From 63e14e6f2d1d2f91f9d58846fc118f8fe1650ce3 Mon Sep 17 00:00:00 2001 From: Vasily Oleynikov Date: Sun, 29 Sep 2024 11:06:03 +0500 Subject: [PATCH] [controller] Fix Helm lib (#40) Signed-off-by: v.oleynikov --- charts/deckhouse_lib_helm-1.31.0.tgz | Bin 0 -> 25584 bytes charts/helm_lib/Chart.yaml | 5 - charts/helm_lib/LICENSE | 201 --- charts/helm_lib/README.md | 1167 ----------------- .../templates/_api_version_and_kind.tpl | 36 - charts/helm_lib/templates/_csi_controller.tpl | 763 ----------- charts/helm_lib/templates/_csi_node.tpl | 206 --- .../templates/_enable_ds_eviction.tpl | 6 - charts/helm_lib/templates/_envs_for_proxy.tpl | 30 - .../helm_lib/templates/_high_availability.tpl | 39 - .../helm_lib/templates/_kube_rbac_proxy.tpl | 21 - .../templates/_module_documentation_uri.tpl | 15 - .../templates/_module_ephemeral_storage.tpl | 15 - .../_module_generate_common_name.tpl | 13 - charts/helm_lib/templates/_module_https.tpl | 160 --- charts/helm_lib/templates/_module_image.tpl | 76 -- .../templates/_module_ingress_class.tpl | 13 - .../templates/_module_init_container.tpl | 56 - charts/helm_lib/templates/_module_labels.tpl | 15 - charts/helm_lib/templates/_module_name.tpl | 11 - .../templates/_module_public_domain.tpl | 11 - .../templates/_module_security_context.tpl | 199 --- .../templates/_module_storage_class.tpl | 38 - .../_monitoring_grafana_dashboards.tpl | 68 - .../_monitoring_prometheus_rules.tpl | 96 -- charts/helm_lib/templates/_node_affinity.tpl | 256 ---- .../templates/_pod_disruption_budget.tpl | 6 - charts/helm_lib/templates/_priority_class.tpl | 9 - .../templates/_resources_management.tpl | 160 --- .../templates/_spec_for_high_availability.tpl | 138 -- 30 files changed, 3829 deletions(-) create mode 100644 charts/deckhouse_lib_helm-1.31.0.tgz delete mode 100644 charts/helm_lib/Chart.yaml delete mode 100644 charts/helm_lib/LICENSE delete mode 100644 charts/helm_lib/README.md delete mode 100644 charts/helm_lib/templates/_api_version_and_kind.tpl delete mode 100644 charts/helm_lib/templates/_csi_controller.tpl delete mode 100644 charts/helm_lib/templates/_csi_node.tpl delete mode 100644 charts/helm_lib/templates/_enable_ds_eviction.tpl delete mode 100644 charts/helm_lib/templates/_envs_for_proxy.tpl delete mode 100644 charts/helm_lib/templates/_high_availability.tpl delete mode 100644 charts/helm_lib/templates/_kube_rbac_proxy.tpl delete mode 100644 charts/helm_lib/templates/_module_documentation_uri.tpl delete mode 100644 charts/helm_lib/templates/_module_ephemeral_storage.tpl delete mode 100644 charts/helm_lib/templates/_module_generate_common_name.tpl delete mode 100644 charts/helm_lib/templates/_module_https.tpl delete mode 100644 charts/helm_lib/templates/_module_image.tpl delete mode 100644 charts/helm_lib/templates/_module_ingress_class.tpl delete mode 100644 charts/helm_lib/templates/_module_init_container.tpl delete mode 100644 charts/helm_lib/templates/_module_labels.tpl delete mode 100644 charts/helm_lib/templates/_module_name.tpl delete mode 100644 charts/helm_lib/templates/_module_public_domain.tpl delete mode 100644 charts/helm_lib/templates/_module_security_context.tpl delete mode 100644 charts/helm_lib/templates/_module_storage_class.tpl delete mode 100644 charts/helm_lib/templates/_monitoring_grafana_dashboards.tpl delete mode 100644 charts/helm_lib/templates/_monitoring_prometheus_rules.tpl delete mode 100644 charts/helm_lib/templates/_node_affinity.tpl delete mode 100644 charts/helm_lib/templates/_pod_disruption_budget.tpl delete mode 100644 charts/helm_lib/templates/_priority_class.tpl delete mode 100644 charts/helm_lib/templates/_resources_management.tpl delete mode 100644 charts/helm_lib/templates/_spec_for_high_availability.tpl diff --git a/charts/deckhouse_lib_helm-1.31.0.tgz b/charts/deckhouse_lib_helm-1.31.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..669d8b04ad7b79d865211a30a40d84548d02bf27 GIT binary patch literal 25584 zcmV)pK%2iGiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMZ(cHB0yD7t^^DKNCNM#@#UKKwPKJ0_N+`U zgC^147_$Ke044X>UTZ(Ze!~4EXQ2R);AgX2E!oMa&)FG^1gi>#LRA4MRK+BEJLQ=q zVM0gYlq9pAqbU|@ILEW(Ki2cx-QC@N{`4vQ@9yqy^?!Hw_xAr|@9Faw&-b41KYhCY zAG>?cc6Xos2ijc|{?1<}6&C-oduv?P&izh)IHf-lAt`4E=z4!6CNdHjZK!!l4p2fz0*m>^wL`l% ze6ly(-T2g;`1kxZ%zro5awo(o4edCEn8o2+%Hp9)msAW3=Kqst&!3d%|Nj2o-iwF% ze;>d1?+0k-OZ0=p6LNswzekisNfr|nXjuTE(1RY5cT_4Fpv{Czg@!2jn|?gdbN#De z3w`{EzT82Bj~_QIKtWU{m_$ls1ko{4Q-WklB08odMuJG5iHIN#1Z_rGk^yCsFi91? zCR>O~BuFZVButSQQ3e2_B$J8=9~J1MR%$3Y&?f5|mB0(FjWt zBhC=M#x%jBgdmN-Gz!~bFtr?~f?v~^#8&(nR|qEw{3Q_<1j#Jb14-hoPFZj5*@N77 z%01xa0&SAt{5}Lf;)KRnQ8qb@XH;se=RBd&JlN{r_G`*w$|k{9iC8*b+`-{@SfT(s zaDq&zR035)dx&3P)2SLg$_t4=PHt1GKk0+nA9V z7xM$O|Lis0@Ci1V?-}!z}heHNJ28 zyr$b4-nM+&#?bago>hFCjfh}G5qU{wKN6t~N%X3Oub(_1~edT5*9s-GpCYv^RH52YSjwc4|T z7pC>C`sZU@L-(p3DD}>`NDDgmqfDnn5Tku>)in>@8hTbCzTC0Gj`bY6%i@dM^|69^ z9UX1xOsTh}mC=I!zVh4Ns;70VYv^lpSNz`6af7ZaZxe2|=x}13?$_p+6@5TcEKzVx zgrX5n1}TpRI8$6kI3Z#Xi5RxBHwJ^jhJVQG+E6y}b_L&379XG=EwFPQALgJoX4dOJ z*g(jf?Y@8SExv$y{V$o~h#a8!F9ZEP-&TZZg0s9O^s1P(@3EJr)f}M z%>_4HyiGWc2W~k$NMX})nD1>3DGyLE!&1+Wtu6EcF}%9Qp7;YVtG~x3ZVG16$u_jAntcckMHGs{N*E}W%DA0`7P#y7p!^n98 z@Q@N|9uJBaXMoh-bP4Qn%8atZB;hwCKCn+Jyl>g4$(dd-=`Y2B%?!V*L4|#X{oPsq zptS$cOt75o4N~9-6XB7=`GZHM{K*^{b<|S(_gYLy?fBQ^>{y1-P6^5DQ@24TqC)AyA3?AT1sO@ z3hQ{z<6|mC2GLPpXYqun&)ha{ZJ{<>H^c9KVEJM70ovO@NRos^iVMTQ8CKEs6(DsS z#c5japk`amAeKB1V>&;7UbV1FkTjtYmWD}!7_0dmm5Ph`D>|d<0PU~LK7`;*lT575 zH$ie2B!V4R?UmT$I1AQeqW&c%46Qi)n2mEm#`GNuqJ(Ghz{VnoLD0@?0L&OyaQ5n9 zGa$^~#UPrJ=&j6VrIQ77)>?pep$5aRu_WhMO;NCuL$PBqm|=z|MC?e-1rv%IZ29wF zPVxS;=Q5i$#)=^1hED&cT&gpow3m1Q+u-(j%%t_T(2`NlB(edCbB33Jsdz%n@p}{5n9T~_j7*k0 z;2B>#NsQ*Ht#3b|-!iU<-yDmHr$z=S7z~s-&Uje?;Z8X|ehkX(uU|f^JkjET<5&@xm7tLtIDmm4aMBYh z9G(RmHRY9mXGL@{mf9%1B=6MI3Ka>#T6M!Tr<^qrT4^%KE$qw3n`eiwPcF|7k50BK zADQVlh;WJ{s^(Qb+s6Zb!-x=MJV?kjNnY;ztnN5jto9R{4vfJYI0KjWrHwl`aKtlE zQ!TEtDmLx_$QK*Ju6>y^6UT~4{v4ret%(lMP9&-RzoF#O+uCR6Z;nIFzUp`12tGUT z9wIcRB#HA)h2mF=yx*(5gpag&JjgBnP$RCBa`|PNCq6eGuuBDadabkxG_H@6>N3ost<5I0?0%h9@LU_(X=uN>$Gqyu9f!wTQNSBrAgsK(|Ky9X!FT+O*Il`dH19tRQLDcqLfxK4MDXJ-pcyD zl|Pa)>3w3ptVVHzP&(26)S99plB}Pu=rz-)N~HtB;*?XSUOwLZ?#<;@czV8d;G-_$ zp6_aETC}TAOmFTVnRY0xa)*J+k?zDpX-pQ>69 zeoIt&_NHd;PYF)c^k3yyT&S{s_LbyaXr1@wa^*K%Ak0w4-ZFl}kRVuchORFm3>}q& zPS6d9Yv&3JlXF4)h`;WrS^6uAserTld66)|6J|)8&=jvxjq12I@$W(T_{?-q&C-^B z`ES;+dV5%>tx3!G4vcG2@y&zhU$$x)F59GGh@LOdC+!!i^sn^R3u=f=!-|$^gw-WB zsH}zC?q_)o&$A?PVL_+kGp^1}5~92nb0Haiz>)?$$PGz#s&-uc>bJ$w{{5oPe}?m> zfhg1UT1-oW`X#ee&5x-#K<|BNy?ecTTdmuqb6YyIl(Oxfw&j++XYc!ZvZaq7H&)3X zAVxUS&eC$Z0?bzpA-Q=h?qw-Vsv)%0Sms(d>21PDhfBtfZahLSi{HkhQjAvh-KEKg zrrjKQu(LCvYMPCP5ufc8cbW8xafjF|Ujq-?&M4ud9TU>G6GIfP_t}nSCj?P?vAQEJ6r4F|qWEq(FSNBi*cc$3(r*RNQh9)W z4uW4ceC>yR4pQA~sR&b613{B(B1Z6fLR7G=msS$~_XewIs{dgkmGr-2k`P6LUzSG| zC78~7;xqS!`d~2uvwgtUfLSGON4o*Ec@IIWy%^PlTyjlVmD&z&TRv=~AZ_V`-FX@= z>Wm$3+q|PU>p}rGqt@4MObZZ1k}@8zYbg4IdV~(6h)9VPw}#uqF3fcQ5S2(Tm=Pl+ zCNa915|g^|=<*cBf?k8_(_XNCc>crJuTC$&3x7Cs|N8OGs~=vUcpDH!KDYUB;}JU5 z(6B-gmSh_>X%=)tlLP^=b@DbIX{uwQh?r>$1msbrsg`(5%u79`5w;%>mmQWG&VJ+5 zq?m0cxj&wMmf7f^BvPQF8}0dWR$TCe*e%Dpaa#i?-1v8J-y6W&n$&(YeNxZH+Sf;UQ zcgV$jBg)2H%uIh)Fj>xxFyQF&E?3nF@V&4{=xR#Pwv&8fswahR8|Rnb&^5){qgPmwah6;Xg*J13 zgV~%Ah0b}rg)ob~TXSgBZ=na1$IwJ+Gj(CEp=of6qcJtlz0bFLNP5cS29DRH7N@DK zf9x*8HF}u8R8-&^jMwi#6W+BYE19tMSu1b(x$&ro881Cuenslw{7#mmUa0)~FLh`aEG*U_gM-W_x1Tt=UMPQLg32;*n(czbO4JiKm?pwGeO{-oaJy&3q=h3TJ# zbzgEy6h?gGQGU+sb`lH?9>{g49T5w^6?Pz2ncp z?B9#9e)d+s;KJu&^b2|(Z2o=O{Lh5vpM}X^Za$P&?fw;tTQ284Pzy}I=BnRX(>ka; z{2W|^^8J#}z&%*^0q6=R!fQL>T>W5pt!JtQw-#?N6q;|n2g;7JMi1vR^+fJ%ZhZFM zNSPC#heuMT>A@?xFR$b?;`?XenJhmyya2*aUF+)MSN|=p|HgPsR;~PIe%WTm5&fvP|)?sa{s`wxv>*8Psq7zvD9>sQ0u9s`t7DY<FsT5QBjo0PoB1~sI zChfJ8^0#fDw%1I`-?n|)StrSF&<&ugHd3us8>mL?pdUT=oxH2 zT3?|SOlF*2l22c!MfYo9rr{v>uzHt8Sm>XvS|Q=tQUx7gaF(L^j!Ar9uHjG}^xsJ> zf(0^fgz>VeRsc`5iueH<+@cP_nhFj0x%csStgZdL_)Pcmu=W(??&WbND4SeHQxa#o zSEm!k^T#LeNR(+GsC-RT!@RVez9M2)xy3p#JUDrm3SvTntI0_Qh^Itg%`^rK9w3+Vb=fg zb02{N_>lEzIqB^v^ktI{S5HkU{%TWkus+|l}5|JdDq{^CVB{$qdd*^9l0_>cSe z^$4~|1%xU4QV;t*_Dq2+2yA>jy}rCcb?Abo=E6M)D;^09{~<*`IDY&#>{5#$cz zP-kGtB7W%)S76Nn3T(y5b*kG%^Z#0gV=lr}@OSf7qreu-|0nw|cB}J$_aXl4ettdX ze_06H<~#cC>gqf^zj*Usf8U0GUz$H4fyvn$`v+myRB&d}q+mg{kefs``8uKkIwmP$ zu|%AqpMd}*iBgnJ#O_bx-JD}9Yz1HEWKb_u&}<8!wWQBje4^nGXgb*n{=Y`2Wo ztfUU@|K-rIx3;UZEQFyRmU9OyuON_%$40*O?4PNw0Nq>XI4t_58Iild(&!Z5l2Nje zQ;@=--L!aQPd?k^jxU|IHaMf8xHe zd(9@6NPoR)KCftaFI2Y{Wr1fTiLfN0*2G?%?v@v1O~+`8<@aP>#Te-EIrOG|kY~bo z_N?^5u-ZQFB(Ti=0b`uMVZ3<3Vvl9e%%iQ*to5O>*&eQ+)_!=4`1HaeE5VcV1T%6f zzk?}p=w`(2sIq@`-KsGG%yj{pV!P`X2WZ$axuJN05#MceGo{f~PizId-Z2`@(S+v_ zg$PRodl#J(+Q)nstEoTK?6MA9z__wQA(fzP5|kXMPdceqBJr-~($d6KrqJLI>T`Dc ze{Zu9fodGL+5lYO|Lr|{wpaE4_V%AV_<#5D>*4=ZgdmJ?7!jf9m_}H6{$P*?%m)p2 zHS$=y0ex<((2g)p%{j4d~x%oR+Rt6h|I5@SuFa5fd2+ znwpc14^}SxGcbHDUlW1djeL-P z7aJDc`ropuw51+qf-YwW7V7_}&nx=>$?ntV5BmQ;em(Smn-F-K|8FT)Q@s{4F>AF#v3Nohe zv~~@89W4b-${T)b-+BNBr(6K1+V&vMv6^b_sMVsQwE{;oS@$pKb-?6oLF0fpr#grG z5~YGNHAcY~nsr~uFSL4X6{t+mP)1WyT0wQRH$;SH+-vvgg3{mwTU!;LRn{4u#A~{n z1fvzAT_9{21FOOPE|h;?{a*`uT(ACr`n-DnzyIRJ!}+jI737-sjs^oBn-wnnzA?Qm~dM4?=$gk*zXGyGGKOD!#_e-(VUSMhGw7NOvXdSrv zH5wR@0mwn?0@29$YCWt-kN$gqq!o|VX9FG%*SzzhUl4QHi5~L|~PtBhhP|B}~8~ z{lE93y8rX!>9dFPzkB)h*DFmz;4cC6-vjF#b-MrBJ2fyMgF+sD1)3m}pf4e`)7uA% zGO741zs0c`5upYqI8=1UX?0S6U*5aMw$OVw+^~%*XBNik?MxNa?H-p%*lK_sCWKAY z6e4m6%Q2Q#2??pTe*V;iv*yETuV0&wyAGs2wctPe;MYt4!(w>#9FX1mfA9I;el`AM z_vy2T{hxdJ_1FLYa=pQgG};}R#;})T8k?<@0C8bARl1`(8jv+_kgp}Q_VJ9z#M=+K zmm}hmN^LtLHk_)QhBh`f(U&NgLC%puInEOL_p*E?;qjMC1%t_NC^)9l#uYp+by~w~I(!B^9S6bn)!1VbOj`&{Ltus1!sKij3qFIp zcMCF=mcQ(n4)-j+)!E~yB0{}3u9>}^b1G$K(udXO+GjKee3>y{1xH0+e7NP?=$#~a z+z7TxAPkTQD-`_AeEOB8%KOFzICw0i63sA+vEpKGDwtP32hwdBWyMjc4AH(`r%LG&zs5BCk^Dck?wGJQm7jkRT9@IYL9pE z6emQ57iO3w_Cadt4>L`-EWSe^p{Pc zu}NK_lxDg@pT<1rR1YuNM{t*3^0Lm2mnS9naazC?8e##XyP2#9HMFAUvJ;0C#?^W- ztxFc^1*Yrv5YW+m!*@y4zt^EztUhl&Il7ofWf(KLyB9`NoFs%zNGN%7ttWeJHmyEH z9a!#g+>CE^EA~_zb7zwT&lGv~B+xz?&*E`{g|xiCB-i%vn-fvk$;t zIjodT1d;M6!BTc(wk=&=R!mTO2}_$bMHEsxv?%QHexy3P+p<2AF6I zdI>AhNX(r`V0Cfc%RR~Qm;FkcPPpu80pu_s|E|oPTThv$)k%G7RF~0ry-8PRQIFnvt?Q?V zb#5D64FTw`MxFkkCEvbJSRQKK7E8UJaBh=DtsIK35^2Ka-GbBGgv!I>qv~)TV}&7o z+W(Qfw-bkF3yPdJmCwyD}k9(3Mk>!lt{ z>mnSrZVQ4A)U7*-u-D@6+{`km(1@TKDcbJ0cKYA*p4=bx*X#Trvculh`Ty>V7kkfY z=l{D;AI|^p7HogPnce_K0%F0mcg-^`^0cf-Sy{9YLdd{8}zka zk#coFJvhg7LZmky-KQ~-ZCVav_(+yIP#FTh_j=)2!dB2ggy2vSaMKw{lhFDLIs8Jx z#v0?upbNUtdF%$`XaTqM+@(1F8q2&Q;=)e5kA@>Gz5eZdiO>|o^+s1)*$#koX_@Ef z%N?H|&8q{ycV$;&ar?kw3TpYPmijo*eG6)ts;1nCNIsEvg0?kIC*Z9b(g?bGk30FA0SE@*TT7=vuKH~MFWez2A*>4X`<24`8%sg1u8!##jd{l6-g>z} z{h*)!t@U$VH?LVwF0c7+sr%NY{q9o#t*!xYp#y7Luv;yzpbHy!{+CmXeyQBs>&3C) zGkZ&6i39mE4ZlMLd3)^<7#;-o;o7y~TFS4h%IWgjYCVR%tJL#a<#-vB-%QklVE49( zcOzjf>T-qkf4}`7|LAu4eW1nn|El#L_V=DWd)WWEkKYmtkMj9_M?94~9fy`i16kGM zf-evk&JK`wRL?GGWwX$klhR%*k}^$qeV%@|=XDDM;{8~QuEWHk->`Zhu_y;By`~deLSk=k zxVJyt-`(FmKo?}juL)99D$$fADG^3x;v_*-Nt9{JArT%cB1|joCsBn2!O@h&=z>RY zFL^?%X(4)<9AECjXv%L`$oPoI^U&0^^BiRJ0G#7a-`KAzX!8pKV2K2YG9l?TN#@YK zG1Ynyvlzv;>KY}|i@Pxx``M|*9qEz4+PycQcmW;GH#V^tu1=%IGO%oU|GxYg04vHv zF14!mYMm!3W%&+;D_n_w4&*f0M!_J`{{=eG-~v5=_Uy^i1Nbl6QL}WXPE_#AMoVp6 zk+DO0#@Pku>cC_ZE}s7&i8w&J#e;7J&rye}n1s^x2bV2k_sA>2tr+heU6~gtF{i_?8Gp{C%0P zUZSVNzYh0aEI)Bb^wwlUF+kC^iJn8;_tw}0@X_4V? zsYz7t(R~z9Ftmpr?X~$=gm|@dvzVVGdOLtV3``%^F(m=&_W;fYGX`5dq7PFZhi=}5 z7FZ}U7GfD@l88cKm4(!%n6;(RUDv)pxi~v{6&}4gyS%zMJUzRDiQ$#dsq?WEMSo}W ztDyjPb((!@hxXyO)UVh2&&1ZQ900a(|8Kt*|Ml$IL;cr#`Smx7l-~A`m`Vaeidk^#fUVi=kzsCHcOC^5I z>pnD=6M(G^sH2OJ7qoaUBlVHx&zcX#1G9VX$N$Cu^fiXtDlgw5}B z9vj7MFEndZaIQ2FJWG37iN1sn)=>WK2Tfk>tQ*c#yvGekH01*tB{H&6I-P-`DXsPW zlN#^s{_5u*3pr(utUH6hmKf2>PzDbAI>yw&y49GjFidc|T^Stn>`sTolp(nhRN+xV z!f|(i-WtXTUTS;<;V2>!>NCROUw*jTYd3H8{(U|pi_rL9hPrfybQgo`Ay~)IdEoAS zu%149@~k>o@a(R~=H6za$K89Ij9tC_e1_PckGB}};<&sgPf{sEL8KBiQjlw`ecTre zx)&?3VCd5%lW0a6o#6xydZ}Ju=W*7Go9KbL0i>n`UE~y+l%sqMkF}gRs?epvEXE@4 zB{jF^)4C-GCkekf7xbDYWI|44gcEG)%(}Rj2&bk{IW=eGvEZpWfX7MFB2#_kQIbfr z{9N!cO^7*jH(7@+GN$N^9Gk@TccqC0=jx7h&hA>2h#~N9)rA}AN_bN_xM{rupoccJ zMG4l$e=AEUHNsSppxcZ_nc8&^#vRXr4voXO3Ss_-sZ#(U$u+|ec-9)Zt`VAQff^wy5Q3KCa97@ZczN)=0y0o+fvJzbNyb;22Z2mDomw&$u5077;p54o+6&UVX zJGG77T`8=7JzKZ#s*TtJb#{;5h%a@aUhHY_YN@eZ+84n|QWADpW2PkTl{0*uo&3y9 zRFevD%Wtg%4qv_cF15`x2n(7MQpT2q(pg=3C^Q())qm$0?)-|~=+aOF% zen89fnJb81lCgUgt%6JII5>Ny`OC+R{rNOf=!{eO=*`dgymmSLjHK~?MDFtwtUsLO z-1dn6E|l0dh?IY#e|mgplJt2V^{;ZO-?j;TuNL`JN31;j*7@rf|7C9i-cA0eCr_W& zKbw%GvxD}!=&mB(|eds=^f zEz>D!`rtZ>gL0BtSKKuxp?m`)Pp8Y3eyAK+ z_ye0VF3>{~w2w(r%SNne&u9E@E%k7V*u+#u{F;b)V+ZRgh&7f~Ak|rQhwN(44D7M( zPVv9*mz^E#hr6)s8wj72Em)!D6;a>+TU-fS4;+y_jd#r z_%&n5oY=| zqGo$P#X?b>By%(&j0mhKn-m0fyP~~$w8$e}!}T=Hrei9q*#R8fCmcl+d8|#mmyxhHo_*n&y3SElWO$*Y?!;;hQoWp-msk2PD&kD%cJT zb^`PPC4_CEJukhFLsNy~u=fEm=1FWaL(2jTj^n*D^evBm>;I-$O}DL?%xypH=M2A1 z_{e5NFL5T=`EvMAS>z~kG*GX|g{c+LKsuHRZB=qjIGHtHR)`>eWdIKw^w?W)bg_M_ zfkTyh+DKCeH?y}YbtOzzqr7K=Ovt+n^XXxdyrPN-?STH{AHbByfvuAe1Ra2MKT8ih zYV`jb1pbp@?MVnvx)I2PMx>6X2V+cmhDGqbQh}wLq~2Zm(l=YyCu&gklCnuc3O!aY z0a`-t2Hz8%t+u7ZW0{SPsgU{NuDSs9CqPa3+Gl{90%aa)V3)x6)=5zQz)|-S;WX8h z=TGeTc_4RTO4k+7{#HI_J3%WWYnZl$bGP6FY%>I@;4`A8B$I?5&?RgziD&@P2p{f4Cq2mI)}YZM-LaPSUld!