Skip to content

Commit 50f79f1

Browse files
elai-shalevelai-shalev
committed
Added Orchestrator templates and values
1 parent 5884cb4 commit 50f79f1

7 files changed

Lines changed: 1481 additions & 1 deletion

File tree

‎charts/backstage/templates/_helpers.tpl‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,3 +48,153 @@ Referenced from: https://github.com/bitnami/charts/blob/main/bitnami/postgresql/
4848
{{- printf "%s" (include "common.names.fullname" .) -}}
4949
{{- end -}}
5050
{{- end -}}
51+
52+
{{/* Helepr functions */}}
53+
54+
{{- define "unmanaged-resource-exists" -}}
55+
{{- $api := index . 0 -}}
56+
{{- $kind := index . 1 -}}
57+
{{- $namespace := index . 2 -}}
58+
{{- $name := index . 3 -}}
59+
{{- $releaseName := index . 4 -}}
60+
{{- $apiCapabilities := index . 5 -}}
61+
{{- $unmanagedSubscriptionExists := "true" -}}
62+
{{- if $apiCapabilities.Has (printf "%s/%s" $api $kind) }}
63+
{{- $existingOperator := lookup $api $kind $namespace $name -}}
64+
{{- if empty $existingOperator -}}
65+
{{- "false" -}}
66+
{{- else -}}
67+
{{- $isManagedResource := include "is-managed-resource" (list $existingOperator $releaseName) -}}
68+
{{- if eq $isManagedResource "true" -}}
69+
{{- "false" -}}
70+
{{- else -}}
71+
{{- "true" -}}
72+
{{- end -}}
73+
{{- end -}}
74+
{{- else -}}
75+
{{- "false" -}}
76+
{{- end -}}
77+
{{- end -}}
78+
79+
{{- define "is-managed-resource" -}}
80+
{{- $resource := index . 0 -}}
81+
{{- $releaseName := index . 1 -}}
82+
{{- $resourceReleaseName := dig "metadata" "annotations" (dict "meta.helm.sh/release-name" "NA") $resource -}}
83+
{{- if eq (get $resourceReleaseName "meta.helm.sh/release-name") $releaseName -}}
84+
{{- "true" -}}
85+
{{- else -}}
86+
{{- "false" -}}
87+
{{- end -}}
88+
{{- end -}}
89+
90+
91+
{{- define "cluster.domain" -}}
92+
{{- if .Capabilities.APIVersions.Has "config.openshift.io/v1/Ingress" -}}
93+
{{- $cluster := (lookup "config.openshift.io/v1" "Ingress" "" "cluster") -}}
94+
{{- if and (hasKey $cluster "spec") (hasKey $cluster.spec "domain") -}}
95+
{{- printf "%s" $cluster.spec.domain -}}
96+
{{- else -}}
97+
{{ fail "Unable to obtain cluster domain, OCP Ingress Resource is missing the `spec.domain` field." }}
98+
{{- end }}
99+
{{- else -}}
100+
{{ fail "Unable to obtain cluster domain, config.openshift.io/v1/Ingress is missing" }}
101+
{{- end -}}
102+
{{- end -}}
103+
104+
105+
{{- define "install-tekton-task" -}}
106+
{{- if and (and (and .Values.orchestrator.tekton.enabled .Values.orchestrator.argocd.enabled) (ne .Values.orchestrator.rhdhOperator.secretRef.k8s.clusterToken "")) (.Capabilities.APIVersions.Has "tekton.dev/v1/Task") }}
107+
{{- "true" -}}
108+
{{- else }}
109+
{{- "false" -}}
110+
{{- end -}}
111+
{{- end -}}
112+
113+
{{- define "install-tekton-pipeline" -}}
114+
{{- if and (and (and .Values.orchestrator.tekton.enabled .Values.orchestrator.argocd.enabled) (ne .Values.orchestrator.rhdhOperator.secretRef.k8s.clusterToken "")) (.Capabilities.APIVersions.Has "tekton.dev/v1/Pipeline") }}
115+
{{- "true" -}}
116+
{{- else }}
117+
{{- "false" -}}
118+
{{- end -}}
119+
{{- end -}}
120+
121+
{{- define "install-argocd-project" -}}
122+
{{- if and (.Values.orchestrator.argocd.enabled) (.Capabilities.APIVersions.Has "argoproj.io/v1alpha1/AppProject") }}
