github/charts
4
0
Fork 0
mirror of https://github.com/truenas/charts.git synced 2024-04-21 15:21:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

serviceaccoutn class, spawner, saname selector

Browse Source
This commit is contained in:
Stavros kois
2023-02-01 18:01:04 +02:00
parent 64a46e9e14
commit de784d0336
26 changed files with 468 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files
library/common-test/tests/pod/automount_sa_token_test.yaml
+75
View File
@@ -0,0 +1,75 @@
suite: pod auto mount sa token test
templates:
- common.yaml
tests:
- it: should pass with automountServiceAccountToken disabled from "global"
set:
podOptions:
automountServiceAccountToken: false
controllers:
controller-name1:
enabled: true
primary: true
type: Deployment
podSpec: {}
asserts:
- documentIndex: &deploymentDoc 0
isKind:
of: Deployment
- documentIndex: *deploymentDoc
equal:
path: spec.template.spec.automountServiceAccountToken
value: false
- it: should pass with automountServiceAccountToken enabled from "global"
set:
podOptions:
automountServiceAccountToken: true
controllers:
controller-name1:
enabled: true
primary: true
type: Deployment
podSpec: {}
asserts:
- documentIndex: *deploymentDoc
isKind:
of: Deployment
- documentIndex: *deploymentDoc
equal:
path: spec.template.spec.automountServiceAccountToken
value: true
- it: should pass with disabled automountServiceAccountToken from pod
set:
podOptions:
automountServiceAccountToken: true
controllers:
controller-name1:
enabled: true
primary: true
type: Deployment
podSpec:
automountServiceAccountToken: false
asserts:
- documentIndex: *deploymentDoc
equal:
path: spec.template.spec.automountServiceAccountToken
value: false
- it: should pass with enabled automountServiceAccountToken from pod
set:
podOptions:
automountServiceAccountToken: false
controllers:
controller-name1:
enabled: true
primary: true
type: Deployment
podSpec:
automountServiceAccountToken: true
asserts:
- documentIndex: *deploymentDoc
equal:
path: spec.template.spec.automountServiceAccountToken
value: true
library/common-test/tests/pod/image_pull_secret_test.yaml
+9 -9
View File
@@ -43,8 +43,8 @@ tests:
equal:
path: spec.jobTemplate.spec.template.spec.imagePullSecrets
value:
- release-name-common-test-pull-secret1
- release-name-common-test-pull-secret2
- name: release-name-common-test-pull-secret1
- name: release-name-common-test-pull-secret2
- documentIndex: &otherDeploymentDoc 3
isKind:
of: Deployment
@@ -90,8 +90,8 @@ tests:
equal:
path: spec.template.spec.imagePullSecrets
value:
- release-name-common-test-pull-secret1
- release-name-common-test-pull-secret2
- name: release-name-common-test-pull-secret1
- name: release-name-common-test-pull-secret2
- documentIndex: &otherDeploymentDoc 3
isKind:
of: Deployment
@@ -99,8 +99,8 @@ tests:
equal:
path: spec.template.spec.imagePullSecrets
value:
- release-name-common-test-pull-secret1
- release-name-common-test-pull-secret2
- name: release-name-common-test-pull-secret1
- name: release-name-common-test-pull-secret2
- it: should assign imagePullSecrets to selected pods
set:
@@ -143,8 +143,8 @@ tests:
equal:
path: spec.template.spec.imagePullSecrets
value:
- release-name-common-test-pull-secret1
- release-name-common-test-pull-secret2
- name: release-name-common-test-pull-secret1
- name: release-name-common-test-pull-secret2
- documentIndex: &otherDeploymentDoc 3
isKind:
of: Deployment
@@ -152,4 +152,4 @@ tests:
equal:
path: spec.template.spec.imagePullSecrets
value:
- release-name-common-test-pull-secret1
- name: release-name-common-test-pull-secret1
library/common-test/tests/pod/service_account_name_test.yaml
+130
View File
@@ -0,0 +1,130 @@
suite: pod service account name test
templates:
- common.yaml
tests:
- it: should assign serviceAccount to primary pod
set:
controllers:
controller-name1:
enabled: true
primary: true
type: CronJob
schedule: "* * * * *"
podSpec: {}
controller-name2:
enabled: true
primary: false
type: Deployment
podSpec: {}
serviceAccounts:
sa-name1:
enabled: true
asserts:
- documentIndex: &cronJobDoc 1
isKind:
of: CronJob
- documentIndex: *cronJobDoc
equal:
path: metadata.name
value: release-name-common-test
- documentIndex: *cronJobDoc
equal:
path: spec.jobTemplate.spec.template.spec.serviceAccountName
value: release-name-common-test-sa-name1
- documentIndex: &otherDeploymentDoc 2
isKind:
of: Deployment
- documentIndex: *otherDeploymentDoc
equal:
path: spec.template.spec.serviceAccountName
value: default
- it: should assign serviceAccount to all pods
set:
controllers:
controller-name1:
enabled: true
primary: true