(W)4v zlDAcJrJAQY~Uk^=R9r?y3 ze_pEntJ^I93seYDeZqym!QW+hy7t{T$DdZIvb;?_~ENXgKp} zf;M!}wostbq*?{vhx!t!H0j!w$mg1W98fxnsDo^S)^McI*wvR6f1%hI2rrK=4$n`* z)3d9SiysePg<;?=)no1UEIi^Vbj)QWa7s>@BH|h+=mWARBk0L4xIP_t|0~>Yz&*>7 zwGjX{OBc}aOp zkh3sLW30%pUg!fj>Q3Y;66ZPq3i;q4>(G%j5@Iay*IM{6cO) z=;WKT%`LRKIm7QZH8yF`09*g`QX3X7OdC9sgsEzyt)SWgji{l}Z0TgT?Xb6^9m{{W zE6dVY=0~q3J-f`7@20kAA5@xbJ#74TZv0kP|HUG27;!NPnRgC(}jR}-Y5V`LU= znJ*_)3X2I*p#)blRCGporb0;~&SGEK?3+$ei~pHPg=|YxBnEQn0&GN`pW0ip7SPs5 z;%+N%t}|`Yb_FEneWnaq@@he~(1)A{=7?G?j;!nH?N_!fa=L4X4d3g}KYo;cprLE# z;CQd^s>VY1{x9P(3Go<=;rx#3zwAGI@ocwN|K-L0!~XAm{OpYSkqA1To04OaBv7yq zNhPo%llibyb-2h~TT~20#(@YOh(d4V*{`*3&u=o0g`SZt4tyOPpupW#4`x^@A_7!) zgUn*ndBGWb%lHk;=|=wuzPSEJ02K(D(^d~lk)EC&zp&c1%n)tcZn$`xa2!h%6Y!%r z>&d7RXYQkje$IzV{rtLV>N$o5P43w?;tW#A^&i0iv-yCTX!9GI#1S0eEx5`6uD`Et zlkzTcOC@Zy-b)azVc|8bm1}zqThAIx80n$QZ#=9(Q#mppLet%#mxiITkyDPn*Mo8C zWc=gD4gYVmdh2NK-)b%Gx!SG#M)o(vvj62WB@rFd=#0nYh-XZFJ-^@yX<(I>V6|mp z?@P4mWhalxK=6c=kBr~HZ&(|D{CI$Z;Et%y$6+;U-RE~nV?H-mAkp11^=T`u0v)AX zz^0iem$|0cs=l%GY(0qUA4OanMWUjntX(LNdH-IaAWAX~;xzz*UiB5}@^ur9NbqEk zCYX^soOZ6qE3o>$NW2rxuy9Mpd0mPpMBpNqUvHml!3x}i8=y^8$LA5+=%y@J@noLMH-q1_d4Y_h2Yoz>xQH6Da@(FM}9ENMTP5Bt)V z<7g+ZO(}b7;Gnn-^pl;s2WUdCi9{(8GYZGq((E)&30&fb6ohsY!Q>EPbEGh3N}|n7 z+J_O&%r$}TDOKnT-!X8)7Ut6C+Ld*!9|_VjQ+B>YhnCudf^KSRuUnU*=!V%@u${>% zZ=t{KnHJ+nPu&Pf>BGee+z7tZ8qTpYImuX}i_#z0OU@0n#3cG5&>NLHU`UJn)WI zwvi18-bUJ=8%Tu}8O(?hG?HK?hix5OxL|G_I4?4`*U)`qEv4Tx$|izHIj~M$LPSlp znh7n;?jkZ>%YH;&TGy>0(Izx(V|>iyHj0Q)gBfOc;zy}>(eK=YMbz8ubFH+uMIe+5 zH+wdN}ER496h2+o{-^}PRC-2 zzAG`Sd9IeE#>&?<+%)Q!Mx@DcsL&K>h^0uKmhLZ#*y$^K~FLECD(oUw?Dm@^XR4v7`G zb*^;VR<4UYlaC)a2IwuBAGB_wn9YqvtxEeCu5libR@zY5K*&V^9H8Lj9hFK3wNE-* z9g~FU4jf??(-L=>EL^tl z$y_!paNd%6gL>!>&XVm)_m_(GH*jRhIbW7hHO0y~js&7y)*zGl#9J(r&AvV`p`okG zc87u21J)pD7DYc+E`T`9)`m{Sm=(hs*yLee%&0c+w2+q`bM54}3@01Ngp>fWeq5m^ zXe)#CJ9P^vme+SO;DrfU+emunAB)DZ*?s@qMltWuos7WRXOefy)Xn{-<;Um7`zG1n zXk7!%wFgt$+#VG7(L$C%!;|7_osMIG$U*z=i!s z28HP14oxO%3*I#dRGH+J1**ceia?b;V8)f{Y)2cOsR17kVk+Nuw3?9_7xRH*Pe)4) zs873;#(kP)Ob{GR^+L9*qeR_s@ph0ge2r-Wt^0~n{kUQoY07O&EJiVMFox)AN@c@2 z(mdY;7|ruAPipqGON(Aa-bEx;p6j}PkzDG$aiL(k6uC{ZshKlOC>v1)7e5j%)!?^` zi)_}`WXwfG29yto5L~piGIyW`dI3G)*F-F#Kn9@3ys<8yD=?0ZE>DYH`)zbHrO_1K zV2M0EZN|}R@ol*MJ;m2Ve;!E++(xmW*F+#eCRD3lW6!9%6CDG+x`lEv%Du}>nQp1U zh;ya+nWjrxtG+{2*^+8^DvE)F5u(y=2$cru=;-wwFuaq-m50IDYzMW$hsX`S?r8JQ z=BfPJ8=&fl0tSbmrgGc-5Hqk#hl_W|f2TYSV=6@kxAntO7Eg#;Iu3k6{?FZ~yVdyb z{U=Wz@_*jTug7#t<53u6GUH5==E}D2$l?6>Yc#{}kZ0<$id#34(`0ngL+Q5Rk8{COf<1#HG<3uL7mRFGk^!(`0w%S*8lEWzYI-$ z2b@H$x&F`I^QZeSYW07fKjeSAmtPP4-y{UEGRR-J8_R#opV*Kz8@%xq`kACtGJ{+l zb}s^gTZvS%D=(bM2})vA0G1?Dr9?UGtog~Qc^=$Vw4Qer*MKrG;9Mb^8w~&L99r96^ zhNb0}T;q6hK_^tN-YWxJ8O|cz(N?)DF0KS>-IS>a9G`-%awm&CK5ZYEEGAnG9qtA( z%!ek(Iq5bCgC_2_^RTtbNv|vhOYyp0A>753PX&>Lb%z%%MSiOe$k(O6r+M!cmMT-& z5X)RfIpbOcE;Wr&Q9HBJNW$x~bT!6-Ho^Y!{IHh!uQcmT?w{H;3KBY_m1$M4$K;{A zPVq2GGY{8-mctokrPj51+B8R_G_&dbS|Iv~(5kc)8lew;z<~?>tclDh&0gsSuW6Fd zhzr9_!7~;^>br4oeHx`%m@%qksCYQb!BrKi-^;DVG;g6@bII)a)4p6bL+*H7B=egE zP2F9@-ipoX=C?U&>p3{4@oMs8zHJsE5AJ%T$O7yZB-03(`}JI{E=C4UAxR?*tWk)H zem2Tcjp|#7QqJx|nu2lBAFB~iWzFbRYZPU*EtG51ye>@8(+@fX80Qv8+IcK)iv zZRoRBxK1%#X=(EpFpH7JDae=z!lLeN>IL2Q6Bhy4!}C*{T(5nhU{e?!o}VJirD_f& zXz)E{v6Z)jioaY11x=e^z&=k6#(oowvwDdF1EZ+&T`o7!03#pArh*5xrIZKl>F>{@ zGR(OkW2hYO1{S5p%~#Pgc}9^{%S)gk!QF36@a;oUIEo@JR`wM% zM*q7!VaJ(XXW3|e$|k391H(Q(c}F71ykx!^7z+J_es-rr_v{sP?4aSY`ZjuOa?BsR z%z0GVY&SR2KYld3C8l*{TjYH;ErsGKPxxg1J((MOTEx6hxl|0#$gMn)n4}4xo6}wv znj{5zLWvNwI20sJXoRIFUu^}9b6CZV2+U&SAb>nfv40;)WQ^%0FlWf%w%3!oB!4B6 zSGS3MMRQn9&st=hTs=jn>xmt`<$-xOZ528hp5ER z{q?Y-nTGcPj3aa0ZD}D3{CjtYf6ZFiWI9=(=_;;Aks2ufXQ=zw>4lRn@rTp@)o{{{=28XPV8;HgZp2pF|Jm% z?02_DtLT(kQg^9Mnc^k^Z{Z~E+fw7pEb#8gTWpqwPrVEF@B3@m|9y3ObaHlivOXN$ z`@j3o_nuVl|L;BBec1oKpC4NEJ4|sjCFm862$N)^qooUT+aK<3qyK|hhQ%E1@9sWr z{b;IGda$!|b8|DqfM&?WWG6AG6^1l^v#YnD0`&yp2%tDBSd4IzSTJyR+q|Mg8q_uzZX01iyvR5-ns4jg z=%*&tSHx#C&Rn>jX=tn?z%dAi=o>CfncYmJToPGuH6L&{MuCMAKvyK%q+8}wenZ4I zim4!xLXec*{2Qu-L^zW~x3f^pE8u|eqp|rI$t;>$!nV=PltA}Kb3;7_*gj`&sFo%! z&?co@W_aY3rW(?ij@2BcL_`|&=Cj=|pq%@R3t}1X0A)%l%wjzTa*Bm^8Vp3bg+_#t zF^wor%FsPJiy{9z&jPf`1^i0{TmGnH20Xc@ai(Dj>i$j2%nMnY{ zQWLdHILr+o{GcjnDFkN=lSgP~N&(=v5XHu0y`(S+dE5XSpGLnPWeU7E2<|5_l&Iii zb)&^Ak0*}FHYx=QTQH`)RZj37$kzBo5_cqqJwOUb1+ZN!Eqt=4h#0=SBa&v(Yk}k!r3W%u* zL*JQl8e0Vyj)|bxSkY^OG(%)il>m*SnFqG_7LwtCBRs#bpr>N2acJomd}ef&Mg_wK zHL)O{R-p_?44HIsf&{syFqB$~8CQ0mAd=t_7w#`E+%WsI$pX_>4(?I{_c6Me@&qOY za#tlA#=NeNot_$(rvEmovd?nQWCk-!lN)#rj1gppX+A$miUmlD<_mOVMg&RbD52~v zFm6N{$O*$UvgHOH(#nr<1V&=pvynMdYeYf06h1CS{Ya~FYvUV7ygCQ+DeK|O8R)Kk zSX-LYp@Egg1Z3DIBa``Yso@QL#YHRe+uo#5TI+L$lf@sU4qKWeN-`kN zP6a>&dc5XVxKRdk*J&+$M@4I8K(FO}M5Z_yBR+0-Uiw*k6y$vh^2mK{?{l@x#|VzR z1!pwc)}t`O3CPin(BCm|J~C#xkMu0?nNA8uX+9}gOcvn3-0n0*x$g3DaOTm3W|-=A zHIzz_+rG)lT_Kb8SNbZPN|_ODLL#t{wuKpfZTXD1lKWad)3-e}Qj!9X+nR4Nl~E?a z$^*t3=u7KH{sbDYFiqs0V?w#FP97u9WJ;rqXEK?i85VCzoGT^m9XXeaNIGGl`zeDl z0>(B zl;pRJFqLSu5f>>p=2|n=-LlwdlOwyoE>(cA#>xtr@vMj|3578GXZSWq@`D;h$b?ei!8 zrrbg}feM*+0XQ2`mV5Q^S@i?gA+y4@)>d)r{4)G6AahSVh zmTJ9X%Vyg~j<~5_$a9NaUN##O-lEC2i=_}Sq!6tcA!d}vJW2SCvF}cI9c<+5sx8yg zOe!cE3FMjeh9D75smapqxxV@8Q2%Nj#b6(*D~bOEGwN`TJe+3Zrf{Y8I!dqK&8Cjf zA|&{XGA$=&^(Z~`kjlh~w1%md?h{}JF>uP5BM-A63RAZ2{AOE70AF(%q?+V-3Y5K&c3H`_O}1<^oHRi&0aH={ir3?MG%;LxT-=x#!J z2$*p~6^09055C&bGSlKMt+ev-w+lZ#)WO-CtJ9;C0KuV{=C_`976&pnX5G)9U7iYP zm?<^R!gzV0+|m;xL2wLf%tGi$BU{}?1)u#^sexuN9f2-v_u;DtrkTTyd<9{{3MB+f zy`1uQ>Fp=QY=w$a^1zXa9gPLA3l5c}N_NulpT06L37J2y%NtN81E|$A+GI`&3s{HG z#de*`*!g^m@maNDqo5-EyeUOxQNu zmozSk4y>mz(?|)6vzc>SOA_N0i&_7<;jHR3V6azmp>Z<7ZWS7tYK=-{RrxcFX*;)Q zWKprI0Jjx3>x~0Y+4%B?LIbh=@JZ$Z#dHk$LOd_G!GkZh_8N|i3>fdMh>shn*)FDy zOQPSr6!CZG@~H&yG-_`*uOOgyT2->bxz`=>nQ^7H9F?|Z@|8+uB~TiWXRz3@Cjn-y zT6lqSh<;!RkrD=tyh{@rQN8>Hh~5E7zP~ZAdXe5{mbZ=7x^-1}`Wj<(BgeRUBY*dK znWdR^vw%!bU z&X0~cF=ZaW<@Qd5G~?}onsHy;F$SIy>3K9#F9^jog_K9|Cl|=duxads)=|7&>^j+H zs=E^dG9d_-9O7HdkV3#M7IUD6G87XT2|BVvkuN&vgx2?G-E4B>X01Vk2{4>`F+|5y z!qSNd-RdVSG+*ZVB*;k}&CLQ9R^EDvRj2_NMOeHPyI|YJfZ4e(3sN^VtprEY>Jrs& zO_eMU?v^Ryj)KEWbb1+}uMaOzFCBA#I=%Yt%@0@Tr^Abj!?UZ?lS}mG!atUO^9?#Y z`#bvn^z3*W5o%6=-$5mzq9+veO6+Zu7BdL;NwL#Yb97@^MM-5I6$cAfr&q5|w$a&} zv%%@vHy5X8-=4faIlJ0MuTL(HzB@d-I{f|Jy*fL&G~ok>7RLGE#ntK2 z53dd{(D@G+=Wi}gjI}kVg$YUYT1}>$NeZV9a57_7g=KNUX)1UssCLhx!()`eUMa|5 zp>e(aQnTAAWj2Ggic{BAf@YUIqWLn}D0O?z3cIoXL2G?6Yh>>)L-Z#to%KoJ}OHS>#2Hp(IzYsc0cC1?l6?CDaRIG|2LM^mg>L*gu%Isizdez@C*z7zLcU0+aC)^0^g!A}@CjQ>xTO<`vQ#>Kt;1gt;@G+)I zCX6-0$v9($a|1@OArd6wvzZoNpC1M>kz3m!hfp`VvJq!tEo(nWbdTFyN;Lxac25w6MfG4at3Odn^K*xc0GDq=gy?Z1VecyOAx6Vep%}7>=vYHGPmIie(0Wl2c+EOXGsX5tDYZh+c1jqZh~{GIZcQ#vCL*Q zw_U8{$CM-P{QiXjQxF^H$PBw0X?gpYwPD zZ;m?Pf7(K@T8Cw-oboJ*wTqwAVOIy9+4jz6A!2;a6n>WWr~FS{;!hWCc!09VJqK7(h-^5~CDSePdZU`Lw|=noNQv z&Cla4=iIq#zCBZHa$pfn>9y08#bKi6+Q~KS(4M^0sz{qE6V?DNt$f7Za;Ypi+kPx4 z+SCp5aLcX#)F9kaMC$-!x$Mrl^WZ77D^SpixiID4jkn z!=4BG!(I5Kk8|GUcGz&U4S$2O#4kr4m8Ax4&i5@nZ|8FZ+b#(yk>KQ8+M7Bk!EBP@ z2|*KnO$4h3_1TS*!c~{`ehnWY`hO?ChWP)Blf&cJC&O91E*zcl|9iW;&tBBx|DQa4 zsQ+~@zenghlFU#-M*^EXVCdM1gssOVH#QzULRX;n__)~p-uO^|h(2t57z_pk{Q{8BeTKj$}(-clBa1d3PwviYd#@mA%F2~i zG*>?O@*4;4J35)7LoXjw4PyB&m=Cf1rpn#oCYb+C@zhc9eKsQKVuYiX9#u1UML3Lz zuntLyp6-?opDB8Vj{OrP^n;)^#71bt(os{G3F@P4Yg0j16v(+WRaM%M)yl7g37^PN zyDcGkrvz?5zVMss$h3Z^mqqY#FD!ZMN@u^d2WaRBE?+<{@V5TC!?w^|)CjeQ+km{O zSq1BNN~N+5O(tk4Bi(@p;Kj=pMnQ6L{YTT+#mmmGwIJHex5Aa@4x+{_Z^MML>|OYl2u2!(Y0)j|EjGOVU;C^8me8D=t1dDDcw-7%b2EhaP`G_#q)-yj z{!7YAFPLkjbxq_gPfuGznwZBrI;YYG)zJU{|xW;o0w# z+E!}UXT9N9p-Rdo2`Sq8fU55rICL)fjHoHeB)Z5FQs+;aHwcAp(9DwdR#kedExVv} zd~3>|g)$O2C873rc&4=Aau&D2?EJ>@=8VS#xs2cSjb5gRU^uZ$O~zvqy0qhYDzei4 zZ=VmU{VcWep_N`#zfwFQqCRcB$M%b`sQr-eEDpH{r}L4ZvD-WQW%JR(HdXAEj(S-8 z@TIAFjatm+h6ClEb~mU&xuHoM=}FZFrKv#;$}FEkt#F!~)F6!o9Otyt)6}2_#oD?y z81>h6?&eW3rP0V3XdaxA-Uyqhl&XW};`l&f*EFZ$G8+D2y?gaVAM=aawwj!xWU8 z-K<7OAhoaSTd3tX4%|gv@8)%$8L9@fv7TP3?7WX?aqFtiTcW=GLPX7<^}^_?<1WPE z8uo(PQW0_?l9um!;cTpRxDaFGS5FL<|$^gQm;pW!g$3hs;RzofatVxq~lCGEq`7ScZ< zYacyA^?02M!@FZ}Ha5^<982`8m8${H6qgZBh!~bj4VeSv(hw zzQiR_$Tf7=j*qPD9u_#zhPfZ7|373n!R8jKr5ZlV!SJyMJms-OF_dr0Cxr$|*<^@% zjb}G!Y%#xIH!Pd|7^Mn}%W+7CrRck>tMl;u;>~~keH;FLY5ss<=d(BV55lgg;0$7_ zud#qTH?mSIa0A68C0b@VLqD4efs!ai*+lj&^PayQxWtWQU^CKJE4chx# z{|m-dMSn@5*L<&;(+ca$0b8CHF{QPFIgx?Zy-q@?L{mDMCi6mtY@2-X|NGznlYbmA z9`x#YTUPNo-11zv3ivy5{nCG(arZ}sCq+P-#}6_~)!clrZFA>PZJLP73ozlxRX0Rf zqA}J?sqvt9lJqr=eFi{6oy2{Qm~v4xe9Xp0*3 zBv8OuR8y^@Oi+6n)I?X92#vgBaHq6TZOFu4$UY2jqsceeDOOWGe_f-(ZhM`t#X2^3 zeqq$&#s+$}`AivRBs6k$%&(P6_MRCXe8Z>to^;@&- zT4r?mA-tE7YY2k&I;t1N#x*o+Y}ltrq`MSqKCroCOl0k9qufBnJq>zujJD?+nrLeS z|7WYTO3~kUw!{L!1B0>@Kfa;$sWt4Z@Yytl_Gv1}n7&&te^~dIXkskg9`dATG@<4}8I(dtgc<8w$$iLd~n374Y}cy@#)S z6Px>1ceJ^c2h=-K+dJn1|C>8W$7swm7BAgf2ln&pwSViOxzmtn&NS;V#ckd9;eXz} z?;iRFF03LAO$a|JTfBMiUv6ocBL3ACpHKEvlXbyVT`@r2RwCSm9~*}NjtopIW5Vn< z!BVrzr{pdcH|3i+ZR}WdrDkIT=?`DiiLGU`w>R9|AMWq&?;fBFGUL}a1H+UgDKUA2 z;TVA`i82Yvdhl4e6jNGys6v96vMLumdV9$e>aQs^O~oLay(S<`A{&NvO_Dj_FnM`R zRzd+$M3hL+H!xjTZd4XA#FKUN0OY*b7U|FD>P@1J&zT2RV%Nil>IJ8TEFh7|n1oFG zq7sT(Uo*Gj@)CeRqWIZ05jHm{rcB+69aW+|R($mmJstjaxcA}?T%M*bpwdmSW~L|h zombh^UD7wNmSKkZqEFs;b*W(Q@xef!lr&V>pTXY^Vos5kc&+*bAWfw<5KB- z4aeo{%hIKI+K;+|+k3mayYQcNv-tyE_J z>*&2pXnWu8nCrK^CF^m10oy(2a{=?yB$H@H8J$51MVs_3UpU(8n#sJ#MR$?YV-5*y z<~cpmxkbKIn8jGcOO4wtx$~)KjNn|YWp3=QRoFFIpNKX7-RIRfBT1yi52b>`Der{= zdTd~>gHJwO=Qd@Bh8_# ziBko@TTIgKJOFFzuL)=>)ECsKbm-Q^jqZ-zfE^S3)*M2u+;LqYBYG*DV-m0-A#{Phuhh^w>*dbVs6LXZQf2ZvbiKZNciA7O19Cs&KG9JyOH8 zFB&6ge9sf!;OsMs?Y;7*cOL!w)xAyiA_5o!TLdX}Y=F!VmDRwJ$Iwm3&aK*1sCK#c z@Og8;XfS{V{bqg@b0drImy_+h>CCj{^DO>nCKa*`?3FXck@*lR&x&iDpru*VNr1;X z`)2Koy8`@q$0$PBx4me_R1Kxv4MUxw@4v?%e_bL{Sejmj7osuwt~B`;RDd) ze8a`tgyUG+d*a9>OvnMRi%AaVHsTCU^a7XaDnLOoVFDDm{hh$1^9WFY*?hp@qEF!R zbp>TFpBl>P90nlWoWZUp3nmn-JIZJ+Vp(JOaujWks+|2PS2>z50;sY-??4LXz?& z=gS)I;?&$rqPW0aG)7SvqaMpXsJqdK+_>eN8yDB2C@WeDMzOVXq1j1e-|aK3!$^8P zBH=DSm4Lx8`X-``rG|*|!}9GSOY*5=oHNQO!~oHW8^Co*+(wiO8cwJiSd;VUVE+KS zPMsl!efWVX*tOk90zOP(Aujp|hADVRs0me6i2fL~LHo#M~#Z~w=$ z?0_VJAQDZ9y$2}-C+2K%4N<~$y+ptx=m;>*U^crWrUG^2=h23}J>}EFc?`)%CbFZa zE1w!UCPl>?UO?E15eEoCj4PJYtumIfQa|vLMYz&&U9qI%XcN1qIJ#(*A&K;+6nhE9 zv>RIephTB3L13l+pubg7y@2|nPPM=gCOQM2zHiia(kUf7IF*Vvx5uL9VLKZaHE+pM z@(4`{T;EB+RZwy?Z zO;_b|waf(@8}6(eK7gh_2bt@+|9jx+KHY3q zIUt{gR3c}@xCTfn_QWbCA_1ueDKTwN6`ilR3a6Z!cfYux_8&xan}23Ic{-rc-HSh1 z*!BF@1amsC0oBv_f3LSRzIAA@n;rkYsRS^mMC;itbzsXVznla9)dnh`ok?G zKtM*WOjT3=QNDOY>mWCn+A^fE&kp3pTX{yV+-d^M3}R=u>359|*I_#uqZk;h@L2ny z5h&h0UFqYKZ{|3n@}!f*Fb;Wl!Wcjpcc+deCHgCN-%%6bK*2*X)ydCB-Q`WO(1Fvi zcUsbG(Qv(qgP-g^O4nxghDL9NpX") }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- Kind name portion - - -### helm_lib_get_api_version_by_kind - - returns current apiVersion string, based on available helm capabilities, for the provided kind (not all kinds are supported) - -#### Usage - -`{{ include "helm_lib_get_api_version_by_kind" (list . "") }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- Kind name portion - -## Enable Ds Eviction - -### helm_lib_prevent_ds_eviction_annotation - - Adds `cluster-autoscaler.kubernetes.io/enable-ds-eviction` annotation to manage DaemonSet eviction by the Cluster Autoscaler. - This is important to prevent the eviction of DaemonSet pods during cluster scaling. - -#### Usage - -`{{ include "helm_lib_prevent_ds_eviction_annotation" . }} ` - - -## Envs For Proxy - -### helm_lib_envs_for_proxy - - Add HTTP_PROXY, HTTPS_PROXY and NO_PROXY environment variables for container - depends on [proxy settings](https://deckhouse.io/documentation/v1/deckhouse-configure-global.html#parameters-modules-proxy) - -#### Usage - -`{{ include "helm_lib_envs_for_proxy" . }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - -## High Availability - -### helm_lib_is_ha_to_value - - returns value "yes" if cluster is highly available, else — returns "no" - -#### Usage - -`{{ include "helm_lib_is_ha_to_value" (list . yes no) }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- Yes value -- No value - - -### helm_lib_ha_enabled - - returns empty value, which is treated by go template as false - -#### Usage - -`{{- if (include "helm_lib_ha_enabled" .) }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - -## Kube Rbac Proxy - -### helm_lib_kube_rbac_proxy_ca_certificate - - Renders configmap with kube-rbac-proxy CA certificate which uses to verify the kube-rbac-proxy clients. - -#### Usage - -`{{ include "helm_lib_kube_rbac_proxy_ca_certificate" (list . "namespace") }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- Namespace where CA configmap will be created - -## Module Documentation Uri - -### helm_lib_module_documentation_uri - - returns rendered documentation uri using publicDomainTemplate or deckhouse.io domains - -#### Usage - -`{{ include "helm_lib_module_documentation_uri" (list . "") }} ` - - -## Module Ephemeral Storage - -### helm_lib_module_ephemeral_storage_logs_with_extra - - 50Mi for container logs `log-opts.max-file * log-opts.max-size` would be added to passed value - returns