diff --git a/stable/voyager/Chart.yaml b/stable/voyager/Chart.yaml index 440c8a5f6a..9b84612281 100755 --- a/stable/voyager/Chart.yaml +++ b/stable/voyager/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v1 description: 'Voyager by AppsCode - Secure Ingress Controller for Kubernetes' icon: https://cdn.appscode.com/images/icon/voyager.png name: voyager -version: 2.1.0 -appVersion: 5.0.0-rc.11 +version: 3.0.0 +appVersion: 6.0.0-rc.0 sources: - https://github.com/appscode/voyager maintainers: diff --git a/stable/voyager/README.md b/stable/voyager/README.md index 39e01d4354..08c983762a 100644 --- a/stable/voyager/README.md +++ b/stable/voyager/README.md @@ -14,7 +14,7 @@ This chart bootstraps an [ingress controller](https://github.com/appscode/voyage ## Prerequisites -- Kubernetes 1.7+ +- Kubernetes 1.8+ ## Installing the Chart To install the chart with the release name `my-release`: @@ -40,27 +40,27 @@ The command removes all the Kubernetes components associated with the chart and The following tables lists the configurable parameters of the Voyager chart and their default values. -| Parameter | Description | Default | -| --------------------------| ------------------------------------------------------------- | ------------------ | -| `operator.image` | Name of Voyager operator image | `appscode/voyager` | -| `operator.imageTag` | Tag of Voyager operator image | `5.0.0-rc.11` | -| `haproxy.image` | Name of HAProxy container image | `appscode/haproxy` | -| `haproxy.imageTag` | Tag of HAProxy container image | `1.7.9-5.0.0-rc.11` | -| `exporter.image` | Name of Prometheus exporter sidecar image | `appscode/voyager` | -| `exporter.imageTag` | Tag of Prometheus exporter sidecar image | `5.0.0-rc.11` | -| `imagePullSecrets` | Specify image pull secrets | `nil` (does not add image pull secrets to deployed pods) | -| `imagePullPolicy` | Image pull policy | `IfNotPresent` | -| `cloudProvider` | Name of cloud provider | `nil` | -| `cloudConfig` | Path to cloud config | `` | -| `criticalAddon` | If true, installs voyager operator as critical addon | `false` | -| `logLevel` | Log level for operator | `3` | -| `persistence.enabled` | Enable mounting cloud config | `false` | -| `persistence.hostPath` | Host mount path for cloud config | `/etc/kubernetes` | -| `nodeSelector` | Node labels for pod assignment | `{}` | -| `rbac.create` | install required rbac service account, roles and rolebindings | `false` | -| `rbac.serviceAccountName` | ServiceAccount Voyager will use (ignored if rbac.create=true) | `default` | -| `ingressClass` | Ingress class to watch for. If empty, it handles all ingress | `` | - +| Parameter | Description | Default | +| -----------------------------------| ------------------------------------------------------------- | ----------------------| +| `dockerRegistry` | Docker registry used to pull Voyager related images | `appscode` | +| `imageTags.voyager` | Tag of Voyager operator image | `6.0.0-rc.0` | +| `imageTags.haproxy` | Tag of HAProxy container image | `1.7.9-6.0.0-rc.0` | +| `imagePullSecrets` | Specify image pull secrets | `nil` (does not add image pull secrets to deployed pods) | +| `imagePullPolicy` | Image pull policy | `IfNotPresent` | +| `cloudProvider` | Name of cloud provider | `nil` | +| `cloudConfig` | Path to cloud config | `` | +| `criticalAddon` | If true, installs voyager operator as critical addon | `false` | +| `logLevel` | Log level for operator | `3` | +| `persistence.enabled` | Enable mounting cloud config | `false` | +| `persistence.hostPath` | Host mount path for cloud config | `/etc/kubernetes` | +| `nodeSelector` | Node labels for pod assignment | `{}` | +| `rbac.create` | install required rbac service account, roles and rolebindings | `false` | +| `rbac.serviceAccountName` | ServiceAccount Voyager will use (ignored if