type: Deployment
podSpec: {}
controller-name2:
enabled: true
primary: false
type: Deployment
podSpec: {}
serviceAccounts:
sa-name1:
enabled: true
targetSelectAll: true
asserts:
- documentIndex: &deploymentDoc 1
isKind:
of: Deployment
- documentIndex: *deploymentDoc
equal:
path: spec.template.spec.serviceAccountName
value: release-name-common-test-sa-name1
- documentIndex: &otherDeploymentDoc 2
isKind:
of: Deployment
- documentIndex: *otherDeploymentDoc
equal:
path: spec.template.spec.serviceAccountName
value: release-name-common-test-sa-name1
- it: should assign serviceAccount to selected pods
set:
controllers:
controller-name1:
enabled: true
primary: true
type: DaemonSet
podSpec: {}
controller-name2:
enabled: true
primary: false
type: Deployment
podSpec: {}
serviceAccounts:
sa-name1:
enabled: true
targetSelector:
- controller-name1
- controller-name2
asserts:
- documentIndex: &daemonSetDoc 1
isKind:
of: DaemonSet
- documentIndex: *daemonSetDoc
equal:
path: spec.template.spec.serviceAccountName
value: release-name-common-test-sa-name1
- documentIndex: &otherDeploymentDoc 2
isKind:
of: Deployment
- documentIndex: *otherDeploymentDoc
equal:
path: spec.template.spec.serviceAccountName
value: release-name-common-test-sa-name1
# Failures
- it: should fail with more than 1 SA assigned to a pod
set:
controllers:
controller-name1:
enabled: true
primary: true
type: Deployment
podSpec: {}
serviceAccounts:
sa-name1:
enabled: true
targetSelector:
- controller-name1
sa-name2:
enabled: true
targetSelector:
- controller-name1
asserts:
- failedTemplate:
errorMessage: Expected at most 1 ServiceAccount to be assigned on a pod [controller-name1]. But [2] were assigned
library/common/1.0.0/docs/controllers.md
+43 -41
View File
@@ -1,46 +1,47 @@
# Controllers
| Key | Type | Required | Helm Template | Default | Description |
| :---------------------------------------------------------------------- | :-------: | :------: | :-----------: | :------------------------------------------------------------: | :----------------------------------------------------------------------------------- |
| controllers | `dict` | ❌ | ❌ | `{}` | Define the controllers as dicts |
| controllers.[controller-name] | `dict` | ✅ | ❌ | `{}` | Holds controller definition |
| controllers.[controller-name].enabled | `boolean` | ✅ | ❌ | `false` | Enables or Disables the controller |
| controllers.[controller-name].primary | `boolean` | ✅ | ❌ | `false` | Sets the controller as primary |
| controllers.[controller-name].labels | `dict` | ❌ | ❌ | `{}` | Additional labels for controller |
| controllers.[controller-name].labels.[key-name] | `string` | ❌ | ❌ | | [Key] of the additional label |
| controllers.[controller-name].labels.[key-name].[value] | `string` | ❌ | ✅ | | [Value] for [key] of the additional label |
| controllers.[controller-name].annotations | `dict` | ❌ | ❌ | `{}` | Additional annotations for controller |
| controllers.[controller-name].annotations.[key-name] | `string` | ❌ | ❌ | | [Key] of the additional annotation |
| controllers.[controller-name].annotations.[key-name].[value] | `string` | ❌ | ✅ | | [Value] for [key] of the additional annotation |
| controllers.[controller-name].type | `string` | ✅ | ❌ | `""` | Define the kind of the controller (Deployment, DaemonSet, StatefulSet, CronJob, Job) |
| controllers.[controller-name].podSpec | `dict` | ✅ | ❌ | `{}` | Holds the pod definition |
| controllers.[controller-name].podSpec.labels | `dict` | ❌ | ❌ | `{}` | Additional Pod Labels |
| controllers.[controller-name].podSpec.labels.[key-name] | `string` | ❌ | ❌ | | [Key] of the additional label |
| controllers.[controller-name].podSpec.labels.[key-name].[value] | `string` | ❌ | ✅ | | [Value] for [key] of the additional label |
| controllers.[controller-name].podSpec.annotations | `dict` | ❌ | ✅ | `{}` | Pod Annotations |
| controllers.[controller-name].podSpec.annotations.[key-name] | `string` | ❌ | ❌ | | [Key] of the additional annotation |
| controllers.[controller-name].podSpec.annotations.[key-name].[value] | `string` | ❌ | ✅ | | [Value] of [key] of the additional annotation |
| controllers.[controller-name].podSpec.hostNetwork | `boolean` | ❌ | ❌ | `{{ .Values.podOptions.hostNetwork }}` (false) | Pod's hostNetwork |
| controllers.[controller-name].podSpec.enableServiceLinks | `boolean` | ❌ | ❌ | `{{ .Values.podOptions.enableServiceLinks }}` (false) | Pod's enableServiceLinks |
| controllers.[controller-name].podSpec.restartPolicy | `string` | ❌ | ✅ | `{{ .Values.podOptions.restartPolicy }}` (Always) | Pod's restartPolicy. (Always, Never, OnFailure) |
