Skip to content

Commit 31db7ae

Browse files
oliverbaehleroliverbaehler
authored
feat: add minor improvements (#965)
* feat: add logger middleware Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * fix(proxy): fix matching of core api groups and remove regexp Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * feat: add strict rbac for proxy Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * feat: use cert-manager as default issuer Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * feat: add optiona gangplank instance Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: merge commit Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: bump controller-runtime Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: upgrade fluxcd to 2.7.5 Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> --------- Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
1 parent d03fb44 commit 31db7ae

42 files changed

Lines changed: 1382 additions & 88 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎Makefile‎

Lines changed: 32 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -183,51 +183,58 @@ ifeq ($(CAPSULE_PROXY_MODE),http)
183183
--set "options.enableSSL=false" \
184184
--set "options.logLevel=10" \
185185
--set "options.pprof=true" \
186+
--set "options.leaderElection=true" \
186187
--set "service.type=NodePort" \
187188
--set "kind=DaemonSet" \
188189
--set "daemonset.hostNetwork=true" \
189190
--set "serviceMonitor.enabled=false" \
190191
--set "options.generateCertificates=false" \
191-
--set "webhooks.enabled=true" \
192+
--set "certManager.generateCertificates=false" \
192193
--set "options.extraArgs={--feature-gates=ProxyClusterScoped=true,--feature-gates=ProxyAllNamespaced=true}"
193194
else
194195
@echo "Running in HTTPS mode"
195-
@echo "capsule proxy certificates..."
196-
cd hack && $(MKCERT) -install && $(MKCERT) 127.0.0.1 \
197-
&& kubectl --namespace capsule-system delete secret capsule-proxy || true \
198-
&& kubectl --namespace capsule-system create secret generic capsule-proxy --from-file=tls.key=./127.0.0.1-key.pem --from-file=tls.crt=./127.0.0.1.pem --from-literal=ca=$$(cat $(ROOTCA) | base64 |tr -d '\n')
199-
@echo "kubeconfig configurations..."
200-
@cd hack \
201-
&& curl -s https://raw.githubusercontent.com/projectcapsule/capsule/main/hack/create-user.sh | bash -s -- alice oil projectcapsule.dev,capsule.clastix.io \
202-
&& mv alice-oil.kubeconfig alice.kubeconfig \
203-
&& KUBECONFIG=alice.kubeconfig kubectl config set clusters.kind-capsule.certificate-authority-data $$(cat $(ROOTCA) | base64 |tr -d '\n') \
204-
&& KUBECONFIG=alice.kubeconfig kubectl config set clusters.kind-capsule.server https://127.0.0.1:9001 \
205-
&& curl -s https://raw.githubusercontent.com/projectcapsule/capsule/main/hack/create-user.sh | bash -s -- bob gas projectcapsule.dev,capsule.clastix.io \
206-
&& mv bob-gas.kubeconfig bob.kubeconfig \
207-
&& KUBECONFIG=bob.kubeconfig kubectl config set clusters.kind-capsule.certificate-authority-data $$(cat $(ROOTCA) | base64 |tr -d '\n') \
208-
&& KUBECONFIG=bob.kubeconfig kubectl config set clusters.kind-capsule.server https://127.0.0.1:9001 \
209-
&& curl -s https://raw.githubusercontent.com/projectcapsule/capsule/main/hack/create-user.sh | bash -s -- joe gas projectcapsule.dev,capsule.clastix.io,foo.clastix.io \
210-
&& mv joe-gas.kubeconfig foo.clastix.io.kubeconfig \
211-
&& KUBECONFIG=foo.clastix.io.kubeconfig kubectl config set clusters.kind-capsule.certificate-authority-data $$(cat $(ROOTCA) | base64 |tr -d '\n') \
212-
&& KUBECONFIG=foo.clastix.io.kubeconfig kubectl config set clusters.kind-capsule.server https://127.0.0.1:9001 \