rbac.create=true) | `default` | +| `ingressClass` | Ingress class to watch for. If empty, it handles all ingress | `` | +| `apiserver.groupPriorityMinimum` | The minimum priority the group should have. | 10000 | +| `apiserver.versionPriority` | The ordering of this API inside of the group. | 15 | +| `apiserver.enableAdmissionWebhook` | Configure apiserver as adission webhooks for Voyager CRDs | false | +| `apiserver.ca` | CA certificate used by main Kubernetes api server | `` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example: diff --git a/stable/voyager/templates/apiregistration.yaml b/stable/voyager/templates/apiregistration.yaml new file mode 100644 index 0000000000..6fb6891ca4 --- /dev/null +++ b/stable/voyager/templates/apiregistration.yaml @@ -0,0 +1,79 @@ +{{- $ca := genCA "svc-cat-ca" 3650 }} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- $cn := printf "%s-%s" $name .Release.Name | trunc 63 -}} +{{- $altName1 := printf "%s.%s" $cn .Release.Namespace }} +{{- $altName2 := printf "%s.%s.svc" $cn .Release.Namespace }} +{{- $cert := genSignedCert $cn nil (list $altName1 $altName2) 3650 $ca }} +apiVersion: apiregistration.k8s.io/v1beta1 +kind: APIService +metadata: + name: v1beta1.admission.voyager.appscode.com + labels: + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + app: "{{ template "voyager.name" . }}" + heritage: "{{ .Release.Service }}" + release: "{{ .Release.Name }}" +spec: + group: admission.voyager.appscode.com + version: v1beta1 + service: + namespace: {{ .Release.Namespace }} + name: {{ template "voyager.fullname" . }} + caBundle: {{ b64enc $ca.Cert }} + groupPriorityMinimum: {{ .Values.apiserver.groupPriorityMinimum }} + versionPriority: {{ .Values.apiserver.versionPriority }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "voyager.fullname" . }}-apiserver-cert + labels: + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + app: "{{ template "voyager.name" . }}" + heritage: "{{ .Release.Service }}" + release: "{{ .Release.Name }}" +type: Opaque +data: + tls.crt: {{ b64enc $cert.Cert }} + tls.key: {{ b64enc $cert.Key }} +--- +{{ if .Values.rbac.create }} +# to read the config for terminating authentication +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ template "voyager.fullname" . }}-apiserver-extension-server-authentication-reader + namespace: kube-system + labels: + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + app: "{{ template "voyager.name" . }}" + heritage: "{{ .Release.Service }}" + release: "{{ .Release.Name }}" +roleRef: + kind: Role + apiGroup: rbac.authorization.k8s.io + name: extension-apiserver-authentication-reader +subjects: +- kind: ServiceAccount + name: {{ template "voyager.fullname" . }} + namespace: {{ .Release.Namespace }} +--- +# to delegate authentication and authorization +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "voyager.fullname" . }}-apiserver-auth-delegator + labels: + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + app: "{{ template "voyager.name" . }}" + heritage: "{{ .Release.Service }}" + release: "{{ .Release.Name }}" +roleRef: + kind: ClusterRole + apiGroup: rbac.authorization.k8s.io + name: system:auth-delegator +subjects: +- kind: ServiceAccount + name: {{ template "voyager.fullname" . }} + namespace: {{ .Release.Namespace }} +{{ end }} \ No newline at end of file diff --git a/stable/voyager/templates/cluster-role-binding.yaml b/stable/voyager/templates/cluster-role-binding.yaml index cec56a6ba9..f0b5e46661 100644 --- a/stable/voyager/templates/cluster-role-binding.yaml +++ b/stable/voyager/templates/cluster-role-binding.yaml @@ -1,5 +1,5 @@ {{ if .Values.rbac.create }} -apiVersion: rbac.authorization.k8s.io/v1beta1 +apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: {{ template "voyager.fullname" . }} diff --git a/stable/voyager/templates/cluster-role.yaml b/stable/voyager/templates/cluster-role.yaml