| controllers.[controller-name].podSpec.schedulerName | `string` | ❌ | ✅ | `{{ .Values.podOptions.schedulerName }}` ("") | Pod's schedulerName |
| controllers.[controller-name].podSpec.priorityClassName | `string` | ❌ | ✅ | `{{ .Values.podOptions.priorityClassName }}` ("") | Pod's priorityClassName |
| controllers.[controller-name].podSpec.hostname | `string` | ❌ | ✅ | `""` | Pod's hostname |
| controllers.[controller-name].podSpec.terminationGracePeriodSeconds | `int` | ❌ | ✅ | `{{ .Values.podOptions.terminationGracePeriodSeconds }}` (120) | Pod's terminationGracePeriodSeconds |
| controllers.[controller-name].podSpec.nodeSelector | `dict` | ❌ | ❌ | `{{ .Values.podOptions.nodeSelector }}` ({}) | Pod's nodeSelector |
| controllers.[controller-name].podSpec.nodeSelector.[key-name] | `string` | ❌ | ❌ | | [Key] for nodeSelector |
| controllers.[controller-name].podSpec.nodeSelector.[key-name].[value] | `string` | ❌ | ✅ | | [Value] for [key] for nodeSelector |
| controllers.[controller-name].podSpec.hostAliases | `list` | ❌ | ❌ | | Pod's host aliases |
| controllers.[controller-name].podSpec.hostAliases.ip | `string` | ❌ | ✅ | | Value for `ip` in hosts aliases |
| controllers.[controller-name].podSpec.hostAliases.hostnames | `list` | ❌ | ❌ | | Hostnames for the `ip` in hosts aliases |
| controllers.[controller-name].podSpec.hostAliases.hostnames.[host-name] | `string` | ❌ | ✅ | | [Value] for `hostnames` for the `ip` in hosts aliases |
| controllers.[controller-name].podSpec.dnsPolicy | `string` | ❌ | ✅ | `{{ .Values.podOptions.dnsPolicy }}` (ClusterFirst) | Pod's DNS Policy (ClusterFirst, ClusterFirstWithHostNet, Default, None). |
| controllers.[controller-name].podSpec.tolerations | `list` | ❌ | ❌ | `{{ .Values.podOptions.tolerations }}` ([]) | Pod's Tolerations |
| controllers.[controller-name].podSpec.tolerations.operator | `string` | ✅ | ✅ | | Toleration's `operator` (Equal, Exists) |
| controllers.[controller-name].podSpec.tolerations.key | `string` | ❌/✅ | ✅ | | Toleration's `key`. Required only when `operator` = `Equal` |
| controllers.[controller-name].podSpec.tolerations.value | `string` | ❌/✅ | ✅ | | Toleration's `value`. Required only when `operator` = `Equal` |
| controllers.[controller-name].podSpec.tolerations.effect | `string` | ❌ | ✅ | | Toleration's `effect`.(NoExecute, NoSchedule, PreferNoSchedule) |
| controllers.[controller-name].podSpec.tolerations.tolerationSeconds | `int` | ❌ | ❌ | | Toleration's `tolerationSeconds`. |
| Key | Type | Required | Helm Template | Default | Description |
| :---------------------------------------------------------------------- | :-------: | :------: | :-----------: | :-------------------------------------------------------------: | :----------------------------------------------------------------------------------- |
| controllers | `dict` | ❌ | ❌ | `{}` | Define the controllers as dicts |
| controllers.[controller-name] | `dict` | ✅ | ❌ | `{}` | Holds controller definition |
| controllers.[controller-name].enabled | `boolean` | ✅ | ❌ | `false` | Enables or Disables the controller |
| controllers.[controller-name].primary | `boolean` | ✅ | ❌ | `false` | Sets the controller as primary |
| controllers.[controller-name].labels | `dict` | ❌ | ❌ | `{}` | Additional labels for controller |
| controllers.[controller-name].labels.[key-name] | `string` | ❌ | ❌ | | [Key] of the additional label |
| controllers.[controller-name].labels.[key-name].[value] | `string` | ❌ | ✅ | | [Value] for [key] of the additional label |
| controllers.[controller-name].annotations | `dict` | ❌ | ❌ | `{}` | Additional annotations for controller |
| controllers.[controller-name].annotations.[key-name] | `string` | ❌ | ❌ | | [Key] of the additional annotation |
| controllers.[controller-name].annotations.[key-name].[value] | `string` | ❌ | ✅ | | [Value] for [key] of the additional annotation |
| controllers.[controller-name].type | `string` | ✅ | ❌ | `""` | Define the kind of the controller (Deployment, DaemonSet, StatefulSet, CronJob, Job) |
| controllers.[controller-name].podSpec | `dict` | ✅ | ❌ | `{}` | Holds the pod definition |
| controllers.[controller-name].podSpec.labels | `dict` | ❌ | ❌ | `{}` | Additional Pod Labels |
| controllers.[controller-name].podSpec.labels.[key-name] | `string` | ❌ | ❌ | | [Key] of the additional label |
| controllers.[controller-name].podSpec.labels.[key-name].[value] | `string` | ❌ | ✅ | | [Value] for [key] of the additional label |
| controllers.[controller-name].podSpec.annotations | `dict` | ❌ | ✅ | `{}` | Pod Annotations |