213-
&& curl -s https://raw.githubusercontent.com/projectcapsule/capsule/main/hack/create-user.sh | bash -s -- dave soil projectcapsule.dev,capsule.clastix.io,bar.clastix.io \
214-
&& mv dave-soil.kubeconfig dave.kubeconfig \
215-
&& kubectl --kubeconfig=dave.kubeconfig config set clusters.kind-capsule.certificate-authority-data $$(cat $(ROOTCA) | base64 |tr -d '\n') \
216-
&& kubectl --kubeconfig=dave.kubeconfig config set clusters.kind-capsule.server https://127.0.0.1:9001
217196
@echo "Installing Capsule-Proxy using HELM..."
218197
@helm upgrade --install capsule-proxy ./charts/capsule-proxy -n capsule-system \
219198
--set "image.pullPolicy=Never" \
220199
--set "image.tag=$(VERSION)" \
221200
--set "options.logLevel=10" \
222201
--set "options.pprof=true" \
202+
--set "options.leaderElection=true" \
223203
--set "service.type=NodePort" \
224204
--set "kind=DaemonSet" \
225205
--set "daemonset.hostNetwork=true" \
226206
--set "serviceMonitor.enabled=false" \
227-
--set "webhooks.enabled=true" \
207+
--set "options.generateCertificates=false" \
208+
--set "certManager.certificate.ipAddresses={127.0.0.1}" \
228209
--set "options.extraArgs={--feature-gates=ProxyClusterScoped=true,--feature-gates=ProxyAllNamespaced=true}"
229210
endif
230211
@kubectl rollout restart ds capsule-proxy -n capsule-system || true
212+
$(MAKE) generate-kubeconfigs
213+
214+
generate-kubeconfigs:
215+
CA_B64=$$(kubectl -n capsule-system get secret capsule-proxy-root-secret -o jsonpath='{.data.ca\.crt}') ; \
216+
if [ -z "$$CA_B64" ]; then \
217+
echo "ERROR: secret capsule-system/capsule-proxy-root-secret missing .data[ca.crt]" ; \
218+
exit 1 ; \
219+
fi;
220+
@cd hack \
221+
&& CA_B64=$$(kubectl -n capsule-system get secret capsule-proxy-root-secret -o jsonpath='{.data.ca\.crt}') \
222+
&& curl -s https://raw.githubusercontent.com/projectcapsule/capsule/main/hack/create-user.sh | bash -s -- alice oil projectcapsule.dev,capsule.clastix.io \
223+
&& mv alice-oil.kubeconfig alice.kubeconfig \
224+
&& KUBECONFIG=alice.kubeconfig kubectl config set clusters.kind-capsule.certificate-authority-data "$$CA_B64" \
225+
&& KUBECONFIG=alice.kubeconfig kubectl config set clusters.kind-capsule.server https://127.0.0.1:9001 \
226+
&& curl -s https://raw.githubusercontent.com/projectcapsule/capsule/main/hack/create-user.sh | bash -s -- bob gas projectcapsule.dev,capsule.clastix.io \
227+
&& mv bob-gas.kubeconfig bob.kubeconfig \
228+
&& KUBECONFIG=bob.kubeconfig kubectl config set clusters.kind-capsule.certificate-authority-data "$$CA_B64" \
229+
&& KUBECONFIG=bob.kubeconfig kubectl config set clusters.kind-capsule.server https://127.0.0.1:9001 \
230+
&& curl -s https://raw.githubusercontent.com/projectcapsule/capsule/main/hack/create-user.sh | bash -s -- joe gas projectcapsule.dev,capsule.clastix.io,foo.clastix.io \
231+
&& mv joe-gas.kubeconfig foo.clastix.io.kubeconfig \
232+
&& KUBECONFIG=foo.clastix.io.kubeconfig kubectl config set clusters.kind-capsule.certificate-authority-data "$$CA_B64" \
233+
&& KUBECONFIG=foo.clastix.io.kubeconfig kubectl config set clusters.kind-capsule.server https://127.0.0.1:9001 \
234+
&& curl -s https://raw.githubusercontent.com/projectcapsule/capsule/main/hack/create-user.sh | bash -s -- dave soil projectcapsule.dev,capsule.clastix.io,bar.clastix.io \
235+
&& mv dave-soil.kubeconfig dave.kubeconfig \
236+
&& kubectl --kubeconfig=dave.kubeconfig config set clusters.kind-capsule.certificate-authority-data "$$CA_B64" \
237+
&& kubectl --kubeconfig=dave.kubeconfig config set clusters.kind-capsule.server https://127.0.0.1:9001
231238

