Compare commits

...

19 Commits

Author SHA1 Message Date
stakater-user
80a7f1ee9f [skip-ci] Update artifacts 2023-02-26 15:15:01 +00:00
Faizan Ahmad
fdc99f8dd3 Merge pull request #398 from yu-croco/add-fullname-override-on-values
[helm] Add nameOverride and fullnameOverride explicitly on values.yaml
2023-02-26 15:55:31 +01:00
yu-croco
d660f9dbdf Merge branch 'master' into add-fullname-override-on-values 2023-02-26 22:45:11 +09:00
yu-croco
ad03e5830d chore: Add nameOverride and fullnameOverride explicitly on values.yaml
Signed-off-by: yu-croco <yu.croco@gmail.com>
2023-02-26 22:42:17 +09:00
stakater-user
032c391cb8 [skip-ci] Update artifacts 2023-02-26 12:43:03 +00:00
Faizan Ahmad
9173f446ab Merge pull request #396 from stakater/update-push-workflow
Remove outdated manifests
2023-02-26 13:23:25 +01:00
stakater-user
f795fa2aec [skip-ci] Update artifacts 2023-02-26 12:07:53 +00:00
Faizan Ahmad
34c1f389bc Merge pull request #393 from stakater/dependabot/go_modules/golang.org/x/net-0.7.0
Bump golang.org/x/net from 0.5.0 to 0.7.0
2023-02-26 12:48:16 +01:00
stakater-user
fdc8a61fc6 [skip-ci] Update artifacts 2023-02-26 11:35:45 +00:00
Faizan Ahmad
c7f507a4b9 Merge pull request #386 from d3adb5/feat/set-rootfs-ro
feat: set read-only root filesystem at container level
2023-02-26 12:16:42 +01:00
stakater-user
70aef8a871 [skip-ci] Update artifacts 2023-02-26 10:59:11 +00:00
Faizan Ahmad
54d0681340 Merge pull request #385 from d3adb5/chore/stop-listening-on-9091
chore: listen on only 9090 for /metrics and /live
2023-02-26 11:39:45 +01:00
MahnoorAsghar
b279aabae3 Remove changes from push workflow 2023-02-24 13:50:48 +05:00
MahnoorAsghar
63022fe4d0 Remove optional manifests which are outdated 2023-02-24 13:48:38 +05:00
MahnoorAsghar
8c4523db69 update push workflow to render manifests correctly 2023-02-22 16:45:43 +05:00
dependabot[bot]
646c64a326 Bump golang.org/x/net from 0.5.0 to 0.7.0
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.5.0 to 0.7.0.
- [Release notes](https://github.com/golang/net/releases)
- [Commits](https://github.com/golang/net/compare/v0.5.0...v0.7.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-02-18 04:14:25 +00:00
d3adb5
5a9ccbf01f fix: properly capitalize 'filesystem' in values
Use the proper capitalization in the reference to the value
reloader.readOnlyRootFileSystem: FileSystem instead of Filesystem.
2023-02-08 14:15:28 -08:00
d3adb5
451e4f636b feat: set read-only root filesystem at container level
Change the securityContext field of the Reloader container if
reloader.readOnlyFilesystem is set to true. The change takes effect even
if not container securityContext is defined.

Closes #339.
2023-02-07 00:16:16 -08:00
d3adb5
2f8999e3cb chore: listen on only 9090 for /metrics and /live
Previously, 9091 and 9090 both led to the same web server, meaning both
/metrics and /live were reachable and fully functional through both.
This commit changes that so that only port 9090 is used for both.

Closes #381.
2023-02-07 00:15:17 -08:00
23 changed files with 118 additions and 85 deletions

View File

@@ -45,7 +45,7 @@ jobs:
version: v1.51.1
only-new-issues: false
args: --timeout 10m
- name: Install kubectl
run: |
curl -LO "https://storage.googleapis.com/kubernetes-release/release/v${KUBERNETES_VERSION}/bin/linux/amd64/kubectl"
@@ -108,7 +108,7 @@ jobs:
org.opencontainers.image.source=${{ github.event.repository.clone_url }}
org.opencontainers.image.created=${{ steps.prep.outputs.created }}
org.opencontainers.image.revision=${{ github.sha }}
##############################
## Add steps to generate required artifacts for a release here(helm chart, operator manifest etc.)
##############################
@@ -148,16 +148,16 @@ jobs:
linting: on
commit_username: stakater-user
commit_email: stakater@gmail.com
# Commit back changes
- name: Commit files
run: |
git config --local user.email "stakater@gmail.com"
git config --local user.name "stakater-user"
git status
git status
git add .
git commit -m "[skip-ci] Update artifacts" -a
- name: Push changes
uses: ad-m/github-push-action@master
with:

View File

@@ -3,8 +3,8 @@
apiVersion: v1
name: reloader
description: Reloader chart that runs on kubernetes
version: v1.0.5
appVersion: v1.0.5
version: v1.0.10
appVersion: v1.0.10
keywords:
- Reloader
- kubernetes

View File

@@ -38,8 +38,8 @@ rules:
resources:
- namespaces
verbs:
- get
{{- end }}
- get
{{- end }}
{{- if and (.Capabilities.APIVersions.Has "apps.openshift.io/v1") (.Values.reloader.isOpenshift) }}
- apiGroups:
- "apps.openshift.io"

View File

@@ -128,8 +128,6 @@ spec:
ports:
- name: http
containerPort: 9091
- name: metrics
containerPort: 9090
livenessProbe:
httpGet:
@@ -142,15 +140,19 @@ spec:
readinessProbe:
httpGet:
path: /metrics
port: metrics
port: http
timeoutSeconds: {{ .Values.reloader.deployment.readinessProbe.timeoutSeconds | default "5" }}
failureThreshold: {{ .Values.reloader.deployment.readinessProbe.failureThreshold | default "5" }}
periodSeconds: {{ .Values.reloader.deployment.readinessProbe.periodSeconds | default "10" }}
successThreshold: {{ .Values.reloader.deployment.readinessProbe.successThreshold | default "1" }}
{{- with .Values.reloader.deployment.containerSecurityContext }}
securityContext: {{ toYaml . | nindent 10 }}
{{- end }}
{{- $containerSecurityContext := .Values.reloader.deployment.containerSecurityContext | default dict }}
{{- if .Values.reloader.readOnlyRootFileSystem }}
{{- $_ := set $containerSecurityContext "readOnlyRootFilesystem" true }}
{{- end }}
securityContext:
{{- toYaml $containerSecurityContext | nindent 10 }}
{{- if eq .Values.reloader.readOnlyRootFileSystem true }}
volumeMounts:

View File

@@ -0,0 +1,50 @@
suite: Deployment
templates:
- deployment.yaml
tests:
- it: sets readOnlyRootFilesystem in container securityContext when reloader.readOnlyRootFileSystem is true
set:
reloader:
readOnlyRootFileSystem: true
deployment:
containerSecurityContext:
readOnlyRootFilesystem: false
asserts:
- equal:
path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
value: true
- it: sets readOnlyRootFilesystem in container securityContext even if reloader.deployment.containerSecurityContext is null
set:
reloader:
readOnlyRootFileSystem: true
deployment:
containerSecurityContext: null
asserts:
- equal:
path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
value: true
- it: does not override readOnlyRootFilesystem in container securityContext based on reloader.readOnlyRootFileSystem
set:
reloader:
readOnlyRootFileSystem: false
deployment:
containerSecurityContext:
readOnlyRootFilesystem: true
asserts:
- equal:
path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
value: true
- it: template is still valid with no defined containerSecurityContext
set:
reloader:
readOnlyRootFileSystem: false
deployment:
containerSecurityContext: null
asserts:
- isEmpty:
path: spec.template.spec.containers[0].securityContext

View File

@@ -8,6 +8,9 @@ global:
kubernetes:
host: https://kubernetes.default
nameOverride: ""
fullnameOverride: ""
reloader:
isArgoRollouts: false
isOpenshift: false
@@ -66,10 +69,10 @@ reloader:
labels:
provider: stakater
group: com.stakater.platform
version: v1.0.5
version: v1.0.10
image:
name: stakater/reloader
tag: v1.0.5
tag: v1.0.10
pullPolicy: IfNotPresent
# Support for extra environment variables.
env:

View File

@@ -4,7 +4,5 @@ kind: Kustomization
resources:
- manifests/clusterrole.yaml
- manifests/clusterrolebinding.yaml
- manifests/role.yaml
- manifests/rolebinding.yaml
- manifests/serviceaccount.yaml
- manifests/deployment.yaml
- manifests/deployment.yaml

View File

@@ -9,7 +9,7 @@ metadata:
meta.helm.sh/release-name: "reloader"
labels:
app: reloader-reloader
chart: "reloader-v1.0.5"
chart: "reloader-v1.0.10"
release: "reloader"
heritage: "Helm"
app.kubernetes.io/managed-by: "Helm"

View File

@@ -9,7 +9,7 @@ metadata:
meta.helm.sh/release-name: "reloader"
labels:
app: reloader-reloader
chart: "reloader-v1.0.5"
chart: "reloader-v1.0.10"
release: "reloader"
heritage: "Helm"
app.kubernetes.io/managed-by: "Helm"

