mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-28 07:37:49 +09:00
feat(kubernetes)!: remove the FluxCD tenant addon
The optional `addons.fluxcd` toggle of the Kubernetes app deployed a Flux Operator + FluxInstance into a tenant cluster. It was served by two vendored charts, packages/system/fluxcd-operator and packages/system/ fluxcd, which were the last AGPL-3.0 content in this Apache-2.0 repository and a governance blocker for CNCF Incubation. The management cluster does not use these charts (it runs classic Flux via internal/fluxinstall; migration 21 already removed the operator from it), and the addon defaulted to disabled. Rather than maintain an AGPL payload for an unused feature, drop it entirely: - delete both system packages and their platform source entries - remove the addons.fluxcd HelmReleases, values and generated schema from the Kubernetes app - drop the addons.fluxcd block still submitted by the e2e harness - drop the removed fluxcd package entries from CODEOWNERS BREAKING CHANGE: the addons.fluxcd option of the Kubernetes app is removed. Tenant clusters that had it enabled keep their running Flux release; see the companion migration for the upgrade path. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Andrei Kvapil <andrei.kvapil@aenix.io>
This commit is contained in:
Andrei Kvapil authored and Aleksei Sviridkin committed
1 parent
4385990869
commit
7cca3d75e7
54 files changed
+3
-4739
No files matched your search
@@ -82,10 +82,6 @@
|
||||
/cmd/backup-controller/ @androndo @lllamnyp @kvaps
|
||||
/cmd/backupstrategy-controller/ @androndo @lllamnyp @kvaps
|
||||
|
||||
# --- Flux ---
|
||||
/packages/system/fluxcd/ @kingdonb @kvaps @lllamnyp @myasnikovdaniil
|
||||
/packages/system/fluxcd-operator/ @kingdonb @kvaps @lllamnyp @myasnikovdaniil
|
||||
|
||||
# --- GPU ---
|
||||
/packages/system/hami/ @lexfrei @kvaps @lllamnyp
|
||||
/packages/system/gpu-operator/ @lexfrei @kvaps @lllamnyp
|
||||
|
||||
Generated
-12
@@ -82,9 +82,6 @@ type Addons struct {
|
||||
// CoreDNS addon.
|
||||
// +kubebuilder:default:={}
|
||||
Coredns CoreDNSAddon `json:"coredns"`
|
||||
// FluxCD GitOps operator.
|
||||
// +kubebuilder:default:={}
|
||||
Fluxcd FluxCDAddon `json:"fluxcd"`
|
||||
// Gateway API addon.
|
||||
// +kubebuilder:default:={}
|
||||
GatewayAPI GatewayAPIAddon `json:"gatewayAPI"`
|
||||
@@ -159,15 +156,6 @@ type CoreDNSAddon struct {
|
||||
ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
|
||||
}
|
||||
|
||||
type FluxCDAddon struct {
|
||||
// Enable FluxCD.
|
||||
// +kubebuilder:default:=false
|
||||
Enabled bool `json:"enabled"`
|
||||
// Custom Helm values overrides.
|
||||
// +kubebuilder:default:={}
|
||||
ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
|
||||
}
|
||||
|
||||
type GPU struct {
|
||||
// Name of GPU, such as "nvidia.com/AD102GL_L40S".
|
||||
Name string `json:"name"`
|
||||
|
||||
@@ -65,7 +65,6 @@ func (in *Addons) DeepCopyInto(out *Addons) {
|
||||
in.CertManager.DeepCopyInto(&out.CertManager)
|
||||
in.Cilium.DeepCopyInto(&out.Cilium)
|
||||
in.Coredns.DeepCopyInto(&out.Coredns)
|
||||
in.Fluxcd.DeepCopyInto(&out.Fluxcd)
|
||||
out.GatewayAPI = in.GatewayAPI
|
||||
in.GpuOperator.DeepCopyInto(&out.GpuOperator)
|
||||
in.Hami.DeepCopyInto(&out.Hami)
|
||||
@@ -223,22 +222,6 @@ func (in *CoreDNSAddon) DeepCopy() *CoreDNSAddon {
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *FluxCDAddon) DeepCopyInto(out *FluxCDAddon) {
|
||||
*out = *in
|
||||
in.ValuesOverride.DeepCopyInto(&out.ValuesOverride)
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FluxCDAddon.
|
||||
func (in *FluxCDAddon) DeepCopy() *FluxCDAddon {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(FluxCDAddon)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *GPU) DeepCopyInto(out *GPU) {
|
||||
*out = *in
|
||||
|
||||
@@ -4565,9 +4565,6 @@ ${talos_block}
|
||||
valuesOverride: {}
|
||||
cilium:
|
||||
valuesOverride: {}
|
||||
fluxcd:
|
||||
enabled: false
|
||||
valuesOverride: {}
|
||||
gatewayAPI:
|
||||
enabled: false
|
||||
gpuOperator:
|
||||
|
||||
@@ -161,9 +161,6 @@ See the reference for components utilized in this service:
|
||||
| `addons.hami` | HAMi GPU virtualization middleware. | `object` | `{}` |
|
||||
| `addons.hami.enabled` | Enable HAMi (requires GPU Operator). | `bool` | `false` |
|
||||
| `addons.hami.valuesOverride` | Custom Helm values overrides. | `object` | `{}` |
|
||||
| `addons.fluxcd` | FluxCD GitOps operator. | `object` | `{}` |
|
||||
| `addons.fluxcd.enabled` | Enable FluxCD. | `bool` | `false` |
|
||||
| `addons.fluxcd.valuesOverride` | Custom Helm values overrides. | `object` | `{}` |
|
||||
| `addons.monitoringAgents` | Monitoring agents. | `object` | `{}` |
|
||||
| `addons.monitoringAgents.enabled` | Enable monitoring agents. | `bool` | `false` |
|
||||
| `addons.monitoringAgents.valuesOverride` | Custom Helm values overrides. | `object` | `{}` |
|
||||
|
||||
@@ -1,76 +0,0 @@
|
||||
{{- if and .Values.addons.fluxcd.enabled .Values._namespace.etcd }}
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-fluxcd-operator
|
||||
labels:
|
||||
cozystack.io/repository: system
|
||||
cozystack.io/target-cluster-name: {{ .Release.Name }}
|
||||
sharding.fluxcd.io/key: tenants
|
||||
spec:
|
||||
releaseName: fluxcd-operator
|
||||
chartRef:
|
||||
kind: ExternalArtifact
|
||||
name: cozystack-kubernetes-application-kubevirt-kubernetes-fluxcd-operator
|
||||
namespace: cozy-system
|
||||
kubeConfig:
|
||||
secretRef:
|
||||
name: {{ .Release.Name }}-admin-kubeconfig
|
||||
key: super-admin.svc
|
||||
targetNamespace: cozy-fluxcd
|
||||
storageNamespace: cozy-fluxcd
|
||||
interval: 5m
|
||||
timeout: 10m
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: -1
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: -1
|
||||
values:
|
||||
flux-operator:
|
||||
fullnameOverride: flux-operator
|
||||
tolerations: []
|
||||
hostNetwork: false
|
||||
dependsOn:
|
||||
- name: {{ .Release.Name }}-cilium
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-fluxcd
|
||||
labels:
|
||||
cozystack.io/repository: system
|
||||
cozystack.io/target-cluster-name: {{ .Release.Name }}
|
||||
sharding.fluxcd.io/key: tenants
|
||||
spec:
|
||||
interval: 5m
|
||||
releaseName: fluxcd
|
||||
chartRef:
|
||||
kind: ExternalArtifact
|
||||
name: cozystack-kubernetes-application-kubevirt-kubernetes-fluxcd
|
||||
namespace: cozy-system
|
||||
kubeConfig:
|
||||
secretRef:
|
||||
name: {{ .Release.Name }}-kubeconfig
|
||||
targetNamespace: cozy-fluxcd
|
||||
storageNamespace: cozy-fluxcd
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: -1
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: -1
|
||||
{{- with .Values.addons.fluxcd.valuesOverride }}
|
||||
values:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
dependsOn:
|
||||
- name: {{ .Release.Name }}-cilium
|
||||
namespace: {{ .Release.Namespace }}
|
||||
- name: {{ .Release.Name }}-fluxcd-operator
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
@@ -225,7 +225,6 @@
|
||||
"certManager",
|
||||
"cilium",
|
||||
"coredns",
|
||||
"fluxcd",
|
||||
"gatewayAPI",
|
||||
"gpuOperator",
|
||||
"hami",
|
||||
@@ -290,28 +289,6 @@
|
||||
}
|
||||
}
|
||||
},
|
||||
"fluxcd": {
|
||||
"description": "FluxCD GitOps operator.",
|
||||
"type": "object",
|
||||
"default": {},
|
||||
"required": [
|
||||
"enabled",
|
||||
"valuesOverride"
|
||||
],
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"description": "Enable FluxCD.",
|
||||
"type": "boolean",
|
||||
"default": false
|
||||
},
|
||||
"valuesOverride": {
|
||||
"description": "Custom Helm values overrides.",
|
||||
"type": "object",
|
||||
"default": {},
|
||||
"x-kubernetes-preserve-unknown-fields": true
|
||||
}
|
||||
}
|
||||
},
|
||||
"gatewayAPI": {
|
||||
"description": "Gateway API addon.",
|
||||
"type": "object",
|
||||
|
||||
@@ -140,10 +140,6 @@ host: ""
|
||||
## @field {bool} enabled - Enable GPU Operator.
|
||||
## @field {object} valuesOverride - Custom Helm values overrides.
|
||||
|
||||
## @typedef {struct} FluxCDAddon - FluxCD GitOps operator.
|
||||
## @field {bool} enabled - Enable FluxCD.
|
||||
## @field {object} valuesOverride - Custom Helm values overrides.
|
||||
|
||||
## @typedef {struct} HAMiAddon - HAMi GPU virtualization middleware.
|
||||
## @field {bool} enabled - Enable HAMi (requires GPU Operator).
|
||||
## @field {object} valuesOverride - Custom Helm values overrides.
|
||||
@@ -173,7 +169,6 @@ host: ""
|
||||
## @field {IngressNginxAddon} ingressNginx - Ingress-NGINX controller.
|
||||
## @field {GPUOperatorAddon} gpuOperator - NVIDIA GPU Operator.
|
||||
## @field {HAMiAddon} hami - HAMi GPU virtualization middleware.
|
||||
## @field {FluxCDAddon} fluxcd - FluxCD GitOps operator.
|
||||
## @field {MonitoringAgentsAddon} monitoringAgents - Monitoring agents.
|
||||
## @field {VerticalPodAutoscalerAddon} verticalPodAutoscaler - Vertical Pod Autoscaler.
|
||||
## @field {VeleroAddon} velero - Velero backup/restore addon.
|
||||
@@ -200,9 +195,6 @@ addons:
|
||||
hami:
|
||||
enabled: false
|
||||
valuesOverride: {}
|
||||
fluxcd:
|
||||
enabled: false
|
||||
valuesOverride: {}
|
||||
monitoringAgents:
|
||||
enabled: false
|
||||
valuesOverride: {}
|
||||
|
||||
@@ -44,10 +44,6 @@ spec:
|
||||
path: system/coredns
|
||||
- name: kubernetes-cert-manager
|
||||
path: system/cert-manager
|
||||
- name: kubernetes-fluxcd-operator
|
||||
path: system/fluxcd-operator
|
||||
- name: kubernetes-fluxcd
|
||||
path: system/fluxcd
|
||||
- name: kubernetes-monitoring-agents
|
||||
path: system/monitoring-agents
|
||||
- name: kubernetes-cilium
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
images
|
||||
hack
|
||||
.gitkeep
|
||||
@@ -1,3 +0,0 @@
|
||||
apiVersion: v2
|
||||
name: cozy-fluxcd-operator
|
||||
version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
|
||||
@@ -1,13 +0,0 @@
|
||||
NAME=fluxcd-operator
|
||||
NAMESPACE=cozy-fluxcd
|
||||
|
||||
include ../../../hack/package.mk
|
||||
|
||||
apply-locally:
|
||||
cozyhr apply --plain -n $(NAMESPACE) $(NAME)
|
||||
|
||||
update:
|
||||
rm -rf charts
|
||||
helm pull oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator --untar --untardir charts
|
||||
patch --no-backup-if-mismatch -p1 < patches/kubernetesEnvs.diff
|
||||
patch --no-backup-if-mismatch -p1 < patches/networkPolicy.diff
|
||||
@@ -1,24 +0,0 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
helmdocs.gotmpl
|
||||
@@ -1,28 +0,0 @@
|
||||
annotations:
|
||||
artifacthub.io/license: AGPL-3.0
|
||||
artifacthub.io/links: |
|
||||
- name: Documentation
|
||||
url: https://fluxoperator.dev/docs
|
||||
- name: Chart Source
|
||||
url: https://github.com/controlplaneio-fluxcd/charts
|
||||
- name: Upstream Project
|
||||
url: https://github.com/controlplaneio-fluxcd/flux-operator
|
||||
apiVersion: v2
|
||||
appVersion: v0.50.0
|
||||
description: 'A Helm chart for deploying the Flux Operator. '
|
||||
home: https://fluxoperator.dev
|
||||
icon: https://raw.githubusercontent.com/cncf/artwork/main/projects/flux/icon/color/flux-icon-color.png
|
||||
keywords:
|
||||
- flux
|
||||
- fluxcd
|
||||
- gitops
|
||||
kubeVersion: '>=1.22.0-0'
|
||||
maintainers:
|
||||
- email: flux-enterprise@control-plane.io
|
||||
name: ControlPlane Flux Team
|
||||
name: flux-operator
|
||||
sources:
|
||||
- https://github.com/controlplaneio-fluxcd/flux-operator
|
||||
- https://github.com/controlplaneio-fluxcd/charts
|
||||
type: application
|
||||
version: 0.50.0
|
||||
@@ -1,95 +0,0 @@
|
||||
# flux-operator
|
||||
|
||||
  
|
||||
|
||||
The [Flux Operator](https://github.com/controlplaneio-fluxcd/flux-operator) provides a
|
||||
declarative API for the installation and upgrade of CNCF [Flux](https://fluxcd.io) and the
|
||||
ControlPlane [enterprise distribution](https://control-plane.io/enterprise-for-flux-cd/).
|
||||
|
||||
The operator automates the patching for hotfixes and CVEs affecting the Flux controllers container images
|
||||
and enables the configuration of multi-tenancy lockdown on Kubernetes and OpenShift clusters.