123+
{{- "true" -}}
124+
{{- else }}
125+
{{- "false" -}}
126+
{{- end -}}
127+
{{- end -}}
128+
129+
130+
{{- define "get-namespace-with-label" -}}
131+
{{- $paramValue:= index . 0 -}}
132+
{{- $matchingLabel:= index . 1 -}}
133+
{{- if $paramValue -}}
134+
{{- $paramValue -}}
135+
{{- else -}}
136+
{{- $ns:= "" }}
137+
{{- $list:= lookup "v1" "Namespace" "" "" -}}
138+
{{- if eq 0 (len (dig "items" (dict "" "") $list ) )}}
139+
{{- fail (printf "No namespaces found: %d" (len (dig "items" (dict "" "") $list)) ) }}
140+
{{- end -}}
141+
{{- range (dig "items" (dict "" "") $list) }}
142+
{{- $labels:= dig "metadata" "labels" (dict "" "" ) . -}}
143+
{{- if (hasKey $labels $matchingLabel ) }}
144+
{{- if not $ns }}
145+
{{- $ns = dig "metadata" "name" "" . -}}
146+
{{- else -}}
147+
{{- fail (printf "More than one namespace found with label %s: %s and %s" $matchingLabel $ns (dig "metadata" "name" "" .) )}}
148+
{{- end }}
149+
{{- end -}}
150+
{{- end -}}
151+
{{- if not $ns -}}
152+
{{- fail (printf "No namespace found with label '%s'. Please follow the installation instructions to properly configure the environment" $matchingLabel) -}}
153+
{{- end }}
154+
{{- $ns }}
155+
{{- end -}}
156+
{{- end -}}
157+
158+
{{- define "get-workflow-namespace" -}}
159+
{{- if (not (hasKey . "workflowNamespace" ) ) -}}
160+
{{- $workflowNamespace := include "get-namespace-with-label" (list .Values.orchestrator.orchestrator.namespace "rhdh.redhat.com/workflow-namespace") }}
161+
{{- $_ := set . "workflowNamespace" $workflowNamespace }}
162+
{{- end -}}
163+
{{- .workflowNamespace -}}
164+
{{- end -}}
165+
166+
{{- define "get-argocd-namespace" -}}
167+
{{- if .Values.orchestrator.argocd.enabled }}
168+
{{- if (not (hasKey . "argoCDNamespace" ) ) -}}
169+
{{- $argoCDNamespace := include "get-namespace-with-label" (list .Values.orchestrator.argocd.namespace "rhdh.redhat.com/argocd-namespace") }}
170+
{{- $_ := set . "argoCDNamespace" $argoCDNamespace }}
171+
{{- end -}}
172+
{{- .argoCDNamespace -}}
173+
{{- end -}}
174+
{{- end -}}
175+
176+
{{- define "get-cluster-version" -}}
177+
{{- $v := "" }}
178+
{{- $version :=(lookup "config.openshift.io/v1" "ClusterVersion" "" "version") }}
179+
{{- range $version.status.history }}
180+
{{- if eq .state "Completed" }}
181+
{{- $v = (semver .version) }}
182+
{{- end }}
183+
{{- end }}
184+
185+
{{- $validMinors := list "4.13" "4.14" "4.15" "4.16" -}}
186+
{{- $versionString := printf "%d.%d" $v.Major $v.Minor -}}
187+
{{- if not (semverCompare ">=4.13 <=4.16" $versionString) -}}
188+
{{- fail (printf "Unsupported OCP version: %s. Supported versions: %s." $versionString $validMinors) -}}
189+
{{- end -}}
190+
{{- $versionString -}}
191+
{{- end -}}
192+
193+
{{- define "get-tekton-version" -}}
194+
{{- $pipelinesSubs := lookup "operators.coreos.com/v1alpha1" "Subscription" "openshift-operators" "openshift-pipelines-operator-rh" -}}
195+
{{- $pipelineInstalledVersion := $pipelinesSubs.status.installedCSV}}
196+
{{- $pipelineVersion := substr 33 ( len $pipelineInstalledVersion) $pipelineInstalledVersion}}
197+
{{- $pipelineVersion = semver $pipelineVersion }}
198+
{{- $pipelineVersionString := printf "%d.%d" $pipelineVersion.Major $pipelineVersion.Minor -}}
199+
{{- $pipelineVersionString -}}
200+
{{- end -}}

