mirror of
https://github.com/submariner-io/submariner-charts.git
synced 2026-09-20 22:40:34 +00:00
Compare commits
20
Commits
v0.8.0-rc1
...
v0.9.0-m1
@@ -1,8 +1,2 @@
|
||||
---
|
||||
name: Broken link detected by CI
|
||||
labels: bug
|
||||
---
|
||||
|
||||
<!-- Used by automation to raise an Issue when the periodic link aliveness tests detect a broken link. -->
|
||||
|
||||
Periodic link aliveness CI detected a broken link. Please see the job results for details.
|
||||
Periodic link aliveness CI detected a broken link. Please see the [periodic job
|
||||
results](https://github.com/submariner-io/submariner-charts/actions?query=workflow%3APeriodic) for details.
|
||||
|
||||
@@ -11,24 +11,17 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
globalnet: ['', 'globalnet']
|
||||
steps:
|
||||
- name: Check out the repository
|
||||
uses: actions/checkout@v2
|
||||
|
||||
- name: Reclaim free space
|
||||
run: |
|
||||
sudo swapoff -a
|
||||
sudo rm -f /swapfile
|
||||
df -h
|
||||
free -h
|
||||
|
||||
- name: Run E2E deployment and tests
|
||||
run: |
|
||||
make e2e
|
||||
uses: submariner-io/shipyard/gh-actions/e2e@devel
|
||||
with:
|
||||
globalnet: ${{ matrix.globalnet }}
|
||||
|
||||
- name: Post mortem
|
||||
if: failure()
|
||||
run: |
|
||||
df -h
|
||||
free -h
|
||||
make post-mortem
|
||||
uses: submariner-io/shipyard/gh-actions/post-mortem@devel
|
||||
|
||||
@@ -19,6 +19,17 @@ jobs:
|
||||
with:
|
||||
commits: ${{ steps.get-pr-commits.outputs.commits }}
|
||||
|
||||
gitlint:
|
||||
name: Commit Message(s)
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Check out the repository
|
||||
uses: actions/checkout@v2
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- name: Run gitlint
|
||||
run: make gitlint
|
||||
|
||||
markdown-link-check:
|
||||
name: Markdown Links (modified files)
|
||||
runs-on: ubuntu-latest
|
||||
@@ -31,6 +42,7 @@ jobs:
|
||||
with:
|
||||
config-file: ".markdownlinkcheck.json"
|
||||
check-modified-files-only: "yes"
|
||||
base-branch: ${{ github.base_ref }}
|
||||
|
||||
markdownlint:
|
||||
name: Markdown
|
||||
@@ -39,10 +51,7 @@ jobs:
|
||||
- name: Check out the repository
|
||||
uses: actions/checkout@v2
|
||||
- name: Run markdownlint
|
||||
uses: nosborn/github-action-markdown-cli@v1.1.1
|
||||
with:
|
||||
files: .
|
||||
config_file: ".markdownlint.yml"
|
||||
run: make markdownlint
|
||||
|
||||
yaml-lint:
|
||||
name: YAML
|
||||
|
||||
@@ -20,8 +20,8 @@ jobs:
|
||||
|
||||
- name: Raise an Issue to report broken links
|
||||
if: ${{ failure() }}
|
||||
uses: JasonEtco/create-an-issue@v2
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
uses: peter-evans/create-issue-from-file@v2.3.2
|
||||
with:
|
||||
filename: .github/ISSUE_TEMPLATE/broken-link.md
|
||||
title: Broken link detected by CI
|
||||
content-filepath: .github/ISSUE_TEMPLATE/broken-link.md
|
||||
labels: automated, broken link
|
||||
|
||||
@@ -4,7 +4,7 @@ name: Release Charts
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
- devel
|
||||
|
||||
jobs:
|
||||
release:
|
||||
|
||||
+3
-1
@@ -1,2 +1,4 @@
|
||||
.dapper
|
||||
.idea
|
||||
*.tgz
|
||||
.shflags
|
||||
*.tgz
|
||||
|
||||
@@ -0,0 +1,9 @@
|
||||
[general]
|
||||
# body-is-missing: Allow commit messages with only a title
|
||||
# body-min-length: Allow short body lines, like "Relates-to: #issue"
|
||||
ignore=body-is-missing,body-min-length
|
||||
|
||||
[ignore-by-body]
|
||||
# Dependabot doesn't follow our conventions, unfortunately
|
||||
regex=^Signed-off-by: dependabot\[bot\](.*)
|
||||
ignore=all
|
||||
+1
-1
@@ -1,3 +1,3 @@
|
||||
# Code of Conduct
|
||||
|
||||
Please see the [Code of Conduct docs on Submariner's website](https://submariner.io/contributing/code-of-conduct/).
|
||||
Please see the [Code of Conduct docs on Submariner's website](https://submariner.io/community/code-of-conduct/).
|
||||
|
||||
+1
-1
@@ -1,3 +1,3 @@
|
||||
# Contributing
|
||||
|
||||
Please see the [Contributing docs on Submariner's website](https://submariner.io/for_developers/).
|
||||
Please see the [Development docs on Submariner's website](https://submariner.io/development/).