|
||||
|
||||
The operator comes with the Flux Status Page web UI exposed on port `9080` that allows users to visualize the
|
||||
status of the Flux installation and monitor the GitOps delivery pipeline in real-time.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.30+
|
||||
- Helm 3.8+
|
||||
|
||||
## Installing Flux Operator
|
||||
|
||||
To install the operator in the `flux-system` namespace:
|
||||
|
||||
```console
|
||||
helm install flux-operator oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator \
|
||||
--namespace flux-system \
|
||||
--create-namespace \
|
||||
--wait
|
||||
```
|
||||
|
||||
## Installing the Flux Web UI as a Standalone Deployment
|
||||
|
||||
You can install the Flux Status Web UI as a dedicated deployment in your Kubernetes cluster,
|
||||
separate from the Flux Operator with:
|
||||
|
||||
```console
|
||||
helm install flux-web oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator \
|
||||
--namespace flux-system \
|
||||
--set fullnameOverride=flux-web \
|
||||
--set web.serverOnly=true \
|
||||
--set installCRDs=false \
|
||||
--wait
|
||||
```
|
||||
|
||||
To deploy the Flux controllers and to configure automated updates,
|
||||
see the Flux Operator [documentation](https://fluxoperator.dev/docs/).
|
||||
|
||||
## Values
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| affinity | object | `{"nodeAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":{"nodeSelectorTerms":[{"matchExpressions":[{"key":"kubernetes.io/os","operator":"In","values":["linux"]}]}]}}}` | Pod affinity and anti-affinity settings. |
|
||||
| apiPriority | object | `{"enabled":false,"extraServiceAccounts":[],"level":"workload-high"}` | Kubernetes [API priority and fairness](https://kubernetes.io/docs/concepts/cluster-administration/flow-control/) settings. |
|
||||
| commonAnnotations | object | `{}` | Common annotations to add to all deployed objects including pods. |
|
||||
| commonLabels | object | `{}` | Common labels to add to all deployed objects including pods. |
|
||||
| extraArgs | list | `[]` | Container extra arguments. |
|
||||
| extraEnvs | list | `[]` | Container extra environment variables. |
|
||||
| extraVolumeMounts | list | `[]` | Container extra volume mounts. |
|
||||
| extraVolumes | list | `[]` | Pod extra volumes. |
|
||||
| fullnameOverride | string | `""` | |
|
||||
| hostNetwork | bool | `false` | If `true`, the container ports (`8080` and `8081`) are exposed on the host network. |
|
||||
| image | object | `{"imagePullPolicy":"IfNotPresent","pullSecrets":[],"repository":"ghcr.io/controlplaneio-fluxcd/flux-operator","tag":""}` | Container image settings. The image tag defaults to the chart appVersion. |
|
||||
| installCRDs | bool | `true` | Install and upgrade the custom resource definitions. |
|
||||
| livenessProbe | object | `{"httpGet":{"path":"/healthz","port":8081},"initialDelaySeconds":15,"periodSeconds":20}` | Container liveness probe settings. |
|
||||
| logLevel | string | `"info"` | Container logging level flag. |
|
||||
| marketplace | object | `{"account":"","license":"","type":""}` | Marketplace settings. |
|
||||
| multitenancy | object | `{"defaultServiceAccount":"flux-operator","defaultWorkloadIdentityServiceAccount":"flux-operator","enabled":false,"enabledForWorkloadIdentity":false}` | Enable [multitenancy lockdown](https://fluxoperator.dev/docs/crd/resourceset/#role-based-access-control) for the ResourceSet APIs. |
|
||||
| nameOverride | string | `""` | |
|
||||
| nodeSelector | object | `{}` | Pod Node Selector settings. |
|
||||
| podSecurityContext | object | `{}` | Pod security context settings. |
|
||||
| priorityClassName | string | `""` | Pod priority class name. Recommended value is system-cluster-critical. |
|
||||
| rbac.create | bool | `true` | Grant the cluster-admin role to the flux-operator service account (required for the Flux Instance deployment). |
|
||||
| rbac.createAggregation | bool | `true` | Grant the Kubernetes view, edit and admin roles access to ResourceSet APIs. |
|
||||
| readinessProbe | object | `{"httpGet":{"path":"/readyz","port":8081},"initialDelaySeconds":5,"periodSeconds":10}` | Container readiness probe settings. |
|
||||
| reporting | object | `{"interval":"5m"}` | Flux [reporting](https://fluxoperator.dev/docs/crd/fluxreport/) settings. |
|
||||
| resources | object | `{"limits":{"cpu":"2000m","memory":"1Gi"},"requests":{"cpu":"100m","memory":"64Mi"}}` | Container resources requests and limits settings. |
|
||||
| securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Container security context settings. The default is compliant with the pod security restricted profile. |
|
||||
| service.ipFamilyPolicy | string | `""` | Sets the IP family policy on all Service resources. Uses Kubernetes defaults if unset |
|
||||
| serviceAccount | object | `{"automount":true,"create":true,"name":""}` | Pod service account settings. The name of the service account defaults to the release name. |
|
||||
| serviceMonitor | object | `{"create":false,"interval":"60s","labels":{},"scrapeTimeout":"30s"}` | Prometheus Operator scraping settings. |
|
||||
| tolerations | list | `[]` | Pod tolerations settings. |
|
||||
| web.config | object | `{}` | The spec of the [Web Config API](https://fluxoperator.dev/docs/web-ui/web-config-api/) |
|
||||
| web.configSecretName | string | `""` | Reference to an existing Secret in the same namespace as the deployment containing the Web Config API. Should have the key `config.yaml`. |
|
||||
| web.enabled | bool | `true` | Enable the [Flux Status web server](https://fluxoperator.dev/web-ui/) on port 9080. |
|
||||
| web.httpRoute | object | `{"annotations":{},"enabled":false,"hostnames":[],"parentRefs":[]}` | Gateway API HTTPRoute settings for the Flux Status web interface. |
|
||||
| web.ingress | object | `{"annotations":{},"className":"","enabled":false,"hosts":[],"tls":[]}` | Ingress settings for the Flux Status web interface. |
|
||||
| web.networkPolicy | object | `{"create":true}` | Create a NetworkPolicy to allow access to the Flux Status web interface. |
|
||||
| web.rbac | object | `{"createAggregation":false,"createRoles":true}` | Create standard roles for [user access management](https://fluxoperator.dev/docs/web-ui/user-management/). |
|
||||
| web.serverOnly | bool | `false` | Run the Flux Status web server as a standalone deployment (requires a dedicated Helm release). |
|
||||
| web.serverReplicas | int | `1` | Number of replicas for the Flux Status web server standalone deployment (only applicable if `web.serverOnly` is `true`). |
|
||||
|
||||
## Source Code
|
||||
|
||||
* <https://github.com/controlplaneio-fluxcd/flux-operator>
|
||||
* <https://github.com/controlplaneio-fluxcd/charts>
|
||||
@@ -1 +0,0 @@
|
||||
Documentation at https://fluxoperator.dev/docs/
|
||||
@@ -1,118 +0,0 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "flux-operator.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "flux-operator.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "flux-operator.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "flux-operator.labels" -}}
|
||||
helm.sh/chart: {{ include "flux-operator.chart" . }}
|
||||
{{ include "flux-operator.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "flux-operator.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "flux-operator.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "flux-operator.serviceAccountName" -}}
|
||||
{{- default (include "flux-operator.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Check if web config secret should be created.
|
||||
Returns "true" when web is enabled, config is provided inline, and no external secret is referenced.
|
||||
*/}}
|
||||
{{- define "flux-operator.createWebConfigSecret" -}}
|
||||
{{- if and .Values.web.enabled .Values.web.config (not .Values.web.configSecretName) -}}
|
||||
true
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Check if an external web config secret is referenced.
|
||||
Returns "true" when web is enabled, an external secret name is provided, and no inline config is set.
|
||||
*/}}
|
||||
{{- define "flux-operator.useWebConfigSecret" -}}
|
||||
{{- if and .Values.web.enabled .Values.web.configSecretName (not .Values.web.config) -}}
|
||||
true
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Check if running in web server only mode.
|
||||
Returns "true" when web is enabled and serverOnly mode is set.
|
||||
*/}}
|
||||
{{- define "flux-operator.webServerOnly" -}}
|
||||
{{- if and .Values.web.enabled .Values.web.serverOnly -}}
|
||||
true
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Check if web server replicas should be set.
|
||||
Returns "true" when web is enabled, serverOnly mode is set, and serverReplicas is greater than 1.
|
||||
*/}}
|
||||
{{- define "flux-operator.setWebServerReplicas" -}}
|
||||
{{- if and .Values.web.enabled .Values.web.serverOnly (gt (int .Values.web.serverReplicas) 1) -}}
|
||||
true
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Check if web roles should be created.
|
||||
Returns "true" when web is enabled and createRoles is enabled.
|
||||
*/}}
|
||||
{{- define "flux-operator.createWebRoles" -}}
|
||||
{{- if and .Values.web.enabled .Values.web.rbac.createRoles -}}
|
||||
true
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Check if web roles aggregation should be created.
|
||||
Returns "true" when web is enabled and createAggregation is enabled.
|
||||
*/}}
|
||||
{{- define "flux-operator.createWebRolesAggregation" -}}
|
||||
{{- if and .Values.web.enabled .Values.web.rbac.createAggregation -}}
|
||||
true
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
@@ -1,23 +0,0 @@
|
||||
{{- if and .Values.rbac.create (not (include "flux-operator.webServerOnly" .)) }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "flux-operator.fullname" . }}
|
||||
labels:
|
||||
{{- include "flux-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.commonAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cluster-admin
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "flux-operator.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
-56
@@ -1,56 +0,0 @@
|
||||
{{- if and .Values.rbac.createAggregation (not (include "flux-operator.webServerOnly" .)) }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "flux-operator.fullname" . }}-edit
|
||||
labels:
|
||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||
{{- include "flux-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.commonAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- fluxcd.controlplane.io
|
||||
resources:
|
||||
- resourcesets
|
||||
- resourcesetinputproviders
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- patch
|
||||
- update
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "flux-operator.fullname" . }}-view
|
||||
labels:
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-view: "true"
|
||||
{{- include "flux-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.commonAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- fluxcd.controlplane.io
|
||||
resources:
|
||||
- resourcesets
|
||||
- resourcesetinputproviders
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end }}
|
||||
File diff suppressed because it is too large.
