Bump Version to v0.0.32

Permit passing resources, tolerations, affinity to Helm chart

.version

@@ -1 +1 @@
-v0.0.26
+v0.0.32

README.md

@@ -95,7 +95,9 @@ spec:
 ```
 
 ### NOTES
-- `reloader.stakater.com/auto: "true"` will always override when use with either `secret.reloader.stakater.com/reload` or `configmap.reloader.stakater.com/reload` annotation.
+- Reloader also supports [sealed-secrets](https://github.com/bitnami-labs/sealed-secrets). [Here](docs/Reloader-with-Sealed-Secrets.md) are the steps to use sealed-secrets with reloader.
+- `reloader.stakater.com/auto: "true"` will only reload the pod, if the configmap or secret is used (as a volume mount or as an env) in `Deployment/Daemonsets/Statefulsets`
+- `secret.reloader.stakater.com/reload` or `configmap.reloader.stakater.com/reload` annotation will reload the pod upon changes in specified configmap or secret, irrespective of the usage of configmap or secret.
 - you may override the auto annotation with the `--auto-annotation` flag
 - you may override the configmap annotation with the `--configmap-annotation` flag
 - you may override the secret annotation with the `--secret-annotation` flag

build/package/Dockerfile.run

@@ -1,4 +1,4 @@
-FROM alpine:3.4
+FROM alpine:3.9
 MAINTAINER "Stakater Team"
 
 RUN apk add --update ca-certificates

deployments/kubernetes/chart/reloader/Chart.yaml

@@ -3,8 +3,8 @@
 apiVersion: v1
 name: reloader
 description: Reloader chart that runs on kubernetes
-version: v0.0.26
-appVersion: v0.0.26
+version: v0.0.32
+appVersion: v0.0.32
 keywords:
   - Reloader
   - kubernetes

deployments/kubernetes/chart/reloader/templates/clusterrole.yaml

@@ -15,7 +15,7 @@ metadata:
 rules:
   - apiGroups:
       - ""
-    resources:      
+    resources:
       - secrets
       - configmaps
     verbs:
@@ -23,7 +23,6 @@ rules:
       - get
       - watch
   - apiGroups:
-      - "extensions"
       - "apps"
     resources:
       - deployments
@@ -34,4 +33,14 @@ rules:
       - get
       - update
       - patch
+  - apiGroups:
+      - "extensions"
+    resources:
+      - deployments
+      - daemonsets
+    verbs:
+      - list
+      - get
+      - update
+      - patch
 {{- end }}

deployments/kubernetes/chart/reloader/templates/deployment.yaml

@@ -35,6 +35,18 @@ spec:
 {{ toYaml .Values.reloader.matchLabels | indent 8 }}
 {{- end }}
     spec:
+      {{- if .Values.reloader.deployment.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.reloader.deployment.nodeSelector | indent 8 }}
+      {{- end }}
+      {{- if .Values.reloader.deployment.affinity }}
+      affinity:
+{{ toYaml .Values.reloader.deployment.affinity | indent 8 }}
+      {{- end }}
+      {{- if .Values.reloader.deployment.tolerations }}
+      tolerations:
+{{ toYaml .Values.reloader.deployment.tolerations | indent 8 }}
+      {{- end }}
       containers:
       - env:
       {{- range $name, $value := .Values.reloader.deployment.env.open }}
@@ -70,6 +82,11 @@ spec:
         image: "{{ .Values.reloader.deployment.image.name }}:{{ .Values.reloader.deployment.image.tag }}"
         imagePullPolicy: {{ .Values.reloader.deployment.image.pullPolicy }}
         name: {{ template "reloader-name" . }}
+      {{- if eq .Values.reloader.readOnlyRootFileSystem true }}
+        volumeMounts:
+          - mountPath: /tmp/
+            name: tmp-volume
+      {{- end }}
       {{- if .Values.reloader.custom_annotations }}
         args:
           {{- if .Values.reloader.custom_annotations.configmap }}
@@ -85,4 +102,13 @@ spec:
           - "{{ .Values.reloader.custom_annotations.auto }}"
           {{- end }}
       {{- end }}
+      {{- if .Values.reloader.deployment.resources }}
+        resources:
+{{ toYaml .Values.reloader.deployment.resources | indent 10 }}
+      {{- end }}
