github/kubevela
1
0
Fork 0
mirror of https://github.com/kubevela/kubevela.git synced 2026-08-19 04:26:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Removed prometheus and certmanager crd's (#1005)

Browse Source 
* Removed prometheus and certmanager crd's, use cert-manager helm chart dependency instead

* Fixed unit and 2e2 tests. Added servicemonitors and certmanager crd dependencies for tests as testdata.

* Run `helm dependency update`

* Delete kubevela helm release and namespace if existing

* WIP - Bad hack to add the certmanager crds before installing kubevela with cert-manager as dependency. The cert-manager crds are not available, when kubevela Issuer are installed otherwise.

* WIP Added admission patch for webhook

* WIP Refactored secrets config

* WIP Fixed helm chart

* WIP Disabled metrics cap, due missing prometheus dependency by default

* WIP Added certmanager for e2e tests

* WIP Added certmanager for e2e tests

* WIP cleanup

* Updated docs

* Re-added certificate mount path
This commit is contained in:
Holger Protzek
2021-02-26 16:46:01 +08:00
committed by GitHub
parent abaac1de2b
commit d6f28bfd9e
23 changed files with 1085 additions and 1861 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+4 -1
View File
@@ -123,7 +123,10 @@ docker-push:
docker push ${IMG}
e2e-setup:
bin/vela install --set installCertManager=true --image-pull-policy IfNotPresent --image-repo vela-core-test --image-tag $(GIT_COMMIT)
helm repo add jetstack https://charts.jetstack.io
helm repo update
helm upgrade --install --create-namespace --namespace cert-manager cert-manager jetstack/cert-manager --version v1.2.0 --set installCRDs=true --wait
helm upgrade --install --create-namespace --namespace vela-system --set image.pullPolicy=IfNotPresent --set admissionWebhooks.certManager.enabled=true --set image.repository=vela-core-test --set image.tag=$(GIT_COMMIT) --wait kubevela ./charts/vela-core
ginkgo version
ginkgo -v -r e2e/setup
kubectl wait --for=condition=Ready pod -l app.kubernetes.io/name=vela-core,app.kubernetes.io/instance=kubevela -n vela-system --timeout=600s
charts/vela-core/crds/prometheus-operator.yaml
-465
View File
@@ -1,465 +0,0 @@
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.2.4
creationTimestamp: null
name: servicemonitors.monitoring.coreos.com
spec:
group: monitoring.coreos.com
names:
kind: ServiceMonitor
listKind: ServiceMonitorList
plural: servicemonitors
singular: servicemonitor
scope: Namespaced
versions:
- name: v1
schema:
openAPIV3Schema:
description: ServiceMonitor defines monitoring for a set of services.
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
description: Specification of desired Service selection for target discovery
by Prometheus.
properties:
endpoints:
description: A list of endpoints allowed as part of this ServiceMonitor.
items:
description: Endpoint defines a scrapeable endpoint serving Prometheus
metrics.
properties:
basicAuth:
description: 'BasicAuth allow an endpoint to authenticate over
basic authentication More info: https://prometheus.io/docs/operating/configuration/#endpoints'
properties:
password:
description: The secret in the service monitor namespace
that contains the password for authentication.
properties:
key:
description: The key of the secret to select from. Must
be a valid secret key.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
optional:
description: Specify whether the Secret or its key must
be defined
type: boolean
required:
- key
type: object
username:
description: The secret in the service monitor namespace
that contains the username for authentication.
properties:
key:
description: The key of the secret to select from. Must
be a valid secret key.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
optional:
description: Specify whether the Secret or its key must
be defined
type: boolean
required:
- key
type: object
type: object
bearerTokenFile:
description: File to read bearer token for scraping targets.
type: string
bearerTokenSecret:
description: Secret to mount to read bearer token for scraping
targets. The secret needs to be in the same namespace as the
service monitor and accessible by the Prometheus Operator.
properties:
key:
description: The key of the secret to select from. Must
be a valid secret key.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
optional:
description: Specify whether the Secret or its key must
be defined
type: boolean
required:
- key
type: object
honorLabels:
description: HonorLabels chooses the metric's labels on collisions
with target labels.
type: boolean
honorTimestamps:
description: HonorTimestamps controls whether Prometheus respects
the timestamps present in scraped data.
type: boolean
interval:
description: Interval at which metrics should be scraped
type: string
metricRelabelings:
description: MetricRelabelConfigs to apply to samples before
ingestion.
items:
description: 'RelabelConfig allows dynamic rewriting of the
label set, being applied to samples before ingestion. It
defines `<metric_relabel_configs>`-section of Prometheus
configuration. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs'
properties:
action:
description: Action to perform based on regex matching.
Default is 'replace'
type: string
modulus:
description: Modulus to take of the hash of the source
label values.
format: int64
type: integer
regex:
description: Regular expression against which the extracted
value is matched. Default is '(.*)'
type: string
replacement:
description: Replacement value against which a regex replace
is performed if the regular expression matches. Regex
capture groups are available. Default is '$1'
type: string
separator:
description: Separator placed between concatenated source
label values. default is ';'.
type: string
sourceLabels:
description: The source labels select values from existing
labels. Their content is concatenated using the configured
separator and matched against the configured regular
expression for the replace, keep, and drop actions.
items:
type: string
type: array
targetLabel:
description: Label to which the resulting value is written
in a replace action. It is mandatory for replace actions.
Regex capture groups are available.
type: string
type: object
type: array
params:
additionalProperties:
items:
type: string
type: array
description: Optional HTTP URL parameters
type: object
path:
description: HTTP path to scrape for metrics.
type: string
port:
description: Name of the service port this endpoint refers to.
Mutually exclusive with targetPort.
type: string
proxyUrl:
description: ProxyURL eg http://proxyserver:2195 Directs scrapes
to proxy through this endpoint.
type: string
relabelings:
description: 'RelabelConfigs to apply to samples before scraping.
More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config'
items:
description: 'RelabelConfig allows dynamic rewriting of the
label set, being applied to samples before ingestion. It
defines `<metric_relabel_configs>`-section of Prometheus
configuration. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs'
properties:
action:
description: Action to perform based on regex matching.
Default is 'replace'
type: string
modulus:
description: Modulus to take of the hash of the source
label values.
format: int64
type: integer
regex:
description: Regular expression against which the extracted
value is matched. Default is '(.*)'
type: string
replacement:
description: Replacement value against which a regex replace
is performed if the regular expression matches. Regex
capture groups are available. Default is '$1'
type: string
separator:
description: Separator placed between concatenated source
label values. default is ';'.
type: string
sourceLabels:
description: The source labels select values from existing
labels. Their content is concatenated using the configured
separator and matched against the configured regular
expression for the replace, keep, and drop actions.
items:
type: string
type: array
targetLabel:
description: Label to which the resulting value is written
in a replace action. It is mandatory for replace actions.
