mirror of
https://github.com/submariner-io/submariner-charts.git
synced 2026-09-20 18:00:35 +00:00
Add an operator Helm chart
The submariner-operator Helm chart deploys Submariner using the Submariner operator: it deploys the CRDs, roles, and SAs required to run the operator and Submariner, then pushes a Submariner CR to instruct the operator to deploy Submariner. This patch also adds a Makefile to validate the deployments; run make deploy to test the Helm charts (this will bring up two clusters, install the broker on one of them and the operator on both, and end with a connectivity test). Fixes: #17 Signed-off-by: Stephen Kitt <skitt@redhat.com>
This commit is contained in:
Stephen Kitt
committed by
Miguel Angel Ajo Pelayo
Miguel Angel Ajo Pelayo
parent
c128fb42c5
commit
96ff45c2f8
@@ -53,5 +53,5 @@ jobs:
|
||||
- name: Run yamllint
|
||||
uses: ibiqlik/action-yamllint@v1
|
||||
with:
|
||||
file_or_dir: submariner/values.yaml submariner-k8s-broker/values.yaml submariner/Chart.yaml submariner-k8s-broker/Chart.yaml
|
||||
file_or_dir: submariner/Chart.yaml submariner/values.yaml submariner-k8s-broker/Chart.yaml submariner-k8s-broker/values.yaml submariner-operator/Chart.yaml submariner-operator/values.yaml
|
||||
config_file: .yamllint.yml
|
||||
|
||||
+2
-2
@@ -18,7 +18,7 @@ install:
|
||||
- sudo pip install yamllint=="${YAMLLINT_VERSION}"
|
||||
|
||||
script:
|
||||
- for dir in submariner submariner-k8s-broker; do helm lint $dir $HELM_FLAGS; done
|
||||
- for dir in submariner submariner-k8s-broker submariner-operator; do helm lint $dir $HELM_FLAGS; done
|
||||
- yamllint -c .yamllint.yml -s $(find . -type f -name "Chart.yaml")
|
||||
- yamllint -c .yamllint.yml -s $(find . -type f -name "values.yaml")
|
||||
|
||||
@@ -26,7 +26,7 @@ after_success:
|
||||
- >
|
||||
if [ $TRAVIS_BRANCH = 'master' ] && [ $TRAVIS_PULL_REQUEST = 'false' ]; then
|
||||
set -e
|
||||
for dir in submariner submariner-k8s-broker; do
|
||||
for dir in submariner submariner-k8s-broker submariner-operator; do
|
||||
helm dep update $dir
|
||||
helm package $dir
|
||||
done
|
||||
|
||||
@@ -0,0 +1,15 @@
|
||||
FROM quay.io/submariner/shipyard-dapper-base:devel
|
||||
|
||||
ARG DAPPER_HOST_ARCH
|
||||
ENV HOST_ARCH=${DAPPER_HOST_ARCH} ARCH=${DAPPER_HOST_ARCH} \
|
||||
DAPPER_ENV="REPO TAG QUAY_USERNAME QUAY_PASSWORD GITHUB_SHA MAKEFLAGS CLUSTERS_ARGS DEPLOY_ARGS E2E_ARGS RELEASE_ARGS" \
|
||||
DAPPER_SOURCE=/go/src/github.com/submariner-io/submariner-charts DAPPER_DOCKER_SOCKET=true
|
||||
ENV DAPPER_OUTPUT=${DAPPER_SOURCE}/output PATH=${DAPPER_SOURCE}/bin/:${PATH}
|
||||
|
||||
WORKDIR ${DAPPER_SOURCE}
|
||||
|
||||
# Override the Helm deployment scripts
|
||||
COPY deploy_helm /opt/shipyard/scripts/lib/
|
||||
|
||||
ENTRYPOINT ["/opt/shipyard/scripts/entry"]
|
||||
CMD ["sh"]
|
||||
@@ -0,0 +1,36 @@
|
||||
ifneq (,$(DAPPER_HOST_ARCH))
|
||||
|
||||
# Running in Dapper
|
||||
|
||||
include $(SHIPYARD_DIR)/Makefile.inc
|
||||
|
||||
CLUSTER_SETTINGS_FLAG = --cluster_settings $(DAPPER_SOURCE)/cluster_settings
|
||||
override CLUSTERS_ARGS += $(CLUSTER_SETTINGS_FLAG)
|
||||
override DEPLOY_ARGS += $(CLUSTER_SETTINGS_FLAG) --deploytool helm
|
||||
export DEPLOY_ARGS
|
||||
|
||||
# Targets to make
|
||||
|
||||
deploy: clusters preload-images
|
||||
|
||||
preload-images:
|
||||
source $(SCRIPTS_DIR)/lib/debug_functions; \
|
||||
source $(SCRIPTS_DIR)/lib/deploy_funcs; \
|
||||
source $(SCRIPTS_DIR)/lib/version; \
|
||||
set -e; \
|
||||
for image in submariner submariner-route-agent submariner-operator lighthouse-agent submariner-globalnet lighthouse-coredns; do \
|
||||
import_image quay.io/submariner/$${image}; \
|
||||
done
|
||||
|
||||
.PHONY: preload-images
|
||||
|
||||
else
|
||||
|
||||
# Not running in Dapper
|
||||
|
||||
include Makefile.dapper
|
||||
|
||||
endif
|
||||
|
||||
# Disable rebuilding Makefile
|
||||
Makefile Makefile.dapper Makefile.inc: ;
|
||||
@@ -0,0 +1,26 @@
|
||||
# This Makefile contains the rules required to set up our
|
||||
# Dapper-based build environment; it can be copied as-is to
|
||||
# other projects (and needs to be copied, it can't be shared
|
||||
# via the Dapper image since it's needed to retrieve the image)
|
||||
|
||||
.dapper:
|
||||
@echo Downloading dapper
|
||||
@curl -sL https://releases.rancher.com/dapper/latest/dapper-`uname -s`-`uname -m` > .dapper.tmp
|
||||
@@chmod +x .dapper.tmp
|
||||
@./.dapper.tmp -v
|
||||
@mv .dapper.tmp .dapper
|
||||
|
||||
invoke_dapper = +./.dapper -m bind make -- $1
|
||||
|
||||
%: .dapper
|
||||
@echo Invoking Dapper, MAKEFLAGS=$(MAKEFLAGS)
|
||||
$(call invoke_dapper,$@)
|
||||
|
||||
# Ensure that files in the current directory don't hide Dapper targets
|
||||
$(wildcard [^M]*): .dapper
|
||||
$(call invoke_dapper,$@)
|
||||
|
||||
shell: .dapper
|
||||
./.dapper -m bind -s
|
||||
|
||||
.PHONY: shell $(wildcard [^M]*)
|
||||
@@ -0,0 +1,10 @@
|
||||
. "${SCRIPTS_DIR}"/lib/source_only
|
||||
|
||||