232239
install-dependencies:
233240
@$(KUBECTL) kustomize e2e/distro/flux/ | kubectl apply --force-conflicts --server-side=true -f -
@@ -305,7 +312,7 @@ helm-doc:
305312
# -- Tools
306313
####################
307314
CONTROLLER_GEN := $(LOCALBIN)/controller-gen
308-
CONTROLLER_GEN_VERSION ?= v0.19.0
315+
CONTROLLER_GEN_VERSION ?= v0.20.0
309316
CONTROLLER_GEN_LOOKUP := kubernetes-sigs/controller-tools
310317
controller-gen:
311318
@test -s $(CONTROLLER_GEN) && $(CONTROLLER_GEN) --version | grep -q $(CONTROLLER_GEN_VERSION) || \

‎charts/capsule-proxy/README.md‎

Lines changed: 50 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ If you only need to make minor customizations, you can specify them on the comma
9595
| global.jobs.certs.image.pullPolicy | string | `"IfNotPresent"` | Set the image pull policy of the post install certgen job |
9696
| global.jobs.certs.image.registry | string | `"registry.k8s.io"` | Set the image repository of the post install certgen job |
9797
| global.jobs.certs.image.repository | string | `"ingress-nginx/kube-webhook-certgen"` | Set the image repository of the post install certgen job |
98-
| global.jobs.certs.image.tag | string | `"v1.6.5"` | Set the image tag of the post install certgen job |
98+
| global.jobs.certs.image.tag | string | `"v1.6.7"` | Set the image tag of the post install certgen job |
9999
| global.jobs.certs.nodeSelector | object | `{}` | Set the node selector |
100100
| global.jobs.certs.podSecurityContext | object | `{"enabled":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the job pods. |
101101
| global.jobs.certs.priorityClassName | string | `""` | Set a pod priorityClassName |
@@ -137,6 +137,7 @@ If you only need to make minor customizations, you can specify them on the comma
137137
| daemonset.hostPort | bool | `false` | Binding the capsule-proxy listening port to the host port. |
138138
| env | list | `[]` | Additional environment variables |
139139
| hostNetwork | bool | `false` | When deployed as DaemonSet use |
140+
| hostUsers | bool | `true` | Don't use Host Users (User Namespaces) |
140141
| image.pullPolicy | string | `"IfNotPresent"` | Set the image pull policy. |
141142
| image.registry | string | `"ghcr.io"` | Set the image registry for capsule-proxy |
142143
| image.repository | string | `"projectcapsule/capsule-proxy"` | Set the image repository for capsule-proxy. |
@@ -150,7 +151,7 @@ If you only need to make minor customizations, you can specify them on the comma
150151
| podLabels | object | `{}` | Labels to add to the capsule-proxy pod. |
151152
| podSecurityContext | object | `{"enabled":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the capsule-proxy pod. |
152153
| priorityClassName | string | `""` | Specifies PriorityClass of the capsule-proxy pod. |
153-
| rbac.clusterRole | string | `"cluster-admin"` | Controller ClusterRole |
154+
| rbac.clusterRole | string | `""` | Controller ClusterRole |
154155
| rbac.enabled | bool | `true` | Enable Creation of ClusterRoles |
155156
| readinessProbe | object | `{"enabled":true,"httpGet":{"path":"/readyz/","port":"probe","scheme":"HTTP"},"initialDelaySeconds":5}` | Proxy Readyness-Probe |
156157
| replicaCount | int | `1` | Set the replica count for capsule-proxy pod. |
@@ -184,7 +185,7 @@ If you only need to make minor customizations, you can specify them on the comma
184185
| options.disableCaching | bool | `false` | Disable the go-client caching to hit directly the Kubernetes API Server, it disables any local caching as the rolebinding reflector. |
185186
| options.enableSSL | bool | `true` | Specify if capsule-proxy will use SSL |
186187
| options.extraArgs | list | `[]` | A list of extra arguments to add to the capsule-proxy. |
187-
| options.generateCertificates | bool | `true` | Specify if capsule-proxy will generate self-signed SSL certificates |
188+
| options.generateCertificates | bool | `false` | Specify if capsule-proxy will generate self-signed SSL certificates |
188189
| options.ignoredUserGroups | list | `[]` | Define which groups must be ignored while proxying requests |
189190
| options.leaderElection | bool | `false` | Set leader election to true if you are running n-replicas |
190191
| options.listeningPort | int | `9001` | Set the listening port of the capsule-proxy |
@@ -207,7 +208,7 @@ You can manage the certificate with the help of [cert-manager](https://cert-mana
207208
| certManager.certificate.uris | list | `[]` | Additional URIs to include in certificate |
208209
| certManager.externalCA.enabled | bool | `false` | Set if want cert manager to sign certificates with an external CA |
209210
| certManager.externalCA.secretName | string | `""` | |
210-
| certManager.generateCertificates | bool | `false` | Set if the cert manager will generate SSL certificates (self-signed or CA-signed) |
211+
| certManager.generateCertificates | bool | `true` | Set if the cert manager will generate SSL certificates (self-signed or CA-signed) |
211212
| certManager.issuer.kind | string | `"Issuer"` | Set if the cert manager will generate either self-signed or CA signed SSL certificates. Its value will be either Issuer or ClusterIssuer |
212213
| certManager.issuer.name | string | `""` | Set the name of the ClusterIssuer if issuer kind is ClusterIssuer and if cert manager will generate CA signed SSL certificates |
213214

