From f2d75becf717a8817bd3c2c681593ff001f8704a Mon Sep 17 00:00:00 2001 From: Lachlan Evenson Date: Wed, 21 Jun 2017 19:51:10 -0700 Subject: [PATCH] Update etcd-operator to latest release (#1248) * bump etcd and etcd-operator version and update notes * Update to latest operator Add ability to create rbac roles and bindings for clusters with rbac enabled Update helpers to provide 63 limit names * update documentation * change rbac default to off --- stable/etcd-operator/Chart.yaml | 3 +- stable/etcd-operator/README.md | 39 ++++++++++- stable/etcd-operator/templates/NOTES.txt | 6 +- stable/etcd-operator/templates/_helpers.tpl | 8 +-- .../etcd-operator/templates/deployment.yaml | 3 + stable/etcd-operator/templates/rbac.yaml | 65 +++++++++++++++++++ .../templates/service-account.yaml | 11 ++++ stable/etcd-operator/values.yaml | 9 ++- 8 files changed, 132 insertions(+), 12 deletions(-) create mode 100644 stable/etcd-operator/templates/rbac.yaml create mode 100644 stable/etcd-operator/templates/service-account.yaml diff --git a/stable/etcd-operator/Chart.yaml b/stable/etcd-operator/Chart.yaml index c5d7ff338f..91f3f17601 100755 --- a/stable/etcd-operator/Chart.yaml +++ b/stable/etcd-operator/Chart.yaml @@ -1,7 +1,8 @@ apiVersion: v1 description: CoreOS etcd-operator Helm chart for Kubernetes name: etcd-operator -version: 0.2.1 +version: 0.4.0 +appVersion: 0.3.2 home: https://github.com/coreos/etcd-operator icon: https://raw.githubusercontent.com/coreos/etcd/master/logos/etcd-horizontal-color.png sources: diff --git a/stable/etcd-operator/README.md b/stable/etcd-operator/README.md index 3953827c56..94fdb4f42e 100644 --- a/stable/etcd-operator/README.md +++ b/stable/etcd-operator/README.md @@ -53,7 +53,7 @@ The following tables lists the configurable parameters of the etcd-operator char | ------------------------------------------------- | -------------------------------------------------------------------- | ---------------------------------------------- | | `replicaCount` | Number of etcd-operator replicas to create (only 1 is supported) | `1` | | `image.repository` | etcd-operator container image | `quay.io/coreos/etcd-operator` | -| `image.tag` | etcd-operator container image tag | `v0.2.1` | +| `image.tag` | etcd-operator container image tag | `v0.3.2` | | `image.pullPolicy` | etcd-operator container image pull policy | `IfNotPresent` | | `resources.limits.cpu` | CPU limit per etcd-operator pod | `100m` | | `resources.limits.memory` | Memory limit per etcd-operator pod | `128Mi` | @@ -61,7 +61,7 @@ The following tables lists the configurable parameters of the etcd-operator char | `resources.requests.memory` | Memory request per etcd-operator pod | `128Mi` | | `cluster.enabled` | Whether to enable provisioning of an etcd-cluster | `false` | | `cluster.name` | etcd cluster name | `etcd-cluster` | -| `cluster.version` | etcd cluster version | `v3.1.2` | +| `cluster.version` | etcd cluster version | `v3.1.8` | | `cluster.size` | etcd cluster size | `3` | | `cluster.backup.enabled` | Whether to create PV for cluster backups | `false` | | `cluster.backup.provisioner` | Which PV provisioner to use | `kubernetes.io/gce-pd` (kubernetes.io/aws-ebs) | @@ -69,6 +69,8 @@ The following tables lists the configurable parameters of the etcd-operator char | `cluster.backup.config.maxSnapshot` | maximum number of snapshots to keep | `5` | | `cluster.backup.config.storageType` | Type of storage to provision | `PersistentVolume` | | `cluster.backup.config.pv.volumeSizeInMB` | size of backup PV | `512MB` | +| `rbac.install` | install required rbac service account, roles and rolebindings | `false` | +| `rbac.apiVersion` | rbac api version `v1alpha1|v1beta1` | `v1beta1` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example: @@ -82,3 +84,36 @@ installing the chart. For example: ```bash $ helm install --name my-release --values values.yaml stable/etcd-operator ``` + +## RBAC +By default the chart will not install the recommended RBAC roles and rolebindings. + +To determine if your cluster supports this running the following: + +```console +$ kubectl api-versions | grep rbac +``` + +You also need to have the following parameter on the api server. See the following document for how to enable [RBAC](https://kubernetes.io/docs/admin/authorization/rbac/) + +``` +--authorization-mode=RBAC +``` + +If the output contains "beta" or both "alpha" and "beta" you can may install with enabling the creating of rbac resources (see below). + +### Enable RBAC role/rolebinding creation + +To enable the creation of RBAC resources (On clusters with RBAC). Do the following: + +```console +$ helm install --name my-release stable/etcd-operator --set rbac.install=true +``` + +### Changing RBAC manifest apiVersion + +By default the RBAC resources are generated with the "v1beta1" apiVersion. To use "v1alpha1" do the following: + +```console +$ helm install --name my-release stable/etcd-operator --set rbac.install=true,rbac.apiVersion=v1alpha1 +``` diff --git a/stable/etcd-operator/templates/NOTES.txt b/stable/etcd-operator/templates/NOTES.txt index b37a0c216b..c703b0d90e 100644 --- a/stable/etcd-operator/templates/NOTES.txt +++ b/stable/etcd-operator/templates/NOTES.txt @@ -8,12 +8,12 @@ Not enabling cluster, the ThirdPartResource must be installed before you can cre 1. Watch etcd cluster start kubectl get pods -l etcd_cluster={{ .Values.cluster.name }} --namespace {{ .Release.Namespace }} -w 2. Confirm etcd cluster is healthy - $ kubectl run --rm -i --tty --env="ETCDCTL_API=3" --env="ETCDCTL_ENDPOINTS=http://{{ .Values.cluster.name }}-0000:2379" etcd-test --image quay.io/coreos/etcd --restart=Never -- /bin/sh -c 'watch -n1 "etcdctl member list"' + $ kubectl run --rm -i --tty --env="ETCDCTL_API=3" --env="ETCDCTL_ENDPOINTS=http://{{ .Values.cluster.name }}-client:2379" etcd-test --image quay.io/coreos/etcd --restart=Never -- /bin/sh -c 'watch -n1 "etcdctl member list"' 3. Interact with the cluster! $ kubectl run --rm -i --tty --env ETCDCTL_API=3 etcd-test --image quay.io/coreos/etcd --restart=Never -- /bin/sh - / # etcdctl --endpoints http://{{ .Values.cluster.name }}-0000:2379 put foo bar - / # etcdctl --endpoints http://{{ .Values.cluster.name }}-0000:2379 get foo + / # etcdctl --endpoints http://{{ .Values.cluster.name }}-client:2379 put foo bar + / # etcdctl --endpoints http://{{ .Values.cluster.name }}-client:2379 get foo OK (ctrl-D to exit) 4. Optional diff --git a/stable/etcd-operator/templates/_helpers.tpl b/stable/etcd-operator/templates/_helpers.tpl index 234480de71..308975b6f9 100644 --- a/stable/etcd-operator/templates/_helpers.tpl +++ b/stable/etcd-operator/templates/_helpers.tpl @@ -3,14 +3,14 @@ Expand the name of the chart. */}} {{- define "name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 24 -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} {{- end -}} {{/* Create a default fully qualified app name. -We truncate at 24 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "fullname" -}} {{- $name := default .Chart.Name .Values.nameOverride -}} -{{- printf "%s-%s" .Release.Name $name | trunc 24 -}} -{{- end -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} \ No newline at end of file diff --git a/stable/etcd-operator/templates/deployment.yaml b/stable/etcd-operator/templates/deployment.yaml index 9d02930792..598229f00c 100644 --- a/stable/etcd-operator/templates/deployment.yaml +++ b/stable/etcd-operator/templates/deployment.yaml @@ -17,6 +17,9 @@ spec: heritage: "{{ .Release.Service }}" release: "{{ .Release.Name }}" spec: +{{- if .Values.rbac.install }} + serviceAccountName: {{ template "fullname" . }} +{{- end }} containers: - name: {{ .Chart.Name }} image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" diff --git a/stable/etcd-operator/templates/rbac.yaml b/stable/etcd-operator/templates/rbac.yaml new file mode 100644 index 0000000000..12a53bec92 --- /dev/null +++ b/stable/etcd-operator/templates/rbac.yaml @@ -0,0 +1,65 @@ +{{ if .Values.rbac.install }} +{{- $serviceName := include "fullname" . -}} +apiVersion: rbac.authorization.k8s.io/{{ required "A valid .Values.rbac.apiVersion entry required!" .Values.rbac.apiVersion }} +kind: ClusterRole +metadata: + name: {{ $serviceName }} + labels: + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + app: "{{ template "fullname" . }}" + heritage: "{{ .Release.Service }}" + release: "{{ .Release.Name }}" +rules: +- apiGroups: + - etcd.coreos.com + resources: + - clusters + verbs: + - "*" +- apiGroups: + - extensions + resources: + - thirdpartyresources + verbs: + - "*" +- apiGroups: + - storage.k8s.io + resources: + - storageclasses + verbs: + - "*" +- apiGroups: + - "" + resources: + - pods + - services + - endpoints + - persistentvolumeclaims + - events + verbs: + - "*" +- apiGroups: + - apps + resources: + - deployments + verbs: + - "*" +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/{{ required "A valid .Values.rbac.apiVersion entry required!" .Values.rbac.apiVersion }} +metadata: + name: {{ $serviceName }} + labels: + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + app: "{{ template "fullname" . }}" + heritage: "{{ .Release.Service }}" + release: "{{ .Release.Name }}" +subjects: +- kind: ServiceAccount + name: {{ $serviceName }} + namespace: {{ .Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ $serviceName }} +{{ end }} \ No newline at end of file diff --git a/stable/etcd-operator/templates/service-account.yaml b/stable/etcd-operator/templates/service-account.yaml new file mode 100644 index 0000000000..30bb383e75 --- /dev/null +++ b/stable/etcd-operator/templates/service-account.yaml @@ -0,0 +1,11 @@ +{{ if .Values.rbac.install }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "fullname" . }} + labels: + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + app: "{{ template "fullname" . }}" + heritage: "{{ .Release.Service }}" + release: "{{ .Release.Name }}" +{{ end }} \ No newline at end of file diff --git a/stable/etcd-operator/values.yaml b/stable/etcd-operator/values.yaml index 01b06d408c..c8fbdb0853 100644 --- a/stable/etcd-operator/values.yaml +++ b/stable/etcd-operator/values.yaml @@ -4,7 +4,7 @@ replicaCount: 1 image: repository: quay.io/coreos/etcd-operator - tag: v0.2.1 + tag: v0.3.2 pullPolicy: IfNotPresent resources: limits: @@ -18,7 +18,7 @@ cluster: enabled: false name: etcd-cluster size: 3 - version: v3.1.2 + version: v3.1.8 backup: enabled: false ## Cloud specific PV provisioner @@ -31,3 +31,8 @@ cluster: storageType: PersistentVolume pv: volumeSizeInMB: 512 + +## Install Default RBAC roles and bindings +rbac: + install: false + apiVersion: v1beta1 \ No newline at end of file