diff --git a/.gitignore b/.gitignore index fbc4daf7..c8c4778f 100644 --- a/.gitignore +++ b/.gitignore @@ -6,6 +6,8 @@ *.dylib fairwinds +!deploy/helm/fairwinds + # Test binary, build with `go test -c` *.test diff --git a/charts/fairwinds/templates/_helpers.tpl b/charts/fairwinds/templates/_helpers.tpl deleted file mode 100644 index 234480de..00000000 --- a/charts/fairwinds/templates/_helpers.tpl +++ /dev/null @@ -1,16 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 24 -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 24 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -*/}} -{{- define "fullname" -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- printf "%s-%s" .Release.Name $name | trunc 24 -}} -{{- end -}} diff --git a/charts/fairwinds/templates/fairwinds-dash.svc.yaml b/charts/fairwinds/templates/fairwinds-dash.svc.yaml deleted file mode 100644 index cf209fc9..00000000 --- a/charts/fairwinds/templates/fairwinds-dash.svc.yaml +++ /dev/null @@ -1,19 +0,0 @@ -{{- if .Values.dashboard.service -}} -apiVersion: v1 -kind: Service -metadata: - labels: - chart: '{{.Chart.Name}}-{{.Chart.Version}}' - heritage: '{{.Release.Service}}' - release: '{{.Release.Name}}' - name: '{{ template "fullname" . }}-dashboard' -spec: - ports: - - name: dashboard - port: 80 - protocol: TCP - targetPort: 8080 - selector: - app: '{{.Release.Name}}' - type: '{{.Values.dashboard.service.type}}' -{{- end -}} diff --git a/charts/fairwinds/templates/fairwinds.clusterrole.yaml b/charts/fairwinds/templates/fairwinds.clusterrole.yaml deleted file mode 100644 index 0177b444..00000000 --- a/charts/fairwinds/templates/fairwinds.clusterrole.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if .Values.rbac.create -}} -apiVersion: rbac.authorization.k8s.io/v1beta1 -kind: ClusterRole -metadata: - labels: - app: '{{.Release.Name}}' - chart: '{{.Chart.Name}}-{{.Chart.Version}}' - heritage: '{{.Release.Service}}' - release: '{{.Release.Name}}' - name: '{{ template "fullname" . }}' -rules: - - apiGroups: - - '' - - 'apps' - - 'admissionregistration.k8s.io' - resources: - - '*' - verbs: - - '*' -{{- end -}} diff --git a/charts/fairwinds/templates/fairwinds.clusterrolebinding.yaml b/charts/fairwinds/templates/fairwinds.clusterrolebinding.yaml deleted file mode 100644 index efd8ad84..00000000 --- a/charts/fairwinds/templates/fairwinds.clusterrolebinding.yaml +++ /dev/null @@ -1,19 +0,0 @@ -{{- if .Values.rbac.create -}} -apiVersion: rbac.authorization.k8s.io/v1beta1 -kind: ClusterRoleBinding -metadata: - labels: - app: '{{.Release.Name}}' - chart: '{{.Chart.Name}}-{{.Chart.Version}}' - heritage: '{{.Release.Service}}' - release: '{{.Release.Name}}' - name: '{{ template "fullname" . }}' -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: '{{ template "fullname" . }}' -subjects: - - kind: ServiceAccount - name: '{{ template "fullname" . }}' - namespace: '{{.Release.Namespace}}' -{{- end -}} diff --git a/charts/fairwinds/templates/fairwinds.configmap.yaml b/charts/fairwinds/templates/fairwinds.configmap.yaml deleted file mode 100644 index d4adbdaf..00000000 --- a/charts/fairwinds/templates/fairwinds.configmap.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - labels: - app: '{{ template "fullname" . }}' - chart: '{{.Chart.Name}}-{{.Chart.Version}}' - heritage: '{{.Release.Service}}' - release: '{{.Release.Name}}' - name: '{{ template "fullname" . }}' -data: - config.yml: {{- toYaml .Values.config | indent 2 -}} diff --git a/charts/fairwinds/templates/fairwinds.secret.yaml b/charts/fairwinds/templates/fairwinds.secret.yaml deleted file mode 100644 index bf89a33b..00000000 --- a/charts/fairwinds/templates/fairwinds.secret.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - labels: - app: '{{ template "fullname" . }}' - chart: '{{.Chart.Name}}-{{.Chart.Version}}' - heritage: '{{.Release.Service}}' - release: '{{.Release.Name}}' - name: '{{ template "fullname" . }}' -type: opaque -data: diff --git a/charts/fairwinds/templates/fairwinds.serviceaccount.yaml b/charts/fairwinds/templates/fairwinds.serviceaccount.yaml deleted file mode 100644 index e18624d2..00000000 --- a/charts/fairwinds/templates/fairwinds.serviceaccount.