|
||||
|
||||
@@ -22,9 +22,8 @@ e2e: E2E_ARGS=cluster1 cluster2
|
||||
preload-images:
|
||||
source $(SCRIPTS_DIR)/lib/debug_functions; \
|
||||
source $(SCRIPTS_DIR)/lib/deploy_funcs; \
|
||||
source $(SCRIPTS_DIR)/lib/version; \
|
||||
set -e; \
|
||||
for image in submariner submariner-route-agent submariner-operator lighthouse-agent submariner-globalnet lighthouse-coredns; do \
|
||||
for image in submariner-gateway submariner-route-agent submariner-operator lighthouse-agent submariner-globalnet lighthouse-coredns; do \
|
||||
import_image quay.io/submariner/$${image}; \
|
||||
done
|
||||
|
||||
|
||||
@@ -105,7 +105,7 @@ spec:
|
||||
type: string
|
||||
colorCodes:
|
||||
type: string
|
||||
engineDaemonSetStatus:
|
||||
gatewayDaemonSetStatus:
|
||||
properties:
|
||||
lastResourceVersion:
|
||||
type: string
|
||||
@@ -720,3 +720,158 @@ status:
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.3.0
|
||||
creationTimestamp: null
|
||||
name: servicediscoveries.submariner.io
|
||||
spec:
|
||||
group: submariner.io
|
||||
names:
|
||||
kind: ServiceDiscovery
|
||||
listKind: ServiceDiscoveryList
|
||||
plural: servicediscoveries
|
||||
singular: servicediscovery
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: ServiceDiscovery is the Schema for the servicediscoveries API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ServiceDiscoverySpec defines the desired state of ServiceDiscovery
|
||||
properties:
|
||||
brokerK8sApiServer:
|
||||
type: string
|
||||
brokerK8sApiServerToken:
|
||||
type: string
|
||||
brokerK8sCA:
|
||||
type: string
|
||||
brokerK8sRemoteNamespace:
|
||||
type: string
|
||||
clusterID:
|
||||
type: string
|
||||
customDomains:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: set
|
||||
debug:
|
||||
type: boolean
|
||||
globalnetEnabled:
|
||||
type: boolean
|
||||
imageOverrides:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
namespace:
|
||||
type: string
|
||||
repository:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- brokerK8sApiServer
|
||||
- brokerK8sApiServerToken
|
||||
- brokerK8sCA
|
||||
- brokerK8sRemoteNamespace
|
||||
- clusterID
|
||||
- debug
|
||||
- namespace
|
||||
type: object
|
||||
status:
|
||||
description: ServiceDiscoveryStatus defines the observed state of ServiceDiscovery
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.3.0
|
||||
creationTimestamp: null
|
||||
name: brokers.submariner.io
|
||||
spec:
|
||||
group: submariner.io
|
||||
names:
|
||||
kind: Broker
|
||||
listKind: BrokerList
|
||||
plural: brokers
|
||||
singular: broker
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: Broker is the Schema for the brokers API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: BrokerSpec defines the desired state of Broker
|
||||
properties:
|
||||
components:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
defaultCustomDomains:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
defaultGlobalnetClusterSize:
|
||||
type: integer
|
||||
globalnetCIDRRange:
|
||||
type: string
|
||||
globalnetEnabled:
|
||||
type: boolean
|
||||
type: object
|
||||
status:
|
||||
description: BrokerStatus defines the observed state of Broker
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
@@ -92,6 +92,13 @@ questions:
|
||||
label: "Service CIDR"
|
||||
group: "CIDR Configuration"
|
||||
required: true
|
||||
- variable: submariner.globalCidr
|
||||
default: ""
|
||||
description: "Enter the globalnet CIDR (i.e. 169.254.1.0/24) for this cluster if using globalnet"
|
||||
type: string
|
||||
label: "Globalnet CIDR"
|
||||
group: "CIDR Configuration"
|
||||
required: false
|
||||
- variable: submariner.natEnabled
|
||||
type: boolean
|
||||
default: false
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
Submariner is now installed.
|
||||
|
||||
{{- if .Values.engine.nodeSelectorEnabled }}
|
||||
{{- if .Values.gateway.nodeSelectorEnabled }}
|
||||
If you haven't done so yet, please label a node as `submariner.io/gateway=true` to elect it for running Submariner.
