diff --git a/deploy/kubernetes/helm/charts/hauler/.helmignore b/deploy/kubernetes/helm/charts/hauler/.helmignore new file mode 100644 index 0000000..5df8cd4 --- /dev/null +++ b/deploy/kubernetes/helm/charts/hauler/.helmignore @@ -0,0 +1,21 @@ +# HELM IGNORE OPTIONS: +# Patterns to ignore when building Helm packages. +# Supports shell glob matching, relative path matching, and negation (prefixed with !) + +.DS_Store +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +*.swp +*.bak +*.tmp +*.orig +*~ +.project +.idea/ +*.tmproj +.vscode/ diff --git a/deploy/kubernetes/helm/charts/hauler/Chart.yaml b/deploy/kubernetes/helm/charts/hauler/Chart.yaml new file mode 100644 index 0000000..76d38a1 --- /dev/null +++ b/deploy/kubernetes/helm/charts/hauler/Chart.yaml @@ -0,0 +1,7 @@ +apiVersion: v2 +name: hauler +description: Hauler Helm Chart for Kubernetes +icon: https://raw.githubusercontent.com/rancherfederal/hauler/main/static/rgs-hauler-logo-icon.svg +type: application +version: 0.1.0 +appVersion: 1.0.2 diff --git a/deploy/kubernetes/helm/charts/hauler/templates/_helpers.tpl b/deploy/kubernetes/helm/charts/hauler/templates/_helpers.tpl new file mode 100644 index 0000000..00ffbfd --- /dev/null +++ b/deploy/kubernetes/helm/charts/hauler/templates/_helpers.tpl @@ -0,0 +1,62 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "hauler.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "hauler.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "hauler.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "hauler.labels" -}} +helm.sh/chart: {{ include "hauler.chart" . }} +{{ include "hauler.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "hauler.selectorLabels" -}} +app.kubernetes.io/name: {{ include "hauler.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "hauler.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "hauler.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/deploy/kubernetes/helm/charts/hauler/templates/hauler-fileserver/hauler-fileserver-deployment.yaml b/deploy/kubernetes/helm/charts/hauler/templates/hauler-fileserver/hauler-fileserver-deployment.yaml new file mode 100644 index 0000000..b0c8719 --- /dev/null +++ b/deploy/kubernetes/helm/charts/hauler/templates/hauler-fileserver/hauler-fileserver-deployment.yaml @@ -0,0 +1,70 @@ +{{- if .Values.haulerFileserver.enabled }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: hauler-fileserver + namespace: {{ .Release.Namespace }} + labels: + {{- include "hauler.labels" . | nindent 4 }} +spec: + replicas: 1 + selector: + matchLabels: + app: hauler-fileserver + {{- include "hauler.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + app: hauler-fileserver + {{- include "hauler.selectorLabels" . | nindent 8 }} + spec: + initContainers: + - name: wait-for-hauler-hauls-job + image: {{ .Values.hauler.initContainers.image.repository }}:{{ .Values.hauler.initContainers.image.tag }} + imagePullPolicy: {{ .Values.hauler.initContainers.imagePullPolicy }} + args: ["wait", "--for=condition=complete", "job", "hauler-hauls-job", "--namespace", "{{ .Release.Namespace }}", "--timeout={{ .Values.hauler.initContainers.timeout }}"] + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + runAsNonRoot: true + runAsUser: 1001 + seccompProfile: + type: RuntimeDefault + - name: wait-for-hauler-manifests-job + image: {{ .Values.hauler.initContainers.image.repository }}:{{ .Values.hauler.initContainers.image.tag }} + imagePullPolicy: {{ .Values.hauler.initContainers.imagePullPolicy }} + args: ["wait", "--for=condition=complete", "job", "hauler-manifests-job", "--namespace", "{{ .Release.Namespace }}", "--timeout={{ .Values.hauler.initContainers.timeout }}"] + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + runAsNonRoot: true + runAsUser: 1001 + seccompProfile: + type: RuntimeDefault + containers: + - name: hauler-fileserver + image: {{ .Values.hauler.image.repository }}:{{ .Values.hauler.image.tag }} + imagePullPolicy: {{ .Values.hauler.imagePullPolicy }} + args: ["store", "serve", "fileserver"] + ports: + - containerPort: {{ .Values.haulerFileserver.service.ports.port }} + volumeMounts: + - name: hauler-data + mountPath: /store + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + runAsNonRoot: true + runAsUser: 1001 + seccompProfile: + type: RuntimeDefault + restartPolicy: Always + serviceAccountName: hauler-service-account + volumes: + - name: hauler-data + persistentVolumeClaim: + claimName: hauler-data +{{- end }} diff --git a/deploy/kubernetes/helm/charts/hauler/templates/hauler-fileserver/hauler-fileserver-ingress.yaml b/deploy/kubernetes/helm/charts/hauler/templates/hauler-fileserver/hauler-fileserver-ingress.yaml new file mode 100644 index 0000000..2e1b49a --- /dev/null +++ b/deploy/kubernetes/helm/charts/hauler/templates/hauler-fileserver/hauler-fileserver-ingress.yaml @@ -0,0 +1,30 @@ +{{- if and .Values.haulerFileserver.enabled .Values.haulerFileserver.ingress.enabled }} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: hauler-fileserver + labels: + {{- include "hauler.labels" . | nindent 4 }} +spec: + rules: + {{- range .Values.haulerFileserver.ingress.hosts }} + - host: {{ . }} + http: + paths: + - backend: + service: + name: hauler-fileserver + port: + number: 8080 + path: / + pathType: Prefix + {{- end }} + {{- if .Values.haulerFileserver.ingress.tls.enabled }} + tls: + - hosts: + {{- range .Values.haulerFileserver.ingress.hosts }} + - {{ . }} + {{- end }} + secretName: {{ .Values.haulerFileserver.ingress.tls.secretName }} + {{- end }} +{{- end }} diff --git a/deploy/kubernetes/helm/charts/hauler/templates/hauler-fileserver/hauler-fileserver-service.yaml b/deploy/kubernetes/helm/charts/hauler/templates/hauler-fileserver/hauler-fileserver-service.yaml new file mode 100644 index 0000000..741bddc --- /dev/null +++ b/deploy/kubernetes/helm/charts/hauler/templates/hauler-fileserver/hauler-fileserver-service.yaml @@ -0,0 +1,17 @@ +{{- if and .Values.haulerFileserver.enabled .Values.haulerFileserver.service.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: hauler-fileserver + labels: + {{- include "hauler.labels" . | nindent 4 }} +spec: + selector: + app: hauler-fileserver + ports: + - name: {{ .Values.haulerFileserver.service.ports.name }} + protocol: {{ .Values.haulerFileserver.service.ports.protocol }} + port: {{ .Values.haulerFileserver.service.ports.port }} + targetPort: {{ .Values.haulerFileserver.service.ports.targetPort }} + type: {{ .Values.haulerFileserver.service.type }} +{{- end }} diff --git a/deploy/kubernetes/helm/charts/hauler/templates/hauler-registry/hauler-registry-deployment.yaml b/deploy/kubernetes/helm/charts/hauler/templates/hauler-registry/hauler-registry-deployment.yaml new file mode 100644 index 0000000..3e0a31a --- /dev/null +++ b/deploy/kubernetes/helm/charts/hauler/templates/hauler-registry/hauler-registry-deployment.yaml @@ -0,0 +1,70 @@ +{{- if .Values.haulerRegistry.enabled }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: hauler-registry + namespace: {{ .Release.Namespace }} + labels: + {{- include "hauler.labels" . | nindent 4 }} +spec: + replicas: 1 + selector: + matchLabels: + app: hauler-registry + {{- include "hauler.