings | object | `{"batchIdleDuration":"1s","batchMaxDuration":"10s","clusterCABundle":"","clusterEndpoint":"","clusterName":"","eksControlPlane":false,"featureGates":{"nodeRepair":false,"spotToSpotConsolidation":false},"interruptionQueue":"","isolatedVPC":false,"reservedENIs":"0","vmMemoryOverheadPercent":0.075}` | Global Settings to configure Karpenter | -| settings.batchIdleDuration | string | `"1s"` | The maximum amount of time with no new ending pods that if exceeded ends the current batching window. If pods arrive faster than this time, the batching window will be extended up to the maxDuration. If they arrive slower, the pods will be batched separately. | -| settings.batchMaxDuration | string | `"10s"` | The maximum length of a batch window. The longer this is, the more pods we can consider for provisioning at one time which usually results in fewer but larger nodes. | -| settings.clusterCABundle | string | `""` | Cluster CA bundle for TLS configuration of provisioned nodes. If not set, this is taken from the controller's TLS configuration for the API server. | -| settings.clusterEndpoint | string | `""` | Cluster endpoint. If not set, will be discovered during startup (EKS only) | -| settings.clusterName | string | `""` | Cluster name. | -| settings.eksControlPlane | bool | `false` | Marking this true means that your cluster is running with an EKS control plane and Karpenter should attempt to discover cluster details from the DescribeCluster API | -| settings.featureGates | object | `{"nodeRepair":false,"spotToSpotConsolidation":false}` | Feature Gate configuration values. Feature Gates will follow the same graduation process and requirements as feature gates in Kubernetes. More information here https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/#feature-gates-for-alpha-or-beta-features | -| settings.featureGates.nodeRepair | bool | `false` | nodeRepair is ALPHA and is disabled by default. Setting this to true will enable node repair. | -| settings.featureGates.spotToSpotConsolidation | bool | `false` | spotToSpotConsolidation is ALPHA and is disabled by default. Setting this to true will enable spot replacement consolidation for both single and multi-node consolidation. | -| settings.interruptionQueue | string | `""` | Interruption queue is the name of the SQS queue used for processing interruption events from EC2 Interruption handling is disabled if not specified. Enabling interruption handling may require additional permissions on the controller service account. Additional permissions are outlined in the docs. | -| settings.isolatedVPC | bool | `false` | If true then assume we can't reach AWS services which don't have a VPC endpoint This also has the effect of disabling look-ups to the AWS pricing endpoint | -| settings.reservedENIs | string | `"0"` | Reserved ENIs are not included in the calculations for max-pods or kube-reserved This is most often used in the VPC CNI custom networking setup https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html | -| settings.vmMemoryOverheadPercent | float | `0.075` | The VM memory overhead as a percent that will be subtracted from the total memory for all instance types. The value of `0.075` equals to 7.5%. | -| strategy | object | `{"rollingUpdate":{"maxUnavailable":1}}` | Strategy for updating the pod. | -| terminationGracePeriodSeconds | string | `nil` | Override the default termination grace period for the pod. | -| tolerations | list | `[{"key":"CriticalAddonsOnly","operator":"Exists"}]` | Tolerations to allow the pod to be scheduled to nodes with taints. | -| topologySpreadConstraints | list | `[{"maxSkew":1,"topologyKey":"topology.kubernetes.io/zone","whenUnsatisfiable":"DoNotSchedule"}]` | Topology spread constraints to increase the controller resilience by distributing pods across the cluster zones. If an explicit label selector is not provided one will be created from the pod selector labels. | - ----------------------------------------------- - -Autogenerated from chart metadata using [helm-docs](https://github.com/norwoodj/helm-docs/). diff --git a/charts/devtron-utilities/charts/karpenter/README.md.gotmpl b/charts/devtron-utilities/charts/karpenter/README.md.gotmpl deleted file mode 100644 index ee4c8d1e4..000000000 --- a/charts/devtron-utilities/charts/karpenter/README.md.gotmpl +++ /dev/null @@ -1,44 +0,0 @@ -{{ template "chart.header" . }} -{{ template "chart.description" . }} - -{{ template "chart.versionBadge" . }}{{ template "chart.typeBadge" . }}{{ template "chart.appVersionBadge" . }} - -## Documentation - -For full Karpenter documentation please checkout [https://karpenter.sh](https://karpenter.sh/docs/). - -## Installing the Chart - -You can follow the detailed installation instruction in the [documentation](https://karpenter.sh/docs/getting-started/getting-started-with-karpenter) which covers the Karpenter prerequisites and installation options. The outcome of these instructions should result in something like the following command. - -```bash -helm upgrade --install --namespace karpenter --create-namespace \ - karpenter oci://public.ecr.aws/karpenter/{{ template "chart.name" . }} \ - --version {{ template "chart.version" . }} \ - --set "serviceAccount.annotations.eks\.amazonaws\.com/role-arn=${KARPENTER_IAM_ROLE_ARN}" \ - --set settings.clusterName=${CLUSTER_NAME} \ - --set settings.interruptionQueue=${CLUSTER_NAME} \ - --wait -``` - -### Verification - -As the OCI Helm chart is signed by [Cosign](https://github.com/sigstore/cosign) as part of the release process you can verify the chart before installing it by running the following command. - -```shell -cosign verify public.ecr.aws/karpenter/karpenter:{{ template "chart.version" . }} \ - --certificate-oidc-issuer=https://token.actions.githubusercontent.com \ - --certificate-identity-regexp='https://github\.com/aws/karpenter-provider-aws/\.github/workflows/release\.yaml@.+' \ - --certificate-github-workflow-repository=aws/karpenter-provider-aws \ - --certificate-github-workflow-name=Release \ - --certificate-github-workflow-ref=refs/tags/v{{ template "chart.version" . }} \ - --annotations version={{ template "chart.version" . }} -``` - -{{ template "chart.requirementsSection" . }} - -{{ template "chart.valuesSection" . }} - ----------------------------------------------- - -Autogenerated from chart metadata using [helm-docs](https://github.com/norwoodj/helm-docs/). diff --git a/charts/devtron-utilities/charts/karpenter/artifacthub-repo.yaml b/charts/devtron-utilities/charts/karpenter/artifacthub-repo.yaml deleted file mode 100644 index 48d9ca7ce..000000000 --- a/charts/devtron-utilities/charts/karpenter/artifacthub-repo.yaml +++ /dev/null @@ -1,7 +0,0 @@ -repositoryID: 356cb63f-9ee3-4956-9c20-003e416715c7 -owners: [] -# - name: awsadmin1 -# email: artifacthub1@aws.com -ignore: - - name: karpenter - version: (?:^\d+$)|(?:^v?0\.0\.0)|(?:^v?\d+\-) diff --git a/charts/devtron-utilities/charts/karpenter/crds/karpenter.k8s.aws_ec2nodeclasses.yaml b/charts/devtron-utilities/charts/karpenter/crds/karpenter.k8s.aws_ec2nodeclasses.yaml deleted file mode 100644 index a2444bfcd..000000000 --- a/charts/devtron-utilities/charts/karpenter/crds/karpenter.k8s.aws_ec2nodeclasses.yaml +++ /dev/null @@ -1,742 +0,0 @@ ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.17.1 - name: ec2nodeclasses.karpenter.k8s.aws -spec: - group: karpenter.k8s.aws - names: - categories: - - karpenter - kind: EC2NodeClass - listKind: EC2NodeClassList - plural: ec2nodeclasses - shortNames: - - ec2nc - - ec2ncs - singular: ec2nodeclass - scope: Cluster - versions: - - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - jsonPath: .spec.role - name: Role - priority: 1 - type: string - name: v1 - schema: - openAPIV3Schema: - description: EC2NodeClass is the Schema for the EC2NodeClass API - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: |- - EC2NodeClassSpec is the top level specification for the AWS Karpenter Provider. - This will contain configuration necessary to launch instances in AWS. - properties: - amiFamily: - description: |- - AMIFamily dictates the UserData format and default BlockDeviceMappings used when generating launch templates. - This field is optional when using an alias amiSelectorTerm, and the value will be inferred from the alias' - family. When an alias is specified, this field may only be set to its corresponding family or 'Custom'. If no - alias is specified, this field is required. - NOTE: We ignore the AMIFamily for hashing here because we hash the AMIFamily dynamically by using the alias using - the AMIFamily() helper function - enum: - - AL2 - - AL2023 - - Bottlerocket - - Custom - - Windows2019 - - Windows2022 - type: string - amiSelectorTerms: - description: AMISelectorTerms is a list of or ami selector terms. The terms are ORed. - items: - description: |- - AMISelectorTerm defines selection logic for an ami used by Karpenter to launch nodes. - If multiple fields are used for selection, the requirements are ANDed. - properties: - alias: - description: |- - Alias specifies which EKS optimized AMI to select. - Each alias consists of a family and an AMI version, specified as "family@version". - Valid families include: al2, al2023, bottlerocket, windows2019, and windows2022. - The version can either be pinned to a specific AMI release, with that AMIs version format (ex: "al2023@v20240625" or "bottlerocket@v1.10.0"). - The version can also be set to "latest" for any family. Setting the version to latest will result in drift when a new AMI is released. This is **not** recommended for production environments. - Note: The Windows families do **not** support version pinning, and only latest may be used. - maxLength: 30 - type: string - x-kubernetes-validations: - - message: '''alias'' is improperly formatted, must match the format ''family@version''' - rule: self.matches('^[a-zA-Z0-9]+@.+$') - - message: 'family is not supported, must be one of the following: ''al2'', ''al2023'', ''bottlerocket'', ''windows2019'', ''windows2022''' - rule: self.split('@')[0] in ['al2','al2023','bottlerocket','windows2019','windows2022'] - - message: windows families may only specify version 'latest' - rule: 'self.split(''@'')[0] in [''windows2019'',''windows2022''] ? self.split(''@'')[1] == ''latest'' : true' - id: - description: ID is the ami id in EC2 - pattern: ami-[0-9a-z]+ - type: string - name: - description: |- - Name is the ami name in EC2. - This value is the name field, which is different from the name tag. - type: string - owner: - description: |- - Owner is the owner for the ami. - You can specify a combination of AWS account IDs, "self", "amazon", and "aws-marketplace" - type: string - tags: - additionalProperties: - type: string - description: |- - Tags is a map of key/value tags used to select amis. - Specifying '*' for a value selects all values for a given tag key. - maxProperties: 20 - type: object - x-kubernetes-validations: - - message: empty tag keys or values aren't supported - rule: self.all(k, k != '' && self[k] != '') - type: object - maxItems: 30 - minItems: 1 - type: array - x-kubernetes-validations: - - message: expected at least one, got none, ['tags', 'id', 'name', 'alias'] - rule: self.all(x, has(x.tags) || has(x.id) || has(x.name) || has(x.alias)) - - message: '''id'' is mutually exclusive, cannot be set with a combination of other fields in amiSelectorTerms' - rule: '!self.exists(x, has(x.id) && (has(x.alias) || has(x.tags) || has(x.name) || has(x.owner)))' - - message: '''alias'' is mutually exclusive, cannot be set with a combination of other fields in amiSelectorTerms' - rule: '!self.exists(x, has(x.alias) && (has(x.id) || has(x.tags) || has(x.name) || has(x.owner)))' - - message: '''alias'' is mutually exclusive, cannot be set with a combination of other amiSelectorTerms' - rule: '!(self.exists(x, has(x.alias)) && self.size() != 1)' - associatePublicIPAddress: - description: AssociatePublicIPAddress controls if public IP addresses are assigned to instances that are launched with the nodeclass. - type: boolean - blockDeviceMappings: - description: BlockDeviceMappings to be applied to provisioned nodes. - items: - properties: - deviceName: - description: The device name (for example, /dev/sdh or xvdh). - type: string - ebs: - description: EBS contains parameters used to automatically set up EBS volumes when an instance is launched. - properties: - deleteOnTermination: - description: DeleteOnTermination indicates whether the EBS volume is deleted on instance termination. - type: boolean - encrypted: - description: |- - Encrypted indicates whether the EBS volume is encrypted. Encrypted volumes can only - be attached to instances that support Amazon EBS encryption. If you are creating - a volume from a snapshot, you can't specify an encryption value. - type: boolean - iops: - description: |- - IOPS is the number of I/O operations per second (IOPS). For gp3, io1, and io2 volumes, - this represents the number of IOPS that are provisioned for the volume. For - gp2 volumes, this represents the baseline performance of the volume and the - rate at which the volume accumulates I/O credits for bursting. - - The following are the supported values for each volume type: - - * gp3: 3,000-16,000 IOPS - - * io1: 100-64,000 IOPS - - * io2: 100-64,000 IOPS - - For io1 and io2 volumes, we guarantee 64,000 IOPS only for Instances built - on the Nitro System (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html#ec2-nitro-instances). - Other instance families guarantee performance up to 32,000 IOPS. - - This parameter is supported for io1, io2, and gp3 volumes only. This parameter - is not supported for gp2, st1, sc1, or standard volumes. - format: int64 - type: integer - kmsKeyID: - description: KMSKeyID (ARN) of the symmetric Key Management Service (KMS) CMK used for encryption. - type: string - snapshotID: - description: SnapshotID is the ID of an EBS snapshot - type: string - throughput: - description: |- - Throughput to provision for a gp3 volume, with a maximum of 1,000 MiB/s. - Valid Range: Minimum value of 125. Maximum value of 1000. - format: int64 - type: integer - volumeSize: - description: |- - VolumeSize in `Gi`, `G`, `Ti`, or `T`. You must specify either a snapshot ID or - a volume size. The following are the supported volumes sizes for each volume - type: - - * gp2 and gp3: 1-16,384 - - * io1 and io2: 4-16,384 - - * st1 and sc1: 125-16,384 - - * standard: 1-1,024 - pattern: ^((?:[1-9][0-9]{0,3}|[1-4][0-9]{4}|[5][0-8][0-9]{3}|59000)Gi|(?:[1-9][0-9]{0,3}|[1-5][0-9]{4}|[6][0-3][0-9]{3}|64000)G|([1-9]||[1-5][0-7]|58)Ti|([1-9]||[1-5][0-9]|6[0-3]|64)T)$ - type: string - volumeType: - description: |- - VolumeType of the block device. - For more information, see Amazon EBS volume types (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html) - in the Amazon Elastic Compute Cloud User Guide. - enum: - - standard - - io1 - - io2 - - gp2 - - sc1 - - st1 - - gp3 - type: string - type: object - x-kubernetes-validations: - - message: snapshotID or volumeSize must be defined - rule: has(self.snapshotID) || has(self.volumeSize) - rootVolume: - description: |- - RootVolume is a flag indicating if this device is mounted as kubelet root dir. You can - configure at most one root volume in BlockDeviceMappings. - type: boolean - type: object - maxItems: 50 - type: array - x-kubernetes-validations: - - message: must have only one blockDeviceMappings with rootVolume - rule: self.filter(x, has(x.rootVolume)?x.rootVolume==true:false).size() <= 1 - context: - description: |- - Context is a Reserved field in EC2 APIs - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFleet.html - type: string - detailedMonitoring: - description: DetailedMonitoring controls if detailed monitoring is enabled for instances that are launched - type: boolean - instanceProfile: - description: |- - InstanceProfile is the AWS entity that instances use. - This field is mutually exclusive from role. - The instance profile should already have a role assigned to it that Karpenter - has PassRole permission on for instance launch using this instanceProfile to succeed. - type: string - x-kubernetes-validations: - - message: instanceProfile cannot be empty - rule: self != '' - instanceStorePolicy: - description: InstanceStorePolicy specifies how to handle instance-store disks. - enum: - - RAID0 - type: string - kubelet: - description: |- - Kubelet defines args to be used when configuring kubelet on provisioned nodes. - They are a subset of the upstream types, recognizing not all options may be supported. - Wherever possible, the types and names should reflect the upstream kubelet types. - properties: - clusterDNS: - description: |- - clusterDNS is a list of IP addresses for the cluster DNS server. - Note that not all providers may use all addresses. - items: - type: string - type: array - cpuCFSQuota: - description: CPUCFSQuota enables CPU CFS quota enforcement for containers that specify CPU limits. - type: boolean - evictionHard: - additionalProperties: - type: string - pattern: ^((\d{1,2}(\.\d{1,2})?|100(\.0{1,2})?)%||(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?)$ - description: EvictionHard is the map of signal names to quantities that define hard eviction thresholds - type: object - x-kubernetes-validations: - - message: valid keys for evictionHard are ['memory.available','nodefs.available','nodefs.inodesFree','imagefs.available','imagefs.inodesFree','pid.available'] - rule: self.all(x, x in ['memory.available','nodefs.available','nodefs.inodesFree','imagefs.available','imagefs.inodesFree','pid.available']) - evictionMaxPodGracePeriod: - description: |- - EvictionMaxPodGracePeriod is the maximum allowed grace period (in seconds) to use when terminating pods in - response to soft eviction thresholds being met. - format: int32 - type: integer - evictionSoft: - additionalProperties: - type: string - pattern: ^((\d{1,2}(\.\d{1,2})?|100(\.0{1,2})?)%||(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?)$ - description: EvictionSoft is the map of signal names to quantities that define soft eviction thresholds - type: object - x-kubernetes-validations: - - message: valid keys for evictionSoft are ['memory.available','nodefs.available','nodefs.inodesFree','imagefs.available','imagefs.inodesFree','pid.available'] - rule: self.all(x, x in ['memory.available','nodefs.available','nodefs.inodesFree','imagefs.available','imagefs.inodesFree','pid.available']) - evictionSoftGracePeriod: - additionalProperties: - type: string - description: EvictionSoftGracePeriod is the map of signal names to quantities that define grace periods for each eviction signal - type: object - x-kubernetes-validations: - - message: valid keys for evictionSoftGracePeriod are ['memory.available','nodefs.available','nodefs.inodesFree','imagefs.available','imagefs.inodesFree','pid.available'] - rule: self.all(x, x in ['memory.available','nodefs.available','nodefs.inodesFree','imagefs.available','imagefs.inodesFree','pid.available']) - imageGCHighThresholdPercent: - description: |- - ImageGCHighThresholdPercent is the percent of disk usage after which image - garbage collection is always run. The percent is calculated by dividing this - field value by 100, so this field must be between 0 and 100, inclusive. - When specified, the value must be greater than ImageGCLowThresholdPercent. - format: int32 - maximum: 100 - minimum: 0 - type: integer - imageGCLowThresholdPercent: - description: |- - ImageGCLowThresholdPercent is the percent of disk usage before which image - garbage collection is never run. Lowest disk usage to garbage collect to. - The percent is calculated by dividing this field value by 100, - so the field value must be between 0 and 100, inclusive. - When specified, the value must be less than imageGCHighThresholdPercent - format: int32 - maximum: 100 - minimum: 0 - type: integer - kubeReserved: - additionalProperties: - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - description: KubeReserved contains resources reserved for Kubernetes system components. - type: object - x-kubernetes-validations: - - message: valid keys for kubeReserved are ['cpu','memory','ephemeral-storage','pid'] - rule: self.all(x, x=='cpu' || x=='memory' || x=='ephemeral-storage' || x=='pid') - - message: kubeReserved value cannot be a negative resource quantity - rule: self.all(x, !self[x].startsWith('-')) - maxPods: - description: |- - MaxPods is an override for the maximum number of pods that can run on - a worker node instance. - format: int32 - minimum: 0 - type: integer - podsPerCore: - description: |- - PodsPerCore is an override for the number of pods that can run on a worker node - instance based on the number of cpu cores. This value cannot exceed MaxPods, so, if - MaxPods is a lower value, that value will be used. - format: int32 - minimum: 0 - type: integer - systemReserved: - additionalProperties: - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - description: SystemReserved contains resources reserved for OS system daemons and kernel memory. - type: object - x-kubernetes-validations: - - message: valid keys for systemReserved are ['cpu','memory','ephemeral-storage','pid'] - rule: self.all(x, x=='cpu' || x=='memory' || x=='ephemeral-storage' || x=='pid') - - message: systemReserved value cannot be a negative resource quantity - rule: self.all(x, !self[x].startsWith('-')) - type: object - x-kubernetes-validations: - - message: imageGCHighThresholdPercent must be greater than imageGCLowThresholdPercent - rule: 'has(self.imageGCHighThresholdPercent) && has(self.imageGCLowThresholdPercent) ? self.imageGCHighThresholdPercent > self.imageGCLowThresholdPercent : true' - - message: evictionSoft OwnerKey does not have a matching evictionSoftGracePeriod - rule: has(self.evictionSoft) ? self.evictionSoft.all(e, (e in self.evictionSoftGracePeriod)):true - - message: evictionSoftGracePeriod OwnerKey does not have a matching evictionSoft - rule: has(self.evictionSoftGracePeriod) ? self.evictionSoftGracePeriod.all(e, (e in self.evictionSoft)):true - metadataOptions: - default: - httpEndpoint: enabled - httpProtocolIPv6: disabled - httpPutResponseHopLimit: 1 - httpTokens: required - description: |- - MetadataOptions for the generated launch template of provisioned nodes. - - This specifies the exposure of the Instance Metadata Service to - provisioned EC2 nodes. For more information, - see Instance Metadata and User Data - (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html) - in the Amazon Elastic Compute Cloud User Guide. - - Refer to recommended, security best practices - (https://aws.github.io/aws-eks-best-practices/security/docs/iam/#restrict-access-to-the-instance-profile-assigned-to-the-worker-node) - for limiting exposure of Instance Metadata and User Data to pods. - If omitted, defaults to httpEndpoint enabled, with httpProtocolIPv6 - disabled, with httpPutResponseLimit of 1, and with httpTokens - required. - properties: - httpEndpoint: - default: enabled - description: |- - HTTPEndpoint enables or disables the HTTP metadata endpoint on provisioned - nodes. If metadata options is non-nil, but this parameter is not specified, - the default state is "enabled". - - If you specify a value of "disabled", instance metadata will not be accessible - on the node. - enum: - - enabled - - disabled - type: string - httpProtocolIPv6: - default: disabled - description: |- - HTTPProtocolIPv6 enables or disables the IPv6 endpoint for the instance metadata - service on provisioned nodes. If metadata options is non-nil, but this parameter - is not specified, the default state is "disabled". - enum: - - enabled - - disabled - type: string - httpPutResponseHopLimit: - default: 1 - description: |- - HTTPPutResponseHopLimit is the desired HTTP PUT response hop limit for - instance metadata requests. The larger the number, the further instance - metadata requests can travel. Possible values are integers from 1 to 64. - If metadata options is non-nil, but this parameter is not specified, the - default value is 1. - format: int64 - maximum: 64 - minimum: 1 - type: integer - httpTokens: - default: required - description: |- - HTTPTokens determines the state of token usage for instance metadata - requests. If metadata options is non-nil, but this parameter is not - specified, the default state is "required". - - If the state is optional, one can choose to retrieve instance metadata with - or without a signed token header on the request. If one retrieves the IAM - role credentials without a token, the version 1.0 role credentials are - returned. If one retrieves the IAM role credentials using a valid signed - token, the version 2.0 role credentials are returned. - - If the state is "required", one must send a signed token header with any - instance metadata retrieval requests. In this state, retrieving the IAM - role credentials always returns the version 2.0 credentials; the version - 1.0 credentials are not available. - enum: - - required - - optional - type: string - type: object - role: - description: |- - Role is the AWS identity that nodes use. This field is immutable. - This field is mutually exclusive from instanceProfile. - Marking this field as immutable avoids concerns around terminating managed instance profiles from running instances. - This field may be made mutable in the future, assuming the correct garbage collection and drift handling is implemented - for the old instance profiles on an update. - type: string - x-kubernetes-validations: - - message: role cannot be empty - rule: self != '' - - message: immutable field changed - rule: self == oldSelf - securityGroupSelectorTerms: - description: SecurityGroupSelectorTerms is a list of or security group selector terms. The terms are ORed. - items: - description: |- - SecurityGroupSelectorTerm defines selection logic for a security group used by Karpenter to launch nodes. - If multiple fields are used for selection, the requirements are ANDed. - properties: - id: - description: ID is the security group id in EC2 - pattern: sg-[0-9a-z]+ - type: string - name: - description: |- - Name is the security group name in EC2. - This value is the name field, which is different from the name tag. - type: string - tags: - additionalProperties: - type: string - description: |- - Tags is a map of key/value tags used to select security groups. - Specifying '*' for a value selects all values for a given tag key. - maxProperties: 20 - type: object - x-kubernetes-validations: - - message: empty tag keys or values aren't supported - rule: self.all(k, k != '' && self[k] != '') - type: object - maxItems: 30 - type: array - x-kubernetes-validations: - - message: securityGroupSelectorTerms cannot be empty - rule: self.size() != 0 - - message: expected at least one, got none, ['tags', 'id', 'name'] - rule: self.all(x, has(x.tags) || has(x.id) || has(x.name)) - - message: '''id'' is mutually exclusive, cannot be set with a combination of other fields in securityGroupSelectorTerms' - rule: '!self.all(x, has(x.id) && (has(x.tags) || has(x.name)))' - - message: '''name'' is mutually exclusive, cannot be set with a combination of other fields in securityGroupSelectorTerms' - rule: '!self.all(x, has(x.name) && (has(x.tags) || has(x.id)))' - subnetSelectorTerms: - description: SubnetSelectorTerms is a list of or subnet selector terms. The terms are ORed. - items: - description: |- - SubnetSelectorTerm defines selection logic for a subnet used by Karpenter to launch nodes. - If multiple fields are used for selection, the requirements are ANDed. - properties: - id: - description: ID is the subnet id in EC2 - pattern: subnet-[0-9a-z]+ - type: string - tags: - additionalProperties: - type: string - description: |- - Tags is a map of key/value tags used to select subnets - Specifying '*' for a value selects all values for a given tag key. - maxProperties: 20 - type: object - x-kubernetes-validations: - - message: empty tag keys or values aren't supported - rule: self.all(k, k != '' && self[k] != '') - type: object - maxItems: 30 - type: array - x-kubernetes-validations: - - message: subnetSelectorTerms cannot be empty - rule: self.size() != 0 - - message: expected at least one, got none, ['tags', 'id'] - rule: self.all(x, has(x.tags) || has(x.id)) - - message: '''id'' is mutually exclusive, cannot be set with a combination of other fields in subnetSelectorTerms' - rule: '!self.all(x, has(x.id) && has(x.tags))' - tags: - additionalProperties: - type: string - description: Tags to be applied on ec2 resources like instances and launch templates. - type: object - x-kubernetes-validations: - - message: empty tag keys aren't supported - rule: self.all(k, k != '') - - message: tag contains a restricted tag matching eks:eks-cluster-name - rule: self.all(k, k !