|
||||
{{- end }}
|
||||
|
||||
|
||||
@@ -43,13 +43,13 @@ Create the name of the submariner-operator service account to use
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the submariner-engine service account to use
|
||||
Create the name of the submariner-gateway service account to use
|
||||
*/}}
|
||||
{{- define "submariner.engineServiceAccountName" -}}
|
||||
{{- if .Values.serviceAccounts.engine.create -}}
|
||||
{{ default (printf "%s-engine" (include "submariner.fullname" .)) .Values.serviceAccounts.engine.name }}
|
||||
{{- define "submariner.gatewayServiceAccountName" -}}
|
||||
{{- if .Values.serviceAccounts.gateway.create -}}
|
||||
{{ default "submariner-gateway" .Values.serviceAccounts.gateway.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccounts.engine.name }}
|
||||
{{ default "default" .Values.serviceAccounts.gateway.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -58,7 +58,7 @@ Create the name of the submariner-route-agent service account to use
|
||||
*/}}
|
||||
{{- define "submariner.routeAgentServiceAccountName" -}}
|
||||
{{- if .Values.serviceAccounts.routeAgent.create -}}
|
||||
{{ default (printf "%s-routeagent" (include "submariner.fullname" .)) .Values.serviceAccounts.routeAgent.name }}
|
||||
{{ default "submariner-routeagent" .Values.serviceAccounts.routeAgent.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccounts.routeAgent.name }}
|
||||
{{- end -}}
|
||||
@@ -69,20 +69,31 @@ Create the name of the submariner-globalnet service account to use
|
||||
*/}}
|
||||
{{- define "submariner.globalnetServiceAccountName" -}}
|
||||
{{- if .Values.serviceAccounts.globalnet.create -}}
|
||||
{{ default (printf "%s-globalnet" (include "submariner.fullname" .)) .Values.serviceAccounts.globalnet.name }}
|
||||
{{ default "submariner-globalnet" .Values.serviceAccounts.globalnet.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccounts.globalnet.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the submariner-lighthouse service account to use
|
||||
Create the name of the submariner-lighthouse-agent service account to use
|
||||
*/}}
|
||||
{{- define "submariner.lighthouseServiceAccountName" -}}
|
||||
{{- if .Values.submariner.serviceDiscovery -}}
|
||||
{{ default (printf "%s-lighthouse" (include "submariner.fullname" .)) .Values.serviceAccounts.lighthouse.name }}
|
||||
{{- define "submariner.lighthouseAgentServiceAccountName" -}}
|
||||
{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseAgent.create) -}}
|
||||
{{ default "submariner-lighthouse-agent" .Values.serviceAccounts.lighthouseAgent.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccounts.lighthouse.name }}
|
||||
{{ default "default" .Values.serviceAccounts.lighthouseAgent.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the submariner-lighthouse-coredns service account to use
|
||||
*/}}
|
||||
{{- define "submariner.lighthouseCoreDnsServiceAccountName" -}}
|
||||
{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseCoreDns.create) -}}
|
||||
{{ default "submariner-lighthouse-coredns" .Values.serviceAccounts.lighthouseCoreDns.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccounts.lighthouseCoreDns.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@ metadata:
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.fullname" . }}
|
||||
component: engine
|
||||
component: gateway
|
||||
name: {{ template "submariner.fullname" . }}
|
||||
spec:
|
||||
progressDeadlineSeconds: 600
|
||||
|
||||
@@ -77,7 +77,7 @@ metadata:
|
||||
app: {{ template "submariner.name" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.fullname" . }}
|
||||
name: {{ template "submariner.operatorServiceAccountName" . }}
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: {{ template "submariner.fullname" . }}
|
||||
@@ -86,27 +86,87 @@ roleRef:
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:engine
|
||||
name: {{ template "submariner.fullname" . }}:gateway
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["create", "get", "list", "watch", "patch", "update"]
|
||||
- apiGroups: ["submariner.io"]
|
||||
resources: ["clusters", "endpoints", "gateways"]
|
||||
verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
- services/finalizers
|
||||
- endpoints
|
||||
- persistentvolumeclaims
|
||||
- events
|
||||
- configmaps
|
||||
- secrets
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
- daemonsets
|
||||
- replicasets
|
||||
- statefulsets
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- monitoring.coreos.com
|
||||
resources:
|
||||
- servicemonitors
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
- apiGroups:
|
||||
- apps
|
||||
resourceNames:
|
||||
- submariner-operator
|
||||
resources:
|
||||
- deployments/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- replicasets
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- submariner.io
|
||||
resources:
|
||||
- '*'
|
||||
- servicediscoveries
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- lighthouse.submariner.io
|
||||
resources:
|
||||
- '*'
|
||||
- serviceexports
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:engine
|
||||
name: {{ template "submariner.fullname" . }}:gateway
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
@@ -115,10 +175,10 @@ metadata:
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "submariner.fullname" . }}:engine
|
||||
name: {{ template "submariner.fullname" . }}:gateway
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.operatorServiceAccountName" . }}
|
||||
name: {{ template "submariner.gatewayServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
@@ -131,12 +191,75 @@ metadata:
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups: ["submariner.io"]
|
||||
resources: ["clusters", "endpoints", "gateways"]
|
||||
verbs: ["create", "get", "list", "watch", "patch", "update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
- services/finalizers
|
||||
- endpoints
|
||||
- persistentvolumeclaims
|
||||
- events
|
||||
- configmaps
|
||||
- secrets
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
- daemonsets
|
||||
- replicasets
|
||||
- statefulsets
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- monitoring.coreos.com
|
||||
resources:
|
||||
- servicemonitors
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
- apiGroups:
|
||||
- apps
|
||||
resourceNames:
|
||||
- submariner-operator
|
||||
resources:
|
||||