Regex capture groups are available.
type: string
type: object
type: array
scheme:
description: HTTP scheme to use for scraping.
type: string
scrapeTimeout:
description: Timeout after which the scrape is ended
type: string
targetPort:
anyOf:
- type: integer
- type: string
description: Name or number of the pod port this endpoint refers
to. Mutually exclusive with port.
x-kubernetes-int-or-string: true
tlsConfig:
description: TLS configuration to use when scraping the endpoint
properties:
ca:
description: Stuct containing the CA cert to use for the
targets.
properties:
configMap:
description: ConfigMap containing data to use for the
targets.
properties:
key:
description: The key to select.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind,
uid?'
type: string
optional:
description: Specify whether the ConfigMap or its
key must be defined
type: boolean
required:
- key
type: object
secret:
description: Secret containing data to use for the targets.
properties:
key:
description: The key of the secret to select from. Must
be a valid secret key.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind,
uid?'
type: string
optional:
description: Specify whether the Secret or its key
must be defined
type: boolean
required:
- key
type: object
type: object
caFile:
description: Path to the CA cert in the Prometheus container
to use for the targets.
type: string
cert:
description: Struct containing the client cert file for
the targets.
properties:
configMap:
description: ConfigMap containing data to use for the
targets.
properties:
key:
description: The key to select.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind,
uid?'
type: string
optional:
description: Specify whether the ConfigMap or its
key must be defined
type: boolean
required:
- key
type: object
secret:
description: Secret containing data to use for the targets.
properties:
key:
description: The key of the secret to select from. Must
be a valid secret key.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind,
uid?'
type: string
optional:
description: Specify whether the Secret or its key
must be defined
type: boolean
required:
- key
type: object
type: object
certFile:
description: Path to the client cert file in the Prometheus
container for the targets.
type: string
insecureSkipVerify:
description: Disable target certificate validation.
type: boolean
keyFile:
description: Path to the client key file in the Prometheus
container for the targets.
type: string
keySecret:
description: Secret containing the client key file for the
targets.
properties:
key:
description: The key of the secret to select from. Must
be a valid secret key.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
optional:
description: Specify whether the Secret or its key must
be defined
type: boolean
required:
- key
type: object
serverName:
description: Used to verify the hostname for the targets.
type: string
type: object
type: object
type: array
jobLabel:
description: The label to use to retrieve the job name from.
type: string
namespaceSelector:
description: Selector to select which namespaces the Endpoints objects
are discovered from.
properties:
any:
description: Boolean describing whether all namespaces are selected
in contrast to a list restricting them.
type: boolean
matchNames:
description: List of namespace names.
items:
type: string
type: array
type: object
podTargetLabels:
description: PodTargetLabels transfers labels on the Kubernetes Pod
onto the target.
items:
type: string
type: array
sampleLimit:
description: SampleLimit defines per-scrape limit on number of scraped
samples that will be accepted.
format: int64
type: integer
selector:
description: Selector to select Endpoints objects.
properties:
matchExpressions:
description: matchExpressions is a list of label selector requirements.
The requirements are ANDed.
items:
description: A label selector requirement is a selector that
contains values, a key, and an operator that relates the key
and values.
properties:
key:
description: key is the label key that the selector applies
to.
type: string
operator:
description: operator represents a key's relationship to
a set of values. Valid operators are In, NotIn, Exists
and DoesNotExist.
type: string
values:
description: values is an array of string values. If the
operator is In or NotIn, the values array must be non-empty.
If the operator is Exists or DoesNotExist, the values
array must be empty. This array is replaced during a strategic
merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchLabels:
additionalProperties:
type: string
description: matchLabels is a map of {key,value} pairs. A single
{key,value} in the matchLabels map is equivalent to an element
of matchExpressions, whose key field is "key", the operator
is "In", and the values array contains only "value". The requirements
are ANDed.
type: object
type: object
targetLabels:
description: TargetLabels transfers labels on the Kubernetes Service
onto the target.
items:
type: string
type: array
required:
- endpoints
- selector
type: object
required:
- spec
type: object
served: true
storage: true
status:
acceptedNames:
kind: ""
plural: ""
conditions: []
storedVersions: []
charts/vela-core/templates/admission-webhooks/job-patch/clusterrole.yaml
+21
View File
@@ -0,0 +1,21 @@
{{- if and .Values.admissionWebhooks.enabled .Values.admissionWebhooks.patch.enabled .Values.rbac.create (not .Values.admissionWebhooks.certManager.enabled) }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ template "kubevela.fullname" . }}-admission
annotations:
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
labels:
app: {{ template "kubevela.name" . }}-admission
{{- include "kubevela.labels" . | nindent 4 }}
rules:
- apiGroups:
- admissionregistration.k8s.io
resources:
- validatingwebhookconfigurations
- mutatingwebhookconfigurations
verbs:
- get
- update
{{- end }}
charts/vela-core/templates/admission-webhooks/job-patch/clusterrolebinding.yaml
+20
View File
@@ -0,0 +1,20 @@
{{- if and .Values.admissionWebhooks.enabled .Values.admissionWebhooks.patch.enabled .Values.rbac.create (not .Values.admissionWebhooks.certManager.enabled) }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: {{ template "kubevela.fullname" . }}-admission
annotations:
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
labels:
app: {{ template "kubevela.name" . }}-admission
{{- include "kubevela.labels" . | nindent 4 }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{ template "kubevela.fullname" . }}-admission
subjects:
- kind: ServiceAccount
name: {{ template "kubevela.fullname" . }}-admission
namespace: {{ .Release.Namespace }}
{{- end }}
charts/vela-core/templates/admission-webhooks/job-patch/job-createSecret.yaml
+50
View File
@@ -0,0 +1,50 @@
{{- if and .Values.admissionWebhooks.enabled .Values.admissionWebhooks.patch.enabled (not .Values.admissionWebhooks.certManager.enabled) }}
apiVersion: batch/v1
kind: Job
metadata:
name: {{ template "kubevela.fullname" . }}-admission-create
namespace: {{ .Release.Namespace }}
annotations:
"helm.sh/hook": pre-install,pre-upgrade
