From 3dbe34541e0d6ddb50af9070640a6ac7302bd952 Mon Sep 17 00:00:00 2001 From: liechtinat Date: Thu, 8 Sep 2022 15:54:23 +0200 Subject: [PATCH 1/3] feat!(helm): refactor helm chart - Group app settings below `config` key - Group deployment settings below `deployment` key - Fix hardcoded replicaCount Signed-off-by: nathanael.liechti@post.ch --- .../kubeinvaders/templates/deployment.yaml | 48 ++++++++----- .../templates/servicemonitor.yaml | 2 +- helm-charts/kubeinvaders/values.yaml | 72 +++++++++---------- 3 files changed, 62 insertions(+), 60 deletions(-) diff --git a/helm-charts/kubeinvaders/templates/deployment.yaml b/helm-charts/kubeinvaders/templates/deployment.yaml index eb8858e..ad97883 100644 --- a/helm-charts/kubeinvaders/templates/deployment.yaml +++ b/helm-charts/kubeinvaders/templates/deployment.yaml @@ -8,7 +8,7 @@ metadata: app.kubernetes.io/instance: {{ .Release.Name }} app.kubernetes.io/managed-by: {{ .Release.Service }} spec: - replicas: 1 + replicas: {{ .Values.deployment.replicaCount }} selector: matchLabels: app.kubernetes.io/name: kubeinvaders @@ -20,48 +20,58 @@ spec: app.kubernetes.io/instance: {{ .Release.Name }} spec: serviceAccountName: kubeinvaders - {{- if .Values.securityContext }} - securityContext: {{- toYaml .Values.securityContext | nindent 8 }} + {{- with .Values.deployment.securityContext }} + securityContext: + {{- toYaml . | nindent 8 }} {{- end }} containers: - env: {{- if .Values.ingress.enabled }} - name: ENDPOINT - value: {{ required ".Values.ingress.hostName is required if Ingress are enabled" .Values.ingress.hostName }} + value: {{ required ".Values.ingress.hostName is required if Ingress is enabled" .Values.ingress.hostName }} {{- else }} - name: ENDPOINT - value: {{ required ".Values.route_host is required if Ingress are disabled" .Values.route_host }} + value: {{ required ".Values.route_host is required if Ingress is disabled" .Values.route_host }} {{- end }} - name: NAMESPACE - value: {{ .Values.target_namespace }} - {{- if .Values.extraEnv }} -{{ toYaml .Values.extraEnv | indent 10 }} + value: {{ .Values.config.target_namespace }} + - name: ALIENPROXIMITY + value: {{ .Values.config.alienProximity }} + - name: HITSLIMIT + value: {{ .Values.config.hitsLimit }} + - name: UPDATETIME + value: {{ .Values.config.updateTime }} + {{- if .Values.deployment.extraEnv }} +{{ toYaml .Values.deployment.extraEnv | indent 10 }} {{- end }} name: {{ .Chart.Name }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" - imagePullPolicy: {{ .Values.image.pullPolicy }} + image: "{{ .Values.deployment.image.repository }}:{{ .Values.deployment.image.tag }}" + imagePullPolicy: {{ .Values.deployment.image.pullPolicy }} ports: - name: http containerPort: 8080 protocol: TCP - {{- with .Values.resources }} + {{- with .Values.deployment.resources }} resources: + {{- toYaml . | nindent 12 }} {{- end }} - {{- with .Values.extraVolumeMounts }} + {{- with .Values.deployment.extraVolumeMounts }} volumeMounts: + {{- toYaml . | nindent 12 }} {{- end }} - {{- with .Values.nodeSelector }} + {{- with .Values.deployment.