github/polaris
1
0
Fork 0
mirror of https://github.com/FairwindsOps/polaris.git synced 2026-08-23 22:26:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Major chart improvements

Browse Source
This commit is contained in:
Andrew Suderman
2019-04-09 15:19:38 -06:00
parent 2e7e4794ae
commit b30ebf1cf4
21 changed files with 231 additions and 230 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+2
View File
@@ -6,6 +6,8 @@
*.dylib
fairwinds
!deploy/helm/fairwinds
# Test binary, build with `go test -c`
*.test
charts/fairwinds/templates/_helpers.tpl
-16
View File
@@ -1,16 +0,0 @@
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 24 -}}
{{- end -}}
{{/*
Create a default fully qualified app name.
We truncate at 24 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "fullname" -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- printf "%s-%s" .Release.Name $name | trunc 24 -}}
{{- end -}}
charts/fairwinds/templates/fairwinds-dash.svc.yaml
-19
View File
@@ -1,19 +0,0 @@
{{- if .Values.dashboard.service -}}
apiVersion: v1
kind: Service
metadata:
labels:
chart: '{{.Chart.Name}}-{{.Chart.Version}}'
heritage: '{{.Release.Service}}'
release: '{{.Release.Name}}'
name: '{{ template "fullname" . }}-dashboard'
spec:
ports:
- name: dashboard
port: 80
protocol: TCP
targetPort: 8080
selector:
app: '{{.Release.Name}}'
type: '{{.Values.dashboard.service.type}}'
{{- end -}}
charts/fairwinds/templates/fairwinds.clusterrole.yaml
-20
View File
@@ -1,20 +0,0 @@
{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
labels:
app: '{{.Release.Name}}'
chart: '{{.Chart.Name}}-{{.Chart.Version}}'
heritage: '{{.Release.Service}}'
release: '{{.Release.Name}}'
name: '{{ template "fullname" . }}'
rules:
- apiGroups:
- ''
- 'apps'
- 'admissionregistration.k8s.io'
resources:
- '*'
verbs:
- '*'
{{- end -}}
charts/fairwinds/templates/fairwinds.clusterrolebinding.yaml
-19
View File
@@ -1,19 +0,0 @@
{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
labels:
app: '{{.Release.Name}}'
chart: '{{.Chart.Name}}-{{.Chart.Version}}'
heritage: '{{.Release.Service}}'
release: '{{.Release.Name}}'
name: '{{ template "fullname" . }}'
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: '{{ template "fullname" . }}'
subjects:
- kind: ServiceAccount
name: '{{ template "fullname" . }}'
namespace: '{{.Release.Namespace}}'
{{- end -}}
charts/fairwinds/templates/fairwinds.configmap.yaml
-11
View File
@@ -1,11 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
labels:
app: '{{ template "fullname" . }}'
chart: '{{.Chart.Name}}-{{.Chart.Version}}'
heritage: '{{.Release.Service}}'
release: '{{.Release.Name}}'
name: '{{ template "fullname" . }}'
data:
config.yml: {{- toYaml .Values.config | indent 2 -}}
charts/fairwinds/templates/fairwinds.secret.yaml
-11
View File
@@ -1,11 +0,0 @@
apiVersion: v1
kind: Secret
metadata:
labels:
app: '{{ template "fullname" . }}'
chart: '{{.Chart.Name}}-{{.Chart.Version}}'
heritage: '{{.Release.Service}}'
release: '{{.Release.Name}}'
name: '{{ template "fullname" . }}'
type: opaque
data:
charts/fairwinds/templates/fairwinds.serviceaccount.yaml
-8
View File
@@ -1,8 +0,0 @@
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
chart: '{{.Chart.Name}}-{{.Chart.Version}}'
heritage: '{{.Release.Service}}'
release: '{{.Release.Name}}'
name: '{{ template "fullname" . }}'
