github/deprecated-helm-charts
1
0
Fork 0
mirror of https://github.com/helm/charts.git synced 2026-08-23 22:37:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update Voyager chart to support RBAC (#2096)

Browse Source 
* Update Voyager chart to support RBAC

* Update values.yaml
This commit is contained in:
Tamal Saha
2017-10-14 19:44:57 +02:00
committed by Reinhard Nägele
parent 45cbad1318
commit 062f353bb0
9 changed files with 193 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stable/voyager/Chart.yaml
+3 -3
View File
@@ -1,9 +1,9 @@
apiVersion: v1
description: Voyager provides controller for Ingress and Certificates for Kubernetes developed by AppsCode.
description: 'Voyager by AppsCode - Secure Ingress Controller for Kubernetes'
icon: https://cdn.appscode.com/images/icon/voyager.png
name: voyager
version: 1.1.0
appVersion: 3.0.0
version: 1.2.0
appVersion: 3.2.1
sources:
- https://github.com/appscode/voyager
maintainers:
stable/voyager/README.md
+53 -15
View File
@@ -1,8 +1,9 @@
# Voyager
[Voyager](https://github.com/appscode/voyager) provides controller for Ingress and Certificates for Kubernetes developed by AppsCode.
[Voyager by AppsCode](https://github.com/appscode/voyager) - Secure Ingress Controller for Kubernetes
## TL;DR;
```bash
```console
$ helm install stable/voyager
```
@@ -17,7 +18,7 @@ This chart bootstraps an [ingress controller](https://github.com/appscode/voyage
## Installing the Chart
To install the chart with the release name `my-release`:
```bash
```console
$ helm install --name my-release stable/voyager
```
The command deploys Voyager Controller on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation.
@@ -28,7 +29,7 @@ The command deploys Voyager Controller on the Kubernetes cluster in the default
To uninstall/delete the `my-release`:
```bash
```console
$ helm delete my-release
```
@@ -39,14 +40,51 @@ The command removes all the Kubernetes components associated with the chart and
The following tables lists the configurable parameters of the Voyager chart and their default values.
| Parameter | Description | Default |
| ----------------------- | ---------------------------------- | -------------------- |
| `image` | Container image to run | `appscode/voyager` |
| `imageTag` | Image tag of container | `3.0.0` |
| `cloudProvider` | Name of cloud provider | `` |
| `cloudConfig` | Path to cloud config | `` |
| `logLevel` | Log level for operator | `3` |
| `persistence.enabled` | Enable mounting cloud config | `false` |
| `persistence.hostPath` | Host mount path for cloud config | `/etc/kubernetes` |
| `nodeSelector` | Node labels for pod assignment | `{}` |
`
| Parameter | Description | Default |
| --------------------------| ------------------------------------------------------------- | ------------------ |
| `image` | Container image to run | `appscode/voyager` |
| `imageTag` | Image tag of container | `3.2.1` |
| `cloudProvider` | Name of cloud provider | `nil` |
| `cloudConfig` | Path to cloud config | `nil` |
| `logLevel` | Log level for operator | `3` |
| `persistence.enabled` | Enable mounting cloud config | `false` |
| `persistence.hostPath` | Host mount path for cloud config | `/etc/kubernetes` |
| `nodeSelector` | Node labels for pod assignment | `{}` |
| `rbac.create` | install required rbac service account, roles and rolebindings | `false` |
| `rbac.serviceAccountName` | ServiceAccount Voyager will use (ignored if rbac.create=true) | `default` |
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example:
```console
$ helm install --name my-release --set image.tag=v0.2.1 stable/voyager
```
Alternatively, a YAML file that specifies the values for the parameters can be provided while
installing the chart. For example:
```console
$ helm install --name my-release --values values.yaml stable/voyager
```
## RBAC
By default the chart will not install the recommended RBAC roles and rolebindings.
You need to have the flag `--authorization-mode=RBAC` on the api server. See the following document for how to enable [RBAC](https://kubernetes.io/docs/admin/authorization/rbac/).
To determine if your cluster supports RBAC, run the the following command:
```console
$ kubectl api-versions | grep rbac
```
If the output contains "beta", you may install the chart with RBAC enabled (see below).