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} {{- end }} - {{- with.Values.extraVolumes }} + {{- with.Values.deployment.extraVolumes }} volumes: + {{- toYaml . | nindent 8 }} {{- end }} - {{- with .Values.affinity }} + {{- with .Values.deployment.affinity }} affinity: {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: + {{- end }} + {{- with .Values.deployment.tolerations }} + tolerations: {{- toYaml . | nindent 8 }} - {{- end }} + {{- end }} diff --git a/helm-charts/kubeinvaders/templates/servicemonitor.yaml b/helm-charts/kubeinvaders/templates/servicemonitor.yaml index 6dcba55..0461f71 100644 --- a/helm-charts/kubeinvaders/templates/servicemonitor.yaml +++ b/helm-charts/kubeinvaders/templates/servicemonitor.yaml @@ -16,4 +16,4 @@ spec: matchLabels: app.kubernetes.io/name: kubeinvaders app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} \ No newline at end of file +{{- end }} diff --git a/helm-charts/kubeinvaders/values.yaml b/helm-charts/kubeinvaders/values.yaml index 3656057..e95d1cb 100644 --- a/helm-charts/kubeinvaders/values.yaml +++ b/helm-charts/kubeinvaders/values.yaml @@ -1,9 +1,17 @@ -# Default namespace target -target_namespace: "default" - # Default values for kubeinvaders. # This is a YAML-formatted file. # Declare variables to be passed into your templates. + +nameOverride: "" +fullnameOverride: "" + +config: + # target_namespace where kubeinvaders should be allowed to kill pods + target_namespace: "default" + alienProximity: 10 + hitsLimit: 1 + updateTime: 0.5 + rbac: # Specifies whether RBAC resources should be created create: true @@ -21,22 +29,33 @@ clusterRole: # true, a name based on fullname is generated name: kubeinvaders -replicaCount: 1 - -image: - repository: luckysideburn/kubeinvaders - tag: v1.9 - pullPolicy: Always - -nameOverride: "" -fullnameOverride: "" +deployment: + replicaCount: 1 + image: + repository: luckysideburn/kubeinvaders + tag: v1.9 + pullPolicy: Always + extraEnv: [] + # - name: FOO + # value: "BAR" + extraVolumes: [] + # - name: tmp + # emptyDir: {} + extraVolumeMounts: [] + # - name: tmp + # mountPath: /usr/local/openresty + resources: {} + nodeSelector: {} + tolerations: [] + securityContext: {} service: type: ClusterIP port: 8080 ingress: - enabled: true + enabled: false + legacyIngress: false annotations: nginx.ingress.kubernetes.io/ssl-redirect: "true" hostName: "" @@ -45,32 +64,5 @@ ingress: # Use route_host only if ingress is disabled route_host: "" -legacyIngress: false - -extraEnv: [] -# extraEnv: -# - name: ALIENPROXIMITY -# value: "10" -# - name: HITSLIMIT -# value: "1" -# - name: UPDATETIME -# value: "0.5" - -extraVolumes: [] - # - name: tmp - # emptyDir: {} - -extraVolumeMounts: [] - # - name: tmp - # mountPath: /usr/local/openresty - -resources: {} -nodeSelector: {} -tolerations: [] -securityContext: {} - # runAsUser: 999 - # runAsGroup: 999 - # fsGroup: 999 - serviceMonitor: enabled: false From 3ed352da5e8a0d9e40e779f4ad40006ceffa1dd4 Mon Sep 17 00:00:00 2001 From: liechtinat Date: Thu, 8 Sep 2022 16:04:47 +0200 Subject: [PATCH 2/3] chore: update README --- helm-charts/kubeinvaders/README.md | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/helm-charts/kubeinvaders/README.md b/helm-charts/kubeinvaders/README.md index cf43a33..2a3ad36 100644 --- a/helm-charts/kubeinvaders/README.md +++ b/helm-charts/kubeinvaders/README.md @@ -9,14 +9,5 @@ kubectl create namespace kubeinvaders # Install new and full open-source version helm install kubeinvaders --set-string target_namespace="namespace1\,namespace2" \ --n kubeinvaders kubeinvaders/kubeinvaders --set