# We need a minimal setup to verify the deployment works
|
||||
clusters=('cluster1' 'cluster2')
|
||||
cluster_nodes['cluster1']="control-plane worker"
|
||||
cluster_nodes['cluster2']="control-plane worker"
|
||||
|
||||
cluster_cni=( ['cluster1']="weave" ['cluster2']="weave" )
|
||||
|
||||
cluster_subm=( ['cluster1']="true" ['cluster2']="true" )
|
||||
+84
@@ -0,0 +1,84 @@
|
||||
# shellcheck shell=bash
|
||||
# shellcheck source=scripts/shared/lib/source_only
|
||||
. "${BASH_SOURCE%/*}"/source_only
|
||||
|
||||
### Constants ###
|
||||
|
||||
readonly SUBMARINER_BROKER_NS=submariner-k8s-broker
|
||||
readonly SUBMARINER_PSK=$(LC_CTYPE=C tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w 64 | head -n 1)
|
||||
|
||||
### Functions ###
|
||||
|
||||
function install_helm() {
|
||||
if kubectl -n kube-system rollout status deploy/tiller-deploy --timeout=3s > /dev/null 2>&1; then
|
||||
echo "Helm already installed, skipping helm installation..."
|
||||
return
|
||||
fi
|
||||
|
||||
echo "Installing helm..."
|
||||
kubectl -n kube-system create serviceaccount tiller
|
||||
kubectl create clusterrolebinding tiller --clusterrole=cluster-admin --serviceaccount=kube-system:tiller
|
||||
helm --kube-context "${cluster}" init --service-account tiller
|
||||
kubectl -n kube-system rollout status deploy/tiller-deploy --timeout=30s
|
||||
}
|
||||
|
||||
function deploytool_prereqs() {
|
||||
helm init --client-only
|
||||
run_all_clusters install_helm
|
||||
}
|
||||
|
||||
function setup_broker() {
|
||||
if kubectl get crd clusters.submariner.io > /dev/null 2>&1; then
|
||||
echo "Submariner CRDs already exist, skipping broker creation..."
|
||||
else
|
||||
echo "Installing submariner broker..."
|
||||
# shellcheck disable=SC2086 # Split on purpose
|
||||
helm install ./submariner-k8s-broker \
|
||||
--kube-context "${cluster}" \
|
||||
--name "${SUBMARINER_BROKER_NS}" \
|
||||
--namespace "${SUBMARINER_BROKER_NS}" \
|
||||
${deploytool_broker_args}
|
||||
fi
|
||||
|
||||
submariner_broker_url=$(kubectl -n default get endpoints kubernetes -o jsonpath="{.subsets[0].addresses[0].ip}:{.subsets[0].ports[?(@.name=='https')].port}")
|
||||
submariner_broker_ca=$(kubectl -n "${SUBMARINER_BROKER_NS}" get secrets -o jsonpath="{.items[?(@.metadata.annotations['kubernetes\.io/service-account\.name']=='${SUBMARINER_BROKER_NS}-client')].data['ca\.crt']}")
|
||||
submariner_broker_token=$(kubectl -n "${SUBMARINER_BROKER_NS}" get secrets -o jsonpath="{.items[?(@.metadata.annotations['kubernetes\.io/service-account\.name']=='${SUBMARINER_BROKER_NS}-client')].data.token}"|base64 --decode)
|
||||
}
|
||||
|
||||
function helm_install_subm() {
|
||||
local crd_create=false
|
||||
[[ "${cluster}" = "${broker}" ]] || crd_create=true
|
||||
|
||||
if kubectl wait --for=condition=Ready pods -l app=submariner-operator -n "${SUBM_NS}" --timeout=60s > /dev/null 2>&1; then
|
||||
echo "Submariner already installed, skipping installation..."
|
||||
return
|
||||
fi
|
||||
|
||||
echo "Installing Submariner..."
|
||||
# shellcheck disable=SC2086 # Split on purpose
|
||||
helm --kube-context "${cluster}" install ./submariner-operator \
|
||||
--name submariner-operator \
|
||||
--namespace "${SUBM_NS}" \
|
||||
--set ipsec.psk="${SUBMARINER_PSK}" \
|
||||
--set broker.server="${submariner_broker_url}" \
|
||||
--set broker.token="${submariner_broker_token}" \
|
||||
--set broker.namespace="${SUBMARINER_BROKER_NS}" \
|
||||
--set broker.ca="${submariner_broker_ca}" \
|
||||
--set submariner.clusterId="${cluster}" \
|
||||
--set submariner.clusterCidr="${cluster_CIDRs[$cluster]}" \
|
||||
--set submariner.serviceCidr="${service_CIDRs[$cluster]}" \
|
||||
--set submariner.globalCidr="${global_CIDRs[$cluster]}" \
|
||||
--set serviceAccounts.globalnet.create="${globalnet}" \
|
||||
--set submariner.natEnabled="false" \
|
||||
--set operator.image.repository="localhost:5000/submariner-operator" \
|
||||
--set operator.image.tag="local" \
|
||||
--set operator.image.pullPolicy="IfNotPresent" \
|
||||
--set submariner.images.repository="localhost:5000" \
|
||||
--set submariner.images.tag="local" \
|
||||
--set brokercrds.create="${crd_create}" \
|
||||
${deploytool_submariner_args}
|
||||
}
|
||||
|
||||
function install_subm_all_clusters() {
|
||||
run_subm_clusters helm_install_subm
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
.git
|
||||
@@ -0,0 +1,12 @@
|
||||
---
|
||||
name: submariner-operator
|
||||
version: 0.7.0
|
||||
appVersion: 0.7.0
|
||||
description: Submariner enables direct networking between Pods and Services in different Kubernetes clusters
|
||||
keywords:
|
||||
home: https://submariner-io.github.io/
|
||||
sources:
|
||||
- https://submariner-io.github.io/submariner-charts/charts
|
||||
maintainers:
|
||||
- name: Submariner Developers
|
||||
email: submariner-dev@googlegroups.com
|
||||
@@ -0,0 +1,5 @@
|
||||
# Submariner
|
||||
|
||||
[Submariner](https://submariner.io) is a cross-cluster networking tool.