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
labels:
app: {{ template "kubevela.name" . }}-admission-create
{{- include "kubevela.labels" . | nindent 4 }}
spec:
{{- if .Capabilities.APIVersions.Has "batch/v1alpha1" }}
# Alpha feature since k8s 1.12
ttlSecondsAfterFinished: 0
{{- end }}
template:
metadata:
name: {{ template "kubevela.fullname" . }}-admission-create
labels:
app: {{ template "kubevela.name" . }}-admission-create
{{- include "kubevela.labels" . | nindent 8 }}
spec:
containers:
- name: create
image: {{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
imagePullPolicy: {{ .Values.admissionWebhooks.patch.image.pullPolicy }}
args:
- create
- --host={{ template "kubevela.name" . }}-webhook,{{ template "kubevela.name" . }}-webhook.{{ .Release.Namespace }}.svc
- --namespace={{ .Release.Namespace }}
- --secret-name={{ template "kubevela.fullname" . }}-admission
- --key-name=tls.key
- --cert-name=tls.crt
restartPolicy: OnFailure
serviceAccountName: {{ template "kubevela.fullname" . }}-admission
{{- with .Values.admissionWebhooks.patch.affinity }}
affinity:
{{ toYaml . | indent 8 }}
{{- end }}
{{- with .Values.admissionWebhooks.patch.tolerations }}
tolerations:
{{ toYaml . | indent 8 }}
{{- end }}
securityContext:
runAsGroup: 2000
runAsNonRoot: true
runAsUser: 2000
{{- end }}
charts/vela-core/templates/admission-webhooks/job-patch/job-patchWebhook.yaml
+49
View File
@@ -0,0 +1,49 @@
{{- if and .Values.admissionWebhooks.enabled .Values.admissionWebhooks.patch.enabled (not .Values.admissionWebhooks.certManager.enabled) }}
apiVersion: batch/v1
kind: Job
metadata:
name: {{ template "kubevela.fullname" . }}-admission-patch
namespace: {{ .Release.Namespace }}
annotations:
"helm.sh/hook": post-install,post-upgrade
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
labels:
app: {{ template "kubevela.name" . }}-admission-patch
{{- include "kubevela.labels" . | nindent 4 }}
spec:
{{- if .Capabilities.APIVersions.Has "batch/v1alpha1" }}
# Alpha feature since k8s 1.12
ttlSecondsAfterFinished: 0
{{- end }}
template:
metadata:
name: {{ template "kubevela.fullname" . }}-admission-patch
labels:
app: {{ template "kubevela.name" . }}-admission-patch
{{- include "kubevela.labels" . | nindent 8 }}
spec:
containers:
- name: patch
image: {{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
imagePullPolicy: {{ .Values.admissionWebhooks.patch.image.pullPolicy }}
args:
- patch
- --webhook-name={{ template "kubevela.fullname" . }}-admission
- --namespace={{ .Release.Namespace }}
- --secret-name={{ template "kubevela.fullname" . }}-admission
- --patch-failure-policy={{ .Values.admissionWebhooks.failurePolicy }}
restartPolicy: OnFailure
serviceAccountName: {{ template "kubevela.fullname" . }}-admission
{{- with .Values.admissionWebhooks.patch.affinity }}
affinity:
{{ toYaml . | indent 8 }}
{{- end }}
{{- with .Values.admissionWebhooks.patch.tolerations }}
tolerations:
{{ toYaml . | indent 8 }}
{{- end }}
securityContext:
runAsGroup: 2000
runAsNonRoot: true
runAsUser: 2000
{{- end }}
charts/vela-core/templates/admission-webhooks/job-patch/role.yaml
+21
View File
@@ -0,0 +1,21 @@
{{- if and .Values.admissionWebhooks.enabled .Values.admissionWebhooks.patch.enabled .Values.rbac.create (not .Values.admissionWebhooks.certManager.enabled) }}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ template "kubevela.fullname" . }}-admission
namespace: {{ .Release.Namespace }}
annotations:
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
labels:
app: {{ template "kubevela.name" . }}-admission
{{- include "kubevela.labels" . | nindent 4 }}
rules:
- apiGroups:
- ""
resources:
- secrets
verbs:
- get
- create
{{- end }}
charts/vela-core/templates/admission-webhooks/job-patch/rolebinding.yaml
+21
View File
@@ -0,0 +1,21 @@
{{- if and .Values.admissionWebhooks.enabled .Values.admissionWebhooks.patch.enabled .Values.rbac.create (not .Values.admissionWebhooks.certManager.enabled) }}
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ template "kubevela.fullname" . }}-admission
namespace: {{ .Release.Namespace }}
annotations:
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
labels:
app: {{ template "kubevela.name" . }}-admission
{{- include "kubevela.labels" . | nindent 4 }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ template "kubevela.fullname" . }}-admission
subjects:
- kind: ServiceAccount
name: {{ template "kubevela.fullname" . }}-admission
namespace: {{ .Release.Namespace }}
{{- end }}
charts/vela-core/templates/admission-webhooks/job-patch/serviceaccount.yaml
+13
View File
@@ -0,0 +1,13 @@
{{- if and .Values.admissionWebhooks.enabled .Values.admissionWebhooks.patch.enabled .Values.rbac.create (not .Values.admissionWebhooks.certManager.enabled) }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ template "kubevela.fullname" . }}-admission
namespace: {{ .Release.Namespace }}
annotations:
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
labels:
app: {{ template "kubevela.name" . }}-admission
{{- include "kubevela.labels" . | nindent 4 }}
{{- end }}
charts/vela-core/templates/admission-webhooks/mutatingWebhookConfiguration.yaml
+109
View File
@@ -0,0 +1,109 @@
{{- if .Values.admissionWebhooks.enabled -}}
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
name: {{ template "kubevela.fullname" . }}-admission
namespace: {{ .Release.Namespace }}
{{- if .Values.admissionWebhooks.certManager.enabled }}
annotations:
cert-manager.io/inject-ca-from: {{ printf "%s/%s-root-cert" .Release.Namespace (include "kubevela.fullname" .) | quote }}
{{- end }}
webhooks:
- clientConfig:
caBundle: Cg==
service:
name: {{ template "kubevela.name" . }}-webhook
namespace: {{ .Release.Namespace }}
path: /mutating-core-oam-dev-v1alpha2-applicationconfigurations
{{- if .Values.admissionWebhooks.patch.enabled }}
failurePolicy: Ignore
{{- else }}
failurePolicy: Fail
{{- end }}
name: mutating.core.oam.dev.v1alpha2.applicationconfigurations
rules:
- apiGroups:
- core.oam.dev
apiVersions:
- v1alpha2
operations:
- CREATE
- UPDATE
resources:
- applicationconfigurations
scope: Namespaced
admissionReviewVersions:
- v1beta1
timeoutSeconds: 5
- clientConfig:
caBundle: Cg==
service:
name: {{ template "kubevela.name" . }}-webhook
namespace: {{ .Release.Namespace }}
path: /mutating-core-oam-dev-v1alpha2-components
{{- if .Values.admissionWebhooks.patch.enabled }}
failurePolicy: Ignore
{{- else }}
failurePolicy: Fails
{{- end }}
name: mutating.core.oam-dev.v1alpha2.components
rules:
- apiGroups:
- core.oam.dev
apiVersions:
- v1alpha2
operations:
- CREATE
- UPDATE
resources:
- components
scope: Namespaced
admissionReviewVersions:
- v1beta1
timeoutSeconds: 5
- clientConfig:
caBundle: Cg==
service:
name: {{ template "kubevela.name" . }}-webhook
namespace: {{ .Release.Namespace }}
path: /mutate-standard-oam-dev-v1alpha1-metricstrait
{{- if .Values.admissionWebhooks.patch.enabled }}
failurePolicy: Ignore
{{- else }}
failurePolicy: Fails
{{- end }}
name: mmetricstrait.kb.io
rules:
- apiGroups:
- standard.oam.dev
apiVersions:
- v1alpha1
operations:
- CREATE
- UPDATE
resources:
- metricstraits
- clientConfig:
caBundle: Cg==
service:
name: {{ template "kubevela.name" . }}-webhook
namespace: {{ .Release.Namespace }}
path: /mutate-standard-oam-dev-v1alpha1-podspecworkload
{{- if .Values.admissionWebhooks.patch.enabled }}
failurePolicy: Ignore
{{- else }}
failurePolicy: Fails
{{- end }}
name: mcontainerized.kb.io
rules:
- apiGroups:
- standard.oam.dev
apiVersions:
- v1alpha1
operations:
- CREATE
- UPDATE
resources:
- podspecworkloads
{{- end -}}
charts/vela-core/templates/admission-webhooks/validatingWebhookConfiguration.yaml
+132
View File
@@ -0,0 +1,132 @@
{{- if .Values.admissionWebhooks.enabled -}}
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
name: {{ template "kubevela.fullname" . }}-admission
namespace: {{ .Release.Namespace }}
{{- if .Values.admissionWebhooks.certManager.enabled }}
annotations:
cert-manager.io/inject-ca-from: {{ printf "%s/%s-root-cert" .Release.Namespace (include "kubevela.fullname" .) | quote }}
{{- end }}
webhooks:
- clientConfig:
caBundle: Cg==
service:
name: {{ template "kubevela.name" . }}-webhook
namespace: {{ .Release.Namespace }}
path: /validating-core-oam-dev-v1alpha2-applicationconfigurations
{{- if .Values.admissionWebhooks.patch.enabled }}
failurePolicy: Ignore
{{- else }}
failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
{{- end }}
name: validating.core.oam.dev.v1alpha2.applicationconfigurations
rules:
- apiGroups:
- core.oam.dev
apiVersions:
- v1alpha2
operations:
- CREATE
- UPDATE
resources:
- applicationconfigurations
scope: Namespaced
admissionReviewVersions:
- v1beta1
timeoutSeconds: 5
- clientConfig:
caBundle: Cg==
service:
name: {{ template "kubevela.name" . }}-webhook
namespace: {{ .Release.Namespace }}
path: /validating-core-oam-dev-v1alpha2-components
{{- if .Values.admissionWebhooks.patch.enabled }}
failurePolicy: Ignore
{{- else }}
failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
{{- end }}
name: validating.core.oam.dev.v1alpha2.components
rules:
- apiGroups:
- core.oam.dev
apiVersions:
- v1alpha2
operations:
- CREATE
- UPDATE
resources:
- components
scope: Namespaced
admissionReviewVersions:
- v1beta1
timeoutSeconds: 5
- clientConfig:
caBundle: Cg==
service:
name: {{ template "kubevela.name" . }}-webhook
namespace: {{ .Release.Namespace }}
path: /validating-core-oam-dev-v1alpha2-traitdefinitions
{{- if .Values.admissionWebhooks.patch.enabled }}
failurePolicy: Ignore
{{- else }}
failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
{{- end }}
name: validating.core.oam.dev.v1alpha2.traitdefinitions
rules:
- apiGroups:
- core.oam.dev
apiVersions:
- v1alpha2
operations:
- CREATE
- UPDATE
resources:
- traitdefinitions
scope: Cluster
admissionReviewVersions:
- v1beta1
timeoutSeconds: 5
- clientConfig:
caBundle: Cg==
service:
name: {{ template "kubevela.name" . }}-webhook
namespace: {{ .Release.Namespace }}
path: /validate-standard-oam-dev-v1alpha1-metricstrait
{{- if .Values.admissionWebhooks.patch.enabled }}
failurePolicy: Ignore
{{- else }}
failurePolicy: {{ .Values.admissionWebhooks.failurePolicy }}
{{- end }}
name: vmetricstrait.kb.io
rules:
- apiGroups:
- standard.oam.dev
apiVersions:
- v1alpha1
operations:
- CREATE
- UPDATE
- DELETE
resources:
- metricstraits
- clientConfig:
caBundle: Cg==
service:
name: {{ template "kubevela.name" . }}-webhook
namespace: {{ .Release.Namespace }}
path: /validate-standard-oam-dev-v1alpha1-podspecworkload
failurePolicy: Fail
name: vcontainerized.kb.io
rules:
- apiGroups:
- standard.oam.dev
apiVersions:
- v1alpha1
operations:
- CREATE
- UPDATE
resources:
- podspecworkloads
{{- end -}}
charts/vela-core/templates/admission-webhooks/webhookService.yaml
+19
View File
@@ -0,0 +1,19 @@
{{- if .Values.admissionWebhooks.enabled -}}
apiVersion: v1
kind: Service
metadata:
name: {{ template "kubevela.name" . }}-webhook
namespace: {{ .Release.Namespace }}
labels:
{{- include "kubevela.labels" . | nindent 4 }}
spec:
type: {{ .Values.webhookService.type }}
ports:
- port: 443
targetPort: {{ .Values.webhookService.port }}
protocol: TCP
name: https
selector:
{{ include "kubevela.selectorLabels" . | nindent 6 }}
{{- end -}}
charts/vela-core/templates/cert-manager.yaml
-1087
View File
File diff suppressed because it is too large Load Diff
charts/vela-core/templates/certmanager.yaml
+53
View File
@@ -0,0 +1,53 @@
{{- if and .Values.admissionWebhooks.certManager.enabled -}}
# The following manifests contain a self-signed issuer CR and a certificate CR.
# More document can be found at https://docs.cert-manager.io
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ template "kubevela.fullname" . }}-self-signed-issuer
spec:
selfSigned: {}
---
# Generate a CA Certificate used to sign certificates for the webhook
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ template "kubevela.fullname" . }}-root-cert
spec:
secretName: {{ template "kubevela.fullname" . }}-root-cert
duration: 43800h # 5y
issuerRef:
name: {{ template "kubevela.fullname" . }}-self-signed-issuer
commonName: "ca.webhook.kubevela"
isCA: true
---
# Create an Issuer that uses the above generated CA certificate to issue certs
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ template "kubevela.fullname" . }}-root-issuer
namespace: {{ .Release.Namespace }}
spec:
ca:
secretName: {{ template "kubevela.fullname" . }}-root-cert
---
# generate a serving certificate for the apiservices to use
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ template "kubevela.fullname" . }}-admission
namespace: {{ .Release.Namespace }}
spec:
secretName: {{ template "kubevela.fullname" . }}-admission
duration: 8760h # 1y
issuerRef:
name: {{ template "kubevela.fullname" . }}-root-issuer
dnsNames:
- {{ template "kubevela.name" . }}-webhook.{{ .Release.Namespace }}.svc
- {{ template "kubevela.name" . }}-webhook.{{ .Release.Namespace }}.svc.cluster.local
{{- end }}
charts/vela-core/templates/kubevela-controller.yaml
+6 -6
View File
@@ -107,10 +107,10 @@ spec:
args:
- "--metrics-addr=:8080"
- "--enable-leader-election"
{{ if .Values.useWebhook }}
{{ if .Values.admissionWebhooks.enabled }}
- "--use-webhook=true"
- "--webhook-port={{ .Values.webhookService.port }}"
- "--webhook-cert-dir={{ .Values.certificate.mountPath }}"
- "--webhook-cert-dir={{ .Values.admissionWebhooks.certificate.mountPath }}"
{{ end }}
- "--health-addr=:{{ .Values.healthCheck.port }}"
- "--apply-once-only={{ .Values.applyOnceOnly }}"
@@ -121,7 +121,7 @@ spec:
imagePullPolicy: {{ quote .Values.image.pullPolicy }}
resources:
{{- toYaml .Values.resources | nindent 12 }}
{{ if .Values.useWebhook }}
{{ if .Values.admissionWebhooks.enabled }}
ports:
- containerPort: {{ .Values.webhookService.port }}
name: webhook-server
@@ -142,16 +142,16 @@ spec:
initialDelaySeconds: 90
periodSeconds: 5
volumeMounts:
- mountPath: {{ .Values.certificate.mountPath }}
- mountPath: {{ .Values.admissionWebhooks.certificate.mountPath }}
name: tls-cert-vol
readOnly: true
{{ end }}
{{ if .Values.useWebhook }}
{{ if .Values.admissionWebhooks.enabled }}
volumes:
- name: tls-cert-vol
secret:
defaultMode: 420
secretName: {{ .Values.certificate.secretName | quote }}