ingress.hostName=kubeinvaders.io +-n kubeinvaders kubeinvaders/kubeinvaders --set ingress.enabled=true --set ingress.hostName=kubeinvaders.io ``` - -## Helm Values - -| Variable | Description | -| ------------------- | -------------------------------------- | -| image.tag | Specify tag of KubeInvaders to deploy | -| ingress.hostName | URL used for ingress | -| target_namespace | namespaces to take under control | -| extraEnv | Extra environment variables for pod | From c5394972700647cfe5065a2c02b610aebde3c919 Mon Sep 17 00:00:00 2001 From: liechtinat Date: Thu, 8 Sep 2022 16:31:05 +0200 Subject: [PATCH 3/3] feat: use fullname in each k8s object --- helm-charts/kubeinvaders/README.md | 10 +++-- .../kubeinvaders/templates/deployment.yaml | 14 +++--- .../kubeinvaders/templates/ingress.yaml | 2 +- .../kubeinvaders/templates/rbac-cluster.yaml | 43 ++++++++++++++++++ .../kubeinvaders/templates/rbac-role.yaml | 33 -------------- helm-charts/kubeinvaders/templates/rbac.yaml | 44 +++++++------------ .../kubeinvaders/templates/service.yaml | 2 +- .../templates/serviceaccount.yaml | 2 +- .../templates/servicemonitor.yaml | 2 +- 9 files changed, 78 insertions(+), 74 deletions(-) create mode 100644 helm-charts/kubeinvaders/templates/rbac-cluster.yaml delete mode 100644 helm-charts/kubeinvaders/templates/rbac-role.yaml diff --git a/helm-charts/kubeinvaders/README.md b/helm-charts/kubeinvaders/README.md index 2a3ad36..b2b43dc 100644 --- a/helm-charts/kubeinvaders/README.md +++ b/helm-charts/kubeinvaders/README.md @@ -7,7 +7,11 @@ helm repo add kubeinvaders https://lucky-sideburn.github.io/helm-charts/ kubectl create namespace kubeinvaders -# Install new and full open-source version -helm install kubeinvaders --set-string target_namespace="namespace1\,namespace2" \ --n kubeinvaders kubeinvaders/kubeinvaders --set ingress.enabled=true --set ingress.hostName=kubeinvaders.io +helm install -n kubeinvaders kubeinvaders kubeinvaders/kubeinvaders \ + --set-string config.target_namespace="namespace1\,namespace2" \ + --set ingress.enabled=true --set ingress.hostName=kubeinvaders.io ``` + +## Values + +See the [values.yaml](./values.yaml) for a full list of configuration options. diff --git a/helm-charts/kubeinvaders/templates/deployment.yaml b/helm-charts/kubeinvaders/templates/deployment.yaml index ad97883..2e531a2 100644 --- a/helm-charts/kubeinvaders/templates/deployment.yaml +++ b/helm-charts/kubeinvaders/templates/deployment.yaml @@ -1,7 +1,7 @@ apiVersion: apps/v1 kind: Deployment metadata: - name: kubeinvaders + name: {{ include "kubeinvaders.fullname" . }} labels: app.kubernetes.io/name: kubeinvaders helm.sh/chart: {{ include "kubeinvaders.chart" . }} @@ -36,13 +36,13 @@ spec: - name: NAMESPACE value: {{ .Values.config.target_namespace }} - name: ALIENPROXIMITY - value: {{ .Values.config.alienProximity }} + value: "{{ .Values.config.alienProximity }}" - name: HITSLIMIT - value: {{ .Values.config.hitsLimit }} + value: "{{ .Values.config.hitsLimit }}" - name: UPDATETIME - value: {{ .Values.config.updateTime }} - {{- if .Values.deployment.extraEnv }} -{{ toYaml .Values.deployment.extraEnv | indent 10 }} + value: "{{ .Values.config.updateTime }}" + {{- with .Values.deployment.extraEnv }} + {{ toYaml . | nindent 10 }} {{- end }} name: {{ .Chart.Name }} image: "{{ .Values.deployment.image.repository }}:{{ .Values.deployment.image.tag }}" @@ -63,7 +63,7 @@ spec: nodeSelector: {{- toYaml . | nindent 8 }} {{- end }} - {{- with.Values.deployment.extraVolumes }} + {{- with .Values.deployment.extraVolumes }} volumes: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/helm-charts/kubeinvaders/templates/ingress.yaml b/helm-charts/kubeinvaders/templates/ingress.yaml index 17ab228..8cb28e7 100644 --- a/helm-charts/kubeinvaders/templates/ingress.yaml +++ b/helm-charts/kubeinvaders/templates/ingress.yaml @@ -2,7 +2,7 @@ apiVersion: networking.k8s.io/v1 kind: Ingress metadata: - name: kubeinvaders + name: {{ include "kubeinvaders.fullname" . }} labels: app.kubernetes.io/name: kubeinvaders helm.sh/chart: {{ include "kubeinvaders.chart" . }} diff --git a/helm-charts/kubeinvaders/templates/rbac-cluster.yaml b/helm-charts/kubeinvaders/templates/rbac-cluster.yaml new file mode 100644 index 0000000..bb4aba9 --- /dev/null +++ b/helm-charts/kubeinvaders/templates/rbac-cluster.yaml @@ -0,0 +1,43 @@ +{{- if .Values.rbac.create -}} +{{if .Values.clusterRole.create -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "kubeinvaders.clusterRoleName" . }} + labels: + app: kubeinvaders + chart: {{ template "kubeinvaders.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: +- apiGroups: [""] + resources: ["pods", "pods/log"] + verbs: ["get", "watch", "list", "delete"] +- apiGroups: ["batch", "extensions"] + resources: ["jobs"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] +- apiGroups: [""] + resources: ["nodes"] + verbs: ["get", "watch", "list"] +{{- end -}} +{{- if or .Values.clusterRole.create .Values.clusterRole.name }} +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ template "kubeinvaders.clusterRoleName" . }} + labels: + app: kubeinvaders + chart: {{ template "kubeinvaders.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +subjects: +- kind: ServiceAccount + name: {{ template "kubeinvaders.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "kubeinvaders.clusterRoleName" . }} +{{- end -}} +{{- end -}} diff --git a/helm-charts/kubeinvaders/templates/rbac-role.yaml b/helm-charts/kubeinvaders/templates/rbac-role.yaml deleted file mode 100644 index 44feccf..0000000 --- a/helm-charts/kubeinvaders/templates/rbac-role.yaml +++ /dev/null @@ -1,33 +0,0 @@ -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: kubeinvaders-role - namespace: {{ .Release.Namespace }} - labels: - app: kubeinvaders - chart: {{ template "kubeinvaders.chart" $ }} - release: {{ $.Release.Name }} - heritage: {{ $.Release.Service }} -rules: -- apiGroups: [""] - resources: ["pods", "pods/log", "jobs"] - verbs: ["get", "list", "delete", "create"] ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: kubeinvaders-rolebinding - namespace: {{ .Release.Namespace }} - labels: - app: kubeinvaders - chart: {{ template "kubeinvaders.chart" $ }} - release: {{ $.Release.Name }} - heritage: {{ $.Release.Service }} -subjects: -- kind: ServiceAccount - name: {{ template "kubeinvaders.serviceAccountName" $ }} - namespace: {{ .Release.Namespace }} -roleRef: - kind: Role - name: kubeinvaders-role - apiGroup: rbac.authorization.k8s.io diff --git a/helm-charts/kubeinvaders/templates/rbac.yaml b/helm-charts/kubeinvaders/templates/rbac.yaml index 237d631..51132be 100644 --- a/helm-charts/kubeinvaders/templates/rbac.yaml +++ b/helm-charts/kubeinvaders/templates/rbac.yaml @@ -1,43 +1,33 @@ -{{- if .Values.rbac.create -}} -{{if .Values.clusterRole.create -}} +kind: Role apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole metadata: - name: kubeinvaders + name: {{ include "kubeinvaders.fullname" . }} + namespace: {{ .Release.Namespace }} labels: app: kubeinvaders - chart: {{ template "kubeinvaders.