### Enable RBAC role/rolebinding creation
To enable the creation of RBAC resources (On clusters with RBAC). Do the following:
```console
$ helm install --name my-release stable/voyager --set rbac.create=true
```
stable/voyager/templates/cluster-role-binding.yaml
+19
View File
@@ -0,0 +1,19 @@
{{ if .Values.rbac.create }}
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: {{ template "fullname" . }}
labels:
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
app: "{{ template "name" . }}"
heritage: "{{ .Release.Service }}"
release: "{{ .Release.Name }}"
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{ template "fullname" . }}
subjects:
- kind: ServiceAccount
name: {{ template "fullname" . }}
namespace: {{ .Release.Namespace }}
{{ end }}
stable/voyager/templates/cluster-role.yaml
+69
View File
@@ -0,0 +1,69 @@
{{ if .Values.rbac.create }}
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: {{ template "fullname" . }}
labels:
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
app: "{{ template "name" . }}"
heritage: "{{ .Release.Service }}"
release: "{{ .Release.Name }}"
rules:
- apiGroups:
- extensions
resources:
- thirdpartyresources
verbs: ["get", "create", "list"]
- apiGroups:
- voyager.appscode.com
resources: ["*"]
verbs: ["*"]
- apiGroups:
- monitoring.coreos.com
resources:
- servicemonitors
verbs: ["get", "create", "update"]
- apiGroups:
- extensions
resources:
- deployments
- daemonsets
- ingresses
verbs: ["*"]
- apiGroups: [""]
resources:
- replicationcontrollers
- services
- endpoints
- configmaps
verbs: ["*"]
- apiGroups: [""]
resources:
- secrets
verbs: ["get", "list", "watch", "create", "update"]
- apiGroups: [""]
resources:
- namespaces
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources:
- events
verbs: ["create"]
- apiGroups: [""]
resources:
- pods
verbs: ["list", "watch", "delete"]
- apiGroups: [""]
resources:
- nodes
verbs: ["list", "watch", "get"]
- apiGroups: [""]
resources:
- serviceaccounts
verbs: ["get", "create", "delete"]
- apiGroups: ["rbac.authorization.k8s.io"]
resources:
- roles
- rolebindings
verbs: ["get", "create", "delete"]
{{ end }}
stable/voyager/templates/deployment.yaml
+12 -19
View File
@@ -1,37 +1,30 @@
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
labels:
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
app: {{ template "name" . }}
name: {{ template "fullname" . }}
labels:
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
app: "{{ template "name" . }}"
heritage: "{{ .Release.Service }}"
release: "{{ .Release.Name }}"
spec:
replicas: 1
selector:
matchLabels:
app: {{ template "name" . }}
release: {{ .Release.Name }}
template:
metadata:
labels:
app: {{ template "name" . }}
release: {{ .Release.Name }}
app: "{{ template "name" . }}"
release: "{{ .Release.Name }}"
spec:
serviceAccountName: {{ if .Values.rbac.create }}{{ template "fullname" . }}{{ else }}"{{ .Values.rbac.serviceAccountName }}"{{ end }}
containers:
- args:
- name: operator
image: {{ .Values.image }}:{{ .Values.imageTag }}
args:
- run
- --cloud-provider={{ .Values.cloudProvider }}
- --cloud-config={{ .Values.cloudConfig }}
- --v={{ .Values.logLevel }}
image: "{{ .Values.image }}:{{ .Values.imageTag }}"
name: voyager
env:
- name: OPERATOR_SERVICE_ACCOUNT
valueFrom:
fieldRef:
fieldPath: spec.serviceAccountName
- --rbac={{ .Values.rbac.create }}
ports:
- containerPort: 56790
name: http
stable/voyager/templates/service-account.yaml
+11
View File
@@ -0,0 +1,11 @@
{{ if .Values.rbac.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ template "fullname" . }}
labels:
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
app: "{{ template "name" . }}"
heritage: "{{ .Release.Service }}"
release: "{{ .Release.Name }}"
{{ end }}
stable/voyager/templates/service.yaml
+17
View File
@@ -0,0 +1,17 @@
apiVersion: v1
kind: Service
metadata:
name: {{ template "fullname" . }}
labels:
app: "{{ template "name" . }}"
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
spec:
ports:
- name: http
port: 56790
targetPort: http
selector:
app: "{{ template "name" . }}"
release: "{{ .Release.Name }}"
stable/voyager/templates/svc.yaml
-17
View File
@@ -1,17 +0,0 @@
apiVersion: v1
kind: Service
metadata:
labels:
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
app: {{ template "name" . }}
name: {{ template "fullname" . }}
spec:
ports:
- name: http
port: 56790
targetPort: http
selector:
app: {{ template "name" . }}
release: {{ .Release.Name }}
stable/voyager/values.yaml
+9 -2
View File
@@ -2,9 +2,9 @@
## Voyager chart configuration
##
image: appscode/voyager
imageTag: 3.0.0
imageTag: 3.2.1
## Use cloud provider here. Read details https://github.com/appscode/voyager/blob/master/docs/user-guide/README.md
cloudProvider: cloud_provider
cloudProvider:
## The path to the cloud provider configuration file. Empty string for no configuration file.
## ie. for azure use /etc/kubernetes/azure.json
# cloudConfig: /etc/kubernetes/azure.json
@@ -18,3 +18,10 @@ persistence:
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
##
nodeSelector: {}
## Install Default RBAC roles and bindings
rbac:
## If true, create & use RBAC resources
create: false
## Ignored if rbac.create is true
serviceAccountName: default