='eks:eks-cluster-name') - - message: tag contains a restricted tag matching kubernetes.io/cluster/ - rule: self.all(k, !k.startsWith('kubernetes.io/cluster') ) - - message: tag contains a restricted tag matching karpenter.sh/nodepool - rule: self.all(k, k != 'karpenter.sh/nodepool') - - message: tag contains a restricted tag matching karpenter.sh/nodeclaim - rule: self.all(k, k !='karpenter.sh/nodeclaim') - - message: tag contains a restricted tag matching karpenter.k8s.aws/ec2nodeclass - rule: self.all(k, k !='karpenter.k8s.aws/ec2nodeclass') - userData: - description: |- - UserData to be applied to the provisioned nodes. - It must be in the appropriate format based on the AMIFamily in use. Karpenter will merge certain fields into - this UserData to ensure nodes are being provisioned with the correct configuration. - type: string - required: - - amiSelectorTerms - - securityGroupSelectorTerms - - subnetSelectorTerms - type: object - x-kubernetes-validations: - - message: must specify exactly one of ['role', 'instanceProfile'] - rule: (has(self.role) && !has(self.instanceProfile)) || (!has(self.role) && has(self.instanceProfile)) - - message: changing from 'instanceProfile' to 'role' is not supported. You must delete and recreate this node class if you want to change this. - rule: (has(oldSelf.role) && has(self.role)) || (has(oldSelf.instanceProfile) && has(self.instanceProfile)) - - message: if set, amiFamily must be 'AL2' or 'Custom' when using an AL2 alias - rule: '!has(self.amiFamily) || (self.amiSelectorTerms.exists(x, has(x.alias) && x.alias.find(''^[^@]+'') == ''al2'') ? (self.amiFamily == ''Custom'' || self.amiFamily == ''AL2'') : true)' - - message: if set, amiFamily must be 'AL2023' or 'Custom' when using an AL2023 alias - rule: '!has(self.amiFamily) || (self.amiSelectorTerms.exists(x, has(x.alias) && x.alias.find(''^[^@]+'') == ''al2023'') ? (self.amiFamily == ''Custom'' || self.amiFamily == ''AL2023'') : true)' - - message: if set, amiFamily must be 'Bottlerocket' or 'Custom' when using a Bottlerocket alias - rule: '!has(self.amiFamily) || (self.amiSelectorTerms.exists(x, has(x.alias) && x.alias.find(''^[^@]+'') == ''bottlerocket'') ? (self.amiFamily == ''Custom'' || self.amiFamily == ''Bottlerocket'') : true)' - - message: if set, amiFamily must be 'Windows2019' or 'Custom' when using a Windows2019 alias - rule: '!has(self.amiFamily) || (self.amiSelectorTerms.exists(x, has(x.alias) && x.alias.find(''^[^@]+'') == ''windows2019'') ? (self.amiFamily == ''Custom'' || self.amiFamily == ''Windows2019'') : true)' - - message: if set, amiFamily must be 'Windows2022' or 'Custom' when using a Windows2022 alias - rule: '!has(self.amiFamily) || (self.amiSelectorTerms.exists(x, has(x.alias) && x.alias.find(''^[^@]+'') == ''windows2022'') ? (self.amiFamily == ''Custom'' || self.amiFamily == ''Windows2022'') : true)' - - message: must specify amiFamily if amiSelectorTerms does not contain an alias - rule: 'self.amiSelectorTerms.exists(x, has(x.alias)) ? true : has(self.amiFamily)' - status: - description: EC2NodeClassStatus contains the resolved state of the EC2NodeClass - properties: - amis: - description: |- - AMI contains the current AMI values that are available to the - cluster under the AMI selectors. - items: - description: AMI contains resolved AMI selector values utilized for node launch - properties: - deprecated: - description: Deprecation status of the AMI - type: boolean - id: - description: ID of the AMI - type: string - name: - description: Name of the AMI - type: string - requirements: - description: Requirements of the AMI to be utilized on an instance type - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - required: - - id - - requirements - type: object - type: array - conditions: - description: Conditions contains signals for health and readiness - items: - description: Condition aliases the upstream type and adds additional helper methods - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array - instanceProfile: - description: InstanceProfile contains the resolved instance profile for the role - type: string - securityGroups: - description: |- - SecurityGroups contains the current security group values that are available to the - cluster under the SecurityGroups selectors. - items: - description: SecurityGroup contains resolved SecurityGroup selector values utilized for node launch - properties: - id: - description: ID of the security group - type: string - name: - description: Name of the security group - type: string - required: - - id - type: object - type: array - subnets: - description: |- - Subnets contains the current subnet values that are available to the - cluster under the subnet selectors. - items: - description: Subnet contains resolved Subnet selector values utilized for node launch - properties: - id: - description: ID of the subnet - type: string - zone: - description: The associated availability zone - type: string - zoneID: - description: The associated availability zone ID - type: string - required: - - id - - zone - type: object - type: array - type: object - type: object - served: true - storage: true - subresources: - status: {} diff --git a/charts/devtron-utilities/charts/karpenter/crds/karpenter.sh_nodeclaims.yaml b/charts/devtron-utilities/charts/karpenter/crds/karpenter.sh_nodeclaims.yaml deleted file mode 100644 index e5b4aeae3..000000000 --- a/charts/devtron-utilities/charts/karpenter/crds/karpenter.sh_nodeclaims.yaml +++ /dev/null @@ -1,395 +0,0 @@ ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.17.1 - name: nodeclaims.karpenter.sh -spec: - group: karpenter.sh - names: - categories: - - karpenter - kind: NodeClaim - listKind: NodeClaimList - plural: nodeclaims - singular: nodeclaim - scope: Cluster - versions: - - additionalPrinterColumns: - - jsonPath: .metadata.labels.node\.kubernetes\.io/instance-type - name: Type - type: string - - jsonPath: .metadata.labels.karpenter\.sh/capacity-type - name: Capacity - type: string - - jsonPath: .metadata.labels.topology\.kubernetes\.io/zone - name: Zone - type: string - - jsonPath: .status.nodeName - name: Node - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - jsonPath: .status.imageID - name: ImageID - priority: 1 - type: string - - jsonPath: .status.providerID - name: ID - priority: 1 - type: string - - jsonPath: .metadata.labels.karpenter\.sh/nodepool - name: NodePool - priority: 1 - type: string - - jsonPath: .spec.nodeClassRef.name - name: NodeClass - priority: 1 - type: string - name: v1 - schema: - openAPIV3Schema: - description: NodeClaim is the Schema for the NodeClaims API - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: NodeClaimSpec describes the desired state of the NodeClaim - properties: - expireAfter: - default: 720h - description: |- - ExpireAfter is the duration the controller will wait - before terminating a node, measured from when the node is created. This - is useful to implement features like eventually consistent node upgrade, - memory leak protection, and disruption testing. - pattern: ^(([0-9]+(s|m|h))+)|(Never)$ - type: string - nodeClassRef: - description: NodeClassRef is a reference to an object that defines provider specific configuration - properties: - group: - description: API version of the referent - pattern: ^[^/]*$ - type: string - x-kubernetes-validations: - - message: group may not be empty - rule: self != '' - kind: - description: 'Kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"' - type: string - x-kubernetes-validations: - - message: kind may not be empty - rule: self != '' - name: - description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' - type: string - x-kubernetes-validations: - - message: name may not be empty - rule: self != '' - required: - - group - - kind - - name - type: object - requirements: - description: Requirements are layered with GetLabels and applied to every node. - items: - description: |- - A node selector requirement with min values is a selector that contains values, a key, an operator that relates the key and values - and minValues that represent the requirement to have at least that many values. - properties: - key: - description: The label key that the selector applies to. - type: string - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$ - x-kubernetes-validations: - - message: label domain "kubernetes.io" is restricted - rule: self in ["beta.kubernetes.io/instance-type", "failure-domain.beta.kubernetes.io/region", "beta.kubernetes.io/os", "beta.kubernetes.io/arch", "failure-domain.beta.kubernetes.io/zone", "topology.kubernetes.io/zone", "topology.kubernetes.io/region", "node.kubernetes.io/instance-type", "kubernetes.io/arch", "kubernetes.io/os", "node.kubernetes.io/windows-build"] || self.find("^([^/]+)").endsWith("node.kubernetes.io") || self.find("^([^/]+)").endsWith("node-restriction.kubernetes.io") || !self.find("^([^/]+)").endsWith("kubernetes.io") - - message: label domain "k8s.io" is restricted - rule: self.find("^([^/]+)").endsWith("kops.k8s.io") || !self.find("^([^/]+)").endsWith("k8s.io") - - message: label domain "karpenter.sh" is restricted - rule: self in ["karpenter.sh/capacity-type", "karpenter.sh/nodepool"] || !self.find("^([^/]+)").endsWith("karpenter.sh") - - message: label "kubernetes.io/hostname" is restricted - rule: self != "kubernetes.io/hostname" - - message: label domain "karpenter.k8s.aws" is restricted - rule: self in ["karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count"] || !self.find("^([^/]+)").endsWith("karpenter.k8s.aws") - minValues: - description: |- - This field is ALPHA and can be dropped or replaced at any time - MinValues is the minimum number of unique values required to define the flexibility of the specific requirement. - maximum: 50 - minimum: 1 - type: integer - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - enum: - - In - - NotIn - - Exists - - DoesNotExist - - Gt - - Lt - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - maxLength: 63 - pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$ - required: - - key - - operator - type: object - maxItems: 100 - type: array - x-kubernetes-validations: - - message: requirements with operator 'In' must have a value defined - rule: 'self.all(x, x.operator == ''In'' ? x.values.size() != 0 : true)' - - message: requirements operator 'Gt' or 'Lt' must have a single positive integer value - rule: 'self.all(x, (x.operator == ''Gt'' || x.operator == ''Lt'') ? (x.values.size() == 1 && int(x.values[0]) >= 0) : true)' - - message: requirements with 'minValues' must have at least that many values specified in the 'values' field - rule: 'self.all(x, (x.operator == ''In'' && has(x.minValues)) ? x.values.size() >= x.minValues : true)' - resources: - description: Resources models the resource requirements for the NodeClaim to launch - properties: - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: Requests describes the minimum required resources for the NodeClaim to launch - type: object - type: object - startupTaints: - description: |- - StartupTaints are taints that are applied to nodes upon startup which are expected to be removed automatically - within a short period of time, typically by a DaemonSet that tolerates the taint. These are commonly used by - daemonsets to allow initialization and enforce startup ordering. StartupTaints are ignored for provisioning - purposes in that pods are not required to tolerate a StartupTaint in order to have nodes provisioned for them. - items: - description: |- - The node this Taint is attached to has the "effect" on - any pod that does not tolerate the Taint. - properties: - effect: - description: |- - Required. The effect of the taint on pods - that do not tolerate the taint. - Valid effects are NoSchedule, PreferNoSchedule and NoExecute. - type: string - enum: - - NoSchedule - - PreferNoSchedule - - NoExecute - key: - description: Required. The taint key to be applied to a node. - type: string - minLength: 1 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$ - timeAdded: - description: |- - TimeAdded represents the time at which the taint was added. - It is only written for NoExecute taints. - format: date-time - type: string - value: - description: The taint value corresponding to the taint key. - type: string - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$ - required: - - effect - - key - type: object - type: array - taints: - description: Taints will be applied to the NodeClaim's node. - items: - description: |- - The node this Taint is attached to has the "effect" on - any pod that does not tolerate the Taint. - properties: - effect: - description: |- - Required. The effect of the taint on pods - that do not tolerate the taint. - Valid effects are NoSchedule, PreferNoSchedule and NoExecute. - type: string - enum: - - NoSchedule - - PreferNoSchedule - - NoExecute - key: - description: Required. The taint key to be applied to a node. - type: string - minLength: 1 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$ - timeAdded: - description: |- - TimeAdded represents the time at which the taint was added. - It is only written for NoExecute taints. - format: date-time - type: string - value: - description: The taint value corresponding to the taint key. - type: string - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$ - required: - - effect - - key - type: object - type: array - terminationGracePeriod: - description: |- - TerminationGracePeriod is the maximum duration the controller will wait before forcefully deleting the pods on a node, measured from when deletion is first initiated. - - Warning: this feature takes precedence over a Pod's terminationGracePeriodSeconds value, and bypasses any blocked PDBs or the karpenter.sh/do-not-disrupt annotation. - - This field is intended to be used by cluster administrators to enforce that nodes can be cycled within a given time period. - When set, drifted nodes will begin draining even if there are pods blocking eviction. Draining will respect PDBs and the do-not-disrupt annotation until the TGP is reached. - - Karpenter will preemptively delete pods so their terminationGracePeriodSeconds align with the node's terminationGracePeriod. - If a pod would be terminated without being granted its full terminationGracePeriodSeconds prior to the node timeout, - that pod will be deleted at T = node timeout - pod terminationGracePeriodSeconds. - - The feature can also be used to allow maximum time limits for long-running jobs which can delay node termination with preStop hooks. - If left undefined, the controller will wait indefinitely for pods to be drained. - pattern: ^([0-9]+(s|m|h))+$ - type: string - required: - - nodeClassRef - - requirements - type: object - x-kubernetes-validations: - - message: spec is immutable - rule: self == oldSelf - status: - description: NodeClaimStatus defines the observed state of NodeClaim - properties: - allocatable: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: Allocatable is the estimated allocatable capacity of the node - type: object - capacity: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: Capacity is the estimated full capacity of the node - type: object - conditions: - description: Conditions contains signals for health and readiness - items: - description: Condition aliases the upstream type and adds additional helper methods - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - pattern: ^([A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?|)$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - status - - type - type: object - type: array - imageID: - description: ImageID is an identifier for the image that runs on the node - type: string - lastPodEventTime: - description: |- - LastPodEventTime is updated with the last time a pod was scheduled - or removed from the node. A pod going terminal or terminating - is also considered as removed. - format: date-time - type: string - nodeName: - description: NodeName is the name of the corresponding node object - type: string - providerID: - description: ProviderID of the corresponding node object - type: string - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} diff --git a/charts/devtron-utilities/charts/karpenter/crds/karpenter.sh_nodepools.yaml b/charts/devtron-utilities/charts/karpenter/crds/karpenter.sh_nodepools.yaml deleted file mode 100644 index 06e232756..000000000 --- a/charts/devtron-utilities/charts/karpenter/crds/karpenter.sh_nodepools.yaml +++ /dev/null @@ -1,519 +0,0 @@ ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.17.1 - name: nodepools.karpenter.sh -spec: - group: karpenter.sh - names: - categories: - - karpenter - kind: NodePool - listKind: NodePoolList - plural: nodepools - singular: nodepool - scope: Cluster - versions: - - additionalPrinterColumns: - - jsonPath: .spec.template.spec.nodeClassRef.name - name: NodeClass - type: string - - jsonPath: .status.resources.nodes - name: Nodes - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - jsonPath: .spec.weight - name: Weight - priority: 1 - type: integer - - jsonPath: .status.resources.cpu - name: CPU - priority: 1 - type: string - - jsonPath: .status.resources.memory - name: Memory - priority: 1 - type: string - name: v1 - schema: - openAPIV3Schema: - description: NodePool is the Schema for the NodePools API - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: |- - NodePoolSpec is the top level nodepool specification. Nodepools - launch nodes in response to pods that are unschedulable. A single nodepool - is capable of managing a diverse set of nodes. Node properties are determined - from a combination of nodepool and pod scheduling constraints. - properties: - disruption: - default: - consolidateAfter: 0s - description: Disruption contains the parameters that relate to Karpenter's disruption logic - properties: - budgets: - default: - - nodes: 10% - description: |- - Budgets is a list of Budgets. - If there are multiple active budgets, Karpenter uses - the most restrictive value. If left undefined, - this will default to one budget with a value to 10%. - items: - description: |- - Budget defines when Karpenter will restrict the - number of Node Claims that can be terminating simultaneously. - properties: - duration: - description: |- - Duration determines how long a Budget is active since each Schedule hit. - Only minutes and hours are accepted, as cron does not work in seconds. - If omitted, the budget is always active. - This is required if Schedule is set. - This regex has an optional 0s at the end since the duration.String() always adds - a 0s at the end. - pattern: ^((([0-9]+(h|m))|([0-9]+h[0-9]+m))(0s)?)$ - type: string - nodes: - default: 10% - description: |- - Nodes dictates the maximum number of NodeClaims owned by this NodePool - that can be terminating at once. This is calculated by counting nodes that - have a deletion timestamp set, or are actively being deleted by Karpenter. - This field is required when specifying a budget. - This cannot be of type intstr.IntOrString since kubebuilder doesn't support pattern - checking for int nodes for IntOrString nodes. - Ref: https://github.com/kubernetes-sigs/controller-tools/blob/55efe4be40394a288216dab63156b0a64fb82929/pkg/crd/markers/validation.go#L379-L388 - pattern: ^((100|[0-9]{1,2})%|[0-9]+)$ - type: string - reasons: - description: |- - Reasons is a list of disruption methods that this budget applies to. If Reasons is not set, this budget applies to all methods. - Otherwise, this will apply to each reason defined. - allowed reasons are Underutilized, Empty, and Drifted. - items: - description: DisruptionReason defines valid reasons for disruption budgets. - enum: - - Underutilized - - Empty - - Drifted - type: string - type: array - schedule: - description: |- - Schedule specifies when a budget begins being active, following - the upstream cronjob syntax. If omitted, the budget is always active. - Timezones are not supported. - This field is required if Duration is set. - pattern: ^(@(annually|yearly|monthly|weekly|daily|midnight|hourly))|((.+)\s(.+)\s(.+)\s(.+)\s(.+))$ - type: string - required: - - nodes - type: object - maxItems: 50 - type: array - x-kubernetes-validations: - - message: '''schedule'' must be set with ''duration''' - rule: self.all(x, has(x.schedule) == has(x.duration)) - consolidateAfter: - description: |- - ConsolidateAfter is the duration the controller will wait - before attempting to terminate nodes that are underutilized. - Refer to ConsolidationPolicy for how underutilization is considered. - pattern: ^(([0-9]+(s|m|h))+)|(Never)$ - type: string - consolidationPolicy: - default: WhenEmptyOrUnderutilized - description: |- - ConsolidationPolicy describes which nodes Karpenter can disrupt through its consolidation - algorithm. This policy defaults to "WhenEmptyOrUnderutilized" if not specified - enum: - - WhenEmpty - - WhenEmptyOrUnderutilized - type: string - required: - - consolidateAfter - type: object - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: Limits define a set of bounds for provisioning capacity. - type: object - template: - description: |- - Template contains the template of possibilities for the provisioning logic to launch a NodeClaim with. - NodeClaims launched from this NodePool will often be further constrained than the template specifies. - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - description: |- - Annotations is an unstructured key value map stored with a resource that may be - set by external tools to store and retrieve arbitrary metadata. They are not - queryable and should be preserved when modifying objects. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations - type: object - labels: - additionalProperties: - type: string - maxLength: 63 - pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$ - description: |- - Map of string keys and values that can be used to organize and categorize - (scope and select) objects. May match selectors of replication controllers - and services. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels - type: object - maxProperties: 100 - x-kubernetes-validations: - - message: label domain "kubernetes.io" is restricted - rule: self.all(x, x in ["beta.kubernetes.io/instance-type", "failure-domain.beta.kubernetes.io/region", "beta.kubernetes.io/os", "beta.kubernetes.io/arch", "failure-domain.beta.kubernetes.io/zone", "topology.kubernetes.io/zone", "topology.kubernetes.io/region", "kubernetes.io/arch", "kubernetes.io/os", "node.kubernetes.io/windows-build"] || x.find("^([^/]+)").endsWith("node.kubernetes.io") || x.find("^([^/]+)").endsWith("node-restriction.kubernetes.io") || !x.find("^([^/]+)").endsWith("kubernetes.io")) - - message: label domain "k8s.io" is restricted - rule: self.all(x, x.find("^([^/]+)").endsWith("kops.k8s.io") || !x.find("^([^/]+)").endsWith("k8s.io")) - - message: label domain "karpenter.sh" is restricted - rule: self.all(x, x in ["karpenter.sh/capacity-type", "karpenter.sh/nodepool"] || !x.find("^([^/]+)").endsWith("karpenter.sh")) - - message: label "karpenter.sh/nodepool" is restricted - rule: self.all(x, x != "karpenter.sh/nodepool") - - message: label "kubernetes.io/hostname" is restricted - rule: self.all(x, x != "kubernetes.io/hostname") - - message: label domain "karpenter.k8s.aws" is restricted - rule: self.all(x, x in ["karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count"] || !x.find("^([^/]+)").endsWith("karpenter.k8s.aws")) - type: object - spec: - description: |- - NodeClaimTemplateSpec describes the desired state of the NodeClaim in the Nodepool - NodeClaimTemplateSpec is used in the NodePool's NodeClaimTemplate, with the resource requests omitted since - users are not able to set resource requests in the NodePool. - properties: - expireAfter: - default: 720h - description: |- - ExpireAfter is the duration the controller will wait - before terminating a node, measured from when the node is created. This - is useful to implement features like eventually consistent node upgrade, - memory leak protection, and disruption testing. - pattern: ^(([0-9]+(s|m|h))+)|(Never)$ - type: string - nodeClassRef: - description: NodeClassRef is a reference to an object that defines provider specific configuration - properties: - group: - description: API version of the referent - pattern: ^[^/]*$ - type: string - x-kubernetes-validations: - - message: group may not be empty - rule: self != '' - kind: - description: 'Kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"' - type: string - x-kubernetes-validations: - - message: kind may not be empty - rule: self != '' - name: - description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' - type: string - x-kubernetes-validations: - - message: name may not be empty - rule: self != '' - required: - - group - - kind - - name - type: object - x-kubernetes-validations: - - message: nodeClassRef.group is immutable - rule: self.group == oldSelf.group - - message: nodeClassRef.kind is immutable - rule: self.kind == oldSelf.kind - requirements: - description: Requirements are layered with GetLabels and applied to every node. - items: - description: |- - A node selector requirement with min values is a selector that contains values, a key, an operator that relates the key and values - and minValues that represent the requirement to have at least that many values. - properties: - key: - description: The label key that the selector applies to. - type: string - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$ - x-kubernetes-validations: - - message: label domain "kubernetes.io" is restricted - rule: self in ["beta.kubernetes.io/instance-type", "failure-domain.beta.kubernetes.io/region", "beta.kubernetes.io/os", "beta.kubernetes.io/arch", "failure-domain.beta.kubernetes.io/zone", "topology.kubernetes.io/zone", "topology.kubernetes.io/region", "node.kubernetes.io/instance-type", "kubernetes.io/arch", "kubernetes.io/os", "node.kubernetes.io/windows-build"] || self.find("^([^/]+)").endsWith("node.kubernetes.io") || self.find("^([^/]+)").endsWith("node-restriction.kubernetes.io") || !self.find("^([^/]+)").endsWith("kubernetes.io") - - message: label domain "k8s.io" is restricted - rule: self.find("^([^/]+)").endsWith("kops.k8s.io") || !self.find("^([^/]+)").endsWith("k8s.io") - - message: label domain "karpenter.sh" is restricted - rule: self in ["karpenter.sh/capacity-type", "karpenter.sh/nodepool"] || !self.find("^([^/]+)").endsWith("karpenter.sh") - - message: label "karpenter.sh/nodepool" is restricted - rule: self != "karpenter.sh/nodepool" - - message: label "kubernetes.io/hostname" is restricted - rule: self != "kubernetes.io/hostname" - - message: label domain "karpenter.k8s.aws" is restricted - rule: self in ["karpenter.k8s.aws/ec2nodeclass", "karpenter.k8s.aws/instance-encryption-in-transit-supported", "karpenter.k8s.aws/instance-category", "karpenter.k8s.aws/instance-hypervisor", "karpenter.k8s.aws/instance-family", "karpenter.k8s.aws/instance-generation", "karpenter.k8s.aws/instance-local-nvme", "karpenter.k8s.aws/instance-size", "karpenter.k8s.aws/instance-cpu", "karpenter.k8s.aws/instance-cpu-manufacturer", "karpenter.k8s.aws/instance-cpu-sustained-clock-speed-mhz", "karpenter.k8s.aws/instance-memory", "karpenter.k8s.aws/instance-ebs-bandwidth", "karpenter.k8s.aws/instance-network-bandwidth", "karpenter.k8s.aws/instance-gpu-name", "karpenter.k8s.aws/instance-gpu-manufacturer", "karpenter.k8s.aws/instance-gpu-count", "karpenter.k8s.aws/instance-gpu-memory", "karpenter.k8s.aws/instance-accelerator-name", "karpenter.k8s.aws/instance-accelerator-manufacturer", "karpenter.k8s.aws/instance-accelerator-count"] || !self.find("^([^/]+)").endsWith("karpenter.k8s.aws") - minValues: - description: |- - This field is ALPHA and can be dropped or replaced at any time - MinValues is the minimum number of unique values required to define the flexibility of the specific requirement. - maximum: 50 - minimum: 1 - type: integer - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - enum: - - In - - NotIn - - Exists - - DoesNotExist - - Gt - - Lt - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - maxLength: 63 - pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$ - required: - - key - - operator - type: object - maxItems: 100 - type: array - x-kubernetes-validations: - - message: requirements with operator 'In' must have a value defined - rule: 'self.all(x, x.operator == ''In'' ? x.values.size() != 0 : true)' - - message: requirements operator 'Gt' or 'Lt' must have a single positive integer value - rule: 'self.all(x, (x.operator == ''Gt'' || x.operator == ''Lt'') ? (x.values.size() == 1 && int(x.values[0]) >= 0) : true)' - - message: requirements with 'minValues' must have at least that many values specified in the 'values' field - rule: 'self.all(x, (x.operator == ''In'' && has(x.minValues)) ? x.values.size() >= x.minValues : true)' - startupTaints: - description: |- - StartupTaints are taints that are applied to nodes upon startup which are expected to be removed automatically - within a short period of time, typically by a DaemonSet that tolerates the taint. These are commonly used by - daemonsets to allow initialization and enforce startup ordering. StartupTaints are ignored for provisioning - purposes in that pods are not required to tolerate a StartupTaint in order to have nodes provisioned for them. - items: - description: |- - The node this Taint is attached to has the "effect" on - any pod that does not tolerate the Taint. - properties: - effect: - description: |- - Required. The effect of the taint on pods - that do not tolerate the taint. - Valid effects are NoSchedule, PreferNoSchedule and NoExecute. - type: string - enum: - - NoSchedule - - PreferNoSchedule - - NoExecute - key: - description: Required. The taint key to be applied to a node. - type: string - minLength: 1 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$ - timeAdded: - description: |- - TimeAdded represents the time at which the taint was added. - It is only written for NoExecute taints. - format: date-time - type: string - value: - description: The taint value corresponding to the taint key. - type: string - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$ - required: - - effect - - key - type: object - type: array - taints: - description: Taints will be applied to the NodeClaim's node. - items: - description: |- - The node this Taint is attached to has the "effect" on - any pod that does not tolerate the Taint. - properties: - effect: - description: |- - Required. The effect of the taint on pods - that do not tolerate the taint. - Valid effects are NoSchedule, PreferNoSchedule and NoExecute. - type: string - enum: - - NoSchedule - - PreferNoSchedule - - NoExecute - key: - description: Required. The taint key to be applied to a node. - type: string - minLength: 1 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$ - timeAdded: - description: |- - TimeAdded represents the time at which the taint was added. - It is only written for NoExecute taints. - format: date-time - type: string - value: - description: The taint value corresponding to the taint key. - type: string - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*(\/))?([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$ - required: - - effect - - key - type: object - type: array - terminationGracePeriod: - description: |- - TerminationGracePeriod is the maximum duration the controller will wait before forcefully deleting the pods on a node, measured from when deletion is first initiated. - - Warning: this feature takes precedence over a Pod's terminationGracePeriodSeconds value, and bypasses any blocked PDBs or the karpenter.sh/do-not-disrupt annotation. - - This field is intended to be used by cluster administrators to enforce that nodes can be cycled within a given time period. - When set, drifted nodes will begin draining even if there are pods blocking eviction. Draining will respect PDBs and the do-not-disrupt annotation until the TGP is reached. - - Karpenter will preemptively delete pods so their terminationGracePeriodSeconds align with the node's terminationGracePeriod. - If a pod would be terminated without being granted its full terminationGracePeriodSeconds prior to the node timeout, - that pod will be deleted at T = node timeout - pod terminationGracePeriodSeconds. - - The feature can also be used to allow maximum time limits for long-running jobs which can delay node termination with preStop hooks. - If left undefined, the controller will wait indefinitely for pods to be drained. - pattern: ^([0-9]+(s|m|h))+$ - type: string - required: - - nodeClassRef - - requirements - type: object - required: - - spec - type: object - weight: - description: |- - Weight is the priority given to the nodepool during scheduling. A higher - numerical weight indicates that this nodepool will be ordered - ahead of other nodepools with lower weights. A nodepool with no weight - will be treated as if it is a nodepool with a weight of 0. - format: int32 - maximum: 100 - minimum: 1 - type: integer - required: - - template - type: object - status: - description: NodePoolStatus defines the observed state of NodePool - properties: - conditions: - description: Conditions contains signals for health and readiness - items: - description: Condition aliases the upstream type and adds additional helper methods - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array - resources: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: Resources is the list of resources that have been provisioned. - type: object - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} diff --git a/charts/devtron-utilities/charts/karpenter/templates/_helpers.tpl b/charts/devtron-utilities/charts/karpenter/templates/_helpers.tpl deleted file mode 100644 index 212f599b1..000000000 --- a/charts/devtron-utilities/charts/karpenter/templates/_helpers.tpl +++ /dev/null @@ -1,142 +0,0 @@ -{{/* -Expand the name of the chart. -*/}} -{{- define "karpenter.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "karpenter.fullname" -}} -{{- if .Values.fullnameOverride }} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- $name := default .Chart.Name .Values.nameOverride }} -{{- if contains $name .Release.Name }} -{{- .Release.Name | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} -{{- end }} -{{- end }} -{{- end }} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "karpenter.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Common labels -*/}} -{{- define "karpenter.labels" -}} -helm.sh/chart: {{ include "karpenter.chart" . }} -{{ include "karpenter.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- with .Values.additionalLabels }} -{{ toYaml . }} -{{- end }} -{{- end }} - -{{/* -Selector labels -*/}} -{{- define "karpenter.selectorLabels" -}} -app.kubernetes.io/name: {{ include "karpenter.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} - -{{/* -Create the name of the service account to use -*/}} -{{- define "karpenter.serviceAccountName" -}} -{{- if .Values.serviceAccount.create }} -{{- default (include "karpenter.fullname" .) .Values.serviceAccount.name }} -{{- else }} -{{- default "default" .Values.serviceAccount.name }} -{{- end }} -{{- end }} - -{{/* -Karpenter image to use -*/}} -{{- define "karpenter.controller.image" -}} -{{- if .Values.controller.image.digest }} -{{- printf "%s:%s@%s" .Values.controller.image.repository (default (printf "%s" .Chart.AppVersion) .Values.controller.image.tag) .Values.controller.image.digest }} -{{- else }} -{{- printf "%s:%s" .Values.controller.image.repository (default (printf "%s" .Chart.AppVersion) .Values.controller.image.tag) }} -{{- end }} -{{- end }} - - -{{/* Get PodDisruptionBudget API Version */}} -{{- define "karpenter.pdb.apiVersion" -}} -{{- if and (.Capabilities.APIVersions.Has "policy/v1") (semverCompare ">= 1.21-0" .Capabilities.KubeVersion.Version) -}} -{{- print "policy/v1" -}} -{{- else -}} -{{- print "policy/v1beta1" -}} -{{- end -}} -{{- end -}} - -{{/* -Patch the label selector on an object -This template will add a labelSelector using matchLabels to the object referenced at _target if there is no labelSelector specified. -The matchLabels are created with the selectorLabels template. -This works because Helm treats dictionaries as mutable objects and allows passing them by reference. -*/}} -{{- define "karpenter.patchLabelSelector" -}} -{{- if not (hasKey ._target "labelSelector") }} -{{- $selectorLabels := (include "karpenter.selectorLabels" .) | fromYaml }} -{{- $_ := set ._target "labelSelector" (dict "matchLabels" $selectorLabels) }} -{{- end }} -{{- end }} - -{{/* -Patch pod affinity -This template uses the patchLabelSelector template to add a labelSelector to pod affinity objects if there is no labelSelector specified. -This works because Helm treats dictionaries as mutable objects and allows passing them by reference. -*/}} -{{- define "karpenter.patchPodAffinity" -}} -{{- if (hasKey ._podAffinity "requiredDuringSchedulingIgnoredDuringExecution") }} -{{- range $term := ._podAffinity.requiredDuringSchedulingIgnoredDuringExecution }} -{{- include "karpenter.patchLabelSelector" (merge (dict "_target" $term) $) }} -{{- end }} -{{- end }} -{{- if (hasKey ._podAffinity "preferredDuringSchedulingIgnoredDuringExecution") }} -{{- range $weightedTerm := ._podAffinity.preferredDuringSchedulingIgnoredDuringExecution }} -{{- include "karpenter.patchLabelSelector" (merge (dict "_target" $weightedTerm.podAffinityTerm) $) }} -{{- end }} -{{- end }} -{{- end }} - -{{/* -Patch affinity -This template uses patchPodAffinity template to add a labelSelector to podAffinity & podAntiAffinity if one isn't specified. -This works because Helm treats dictionaries as mutable objects and allows passing them by reference. -*/}} -{{- define "karpenter.patchAffinity" -}} -{{- if (hasKey .Values.affinity "podAffinity") }} -{{- include "karpenter.patchPodAffinity" (merge (dict "_podAffinity" .Values.affinity.podAffinity) .) }} -{{- end }} -{{- if (hasKey .Values.affinity "podAntiAffinity") }} -{{- include "karpenter.patchPodAffinity" (merge (dict "_podAffinity" .Values.affinity.podAntiAffinity) .) }} -{{- end }} -{{- end }} - -{{/* -Patch topology spread constraints -This template uses the patchLabelSelector template to add a labelSelector to topologySpreadConstraints if one isn't specified. -This works because Helm treats dictionaries as mutable objects and allows passing them by reference. -*/}} -{{- define "karpenter.patchTopologySpreadConstraints" -}} -{{- range $constraint := .Values.topologySpreadConstraints }} -{{- include "karpenter.patchLabelSelector" (merge (dict "_target" $constraint) $) }} -{{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/karpenter/templates/aggregate-clusterrole.yaml b/charts/devtron-utilities/charts/karpenter/templates/aggregate-clusterrole.yaml deleted file mode 100644 index 038aa1351..000000000 --- a/charts/devtron-utilities/charts/karpenter/templates/aggregate-clusterrole.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ include "karpenter.fullname" . }}-admin - labels: - rbac.authorization.k8s.io/aggregate-to-admin: "true" - {{- include "karpenter.labels" . | nindent 4 }} - {{- with .Values.additionalAnnotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -rules: - - apiGroups: ["karpenter.sh"] - resources: ["nodepools", "nodepools/status", "nodeclaims", "nodeclaims/status"] - verbs: ["get", "list", "watch", "create", "delete", "patch"] - - apiGroups: ["karpenter.k8s.aws"] - resources: ["ec2nodeclasses"] - verbs: ["get", "list", "watch", "create", "delete", "patch"] diff --git a/charts/devtron-utilities/charts/karpenter/templates/clusterrole-core.yaml b/charts/devtron-utilities/charts/karpenter/templates/clusterrole-core.yaml deleted file mode 100644 index bc12a8a70..000000000 --- a/charts/devtron-utilities/charts/karpenter/templates/clusterrole-core.yaml +++ /dev/null @@ -1,71 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ include "karpenter.fullname" . }}-core - labels: - {{- include "karpenter.labels" . | nindent 4 }} - {{- with .Values.additionalAnnotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ include "karpenter.fullname" . }}-core -subjects: - - kind: ServiceAccount - name: {{ template "karpenter.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ include "karpenter.fullname" . }}-core - labels: - {{- include "karpenter.labels" . | nindent 4 }} - {{- with .Values.additionalAnnotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -rules: - # Read - - apiGroups: ["karpenter.sh"] - resources: ["nodepools", "nodepools/status", "nodeclaims", "nodeclaims/status"] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["pods", "nodes", "persistentvolumes", "persistentvolumeclaims", "replicationcontrollers", "namespaces"] - verbs: ["get", "list", "watch"] - - apiGroups: ["storage.k8s.io"] - resources: ["storageclasses", "csinodes", "volumeattachments"] - verbs: ["get", "watch", "list"] - - apiGroups: ["apps"] - resources: ["daemonsets", "deployments", "replicasets", "statefulsets"] - verbs: ["list", "watch"] - - apiGroups: ["policy"] - resources: ["poddisruptionbudgets"] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["events"] - verbs: ["get", list, "watch"] - # Write - - apiGroups: ["karpenter.sh"] - resources: ["nodeclaims", "nodeclaims/status"] - verbs: ["create", "delete", "update", "patch"] - - apiGroups: ["karpenter.sh"] - resources: ["nodepools", "nodepools/status"] - verbs: ["update", "patch"] - - apiGroups: [""] - resources: ["events"] - verbs: ["create", "patch"] - - apiGroups: [""] - resources: ["nodes"] - verbs: ["patch", "delete", "update"] - - apiGroups: [""] - resources: ["pods/eviction"] - verbs: ["create"] - - apiGroups: [""] - resources: ["pods"] - verbs: ["delete"] - {{- with .Values.additionalClusterRoleRules -}} - {{ toYaml . | nindent 2 }} - {{- end -}} diff --git a/charts/devtron-utilities/charts/karpenter/templates/clusterrole.yaml b/charts/devtron-utilities/charts/karpenter/templates/clusterrole.yaml deleted file mode 100644 index 769a343d0..000000000 --- a/charts/devtron-utilities/charts/karpenter/templates/clusterrole.yaml +++ /dev/null @@ -1,38 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ include "karpenter.fullname" . }} - labels: - {{- include "karpenter.labels" . | nindent 4 }} - {{- with .Values.additionalAnnotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ include "karpenter.fullname" . }} -subjects: - - kind: ServiceAccount - name: {{ template "karpenter.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ include "karpenter.fullname" . }} - labels: - {{- include "karpenter.labels" . | nindent 4 }} - {{- with .Values.additionalAnnotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -rules: - # Read - - apiGroups: ["karpenter.k8s.aws"] - resources: ["ec2nodeclasses"] - verbs: ["get", "list", "watch"] - # Write - - apiGroups: ["karpenter.k8s.aws"] - resources: ["ec2nodeclasses", "ec2nodeclasses/status"] - verbs: ["patch", "update"] \ No newline at end of file diff --git a/charts/devtron-utilities/charts/karpenter/templates/deployment.yaml b/charts/devtron-utilities/charts/karpenter/templates/deployment.yaml deleted file mode 100644 index 990ce4862..000000000 --- a/charts/devtron-utilities/charts/karpenter/templates/deployment.yaml +++ /dev/null @@ -1,223 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "karpenter.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "karpenter.labels" . | nindent 4 }} - {{- with .Values.additionalAnnotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -spec: - replicas: {{ .Values.replicas }} - revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} - {{- with .Values.strategy }} - strategy: - {{- toYaml . | nindent 4 }} - {{- end }} - selector: - matchLabels: - {{- include "karpenter.selectorLabels" . | nindent 6 }} - template: - metadata: - labels: - {{- include "karpenter.selectorLabels" . | nindent 8 }} - {{- with .Values.podLabels }} - {{- toYaml . | nindent 8 }} - {{- end }} - annotations: - {{- with .Values.podAnnotations }} - {{- toYaml . | nindent 8 }} - {{- end }} - spec: - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - serviceAccountName: {{ include "karpenter.serviceAccountName" . }} - {{- with .Values.podSecurityContext }} - securityContext: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.priorityClassName }} - priorityClassName: {{ . | quote }} - {{- end }} - {{- with .Values.terminationGracePeriodSeconds }} - terminationGracePeriodSeconds: {{ . }} - {{- end }} - {{- with .Values.dnsPolicy }} - dnsPolicy: {{ . }} - {{- end }} - {{- with .Values.dnsConfig }} - dnsConfig: - {{- toYaml . | nindent 8}} - {{- end }} - {{- if .Values.hostNetwork }} - hostNetwork: true - {{- end }} - {{- with .Values.schedulerName }} - schedulerName: {{ . | quote }} - {{- end }} - containers: - - name: {{ .Values.controller.containerName | default "controller" }} - securityContext: - runAsUser: 65532 - runAsGroup: 65532 - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - image: {{ include "karpenter.controller.image" . }} - imagePullPolicy: {{ .Values.imagePullPolicy }} - env: - - name: KUBERNETES_MIN_VERSION - value: "1.19.0-0" - - name: KARPENTER_SERVICE - value: {{ include "karpenter.fullname" . }} - {{- with .Values.logLevel }} - - name: LOG_LEVEL - value: "{{ . }}" - {{- end }} - {{- with .Values.logOutputPaths }} - - name: LOG_OUTPUT_PATHS - value: "{{ join "," . }}" - {{- end }} - {{- with .Values.logErrorOutputPaths }} - - name: LOG_ERROR_OUTPUT_PATHS - value: "{{ join "," . }}" - {{- end }} - - name: METRICS_PORT - value: "{{ .Values.controller.metrics.port }}" - - name: HEALTH_PROBE_PORT - value: "{{ .Values.controller.healthProbe.port }}" - - name: SYSTEM_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: MEMORY_LIMIT - valueFrom: - resourceFieldRef: - containerName: controller - divisor: "0" - resource: limits.memory - - name: FEATURE_GATES - value: "SpotToSpotConsolidation={{ .Values.settings.featureGates.spotToSpotConsolidation }},NodeRepair={{ .Values.settings.featureGates.nodeRepair }}" - {{- with .Values.settings.batchMaxDuration }} - - name: BATCH_MAX_DURATION - value: "{{ . }}" - {{- end }} - {{- with .Values.settings.batchIdleDuration }} - - name: BATCH_IDLE_DURATION - value: "{{ . }}" - {{- end }} - {{- with .Values.settings.clusterCABundle }} - - name: CLUSTER_CA_BUNDLE - value: "{{ . }}" - {{- end }} - {{- with .Values.settings.clusterName }} - - name: CLUSTER_NAME - value: "{{ . }}" - {{- end }} - {{- with .Values.settings.clusterEndpoint }} - - name: CLUSTER_ENDPOINT - value: "{{ . }}" - {{- end }} - {{- with .Values.settings.isolatedVPC }} - - name: ISOLATED_VPC - value: "{{ . }}" - {{- end }} - {{- with .Values.settings.eksControlPlane }} - - name: EKS_CONTROL_PLANE - value: "{{ . }}" - {{- end }} - {{- with .Values.settings.vmMemoryOverheadPercent }} - - name: VM_MEMORY_OVERHEAD_PERCENT - value: "{{ . }}" - {{- end }} - {{- with .Values.settings.interruptionQueue }} - - name: INTERRUPTION_QUEUE - value: "{{ . }}" - {{- end }} - {{- with .Values.settings.reservedENIs }} - - name: RESERVED_ENIS - value: "{{ . }}" - {{- end }} - {{- with .Values.controller.env }} - {{- toYaml . | nindent 12 }} - {{- end }} - {{- with .Values.controller.envFrom }} - envFrom: - {{- toYaml . | nindent 12 }} - {{- end }} - ports: - - name: http-metrics - containerPort: {{ .Values.controller.metrics.port }} - protocol: TCP - - name: http - containerPort: {{ .Values.controller.healthProbe.port }} - protocol: TCP - livenessProbe: - initialDelaySeconds: 30 - timeoutSeconds: 30 - httpGet: - path: /healthz - port: http - readinessProbe: - initialDelaySeconds: 5 - timeoutSeconds: 30 - httpGet: - path: /readyz - port: http - {{- with .Values.controller.resources }} - resources: - {{- toYaml . | nindent 12 }} - {{- end }} - {{- if .Values.controller.extraVolumeMounts }} - volumeMounts: - {{- with .Values.controller.extraVolumeMounts }} - {{- toYaml . | nindent 12 }} - {{- end }} - {{- end }} - {{- with .Values.controller.sidecarContainer }} - {{- toYaml . | nindent 8 }} - {{- end }} - {{- if and (.Values.controller.sidecarContainer) (or .Values.controller.extraVolumeMounts .Values.controller.sidecarVolumeMounts) }} - volumeMounts: - {{- with .Values.controller.extraVolumeMounts }} - {{- toYaml . | nindent 12 }} - {{- end }} - {{- with .Values.controller.sidecarVolumeMounts }} - {{- toYaml . | nindent 12 }} - {{- end }} - {{- end }} - {{- with .Values.