charts/fairwinds/values.yaml
-96
View File
@@ -1,96 +0,0 @@
---
config: |
resources:
cpuRequestsMissing: warning
cpuRequestRanges:
warning:
below: 50m
above: 1000m
error:
below: 500m
above: 2000m
cpuLimitsMissing: warning
cpuLimitRanges:
warning:
below: 50m
above: 1000m
error:
below: 500m
above: 2000m
memoryRequestsMissing: warning
memoryRequestRanges:
warning:
below: 50M
above: 2G
error:
below: 100M
above: 4G
memoryLimitsMissing: warning
memoryLimitRanges:
warning:
below: 50M
above: 2G
error:
below: 100M
above: 4G
images:
tagNotSpecified: error
pullPolicyNotAlways: warning
whitelist:
error:
- gcr.io/*
blacklist:
warning:
- docker.io/*
healthChecks:
readinessProbeMissing: warning
livenessProbeMissing: warning
networking:
hostAliasSet: error
hostIPCSet: error
hostNetworkSet: error
hostPIDSet: error
hostPortSet: error
security:
runAsPriviliged: warning
notReadOnlyRootFileSystem: warning
runAsNonRoot: warning
capabilities:
blacklist:
error:
- CHOWN
- SYS_CHROOT
- AUDIT_WRITE
whitelist:
warning:
- CHOWN
- DAC_OVERRIDE
- FSETID
- FOWNER
- MKNOD
- NET_RAW
- SETGID
- SETUID
- SETFCAP
- SETPCAP
- NET_BIND_SERVICE
- SYS_CHROOT
- KILL
- AUDIT_WRITE
dashboard:
enable: true
service:
type: ClusterIP
image:
repository: quay.io/reactiveops/fairwinds
tag: dev-80b331447bdaebe1cd0191a165e8d4c1cdaa2e60
pullPolicy: IfNotPresent
webhook:
enable: false
image:
repository: quay.io/reactiveops/fairwinds
tag: dev-80b331447bdaebe1cd0191a165e8d4c1cdaa2e60
pullPolicy: IfNotPresent
replicas: 1
rbac:
create: true
charts/fairwinds/Chart.yaml → deploy/helm/fairwinds/Chart.yaml
View File
charts/fairwinds/templates/NOTES.txt → deploy/helm/fairwinds/templates/NOTES.txt
+1 -1
View File
@@ -6,7 +6,7 @@ Enjoy Fairwinds and smooth sailing!
## To view the dashboard execute these commands:
kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ template "fullname" . }}-dashboard 8080:80 &
kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ include "fairwinds.name" . }}-dashboard 8080:80 &
open http://localhost:8080
{{- end }}
deploy/helm/fairwinds/templates/_helpers.tpl
+32
View File
@@ -0,0 +1,32 @@
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "fairwinds.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "fairwinds.fullname" -}}
{{- if .Values.fullnameOverride -}}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "fairwinds.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- end -}}
deploy/helm/fairwinds/templates/clusterrole.yaml
+20
View File
@@ -0,0 +1,20 @@
{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: {{ include "fairwinds.fullname" . }}
labels:
app.kubernetes.io/name: {{ include "fairwinds.name" . }}
helm.sh/chart: {{ include "fairwinds.chart" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
rules:
- apiGroups:
- ''
- 'apps'
- 'admissionregistration.k8s.io'
resources:
- '*'
verbs:
- '*'
{{- end -}}
deploy/helm/fairwinds/templates/clusterrolebinding.yaml
+19
View File
@@ -0,0 +1,19 @@
{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: {{ include "fairwinds.fullname" . }}
labels:
app.kubernetes.io/name: {{ include "fairwinds.name" . }}
helm.sh/chart: {{ include "fairwinds.chart" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{ include "fairwinds.fullname" . }}
subjects:
- kind: ServiceAccount
name: {{ include "fairwinds.fullname" . }}