|
||||
|
||||
This chart creates the required components in this cluster to deploy the Submariner operator.
|
||||
@@ -0,0 +1,118 @@
|
||||
questions:
|
||||
- variable: defaultOperatorImage
|
||||
default: true
|
||||
description: "Use default Submariner operator image or specify a custom one"
|
||||
label: Use default Submariner operator image
|
||||
type: boolean
|
||||
show_subquestion_if: false
|
||||
group: "Container Images"
|
||||
subquestions:
|
||||
- variable: operator.image.repository
|
||||
default: "quay.io/submariner/submariner-operator"
|
||||
description: "Submariner Operator Image Repository"
|
||||
type: string
|
||||
label: Submariner Operator Image Repository
|
||||
- variable: operator.image.tag
|
||||
default: "0.7.0"
|
||||
description: "Submariner Operator Image Tag"
|
||||
type: string
|
||||
label: Submariner Operator Image Tag
|
||||
- variable: defaultSubmarinerImages
|
||||
default: true
|
||||
description: "Use default Submariner images or specify custom ones"
|
||||
label: Use default Submariner images
|
||||
type: boolean
|
||||
show_subquestion_if: false
|
||||
group: "Container images"
|
||||
subquestions:
|
||||
- variable: submariner.images.repository
|
||||
default: "quay.io/submariner"
|
||||
description: "Submariner Repository (base for all non-operator images)"
|
||||
type: string
|
||||
label: Submariner Repository
|
||||
- variable: submariner.images.tag
|
||||
default: "0.7.0"
|
||||
description: "Submariner Images Tag (shared for all non-operator images)"
|
||||
type: string
|
||||
label: Submariner Images Tag
|
||||
- variable: submariner.clusterId
|
||||
default: ""
|
||||
description: "Enter a unique cluster ID to identify this cluster"
|
||||
type: string
|
||||
label: "Cluster ID"
|
||||
group: "Configuration"
|
||||
required: true
|
||||
- variable: ipsec.psk
|
||||
default: ""
|
||||
description: "Enter the pre-shared key for the IPsec Cable Engine"
|
||||
type: string
|
||||
label: "IPsec Pre-Shared Key"
|
||||
group: "Configuration"
|
||||
required: true
|
||||
- variable: broker.server
|
||||
type: string
|
||||
default: ""
|
||||
group: "Broker Configuration"
|
||||
label: "Broker Server"
|
||||
description: "Broker server to use (without the https://)"
|
||||
- variable: broker.insecure
|
||||
type: boolean
|
||||
default: false
|
||||
show_subquestion_if: false
|
||||
group: "Broker Configuration"
|
||||
label: "Insecure Broker"
|
||||
description: "Connect to K8s broker without validating CA"
|
||||
subquestions:
|
||||
- variable: broker.ca
|
||||
type: string
|
||||
description: "Base64 encoded broker ca.crt"
|
||||
label: "Broker CA encoded in base64"
|
||||
default: ""
|
||||
- variable: broker.token
|
||||
type: string
|
||||
group: "Broker Configuration"
|
||||
label: "Broker Token"
|
||||
description: "Bearer token for broker"
|
||||
- variable: broker.namespace
|
||||
type: string
|
||||
group: "Broker Configuration"
|
||||
label: "Broker Namespace"
|
||||
description: "Enter namespace to use on central broker"
|
||||
- variable: submariner.clusterCidr
|
||||
default: ""
|
||||
description: "Enter the cluster CIDR (i.e. 10.42.0.0/16) for this cluster"
|
||||
type: string
|
||||
label: "Cluster CIDR"
|
||||
group: "CIDR Configuration"
|
||||
required: true
|
||||
- variable: submariner.serviceCidr
|
||||
default: ""
|
||||
description: "Enter the service CIDR (i.e. 10.43.0.0/16) for this cluster"
|
||||
type: string
|
||||
label: "Service CIDR"
|
||||
group: "CIDR Configuration"
|
||||
required: true
|
||||
- variable: submariner.natEnabled
|
||||
type: boolean
|
||||
default: false
|
||||
group: "Advanced Configuration"
|
||||
description: "If the gateway nodes for this cluster are behind 1:1 NAT, you should enable NAT"
|
||||
label: "NAT Enabled"
|
||||
- variable: submariner.debug
|
||||
type: boolean
|
||||
default: false
|
||||
group: "Advanced Configuration"
|
||||
description: "Enable submariner debug mode"
|
||||
label: "Submariner Debug Enabled"
|
||||
- variable: ipsec.debug
|
||||
type: boolean
|
||||
default: false
|
||||
group: "Advanced Configuration"
|
||||
description: "Enable Charon debug mode"
|
||||
label: "Charon Enabled"
|
||||
- variable: submariner.cableDriver
|
||||
type: string
|
||||
default: ""
|
||||
group: "Advanced Configuration"
|
||||
description: "Cable driver implementation"
|
||||
label: "Cable Driver"
|
||||
@@ -0,0 +1,7 @@
|
||||
Submariner is now installed.
|
||||
|
||||
{{- if .Values.engine.nodeSelectorEnabled }}
|
||||
If you haven't done so yet, please label a node as `submariner.io/gateway=true` to elect it for running Submariner.
|
||||
{{- end }}
|
||||
|
||||
By default, Submariner runs with 1 replica. If you have more than one Gateway host, you can scale Submariner to N replicas, and the other Submariner pods will simply join the leader election pool.