View File

@@ -8,13 +8,13 @@ metadata:
meta.helm.sh/release-name: "reloader"
labels:
app: reloader-reloader
chart: "reloader-v1.0.5"
chart: "reloader-v1.0.10"
release: "reloader"
heritage: "Helm"
app.kubernetes.io/managed-by: "Helm"
group: com.stakater.platform
provider: stakater
version: v1.0.5
version: v1.0.10
name: reloader-reloader
namespace: default
spec:
@@ -28,23 +28,21 @@ spec:
metadata:
labels:
app: reloader-reloader
chart: "reloader-v1.0.5"
chart: "reloader-v1.0.10"
release: "reloader"
heritage: "Helm"
app.kubernetes.io/managed-by: "Helm"
group: com.stakater.platform
provider: stakater
version: v1.0.5
version: v1.0.10
spec:
containers:
- image: "stakater/reloader:v1.0.5"
- image: "stakater/reloader:v1.0.10"
imagePullPolicy: IfNotPresent
name: reloader-reloader
ports:
- name: http
containerPort: 9091
- name: metrics
containerPort: 9090
livenessProbe:
httpGet:
@@ -57,11 +55,14 @@ spec:
readinessProbe:
httpGet:
path: /metrics
port: metrics
port: http
timeoutSeconds: 5
failureThreshold: 5
periodSeconds: 10
successThreshold: 1
securityContext:
{}
securityContext:
runAsNonRoot: true
runAsUser: 65534

View File

@@ -1,3 +0,0 @@
---
# Source: reloader/templates/podmonitor.yaml

View File

@@ -1,4 +0,0 @@
---
# Source: reloader/templates/role.yaml

View File

@@ -1,4 +0,0 @@
---
# Source: reloader/templates/rolebinding.yaml

View File

@@ -1,4 +0,0 @@
---
# Source: reloader/templates/service.yaml

View File

@@ -8,7 +8,7 @@ metadata:
meta.helm.sh/release-name: "reloader"
labels:
app: reloader-reloader
chart: "reloader-v1.0.5"
chart: "reloader-v1.0.10"
release: "reloader"
heritage: "Helm"
app.kubernetes.io/managed-by: "Helm"

View File

@@ -1,4 +0,0 @@
---
# Source: reloader/templates/servicemonitor.yaml

View File

@@ -8,7 +8,7 @@ metadata:
meta.helm.sh/release-name: "reloader"
labels:
app: reloader-reloader
chart: "reloader-v1.0.5"
chart: "reloader-v1.0.10"
release: "reloader"
heritage: "Helm"
app.kubernetes.io/managed-by: "Helm"
@@ -25,7 +25,7 @@ metadata:
meta.helm.sh/release-name: "reloader"
labels:
app: reloader-reloader
chart: "reloader-v1.0.5"
chart: "reloader-v1.0.10"
release: "reloader"
heritage: "Helm"
app.kubernetes.io/managed-by: "Helm"
@@ -80,7 +80,7 @@ metadata:
meta.helm.sh/release-name: "reloader"
labels:
app: reloader-reloader
chart: "reloader-v1.0.5"
chart: "reloader-v1.0.10"
release: "reloader"
heritage: "Helm"
app.kubernetes.io/managed-by: "Helm"
@@ -104,13 +104,13 @@ metadata:
meta.helm.sh/release-name: "reloader"
labels:
app: reloader-reloader
chart: "reloader-v1.0.5"
chart: "reloader-v1.0.10"
release: "reloader"
heritage: "Helm"
app.kubernetes.io/managed-by: "Helm"
group: com.stakater.platform
provider: stakater
version: v1.0.5
version: v1.0.10
name: reloader-reloader
namespace: default
spec:
@@ -124,23 +124,21 @@ spec:
metadata:
labels:
app: reloader-reloader
chart: "reloader-v1.0.5"
chart: "reloader-v1.0.10"
release: "reloader"
heritage: "Helm"
app.kubernetes.io/managed-by: "Helm"
group: com.stakater.platform
provider: stakater
version: v1.0.5
version: v1.0.10
spec:
containers:
- image: "stakater/reloader:v1.0.5"
- image: "stakater/reloader:v1.0.10"
imagePullPolicy: IfNotPresent
name: reloader-reloader
ports:
- name: http
containerPort: 9091
- name: metrics
containerPort: 9090
livenessProbe:
httpGet:
@@ -153,11 +151,14 @@ spec:
readinessProbe:
httpGet:
path: /metrics
port: metrics
port: http
timeoutSeconds: 5
failureThreshold: 5
periodSeconds: 10
successThreshold: 1
securityContext:
{}
securityContext:
runAsNonRoot: true
runAsUser: 65534