ephemeral-storage size for logs with extra space - -#### Usage - -`{{ include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 }} ` - -#### Arguments - -- Extra space in mebibytes - - -### helm_lib_module_ephemeral_storage_only_logs - - 50Mi for container logs `log-opts.max-file * log-opts.max-size` would be requested - returns ephemeral-storage size for only logs - -#### Usage - -`{{ include "helm_lib_module_ephemeral_storage_only_logs" . }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - -## Module Generate Common Name - -### helm_lib_module_generate_common_name - - returns the commonName parameter for use in the Certificate custom resource(cert-manager) - -#### Usage - -`{{ include "helm_lib_module_generate_common_name" (list . "") }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- Name portion - -## Module Https - -### helm_lib_module_uri_scheme - - return module uri scheme "http" or "https" - -#### Usage - -`{{ include "helm_lib_module_uri_scheme" . }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - - -### helm_lib_module_https_mode - - returns https mode for module - -#### Usage - -`{{ if (include "helm_lib_module_https_mode" .) }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - - -### helm_lib_module_https_cert_manager_cluster_issuer_name - - returns cluster issuer name - -#### Usage - -`{{ include "helm_lib_module_https_cert_manager_cluster_issuer_name" . }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - - -### helm_lib_module_https_ingress_tls_enabled - - returns not empty string if tls should enable for ingress - -#### Usage - -`{{ if (include "helm_lib_module_https_ingress_tls_enabled" .) }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - - -### helm_lib_module_https_copy_custom_certificate - - Renders secret with [custom certificate](https://deckhouse.io/documentation/v1/deckhouse-configure-global.html#parameters-modules-https-customcertificate) - in passed namespace with passed prefix - -#### Usage - -`{{ include "helm_lib_module_https_copy_custom_certificate" (list . "namespace" "secret_name_prefix") }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- Namespace -- Secret name prefix - - -### helm_lib_module_https_secret_name - - returns custom certificate name - -#### Usage - -`{{ include "helm_lib_module_https_secret_name (list . "secret_name_prefix") }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- Secret name prefix - -## Module Image - -### helm_lib_module_image - - returns image name - -#### Usage - -`{{ include "helm_lib_module_image" (list . "") }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- Container name - - -### helm_lib_module_image_no_fail - - returns image name if found - -#### Usage - -`{{ include "helm_lib_module_image_no_fail" (list . "") }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- Container name - - -### helm_lib_module_common_image - - returns image name from common module - -#### Usage - -`{{ include "helm_lib_module_common_image" (list . "") }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- Container name - - -### helm_lib_module_common_image_no_fail - - returns image name from common module if found - -#### Usage - -`{{ include "helm_lib_module_common_image_no_fail" (list . "") }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- Container name - -## Module Ingress Class - -### helm_lib_module_ingress_class - - returns ingress class from module settings or if not exists from global config - -#### Usage - -`{{ include "helm_lib_module_ingress_class" . }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - -## Module Init Container - -### helm_lib_module_init_container_chown_nobody_volume - - ### Migration 11.12.2020: Remove this helper with all its usages after this commit reached RockSolid - returns initContainer which chowns recursively all files and directories in passed volume - -#### Usage - -`{{ include "helm_lib_module_init_container_chown_nobody_volume" (list . "volume-name") }} ` - - - -### helm_lib_module_init_container_chown_deckhouse_volume - - returns initContainer which chowns recursively all files and directories in passed volume - -#### Usage - -`{{ include "helm_lib_module_init_container_chown_deckhouse_volume" (list . "volume-name") }} ` - - - -### helm_lib_module_init_container_check_linux_kernel - - returns initContainer which checks the kernel version on the node for compliance to semver constraint - -#### Usage - -`{{ include "helm_lib_module_init_container_check_linux_kernel" (list . ">= 4.9.17") }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- Semver constraint - -## Module Labels - -### helm_lib_module_labels - - returns deckhouse labels - -#### Usage - -`{{ include "helm_lib_module_labels" (list . (dict "app" "test" "component" "testing")) }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- Additional labels dict - -## Module Public Domain - -### helm_lib_module_public_domain - - returns rendered publicDomainTemplate to service fqdn - -#### Usage - -`{{ include "helm_lib_module_public_domain" (list . "") }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- Name portion - -## Module Security Context - -### helm_lib_module_pod_security_context_run_as_user_custom - - returns PodSecurityContext parameters for Pod with custom user and group - -#### Usage - -`{{ include "helm_lib_module_pod_security_context_run_as_user_custom" (list . 1000 1000) }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- User id -- Group id - - -### helm_lib_module_pod_security_context_run_as_user_nobody - - returns PodSecurityContext parameters for Pod with user and group "nobody" - -#### Usage - -`{{ include "helm_lib_module_pod_security_context_run_as_user_nobody" . }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - - -### helm_lib_module_pod_security_context_run_as_user_nobody_with_writable_fs - - returns PodSecurityContext parameters for Pod with user and group "nobody" with write access to mounted volumes - -#### Usage - -`{{ include "helm_lib_module_pod_security_context_run_as_user_nobody_with_writable_fs" . }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - - -### helm_lib_module_pod_security_context_run_as_user_deckhouse - - returns PodSecurityContext parameters for Pod with user and group "deckhouse" - -#### Usage - -`{{ include "helm_lib_module_pod_security_context_run_as_user_deckhouse" . }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - - -### helm_lib_module_pod_security_context_run_as_user_deckhouse_with_writable_fs - - returns PodSecurityContext parameters for Pod with user and group "deckhouse" with write access to mounted volumes - -#### Usage - -`{{ include "helm_lib_module_pod_security_context_run_as_user_deckhouse_with_writable_fs" . }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - - -### helm_lib_module_container_security_context_run_as_user_deckhouse_pss_restricted - - returns SecurityContext parameters for Container with user and group "deckhouse" plus minimal required settings to comply with the Restricted mode of the Pod Security Standards - -#### Usage - -`{{ include "helm_lib_module_container_security_context_run_as_user_deckhouse_pss_restricted" . }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - - -### helm_lib_module_pod_security_context_run_as_user_root - - returns PodSecurityContext parameters for Pod with user and group 0 - -#### Usage - -`{{ include "helm_lib_module_pod_security_context_run_as_user_root" . }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - - -### helm_lib_module_pod_security_context_runtime_default - - returns PodSecurityContext parameters for Pod with seccomp profile RuntimeDefault - -#### Usage - -`{{ include "helm_lib_module_pod_security_context_runtime_default" . }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - - -### helm_lib_module_container_security_context_not_allow_privilege_escalation - - returns SecurityContext parameters for Container with allowPrivilegeEscalation false - -#### Usage - -`{{ include "helm_lib_module_container_security_context_not_allow_privilege_escalation" . }} ` - - - -### helm_lib_module_container_security_context_read_only_root_filesystem_with_selinux - - returns SecurityContext parameters for Container with read only root filesystem and options for SELinux compatibility - -#### Usage - -`{{ include "helm_lib_module_container_security_context_read_only_root_filesystem_with_selinux" . }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - - -### helm_lib_module_container_security_context_read_only_root_filesystem - - returns SecurityContext parameters for Container with read only root filesystem - -#### Usage - -`{{ include "helm_lib_module_container_security_context_read_only_root_filesystem" . }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - - -### helm_lib_module_container_security_context_privileged - - returns SecurityContext parameters for Container running privileged - -#### Usage - -`{{ include "helm_lib_module_container_security_context_privileged" . }} ` - - - -### helm_lib_module_container_security_context_escalated_sys_admin_privileged - - returns SecurityContext parameters for Container running privileged with escalation and sys_admin - -#### Usage - -`{{ include "helm_lib_module_container_security_context_escalated_sys_admin_privileged" . }} ` - - - -### helm_lib_module_container_security_context_privileged_read_only_root_filesystem - - returns SecurityContext parameters for Container running privileged with read only root filesystem - -#### Usage - -`{{ include "helm_lib_module_container_security_context_privileged_read_only_root_filesystem" . }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - - -### helm_lib_module_container_security_context_read_only_root_filesystem_capabilities_drop_all - - returns SecurityContext for Container with read only root filesystem and all capabilities dropped - -#### Usage - -`{{ include "helm_lib_module_container_security_context_read_only_root_filesystem_capabilities_drop_all" . }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - - -### helm_lib_module_container_security_context_read_only_root_filesystem_capabilities_drop_all_and_add - - returns SecurityContext parameters for Container with read only root filesystem, all dropped and some added capabilities - -#### Usage - -`{{ include "helm_lib_module_container_security_context_read_only_root_filesystem_capabilities_drop_all_and_add" (list . (list "KILL" "SYS_PTRACE")) }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- List of capabilities - - -### helm_lib_module_container_security_context_capabilities_drop_all_and_add - - returns SecurityContext parameters for Container with all dropped and some added capabilities - -#### Usage - -`{{ include "helm_lib_module_container_security_context_capabilities_drop_all_and_add" (list . (list "KILL" "SYS_PTRACE")) }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- List of capabilities - - -### helm_lib_module_container_security_context_capabilities_drop_all_and_run_as_user_custom - - returns SecurityContext parameters for Container with read only root filesystem, all dropped, and custom user ID - -#### Usage - -`{{ include "helm_lib_module_container_security_context_capabilities_drop_all_and_run_as_user_custom" (list . 