       serviceAccountName: {{ template "reloader-serviceAccountName" . }}
+    {{- if eq .Values.reloader.readOnlyRootFileSystem true }}
+      volumes:
+        - emptyDir: {}
+          name: tmp-volume
+    {{- end }}

deployments/kubernetes/chart/reloader/templates/role.yaml

@@ -15,7 +15,7 @@ metadata:
 rules:
   - apiGroups:
       - ""
-    resources:      
+    resources:
       - secrets
       - configmaps
     verbs:
@@ -23,7 +23,6 @@ rules:
       - get
       - watch
   - apiGroups:
-      - "extensions"
       - "apps"
     resources:
       - deployments
@@ -34,4 +33,14 @@ rules:
       - get
       - update
       - patch
+  - apiGroups:
+      - "extensions"
+    resources:
+      - deployments
+      - daemonsets
+    verbs:
+      - list
+      - get
+      - update
+      - patch
 {{- end }}

deployments/kubernetes/chart/reloader/values.yaml

@@ -5,16 +5,40 @@ kubernetes:
 
 reloader:
   watchGlobally: true
+  # Set to true if you have a pod security policy that enforces readOnlyRootFilesystem
+  readOnlyRootFileSystem: false
   matchLabels: {}
   deployment:
+    nodeSelector:
+    # cloud.google.com/gke-nodepool: default-pool
+
+    # An affinity stanza to be applied to the Deployment.
+    # Example:
+    #   affinity:
+    #     nodeAffinity:
+    #       requiredDuringSchedulingIgnoredDuringExecution:
+    #         nodeSelectorTerms:
+    #         - matchExpressions:
+    #           - key: "node-role.kubernetes.io/infra-worker"
+    #             operator: "Exists"
+    affinity: {}
+
+    # A list of tolerations to be applied to the Deployment.
+    # Example:
+    #   tolerations:
+    #   - key: "node-role.kubernetes.io/infra-worker"
+    #     operator: "Exists"
+    #     effect: "NoSchedule"
+    tolerations: []
+
     annotations: {}
     labels:
       provider: stakater
       group: com.stakater.platform
-      version: v0.0.26
+      version: v0.0.32
     image:
       name: stakater/reloader
-      tag: "v0.0.26"
+      tag: "v0.0.32"
       pullPolicy: IfNotPresent
     # Support for extra environment variables.
     env:
@@ -24,6 +48,18 @@ reloader:
       secret:
       # field supports Key value pair as environment variables. It gets the values from other fields of pod.
       field:
+
+    # Specify resource requests/limits for the deployment.
+    # Example:
+    # resources:
+    #   limits:
+    #     cpu: "100m"
+    #     memory: "512Mi"
+    #   requests:
+    #     cpu: "10m"
+    #     memory: "128Mi"
+    resources: {}
+
   rbac:
     enabled: true
     labels: {}
@@ -40,4 +76,4 @@ reloader:
   #   custom_annotations:
   #     configmap: "my.company.com/configmap"
   #     secret: "my.company.com/secret"
-  custom_annotations: {} 
+  custom_annotations: {}

deployments/kubernetes/manifests/clusterrole.yaml

@@ -6,7 +6,7 @@ kind: ClusterRole
 metadata:
   labels:
     app: reloader
-    chart: "reloader-v0.0.26"
+    chart: "reloader-v0.0.32"
     release: "RELEASE-NAME"
     heritage: "Tiller"
   name: reloader-role
@@ -14,7 +14,7 @@ metadata:
 rules:
   - apiGroups:
       - ""
-    resources:      
+    resources:
       - secrets
       - configmaps
     verbs:
@@ -22,7 +22,6 @@ rules:
       - get
       - watch
   - apiGroups:
-      - "extensions"
       - "apps"
     resources:
       - deployments
@@ -33,4 +32,14 @@ rules:
       - get
       - update
       - patch
+  - apiGroups:
+      - "extensions"
+    resources:
+      - deployments
+      - daemonsets
+    verbs:
+      - list
+      - get
+      - update
+      - patch
 

deployments/kubernetes/manifests/clusterrolebinding.yaml

@@ -6,7 +6,7 @@ kind: ClusterRoleBinding
 metadata:
   labels:
     app: reloader
-    chart: "reloader-v0.0.26"
+    chart: "reloader-v0.0.32"
     release: "RELEASE-NAME"
     heritage: "Tiller"
   name: reloader-role-binding

