From 96ff45c2f8ff70490f882d88f7306c45a823520c Mon Sep 17 00:00:00 2001 From: Stephen Kitt Date: Fri, 21 Aug 2020 11:06:17 +0200 Subject: [PATCH] Add an operator Helm chart The submariner-operator Helm chart deploys Submariner using the Submariner operator: it deploys the CRDs, roles, and SAs required to run the operator and Submariner, then pushes a Submariner CR to instruct the operator to deploy Submariner. This patch also adds a Makefile to validate the deployments; run make deploy to test the Helm charts (this will bring up two clusters, install the broker on one of them and the operator on both, and end with a connectivity test). Fixes: #17 Signed-off-by: Stephen Kitt --- .github/workflows/linting.yml | 2 +- .travis.yml | 4 +- Dockerfile.dapper | 15 + Makefile | 36 + Makefile.dapper | 26 + cluster_settings | 10 + deploy_helm | 84 ++ submariner-operator/.helmignore | 1 + submariner-operator/Chart.yaml | 12 + submariner-operator/app-readme.md | 5 + submariner-operator/questions.yml | 118 +++ submariner-operator/templates/NOTES.txt | 7 + submariner-operator/templates/_helpers.tpl | 94 +++ submariner-operator/templates/crd.yaml | 723 ++++++++++++++++++ .../templates/operator-deployment.yaml | 57 ++ submariner-operator/templates/rbac.yaml | 318 ++++++++ submariner-operator/templates/submariner.yaml | 24 + submariner-operator/templates/svc-acct.yaml | 59 ++ submariner-operator/values.yaml | 59 ++ 19 files changed, 1651 insertions(+), 3 deletions(-) create mode 100644 Dockerfile.dapper create mode 100644 Makefile create mode 100644 Makefile.dapper create mode 100644 cluster_settings create mode 100644 deploy_helm create mode 100644 submariner-operator/.helmignore create mode 100644 submariner-operator/Chart.yaml create mode 100644 submariner-operator/app-readme.md create mode 100644 submariner-operator/questions.yml create mode 100644 submariner-operator/templates/NOTES.txt create mode 100644 submariner-operator/templates/_helpers.tpl create mode 100644 submariner-operator/templates/crd.yaml create mode 100644 submariner-operator/templates/operator-deployment.yaml create mode 100644 submariner-operator/templates/rbac.yaml create mode 100644 submariner-operator/templates/submariner.yaml create mode 100644 submariner-operator/templates/svc-acct.yaml create mode 100644 submariner-operator/values.yaml diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml index 29ead3d..63cf427 100644 --- a/.github/workflows/linting.yml +++ b/.github/workflows/linting.yml @@ -53,5 +53,5 @@ jobs: - name: Run yamllint uses: ibiqlik/action-yamllint@v1 with: - file_or_dir: submariner/values.yaml submariner-k8s-broker/values.yaml submariner/Chart.yaml submariner-k8s-broker/Chart.yaml + file_or_dir: submariner/Chart.yaml submariner/values.yaml submariner-k8s-broker/Chart.yaml submariner-k8s-broker/values.yaml submariner-operator/Chart.yaml submariner-operator/values.yaml config_file: .yamllint.yml diff --git a/.travis.yml b/.travis.yml index 6abeec0..a734e16 100644 --- a/.travis.yml +++ b/.travis.yml @@ -18,7 +18,7 @@ install: - sudo pip install yamllint=="${YAMLLINT_VERSION}" script: - - for dir in submariner submariner-k8s-broker; do helm lint $dir $HELM_FLAGS; done + - for dir in submariner submariner-k8s-broker submariner-operator; do helm lint $dir $HELM_FLAGS; done - yamllint -c .yamllint.yml -s $(find . -type f -name "Chart.yaml") - yamllint -c .yamllint.yml -s $(find . -type f -name "values.yaml") @@ -26,7 +26,7 @@ after_success: - > if [ $TRAVIS_BRANCH = 'master' ] && [ $TRAVIS_PULL_REQUEST = 'false' ]; then set -e - for dir in submariner submariner-k8s-broker; do + for dir in submariner submariner-k8s-broker submariner-operator; do helm dep update $dir helm package $dir done diff --git a/Dockerfile.dapper b/Dockerfile.dapper new file mode 100644 index 0000000..4ffab1a --- /dev/null +++ b/Dockerfile.dapper @@ -0,0 +1,15 @@ +FROM quay.io/submariner/shipyard-dapper-base:devel + +ARG DAPPER_HOST_ARCH +ENV HOST_ARCH=${DAPPER_HOST_ARCH} ARCH=${DAPPER_HOST_ARCH} \ + DAPPER_ENV="REPO TAG QUAY_USERNAME QUAY_PASSWORD GITHUB_SHA MAKEFLAGS CLUSTERS_ARGS DEPLOY_ARGS E2E_ARGS RELEASE_ARGS" \ + DAPPER_SOURCE=/go/src/github.com/submariner-io/submariner-charts DAPPER_DOCKER_SOCKET=true +ENV DAPPER_OUTPUT=${DAPPER_SOURCE}/output PATH=${DAPPER_SOURCE}/bin/:${PATH} + +WORKDIR ${DAPPER_SOURCE} + +# Override the Helm deployment scripts +COPY deploy_helm /opt/shipyard/scripts/lib/ + +ENTRYPOINT ["/opt/shipyard/scripts/entry"] +CMD ["sh"] diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..81fe004 --- /dev/null +++ b/Makefile @@ -0,0 +1,36 @@ +ifneq (,$(DAPPER_HOST_ARCH)) + +# Running in Dapper + +include $(SHIPYARD_DIR)/Makefile.inc + +CLUSTER_SETTINGS_FLAG = --cluster_settings $(DAPPER_SOURCE)/cluster_settings +override CLUSTERS_ARGS += $(CLUSTER_SETTINGS_FLAG) +override DEPLOY_ARGS += $(CLUSTER_SETTINGS_FLAG) --deploytool helm +export DEPLOY_ARGS + +# Targets to make + +deploy: clusters preload-images + +preload-images: + source $(SCRIPTS_DIR)/lib/debug_functions; \ + source $(SCRIPTS_DIR)/lib/deploy_funcs; \ + source $(SCRIPTS_DIR)/lib/version; \ + set -e; \ + for image in submariner submariner-route-agent submariner-operator lighthouse-agent submariner-globalnet lighthouse-coredns; do \ + import_image quay.io/submariner/$${image}; \ + done + +.PHONY: preload-images + +else + +# Not running in Dapper + +include Makefile.dapper + +endif + +# Disable rebuilding Makefile +Makefile Makefile.dapper Makefile.inc: ; diff --git a/Makefile.dapper b/Makefile.dapper new file mode 100644 index 0000000..cd42de7 --- /dev/null +++ b/Makefile.dapper @@ -0,0 +1,26 @@ +# This Makefile contains the rules required to set up our +# Dapper-based build environment; it can be copied as-is to +# other projects (and needs to be copied, it can't be shared +# via the Dapper image since it's needed to retrieve the image) + +.dapper: + @echo Downloading dapper + @curl -sL https://releases.rancher.com/dapper/latest/dapper-`uname -s`-`uname -m` > .dapper.tmp + @@chmod +x .dapper.tmp + @./.dapper.tmp -v + @mv .dapper.tmp .dapper + +invoke_dapper = +./.dapper -m bind make -- $1 + +%: .dapper + @echo Invoking Dapper, MAKEFLAGS=$(MAKEFLAGS) + $(call invoke_dapper,$@) + +# Ensure that files in the current directory don't hide Dapper targets +$(wildcard [^M]*): .dapper + $(call invoke_dapper,$@) + +shell: .dapper + ./.dapper -m bind -s + +.PHONY: shell $(wildcard [^M]*) diff --git a/cluster_settings b/cluster_settings new file mode 100644 index 0000000..f9d25ea --- /dev/null +++ b/cluster_settings @@ -0,0 +1,10 @@ +. "${SCRIPTS_DIR}"/lib/source_only + +# We need a minimal setup to verify the deployment works +clusters=('cluster1' 'cluster2') +cluster_nodes['cluster1']="control-plane worker" +cluster_nodes['cluster2']="control-plane worker" + +cluster_cni=( ['cluster1']="weave" ['cluster2']="weave" ) + +cluster_subm=( ['cluster1']="true" ['cluster2']="true" ) diff --git a/deploy_helm b/deploy_helm new file mode 100644 index 0000000..d1f45fd --- /dev/null +++ b/deploy_helm @@ -0,0 +1,84 @@ +# shellcheck shell=bash +# shellcheck source=scripts/shared/lib/source_only +. "${BASH_SOURCE%/*}"/source_only + +### Constants ### + +readonly SUBMARINER_BROKER_NS=submariner-k8s-broker +readonly SUBMARINER_PSK=$(LC_CTYPE=C tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w 64 | head -n 1) + +### Functions ### + +function install_helm() { + if kubectl -n kube-system rollout status deploy/tiller-deploy --timeout=3s > /dev/null 2>&1; then + echo "Helm already installed, skipping helm installation..." + return + fi + + echo "Installing helm..." + kubectl -n kube-system create serviceaccount tiller + kubectl create clusterrolebinding tiller --clusterrole=cluster-admin --serviceaccount=kube-system:tiller + helm --kube-context "${cluster}" init --service-account tiller + kubectl -n kube-system rollout status deploy/tiller-deploy --timeout=30s +} + +function deploytool_prereqs() { + helm init --client-only + run_all_clusters install_helm +} + +function setup_broker() { + if kubectl get crd clusters.submariner.io > /dev/null 2>&1; then + echo "Submariner CRDs already exist, skipping broker creation..." + else + echo "Installing submariner broker..." + # shellcheck disable=SC2086 # Split on purpose + helm install ./submariner-k8s-broker \ + --kube-context "${cluster}" \ + --name "${SUBMARINER_BROKER_NS}" \ + --namespace "${SUBMARINER_BROKER_NS}" \ + ${deploytool_broker_args} + fi + + submariner_broker_url=$(kubectl -n default get endpoints kubernetes -o jsonpath="{.subsets[0].addresses[0].ip}:{.subsets[0].ports[?(@.name=='https')].port}") + submariner_broker_ca=$(kubectl -n "${SUBMARINER_BROKER_NS}" get secrets -o jsonpath="{.items[?(@.metadata.annotations['kubernetes\.io/service-account\.name']=='${SUBMARINER_BROKER_NS}-client')].data['ca\.crt']}") + submariner_broker_token=$(kubectl -n "${SUBMARINER_BROKER_NS}" get secrets -o jsonpath="{.items[?(@.metadata.annotations['kubernetes\.io/service-account\.name']=='${SUBMARINER_BROKER_NS}-client')].data.token}"|base64 --decode) +} + +function helm_install_subm() { + local crd_create=false + [[ "${cluster}" = "${broker}" ]] || crd_create=true + + if kubectl wait --for=condition=Ready pods -l app=submariner-operator -n "${SUBM_NS}" --timeout=60s > /dev/null 2>&1; then + echo "Submariner already installed, skipping installation..." + return + fi + + echo "Installing Submariner..." + # shellcheck disable=SC2086 # Split on purpose + helm --kube-context "${cluster}" install ./submariner-operator \ + --name submariner-operator \ + --namespace "${SUBM_NS}" \ + --set ipsec.psk="${SUBMARINER_PSK}" \ + --set broker.server="${submariner_broker_url}" \ + --set broker.token="${submariner_broker_token}" \ + --set broker.namespace="${SUBMARINER_BROKER_NS}" \ + --set broker.ca="${submariner_broker_ca}" \ + --set submariner.clusterId="${cluster}" \ + --set submariner.clusterCidr="${cluster_CIDRs[$cluster]}" \ + --set submariner.serviceCidr="${service_CIDRs[$cluster]}" \ + --set submariner.globalCidr="${global_CIDRs[$cluster]}" \ + --set serviceAccounts.globalnet.create="${globalnet}" \ + --set submariner.natEnabled="false" \ + --set operator.image.repository="localhost:5000/submariner-operator" \ + --set operator.image.tag="local" \ + --set operator.image.pullPolicy="IfNotPresent" \ + --set submariner.images.repository="localhost:5000" \ + --set submariner.images.tag="local" \ + --set brokercrds.create="${crd_create}" \ + ${deploytool_submariner_args} +} + +function install_subm_all_clusters() { + run_subm_clusters helm_install_subm +} diff --git a/submariner-operator/.helmignore b/submariner-operator/.helmignore new file mode 100644 index 0000000..6b8710a --- /dev/null +++ b/submariner-operator/.helmignore @@ -0,0 +1 @@ +.git diff --git a/submariner-operator/Chart.yaml b/submariner-operator/Chart.yaml new file mode 100644 index 0000000..70f3e71 --- /dev/null +++ b/submariner-operator/Chart.yaml @@ -0,0 +1,12 @@ +--- +name: submariner-operator +version: 0.7.0 +appVersion: 0.7.0 +description: Submariner enables direct networking between Pods and Services in different Kubernetes clusters +keywords: +home: https://submariner-io.github.io/ +sources: + - https://submariner-io.github.io/submariner-charts/charts +maintainers: + - name: Submariner Developers + email: submariner-dev@googlegroups.com diff --git a/submariner-operator/app-readme.md b/submariner-operator/app-readme.md new file mode 100644 index 0000000..72c7781 --- /dev/null +++ b/submariner-operator/app-readme.md @@ -0,0 +1,5 @@ +# Submariner + +[Submariner](https://submariner.io) is a cross-cluster networking tool. + +This chart creates the required components in this cluster to deploy the Submariner operator. diff --git a/submariner-operator/questions.yml b/submariner-operator/questions.yml new file mode 100644 index 0000000..07700ed --- /dev/null +++ b/submariner-operator/questions.yml @@ -0,0 +1,118 @@ +questions: +- variable: defaultOperatorImage + default: true + description: "Use default Submariner operator image or specify a custom one" + label: Use default Submariner operator image + type: boolean + show_subquestion_if: false + group: "Container Images" + subquestions: + - variable: operator.image.repository + default: "quay.io/submariner/submariner-operator" + description: "Submariner Operator Image Repository" + type: string + label: Submariner Operator Image Repository + - variable: operator.image.tag + default: "0.7.0" + description: "Submariner Operator Image Tag" + type: string + label: Submariner Operator Image Tag +- variable: defaultSubmarinerImages + default: true + description: "Use default Submariner images or specify custom ones" + label: Use default Submariner images + type: boolean + show_subquestion_if: false + group: "Container images" + subquestions: + - variable: submariner.images.repository + default: "quay.io/submariner" + description: "Submariner Repository (base for all non-operator images)" + type: string + label: Submariner Repository + - variable: submariner.images.tag + default: "0.7.0" + description: "Submariner Images Tag (shared for all non-operator images)" + type: string + label: Submariner Images Tag +- variable: submariner.clusterId + default: "" + description: "Enter a unique cluster ID to identify this cluster" + type: string + label: "Cluster ID" + group: "Configuration" + required: true +- variable: ipsec.psk + default: "" + description: "Enter the pre-shared key for the IPsec Cable Engine" + type: string + label: "IPsec Pre-Shared Key" + group: "Configuration" + required: true +- variable: broker.server + type: string + default: "" + group: "Broker Configuration" + label: "Broker Server" + description: "Broker server to use (without the https://)" +- variable: broker.insecure + type: boolean + default: false + show_subquestion_if: false + group: "Broker Configuration" + label: "Insecure Broker" + description: "Connect to K8s broker without validating CA" + subquestions: + - variable: broker.ca + type: string + description: "Base64 encoded broker ca.crt" + label: "Broker CA encoded in base64" + default: "" +- variable: broker.token + type: string + group: "Broker Configuration" + label: "Broker Token" + description: "Bearer token for broker" +- variable: broker.namespace + type: string + group: "Broker Configuration" + label: "Broker Namespace" + description: "Enter namespace to use on central broker" +- variable: submariner.clusterCidr + default: "" + description: "Enter the cluster CIDR (i.e. 10.42.0.0/16) for this cluster" + type: string + label: "Cluster CIDR" + group: "CIDR Configuration" + required: true +- variable: submariner.serviceCidr + default: "" + description: "Enter the service CIDR (i.e. 10.43.0.0/16) for this cluster" + type: string + label: "Service CIDR" + group: "CIDR Configuration" + required: true +- variable: submariner.natEnabled + type: boolean + default: false + group: "Advanced Configuration" + description: "If the gateway nodes for this cluster are behind 1:1 NAT, you should enable NAT" + label: "NAT Enabled" +- variable: submariner.debug + type: boolean + default: false + group: "Advanced Configuration" + description: "Enable submariner debug mode" + label: "Submariner Debug Enabled" +- variable: ipsec.debug + type: boolean + default: false + group: "Advanced Configuration" + description: "Enable Charon debug mode" + label: "Charon Enabled" +- variable: submariner.cableDriver + type: string + default: "" + group: "Advanced Configuration" + description: "Cable driver implementation" + label: "Cable Driver" diff --git a/submariner-operator/templates/NOTES.txt b/submariner-operator/templates/NOTES.txt new file mode 100644 index 0000000..9812618 --- /dev/null +++ b/submariner-operator/templates/NOTES.txt @@ -0,0 +1,7 @@ +Submariner is now installed. + +{{- if .Values.engine.nodeSelectorEnabled }} +If you haven't done so yet, please label a node as `submariner.io/gateway=true` to elect it for running Submariner. +{{- end }} + +By default, Submariner runs with 1 replica. If you have more than one Gateway host, you can scale Submariner to N replicas, and the other Submariner pods will simply join the leader election pool. \ No newline at end of file diff --git a/submariner-operator/templates/_helpers.tpl b/submariner-operator/templates/_helpers.tpl new file mode 100644 index 0000000..47cd3c6 --- /dev/null +++ b/submariner-operator/templates/_helpers.tpl @@ -0,0 +1,94 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "submariner.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "submariner.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "submariner.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create the name of the submariner-operator service account to use +*/}} +{{- define "submariner.operatorServiceAccountName" -}} +{{- if .Values.serviceAccounts.operator.create -}} + {{ default (printf "%s" (include "submariner.fullname" .)) .Values.serviceAccounts.operator.name }} +{{- else -}} + {{ default "default" .Values.serviceAccounts.operator.name }} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the submariner-engine service account to use +*/}} +{{- define "submariner.engineServiceAccountName" -}} +{{- if .Values.serviceAccounts.engine.create -}} + {{ default (printf "%s-engine" (include "submariner.fullname" .)) .Values.serviceAccounts.engine.name }} +{{- else -}} + {{ default "default" .Values.serviceAccounts.engine.name }} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the submariner-route-agent service account to use +*/}} +{{- define "submariner.routeAgentServiceAccountName" -}} +{{- if .Values.serviceAccounts.routeAgent.create -}} + {{ default (printf "%s-routeagent" (include "submariner.fullname" .)) .Values.serviceAccounts.routeAgent.name }} +{{- else -}} + {{ default "default" .Values.serviceAccounts.routeAgent.name }} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the submariner-globalnet service account to use +*/}} +{{- define "submariner.globalnetServiceAccountName" -}} +{{- if .Values.serviceAccounts.globalnet.create -}} + {{ default (printf "%s:globalnet" (include "submariner.fullname" .)) .Values.serviceAccounts.globalnet.name }} +{{- else -}} + {{ default "default" .Values.serviceAccounts.globalnet.name }} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the submariner-lighthouse service account to use +*/}} +{{- define "submariner.lighthouseServiceAccountName" -}} +{{- if .Values.submariner.serviceDiscovery -}} + {{ default (printf "%s-lighthouse" (include "submariner.fullname" .)) .Values.serviceAccounts.lighthouse.name }} +{{- else -}} + {{ default "default" .Values.serviceAccounts.lighthouse.name }} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the submariner-lighthouse-coredns service name to use +*/}} +{{- define "submariner.lighthouseDnsName" -}} +{{- default (printf "%s-lighthouse-coredns" (include "submariner.fullname" .)) .Values.lighthouseCoredns.name }} +{{- end -}} diff --git a/submariner-operator/templates/crd.yaml b/submariner-operator/templates/crd.yaml new file mode 100644 index 0000000..457a96f --- /dev/null +++ b/submariner-operator/templates/crd.yaml @@ -0,0 +1,723 @@ +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: submariners.submariner.io + annotations: + "helm.sh/hook": crd-install + controller-gen.kubebuilder.io/version: v0.3.0 +spec: + group: submariner.io + names: + kind: Submariner + listKind: SubmarinerList + plural: submariners + singular: submariner + scope: Namespaced + subresources: + status: {} + validation: + openAPIV3Schema: + description: Submariner is the Schema for the submariners API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: SubmarinerSpec defines the desired state of Submariner + properties: + broker: + type: string + brokerK8sApiServer: + type: string + brokerK8sApiServerToken: + type: string + brokerK8sCA: + type: string + brokerK8sRemoteNamespace: + type: string + cableDriver: + type: string + ceIPSecDebug: + type: boolean + ceIPSecIKEPort: + type: integer + ceIPSecNATTPort: + type: integer + ceIPSecPSK: + type: string + clusterCIDR: + type: string + clusterID: + type: string + colorCodes: + type: string + customDomains: + items: + type: string + type: array + x-kubernetes-list-type: set + debug: + type: boolean + globalCIDR: + type: string + namespace: + type: string + natEnabled: + type: boolean + repository: + type: string + serviceCIDR: + type: string + serviceDiscoveryEnabled: + type: boolean + version: + type: string + required: + - broker + - brokerK8sApiServer + - brokerK8sApiServerToken + - brokerK8sCA + - brokerK8sRemoteNamespace + - ceIPSecDebug + - ceIPSecPSK + - clusterCIDR + - clusterID + - debug + - namespace + - natEnabled + - serviceCIDR + type: object + status: + description: SubmarinerStatus defines the observed state of Submariner + properties: + clusterCIDR: + type: string + clusterID: + type: string + colorCodes: + type: string + engineDaemonSetStatus: + properties: + lastResourceVersion: + type: string + mismatchedContainerImages: + type: boolean + nonReadyContainerStates: + items: + description: ContainerState holds a possible state of container. + Only one of its members may be specified. If none of them is + specified, the default one is ContainerStateWaiting. + properties: + running: + description: Details about a running container + properties: + startedAt: + description: Time at which the container was last (re-)started + format: date-time + type: string + type: object + terminated: + description: Details about a terminated container + properties: + containerID: + description: Container's ID in the format 'docker://' + type: string + exitCode: + description: Exit status from the last termination of + the container + format: int32 + type: integer + finishedAt: + description: Time at which the container last terminated + format: date-time + type: string + message: + description: Message regarding the last termination of + the container + type: string + reason: + description: (brief) reason from the last termination + of the container + type: string + signal: + description: Signal from the last termination of the container + format: int32 + type: integer + startedAt: + description: Time at which previous execution of the container + started + format: date-time + type: string + required: + - exitCode + type: object + waiting: + description: Details about a waiting container + properties: + message: + description: Message regarding why the container is not + yet running. + type: string + reason: + description: (brief) reason the container is not yet running. + type: string + type: object + type: object + type: array + status: + description: DaemonSetStatus represents the current status of a + daemon set. + properties: + collisionCount: + description: Count of hash collisions for the DaemonSet. The + DaemonSet controller uses this field as a collision avoidance + mechanism when it needs to create the name for the newest + ControllerRevision. + format: int32 + type: integer + conditions: + description: Represents the latest available observations of + a DaemonSet's current state. + items: + description: DaemonSetCondition describes the state of a DaemonSet + at a certain point. + properties: + lastTransitionTime: + description: Last time the condition transitioned from + one status to another. + format: date-time + type: string + message: + description: A human readable message indicating details + about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of DaemonSet condition. + type: string + required: + - status + - type + type: object + type: array + currentNumberScheduled: + description: 'The number of nodes that are running at least + 1 daemon pod and are supposed to run the daemon pod. More + info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/' + format: int32 + type: integer + desiredNumberScheduled: + description: 'The total number of nodes that should be running + the daemon pod (including nodes correctly running the daemon + pod). More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/' + format: int32 + type: integer + numberAvailable: + description: The number of nodes that should be running the + daemon pod and have one or more of the daemon pod running + and available (ready for at least spec.minReadySeconds) + format: int32 + type: integer + numberMisscheduled: + description: 'The number of nodes that are running the daemon + pod, but are not supposed to run the daemon pod. More info: + https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/' + format: int32 + type: integer + numberReady: + description: The number of nodes that should be running the + daemon pod and have one or more of the daemon pod running + and ready. + format: int32 + type: integer + numberUnavailable: + description: The number of nodes that should be running the + daemon pod and have none of the daemon pod running and available + (ready for at least spec.minReadySeconds) + format: int32 + type: integer + observedGeneration: + description: The most recent generation observed by the daemon + set controller. + format: int64 + type: integer + updatedNumberScheduled: + description: The total number of nodes that are running updated + daemon pod + format: int32 + type: integer + required: + - currentNumberScheduled + - desiredNumberScheduled + - numberMisscheduled + - numberReady + type: object + required: + - mismatchedContainerImages + type: object + gateways: + items: + properties: + connections: + items: + properties: + endpoint: + properties: + backend: + type: string + backend_config: + additionalProperties: + type: string + type: object + cable_name: + type: string + cluster_id: + type: string + hostname: + type: string + nat_enabled: + type: boolean + private_ip: + type: string + public_ip: + type: string + subnets: + items: + type: string + type: array + required: + - backend + - cable_name + - cluster_id + - hostname + - nat_enabled + - private_ip + - public_ip + - subnets + type: object + status: + type: string + statusMessage: + type: string + required: + - endpoint + - status + - statusMessage + type: object + type: array + haStatus: + type: string + localEndpoint: + properties: + backend: + type: string + backend_config: + additionalProperties: + type: string + type: object + cable_name: + type: string + cluster_id: + type: string + hostname: + type: string + nat_enabled: + type: boolean + private_ip: + type: string + public_ip: + type: string + subnets: + items: + type: string + type: array + required: + - backend + - cable_name + - cluster_id + - hostname + - nat_enabled + - private_ip + - public_ip + - subnets + type: object + statusFailure: + type: string + version: + type: string + required: + - connections + - haStatus + - localEndpoint + - statusFailure + - version + type: object + type: array + globalCIDR: + type: string + globalnetDaemonSetStatus: + properties: + lastResourceVersion: + type: string + mismatchedContainerImages: + type: boolean + nonReadyContainerStates: + items: + description: ContainerState holds a possible state of container. + Only one of its members may be specified. If none of them is + specified, the default one is ContainerStateWaiting. + properties: + running: + description: Details about a running container + properties: + startedAt: + description: Time at which the container was last (re-)started + format: date-time + type: string + type: object + terminated: + description: Details about a terminated container + properties: + containerID: + description: Container's ID in the format 'docker://' + type: string + exitCode: + description: Exit status from the last termination of + the container + format: int32 + type: integer + finishedAt: + description: Time at which the container last terminated + format: date-time + type: string + message: + description: Message regarding the last termination of + the container + type: string + reason: + description: (brief) reason from the last termination + of the container + type: string + signal: + description: Signal from the last termination of the container + format: int32 + type: integer + startedAt: + description: Time at which previous execution of the container + started + format: date-time + type: string + required: + - exitCode + type: object + waiting: + description: Details about a waiting container + properties: + message: + description: Message regarding why the container is not + yet running. + type: string + reason: + description: (brief) reason the container is not yet running. + type: string + type: object + type: object + type: array + status: + description: DaemonSetStatus represents the current status of a + daemon set. + properties: + collisionCount: + description: Count of hash collisions for the DaemonSet. The + DaemonSet controller uses this field as a collision avoidance + mechanism when it needs to create the name for the newest + ControllerRevision. + format: int32 + type: integer + conditions: + description: Represents the latest available observations of + a DaemonSet's current state. + items: + description: DaemonSetCondition describes the state of a DaemonSet + at a certain point. + properties: + lastTransitionTime: + description: Last time the condition transitioned from + one status to another. + format: date-time + type: string + message: + description: A human readable message indicating details + about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of DaemonSet condition. + type: string + required: + - status + - type + type: object + type: array + currentNumberScheduled: + description: 'The number of nodes that are running at least + 1 daemon pod and are supposed to run the daemon pod. More + info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/' + format: int32 + type: integer + desiredNumberScheduled: + description: 'The total number of nodes that should be running + the daemon pod (including nodes correctly running the daemon + pod). More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/' + format: int32 + type: integer + numberAvailable: + description: The number of nodes that should be running the + daemon pod and have one or more of the daemon pod running + and available (ready for at least spec.minReadySeconds) + format: int32 + type: integer + numberMisscheduled: + description: 'The number of nodes that are running the daemon + pod, but are not supposed to run the daemon pod. More info: + https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/' + format: int32 + type: integer + numberReady: + description: The number of nodes that should be running the + daemon pod and have one or more of the daemon pod running + and ready. + format: int32 + type: integer + numberUnavailable: + description: The number of nodes that should be running the + daemon pod and have none of the daemon pod running and available + (ready for at least spec.minReadySeconds) + format: int32 + type: integer + observedGeneration: + description: The most recent generation observed by the daemon + set controller. + format: int64 + type: integer + updatedNumberScheduled: + description: The total number of nodes that are running updated + daemon pod + format: int32 + type: integer + required: + - currentNumberScheduled + - desiredNumberScheduled + - numberMisscheduled + - numberReady + type: object + required: + - mismatchedContainerImages + type: object + natEnabled: + type: boolean + routeAgentDaemonSetStatus: + properties: + lastResourceVersion: + type: string + mismatchedContainerImages: + type: boolean + nonReadyContainerStates: + items: + description: ContainerState holds a possible state of container. + Only one of its members may be specified. If none of them is + specified, the default one is ContainerStateWaiting. + properties: + running: + description: Details about a running container + properties: + startedAt: + description: Time at which the container was last (re-)started + format: date-time + type: string + type: object + terminated: + description: Details about a terminated container + properties: + containerID: + description: Container's ID in the format 'docker://' + type: string + exitCode: + description: Exit status from the last termination of + the container + format: int32 + type: integer + finishedAt: + description: Time at which the container last terminated + format: date-time + type: string + message: + description: Message regarding the last termination of + the container + type: string + reason: + description: (brief) reason from the last termination + of the container + type: string + signal: + description: Signal from the last termination of the container + format: int32 + type: integer + startedAt: + description: Time at which previous execution of the container + started + format: date-time + type: string + required: + - exitCode + type: object + waiting: + description: Details about a waiting container + properties: + message: + description: Message regarding why the container is not + yet running. + type: string + reason: + description: (brief) reason the container is not yet running. + type: string + type: object + type: object + type: array + status: + description: DaemonSetStatus represents the current status of a + daemon set. + properties: + collisionCount: + description: Count of hash collisions for the DaemonSet. The + DaemonSet controller uses this field as a collision avoidance + mechanism when it needs to create the name for the newest + ControllerRevision. + format: int32 + type: integer + conditions: + description: Represents the latest available observations of + a DaemonSet's current state. + items: + description: DaemonSetCondition describes the state of a DaemonSet + at a certain point. + properties: + lastTransitionTime: + description: Last time the condition transitioned from + one status to another. + format: date-time + type: string + message: + description: A human readable message indicating details + about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of DaemonSet condition. + type: string + required: + - status + - type + type: object + type: array + currentNumberScheduled: + description: 'The number of nodes that are running at least + 1 daemon pod and are supposed to run the daemon pod. More + info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/' + format: int32 + type: integer + desiredNumberScheduled: + description: 'The total number of nodes that should be running + the daemon pod (including nodes correctly running the daemon + pod). More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/' + format: int32 + type: integer + numberAvailable: + description: The number of nodes that should be running the + daemon pod and have one or more of the daemon pod running + and available (ready for at least spec.minReadySeconds) + format: int32 + type: integer + numberMisscheduled: + description: 'The number of nodes that are running the daemon + pod, but are not supposed to run the daemon pod. More info: + https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/' + format: int32 + type: integer + numberReady: + description: The number of nodes that should be running the + daemon pod and have one or more of the daemon pod running + and ready. + format: int32 + type: integer + numberUnavailable: + description: The number of nodes that should be running the + daemon pod and have none of the daemon pod running and available + (ready for at least spec.minReadySeconds) + format: int32 + type: integer + observedGeneration: + description: The most recent generation observed by the daemon + set controller. + format: int64 + type: integer + updatedNumberScheduled: + description: The total number of nodes that are running updated + daemon pod + format: int32 + type: integer + required: + - currentNumberScheduled + - desiredNumberScheduled + - numberMisscheduled + - numberReady + type: object + required: + - mismatchedContainerImages + type: object + serviceCIDR: + type: string + required: + - clusterID + - natEnabled + type: object + type: object + version: v1alpha1 + versions: + - name: v1alpha1 + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/submariner-operator/templates/operator-deployment.yaml b/submariner-operator/templates/operator-deployment.yaml new file mode 100644 index 0000000..fc2812e --- /dev/null +++ b/submariner-operator/templates/operator-deployment.yaml @@ -0,0 +1,57 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.fullname" . }} + component: engine + name: {{ template "submariner.fullname" . }} +spec: + progressDeadlineSeconds: 600 + replicas: 1 + revisionHistoryLimit: 10 + selector: + matchLabels: + name: {{ template "submariner.fullname" . }} + strategy: + rollingUpdate: + maxSurge: 25% + maxUnavailable: 25% + type: RollingUpdate + template: + metadata: + creationTimestamp: null + labels: + name: {{ template "submariner.fullname" . }} + spec: + containers: + - command: + - submariner-operator + env: + - name: WATCH_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.name + - name: OPERATOR_NAME + value: submariner-operator + image: {{ .Values.operator.image.repository }}:{{ default .Chart.AppVersion .Values.operator.image.tag }} + imagePullPolicy: {{ .Values.operator.image.pullPolicy }} + name: submariner-operator + resources: {} + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + dnsPolicy: ClusterFirst + restartPolicy: Always + schedulerName: default-scheduler + securityContext: {} + serviceAccount: {{ template "submariner.fullname" . }} + serviceAccountName: {{ template "submariner.fullname" . }} + terminationGracePeriodSeconds: 30 diff --git a/submariner-operator/templates/rbac.yaml b/submariner-operator/templates/rbac.yaml new file mode 100644 index 0000000..8fbb6a7 --- /dev/null +++ b/submariner-operator/templates/rbac.yaml @@ -0,0 +1,318 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ template "submariner.fullname" . }} + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +rules: +- apiGroups: + - "" + resources: + - pods + - services + - services/finalizers + - endpoints + - persistentvolumeclaims + - events + - configmaps + - secrets + verbs: + - '*' +- apiGroups: + - apps + resources: + - deployments + - daemonsets + - replicasets + - statefulsets + verbs: + - '*' +- apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - get + - create +- apiGroups: + - apps + resourceNames: + - {{ template "submariner.fullname" . }} + resources: + - deployments/finalizers + verbs: + - update +- apiGroups: + - "" + resources: + - pods + verbs: + - get +- apiGroups: + - apps + resources: + - replicasets + verbs: + - get +- apiGroups: + - submariner.io + resources: + - '*' + - servicediscoveries + verbs: + - '*' +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ template "submariner.fullname" . }} + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +subjects: +- kind: ServiceAccount + name: {{ template "submariner.fullname" . }} +roleRef: + kind: Role + name: {{ template "submariner.fullname" . }} + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ template "submariner.fullname" . }}:engine + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +rules: +- apiGroups: [""] + resources: ["configmaps"] + verbs: ["create", "get", "list", "watch", "patch", "update"] +- apiGroups: ["submariner.io"] + resources: ["clusters", "endpoints", "gateways"] + verbs: ["create", "get", "list", "watch", "patch", "update", "delete"] +- apiGroups: [""] + resources: ["events"] + verbs: ["create", "patch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ template "submariner.fullname" . }}:engine + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "submariner.fullname" . }}:engine +subjects: +- kind: ServiceAccount + name: {{ template "submariner.operatorServiceAccountName" . }} + namespace: {{ .Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ template "submariner.fullname" . }}:routeagent + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +rules: +- apiGroups: ["submariner.io"] + resources: ["clusters", "endpoints", "gateways"] + verbs: ["create", "get", "list", "watch", "patch", "update"] +- apiGroups: [""] + resources: ["pods"] + verbs: ["get", "watch", "list"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ template "submariner.fullname" . }}:routeagent + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "submariner.fullname" . }}:routeagent +subjects: +- kind: ServiceAccount + name: {{ template "submariner.operatorServiceAccountName" . }} + namespace: {{ .Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "submariner.fullname" . }} + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +rules: + # submariner-operator updates the config map of core-dns to forward requests to + # clusterset.local to Lighthouse DNS, also looks at existing configmaps + # to figure out network settings + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["get", "list", "watch", "update"] + - apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"] + verbs: ["get", "list", "create", "update", "delete"] + - apiGroups: [""] # pods and services are looked up to figure out network settings + resources: ["pods", "services"] + verbs: ["get", "list", "watch"] + - apiGroups: ["operator.openshift.io"] + resources: ["dnses"] + verbs: ["get", "list", "watch", "update"] + - apiGroups: ["config.openshift.io"] + resources: ["networks"] + verbs: ["get", "list"] + - apiGroups: ["multicluster.x-k8s.io"] + resources: ["*"] + verbs: ["create", "get", "list", "watch", "update", "delete"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "submariner.fullname" . }} + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +subjects: + - kind: ServiceAccount + name: {{ template "submariner.operatorServiceAccountName" . }} + namespace: {{ .Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "submariner.fullname" . }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "submariner.fullname" . }}:routeagent + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +rules: + - apiGroups: [""] + resources: ["nodes"] + verbs: ["get", "update"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "submariner.fullname" . }}:routeagent + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "submariner.fullname" . }}:routeagent +subjects: + - kind: ServiceAccount + name: {{ template "submariner.operatorServiceAccountName" . }} + namespace: {{ .Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "submariner.fullname" . }}:globalnet + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +rules: +- apiGroups: [""] + resources: ["services", "namespaces", "pods", "nodes"] + verbs: ["get", "list", "watch", "update"] +- apiGroups: ["submariner.io"] + resources: ["clusters", "endpoints", "gateways"] + verbs: ["get", "list", "watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "submariner.fullname" . }}:globalnet + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "submariner.fullname" . }}:globalnet +subjects: +- kind: ServiceAccount + name: {{ template "submariner.operatorServiceAccountName" . }} + namespace: {{ .Release.Namespace }} +--- +{{- if .Values.submariner.serviceDiscovery }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "submariner.fullname" . }}:lighthouse + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +rules: + - apiGroups: [""] + resources: ["services", "namespaces", "configmaps", "endpoints"] + verbs: ["get", "list", "watch", "update"] + - apiGroups: ["discovery.k8s.io"] + resources: ["endpointslices"] + verbs: ["create", "get", "list", "watch", "update", "delete"] + - apiGroups: ["lighthouse.submariner.io"] + resources: ["*"] + verbs: ["create", "get", "list", "watch", "update", "delete"] + - apiGroups: ["submariner.io"] + resources: ["gateways"] + verbs: ["get", "list", "watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "submariner.fullname" . }}:lighthouse + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "submariner.fullname" . }}:lighthouse +subjects: + - kind: ServiceAccount + name: {{ template "submariner.operatorServiceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end -}} +{{- end -}} diff --git a/submariner-operator/templates/submariner.yaml b/submariner-operator/templates/submariner.yaml new file mode 100644 index 0000000..af9d0a2 --- /dev/null +++ b/submariner-operator/templates/submariner.yaml @@ -0,0 +1,24 @@ +apiVersion: submariner.io/v1alpha1 +kind: Submariner +metadata: + name: submariner + namespace: submariner-operator +spec: + broker: k8s + brokerK8sApiServer: {{ .Values.broker.server }} + brokerK8sApiServerToken: {{ .Values.broker.token }} + brokerK8sCA: {{ .Values.broker.ca }} + brokerK8sRemoteNamespace: {{ .Values.broker.namespace }} + ceIPSecDebug: {{ .Values.ipsec.debug }} + ceIPSecIKEPort: {{ .Values.ipsec.ikePort }} + ceIPSecNATTPort: {{ .Values.ipsec.natPort }} + ceIPSecPSK: {{ .Values.ipsec.psk }} + clusterCIDR: "{{ .Values.submariner.clusterCidr }}" + clusterID: {{ .Values.submariner.clusterId }} + colorCodes: {{ .Values.submariner.colorCodes }} + debug: {{ .Values.submariner.debug }} + namespace: {{ .Release.Namespace }} + natEnabled: {{ .Values.submariner.natEnabled }} + repository: {{ .Values.submariner.images.repository }} + version: {{ .Values.submariner.images.tag }} + serviceCIDR: "{{ .Values.submariner.serviceCidr }}" diff --git a/submariner-operator/templates/svc-acct.yaml b/submariner-operator/templates/svc-acct.yaml new file mode 100644 index 0000000..f7abcad --- /dev/null +++ b/submariner-operator/templates/svc-acct.yaml @@ -0,0 +1,59 @@ +{{- if .Values.serviceAccounts.operator.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "submariner.operatorServiceAccountName" . }} + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +{{- end }} +--- +{{- if .Values.serviceAccounts.engine.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "submariner.engineServiceAccountName" . }} + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +{{- end }} +--- +{{- if .Values.serviceAccounts.routeAgent.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "submariner.routeAgentServiceAccountName" . }} + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +{{- end }} +--- +{{- if .Values.serviceAccounts.globalnet.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "submariner.globalnetServiceAccountName" . }} + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +{{- end }} +--- +{{- if .Values.serviceAccounts.lighthouse.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "submariner.lighthouseServiceAccountName" . }} + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +{{- end }} diff --git a/submariner-operator/values.yaml b/submariner-operator/values.yaml new file mode 100644 index 0000000..1e60d96 --- /dev/null +++ b/submariner-operator/values.yaml @@ -0,0 +1,59 @@ +--- +submariner: + clusterId: "" + token: "" + clusterCidr: "" + serviceCidr: "" + globalCidr: "" + natEnabled: false + colorCodes: blue + debug: false + serviceDiscovery: true + images: + repository: quay.io/submariner + tag: "0.7.0" +broker: + server: example.k8s.apiserver + token: test + namespace: xyz + insecure: false + ca: "" +rbac: + create: true +ipsec: + psk: "" + debug: false + ikePort: 500 + natPort: 4500 +leadership: + leaseDuration: 10 + renewDeadline: 5 + retryPeriod: 2 +operator: + image: + repository: quay.io/submariner/submariner-operator + tag: "0.7.0" + pullPolicy: IfNotPresent + resources: {} + tolerations: [] + affinity: {} +engine: + image: + repository: quay.io/submariner/submariner + tag: "0.7.0" +serviceAccounts: + operator: + create: true + name: "" + engine: + create: true + name: "" + routeAgent: + create: true + name: "" + globalnet: + create: true + name: "" + lighthouse: + create: false + name: ""