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + app: hauler-registry + {{- include "hauler.selectorLabels" . | nindent 8 }} + spec: + initContainers: + - name: wait-for-hauler-hauls-job + image: {{ .Values.hauler.initContainers.image.repository }}:{{ .Values.hauler.initContainers.image.tag }} + imagePullPolicy: {{ .Values.hauler.initContainers.imagePullPolicy }} + args: ["wait", "--for=condition=complete", "job", "hauler-hauls-job", "--namespace", "{{ .Release.Namespace }}", "--timeout={{ .Values.hauler.initContainers.timeout }}"] + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + runAsNonRoot: true + runAsUser: 1001 + seccompProfile: + type: RuntimeDefault + - name: wait-for-hauler-manifests-job + image: {{ .Values.hauler.initContainers.image.repository }}:{{ .Values.hauler.initContainers.image.tag }} + imagePullPolicy: {{ .Values.hauler.initContainers.imagePullPolicy }} + args: ["wait", "--for=condition=complete", "job", "hauler-manifests-job", "--namespace", "{{ .Release.Namespace }}", "--timeout={{ .Values.hauler.initContainers.timeout }}"] + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + runAsNonRoot: true + runAsUser: 1001 + seccompProfile: + type: RuntimeDefault + containers: + - name: hauler-registry + image: {{ .Values.hauler.image.repository }}:{{ .Values.hauler.image.tag }} + imagePullPolicy: {{ .Values.hauler.imagePullPolicy }} + args: ["store", "serve", "registry"] + ports: + - containerPort: {{ .Values.haulerRegistry.service.ports.port }} + volumeMounts: + - name: hauler-data + mountPath: /store + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + runAsNonRoot: true + runAsUser: 1001 + seccompProfile: + type: RuntimeDefault + restartPolicy: Always + serviceAccountName: hauler-service-account + volumes: + - name: hauler-data + persistentVolumeClaim: + claimName: hauler-data +{{- end }} diff --git a/deploy/kubernetes/helm/charts/hauler/templates/hauler-registry/hauler-registry-ingress.yaml b/deploy/kubernetes/helm/charts/hauler/templates/hauler-registry/hauler-registry-ingress.yaml new file mode 100644 index 0000000..8e2c4e9 --- /dev/null +++ b/deploy/kubernetes/helm/charts/hauler/templates/hauler-registry/hauler-registry-ingress.yaml @@ -0,0 +1,31 @@ +{{- if and .Values.haulerRegistry.enabled .Values.haulerRegistry.ingress.enabled }} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: hauler-registry + namespace: {{ .Release.Namespace }} + labels: + {{- include "hauler.labels" . | nindent 4 }} +spec: + rules: + {{- range .Values.haulerRegistry.ingress.hosts }} + - host: {{ . }} + http: + paths: + - backend: + service: + name: hauler-registry + port: + number: 5000 + path: / + pathType: Prefix + {{- end }} + {{- if .Values.haulerRegistry.ingress.tls.enabled }} + tls: + - hosts: + {{- range .Values.haulerRegistry.ingress.hosts }} + - {{ . }} + {{- end }} + secretName: {{ .Values.haulerRegistry.ingress.tls.secretName }} + {{- end }} +{{- end }} diff --git a/deploy/kubernetes/helm/charts/hauler/templates/hauler-registry/hauler-registry-service.yaml b/deploy/kubernetes/helm/charts/hauler/templates/hauler-registry/hauler-registry-service.yaml new file mode 100644 index 0000000..55182fc --- /dev/null +++ b/deploy/kubernetes/helm/charts/hauler/templates/hauler-registry/hauler-registry-service.yaml @@ -0,0 +1,18 @@ +{{- if and .Values.haulerRegistry.enabled .Values.haulerRegistry.service.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: hauler-registry + namespace: {{ .Release.Namespace }} + labels: + {{- include "hauler.labels" . | nindent 4 }} +spec: + selector: + app: hauler-registry + ports: + - name: {{ .Values.haulerRegistry.service.ports.name }} + protocol: {{ .Values.haulerRegistry.service.ports.protocol }} + port: {{ .Values.haulerRegistry.service.ports.port }} + targetPort: {{ .Values.haulerRegistry.service.ports.targetPort }} + type: {{ .Values.haulerRegistry.service.type }} +{{- end }} diff --git a/deploy/kubernetes/helm/charts/hauler/templates/hauler/hauler-deployment.yaml b/deploy/kubernetes/helm/charts/hauler/templates/hauler/hauler-deployment.yaml new file mode 100644 index 0000000..fe6b161 --- /dev/null +++ b/deploy/kubernetes/helm/charts/hauler/templates/hauler/hauler-deployment.yaml @@ -0,0 +1,67 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: hauler + namespace: {{ .Release.Namespace }} + labels: + {{- include "hauler.labels" . | nindent 4 }} +spec: + replicas: 1 + selector: + matchLabels: + app: hauler + {{- include "hauler.