deployments/kubernetes/manifests/deployment.yaml

@@ -5,12 +5,12 @@ kind: Deployment
 metadata:
   labels:
     app: reloader
-    chart: "reloader-v0.0.26"
+    chart: "reloader-v0.0.32"
     release: "RELEASE-NAME"
     heritage: "Tiller"
     group: com.stakater.platform
     provider: stakater
-    version: v0.0.26
+    version: v0.0.32
     
   name: reloader
 spec:
@@ -24,17 +24,17 @@ spec:
     metadata:
       labels:
         app: reloader
-        chart: "reloader-v0.0.26"
+        chart: "reloader-v0.0.32"
         release: "RELEASE-NAME"
         heritage: "Tiller"
         group: com.stakater.platform
         provider: stakater
-        version: v0.0.26
+        version: v0.0.32
         
     spec:
       containers:
       - env:
-        image: "stakater/reloader:v0.0.26"
+        image: "stakater/reloader:v0.0.32"
         imagePullPolicy: IfNotPresent
         name: reloader
       serviceAccountName: reloader

deployments/kubernetes/manifests/serviceaccount.yaml

@@ -6,7 +6,7 @@ kind: ServiceAccount
 metadata:
   labels:
     app: reloader
-    chart: "reloader-v0.0.26"
+    chart: "reloader-v0.0.32"
     release: "RELEASE-NAME"
     heritage: "Tiller"
   name: reloader

deployments/kubernetes/reloader.yaml

@@ -9,12 +9,12 @@ kind: Deployment
 metadata:
   labels:
     app: reloader
-    chart: "reloader-v0.0.26"
+    chart: "reloader-v0.0.32"
     release: "RELEASE-NAME"
     heritage: "Tiller"
     group: com.stakater.platform
     provider: stakater
-    version: v0.0.26
+    version: v0.0.32
     
   name: reloader
 spec:
@@ -28,17 +28,17 @@ spec:
     metadata:
       labels:
         app: reloader
-        chart: "reloader-v0.0.26"
+        chart: "reloader-v0.0.32"
         release: "RELEASE-NAME"
         heritage: "Tiller"
         group: com.stakater.platform
         provider: stakater
-        version: v0.0.26
+        version: v0.0.32
         
     spec:
       containers:
       - env:
-        image: "stakater/reloader:v0.0.26"
+        image: "stakater/reloader:v0.0.32"
         imagePullPolicy: IfNotPresent
         name: reloader
       serviceAccountName: reloader
@@ -51,7 +51,7 @@ kind: ClusterRole
 metadata:
   labels:
     app: reloader
-    chart: "reloader-v0.0.26"
+    chart: "reloader-v0.0.32"
     release: "RELEASE-NAME"
     heritage: "Tiller"
   name: reloader-role
@@ -59,7 +59,7 @@ metadata:
 rules:
   - apiGroups:
       - ""
-    resources:      
+    resources:
       - secrets
       - configmaps
     verbs:
@@ -67,7 +67,6 @@ rules:
       - get
       - watch
   - apiGroups:
-      - "extensions"
       - "apps"
     resources:
       - deployments
@@ -78,6 +77,16 @@ rules:
       - get
       - update
       - patch
+  - apiGroups:
+      - "extensions"
+    resources:
+      - deployments
+      - daemonsets
+    verbs:
+      - list
+      - get
+      - update
+      - patch
 
 ---
 # Source: reloader/templates/rolebinding.yaml
@@ -91,7 +100,7 @@ kind: ClusterRoleBinding
 metadata:
   labels:
     app: reloader
-    chart: "reloader-v0.0.26"
+    chart: "reloader-v0.0.32"
     release: "RELEASE-NAME"
     heritage: "Tiller"
   name: reloader-role-binding
@@ -113,7 +122,7 @@ kind: ServiceAccount
 metadata:
   labels:
     app: reloader
-    chart: "reloader-v0.0.26"
+    chart: "reloader-v0.0.32"
     release: "RELEASE-NAME"
     heritage: "Tiller"
   name: reloader

deployments/kubernetes/templates/chart/values.yaml.tmpl

@@ -5,8 +5,32 @@ kubernetes:
 
 reloader:
   watchGlobally: true
+  # Set to true if you have a pod security policy that enforces readOnlyRootFilesystem
+  readOnlyRootFileSystem: false
   matchLabels: {}
   deployment:
+    nodeSelector:
+    # cloud.google.com/gke-nodepool: default-pool
+
+    # An affinity stanza to be applied to the Deployment.