Load diff
@@ -1,158 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "flux-operator.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "flux-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.commonAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if include "flux-operator.setWebServerReplicas" . }}
|
||||
replicas: {{ .Values.web.serverReplicas }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "flux-operator.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/port: "8080"
|
||||
prometheus.io/path: "/metrics"
|
||||
{{- if include "flux-operator.createWebConfigSecret" . }}
|
||||
checksum/web-config: {{ (include (print $.Template.BasePath "/web-secret.yaml") . | fromYaml).stringData | toYaml | sha256sum }}
|
||||
{{- end }}
|
||||
{{- with .Values.commonAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "flux-operator.labels" . | nindent 8 }}
|
||||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.priorityClassName }}
|
||||
priorityClassName: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.image.pullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "flux-operator.serviceAccountName" . }}
|
||||
{{- with .Values.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.hostNetwork }}
|
||||
hostNetwork: true
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: manager
|
||||
args:
|
||||
- --log-level={{ .Values.logLevel }}
|
||||
{{- if .Values.multitenancy.enabled }}
|
||||
- --default-service-account={{ .Values.multitenancy.defaultServiceAccount }}
|
||||
{{- end }}
|
||||
{{- if .Values.multitenancy.enabledForWorkloadIdentity }}
|
||||
- --default-workload-identity-service-account={{ .Values.multitenancy.defaultWorkloadIdentityServiceAccount }}
|
||||
{{- end }}
|
||||
{{- if include "flux-operator.webServerOnly" . }}
|
||||
- --web-server-only=true
|
||||
{{- end }}
|
||||
{{- if include "flux-operator.createWebConfigSecret" . }}
|
||||
- --web-config=/etc/flux-operator/web/config.yaml
|
||||
{{- end }}
|
||||
{{- if include "flux-operator.useWebConfigSecret" . }}
|
||||
- --web-config-secret-name={{ .Values.web.configSecretName }}
|
||||
{{- end }}
|
||||
{{- range .Values.extraArgs }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: RUNTIME_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: REPORTING_INTERVAL
|
||||
value: {{ .Values.reporting.interval }}
|
||||
- name: WEB_SERVER_PORT
|
||||
value: "{{ ternary "9080" "0" .Values.web.enabled }}"
|
||||
{{- with .Values.marketplace.type }}
|
||||
- name: MARKETPLACE_TYPE
|
||||
value: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.marketplace.account }}
|
||||
- name: MARKETPLACE_ACCOUNT
|
||||
value: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.marketplace.license }}
|
||||
- name: MARKETPLACE_LICENSE
|
||||
value: {{ . }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraEnvs }}
|
||||
{{- toYaml .Values.extraEnvs | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- include "cozy.kubernetes_envs" . | nindent 12 }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: "{{ .Values.image.imagePullPolicy }}"
|
||||
ports:
|
||||
- name: http-metrics
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
- name: http
|
||||
containerPort: 8081
|
||||
protocol: TCP
|
||||
{{- if .Values.web.enabled }}
|
||||
- name: http-web
|
||||
containerPort: 9080
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
livenessProbe:
|
||||
{{- toYaml .Values.livenessProbe | nindent 12 }}
|
||||
readinessProbe:
|
||||
{{- toYaml .Values.readinessProbe | nindent 12 }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
{{- if include "flux-operator.createWebConfigSecret" . }}
|
||||
- name: web-config
|
||||
mountPath: /etc/flux-operator/web
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if .Values.extraVolumeMounts }}
|
||||
{{- toYaml .Values.extraVolumeMounts | nindent 12 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: temp
|
||||
emptyDir: {}
|
||||
{{- if include "flux-operator.createWebConfigSecret" . }}
|
||||
- name: web-config
|
||||
secret:
|
||||
secretName: {{ include "flux-operator.fullname" . }}-web-config
|
||||
{{- end }}
|
||||
{{- if .Values.extraVolumes }}
|
||||
{{- toYaml .Values.extraVolumes | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,41 +0,0 @@
|
||||
{{- if .Values.apiPriority.enabled }}
|
||||
apiVersion: flowcontrol.apiserver.k8s.io/v1
|
||||
kind: FlowSchema
|
||||
metadata:
|
||||
name: {{ include "flux-operator.fullname" . }}
|
||||
annotations:
|
||||
apf.kubernetes.io/autoupdate-spec: "false"
|
||||
spec:
|
||||
distinguisherMethod:
|
||||
type: ByUser
|
||||
matchingPrecedence: 950
|
||||
priorityLevelConfiguration:
|
||||
name: {{ .Values.apiPriority.level }}
|
||||
rules:
|
||||
- nonResourceRules:
|
||||
- nonResourceURLs:
|
||||
- '*'
|
||||
verbs:
|
||||
- '*'
|
||||
resourceRules:
|
||||
- apiGroups:
|
||||
- '*'
|
||||
clusterScope: true
|
||||
namespaces:
|
||||
- '*'
|
||||
resources:
|
||||
- '*'
|
||||
verbs:
|
||||
- '*'
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
serviceAccount:
|
||||
name: {{ include "flux-operator.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- range .Values.apiPriority.extraServiceAccounts }}
|
||||
- kind: ServiceAccount
|
||||
serviceAccount:
|
||||
name: {{ .name }}
|
||||
namespace: {{ .namespace }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -1,26 +0,0 @@
|
||||
{{- if .Values.web.httpRoute.enabled -}}
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: {{ include "flux-operator.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "flux-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.web.httpRoute.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.web.httpRoute.parentRefs }}
|
||||
parentRefs:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.web.httpRoute.hostnames }}
|
||||
hostnames:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- backendRefs:
|
||||
- name: {{ include "flux-operator.fullname" . }}
|
||||
port: 9080
|
||||
{{- end }}
|
||||
@@ -1,44 +0,0 @@
|
||||
{{- if .Values.web.ingress.enabled -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ include "flux-operator.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "flux-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.web.ingress.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.web.ingress.className }}
|
||||
ingressClassName: {{ . }}
|
||||
{{- end }}
|
||||
{{- if .Values.web.ingress.tls }}
|
||||
tls:
|
||||
{{- range .Values.web.ingress.tls }}
|
||||
- hosts:
|
||||
{{- range .hosts }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
secretName: {{ .secretName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- range .Values.web.ingress.hosts }}
|
||||
- host: {{ .host | quote }}
|
||||
http:
|
||||
paths:
|
||||
{{- range .paths }}
|
||||
- path: {{ .path }}
|
||||
{{- with .pathType }}
|
||||
pathType: {{ . }}
|
||||
{{- end }}
|
||||
backend:
|
||||
service:
|
||||
name: {{ include "flux-operator.fullname" $ }}
|
||||
port:
|
||||
name: http-web
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -1,22 +0,0 @@
|
||||
{{- if .Capabilities.APIVersions.Has "cilium.io/v2/CiliumClusterwideNetworkPolicy" }}
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumClusterwideNetworkPolicy
|
||||
metadata:
|
||||
name: {{ include "flux-operator.fullname" . }}-restrict
|
||||
spec:
|
||||
nodeSelector: {}
|
||||
ingressDeny:
|
||||
- fromEntities:
|
||||
- world
|
||||
toPorts:
|
||||
- ports:
|
||||
- port: "8080"
|
||||
protocol: TCP
|
||||
- port: "8081"
|
||||
protocol: TCP
|
||||
- port: "9080"
|
||||
protocol: TCP
|
||||
ingress:
|
||||
- fromEntities:
|
||||
- cluster
|
||||
{{- end }}
|
||||
@@ -1,32 +0,0 @@
|
||||
{{- if and .Values.web.enabled .Values.web.networkPolicy.create }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: {{ include "flux-operator.fullname" . }}-web
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "flux-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.commonAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
policyTypes:
|
||||
- Ingress
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- include "flux-operator.selectorLabels" . | nindent 6 }}
|
||||
ingress:
|
||||
- from:
|
||||
- namespaceSelector: {}
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 9080
|
||||
{{- if .Values.serviceMonitor.create }}
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -1,31 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "flux-operator.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "flux-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.commonAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.service.ipFamilyPolicy }}
|
||||
ipFamilyPolicy: {{ . }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- port: 8080
|
||||
targetPort: http-metrics
|
||||
protocol: TCP
|
||||
name: http
|
||||
{{- if .Values.web.enabled }}
|
||||
- port: 9080
|
||||
targetPort: http-web
|
||||
protocol: TCP
|
||||
name: http-web
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "flux-operator.selectorLabels" . | nindent 4 }}
|
||||
@@ -1,17 +0,0 @@
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "flux-operator.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "flux-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.commonAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.serviceAccount.automount }}
|
||||
{{- end }}
|
||||
@@ -1,31 +0,0 @@
|
||||
{{- if .Values.serviceMonitor.create }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ include "flux-operator.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "flux-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.serviceMonitor.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.commonAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ .Release.Namespace | quote }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "flux-operator.selectorLabels" . | nindent 6 }}
|
||||
endpoints:
|
||||
- targetPort: 8080
|
||||
path: /metrics
|
||||
interval: {{ .Values.serviceMonitor.interval }}
|
||||
scrapeTimeout: {{ .Values.serviceMonitor.scrapeTimeout }}
|
||||
{{- end }}
|
||||
@@ -1,47 +0,0 @@
|
||||
{{- if include "flux-operator.webServerOnly" . }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "flux-operator.fullname" . }}-view
|
||||
labels:
|
||||
{{- include "flux-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.commonAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups: ["*"]
|
||||
resources: ["*"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create"]
|
||||
- apiGroups: [""]
|
||||
resources: ["users", "groups"]
|
||||
verbs: ["impersonate"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "flux-operator.fullname" . }}
|
||||
labels:
|
||||
{{- include "flux-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.commonAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "flux-operator.fullname" . }}-view
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "flux-operator.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
@@ -1,26 +0,0 @@
|
||||
{{- if and .Values.web.config .Values.web.configSecretName -}}
|
||||
{{- fail "Invalid values: 'web.config' and 'web.configSecretName' cannot both be set. Set at most one." -}}
|
||||
{{- end -}}
|
||||
{{- if include "flux-operator.createWebConfigSecret" . -}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "flux-operator.fullname" . }}-web-config
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "flux-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.commonAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
stringData:
|
||||
config.yaml: |
|
||||
apiVersion: web.fluxcd.controlplane.io/v1
|
||||
kind: Config
|
||||
spec:
|
||||
{{- toYaml .Values.web.config | nindent 6 }}
|
||||
{{- end }}
|
||||
-131
@@ -1,131 +0,0 @@
|
||||
{{- if include "flux-operator.createWebRoles" . }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: flux-web-user
|
||||
labels:
|
||||
{{- include "flux-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.commonAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups: ["*"]
|
||||
resources: ["*"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: flux-web-admin
|
||||
labels:
|
||||
{{- include "flux-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.commonAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups: ["*"]
|
||||
resources: ["*"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups:
|
||||
- fluxcd.controlplane.io
|
||||
- source.toolkit.fluxcd.io
|
||||
- source.extensions.fluxcd.io
|
||||
- kustomize.toolkit.fluxcd.io
|
||||
- helm.toolkit.fluxcd.io
|
||||
- image.toolkit.fluxcd.io
|
||||
- notification.toolkit.fluxcd.io
|
||||
resources: ["*"]
|
||||
verbs:
|
||||
- patch
|
||||
- reconcile
|
||||
- suspend
|
||||
- resume
|
||||
- download
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
- statefulsets
|
||||
- daemonsets
|
||||
verbs:
|
||||
- patch
|
||||
- restart
|
||||
- apiGroups:
|
||||
- batch
|
||||
resources:
|
||||
- cronjobs
|
||||
- jobs
|
||||
verbs:
|
||||
- create
|
||||
- restart
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- delete
|
||||
{{- end }}
|
||||
{{- if include "flux-operator.createWebRolesAggregation" . }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: flux-web-edit
|
||||
labels:
|
||||
{{- include "flux-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||
{{- with .Values.commonAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- fluxcd.controlplane.io
|
||||
- source.toolkit.fluxcd.io
|
||||
- source.extensions.fluxcd.io
|
||||
- kustomize.toolkit.fluxcd.io
|
||||
- helm.toolkit.fluxcd.io
|
||||
- image.toolkit.fluxcd.io
|
||||
- notification.toolkit.fluxcd.io
|
||||
resources:
|
||||
- '*'
|
||||
verbs:
|
||||
- reconcile
|
||||
- suspend
|
||||
- resume
|
||||
- download
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
- statefulsets
|
||||
- daemonsets
|
||||
verbs:
|
||||
- patch
|
||||
- restart
|
||||
- apiGroups:
|
||||
- batch
|
||||
resources:
|
||||
- cronjobs
|
||||
- jobs
|
||||
verbs:
|
||||
- create
|
||||
- restart
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- delete
|
||||
{{- end }}
|
||||
@@ -1,553 +0,0 @@
|
||||
{
|
||||
"$schema": "https://json-schema.org/draft/2019-09/schema",
|
||||
"type": "object",
|
||||
"required": [
|
||||
"resources",
|
||||
"securityContext"
|
||||
],
|
||||
"properties": {
|
||||
"affinity": {
|
||||
"default": {
|
||||
"nodeAffinity": {
|
||||
"requiredDuringSchedulingIgnoredDuringExecution": {
|
||||
"nodeSelectorTerms": [
|
||||
{
|
||||
"matchExpressions": [
|
||||
{
|
||||
"key": "kubernetes.io/os",
|
||||
"operator": "In",
|
||||
"values": [
|
||||
"linux"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"nodeAffinity": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"requiredDuringSchedulingIgnoredDuringExecution": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"nodeSelectorTerms": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"matchExpressions": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"key": {
|
||||
"type": "string"
|
||||
},
|
||||
"operator": {
|
||||
"type": "string"
|
||||
},
|
||||
"values": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"apiPriority": {
|
||||
"default": {
|
||||
"enabled": false,
|
||||
"extraServiceAccounts": [],
|
||||
"level": "workload-high"
|
||||
},
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"extraServiceAccounts": {
|
||||
"type": "array"
|
||||
},
|
||||
"level": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"commonAnnotations": {
|
||||
"type": "object"
|
||||
},
|
||||
"commonLabels": {
|
||||
"type": "object"
|
||||
},
|
||||
"extraArgs": {
|
||||
"type": "array",
|
||||
"uniqueItems": true,
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"extraEnvs": {
|
||||
"type": "array",
|
||||
"uniqueItems": true,
|
||||
"items": {
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"extraVolumeMounts": {
|
||||
"type": "array",
|
||||
"uniqueItems": true,
|
||||
"items": {
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"extraVolumes": {
|
||||
"type": "array",
|
||||
"uniqueItems": true,
|
||||
"items": {
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"fullnameOverride": {
|
||||
"type": "string"
|
||||
},
|
||||
"hostNetwork": {
|
||||
"default": false,
|
||||
"type": "boolean"
|
||||
},
|
||||
"image": {
|
||||
"type": "object",
|
||||
"required": [
|
||||
"repository"
|
||||
],
|
||||
"properties": {
|
||||
"imagePullPolicy": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"IfNotPresent",
|
||||
"Always",
|
||||
"Never"
|
||||
]
|
||||
},
|
||||
"pullSecrets": {
|
||||
"type": "array",
|
||||
"uniqueItems": true,
|
||||
"items": {
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"repository": {
|
||||
"type": "string"
|
||||
},
|
||||
"tag": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"installCRDs": {
|
||||
"default": true,
|
||||
"type": "boolean"
|
||||
},
|
||||
"livenessProbe": {
|
||||
"default": {
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": 8081
|
||||
},
|
||||
"initialDelaySeconds": 15,
|
||||
"periodSeconds": 20
|
||||
},
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"httpGet": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"path": {
|
||||
"type": "string"
|
||||
},
|
||||
"port": {
|
||||
"type": "integer"
|
||||
}
|
||||
}
|
||||
},
|
||||
"initialDelaySeconds": {
|
||||
"type": "integer"
|
||||
},
|
||||
"periodSeconds": {
|
||||
"type": "integer"
|
||||
}
|
||||
}
|
||||
},
|
||||
"logLevel": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"debug",
|
||||
"info",
|
||||
"error"
|
||||
]
|
||||
},
|
||||
"marketplace": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"account": {
|
||||
"type": "string"
|
||||
},
|
||||
"license": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"multitenancy": {
|
||||
"type": "object",
|
||||
"required": [
|
||||
"defaultServiceAccount",
|
||||
"defaultWorkloadIdentityServiceAccount"
|
||||
],
|
||||
"properties": {
|
||||
"defaultServiceAccount": {
|
||||
"type": "string"
|
||||
},
|
||||
"defaultWorkloadIdentityServiceAccount": {
|
||||
"type": "string"
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"enabledForWorkloadIdentity": {
|
||||
"type": "boolean"
|
||||
}
|
||||
}
|
||||
},
|
||||
"nameOverride": {
|
||||
"type": "string"
|
||||
},
|
||||
"nodeSelector": {
|
||||
"type": "object"
|
||||
},
|
||||
"podSecurityContext": {
|
||||
"default": {
|
||||
"fsGroup": 1337
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"priorityClassName": {
|
||||
"default": "system-cluster-critical",
|
||||
"type": "string"
|
||||
},
|
||||
"rbac": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"create": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"createAggregation": {
|
||||
"type": "boolean"
|
||||
}
|
||||
}
|
||||
},
|
||||
"readinessProbe": {
|
||||
"default": {
|
||||
"httpGet": {
|
||||
"path": "/readyz",
|
||||
"port": 8081
|
||||
},
|
||||
"initialDelaySeconds": 5,
|
||||
"periodSeconds": 10
|
||||
},
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"httpGet": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"path": {
|
||||
"type": "string"
|
||||
},
|
||||
"port": {
|
||||
"type": "integer"
|
||||
}
|
||||
}
|
||||
},
|
||||
"initialDelaySeconds": {
|
||||
"type": "integer"
|
||||
},
|
||||
"periodSeconds": {
|
||||
"type": "integer"
|
||||
}
|
||||
}
|
||||
},
|
||||
"reporting": {
|
||||
"type": "object",
|
||||
"required": [
|
||||
"interval"
|
||||
],
|
||||
"properties": {
|
||||
"interval": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"resources": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"limits": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"requests": {
|
||||
"default": {
|
||||
"cpu": "100m",
|
||||
"memory": "64Mi"
|
||||
},
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"securityContext": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"allowPrivilegeEscalation": {
|
||||
"default": false,
|
||||
"type": "boolean"
|
||||
},
|
||||
"capabilities": {
|
||||
"default": {
|
||||
"drop": [
|
||||
"ALL"
|
||||
]
|
||||
},
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"drop": {
|
||||
"type": "array",
|
||||
"uniqueItems": true,
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"readOnlyRootFilesystem": {
|
||||
"default": true,
|
||||
"type": "boolean"
|
||||
},
|
||||
"runAsNonRoot": {
|
||||
"default": true,
|
||||
"type": "boolean"
|
||||
},
|
||||
"seccompProfile": {
|
||||
"default": {
|
||||
"type": "RuntimeDefault"
|
||||
},
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"type": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"service": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"ipFamilyPolicy": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"",
|
||||
"SingleStack",
|
||||
"PreferDualStack",
|
||||
"RequireDualStack"
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"serviceAccount": {
|
||||
"default": {
|
||||
"automount": true,
|
||||
"create": true,
|
||||
"name": ""
|
||||
},
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"automount": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"create": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"serviceMonitor": {
|
||||
"default": {
|
||||
"create": false,
|
||||
"interval": "60s",
|
||||
"scrapeTimeout": "30s"
|
||||
},
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"create": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"interval": {
|
||||
"type": "string"
|
||||
},
|
||||
"labels": {
|
||||
"type": "object"
|
||||
},
|
||||
"scrapeTimeout": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"tolerations": {
|
||||
"type": "array",
|
||||
"uniqueItems": true,
|
||||
"items": {
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"web": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"config": {
|
||||
"type": "object"
|
||||
},
|
||||
"configSecretName": {
|
||||
"default": "",
|
||||
"type": "string"
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"httpRoute": {
|
||||
"default": {
|
||||
"annotations": {},
|
||||
"enabled": false,
|
||||
"hostnames": [],
|
||||
"parentRefs": []
|
||||
},
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"type": "object"
|
||||
},
|
||||
"enabled": {
|
||||
"default": false,
|
||||
"type": "boolean"
|
||||
},
|
||||
"hostnames": {
|
||||
"type": "array",
|
||||
"uniqueItems": true,
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"parentRefs": {
|
||||
"type": "array",
|
||||
"uniqueItems": true,
|
||||
"items": {
|
||||
"type": "object"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"ingress": {
|
||||
"default": {
|
||||
"annotations": {},
|
||||
"className": "",
|
||||
"enabled": false
|
||||
},
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"type": "object"
|
||||
},
|
||||
"className": {
|
||||
"type": "string"
|
||||
},
|
||||
"enabled": {
|
||||
"default": false,
|
||||
"type": "boolean"
|
||||
},
|
||||
"hosts": {
|
||||
"type": "array",
|
||||
"uniqueItems": true,
|
||||
"items": {
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"tls": {
|
||||
"type": "array",
|
||||
"uniqueItems": true,
|
||||
"items": {
|
||||
"type": "object"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"networkPolicy": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"create": {
|
||||
"type": "boolean"
|
||||
}
|
||||
}
|
||||
},
|
||||
"rbac": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"createAggregation": {
|
||||
"default": false,
|
||||
"type": "boolean"
|
||||
},
|
||||
"createRoles": {
|
||||
"default": true,
|
||||
"type": "boolean"
|
||||
}
|
||||
}
|
||||
},
|
||||
"serverOnly": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"serverReplicas": {
|
||||
"default": 1,
|
||||
"type": "integer"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,194 +0,0 @@
|
||||
# Default values for flux-operator.
|
||||
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
# -- Enable [multitenancy lockdown](https://fluxoperator.dev/docs/crd/resourceset/#role-based-access-control) for the ResourceSet APIs.
|
||||
multitenancy:
|
||||
enabled: false
|
||||
enabledForWorkloadIdentity: false
|
||||
defaultServiceAccount: "flux-operator" # @schema required: true
|
||||
defaultWorkloadIdentityServiceAccount: "flux-operator" # @schema required: true
|
||||
|
||||
# -- Flux [reporting](https://fluxoperator.dev/docs/crd/fluxreport/) settings.
|
||||
reporting:
|
||||
interval: 5m # @schema required: true
|
||||
|
||||
web:
|
||||
# -- Enable the [Flux Status web server](https://fluxoperator.dev/web-ui/) on port 9080.
|
||||
enabled: true
|
||||
# -- The spec of the [Web Config API](https://fluxoperator.dev/docs/web-ui/web-config-api/)
|
||||
config: { } # @schema type: object
|
||||
# -- Reference to an existing Secret in the same namespace as the deployment containing the Web Config API. Should have the key `config.yaml`.
|
||||
configSecretName: "" # @schema default: ""
|
||||
# -- Create a NetworkPolicy to allow access to the Flux Status web interface.
|
||||
networkPolicy:
|
||||
create: true
|
||||
# -- Create standard roles for [user access management](https://fluxoperator.dev/docs/web-ui/user-management/).
|
||||
rbac:
|
||||
createRoles: true # @schema default: true
|
||||
createAggregation: false # @schema default: false
|
||||
# -- Run the Flux Status web server as a standalone deployment (requires a dedicated Helm release).
|
||||
serverOnly: false
|
||||
# -- Number of replicas for the Flux Status web server standalone deployment (only applicable if `web.serverOnly` is `true`).
|
||||
serverReplicas: 1 # @schema default: 1
|
||||
# -- Ingress settings for the Flux Status web interface.
|
||||
ingress: # @schema default: {"enabled":false,"className":"","annotations":{}}
|
||||
enabled: false # @schema default: false
|
||||
className: ""
|
||||
annotations: { } # @schema type: object
|
||||
hosts: [ ] # @schema item: object ; uniqueItems: true
|
||||
# - host: flux-operator.example.com
|
||||
# paths:
|
||||
# - path: /
|
||||
# pathType: ImplementationSpecific
|
||||
tls: [ ] # @schema item: object ; uniqueItems: true
|
||||
# - secretName: flux-operator-tls
|
||||
# hosts:
|
||||
# - flux-operator.example.com
|
||||
# -- Gateway API HTTPRoute settings for the Flux Status web interface.
|
||||
httpRoute: # @schema default: {"enabled":false,"annotations":{},"parentRefs":[],"hostnames":[]}
|
||||
enabled: false # @schema default: false
|
||||
annotations: { } # @schema type: object
|
||||
parentRefs: [ ] # @schema item: object ; uniqueItems: true
|
||||
# - name: my-gateway
|
||||
# namespace: gateway-system
|
||||
# sectionName: https
|
||||
hostnames: [ ] # @schema item: string ; uniqueItems: true
|
||||
# - flux.example.com
|
||||
|
||||
# -- Install and upgrade the custom resource definitions.
|
||||
installCRDs: true # @schema default: true
|
||||
|
||||
# -- Common annotations to add to all deployed objects including pods.
|
||||
commonAnnotations: { }
|
||||
|
||||
# -- Common labels to add to all deployed objects including pods.
|
||||
commonLabels: { }
|
||||
|
||||
# -- Container image settings.
|
||||
# The image tag defaults to the chart appVersion.
|
||||
image:
|
||||
repository: ghcr.io/controlplaneio-fluxcd/flux-operator # @schema required: true
|
||||
tag: ""
|
||||
pullSecrets: [ ] # @schema item: object ; uniqueItems: true
|
||||
imagePullPolicy: IfNotPresent # @schema enum:[IfNotPresent, Always, Never]
|
||||
|
||||
# -- Pod priority class name.
|
||||
# Recommended value is system-cluster-critical.
|
||||
priorityClassName: "" # @schema default: "system-cluster-critical"
|
||||
|
||||
# -- Kubernetes [API priority and fairness](https://kubernetes.io/docs/concepts/cluster-administration/flow-control/) settings.
|
||||
apiPriority: # @schema default: {"enabled":false,"level":"workload-high","extraServiceAccounts":[]}
|
||||
enabled: false
|
||||
level: workload-high
|
||||
extraServiceAccounts: []
|
||||
# - name: kustomize-controller
|
||||
# namespace: flux-system
|
||||
# - name: helm-controller
|
||||
# namespace: flux-system
|
||||
|
||||
# -- Container resources requests and limits settings.
|
||||
resources: # @schema required: true
|
||||
limits:
|
||||
cpu: 2000m
|
||||
memory: 1Gi
|
||||
requests: # @schema default: {"cpu":"100m","memory":"64Mi"}
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
|
||||
# -- Container liveness probe settings.
|
||||
livenessProbe: # @schema default: {"httpGet":{"path":"/healthz","port":8081},"initialDelaySeconds":15,"periodSeconds":20}
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8081
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
|
||||
# -- Container readiness probe settings.
|
||||
readinessProbe: # @schema default: {"httpGet":{"path":"/readyz","port":8081},"initialDelaySeconds":5,"periodSeconds":10}
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 8081
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
|
||||
# -- Pod service account settings.
|
||||
# The name of the service account defaults to the release name.
|
||||
serviceAccount: # @schema default: {"create":true,"automount":true,"name":""}
|
||||
create: true
|
||||
automount: true
|
||||
name: ""
|
||||
|
||||
rbac:
|
||||
# -- Grant the cluster-admin role to the flux-operator service account (required for the Flux Instance deployment).
|
||||
create: true
|
||||
# -- Grant the Kubernetes view, edit and admin roles access to ResourceSet APIs.
|
||||
createAggregation: true
|
||||
|
||||
# -- Pod security context settings.
|
||||
podSecurityContext: { } # @schema default: {"fsGroup":1337}
|
||||
|
||||
# -- Container security context settings.
|
||||
# The default is compliant with the pod security restricted profile.
|
||||
securityContext: # @schema required: true
|
||||
runAsNonRoot: true # @schema default: true
|
||||
readOnlyRootFilesystem: true # @schema default: true
|
||||
allowPrivilegeEscalation: false # @schema default: false
|
||||
capabilities: # @schema default: {"drop":["ALL"]}
|
||||
drop: # @schema item: string ; uniqueItems: true
|
||||
- "ALL"
|
||||
seccompProfile: # @schema default: {"type":"RuntimeDefault"}
|
||||
type: "RuntimeDefault"
|
||||
|
||||
# -- Pod affinity and anti-affinity settings.
|
||||
affinity: # @schema default: {"nodeAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":{"nodeSelectorTerms":[{"matchExpressions":[{"key":"kubernetes.io/os","operator":"In","values":["linux"]}]}]}}}
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/os
|
||||
operator: In
|
||||
values:
|
||||
- linux
|
||||
|
||||
# -- Pod tolerations settings.
|
||||
tolerations: [ ] # @schema item: object ; uniqueItems: true
|
||||
|
||||
# -- Pod Node Selector settings.
|
||||
nodeSelector: { } # @schema type: object
|
||||
|
||||
# -- If `true`, the container ports (`8080` and `8081`) are exposed on the host network.
|
||||
hostNetwork: false # @schema default: false
|
||||
|
||||
# -- Pod extra volumes.
|
||||
extraVolumes: [ ] # @schema item: object ; uniqueItems: true
|
||||
|
||||
# -- Container extra environment variables.
|
||||
extraEnvs: [ ] # @schema item: object ; uniqueItems: true
|
||||
|
||||
# -- Container extra arguments.
|
||||
extraArgs: [ ] # @schema item: string ; uniqueItems: true
|
||||
|
||||
# -- Container extra volume mounts.
|
||||
extraVolumeMounts: [ ] # @schema item: object ; uniqueItems: true
|
||||
|
||||
# -- Container logging level flag.
|
||||
logLevel: "info" # @schema enum:[debug,info,error]
|
||||
|
||||
# -- Prometheus Operator scraping settings.
|
||||
serviceMonitor: # @schema default: {"create":false,"interval":"60s","scrapeTimeout":"30s"}
|
||||
create: false
|
||||
interval: 60s
|
||||
scrapeTimeout: 30s
|
||||
labels: { }
|
||||
|
||||
service:
|
||||
# -- Sets the IP family policy on all Service resources. Uses Kubernetes defaults if unset
|
||||
ipFamilyPolicy: '' # @schema type: string; enum:['', SingleStack, PreferDualStack, RequireDualStack]
|
||||
|
||||
# -- Marketplace settings.
|
||||
marketplace:
|
||||
type: ""
|
||||
license: ""
|
||||
account: ""
|
||||
@@ -1,12 +0,0 @@
|
||||
diff --git a/packages/core/fluxcd/charts/flux-operator/templates/deployment.yaml b/packages/core/fluxcd/charts/flux-operator/templates/deployment.yaml
|
||||
index 8ffd8d8..5ad96a8 100644
|
||||
--- a/charts/flux-operator/templates/deployment.yaml
|
||||
+++ b/charts/flux-operator/templates/deployment.yaml
|
||||
@@ -58,6 +58,7 @@ spec:
|
||||
{{- if .Values.extraEnvs }}
|
||||
{{- toYaml .Values.extraEnvs | nindent 12 }}
|
||||
{{- end }}
|
||||
+ {{- include "cozy.kubernetes_envs" . | nindent 12 }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
@@ -1,27 +0,0 @@
|
||||
diff --git a/charts/flux-operator/templates/network-policy.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/network-policy.yaml
|
||||
new file mode 100644
|
||||
--- /dev/null (revision 52a23eacfc32430d8b008b765c64a81526521bae)
|
||||
+++ b/charts/flux-operator/templates/network-policy.yaml (revision 52a23eacfc32430d8b008b765c64a81526521bae)
|
||||
@@ -0,0 +1,22 @@
|
||||
+{{- if .Capabilities.APIVersions.Has "cilium.io/v2/CiliumClusterwideNetworkPolicy" }}
|
||||
+apiVersion: cilium.io/v2
|
||||
+kind: CiliumClusterwideNetworkPolicy
|
||||
+metadata:
|
||||
+ name: {{ include "flux-operator.fullname" . }}-restrict
|
||||
+spec:
|
||||
+ nodeSelector: {}
|
||||
+ ingressDeny:
|
||||
+ - fromEntities:
|
||||
+ - world
|
||||
+ toPorts:
|
||||
+ - ports:
|
||||
+ - port: "8080"
|
||||
+ protocol: TCP
|
||||
+ - port: "8081"
|
||||
+ protocol: TCP
|
||||
+ - port: "9080"
|
||||
+ protocol: TCP
|
||||
+ ingress:
|
||||
+ - fromEntities:
|
||||
+ - cluster
|
||||
+{{- end }}
|
||||
@@ -1,13 +0,0 @@
|
||||
{{- define "cozy.kubernetes_envs" }}
|
||||
{{- $cozyDeployment := lookup "apps/v1" "Deployment" "cozy-system" "cozystack" }}
|
||||
{{- $cozyContainers := dig "spec" "template" "spec" "containers" dict $cozyDeployment }}
|
||||
{{- range $cozyContainers }}
|
||||
{{- if eq .name "cozystack" }}
|
||||
{{- range .env }}
|
||||
{{- if has .name (list "KUBERNETES_SERVICE_HOST" "KUBERNETES_SERVICE_PORT") }}
|
||||
- {{ toJson . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -1,22 +0,0 @@
|
||||
flux-operator:
|
||||
fullnameOverride: flux-operator
|
||||
tolerations:
|
||||
- key: node.kubernetes.io/not-ready
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
hostNetwork: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 350Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 350Mi
|
||||
# Flux Status Web UI is opt-in. Override `web.enabled: true` (and configure
|
||||
# `web.config` / `web.configSecretName` / `web.ingress` as needed) to enable.
|
||||
# The upstream chart's NetworkPolicy is suppressed because Cozystack ships a
|
||||
# CiliumClusterwideNetworkPolicy that already restricts ports 8080/8081/9080.
|
||||
web:
|
||||
enabled: false
|
||||
networkPolicy:
|
||||
create: false
|
||||
@@ -1,3 +0,0 @@
|
||||
apiVersion: v2
|
||||
name: cozy-fluxcd
|
||||
version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
|
||||
@@ -1,12 +0,0 @@
|
||||
NAME=fluxcd
|
||||
NAMESPACE=cozy-$(NAME)
|
||||
|
||||
include ../../../hack/package.mk
|
||||
|
||||
apply-locally:
|
||||
cozyhr apply --plain -n $(NAMESPACE) $(NAME)
|
||||
|
||||
update:
|
||||
rm -rf charts
|
||||
helm pull oci://ghcr.io/controlplaneio-fluxcd/charts/flux-instance --version 0.50.0 --untar --untardir charts
|
||||
patch --no-backup-if-mismatch -p1 < patches/guard-distribution-artifact.diff
|
||||
@@ -1,24 +0,0 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
helmdocs.gotmpl
|
||||
@@ -1,28 +0,0 @@
|
||||
annotations:
|
||||
artifacthub.io/license: AGPL-3.0
|
||||
artifacthub.io/links: |
|
||||
- name: Documentation
|
||||
url: https://fluxoperator.dev/docs
|
||||
- name: Chart Source
|
||||
url: https://github.com/controlplaneio-fluxcd/charts
|
||||
- name: Upstream Project
|
||||
url: https://github.com/controlplaneio-fluxcd/flux-operator
|
||||
apiVersion: v2
|
||||
appVersion: v0.50.0
|
||||
description: 'A Helm chart for deploying a Flux instance managed by Flux Operator. '
|
||||
home: https://fluxoperator.dev
|
||||
icon: https://raw.githubusercontent.com/cncf/artwork/main/projects/flux/icon/color/flux-icon-color.png
|
||||
keywords:
|
||||
- flux
|
||||
- fluxcd
|
||||
- gitops
|
||||
kubeVersion: '>=1.22.0-0'
|
||||
maintainers:
|
||||
- email: flux-enterprise@control-plane.io
|
||||
name: ControlPlane Flux Team
|
||||
name: flux-instance
|
||||
sources:
|
||||
- https://github.com/controlplaneio-fluxcd/flux-operator
|
||||
- https://github.com/controlplaneio-fluxcd/charts
|
||||
type: application
|
||||
version: 0.50.0
|
||||
@@ -1,55 +0,0 @@
|
||||
# flux-instance
|
||||
|
||||
  
|
||||
|
||||
This chart is a thin wrapper around the `FluxInstance` custom resource, which is
|
||||
used by the [Flux Operator](https://github.com/controlplaneio-fluxcd/flux-operator)
|
||||
to install, configure and automatically upgrade Flux.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.30+
|
||||
- Helm 3.8+
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To deploy Flux in the `flux-system` namespace:
|
||||
|
||||
```console
|
||||
helm -n flux-system install flux oci://ghcr.io/controlplaneio-fluxcd/charts/flux-instance
|
||||
```
|
||||
|
||||
For more information on the available configuration options,
|
||||
see the [Flux Instance documentation](https://fluxoperator.dev/docs/crd/fluxinstance/).
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
To uninstall Flux without affecting the resources it manages:
|
||||
|
||||
```console
|
||||
helm -n flux-system uninstall flux
|
||||
```
|
||||
|
||||
## Values
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| commonAnnotations | object | `{}` | Common annotations to add to all deployed objects including pods. |
|
||||
| commonLabels | object | `{}` | Common labels to add to all deployed objects including pods. |
|
||||
| fullnameOverride | string | `"flux"` | |
|
||||
| healthcheck.enabled | bool | `false` | Enable post-install and post-upgrade health checks. |
|
||||
| healthcheck.timeout | string | `"5m"` | Health check timeout in Go duration format. |
|
||||
| instance.cluster | object | `{"domain":"cluster.local","multitenant":false,"networkPolicy":true,"size":"","tenantDefaultServiceAccount":"default","type":"kubernetes"}` | Cluster https://fluxoperator.dev/docs/crd/fluxinstance/#cluster-configuration |
|
||||
| instance.commonMetadata | object | `{"annotations":{},"labels":{}}` | Common metadata https://fluxoperator.dev/docs/crd/fluxinstance/#common-metadata |
|
||||
| instance.components | list | `["source-controller","kustomize-controller","helm-controller","notification-controller"]` | Components https://fluxoperator.dev/docs/crd/fluxinstance/#components-configuration |
|
||||
| instance.distribution | object | `{"artifact":"oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests:latest","artifactPullSecret":"","imagePullSecret":"","registry":"ghcr.io/fluxcd","variant":"","version":"2.x"}` | Distribution https://fluxoperator.dev/docs/crd/fluxinstance/#distribution-configuration |
|
||||
| instance.kustomize.patches | list | `[]` | Kustomize patches https://fluxoperator.dev/docs/crd/fluxinstance/#kustomize-patches |
|
||||
| instance.sharding | object | `{"key":"sharding.fluxcd.io/key","shards":[]}` | Sharding https://fluxoperator.dev/docs/crd/fluxinstance/#sharding-configuration |
|
||||
| instance.storage | object | `{"class":"","size":""}` | Storage https://fluxoperator.dev/docs/crd/fluxinstance/#storage-configuration |
|
||||
| instance.sync | object | `{"interval":"1m","kind":"GitRepository","name":"","path":"","provider":"","pullSecret":"","ref":"","url":""}` | Sync https://fluxoperator.dev/docs/crd/fluxinstance/#sync-configuration |
|
||||
| nameOverride | string | `""` | |
|
||||
|
||||
## Source Code
|
||||
|
||||
* <https://github.com/controlplaneio-fluxcd/flux-operator>
|
||||
* <https://github.com/controlplaneio-fluxcd/charts>
|
||||
@@ -1 +0,0 @@
|
||||
Documentation at https://fluxoperator.dev/docs/
|
||||
@@ -1,51 +0,0 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "flux-instance.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "flux-instance.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "flux-instance.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "flux-instance.labels" -}}
|
||||
helm.sh/chart: {{ include "flux-instance.chart" . }}
|
||||
{{ include "flux-instance.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "flux-instance.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "flux-instance.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
@@ -1,79 +0,0 @@
|
||||
{{- if .Values.healthcheck.enabled }}
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: "{{ .Release.Name }}-healthcheck"
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name | quote }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion }}
|
||||
helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
annotations:
|
||||
helm.sh/hook: post-install,post-upgrade
|
||||
helm.sh/hook-weight: "-5"
|
||||
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
name: "{{ .Release.Name }}"
|
||||
labels:
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name | quote }}
|
||||
helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
{{- with .Values.healthcheck.image.pullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ .Values.healthcheck.serviceAccount.name }}
|
||||
{{- with .Values.healthcheck.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.healthcheck.hostNetwork }}
|
||||
hostNetwork: true
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: healthcheck
|
||||
image: "{{ .Values.healthcheck.image.repository }}:{{ .Values.healthcheck.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: "{{ .Values.healthcheck.image.imagePullPolicy }}"
|
||||
args:
|
||||
- wait
|
||||
- instance
|
||||
- {{ include "flux-instance.fullname" . }}
|
||||
- --namespace={{ .Release.Namespace }}
|
||||
- --timeout={{ .Values.healthcheck.timeout }}
|
||||
{{- range .Values.healthcheck.extraArgs }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.healthcheck.envs }}
|
||||
env:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.healthcheck.securityContext | nindent 12 }}
|
||||
resources:
|
||||
{{- toYaml .Values.healthcheck.resources | nindent 12 }}
|
||||
{{- with .Values.healthcheck.volumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.healthcheck.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.healthcheck.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.healthcheck.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.healthcheck.volumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -1,74 +0,0 @@
|
||||
apiVersion: fluxcd.controlplane.io/v1
|
||||
kind: FluxInstance
|
||||
metadata:
|
||||
name: {{ include "flux-instance.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "flux-instance.labels" . | nindent 4 }}
|
||||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.commonAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
distribution:
|
||||
version: {{ .Values.instance.distribution.version | quote }}
|
||||
registry: {{ .Values.instance.distribution.registry }}
|
||||
{{- if .Values.instance.distribution.artifact }}
|
||||
artifact: {{ .Values.instance.distribution.artifact }}
|
||||
{{- end }}
|
||||
{{- if .Values.instance.distribution.artifactPullSecret }}
|
||||
artifactPullSecret: {{ .Values.instance.distribution.artifactPullSecret }}
|
||||
{{- end }}
|
||||
{{- if .Values.instance.distribution.imagePullSecret }}
|
||||
imagePullSecret: {{ .Values.instance.distribution.imagePullSecret }}
|
||||
{{- end }}
|
||||
{{- if .Values.instance.distribution.variant }}
|
||||
variant: {{ .Values.instance.distribution.variant }}
|
||||
{{- end }}
|
||||
components: {{ .Values.instance.components | toYaml | nindent 4 }}
|
||||
cluster:
|
||||
{{- range $key, $value := .Values.instance.cluster }}
|
||||
{{- if not (and (kindIs "string" $value) (eq $value "")) }}
|
||||
{{ $key }}: {{ $value }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or .Values.instance.commonMetadata.annotations .Values.instance.commonMetadata.labels }}
|
||||
commonMetadata:
|
||||
{{- with .Values.instance.commonMetadata.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with .Values.instance.commonMetadata.labels }}
|
||||
labels:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
kustomize: {{ .Values.instance.kustomize | toYaml | nindent 4 }}
|
||||
{{- if .Values.instance.sync.url }}
|
||||
sync:
|
||||
kind: {{ .Values.instance.sync.kind }}
|
||||
interval: {{ .Values.instance.sync.interval }}
|
||||
url: {{ .Values.instance.sync.url }}
|
||||
ref: {{ .Values.instance.sync.ref }}
|
||||
path: {{ .Values.instance.sync.path }}
|
||||
{{- if .Values.instance.sync.name }}
|
||||
name: {{ .Values.instance.sync.name }}
|
||||
{{- end }}
|
||||
{{- if .Values.instance.sync.provider }}
|
||||
provider: {{ .Values.instance.sync.provider }}
|
||||
{{- end }}
|
||||
{{- if .Values.instance.sync.pullSecret }}
|
||||
pullSecret: {{ .Values.instance.sync.pullSecret }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.instance.storage.size }}
|
||||
storage: {{ .Values.instance.storage | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.instance.sharding.shards }}
|
||||
sharding:
|
||||
key: {{ .Values.instance.sharding.key }}
|
||||
shards: {{ .Values.instance.sharding.shards | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -1,17 +0,0 @@
|
||||
{{- if .Values.healthcheck.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ .Values.healthcheck.serviceAccount.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "flux-instance.labels" . | nindent 4 }}
|
||||
{{- with .Values.commonLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.commonAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.healthcheck.serviceAccount.automount }}
|
||||
{{- end }}
|
||||
@@ -1,444 +0,0 @@
|
||||
{
|
||||
"$schema": "https://json-schema.org/draft/2019-09/schema",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"commonAnnotations": {
|
||||
"type": "object"
|
||||
},
|
||||
"commonLabels": {
|
||||
"type": "object"
|
||||
},
|
||||
"fullnameOverride": {
|
||||
"type": "string"
|
||||
},
|
||||
"healthcheck": {
|
||||
"type": "object",
|
||||
"required": [
|
||||
"resources",
|
||||
"securityContext"
|
||||
],
|
||||
"properties": {
|
||||
"affinity": {
|
||||
"default": {
|
||||
"nodeAffinity": {
|
||||
"requiredDuringSchedulingIgnoredDuringExecution": {
|
||||
"nodeSelectorTerms": [
|
||||
{
|
||||
"matchExpressions": [
|
||||
{
|
||||
"key": "kubernetes.io/os",
|
||||
"operator": "In",
|
||||
"values": [
|
||||
"linux"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"nodeAffinity": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"requiredDuringSchedulingIgnoredDuringExecution": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"nodeSelectorTerms": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"matchExpressions": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"key": {
|
||||
"type": "string"
|
||||
},
|
||||
"operator": {
|
||||
"type": "string"
|
||||
},
|
||||
"values": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"envs": {
|
||||
"type": "array",
|
||||
"uniqueItems": true,
|
||||
"items": {
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"extraArgs": {
|
||||
"type": "array",
|
||||
"uniqueItems": true,
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"hostNetwork": {
|
||||
"default": false,
|
||||
"type": "boolean"
|
||||
},
|
||||
"image": {
|
||||
"type": "object",
|
||||
"required": [
|
||||
"repository"
|
||||
],
|
||||
"properties": {
|
||||
"imagePullPolicy": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"IfNotPresent",
|
||||
"Always",
|
||||
"Never"
|
||||
]
|
||||
},
|
||||
"pullSecrets": {
|
||||
"type": "array",
|
||||
"uniqueItems": true,
|
||||
"items": {
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"repository": {
|
||||
"type": "string"
|
||||
},
|
||||
"tag": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"nodeSelector": {
|
||||
"type": "object"
|
||||
},
|
||||
"podSecurityContext": {
|
||||
"default": {
|
||||
"fsGroup": 1337
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"resources": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"limits": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"requests": {
|
||||
"default": {
|
||||
"cpu": "100m",
|
||||
"memory": "64Mi"
|
||||
},
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"cpu": {
|
||||
"type": "string"
|
||||
},
|
||||
"memory": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"securityContext": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"allowPrivilegeEscalation": {
|
||||
"default": false,
|
||||
"type": "boolean"
|
||||
},
|
||||
"capabilities": {
|
||||
"default": {
|
||||
"drop": [
|
||||
"ALL"
|
||||
]
|
||||
},
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"drop": {
|
||||
"type": "array",
|
||||
"uniqueItems": true,
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"readOnlyRootFilesystem": {
|
||||
"default": true,
|
||||
"type": "boolean"
|
||||
},
|
||||
"runAsNonRoot": {
|
||||
"default": true,
|
||||
"type": "boolean"
|
||||
},
|
||||
"seccompProfile": {
|
||||
"default": {
|
||||
"type": "RuntimeDefault"
|
||||
},
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"type": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"serviceAccount": {
|
||||
"default": {
|
||||
"automount": true,
|
||||
"create": false,
|
||||
"name": "flux-operator"
|
||||
},
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"automount": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"create": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"timeout": {
|
||||
"default": "5m",
|
||||
"type": "string"
|
||||
},
|
||||
"tolerations": {
|
||||
"type": "array",
|
||||
"uniqueItems": true,
|
||||
"items": {
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"volumeMounts": {
|
||||
"type": "array",
|
||||
"uniqueItems": true,
|
||||
"items": {
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"volumes": {
|
||||
"type": "array",
|
||||
"uniqueItems": true,
|
||||
"items": {
|
||||
"type": "object"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"instance": {
|
||||
"type": "object",
|
||||
"required": [
|
||||
"distribution",
|
||||
"cluster"
|
||||
],
|
||||
"properties": {
|
||||
"cluster": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"domain": {
|
||||
"type": "string"
|
||||
},
|
||||
"multitenant": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"networkPolicy": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"size": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"",
|
||||
"small",
|
||||
"medium",
|
||||
"large"
|
||||
]
|
||||
},
|
||||
"tenantDefaultServiceAccount": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"kubernetes",
|
||||
"openshift",
|
||||
"aws",
|
||||
"azure",
|
||||
"gcp"
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"commonMetadata": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"annotations": {
|
||||
"type": "object"
|
||||
},
|
||||
"labels": {
|
||||
"type": "object"
|
||||
}
|
||||
}
|
||||
},
|
||||
"components": {
|
||||
"type": "array",
|
||||
"uniqueItems": true,
|
||||
"items": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"source-controller",
|
||||
"kustomize-controller",
|
||||
"helm-controller",
|
||||
"notification-controller",
|
||||
"image-reflector-controller",
|
||||
"image-automation-controller",
|
||||
"source-watcher"
|
||||
]
|
||||
}
|
||||
},
|
||||
"distribution": {
|
||||
"type": "object",
|
||||
"required": [
|
||||
"version",
|
||||
"registry"
|
||||
],
|
||||
"properties": {
|
||||
"artifact": {
|
||||
"type": "string"
|
||||
},
|
||||
"artifactPullSecret": {
|
||||
"type": "string"
|
||||
},
|
||||
"imagePullSecret": {
|
||||
"type": "string"
|
||||
},
|
||||
"registry": {
|
||||
"type": "string"
|
||||
},
|
||||
"variant": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"",
|
||||
"upstream-alpine",
|
||||
"enterprise-alpine",
|
||||
"enterprise-distroless",
|
||||
"enterprise-distroless-fips"
|
||||
]
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"kustomize": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"patches": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"sharding": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"key": {
|
||||
"type": "string"
|
||||
},
|
||||
"shards": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"storage": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"class": {
|
||||
"type": "string"
|
||||
},
|
||||
"size": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"sync": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"interval": {
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"GitRepository",
|
||||
"OCIRepository",
|
||||
"Bucket"
|
||||
]
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"path": {
|
||||
"type": "string"
|
||||
},
|
||||
"provider": {
|
||||
"type": "string"
|
||||
},
|
||||
"pullSecret": {
|
||||
"type": "string"
|
||||
},
|
||||
"ref": {
|
||||
"type": "string"
|
||||
},
|
||||
"url": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"nameOverride": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,150 +0,0 @@
|
||||
# Default values for flux-instance.
|
||||
|
||||
nameOverride: ""
|
||||
fullnameOverride: "flux"
|
||||
|
||||
instance:
|
||||
# -- Distribution https://fluxoperator.dev/docs/crd/fluxinstance/#distribution-configuration
|
||||
distribution: # @schema required: true
|
||||
version: "2.x" # @schema required: true
|
||||
registry: "ghcr.io/fluxcd" # @schema required: true
|
||||
artifact: "oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests:latest"
|
||||
artifactPullSecret: ""
|
||||
imagePullSecret: ""
|
||||
variant: "" # @schema enum:['',upstream-alpine,enterprise-alpine,enterprise-distroless,enterprise-distroless-fips]
|
||||
# -- Components https://fluxoperator.dev/docs/crd/fluxinstance/#components-configuration
|
||||
components: # @schema item: string; uniqueItems: true; itemEnum: [source-controller,kustomize-controller,helm-controller,notification-controller,image-reflector-controller,image-automation-controller,source-watcher]
|
||||
- source-controller
|
||||
- kustomize-controller
|
||||
- helm-controller
|
||||
- notification-controller
|
||||
# -- Cluster https://fluxoperator.dev/docs/crd/fluxinstance/#cluster-configuration
|
||||
cluster: # @schema required: true
|
||||
type: kubernetes # @schema enum:[kubernetes,openshift,aws,azure,gcp]
|
||||
size: "" # @schema enum:['',small,medium,large]
|
||||
domain: "cluster.local"
|
||||
networkPolicy: true
|
||||
multitenant: false
|
||||
tenantDefaultServiceAccount: "default"
|
||||
# -- Common metadata https://fluxoperator.dev/docs/crd/fluxinstance/#common-metadata
|
||||
commonMetadata: # @schema required: false
|
||||
labels: { }
|
||||
annotations: { }
|
||||
# -- Storage https://fluxoperator.dev/docs/crd/fluxinstance/#storage-configuration
|
||||
storage: # @schema required: false
|
||||
class: ""
|
||||
size: ""
|
||||
# -- Sharding https://fluxoperator.dev/docs/crd/fluxinstance/#sharding-configuration
|
||||
sharding: # @schema required: false
|
||||
key: "sharding.fluxcd.io/key"
|
||||
shards: [ ] # @schema item: string
|
||||
# -- Sync https://fluxoperator.dev/docs/crd/fluxinstance/#sync-configuration
|
||||
sync: # @schema required: false
|
||||
interval: 1m
|
||||
kind: "GitRepository" # @schema enum:[GitRepository,OCIRepository,Bucket]
|
||||
url: ""
|
||||
ref: ""
|
||||
path: ""
|
||||
pullSecret: ""
|
||||
name: ""
|
||||
provider: ""
|
||||
kustomize: # @schema required: false
|
||||
# -- Kustomize patches https://fluxoperator.dev/docs/crd/fluxinstance/#kustomize-patches
|
||||
patches: [ ] # @schema item: object
|
||||
|
||||
# -- Common annotations to add to all deployed objects including pods.
|
||||
commonAnnotations: { }
|
||||
|
||||
# -- Common labels to add to all deployed objects including pods.
|
||||
commonLabels: { }
|
||||
|
||||
# Healthcheck job settings.
|
||||
healthcheck:
|
||||
# -- Enable post-install and post-upgrade health checks.
|
||||
enabled: false
|
||||
# -- Health check timeout in Go duration format.
|
||||
timeout: 5m # @schema default: "5m"
|
||||
|
||||
# Container image settings.
|
||||
# The image tag defaults to the chart appVersion.
|
||||
# @ignore
|
||||
image:
|
||||
repository: ghcr.io/controlplaneio-fluxcd/flux-operator-cli # @schema required: true
|
||||
tag: ""
|
||||
pullSecrets: [ ] # @schema item: object ; uniqueItems: true
|
||||
imagePullPolicy: IfNotPresent # @schema enum:[IfNotPresent, Always, Never]
|
||||
|
||||
# Container resources requests and limits settings.
|
||||
# @ignore
|
||||
resources: # @schema required: true
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 1Gi
|
||||
requests: # @schema default: {"cpu":"100m","memory":"64Mi"}
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
|
||||
# Pod service account settings.
|
||||
# The name of the service account defaults to the release name.
|
||||
# @ignore
|
||||
serviceAccount: # @schema default: {"create":false,"automount":true,"name":"flux-operator"}
|
||||
create: false
|
||||
automount: true
|
||||
name: "flux-operator"
|
||||
|
||||
# Pod security context settings.
|
||||
# @ignore
|
||||
podSecurityContext: { } # @schema default: {"fsGroup":1337}
|
||||
|
||||
# Container security context settings.
|
||||
# The default is compliant with the pod security restricted profile.
|
||||
# @ignore
|
||||
securityContext: # @schema required: true
|
||||
runAsNonRoot: true # @schema default: true
|
||||
readOnlyRootFilesystem: true # @schema default: true
|
||||
allowPrivilegeEscalation: false # @schema default: false
|
||||
capabilities: # @schema default: {"drop":["ALL"]}
|
||||
drop: # @schema item: string ; uniqueItems: true
|
||||
- "ALL"
|
||||
seccompProfile: # @schema default: {"type":"RuntimeDefault"}
|
||||
type: "RuntimeDefault"
|
||||
|
||||
# Pod affinity and anti-affinity settings.
|
||||
# @ignore
|
||||
affinity: # @schema default: {"nodeAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":{"nodeSelectorTerms":[{"matchExpressions":[{"key":"kubernetes.io/os","operator":"In","values":["linux"]}]}]}}}
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/os
|
||||
operator: In
|
||||
values:
|
||||
- linux
|
||||
|
||||
# Pod tolerations settings.
|
||||
# @ignore
|
||||
tolerations: [ ] # @schema item: object ; uniqueItems: true
|
||||
|
||||
# Pod Node Selector settings.
|
||||
# @ignore
|
||||
nodeSelector: { } # @schema type: object
|
||||
|
||||
# If `true`, the container ports (`8080` and `8081`) are exposed on the host network.
|
||||
# @ignore
|
||||
hostNetwork: false # @schema default: false
|
||||
|
||||
# Pod extra volumes.
|
||||
# @ignore
|
||||
volumes: [ ] # @schema item: object ; uniqueItems: true
|
||||
|
||||
# Container extra volume mounts.
|
||||
# @ignore
|
||||
volumeMounts: [ ] # @schema item: object ; uniqueItems: true
|
||||
|
||||
# Container extra environment variables.
|
||||
# @ignore
|
||||
envs: [ ] # @schema item: object ; uniqueItems: true
|
||||
|
||||
# Container extra arguments.
|
||||
# @ignore
|
||||
extraArgs: [ ] # @schema item: string ; uniqueItems: true
|
||||
@@ -1,22 +0,0 @@
|
||||
# Upstream bug: flux-instance's instance.yaml renders spec.distribution.artifact
|
||||
# unconditionally, unlike the sibling optional fields (artifactPullSecret,
|
||||
# imagePullSecret, variant). The umbrella's empty default then renders as
|
||||
# `artifact: null`, which the FluxInstance CRD rejects (type: string,
|
||||
# pattern ^oci://.*$, and the field is optional). Guard it like its siblings.
|
||||
#
|
||||
# Chart source: https://github.com/controlplaneio-fluxcd/charts (flux-instance)
|
||||
# Not yet reported upstream; drop this hunk once upstream guards the field.
|
||||
diff --git a/charts/flux-instance/templates/instance.yaml b/charts/flux-instance/templates/instance.yaml
|
||||
index f1f58309e..5217c24d9 100644
|
||||
--- a/charts/flux-instance/templates/instance.yaml
|
||||
+++ b/charts/flux-instance/templates/instance.yaml
|
||||
@@ -16,7 +16,9 @@ spec:
|
||||
distribution:
|
||||
version: {{ .Values.instance.distribution.version | quote }}
|
||||
registry: {{ .Values.instance.distribution.registry }}
|
||||
+ {{- if .Values.instance.distribution.artifact }}
|
||||
artifact: {{ .Values.instance.distribution.artifact }}
|
||||
+ {{- end }}
|
||||
{{- if .Values.instance.distribution.artifactPullSecret }}
|
||||
artifactPullSecret: {{ .Values.instance.distribution.artifactPullSecret }}
|
||||
{{- end }}
|
||||
@@ -1,55 +0,0 @@
|
||||
flux-instance:
|
||||
instance:
|
||||
cluster:
|
||||
networkPolicy: true
|
||||
domain: cozy.local # -- default value is overriden in patches
|
||||
distribution:
|
||||
artifact: ""
|
||||
version: 2.8.x
|
||||
registry: ghcr.io/fluxcd
|
||||
components:
|
||||
- source-controller
|
||||
- source-watcher
|
||||
- kustomize-controller
|
||||
- helm-controller
|
||||
- notification-controller
|
||||
- image-reflector-controller
|
||||
- image-automation-controller
|
||||
kustomize:
|
||||
patches:
|
||||
- target:
|
||||
kind: Deployment
|
||||
name: "(kustomize-controller|helm-controller|source-controller|source-watcher)"
|
||||
patch: |
|
||||
- op: add
|
||||
path: /spec/template/spec/containers/0/args/-
|
||||
value: --concurrent=20
|
||||
- op: add
|
||||
path: /spec/template/spec/containers/0/args/-
|
||||
value: --requeue-dependency=5s
|
||||
- op: replace
|
||||
path: /spec/template/spec/containers/0/resources/limits
|
||||
value:
|
||||
cpu: 2000m
|
||||
memory: 2048Mi
|
||||
- target:
|
||||
kind: Deployment
|
||||
name: source-controller
|
||||
patch: |
|
||||
- op: add
|
||||
path: /spec/template/spec/containers/0/args/-
|
||||
value: --storage-adv-addr=source-controller.cozy-fluxcd.svc
|
||||
- target:
|
||||
kind: Deployment
|
||||
name: source-watcher
|
||||
patch: |
|
||||
- op: add
|
||||
path: /spec/template/spec/containers/0/args/-
|
||||
value: --storage-adv-addr=source-watcher.cozy-fluxcd.svc
|
||||
- target:
|
||||
kind: Deployment
|
||||
name: (kustomize-controller|helm-controller|image-reflector-controller|image-automation-controller|source-controller|source-watcher)
|
||||
patch: |
|
||||
- op: add
|
||||
path: /spec/template/spec/containers/0/args/-
|
||||
value: --events-addr=http://notification-controller.cozy-fluxcd.svc/
|
||||
@@ -12,7 +12,7 @@ update:
|
||||
sed -i "/ARG VERSION/ s|=.*|=$${tag}|g" images/kamaji/Dockerfile
|
||||
# Re-apply Cozystack-side patches over the freshly extracted chart so
|
||||
# `make update` stays reproducible. Mirrors the pattern used by
|
||||
# packages/system/fluxcd-operator and packages/system/ingress-nginx.
|
||||
# packages/system/ingress-nginx.
|
||||
patch --no-backup-if-mismatch -p1 < patches/1.diff
|
||||
|
||||
image:
|
||||
|
||||
+2
-2
@@ -32,7 +32,7 @@ spec:
|
||||
singular: kubernetes
|
||||
plural: kuberneteses
|
||||
openAPISchema: |-
|
||||
{"title":"Chart Values","type":"object","properties":{"storageClass":{"description":"Default StorageClass inside the tenant cluster. Remote-accessible LINSTOR classes are auto-propagated to the tenant under the same name.","type":"string","default":"replicated","x-kubernetes-validations":[{"rule":"self == oldSelf","message":"storageClass is immutable"}],"x-cozystack-options":{"source":"storageclass"}},"nodeGroups":{"description":"Worker nodes configuration map. When left empty, a default node group `md0` is emitted with `minReplicas: 0` and `roles: [ingress-nginx]` — the MachineDeployment renders but provisions no workers until an unschedulable Pod triggers the cluster-autoscaler (or an operator scales the group manually). Enabling `addons.ingressNginx.enabled: true` on a CR with default `nodeGroups: {}` therefore requires either supplying a nodeGroup with `roles: [ingress-nginx]` and `minReplicas >= 1`, or waiting for the autoscaler to bring up the default md0 in response to the ingress-nginx controller Pods becoming Pending. Provide your own groups to take full control — they are not merged with the default, so you may name and omit groups freely.","type":"object","default":{},"additionalProperties":{"type":"object","required":["diskSize","instanceType","maxReplicas","minReplicas"],"properties":{"diskSize":{"description":"System disk size for the worker VM. Carries the Talos OS image (factory.talos.dev raw artifact streamed in by CDI), kubelet state, containerd image cache, and any local-path PVCs. Pre-Talos installs used a separate disk-kubelet PVC for kubelet/containerd state; on Talos this is consolidated onto the single system disk imaged from the factory artifact.","default":"20Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"description":"Name of GPU, such as \"nvidia.com/AD102GL_L40S\".","type":"string","x-cozystack-options":{"source":"gpu"}}}}},"instanceType":{"description":"Virtual machine instance type.","type":"string","default":"u1.medium","x-cozystack-options":{"source":"instancetype"}},"kubelet":{"description":"Kubelet resource reservations for this node group.","type":"object","properties":{"evictionHardMemory":{"description":"Hard eviction threshold for memory (absolute like 200Mi or percentage like 7%).","type":"string","default":"7%"},"evictionSoftMemory":{"description":"Soft eviction threshold for memory (absolute like 1Gi or percentage like 10%).","type":"string","default":"10%"},"kubeReservedCpu":{"description":"CPU reserved for kubelet and container runtime. Auto-computed from instanceType if empty.","type":"string"},"kubeReservedMemory":{"description":"Memory reserved for kubelet and container runtime. Auto-computed from instanceType if empty.","type":"string"},"systemReservedCpu":{"description":"CPU reserved for host OS. Auto-computed from instanceType if empty.","type":"string"},"systemReservedMemory":{"description":"Memory reserved for host OS. Auto-computed from instanceType if empty.","type":"string"}}},"logSerialConsole":{"description":"Stream each worker VM's guest serial console into a `guest-console-log` container beside virt-launcher, readable with `kubectl logs`. The only view of a worker that stalls during boot before Talos apid answers, when neither a Node nor a certificate request exists to diagnose from. Two costs the field name does not show. Changing the value rolls the node group, because it is part of the worker VM template whose name is a hash of its content -- including the stuck VM whose console was wanted, so it buys visibility into the next boot rather than the current one. And it overrides the platform's cluster-wide `disableSerialConsoleLog`, set because that container has been seen holding virt-launcher in `PodInitializing` (kubevirt/kubevirt#15989), which would take the node group down rather than explain it -- so check that virt-launcher Pods reach Running after enabling it.","type":"boolean","default":false},"maxReplicas":{"description":"Maximum number of replicas.","type":"integer","default":10},"maxUnhealthy":{"description":"Per-group override for `nodeHealthCheck.maxUnhealthy`. When unset, the cluster-wide `nodeHealthCheck.maxUnhealthy` applies. Accepts a bare integer (\"0\", \"1\", ...) or an integer percentage (\"0%\", \"50%\").","type":"string"},"minReplicas":{"description":"Minimum number of replicas.","type":"integer","default":0},"nodeStartupTimeout":{"description":"Per-group override for `nodeHealthCheck.nodeStartupTimeout`. When unset, the cluster-wide `nodeHealthCheck.nodeStartupTimeout` applies.","type":"string"},"podCpuLimit":{"description":"CPU limit for the worker VM's virt-launcher `compuLine truncated
|
||||
{"title":"Chart Values","type":"object","properties":{"storageClass":{"description":"Default StorageClass inside the tenant cluster. Remote-accessible LINSTOR classes are auto-propagated to the tenant under the same name.","type":"string","default":"replicated","x-kubernetes-validations":[{"rule":"self == oldSelf","message":"storageClass is immutable"}],"x-cozystack-options":{"source":"storageclass"}},"nodeGroups":{"description":"Worker nodes configuration map. When left empty, a default node group `md0` is emitted with `minReplicas: 0` and `roles: [ingress-nginx]` — the MachineDeployment renders but provisions no workers until an unschedulable Pod triggers the cluster-autoscaler (or an operator scales the group manually). Enabling `addons.ingressNginx.enabled: true` on a CR with default `nodeGroups: {}` therefore requires either supplying a nodeGroup with `roles: [ingress-nginx]` and `minReplicas >= 1`, or waiting for the autoscaler to bring up the default md0 in response to the ingress-nginx controller Pods becoming Pending. Provide your own groups to take full control — they are not merged with the default, so you may name and omit groups freely.","type":"object","default":{},"additionalProperties":{"type":"object","required":["diskSize","instanceType","maxReplicas","minReplicas"],"properties":{"diskSize":{"description":"System disk size for the worker VM. Carries the Talos OS image (factory.talos.dev raw artifact streamed in by CDI), kubelet state, containerd image cache, and any local-path PVCs. Pre-Talos installs used a separate disk-kubelet PVC for kubelet/containerd state; on Talos this is consolidated onto the single system disk imaged from the factory artifact.","default":"20Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"description":"Name of GPU, such as \"nvidia.com/AD102GL_L40S\".","type":"string","x-cozystack-options":{"source":"gpu"}}}}},"instanceType":{"description":"Virtual machine instance type.","type":"string","default":"u1.medium","x-cozystack-options":{"source":"instancetype"}},"kubelet":{"description":"Kubelet resource reservations for this node group.","type":"object","properties":{"evictionHardMemory":{"description":"Hard eviction threshold for memory (absolute like 200Mi or percentage like 7%).","type":"string","default":"7%"},"evictionSoftMemory":{"description":"Soft eviction threshold for memory (absolute like 1Gi or percentage like 10%).","type":"string","default":"10%"},"kubeReservedCpu":{"description":"CPU reserved for kubelet and container runtime. Auto-computed from instanceType if empty.","type":"string"},"kubeReservedMemory":{"description":"Memory reserved for kubelet and container runtime. Auto-computed from instanceType if empty.","type":"string"},"systemReservedCpu":{"description":"CPU reserved for host OS. Auto-computed from instanceType if empty.","type":"string"},"systemReservedMemory":{"description":"Memory reserved for host OS. Auto-computed from instanceType if empty.","type":"string"}}},"logSerialConsole":{"description":"Stream each worker VM's guest serial console into a `guest-console-log` container beside virt-launcher, readable with `kubectl logs`. The only view of a worker that stalls during boot before Talos apid answers, when neither a Node nor a certificate request exists to diagnose from. Two costs the field name does not show. Changing the value rolls the node group, because it is part of the worker VM template whose name is a hash of its content -- including the stuck VM whose console was wanted, so it buys visibility into the next boot rather than the current one. And it overrides the platform's cluster-wide `disableSerialConsoleLog`, set because that container has been seen holding virt-launcher in `PodInitializing` (kubevirt/kubevirt#15989), which would take the node group down rather than explain it -- so check that virt-launcher Pods reach Running after enabling it.","type":"boolean","default":false},"maxReplicas":{"description":"Maximum number of replicas.","type":"integer","default":10},"maxUnhealthy":{"description":"Per-group override for `nodeHealthCheck.maxUnhealthy`. When unset, the cluster-wide `nodeHealthCheck.maxUnhealthy` applies. Accepts a bare integer (\"0\", \"1\", ...) or an integer percentage (\"0%\", \"50%\").","type":"string"},"minReplicas":{"description":"Minimum number of replicas.","type":"integer","default":0},"nodeStartupTimeout":{"description":"Per-group override for `nodeHealthCheck.nodeStartupTimeout`. When unset, the cluster-wide `nodeHealthCheck.nodeStartupTimeout` applies.","type":"string"},"podCpuLimit":{"description":"CPU limit for the worker VM's virt-launcher `compuLine truncated
|
||||
release:
|
||||
prefix: kubernetes-
|
||||
labels:
|
||||
@@ -50,7 +50,7 @@ spec:
|
||||
tags:
|
||||
- compute
|
||||
icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl82ODFfMjg0NSkiLz4KPHBhdGggZD0iTTcxLjk5NjggMTlDNzAuMzAzOSAxOS4wMDAyIDY4LjkzMTIgMjAuNTMyMiA2OC45MzE0IDIyLjQyMjFDNjguOTMxNCAyMi40NTExIDY4LjkzNzMgMjIuNDc4OCA2OC45Mzc5IDIyLjUwNzZDNjguOTM1NCAyMi43NjQ0IDY4LjkyMzEgMjMuMDczNyA2OC45MzE0IDIzLjI5NzNDNjguOTcxNyAyNC4zODczIDY5LjIwODIgMjUuMjIxNiA2OS4zNTA2IDI2LjIyNThDNjkuNjA4NCAyOC4zNzUyIDY5LjgyNDUgMzAuMTU2OSA2OS42OTEyIDMxLjgxM0M2OS41NjE1IDMyLjQzNzUgNjkuMTAzNyAzMy4wMDg2IDY4LjY5NTYgMzMuNDA1Nkw2OC42MjM1IDM0LjcwODZDNjYuNzgzOSAzNC44NjE3IDY0LjkzMTkgMzUuMTQyMSA2My4wODIxIDM1LjU2NDFDNTUuMTIyNiAzNy4zNzk4IDQ4LjI2OTUgNDEuNDk5MSA0My4wNTIgNDcuMDYwOUM0Mi43MTM0IDQ2LjgyODggNDIuMTIxMSA0Ni40MDE5IDQxLjk0NSA0Ni4yNzEyQzQxLjM5NzcgNDYuMzQ1NCA0MC44NDQ1IDQ2LjUxNTEgNDAuMTI0MSA0Ni4wOTM1QzM4Ljc1MjIgNDUuMTY1NyAzNy41MDI4IDQzLjg4NTEgMzUuOTkxIDQyLjM0MjRDMzUuMjk4MiA0MS42MDQ0IDM0Ljc5NjYgNDAuOTAxOCAzMy45NzM1IDQwLjE5MDRDMzMuNzg2NiA0MC4wMjg5IDMzLjUwMTQgMzkuODEwNCAzMy4yOTIzIDM5LjY0NDJDMzIuNjQ4OSAzOS4xMjg4IDMxLjg5IDM4Ljg2IDMxLjE1NyAzOC44MzQ4QzMwLjIxNDcgMzguODAyNCAyOS4zMDc1IDM5LjE3MjUgMjguNzEzOCAzOS45MjA2QzI3LjY1ODQgNDEuMjUwNiAyNy45OTYzIDQzLjI4MzMgMjkuNDY3MSA0NC40NjE0QzI5LjQ4MiA0NC40NzM0IDI5LjQ5NzkgNDQuNDgyNyAyOS41MTI5IDQ0LjQ5NDNDMjkuNzE1IDQ0LjY1ODkgMjkuOTYyNSA0NC44Njk4IDMwLjE0ODMgNDUuMDA3NkMzMS4wMjE3IDQ1LjY1NTUgMzEuODE5NSA0NS45ODcyIDMyLjY4OTcgNDYuNTAxNUMzNC41MjMxIDQ3LjYzOTEgMzYuMDQzIDQ4LjU4MjMgMzcuMjQ4NiA0OS43MTk2QzM3LjcxOTQgNTAuMjIzNyAzNy44MDE2IDUxLjExMjIgMzcuODY0MyA1MS40OTY0TDM4Ljg0NjggNTIuMzc4MkMzMy41ODcyIDYwLjMzMDggMzEuMTUzIDcwLjE1MzkgMzIuNTkxNSA4MC4xNjI3TDMxLjMwNzcgODAuNTM3OEMzMC45NjkzIDgwLjk3NjggMzAuNDkxMiA4MS42Njc2IDI5Ljk5MTEgODEuODczOEMyOC40MTM4IDgyLjM3MjkgMjYuNjM4NyA4Mi41NTYyIDI0LjQ5NTYgODIuNzgxOUMyMy40ODk0IDgyLjg2NiAyMi42MjEzIDgyLjgxNTggMjEuNTU0NiA4My4wMTg4QzIxLjMxOTggODMuMDYzNSAyMC45OTI3IDgzLjE0OTEgMjAuNzM1OCA4My4yMDk3QzIwLjcyNjkgODMuMjExNiAyMC43MTg2IDgzLjIxNDIgMjAuNzA5NiA4My4yMTYyQzIwLjY5NTYgODMuMjE5NSAyMC42NzcyIDgzLjIyNjMgMjAuNjYzOCA4My4yMjk0QzE4Ljg1NyA4My42NjggMTcuNjk2MyA4NS4zMzY1IDE4LjA2OTkgODYuOTgwNUMxOC40NDM3IDg4LjYyNDggMjAuMjA4NiA4OS42MjQ4IDIyLjAyNjIgODkuMjMxMkMyMi4wMzkzIDg5LjIyODIgMjIuMDU4NCA4OS4yMjc3IDIyLjA3MiA4OS4yMjQ2QzIyLjA5MjYgODkuMjE5OSAyMi4xMTA2IDg5LjIwOTkgMjIuMTMxIDg5LjIwNDlDMjIuMzg0NCA4OS4xNDkgMjIuNzAxOSA4OS4wODY4IDIyLjkyMzYgODkuMDI3MkMyMy45NzIzIDg4Ljc0NTEgMjQuNzMxOCA4OC4zMzA2IDI1LjY3NDYgODcuOTY3N0MyNy43MDI5IDg3LjIzNjggMjkuMzgyOCA4Ni42MjYyIDMxLjAxOTUgODYuMzg4M0MzMS43MDMgODYuMzM0NSAzMi40MjMyIDg2LjgxMiAzMi43ODE0IDg3LjAxMzRMMzQuMTE3NyA4Ni43ODMxQzM3LjE5MjYgOTYuMzYxMyA0My42MzY2IDEwNC4xMDMgNTEuNzk2MyAxMDguOTYxTDUxLjIzOTYgMTEwLjMwM0M1MS40NDAzIDExMC44MjQgNTEuNjYxNiAxMTEuNTMgNTEuNTEyMSAxMTIuMDQ1QzUwLjkxNzEgMTEzLjU5NSA0OS44OTggMTE1LjIzMSA0OC43Mzc0IDExNy4wNTVDNDguMTc1NSAxMTcuODk4IDQ3LjYwMDQgMTE4LjU1MiA0Ny4wOTM0IDExOS41MTZDNDYuOTcyIDExOS43NDcgNDYuODE3NSAxMjAuMTAyIDQ2LjcwMDQgMTIwLjM0NkM0NS45MTI1IDEyMi4wMzkgNDYuNDkwNCAxMjMuOTkgNDguMDAzOCAxMjQuNzIyQzQ5LjUyNjggMTI1LjQ1OSA1MS40MTcxIDEyNC42ODIgNTIuMjM1MiAxMjIuOTg1QzUyLjIzNjQgMTIyLjk4MiA1Mi4yNDA2IDEyMi45OCA1Mi4yNDE3IDEyMi45NzhDNTIuMjQyNiAxMjIuOTc2IDUyLjI0MDkgMTIyLjk3MyA1Mi4yNDE3IDEyMi45NzFDNTIuMzU4MiAxMjIuNzMxIDUyLjUyMzMgMTIyLjQxNSA1Mi42MjE2IDEyMi4xODhDNTMuMDU2IDEyMS4xODkgNTMuMjAwNSAxMjAuMzMyIDUzLjUwNTkgMTE5LjM2NUM1NC4zMTcgMTE3LjMxOCA1NC43NjI2IDExNS4xNyA1NS44NzkxIDExMy44MzJDNTYuMTg0OSAxMTMuNDY2IDU2LjY4MzMgMTEzLjMyNSA1Ny4yMDAxIDExMy4xODZMNTcuODk0NCAxMTEuOTIyQzY1LjAwOCAxMTQuNjY1IDcyLjk3MDUgMTE1LjQwMiA4MC45MjQ1IDExMy41ODdDODIuNzM5MSAxMTMuMTczIDg0LjQ5MDggMTEyLjYzNyA4Ni4xODQzIDExMS45OTRDODYuMzc5NCAxMTIuMzQyIDg2Ljc0MiAxMTMuMDExIDg2LjgzOTMgMTEzLjE3OUM4Ny4zNjQ0IDExMy4zNTEgODcuOTM3NyAxMTMuNDM5IDg4LjQwNDcgMTE0LjEzM0M4OS4yNDAxIDExNS41NjcgODkuODExNCAxMTcuMjYzIDkwLjUwNzMgMTE5LjMxMkM5MC44MTI4IDEyMC4yNzkgOTAuOTYzOCAxMjEuMTM2IDkxLjM5ODEgMTIyLjEzNkM5MS40OTcxIDEyMi4zNjMgOTEuNjYxNCAxMjIuNjg0IDkxLjc3OCAxMjIuOTI1QzkyLjU5NDQgMTI0LjYyOCA5NC40OTA3IDEyNS40MDcgOTYuMDE1OSAxMjQuNjY5Qzk3LjUyOTIgMTIzLjkzNyA5OC4xMDc3IDEyMS45ODYgOTcuMzE5NCAxMjAuMjkzQzk3LjIwMjMgMTIwLjA0OSA5Ny4wNDEyIDExOS42OTUgOTYuOTE5OCAxMTkuNDY0Qzk2LjQxMjcgMTE4LjQ5OSA5NS44Mzc3IDExNy44NTIgOTUuMjc1OCAxMTcuMDA5Qzk0LjExNTIgMTE1LjE4NSA5My4xNTI2IDExMy42NyA5Mi41NTc1IDExMi4xMkM5Mi4zMDg3IDExMS4zMiA5Mi41OTk1IDExMC44MjMgOTIuNzkzMyAxMTAuMzAzQzkyLjY3NzIgMTEwLjE3IDkyLjQyODggMTA5LjQxNCA5Mi4yODI0IDEwOS4wNTlDMTAwLjc2MiAxMDQuMDI5IDEwNy4wMTcgOTUuOTk4NSAxMDkuOTU1IDg2LjcyMzlDMTEwLjM1MSA4Ni43ODY1IDExMS4wNDEgODYuOTA5MSAxMTEuMjY1IDg2Ljk1NDJDMTExLjcyNiA4Ni42NDg3IDExMi4xNDkgODYuMjUwMSAxMTIuOTgxIDg2LjMxNTlDMTE0LjYxNyA4Ni41NTM3IDExNi4yOTcgODcuMTY0NSAxMTguMzI2IDg3Ljg5NTNDMTE5LjI2OCA4OC4yNTgxIDEyMC4wMjggODguNjc5MyAxMjEuMDc3IDg4Ljk2MTRDMTIxLjI5OCA4OS4wMjEgMTIxLjYxNiA4OS4wNzY2IDEyMS44NjkgODkuMTMyNUMxMjEuODg5IDg5LjEzNzUgMTIxLjkwOCA4OS4xNDc1IDEyMS45MjggODkuMTUyMkMxMjEuOTQyIDg5LjE1NTMgMTIxLjk2MSA4OS4xNTU4IDEyMS45NzQgODkuMTU4OEMxMjMuNzkyIDg5LjU1MiAxMjUuNTU3IDg4LjU1MjYgMTI1LjkzIDg2LjkwODFDMTI2LjMwMyA4NS4yNjQxIDEyNS4xNDMgODMuNTk1MLine truncated
|
||||
keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "storageClass"], ["spec", "nodeGroups"], ["spec", "version"], ["spec", "host"], ["spec", "addons"], ["spec", "addons", "certManager"], ["spec", "addons", "certManager", "enabled"], ["spec", "addons", "certManager", "valuesOverride"], ["spec", "addons", "cilium"], ["spec", "addons", "cilium", "valuesOverride"], ["spec", "addons", "gatewayAPI"], ["spec", "addons", "gatewayAPI", "enabled"], ["spec", "addons", "ingressNginx"], ["spec", "addons", "ingressNginx", "enabled"], ["spec", "addons", "ingressNginx", "exposeMethod"], ["spec", "addons", "ingressNginx", "hosts"], ["spec", "addons", "ingressNginx", "valuesOverride"], ["spec", "addons", "gpuOperator"], ["spec", "addons", "gpuOperator", "enabled"], ["spec", "addons", "gpuOperator", "valuesOverride"], ["spec", "addons", "hami"], ["spec", "addons", "hami", "enabled"], ["spec", "addons", "hami", "valuesOverride"], ["spec", "addons", "fluxcd"], ["spec", "addons", "fluxcd", "enabled"], ["spec", "addons", "fluxcd", "valuesOverride"], ["spec", "addons", "monitoringAgents"], ["spec", "addons", "monitoringAgents", "enabled"], ["spec", "addons", "monitoringAgents", "valuesOverride"], ["spec", "addons", "verticalPodAutoscaler"], ["spec", "addons", "verticalPodAutoscaler", "valuesOverride"], ["spec", "addons", "velero"], ["spec", "addons", "velero", "enabled"], ["spec", "addons", "velero", "valuesOverride"], ["spec", "addons", "coredns"], ["spec", "addons", "coredns", "valuesOverride"], ["spec", "addons", "ouroboros"], ["spec", "addons", "ouroboros", "enabled"], ["spec", "addons", "ouroboros", "valuesOverride"], ["spec", "controlPlane"], ["spec", "controlPlane", "replicas"], ["spec", "controlPlane", "apiServer"], ["spec", "controlPlane", "apiServer", "resources"], ["spec", "controlPlane", "apiServer", "resourcesPreset"], ["spec", "controlPlane", "apiServer", "extraArgs"], ["spec", "controlPlane", "apiServer", "extraVolumes"], ["spec", "controlPlane", "apiServer", "extraVolumeMounts"], ["spec", "controlPlane", "controllerManager"], ["spec", "controlPlane", "controllerManager", "resources"], ["spec", "controlPlane", "controllerManager", "resourcesPreset"], ["spec", "controlPlane", "scheduler"], ["spec", "controlPlane", "scheduler", "resources"], ["spec", "controlPlane", "scheduler", "resourcesPreset"], ["spec", "controlPlane", "konnectivity"], ["spec", "controlPlane", "konnectivity", "server"], ["spec", "controlPlane", "konnectivity", "server", "resources"], ["spec", "controlPlane", "konnectivity", "server", "resourcesPreset"], ["spec", "images"], ["spec", "images", "waitForKubeconfig"], ["spec", "images", "kubectl"], ["spec", "images", "talosCsrSigner"], ["spec", "talos"], ["spec", "talos", "version"], ["spec", "talos", "schematicID"], ["spec", "talos", "imageFactoryURL"], ["spec", "talos", "installerRepository"], ["spec", "talos", "registryMirrors"], ["spec", "nodeHealthCheck"], ["spec", "nodeHealthCheck", "maxUnhealthy"], ["spec", "nodeHealthCheck", "nodeStartupTimeout"], ["spec", "nodeHealthCheck", "readyUnknownTimeout"], ["spec", "nodeHealthCheck", "readyFalseTimeout"], ["spec", "maxNodeProvisionTime"], ["spec", "oidc"], ["spec", "oidc", "mode"], ["spec", "oidc", "customConfig"], ["spec", "oidc", "customConfig", "config"], ["spec", "oidc", "customConfig", "secretRef"], ["spec", "oidc", "customConfig", "secretRef", "name"], ["spec", "oidc", "users"]]
|
||||
keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "storageClass"], ["spec", "nodeGroups"], ["spec", "version"], ["spec", "host"], ["spec", "addons"], ["spec", "addons", "certManager"], ["spec", "addons", "certManager", "enabled"], ["spec", "addons", "certManager", "valuesOverride"], ["spec", "addons", "cilium"], ["spec", "addons", "cilium", "valuesOverride"], ["spec", "addons", "gatewayAPI"], ["spec", "addons", "gatewayAPI", "enabled"], ["spec", "addons", "ingressNginx"], ["spec", "addons", "ingressNginx", "enabled"], ["spec", "addons", "ingressNginx", "exposeMethod"], ["spec", "addons", "ingressNginx", "hosts"], ["spec", "addons", "ingressNginx", "valuesOverride"], ["spec", "addons", "gpuOperator"], ["spec", "addons", "gpuOperator", "enabled"], ["spec", "addons", "gpuOperator", "valuesOverride"], ["spec", "addons", "hami"], ["spec", "addons", "hami", "enabled"], ["spec", "addons", "hami", "valuesOverride"], ["spec", "addons", "monitoringAgents"], ["spec", "addons", "monitoringAgents", "enabled"], ["spec", "addons", "monitoringAgents", "valuesOverride"], ["spec", "addons", "verticalPodAutoscaler"], ["spec", "addons", "verticalPodAutoscaler", "valuesOverride"], ["spec", "addons", "velero"], ["spec", "addons", "velero", "enabled"], ["spec", "addons", "velero", "valuesOverride"], ["spec", "addons", "coredns"], ["spec", "addons", "coredns", "valuesOverride"], ["spec", "addons", "ouroboros"], ["spec", "addons", "ouroboros", "enabled"], ["spec", "addons", "ouroboros", "valuesOverride"], ["spec", "controlPlane"], ["spec", "controlPlane", "replicas"], ["spec", "controlPlane", "apiServer"], ["spec", "controlPlane", "apiServer", "resources"], ["spec", "controlPlane", "apiServer", "resourcesPreset"], ["spec", "controlPlane", "apiServer", "extraArgs"], ["spec", "controlPlane", "apiServer", "extraVolumes"], ["spec", "controlPlane", "apiServer", "extraVolumeMounts"], ["spec", "controlPlane", "controllerManager"], ["spec", "controlPlane", "controllerManager", "resources"], ["spec", "controlPlane", "controllerManager", "resourcesPreset"], ["spec", "controlPlane", "scheduler"], ["spec", "controlPlane", "scheduler", "resources"], ["spec", "controlPlane", "scheduler", "resourcesPreset"], ["spec", "controlPlane", "konnectivity"], ["spec", "controlPlane", "konnectivity", "server"], ["spec", "controlPlane", "konnectivity", "server", "resources"], ["spec", "controlPlane", "konnectivity", "server", "resourcesPreset"], ["spec", "images"], ["spec", "images", "waitForKubeconfig"], ["spec", "images", "kubectl"], ["spec", "images", "talosCsrSigner"], ["spec", "talos"], ["spec", "talos", "version"], ["spec", "talos", "schematicID"], ["spec", "talos", "imageFactoryURL"], ["spec", "talos", "installerRepository"], ["spec", "talos", "registryMirrors"], ["spec", "nodeHealthCheck"], ["spec", "nodeHealthCheck", "maxUnhealthy"], ["spec", "nodeHealthCheck", "nodeStartupTimeout"], ["spec", "nodeHealthCheck", "readyUnknownTimeout"], ["spec", "nodeHealthCheck", "readyFalseTimeout"], ["spec", "maxNodeProvisionTime"], ["spec", "oidc"], ["spec", "oidc", "mode"], ["spec", "oidc", "customConfig"], ["spec", "oidc", "customConfig", "config"], ["spec", "oidc", "customConfig", "secretRef"], ["spec", "oidc", "customConfig", "secretRef", "name"], ["spec", "oidc", "users"]]
|
||||
secrets:
|
||||
exclude: []
|
||||
include:
|
||||
|
||||
Reference in new issue
Block a user