|
||||
@@ -0,0 +1,94 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "submariner.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "submariner.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "submariner.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the submariner-operator service account to use
|
||||
*/}}
|
||||
{{- define "submariner.operatorServiceAccountName" -}}
|
||||
{{- if .Values.serviceAccounts.operator.create -}}
|
||||
{{ default (printf "%s" (include "submariner.fullname" .)) .Values.serviceAccounts.operator.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccounts.operator.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the submariner-engine service account to use
|
||||
*/}}
|
||||
{{- define "submariner.engineServiceAccountName" -}}
|
||||
{{- if .Values.serviceAccounts.engine.create -}}
|
||||
{{ default (printf "%s-engine" (include "submariner.fullname" .)) .Values.serviceAccounts.engine.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccounts.engine.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the submariner-route-agent service account to use
|
||||
*/}}
|
||||
{{- define "submariner.routeAgentServiceAccountName" -}}
|
||||
{{- if .Values.serviceAccounts.routeAgent.create -}}
|
||||
{{ default (printf "%s-routeagent" (include "submariner.fullname" .)) .Values.serviceAccounts.routeAgent.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccounts.routeAgent.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the submariner-globalnet service account to use
|
||||
*/}}
|
||||
{{- define "submariner.globalnetServiceAccountName" -}}
|
||||
{{- if .Values.serviceAccounts.globalnet.create -}}
|
||||
{{ default (printf "%s:globalnet" (include "submariner.fullname" .)) .Values.serviceAccounts.globalnet.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccounts.globalnet.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the submariner-lighthouse service account to use
|
||||
*/}}
|
||||
{{- define "submariner.lighthouseServiceAccountName" -}}
|
||||
{{- if .Values.submariner.serviceDiscovery -}}
|
||||
{{ default (printf "%s-lighthouse" (include "submariner.fullname" .)) .Values.serviceAccounts.lighthouse.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccounts.lighthouse.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the submariner-lighthouse-coredns service name to use
|
||||
*/}}
|
||||
{{- define "submariner.lighthouseDnsName" -}}
|
||||
{{- default (printf "%s-lighthouse-coredns" (include "submariner.fullname" .)) .Values.lighthouseCoredns.name }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,723 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: submariners.submariner.io
|
||||
annotations:
|
||||
"helm.sh/hook": crd-install
|
||||
controller-gen.kubebuilder.io/version: v0.3.0
|
||||
spec:
|
||||
group: submariner.io
|
||||
names:
|
||||
kind: Submariner
|
||||
listKind: SubmarinerList
|
||||
plural: submariners
|
||||
singular: submariner
|
||||
scope: Namespaced
|
||||
subresources:
|
||||
status: {}
|
||||
validation:
|
||||
openAPIV3Schema:
|
||||
description: Submariner is the Schema for the submariners API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: SubmarinerSpec defines the desired state of Submariner
|
||||
properties:
|
||||
broker:
|
||||
type: string
|
||||
brokerK8sApiServer:
|
||||
type: string
|
||||
brokerK8sApiServerToken:
|
||||
type: string
|
||||
brokerK8sCA:
|
||||
type: string
|
||||
brokerK8sRemoteNamespace:
|
||||
type: string
|
||||
cableDriver:
|
||||
type: string
|
||||
ceIPSecDebug:
|
||||
type: boolean
|
||||
ceIPSecIKEPort:
|
||||
type: integer
|
||||
ceIPSecNATTPort:
|
||||
type: integer
|
||||
ceIPSecPSK:
|
||||
type: string
|
||||
clusterCIDR:
|
||||
type: string
|
||||
clusterID:
|
||||
type: string
|
||||
colorCodes:
|
||||
type: string
|
||||
customDomains:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: set
|
||||
debug:
|
||||
type: boolean
|
||||
globalCIDR:
|
||||
type: string
|
||||
namespace:
|
||||
type: string
|
||||
natEnabled:
|
||||
type: boolean
|
||||
repository:
|
||||
type: string
|
||||
serviceCIDR:
|
||||
type: string
|
||||
serviceDiscoveryEnabled:
|
||||
type: boolean
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- broker
|
||||
- brokerK8sApiServer
|
||||
- brokerK8sApiServerToken
|
||||
- brokerK8sCA
|
||||
- brokerK8sRemoteNamespace
|
||||
- ceIPSecDebug
|
||||
- ceIPSecPSK
|
||||
- clusterCIDR
|
||||
- clusterID
|
||||
- debug
|
||||
- namespace
|
||||
- natEnabled
|
||||
- serviceCIDR
|
||||
type: object
|
||||
status:
|
||||
description: SubmarinerStatus defines the observed state of Submariner
|
||||
properties:
|
||||
clusterCIDR:
|
||||
type: string
|
||||
clusterID:
|
||||
type: string
|
||||
colorCodes:
|
||||
type: string
|
||||
engineDaemonSetStatus:
|
||||
properties:
|
||||
lastResourceVersion:
|
||||
type: string
|
||||
mismatchedContainerImages:
|
||||
type: boolean
|
||||
nonReadyContainerStates:
|
||||
items:
|
||||
description: ContainerState holds a possible state of container.
|
||||
Only one of its members may be specified. If none of them is
|
||||
specified, the default one is ContainerStateWaiting.
|
||||
properties:
|
||||
running:
|
||||
description: Details about a running container
|
||||
properties:
|
||||
startedAt:
|
||||
description: Time at which the container was last (re-)started
|
||||
format: date-time
|
||||
type: string
|
||||
type: object
|
||||
terminated:
|
||||
description: Details about a terminated container
|
||||
properties:
|
||||
containerID:
|
||||
description: Container's ID in the format 'docker://<container_id>'
|
||||
type: string
|
||||
exitCode:
|
||||
description: Exit status from the last termination of
|
||||
the container
|
||||
format: int32
|
||||
type: integer
|
||||
finishedAt:
|
||||
description: Time at which the container last terminated
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: Message regarding the last termination of
|
||||
the container
|
||||
type: string
|
||||
reason:
|
||||
description: (brief) reason from the last termination
|
||||
of the container
|
||||
type: string
|
||||
signal:
|
||||
description: Signal from the last termination of the container
|
||||
format: int32
|
||||
type: integer
|
||||
startedAt:
|
||||
description: Time at which previous execution of the container
|
||||
started
|
||||
format: date-time
|
||||
type: string
|
||||
required:
|
||||
- exitCode
|
||||
type: object
|
||||
waiting:
|
||||
description: Details about a waiting container
|
||||
properties:
|
||||
message:
|
||||
description: Message regarding why the container is not
|
||||
yet running.