secretName: {{ template "kubevela.fullname" . }}-admission
{{ end }}
{{- with .Values.nodeSelector }}
nodeSelector:
charts/vela-core/templates/webhook.yaml
-249
View File
@@ -1,249 +0,0 @@
{{- if .Values.useWebhook -}}
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
name: kubevela-mutating-webhook-configuration
namespace: {{ .Release.Namespace }}
annotations:
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ .Values.certificate.certificateName }}
webhooks:
- clientConfig:
caBundle: Cg==
service:
name: {{ template "kubevela.name" . }}-webhook
namespace: {{ .Release.Namespace }}
path: /mutating-core-oam-dev-v1alpha2-applicationconfigurations
failurePolicy: Fail
name: mutating.core.oam.dev.v1alpha2.applicationconfigurations
rules:
- apiGroups:
- core.oam.dev
apiVersions:
- v1alpha2
operations:
- CREATE
- UPDATE
resources:
- applicationconfigurations
scope: Namespaced
admissionReviewVersions:
- v1beta1
timeoutSeconds: 5
- clientConfig:
caBundle: Cg==
service:
name: {{ template "kubevela.name" . }}-webhook
namespace: {{ .Release.Namespace }}
path: /mutating-core-oam-dev-v1alpha2-components
failurePolicy: Fail
name: mutating.core.oam-dev.v1alpha2.components
rules:
- apiGroups:
- core.oam.dev
apiVersions:
- v1alpha2
operations:
- CREATE
- UPDATE
resources:
- components
scope: Namespaced
admissionReviewVersions:
- v1beta1
timeoutSeconds: 5
- clientConfig:
caBundle: Cg==
service:
name: {{ template "kubevela.name" . }}-webhook
namespace: {{ .Release.Namespace }}
path: /mutate-standard-oam-dev-v1alpha1-metricstrait
failurePolicy: Fail
name: mmetricstrait.kb.io
rules:
- apiGroups:
- standard.oam.dev
apiVersions:
- v1alpha1
operations:
- CREATE
- UPDATE
resources:
- metricstraits
- clientConfig:
caBundle: Cg==
service:
name: {{ template "kubevela.name" . }}-webhook
namespace: {{ .Release.Namespace }}
path: /mutate-standard-oam-dev-v1alpha1-podspecworkload
failurePolicy: Fail
name: mcontainerized.kb.io
rules:
- apiGroups:
- standard.oam.dev
apiVersions:
- v1alpha1
operations:
- CREATE
- UPDATE
resources:
- podspecworkloads
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
name: kubevela-validating-webhook-configuration
namespace: {{ .Release.Namespace }}
annotations:
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ .Values.certificate.certificateName }}
webhooks:
- clientConfig:
caBundle: Cg==
service:
name: {{ template "kubevela.name" . }}-webhook
namespace: {{ .Release.Namespace }}
path: /validating-core-oam-dev-v1alpha2-applicationconfigurations
failurePolicy: Fail
name: validating.core.oam.dev.v1alpha2.applicationconfigurations
rules:
- apiGroups:
- core.oam.dev
apiVersions:
- v1alpha2
operations:
- CREATE
- UPDATE
resources:
- applicationconfigurations
scope: Namespaced
admissionReviewVersions:
- v1beta1
timeoutSeconds: 5
- clientConfig:
caBundle: Cg==
service:
name: {{ template "kubevela.name" . }}-webhook
namespace: {{ .Release.Namespace }}
path: /validating-core-oam-dev-v1alpha2-components
failurePolicy: Fail
name: validating.core.oam.dev.v1alpha2.components
rules:
- apiGroups:
- core.oam.dev
apiVersions:
- v1alpha2
operations:
- CREATE
- UPDATE
resources:
- components
scope: Namespaced
admissionReviewVersions:
- v1beta1
timeoutSeconds: 5
- clientConfig:
caBundle: Cg==
service:
name: {{ template "kubevela.name" . }}-webhook
namespace: {{ .Release.Namespace }}
path: /validating-core-oam-dev-v1alpha2-traitdefinitions
failurePolicy: Fail
name: validating.core.oam.dev.v1alpha2.traitdefinitions
rules:
- apiGroups:
- core.oam.dev
apiVersions:
- v1alpha2
operations:
- CREATE
- UPDATE
resources:
- traitdefinitions
scope: Cluster
admissionReviewVersions:
- v1beta1
timeoutSeconds: 5
- clientConfig:
caBundle: Cg==
service:
name: {{ template "kubevela.name" . }}-webhook
namespace: {{ .Release.Namespace }}
path: /validate-standard-oam-dev-v1alpha1-metricstrait
failurePolicy: Fail
name: vmetricstrait.kb.io
rules:
- apiGroups:
- standard.oam.dev
apiVersions:
- v1alpha1
operations:
- CREATE
- UPDATE
- DELETE
resources:
- metricstraits
- clientConfig:
caBundle: Cg==
service:
name: {{ template "kubevela.name" . }}-webhook
namespace: {{ .Release.Namespace }}
path: /validate-standard-oam-dev-v1alpha1-podspecworkload
failurePolicy: Fail
name: vcontainerized.kb.io
rules:
- apiGroups:
- standard.oam.dev
apiVersions:
- v1alpha1
operations:
- CREATE
- UPDATE
resources:
- podspecworkloads
---
apiVersion: v1
kind: Service
metadata:
name: {{ template "kubevela.name" . }}-webhook
namespace: {{ .Release.Namespace }}
labels:
{{- include "kubevela.labels" . | nindent 4 }}
spec:
type: {{ .Values.webhookService.type }}
ports:
- port: 443
targetPort: {{ .Values.webhookService.port }}
protocol: TCP
name: https
selector:
{{ include "kubevela.selectorLabels" . | nindent 6 }}
---
# The following manifests contain a self-signed issuer CR and a certificate CR.
# More document can be found at https://docs.cert-manager.io
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ .Values.certificate.issuerName | quote }}
spec:
selfSigned: {}
# The following Certificate will generate a secret for vela-core
# This rely on the system has a installed cert-manager in it.
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ .Values.certificate.certificateName }}
spec:
dnsNames:
- {{ template "kubevela.name" . }}-webhook.{{ .Release.Namespace }}.svc
- {{ template "kubevela.name" . }}-webhook.{{ .Release.Namespace }}.svc.cluster.local
issuerRef:
kind: Issuer
name: {{ .Values.certificate.issuerName | default "selfsigned-issuer" | quote }}
secretName: {{ .Values.certificate.secretName | quote }}
---
{{- end -}}
charts/vela-core/values.yaml
+22 -11
View File
@@ -3,12 +3,11 @@
# Declare variables to be passed into your templates.
replicaCount: 1
installCertManager: false
# Valid applyOnceOnly values: true/false/on/off/force
applyOnceOnly: "off"
useWebhook: true
# By default, don't disable any builtin capabilities
disableCaps: ""
# By default, metrics are disabled due the prometheus dependency
disableCaps: "metrics"
image:
repository: oamdev/vela-core
tag: latest
@@ -77,10 +76,22 @@ tolerations: []
affinity: {}
# certificate related to the webhook
certificate:
issuerName: selfsigned-issuer
certificateName: serving-cert
secretName: webhook-server-cert
mountPath: /etc/k8s-webhook-certs
caBundle: replace-me
rbac:
create: true
admissionWebhooks:
enabled: true
failurePolicy: Fail
certificate:
mountPath: /etc/k8s-webhook-certs
patch:
enabled: true
image:
repository: jettech/kube-webhook-certgen
tag: v1.5.0
pullPolicy: IfNotPresent
affinity: {}
tolerations: []
certManager:
enabled: false
docs/en/install.md
+21 -23
View File
@@ -77,36 +77,18 @@ These steps will install KubeVela controller and its dependency.
helm repo update
```
3. Create Namespace for KubeVela controller
3. Install KubeVela
```shell script
kubectl create namespace vela-system
```
4. Install KubeVela
```shell script
helm install -n vela-system kubevela kubevela/vela-core
```
By default, it will enable webhook. KubeVela relies on [cert-manager](https://cert-manager.io/docs/)
to create certificates for webhook.