8
go.mod
View File

@@ -47,11 +47,11 @@ require (
github.com/prometheus/procfs v0.9.0 // indirect
github.com/smartystreets/goconvey v1.7.2 // indirect
github.com/spf13/pflag v1.0.5 // indirect
golang.org/x/net v0.5.0 // indirect
golang.org/x/net v0.7.0 // indirect
golang.org/x/oauth2 v0.4.0 // indirect
golang.org/x/sys v0.4.0 // indirect
golang.org/x/term v0.4.0 // indirect
golang.org/x/text v0.6.0 // indirect
golang.org/x/sys v0.5.0 // indirect
golang.org/x/term v0.5.0 // indirect
golang.org/x/text v0.7.0 // indirect
golang.org/x/time v0.3.0 // indirect
google.golang.org/appengine v1.6.7 // indirect
google.golang.org/protobuf v1.28.1 // indirect

16
go.sum
View File

@@ -352,8 +352,8 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY
golang.org/x/net v0.0.0-20210224082022-3d97a244fca7/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
golang.org/x/net v0.5.0 h1:GyT4nK/YDHSqa1c4753ouYCDajOYKTja9Xb/OHtgvSw=
golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g=
golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -398,13 +398,13 @@ golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7w
golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.4.0 h1:Zr2JFtRQNX3BCZ8YtxRE9hNJYC8J6I1MVbMg6owUp18=
golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU=
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.4.0 h1:O7UWfv5+A2qiuulQk30kVinPoMtoIPeVaKLEgLpVkvg=
golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
golang.org/x/term v0.5.0 h1:n2a8QNdAb0sZNpU9R1ALUXBbY+w51fCQDN+7EdxNBsY=
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -413,8 +413,8 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.6.0 h1:3XmdazWV+ubf7QgHSTWeykHOci5oeekaGJBLkrkaw4k=
golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
golang.org/x/text v0.7.0 h1:4BRB4x83lYWy72KwLD/qYDuTu7q9PjSagHvijDw7cLo=
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=

View File

@@ -4,6 +4,7 @@ import (
"context"
"errors"
"fmt"
"net/http"
"os"
"strings"
@@ -177,7 +178,8 @@ func startReloader(cmd *cobra.Command, args []string) {
go leadership.RunLeaderElection(lock, ctx, cancel, podName, controllers)
}
logrus.Fatal(leadership.Healthz())
leadership.SetupLivenessEndpoint()
logrus.Fatal(http.ListenAndServe(constants.DefaultHttpListenAddr, nil))
}
func getIgnoredNamespacesList(cmd *cobra.Command) (util.List, error) {

View File

@@ -1,6 +1,9 @@
package constants
const (
// DefaultHttpListenAddr is the default listening address for global http server
DefaultHttpListenAddr = ":9090"
// ConfigmapEnvVarPostfix is a postfix for configmap envVar
ConfigmapEnvVarPostfix = "CONFIGMAP"
// SecretEnvVarPostfix is a postfix for secret envVar

View File

@@ -15,8 +15,6 @@ import (
coordinationv1 "k8s.io/client-go/kubernetes/typed/coordination/v1"
)
const healthPort string = ":9091"
var (
// Used for liveness probe
m sync.Mutex
@@ -88,12 +86,11 @@ func stopControllers(stopChannels []chan struct{}) {
}
}
// Healthz serves the liveness probe endpoint. If leadership election is
// Healthz sets up the liveness probe endpoint. If leadership election is
// enabled and a replica stops leading the liveness probe will fail and the
// kubelet will restart the container.
func Healthz() error {
func SetupLivenessEndpoint() {
http.HandleFunc("/live", healthz)
return http.ListenAndServe(healthPort, nil)
}
func healthz(w http.ResponseWriter, req *http.Request) {

View File

@@ -3,7 +3,6 @@ package metrics
import (
"github.com/prometheus/client_golang/prometheus"
"github.com/prometheus/client_golang/prometheus/promhttp"
"github.com/sirupsen/logrus"
"net/http"
)
@@ -33,11 +32,7 @@ func NewCollectors() Collectors {
func SetupPrometheusEndpoint() Collectors {
collectors := NewCollectors()
prometheus.MustRegister(collectors.Reloaded)
go func() {
http.Handle("/metrics", promhttp.Handler())
logrus.Fatal(http.ListenAndServe(":9090", nil))
}()
http.Handle("/metrics", promhttp.Handler())
return collectors
}