|
||||
type: string
|
||||
reason:
|
||||
description: (brief) reason the container is not yet running.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
type: array
|
||||
status:
|
||||
description: DaemonSetStatus represents the current status of a
|
||||
daemon set.
|
||||
properties:
|
||||
collisionCount:
|
||||
description: Count of hash collisions for the DaemonSet. The
|
||||
DaemonSet controller uses this field as a collision avoidance
|
||||
mechanism when it needs to create the name for the newest
|
||||
ControllerRevision.
|
||||
format: int32
|
||||
type: integer
|
||||
conditions:
|
||||
description: Represents the latest available observations of
|
||||
a DaemonSet's current state.
|
||||
items:
|
||||
description: DaemonSetCondition describes the state of a DaemonSet
|
||||
at a certain point.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: Last time the condition transitioned from
|
||||
one status to another.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: A human readable message indicating details
|
||||
about the transition.
|
||||
type: string
|
||||
reason:
|
||||
description: The reason for the condition's last transition.
|
||||
type: string
|
||||
status:
|
||||
description: Status of the condition, one of True, False,
|
||||
Unknown.
|
||||
type: string
|
||||
type:
|
||||
description: Type of DaemonSet condition.
|
||||
type: string
|
||||
required:
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
currentNumberScheduled:
|
||||
description: 'The number of nodes that are running at least
|
||||
1 daemon pod and are supposed to run the daemon pod. More
|
||||
info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/'
|
||||
format: int32
|
||||
type: integer
|
||||
desiredNumberScheduled:
|
||||
description: 'The total number of nodes that should be running
|
||||
the daemon pod (including nodes correctly running the daemon
|
||||
pod). More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/'
|
||||
format: int32
|
||||
type: integer
|
||||
numberAvailable:
|
||||
description: The number of nodes that should be running the
|
||||
daemon pod and have one or more of the daemon pod running
|
||||
and available (ready for at least spec.minReadySeconds)
|
||||
format: int32
|
||||
type: integer
|
||||
numberMisscheduled:
|
||||
description: 'The number of nodes that are running the daemon
|
||||
pod, but are not supposed to run the daemon pod. More info:
|
||||
https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/'
|
||||
format: int32
|
||||
type: integer
|
||||
numberReady:
|
||||
description: The number of nodes that should be running the
|
||||
daemon pod and have one or more of the daemon pod running
|
||||
and ready.
|
||||
format: int32
|
||||
type: integer
|
||||
numberUnavailable:
|
||||
description: The number of nodes that should be running the
|
||||
daemon pod and have none of the daemon pod running and available
|
||||
(ready for at least spec.minReadySeconds)
|
||||
format: int32
|
||||
type: integer
|
||||
observedGeneration:
|
||||
description: The most recent generation observed by the daemon
|
||||
set controller.
|
||||
format: int64
|
||||
type: integer
|
||||
updatedNumberScheduled:
|
||||
description: The total number of nodes that are running updated
|
||||
daemon pod
|
||||
format: int32
|
||||
type: integer
|
||||
required:
|
||||
- currentNumberScheduled
|
||||
- desiredNumberScheduled
|
||||
- numberMisscheduled
|
||||
- numberReady
|
||||
type: object
|
||||
required:
|
||||
- mismatchedContainerImages
|
||||
type: object
|
||||
gateways:
|
||||
items:
|
||||
properties:
|
||||
connections:
|
||||
items:
|
||||
properties:
|
||||
endpoint:
|
||||
properties:
|
||||
backend:
|
||||
type: string
|
||||
backend_config:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
cable_name:
|
||||
type: string
|
||||
cluster_id:
|
||||
type: string
|
||||
hostname:
|
||||
type: string
|
||||
nat_enabled:
|
||||
type: boolean
|
||||
private_ip:
|
||||
type: string
|
||||
public_ip:
|
||||
type: string
|
||||
subnets:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- backend
|
||||
- cable_name
|
||||
- cluster_id
|
||||
- hostname
|
||||
- nat_enabled
|
||||
- private_ip
|
||||
- public_ip
|
||||
- subnets
|
||||
type: object
|
||||
status:
|
||||
type: string
|
||||
statusMessage:
|
||||
type: string
|
||||
required:
|
||||
- endpoint
|
||||
- status
|
||||
- statusMessage
|
||||
type: object
|
||||
type: array
|
||||
haStatus:
|
||||
type: string
|
||||
localEndpoint:
|
||||
properties:
|
||||
backend:
|
||||
type: string
|
||||
backend_config:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
cable_name:
|
||||
type: string
|
||||
cluster_id:
|
||||
type: string
|
||||
hostname:
|
||||
type: string
|
||||
nat_enabled:
|
||||
type: boolean
|
||||
private_ip:
|
||||
type: string
|
||||
public_ip:
|
||||
type: string
|
||||
subnets:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- backend
|
||||
- cable_name
|
||||
- cluster_id
|
||||
- hostname
|
||||
- nat_enabled
|
||||
- private_ip
|
||||
- public_ip
|
||||
- subnets
|
||||
type: object
|
||||
statusFailure:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- connections
|
||||
- haStatus
|
||||
- localEndpoint
|
||||
- statusFailure
|
||||
- version
|
||||
type: object
|
||||
type: array
|
||||
globalCIDR:
|
||||
type: string
|
||||
globalnetDaemonSetStatus:
|
||||
properties:
|
||||
lastResourceVersion:
|
||||
type: string
|
||||
mismatchedContainerImages:
|
||||
type: boolean
|
||||
nonReadyContainerStates:
|
||||
items:
|
||||
description: ContainerState holds a possible state of container.