namespace: {{ .Release.Namespace }}
{{- end -}}
deploy/helm/fairwinds/templates/configmap.yaml
+11
View File
@@ -0,0 +1,11 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "fairwinds.fullname" . }}
labels:
app.kubernetes.io/name: {{ include "fairwinds.name" . }}
helm.sh/chart: {{ include "fairwinds.chart" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
data:
config.yaml: {{- toYaml .Values.config | indent 2 -}}
charts/fairwinds/templates/fairwinds.deployment-dashboard.yaml → deploy/helm/fairwinds/templates/dashboard.deployment.yaml
+20 -15
View File
@@ -3,30 +3,35 @@ apiVersion: extensions/v1beta1
kind: Deployment
metadata:
annotations:
checksum/config: '{{ include (print $.Template.BasePath "/fairwinds.configmap.yaml") . | sha256sum }}'
checksum/config: '{{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}'
name: {{ include "fairwinds.fullname" . }}-dashboard
labels:
app: '{{.Release.Name}}'
chart: '{{.Chart.Name}}-{{.Chart.Version}}'
heritage: '{{.Release.Service}}'
release: '{{.Release.Name}}'
name: '{{ template "fullname" . }}-dashboard'
app.kubernetes.io/name: {{ include "fairwinds.name" . }}
helm.sh/chart: {{ include "fairwinds.chart" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
component: dashboard
spec:
replicas: {{.Values.dashboard.replicas}}
selector:
matchLabels:
app: '{{.Release.Name}}'
app.kubernetes.io/name: {{ include "fairwinds.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
component: dashboard
template:
metadata:
labels:
app: '{{.Release.Name}}'
app.kubernetes.io/name: {{ include "fairwinds.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
component: dashboard
spec:
volumes:
- configMap:
name: '{{ template "fullname" . }}'
name: '{{ template "fullname" . }}'
name: {{ include "fairwinds.name" . }}
name: {{ include "fairwinds.name" . }}
- name: certs
secret:
secretName: '{{ template "fullname" . }}'
secretName: {{ include "fairwinds.name" . }}
containers:
- command:
- fairwinds
@@ -56,9 +61,9 @@ spec:
cpu: 100m
memory: 128Mi
volumeMounts:
- mountPath: /opt/app/config.yml
name: '{{ template "fullname" . }}'
- mountPath: /opt/app/config.yaml
name: {{ include "fairwinds.name" . }}
readOnly: true
subPath: config.yml
serviceAccountName: '{{ template "fullname" . }}'
subPath: config.yaml
serviceAccountName: {{ include "fairwinds.name" . }}
{{- end -}}
deploy/helm/fairwinds/templates/dashboard.service.yaml
+21
View File
@@ -0,0 +1,21 @@
{{- if .Values.dashboard.service -}}
apiVersion: v1
kind: Service
metadata:
name: {{ include "fairwinds.fullname" . }}-dashboard
labels:
app.kubernetes.io/name: {{ include "fairwinds.name" . }}
helm.sh/chart: {{ include "fairwinds.chart" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
spec:
ports:
- name: dashboard
port: 80
protocol: TCP
targetPort: 8080
selector:
app.kubernetes.io/name: {{ .Release.Name }}
component: dashboard
type: {{ .Values.dashboard.service.type }}
{{- end -}}
deploy/helm/fairwinds/templates/secret.yaml
+11
View File
@@ -0,0 +1,11 @@
apiVersion: v1
kind: Secret
metadata:
name: {{ include "fairwinds.fullname" . }}
labels:
app.kubernetes.io/name: {{ include "fairwinds.name" . }}
helm.sh/chart: {{ include "fairwinds.chart" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
type: opaque
data:
deploy/helm/fairwinds/templates/serviceaccount.yaml