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - chart: '{{.Chart.Name}}-{{.Chart.Version}}' - heritage: '{{.Release.Service}}' - release: '{{.Release.Name}}' - name: '{{ template "fullname" . }}' diff --git a/charts/fairwinds/values.yaml b/charts/fairwinds/values.yaml deleted file mode 100644 index 79767ce3..00000000 --- a/charts/fairwinds/values.yaml +++ /dev/null @@ -1,96 +0,0 @@ ---- -config: | - resources: - cpuRequestsMissing: warning - cpuRequestRanges: - warning: - below: 50m - above: 1000m - error: - below: 500m - above: 2000m - cpuLimitsMissing: warning - cpuLimitRanges: - warning: - below: 50m - above: 1000m - error: - below: 500m - above: 2000m - memoryRequestsMissing: warning - memoryRequestRanges: - warning: - below: 50M - above: 2G - error: - below: 100M - above: 4G - memoryLimitsMissing: warning - memoryLimitRanges: - warning: - below: 50M - above: 2G - error: - below: 100M - above: 4G - images: - tagNotSpecified: error - pullPolicyNotAlways: warning - whitelist: - error: - - gcr.io/* - blacklist: - warning: - - docker.io/* - healthChecks: - readinessProbeMissing: warning - livenessProbeMissing: warning - networking: - hostAliasSet: error - hostIPCSet: error - hostNetworkSet: error - hostPIDSet: error - hostPortSet: error - security: - runAsPriviliged: warning - notReadOnlyRootFileSystem: warning - runAsNonRoot: warning - capabilities: - blacklist: - error: - - CHOWN - - SYS_CHROOT - - AUDIT_WRITE - whitelist: - warning: - - CHOWN - - DAC_OVERRIDE - - FSETID - - FOWNER - - MKNOD - - NET_RAW - - SETGID - - SETUID - - SETFCAP - - SETPCAP - - NET_BIND_SERVICE - - SYS_CHROOT - - KILL - - AUDIT_WRITE -dashboard: - enable: true - service: - type: ClusterIP - image: - repository: quay.io/reactiveops/fairwinds - tag: dev-80b331447bdaebe1cd0191a165e8d4c1cdaa2e60 - pullPolicy: IfNotPresent -webhook: - enable: false - image: - repository: quay.io/reactiveops/fairwinds - tag: dev-80b331447bdaebe1cd0191a165e8d4c1cdaa2e60 - pullPolicy: IfNotPresent -replicas: 1 -rbac: - create: true diff --git a/charts/fairwinds/Chart.yaml b/deploy/helm/fairwinds/Chart.yaml similarity index 100% rename from charts/fairwinds/Chart.yaml rename to deploy/helm/fairwinds/Chart.yaml diff --git a/charts/fairwinds/templates/NOTES.txt b/deploy/helm/fairwinds/templates/NOTES.txt similarity index 85% rename from charts/fairwinds/templates/NOTES.txt rename to deploy/helm/fairwinds/templates/NOTES.txt index 9c12a4a8..3a1b4c36 100644 --- a/charts/fairwinds/templates/NOTES.txt +++ b/deploy/helm/fairwinds/templates/NOTES.txt @@ -6,7 +6,7 @@ Enjoy Fairwinds and smooth sailing! ## To view the dashboard execute these commands: -kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ template "fullname" . }}-dashboard 8080:80 & +kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ include "fairwinds.name" . }}-dashboard 8080:80 & open http://localhost:8080 {{- end }} diff --git a/deploy/helm/fairwinds/templates/_helpers.tpl b/deploy/helm/fairwinds/templates/_helpers.tpl new file mode 100644 index 00000000..03cc7d8e --- /dev/null +++ b/deploy/helm/fairwinds/templates/_helpers.tpl @@ -0,0 +1,32 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "fairwinds.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "fairwinds.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "fairwinds.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} diff --git a/deploy/helm/fairwinds/templates/clusterrole.yaml b/deploy/helm/fairwinds/templates/clusterrole.yaml new file mode 100644 index 00000000..1ec18b75 --- /dev/null +++ b/deploy/helm/fairwinds/templates/clusterrole.yaml @@ -0,0 +1,20 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + name: {{ include "fairwinds.fullname" . }} + labels: + app.kubernetes.io/name: {{ include "fairwinds.name" . }} + helm.sh/chart: {{ include "fairwinds.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} +rules: + - apiGroups: + - '' + - 'apps' + - 'admissionregistration.k8s.io' + resources: + - '*' + verbs: + - '*' +{{- end -}} diff --git a/deploy/helm/fairwinds/templates/clusterrolebinding.yaml b/deploy/helm/fairwinds/templates/clusterrolebinding.yaml new file mode 100644 index 00000000..55b4015f --- /dev/null +++ b/deploy/helm/fairwinds/templates/clusterrolebinding.yaml @@ -0,0 +1,19 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: {{ include "fairwinds.fullname" . }} + labels: + app.kubernetes.io/name: {{ include "fairwinds.name" . }} + helm.sh/chart: {{ include "fairwinds.