Skip to content

Commit 9cdf589

Browse files
flavioflavio
committed
Initial release
1 parent 0c66e78 commit 9cdf589

12 files changed

+563
-0
lines changed

‎.github/workflows/helm-chart-release.yml

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# This action releases the chimera-controller helm chart
2+
# The action must run on each commit done against master, however
3+
# a new release will be performed **only** when a change occurs inside
4+
# of the `charts` directory.
5+
#
6+
# When the helm chart is changed, this action will:
7+
# * Create a new GitHub release named: chimera-controller-chart
8+
# * This release has a chimera-controller-chart.tar.gz asset associated with
9+
# it. This is the actual helm chart
10+
# * Update the `index.yaml` file inside of the `gh-pages` branch. This is the
11+
# index of the helm chart repository, which we serve through GitHub pages
12+
#
13+
# = FAQ
14+
#
15+
# == Why don't we run this action only when a tag like `v*` is created?
16+
#
17+
# Running the action only when a "release tag" is created will not produce
18+
# a helm chart. That happens because the code which determines if something
19+
# changed inside of the `charts` directory will not find any changes.
20+
#
21+
# == The action is just a "wrapper" around the official `github.com/helm/chart-releaser` tool, can't we just create our own action?
22+
#
23+
# Yes, we even got that to work. However, what we really want to do is the
24+
# ability to tag the releases of the chimera-controller and its helm chart
25+
# in an independent way. Which what the official GitHub action already does.
26+
27+
name: Release helm chart
28+
29+
on:
30+
push:
31+
branches:
32+
- main
33+
34+
jobs:
35+
release:
36+
runs-on: ubuntu-latest
37+
steps:
38+
- name: Checkout
39+
uses: actions/checkout@v2
40+
with:
41+
fetch-depth: 0
42+
43+
- name: Configure Git
44+
run: |
45+
git config user.name "$GITHUB_ACTOR"
46+
git config user.email "[email protected]"
47+
48+
- name: Install Helm
49+
uses: azure/setup-helm@v1
50+
with:
51+
version: v3.4.0
52+
53+
- name: Run chart-releaser
54+
uses: helm/[email protected]
55+
with:
56+
charts_dir: charts
57+
env:
58+
CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

‎charts/chimera-controller/.helmignore

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎charts/chimera-controller/Chart.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: v2
2+
name: chimera-controller
3+
description: A Helm chart for deploying the Chimera stack
4+
5+
type: application
6+
7+
# This is the chart version. This version number should be incremented each time you make changes
8+
# to the chart and its templates, including the app version.
9+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
10+
version: 0.1.0
11+
12+
# This is the version number of the application being deployed. This version number should be
13+
# incremented each time you make changes to the application. Versions are not expected to
14+
# follow Semantic Versioning. They should reflect the version the application is using.
15+
# It is recommended to use it with quotes.
16+
appVersion: "0.1.0"

‎charts/chimera-controller/crds/admissionpolicies.yaml

+75
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
apiVersion: apiextensions.k8s.io/v1
2+
kind: CustomResourceDefinition
3+
metadata:
4+
annotations:
5+
controller-gen.kubebuilder.io/version: v0.4.1
6+
creationTimestamp: null
7+
name: admissionpolicies.chimera.suse.com
8+
spec:
9+
group: chimera.suse.com
10+
names:
11+
kind: AdmissionPolicy
12+
listKind: AdmissionPolicyList
13+
plural: admissionpolicies
14+
singular: admissionpolicy
15+
scope: Cluster
16+
versions:
17+
- name: v1alpha1
18+
schema:
19+
openAPIV3Schema:
20+
description: AdmissionPolicy is the Schema for the admissionpolicies API
21+
properties:
22+
apiVersion:
23+
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
24+
type: string
25+
kind:
26+
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
27+
type: string
28+
metadata:
29+
type: object
30+
spec:
31+
description: AdmissionPolicySpec defines the desired state of AdmissionPolicy
32+
properties:
33+
apiGroups:
34+
description: APIGroups is a list of API groups that this webhook should be registered against. Empty array or "*" means everything.
35+
items:
36+
type: string
37+
type: array
38+
apiVersions:
39+
description: APIVersions is a list of API versions that this webhook should be registered against. Empty array or "*" means everything.
40+
items:
41+
type: string
42+
type: array
43+
failurePolicy:
44+
description: FailurePolicy defines how unrecognized errors and timeout errors from the policy are handled. Allowed values are "Ignore" or "Fail". * "Ignore" means that an error calling the webhook is ignored and the API request is allowed to continue. * "Fail" means that an error calling the webhook causes the admission to fail and the API request to be rejected. The default behaviour is "Fail"
45+
type: string
46+
module:
47+
description: Module is the location of the WASM module to be loaded. Can be a local file (file://), a remote file served by an HTTP server (http://, https://), or an artifact served by an OCI-compatible registry (registry://).
48+
type: string
49+
operations:
50+
description: Operations is a list of operations that this webhook should be registered against. Empty array or "*" means everything.
51+
items:
52+
type: string
53+
type: array
54+
resources:
55+
description: Resources is a list of resource types that this webhook should be registered against. Empty array or "*" means everything.
56+
items:
57+
type: string
58+
type: array
59+
settings:
60+
description: 'Settings is a free-form object that contains the policy configuration values. x-kubernetes-embedded-resource: false'
61+
type: object
62+
x-kubernetes-preserve-unknown-fields: true
63+
type: object
64+
status:
65+
description: AdmissionPolicyStatus defines the observed state of AdmissionPolicy
66+
type: object
67+
type: object
68+
served: true
69+
storage: true
70+
status:
71+
acceptedNames:
72+
kind: ""
73+
plural: ""
74+
conditions: []
75+
storedVersions: []