| controllers.[controller-name].podSpec.annotations.[key-name] | `string` | ❌ | ❌ | | [Key] of the additional annotation |
| controllers.[controller-name].podSpec.annotations.[key-name].[value] | `string` | ❌ | ✅ | | [Value] of [key] of the additional annotation |
| controllers.[controller-name].podSpec.automountServiceAccountToken | `boolean` | ❌ | ❌ | `{{ .Values.podOptions.automountServiceAccoutnToken }}` (false) | Pod's automountServiceAccountToken |
| controllers.[controller-name].podSpec.hostNetwork | `boolean` | ❌ | ❌ | `{{ .Values.podOptions.hostNetwork }}` (false) | Pod's hostNetwork |
| controllers.[controller-name].podSpec.enableServiceLinks | `boolean` | ❌ | ❌ | `{{ .Values.podOptions.enableServiceLinks }}` (false) | Pod's enableServiceLinks |
| controllers.[controller-name].podSpec.restartPolicy | `string` | ❌ | ✅ | `{{ .Values.podOptions.restartPolicy }}` (Always) | Pod's restartPolicy. (Always, Never, OnFailure) |
| controllers.[controller-name].podSpec.schedulerName | `string` | ❌ | ✅ | `{{ .Values.podOptions.schedulerName }}` ("") | Pod's schedulerName |
| controllers.[controller-name].podSpec.priorityClassName | `string` | ❌ | ✅ | `{{ .Values.podOptions.priorityClassName }}` ("") | Pod's priorityClassName |
| controllers.[controller-name].podSpec.hostname | `string` | ❌ | ✅ | `""` | Pod's hostname |
| controllers.[controller-name].podSpec.terminationGracePeriodSeconds | `int` | ❌ | ✅ | `{{ .Values.podOptions.terminationGracePeriodSeconds }}` (120) | Pod's terminationGracePeriodSeconds |
| controllers.[controller-name].podSpec.nodeSelector | `dict` | ❌ | ❌ | `{{ .Values.podOptions.nodeSelector }}` ({}) | Pod's nodeSelector |
| controllers.[controller-name].podSpec.nodeSelector.[key-name] | `string` | ❌ | ❌ | | [Key] for nodeSelector |
| controllers.[controller-name].podSpec.nodeSelector.[key-name].[value] | `string` | ❌ | ✅ | | [Value] for [key] for nodeSelector |
| controllers.[controller-name].podSpec.hostAliases | `list` | ❌ | ❌ | | Pod's host aliases |
| controllers.[controller-name].podSpec.hostAliases.ip | `string` | ❌ | ✅ | | Value for `ip` in hosts aliases |
| controllers.[controller-name].podSpec.hostAliases.hostnames | `list` | ❌ | ❌ | | Hostnames for the `ip` in hosts aliases |
| controllers.[controller-name].podSpec.hostAliases.hostnames.[host-name] | `string` | ❌ | ✅ | | [Value] for `hostnames` for the `ip` in hosts aliases |
| controllers.[controller-name].podSpec.dnsPolicy | `string` | ❌ | ✅ | `{{ .Values.podOptions.dnsPolicy }}` (ClusterFirst) | Pod's DNS Policy (ClusterFirst, ClusterFirstWithHostNet, Default, None). |
| controllers.[controller-name].podSpec.tolerations | `list` | ❌ | ❌ | `{{ .Values.podOptions.tolerations }}` ([]) | Pod's Tolerations |
| controllers.[controller-name].podSpec.tolerations.operator | `string` | ✅ | ✅ | | Toleration's `operator` (Equal, Exists) |
| controllers.[controller-name].podSpec.tolerations.key | `string` | ❌/✅ | ✅ | | Toleration's `key`. Required only when `operator` = `Equal` |
| controllers.[controller-name].podSpec.tolerations.value | `string` | ❌/✅ | ✅ | | Toleration's `value`. Required only when `operator` = `Equal` |
| controllers.[controller-name].podSpec.tolerations.effect | `string` | ❌ | ✅ | | Toleration's `effect`.(NoExecute, NoSchedule, PreferNoSchedule) |
| controllers.[controller-name].podSpec.tolerations.tolerationSeconds | `int` | ❌ | ❌ | | Toleration's `tolerationSeconds`. |
---
@@ -90,6 +91,7 @@ controllers:
key: value
annotations:
key: value
automountServiceAccountToken: true
hostNetwork: false
enableServiceLinks: false
schedulerName: some-scheduler
library/common/1.0.0/docs/imagePullSecrets.md
+2 -2
View File
@@ -13,10 +13,10 @@
| imagePullSecrets.[pull-secret-name].data.password | `string` | ✅ | ✅ | `""` | Define the password of the image pull secret |
| imagePullSecrets.[pull-secret-name].data.email | `string` | ✅ | ✅ | `""` | Define the email of the image pull secret |
| imagePullSecrets.[pull-secret-name].targetSelectAll | `boolean` | ❌ | ❌ | | Whether to assign the secret to all pods or not |
| imagePullSecrets.[pull-secret-name].targetSelector | `list` | ❌ | ❌ | `""` | Define the pod(s) to assign the secret |
| imagePullSecrets.[pull-secret-name].targetSelector | `list` | ❌ | ❌ | `[]` | Define the pod(s) to assign the secret |
> When `targetSelectAll` is `true`, it will assign the secret to all pods (`targetSelector` is ignored in this case)
> When `targetSelector` is a list, it's entry is a string, referencing the pod(s) name that will be assigned.