@@ -280,6 +281,51 @@ You can manage the certificate with the help of [cert-manager](https://cert-mana
280281
| serviceMonitor.serviceAccount.namespace | string | `""` | |
281282
| serviceMonitor.targetLabels | list | `[]` | Set targetLabels for the serviceMonitor |
282283

284+
### Gangplank Parameters
285+
286+
[Read More](https://projectcapsule.dev/docs/proxy/gangplank/)
287+
288+
| Key | Type | Default | Description |
289+
|-----|------|---------|-------------|
290+
| gangplank.affinity | object | `{}` | Set affinity rules |
291+
| gangplank.config | object | `{"apiServerURL":"https://apiserver.example.test","authorizeURL":"https://oauth2provider.test/authorize","clientID":"client-id","clientSecret":"client-secret","clusterName":"cluster-name","redirectURL":"https://gangplank.example.test/callback","tokenURL":"https://oauth2provider.test/token"}` | Custom inline Gangplank configuration (ENV Styles) |
292+
| gangplank.enabled | bool | `false` | Enable Gangplank |
293+
| gangplank.envFrom | list | `[]` | |
294+
| gangplank.envs | object | `{}` | |
295+
| gangplank.hostUsers | bool | `true` | Don't use Host Users (User Namespaces) |
296+
| gangplank.image.pullPolicy | string | `"IfNotPresent"` | |
297+
| gangplank.image.repository | string | `"registry.sighup.io/fury/gangplank"` | |
298+
| gangplank.image.tag | string | `"1.1.1"` | |
299+
| gangplank.imagePullSecrets | list | `[]` | Configuration for `imagePullSecrets` so that you can use a private images registry. |
300+
| gangplank.ingress.annotations | object | `{}` | |
301+
| gangplank.ingress.className | string | `""` | |
302+
| gangplank.ingress.enabled | bool | `false` | |
303+
| gangplank.ingress.hosts[0].host | string | `"chart-example.local"` | |
304+
| gangplank.ingress.hosts[0].paths[0].path | string | `"/"` | |
305+
| gangplank.ingress.hosts[0].paths[0].pathType | string | `"ImplementationSpecific"` | |
306+
| gangplank.ingress.tls | list | `[]` | |
307+
| gangplank.livenessProbe | object | `{"httpGet":{"path":"/","port":"http"}}` | Configure the liveness probe using Deployment probe specs |
308+
| gangplank.nodeSelector | object | `{}` | Set the node selector |
309+
| gangplank.podAnnotations | object | `{}` | Annotations to add to the pod. |
310+
| gangplank.podLabels | object | `{}` | Labels to add to the pod. |
311+
| gangplank.podSecurityContext | object | `{"seccompProfile":{"type":"RuntimeDefault"}}` | Set the securityContext for the Pod |
312+
| gangplank.priorityClassName | string | `""` | Set a pod priorityClassName |
313+
| gangplank.readinessProbe | object | `{"httpGet":{"path":"/","port":"http"}}` | Configure the readiness probe using Deployment probe spec |
314+
| gangplank.replicaCount | int | `1` | Set the replica count |
315+
| gangplank.resources | object | `{}` | Set the resource requests/limits |
316+
| gangplank.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534}` | Set the securityContext for the Container |
317+
| gangplank.sensitiveEnvs | object | `{"GANGPLANK_CONFIG_SESSION_SECURITY_KEY":"session-security-key"}` | Environment variables (Secret) |
318+
| gangplank.service.port | int | `80` | |
319+
| gangplank.service.type | string | `"ClusterIP"` | |
320+
| gangplank.serviceAccount.annotations | object | `{}` | |
321+
| gangplank.serviceAccount.automount | bool | `true` | |
322+
| gangplank.serviceAccount.create | bool | `true` | |
323+
| gangplank.serviceAccount.name | string | `""` | |
324+
| gangplank.tolerations | list | `[]` | Set list of tolerations |
325+
| gangplank.topologySpreadConstraints | list | `[]` | Set topology spread constraints |
326+
| gangplank.volumeMounts | list | `[]` | Additional volumeMounts on the output Deployment definition. |
327+
| gangplank.volumes | list | `[]` | Additional volumes on the output Deployment definition. |
328+
283329
## Created resources
284330