index 2ad78d39a2..8804189f98 100644 --- a/stable/voyager/templates/cluster-role.yaml +++ b/stable/voyager/templates/cluster-role.yaml @@ -1,5 +1,5 @@ {{ if .Values.rbac.create }} -apiVersion: rbac.authorization.k8s.io/v1beta1 +apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: {{ template "voyager.fullname" . }} diff --git a/stable/voyager/templates/deployment.yaml b/stable/voyager/templates/deployment.yaml index d85a336ab9..f7f5db07fe 100644 --- a/stable/voyager/templates/deployment.yaml +++ b/stable/voyager/templates/deployment.yaml @@ -9,6 +9,10 @@ metadata: release: "{{ .Release.Name }}" spec: replicas: 1 + selector: + matchLabels: + app: "{{ template "voyager.name" . }}" + release: "{{ .Release.Name }}" template: metadata: labels: @@ -20,14 +24,14 @@ spec: {{- end }} spec: serviceAccountName: {{ if .Values.rbac.create }}{{ template "voyager.fullname" . }}{{ else }}"{{ .Values.rbac.serviceAccountName }}"{{ end }} + {{- if .Values.imagePullSecrets }} + imagePullSecrets: +{{ toYaml .Values.imagePullSecrets | indent 6 }} + {{- end }} containers: - - name: operator - image: {{ .Values.operator.image }}:{{ .Values.operator.imageTag }} + - name: voyager + image: {{ .Values.dockerRegistry }}/voyager:{{ .Values.imageTags.voyager }} imagePullPolicy: {{ .Values.imagePullPolicy }} - {{- if .Values.imagePullSecrets }} - imagePullSecrets: -{{ toYaml .Values.imagePullSecrets | indent 8 }} - {{- end }} args: - run - --cloud-provider={{ .Values.cloudProvider }} @@ -36,29 +40,44 @@ spec: - --rbac={{ .Values.rbac.create }} - --ingress-class={{ .Values.ingressClass }} - --operator-service={{ template "voyager.fullname" . }} - - --haproxy-image={{ .Values.haproxy.image }}:{{ .Values.haproxy.imageTag }} - - --exporter-sidecar-image={{ .Values.exporter.image }}:{{ .Values.exporter.imageTag }} + - --docker-registry={{ .Values.dockerRegistry }} + - --haproxy-image-tag={{ .Values.imageTags.haproxy }} + - --exporter-image-tag={{ .Values.imageTags.voyager }} + - --secure-port=8443 + - --audit-log-path=- + - --tls-cert-file=/var/serving-cert/tls.crt + - --tls-private-key-file=/var/serving-cert/tls.key ports: + - containerPort: 8443 - containerPort: 56790 - name: ops - protocol: TCP - containerPort: 56791 - name: acme - protocol: TCP -{{- if .Values.persistence.enabled }} + readinessProbe: + httpGet: + path: /healthz + port: 8443 + scheme: HTTPS volumeMounts: - - mountPath: {{ dir .Values.cloudConfig | quote }} - name: cloudconfig - readOnly: true - volumes: - - hostPath: - path: {{ .Values.persistence.hostPath | quote }} + - mountPath: /var/serving-cert + name: serving-cert +{{- if .Values.persistence.enabled }} + - mountPath: {{ dir .Values.cloudConfig | quote }} name: cloudconfig + readOnly: true +{{- end }} + volumes: + - name: serving-cert + secret: + defaultMode: 420 + secretName: {{ template "voyager.fullname" . }}-apiserver-cert +{{- if .Values.persistence.enabled }} + - hostPath: + path: {{ .Values.persistence.hostPath | quote }} + name: cloudconfig {{- end -}} {{- if and .Values.criticalAddon (eq .Release.Namespace "kube-system") }} tolerations: - - key: "CriticalAddonsOnly" - operator: "Exists" + - key: CriticalAddonsOnly + operator: Exists {{- end -}} {{- if .Values.nodeSelector }} nodeSelector: diff --git a/stable/voyager/templates/service.yaml b/stable/voyager/templates/service.yaml index 5c15d416d9..13026f0ed7 100644 --- a/stable/voyager/templates/service.yaml +++ b/stable/voyager/templates/service.yaml @@ -9,12 +9,18 @@ metadata: heritage: "{{ .Release.Service }}" spec: ports: + # Port used to expose admission webhook apiserver + - name: admission + port: 443 + targetPort: 8443 + # Port used to expose Prometheus metrics for the operator - name: ops port: 56790 - targetPort: ops + targetPort: 56790 + # Port used to respond to Let's Encrypt HTTP challenges - name: acme port: 