> When `targetSelector` is a list, each entry is a string, referencing the pod(s) name that will be assigned.
> When `targetSelector` is a empty, it will assign the secret to the primary pod
---
library/common/1.0.0/docs/secrets.md
+1 -1
View File
@@ -31,9 +31,9 @@ secrets:
secret-name:
enabled: true
type: CustomSecretType
labels:
key: value
type: CustomSecretType
keytpl: "{{ .Values.some.value }}"
annotations:
key: value
library/common/1.0.0/docs/serviceAccounts.md
+50
View File
@@ -0,0 +1,50 @@
# Service Account
| Key | Type | Required | Helm Template | Default | Description |
| :---------------------------------------- | :-------: | :------: | :-----------: | :-----: | :------------------------------------------------------ |
| serviceAccounts | `dict` | ❌ | ❌ | `{}` | Define the serviceAccounts as dicts |
| serviceAccounts.[sa-name] | `dict` | ✅ | ❌ | `{}` | Holds secret definition |
| serviceAccounts.[sa-name].enabled | `boolean` | ✅ | ❌ | `false` | Enables or Disables the secret |
| serviceAccounts.[sa-name].labels | `dict` | ❌ | ✅ | `{}` | Additional labels for secret |
| serviceAccounts.[sa-name].annotations | `dict` | ❌ | ✅ | `{}` | Additional annotations for secret |
| serviceAccounts.[sa-name].targetSelectAll | `boolean` | ❌ | ❌ | | Whether to assign the serviceAccount to all pods or not |
| serviceAccounts.[sa-name].targetSelector | `list` | ❌ | ❌ | `[]` | Define the pod(s) to assign the serviceAccount |
> When `targetSelectAll` is `true`, it will assign the serviceAccount to all pods (`targetSelector` is ignored in this case)
> When `targetSelector` is a list, each entry is a string, referencing the pod(s) name that will be assigned.
> When `targetSelector` is a empty, it will assign the serviceAccount to the primary pod
---
Appears in:
- `.Values.serviceAccounts`
---
Naming scheme:
- `$FullName-$ServiceAccountName` (release-name-chart-name-ServiceAccountName)
---
Examples:
```yaml
serviceAccounts:
sa-name:
enabled: true
labels:
key: value
keytpl: "{{ .Values.some.value }}"
annotations:
key: value
keytpl: "{{ .Values.some.value }}"
targetSelectAll: true
other-sa-name:
enabled: true
targetSelector:
- pod-name
- other-pod-name
```
library/common/1.0.0/templates/classes/_configmap.tpl
+1 -1
View File
@@ -1,6 +1,6 @@
{{/* Configmap Class */}}
{{/* Call this template:
{{ include "ix.v1.common.class.configmap" (dict "objectData" $objectData "rootCtx" $) }}
{{ include "ix.v1.common.class.configmap" (dict "rootCtx" $ "objectData" $objectData) }}
rootCtx: The root context of the template. It is used to access the global context.
objectData:
library/common/1.0.0/templates/classes/_cronjob.tpl
+1 -1
View File
@@ -1,6 +1,6 @@
{{/* CronJob Class */}}
{{/* Call this template:
{{ include "ix.v1.common.class.cronjob" (dict "objectData" $objectData "rootCtx" $) }}
{{ include "ix.v1.common.class.cronjob" (dict "rootCtx" $ "objectData" $objectData) }}
rootCtx: The root context of the template. It is used to access the global context.
objectData: The object data to be used to render the CronJob.
library/common/1.0.0/templates/classes/_daemonset.tpl
+1 -1
View File
@@ -1,6 +1,6 @@
{{/* DaemonSet Class */}}
{{/* Call this template:
{{ include "ix.v1.common.class.deployment" (dict "objectData" $objectData "rootCtx" $) }}
{{ include "ix.v1.common.class.deployment" (dict "rootCtx" $ "objectData" $objectData) }}
rootCtx: The root context of the template. It is used to access the global context.
objectData: The object data to be used to render the DaemonSet.