285331
This Helm Chart cretes the following Kubernetes resources in the release namespace:

‎charts/capsule-proxy/README.md.gotmpl‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ If you only need to make minor customizations, you can specify them on the comma
103103
| Key | Type | Default | Description |
104104
|-----|------|---------|-------------|
105105
{{- range .Values }}
106-
{{- if not (or (hasPrefix "certManager" .Key) (hasPrefix "webhooks" .Key) (hasPrefix "global" .Key) (hasPrefix "options" .Key) (hasPrefix "service." .Key) (hasPrefix "ingress" .Key) (hasPrefix "autoscaling" .Key) (hasPrefix "serviceMonitor" .Key) ) }}
106+
{{- if not (or (hasPrefix "gangplank" .Key) (hasPrefix "certManager" .Key) (hasPrefix "webhooks" .Key) (hasPrefix "global" .Key) (hasPrefix "options" .Key) (hasPrefix "service." .Key) (hasPrefix "ingress" .Key) (hasPrefix "autoscaling" .Key) (hasPrefix "serviceMonitor" .Key) ) }}
107107
| {{ .Key }} | {{ .Type }} | {{ if .Default }}{{ .Default }}{{ else }}{{ .AutoDefault }}{{ end }} | {{ if .Description }}{{ .Description }}{{ else }}{{ .AutoDescription }}{{ end }} |
108108
{{- end }}
109109
{{- end }}
@@ -182,6 +182,18 @@ You can manage the certificate with the help of [cert-manager](https://cert-mana
182182
{{- end }}
183183
{{- end }}
184184

185+
### Gangplank Parameters
186+
187+
[Read More](https://projectcapsule.dev/docs/proxy/gangplank/)
188+
189+
| Key | Type | Default | Description |
190+
|-----|------|---------|-------------|
191+
{{- range .Values }}
192+
{{- if hasPrefix "gangplank" .Key }}
193+
| {{ .Key }} | {{ .Type }} | {{ if .Default }}{{ .Default }}{{ else }}{{ .AutoDefault }}{{ end }} | {{ if .Description }}{{ .Description }}{{ else }}{{ .AutoDescription }}{{ end }} |
194+
{{- end }}
195+
{{- end }}
196+
185197

186198
## Created resources
187199

‎charts/capsule-proxy/ci/gangplank-values.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
gangplank:
2+
enabled: true

‎charts/capsule-proxy/crds/capsule.clastix.io_globalproxysettings.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
55
annotations:
6-
controller-gen.kubebuilder.io/version: v0.19.0
6+
controller-gen.kubebuilder.io/version: v0.20.0
77
name: globalproxysettings.capsule.clastix.io
88
spec:
99
group: capsule.clastix.io