‎charts/backstage/templates/network-policies.yaml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
{{- if .Values.orchestrator.enabled }}
2+
{{- if .Values.orchestrator.sonataFlowOperator.enabled }}
3+
apiVersion: networking.k8s.io/v1
4+
kind: NetworkPolicy
5+
metadata:
6+
name: allow-knative-to-sonataflow-and-workflows
7+
# Sonataflow and Workflows are using the RHDH target namespace.
8+
namespace: {{ .Release.Namespace | quote }}
9+
spec:
10+
podSelector: {}
11+
ingress:
12+
- from:
13+
- namespaceSelector:
14+
matchLabels:
15+
# Allow knative events to be delivered to workflows.
16+
kubernetes.io/metadata.name: knative-eventing
17+
- namespaceSelector:
18+
matchLabels:
19+
# Allow auxiliary knative function for workflow (such as m2k-save-transformation)
20+
kubernetes.io/metadata.name: knative-serving
21+
---
22+
# NetworkPolicy to unblock incoming traffic to the namespace
23+
apiVersion: networking.k8s.io/v1
24+
kind: NetworkPolicy
25+
metadata:
26+
name: allow-intra-namespace
27+
namespace: {{ .Release.Namespace | quote }}
28+
spec:
29+
podSelector: {}
30+
ingress:
31+
- from:
32+
- namespaceSelector:
33+
matchLabels:
34+
# Allow knative events to be delivered to workflows.
35+
kubernetes.io/metadata.name: openshift-ingress
36+
---
37+
apiVersion: networking.k8s.io/v1
38+
kind: NetworkPolicy
39+
metadata:
40+
name: allow-extra-communication
41+
namespace: {{ .Release.Namespace | quote }}
42+
spec:
43+
# Apply this policy to all pods in the namespace
44+
podSelector: {}
45+
# Specify policy type as 'Ingress' to control incoming traffic rules
46+
policyTypes:
47+
- Ingress
48+
ingress:
49+
- from:
50+
# Allow ingress from any pod within the same namespace
51+
- podSelector: {}
52+
53+
54+
{{- end }}
55+
---
56+
{{- if .Values.orchestrator.orchestrator.sonataflowPlatform.monitoring.enabled }}
57+
# NetworkPolicy to allow openshift-user-workload-monitoring pods to access all pods within the workflow's namespace
58+
apiVersion: networking.k8s.io/v1
59+
kind: NetworkPolicy
60+
metadata:
61+
name: allow-monitoring-to-sonataflow-and-workflows
62+
namespace: {{ .Release.Namespace | quote }}
63+
spec:
64+
# Apply this policy to all pods in the namespace
65+
podSelector: {}
66+
# Specify policy type as 'Ingress' to control incoming traffic rules
67+
policyTypes:
68+
- Ingress
69+
ingress:
70+
- from:
71+
- namespaceSelector:
72+
matchLabels:
73+
# Allow openshift-user-workload-monitoring pods to access the workflow.
74+
kubernetes.io/metadata.name: openshift-user-workload-monitoring
75+
{{- end }}
76+
{{- end }}

0 commit comments

Comments
 (0)