Skip to content

Commit d706af3

Browse files
oliverbaehleroliverbaehler
committed
fix: deduplicate component label
Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
1 parent 2acfbc4 commit d706af3

18 files changed

Lines changed: 120 additions & 2 deletions

‎charts/capsule-proxy/ci/config-values.yaml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# Controller Options
2+
options:
3+
# -- Set the listening port of the capsule-proxy
4+
listeningPort: 9001
5+
# -- Set leader election to true if you are running n-replicas
6+
leaderElection: false
7+
# -- Set the log verbosity of the capsule-proxy with a value from 1 to 10
8+
logLevel: 4
9+
# -- Name of the CapsuleConfiguration custom resource used by Capsule, required to identify the user groups
10+
capsuleConfigurationName: default
11+
# -- Define which groups must be ignored while proxying requests
12+
ignoredUserGroups:
13+
- "group-1"
14+
- "group-2"
15+
# -- Names of the groups which are not used for impersonation (considered after impersonation-group-regexp)
16+
ignoredImpersonationGroups:
17+
- "group-1"
18+
- "group-2"
19+
# -- Regular expression to match the groups which are considered for impersonation
20+
impersonationGroupRegexp: "some-regex-.*"
21+
# -- Specify if capsule-proxy will use SSL
22+
oidcUsernameClaim: preferred_username
23+
# -- Specify if capsule-proxy will use SSL
24+
enableSSL: true
25+
# -- Set the directory, where SSL certificate and keyfile will be located
26+
SSLDirectory: /opt/capsule-proxy
27+
# -- Set the name of SSL certificate file
28+
SSLCertFileName: tls.crt
29+
# -- Set the name of SSL key file
30+
SSLKeyFileName: tls.key
31+
# -- Specify if capsule-proxy will generate self-signed SSL certificates
32+
generateCertificates: false
33+
# -- Specify additional subject alternative names for the self-signed SSL
34+
additionalSANs: []
35+
# -- Specify an override for the Secret containing the certificate for SSL. Default value is empty and referring to the generated certificate.
36+
certificateVolumeName: ""
37+
# -- Set the role bindings reflector resync period, a local cache to store mappings between users and their namespaces. [Use a lower value in case of flaky etcd server connections.](https://github.com/projectcapsule/capsule-proxy/issues/174)
38+
rolebindingsResyncPeriod: 10h
39+
# -- Disable the go-client caching to hit directly the Kubernetes API Server, it disables any local caching as the rolebinding reflector.
40+
disableCaching: false
41+
# -- Enable the rolebinding reflector, which allows to list the namespaces, where a rolebinding mentions a user.
42+
roleBindingReflector: false
43+
# -- Authentication types to be used for requests. Possible Auth Types: [BearerToken, TLSCertificate,XForwardedClientCert]
44+
authPreferredTypes: "BearerToken,TLSCertificate"
45+
# -- QPS to use for interacting with Kubernetes API Server.
46+
clientConnectionQPS: 20
47+
# -- Burst to use for interacting with kubernetes API Server.
48+
clientConnectionBurst: 30
49+
# -- Enable Pprof for profiling
50+
pprof: false
51+
# -- CIDR ranges of trusted proxies allowed to make requests to the proxy
52+
trustedProxyCidrs:
53+
- "127.0.0.1/32"
54+
extraArgs:
55+
- "--feature-gates=ProxyClusterScoped=true"

‎charts/capsule-proxy/templates/_helpers.tpl‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,6 @@ Selector labels
6565
{{- define "capsule-proxy.selectorLabels" -}}
6666
app.kubernetes.io/name: {{ include "capsule-proxy.name" . }}
6767
app.kubernetes.io/instance: {{ .Release.Name }}
68-
app.kubernetes.io/component: "proxy"
6968

7069
{{- end }}
7170

‎charts/capsule-proxy/templates/_pod.tpl‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ metadata:
55
{{- toYaml . | nindent 4 }}
66
{{- end }}
77
labels:
8+
app.kubernetes.io/component: "proxy"
89
{{- include "capsule-proxy.selectorLabels" . | nindent 4 }}
910
{{- with .Values.podLabels }}
1011
{{- toYaml . | nindent 4 }}
@@ -76,6 +77,15 @@ spec:
7677
- --client-connection-burst={{ .Values.options.clientConnectionBurst }}
7778
- --enable-pprof={{ .Values.options.pprof }}
7879
- --enable-leader-election={{ .Values.options.leaderElection }}
80+
{{- range .Values.options.trustedProxyCidrs }}
81+
- --trusted-proxy-cidrs={{.}}
82+
{{- end }}
83+
{{- range .Values.options.ignoredImpersonationGroups }}
84+
- --ignored-impersonation-group={{.}}
85+
{{- end }}
86+
{{- with .Values.options.impersonationGroupRegexp }}
87+
- --impersonation-group-regexp={{.}}
88+
{{- end }}
7989
{{- with .Values.options.extraArgs }}
8090
{{- toYaml . | nindent 4 }}
8191
{{- end }}

‎charts/capsule-proxy/templates/certgen-job.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ metadata:
88
name: {{ include "capsule-proxy.fullname" . }}-certgen
99
namespace: {{ $.Release.Namespace }}
1010
labels:
11+
app.kubernetes.io/component: "proxy"
1112
{{- include "capsule-proxy.labels" . | nindent 4 }}
1213
{{- with $Values.annotations }}
1314
annotations:
@@ -19,6 +20,7 @@ spec:
1920
metadata:
2021
name: {{ include "capsule-proxy.fullname" . }}-certgen
2122
labels:
23+
app.kubernetes.io/component: "proxy"
2224
{{- include "capsule-proxy.selectorLabels" . | nindent 8 }}
2325
spec:
2426
restartPolicy: {{ $Values.restartPolicy }}