If cert-manager hasn't been installed, please refer to [cert-manager installation doc](https://cert-manager.io/docs/installation/kubernetes/).
You can add an argument `--set useWebhook=false` after the command to disable the webhook if you don't want to rely on cert-manager.
If you just want to have a try this can also work:
```shell script
helm install -n vela-system kubevela kubevela/vela-core --set useWebhook=false
```
You can also install cert-manager via kubevela chart by adding the argument `--set installCertManager=true`.
```shell script
helm install -n vela-system kubevela kubevela/vela-core --set installCertManager=true
helm install --create-namespace -n vela-system kubevela kubevela/vela-core
```
By default, it will enable the webhook with a self-signed certificate provided by [kube-webhook-certgen](https://github.com/jet/kube-webhook-certgen)
If you want to try the latest master branch, add flag `--devel` in command `helm search` to choose a pre-release
version in format `<next_version>-rc-master` which means the next release candidate version build on `master` branch,
like `0.4.0-rc-master`.
```shell script
$ helm search repo kubevela/vela-core -l --devel
helm search repo kubevela/vela-core -l --devel
NAME CHART VERSION APP VERSION DESCRIPTION
kubevela/vela-core 0.4.0-rc-master 0.4.0-rc-master A Helm chart for KubeVela core
kubevela/vela-core 0.3.2 0.3.2 A Helm chart for KubeVela core
@@ -116,7 +98,23 @@ These steps will install KubeVela controller and its dependency.
And try the following command to install it.
```shell script
helm install -n vela-system kubevela kubevela/vela-core --version <next_version>-rc-master --set useWebhook=false
helm install --create-namespace -n vela-system kubevela kubevela/vela-core --version <next_version>-rc-master
```
4. Install Kubevela with cert-manager (optional)
If cert-manager has been installed, it can be used to take care about generating certs.
You need to install cert-manager before the kubevela chart.
```shell script
helm repo add jetstack https://charts.jetstack.io
helm repo update
helm install cert-manager jetstack/cert-manager --namespace cert-manager --version v1.2.0 --create-namespace --set installCRDs=true
```
Install kubevela with enabled certmanager:
```shell script
helm install --create-namespace -n vela-system --set admissionWebhooks.certManager.enabled=true kubevela kubevela/vela-core
```
## 3. Get KubeVela CLI
pkg/controller/standard.oam.dev/v1alpha1/metrics/suite_test.go
+2 -1
View File
@@ -71,7 +71,8 @@ var _ = BeforeSuite(func(done Done) {
useExistCluster := false
testEnv = &envtest.Environment{
CRDDirectoryPaths: []string{
filepath.Join("../../../../..", "charts/vela-core/crds"), // this has all the required CRDs,
filepath.Join("../../../../..", "charts/vela-core/crds"), // this has all the required oam CRDs,
filepath.Join("..", "testdata/crds"),
},
UseExistingCluster: &useExistCluster,
}
pkg/controller/standard.oam.dev/v1alpha1/podspecworkload/suite_test.go
+2 -1
View File
@@ -56,7 +56,8 @@ var _ = BeforeSuite(func(done Done) {
testEnv = &envtest.Environment{
CRDDirectoryPaths: []string{
filepath.Join("../../../../..", "charts/vela-core/crds"), // this has all the required CRDs,
filepath.Join("..", "config", "crd", "bases")},
filepath.Join("..", "testdata/crds"),
},
}
var err error
pkg/controller/standard.oam.dev/v1alpha1/routes/suite_test.go
+1
View File
@@ -79,6 +79,7 @@ var _ = BeforeSuite(func(done Done) {
testEnv = &envtest.Environment{
CRDDirectoryPaths: []string{
filepath.Join("../../../../..", "charts/vela-core/crds"), // this has all the required CRDs,
filepath.Join("..", "testdata/crds"),
},
UseExistingCluster: &useExistCluster,
}
charts/vela-core/crds/cert-manager.yaml → pkg/controller/standard.oam.dev/v1alpha1/testdata/crds/cert-manager.yaml
Vendored
+147 -17
View File
@@ -1,3 +1,16 @@
# Copyright The Jetstack cert-manager contributors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
@@ -907,6 +920,10 @@ spec:
items:
type: string
type: array
encodeUsagesInRequest:
description: EncodeUsagesInRequest controls whether key usages should
be present in the CertificateRequest
type: boolean
ipAddresses:
description: IPAddresses is a list of IP address subjectAltNames to
be set on the Certificate.
@@ -1315,6 +1332,10 @@ spec:
items:
type: string
type: array
encodeUsagesInRequest:
description: EncodeUsagesInRequest controls whether key usages should
be present in the CertificateRequest
type: boolean
ipAddresses:
description: IPAddresses is a list of IP address subjectAltNames to
be set on the Certificate.
@@ -1722,6 +1743,10 @@ spec:
items:
type: string
type: array
encodeUsagesInRequest:
description: EncodeUsagesInRequest controls whether key usages should
be present in the CertificateRequest
type: boolean
ipAddresses:
description: IPAddresses is a list of IP address subjectAltNames to
be set on the Certificate.
@@ -2131,6 +2156,10 @@ spec:
items:
type: string
type: array
encodeUsagesInRequest:
description: EncodeUsagesInRequest controls whether key usages should
be present in the CertificateRequest
type: boolean
ipAddresses:
description: IPAddresses is a list of IP address subjectAltNames to
be set on the Certificate.
@@ -8589,6 +8618,13 @@ spec:
notification emails. This field may be updated after the account
is initially registered.
type: string
enableDurationFeature:
description: Enables requesting a Not After date on certificates
that matches the duration of the certificate. This is not supported
by all ACME servers like Let's Encrypt. If set to true when
the ACME server does not support it it will create an error
on the Order. Defaults to false.
type: boolean
externalAccountBinding:
description: ExternalAccountBinding is a reference to a CA external
account of the ACME server. If set, upon registration cert-manager
@@ -10561,6 +10597,13 @@ spec:
notification emails. This field may be updated after the account
is initially registered.
type: string
enableDurationFeature:
description: Enables requesting a Not After date on certificates
that matches the duration of the certificate. This is not supported
by all ACME servers like Let's Encrypt. If set to true when
the ACME server does not support it it will create an error
on the Order. Defaults to false.
type: boolean
externalAccountBinding:
description: ExternalAccountBinding is a reference to a CA external
account of the ACME server. If set, upon registration cert-manager
@@ -12533,6 +12576,13 @@ spec:
notification emails. This field may be updated after the account
is initially registered.
type: string
enableDurationFeature:
description: Enables requesting a Not After date on certificates
that matches the duration of the certificate. This is not supported
by all ACME servers like Let's Encrypt. If set to true when
the ACME server does not support it it will create an error
on the Order. Defaults to false.
type: boolean
externalAccountBinding:
description: ExternalAccountBinding is a reference to a CA external
account of the ACME server. If set, upon registration cert-manager
@@ -14507,6 +14557,13 @@ spec:
notification emails. This field may be updated after the account
is initially registered.
type: string
enableDurationFeature:
description: Enables requesting a Not After date on certificates
that matches the duration of the certificate. This is not supported
by all ACME servers like Let's Encrypt. If set to true when
the ACME server does not support it it will create an error
on the Order. Defaults to false.