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} + chart: {{ template "kubeinvaders.chart" $ }} + release: {{ $.Release.Name }} + heritage: {{ $.Release.Service }} rules: - apiGroups: [""] - resources: ["pods", "pods/log"] - verbs: ["get", "watch", "list", "delete"] -- apiGroups: ["batch", "extensions"] - resources: ["jobs"] - verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] -- apiGroups: [""] - resources: ["nodes"] - verbs: ["get", "watch", "list"] -{{- end -}} -{{- if or .Values.clusterRole.create .Values.clusterRole.name }} + resources: ["pods", "pods/log", "jobs"] + verbs: ["get", "list", "delete", "create"] --- -kind: ClusterRoleBinding +kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ template "kubeinvaders.clusterRoleName" . }} + name: {{ include "kubeinvaders.fullname" . }} + namespace: {{ .Release.Namespace }} labels: app: kubeinvaders - chart: {{ template "kubeinvaders.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} + chart: {{ template "kubeinvaders.chart" $ }} + release: {{ $.Release.Name }} + heritage: {{ $.Release.Service }} subjects: - kind: ServiceAccount - name: {{ template "kubeinvaders.serviceAccountName" . }} + name: {{ template "kubeinvaders.serviceAccountName" $ }} namespace: {{ .Release.Namespace }} roleRef: + kind: Role + name: {{ include "kubeinvaders.fullname" . }} apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: kubeinvaders -{{- end -}} -{{- end -}} diff --git a/helm-charts/kubeinvaders/templates/service.yaml b/helm-charts/kubeinvaders/templates/service.yaml index 1f667c2..08793f7 100644 --- a/helm-charts/kubeinvaders/templates/service.yaml +++ b/helm-charts/kubeinvaders/templates/service.yaml @@ -1,7 +1,7 @@ apiVersion: v1 kind: Service metadata: - name: kubeinvaders + name: {{ include "kubeinvaders.fullname" . }} labels: app.kubernetes.io/name: kubeinvaders helm.sh/chart: {{ include "kubeinvaders.chart" . }} diff --git a/helm-charts/kubeinvaders/templates/serviceaccount.yaml b/helm-charts/kubeinvaders/templates/serviceaccount.yaml index a261355..6cc7aab 100644 --- a/helm-charts/kubeinvaders/templates/serviceaccount.yaml +++ b/helm-charts/kubeinvaders/templates/serviceaccount.yaml @@ -3,7 +3,7 @@ kind: ServiceAccount metadata: annotations: "helm.sh/hook": "pre-install" - name: kubeinvaders + name: {{ template "kubeinvaders.serviceAccountName" $ }} labels: app: {{ template "kubeinvaders.name" . }} chart: {{ template "kubeinvaders.chart" . }} diff --git a/helm-charts/kubeinvaders/templates/servicemonitor.yaml b/helm-charts/kubeinvaders/templates/servicemonitor.yaml index 0461f71..de6929f 100644 --- a/helm-charts/kubeinvaders/templates/servicemonitor.yaml +++ b/helm-charts/kubeinvaders/templates/servicemonitor.yaml @@ -2,7 +2,7 @@ apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: - name: kubeinvaders-metrics + name: {{ include "kubeinvaders.fullname" . }} labels: app.kubernetes.io/name: kubeinvaders helm.sh/chart: {{ include "kubeinvaders.chart" . }}