‎charts/capsule-proxy/templates/certmanager.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ kind: Issuer
66
metadata:
77
name: {{ include "capsule-proxy.fullname" . }}-selfsigned-issuer
88
namespace: {{ $.Release.Namespace }}
9+
labels:
10+
app.kubernetes.io/component: "proxy"
11+
{{- include "capsule-proxy.labels" . | nindent 4 }}
912
spec:
1013
selfSigned: {}
1114
---
@@ -14,6 +17,9 @@ kind: Certificate
1417
metadata:
1518
name: {{ include "capsule-proxy.fullname" . }}-selfsigned-ca
1619
namespace: {{ $.Release.Namespace }}
20+
labels:
21+
app.kubernetes.io/component: "proxy"
22+
{{- include "capsule-proxy.labels" . | nindent 4 }}
1723
spec:
1824
isCA: true
1925
commonName: {{ include "capsule-proxy.fullname" . }}-selfsigned-ca
@@ -37,6 +43,9 @@ kind: Issuer
3743
metadata:
3844
name: {{ include "capsule-proxy.fullname" . }}-ca-issuer
3945
namespace: {{ $.Release.Namespace }}
46+
labels:
47+
app.kubernetes.io/component: "proxy"
48+
{{- include "capsule-proxy.labels" . | nindent 4 }}
4049
spec:
4150
ca:
4251
secretName: {{ include "capsule-proxy.caSecretName" . }}
@@ -47,6 +56,9 @@ kind: Certificate
4756
metadata:
4857
name: {{ include "capsule-proxy.fullname" . }}-serving-cert
4958
namespace: {{ $.Release.Namespace }}
59+
labels:
60+
app.kubernetes.io/component: "proxy"
61+
{{- include "capsule-proxy.labels" . | nindent 4 }}
5062
spec:
5163
{{- with .Values.certManager.certificate.fields }}
5264
{{ toYaml . | nindent 2 }}

‎charts/capsule-proxy/templates/daemonset.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ metadata:
66
name: {{ include "capsule-proxy.fullname" . }}
77
namespace: {{ $.Release.Namespace }}
88
labels:
9+
app.kubernetes.io/component: "proxy"
910
{{- include "capsule-proxy.labels" . | nindent 4 }}
1011
spec:
1112
updateStrategy:
@@ -14,5 +15,6 @@ spec:
1415
matchLabels:
1516
{{- include "capsule-proxy.selectorLabels" . | nindent 6 }}
1617
template:
18+
app.kubernetes.io/component: "proxy"
1719
{{- include "capsule-proxy.pod" $ | nindent 4 }}
1820
{{- end }}

‎charts/capsule-proxy/templates/deployment.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ metadata:
66
name: {{ include "capsule-proxy.fullname" . }}
77
namespace: {{ $.Release.Namespace }}
88
labels:
9+
app.kubernetes.io/component: "proxy"
910
{{- include "capsule-proxy.labels" . | nindent 4 }}
1011
spec:
1112
strategy:
@@ -15,6 +16,7 @@ spec:
1516
{{- end }}
1617
selector:
1718
matchLabels:
19+
app.kubernetes.io/component: "proxy"
1820
{{- include "capsule-proxy.selectorLabels" . | nindent 6 }}
1921
template:
2022
{{- include "capsule-proxy.pod" $ | nindent 4 }}

‎charts/capsule-proxy/templates/hpa.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ metadata:
1010
name: {{ include "capsule-proxy.fullname" . }}
1111
namespace: {{ $.Release.Namespace }}
1212
labels:
13+
app.kubernetes.io/component: "proxy"
1314
{{- include "capsule-proxy.labels" . | nindent 4 }}
1415
{{- if .Values.autoscaling.labels }}
1516
{{- toYaml .Values.autoscaling.labels | nindent 4 }}

‎charts/capsule-proxy/templates/ingress.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ metadata:
1111
name: {{ $fullName }}
1212
namespace: {{ $.Release.Namespace }}
1313
labels:
14+
app.kubernetes.io/component: "proxy"
1415
{{- include "capsule-proxy.labels" . | nindent 4 }}
1516
{{- if .Values.ingress.labels }}
1617
{{- toYaml .Values.ingress.labels | nindent 4 }}

‎charts/capsule-proxy/templates/metrics-rbac.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ apiVersion: rbac.authorization.k8s.io/v1
55
kind: Role
66
metadata:
77
labels:
8+
app.kubernetes.io/component: "proxy"
89
{{- include "capsule-proxy.labels" . | nindent 4 }}
910
{{- if .Values.serviceMonitor.labels }}
1011
{{- toYaml .Values.serviceMonitor.labels | nindent 4 }}
@@ -31,6 +32,7 @@ apiVersion: rbac.authorization.k8s.io/v1
3132
kind: RoleBinding
3233
metadata:
3334
labels:
35+
app.kubernetes.io/component: "proxy"
3436
{{- include "capsule-proxy.labels" . | nindent 4 }}
3537
{{- if .Values.serviceMonitor.labels }}
3638
{{- toYaml .Values.serviceMonitor.labels | nindent 4 }}

0 commit comments

Comments
 (0)