type: boolean
externalAccountBinding:
description: ExternalAccountBinding is a reference to a CA external
account of the ACME server. If set, upon registration cert-manager
@@ -16517,6 +16574,13 @@ spec:
notification emails. This field may be updated after the account
is initially registered.
type: string
enableDurationFeature:
description: Enables requesting a Not After date on certificates
that matches the duration of the certificate. This is not supported
by all ACME servers like Let's Encrypt. If set to true when
the ACME server does not support it it will create an error
on the Order. Defaults to false.
type: boolean
externalAccountBinding:
description: ExternalAccountBinding is a reference to a CA external
account of the ACME server. If set, upon registration cert-manager
@@ -18488,6 +18552,13 @@ spec:
notification emails. This field may be updated after the account
is initially registered.
type: string
enableDurationFeature:
description: Enables requesting a Not After date on certificates
that matches the duration of the certificate. This is not supported
by all ACME servers like Let's Encrypt. If set to true when
the ACME server does not support it it will create an error
on the Order. Defaults to false.
type: boolean
externalAccountBinding:
description: ExternalAccountBinding is a reference to a CA external
account of the ACME server. If set, upon registration cert-manager
@@ -20459,6 +20530,13 @@ spec:
notification emails. This field may be updated after the account
is initially registered.
type: string
enableDurationFeature:
description: Enables requesting a Not After date on certificates
that matches the duration of the certificate. This is not supported
by all ACME servers like Let's Encrypt. If set to true when
the ACME server does not support it it will create an error
on the Order. Defaults to false.
type: boolean
externalAccountBinding:
description: ExternalAccountBinding is a reference to a CA external
account of the ACME server. If set, upon registration cert-manager
@@ -22432,6 +22510,13 @@ spec:
notification emails. This field may be updated after the account
is initially registered.
type: string
enableDurationFeature:
description: Enables requesting a Not After date on certificates
that matches the duration of the certificate. This is not supported
by all ACME servers like Let's Encrypt. If set to true when
the ACME server does not support it it will create an error
on the Order. Defaults to false.
type: boolean
externalAccountBinding:
description: ExternalAccountBinding is a reference to a CA external
account of the ACME server. If set, upon registration cert-manager
@@ -24426,9 +24511,9 @@ spec:
properties:
commonName:
description: CommonName is the common name as specified on the DER
encoded CSR. If specified, this value must also be present in `dnsNames`.
This field must match the corresponding field on the DER encoded
CSR.
encoded CSR. If specified, this value must also be present in `dnsNames`
or `ipAddresses`. This field must match the corresponding field
on the DER encoded CSR.
type: string
csr:
description: Certificate signing request bytes in DER encoding. This
@@ -24443,6 +24528,18 @@ spec:
items:
type: string
type: array
duration:
description: Duration is the duration for the not after date for the
requested certificate. this is set on order creation as pe the ACME
spec.
type: string
ipAddresses:
description: IPAddresses is a list of IP addresses that should be
included as part of the Order validation process. This field must
match the corresponding field on the DER encoded CSR.
items:
type: string
type: array
issuerRef:
description: IssuerRef references a properly configured ACME-type
Issuer which should be used to create this Order. If the Issuer
@@ -24464,7 +24561,6 @@ spec:
type: object
required:
- csr
- dnsNames
- issuerRef
type: object
status:
@@ -24634,9 +24730,9 @@ spec:
properties:
commonName:
description: CommonName is the common name as specified on the DER
encoded CSR. If specified, this value must also be present in `dnsNames`.
This field must match the corresponding field on the DER encoded
CSR.
encoded CSR. If specified, this value must also be present in `dnsNames`
or `ipAddresses`. This field must match the corresponding field
on the DER encoded CSR.
type: string
csr:
description: Certificate signing request bytes in DER encoding. This
@@ -24651,6 +24747,18 @@ spec:
items:
type: string
type: array
duration:
description: Duration is the duration for the not after date for the
requested certificate. this is set on order creation as pe the ACME
spec.
type: string
ipAddresses:
description: IPAddresses is a list of IP addresses that should be
included as part of the Order validation process. This field must
match the corresponding field on the DER encoded CSR.
items:
type: string
type: array
issuerRef:
description: IssuerRef references a properly configured ACME-type
Issuer which should be used to create this Order. If the Issuer
@@ -24672,7 +24780,6 @@ spec:
type: object
required:
- csr
- dnsNames
- issuerRef
type: object
status:
@@ -24842,9 +24949,9 @@ spec:
properties:
commonName:
description: CommonName is the common name as specified on the DER
encoded CSR. If specified, this value must also be present in `dnsNames`.
This field must match the corresponding field on the DER encoded
CSR.
encoded CSR. If specified, this value must also be present in `dnsNames`
or `ipAddresses`. This field must match the corresponding field
on the DER encoded CSR.
type: string
dnsNames:
description: DNSNames is a list of DNS names that should be included
@@ -24853,6 +24960,18 @@ spec:
items:
type: string
type: array
duration:
description: Duration is the duration for the not after date for the
requested certificate. this is set on order creation as pe the ACME
spec.
type: string
ipAddresses:
description: IPAddresses is a list of IP addresses that should be
included as part of the Order validation process. This field must
match the corresponding field on the DER encoded CSR.
items:
type: string
type: array
issuerRef:
description: IssuerRef references a properly configured ACME-type
Issuer which should be used to create this Order. If the Issuer
@@ -24879,7 +24998,6 @@ spec:
format: byte
type: string
required:
- dnsNames
- issuerRef
- request
type: object
@@ -25051,9 +25169,9 @@ spec:
properties:
commonName:
description: CommonName is the common name as specified on the DER
encoded CSR. If specified, this value must also be present in `dnsNames`.
This field must match the corresponding field on the DER encoded
CSR.
encoded CSR. If specified, this value must also be present in `dnsNames`
or `ipAddresses`. This field must match the corresponding field
on the DER encoded CSR.
type: string
dnsNames:
description: DNSNames is a list of DNS names that should be included
@@ -25062,6 +25180,18 @@ spec:
items:
type: string
type: array
duration:
description: Duration is the duration for the not after date for the
requested certificate. this is set on order creation as pe the ACME
spec.
type: string
ipAddresses:
description: IPAddresses is a list of IP addresses that should be
included as part of the Order validation process. This field must
match the corresponding field on the DER encoded CSR.
items:
type: string
type: array
issuerRef:
description: IssuerRef references a properly configured ACME-type
Issuer which should be used to create this Order. If the Issuer
@@ -25088,7 +25218,6 @@ spec:
format: byte
type: string
required:
- dnsNames
- issuerRef
- request
type: object
@@ -25225,4 +25354,5 @@ status:
kind: ""
plural: ""
conditions: []
storedVersions: []
storedVersions: []
pkg/controller/standard.oam.dev/v1alpha1/testdata/crds/servicemonitors.yaml
Vendored
+372
View File
@@ -0,0 +1,372 @@
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.4.1
creationTimestamp: null
name: servicemonitors.monitoring.coreos.com
spec:
group: monitoring.coreos.com
names:
kind: ServiceMonitor
listKind: ServiceMonitorList
plural: servicemonitors
singular: servicemonitor
scope: Namespaced
versions:
- name: v1
schema:
openAPIV3Schema:
description: ServiceMonitor defines monitoring for a set of services.
