mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-13 08:05:19 +09:00
Aleksei Sviridkin
69247ba80c
Add the securitygroup-controller Helm package (Deployment, ServiceAccount, ClusterRole and binding, image build) and register it as a default system package so it ships with the platform. The ClusterRole grants cluster-wide pod patch — the controller stamps the SecurityGroup membership label on managed-app pods across dynamically-created tenant namespaces, so the grant cannot be namespace-scoped — plus read and finalizer patch on the backing CiliumNetworkPolicies, and leader-election leases. Tenants gain no new permissions; the membership label is written exclusively by this platform controller. helm-unittest pins the pod-patch and ciliumnetworkpolicies grants so a dropped verb fails the suite rather than silently failing closed at runtime. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
71 lines
2.0 KiB
YAML
71 lines
2.0 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: securitygroup-controller
|
|
labels:
|
|
app: securitygroup-controller
|
|
spec:
|
|
replicas: {{ .Values.securityGroupController.replicas }}
|
|
selector:
|
|
matchLabels:
|
|
app: securitygroup-controller
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: securitygroup-controller
|
|
spec:
|
|
tolerations:
|
|
- key: "node-role.kubernetes.io/control-plane"
|
|
operator: "Exists"
|
|
effect: "NoSchedule"
|
|
- key: "node-role.kubernetes.io/master"
|
|
operator: "Exists"
|
|
effect: "NoSchedule"
|
|
affinity:
|
|
podAntiAffinity:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
- weight: 100
|
|
podAffinityTerm:
|
|
labelSelector:
|
|
matchLabels:
|
|
app: securitygroup-controller
|
|
topologyKey: kubernetes.io/hostname
|
|
serviceAccountName: securitygroup-controller
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: securitygroup-controller
|
|
image: "{{ .Values.securityGroupController.image }}"
|
|
args:
|
|
- --leader-elect
|
|
{{- if .Values.securityGroupController.debug }}
|
|
- --zap-log-level=debug
|
|
{{- else }}
|
|
- --zap-log-level=info
|
|
{{- end }}
|
|
ports:
|
|
- name: health
|
|
containerPort: 8081
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /readyz
|
|
port: health
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: health
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 20
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
{{- with .Values.securityGroupController.resources }}
|
|
resources: {{- . | toYaml | nindent 10 }}
|
|
{{- end }}
|