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.affinity }} - # The template below patches the .Values.affinity to add a default label selector where not specificed - {{- $_ := include "karpenter.patchAffinity" $ }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.topologySpreadConstraints }} - # The template below patches the .Values.topologySpreadConstraints to add a default label selector where not specificed - {{- $_ := include "karpenter.patchTopologySpreadConstraints" $ }} - topologySpreadConstraints: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- if .Values.extraVolumes }} - volumes: - {{- with .Values.extraVolumes }} - {{- toYaml . | nindent 8 }} - {{- end }} - {{- end }} diff --git a/charts/devtron-utilities/charts/karpenter/templates/poddisruptionbudget.yaml b/charts/devtron-utilities/charts/karpenter/templates/poddisruptionbudget.yaml deleted file mode 100644 index a5a55cadf..000000000 --- a/charts/devtron-utilities/charts/karpenter/templates/poddisruptionbudget.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: {{ include "karpenter.pdb.apiVersion" . }} -kind: PodDisruptionBudget -metadata: - name: {{ .Values.podDisruptionBudget.name }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "karpenter.labels" . | nindent 4 }} - {{- with .Values.additionalAnnotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -spec: - maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }} - selector: - matchLabels: - {{- include "karpenter.selectorLabels" . | nindent 6 }} diff --git a/charts/devtron-utilities/charts/karpenter/templates/role.yaml b/charts/devtron-utilities/charts/karpenter/templates/role.yaml deleted file mode 100644 index 2be091815..000000000 --- a/charts/devtron-utilities/charts/karpenter/templates/role.yaml +++ /dev/null @@ -1,45 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ include "karpenter.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "karpenter.labels" . | nindent 4 }} - {{- with .Values.additionalAnnotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -rules: - # Read - - apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["get", "watch"] - # Write - - apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["patch", "update"] - resourceNames: - - "karpenter-leader-election" - # Cannot specify resourceNames on create - # https://kubernetes.io/docs/reference/access-authn-authz/rbac/#referring-to-resources - - apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["create"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ include "karpenter.fullname" . }}-dns - namespace: kube-system - labels: - {{- include "karpenter.labels" . | nindent 4 }} - {{- with .Values.additionalAnnotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -rules: - # Read - - apiGroups: [""] - resources: ["services"] - resourceNames: ["kube-dns"] - verbs: ["get"] diff --git a/charts/devtron-utilities/charts/karpenter/templates/rolebinding.yaml b/charts/devtron-utilities/charts/karpenter/templates/rolebinding.yaml deleted file mode 100644 index ba54e1830..000000000 --- a/charts/devtron-utilities/charts/karpenter/templates/rolebinding.yaml +++ /dev/null @@ -1,39 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ include "karpenter.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "karpenter.labels" . | nindent 4 }} - {{- with .Values.additionalAnnotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ include "karpenter.fullname" . }} -subjects: - - kind: ServiceAccount - name: {{ template "karpenter.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ include "karpenter.fullname" . }}-dns - namespace: kube-system - labels: - {{- include "karpenter.labels" . | nindent 4 }} - {{- with .Values.additionalAnnotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ include "karpenter.fullname" . }}-dns -subjects: - - kind: ServiceAccount - name: {{ template "karpenter.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} \ No newline at end of file diff --git a/charts/devtron-utilities/charts/karpenter/templates/service.yaml b/charts/devtron-utilities/charts/karpenter/templates/service.yaml deleted file mode 100644 index 694265c89..000000000 --- a/charts/devtron-utilities/charts/karpenter/templates/service.yaml +++ /dev/null @@ -1,25 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ include "karpenter.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "karpenter.labels" . | nindent 4 }} - {{- if or .Values.additionalAnnotations .Values.service.annotations }} - annotations: - {{- with .Values.additionalAnnotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.service.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} -spec: - type: ClusterIP - ports: - - name: http-metrics - port: {{ .Values.controller.metrics.port }} - targetPort: http-metrics - protocol: TCP - selector: - {{- include "karpenter.selectorLabels" . | nindent 4 }} diff --git a/charts/devtron-utilities/charts/karpenter/templates/serviceaccount.yaml b/charts/devtron-utilities/charts/karpenter/templates/serviceaccount.yaml deleted file mode 100644 index 0141afc29..000000000 --- a/charts/devtron-utilities/charts/karpenter/templates/serviceaccount.yaml +++ /dev/null @@ -1,18 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "karpenter.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "karpenter.labels" . | nindent 4 }} - {{- if or .Values.additionalAnnotations .Values.serviceAccount.annotations }} - annotations: - {{- with .Values.additionalAnnotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.serviceAccount.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} -{{- end -}} diff --git a/charts/devtron-utilities/charts/karpenter/templates/servicemonitor.yaml b/charts/devtron-utilities/charts/karpenter/templates/servicemonitor.yaml deleted file mode 100644 index 70f07608f..000000000 --- a/charts/devtron-utilities/charts/karpenter/templates/servicemonitor.yaml +++ /dev/null @@ -1,29 +0,0 @@ -{{- if.Values.serviceMonitor.enabled -}} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ include "karpenter.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "karpenter.labels" . | nindent 4 }} - {{- with .Values.serviceMonitor.additionalLabels }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.additionalAnnotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -spec: - namespaceSelector: - matchNames: - - {{ .Release.Namespace }} - selector: - matchLabels: - {{- include "karpenter.selectorLabels" . | nindent 6 }} - endpoints: - - port: http-metrics - path: /metrics - {{- with .Values.serviceMonitor.endpointConfig }} - {{- toYaml . | nindent 6 }} - {{- end }} -{{- end -}} diff --git a/charts/devtron-utilities/charts/karpenter/values.yaml b/charts/devtron-utilities/charts/karpenter/values.yaml deleted file mode 100644 index b16c3b1ee..000000000 --- a/charts/devtron-utilities/charts/karpenter/values.yaml +++ /dev/null @@ -1,192 +0,0 @@ -# -- Overrides the chart's name. -nameOverride: "" -# -- Overrides the chart's computed fullname. -fullnameOverride: "" -# -- Additional labels to add into metadata. -additionalLabels: {} -# app: karpenter - -# -- Additional annotations to add into metadata. -additionalAnnotations: {} -# -- Image pull policy for Docker images. -imagePullPolicy: IfNotPresent -# -- Image pull secrets for Docker images. -imagePullSecrets: [] -service: - # -- Additional annotations for the Service. - annotations: {} -serviceAccount: - # -- Specifies if a ServiceAccount should be created. - create: true - # -- The name of the ServiceAccount to use. - # If not set and create is true, a name is generated using the fullname template. - name: "" - # -- Additional annotations for the ServiceAccount. - annotations: {} -# -- Specifies additional rules for the core ClusterRole. -additionalClusterRoleRules: [] -serviceMonitor: - # -- Specifies whether a ServiceMonitor should be created. - enabled: false - # -- Additional labels for the ServiceMonitor. - additionalLabels: {} - # -- Configuration on `http-metrics` endpoint for the ServiceMonitor. - # Not to be used to add additional endpoints. - # See the Prometheus operator documentation for configurable fields https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#endpoint - endpointConfig: {} -# -- Number of replicas. -replicas: 2 -# -- The number of old ReplicaSets to retain to allow rollback. -revisionHistoryLimit: 10 -# -- Strategy for updating the pod. -strategy: - rollingUpdate: - maxUnavailable: 1 -# -- Additional labels for the pod. -podLabels: {} -# -- Additional annotations for the pod. -podAnnotations: {} -podDisruptionBudget: - name: karpenter - maxUnavailable: 1 -# -- SecurityContext for the pod. -podSecurityContext: - fsGroup: 65532 -# -- PriorityClass name for the pod. -priorityClassName: system-cluster-critical -# -- Override the default termination grace period for the pod. -terminationGracePeriodSeconds: -# -- Bind the pod to the host network. -# This is required when using a custom CNI. -hostNetwork: false -# -- Specify which Kubernetes scheduler should dispatch the pod. -schedulerName: default-scheduler -# -- Configure the DNS Policy for the pod -dnsPolicy: ClusterFirst -# -- Configure DNS Config for the pod -dnsConfig: {} -# options: -# - name: ndots -# value: "1" -# -- Node selectors to schedule the pod to nodes with labels. -nodeSelector: - kubernetes.io/os: linux -# -- Affinity rules for scheduling the pod. If an explicit label selector is not provided for pod affinity or pod anti-affinity one will be created from the pod selector labels. -affinity: - nodeAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - nodeSelectorTerms: - - matchExpressions: - - key: karpenter.sh/nodepool - operator: DoesNotExist - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - topologyKey: "kubernetes.io/hostname" -# -- Topology spread constraints to increase the controller resilience by distributing pods across the cluster zones. If an explicit label selector is not provided one will be created from the pod selector labels. -topologySpreadConstraints: - - maxSkew: 1 - topologyKey: topology.kubernetes.io/zone - whenUnsatisfiable: DoNotSchedule -# -- Tolerations to allow the pod to be scheduled to nodes with taints. -tolerations: - - key: CriticalAddonsOnly - operator: Exists -# -- Additional volumes for the pod. -extraVolumes: [] -# - name: aws-iam-token -# projected: -# defaultMode: 420 -# sources: -# - serviceAccountToken: -# audience: sts.amazonaws.com -# expirationSeconds: 86400 -# path: token -controller: - # -- Distinguishing container name (containerName: karpenter-controller). - containerName: controller - image: - # -- Repository path to the controller image. - repository: public.ecr.aws/karpenter/controller - # -- Tag of the controller image. - tag: 1.2.1 - # -- SHA256 digest of the controller image. - digest: sha256:6d771157293958fdf58ea64613e6fb5f3854ed5bebe68fdb457259e29ee68b43 - # -- Additional environment variables for the controller pod. - env: [] - # - name: AWS_REGION - # value: eu-west-1 - envFrom: [] - # -- Resources for the controller pod. - resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # requests: - # cpu: 1 - # memory: 1Gi - # limits: - # cpu: 1 - # memory: 1Gi - - # -- Additional volumeMounts for the controller pod. - extraVolumeMounts: [] - # - name: aws-iam-token - # mountPath: /var/run/secrets/eks.amazonaws.com/serviceaccount - # readOnly: true - # -- Additional sidecarContainer config - sidecarContainer: [] - # -- Additional volumeMounts for the sidecar - this will be added to the volume mounts on top of extraVolumeMounts - sidecarVolumeMounts: [] - metrics: - # -- The container port to use for metrics. - port: 8080 - healthProbe: - # -- The container port to use for http health probe. - port: 8081 -# -- Global log level, defaults to 'info' -logLevel: info -# -- Log outputPaths - defaults to stdout only -logOutputPaths: - - stdout -# -- Log errorOutputPaths - defaults to stderr only -logErrorOutputPaths: - - stderr -# -- Global Settings to configure Karpenter -settings: - # -- The maximum length of a batch window. The longer this is, the more pods we can consider for provisioning at one - # time which usually results in fewer but larger nodes. - batchMaxDuration: 10s - # -- The maximum amount of time with no new ending pods that if exceeded ends the current batching window. If pods arrive - # faster than this time, the batching window will be extended up to the maxDuration. If they arrive slower, the pods - # will be batched separately. - batchIdleDuration: 1s - # -- Cluster CA bundle for TLS configuration of provisioned nodes. If not set, this is taken from the controller's TLS configuration for the API server. - clusterCABundle: "" - # -- Cluster name. - clusterName: "" - # -- Cluster endpoint. If not set, will be discovered during startup (EKS only) - clusterEndpoint: "" - # -- If true then assume we can't reach AWS services which don't have a VPC endpoint - # This also has the effect of disabling look-ups to the AWS pricing endpoint - isolatedVPC: false - # Marking this true means that your cluster is running with an EKS control plane and Karpenter should attempt to discover cluster details from the DescribeCluster API - eksControlPlane: false - # -- The VM memory overhead as a percent that will be subtracted from the total memory for all instance types. The value of `0.075` equals to 7.5%. - vmMemoryOverheadPercent: 0.075 - # -- Interruption queue is the name of the SQS queue used for processing interruption events from EC2 - # Interruption handling is disabled if not specified. Enabling interruption handling may - # require additional permissions on the controller service account. Additional permissions are outlined in the docs. - interruptionQueue: "" - # -- Reserved ENIs are not included in the calculations for max-pods or kube-reserved - # This is most often used in the VPC CNI custom networking setup https://docs.aws.amazon.com/eks/latest/userguide/cni-custom-network.html - reservedENIs: "0" - # -- Feature Gate configuration values. Feature Gates will follow the same graduation process and requirements as feature gates - # in Kubernetes. More information here https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/#feature-gates-for-alpha-or-beta-features - featureGates: - # -- spotToSpotConsolidation is ALPHA and is disabled by default. - # Setting this to true will enable spot replacement consolidation for both single and multi-node consolidation. - spotToSpotConsolidation: false - # -- nodeRepair is ALPHA and is disabled by default. - # Setting this to true will enable node repair. - nodeRepair: false diff --git a/charts/devtron-utilities/charts/kcert/Chart.yaml b/charts/devtron-utilities/charts/kcert/Chart.yaml deleted file mode 100644 index 3f0b76080..000000000 --- a/charts/devtron-utilities/charts/kcert/Chart.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: v2 -appVersion: 1.2.0 -description: Deploys KCert for issuing Let's Encrypt certificates -keywords: -- kubernetes -- letsencrypt -- ssl -maintainers: -- name: Nabeel Sulieman - url: https://nabeel.dev -name: kcert -sources: -- https://github.com/nabsul/kcert -version: 1.0.7 diff --git a/charts/devtron-utilities/charts/kcert/templates/020-ServiceAccount.yaml b/charts/devtron-utilities/charts/kcert/templates/020-ServiceAccount.yaml deleted file mode 100644 index 86b8b9420..000000000 --- a/charts/devtron-utilities/charts/kcert/templates/020-ServiceAccount.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ required "names.serviceAccount is required" .Values.names.serviceAccount }} - namespace: {{ .Release.Namespace | default "default" }} -{{- if .Values.forHelm }} - labels: - app.kubernetes.io/name: {{ .Chart.Name }} - helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/version: {{ .Chart.AppVersion }} - app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} diff --git a/charts/devtron-utilities/charts/kcert/templates/030-ClusterRole.yaml b/charts/devtron-utilities/charts/kcert/templates/030-ClusterRole.yaml deleted file mode 100644 index be55dd811..000000000 --- a/charts/devtron-utilities/charts/kcert/templates/030-ClusterRole.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ required "names.clusterRole is required" .Values.names.clusterRole }} -{{- if .Values.forHelm }} - labels: - app.kubernetes.io/name: {{ .Chart.Name }} - helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/version: {{ .Chart.AppVersion }} - app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} -rules: -- apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "list", "create", "update", "patch"] -- apiGroups: ["networking.k8s.io"] - resources: ["ingresses"] - verbs: ["get", "list", "watch"] -- apiGroups: [""] - resources: ["configmaps"] - verbs: ["get", "list", "watch"] diff --git a/charts/devtron-utilities/charts/kcert/templates/040-ClusterRoleBinding.yaml b/charts/devtron-utilities/charts/kcert/templates/040-ClusterRoleBinding.yaml deleted file mode 100644 index be1eb859c..000000000 --- a/charts/devtron-utilities/charts/kcert/templates/040-ClusterRoleBinding.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ required "names.clusterRoleBinding is required" .Values.names.clusterRoleBinding }} -{{- if .Values.forHelm }} - labels: - app.kubernetes.io/name: {{ .Chart.Name }} - helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/version: {{ .Chart.AppVersion }} - app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} -subjects: -- kind: ServiceAccount - name: {{ required "names.serviceAccount is required" .Values.names.serviceAccount }} - namespace: {{ .Release.Namespace | default "kcert" }} -roleRef: - kind: ClusterRole - name: {{ required "names.clusterRole is required" .Values.names.clusterRole }} - apiGroup: rbac.authorization.k8s.io diff --git a/charts/devtron-utilities/charts/kcert/templates/050-Role.yaml b/charts/devtron-utilities/charts/kcert/templates/050-Role.yaml deleted file mode 100644 index c14c727fc..000000000 --- a/charts/devtron-utilities/charts/kcert/templates/050-Role.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ required "names.role is required" .Values.names.role }} - namespace: {{ .Release.Namespace | default "default" }} -{{- if .Values.forHelm }} - labels: - app.kubernetes.io/name: {{ .Chart.Name }} - helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/version: {{ .Chart.AppVersion }} - app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} -rules: -- apiGroups: ["networking.k8s.io"] - resources: ["ingresses"] - verbs: ["get", "list", "create", "delete", "update", "patch"] diff --git a/charts/devtron-utilities/charts/kcert/templates/060-RoleBinding.yaml b/charts/devtron-utilities/charts/kcert/templates/060-RoleBinding.yaml deleted file mode 100644 index 666da36a1..000000000 --- a/charts/devtron-utilities/charts/kcert/templates/060-RoleBinding.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ required "names.role is required" .Values.names.role }} - namespace: {{ .Release.Namespace | default "default" }} -{{- if .Values.forHelm }} - labels: - app.kubernetes.io/name: {{ .Chart.Name }} - helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/version: {{ .Chart.AppVersion }} - app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} -subjects: -- kind: ServiceAccount - name: {{ required "names.serviceAccount is required" .Values.names.serviceAccount }} - namespace: {{ .Release.Namespace | default "default" }} -roleRef: - kind: Role - name: {{ required "names.role is required" .Values.names.role }} - apiGroup: rbac.authorization.k8s.io diff --git a/charts/devtron-utilities/charts/kcert/templates/065-Secret.yaml b/charts/devtron-utilities/charts/kcert/templates/065-Secret.yaml deleted file mode 100644 index 86114779d..000000000 --- a/charts/devtron-utilities/charts/kcert/templates/065-Secret.yaml +++ /dev/null @@ -1,18 +0,0 @@ -{{- if .Values.smtp.host }} -apiVersion: v1 -kind: Secret -type: Opaque -metadata: - name: {{ required "names.secret is required" .Values.names.secret }} - namespace: {{ .Release.Namespace | default "default" }} -{{- if .Values.forHelm }} - labels: - app.kubernetes.io/name: {{ .Chart.Name }} - helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/version: {{ .Chart.AppVersion }} - app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} -stringData: - password: {{ required "smtp.pass is required" .Values.smtp.pass }} -{{- end }} diff --git a/charts/devtron-utilities/charts/kcert/templates/070-Deployment.yaml b/charts/devtron-utilities/charts/kcert/templates/070-Deployment.yaml deleted file mode 100644 index 9d116dd4d..000000000 --- a/charts/devtron-utilities/charts/kcert/templates/070-Deployment.yaml +++ /dev/null @@ -1,83 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ required "names.deployment is required" .Values.names.deployment }} - namespace: {{ .Release.Namespace | default "default" }} - labels: - app: {{ required "names.app is required" .Values.names.app }} -{{- if .Values.forHelm }} - app.kubernetes.io/name: {{ .Chart.Name }} - helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/version: {{ .Chart.AppVersion }} - app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} -spec: - replicas: 1 - selector: - matchLabels: - app: {{ required "names.app is required" .Values.names.app }} - template: - metadata: - labels: - app: {{ required "names.app is required" .Values.names.app }} - spec: - serviceAccountName: {{ required "names.serviceAccount is required" .Values.names.serviceAccount }} - containers: - - name: kcert - image: {{ required "kcertImage is required" .Values.kcertImage }} - ports: - - containerPort: 80 - name: http - - containerPort: 8080 - name: http-admin - {{- if .Values.resources }} - resources: - {{- toYaml .Values.resources | nindent 10 }} - {{- end }} - env: - - name: KCERT__NAMESPACE - value: {{ .Release.Namespace | default "default" }} - - name: ACME__DIRURL - # https://acme-staging-v02.api.letsencrypt.org/directory or https://acme-v02.api.letsencrypt.org/directory - value: {{ required "acmeDirUrl is required" .Values.acmeDirUrl }} - - name: ACME__TERMSACCEPTED - # You must set this to "true" to indicate your acceptance of Let's Encrypt's terms of service (https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf) - value: {{ required "acmeTermsAccepted is required" .Values.acmeTermsAccepted | quote }} - - name: ACME__EMAIL - # Your email address for Let's Encrypt and email notifications - value: {{ required "acmeEmail is required" .Values.acmeEmail }} -{{- if .Values.smtp.host }} - - name: SMTP__EMAILFROM - value: {{ required "smtp.email is required" .Values.smtp.email }} - - name: SMTP__HOST - value: {{ required "smtp.email is required" .Values.smtp.host }} - - name: SMTP__PORT - value: "{{ required "smtp.email is required" .Values.smtp.port }}" - - name: SMTP__USER - value: {{ required "smtp.email is required" .Values.smtp.user }} - - name: SMTP__PASS - valueFrom: - secretKeyRef: - name: {{ .Values.names.secret }} - key: password -{{- end }} -{{- if .Values.acmeKey.secretName }} - - name: ACME__KEY - valueFrom: - secretKeyRef: - name: "{{ .Values.acmeKey.secretName }}" - key: "{{ .Values.acmeKey.keyName }}" -{{- end }} -{{- if .Values.showRenewButton }} - - name: KCERT__SHOWRENEWBUTTON - value: "{{ .Values.showRenewButton }}" -{{- end }} -{{- range $key, $value := .Values.env }} - - name: "{{ $key }}" - value: "{{ $value }}" -{{- end }} - - - - diff --git a/charts/devtron-utilities/charts/kcert/templates/080-Service.yaml b/charts/devtron-utilities/charts/kcert/templates/080-Service.yaml deleted file mode 100644 index a4aa48568..000000000 --- a/charts/devtron-utilities/charts/kcert/templates/080-Service.yaml +++ /dev/null @@ -1,26 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ required "names.service is required" .Values.names.service }} - namespace: {{ .Release.Namespace | default "default" }} - labels: - app: kcert -{{- if .Values.forHelm }} - app.kubernetes.io/name: {{ .Chart.Name }} - helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/version: {{ .Chart.AppVersion }} - app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} -spec: - ports: - - name: http - protocol: TCP - port: 80 - targetPort: 80 - - name: http-admin - protocol: TCP - port: 8080 - targetPort: 8080 - selector: - app: {{ required "names.app is required" .Values.names.app }} diff --git a/charts/devtron-utilities/charts/kcert/templates/NOTES.txt b/charts/devtron-utilities/charts/kcert/templates/NOTES.txt deleted file mode 100644 index 60e518b05..000000000 --- a/charts/devtron-utilities/charts/kcert/templates/NOTES.txt +++ /dev/null @@ -1,4 +0,0 @@ -Congratulations! kcert should now be setup and running in your cluster. - -You can check out the dashboard by running `kubectl -n {{ .Release.Namespace | default "default" }} port-forward svc/{{ .Values.names.service }} 8080` -and then opening http://localhost:8080 in your browser. diff --git a/charts/devtron-utilities/charts/kcert/values.yaml b/charts/devtron-utilities/charts/kcert/values.yaml deleted file mode 100644 index 0f9b23e44..000000000 --- a/charts/devtron-utilities/charts/kcert/values.yaml +++ /dev/null @@ -1,35 +0,0 @@ -acmeDirUrl: https://acme-staging-v02.api.letsencrypt.org/directory -acmeEmail: null -acmeTermsAccepted: false -kcertImage: nabsul/kcert:v1.2.0 - -env: {} - -acmeKey: - secretName: null - keyName: key - -showRenewButton: null - -smtp: - email: null - host: null - port: null - user: null - pass: null - -names: - serviceAccount: kcert - clusterRole: kcert - clusterRoleBinding: kcert - role: kcert - roleBinding: kcert - secret: kcert-smtp - deployment: kcert - service: kcert - app: kcert - -resources: {} - -# Set this to false in order to generate a plain yaml template without the Helm custom labels -forHelm: true diff --git a/charts/devtron-utilities/charts/minio/.helmignore b/charts/devtron-utilities/charts/minio/.helmignore deleted file mode 100644 index a9fe72788..000000000 --- a/charts/devtron-utilities/charts/minio/.helmignore +++ /dev/null @@ -1,23 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -# OWNERS file for Kubernetes -OWNERS \ No newline at end of file diff --git a/charts/devtron-utilities/charts/minio/Chart.yaml b/charts/devtron-utilities/charts/minio/Chart.yaml deleted file mode 100644 index 827787ea7..000000000 --- a/charts/devtron-utilities/charts/minio/Chart.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: v1 -appVersion: RELEASE.2024-12-18T13-15-44Z -description: High Performance Object Storage -home: https://min.io -icon: https://min.io/resources/img/logo/MINIO_wordmark.png -keywords: -- minio -- storage -- object-storage -- s3 -- cluster -maintainers: -- email: dev@minio.io - name: MinIO, Inc -name: minio -sources: -- https://github.com/minio/minio -version: 5.4.0 diff --git a/charts/devtron-utilities/charts/minio/README.md b/charts/devtron-utilities/charts/minio/README.md deleted file mode 100644 index a1d5c99f8..000000000 --- a/charts/devtron-utilities/charts/minio/README.md +++ /dev/null @@ -1,264 +0,0 @@ -# MinIO Community Helm Chart - -[![Slack](https://slack.min.io/slack?type=svg)](https://slack.min.io) [![license](https://img.shields.io/badge/license-AGPL%20V3-blue)](https://github.com/minio/minio/blob/master/LICENSE) - -MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. It is API compatible with Amazon S3 cloud storage service. Use MinIO to build high performance infrastructure for machine learning, analytics and application data workloads. - -| IMPORTANT | -| -------------------------- | -| This Helm chart is community built, maintained, and supported. MinIO does not guarantee support for any given bug, feature request, or update referencing this chart.