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + app: hauler + {{- include "hauler.selectorLabels" . | nindent 8 }} + spec: + initContainers: + - name: wait-for-hauler-hauls-job + image: {{ .Values.hauler.initContainers.image.repository }}:{{ .Values.hauler.initContainers.image.tag }} + imagePullPolicy: {{ .Values.hauler.initContainers.imagePullPolicy }} + args: ["wait", "--for=condition=complete", "job", "hauler-hauls-job", "--namespace", "{{ .Release.Namespace }}", "--timeout={{ .Values.hauler.initContainers.timeout }}"] + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + runAsNonRoot: true + runAsUser: 1001 + seccompProfile: + type: RuntimeDefault + - name: wait-for-hauler-manifests-job + image: {{ .Values.hauler.initContainers.image.repository }}:{{ .Values.hauler.initContainers.image.tag }} + imagePullPolicy: {{ .Values.hauler.initContainers.imagePullPolicy }} + args: ["wait", "--for=condition=complete", "job", "hauler-manifests-job", "--namespace", "{{ .Release.Namespace }}", "--timeout={{ .Values.hauler.initContainers.timeout }}"] + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + runAsNonRoot: true + runAsUser: 1001 + seccompProfile: + type: RuntimeDefault + containers: + - name: hauler + image: {{ .Values.hauler.image.repository }}:{{ .Values.hauler.image.tag }} + imagePullPolicy: {{ .Values.hauler.imagePullPolicy }} + ports: + - containerPort: {{ .Values.hauler.service.ports.port }} + volumeMounts: + - name: hauler-data + mountPath: /store + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + runAsNonRoot: true + runAsUser: 1001 + seccompProfile: + type: RuntimeDefault + restartPolicy: Always + serviceAccountName: hauler-service-account + volumes: + - name: hauler-data + persistentVolumeClaim: + claimName: hauler-data diff --git a/deploy/kubernetes/helm/charts/hauler/templates/hauler/hauler-ingress.yaml b/deploy/kubernetes/helm/charts/hauler/templates/hauler/hauler-ingress.yaml new file mode 100644 index 0000000..3f82aa4 --- /dev/null +++ b/deploy/kubernetes/helm/charts/hauler/templates/hauler/hauler-ingress.yaml @@ -0,0 +1,31 @@ +{{- if .Values.hauler.ingress.enabled }} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: hauler-ingress + namespace: {{ .Release.Namespace }} + labels: + {{- include "hauler.labels" . | nindent 4 }} +spec: + rules: + {{- range .Values.hauler.ingress.hosts }} + - host: {{ . }} + http: + paths: + - backend: + service: + name: hauler-service + port: + number: 80 + path: / + pathType: Prefix + {{- end }} + {{- if .Values.hauler.ingress.tls.enabled }} + tls: + - hosts: + {{- range .Values.hauler.ingress.hosts }} + - {{ . }} + {{- end }} + secretName: {{ .Values.hauler.ingress.tls.secretName }} + {{- end }} +{{- end }} diff --git a/deploy/kubernetes/helm/charts/hauler/templates/hauler/hauler-jobs.yaml b/deploy/kubernetes/helm/charts/hauler/templates/hauler/hauler-jobs.yaml new file mode 100644 index 0000000..b13a88b --- /dev/null +++ b/deploy/kubernetes/helm/charts/hauler/templates/hauler/hauler-jobs.yaml @@ -0,0 +1,122 @@ +{{- if .Values.haulerJobs.hauls.enabled }} +apiVersion: batch/v1 +kind: Job +metadata: + name: hauler-hauls-job + namespace: {{ .Release.Namespace }} + labels: + {{- include "hauler.labels" . | nindent 4 }} +spec: + template: + spec: + initContainers: + - name: hauler-fetch-hauls + image: {{ .Values.haulerJobs.image.repository }}:{{ .Values.haulerJobs.image.tag }} + imagePullPolicy: {{ .Values.haulerJobs.imagePullPolicy }} + command: ["/bin/sh", "-c"] + args: + - | + curl -o /hauls/longhorn.tar.zst https://rancher-airgap.s3.amazonaws.com/longhorn.tar.zst && + curl -o /hauls/neuvector.tar.zst https://rancher-airgap.s3.amazonaws.com/neuvector.tar.zst && + echo 'hauler fetch completed' + volumeMounts: + - name: hauler-data + mountPath: /hauls + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + runAsNonRoot: true + runAsUser: 1001 + seccompProfile: + type: RuntimeDefault + containers: + - name: hauler-load-hauls + image: {{ .Values.hauler.image.repository }}:{{ .Values.hauler.image.tag }} + imagePullPolicy: {{ .Values.hauler.imagePullPolicy }} + args: + - "store" + - "load" + - "/hauls/longhorn.tar.zst" + - "/hauls/neuvector.tar.zst" + volumeMounts: + - name: hauler-data + mountPath: /hauls + - name: hauler-data + mountPath: /store + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + runAsNonRoot: true + runAsUser: 1001 + seccompProfile: + type: RuntimeDefault + restartPolicy: OnFailure + volumes: + - name: hauler-data + persistentVolumeClaim: + claimName: hauler-data +{{- end }} +--- +{{- if .Values.haulerJobs.manifests.enabled }} +apiVersion: batch/v1 +kind: Job +metadata: + name: hauler-manifests-job + namespace: {{ .Release.Namespace }} + labels: + {{- include "hauler.labels" . | nindent 4 }} +spec: + template: + spec: + initContainers: + - name: hauler-fetch-manifests + image: {{ .Values.haulerJobs.image.repository }}:{{ .Values.haulerJobs.image.tag }} + imagePullPolicy: {{ .Values.haulerJobs.imagePullPolicy }} + command: ["/bin/sh", "-c"] + args: + - | + curl -o /manifests/rancher-airgap-cosign.yaml https://rancher-airgap.s3.amazonaws.com/rancher-airgap-cosign.yaml && + curl -o /manifests/rancher-airgap-helm.yaml https://rancher-airgap.s3.amazonaws.com/rancher-airgap-helm.yaml && + echo 'hauler fetch completed' + volumeMounts: + - name: hauler-data + mountPath: /manifests + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + runAsNonRoot: true + runAsUser: 1001 + seccompProfile: + type: RuntimeDefault + containers: + - name: hauler-load-manifests + image: {{ .Values.hauler.image.repository }}:{{ .Values.hauler.image.tag }} + imagePullPolicy: {{ .Values.hauler.imagePullPolicy }} + args: + - "store" + - "sync" + - "--files" + - "/manifests/rancher-airgap-cosign.yaml" + - "/manifests/rancher-airgap-helm.yaml" + volumeMounts: + - name: hauler-data + mountPath: /manifests + - name: hauler-data + mountPath: /store + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + runAsNonRoot: true + runAsUser: 1001 + seccompProfile: + type: RuntimeDefault + restartPolicy: OnFailure + volumes: + - name: hauler-data + persistentVolumeClaim: + claimName: hauler-data +{{- end }} diff --git a/deploy/kubernetes/helm/charts/hauler/templates/hauler/hauler-ns.yaml b/deploy/kubernetes/helm/charts/hauler/templates/hauler/hauler-ns.yaml new file mode 100644 index 0000000..813a95d --- /dev/null +++ b/deploy/kubernetes/helm/charts/hauler/templates/hauler/hauler-ns.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: {{ .Release.Namespace }} + labels: + {{- include "hauler.labels" . | nindent 4 }} diff --git a/deploy/kubernetes/helm/charts/hauler/templates/hauler/hauler-pvc.yaml b/deploy/kubernetes/helm/charts/hauler/templates/hauler/hauler-pvc.yaml new file mode 100644 index 0000000..5176457 --- /dev/null +++ b/deploy/kubernetes/helm/charts/hauler/templates/hauler/hauler-pvc.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: hauler-data + namespace: {{ .Release.Namespace }} + labels: + {{- include "hauler.labels" . | nindent 4 }} +spec: + accessModes: + - {{ .Values.hauler.data.pvc.accessModes }} + resources: + requests: + storage: {{ .Values.hauler.data.pvc.storageRequest }} + storageClassName: {{ .Values.hauler.data.pvc.storageClass }} diff --git a/deploy/kubernetes/helm/charts/hauler/templates/hauler/hauler-rbac.yaml b/deploy/kubernetes/helm/charts/hauler/templates/hauler/hauler-rbac.yaml new file mode 100644 index 0000000..36523c0 --- /dev/null +++ b/deploy/kubernetes/helm/charts/hauler/templates/hauler/hauler-rbac.yaml @@ -0,0 +1,35 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: hauler-service-account + namespace: {{ .Release.Namespace }} + labels: + {{- include "hauler.labels" . | nindent 4 }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: hauler-role + namespace: {{ .Release.Namespace }} + labels: + {{- include "hauler.labels" . | nindent 4 }} +rules: +- apiGroups: ["batch"] + resources: ["jobs"] + verbs: ["get", "list", "watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: hauler-role-binding + namespace: {{ .Release.Namespace }} + labels: + {{- include "hauler.labels" . | nindent 4 }} +roleRef: + kind: Role + name: hauler-role + apiGroup: rbac.authorization.k8s.io +subjects: + - kind: ServiceAccount + name: hauler-service-account + namespace: {{ .Release.Namespace }} diff --git a/deploy/kubernetes/helm/charts/hauler/templates/hauler/hauler-service.yaml b/deploy/kubernetes/helm/charts/hauler/templates/hauler/hauler-service.yaml new file mode 100644 index 0000000..15dd8cd --- /dev/null +++ b/deploy/kubernetes/helm/charts/hauler/templates/hauler/hauler-service.yaml @@ -0,0 +1,18 @@ +{{- if .Values.hauler.service.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: hauler-service + namespace: {{ .Release.Namespace }} + labels: + {{- include "hauler.labels" . | nindent 4 }} +spec: + selector: + app: hauler + ports: + - name: {{ .Values.hauler.service.ports.name }} + protocol: {{ .Values.hauler.service.ports.protocol }} + port: {{ .Values.hauler.service.ports.port }} + targetPort: {{ .Values.hauler.service.ports.targetPort }} + type: {{ .Values.hauler.service.type }} +{{- end }} diff --git a/deploy/kubernetes/helm/charts/hauler/values.yaml b/deploy/kubernetes/helm/charts/hauler/values.yaml new file mode 100644 index 0000000..6abadab --- /dev/null +++ b/deploy/kubernetes/helm/charts/hauler/values.yaml @@ -0,0 +1,109 @@ +# Helm Chart Values for Hauler +# Docs: http://hauler.dev + +hauler: + image: + repository: zackbradys/hauler + tag: v1.0.2 + imagePullPolicy: Always + + initContainers: + image: + repository: rancher/kubectl + tag: v1.27.0 + imagePullPolicy: Always + timeout: 1h + + data: + pvc: + accessModes: ReadWriteMany + storageClass: longhorn + storageRequest: 48Gi + + ingress: + enabled: true + hosts: + - hauler.ranchers.io + tls: + enabled: true + secretName: tls-certs + + service: + enabled: true + type: ClusterIP + ports: + name: hauler + protocol: TCP + port: 80 + targetPort: 80 + +# Helm Chart Values for the Hauler Jobs +# Docs: http://hauler.dev + +haulerJobs: + image: + repository: rancher/shell + tag: v0.1.22 + imagePullPolicy: Always + + hauls: + enabled: true + artifacts: + - path: https://rancher-airgap.s3.amazonaws.com/longhorn.tar.zst + name: /hauls/longhorn.tar.zst + - path: https://rancher-airgap.s3.amazonaws.com/neuvector.tar.zst + name: /hauls/neuvector.tar.zst + + manifests: + enabled: true + stuff: + - path: https://rancher-airgap.s3.amazonaws.com/rancher-airgap-cosign.yaml + name: /manifests/rancher-airgap-cosign.yaml + - path: https://rancher-airgap.s3.amazonaws.com/rancher-airgap-helm.yaml + name: /manifests/rancher-airgap-helm.yaml + +# Helm Chart Values for the Hauler Fileserver +# Docs: http://hauler.dev + +haulerFileserver: + enabled: true + + ingress: + enabled: true + hosts: + - fileserver.ranchers.io + tls: + enabled: true + secretName: tls-certs + + service: + enabled: true + type: ClusterIP + ports: + name: hauler-fileserver + protocol: TCP + port: 8080 + targetPort: 8080 + +# Helm Chart Values for the Hauler Registry +# Docs: http://hauler.dev + +haulerRegistry: + enabled: true + + ingress: + enabled: true + hosts: + - registry.ranchers.io + tls: + enabled: true + secretName: tls-certs + + service: + enabled: true + type: ClusterIP + ports: + name: hauler-registry + protocol: TCP + port: 5000 + targetPort: 5000