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "fairwinds.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ include "fairwinds.fullname" . }} + namespace: {{ .Release.Namespace }} +{{- end -}} diff --git a/deploy/helm/fairwinds/templates/configmap.yaml b/deploy/helm/fairwinds/templates/configmap.yaml new file mode 100644 index 00000000..79a0abb2 --- /dev/null +++ b/deploy/helm/fairwinds/templates/configmap.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "fairwinds.fullname" . }} + labels: + app.kubernetes.io/name: {{ include "fairwinds.name" . }} + helm.sh/chart: {{ include "fairwinds.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} +data: + config.yaml: {{- toYaml .Values.config | indent 2 -}} diff --git a/charts/fairwinds/templates/fairwinds.deployment-dashboard.yaml b/deploy/helm/fairwinds/templates/dashboard.deployment.yaml similarity index 52% rename from charts/fairwinds/templates/fairwinds.deployment-dashboard.yaml rename to deploy/helm/fairwinds/templates/dashboard.deployment.yaml index bc6222bc..db86ecef 100644 --- a/charts/fairwinds/templates/fairwinds.deployment-dashboard.yaml +++ b/deploy/helm/fairwinds/templates/dashboard.deployment.yaml @@ -3,30 +3,35 @@ apiVersion: extensions/v1beta1 kind: Deployment metadata: annotations: - checksum/config: '{{ include (print $.Template.BasePath "/fairwinds.configmap.yaml") . | sha256sum }}' + checksum/config: '{{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}' + name: {{ include "fairwinds.fullname" . }}-dashboard labels: - app: '{{.Release.Name}}' - chart: '{{.Chart.Name}}-{{.Chart.Version}}' - heritage: '{{.Release.Service}}' - release: '{{.Release.Name}}' - name: '{{ template "fullname" . }}-dashboard' + app.kubernetes.io/name: {{ include "fairwinds.name" . }} + helm.sh/chart: {{ include "fairwinds.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + component: dashboard spec: replicas: {{.Values.dashboard.replicas}} selector: matchLabels: - app: '{{.Release.Name}}' + app.kubernetes.io/name: {{ include "fairwinds.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + component: dashboard template: metadata: labels: - app: '{{.Release.Name}}' + app.kubernetes.io/name: {{ include "fairwinds.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + component: dashboard spec: volumes: - configMap: - name: '{{ template "fullname" . }}' - name: '{{ template "fullname" . }}' + name: {{ include "fairwinds.name" . }} + name: {{ include "fairwinds.name" . }} - name: certs secret: - secretName: '{{ template "fullname" . }}' + secretName: {{ include "fairwinds.name" . }} containers: - command: - fairwinds @@ -56,9 +61,9 @@ spec: cpu: 100m memory: 128Mi volumeMounts: - - mountPath: /opt/app/config.yml - name: '{{ template "fullname" . }}' + - mountPath: /opt/app/config.yaml + name: {{ include "fairwinds.name" . }} readOnly: true - subPath: config.yml - serviceAccountName: '{{ template "fullname" . }}' + subPath: config.yaml + serviceAccountName: {{ include "fairwinds.name" . }} {{- end -}} diff --git a/deploy/helm/fairwinds/templates/dashboard.service.yaml b/deploy/helm/fairwinds/templates/dashboard.service.yaml new file mode 100644 index 00000000..c87d0a94 --- /dev/null +++ b/deploy/helm/fairwinds/templates/dashboard.service.yaml @@ -0,0 +1,21 @@ +{{- if .Values.dashboard.service -}} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "fairwinds.fullname" . }}-dashboard + labels: + app.kubernetes.io/name: {{ include "fairwinds.name" . }} + helm.sh/chart: {{ include "fairwinds.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} +spec: + ports: + - name: dashboard + port: 80 + protocol: TCP + targetPort: 8080 + selector: + app.kubernetes.io/name: {{ .Release.Name }} + component: dashboard + type: {{ .Values.dashboard.service.type }} +{{- end -}} diff --git a/deploy/helm/fairwinds/templates/secret.yaml b/deploy/helm/fairwinds/templates/secret.yaml new file mode 100644 index 00000000..68a43b06 --- /dev/null +++ b/deploy/helm/fairwinds/templates/secret.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "fairwinds.fullname" . }} + labels: + app.kubernetes.io/name: {{ include "fairwinds.name" . }} + helm.sh/chart: {{ include "fairwinds.