MinIO publishes a separate [MinIO Kubernetes Operator and Tenant Helm Chart](https://github.com/minio/operator/tree/master/helm) that is officially maintained and supported. MinIO strongly recommends using the MinIO Kubernetes Operator for production deployments. See [Deploy Operator With Helm](https://min.io/docs/minio/kubernetes/upstream/operations/install-deploy-manage/deploy-operator-helm.html?ref=github) for additional documentation. | - -## Introduction - -This chart bootstraps MinIO Cluster on [Kubernetes](http://kubernetes.io) using the [Helm](https://helm.sh) package manager. - -## Prerequisites - -- Helm cli with Kubernetes cluster configured. -- PV provisioner support in the underlying infrastructure. (We recommend using ) -- Use Kubernetes version v1.19 and later for best experience. - -## Configure MinIO Helm repo - -```bash -helm repo add minio https://charts.min.io/ -``` - -### Installing the Chart - -Install this chart using: - -```bash -helm install --namespace minio --set rootUser=rootuser,rootPassword=rootpass123 --generate-name minio/minio -``` - -The command deploys MinIO on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation. - -### Installing the Chart (toy-setup) - -Minimal toy setup for testing purposes can be deployed using: - -```bash -helm install --set resources.requests.memory=512Mi --set replicas=1 --set persistence.enabled=false --set mode=standalone --set rootUser=rootuser,rootPassword=rootpass123 --generate-name minio/minio -``` - -### Upgrading the Chart - -You can use Helm to update MinIO version in a live release. Assuming your release is named as `my-release`, get the values using the command: - -```bash -helm get values my-release > old_values.yaml -``` - -Then change the field `image.tag` in `old_values.yaml` file with MinIO image tag you want to use. Now update the chart using - -```bash -helm upgrade -f old_values.yaml my-release minio/minio -``` - -Default upgrade strategies are specified in the `values.yaml` file. Update these fields if you'd like to use a different strategy. - -### Configuration - -Refer the [Values file](./values.yaml) for all the possible config fields. - -You can specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, - -```bash -helm install --name my-release --set persistence.size=1Ti minio/minio -``` - -The above command deploys MinIO server with a 1Ti backing persistent volume. - -Alternately, you can provide a YAML file that specifies parameter values while installing the chart. For example, - -```bash -helm install --name my-release -f values.yaml minio/minio -``` - -### Persistence - -This chart provisions a PersistentVolumeClaim and mounts corresponding persistent volume to default location `/export`. You'll need physical storage available in the Kubernetes cluster for this to work. If you'd rather use `emptyDir`, disable PersistentVolumeClaim by: - -```bash -helm install --set persistence.enabled=false minio/minio -``` - -> *"An emptyDir volume is first created when a Pod is assigned to a Node, and exists as long as that Pod is running on that node. When a Pod is removed from a node for any reason, the data in the emptyDir is deleted forever."* - -### Existing PersistentVolumeClaim - -If a Persistent Volume Claim already exists, specify it during installation. - -1. Create the PersistentVolume -2. Create the PersistentVolumeClaim -3. Install the chart - -```bash -helm install --set persistence.existingClaim=PVC_NAME minio/minio -``` - -### NetworkPolicy - -To enable network policy for MinIO, -install [a networking plugin that implements the Kubernetes -NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin), -and set `networkPolicy.enabled` to `true`. - -For Kubernetes v1.5 & v1.6, you must also turn on NetworkPolicy by setting -the DefaultDeny namespace annotation. Note: this will enforce policy for *all* pods in the namespace: - -``` -kubectl annotate namespace default "net.beta.kubernetes.io/network-policy={\"ingress\":{\"isolation\":\"DefaultDeny\"}}" -``` - -When using `Cilium` as a CNI in your cluster, please edit the `flavor` field to `cilium`. - -With NetworkPolicy enabled, traffic will be limited to just port 9000. - -For more precise policy, set `networkPolicy.allowExternal=true`. This will -only allow pods with the generated client label to connect to MinIO. -This label will be displayed in the output of a successful install. - -### Existing secret - -Instead of having this chart create the secret for you, you can supply a preexisting secret, much -like an existing PersistentVolumeClaim. - -First, create the secret: - -```bash -kubectl create secret generic my-minio-secret --from-literal=rootUser=foobarbaz --from-literal=rootPassword=foobarbazqux -``` - -Then install the chart, specifying that you want to use an existing secret: - -```bash -helm install --set existingSecret=my-minio-secret minio/minio -``` - -The following fields are expected in the secret: - -| .data.\ in Secret | Corresponding variable | Description | Required | -|:------------------------|:-----------------------|:---------------|:---------| -| `rootUser` | `rootUser` | Root user. | yes | -| `rootPassword` | `rootPassword` | Root password. | yes | - -All corresponding variables will be ignored in values file. - -### Configure TLS - -To enable TLS for MinIO containers, acquire TLS certificates from a CA or create self-signed certificates. While creating / acquiring certificates ensure the corresponding domain names are set as per the standard [DNS naming conventions](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-identity) in a Kubernetes StatefulSet (for a distributed MinIO setup). Then create a secret using - -```bash -kubectl create secret generic tls-ssl-minio --from-file=path/to/private.key --from-file=path/to/public.crt -``` - -Then install the chart, specifying that you want to use the TLS secret: - -```bash -helm install --set tls.enabled=true,tls.certSecret=tls-ssl-minio minio/minio -``` - -### Installing certificates from third party CAs - -MinIO can connect to other servers, including MinIO nodes or other server types such as NATs and Redis. If these servers use certificates that were not registered with a known CA, add trust for these certificates to MinIO Server by bundling these certificates into a Kubernetes secret and providing it to Helm via the `trustedCertsSecret` value. If `.Values.tls.enabled` is `true` and you're installing certificates for third party CAs, remember to include MinIO's own certificate with key `public.crt`, if it also needs to be trusted. - -For instance, given that TLS is enabled and you need to add trust for MinIO's own CA and for the CA of a Keycloak server, a Kubernetes secret can be created from the certificate files using `kubectl`: - -``` -kubectl -n minio create secret generic minio-trusted-certs --from-file=public.crt --from-file=keycloak.crt -``` - -If TLS is not enabled, you would need only the third party CA: - -``` -kubectl -n minio create secret generic minio-trusted-certs --from-file=keycloak.crt -``` - -The name of the generated secret can then be passed to Helm using a values file or the `--set` parameter: - -``` -trustedCertsSecret: "minio-trusted-certs" - -or - ---set trustedCertsSecret=minio-trusted-certs -``` - -### Create buckets after install - -Install the chart, specifying the buckets you want to create after install: - -```bash -helm install --set buckets[0].name=bucket1,buckets[0].policy=none,buckets[0].purge=false minio/minio -``` - -Description of the configuration parameters used above - - -- `buckets[].name` - name of the bucket to create, must be a string with length > 0 -- `buckets[].policy` - can be one of none|download|upload|public -- `buckets[].purge` - purge if bucket exists already - -### Create policies after install - -Install the chart, specifying the policies you want to create after install: - -```bash -helm install --set policies[0].name=mypolicy,policies[0].statements[0].resources[0]='arn:aws:s3:::bucket1',policies[0].statements[0].actions[0]='s3:ListBucket',policies[0].statements[0].actions[1]='s3:GetObject' minio/minio -``` - -Description of the configuration parameters used above - - -- `policies[].name` - name of the policy to create, must be a string with length > 0 -- `policies[].statements[]` - list of statements, includes actions and resources -- `policies[].statements[].resources[]` - list of resources that applies the statement -- `policies[].statements[].actions[]` - list of actions granted - -### Create user after install - -Install the chart, specifying the users you want to create after install: - -```bash -helm install --set users[0].accessKey=accessKey,users[0].secretKey=secretKey,users[0].policy=none,users[1].accessKey=accessKey2,users[1].secretRef=existingSecret,users[1].secretKey=password,users[1].policy=none minio/minio -``` - -Description of the configuration parameters used above - - -- `users[].accessKey` - accessKey of user -- `users[].secretKey` - secretKey of usersecretRef -- `users[].existingSecret` - secret name that contains the secretKey of user -- `users[].existingSecretKey` - data key in existingSecret secret containing the secretKey -- `users[].policy` - name of the policy to assign to user - -### Create service account after install - -Install the chart, specifying the service accounts you want to create after install: - -```bash -helm install --set svcaccts[0].accessKey=accessKey,svcaccts[0].secretKey=secretKey,svcaccts[0].user=parentUser,svcaccts[1].accessKey=accessKey2,svcaccts[1].secretRef=existingSecret,svcaccts[1].secretKey=password,svcaccts[1].user=parentUser2 minio/minio -``` - -Description of the configuration parameters used above - - -- `svcaccts[].accessKey` - accessKey of service account -- `svcaccts[].secretKey` - secretKey of svcacctsecretRef -- `svcaccts[].existingSecret` - secret name that contains the secretKey of service account -- `svcaccts[].existingSecretKey` - data key in existingSecret secret containing the secretKey -- `svcaccts[].user` - name of the parent user to assign to service account - -## Uninstalling the Chart - -Assuming your release is named as `my-release`, delete it using the command: - -```bash -helm delete my-release -``` - -or - -```bash -helm uninstall my-release -``` - -The command removes all the Kubernetes components associated with the chart and deletes the release. diff --git a/charts/devtron-utilities/charts/minio/templates/NOTES.txt b/charts/devtron-utilities/charts/minio/templates/NOTES.txt deleted file mode 100644 index ba51b4c6c..000000000 --- a/charts/devtron-utilities/charts/minio/templates/NOTES.txt +++ /dev/null @@ -1,43 +0,0 @@ -{{- if eq .Values.service.type "ClusterIP" "NodePort" }} -MinIO can be accessed via port {{ .Values.service.port }} on the following DNS name from within your cluster: -{{ template "minio.fullname" . }}.{{ .Release.Namespace }}.{{ .Values.clusterDomain }} - -To access MinIO from localhost, run the below commands: - - 1. export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") - - 2. kubectl port-forward $POD_NAME 9000 --namespace {{ .Release.Namespace }} - -Read more about port forwarding here: http://kubernetes.io/docs/user-guide/kubectl/kubectl_port-forward/ - -You can now access MinIO server on http://localhost:9000. Follow the below steps to connect to MinIO server with mc client: - - 1. Download the MinIO mc client - https://min.io/docs/minio/linux/reference/minio-mc.html#quickstart - - 2. export MC_HOST_{{ template "minio.fullname" . }}-local=http://$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "minio.secretName" . }} -o jsonpath="{.data.rootUser}" | base64 --decode):$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "minio.secretName" . }} -o jsonpath="{.data.rootPassword}" | base64 --decode)@localhost:{{ .Values.service.port }} - - 3. mc ls {{ template "minio.fullname" . }}-local - -{{- end }} -{{- if eq .Values.service.type "LoadBalancer" }} -MinIO can be accessed via port {{ .Values.service.port }} on an external IP address. Get the service external IP address by: -kubectl get svc --namespace {{ .Release.Namespace }} -l app={{ template "minio.fullname" . }} - -Note that the public IP may take a couple of minutes to be available. - -You can now access MinIO server on http://:9000. Follow the below steps to connect to MinIO server with mc client: - - 1. Download the MinIO mc client - https://min.io/docs/minio/linux/reference/minio-mc.html#quickstart - - 2. export MC_HOST_{{ template "minio.fullname" . }}-local=http://$(kubectl get secret {{ template "minio.secretName" . }} --namespace {{ .Release.Namespace }} -o jsonpath="{.data.rootUser}" | base64 --decode):$(kubectl get secret {{ template "minio.secretName" . }} -o jsonpath="{.data.rootPassword}" | base64 --decode)@:{{ .Values.service.port }} - - 3. mc ls {{ template "minio.fullname" . }} - -Alternately, you can use your browser or the MinIO SDK to access the server - https://min.io/docs/minio/linux/reference/minio-server/minio-server.html -{{- end }} - -{{ if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }} -Note: Since NetworkPolicy is enabled, only pods with label -{{ template "minio.fullname" . }}-client=true" -will be able to connect to this minio cluster. -{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/_helper_create_bucket.txt b/charts/devtron-utilities/charts/minio/templates/_helper_create_bucket.txt deleted file mode 100644 index 83b8dcb2d..000000000 --- a/charts/devtron-utilities/charts/minio/templates/_helper_create_bucket.txt +++ /dev/null @@ -1,122 +0,0 @@ -#!/bin/sh -set -e # Have script exit in the event of a failed command. - -{{- if .Values.configPathmc }} -MC_CONFIG_DIR="{{ .Values.configPathmc }}" -MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}" -{{- else }} -MC="/usr/bin/mc --insecure" -{{- end }} - -# connectToMinio -# Use a check-sleep-check loop to wait for MinIO service to be available -connectToMinio() { - SCHEME=$1 - ATTEMPTS=0 - LIMIT=29 # Allow 30 attempts - set -e # fail if we can't read the keys. - ACCESS=$(cat /config/rootUser) - SECRET=$(cat /config/rootPassword) - set +e # The connections to minio are allowed to fail. - echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" - MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" - $MC_COMMAND - STATUS=$? - until [ $STATUS = 0 ]; do - ATTEMPTS=$(expr $ATTEMPTS + 1) - echo \"Failed attempts: $ATTEMPTS\" - if [ $ATTEMPTS -gt $LIMIT ]; then - exit 1 - fi - sleep 2 # 1 second intervals between attempts - $MC_COMMAND - STATUS=$? - done - set -e # reset `e` as active - return 0 -} - -# checkBucketExists ($bucket) -# Check if the bucket exists, by using the exit code of `mc ls` -checkBucketExists() { - BUCKET=$1 - CMD=$(${MC} stat myminio/$BUCKET >/dev/null 2>&1) - return $? -} - -# createBucket ($bucket, $policy, $purge) -# Ensure bucket exists, purging if asked to -createBucket() { - BUCKET=$1 - POLICY=$2 - PURGE=$3 - VERSIONING=$4 - OBJECTLOCKING=$5 - - # Purge the bucket, if set & exists - # Since PURGE is user input, check explicitly for `true` - if [ $PURGE = true ]; then - if checkBucketExists $BUCKET; then - echo "Purging bucket '$BUCKET'." - set +e # don't exit if this fails - ${MC} rm -r --force myminio/$BUCKET - set -e # reset `e` as active - else - echo "Bucket '$BUCKET' does not exist, skipping purge." - fi - fi - - # Create the bucket if it does not exist and set objectlocking if enabled (NOTE: versioning will be not changed if OBJECTLOCKING is set because it enables versioning to the Buckets created) - if ! checkBucketExists $BUCKET; then - if [ ! -z $OBJECTLOCKING ]; then - if [ $OBJECTLOCKING = true ]; then - echo "Creating bucket with OBJECTLOCKING '$BUCKET'" - ${MC} mb --with-lock myminio/$BUCKET - elif [ $OBJECTLOCKING = false ]; then - echo "Creating bucket '$BUCKET'" - ${MC} mb myminio/$BUCKET - fi - elif [ -z $OBJECTLOCKING ]; then - echo "Creating bucket '$BUCKET'" - ${MC} mb myminio/$BUCKET - else - echo "Bucket '$BUCKET' already exists." - fi - fi - - # set versioning for bucket if objectlocking is disabled or not set - if [ $OBJECTLOCKING = false ]; then - if [ ! -z $VERSIONING ]; then - if [ $VERSIONING = true ]; then - echo "Enabling versioning for '$BUCKET'" - ${MC} version enable myminio/$BUCKET - elif [ $VERSIONING = false ]; then - echo "Suspending versioning for '$BUCKET'" - ${MC} version suspend myminio/$BUCKET - fi - fi - else - echo "Bucket '$BUCKET' versioning unchanged." - fi - - # At this point, the bucket should exist, skip checking for existence - # Set policy on the bucket - echo "Setting policy of bucket '$BUCKET' to '$POLICY'." - ${MC} anonymous set $POLICY myminio/$BUCKET -} - -# Try connecting to MinIO instance -{{- if .Values.tls.enabled }} -scheme=https -{{- else }} -scheme=http -{{- end }} -connectToMinio $scheme - -{{ if .Values.buckets }} -{{ $global := . }} -# Create the buckets -{{- range .Values.buckets }} -createBucket {{ tpl .name $global }} {{ .policy | default "none" | quote }} {{ .purge | default false }} {{ .versioning | default false }} {{ .objectlocking | default false }} -{{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/_helper_create_policy.txt b/charts/devtron-utilities/charts/minio/templates/_helper_create_policy.txt deleted file mode 100644 index aa584952f..000000000 --- a/charts/devtron-utilities/charts/minio/templates/_helper_create_policy.txt +++ /dev/null @@ -1,75 +0,0 @@ -#!/bin/sh -set -e ; # Have script exit in the event of a failed command. - -{{- if .Values.configPathmc }} -MC_CONFIG_DIR="{{ .Values.configPathmc }}" -MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}" -{{- else }} -MC="/usr/bin/mc --insecure" -{{- end }} - -# connectToMinio -# Use a check-sleep-check loop to wait for MinIO service to be available -connectToMinio() { - SCHEME=$1 - ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts - set -e ; # fail if we can't read the keys. - ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ; - set +e ; # The connections to minio are allowed to fail. - echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ; - MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ; - $MC_COMMAND ; - STATUS=$? ; - until [ $STATUS = 0 ] - do - ATTEMPTS=`expr $ATTEMPTS + 1` ; - echo \"Failed attempts: $ATTEMPTS\" ; - if [ $ATTEMPTS -gt $LIMIT ]; then - exit 1 ; - fi ; - sleep 2 ; # 1 second intervals between attempts - $MC_COMMAND ; - STATUS=$? ; - done ; - set -e ; # reset `e` as active - return 0 -} - -# checkPolicyExists ($policy) -# Check if the policy exists, by using the exit code of `mc admin policy info` -checkPolicyExists() { - POLICY=$1 - CMD=$(${MC} admin policy info myminio $POLICY > /dev/null 2>&1) - return $? -} - -# createPolicy($name, $filename) -createPolicy () { - NAME=$1 - FILENAME=$2 - - # Create the name if it does not exist - echo "Checking policy: $NAME (in /config/$FILENAME.json)" - if ! checkPolicyExists $NAME ; then - echo "Creating policy '$NAME'" - else - echo "Policy '$NAME' already exists." - fi - ${MC} admin policy create myminio $NAME /config/$FILENAME.json - -} - -# Try connecting to MinIO instance -{{- if .Values.tls.enabled }} -scheme=https -{{- else }} -scheme=http -{{- end }} -connectToMinio $scheme - -{{ if .Values.policies }} -# Create the policies -{{- range $idx, $policy := .Values.policies }} -createPolicy {{ $policy.name }} policy_{{ $idx }} -{{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/_helper_create_svcacct.txt b/charts/devtron-utilities/charts/minio/templates/_helper_create_svcacct.txt deleted file mode 100644 index 5c8aec4f0..000000000 --- a/charts/devtron-utilities/charts/minio/templates/_helper_create_svcacct.txt +++ /dev/null @@ -1,106 +0,0 @@ -#!/bin/sh -set -e ; # Have script exit in the event of a failed command. - -{{- if .Values.configPathmc }} -MC_CONFIG_DIR="{{ .Values.configPathmc }}" -MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}" -{{- else }} -MC="/usr/bin/mc --insecure" -{{- end }} - -# AccessKey and secretkey credentials file are added to prevent shell execution errors caused by special characters. -# Special characters for example : ',",<,>,{,} -MINIO_ACCESSKEY_SECRETKEY_TMP="/tmp/accessKey_and_secretKey_svcacct_tmp" - -# connectToMinio -# Use a check-sleep-check loop to wait for MinIO service to be available -connectToMinio() { - SCHEME=$1 - ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts - set -e ; # fail if we can't read the keys. - ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ; - set +e ; # The connections to minio are allowed to fail. - echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ; - MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ; - $MC_COMMAND ; - STATUS=$? ; - until [ $STATUS = 0 ] - do - ATTEMPTS=`expr $ATTEMPTS + 1` ; - echo \"Failed attempts: $ATTEMPTS\" ; - if [ $ATTEMPTS -gt $LIMIT ]; then - exit 1 ; - fi ; - sleep 2 ; # 2 second intervals between attempts - $MC_COMMAND ; - STATUS=$? ; - done ; - set -e ; # reset `e` as active - return 0 -} - -# checkSvcacctExists () -# Check if the svcacct exists, by using the exit code of `mc admin user svcacct info` -checkSvcacctExists() { - CMD=$(${MC} admin user svcacct info myminio $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) > /dev/null 2>&1) - return $? -} - -# createSvcacct ($user) -createSvcacct () { - USER=$1 - FILENAME=$2 - #check accessKey_and_secretKey_tmp file - if [[ ! -f $MINIO_ACCESSKEY_SECRETKEY_TMP ]];then - echo "credentials file does not exist" - return 1 - fi - if [[ $(cat $MINIO_ACCESSKEY_SECRETKEY_TMP|wc -l) -ne 2 ]];then - echo "credentials file is invalid" - rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP - return 1 - fi - SVCACCT=$(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) - # Create the svcacct if it does not exist - if ! checkSvcacctExists ; then - echo "Creating svcacct '$SVCACCT'" - # Check if policy file is define - if [ -z $FILENAME ]; then - ${MC} admin user svcacct add --access-key $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --secret-key $(tail -n1 $MINIO_ACCESSKEY_SECRETKEY_TMP) myminio $USER - else - ${MC} admin user svcacct add --access-key $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --secret-key $(tail -n1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --policy /config/$FILENAME.json myminio $USER - fi - else - echo "Svcacct '$SVCACCT' already exists." - fi - #clean up credentials files. - rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP -} - -# Try connecting to MinIO instance -{{- if .Values.tls.enabled }} -scheme=https -{{- else }} -scheme=http -{{- end }} -connectToMinio $scheme - -{{ if .Values.svcaccts }} -{{ $global := . }} -# Create the svcaccts -{{- range $idx, $svc := .Values.svcaccts }} -echo {{ tpl .accessKey $global }} > $MINIO_ACCESSKEY_SECRETKEY_TMP -{{- if .existingSecret }} -cat /config/secrets-svc/{{ tpl .existingSecret $global }}/{{ tpl .existingSecretKey $global }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP -# Add a new line if it doesn't exist -echo >> $MINIO_ACCESSKEY_SECRETKEY_TMP -{{ else }} -echo {{ .secretKey }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP -{{- end }} -{{- if $svc.policy}} -createSvcacct {{ .user }} svc_policy_{{ $idx }} -{{ else }} -createSvcacct {{ .user }} -{{- end }} -{{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/_helper_create_user.txt b/charts/devtron-utilities/charts/minio/templates/_helper_create_user.txt deleted file mode 100644 index bfb79bee5..000000000 --- a/charts/devtron-utilities/charts/minio/templates/_helper_create_user.txt +++ /dev/null @@ -1,107 +0,0 @@ -#!