- deployments/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- replicasets
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- submariner.io
|
||||
resources:
|
||||
- '*'
|
||||
- servicediscoveries
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- lighthouse.submariner.io
|
||||
resources:
|
||||
- '*'
|
||||
- serviceexports
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
@@ -153,9 +276,109 @@ roleRef:
|
||||
name: {{ template "submariner.fullname" . }}:routeagent
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.operatorServiceAccountName" . }}
|
||||
name: {{ template "submariner.routeAgentServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
{{- if ne .Values.submariner.globalCidr "" }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:globalnet
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
- services/finalizers
|
||||
- endpoints
|
||||
- persistentvolumeclaims
|
||||
- events
|
||||
- configmaps
|
||||
- secrets
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
- daemonsets
|
||||
- replicasets
|
||||
- statefulsets
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- monitoring.coreos.com
|
||||
resources:
|
||||
- servicemonitors
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
- apiGroups:
|
||||
- apps
|
||||
resourceNames:
|
||||
- submariner-operator
|
||||
resources:
|
||||
- deployments/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- replicasets
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- submariner.io
|
||||
resources:
|
||||
- '*'
|
||||
- servicediscoveries
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- lighthouse.submariner.io
|
||||
resources:
|
||||
- '*'
|
||||
- serviceexports
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:globalnet
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "submariner.fullname" . }}:globalnet
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.globalnetServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
{{- end -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
@@ -169,24 +392,50 @@ rules:
|
||||
# submariner-operator updates the config map of core-dns to forward requests to
|
||||
# clusterset.local to Lighthouse DNS, also looks at existing configmaps
|
||||
# to figure out network settings
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
- apiGroups: ["apiextensions.k8s.io"]
|
||||
resources: ["customresourcedefinitions"]
|
||||
verbs: ["get", "list", "create", "update", "delete"]
|
||||
- apiGroups: [""] # pods and services are looked up to figure out network settings
|
||||
resources: ["pods", "services"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["operator.openshift.io"]
|
||||
resources: ["dnses"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
- apiGroups: ["config.openshift.io"]
|
||||
resources: ["networks"]
|
||||
verbs: ["get", "list"]
|
||||
- apiGroups: ["multicluster.x-k8s.io"]
|
||||
resources: ["*"]
|
||||
verbs: ["create", "get", "list", "watch", "update", "delete"]
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- create
|
||||
- update
|
||||
- delete
|
||||
- apiGroups: # pods and services are looked up to figure out network settings
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- operator.openshift.io
|
||||
resources:
|
||||
- dnses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- config.openshift.io
|
||||
resources:
|
||||
- networks
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
@@ -208,6 +457,91 @@ roleRef:
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:gateway
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- create
|
||||
- update
|
||||
- delete
|
||||
- apiGroups: # pods and services are looked up to figure out network settings
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- operator.openshift.io
|
||||
resources:
|
||||
- dnses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- config.openshift.io
|
||||
resources:
|
||||
- networks
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- apiGroups:
|
||||
- submariner.io
|
||||
resources:
|
||||
- endpoints
|
||||
- gateways
|
||||
- clusters
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:gateway
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "submariner.fullname" . }}:gateway
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.gatewayServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:routeagent
|
||||
labels:
|
||||
@@ -216,9 +550,59 @@ metadata:
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get", "update"]
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- create
|
||||
- update
|
||||
- delete
|
||||
- apiGroups: # pods and services are looked up to figure out network settings
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- operator.openshift.io
|
||||
resources:
|
||||
- dnses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- config.openshift.io
|
||||
resources:
|
||||
- networks
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- apiGroups:
|
||||
- ""
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
resources:
|
||||
- nodes
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
@@ -235,9 +619,10 @@ roleRef:
|
||||
name: {{ template "submariner.fullname" . }}:routeagent
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.operatorServiceAccountName" . }}
|
||||
name: {{ template "submariner.routeAgentServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
{{- if ne .Values.submariner.globalCidr "" }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
@@ -248,13 +633,37 @@ metadata:
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["services", "namespaces", "pods", "nodes"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
- apiGroups: ["submariner.io"]
|
||||
resources: ["clusters", "endpoints", "gateways"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
- namespaces
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- submariner.io
|
||||
resources:
|
||||
- endpoints
|
||||
- clusters
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- multicluster.x-k8s.io
|
||||
resources:
|
||||
- "serviceexports"
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
{{- end -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
@@ -270,37 +679,67 @@ roleRef:
|
||||
name: {{ template "submariner.fullname" . }}:globalnet
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.operatorServiceAccountName" . }}
|
||||