library/common/1.0.0/templates/classes/_deployment.tpl
+1 -1
View File
@@ -1,6 +1,6 @@
{{/* Deployment Class */}}
{{/* Call this template:
{{ include "ix.v1.common.class.deployment" (dict "objectData" $objectData "rootCtx" $) }}
{{ include "ix.v1.common.class.deployment" (dict "rootCtx" $ "objectData" $objectData) }}
rootCtx: The root context of the template. It is used to access the global context.
objectData: The object data to be used to render the Deployment.
library/common/1.0.0/templates/classes/_job.tpl
+1 -1
View File
@@ -1,6 +1,6 @@
{{/* Job Class */}}
{{/* Call this template:
{{ include "ix.v1.common.class.job" (dict "objectData" $objectData "rootCtx" $) }}
{{ include "ix.v1.common.class.job" (dict "rootCtx" $ "objectData" $objectData) }}
rootCtx: The root context of the template. It is used to access the global context.
objectData: The object data to be used to render the Job.
library/common/1.0.0/templates/classes/_secret.tpl
+1 -1
View File
@@ -1,6 +1,6 @@
{{/* Secret Class */}}
{{/* Call this template:
{{ include "ix.v1.common.class.secret" (dict "objectData" $objectData "rootCtx" $) }}
{{ include "ix.v1.common.class.secret" (dict "rootCtx" $ "objectData" $objectData) }}
rootCtx: The root context of the template. It is used to access the global context.
objectData:
library/common/1.0.0/templates/classes/_serviceAccount.tpl
+32
View File
@@ -0,0 +1,32 @@
{{/* Service Account Class */}}
{{/* Call this template:
{{ include "ix.v1.common.class.serviceAccount" (dict "rootCtx" $ "objectData" $objectData) }}
rootCtx: The root context of the template. It is used to access the global context.
objectData:
name: The name of the serviceAccount.
labels: The labels of the serviceAccount.
annotations: The annotations of the serviceAccount.
autoMountToken: Whether to mount the ServiceAccount token or not.
*/}}
{{- define "ix.v1.common.class.serviceAccount" -}}
{{- $rootCtx := .rootCtx -}}
{{- $objectData := .objectData }}
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ $objectData.name }}
{{- $labels := (mustMerge ($objectData.labels | default dict) (include "ix.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml)) -}}
{{- with (include "ix.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }}
labels:
{{- . | nindent 4 }}
{{- end -}}
{{- $annotations := (mustMerge ($objectData.annotations | default dict) (include "ix.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml)) -}}
{{- with (include "ix.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }}
annotations:
{{- . | nindent 4 }}
{{- end -}}
{{- end -}}
library/common/1.0.0/templates/classes/_statefulset.tpl
+1 -1
View File
@@ -1,6 +1,6 @@
{{/* StatefulSet Class */}}
{{/* Call this template:
{{ include "ix.v1.common.class.deployment" (dict "objectData" $objectData "rootCtx" $) }}
{{ include "ix.v1.common.class.deployment" (dict "rootCtx" $ "objectData" $objectData) }}
rootCtx: The root context of the template. It is used to access the global context.
objectData: The object data to be used to render the StatefulSet.
library/common/1.0.0/templates/lib/controller/_pod.tpl
+2 -1
View File
@@ -7,7 +7,8 @@ objectData: The object data to be used to render the Pod.
{{- define "ix.v1.common.lib.controller.pod" -}}
{{- $rootCtx := .rootCtx -}}
{{- $objectData := .objectData -}}
#TODO:serviceAccountName:
serviceAccountName: {{ include "ix.v1.common.lib.pod.serviceAccountName" (dict "rootCtx" $rootCtx "objectData" $objectData) }}
automountServiceAccountToken: {{ include "ix.v1.common.lib.pod.automountServiceAccountToken" (dict "rootCtx" $rootCtx "objectData" $objectData) }}
{{- with (include "ix.v1.common.lib.pod.imagePullSecrets" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim) }}
imagePullSecrets:
{{- . | nindent 2 }}
library/common/1.0.0/templates/lib/pod/_autoMountServiceAccountToken.tpl
+24
View File
@@ -0,0 +1,24 @@
{{/* Returns automountServiceAccountToken */}}
{{/* Call this template:
{{ include "ix.v1.common.lib.pod.automountServiceAccountToken" (dict "rootCtx" $ "objectData" $objectData) }}
rootCtx: The root context of the template. It is used to access the global context.
objectData: The object data to be used to render the Pod.
*/}}
{{- define "ix.v1.common.lib.pod.automountServiceAccountToken" -}}
{{- $rootCtx := .rootCtx -}}
{{- $objectData := .objectData -}}
{{- $automount := false -}}
{{/* Initialize from the "global" option */}}
{{- if (kindIs "bool" $rootCtx.Values.podOptions.automountServiceAccountToken) -}}
{{- $automount = $rootCtx.Values.podOptions.automountServiceAccountToken -}}
{{- end -}}
{{/* Override with pod's option */}}
{{- if (kindIs "bool" $objectData.podSpec.automountServiceAccountToken) -}}
{{- $automount = $objectData.podSpec.automountServiceAccountToken -}}
{{- end -}}
{{- $automount -}}
{{- end -}}
library/common/1.0.0/templates/lib/pod/_imagePullSecrets.tpl
+1 -2
View File
@@ -9,7 +9,6 @@ objectData: The object data to be used to render the Pod.