|
||||
Only one of its members may be specified. If none of them is
|
||||
specified, the default one is ContainerStateWaiting.
|
||||
properties:
|
||||
running:
|
||||
description: Details about a running container
|
||||
properties:
|
||||
startedAt:
|
||||
description: Time at which the container was last (re-)started
|
||||
format: date-time
|
||||
type: string
|
||||
type: object
|
||||
terminated:
|
||||
description: Details about a terminated container
|
||||
properties:
|
||||
containerID:
|
||||
description: Container's ID in the format 'docker://<container_id>'
|
||||
type: string
|
||||
exitCode:
|
||||
description: Exit status from the last termination of
|
||||
the container
|
||||
format: int32
|
||||
type: integer
|
||||
finishedAt:
|
||||
description: Time at which the container last terminated
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: Message regarding the last termination of
|
||||
the container
|
||||
type: string
|
||||
reason:
|
||||
description: (brief) reason from the last termination
|
||||
of the container
|
||||
type: string
|
||||
signal:
|
||||
description: Signal from the last termination of the container
|
||||
format: int32
|
||||
type: integer
|
||||
startedAt:
|
||||
description: Time at which previous execution of the container
|
||||
started
|
||||
format: date-time
|
||||
type: string
|
||||
required:
|
||||
- exitCode
|
||||
type: object
|
||||
waiting:
|
||||
description: Details about a waiting container
|
||||
properties:
|
||||
message:
|
||||
description: Message regarding why the container is not
|
||||
yet running.
|
||||
type: string
|
||||
reason:
|
||||
description: (brief) reason the container is not yet running.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
type: array
|
||||
status:
|
||||
description: DaemonSetStatus represents the current status of a
|
||||
daemon set.
|
||||
properties:
|
||||
collisionCount:
|
||||
description: Count of hash collisions for the DaemonSet. The
|
||||
DaemonSet controller uses this field as a collision avoidance
|
||||
mechanism when it needs to create the name for the newest
|
||||
ControllerRevision.
|
||||
format: int32
|
||||
type: integer
|
||||
conditions:
|
||||
description: Represents the latest available observations of
|
||||
a DaemonSet's current state.
|
||||
items:
|
||||
description: DaemonSetCondition describes the state of a DaemonSet
|
||||
at a certain point.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: Last time the condition transitioned from
|
||||
one status to another.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: A human readable message indicating details
|
||||
about the transition.
|
||||
type: string
|
||||
reason:
|
||||
description: The reason for the condition's last transition.
|
||||
type: string
|
||||
status:
|
||||
description: Status of the condition, one of True, False,
|
||||
Unknown.
|
||||
type: string
|
||||
type:
|
||||
description: Type of DaemonSet condition.
|
||||
type: string
|
||||
required:
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
currentNumberScheduled:
|
||||
description: 'The number of nodes that are running at least
|
||||
1 daemon pod and are supposed to run the daemon pod. More
|
||||
info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/'
|
||||
format: int32
|
||||
type: integer
|
||||
desiredNumberScheduled:
|
||||
description: 'The total number of nodes that should be running
|
||||
the daemon pod (including nodes correctly running the daemon
|
||||
pod). More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/'
|
||||
format: int32
|
||||
type: integer
|
||||
numberAvailable:
|
||||
description: The number of nodes that should be running the
|
||||
daemon pod and have one or more of the daemon pod running
|
||||
and available (ready for at least spec.minReadySeconds)
|
||||
format: int32
|
||||
type: integer
|
||||
numberMisscheduled:
|
||||
description: 'The number of nodes that are running the daemon
|
||||
pod, but are not supposed to run the daemon pod. More info:
|
||||
https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/'
|
||||
format: int32
|
||||
type: integer
|
||||
numberReady:
|
||||
description: The number of nodes that should be running the
|
||||
daemon pod and have one or more of the daemon pod running
|
||||
and ready.
|
||||
format: int32
|
||||
type: integer
|
||||
numberUnavailable:
|
||||
description: The number of nodes that should be running the
|
||||
daemon pod and have none of the daemon pod running and available
|
||||
(ready for at least spec.minReadySeconds)
|
||||
format: int32
|
||||
type: integer
|
||||
observedGeneration:
|
||||
description: The most recent generation observed by the daemon
|
||||
set controller.
|
||||
format: int64
|
||||
type: integer
|
||||
updatedNumberScheduled:
|
||||
description: The total number of nodes that are running updated
|
||||
daemon pod
|
||||
format: int32
|
||||
type: integer
|
||||
required:
|
||||
- currentNumberScheduled
|
||||
- desiredNumberScheduled
|
||||
- numberMisscheduled
|
||||
- numberReady
|
||||
type: object
|
||||
required:
|
||||
- mismatchedContainerImages
|
||||
type: object
|
||||
natEnabled:
|
||||
type: boolean
|
||||
routeAgentDaemonSetStatus:
|
||||
properties:
|
||||
lastResourceVersion:
|
||||
type: string
|
||||
mismatchedContainerImages:
|
||||
type: boolean
|
||||
nonReadyContainerStates:
|
||||
items:
|
||||
description: ContainerState holds a possible state of container.
|
||||
Only one of its members may be specified. If none of them is
|
||||
specified, the default one is ContainerStateWaiting.
|
||||
properties:
|
||||
running:
|
||||
description: Details about a running container
|
||||
properties:
|
||||
startedAt:
|
||||
description: Time at which the container was last (re-)started
|
||||
format: date-time
|
||||
type: string
|
||||
type: object
|
||||
terminated:
|
||||
description: Details about a terminated container
|
||||
properties:
|
||||
containerID:
|
||||
description: Container's ID in the format 'docker://<container_id>'
|
||||
type: string
|
||||
exitCode:
|
||||
description: Exit status from the last termination of
|
||||
the container
|
||||
format: int32
|
||||
type: integer
|
||||
finishedAt:
|
||||
description: Time at which the container last terminated
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: Message regarding the last termination of
|
||||
the container
|
||||
type: string
|
||||
reason:
|
||||
description: (brief) reason from the last termination
|
||||
of the container
|
||||
type: string
|
||||
signal:
|
||||
description: Signal from the last termination of the container
|
||||
format: int32
|
||||
type: integer
|
||||
startedAt:
|
||||
description: Time at which previous execution of the container
|
||||
started
|
||||
format: date-time
|
||||
type: string
|
||||
required:
|
||||
- exitCode
|
||||
type: object
|
||||
waiting:
|
||||
description: Details about a waiting container
|
||||
properties:
|
||||
message:
|
||||
description: Message regarding why the container is not
|
||||
yet running.