name: {{ template "submariner.globalnetServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
{{- if .Values.submariner.serviceDiscovery }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse-agent
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["services", "namespaces", "configmaps", "endpoints"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources: ["endpointslices"]
|
||||
verbs: ["create", "get", "list", "watch", "update", "delete"]
|
||||
- apiGroups: ["lighthouse.submariner.io"]
|
||||
resources: ["*"]
|
||||
verbs: ["create", "get", "list", "watch", "update", "delete"]
|
||||
- apiGroups: ["submariner.io"]
|
||||
resources: ["gateways"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
- namespaces
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- delete
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- submariner.io
|
||||
resources:
|
||||
- "gateways"
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- multicluster.x-k8s.io
|
||||
resources:
|
||||
- "*"
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- delete
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse-agent
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
@@ -309,10 +748,82 @@ metadata:
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse-agent
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.operatorServiceAccountName" . }}
|
||||
name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse-coredns
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
- namespaces
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- delete
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- lighthouse.submariner.io
|
||||
resources:
|
||||
- "*"
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- delete
|
||||
- apiGroups:
|
||||
- submariner.io
|
||||
resources:
|
||||
- "gateways"
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- multicluster.x-k8s.io
|
||||
resources:
|
||||
- "*"
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- delete
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse-coredns
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse-coredns
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -22,3 +22,5 @@ spec:
|
||||
repository: {{ .Values.submariner.images.repository }}
|
||||
version: {{ .Values.submariner.images.tag }}
|
||||
serviceCIDR: "{{ .Values.submariner.serviceCidr }}"
|
||||
globalCIDR: "{{ .Values.submariner.globalCidr }}"
|
||||
serviceDiscoveryEnabled: {{ .Values.submariner.serviceDiscovery }}
|
||||
|
||||
@@ -10,11 +10,11 @@ metadata:
|
||||
app: {{ template "submariner.name" . }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if .Values.serviceAccounts.engine.create }}
|
||||
{{- if .Values.serviceAccounts.gateway.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "submariner.engineServiceAccountName" . }}
|
||||
name: {{ template "submariner.gatewayServiceAccountName" . }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
@@ -46,14 +46,26 @@ metadata:
|
||||
app: {{ template "submariner.name" . }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if .Values.serviceAccounts.lighthouse.create }}
|
||||
{{- if .Values.serviceAccounts.lighthouseAgent.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "submariner.lighthouseServiceAccountName" . }}
|
||||
name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if .Values.serviceAccounts.lighthouseCoreDns.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
{{- end }}
|
||||
|
||||
@@ -37,15 +37,15 @@ operator:
|
||||
resources: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
engine:
|
||||
gateway:
|
||||
image:
|
||||
repository: quay.io/submariner/submariner
|
||||
repository: quay.io/submariner/submariner-gateway
|
||||
tag: "0.7.0"
|
||||
serviceAccounts:
|
||||
operator:
|
||||
create: true
|
||||
name: ""
|
||||
engine:
|
||||
gateway:
|
||||
create: true
|
||||
name: ""
|
||||
routeAgent:
|
||||
@@ -54,6 +54,9 @@ serviceAccounts:
|
||||
globalnet:
|
||||
create: true
|
||||
name: ""
|
||||
lighthouse:
|
||||
create: false
|
||||
lighthouseAgent:
|
||||
create: true
|
||||
name: ""
|
||||
lighthouseCoreDns:
|
||||
create: true
|
||||
name: ""
|
||||
|
||||
+11
-11
@@ -1,22 +1,22 @@
|
||||
questions:
|
||||
- variable: defaultEngineImage
|
||||
- variable: defaultGatewayImage
|
||||
default: true
|
||||
description: "Use default Submariner Engine image or specify a custom one"
|
||||
label: Use default submariner engine image
|
||||
description: "Use default Submariner Gateway image or specify a custom one"
|
||||
label: Use default submariner gateway image
|
||||
type: boolean
|
||||
show_subquestion_if: false
|
||||
group: "Container Images"
|
||||
subquestions:
|
||||
- variable: engine.image.repository
|
||||
default: "quay.io/submariner/submariner"
|
||||
description: "Submariner Engine Image Repository"
|
||||
- variable: gateway.image.repository
|
||||
default: "quay.io/submariner/submariner-gateway"
|
||||
description: "Submariner Gateway Image Repository"
|
||||
type: string
|
||||
label: Submariner Engine Image Repository
|
||||
- variable: engine.image.tag
|
||||
label: Submariner Gateway Image Repository
|
||||
- variable: gateway.image.tag
|
||||
default: "0.6.0"
|
||||
description: "Submariner Engine Image Tag"
|
||||
description: "Submariner Gateway Image Tag"
|
||||
type: string
|
||||
label: Submariner Engine Image Tag
|
||||
label: Submariner Gateway Image Tag
|
||||
- variable: defaultRouteAgentImage
|
||||
default: true
|
||||
description: "Use default Submariner Route Agent image or specify a custom one"
|
||||
@@ -35,7 +35,7 @@ questions:
|
||||
description: "Submariner Route Agent Image Tag"
|
||||
type: string
|
||||
label: Submariner Route Agent Image Tag
|
||||
- variable: engine.nodeSelectorEnabled
|
||||
- variable: gateway.nodeSelectorEnabled
|
||||
default: true
|
||||
description: "Restrict submariner to nodes labeled with submariner.io/gateway=true"
|
||||
label: Restrict gateway deployments to specific nodes
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
Submariner is now installed.
|
||||
|
||||
{{- if .Values.engine.nodeSelectorEnabled }}
|
||||
{{- if .Values.gateway.nodeSelectorEnabled }}
|
||||
If you haven't done so yet, please label a node as `submariner.io/gateway=true` to elect it for running Submariner.
|
||||
{{- end }}
|
||||
|
||||
|
||||
@@ -32,13 +32,13 @@ Create chart name and version as used by the chart label.