+    # Example:
+    #   affinity:
+    #     nodeAffinity:
+    #       requiredDuringSchedulingIgnoredDuringExecution:
+    #         nodeSelectorTerms:
+    #         - matchExpressions:
+    #           - key: "node-role.kubernetes.io/infra-worker"
+    #             operator: "Exists"
+    affinity: {}
+
+    # A list of tolerations to be applied to the Deployment.
+    # Example:
+    #   tolerations:
+    #   - key: "node-role.kubernetes.io/infra-worker"
+    #     operator: "Exists"
+    #     effect: "NoSchedule"
+    tolerations: []
+
     annotations: {}
     labels:
       provider: stakater
@@ -24,6 +48,18 @@ reloader:
       secret:
       # field supports Key value pair as environment variables. It gets the values from other fields of pod.
       field:
+
+    # Specify resource requests/limits for the deployment.
+    # Example:
+    # resources:
+    #   limits:
+    #     cpu: "100m"
+    #     memory: "512Mi"
+    #   requests:
+    #     cpu: "10m"
+    #     memory: "128Mi"
+    resources: {}
+
   rbac:
     enabled: true
     labels: {}
@@ -40,4 +76,4 @@ reloader:
   #   custom_annotations:
   #     configmap: "my.company.com/configmap"
   #     secret: "my.company.com/secret"
-  custom_annotations: {} 
+  custom_annotations: {}

docs/Reloader-with-Sealed-Secrets.md

@@ -0,0 +1,11 @@
+Below are the steps to use reloader with Sealed Secrets.
+1. Download and install the kubeseal client from [here](https://github.com/bitnami-labs/sealed-secrets).
+2. Install the controller for sealed secrets
+3. Fetch the encryption certificate
+4. Encrypt the secret.
+5. Apply the secret.
+7. Install the tool which uses that sealed secret.
+8. Install Reloader.
+9. Once everything is setup, update the original secret at client and encrypt it with kubeseal to see reloader working.
+10. Apply the updated sealed secret.
+11. Reloader will resatart the pod to use that updated secret.