‎charts/capsule-proxy/crds/capsule.clastix.io_proxysettings.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
55
annotations:
6-
controller-gen.kubebuilder.io/version: v0.19.0
6+
controller-gen.kubebuilder.io/version: v0.20.0
77
name: proxysettings.capsule.clastix.io
88
spec:
99
group: capsule.clastix.io

‎charts/capsule-proxy/templates/_helpers.tpl‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@ Expand the name of the chart.
55
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
66
{{- end }}
77

8+
{{- define "gangplank.name" -}}
9+
{{- include "capsule-proxy.name" $ }}-gangplank
10+
{{- end }}
11+
812
{{/*
913
Create a default fully qualified app name.
1014
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
@@ -23,6 +27,10 @@ If release name contains chart name it will be used as a full name.
2327
{{- end }}
2428
{{- end }}
2529

30+
{{- define "gangplank.fullname" -}}
31+
{{- include "capsule-proxy.fullname" $ }}-gangplank
32+
{{- end }}
33+
2634
{{/*
2735
Create chart name and version as used by the chart label.
2836
*/}}
@@ -40,6 +48,17 @@ helm.sh/chart: {{ include "capsule-proxy.chart" . }}
4048
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
4149
{{- end }}
4250
app.kubernetes.io/managed-by: {{ .Release.Service }}
51+
app.kubernetes.io/component: "proxy"
52+
{{- end }}
53+
54+
{{- define "gangplank.labels" -}}
55+
helm.sh/chart: {{ include "capsule-proxy.chart" . }}
56+
{{ include "capsule-proxy.selectorLabels" . }}
57+
{{- if .Chart.AppVersion }}
58+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
59+
{{- end }}
60+
app.kubernetes.io/managed-by: {{ .Release.Service }}
61+
app.kubernetes.io/component: "gangplank"
4362
{{- end }}
4463

4564
{{/*
@@ -48,8 +67,17 @@ Selector labels
4867
{{- define "capsule-proxy.selectorLabels" -}}
4968
app.kubernetes.io/name: {{ include "capsule-proxy.name" . }}
5069
app.kubernetes.io/instance: {{ .Release.Name }}
70+
app.kubernetes.io/component: "proxy"
71+
72+
{{- end }}
73+
74+
{{- define "gangplank.selectorLabels" -}}
75+
app.kubernetes.io/name: {{ include "capsule-proxy.name" . }}
76+
app.kubernetes.io/instance: {{ .Release.Name }}
77+
app.kubernetes.io/component: "gangplank"
5178
{{- end }}
5279

80+
5381
{{/*
5482
Create the name of the service account to use
5583
*/}}
@@ -61,6 +89,14 @@ Create the name of the service account to use
6189
{{- end }}
6290
{{- end }}
6391

92+
{{- define "gangplank.serviceAccountName" -}}
93+
{{- if .Values.gangplank.serviceAccount.create }}
94+
{{- default (include "gangplank.fullname" .) .Values.gangplank.serviceAccount.name }}
95+
{{- else }}
96+
{{- default "default" .Values.gangplank.serviceAccount.name }}
97+
{{- end }}
98+
{{- end }}
99+
64100
{{/*
65101
Create the fully-qualified Docker image to use
66102
*/}}

‎charts/capsule-proxy/templates/_pod.tpl‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@ spec:
1616
dnsPolicy: ClusterFirstWithHostNet
1717
{{- end }}
1818
{{- end }}
19+
{{- if not .Values.hostUsers }}
20+
hostUsers: {{ .Values.hostUsers }}
21+
{{- end }}
1922
{{- with .Values.imagePullSecrets }}
2023
imagePullSecrets:
2124
{{- toYaml . | nindent 4 }}

‎charts/capsule-proxy/templates/certgen-job.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
{{/* Backwards compatibility */}}
22
{{- $Values := mergeOverwrite $.Values.global.jobs.certs $.Values.jobs -}}
3-
43
{{- if and .Values.options.enableSSL .Values.options.generateCertificates -}}
4+
---
55
apiVersion: batch/v1
66
kind: Job
77
metadata:
88
name: {{ include "capsule-proxy.fullname" . }}-certgen
9+
namespace: {{ $.Release.Namespace }}
910
labels:
1011
{{- include "capsule-proxy.labels" . | nindent 4 }}
1112
{{- with $Values.annotations }}

0 commit comments

Comments
 (0)