+9
View File
@@ -0,0 +1,9 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "fairwinds.fullname" . }}
labels:
app.kubernetes.io/name: {{ include "fairwinds.name" . }}
helm.sh/chart: {{ include "fairwinds.chart" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
charts/fairwinds/templates/fairwinds.deployment-webook.yaml → deploy/helm/fairwinds/templates/webhook.deployment.yaml
+19 -14
View File
@@ -4,29 +4,34 @@ kind: Deployment
metadata:
annotations:
checksum/config: '{{ include (print $.Template.BasePath "/fairwinds.configmap.yaml") . | sha256sum }}'
name: {{ include "fairwinds.fullname" . }}-webhook
labels:
app: '{{.Release.Name}}'
chart: '{{.Chart.Name}}-{{.Chart.Version}}'
heritage: '{{.Release.Service}}'
release: '{{.Release.Name}}'
name: '{{ template "fullname" . }}-webhook'
app.kubernetes.io/name: {{ include "fairwinds.name" . }}
helm.sh/chart: {{ include "fairwinds.chart" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
component: webhook
spec:
replicas: {{.Values.webhookreplicas}}
replicas: {{ .Values.webhook.replicas }}
selector:
matchLabels:
app: '{{.Release.Name}}'
app.kubernetes.io/name: {{ include "fairwinds.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
component: webhook
template:
metadata:
labels:
app: '{{.Release.Name}}'
app.kubernetes.io/name: {{ include "fairwinds.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
component: webhook
spec:
volumes:
- configMap:
name: '{{ template "fullname" . }}'
name: '{{ template "fullname" . }}'
name: {{ include "fairwinds.name" . }}
name: {{ include "fairwinds.name" . }}
- name: certs
secret:
secretName: '{{ template "fullname" . }}'
secretName: {{ include "fairwinds.name" . }}
containers:
- command:
- fairwinds
@@ -39,7 +44,7 @@ spec:
livenessProbe:
exec:
command:
- sh
- sh
- -c
- ps -ef | grep fairwinds
initialDelaySeconds: 5
@@ -60,8 +65,8 @@ spec:
- mountPath: /tmp/cert/
name: certs
- mountPath: /opt/app/config.yml
name: '{{ template "fullname" . }}'
name: {{ include "fairwinds.name" . }}
readOnly: true
subPath: config.yml
serviceAccountName: '{{ template "fullname" . }}'
serviceAccountName: {{ include "fairwinds.name" . }}
{{- end -}}
deploy/helm/fairwinds/values.yaml
+66
View File
@@ -0,0 +1,66 @@
---
config: |
resources:
cpuRequestsMissing: error
cpuLimitsMissing: error
memoryRequestsMissing: error
memoryLimitsMissing: error
images:
tagNotSpecified: error
healthChecks:
readinessProbeMissing: warning
livenessProbeMissing: warning
networking:
hostAliasSet: error
hostIPCSet: error
hostNetworkSet: error
hostPIDSet: error
hostPortSet: error
security:
runAsRootAllowed: warning
runAsPrivileged: error
notReadOnlyRootFileSystem: warning
privilegeEscalationAllowed: error
capabilities:
error:
ifAnyAdded:
- SYS_ADMIN
- NET_ADMIN
- ALL
warning:
ifAnyAddedBeyond:
- CHOWN
- DAC_OVERRIDE
- FSETID
- FOWNER
- MKNOD
- NET_RAW
- SETGID
- SETUID
- SETFCAP
- SETPCAP
- NET_BIND_SERVICE
- SYS_CHROOT
- KILL
- AUDIT_WRITE
dashboard:
enable: true
replicas: 1
service:
type: ClusterIP
image:
repository: quay.io/reactiveops/fairwinds
tag: dev-7263ff7e59b3809bf8ea5e7845261a9da14752c7
pullPolicy: Always
webhook:
enable: false
replicas: 1
image:
repository: quay.io/reactiveops/fairwinds
tag: dev-7263ff7e59b3809bf8ea5e7845261a9da14752c7
pullPolicy: Always
rbac:
create: true