56791 - targetPort: acme + targetPort: 56791 selector: app: "{{ template "voyager.name" . }}" release: "{{ .Release.Name }}" diff --git a/stable/voyager/templates/user-roles.yaml b/stable/voyager/templates/user-roles.yaml new file mode 100644 index 0000000000..cc58f3c90c --- /dev/null +++ b/stable/voyager/templates/user-roles.yaml @@ -0,0 +1,39 @@ +{{ if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: appscode:voyager:edit + labels: + rbac.authorization.k8s.io/aggregate-to-admin: "true" + rbac.authorization.k8s.io/aggregate-to-edit: "true" +rules: +- apiGroups: + - "voyager.appscode.com" + resources: + - "*" + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: appscode:voyager:view + labels: + rbac.authorization.k8s.io/aggregate-to-view: "true" +rules: +- apiGroups: + - "voyager.appscode.com" + resources: + - "*" + verbs: + - get + - list + - watch +{{ end }} diff --git a/stable/voyager/templates/validating-webhook-configuration.yaml b/stable/voyager/templates/validating-webhook-configuration.yaml new file mode 100644 index 0000000000..725c8973cb --- /dev/null +++ b/stable/voyager/templates/validating-webhook-configuration.yaml @@ -0,0 +1,39 @@ +{{- if .Values.apiserver.enableAdmissionWebhook }} +apiVersion: admissionregistration.k8s.io/v1beta1 +kind: ValidatingWebhookConfiguration +metadata: + name: admission.voyager.appscode.com + labels: + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + app: "{{ template "voyager.name" . }}" + heritage: "{{ .Release.Service }}" + release: "{{ .Release.Name }}" +webhooks: +- name: admission.voyager.appscode.com + clientConfig: + service: + namespace: default + name: kubernetes + path: /apis/admission.voyager.appscode.com/v1beta1/admissionreviews + caBundle: {{ b64enc .Values.apiserver.ca }} + rules: + - operations: + - CREATE + - UPDATE + apiGroups: + - voyager.appscode.com + apiVersions: + - "*" + resources: + - "*" + - operations: + - CREATE + - UPDATE + apiGroups: + - extensions + apiVersions: + - v1beta1 + resources: + - ingresses + failurePolicy: Fail +{{ end }} diff --git a/stable/voyager/values.yaml b/stable/voyager/values.yaml index 50d836046d..1f9b87abb6 100644 --- a/stable/voyager/values.yaml +++ b/stable/voyager/values.yaml @@ -1,17 +1,14 @@ ## ## Voyager chart configuration ## -operator: - image: appscode/voyager - imageTag: 5.0.0-rc.11 -## Docker image containing HAProxy binary -haproxy: - image: appscode/haproxy - imageTag: 1.7.9-5.0.0-rc.11 -## Docker image containing Prometheus exporter -exporter: - image: appscode/voyager - imageTag: 5.0.0-rc.11 +# Docker registry containing Voyager & HAProxy images +dockerRegistry: appscode +## Tags for Docker images +imageTags: + ## Docker image tag containing Voyager + voyager: 6.0.0-rc.0 + ## Docker image tag containing HAProxy binary + haproxy: 1.7.9-6.0.0-rc.0 ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. ## ref: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod @@ -51,3 +48,17 @@ rbac: # this flag can be set to 'voyager' to handle only ingress # with annotation kubernetes.io/ingress.class=voyager. ingressClass: + +apiserver: + # groupPriorityMinimum is the minimum priority the group should have. Please see + # https://github.com/kubernetes/kube-aggregator/blob/release-1.9/pkg/apis/apiregistration/v1beta1/types.go#L58-L64 + # for more information on proper values of this field. + groupPriorityMinimum: 10000 + # versionPriority is the ordering of this API inside of the group. Please see + # https://github.com/kubernetes/kube-aggregator/blob/release-1.9/pkg/apis/apiregistration/v1beta1/types.go#L66-L70 + # for more information on proper values of this field + versionPriority: 15 + # enableAdmissionWebhook is used to configure apiserver as ValidationWebhook for Voyager CRDs + enableAdmissionWebhook: false + # CA certificate used by main Kubernetes api server + ca: