Skip to content

Commit

Permalink
Merge pull request #785 from truefoundry/support_additional_clusterro…
Browse files Browse the repository at this point in the history 
…le_rules

support additional cluster scoped cluster role rules
  • Loading branch information
@shubhamrai1993
shubhamrai1993 authored Nov 12, 2024
2 parents c8ad502 + 7f3dfdd commit 1b8a748
Show file tree
Hide file tree
Showing 4 changed files with 38 additions and 25 deletions.
2 changes: 1 addition & 1 deletion charts/tfy-agent/Chart.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ type: application
# This is the chart version. This version number should be incremented each time you make changes
# to the chart and its templates, including the app version.
# Versions are expected to follow Semantic Versioning (https://semver.org/)
version: 0.2.35
version: 0.2.36

# This is the version number of the application being deployed. This version number should be
# incremented each time you make changes to the application. Versions are not expected to
Expand Down
49 changes: 25 additions & 24 deletions charts/tfy-agent/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -111,30 +111,31 @@ This application has two parts.

### tfyAgentProxy configuration parameters

| Name | Description | Value |
| ---------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------ |
| `tfyAgentProxy.enabled` | Bool value to deploy tfyAgentProxy | `true` |
| `tfyAgentProxy.annotations` | Add annotations to tfyAgentProxy pods | `{}` |
| `tfyAgentProxy.image.repository` | tfyAgentProxy repository | `tfy.jfrog.io/tfy-images/tfy-agent-proxy` |
| `tfyAgentProxy.image.pullPolicy` | Pull policy for tfyAgentProxy | `IfNotPresent` |
| `tfyAgentProxy.image.tag` | Image tag whose default is the chart appVersion. | `0823e317799add6beaaa4037b81068f6c25f3bf7` |
| `tfyAgentProxy.extraEnvVars` | Additional envrionment variables for tfyAgentPRoxy | `[]` |
| `tfyAgentProxy.resources.limits.cpu` | CPU resource limits for tfyAgentProxy container. Advised to only increase the limits and not decrease it | `500m` |
| `tfyAgentProxy.resources.limits.memory` | Memory Resource limits for tfyAgentProxy container. Advised to only increase the limits and not decrease it | `512Mi` |
| `tfyAgentProxy.resources.limits.ephemeral-storage` | Ephemeral storage Resource limits for tfyAgentProxy container. Advised to only increase the limits and not decrease it | `500M` |
| `tfyAgentProxy.resources.requests.cpu` | CPU resource requests for tfyAgentProxy container. Advised to only increase the requests and not decrease it | `50m` |
| `tfyAgentProxy.resources.requests.memory` | Memory Resource requests for tfyAgentProxy container. Advised to only increase the requests and not decrease it | `128Mi` |
| `tfyAgentProxy.resources.requests.ephemeral-storage` | Ephemeral storage Resource requests for tfyAgentProxy container. Advised to only increase the requests and not decrease it | `200M` |
| `tfyAgentProxy.securityContext` | Security Context for the tfyAgentProxy container | `{}` |
| `tfyAgentProxy.tolerations` | Taints that pod can tolerate | `[]` |
| `tfyAgentProxy.nodeSelector` | Parameters to select for scheduling of pod on a node | `{}` |
| `tfyAgentProxy.affinity` | Affinity rules for pod scheduling on a node | `{}` |
| `tfyAgentProxy.priorityClassName` | PriorityClass name for the pod. | `system-cluster-critical` |
| `tfyAgentProxy.serviceAccount.create` | Bool to enable serviceAccount creation | `true` |
| `tfyAgentProxy.serviceAccount.annotations` | Annotations to add to the serviceAccount | `{}` |
| `tfyAgentProxy.serviceAccount.name` | Name of the serviceAccount to use. If not set and create is true, a name is generated using the fullname template | `""` |
| `tfyAgentProxy.clusterRole.enable` | Create cluster role. | `true` |
| `tfyAgentProxy.clusterRole.strictMode` | Only add required authz rules. | `false` |
| Name | Description | Value |
| ------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------ |
| `tfyAgentProxy.enabled` | Bool value to deploy tfyAgentProxy | `true` |
| `tfyAgentProxy.annotations` | Add annotations to tfyAgentProxy pods | `{}` |
| `tfyAgentProxy.image.repository` | tfyAgentProxy repository | `tfy.jfrog.io/tfy-images/tfy-agent-proxy` |
| `tfyAgentProxy.image.pullPolicy` | Pull policy for tfyAgentProxy | `IfNotPresent` |
| `tfyAgentProxy.image.tag` | Image tag whose default is the chart appVersion. | `0823e317799add6beaaa4037b81068f6c25f3bf7` |
| `tfyAgentProxy.extraEnvVars` | Additional envrionment variables for tfyAgentPRoxy | `[]` |
| `tfyAgentProxy.resources.limits.cpu` | CPU resource limits for tfyAgentProxy container. Advised to only increase the limits and not decrease it | `500m` |
| `tfyAgentProxy.resources.limits.memory` | Memory Resource limits for tfyAgentProxy container. Advised to only increase the limits and not decrease it | `512Mi` |
| `tfyAgentProxy.resources.limits.ephemeral-storage` | Ephemeral storage Resource limits for tfyAgentProxy container. Advised to only increase the limits and not decrease it | `500M` |
| `tfyAgentProxy.resources.requests.cpu` | CPU resource requests for tfyAgentProxy container. Advised to only increase the requests and not decrease it | `50m` |
| `tfyAgentProxy.resources.requests.memory` | Memory Resource requests for tfyAgentProxy container. Advised to only increase the requests and not decrease it | `128Mi` |
| `tfyAgentProxy.resources.requests.ephemeral-storage` | Ephemeral storage Resource requests for tfyAgentProxy container. Advised to only increase the requests and not decrease it | `200M` |
| `tfyAgentProxy.securityContext` | Security Context for the tfyAgentProxy container | `{}` |
| `tfyAgentProxy.tolerations` | Taints that pod can tolerate | `[]` |
| `tfyAgentProxy.nodeSelector` | Parameters to select for scheduling of pod on a node | `{}` |
| `tfyAgentProxy.affinity` | Affinity rules for pod scheduling on a node | `{}` |
| `tfyAgentProxy.priorityClassName` | PriorityClass name for the pod. | `system-cluster-critical` |
| `tfyAgentProxy.serviceAccount.create` | Bool to enable serviceAccount creation | `true` |
| `tfyAgentProxy.serviceAccount.annotations` | Annotations to add to the serviceAccount | `{}` |
| `tfyAgentProxy.serviceAccount.name` | Name of the serviceAccount to use. If not set and create is true, a name is generated using the fullname template | `""` |
| `tfyAgentProxy.clusterRole.enable` | Create cluster role. | `true` |
| `tfyAgentProxy.clusterRole.strictMode` | Only add required authz rules. | `false` |
| `tfyAgentProxy.clusterRole.clusterScopedAdditionalClusterRoleRules` | Additional rules to add to the cluster role for cluster-scoped resources. | `[]` |

### resourceQuota Add a ResourceQuota to enable priority class in a namspace.

Expand Down
5 changes: 5 additions & 0 deletions charts/tfy-agent/templates/tfy-agent-proxy-clusterrole-cs.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,5 +35,10 @@ rules:
resources: ["*"]
verbs: ["*"]
{{- end }}
{{- range $rule := .Values.tfyAgentProxy.clusterRole.clusterScopedAdditionalClusterRoleRules }}
- apiGroups: {{ $rule.apiGroups | toJson }}
resources: {{ $rule.resources | toJson }}
verbs: {{ $rule.verbs | toJson }}
{{- end }}
{{- end }}
{{- end }}
7 changes: 7 additions & 0 deletions charts/tfy-agent/values.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -433,6 +433,13 @@ tfyAgentProxy:
## `templates/tfy-agent-proxy-clusterrolebinding-ns.yaml` files for more details.
strictMode: false

## @param tfyAgentProxy.clusterRole.clusterScopedAdditionalClusterRoleRules Additional rules to add to the cluster role for cluster-scoped resources.
clusterScopedAdditionalClusterRoleRules: []
# Example:
# - apiGroups: [""]
# resources: ["namespaces"]
# verbs: ["create"]

## @section resourceQuota Add a ResourceQuota to enable priority class in a namspace.
##
resourceQuota:
Expand Down

0 comments on commit 1b8a748

Please sign in to comment.