/bin/sh -set -e ; # Have script exit in the event of a failed command. - -{{- if .Values.configPathmc }} -MC_CONFIG_DIR="{{ .Values.configPathmc }}" -MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}" -{{- else }} -MC="/usr/bin/mc --insecure" -{{- end }} - -# AccessKey and secretkey credentials file are added to prevent shell execution errors caused by special characters. -# Special characters for example : ',",<,>,{,} -MINIO_ACCESSKEY_SECRETKEY_TMP="/tmp/accessKey_and_secretKey_tmp" - -# connectToMinio -# Use a check-sleep-check loop to wait for MinIO service to be available -connectToMinio() { - SCHEME=$1 - ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts - set -e ; # fail if we can't read the keys. - ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ; - set +e ; # The connections to minio are allowed to fail. - echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ; - MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ; - $MC_COMMAND ; - STATUS=$? ; - until [ $STATUS = 0 ] - do - ATTEMPTS=`expr $ATTEMPTS + 1` ; - echo \"Failed attempts: $ATTEMPTS\" ; - if [ $ATTEMPTS -gt $LIMIT ]; then - exit 1 ; - fi ; - sleep 2 ; # 1 second intervals between attempts - $MC_COMMAND ; - STATUS=$? ; - done ; - set -e ; # reset `e` as active - return 0 -} - -# checkUserExists () -# Check if the user exists, by using the exit code of `mc admin user info` -checkUserExists() { - CMD=$(${MC} admin user info myminio $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) > /dev/null 2>&1) - return $? -} - -# createUser ($policy) -createUser() { - POLICY=$1 - #check accessKey_and_secretKey_tmp file - if [[ ! -f $MINIO_ACCESSKEY_SECRETKEY_TMP ]];then - echo "credentials file does not exist" - return 1 - fi - if [[ $(cat $MINIO_ACCESSKEY_SECRETKEY_TMP|wc -l) -ne 2 ]];then - echo "credentials file is invalid" - rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP - return 1 - fi - USER=$(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) - # Create the user if it does not exist - if ! checkUserExists ; then - echo "Creating user '$USER'" - cat $MINIO_ACCESSKEY_SECRETKEY_TMP | ${MC} admin user add myminio - else - echo "User '$USER' already exists." - fi - #clean up credentials files. - rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP - - # set policy for user - if [ ! -z $POLICY -a $POLICY != " " ] ; then - echo "Adding policy '$POLICY' for '$USER'" - set +e ; # policy already attach errors out, allow it. - ${MC} admin policy attach myminio $POLICY --user=$USER - set -e - else - echo "User '$USER' has no policy attached." - fi -} - -# Try connecting to MinIO instance -{{- if .Values.tls.enabled }} -scheme=https -{{- else }} -scheme=http -{{- end }} -connectToMinio $scheme - -{{ if .Values.users }} -{{ $global := . }} -# Create the users -{{- range .Values.users }} -echo {{ tpl .accessKey $global }} > $MINIO_ACCESSKEY_SECRETKEY_TMP -{{- if .existingSecret }} -cat /config/secrets/{{ tpl .existingSecret $global }}/{{ tpl .existingSecretKey $global }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP -# Add a new line if it doesn't exist -echo >> $MINIO_ACCESSKEY_SECRETKEY_TMP -createUser {{ .policy }} -{{ else }} -echo {{ .secretKey }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP -createUser {{ .policy }} -{{- end }} -{{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/_helper_custom_command.txt b/charts/devtron-utilities/charts/minio/templates/_helper_custom_command.txt deleted file mode 100644 index b583a7782..000000000 --- a/charts/devtron-utilities/charts/minio/templates/_helper_custom_command.txt +++ /dev/null @@ -1,58 +0,0 @@ -#!/bin/sh -set -e ; # Have script exit in the event of a failed command. - -{{- if .Values.configPathmc }} -MC_CONFIG_DIR="{{ .Values.configPathmc }}" -MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}" -{{- else }} -MC="/usr/bin/mc --insecure" -{{- end }} - -# connectToMinio -# Use a check-sleep-check loop to wait for MinIO service to be available -connectToMinio() { - SCHEME=$1 - ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts - set -e ; # fail if we can't read the keys. - ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ; - set +e ; # The connections to minio are allowed to fail. - echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ; - MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ; - $MC_COMMAND ; - STATUS=$? ; - until [ $STATUS = 0 ] - do - ATTEMPTS=`expr $ATTEMPTS + 1` ; - echo \"Failed attempts: $ATTEMPTS\" ; - if [ $ATTEMPTS -gt $LIMIT ]; then - exit 1 ; - fi ; - sleep 2 ; # 1 second intervals between attempts - $MC_COMMAND ; - STATUS=$? ; - done ; - set -e ; # reset `e` as active - return 0 -} - -# runCommand ($@) -# Run custom mc command -runCommand() { - ${MC} "$@" - return $? -} - -# Try connecting to MinIO instance -{{- if .Values.tls.enabled }} -scheme=https -{{- else }} -scheme=http -{{- end }} -connectToMinio $scheme - -{{ if .Values.customCommands }} -# Run custom commands -{{- range .Values.customCommands }} -runCommand {{ .command }} -{{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/_helper_policy.tpl b/charts/devtron-utilities/charts/minio/templates/_helper_policy.tpl deleted file mode 100644 index 8be998e5d..000000000 --- a/charts/devtron-utilities/charts/minio/templates/_helper_policy.tpl +++ /dev/null @@ -1,28 +0,0 @@ -{{- $statements_length := len .statements -}} -{{- $statements_length := sub $statements_length 1 -}} -{ - "Version": "2012-10-17", - "Statement": [ -{{- range $i, $statement := .statements }} - { - "Effect": "{{ $statement.effect | default "Allow" }}", - "Action": [ -"{{ $statement.actions | join "\",\n\"" }}" - ]{{ if $statement.resources }}, - "Resource": [ -"{{ $statement.resources | join "\",\n\"" }}" - ]{{ end }} -{{- if $statement.conditions }} -{{- $condition_len := len $statement.conditions }} -{{- $condition_len := sub $condition_len 1 }} - , - "Condition": { - {{- range $k,$v := $statement.conditions }} - {{- range $operator,$object := $v }} - "{{ $operator }}": { {{ $object }} }{{- if lt $k $condition_len }},{{- end }} - {{- end }}{{- end }} - }{{- end }} - }{{ if lt $i $statements_length }},{{end }} -{{- end }} - ] -} diff --git a/charts/devtron-utilities/charts/minio/templates/_helpers.tpl b/charts/devtron-utilities/charts/minio/templates/_helpers.tpl deleted file mode 100644 index 1cb209e5e..000000000 --- a/charts/devtron-utilities/charts/minio/templates/_helpers.tpl +++ /dev/null @@ -1,218 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "minio.name" -}} - {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "minio.fullname" -}} - {{- if .Values.fullnameOverride -}} - {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} - {{- else -}} - {{- $name := default .Chart.Name .Values.nameOverride -}} - {{- if contains $name .Release.Name -}} - {{- .Release.Name | trunc 63 | trimSuffix "-" -}} - {{- else -}} - {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} - {{- end -}} - {{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "minio.chart" -}} - {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for networkpolicy. -*/}} -{{- define "minio.networkPolicy.apiVersion" -}} - {{- if semverCompare ">=1.4-0, <1.7-0" .Capabilities.KubeVersion.Version -}} - {{- print "extensions/v1beta1" -}} - {{- else if semverCompare ">=1.7-0, <1.16-0" .Capabilities.KubeVersion.Version -}} - {{- print "networking.k8s.io/v1beta1" -}} - {{- else if semverCompare "^1.16-0" .Capabilities.KubeVersion.Version -}} - {{- print "networking.k8s.io/v1" -}} - {{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for deployment. -*/}} -{{- define "minio.deployment.apiVersion" -}} - {{- if semverCompare "<1.9-0" .Capabilities.KubeVersion.Version -}} - {{- print "apps/v1beta2" -}} - {{- else -}} - {{- print "apps/v1" -}} - {{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for statefulset. -*/}} -{{- define "minio.statefulset.apiVersion" -}} - {{- if semverCompare "<1.16-0" .Capabilities.KubeVersion.Version -}} - {{- print "apps/v1beta2" -}} - {{- else -}} - {{- print "apps/v1" -}} - {{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for ingress. -*/}} -{{- define "minio.ingress.apiVersion" -}} - {{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}} - {{- print "extensions/v1beta1" -}} - {{- else if semverCompare "<1.19-0" .Capabilities.KubeVersion.GitVersion -}} - {{- print "networking.k8s.io/v1beta1" -}} - {{- else -}} - {{- print "networking.k8s.io/v1" -}} - {{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for console ingress. -*/}} -{{- define "minio.consoleIngress.apiVersion" -}} - {{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}} - {{- print "extensions/v1beta1" -}} - {{- else if semverCompare "<1.19-0" .Capabilities.KubeVersion.GitVersion -}} - {{- print "networking.k8s.io/v1beta1" -}} - {{- else -}} - {{- print "networking.k8s.io/v1" -}} - {{- end -}} -{{- end -}} - -{{/* -Determine secret name. -*/}} -{{- define "minio.secretName" -}} - {{- if .Values.existingSecret -}} - {{- .Values.existingSecret }} - {{- else -}} - {{- include "minio.fullname" . -}} - {{- end -}} -{{- end -}} - -{{/* -Determine name for scc role and rolebinding -*/}} -{{- define "minio.sccRoleName" -}} - {{- printf "%s-%s" "scc" (include "minio.fullname" .) | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Properly format optional additional arguments to MinIO binary -*/}} -{{- define "minio.extraArgs" -}} -{{- range .Values.extraArgs -}} -{{ " " }}{{ . }} -{{- end -}} -{{- end -}} - -{{/* -Return the proper Docker Image Registry Secret Names -*/}} -{{- define "minio.imagePullSecrets" -}} -{{/* -Helm 2.11 supports the assignment of a value to a variable defined in a different scope, -but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic. -Also, we can not use a single if because lazy evaluation is not an option -*/}} -{{- if .Values.global }} -{{- if .Values.global.imagePullSecrets }} -imagePullSecrets: -{{- range .Values.global.imagePullSecrets }} - - name: {{ . }} -{{- end }} -{{- else if .Values.imagePullSecrets }} -imagePullSecrets: - {{ toYaml .Values.imagePullSecrets }} -{{- end -}} -{{- else if .Values.imagePullSecrets }} -imagePullSecrets: - {{ toYaml .Values.imagePullSecrets }} -{{- end -}} -{{- end -}} - -{{/* -Formats volumeMount for MinIO TLS keys and trusted certs -*/}} -{{- define "minio.tlsKeysVolumeMount" -}} -{{- if .Values.tls.enabled }} -- name: cert-secret-volume - mountPath: {{ .Values.certsPath }} -{{- end }} -{{- if or .Values.tls.enabled (ne .Values.trustedCertsSecret "") }} -{{- $casPath := printf "%s/CAs" .Values.certsPath | clean }} -- name: trusted-cert-secret-volume - mountPath: {{ $casPath }} -{{- end }} -{{- end -}} - -{{/* -Formats volume for MinIO TLS keys and trusted certs -*/}} -{{- define "minio.tlsKeysVolume" -}} -{{- if .Values.tls.enabled }} -- name: cert-secret-volume - secret: - secretName: {{ tpl .Values.tls.certSecret $ }} - items: - - key: {{ .Values.tls.publicCrt }} - path: public.crt - - key: {{ .Values.tls.privateKey }} - path: private.key -{{- end }} -{{- if or .Values.tls.enabled (ne .Values.trustedCertsSecret "") }} -{{- $certSecret := eq .Values.trustedCertsSecret "" | ternary .Values.tls.certSecret .Values.trustedCertsSecret }} -{{- $publicCrt := eq .Values.trustedCertsSecret "" | ternary .Values.tls.publicCrt "" }} -- name: trusted-cert-secret-volume - secret: - secretName: {{ $certSecret }} - {{- if ne $publicCrt "" }} - items: - - key: {{ $publicCrt }} - path: public.crt - {{- end }} -{{- end }} -{{- end -}} - -{{/* -Returns the available value for certain key in an existing secret (if it exists), -otherwise it generates a random value. -*/}} -{{- define "minio.getValueFromSecret" }} - {{- $len := (default 16 .Length) | int -}} - {{- $obj := (lookup "v1" "Secret" .Namespace .Name).data -}} - {{- if $obj }} - {{- index $obj .Key | b64dec -}} - {{- else -}} - {{- randAlphaNum $len -}} - {{- end -}} -{{- end }} - -{{- define "minio.root.username" -}} - {{- if .Values.rootUser }} - {{- .Values.rootUser | toString }} - {{- else }} - {{- include "minio.getValueFromSecret" (dict "Namespace" .Release.Namespace "Name" (include "minio.fullname" .) "Length" 20 "Key" "rootUser") }} - {{- end }} -{{- end -}} - -{{- define "minio.root.password" -}} - {{- if .Values.rootPassword }} - {{- .Values.rootPassword | toString }} - {{- else }} - {{- include "minio.getValueFromSecret" (dict "Namespace" .Release.Namespace "Name" (include "minio.fullname" .) "Length" 40 "Key" "rootPassword") }} - {{- end }} -{{- end -}} diff --git a/charts/devtron-utilities/charts/minio/templates/ciliumnetworkpolicy.yaml b/charts/devtron-utilities/charts/minio/templates/ciliumnetworkpolicy.yaml deleted file mode 100644 index 1dc91bcf2..000000000 --- a/charts/devtron-utilities/charts/minio/templates/ciliumnetworkpolicy.yaml +++ /dev/null @@ -1,33 +0,0 @@ -{{- if and (.Values.networkPolicy.enabled) (eq .Values.networkPolicy.flavor "cilium") }} -kind: CiliumNetworkPolicy -apiVersion: cilium.io/v2 -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - endpointSelector: - matchLabels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} - ingress: - - toPorts: - - ports: - - port: "{{ .Values.minioAPIPort }}" - protocol: TCP - - port: "{{ .Values.minioConsolePort }}" - protocol: TCP - {{- if not .Values.networkPolicy.allowExternal }} - fromEndpoints: - - matchLabels: - {{ template "minio.name" . }}-client: "true" - {{- end }} - egress: - {{- range $entity := .Values.networkPolicy.egressEntities }} - - toEntities: - - {{ $entity }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/configmap.yaml b/charts/devtron-utilities/charts/minio/templates/configmap.yaml deleted file mode 100644 index 47f64cc23..000000000 --- a/charts/devtron-utilities/charts/minio/templates/configmap.yaml +++ /dev/null @@ -1,32 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -data: - initialize: |- - {{- include (print $.Template.BasePath "/_helper_create_bucket.txt") . | nindent 4 }} - add-user: |- - {{- include (print $.Template.BasePath "/_helper_create_user.txt") . | nindent 4 }} - add-policy: |- - {{- include (print $.Template.BasePath "/_helper_create_policy.txt") . | nindent 4 }} - {{- range $idx, $policy := .Values.policies }} - # Policy: {{ $policy.name }} - policy_{{ $idx }}.json: |- - {{- include (print $.Template.BasePath "/_helper_policy.tpl") . | nindent 4 }} - {{ end }} - {{- range $idx, $svc := .Values.svcaccts }} - {{- if $svc.policy }} - # SVC: {{ $svc.accessKey }} - svc_policy_{{ $idx }}.json: |- - {{- include (print $.Template.BasePath "/_helper_policy.tpl") .policy | nindent 4 }} - {{- end }} - {{- end }} - add-svcacct: |- - {{- include (print $.Template.BasePath "/_helper_create_svcacct.txt") . | nindent 4 }} - custom-command: |- - {{- include (print $.Template.BasePath "/_helper_custom_command.txt") . | nindent 4 }} diff --git a/charts/devtron-utilities/charts/minio/templates/console-ingress.yaml b/charts/devtron-utilities/charts/minio/templates/console-ingress.yaml deleted file mode 100644 index 79a2b1b58..000000000 --- a/charts/devtron-utilities/charts/minio/templates/console-ingress.yaml +++ /dev/null @@ -1,55 +0,0 @@ -{{- if .Values.consoleIngress.enabled -}} -{{- $fullName := printf "%s-console" (include "minio.fullname" .) -}} -{{- $servicePort := .Values.consoleService.port -}} -{{- $ingressPath := .Values.consoleIngress.path -}} -apiVersion: {{ template "minio.consoleIngress.apiVersion" . }} -kind: Ingress -metadata: - name: {{ $fullName }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - {{- with .Values.consoleIngress.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.consoleIngress.annotations }} - annotations: {{- toYaml . | nindent 4 }} - {{- end }} -spec: - {{- if .Values.consoleIngress.ingressClassName }} - ingressClassName: {{ .Values.consoleIngress.ingressClassName }} - {{- end }} - {{- if .Values.consoleIngress.tls }} - tls: - {{- range .Values.consoleIngress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} - {{- end }} - rules: - {{- range .Values.consoleIngress.hosts }} - - http: - paths: - - path: {{ $ingressPath }} - {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} - pathType: Prefix - backend: - service: - name: {{ $fullName }} - port: - number: {{ $servicePort }} - {{- else }} - backend: - serviceName: {{ $fullName }} - servicePort: {{ $servicePort }} - {{- end }} - {{- if . }} - host: {{ tpl . $ | quote }} - {{- end }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/console-service.yaml b/charts/devtron-utilities/charts/minio/templates/console-service.yaml deleted file mode 100644 index f09e3f3c6..000000000 --- a/charts/devtron-utilities/charts/minio/templates/console-service.yaml +++ /dev/null @@ -1,45 +0,0 @@ -{{ $scheme := .Values.tls.enabled | ternary "https" "http" }} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "minio.fullname" . }}-console - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - {{- if .Values.consoleService.annotations }} - annotations: {{- toYaml .Values.consoleService.annotations | nindent 4 }} - {{- end }} -spec: - type: {{ .Values.consoleService.type }} - {{- if and (eq .Values.consoleService.type "ClusterIP") .Values.consoleService.clusterIP }} - clusterIP: {{ .Values.consoleService.clusterIP }} - {{- end }} - {{- if or (eq .Values.consoleService.type "LoadBalancer") (eq .Values.consoleService.type "NodePort") }} - externalTrafficPolicy: {{ .Values.consoleService.externalTrafficPolicy | quote }} - {{- end }} - {{- if and (eq .Values.consoleService.type "LoadBalancer") .Values.consoleService.loadBalancerSourceRanges }} - loadBalancerSourceRanges: {{ .Values.consoleService.loadBalancerSourceRanges }} - {{ end }} - {{- if and (eq .Values.consoleService.type "LoadBalancer") (not (empty .Values.consoleService.loadBalancerIP)) }} - loadBalancerIP: {{ .Values.consoleService.loadBalancerIP }} - {{- end }} - ports: - - name: {{ $scheme }} - port: {{ .Values.consoleService.port }} - protocol: TCP - {{- if (and (eq .Values.consoleService.type "NodePort") ( .Values.consoleService.nodePort)) }} - nodePort: {{ .Values.consoleService.nodePort }} - {{- else }} - targetPort: {{ .Values.minioConsolePort }} - {{- end }} - {{- if .Values.consoleService.externalIPs }} - externalIPs: - {{- range $i , $ip := .Values.consoleService.externalIPs }} - - {{ $ip }} - {{- end }} - {{- end }} - selector: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} diff --git a/charts/devtron-utilities/charts/minio/templates/deployment.yaml b/charts/devtron-utilities/charts/minio/templates/deployment.yaml deleted file mode 100644 index 4c57010fd..000000000 --- a/charts/devtron-utilities/charts/minio/templates/deployment.yaml +++ /dev/null @@ -1,213 +0,0 @@ -{{- if eq .Values.mode "standalone" }} -{{ $scheme := .Values.tls.enabled | ternary "https" "http" }} -{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }} -apiVersion: {{ template "minio.deployment.apiVersion" . }} -kind: Deployment -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - {{- if .Values.additionalLabels }} - {{- toYaml .Values.additionalLabels | nindent 4 }} - {{- end }} - {{- if .Values.additionalAnnotations }} - annotations: {{- toYaml .Values.additionalAnnotations | nindent 4 }} - {{- end }} -spec: - strategy: - type: {{ .Values.deploymentUpdate.type }} - {{- if eq .Values.deploymentUpdate.type "RollingUpdate" }} - rollingUpdate: - maxSurge: {{ .Values.deploymentUpdate.maxSurge }} - maxUnavailable: {{ .Values.deploymentUpdate.maxUnavailable }} - {{- end }} - replicas: 1 - selector: - matchLabels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} - template: - metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} - {{- if .Values.podLabels }} - {{- toYaml .Values.podLabels | nindent 8 }} - {{- end }} - annotations: - {{- if not .Values.ignoreChartChecksums }} - checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} - checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} - {{- end }} - {{- if .Values.podAnnotations }} - {{- toYaml .Values.podAnnotations | trimSuffix "\n" | nindent 8 }} - {{- end }} - spec: - {{- if .Values.priorityClassName }} - priorityClassName: "{{ .Values.priorityClassName }}" - {{- end }} - {{- if .Values.runtimeClassName }} - runtimeClassName: "{{ .Values.runtimeClassName }}" - {{- end }} - {{- if and .Values.securityContext.enabled .Values.persistence.enabled }} - securityContext: - {{ omit .Values.securityContext "enabled" | toYaml | nindent 8 }} - {{- end }} - {{ if .Values.serviceAccount.create }} - serviceAccountName: {{ .Values.serviceAccount.name }} - {{- end }} - containers: - - name: {{ .Chart.Name }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" - imagePullPolicy: {{ .Values.image.pullPolicy }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio server {{ $bucketRoot }} -S {{ .Values.certsPath }} --address :{{ .Values.minioAPIPort }} --console-address :{{ .Values.minioConsolePort }} {{- template "minio.extraArgs" . }}" - volumeMounts: - - name: minio-user - mountPath: "/tmp/credentials" - readOnly: true - - name: export - mountPath: {{ .Values.mountPath }} - {{- if and .Values.persistence.enabled .Values.persistence.subPath }} - subPath: "{{ .Values.persistence.subPath }}" - {{- end }} - {{- if .Values.extraSecret }} - - name: extra-secret - mountPath: "/tmp/minio-config-env" - {{- end }} - {{- include "minio.tlsKeysVolumeMount" . | indent 12 }} - {{- if .Values.extraVolumeMounts }} - {{- toYaml .Values.extraVolumeMounts | nindent 12 }} - {{- end }} - ports: - - name: {{ $scheme }} - containerPort: {{ .Values.minioAPIPort }} - - name: {{ $scheme }}-console - containerPort: {{ .Values.minioConsolePort }} - env: - - name: MINIO_ROOT_USER - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: rootUser - - name: MINIO_ROOT_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: rootPassword - {{- if .Values.extraSecret }} - - name: MINIO_CONFIG_ENV_FILE - value: "/tmp/minio-config-env/config.env" - {{- end }} - {{- if .Values.metrics.serviceMonitor.public }} - - name: MINIO_PROMETHEUS_AUTH_TYPE - value: "public" - {{- end }} - {{- if .Values.oidc.enabled }} - - name: MINIO_IDENTITY_OPENID_CONFIG_URL - value: {{ .Values.oidc.configUrl }} - - name: MINIO_IDENTITY_OPENID_CLIENT_ID - {{- if and .Values.oidc.existingClientSecretName .Values.oidc.existingClientIdKey }} - valueFrom: - secretKeyRef: - name: {{ .Values.oidc.existingClientSecretName }} - key: {{ .Values.oidc.existingClientIdKey }} - {{- else }} - value: {{ .Values.oidc.clientId }} - {{- end }} - - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET - {{- if and .Values.oidc.existingClientSecretName .Values.oidc.existingClientSecretKey }} - valueFrom: - secretKeyRef: - name: {{ .Values.oidc.existingClientSecretName }} - key: {{ .Values.oidc.existingClientSecretKey }} - {{- else }} - value: {{ .Values.oidc.clientSecret }} - {{- end }} - - name: MINIO_IDENTITY_OPENID_CLAIM_NAME - value: {{ .Values.oidc.claimName }} - - name: MINIO_IDENTITY_OPENID_CLAIM_PREFIX - value: {{ .Values.oidc.claimPrefix }} - - name: MINIO_IDENTITY_OPENID_SCOPES - value: {{ .Values.oidc.scopes }} - - name: MINIO_IDENTITY_OPENID_COMMENT - value: {{ .Values.oidc.comment }} - - name: MINIO_IDENTITY_OPENID_REDIRECT_URI - value: {{ .Values.oidc.redirectUri }} - - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME - value: {{ .Values.oidc.displayName }} - {{- end }} - {{- if .Values.etcd.endpoints }} - - name: MINIO_ETCD_ENDPOINTS - value: {{ join "," .Values.etcd.endpoints | quote }} - {{- if .Values.etcd.clientCert }} - - name: MINIO_ETCD_CLIENT_CERT - value: "/tmp/credentials/etcd_client_cert.pem" - {{- end }} - {{- if .Values.etcd.clientCertKey }} - - name: MINIO_ETCD_CLIENT_CERT_KEY - value: "/tmp/credentials/etcd_client_cert_key.pem" - {{- end }} - {{- if .Values.etcd.pathPrefix }} - - name: MINIO_ETCD_PATH_PREFIX - value: {{ .Values.etcd.pathPrefix }} - {{- end }} - {{- if .Values.etcd.corednsPathPrefix }} - - name: MINIO_ETCD_COREDNS_PATH - value: {{ .Values.etcd.corednsPathPrefix }} - {{- end }} - {{- end }} - {{- range $key, $val := .Values.environment }} - - name: {{ $key }} - value: {{ tpl $val $ | quote }} - {{- end }} - resources: {{- toYaml .Values.resources | nindent 12 }} - {{- if and .Values.securityContext.enabled .Values.persistence.enabled }} - {{- with .Values.containerSecurityContext }} - securityContext: {{ toYaml . | nindent 12}} - {{- end }} - {{- end }} - {{- with .Values.extraContainers }} - {{- if eq (typeOf .) "string" }} - {{- tpl . $ | nindent 8 }} - {{- else }} - {{- toYaml . | nindent 8 }} - {{- end }} - {{- end }} - {{- with .Values.nodeSelector }} - nodeSelector: {{- toYaml . | nindent 8 }} - {{- end }} - {{- include "minio.imagePullSecrets" . | indent 6 }} - {{- with .Values.affinity }} - affinity: {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: {{- toYaml . | nindent 8 }} - {{- end }} - volumes: - - name: export - {{- if .Values.persistence.enabled }} - persistentVolumeClaim: - claimName: {{ .Values.persistence.existingClaim | default (include "minio.fullname" .) }} - {{- else }} - emptyDir: {} - {{- end }} - {{- if .Values.extraSecret }} - - name: extra-secret - secret: - secretName: {{ .Values.extraSecret }} - {{- end }} - - name: minio-user - secret: - secretName: {{ template "minio.secretName" . }} - {{- include "minio.tlsKeysVolume" . | indent 8 }} - {{- if .Values.extraVolumes }} - {{ toYaml .Values.extraVolumes | nindent 8 }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/ingress.yaml b/charts/devtron-utilities/charts/minio/templates/ingress.yaml deleted file mode 100644 index 1a564c6bc..000000000 --- a/charts/devtron-utilities/charts/minio/templates/ingress.yaml +++ /dev/null @@ -1,55 +0,0 @@ -{{- if .Values.ingress.enabled -}} -{{- $fullName := include "minio.fullname" . -}} -{{- $servicePort := .Values.service.port -}} -{{- $ingressPath := .Values.ingress.path -}} -apiVersion: {{ template "minio.ingress.apiVersion" . }} -kind: Ingress -metadata: - name: {{ $fullName }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - {{- with .Values.ingress.labels }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- with .Values.ingress.annotations }} - annotations: {{- toYaml . | nindent 4 }} - {{- end }} -spec: - {{- if .Values.ingress.ingressClassName }} - ingressClassName: {{ .Values.ingress.ingressClassName }} - {{- end }} - {{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} - {{- end }} - rules: - {{- range .Values.ingress.hosts }} - - http: - paths: - - path: {{ $ingressPath }} - {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} - pathType: Prefix - backend: - service: - name: {{ $fullName }} - port: - number: {{ $servicePort }} - {{- else }} - backend: - serviceName: {{ $fullName }} - servicePort: {{ $servicePort }} - {{- end }} - {{- if . }} - host: {{ tpl . $ | quote }} - {{- end }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/networkpolicy.yaml b/charts/devtron-utilities/charts/minio/templates/networkpolicy.yaml deleted file mode 100644 index b9c077171..000000000 --- a/charts/devtron-utilities/charts/minio/templates/networkpolicy.yaml +++ /dev/null @@ -1,26 +0,0 @@ -{{- if and (.Values.networkPolicy.enabled) (eq .Values.networkPolicy.flavor "kubernetes") }} -kind: NetworkPolicy -apiVersion: {{ template "minio.networkPolicy.apiVersion" . }} -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - podSelector: - matchLabels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} - ingress: - - ports: - - port: {{ .Values.minioAPIPort }} - - port: {{ .Values.minioConsolePort }} - {{- if not .Values.networkPolicy.allowExternal }} - from: - - podSelector: - matchLabels: - {{ template "minio.name" . }}-client: "true" - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/poddisruptionbudget.yaml b/charts/devtron-utilities/charts/minio/templates/poddisruptionbudget.yaml deleted file mode 100644 index a5f90a080..000000000 --- a/charts/devtron-utilities/charts/minio/templates/poddisruptionbudget.yaml +++ /dev/null @@ -1,17 +0,0 @@ -{{- if .Values.podDisruptionBudget.enabled }} -{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodDisruptionBudget" }} -apiVersion: policy/v1beta1 -{{- else }} -apiVersion: policy/v1 -{{- end }} -kind: PodDisruptionBudget -metadata: - name: minio - labels: - app: {{ template "minio.name" . }} -spec: - maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }} - selector: - matchLabels: - app: {{ template "minio.name" . }} -{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/post-job.yaml b/charts/devtron-utilities/charts/minio/templates/post-job.yaml deleted file mode 100644 index 955d6558c..000000000 --- a/charts/devtron-utilities/charts/minio/templates/post-job.yaml +++ /dev/null @@ -1,258 +0,0 @@ -{{- if or .Values.buckets .Values.users .Values.policies .Values.customCommands .Values.svcaccts }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ template "minio.fullname" . }}-post-job - labels: - app: {{ template "minio.name" . }}-post-job - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - annotations: - "helm.sh/hook": post-install,post-upgrade - "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation - {{- with .Values.postJob.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} -spec: - template: - metadata: - labels: - app: {{ template "minio.name" . }}-job - release: {{ .Release.Name }} - {{- if .Values.podLabels }} - {{- toYaml .Values.podLabels | nindent 8 }} - {{- end }} - {{- if .Values.postJob.podAnnotations }} - annotations: {{- toYaml .Values.postJob.podAnnotations | nindent 8 }} - {{- end }} - spec: - restartPolicy: OnFailure - {{- include "minio.imagePullSecrets" . | indent 6 }} - {{- if .Values.nodeSelector }} - nodeSelector: {{- toYaml .Values.postJob.nodeSelector | nindent 8 }} - {{- end }} - {{- with .Values.postJob.affinity }} - affinity: {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.postJob.tolerations }} - tolerations: {{- toYaml . | nindent 8 }} - {{- end }} - {{- if .Values.postJob.securityContext.enabled }} - securityContext: {{ omit .Values.postJob.securityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - volumes: - - name: etc-path - emptyDir: {} - - name: tmp - emptyDir: {} - - name: minio-configuration - projected: - sources: - - configMap: - name: {{ template "minio.fullname" . }} - - secret: - name: {{ template "minio.secretName" . }} - {{- range (concat .Values.users (default (list) .Values.svcaccts)) }} - {{- if .existingSecret }} - - secret: - name: {{ tpl .existingSecret $ }} - items: - - key: {{ .existingSecretKey }} - path: secrets/{{ tpl .existingSecret $ }}/{{ tpl .existingSecretKey $ }} - {{- end }} - {{- end }} - {{- range ( default list .Values.svcaccts ) }} - {{- if .existingSecret }} - - secret: - name: {{ tpl .existingSecret $ }} - items: - - key: {{ .existingSecretKey }} - path: secrets-svc/{{ tpl .existingSecret $ }}/{{ tpl .existingSecretKey $ }} - {{- end }} - {{- end }} - {{- if .Values.tls.enabled }} - - name: cert-secret-volume-mc - secret: - secretName: {{ .Values.tls.certSecret }} - items: - - key: {{ .Values.tls.publicCrt }} - path: CAs/public.crt - {{- end }} - {{- if .Values.customCommandJob.extraVolumes }} - {{- toYaml .Values.customCommandJob.extraVolumes | nindent 8 }} - {{- end }} - {{- if .Values.serviceAccount.create }} - serviceAccountName: {{ .Values.serviceAccount.name }} - {{- end }} - {{- if .Values.policies }} - initContainers: - - name: minio-make-policy - image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" - {{- if .Values.makePolicyJob.securityContext.enabled }} - {{- with .Values.makePolicyJob.containerSecurityContext }} - securityContext: {{ toYaml . | nindent 12 }} - {{- end }} - {{- end }} - imagePullPolicy: {{ .Values.mcImage.pullPolicy }} - {{- if .Values.makePolicyJob.exitCommand }} - command: [ "/bin/sh", "-c" ] - args: [ "/bin/sh /config/add-policy; EV=$?; {{ .Values.makePolicyJob.exitCommand }} && exit $EV" ] - {{- else }} - command: [ "/bin/sh", "/config/add-policy" ] - {{- end }} - env: - - name: MINIO_ENDPOINT - value: {{ template "minio.fullname" . }} - - name: MINIO_PORT - value: {{ .Values.service.port | quote }} - volumeMounts: - - name: etc-path - mountPath: /etc/minio/mc - - name: tmp - mountPath: /tmp - - name: minio-configuration - mountPath: /config - {{- if .Values.tls.enabled }} - - name: cert-secret-volume-mc - mountPath: {{ .Values.configPathmc }}certs - {{- end }} - resources: {{- toYaml .Values.makePolicyJob.resources | nindent 12 }} - {{- end }} - containers: - {{- if .Values.buckets }} - - name: minio-make-bucket - image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" - {{- if .Values.makeBucketJob.securityContext.enabled }} - {{- with .Values.makeBucketJob.containerSecurityContext }} - securityContext: {{ toYaml . | nindent 12 }} - {{- end }} - {{- end }} - imagePullPolicy: {{ .Values.mcImage.pullPolicy }} - {{- if .Values.makeBucketJob.exitCommand }} - command: [ "/bin/sh", "-c" ] - args: [ "/bin/sh /config/initialize; EV=$?; {{ .Values.makeBucketJob.exitCommand }} && exit $EV" ] - {{- else }} - command: [ "/bin/sh", "/config/initialize" ] - {{- end }} - env: - - name: MINIO_ENDPOINT - value: {{ template "minio.fullname" . }} - - name: MINIO_PORT - value: {{ .Values.service.port | quote }} - volumeMounts: - - name: etc-path - mountPath: /etc/minio/mc - - name: tmp - mountPath: /tmp - - name: minio-configuration - mountPath: /config - {{- if .Values.tls.enabled }} - - name: cert-secret-volume-mc - mountPath: {{ .Values.configPathmc }}certs - {{- end }} - resources: {{- toYaml .Values.makeBucketJob.resources | nindent 12 }} - {{- end }} - {{- if .Values.users }} - - name: minio-make-user - image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" - {{- if .Values.makeUserJob.securityContext.enabled }} - {{- with .Values.makeUserJob.containerSecurityContext }} - securityContext: {{ toYaml . | nindent 12 }} - {{- end }} - {{- end }} - imagePullPolicy: {{ .Values.mcImage.pullPolicy }} - {{- if .Values.makeUserJob.exitCommand }} - command: [ "/bin/sh", "-c" ] - args: [ "/bin/sh /config/add-user; EV=$?; {{ .Values.makeUserJob.exitCommand }} && exit $EV" ] - {{- else }} - command: [ "/bin/sh", "/config/add-user" ] - {{- end }} - env: - - name: MINIO_ENDPOINT - value: {{ template "minio.fullname" . }} - - name: MINIO_PORT - value: {{ .Values.service.port | quote }} - volumeMounts: - - name: etc-path - mountPath: /etc/minio/mc - - name: tmp - mountPath: /tmp - - name: minio-configuration - mountPath: /config - {{- if .Values.tls.enabled }} - - name: cert-secret-volume-mc - mountPath: {{ .Values.configPathmc }}certs - {{- end }} - resources: {{- toYaml .Values.makeUserJob.resources | nindent 12 }} - {{- end }} - {{- if .Values.customCommands }} - - name: minio-custom-command - image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" - {{- if .Values.customCommandJob.securityContext.enabled }} - {{- with .Values.customCommandJob.containerSecurityContext }} - securityContext: {{ toYaml . | nindent 12 }} - {{- end }} - {{- end }} - imagePullPolicy: {{ .Values.mcImage.pullPolicy }} - {{- if .Values.customCommandJob.exitCommand }} - command: [ "/bin/sh", "-c" ] - args: [ "/bin/sh /config/custom-command; EV=$?; {{ .Values.customCommandJob.exitCommand }} && exit $EV" ] - {{- else }} - command: [ "/bin/sh", "/config/custom-command" ] - {{- end }} - env: - - name: MINIO_ENDPOINT - value: {{ template "minio.fullname" . }} - - name: MINIO_PORT - value: {{ .Values.service.port | quote }} - volumeMounts: - - name: etc-path - mountPath: /etc/minio/mc - - name: tmp - mountPath: /tmp - - name: minio-configuration - mountPath: /config - {{- if .Values.tls.enabled }} - - name: cert-secret-volume-mc - mountPath: {{ .Values.configPathmc }}certs - {{- end }} - {{- if .Values.customCommandJob.extraVolumeMounts }} - {{- toYaml .Values.customCommandJob.extraVolumeMounts | nindent 12 }} - {{- end }} - resources: {{- toYaml .Values.customCommandJob.resources | nindent 12 }} - {{- end }} - {{- if .Values.svcaccts }} - - name: minio-make-svcacct - image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" - {{- if .Values.makeServiceAccountJob.securityContext.enabled }} - {{- with .Values.makeServiceAccountJob.containerSecurityContext }} - securityContext: {{ toYaml . | nindent 12 }} - {{- end }} - {{- end }} - imagePullPolicy: {{ .Values.mcImage.pullPolicy }} - {{- if .Values.makeServiceAccountJob.exitCommand }} - command: [ "/bin/sh", "-c" ] - args: ["/bin/sh /config/add-svcacct; EV=$?; {{ .Values.makeServiceAccountJob.exitCommand }} && exit $EV" ] - {{- else }} - command: ["/bin/sh", "/config/add-svcacct"] - {{- end }} - env: - - name: MINIO_ENDPOINT - value: {{ template "minio.fullname" . }} - - name: MINIO_PORT - value: {{ .Values.service.port | quote }} - volumeMounts: - - name: etc-path - mountPath: /etc/minio/mc - - name: tmp - mountPath: /tmp - - name: minio-configuration - mountPath: /config - {{- if .Values.tls.enabled }} - - name: cert-secret-volume-mc - mountPath: {{ .Values.configPathmc }}certs - {{- end }} - resources: {{- toYaml .Values.makeServiceAccountJob.resources | nindent 12 }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/pvc.yaml b/charts/devtron-utilities/charts/minio/templates/pvc.yaml deleted file mode 100644 index 60f5267b0..000000000 --- a/charts/devtron-utilities/charts/minio/templates/pvc.yaml +++ /dev/null @@ -1,32 +0,0 @@ -{{- if eq .Values.mode "standalone" }} -{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }} -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - {{- if .Values.persistence.annotations }} - annotations: {{- toYaml .Values.persistence.annotations | nindent 4 }} - {{- end }} -spec: - accessModes: - - {{ .Values.persistence.accessMode | quote }} - resources: - requests: - storage: {{ .Values.persistence.size | quote }} - {{- if .Values.persistence.storageClass }} - {{- if (eq "-" .Values.persistence.storageClass) }} - storageClassName: "" - {{- else }} - storageClassName: "{{ .Values.persistence.storageClass }}" - {{- end }} - {{- end }} - {{- if .Values.persistence.volumeName }} - volumeName: "{{ .Values.persistence.volumeName }}" - {{- end }} -{{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/secrets.yaml b/charts/devtron-utilities/charts/minio/templates/secrets.yaml deleted file mode 100644 index 476c3da51..000000000 --- a/charts/devtron-utilities/charts/minio/templates/secrets.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{- if not .Values.existingSecret }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "minio.secretName" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -type: Opaque -data: - rootUser: {{ include "minio.root.username" . | b64enc | quote }} - rootPassword: {{ include "minio.root.password" . | b64enc | quote }} - {{- if .Values.etcd.clientCert }} - etcd_client.crt: {{ .Values.etcd.clientCert | toString | b64enc | quote }} - {{- end }} - {{- if .Values.etcd.clientCertKey }} - etcd_client.key: {{ .Values.etcd.clientCertKey | toString | b64enc | quote }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/securitycontextconstraints.yaml b/charts/devtron-utilities/charts/minio/templates/securitycontextconstraints.yaml deleted file mode 100644 index 4bac7e372..000000000 --- a/charts/devtron-utilities/charts/minio/templates/securitycontextconstraints.yaml +++ /dev/null @@ -1,45 +0,0 @@ -{{- if and .Values.securityContext.enabled .Values.persistence.enabled (.Capabilities.APIVersions.Has "security.openshift.io/v1") }} -apiVersion: security.openshift.io/v1 -kind: SecurityContextConstraints -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -allowHostDirVolumePlugin: false -allowHostIPC: false -allowHostNetwork: false -allowHostPID: false -allowHostPorts: false -allowPrivilegeEscalation: true -allowPrivilegedContainer: false -allowedCapabilities: [] -readOnlyRootFilesystem: false -defaultAddCapabilities: [] -requiredDropCapabilities: -- KILL -- MKNOD -- SETUID -- SETGID -fsGroup: - type: MustRunAs - ranges: - - max: {{ .Values.securityContext.fsGroup }} - min: {{ .Values.securityContext.fsGroup }} -runAsUser: - type: MustRunAs - uid: {{ .Values.securityContext.runAsUser }} -seLinuxContext: - type: MustRunAs -supplementalGroups: - type: RunAsAny -volumes: -- configMap -- downwardAPI -- emptyDir -- persistentVolumeClaim -- projected -- secret -{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/service.yaml b/charts/devtron-utilities/charts/minio/templates/service.yaml deleted file mode 100644 index d872cd07a..000000000 --- a/charts/devtron-utilities/charts/minio/templates/service.yaml +++ /dev/null @@ -1,46 +0,0 @@ -{{ $scheme := .Values.tls.enabled | ternary "https" "http" }} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - monitoring: "true" - {{- if .Values.service.annotations }} - annotations: {{- toYaml .Values.service.annotations | nindent 4 }} - {{- end }} -spec: - type: {{ .Values.service.type }} - {{- if and (eq .Values.service.type "ClusterIP") .Values.service.clusterIP }} - clusterIP: {{ .Values.service.clusterIP }} - {{- end }} - {{- if or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "NodePort") }} - externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy | quote }} - {{- end }} - {{- if and (eq .Values.service.type "LoadBalancer") .Values.service.loadBalancerSourceRanges }} - loadBalancerSourceRanges: {{ .Values.service.loadBalancerSourceRanges }} - {{ end }} - {{- if and (eq .Values.service.type "LoadBalancer") (not (empty .Values.service.loadBalancerIP)) }} - loadBalancerIP: {{ default "" .Values.service.loadBalancerIP | quote }} - {{- end }} - ports: - - name: {{ $scheme }} - port: {{ .Values.service.port }} - protocol: TCP - {{- if (and (eq .Values.service.type "NodePort") ( .Values.service.nodePort)) }} - nodePort: {{ .Values.service.nodePort }} - {{- else }} - targetPort: {{ .Values.minioAPIPort }} - {{- end }} - {{- if .Values.service.externalIPs }} - externalIPs: - {{- range $i , $ip := .Values.service.externalIPs }} - - {{ $ip }} - {{- end }} - {{- end }} - selector: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} diff --git a/charts/devtron-utilities/charts/minio/templates/serviceaccount.yaml b/charts/devtron-utilities/charts/minio/templates/serviceaccount.yaml deleted file mode 100644 index 07840153d..000000000 --- a/charts/devtron-utilities/charts/minio/templates/serviceaccount.yaml +++ /dev/null @@ -1,6 +0,0 @@ -{{- if .Values.serviceAccount.create }} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ .Values.serviceAccount.name | quote }} -{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/servicemonitor.yaml b/charts/devtron-utilities/charts/minio/templates/servicemonitor.yaml deleted file mode 100644 index f875a850e..000000000 --- a/charts/devtron-utilities/charts/minio/templates/servicemonitor.yaml +++ /dev/null @@ -1,112 +0,0 @@ -{{- if and .Values.metrics.serviceMonitor.enabled .Values.metrics.serviceMonitor.includeNode }} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ template "minio.fullname" . }} - {{- if .Values.metrics.serviceMonitor.namespace }} - namespace: {{ .Values.metrics.serviceMonitor.namespace }} - {{- end }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - {{- if .Values.metrics.serviceMonitor.additionalLabels }} - {{- toYaml .Values.metrics.serviceMonitor.additionalLabels | nindent 4 }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.annotations }} - annotations: {{- toYaml .Values.metrics.serviceMonitor.annotations | nindent 4 }} - {{- end }} -spec: - endpoints: - {{- if .Values.tls.enabled }} - - port: https - scheme: https - tlsConfig: - ca: - secret: - name: {{ .Values.tls.certSecret }} - key: {{ .Values.tls.publicCrt }} - serverName: {{ template "minio.fullname" . }} - {{- else }} - - port: http - scheme: http - {{- end }} - path: /minio/v2/metrics/node - {{- if .Values.metrics.serviceMonitor.interval }} - interval: {{ .Values.metrics.serviceMonitor.interval }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} - scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.relabelConfigs }} - {{- toYaml .Values.metrics.serviceMonitor.relabelConfigs | nindent 6 }} - {{- end }} - {{- if not .Values.metrics.serviceMonitor.public }} - bearerTokenSecret: - name: {{ template "minio.fullname" . }}-prometheus - key: token - {{- end }} - namespaceSelector: - matchNames: - - {{ .Release.Namespace | quote }} - selector: - matchLabels: - app: {{ include "minio.name" . }} - release: {{ .Release.Name }} - monitoring: "true" -{{- end }} -{{- if .Values.metrics.serviceMonitor.enabled }} ---- -apiVersion: monitoring.coreos.com/v1 -kind: Probe -metadata: - name: {{ template "minio.fullname" . }}-cluster - {{- if .Values.metrics.serviceMonitor.namespace }} - namespace: {{ .Values.metrics.serviceMonitor.namespace }} - {{- end }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - {{- if .Values.metrics.serviceMonitor.additionalLabels }} - {{- toYaml .Values.metrics.serviceMonitor.additionalLabels | nindent 4 }} - {{- end }} -spec: - jobName: {{ template "minio.fullname" . }} - {{- if .Values.tls.enabled }} - tlsConfig: - ca: - secret: - name: {{ .Values.tls.certSecret }} - key: {{ .Values.tls.publicCrt }} - serverName: {{ template "minio.fullname" . }} - {{- end }} - prober: - url: {{ template "minio.fullname" . }}.{{ .Release.Namespace }}:{{ .Values.service.port }} - path: /minio/v2/metrics/cluster - {{- if .Values.tls.enabled }} - scheme: https - {{- else }} - scheme: http - {{- end }} - {{- if .Values.metrics.serviceMonitor.relabelConfigsCluster }} - {{- toYaml .Values.metrics.serviceMonitor.relabelConfigsCluster | nindent 2 }} - {{- end }} - targets: - staticConfig: - static: - - {{ template "minio.fullname" . }}.{{ .Release.Namespace }} - {{- if not .Values.metrics.serviceMonitor.public }} - {{- if .Values.metrics.serviceMonitor.interval }} - interval: {{ .Values.metrics.serviceMonitor.interval }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} - scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} - {{- end }} - bearerTokenSecret: - name: {{ template "minio.fullname" . }}-prometheus - key: token - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/minio/templates/statefulset.yaml b/charts/devtron-utilities/charts/minio/templates/statefulset.yaml deleted file mode 100644 index d671eaaf4..000000000 --- a/charts/devtron-utilities/charts/minio/templates/statefulset.yaml +++ /dev/null @@ -1,267 +0,0 @@ -{{- if eq .Values.mode "distributed" }} -{{ $poolCount := .Values.pools | int }} -{{ $nodeCount := .Values.replicas | int }} -{{ $replicas := mul $poolCount $nodeCount }} -{{ $drivesPerNode := .Values.drivesPerNode | int }} -{{ $scheme := .Values.tls.enabled | ternary "https" "http" }} -{{ $mountPath := .Values.mountPath }} -{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }} -{{ $subPath := .Values.persistence.subPath }} -{{ $penabled := .Values.persistence.enabled }} -{{ $accessMode := .Values.persistence.accessMode }} -{{ $storageClass := .Values.persistence.storageClass }} -{{ $psize := .Values.persistence.size }} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "minio.fullname" . }}-svc - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - publishNotReadyAddresses: true - clusterIP: None - ports: - - name: {{ $scheme }} - port: {{ .Values.service.port }} - protocol: TCP - targetPort: {{ .Values.minioAPIPort }} - selector: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} ---- -apiVersion: {{ template "minio.statefulset.apiVersion" . }} -kind: StatefulSet -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - {{- if .Values.additionalLabels }} - {{- toYaml .Values.additionalLabels | nindent 4 }} - {{- end }} - {{- if .Values.additionalAnnotations }} - annotations: {{- toYaml .Values.additionalAnnotations | nindent 4 }} - {{- end }} -spec: - updateStrategy: - type: {{ .Values.statefulSetUpdate.updateStrategy }} - podManagementPolicy: "Parallel" - serviceName: {{ template "minio.fullname" . }}-svc - replicas: {{ $replicas }} - selector: - matchLabels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} - template: - metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} - {{- if .Values.podLabels }} - {{- toYaml .Values.podLabels | nindent 8 }} - {{- end }} - annotations: - {{- if not .Values.ignoreChartChecksums }} - checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} - checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} - {{- end }} - {{- if .Values.podAnnotations }} - {{- toYaml .Values.podAnnotations | nindent 8 }} - {{- end }} - spec: - {{- if .Values.priorityClassName }} - priorityClassName: "{{ .Values.priorityClassName }}" - {{- end }} - {{- if .Values.runtimeClassName }} - runtimeClassName: "{{ .Values.runtimeClassName }}" - {{- end }} - {{- if and .Values.securityContext.enabled .Values.persistence.enabled }} - securityContext: - {{- omit .Values.securityContext "enabled" | toYaml | nindent 8 }} - {{- end }} - {{- if .Values.serviceAccount.create }} - serviceAccountName: {{ .Values.serviceAccount.name }} - {{- end }} - containers: - - name: {{ .Chart.Name }} - image: {{ .Values.image.repository }}:{{ .Values.image.tag }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - command: [ - "/bin/sh", - "-ce", - "/usr/bin/docker-entrypoint.sh minio server {{- range $i := until $poolCount }}{{ $factor := mul $i $nodeCount }}{{ $endIndex := add $factor $nodeCount }}{{ $beginIndex := mul $i $nodeCount }} {{ $scheme }}://{{ template `minio.fullname` $ }}-{{ `{` }}{{ $beginIndex }}...{{ sub $endIndex 1 }}{{ `}`}}.{{ template `minio.fullname` $ }}-svc.{{ $.Release.Namespace }}.svc{{if (gt $drivesPerNode 1)}}{{ $bucketRoot }}-{{ `{` }}0...