1000 1000) }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- User id -- Group id - -## Module Storage Class - -### helm_lib_module_storage_class_annotations - - return module StorageClass annotations - -#### Usage - -`{{ include "helm_lib_module_storage_class_annotations" (list $ $index $storageClass.name) }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- Storage class index -- Storage class name - -## Monitoring Grafana Dashboards - -### helm_lib_grafana_dashboard_definitions_recursion - - returns all the dashboard-definintions from / - current dir is optional — used for recursion but you can use it for partially generating dashboards - -#### Usage - -`{{ include "helm_lib_grafana_dashboard_definitions_recursion" (list . [current dir]) }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- Dashboards root dir -- Dashboards current dir - - -### helm_lib_grafana_dashboard_definitions - - returns dashboard-definintions from monitoring/grafana-dashboards/ - -#### Usage - -`{{ include "helm_lib_grafana_dashboard_definitions" . }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - - -### helm_lib_single_dashboard - - renders a single dashboard - -#### Usage - -`{{ include "helm_lib_single_dashboard" (list . "dashboard-name" "folder" $dashboard) }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- Dashboard name -- Folder -- Dashboard definition - -## Monitoring Prometheus Rules - -### helm_lib_prometheus_rules_recursion - - returns all the prometheus rules from / - current dir is optional — used for recursion but you can use it for partially generating rules - -#### Usage - -`{{ include "helm_lib_prometheus_rules_recursion" (list . [current dir]) }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- Namespace for creating rules -- Rules root dir -- Current dir (optional) - - -### helm_lib_prometheus_rules - - returns all the prometheus rules from monitoring/prometheus-rules/ - -#### Usage - -`{{ include "helm_lib_prometheus_rules" (list . ) }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- Namespace for creating rules - - -### helm_lib_prometheus_target_scrape_timeout_seconds - - returns adjust timeout value to scrape interval / - -#### Usage - -`{{ include "helm_lib_prometheus_target_scrape_timeout_seconds" (list . ) }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- Target timeout in seconds - -## Node Affinity - -### helm_lib_internal_check_node_selector_strategy - - Verify node selector strategy. - - - -### helm_lib_node_selector - - Returns node selector for workloads depend on strategy. - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- strategy, one of "frontend" "monitoring" "system" "master" "any-node" "wildcard" - - -### helm_lib_tolerations - - Returns tolerations for workloads depend on strategy. - -#### Usage - -`{{ include "helm_lib_tolerations" (tuple . "any-node" "with-uninitialized" "without-storage-problems") }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- base strategy, one of "frontend" "monitoring" "system" any-node" "wildcard" -- list of additional strategies. To add strategy list it with prefix "with-", to remove strategy list it with prefix "without-". - - -### _helm_lib_cloud_or_hybrid_cluster - - Check cluster type. - Returns not empty string if this is cloud or hybrid cluster - - - -### helm_lib_internal_check_tolerations_strategy - - Verify base strategy. - Fails if strategy not in allowed list - - - -### _helm_lib_any_node_tolerations - - Base strategy for any uncordoned node in cluster. - -#### Usage - -`{{ include "helm_lib_tolerations" (tuple . "any-node") }} ` - - - -### _helm_lib_wildcard_tolerations - - Base strategy that tolerates all. - -#### Usage - -`{{ include "helm_lib_tolerations" (tuple . "wildcard") }} ` - - - -### _helm_lib_monitoring_tolerations - - Base strategy that tolerates nodes with "dedicated.deckhouse.io: monitoring" and "dedicated.deckhouse.io: system" taints. - -#### Usage - -`{{ include "helm_lib_tolerations" (tuple . "monitoring") }} ` - - - -### _helm_lib_frontend_tolerations - - Base strategy that tolerates nodes with "dedicated.deckhouse.io: frontend" taints. - -#### Usage - -`{{ include "helm_lib_tolerations" (tuple . "frontend") }} ` - - - -### _helm_lib_system_tolerations - - Base strategy that tolerates nodes with "dedicated.deckhouse.io: system" taints. - -#### Usage - -`{{ include "helm_lib_tolerations" (tuple . "system") }} ` - - - -### _helm_lib_additional_tolerations_uninitialized - - Additional strategy "uninitialized" - used for CNI's and kube-proxy to allow cni components scheduled on node after CCM initialization. - -#### Usage - -`{{ include "helm_lib_tolerations" (tuple . "any-node" "with-uninitialized") }} ` - - - -### _helm_lib_additional_tolerations_node_problems - - Additional strategy "node-problems" - used for shedule critical components on non-ready nodes or nodes under pressure. - -#### Usage - -`{{ include "helm_lib_tolerations" (tuple . "any-node" "with-node-problems") }} ` - - - -### _helm_lib_additional_tolerations_storage_problems - - Additional strategy "storage-problems" - used for shedule critical components on nodes with drbd problems. This additional strategy enabled by default in any base strategy except "wildcard". - -#### Usage - -`{{ include "helm_lib_tolerations" (tuple . "any-node" "without-storage-problems") }} ` - - - -### _helm_lib_additional_tolerations_no_csi - - Additional strategy "no-csi" - used for any node with no CSI: any node, which was initialized by deckhouse, but have no csi-node driver registered on it. - -#### Usage - -`{{ include "helm_lib_tolerations" (tuple . "any-node" "with-no-csi") }} ` - - - -### _helm_lib_additional_tolerations_cloud_provider_uninitialized - - Additional strategy "cloud-provider-uninitialized" - used for any node which is not initialized by CCM. - -#### Usage - -`{{ include "helm_lib_tolerations" (tuple . "any-node" "with-cloud-provider-uninitialized") }} ` - - -## Pod Disruption Budget - -### helm_lib_pdb_daemonset - - Returns PDB max unavailable - -#### Usage - -`{{ include "helm_lib_pdb_daemonset" . }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - -## Priority Class - -### helm_lib_priority_class - - returns priority class if priority-class module enabled, otherwise returns nothing - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- Priority class name - -## Resources Management - -### helm_lib_resources_management_pod_resources - - returns rendered resources section based on configuration if it is - -#### Usage - -`{{ include "helm_lib_resources_management_pod_resources" (list [ephemeral storage requests]) }} ` - -#### Arguments - -list: -- VPA resource configuration [example](https://deckhouse.io/documentation/v1/modules/110-istio/configuration.html#parameters-controlplane-resourcesmanagement) -- Ephemeral storage requests - - -### helm_lib_resources_management_original_pod_resources - - returns rendered resources section based on configuration if it is present - -#### Usage - -`{{ include "helm_lib_resources_management_original_pod_resources" }} ` - -#### Arguments - -- VPA resource configuration [example](https://deckhouse.io/documentation/v1/modules/110-istio/configuration.html#parameters-controlplane-resourcesmanagement) - - -### helm_lib_resources_management_vpa_spec - - returns rendered vpa spec based on configuration and target reference - -#### Usage - -`{{ include "helm_lib_resources_management_vpa_spec" (list ) }} ` - -#### Arguments - -list: -- Target API version -- Target Kind -- Target Name -- Target container name -- VPA resource configuration [example](https://deckhouse.io/documentation/v1/modules/110-istio/configuration.html#parameters-controlplane-resourcesmanagement) - - -### helm_lib_resources_management_cpu_units_to_millicores - - helper for converting cpu units to millicores - -#### Usage - -`{{ include "helm_lib_resources_management_cpu_units_to_millicores" }} ` - - - -### helm_lib_resources_management_memory_units_to_bytes - - helper for converting memory units to bytes - -#### Usage - -`{{ include "helm_lib_resources_management_memory_units_to_bytes" }} ` - - - -### helm_lib_vpa_kube_rbac_proxy_resources - - helper for VPA resources for kube_rbac_proxy - -#### Usage - -`{{ include "helm_lib_vpa_kube_rbac_proxy_resources" . }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - - -### helm_lib_container_kube_rbac_proxy_resources - - helper for container resources for kube_rbac_proxy - -#### Usage - -`{{ include "helm_lib_container_kube_rbac_proxy_resources" . }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - -## Spec For High Availability - -### helm_lib_pod_anti_affinity_for_ha - - returns pod affinity spec - -#### Usage - -`{{ include "helm_lib_pod_anti_affinity_for_ha" (list . (dict "app" "test")) }} ` - -#### Arguments - -list: -- Template context with .Values, .Chart, etc -- Match labels for podAntiAffinity label selector - - -### helm_lib_deployment_on_master_strategy_and_replicas_for_ha - - returns deployment strategy and replicas for ha components running on master nodes - -#### Usage - -`{{ include "helm_lib_deployment_on_master_strategy_and_replicas_for_ha" }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc - - -### helm_lib_deployment_on_master_custom_strategy_and_replicas_for_ha - - returns deployment with custom strategy and replicas for ha components running on master nodes - -#### Usage - -`{{ include "helm_lib_deployment_on_master_custom_strategy_and_replicas_for_ha" (list . (dict "strategy" "strategy_type")) }} ` - - - -### helm_lib_deployment_strategy_and_replicas_for_ha - - returns deployment strategy and replicas for ha components running not on master nodes - -#### Usage - -`{{ include "helm_lib_deployment_strategy_and_replicas_for_ha" }} ` - -#### Arguments - -- Template context with .Values, .Chart, etc diff --git a/charts/helm_lib/templates/_api_version_and_kind.tpl b/charts/helm_lib/templates/_api_version_and_kind.tpl deleted file mode 100644 index 4de8a8a..0000000 --- a/charts/helm_lib/templates/_api_version_and_kind.tpl +++ /dev/null @@ -1,36 +0,0 @@ -{{- /* Usage: {{ include "helm_lib_kind_exists" (list . "") }} */ -}} -{{- /* returns true if the specified resource kind (case-insensitive) is represented in the cluster */ -}} -{{- define "helm_lib_kind_exists" }} - {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $kind_name := index . 1 -}} {{- /* Kind name portion */ -}} - {{- if eq (len $context.Capabilities.APIVersions) 0 -}} - {{- fail "Helm reports no capabilities" -}} - {{- end -}} - {{ range $cap := $context.Capabilities.APIVersions }} - {{- if hasSuffix (lower (printf "/%s" $kind_name)) (lower $cap) }} - found - {{- break }} - {{- end }} - {{- end }} -{{- end -}} - -{{- /* Usage: {{ include "helm_lib_get_api_version_by_kind" (list . "") }} */ -}} -{{- /* returns current apiVersion string, based on available helm capabilities, for the provided kind (not all kinds are supported) */ -}} -{{- define "helm_lib_get_api_version_by_kind" }} - {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $kind_name := index . 1 -}} {{- /* Kind name portion */ -}} - {{- if eq (len $context.Capabilities.APIVersions) 0 -}} - {{- fail "Helm reports no capabilities" -}} - {{- end -}} - {{- if or (eq $kind_name "ValidatingAdmissionPolicy") (eq $kind_name "ValidatingAdmissionPolicyBinding") -}} - {{- if $context.Capabilities.APIVersions.Has "admissionregistration.k8s.io/v1/ValidatingAdmissionPolicy" -}} -admissionregistration.k8s.io/v1 - {{- else if $context.Capabilities.APIVersions.Has "admissionregistration.k8s.io/v1beta1/ValidatingAdmissionPolicy" -}} -admissionregistration.k8s.io/v1beta1 - {{- else -}} -admissionregistration.k8s.io/v1alpha1 - {{- end -}} - {{- else -}} - {{- fail (printf "Kind '%s' isn't supported by the 'helm_lib_get_api_version_by_kind' helper" $kind_name) -}} - {{- end -}} -{{- end -}} diff --git a/charts/helm_lib/templates/_csi_controller.tpl b/charts/helm_lib/templates/_csi_controller.tpl deleted file mode 100644 index 9bc0d8c..0000000 --- a/charts/helm_lib/templates/_csi_controller.tpl +++ /dev/null @@ -1,763 +0,0 @@ -{{- define "attacher_resources" }} -cpu: 10m -memory: 25Mi -{{- end }} - -{{- define "provisioner_resources" }} -cpu: 10m -memory: 25Mi -{{- end }} - -{{- define "resizer_resources" }} -cpu: 10m -memory: 25Mi -{{- end }} - -{{- define "syncer_resources" }} -cpu: 10m -memory: 25Mi -{{- end }} - -{{- define "snapshotter_resources" }} -cpu: 10m -memory: 25Mi -{{- end }} - -{{- define "livenessprobe_resources" }} -cpu: 10m -memory: 25Mi -{{- end }} - -{{- define "controller_resources" }} -cpu: 10m -memory: 50Mi -{{- end }} - -{{- /* Usage: {{ include "helm_lib_csi_controller_manifests" (list . $config) }} */ -}} -{{- define "helm_lib_csi_controller_manifests" }} - {{- $context := index . 0 }} - - {{- $config := index . 