|
||||
type: string
|
||||
reason:
|
||||
description: (brief) reason the container is not yet running.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
type: array
|
||||
status:
|
||||
description: DaemonSetStatus represents the current status of a
|
||||
daemon set.
|
||||
properties:
|
||||
collisionCount:
|
||||
description: Count of hash collisions for the DaemonSet. The
|
||||
DaemonSet controller uses this field as a collision avoidance
|
||||
mechanism when it needs to create the name for the newest
|
||||
ControllerRevision.
|
||||
format: int32
|
||||
type: integer
|
||||
conditions:
|
||||
description: Represents the latest available observations of
|
||||
a DaemonSet's current state.
|
||||
items:
|
||||
description: DaemonSetCondition describes the state of a DaemonSet
|
||||
at a certain point.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: Last time the condition transitioned from
|
||||
one status to another.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: A human readable message indicating details
|
||||
about the transition.
|
||||
type: string
|
||||
reason:
|
||||
description: The reason for the condition's last transition.
|
||||
type: string
|
||||
status:
|
||||
description: Status of the condition, one of True, False,
|
||||
Unknown.
|
||||
type: string
|
||||
type:
|
||||
description: Type of DaemonSet condition.
|
||||
type: string
|
||||
required:
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
currentNumberScheduled:
|
||||
description: 'The number of nodes that are running at least
|
||||
1 daemon pod and are supposed to run the daemon pod. More
|
||||
info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/'
|
||||
format: int32
|
||||
type: integer
|
||||
desiredNumberScheduled:
|
||||
description: 'The total number of nodes that should be running
|
||||
the daemon pod (including nodes correctly running the daemon
|
||||
pod). More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/'
|
||||
format: int32
|
||||
type: integer
|
||||
numberAvailable:
|
||||
description: The number of nodes that should be running the
|
||||
daemon pod and have one or more of the daemon pod running
|
||||
and available (ready for at least spec.minReadySeconds)
|
||||
format: int32
|
||||
type: integer
|
||||
numberMisscheduled:
|
||||
description: 'The number of nodes that are running the daemon
|
||||
pod, but are not supposed to run the daemon pod. More info:
|
||||
https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/'
|
||||
format: int32
|
||||
type: integer
|
||||
numberReady:
|
||||
description: The number of nodes that should be running the
|
||||
daemon pod and have one or more of the daemon pod running
|
||||
and ready.
|
||||
format: int32
|
||||
type: integer
|
||||
numberUnavailable:
|
||||
description: The number of nodes that should be running the
|
||||
daemon pod and have none of the daemon pod running and available
|
||||
(ready for at least spec.minReadySeconds)
|
||||
format: int32
|
||||
type: integer
|
||||
observedGeneration:
|
||||
description: The most recent generation observed by the daemon
|
||||
set controller.
|
||||
format: int64
|
||||
type: integer
|
||||
updatedNumberScheduled:
|
||||
description: The total number of nodes that are running updated
|
||||
daemon pod
|
||||
format: int32
|
||||
type: integer
|
||||
required:
|
||||
- currentNumberScheduled
|
||||
- desiredNumberScheduled
|
||||
- numberMisscheduled
|
||||
- numberReady
|
||||
type: object
|
||||
required:
|
||||
- mismatchedContainerImages
|
||||
type: object
|
||||
serviceCIDR:
|
||||
type: string
|
||||
required:
|
||||
- clusterID
|
||||
- natEnabled
|
||||
type: object
|
||||
type: object
|
||||
version: v1alpha1
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
served: true
|
||||
storage: true
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
@@ -0,0 +1,57 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.fullname" . }}
|
||||
component: engine
|
||||
name: {{ template "submariner.fullname" . }}
|
||||
spec:
|
||||
progressDeadlineSeconds: 600
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
name: {{ template "submariner.fullname" . }}
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
labels:
|
||||
name: {{ template "submariner.fullname" . }}
|
||||
spec:
|
||||
containers:
|
||||
- command:
|
||||
- submariner-operator
|
||||
env:
|
||||
- name: WATCH_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
- name: OPERATOR_NAME
|
||||
value: submariner-operator
|
||||
image: {{ .Values.operator.image.repository }}:{{ default .Chart.AppVersion .Values.operator.image.tag }}
|
||||
imagePullPolicy: {{ .Values.operator.image.pullPolicy }}
|
||||
name: submariner-operator
|
||||
resources: {}
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
dnsPolicy: ClusterFirst
|
||||
restartPolicy: Always
|
||||
schedulerName: default-scheduler
|
||||
securityContext: {}
|
||||
serviceAccount: {{ template "submariner.fullname" . }}
|
||||
serviceAccountName: {{ template "submariner.fullname" . }}
|
||||
terminationGracePeriodSeconds: 30
|
||||
@@ -0,0 +1,318 @@
|
||||
{{- if .Values.rbac.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
- services/finalizers
|
||||
- endpoints
|
||||
- persistentvolumeclaims
|
||||
- events
|
||||
- configmaps
|
||||
- secrets
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
- daemonsets
|
||||
- replicasets
|
||||
- statefulsets
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- monitoring.coreos.com
|
||||
resources:
|
||||
- servicemonitors
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
- apiGroups:
|
||||
- apps
|
||||
resourceNames:
|
||||
- {{ template "submariner.fullname" . }}
|
||||
resources:
|
||||
- deployments/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- replicasets
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- submariner.io
|
||||
resources:
|
||||
- '*'
|
||||
- servicediscoveries
|
||||
verbs:
|
||||
- '*'
|
||||
---
|
||||
kind: RoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.fullname" . }}
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: {{ template "submariner.fullname" . }}
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:engine
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["create", "get", "list", "watch", "patch", "update"]
|
||||
- apiGroups: ["submariner.io"]
|
||||
resources: ["clusters", "endpoints", "gateways"]
|
||||
verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:engine
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "submariner.fullname" . }}:engine