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the submariner-engine service account to use
|
||||
Create the name of the submariner-gateway service account to use
|
||||
*/}}
|
||||
{{- define "submariner.engineServiceAccountName" -}}
|
||||
{{- if .Values.serviceAccounts.engine.create -}}
|
||||
{{ default (printf "%s-engine" (include "submariner.fullname" .)) .Values.serviceAccounts.engine.name }}
|
||||
{{- define "submariner.gatewayServiceAccountName" -}}
|
||||
{{- if .Values.serviceAccounts.gateway.create -}}
|
||||
{{ default "submariner-gateway" .Values.serviceAccounts.gateway.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccounts.engine.name }}
|
||||
{{ default "default" .Values.serviceAccounts.gateway.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -47,7 +47,7 @@ Create the name of the submariner-route-agent service account to use
|
||||
*/}}
|
||||
{{- define "submariner.routeAgentServiceAccountName" -}}
|
||||
{{- if .Values.serviceAccounts.routeAgent.create -}}
|
||||
{{ default (printf "%s-routeagent" (include "submariner.fullname" .)) .Values.serviceAccounts.routeAgent.name }}
|
||||
{{ default "submariner-routeagent" .Values.serviceAccounts.routeAgent.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccounts.routeAgent.name }}
|
||||
{{- end -}}
|
||||
@@ -58,20 +58,31 @@ Create the name of the submariner-globalnet service account to use
|
||||
*/}}
|
||||
{{- define "submariner.globalnetServiceAccountName" -}}
|
||||
{{- if .Values.serviceAccounts.globalnet.create -}}
|
||||
{{ default (printf "%s-globalnet" (include "submariner.fullname" .)) .Values.serviceAccounts.globalnet.name }}
|
||||
{{ default "submariner-globalnet" .Values.serviceAccounts.globalnet.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccounts.globalnet.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the submariner-lighthouse service account to use
|
||||
Create the name of the submariner-lighthouse-agent service account to use
|
||||
*/}}
|
||||
{{- define "submariner.lighthouseServiceAccountName" -}}
|
||||
{{- if .Values.submariner.serviceDiscovery -}}
|
||||
{{ default (printf "%s-lighthouse" (include "submariner.fullname" .)) .Values.serviceAccounts.lighthouse.name }}
|
||||
{{- define "submariner.lighthouseAgentServiceAccountName" -}}
|
||||
{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseAgent.create) -}}
|
||||
{{ default "submariner-lighthouse-agent" .Values.serviceAccounts.lighthouseAgent.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccounts.lighthouse.name }}
|
||||
{{ default "default" .Values.serviceAccounts.lighthouseAgent.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the submariner-lighthouse-coredns service account to use
|
||||
*/}}
|
||||
{{- define "submariner.lighthouseCoreDnsServiceAccountName" -}}
|
||||
{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseCoreDns.create) -}}
|
||||
{{ default "submariner-lighthouse-coredns" .Values.serviceAccounts.lighthouseCoreDns.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccounts.lighthouseCoreDns.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
@@ -5,14 +5,14 @@ metadata:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.fullname" . }}-engine
|
||||
component: engine
|
||||
app: {{ template "submariner.fullname" . }}-gateway
|
||||
component: gateway
|
||||
name: {{ template "submariner.fullname" . }}-gateway
|
||||
spec:
|
||||
revisionHistoryLimit: 5
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "submariner.fullname" . }}-engine
|
||||
app: {{ template "submariner.fullname" . }}-gateway
|
||||
updateStrategy:
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
@@ -21,7 +21,7 @@ spec:
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
labels:
|
||||
app: {{ template "submariner.fullname" . }}-engine
|
||||
app: {{ template "submariner.fullname" . }}-gateway
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
@@ -31,19 +31,19 @@ spec:
|
||||
- key: app
|
||||
operator: In
|
||||
values:
|
||||
- {{ template "submariner.fullname" . }}-engine
|
||||
- {{ template "submariner.fullname" . }}-gateway
|
||||
topologyKey: "kubernetes.io/hostname"
|
||||
{{- with .Values.engine.affinity }}
|
||||
{{- with .Values.gateway.affinity }}
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
nodeSelector:
|
||||
{{- if .Values.engine.nodeSelectorEnabled }}
|
||||
{{- if .Values.gateway.nodeSelectorEnabled }}
|
||||
submariner.io/gateway: "true"
|
||||
{{- end }}
|
||||
{{- with .Values.engine.nodeSelector }}
|
||||
{{- with .Values.gateway.nodeSelector }}
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.engine.tolerations }}
|
||||
{{- with .Values.gateway.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
@@ -108,11 +108,15 @@ spec:
|
||||
value: "{{ .Values.leadership.renewDeadline }}"
|
||||
- name: LEADERSHIP_RETRYPERIOD
|
||||
value: "{{ .Values.leadership.retryPeriod }}"
|
||||
image: {{ .Values.engine.image.repository }}:{{ default .Chart.AppVersion .Values.engine.image.tag }}
|
||||
imagePullPolicy: {{ .Values.engine.image.pullPolicy }}
|
||||
- name: NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: "spec.nodeName"
|
||||
image: {{ .Values.gateway.image.repository }}:{{ default .Chart.AppVersion .Values.gateway.image.tag }}
|
||||
imagePullPolicy: {{ .Values.gateway.image.pullPolicy }}
|
||||
name: submariner
|
||||
resources:
|
||||
{{ toYaml .Values.engine.resources | indent 10 }}
|
||||
{{ toYaml .Values.gateway.resources | indent 10 }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: true
|
||||
capabilities:
|
||||
@@ -131,4 +135,4 @@ spec:
|
||||
schedulerName: default-scheduler
|
||||
securityContext: {}
|
||||
terminationGracePeriodSeconds: 1
|
||||
serviceAccountName: {{ template "submariner.engineServiceAccountName" . }}
|
||||
serviceAccountName: {{ template "submariner.gatewayServiceAccountName" . }}
|
||||
|
||||
@@ -29,29 +29,33 @@ spec:
|
||||
nodeSelector:
|
||||
submariner.io/gateway: 'true'
|
||||
containers:
|
||||
- name: {{ template "submariner.fullname" . }}-globalnet
|
||||
image: {{ .Values.globalnet.image.repository }}:{{ default .Chart.AppVersion .Values.globalnet.image.tag }}
|
||||
imagePullPolicy: {{ .Values.globalnet.image.pullPolicy }}
|
||||
env:
|
||||
- name: SUBMARINER_CLUSTERID
|
||||
value: '{{ .Values.submariner.clusterId }}'
|
||||
- name: SUBMARINER_EXCLUDENS
|
||||
value: 'submariner-operator,kube-system,operators,openshift-monitoring,openshift-dns'
|
||||
- name: SUBMARINER_NAMESPACE
|
||||
value: '{{ .Release.Namespace }}'
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: true