1 }} - {{- $fullname := $config.fullname | default "csi-controller" }} - {{- $snapshotterEnabled := dig "snapshotterEnabled" true $config }} - {{- $resizerEnabled := dig "resizerEnabled" true $config }} - {{- $syncerEnabled := dig "syncerEnabled" false $config }} - {{- $topologyEnabled := dig "topologyEnabled" true $config }} - {{- $extraCreateMetadataEnabled := dig "extraCreateMetadataEnabled" false $config }} - {{- $controllerImage := $config.controllerImage | required "$config.controllerImage is required" }} - {{- $provisionerTimeout := $config.provisionerTimeout | default "600s" }} - {{- $attacherTimeout := $config.attacherTimeout | default "600s" }} - {{- $resizerTimeout := $config.resizerTimeout | default "600s" }} - {{- $snapshotterTimeout := $config.snapshotterTimeout | default "600s" }} - {{- $provisionerWorkers := $config.provisionerWorkers | default "10" }} - {{- $attacherWorkers := $config.attacherWorkers | default "10" }} - {{- $resizerWorkers := $config.resizerWorkers | default "10" }} - {{- $snapshotterWorkers := $config.snapshotterWorkers | default "10" }} - {{- $additionalControllerEnvs := $config.additionalControllerEnvs }} - {{- $additionalSyncerEnvs := $config.additionalSyncerEnvs }} - {{- $additionalControllerArgs := $config.additionalControllerArgs }} - {{- $additionalControllerVolumes := $config.additionalControllerVolumes }} - {{- $additionalControllerVolumeMounts := $config.additionalControllerVolumeMounts }} - {{- $additionalContainers := $config.additionalContainers }} - {{- $livenessProbePort := $config.livenessProbePort | default 9808 }} - {{- $initContainerCommand := $config.initContainerCommand }} - {{- $initContainerImage := $config.initContainerImage }} - {{- $initContainerVolumeMounts := $config.initContainerVolumeMounts }} - - {{- $kubernetesSemVer := semver $context.Values.global.discovery.kubernetesVersion }} - - {{- $provisionerImageName := join "" (list "csiExternalProvisioner" $kubernetesSemVer.Major $kubernetesSemVer.Minor) }} - {{- $provisionerImage := include "helm_lib_module_common_image_no_fail" (list $context $provisionerImageName) }} - - {{- $attacherImageName := join "" (list "csiExternalAttacher" $kubernetesSemVer.Major $kubernetesSemVer.Minor) }} - {{- $attacherImage := include "helm_lib_module_common_image_no_fail" (list $context $attacherImageName) }} - - {{- $resizerImageName := join "" (list "csiExternalResizer" $kubernetesSemVer.Major $kubernetesSemVer.Minor) }} - {{- $resizerImage := include "helm_lib_module_common_image_no_fail" (list $context $resizerImageName) }} - - {{- $syncerImageName := join "" (list "csiVsphereSyncer" $kubernetesSemVer.Major $kubernetesSemVer.Minor) }} - {{- $syncerImage := include "helm_lib_module_common_image_no_fail" (list $context $syncerImageName) }} - - {{- $snapshotterImageName := join "" (list "csiExternalSnapshotter" $kubernetesSemVer.Major $kubernetesSemVer.Minor) }} - {{- $snapshotterImage := include "helm_lib_module_common_image_no_fail" (list $context $snapshotterImageName) }} - - {{- $livenessprobeImageName := join "" (list "csiLivenessprobe" $kubernetesSemVer.Major $kubernetesSemVer.Minor) }} - {{- $livenessprobeImage := include "helm_lib_module_common_image_no_fail" (list $context $livenessprobeImageName) }} - - {{- if $provisionerImage }} - {{- if ($context.Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }} ---- -apiVersion: autoscaling.k8s.io/v1 -kind: VerticalPodAutoscaler -metadata: - name: {{ $fullname }} - namespace: d8-{{ $context.Chart.Name }} - {{- include "helm_lib_module_labels" (list $context (dict "app" "csi-controller" "workload-resource-policy.deckhouse.io" "master")) | nindent 2 }} -spec: - targetRef: - apiVersion: "apps/v1" - kind: Deployment - name: {{ $fullname }} - updatePolicy: - updateMode: "Auto" - resourcePolicy: - containerPolicies: - - containerName: "provisioner" - minAllowed: - {{- include "provisioner_resources" $context | nindent 8 }} - maxAllowed: - cpu: 20m - memory: 50Mi - - containerName: "attacher" - minAllowed: - {{- include "attacher_resources" $context | nindent 8 }} - maxAllowed: - cpu: 20m - memory: 50Mi - {{- if $resizerEnabled }} - - containerName: "resizer" - minAllowed: - {{- include "resizer_resources" $context | nindent 8 }} - maxAllowed: - cpu: 20m - memory: 50Mi - {{- end }} - {{- if $syncerEnabled }} - - containerName: "syncer" - minAllowed: - {{- include "syncer_resources" $context | nindent 8 }} - maxAllowed: - cpu: 20m - memory: 50Mi - {{- end }} - {{- if $snapshotterEnabled }} - - containerName: "snapshotter" - minAllowed: - {{- include "snapshotter_resources" $context | nindent 8 }} - maxAllowed: - cpu: 20m - memory: 50Mi - {{- end }} - - containerName: "livenessprobe" - minAllowed: - {{- include "livenessprobe_resources" $context | nindent 8 }} - maxAllowed: - cpu: 20m - memory: 50Mi - - containerName: "controller" - minAllowed: - {{- include "controller_resources" $context | nindent 8 }} - maxAllowed: - cpu: 20m - memory: 100Mi - {{- end }} ---- -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: {{ $fullname }} - namespace: d8-{{ $context.Chart.Name }} - {{- include "helm_lib_module_labels" (list $context (dict "app" "csi-controller")) | nindent 2 }} -spec: - maxUnavailable: 1 - selector: - matchLabels: - app: {{ $fullname }} ---- -kind: Deployment -apiVersion: apps/v1 -metadata: - name: {{ $fullname }} - namespace: d8-{{ $context.Chart.Name }} - {{- include "helm_lib_module_labels" (list $context (dict "app" "csi-controller")) | nindent 2 }} -spec: - replicas: 1 - revisionHistoryLimit: 2 - selector: - matchLabels: - app: {{ $fullname }} - strategy: - type: Recreate - template: - metadata: - labels: - app: {{ $fullname }} - {{- if hasPrefix "cloud-provider-" $context.Chart.Name }} - annotations: - cloud-config-checksum: {{ include (print $context.Template.BasePath "/cloud-controller-manager/secret.yaml") $context | sha256sum }} - {{- end }} - spec: - hostNetwork: true - dnsPolicy: ClusterFirstWithHostNet - imagePullSecrets: - - name: deckhouse-registry - {{- include "helm_lib_priority_class" (tuple $context "system-cluster-critical") | nindent 6 }} - {{- include "helm_lib_node_selector" (tuple $context "master") | nindent 6 }} - {{- include "helm_lib_tolerations" (tuple $context "any-node" "with-uninitialized") | nindent 6 }} -{{- if $context.Values.global.enabledModules | has "csi-nfs" }} - {{- include "helm_lib_module_pod_security_context_runtime_default" . | nindent 6 }} -{{- else }} - {{- include "helm_lib_module_pod_security_context_run_as_user_deckhouse" . | nindent 6 }} -{{- end }} - serviceAccountName: csi - containers: - - name: provisioner - {{- include "helm_lib_module_container_security_context_read_only_root_filesystem" . | nindent 8 }} - image: {{ $provisionerImage | quote }} - args: - - "--timeout={{ $provisionerTimeout }}" - - "--v=5" - - "--csi-address=$(ADDRESS)" - {{- if $topologyEnabled }} - - "--feature-gates=Topology=true" - - "--strict-topology" - {{- else }} - - "--feature-gates=Topology=false" - {{- end }} - - "--default-fstype=ext4" - - "--leader-election=true" - - "--leader-election-namespace=$(NAMESPACE)" - - "--enable-capacity" - - "--capacity-ownerref-level=2" - {{- if $extraCreateMetadataEnabled }} - - "--extra-create-metadata=true" - {{- end }} - - "--worker-threads={{ $provisionerWorkers }}" - env: - - name: ADDRESS - value: /csi/csi.sock - - name: POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - - name: NAMESPACE - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - volumeMounts: - - name: socket-dir - mountPath: /csi - resources: - requests: - {{- include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 | nindent 12 }} - {{- if not ( $context.Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }} - {{- include "provisioner_resources" $context | nindent 12 }} - {{- end }} - - name: attacher - {{- include "helm_lib_module_container_security_context_read_only_root_filesystem" . | nindent 8 }} - image: {{ $attacherImage | quote }} - args: - - "--timeout={{ $attacherTimeout }}" - - "--v=5" - - "--csi-address=$(ADDRESS)" - - "--leader-election=true" - - "--leader-election-namespace=$(NAMESPACE)" - - "--worker-threads={{ $attacherWorkers }}" - env: - - name: ADDRESS - value: /csi/csi.sock - - name: NAMESPACE - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - volumeMounts: - - name: socket-dir - mountPath: /csi - resources: - requests: - {{- include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 | nindent 12 }} - {{- if not ( $context.Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }} - {{- include "attacher_resources" $context | nindent 12 }} - {{- end }} - {{- if $resizerEnabled }} - - name: resizer - {{- include "helm_lib_module_container_security_context_read_only_root_filesystem" . | nindent 8 }} - image: {{ $resizerImage | quote }} - args: - - "--timeout={{ $resizerTimeout }}" - - "--v=5" - - "--csi-address=$(ADDRESS)" - - "--leader-election=true" - - "--leader-election-namespace=$(NAMESPACE)" - - "--workers={{ $resizerWorkers }}" - env: - - name: ADDRESS - value: /csi/csi.sock - - name: NAMESPACE - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - volumeMounts: - - name: socket-dir - mountPath: /csi - resources: - requests: - {{- include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 | nindent 12 }} - {{- if not ( $context.Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }} - {{- include "resizer_resources" $context | nindent 12 }} - {{- end }} - {{- end }} - {{- if $syncerEnabled }} - - name: syncer - {{- include "helm_lib_module_container_security_context_read_only_root_filesystem" . | nindent 8 }} - image: {{ $syncerImage | quote }} - args: - - "--leader-election" - - "--leader-election-lease-duration=30s" - - "--leader-election-renew-deadline=20s" - - "--leader-election-retry-period=10s" - {{- if $additionalControllerArgs }} - {{- $additionalControllerArgs | toYaml | nindent 8 }} - {{- end }} - {{- if $additionalSyncerEnvs }} - env: - {{- $additionalSyncerEnvs | toYaml | nindent 8 }} - {{- end }} - {{- if $additionalControllerVolumeMounts }} - volumeMounts: - {{- $additionalControllerVolumeMounts | toYaml | nindent 8 }} - {{- end }} - resources: - requests: - {{- include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 | nindent 12 }} - {{- if not ( $context.Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }} - {{- include "syncer_resources" $context | nindent 12 }} - {{- end }} - {{- end }} - {{- if $snapshotterEnabled }} - - name: snapshotter - {{- include "helm_lib_module_container_security_context_read_only_root_filesystem" . | nindent 8 }} - image: {{ $snapshotterImage | quote }} - args: - - "--timeout={{ $snapshotterTimeout }}" - - "--v=5" - - "--csi-address=$(ADDRESS)" - - "--leader-election=true" - - "--leader-election-namespace=$(NAMESPACE)" - - "--worker-threads={{ $snapshotterWorkers }}" - env: - - name: ADDRESS - value: /csi/csi.sock - - name: NAMESPACE - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - volumeMounts: - - name: socket-dir - mountPath: /csi - resources: - requests: - {{- include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 | nindent 12 }} - {{- if not ( $context.Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }} - {{- include "snapshotter_resources" $context | nindent 12 }} - {{- end }} - {{- end }} - - name: livenessprobe - {{- include "helm_lib_module_container_security_context_read_only_root_filesystem" . | nindent 8 }} - image: {{ $livenessprobeImage | quote }} - args: - - "--csi-address=$(ADDRESS)" - - "--http-endpoint=$(HOST_IP):{{ $livenessProbePort }}" - env: - - name: ADDRESS - value: /csi/csi.sock - - name: HOST_IP - valueFrom: - fieldRef: - fieldPath: status.hostIP - volumeMounts: - - name: socket-dir - mountPath: /csi - resources: - requests: - {{- include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 | nindent 12 }} - {{- if not ( $context.Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }} - {{- include "livenessprobe_resources" $context | nindent 12 }} - {{- end }} - - name: controller -{{- if $context.Values.global.enabledModules | has "csi-nfs" }} - {{- include "helm_lib_module_container_security_context_escalated_sys_admin_privileged" . | nindent 8 }} -{{- else }} - {{- include "helm_lib_module_container_security_context_read_only_root_filesystem" . | nindent 8 }} -{{- end }} - image: {{ $controllerImage | quote }} - args: - {{- if $additionalControllerArgs }} - {{- $additionalControllerArgs | toYaml | nindent 8 }} - {{- end }} - {{- if $additionalControllerEnvs }} - env: - {{- $additionalControllerEnvs | toYaml | nindent 8 }} - {{- end }} - livenessProbe: - httpGet: - path: /healthz - port: {{ $livenessProbePort }} - volumeMounts: - - name: socket-dir - mountPath: /csi - {{- /* For an unknown reason vSphere csi-controller won't start without `/tmp` directory */ -}} - {{- if eq $context.Chart.Name "cloud-provider-vsphere" }} - - name: tmp - mountPath: /tmp - {{- end }} - {{- if $additionalControllerVolumeMounts }} - {{- $additionalControllerVolumeMounts | toYaml | nindent 8 }} - {{- end }} - resources: - requests: - {{- include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 | nindent 12 }} - {{- if not ( $context.Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }} - {{- include "controller_resources" $context | nindent 12 }} - {{- end }} - {{- if $additionalContainers }} - {{- $additionalContainers | toYaml | nindent 6 }} - {{- end }} - {{- if $initContainerCommand }} - initContainers: - - command: - {{- $initContainerCommand | toYaml | nindent 8 }} - image: {{ $initContainerImage }} - imagePullPolicy: IfNotPresent - name: csi-controller-init-container - {{- if $initContainerVolumeMounts }} - volumeMounts: - {{- $initContainerVolumeMounts | toYaml | nindent 8 }} - {{- end }} - resources: - requests: - {{- include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 | nindent 12 }} - {{- end }} - volumes: - - name: socket-dir - emptyDir: {} - {{- /* For an unknown reason vSphere csi-controller won't start without `/tmp` directory */ -}} - {{- if eq $context.Chart.Name "cloud-provider-vsphere" }} - - name: tmp - emptyDir: {} - {{- end }} - {{- if $additionalControllerVolumes }} - {{- $additionalControllerVolumes | toYaml | nindent 6 }} - {{- end }} - {{- end }} -{{- end }} - - -{{- /* Usage: {{ include "helm_lib_csi_controller_rbac" . }} */ -}} -{{- define "helm_lib_csi_controller_rbac" }} ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: csi - namespace: d8-{{ .Chart.Name }} - {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} - -# =========== -# provisioner -# =========== -# Source https://github.com/kubernetes-csi/external-provisioner/blob/master/deploy/kubernetes/rbac.yaml ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: d8:{{ .Chart.Name }}:csi:controller:external-provisioner - {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} -rules: -- apiGroups: [""] - resources: ["persistentvolumes"] - verbs: ["get", "list", "watch", "create", "delete"] -- apiGroups: [""] - resources: ["persistentvolumeclaims"] - verbs: ["get", "list", "watch", "update"] -- apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "list", "watch"] -- apiGroups: ["storage.k8s.io"] - resources: ["storageclasses"] - verbs: ["get", "list", "watch"] -- apiGroups: [""] - resources: ["events"] - verbs: ["list", "watch", "create", "update", "patch"] -- apiGroups: ["snapshot.storage.k8s.io"] - resources: ["volumesnapshots"] - verbs: ["get", "list"] -- apiGroups: ["snapshot.storage.k8s.io"] - resources: ["volumesnapshotcontents"] - verbs: ["get", "list"] -- apiGroups: ["storage.k8s.io"] - resources: ["csinodes"] - verbs: ["get", "list", "watch"] -- apiGroups: [""] - resources: ["nodes"] - verbs: ["get", "list", "watch"] -# Access to volumeattachments is only needed when the CSI driver -# has the PUBLISH_UNPUBLISH_VOLUME controller capability. -# In that case, external-provisioner will watch volumeattachments -# to determine when it is safe to delete a volume. -- apiGroups: ["storage.k8s.io"] - resources: ["volumeattachments"] - verbs: ["get", "list", "watch"] ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: d8:{{ .Chart.Name }}:csi:controller:external-provisioner - {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} -subjects: -- kind: ServiceAccount - name: csi - namespace: d8-{{ .Chart.Name }} -roleRef: - kind: ClusterRole - name: d8:{{ .Chart.Name }}:csi:controller:external-provisioner - apiGroup: rbac.authorization.k8s.io ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: csi:controller:external-provisioner - namespace: d8-{{ .Chart.Name }} - {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} -rules: -# Only one of the following rules for endpoints or leases is required based on -# what is set for `--leader-election-type`. Endpoints are deprecated in favor of Leases. -- apiGroups: [""] - resources: ["endpoints"] - verbs: ["get", "watch", "list", "delete", "update", "create"] -- apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["get", "watch", "list", "delete", "update", "create"] -# Permissions for CSIStorageCapacity are only needed enabling the publishing -# of storage capacity information. -- apiGroups: ["storage.k8s.io"] - resources: ["csistoragecapacities"] - verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] -# The GET permissions below are needed for walking up the ownership chain -# for CSIStorageCapacity. They are sufficient for deployment via -# StatefulSet (only needs to get Pod) and Deployment (needs to get -# Pod and then ReplicaSet to find the Deployment). -- apiGroups: [""] - resources: ["pods"] - verbs: ["get"] -- apiGroups: ["apps"] - resources: ["replicasets"] - verbs: ["get"] ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: csi:controller:external-provisioner - namespace: d8-{{ .Chart.Name }} - {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} -subjects: -- kind: ServiceAccount - name: csi - namespace: d8-{{ .Chart.Name }} -roleRef: - kind: Role - name: csi:controller:external-provisioner - apiGroup: rbac.authorization.k8s.io - -# ======== -# attacher -# ======== -# Source https://github.com/kubernetes-csi/external-attacher/blob/master/deploy/kubernetes/rbac.yaml ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: d8:{{ .Chart.Name }}:csi:controller:external-attacher - {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} -rules: -- apiGroups: [""] - resources: ["persistentvolumes"] - verbs: ["get", "list", "watch", "update", "patch"] -- apiGroups: ["storage.k8s.io"] - resources: ["csinodes"] - verbs: ["get", "list", "watch"] -- apiGroups: ["storage.k8s.io"] - resources: ["volumeattachments"] - verbs: ["get", "list", "watch", "update", "patch"] -- apiGroups: ["storage.k8s.io"] - resources: ["volumeattachments/status"] - verbs: ["patch"] ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: d8:{{ .Chart.Name }}:csi:controller:external-attacher - {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} -subjects: -- kind: ServiceAccount - name: csi - namespace: d8-{{ .Chart.Name }} -roleRef: - kind: ClusterRole - name: d8:{{ .Chart.Name }}:csi:controller:external-attacher - apiGroup: rbac.authorization.k8s.io ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: csi:controller:external-attacher - namespace: d8-{{ .Chart.Name }} - {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} -rules: -- apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["get", "watch", "list", "delete", "update", "create"] ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: csi:controller:external-attacher - namespace: d8-{{ .Chart.Name }} - {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} -subjects: -- kind: ServiceAccount - name: csi - namespace: d8-{{ .Chart.Name }} -roleRef: - kind: Role - name: csi:controller:external-attacher - apiGroup: rbac.authorization.k8s.io - -# ======= -# resizer -# ======= -# Source https://github.com/kubernetes-csi/external-resizer/blob/master/deploy/kubernetes/rbac.yaml ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: d8:{{ .Chart.Name }}:csi:controller:external-resizer - {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} -rules: -- apiGroups: [""] - resources: ["persistentvolumes"] - verbs: ["get", "list", "watch", "patch"] -- apiGroups: [""] - resources: ["persistentvolumeclaims"] - verbs: ["get", "list", "watch"] -- apiGroups: [""] - resources: ["pods"] - verbs: ["get", "list", "watch"] -- apiGroups: [""] - resources: ["persistentvolumeclaims/status"] - verbs: ["patch"] -- apiGroups: [""] - resources: ["events"] - verbs: ["list", "watch", "create", "update", "patch"] ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: d8:{{ .Chart.Name }}:csi:controller:external-resizer - {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} -subjects: -- kind: ServiceAccount - name: csi - namespace: d8-{{ .Chart.Name }} -roleRef: - kind: ClusterRole - name: d8:{{ .Chart.Name }}:csi:controller:external-resizer - apiGroup: rbac.authorization.k8s.io ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: csi:controller:external-resizer - namespace: d8-{{ .Chart.Name }} - {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} -rules: -- apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["get", "watch", "list", "delete", "update", "create"] ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: csi:controller:external-resizer - namespace: d8-{{ .Chart.Name }} - {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} -subjects: -- kind: ServiceAccount - name: csi - namespace: d8-{{ .Chart.Name }} -roleRef: - kind: Role - name: csi:controller:external-resizer - apiGroup: rbac.authorization.k8s.io -# ======== -# snapshotter -# ======== -# Source https://github.com/kubernetes-csi/external-snapshotter/blob/master/deploy/kubernetes/csi-snapshotter/rbac-csi-snapshotter.yaml ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: d8:{{ .Chart.Name }}:csi:controller:external-snapshotter - {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} -rules: -- apiGroups: [""] - resources: ["events"] - verbs: ["list", "watch", "create", "update", "patch"] -- apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "list"] -- apiGroups: ["snapshot.storage.k8s.io"] - resources: ["volumesnapshotclasses"] - verbs: ["get", "list", "watch"] -- apiGroups: ["snapshot.storage.k8s.io"] - resources: ["volumesnapshotcontents"] - verbs: ["create", "get", "list", "watch", "update", "delete", "patch"] -- apiGroups: ["snapshot.storage.k8s.io"] - resources: ["volumesnapshotcontents/status"] - verbs: ["update", "patch"] ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: d8:{{ .Chart.Name }}:csi:controller:external-snapshotter - {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} -subjects: -- kind: ServiceAccount - name: csi - namespace: d8-{{ .Chart.Name }} -roleRef: - kind: ClusterRole - name: d8:{{ .Chart.Name }}:csi:controller:external-snapshotter - apiGroup: rbac.authorization.k8s.io ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: csi:controller:external-snapshotter - namespace: d8-{{ .Chart.Name }} - {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} -rules: -- apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["get", "watch", "list", "delete", "update", "create"] ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: csi:controller:external-snapshotter - namespace: d8-{{ .Chart.Name }} - {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} -subjects: -- kind: ServiceAccount - name: csi - namespace: d8-{{ .Chart.Name }} -roleRef: - kind: Role - name: csi:controller:external-snapshotter - apiGroup: rbac.authorization.k8s.io -{{- end }} diff --git a/charts/helm_lib/templates/_csi_node.tpl b/charts/helm_lib/templates/_csi_node.tpl deleted file mode 100644 index 254bc40..0000000 --- a/charts/helm_lib/templates/_csi_node.tpl +++ /dev/null @@ -1,206 +0,0 @@ -{{- define "node_driver_registrar_resources" }} -cpu: 12m -memory: 25Mi -{{- end }} - -{{- define "node_resources" }} -cpu: 12m -memory: 25Mi -{{- end }} - -{{- /* Usage: {{ include "helm_lib_csi_node_manifests" (list . $config) }} */ -}} -{{- define "helm_lib_csi_node_manifests" }} - {{- $context := index . 0 }} - - {{- $config := index . 1 }} - {{- $fullname := $config.fullname | default "csi-node" }} - {{- $nodeImage := $config.nodeImage | required "$config.nodeImage is required" }} - {{- $driverFQDN := $config.driverFQDN | required "$config.driverFQDN is required" }} - {{- $serviceAccount := $config.serviceAccount | default "" }} - {{- $additionalNodeEnvs := $config.additionalNodeEnvs }} - {{- $additionalNodeArgs := $config.additionalNodeArgs }} - {{- $additionalNodeVolumes := $config.additionalNodeVolumes }} - {{- $additionalNodeVolumeMounts := $config.additionalNodeVolumeMounts }} - {{- $additionalNodeLivenessProbesCmd := $config.additionalNodeLivenessProbesCmd }} - {{- $initContainerCommand := $config.initContainerCommand }} - {{- $initContainerImage := $config.initContainerImage }} - {{- $initContainerVolumeMounts := $config.initContainerVolumeMounts }} - - {{- $kubernetesSemVer := semver $context.Values.global.discovery.kubernetesVersion }} - {{- $driverRegistrarImageName := join "" (list "csiNodeDriverRegistrar" $kubernetesSemVer.Major $kubernetesSemVer.Minor) }} - {{- $driverRegistrarImage := include "helm_lib_module_common_image_no_fail" (list $context $driverRegistrarImageName) }} - {{- if $driverRegistrarImage }} - {{- if or (include "_helm_lib_cloud_or_hybrid_cluster" $context) ($context.Values.global.enabledModules | has "ceph-csi") ($context.Values.global.enabledModules | has "csi-nfs") ($context.Values.global.enabledModules | has "csi-ceph") ($context.Values.global.enabledModules | has "csi-yadro") }} - {{- if ($context.Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }} ---- -apiVersion: autoscaling.k8s.io/v1 -kind: VerticalPodAutoscaler -metadata: - name: {{ $fullname }} - namespace: d8-{{ $context.Chart.Name }} - {{- include "helm_lib_module_labels" (list $context (dict "app" "csi-node" "workload-resource-policy.deckhouse.io" "every-node")) | nindent 2 }} -spec: - targetRef: - apiVersion: "apps/v1" - kind: DaemonSet - name: {{ $fullname }} - updatePolicy: - updateMode: "Auto" - resourcePolicy: - containerPolicies: - - containerName: "node-driver-registrar" - minAllowed: - {{- include "node_driver_registrar_resources" $context | nindent 8 }} - maxAllowed: - cpu: 25m - memory: 50Mi - - containerName: "node" - minAllowed: - {{- include "node_resources" $context | nindent 8 }} - maxAllowed: - cpu: 25m - memory: 50Mi - {{- end }} ---- -kind: DaemonSet -apiVersion: apps/v1 -metadata: - name: {{ $fullname }} - namespace: d8-{{ $context.Chart.Name }} - {{- include "helm_lib_module_labels" (list $context (dict "app" "csi-node")) | nindent 2 }} -spec: - updateStrategy: - type: RollingUpdate - selector: - matchLabels: - app: {{ $fullname }} - template: - metadata: - labels: - app: {{ $fullname }} - spec: - affinity: - nodeAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - nodeSelectorTerms: - - matchExpressions: - - operator: In - key: node.deckhouse.io/type - values: - - CloudEphemeral - - CloudPermanent - - CloudStatic - {{- if or (eq $fullname "csi-node-rbd") (eq $fullname "csi-node-cephfs") (eq $fullname "csi-nfs") (eq $fullname "csi-yadro") }} - - Static - {{- end }} - imagePullSecrets: - - name: deckhouse-registry - {{- include "helm_lib_priority_class" (tuple $context "system-node-critical") | nindent 6 }} - {{- include "helm_lib_tolerations" (tuple $context "any-node" "with-no-csi") | nindent 6 }} - {{- include "helm_lib_module_pod_security_context_run_as_user_root" . | nindent 6 }} - hostNetwork: true - dnsPolicy: ClusterFirstWithHostNet - containers: - - name: node-driver-registrar - {{- include "helm_lib_module_container_security_context_not_allow_privilege_escalation" $context | nindent 8 }} - image: {{ $driverRegistrarImage | quote }} - args: - - "--v=5" - - "--csi-address=$(CSI_ENDPOINT)" - - "--kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)" - env: - - name: CSI_ENDPOINT - value: "/csi/csi.sock" - - name: DRIVER_REG_SOCK_PATH - value: "/var/lib/kubelet/csi-plugins/{{ $driverFQDN }}/csi.sock" - - name: KUBE_NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName - {{- if $additionalNodeLivenessProbesCmd }} - livenessProbe: - initialDelaySeconds: 3 - exec: - command: - {{- $additionalNodeLivenessProbesCmd | toYaml | nindent 12 }} - {{- end }} - volumeMounts: - - name: plugin-dir - mountPath: /csi - - name: registration-dir - mountPath: /registration - resources: - requests: - {{- include "helm_lib_module_ephemeral_storage_only_logs" 10 | nindent 12 }} - {{- if not ($context.Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }} - {{- include "node_driver_registrar_resources" $context | nindent 12 }} - {{- end }} - - name: node - securityContext: - privileged: true - image: {{ $nodeImage }} - args: - {{- if $additionalNodeArgs }} - {{- $additionalNodeArgs | toYaml | nindent 8 }} - {{- end }} - {{- if $additionalNodeEnvs }} - env: - {{- $additionalNodeEnvs | toYaml | nindent 8 }} - {{- end }} - volumeMounts: - - name: kubelet-dir - mountPath: /var/lib/kubelet - mountPropagation: "Bidirectional" - - name: plugin-dir - mountPath: /csi - - name: device-dir - mountPath: /dev - {{- if $additionalNodeVolumeMounts }} - {{- $additionalNodeVolumeMounts | toYaml | nindent 8 }} - {{- end }} - resources: - requests: - {{- include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 | nindent 12 }} - {{- if not ($context.Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }} - {{- include "node_resources" $context | nindent 12 }} - {{- end }} - {{- if $initContainerCommand }} - initContainers: - - command: - {{- $initContainerCommand | toYaml | nindent 8 }} - image: {{ $initContainerImage }} - imagePullPolicy: IfNotPresent - name: csi-node-init-container - {{- if $initContainerVolumeMounts }} - volumeMounts: - {{- $initContainerVolumeMounts | toYaml | nindent 8 }} - {{- end }} - resources: - requests: - {{- include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 | nindent 12 }} - {{- end }} - serviceAccount: {{ $serviceAccount | quote }} - serviceAccountName: {{ $serviceAccount | quote }} - volumes: - - name: registration-dir - hostPath: - path: /var/lib/kubelet/plugins_registry/ - type: Directory - - name: kubelet-dir - hostPath: - path: /var/lib/kubelet - type: Directory - - name: plugin-dir - hostPath: - path: /var/lib/kubelet/csi-plugins/{{ $driverFQDN }}/ - type: DirectoryOrCreate - - name: device-dir - hostPath: - path: /dev - type: Directory - {{- if $additionalNodeVolumes }} - {{- $additionalNodeVolumes | toYaml | nindent 6 }} - {{- end }} - {{- end }} - {{- end }} -{{- end }} diff --git a/charts/helm_lib/templates/_enable_ds_eviction.tpl b/charts/helm_lib/templates/_enable_ds_eviction.tpl deleted file mode 100644 index b912c05..0000000 --- a/charts/helm_lib/templates/_enable_ds_eviction.tpl +++ /dev/null @@ -1,6 +0,0 @@ -{{- /* Usage: {{ include "helm_lib_prevent_ds_eviction_annotation" . }} */ -}} -{{- /* Adds `cluster-autoscaler.kubernetes.io/enable-ds-eviction` annotation to manage DaemonSet eviction by the Cluster Autoscaler. */ -}} -{{- /* This is important to prevent the eviction of DaemonSet pods during cluster scaling. */ -}} -{{- define "helm_lib_prevent_ds_eviction_annotation" -}} -cluster-autoscaler.kubernetes.io/enable-ds-eviction: "false" -{{- end }} diff --git a/charts/helm_lib/templates/_envs_for_proxy.tpl b/charts/helm_lib/templates/_envs_for_proxy.tpl deleted file mode 100644 index 177bb1c..0000000 --- a/charts/helm_lib/templates/_envs_for_proxy.tpl +++ /dev/null @@ -1,30 +0,0 @@ -{{- /* Usage: {{ include "helm_lib_envs_for_proxy" . }} */ -}} -{{- /* Add HTTP_PROXY, HTTPS_PROXY and NO_PROXY environment variables for container */ -}} -{{- /* depends on [proxy settings](https://deckhouse.io/documentation/v1/deckhouse-configure-global.html#parameters-modules-proxy) */ -}} -{{- define "helm_lib_envs_for_proxy" }} - {{- $context := . -}} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- if $context.Values.global.clusterConfiguration }} - {{- if $context.Values.global.clusterConfiguration.proxy }} - {{- if $context.Values.global.clusterConfiguration.proxy.httpProxy }} -- name: HTTP_PROXY - value: {{ $context.Values.global.clusterConfiguration.proxy.httpProxy | quote }} -- name: http_proxy - value: {{ $context.Values.global.clusterConfiguration.proxy.httpProxy | quote }} - {{- end }} - {{- if $context.Values.global.clusterConfiguration.proxy.httpsProxy }} -- name: HTTPS_PROXY - value: {{ $context.Values.global.clusterConfiguration.proxy.httpsProxy | quote }} -- name: https_proxy - value: {{ $context.Values.global.clusterConfiguration.proxy.httpsProxy | quote }} - {{- end }} - {{- $noProxy := list "127.0.0.1" "169.254.169.254" $context.Values.global.clusterConfiguration.clusterDomain $context.Values.global.clusterConfiguration.podSubnetCIDR $context.Values.global.clusterConfiguration.serviceSubnetCIDR }} - {{- if $context.Values.global.clusterConfiguration.proxy.noProxy }} - {{- $noProxy = concat $noProxy $context.Values.global.clusterConfiguration.proxy.noProxy }} - {{- end }} -- name: NO_PROXY - value: {{ $noProxy | join "," | quote }} -- name: no_proxy - value: {{ $noProxy | join "," | quote }} - {{- end }} - {{- end }} -{{- end }} diff --git a/charts/helm_lib/templates/_high_availability.tpl b/charts/helm_lib/templates/_high_availability.tpl deleted file mode 100644 index 8c7da23..0000000 --- a/charts/helm_lib/templates/_high_availability.tpl +++ /dev/null @@ -1,39 +0,0 @@ -{{- /* Usage: {{ include "helm_lib_is_ha_to_value" (list . yes no) }} */ -}} -{{- /* returns value "yes" if cluster is highly available, else — returns "no" */ -}} -{{- define "helm_lib_is_ha_to_value" }} - {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $yes := index . 1 -}} {{- /* Yes value */ -}} - {{- $no := index . 2 -}} {{- /* No value */ -}} - - {{- $module_values := (index $context.Values (include "helm_lib_module_camelcase_name" $context)) }} - - {{- if hasKey $module_values "highAvailability" -}} - {{- if $module_values.highAvailability -}} {{- $yes -}} {{- else -}} {{- $no -}} {{- end -}} - {{- else if hasKey $context.Values.global "highAvailability" -}} - {{- if $context.Values.global.highAvailability -}} {{- $yes -}} {{- else -}} {{- $no -}} {{- end -}} - {{- else -}} - {{- if $context.Values.global.discovery.clusterControlPlaneIsHighlyAvailable -}} {{- $yes -}} {{- else -}} {{- $no -}} {{- end -}} - {{- end -}} -{{- end }} - -{{- /* Usage: {{- if (include "helm_lib_ha_enabled" .) }} */ -}} -{{- /* returns empty value, which is treated by go template as false */ -}} -{{- define "helm_lib_ha_enabled" }} - {{- $context := . -}} {{- /* Template context with .Values, .Chart, etc */ -}} - - {{- $module_values := (index $context.Values (include "helm_lib_module_camelcase_name" $context)) }} - - {{- if hasKey $module_values "highAvailability" -}} - {{- if $module_values.highAvailability -}} - "not empty string" - {{- end -}} - {{- else if hasKey $context.Values.global "highAvailability" -}} - {{- if $context.Values.global.highAvailability -}} - "not empty string" - {{- end -}} - {{- else -}} - {{- if $context.Values.global.discovery.clusterControlPlaneIsHighlyAvailable -}} - "not empty string" - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/charts/helm_lib/templates/_kube_rbac_proxy.tpl b/charts/helm_lib/templates/_kube_rbac_proxy.tpl deleted file mode 100644 index af9f7a4..0000000 --- a/charts/helm_lib/templates/_kube_rbac_proxy.tpl +++ /dev/null @@ -1,21 +0,0 @@ -{{- /* Usage: {{ include "helm_lib_kube_rbac_proxy_ca_certificate" (list . "namespace") }} */ -}} -{{- /* Renders configmap with kube-rbac-proxy CA certificate which uses to verify the kube-rbac-proxy clients. */ -}} -{{- define "helm_lib_kube_rbac_proxy_ca_certificate" -}} -{{- /* Template context with .Values, .Chart, etc */ -}} -{{- /* Namespace where CA configmap will be created */ -}} - {{- $context := index . 0 }} - {{- $namespace := index . 1 }} ---- -apiVersion: v1 -data: - ca.crt: | - {{ $context.Values.global.internal.modules.kubeRBACProxyCA.cert | nindent 4 }} -kind: ConfigMap -metadata: - annotations: - kubernetes.io/description: | - Contains a CA bundle that can be used to verify the kube-rbac-proxy clients. - {{- include "helm_lib_module_labels" (list $context) | nindent 2 }} - name: kube-rbac-proxy-ca.crt - namespace: {{ $namespace }} -{{- end }} diff --git a/charts/helm_lib/templates/_module_documentation_uri.tpl b/charts/helm_lib/templates/_module_documentation_uri.tpl deleted file mode 100644 index a02cf45..0000000 --- a/charts/helm_lib/templates/_module_documentation_uri.tpl +++ /dev/null @@ -1,15 +0,0 @@ -{{- /* Usage: {{ include "helm_lib_module_documentation_uri" (list . "") }} */ -}} -{{- /* returns rendered documentation uri using publicDomainTemplate or deckhouse.io domains*/ -}} -{{- define "helm_lib_module_documentation_uri" }} - {{- $default_doc_prefix := "https://deckhouse.io/documentation/v1" -}} - {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $path_portion := index . 1 -}} {{- /* Path to the document */ -}} - {{- $uri := "" -}} - {{- if $context.Values.global.modules.publicDomainTemplate }} - {{- $uri = printf "%s://%s%s" (include "helm_lib_module_uri_scheme" $context) (include "helm_lib_module_public_domain" (list $context "documentation")) $path_portion -}} - {{- else }} - {{- $uri = printf "%s%s" $default_doc_prefix $path_portion -}} - {{- end -}} - - {{ $uri }} -{{- end }} diff --git a/charts/helm_lib/templates/_module_ephemeral_storage.tpl b/charts/helm_lib/templates/_module_ephemeral_storage.tpl deleted file mode 100644 index 4b2dd02..0000000 --- a/charts/helm_lib/templates/_module_ephemeral_storage.tpl +++ /dev/null @@ -1,15 +0,0 @@ -{{- /* Usage: {{ include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 }} */ -}} -{{- /* 50Mi for container logs `log-opts.max-file * log-opts.max-size` would be added to passed value */ -}} -{{- /* returns ephemeral-storage size for logs with extra space */ -}} -{{- define "helm_lib_module_ephemeral_storage_logs_with_extra" -}} -{{- /* Extra space in mebibytes */ -}} -ephemeral-storage: {{ add . 50 }}Mi -{{- end }} - -{{- /* Usage: {{ include "helm_lib_module_ephemeral_storage_only_logs" . }} */ -}} -{{- /* 50Mi for container logs `log-opts.max-file * log-opts.max-size` would be requested */ -}} -{{- /* returns ephemeral-storage size for only logs */ -}} -{{- define "helm_lib_module_ephemeral_storage_only_logs" -}} -{{- /* Template context with .Values, .Chart, etc */ -}} -ephemeral-storage: 50Mi -{{- end }} diff --git a/charts/helm_lib/templates/_module_generate_common_name.tpl b/charts/helm_lib/templates/_module_generate_common_name.tpl deleted file mode 100644 index fb142f8..0000000 --- a/charts/helm_lib/templates/_module_generate_common_name.tpl +++ /dev/null @@ -1,13 +0,0 @@ -{{- /* Usage: {{ include "helm_lib_module_generate_common_name" (list . "") }} */ -}} -{{- /* returns the commonName parameter for use in the Certificate custom resource(cert-manager) */ -}} -{{- define "helm_lib_module_generate_common_name" }} - {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $name_portion := index . 