internal/pkg/handler/create.go

@@ -17,7 +17,6 @@ func (r ResourceCreatedHandler) Handle() error {
 		logrus.Errorf("Resource creation handler received nil resource")
 	} else {
 		config, _ := r.GetConfig()
-		logrus.Infof("Resource '%s' of type '%s' in namespace '%s' has been created", config.ResourceName, config.Type, config.Namespace)
 		// process resource based on its type
 		doRollingUpgrade(config)
 	}

internal/pkg/handler/update.go

@@ -3,7 +3,7 @@ package handler
 import (
 	"github.com/sirupsen/logrus"
 	"github.com/stakater/Reloader/internal/pkg/util"
-	"k8s.io/api/core/v1"
+    "k8s.io/api/core/v1"
 )
 
 // ResourceUpdatedHandler contains updated objects
@@ -19,7 +19,6 @@ func (r ResourceUpdatedHandler) Handle() error {
 	} else {
 		config, oldSHAData := r.GetConfig()
 		if config.SHAValue != oldSHAData {
-			logrus.Infof("Changes detected in '%s' of type '%s' in namespace '%s'", config.ResourceName, config.Type, config.Namespace)
 			// process resource based on its type
 			doRollingUpgrade(config)
 		}

internal/pkg/handler/upgrade.go

@@ -79,24 +79,28 @@ func PerformRollingUpgrade(client kubernetes.Interface, config util.Config, upgr
 		result := constants.NotUpdated
 		reloaderEnabled, err := strconv.ParseBool(reloaderEnabledValue)
 		if err == nil && reloaderEnabled {
-			result = updateContainers(upgradeFuncs, i, config)
-		} else if annotationValue != "" {
+			result = updateContainers(upgradeFuncs, i, config, true)
+		}
+
+		if result != constants.Updated && annotationValue != "" {
 			values := strings.Split(annotationValue, ",")
 			for _, value := range values {
 				if value == config.ResourceName {
-					result = updateContainers(upgradeFuncs, i, config)
+					result = updateContainers(upgradeFuncs, i, config, false)
 					if result == constants.Updated {
 						break
 					}
 				}
 			}
 		}
+
 		if result == constants.Updated {
 			err = upgradeFuncs.UpdateFunc(client, config.Namespace, i)
 			resourceName := util.ToObjectMeta(i).Name
 			if err != nil {
 				logrus.Errorf("Update for '%s' of type '%s' in namespace '%s' failed with error %v", resourceName, upgradeFuncs.ResourceType, config.Namespace, err)
 			} else {
+				logrus.Infof("Changes detected in '%s' of type '%s' in namespace '%s'", config.ResourceName, config.Type, config.Namespace)
 				logrus.Infof("Updated '%s' of type '%s' in namespace '%s'", resourceName, upgradeFuncs.ResourceType, config.Namespace)
 			}
 		}
@@ -154,7 +158,7 @@ func getContainerWithEnvReference(containers []v1.Container, resourceName string
 	return nil
 }
 
-func getContainerToUpdate(upgradeFuncs callbacks.RollingUpgradeFuncs, item interface{}, config util.Config) *v1.Container {
+func getContainerToUpdate(upgradeFuncs callbacks.RollingUpgradeFuncs, item interface{}, config util.Config, autoReload bool) *v1.Container {
 	volumes := upgradeFuncs.VolumesFunc(item)
 	containers := upgradeFuncs.ContainersFunc(item)
 	initContainers := upgradeFuncs.InitContainersFunc(item)
@@ -177,20 +181,26 @@ func getContainerToUpdate(upgradeFuncs callbacks.RollingUpgradeFuncs, item inter
 
 	// Get the container with referenced secret or configmap as env var
 	container = getContainerWithEnvReference(containers, config.ResourceName, config.Type)
-	if container == nil  && len(initContainers) > 0 {
+	if container == nil && len(initContainers) > 0 {
 		container = getContainerWithEnvReference(initContainers, config.ResourceName, config.Type)
 		if container != nil {
 			// if configmap/secret is being used in init container then return the first Pod container to save reloader env
 			return &containers[0]
 		}
 	}
+
+	// Get the first container if the annotation is related to specified configmap or secret i.e. configmap.reloader.stakater.com/reload
+	if container == nil && !autoReload {
+		return &containers[0]
+	}
+
 	return container
 }
 
-func updateContainers(upgradeFuncs callbacks.RollingUpgradeFuncs, item interface{}, config util.Config) constants.Result {
+func updateContainers(upgradeFuncs callbacks.RollingUpgradeFuncs, item interface{}, config util.Config, autoReload bool) constants.Result {
 	var result constants.Result
 	envar := constants.EnvVarPrefix + util.ConvertToEnvVarName(config.ResourceName) + "_" + config.Type
-	container := getContainerToUpdate(upgradeFuncs, item, config)
+	container := getContainerToUpdate(upgradeFuncs, item, config, autoReload)
 
 	if container == nil {
 		return constants.NoContainerFound