|
||||
capabilities:
|
||||
add:
|
||||
- ALL
|
||||
privileged: true
|
||||
readOnlyRootFilesystem: false
|
||||
runAsNonRoot: false
|
||||
volumeMounts:
|
||||
# Because we don't actually run iptables locally, but chroot in to the host
|
||||
- mountPath: /host
|
||||
name: host-slash
|
||||
readOnly: true
|
||||
- name: {{ template "submariner.fullname" . }}-globalnet
|
||||
image: {{ .Values.globalnet.image.repository }}:{{ default .Chart.AppVersion .Values.globalnet.image.tag }}
|
||||
imagePullPolicy: {{ .Values.globalnet.image.pullPolicy }}
|
||||
env:
|
||||
- name: SUBMARINER_CLUSTERID
|
||||
value: '{{ .Values.submariner.clusterId }}'
|
||||
- name: SUBMARINER_EXCLUDENS
|
||||
value: 'submariner-operator,kube-system,operators,openshift-monitoring,openshift-dns'
|
||||
- name: SUBMARINER_NAMESPACE
|
||||
value: '{{ .Release.Namespace }}'
|
||||
- name: NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: "spec.nodeName"
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: true
|
||||
capabilities:
|
||||
add:
|
||||
- ALL
|
||||
privileged: true
|
||||
readOnlyRootFilesystem: false
|
||||
runAsNonRoot: false
|
||||
volumeMounts:
|
||||
# Because we don't actually run iptables locally, but chroot in to the host
|
||||
- mountPath: /host
|
||||
name: host-slash
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: host-slash
|
||||
hostPath:
|
||||
|
||||
@@ -30,7 +30,7 @@ spec:
|
||||
- mountPath: /etc/coredns
|
||||
name: config-volume
|
||||
readOnly: true
|
||||
serviceAccountName: {{ template "submariner.lighthouseServiceAccountName" . }}
|
||||
serviceAccountName: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
|
||||
volumes:
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
|
||||
@@ -19,7 +19,7 @@ spec:
|
||||
labels:
|
||||
app: {{ template "submariner.fullname" . }}-lighthouse-agent
|
||||
spec:
|
||||
serviceAccountName: {{ template "submariner.lighthouseServiceAccountName" . }}
|
||||
serviceAccountName: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
|
||||
containers:
|
||||
- command:
|
||||
- lighthouse-agent.sh
|
||||
|
||||
+585
-64
@@ -2,22 +2,100 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:engine
|
||||
name: {{ template "submariner.fullname" . }}:gateway
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["create", "get", "list", "watch", "patch", "update"]
|
||||
- apiGroups: ["submariner.io"]
|
||||
resources: ["clusters", "endpoints", "gateways"]
|
||||
verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
- services/finalizers
|
||||
- endpoints
|
||||
- persistentvolumeclaims
|
||||
- events
|
||||
- configmaps
|
||||
- secrets
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
- daemonsets
|
||||
- replicasets
|
||||
- statefulsets
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- monitoring.coreos.com
|
||||
resources:
|
||||
- servicemonitors
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
- apiGroups:
|
||||
- apps
|
||||
resourceNames:
|
||||
- submariner-operator
|
||||
resources:
|
||||
- deployments/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- replicasets
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- submariner.io
|
||||
resources:
|
||||
- '*'
|
||||
- servicediscoveries
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- lighthouse.submariner.io
|
||||
resources:
|
||||
- '*'
|
||||
- serviceexports
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:gateway
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "submariner.fullname" . }}:gateway
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.gatewayServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
@@ -29,52 +107,353 @@ metadata:
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups: ["submariner.io"]
|
||||
resources: ["clusters", "endpoints", "gateways"]
|
||||
verbs: ["create", "get", "list", "watch", "patch", "update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:engine
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "submariner.fullname" . }}:engine
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.engineServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
- services/finalizers
|
||||
- endpoints
|
||||
- persistentvolumeclaims
|
||||
- events
|
||||
- configmaps
|
||||
- secrets
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
- daemonsets
|
||||
- replicasets
|
||||
- statefulsets
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- monitoring.coreos.com
|
||||
resources:
|
||||
- servicemonitors
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
- apiGroups:
|
||||
- apps
|
||||
resourceNames:
|
||||
- submariner-operator
|
||||
resources:
|
||||
- deployments/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- replicasets
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- submariner.io
|
||||
resources:
|
||||
- '*'
|
||||
- servicediscoveries
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- lighthouse.submariner.io
|
||||
resources:
|
||||
- '*'
|
||||
- serviceexports
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:routeagent
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "submariner.fullname" . }}:routeagent
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.routeAgentServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.routeAgentServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
{{- if ne .Values.submariner.globalCidr "" }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:globalnet
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
- services/finalizers
|
||||
- endpoints
|
||||
- persistentvolumeclaims
|
||||
- events
|
||||
- configmaps
|
||||
- secrets
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
- daemonsets
|
||||
- replicasets
|
||||
- statefulsets
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- monitoring.coreos.com
|
||||
resources:
|
||||
- servicemonitors
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
- apiGroups:
|
||||
- apps
|
||||
resourceNames:
|
||||
- submariner-operator
|
||||
resources:
|
||||
- deployments/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- replicasets
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- submariner.io
|
||||
resources:
|
||||
- '*'
|
||||
- servicediscoveries
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- lighthouse.submariner.io
|
||||
resources:
|
||||
- '*'
|
||||
- serviceexports
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:globalnet
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "submariner.fullname" . }}:globalnet