{{ sub $drivesPerNode 1 }}{{ `}` }}{{ else }}{{ $bucketRoot }}{{end }}{{- end }} -S {{ .Values.certsPath }} --address :{{ .Values.minioAPIPort }} --console-address :{{ .Values.minioConsolePort }} {{- template `minio.extraArgs` . }}" - ] - volumeMounts: - {{- if $penabled }} - {{- if (gt $drivesPerNode 1) }} - {{- range $i := until $drivesPerNode }} - - name: export-{{ $i }} - mountPath: {{ $mountPath }}-{{ $i }} - {{- if and $penabled $subPath }} - subPath: {{ $subPath }} - {{- end }} - {{- end }} - {{- else }} - - name: export - mountPath: {{ $mountPath }} - {{- if and $penabled $subPath }} - subPath: {{ $subPath }} - {{- end }} - {{- end }} - {{- end }} - {{- if .Values.extraSecret }} - - name: extra-secret - mountPath: "/tmp/minio-config-env" - {{- end }} - {{- include "minio.tlsKeysVolumeMount" . | indent 12 }} - {{- if .Values.extraVolumeMounts }} - {{- toYaml .Values.extraVolumeMounts | nindent 12 }} - {{- end }} - ports: - - name: {{ $scheme }} - containerPort: {{ .Values.minioAPIPort }} - - name: {{ $scheme }}-console - containerPort: {{ .Values.minioConsolePort }} - env: - - name: MINIO_ROOT_USER - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: rootUser - - name: MINIO_ROOT_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: rootPassword - {{- if .Values.extraSecret }} - - name: MINIO_CONFIG_ENV_FILE - value: "/tmp/minio-config-env/config.env" - {{- end }} - {{- if .Values.metrics.serviceMonitor.public }} - - name: MINIO_PROMETHEUS_AUTH_TYPE - value: "public" - {{- end }} - {{- if .Values.oidc.enabled }} - - name: MINIO_IDENTITY_OPENID_CONFIG_URL - value: {{ .Values.oidc.configUrl }} - - name: MINIO_IDENTITY_OPENID_CLIENT_ID - {{- if and .Values.oidc.existingClientSecretName .Values.oidc.existingClientIdKey }} - valueFrom: - secretKeyRef: - name: {{ .Values.oidc.existingClientSecretName }} - key: {{ .Values.oidc.existingClientIdKey }} - {{- else }} - value: {{ .Values.oidc.clientId }} - {{- end }} - - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET - {{- if and .Values.oidc.existingClientSecretName .Values.oidc.existingClientSecretKey }} - valueFrom: - secretKeyRef: - name: {{ .Values.oidc.existingClientSecretName }} - key: {{ .Values.oidc.existingClientSecretKey }} - {{- else }} - value: {{ .Values.oidc.clientSecret }} - {{- end }} - - name: MINIO_IDENTITY_OPENID_CLAIM_NAME - value: {{ .Values.oidc.claimName }} - - name: MINIO_IDENTITY_OPENID_CLAIM_PREFIX - value: {{ .Values.oidc.claimPrefix }} - - name: MINIO_IDENTITY_OPENID_SCOPES - value: {{ .Values.oidc.scopes }} - - name: MINIO_IDENTITY_OPENID_COMMENT - value: {{ .Values.oidc.comment }} - - name: MINIO_IDENTITY_OPENID_REDIRECT_URI - value: {{ .Values.oidc.redirectUri }} - - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME - value: {{ .Values.oidc.displayName }} - {{- end }} - {{- range $key, $val := .Values.environment }} - - name: {{ $key }} - value: {{ tpl $val $ | quote }} - {{- end }} - resources: {{- toYaml .Values.resources | nindent 12 }} - {{- if and .Values.securityContext.enabled .Values.persistence.enabled }} - {{- with .Values.containerSecurityContext }} - securityContext: {{ toYaml . | nindent 12}} - {{- end }} - {{- end }} - {{- with .Values.extraContainers }} - {{- if eq (typeOf .) "string" }} - {{- tpl . $ | nindent 8 }} - {{- else }} - {{- toYaml . | nindent 8 }} - {{- end }} - {{- end }} - {{- with .Values.nodeSelector }} - nodeSelector: {{- toYaml . | nindent 8 }} - {{- end }} - {{- include "minio.imagePullSecrets" . | indent 6 }} - {{- with .Values.affinity }} - affinity: {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: {{- toYaml . | nindent 8 }} - {{- end }} - {{- if and (gt $replicas 1) (ge .Capabilities.KubeVersion.Major "1") (ge .Capabilities.KubeVersion.Minor "19") }} - {{- with .Values.topologySpreadConstraints }} - topologySpreadConstraints: {{- toYaml . | nindent 8 }} - {{- end }} - {{- end }} - volumes: - - name: minio-user - secret: - secretName: {{ template "minio.secretName" . }} - {{- if .Values.extraSecret }} - - name: extra-secret - secret: - secretName: {{ .Values.extraSecret }} - {{- end }} - {{- include "minio.tlsKeysVolume" . | indent 8 }} - {{- if .Values.extraVolumes }} - {{- toYaml .Values.extraVolumes | nindent 8 }} - {{- end }} - {{- if .Values.persistence.enabled }} - volumeClaimTemplates: - {{- if gt $drivesPerNode 1 }} - {{- range $diskId := until $drivesPerNode}} - - apiVersion: v1 - kind: PersistentVolumeClaim - metadata: - name: export-{{ $diskId }} - {{- if $.Values.persistence.annotations }} - annotations: {{- toYaml $.Values.persistence.annotations | nindent 10 }} - {{- end }} - spec: - accessModes: [ {{ $accessMode | quote }} ] - {{- if $storageClass }} - storageClassName: {{ $storageClass }} - {{- end }} - resources: - requests: - storage: {{ $psize }} - {{- end }} - {{- else }} - - apiVersion: v1 - kind: PersistentVolumeClaim - metadata: - name: export - {{- if $.Values.persistence.annotations }} - annotations: {{- toYaml $.Values.persistence.annotations | nindent 10 }} - {{- end }} - spec: - accessModes: [ {{ $accessMode | quote }} ] - {{- if $storageClass }} - storageClassName: {{ $storageClass }} - {{- end }} - resources: - requests: - storage: {{ $psize }} - {{- end }} - {{- end }} -{{- end }} diff --git a/charts/devtron-utilities/charts/minio/values.yaml b/charts/devtron-utilities/charts/minio/values.yaml deleted file mode 100644 index 4c9714ea9..000000000 --- a/charts/devtron-utilities/charts/minio/values.yaml +++ /dev/null @@ -1,593 +0,0 @@ -## Provide a name in place of minio for `app:` labels -## -nameOverride: "" - -## Provide a name to substitute for the full names of resources -## -fullnameOverride: "" - -## set kubernetes cluster domain where minio is running -## -clusterDomain: cluster.local - -## Set default image, imageTag, and imagePullPolicy. mode is used to indicate the -## -image: - repository: quay.io/minio/minio - tag: RELEASE.2024-12-18T13-15-44Z - pullPolicy: IfNotPresent - -imagePullSecrets: [] -# - name: "image-pull-secret" - -## Set default image, imageTag, and imagePullPolicy for the `mc` (the minio -## client used to create a default bucket). -## -mcImage: - repository: quay.io/minio/mc - tag: RELEASE.2024-11-21T17-21-54Z - pullPolicy: IfNotPresent - -## minio mode, i.e. standalone or distributed -mode: distributed ## other supported values are "standalone" - -## Additional labels to include with deployment or statefulset -additionalLabels: {} - -## Additional annotations to include with deployment or statefulset -additionalAnnotations: {} - -## Typically the deployment/statefulset includes checksums of secrets/config, -## So that when these change on a subsequent helm install, the deployment/statefulset -## is restarted. This can result in unnecessary restarts under GitOps tooling such as -## flux, so set to "true" to disable this behaviour. -ignoreChartChecksums: false - -## Additional arguments to pass to minio binary -extraArgs: [] -# example for enabling FTP: -# - --ftp=\"address=:8021\" -# - --ftp=\"passive-port-range=10000-10010\" - -## Additional volumes to minio container -extraVolumes: [] - -## Additional volumeMounts to minio container -extraVolumeMounts: [] - -## Additional sidecar containers -extraContainers: [] - -## Internal port number for MinIO S3 API container -## Change service.port to change external port number -minioAPIPort: "9000" - -## Internal port number for MinIO Browser Console container -## Change consoleService.port to change external port number -minioConsolePort: "9001" - -## Update strategy for Deployments -deploymentUpdate: - type: RollingUpdate - maxUnavailable: 0 - maxSurge: 100% - -## Update strategy for StatefulSets -statefulSetUpdate: - updateStrategy: RollingUpdate - -## Pod priority settings -## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ -## -priorityClassName: "" - -## Pod runtime class name -## ref https://kubernetes.io/docs/concepts/containers/runtime-class/ -## -runtimeClassName: "" - -## Set default rootUser, rootPassword -## rootUser and rootPassword is generated when not set -## Distributed MinIO ref: https://min.io/docs/minio/linux/operations/install-deploy-manage/deploy-minio-multi-node-multi-drive.html -## -rootUser: "" -rootPassword: "" - -## Use existing Secret that store following variables: -## -## | Chart var | .data. in Secret | -## |:----------------------|:-------------------------| -## | rootUser | rootUser | -## | rootPassword | rootPassword | -## -## All mentioned variables will be ignored in values file. -## .data.rootUser and .data.rootPassword are mandatory, -## others depend on enabled status of corresponding sections. -existingSecret: "" - -## Directory on the MinIO pof -certsPath: "/etc/minio/certs/" -configPathmc: "/etc/minio/mc/" - -## Path where PV would be mounted on the MinIO Pod -mountPath: "/export" -## Override the root directory which the minio server should serve from. -## If left empty, it defaults to the value of {{ .Values.mountPath }} -## If defined, it must be a sub-directory of the path specified in {{ .Values.mountPath }} -## -bucketRoot: "" - -# Number of drives attached to a node -drivesPerNode: 1 -# Number of MinIO containers running -replicas: 16 -# Number of expanded MinIO clusters -pools: 1 - -## TLS Settings for MinIO -tls: - enabled: false - ## Create a secret with private.key and public.crt files and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret - certSecret: "" - publicCrt: public.crt - privateKey: private.key - -## Trusted Certificates Settings for MinIO. Ref: https://min.io/docs/minio/linux/operations/network-encryption.html#third-party-certificate-authorities -## Bundle multiple trusted certificates into one secret and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret -## When using self-signed certificates, remember to include MinIO's own certificate in the bundle with key public.crt. -## If certSecret is left empty and tls is enabled, this chart installs the public certificate from .Values.tls.certSecret. -trustedCertsSecret: "" - -## Enable persistence using Persistent Volume Claims -## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ -## -persistence: - enabled: true - annotations: {} - - ## A manually managed Persistent Volume and Claim - ## Requires persistence.enabled: true - ## If defined, PVC must be created manually before volume will be bound - existingClaim: "" - - ## minio data Persistent Volume Storage Class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - ## - ## Storage class of PV to bind. By default it looks for standard storage class. - ## If the PV uses a different storage class, specify that here. - storageClass: "" - volumeName: "" - accessMode: ReadWriteOnce - size: 500Gi - - ## If subPath is set mount a sub folder of a volume instead of the root of the volume. - ## This is especially handy for volume plugins that don't natively support sub mounting (like glusterfs). - ## - subPath: "" - -## Expose the MinIO service to be accessed from outside the cluster (LoadBalancer service). -## or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it. -## ref: http://kubernetes.io/docs/user-guide/services/ -## -service: - type: ClusterIP - clusterIP: ~ - port: "9000" - nodePort: 32000 - loadBalancerIP: ~ - externalIPs: [] - annotations: {} - - ## service.loadBalancerSourceRanges Addresses that are allowed when service is LoadBalancer - ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service - ## - #loadBalancerSourceRanges: - # - 10.10.10.0/24 - loadBalancerSourceRanges: [] - - ## service.externalTrafficPolicy minio service external traffic policy - ## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip - ## - externalTrafficPolicy: Cluster - -## Configure Ingress based on the documentation here: https://kubernetes.io/docs/concepts/services-networking/ingress/ -## - -ingress: - enabled: false - ingressClassName: ~ - labels: {} - # node-role.kubernetes.io/ingress: platform - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - # kubernetes.io/ingress.allow-http: "false" - # kubernetes.io/ingress.global-static-ip-name: "" - # nginx.ingress.kubernetes.io/secure-backends: "true" - # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" - # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0 - path: / - hosts: - - minio-example.local - tls: [] - # - secretName: chart-example-tls - # hosts: - # - chart-example.local - -consoleService: - type: ClusterIP - clusterIP: ~ - port: "9001" - nodePort: 32001 - loadBalancerIP: ~ - externalIPs: [] - annotations: {} - ## consoleService.loadBalancerSourceRanges Addresses that are allowed when service is LoadBalancer - ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service - ## - #loadBalancerSourceRanges: - # - 10.10.10.0/24 - loadBalancerSourceRanges: [] - - ## servconsoleServiceice.externalTrafficPolicy minio service external traffic policy - ## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip - ## - externalTrafficPolicy: Cluster - -consoleIngress: - enabled: false - ingressClassName: ~ - labels: {} - # node-role.kubernetes.io/ingress: platform - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - # kubernetes.io/ingress.allow-http: "false" - # kubernetes.io/ingress.global-static-ip-name: "" - # nginx.ingress.kubernetes.io/secure-backends: "true" - # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" - # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0 - path: / - hosts: - - console.minio-example.local - tls: [] - # - secretName: chart-example-tls - # hosts: - # - chart-example.local - -## Node labels for pod assignment -## Ref: https://kubernetes.io/docs/user-guide/node-selection/ -## -nodeSelector: {} -tolerations: [] -affinity: {} -topologySpreadConstraints: [] - -## Add stateful containers to have security context, if enabled MinIO will run as this -## user and group NOTE: securityContext is only enabled if persistence.enabled=true -securityContext: - enabled: true - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - fsGroupChangePolicy: "OnRootMismatch" - -containerSecurityContext: - readOnlyRootFilesystem: false - -# Additational pod annotations -podAnnotations: {} - -# Additional pod labels -podLabels: {} - -## Configure resource requests and limits -## ref: http://kubernetes.io/docs/user-guide/compute-resources/ -## -resources: - requests: - memory: 16Gi - -## List of policies to be created after minio install -## -## In addition to default policies [readonly|readwrite|writeonly|consoleAdmin|diagnostics] -## you can define additional policies with custom supported actions and resources -policies: [] -## writeexamplepolicy policy grants creation or deletion of buckets with name -## starting with example. In addition, grants objects write permissions on buckets starting with -## example. -# - name: writeexamplepolicy -# statements: -# - effect: Allow # this is the default -# resources: -# - 'arn:aws:s3:::example*/*' -# actions: -# - "s3:AbortMultipartUpload" -# - "s3:GetObject" -# - "s3:DeleteObject" -# - "s3:PutObject" -# - "s3:ListMultipartUploadParts" -# - resources: -# - 'arn:aws:s3:::example*' -# actions: -# - "s3:CreateBucket" -# - "s3:DeleteBucket" -# - "s3:GetBucketLocation" -# - "s3:ListBucket" -# - "s3:ListBucketMultipartUploads" -## readonlyexamplepolicy policy grants access to buckets with name starting with example. -## In addition, grants objects read permissions on buckets starting with example. -# - name: readonlyexamplepolicy -# statements: -# - resources: -# - 'arn:aws:s3:::example*/*' -# actions: -# - "s3:GetObject" -# - resources: -# - 'arn:aws:s3:::example*' -# actions: -# - "s3:GetBucketLocation" -# - "s3:ListBucket" -# - "s3:ListBucketMultipartUploads" -## conditionsexample policy creates all access to example bucket with aws:username="johndoe" and source ip range 10.0.0.0/8 and 192.168.0.0/24 only -# - name: conditionsexample -# statements: -# - resources: -# - 'arn:aws:s3:::example/*' -# actions: -# - 's3:*' -# conditions: -# - StringEquals: '"aws:username": "johndoe"' -# - IpAddress: | -# "aws:SourceIp": [ -# "10.0.0.0/8", -# "192.168.0.0/24" -# ] -# -## Additional Annotations for the Kubernetes Job makePolicyJob -makePolicyJob: - securityContext: - enabled: false - runAsUser: 1000 - runAsGroup: 1000 - resources: - requests: - memory: 128Mi - # Command to run after the main command on exit - exitCommand: "" - -## List of users to be created after minio install -## -users: - ## Username, password and policy to be assigned to the user - ## Default policies are [readonly|readwrite|writeonly|consoleAdmin|diagnostics] - ## Add new policies as explained here https://min.io/docs/minio/kubernetes/upstream/administration/identity-access-management.html#access-management - ## NOTE: this will fail if LDAP is enabled in your MinIO deployment - ## make sure to disable this if you are using LDAP. - - accessKey: console - secretKey: console123 - policy: consoleAdmin - # Or you can refer to specific secret - #- accessKey: externalSecret - # existingSecret: my-secret - # existingSecretKey: password - # policy: readonly - -## Additional Annotations for the Kubernetes Job makeUserJob -makeUserJob: - securityContext: - enabled: false - runAsUser: 1000 - runAsGroup: 1000 - resources: - requests: - memory: 128Mi - # Command to run after the main command on exit - exitCommand: "" - -## List of service accounts to be created after minio install -## -svcaccts: [] - ## accessKey, secretKey and parent user to be assigned to the service accounts - ## Add new service accounts as explained here https://min.io/docs/minio/kubernetes/upstream/administration/identity-access-management/minio-user-management.html#service-accounts - # - accessKey: console-svcacct - # secretKey: console123 - # user: console - ## Or you can refer to specific secret - # - accessKey: externalSecret - # existingSecret: my-secret - # existingSecretKey: password - # user: console - ## You also can pass custom policy - # - accessKey: console-svcacct - # secretKey: console123 - # user: console - # policy: - # statements: - # - resources: - # - 'arn:aws:s3:::example*/*' - # actions: - # - "s3:AbortMultipartUpload" - # - "s3:GetObject" - # - "s3:DeleteObject" - # - "s3:PutObject" - # - "s3:ListMultipartUploadParts" - -makeServiceAccountJob: - securityContext: - enabled: false - runAsUser: 1000 - runAsGroup: 1000 - resources: - requests: - memory: 128Mi - # Command to run after the main command on exit - exitCommand: "" - -## List of buckets to be created after minio install -## -buckets: [] - # # Name of the bucket - # - name: bucket1 - # # Policy to be set on the - # # bucket [none|download|upload|public] - # policy: none - # # Purge if bucket exists already - # purge: false - # # set versioning for - # # bucket [true|false] - # versioning: false # remove this key if you do not want versioning feature - # # set objectlocking for - # # bucket [true|false] NOTE: versioning is enabled by default if you use locking - # objectlocking: false - # - name: bucket2 - # policy: none - # purge: false - # versioning: true - # # set objectlocking for - # # bucket [true|false] NOTE: versioning is enabled by default if you use locking - # objectlocking: false - -## Additional Annotations for the Kubernetes Job makeBucketJob -makeBucketJob: - securityContext: - enabled: false - runAsUser: 1000 - runAsGroup: 1000 - resources: - requests: - memory: 128Mi - # Command to run after the main command on exit - exitCommand: "" - -## List of command to run after minio install -## NOTE: the mc command TARGET is always "myminio" -customCommands: - # - command: "admin policy attach myminio consoleAdmin --group='cn=ops,cn=groups,dc=example,dc=com'" - -## Additional Annotations for the Kubernetes Job customCommandJob -customCommandJob: - securityContext: - enabled: false - runAsUser: 1000 - runAsGroup: 1000 - resources: - requests: - memory: 128Mi - ## Additional volumes to add to the post-job. - extraVolumes: [] - # - name: extra-policies - # configMap: - # name: my-extra-policies-cm - ## Additional volumeMounts to add to the custom commands container when - ## running the post-job. - extraVolumeMounts: [] - # - name: extra-policies - # mountPath: /mnt/extras/ - # Command to run after the main command on exit - exitCommand: "" - -## Merge jobs -postJob: - podAnnotations: {} - annotations: {} - securityContext: - enabled: false - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - nodeSelector: {} - tolerations: [] - affinity: {} - -## Use this field to add environment variables relevant to MinIO server. These fields will be passed on to MinIO container(s) -## when Chart is deployed -environment: - ## Please refer for comprehensive list https://min.io/docs/minio/linux/reference/minio-server/minio-server.html - ## MINIO_SUBNET_LICENSE: "License key obtained from https://subnet.min.io" - ## MINIO_BROWSER: "off" - -## The name of a secret in the same kubernetes namespace which contain secret values -## This can be useful for LDAP password, etc -## The key in the secret must be 'config.env' -## -extraSecret: ~ - -## OpenID Identity Management -## The following section documents environment variables for enabling external identity management using an OpenID Connect (OIDC)-compatible provider. -## See https://min.io/docs/minio/linux/operations/external-iam/configure-openid-external-identity-management.html for a tutorial on using these variables. -oidc: - enabled: false - configUrl: "https://identity-provider-url/.well-known/openid-configuration" - clientId: "minio" - clientSecret: "" - # Provide existing client secret from the Kubernetes Secret resource, existing secret will have priority over `clientId` and/or `clientSecret`` - existingClientSecretName: "" - existingClientIdKey: "" - existingClientSecretKey: "" - claimName: "policy" - scopes: "openid,profile,email" - redirectUri: "https://console-endpoint-url/oauth_callback" - # Can leave empty - claimPrefix: "" - comment: "" - displayName: "" - -networkPolicy: - enabled: false - # Specifies whether the policies created will be standard Network Policies (flavor: kubernetes) - # or Cilium Network Policies (flavor: cilium) - flavor: kubernetes - allowExternal: true - # only when using flavor: cilium - egressEntities: - - kube-apiserver - -## PodDisruptionBudget settings -## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ -## -podDisruptionBudget: - enabled: false - maxUnavailable: 1 - -## Specify the service account to use for the MinIO pods. If 'create' is set to 'false' -## and 'name' is left unspecified, the account 'default' will be used. -serviceAccount: - create: true - ## The name of the service account to use. If 'create' is 'true', a service account with that name - ## will be created. - name: "minio-sa" - -metrics: - serviceMonitor: - enabled: false - # scrape each node/pod individually for additional metrics - includeNode: false - public: true - additionalLabels: {} - annotations: {} - # for node metrics - relabelConfigs: {} - # for cluster metrics - relabelConfigsCluster: {} - # metricRelabelings: - # - regex: (server|pod) - # action: labeldrop - namespace: ~ - # Scrape interval, for example `interval: 30s` - interval: ~ - # Scrape timeout, for example `scrapeTimeout: 10s` - scrapeTimeout: ~ - -## ETCD settings: https://github.com/minio/minio/blob/master/docs/sts/etcd.md -## Define endpoints to enable this section. -etcd: - endpoints: [] - pathPrefix: "" - corednsPathPrefix: "" - clientCert: "" - clientCertKey: "" From 5d741bf5aefa820136fe1f425c0c67b0fd8f5080 Mon Sep 17 00:00:00 2001 From: Yashasvi17 <155513200+YashasviDevtron@users.noreply.github.com> Date: Thu, 25 Sep 2025 16:13:56 +0530 Subject: [PATCH 6/7] Delete charts/devtron-utilities/Chart.lock --- charts/devtron-utilities/Chart.lock | 39 ----------------------------- 1 file changed, 39 deletions(-) delete mode 100644 charts/devtron-utilities/Chart.lock diff --git a/charts/devtron-utilities/Chart.lock b/charts/devtron-utilities/Chart.lock deleted file mode 100644 index 0510f34b9..000000000 --- a/charts/devtron-utilities/Chart.lock +++ /dev/null @@ -1,39 +0,0 @@ -dependencies: -- name: ingress-nginx - repository: https://kubernetes.github.io/ingress-nginx - version: 4.12.0 -- name: cluster-autoscaler - repository: https://kubernetes.github.io/autoscaler - version: 9.46.0 -- name: karpenter - repository: oci://public.ecr.aws/karpenter - version: 1.4.0 -- name: aws-load-balancer-controller - repository: https://aws.github.io/eks-charts - version: 1.11.0 -- name: aws-node-termination-handler - repository: https://aws.github.io/eks-charts - version: 0.21.0 -- name: minio - repository: https://charts.min.io/ - version: 5.4.0 -- name: kcert - repository: https://nabsul.github.io/helm - version: 1.0.7 -- name: argocd-certificate-refresh - repository: https://helm.devtron.ai/ - version: 0.10.8 -- name: k8s-shield - repository: https://helm.devtron.ai/ - version: 0.1.0 -- name: devtron-backups - repository: https://helm.devtron.ai/ - version: 0.2.5 -- name: devtron-generic-helm - repository: https://helm.devtron.ai/ - version: 0.10.1 -- name: holmes - repository: https://robusta-charts.storage.googleapis.com - version: 0.8.1 -digest: sha256:a496eecb07ba3de9d4def3cb2afbc652f95ded26af0745559bb6b7da033b33f8 -generated: "2025-07-07T17:13:45.33696+05:30" From 30dd82cc02c9e7eddb2476fad977fd71ebe9220e Mon Sep 17 00:00:00 2001 From: Yashasvi17 <155513200+YashasviDevtron@users.noreply.github.com> Date: Thu, 25 Sep 2025 16:17:39 +0530 Subject: [PATCH 7/7] Update values.yaml --- charts/devtron-utilities/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/devtron-utilities/values.yaml b/charts/devtron-utilities/values.yaml index fea9bdbfa..242e71248 100644 --- a/charts/devtron-utilities/values.yaml +++ b/charts/devtron-utilities/values.yaml @@ -1,6 +1,6 @@ # Default values for aws-load-balancer-controller. aws-load-balancer-controller: - enabled: true + enabled: false resources: {} clusterName: "" region: "" @@ -241,4 +241,4 @@ holmes-ai: value: gpt-4o-mini k8s-shield: - enabled: false \ No newline at end of file + enabled: false