{{- $objectData := .objectData -}}
{{- $imgPullSecrets := list -}}
{{- $podSelected := true -}}
{{- range $name, $imgPull := $rootCtx.Values.imagePullSecrets -}}
{{- $pullName := (printf "%s-%s" (include "ix.v1.common.lib.chart.names.fullname" $rootCtx) $name) -}}
@@ -34,6 +33,6 @@ objectData: The object data to be used to render the Pod.
{{- end -}}
{{- range $imgPullSecrets }}
- {{ . }}
- name: {{ . }}
{{- end -}}
{{- end -}}
library/common/1.0.0/templates/lib/pod/_serviceAccountName.tpl
+44
View File
@@ -0,0 +1,44 @@
{{/* Returns Service Account Name */}}
{{/* Call this template:
{{ include "ix.v1.common.lib.pod.serviceAccountName" (dict "rootCtx" $ "objectData" $objectData) }}
rootCtx: The root context of the template. It is used to access the global context.
objectData: The object data to be used to render the Pod.
*/}}
{{- define "ix.v1.common.lib.pod.serviceAccountName" -}}
{{- $rootCtx := .rootCtx -}}
{{- $objectData := .objectData -}}
{{- $saName := "default" -}}
{{- $saNameCount := 0 -}}
{{- range $name, $serviceAccount := $rootCtx.Values.serviceAccounts -}}
{{- $name = (printf "%s-%s" (include "ix.v1.common.lib.chart.names.fullname" $rootCtx) $name) -}}
{{- if $serviceAccount.enabled -}}
{{/* If targetSelectAll is true */}}
{{- if $serviceAccount.targetSelectAll -}}
{{- $saName = $name -}}
{{- $saNameCount = add1 $saNameCount -}}
{{/* Else if targetSelector is a list */}}
{{- else if (kindIs "slice" $serviceAccount.targetSelector) -}}
{{- if (mustHas $objectData.shortName $serviceAccount.targetSelector) -}}
{{- $saName = $name -}}
{{- $saNameCount = add1 $saNameCount -}}
{{- end -}}
{{/* If not targetSelectAll or targetSelector, but is the primary pod */}}
{{- else if $objectData.primary -}}
{{- $saName = $name -}}
{{- $saNameCount = add1 $saNameCount -}}
{{- end -}}
{{- end -}}
{{- end -}}
{{- if gt $saNameCount 1 -}}
{{- fail (printf "Expected at most 1 ServiceAccount to be assigned on a pod [%s]. But [%v] were assigned" $objectData.shortName $saNameCount) -}}
{{- end -}}
{{- $saName -}}
{{- end -}}
library/common/1.0.0/templates/loader/_apply.tpl
+3
View File
@@ -10,6 +10,9 @@
{{/* Render Image Pull Secrets(s) */}}
{{- include "ix.v1.common.spawner.imagePullSecrets" . | nindent 0 -}}
{{/* Render Service Accounts(s) */}}
{{- include "ix.v1.common.spawner.serviceAccounts" . | nindent 0 -}}
{{/* Render Controller(s) */}}
{{- include "ix.v1.common.spawner.controllers" . | nindent 0 -}}
library/common/1.0.0/templates/spawner/_configmap.tpl
+1 -1
View File
@@ -20,7 +20,7 @@
{{/* Set the name of the configmap */}}
{{- $_ := set $objectData "name" $objectName -}}
{{/* Call class to create the object */}}
{{- include "ix.v1.common.class.configmap" (dict "objectData" $objectData "rootCtx" $) -}}
{{- include "ix.v1.common.class.configmap" (dict "rootCtx" $ "objectData" $objectData) -}}
{{- end -}}
library/common/1.0.0/templates/spawner/_controller.tpl
+5 -5
View File
@@ -33,15 +33,15 @@
{{/* Call class to create the object */}}
{{- if eq $objectData.type "Deployment" -}}
{{- include "ix.v1.common.class.deployment" (dict "objectData" $objectData "rootCtx" $) -}}
{{- include "ix.v1.common.class.deployment" (dict "rootCtx" $ "objectData" $objectData) -}}
{{- else if eq $objectData.type "StatefulSet" -}}
{{- include "ix.v1.common.class.statefulset" (dict "objectData" $objectData "rootCtx" $) -}}
{{- include "ix.v1.common.class.statefulset" (dict "rootCtx" $ "objectData" $objectData) -}}
{{- else if eq $objectData.type "DaemonSet" -}}
{{- include "ix.v1.common.class.daemonset" (dict "objectData" $objectData "rootCtx" $) -}}
{{- include "ix.v1.common.class.daemonset" (dict "rootCtx" $ "objectData" $objectData) -}}
{{- else if eq $objectData.type "Job" -}}
{{- include "ix.v1.common.class.job" (dict "objectData" $objectData "rootCtx" $) -}}