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.globalnetServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
{{- end -}}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:gateway
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- create
|
||||
- update
|
||||
- delete
|
||||
- apiGroups: # pods and services are looked up to figure out network settings
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- operator.openshift.io
|
||||
resources:
|
||||
- dnses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- config.openshift.io
|
||||
resources:
|
||||
- networks
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- apiGroups:
|
||||
- submariner.io
|
||||
resources:
|
||||
- endpoints
|
||||
- gateways
|
||||
- clusters
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:gateway
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "submariner.fullname" . }}:gateway
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.gatewayServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:routeagent
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- create
|
||||
- update
|
||||
- delete
|
||||
- apiGroups: # pods and services are looked up to figure out network settings
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- operator.openshift.io
|
||||
resources:
|
||||
- dnses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- config.openshift.io
|
||||
resources:
|
||||
- networks
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- apiGroups:
|
||||
- ""
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
resources:
|
||||
- nodes
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:routeagent
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
@@ -89,61 +468,203 @@ apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:globalnet
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["services", "namespaces", "pods", "nodes"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
- apiGroups: ["submariner.io"]
|
||||
resources: ["clusters", "endpoints", "gateways"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
- namespaces
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- submariner.io
|
||||
resources:
|
||||
- endpoints
|
||||
- clusters
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- multicluster.x-k8s.io
|
||||
resources:
|
||||
- "serviceexports"
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
{{- end -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:globalnet
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "submariner.fullname" . }}:globalnet
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.globalnetServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.globalnetServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
{{- end -}}
|
||||
{{- if .Values.submariner.serviceDiscovery }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse-agent
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["services", "namespaces", "configmaps", "endpoints"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources: ["endpointslices"]
|
||||
verbs: ["create", "get", "list", "watch", "update", "delete", "deletecollection"]
|
||||
- apiGroups: ["lighthouse.submariner.io"]
|
||||
resources: ["*"]
|
||||
verbs: ["create", "get", "list", "watch", "update", "delete"]
|
||||
- apiGroups: ["submariner.io"]
|
||||
resources: ["gateways"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["multicluster.x-k8s.io"]
|
||||
resources: ["*"]
|
||||
verbs: ["create", "get", "list", "watch", "update", "delete"]
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
- namespaces
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- delete
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- submariner.io
|
||||
resources:
|
||||
- "gateways"
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- multicluster.x-k8s.io
|
||||
resources:
|
||||
- "*"
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- delete
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse-agent
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse-agent
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.lighthouseServiceAccountName" . }}
|
||||
name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse-coredns
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
- namespaces
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- delete
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- lighthouse.submariner.io
|
||||
resources:
|
||||
- "*"
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- delete
|
||||
- apiGroups:
|
||||
- submariner.io
|
||||
resources:
|
||||
- "gateways"
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- multicluster.x-k8s.io
|
||||
resources:
|
||||
- "*"
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- delete
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse-coredns
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse-coredns
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
{{- if .Values.serviceAccounts.engine.create }}
|
||||
{{- if .Values.serviceAccounts.gateway.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "submariner.engineServiceAccountName" . }}
|
||||
name: {{ template "submariner.gatewayServiceAccountName" . }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
@@ -34,14 +34,26 @@ metadata:
|
||||
app: {{ template "submariner.name" . }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if .Values.serviceAccounts.lighthouse.create }}
|
||||
{{- if .Values.serviceAccounts.lighthouseAgent.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "submariner.lighthouseServiceAccountName" . }}
|
||||
name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if .Values.serviceAccounts.lighthouseCoreDns.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
{{- end }}
|
||||
|
||||
@@ -29,9 +29,9 @@ leadership:
|
||||
leaseDuration: 10
|
||||
renewDeadline: 5
|
||||
retryPeriod: 2
|
||||
engine:
|
||||
gateway:
|
||||
image:
|
||||
repository: quay.io/submariner/submariner
|
||||
repository: quay.io/submariner/submariner-gateway
|
||||
tag: ""
|
||||
pullPolicy: IfNotPresent
|
||||
resources: {}
|
||||
@@ -65,15 +65,18 @@ lighthouseCoredns:
|
||||
tag: ""
|
||||
pullPolicy: IfNotPresent
|
||||
serviceAccounts:
|
||||
engine:
|
||||
gateway:
|
||||
create: true
|
||||
name: ""
|
||||
routeAgent:
|
||||
create: true
|
||||
name: ""
|
||||
globalnet:
|
||||
create: false
|
||||
create: true
|
||||
name: ""
|
||||
lighthouse:
|
||||
create: false
|
||||
lighthouseAgent:
|
||||
create: true
|
||||
name: ""
|
||||
lighthouseCoreDns:
|
||||
create: true
|
||||
name: ""
|
||||
|
||||
Reference in New Issue
Block a user