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.operatorServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:routeagent
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups: ["submariner.io"]
|
||||
resources: ["clusters", "endpoints", "gateways"]
|
||||
verbs: ["create", "get", "list", "watch", "patch", "update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:routeagent
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "submariner.fullname" . }}:routeagent
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.operatorServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
# submariner-operator updates the config map of core-dns to forward requests to
|
||||
# clusterset.local to Lighthouse DNS, also looks at existing configmaps
|
||||
# to figure out network settings
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
- apiGroups: ["apiextensions.k8s.io"]
|
||||
resources: ["customresourcedefinitions"]
|
||||
verbs: ["get", "list", "create", "update", "delete"]
|
||||
- apiGroups: [""] # pods and services are looked up to figure out network settings
|
||||
resources: ["pods", "services"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["operator.openshift.io"]
|
||||
resources: ["dnses"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
- apiGroups: ["config.openshift.io"]
|
||||
resources: ["networks"]
|
||||
verbs: ["get", "list"]
|
||||
- apiGroups: ["multicluster.x-k8s.io"]
|
||||
resources: ["*"]
|
||||
verbs: ["create", "get", "list", "watch", "update", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.operatorServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "submariner.fullname" . }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:routeagent
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get", "update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:routeagent
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "submariner.fullname" . }}:routeagent
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.operatorServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:globalnet
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["services", "namespaces", "pods", "nodes"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
- apiGroups: ["submariner.io"]
|
||||
resources: ["clusters", "endpoints", "gateways"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:globalnet
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "submariner.fullname" . }}:globalnet
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.operatorServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
{{- if .Values.submariner.serviceDiscovery }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["services", "namespaces", "configmaps", "endpoints"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources: ["endpointslices"]
|
||||
verbs: ["create", "get", "list", "watch", "update", "delete"]
|
||||
- apiGroups: ["lighthouse.submariner.io"]
|
||||
resources: ["*"]
|
||||
verbs: ["create", "get", "list", "watch", "update", "delete"]
|
||||
- apiGroups: ["submariner.io"]
|
||||
resources: ["gateways"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.operatorServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,24 @@
|
||||
apiVersion: submariner.io/v1alpha1
|
||||
kind: Submariner
|
||||
metadata:
|
||||
name: submariner
|
||||
namespace: submariner-operator
|
||||
spec:
|
||||
broker: k8s
|
||||
brokerK8sApiServer: {{ .Values.broker.server }}
|
||||
brokerK8sApiServerToken: {{ .Values.broker.token }}
|
||||
brokerK8sCA: {{ .Values.broker.ca }}
|
||||
brokerK8sRemoteNamespace: {{ .Values.broker.namespace }}
|
||||
ceIPSecDebug: {{ .Values.ipsec.debug }}
|
||||
ceIPSecIKEPort: {{ .Values.ipsec.ikePort }}
|
||||
ceIPSecNATTPort: {{ .Values.ipsec.natPort }}
|
||||
ceIPSecPSK: {{ .Values.ipsec.psk }}
|
||||
clusterCIDR: "{{ .Values.submariner.clusterCidr }}"
|
||||
clusterID: {{ .Values.submariner.clusterId }}
|
||||
colorCodes: {{ .Values.submariner.colorCodes }}
|
||||
debug: {{ .Values.submariner.debug }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
natEnabled: {{ .Values.submariner.natEnabled }}
|
||||
repository: {{ .Values.submariner.images.repository }}
|
||||
version: {{ .Values.submariner.images.tag }}
|
||||
serviceCIDR: "{{ .Values.submariner.serviceCidr }}"
|
||||
@@ -0,0 +1,59 @@
|
||||
{{- if .Values.serviceAccounts.operator.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "submariner.operatorServiceAccountName" . }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if .Values.serviceAccounts.engine.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "submariner.engineServiceAccountName" . }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if .Values.serviceAccounts.routeAgent.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "submariner.routeAgentServiceAccountName" . }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if .Values.serviceAccounts.globalnet.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "submariner.globalnetServiceAccountName" . }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if .Values.serviceAccounts.lighthouse.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "submariner.lighthouseServiceAccountName" . }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,59 @@
|
||||
---
|
||||
submariner:
|
||||
clusterId: ""
|
||||
token: ""
|
||||
clusterCidr: ""
|
||||
serviceCidr: ""
|
||||
globalCidr: ""
|
||||
natEnabled: false
|
||||
colorCodes: blue
|
||||
debug: false
|
||||
serviceDiscovery: true
|
||||
images:
|
||||
repository: quay.io/submariner
|
||||
tag: "0.7.0"
|
||||
broker:
|
||||
server: example.k8s.apiserver
|
||||
token: test
|
||||
namespace: xyz
|
||||
insecure: false
|
||||
ca: ""
|
||||
rbac:
|
||||
create: true
|
||||
ipsec:
|
||||
psk: ""
|
||||
debug: false
|
||||
ikePort: 500
|
||||
natPort: 4500
|
||||
leadership:
|
||||
leaseDuration: 10
|
||||
renewDeadline: 5
|
||||
retryPeriod: 2
|
||||
operator:
|
||||
image:
|
||||
repository: quay.io/submariner/submariner-operator
|
||||
tag: "0.7.0"
|
||||
pullPolicy: IfNotPresent
|
||||
resources: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
engine:
|
||||
image:
|
||||
repository: quay.io/submariner/submariner
|
||||
tag: "0.7.0"
|
||||
serviceAccounts:
|
||||
operator:
|
||||
create: true
|
||||
name: ""
|
||||
engine:
|
||||
create: true
|
||||
name: ""
|
||||
routeAgent:
|
||||
create: true
|
||||
name: ""
|
||||
globalnet:
|
||||
create: true
|
||||
name: ""
|
||||
lighthouse:
|
||||
create: false
|
||||
name: ""
|
||||
Reference in New Issue
Block a user