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
description: Specification of desired Service selection for target discovery by Prometheus.
properties:
endpoints:
description: A list of endpoints allowed as part of this ServiceMonitor.
items:
description: Endpoint defines a scrapeable endpoint serving Prometheus metrics.
properties:
basicAuth:
description: 'BasicAuth allow an endpoint to authenticate over basic authentication More info: https://prometheus.io/docs/operating/configuration/#endpoints'
properties:
password:
description: The secret in the service monitor namespace that contains the password for authentication.
properties:
key:
description: The key of the secret to select from. Must be a valid secret key.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
optional:
description: Specify whether the Secret or its key must be defined
type: boolean
required:
- key
type: object
username:
description: The secret in the service monitor namespace that contains the username for authentication.
properties:
key:
description: The key of the secret to select from. Must be a valid secret key.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
optional:
description: Specify whether the Secret or its key must be defined
type: boolean
required:
- key
type: object
type: object
bearerTokenFile:
description: File to read bearer token for scraping targets.
type: string
bearerTokenSecret:
description: Secret to mount to read bearer token for scraping targets. The secret needs to be in the same namespace as the service monitor and accessible by the Prometheus Operator.
properties:
key:
description: The key of the secret to select from. Must be a valid secret key.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
optional:
description: Specify whether the Secret or its key must be defined
type: boolean
required:
- key
type: object
honorLabels:
description: HonorLabels chooses the metric's labels on collisions with target labels.
type: boolean
honorTimestamps:
description: HonorTimestamps controls whether Prometheus respects the timestamps present in scraped data.
type: boolean
interval:
description: Interval at which metrics should be scraped
type: string
metricRelabelings:
description: MetricRelabelConfigs to apply to samples before ingestion.
items:
description: 'RelabelConfig allows dynamic rewriting of the label set, being applied to samples before ingestion. It defines `<metric_relabel_configs>`-section of Prometheus configuration. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs'
properties:
action:
description: Action to perform based on regex matching. Default is 'replace'
type: string
modulus:
description: Modulus to take of the hash of the source label values.
format: int64
type: integer
regex:
description: Regular expression against which the extracted value is matched. Default is '(.*)'
type: string
replacement:
description: Replacement value against which a regex replace is performed if the regular expression matches. Regex capture groups are available. Default is '$1'
type: string
separator:
description: Separator placed between concatenated source label values. default is ';'.
type: string
sourceLabels:
description: The source labels select values from existing labels. Their content is concatenated using the configured separator and matched against the configured regular expression for the replace, keep, and drop actions.
items:
type: string
type: array
targetLabel:
description: Label to which the resulting value is written in a replace action. It is mandatory for replace actions. Regex capture groups are available.
type: string
type: object
type: array
params:
additionalProperties:
items:
type: string
type: array
description: Optional HTTP URL parameters
type: object
path:
description: HTTP path to scrape for metrics.
type: string
port:
description: Name of the service port this endpoint refers to. Mutually exclusive with targetPort.
type: string
proxyUrl:
description: ProxyURL eg http://proxyserver:2195 Directs scrapes to proxy through this endpoint.
type: string
relabelings:
description: 'RelabelConfigs to apply to samples before scraping. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config'
items:
description: 'RelabelConfig allows dynamic rewriting of the label set, being applied to samples before ingestion. It defines `<metric_relabel_configs>`-section of Prometheus configuration. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs'
properties:
action:
description: Action to perform based on regex matching. Default is 'replace'
type: string
modulus:
description: Modulus to take of the hash of the source label values.
format: int64
type: integer
regex:
description: Regular expression against which the extracted value is matched. Default is '(.*)'
type: string
replacement:
description: Replacement value against which a regex replace is performed if the regular expression matches. Regex capture groups are available. Default is '$1'
type: string
separator:
description: Separator placed between concatenated source label values. default is ';'.
type: string
sourceLabels:
description: The source labels select values from existing labels. Their content is concatenated using the configured separator and matched against the configured regular expression for the replace, keep, and drop actions.
items:
type: string
type: array
targetLabel:
description: Label to which the resulting value is written in a replace action. It is mandatory for replace actions. Regex capture groups are available.
type: string
type: object
type: array
scheme:
description: HTTP scheme to use for scraping.
type: string
scrapeTimeout:
description: Timeout after which the scrape is ended
type: string
targetPort:
anyOf:
- type: integer
- type: string
description: Name or number of the target port of the Pod behind the Service, the port must be specified with container port property. Mutually exclusive with port.
x-kubernetes-int-or-string: true
tlsConfig:
description: TLS configuration to use when scraping the endpoint
properties:
ca:
description: Struct containing the CA cert to use for the targets.
properties:
configMap:
description: ConfigMap containing data to use for the targets.
properties:
key:
description: The key to select.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
optional:
description: Specify whether the ConfigMap or its key must be defined
type: boolean
required:
- key
type: object
secret:
description: Secret containing data to use for the targets.
properties:
key:
description: The key of the secret to select from. Must be a valid secret key.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
optional:
description: Specify whether the Secret or its key must be defined
type: boolean
required:
- key
type: object
type: object
caFile:
description: Path to the CA cert in the Prometheus container to use for the targets.
type: string
cert:
description: Struct containing the client cert file for the targets.
properties:
configMap:
description: ConfigMap containing data to use for the targets.
properties:
key:
description: The key to select.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
optional:
description: Specify whether the ConfigMap or its key must be defined
type: boolean
required:
- key
type: object
secret:
description: Secret containing data to use for the targets.
properties:
key:
description: The key of the secret to select from. Must be a valid secret key.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
optional:
description: Specify whether the Secret or its key must be defined
type: boolean
required:
- key
type: object
type: object
certFile:
description: Path to the client cert file in the Prometheus container for the targets.
type: string
insecureSkipVerify:
description: Disable target certificate validation.
type: boolean
keyFile:
description: Path to the client key file in the Prometheus container for the targets.
type: string
keySecret:
description: Secret containing the client key file for the targets.
properties:
key:
description: The key of the secret to select from. Must be a valid secret key.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
optional:
description: Specify whether the Secret or its key must be defined
type: boolean
required:
- key
type: object
serverName:
description: Used to verify the hostname for the targets.
type: string
type: object
type: object
type: array
jobLabel:
description: The label to use to retrieve the job name from.
type: string
namespaceSelector:
description: Selector to select which namespaces the Endpoints objects are discovered from.
properties:
any:
description: Boolean describing whether all namespaces are selected in contrast to a list restricting them.
type: boolean
matchNames:
description: List of namespace names.
items:
type: string
type: array
type: object
podTargetLabels:
description: PodTargetLabels transfers labels on the Kubernetes Pod onto the target.
items:
type: string
type: array
sampleLimit:
description: SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.
format: int64
type: integer
selector:
description: Selector to select Endpoints objects.
properties:
matchExpressions:
description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
items:
description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
properties:
key:
description: key is the label key that the selector applies to.
type: string
operator:
description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
type: string
values:
description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
items:
type: string
type: array
required:
- key
- operator
type: object
type: array
matchLabels:
additionalProperties:
type: string
description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
type: object
type: object
targetLabels:
description: TargetLabels transfers labels on the Kubernetes Service onto the target.
items:
type: string
type: array
targetLimit:
description: TargetLimit defines a limit on the number of scraped targets that will be accepted.
format: int64
type: integer
required:
- endpoints
- selector
type: object
required:
- spec
type: object
served: true
storage: true
status:
acceptedNames:
kind: ""
plural: ""
conditions: []
storedVersions: []