{{- include "ix.v1.common.class.job" (dict "rootCtx" $ "objectData" $objectData) -}}
{{- else if eq $objectData.type "CronJob" -}}
{{- include "ix.v1.common.class.cronjob" (dict "objectData" $objectData "rootCtx" $) -}}
{{- include "ix.v1.common.class.cronjob" (dict "rootCtx" $ "objectData" $objectData) -}}
{{- end -}}
{{- end -}}
library/common/1.0.0/templates/spawner/_imagePullSecret.tpl
+4 -4
View File
@@ -1,4 +1,4 @@
{{/* Configmap Spawwner */}}
{{/* Image Pull Secrets Spawner */}}
{{/* Call this template:
{{ include "ix.v1.common.spawner.imagePullSecrets" $ -}}
*/}}
@@ -13,11 +13,11 @@
{{- $objectData := (mustDeepCopy $imgPullSecret) -}}
{{- $objectName := (printf "%s-%s" (include "ix.v1.common.lib.chart.names.fullname" $) $name) -}}
{{/* Perform validations */}}
{{- include "ix.v1.common.lib.chart.names.validation" (dict "name" $objectName) -}}
{{- include "ix.v1.common.lib.imagePullSecret.validation" (dict "objectData" $objectData) -}}
{{- $data := include "ix.v1.common.lib.imagePullSecret.createData" (dict "objectData" $objectData "rootCtx" $) -}}
{{- $data := include "ix.v1.common.lib.imagePullSecret.createData" (dict "rootCtx" $ "objectData" $objectData) -}}
{{/* Update the data */}}
{{- $_ := set $objectData "data" $data -}}
@@ -29,7 +29,7 @@
{{- $_ := set $objectData "name" $objectName -}}
{{/* Call class to create the object */}}
{{- include "ix.v1.common.class.secret" (dict "objectData" $objectData "rootCtx" $) -}}
{{- include "ix.v1.common.class.secret" (dict "rootCtx" $ "objectData" $objectData) -}}
{{- end -}}
library/common/1.0.0/templates/spawner/_secret.tpl
+1 -1
View File
@@ -20,7 +20,7 @@
{{/* Set the name of the secret */}}
{{- $_ := set $objectData "name" $objectName -}}
{{/* Call class to create the object */}}
{{- include "ix.v1.common.class.secret" (dict "objectData" $objectData "rootCtx" $) -}}
{{- include "ix.v1.common.class.secret" (dict "rootCtx" $ "objectData" $objectData) -}}
{{- end -}}
library/common/1.0.0/templates/spawner/_serviceAccount.tpl
+30
View File
@@ -0,0 +1,30 @@
{{/* Service Account Spawner */}}
{{/* Call this template:
{{ include "ix.v1.common.spawner.serviceAccounts" $ -}}
*/}}
{{- define "ix.v1.common.spawner.serviceAccounts" -}}
{{- range $name, $serviceAccount := .Values.serviceAccounts -}}
{{- if $serviceAccount.enabled -}}
{{/* Create a copy of the configmap */}}
{{- $objectData := (mustDeepCopy $serviceAccount) -}}
{{- $objectName := (printf "%s-%s" (include "ix.v1.common.lib.chart.names.fullname" $) $name) -}}
{{/* Perform validations */}}
{{- include "ix.v1.common.lib.chart.names.validation" (dict "name" $objectName) -}}
{{/* Set the name of the service account */}}
{{- $_ := set $objectData "name" $objectName -}}
{{/* Call class to create the object */}}
{{- include "ix.v1.common.class.serviceAccount" (dict "rootCtx" $ "objectData" $objectData) -}}
{{- end -}}
{{- end -}}
{{- end -}}
library/common/1.0.0/values.yaml
+4 -4
View File
@@ -5,7 +5,7 @@ global:
# -- Set additional global annotations
annotations: {}
# -- Scale Storage Class
scaleZFSStorageClass: '{{ printf "ix-storage-class-%v" .Release.Name}}'
scaleZFSStorageClass: '{{ printf "ix-storage-class-%v" .Release.Name }}'
# TODO:
fallbackDefaults:
@@ -36,7 +36,7 @@ image:
pullPolicy: IfNotPresent
# -- Service Account:
serviceAccount:
serviceAccounts:
sa-name:
# -- Enables the service account
enabled: false
@@ -44,8 +44,7 @@ serviceAccount:
labels: {}
# -- Service account annotations
annotations: {}
autoMountSAToken: true
# targetSelector: all
targetSelectAll: false
targetSelector:
- pod-name
@@ -122,6 +121,7 @@ podOptions:
tolerations: []
schedulerName: ""
priorityClassName: ""
automountServiceAccountToken: false
terminationGracePeriodSeconds: 120
# TODO: Add affinity
# TODO: Add topologySpreadConstraints