‎charts/chimera-controller/templates/NOTES.txt

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
chimera-controller installed.
2+
3+
You can start defining chimera policies by using the `admissionpolicies.chimera.suse.com`
4+
resource.
5+
6+
For more information checkout https://chimera-kube.github.io/

‎charts/chimera-controller/templates/_helpers.tpl

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "chimera-controller.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "chimera-controller.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "chimera-controller.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "chimera-controller.labels" -}}
37+
helm.sh/chart: {{ include "chimera-controller.chart" . }}
38+
{{ include "chimera-controller.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "chimera-controller.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "chimera-controller.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}
52+
53+
{{/*
54+
Create the name of the service account to use
55+
*/}}
56+
{{- define "chimera-controller.serviceAccountName" -}}
57+
{{- include "chimera-controller.fullname" . }}
58+
{{- end }}

‎charts/chimera-controller/templates/configmap.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: policy-server
5+
data:
6+
replicas: {{ .Values.policyServer.replicaCount | default 1 }}
7+
image: {{ .Values.policyServer.image.repository }}:{{ .Values.policyServer.image.tag }}
8+

‎charts/chimera-controller/templates/deployment.yaml

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ include "chimera-controller.fullname" . }}
5+
labels:
6+
{{- include "chimera-controller.labels" . | nindent 4 }}
7+
spec:
8+
replicas: 1
9+
selector:
10+
matchLabels:
11+
{{- include "chimera-controller.selectorLabels" . | nindent 6 }}
12+
template:
13+
metadata:
14+
{{- with .Values.podAnnotations }}
15+
annotations:
16+
{{- toYaml . | nindent 8 }}
17+
{{- end }}
18+
labels:
19+
{{- include "chimera-controller.selectorLabels" . | nindent 8 }}
20+
spec:
21+
{{- with .Values.imagePullSecrets }}
22+
imagePullSecrets:
23+
{{- toYaml . | nindent 8 }}
24+
{{- end }}
25+
serviceAccountName: {{ include "chimera-controller.serviceAccountName" . }}
26+
containers:
27+
- name: kube-rbac-proxy
28+
args:
29+
- --secure-listen-address=0.0.0.0:8443
30+
- --upstream=http://127.0.0.1:8080/
31+
- --logtostderr=true
32+
- --v=10
33+
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.5.0
34+
ports:
35+
- containerPort: 8443
36+
name: https
37+
- name: manager
38+
args:
39+
- --metrics-addr=127.0.0.1:8080
40+
- --enable-leader-election
41+
- --deployments-namespace={{ .Release.Namespace }}
42+
command:
43+
- /manager
44+
image: '{{ .Values.image.repository | default "ghcr.io/chimera-kube/chimera-controller" }}:{{ .Values.image.tag | default .Chart.AppVersion }}'
45+
imagePullPolicy: {{ .Values.image.pullPolicy }}
46+
resources:
47+
limits:
48+
cpu: 100m
49+
memory: 30Mi
50+
requests:
51+
cpu: 100m
52+
memory: 20Mi
53+
terminationGracePeriodSeconds: 10
54+
{{- with .Values.nodeSelector }}
55+
nodeSelector:
56+
{{- toYaml . | nindent 8 }}
57+
{{- end }}
58+
{{- with .Values.affinity }}
59+
affinity:
60+
{{- toYaml . | nindent 8 }}
61+
{{- end }}
62+
{{- with .Values.tolerations }}
63+
tolerations:
64+
{{- toYaml . | nindent 8 }}
65+
{{- end }}

0 commit comments

Comments
 (0)