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} +type: opaque +data: diff --git a/deploy/helm/fairwinds/templates/serviceaccount.yaml b/deploy/helm/fairwinds/templates/serviceaccount.yaml new file mode 100644 index 00000000..3004081b --- /dev/null +++ b/deploy/helm/fairwinds/templates/serviceaccount.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "fairwinds.fullname" . }} + labels: + app.kubernetes.io/name: {{ include "fairwinds.name" . }} + helm.sh/chart: {{ include "fairwinds.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} diff --git a/charts/fairwinds/templates/fairwinds.deployment-webook.yaml b/deploy/helm/fairwinds/templates/webhook.deployment.yaml similarity index 58% rename from charts/fairwinds/templates/fairwinds.deployment-webook.yaml rename to deploy/helm/fairwinds/templates/webhook.deployment.yaml index 32537440..0d63c01a 100644 --- a/charts/fairwinds/templates/fairwinds.deployment-webook.yaml +++ b/deploy/helm/fairwinds/templates/webhook.deployment.yaml @@ -4,29 +4,34 @@ kind: Deployment metadata: annotations: checksum/config: '{{ include (print $.Template.BasePath "/fairwinds.configmap.yaml") . | sha256sum }}' + name: {{ include "fairwinds.fullname" . }}-webhook labels: - app: '{{.Release.Name}}' - chart: '{{.Chart.Name}}-{{.Chart.Version}}' - heritage: '{{.Release.Service}}' - release: '{{.Release.Name}}' - name: '{{ template "fullname" . }}-webhook' + app.kubernetes.io/name: {{ include "fairwinds.name" . }} + helm.sh/chart: {{ include "fairwinds.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + component: webhook spec: - replicas: {{.Values.webhookreplicas}} + replicas: {{ .Values.webhook.replicas }} selector: matchLabels: - app: '{{.Release.Name}}' + app.kubernetes.io/name: {{ include "fairwinds.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + component: webhook template: metadata: labels: - app: '{{.Release.Name}}' + app.kubernetes.io/name: {{ include "fairwinds.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + component: webhook spec: volumes: - configMap: - name: '{{ template "fullname" . }}' - name: '{{ template "fullname" . }}' + name: {{ include "fairwinds.name" . }} + name: {{ include "fairwinds.name" . }} - name: certs secret: - secretName: '{{ template "fullname" . }}' + secretName: {{ include "fairwinds.name" . }} containers: - command: - fairwinds @@ -39,7 +44,7 @@ spec: livenessProbe: exec: command: - - sh + - sh - -c - ps -ef | grep fairwinds initialDelaySeconds: 5 @@ -60,8 +65,8 @@ spec: - mountPath: /tmp/cert/ name: certs - mountPath: /opt/app/config.yml - name: '{{ template "fullname" . }}' + name: {{ include "fairwinds.name" . }} readOnly: true subPath: config.yml - serviceAccountName: '{{ template "fullname" . }}' + serviceAccountName: {{ include "fairwinds.name" . }} {{- end -}} diff --git a/deploy/helm/fairwinds/values.yaml b/deploy/helm/fairwinds/values.yaml new file mode 100644 index 00000000..67d26e6d --- /dev/null +++ b/deploy/helm/fairwinds/values.yaml @@ -0,0 +1,66 @@ +--- +config: | +resources: + cpuRequestsMissing: error + cpuLimitsMissing: error + memoryRequestsMissing: error + memoryLimitsMissing: error +images: + tagNotSpecified: error +healthChecks: + readinessProbeMissing: warning + livenessProbeMissing: warning +networking: + hostAliasSet: error + hostIPCSet: error + hostNetworkSet: error + hostPIDSet: error + hostPortSet: error +security: + runAsRootAllowed: warning + runAsPrivileged: error + notReadOnlyRootFileSystem: warning + privilegeEscalationAllowed: error + capabilities: + error: + ifAnyAdded: + - SYS_ADMIN + - NET_ADMIN + - ALL + warning: + ifAnyAddedBeyond: + - CHOWN + - DAC_OVERRIDE + - FSETID + - FOWNER + - MKNOD + - NET_RAW + - SETGID + - SETUID + - SETFCAP + - SETPCAP + - NET_BIND_SERVICE + - SYS_CHROOT + - KILL + - AUDIT_WRITE + +dashboard: + enable: true + replicas: 1 + service: + type: ClusterIP + image: + repository: quay.io/reactiveops/fairwinds + tag: dev-7263ff7e59b3809bf8ea5e7845261a9da14752c7 + pullPolicy: Always + +webhook: + enable: false + replicas: 1 + image: + repository: quay.io/reactiveops/fairwinds + tag: dev-7263ff7e59b3809bf8ea5e7845261a9da14752c7 + pullPolicy: Always + +rbac: + create: true