1 -}} {{- /* Name portion */ -}} - - {{- $domain := include "helm_lib_module_public_domain" (list $context $name_portion) -}} - - {{- $domain_length := len $domain -}} - {{- if le $domain_length 64 -}} -commonName: {{ $domain }} - {{- end -}} -{{- end }} diff --git a/charts/helm_lib/templates/_module_https.tpl b/charts/helm_lib/templates/_module_https.tpl deleted file mode 100644 index 8ee41ef..0000000 --- a/charts/helm_lib/templates/_module_https.tpl +++ /dev/null @@ -1,160 +0,0 @@ -{{- /* Usage: {{ include "helm_lib_module_uri_scheme" . }} */ -}} -{{- /* return module uri scheme "http" or "https" */ -}} -{{- define "helm_lib_module_uri_scheme" -}} - {{- $context := . -}} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $mode := "" -}} - - {{- $module_values := (index $context.Values (include "helm_lib_module_camelcase_name" $context)) -}} - {{- if hasKey $module_values "https" -}} - {{- if hasKey $module_values.https "mode" -}} - {{- $mode = $module_values.https.mode -}} - {{- else }} - {{- $mode = $context.Values.global.modules.https.mode | default "" -}} - {{- end }} - {{- else }} - {{- $mode = $context.Values.global.modules.https.mode | default "" -}} - {{- end }} - - - {{- if eq "Disabled" $mode -}} - http - {{- else -}} - https - {{- end -}} -{{- end -}} - -{{- /* Usage: {{ $https_values := include "helm_lib_https_values" . | fromYaml }} */ -}} -{{- define "helm_lib_https_values" -}} - {{- $context := . -}} - {{- $module_values := (index $context.Values (include "helm_lib_module_camelcase_name" $context)) -}} - {{- $mode := "" -}} - {{- $certManagerClusterIssuerName := "" -}} - - {{- if hasKey $module_values "https" -}} - {{- if hasKey $module_values.https "mode" -}} - {{- $mode = $module_values.https.mode -}} - {{- if eq $mode "CertManager" -}} - {{- if not (hasKey $module_values.https "certManager") -}} - {{- cat ".https.certManager.clusterIssuerName is mandatory when .https.mode is set to CertManager" | fail -}} - {{- end -}} - {{- if hasKey $module_values.https.certManager "clusterIssuerName" -}} - {{- $certManagerClusterIssuerName = $module_values.https.certManager.clusterIssuerName -}} - {{- else -}} - {{- cat ".https.certManager.clusterIssuerName is mandatory when .https.mode is set to CertManager" | fail -}} - {{- end -}} - {{- end -}} - {{- else -}} - {{- cat ".https.mode is mandatory when .https is defined" | fail -}} - {{- end -}} - {{- end -}} - - {{- if empty $mode -}} - {{- $mode = $context.Values.global.modules.https.mode -}} - {{- if eq $mode "CertManager" -}} - {{- $certManagerClusterIssuerName = $context.Values.global.modules.https.certManager.clusterIssuerName -}} - {{- end -}} - {{- end -}} - - {{- if not (has $mode (list "Disabled" "CertManager" "CustomCertificate" "OnlyInURI")) -}} - {{- cat "Unknown https.mode:" $mode | fail -}} - {{- end -}} - - {{- if and (eq $mode "CertManager") (not ($context.Values.global.enabledModules | has "cert-manager")) -}} - {{- cat "https.mode has value CertManager but cert-manager module not enabled" | fail -}} - {{- end -}} - -mode: {{ $mode }} - {{- if eq $mode "CertManager" }} -certManager: - clusterIssuerName: {{ $certManagerClusterIssuerName }} - {{- end -}} - -{{- end -}} - -{{- /* Usage: {{ if (include "helm_lib_module_https_mode" .) }} */ -}} -{{- /* returns https mode for module */ -}} -{{- define "helm_lib_module_https_mode" -}} - {{- $context := . -}} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $https_values := include "helm_lib_https_values" $context | fromYaml -}} - {{- $https_values.mode -}} -{{- end -}} - -{{- /* Usage: {{ include "helm_lib_module_https_cert_manager_cluster_issuer_name" . }} */ -}} -{{- /* returns cluster issuer name */ -}} -{{- define "helm_lib_module_https_cert_manager_cluster_issuer_name" -}} - {{- $context := . -}} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $https_values := include "helm_lib_https_values" $context | fromYaml -}} - {{- $https_values.certManager.clusterIssuerName -}} -{{- end -}} - -{{- /* Usage: {{ if (include "helm_lib_module_https_cert_manager_cluster_issuer_is_dns01_challenge_solver" .) }} */ -}} -{{- define "helm_lib_module_https_cert_manager_cluster_issuer_is_dns01_challenge_solver" -}} - {{- $context := . -}} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- if has (include "helm_lib_module_https_cert_manager_cluster_issuer_name" $context) (list "route53" "cloudflare" "digitalocean" "clouddns") }} - "not empty string" - {{- end -}} -{{- end -}} - -{{- /* Usage: {{ include "helm_lib_module_https_cert_manager_acme_solver_challenge_settings" . | nindent 4 }} */ -}} -{{- define "helm_lib_module_https_cert_manager_acme_solver_challenge_settings" -}} - {{- $context := . -}} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- if (include "helm_lib_module_https_cert_manager_cluster_issuer_is_dns01_challenge_solver" $context) }} -- dns01: - provider: {{ include "helm_lib_module_https_cert_manager_cluster_issuer_name" $context }} - {{- else }} -- http01: - ingressClass: {{ include "helm_lib_module_ingress_class" $context | quote }} - {{- end }} -{{- end -}} - -{{- /* Usage: {{ if (include "helm_lib_module_https_ingress_tls_enabled" .) }} */ -}} -{{- /* returns not empty string if tls should enable for ingress */ -}} -{{- define "helm_lib_module_https_ingress_tls_enabled" -}} - {{- $context := . -}} {{- /* Template context with .Values, .Chart, etc */ -}} - - {{- $mode := include "helm_lib_module_https_mode" $context -}} - - {{- if or (eq "CertManager" $mode) (eq "CustomCertificate" $mode) -}} - not empty string - {{- end -}} -{{- end -}} - -{{- /* Usage: {{ include "helm_lib_module_https_copy_custom_certificate" (list . "namespace" "secret_name_prefix") }} */ -}} -{{- /* Renders secret with [custom certificate](https://deckhouse.io/documentation/v1/deckhouse-configure-global.html#parameters-modules-https-customcertificate) */ -}} -{{- /* in passed namespace with passed prefix */ -}} -{{- define "helm_lib_module_https_copy_custom_certificate" -}} - {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $namespace := index . 1 -}} {{- /* Namespace */ -}} - {{- $secret_name_prefix := index . 2 -}} {{- /* Secret name prefix */ -}} - {{- $mode := include "helm_lib_module_https_mode" $context -}} - {{- if eq $mode "CustomCertificate" -}} - {{- $module_values := (index $context.Values (include "helm_lib_module_camelcase_name" $context)) -}} - {{- $secret_name := include "helm_lib_module_https_secret_name" (list $context $secret_name_prefix) -}} ---- -apiVersion: v1 -kind: Secret -metadata: - name: {{ $secret_name }} - namespace: {{ $namespace }} - {{- include "helm_lib_module_labels" (list $context) | nindent 2 }} -type: kubernetes.io/tls -data: {{ $module_values.internal.customCertificateData | toJson }} - {{- end -}} -{{- end -}} - -{{- /* Usage: {{ include "helm_lib_module_https_secret_name (list . "secret_name_prefix") }} */ -}} -{{- /* returns custom certificate name */ -}} -{{- define "helm_lib_module_https_secret_name" -}} - {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $secret_name_prefix := index . 1 -}} {{- /* Secret name prefix */ -}} - {{- $mode := include "helm_lib_module_https_mode" $context -}} - {{- if eq $mode "CertManager" -}} - {{- $secret_name_prefix -}} - {{- else -}} - {{- if eq $mode "CustomCertificate" -}} - {{- printf "%s-customcertificate" $secret_name_prefix -}} - {{- else -}} - {{- fail "https.mode must be CustomCertificate or CertManager" -}} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/charts/helm_lib/templates/_module_image.tpl b/charts/helm_lib/templates/_module_image.tpl deleted file mode 100644 index bdf29f0..0000000 --- a/charts/helm_lib/templates/_module_image.tpl +++ /dev/null @@ -1,76 +0,0 @@ -{{- /* Usage: {{ include "helm_lib_module_image" (list . "") }} */ -}} -{{- /* returns image name */ -}} -{{- define "helm_lib_module_image" }} - {{- $context := index . 0 }} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $containerName := index . 1 | trimAll "\"" }} {{- /* Container name */ -}} - {{- $moduleName := (include "helm_lib_module_camelcase_name" $context) }} - {{- if ge (len .) 3 }} - {{- $moduleName = (include "helm_lib_module_camelcase_name" (index . 2)) }} {{- /* Optional module name */ -}} - {{- end }} - {{- $imageDigest := index $context.Values.global.modulesImages.digests $moduleName $containerName }} - {{- if not $imageDigest }} - {{- $error := (printf "Image %s.%s has no digest" $moduleName $containerName ) }} - {{- fail $error }} - {{- end }} - {{- $registryBase := $context.Values.global.modulesImages.registry.base }} - {{- /* handle external modules registry */}} - {{- if index $context.Values $moduleName }} - {{- if index $context.Values $moduleName "registry" }} - {{- if index $context.Values $moduleName "registry" "base" }} - {{- $host := trimAll "/" (index $context.Values $moduleName "registry" "base") }} - {{- $path := trimAll "/" $context.Chart.Name }} - {{- $registryBase = join "/" (list $host $path) }} - {{- end }} - {{- end }} - {{- end }} - {{- printf "%s@%s" $registryBase $imageDigest }} -{{- end }} - -{{- /* Usage: {{ include "helm_lib_module_image_no_fail" (list . "") }} */ -}} -{{- /* returns image name if found */ -}} -{{- define "helm_lib_module_image_no_fail" }} - {{- $context := index . 0 }} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $containerName := index . 1 | trimAll "\"" }} {{- /* Container name */ -}} - {{- $moduleName := (include "helm_lib_module_camelcase_name" $context) }} - {{- if ge (len .) 3 }} - {{- $moduleName = (include "helm_lib_module_camelcase_name" (index . 2)) }} {{- /* Optional module name */ -}} - {{- end }} - {{- $imageDigest := index $context.Values.global.modulesImages.digests $moduleName $containerName }} - {{- if $imageDigest }} - {{- $registryBase := $context.Values.global.modulesImages.registry.base }} - {{- if index $context.Values $moduleName }} - {{- if index $context.Values $moduleName "registry" }} - {{- if index $context.Values $moduleName "registry" "base" }} - {{- $host := trimAll "/" (index $context.Values $moduleName "registry" "base") }} - {{- $path := trimAll "/" $context.Chart.Name }} - {{- $registryBase = join "/" (list $host $path) }} - {{- end }} - {{- end }} - {{- end }} - {{- printf "%s@%s" $registryBase $imageDigest }} - {{- end }} -{{- end }} - -{{- /* Usage: {{ include "helm_lib_module_common_image" (list . "") }} */ -}} -{{- /* returns image name from common module */ -}} -{{- define "helm_lib_module_common_image" }} - {{- $context := index . 0 }} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $containerName := index . 1 | trimAll "\"" }} {{- /* Container name */ -}} - {{- $imageDigest := index $context.Values.global.modulesImages.digests "common" $containerName }} - {{- if not $imageDigest }} - {{- $error := (printf "Image %s.%s has no digest" "common" $containerName ) }} - {{- fail $error }} - {{- end }} - {{- printf "%s@%s" $context.Values.global.modulesImages.registry.base $imageDigest }} -{{- end }} - -{{- /* Usage: {{ include "helm_lib_module_common_image_no_fail" (list . "") }} */ -}} -{{- /* returns image name from common module if found */ -}} -{{- define "helm_lib_module_common_image_no_fail" }} - {{- $context := index . 0 }} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $containerName := index . 1 | trimAll "\"" }} {{- /* Container name */ -}} - {{- $imageDigest := index $context.Values.global.modulesImages.digests "common" $containerName }} - {{- if $imageDigest }} - {{- printf "%s@%s" $context.Values.global.modulesImages.registry.base $imageDigest }} - {{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/helm_lib/templates/_module_ingress_class.tpl b/charts/helm_lib/templates/_module_ingress_class.tpl deleted file mode 100644 index db7f50b..0000000 --- a/charts/helm_lib/templates/_module_ingress_class.tpl +++ /dev/null @@ -1,13 +0,0 @@ -{{- /* Usage: {{ include "helm_lib_module_ingress_class" . }} */ -}} -{{- /* returns ingress class from module settings or if not exists from global config */ -}} -{{- define "helm_lib_module_ingress_class" -}} - {{- $context := . -}} {{- /* Template context with .Values, .Chart, etc */ -}} - - {{- $module_values := (index $context.Values (include "helm_lib_module_camelcase_name" $context)) -}} - - {{- if hasKey $module_values "ingressClass" -}} - {{- $module_values.ingressClass -}} - {{- else if hasKey $context.Values.global.modules "ingressClass" -}} - {{- $context.Values.global.modules.ingressClass -}} - {{- end -}} -{{- end -}} diff --git a/charts/helm_lib/templates/_module_init_container.tpl b/charts/helm_lib/templates/_module_init_container.tpl deleted file mode 100644 index 9b3fe00..0000000 --- a/charts/helm_lib/templates/_module_init_container.tpl +++ /dev/null @@ -1,56 +0,0 @@ -{{- /* ### Migration 11.12.2020: Remove this helper with all its usages after this commit reached RockSolid */ -}} -{{- /* Usage: {{ include "helm_lib_module_init_container_chown_nobody_volume" (list . "volume-name") }} */ -}} -{{- /* returns initContainer which chowns recursively all files and directories in passed volume */ -}} -{{- define "helm_lib_module_init_container_chown_nobody_volume" }} - {{- $context := index . 0 -}} - {{- $volume_name := index . 1 -}} -- name: chown-volume-{{ $volume_name }} - image: {{ include "helm_lib_module_common_image" (list $context "alpine") }} - command: ["sh", "-c", "chown -R 65534:65534 /tmp/{{ $volume_name }}"] - securityContext: - runAsNonRoot: false - runAsUser: 0 - runAsGroup: 0 - volumeMounts: - - name: {{ $volume_name }} - mountPath: /tmp/{{ $volume_name }} - resources: - requests: - {{- include "helm_lib_module_ephemeral_storage_only_logs" . | nindent 6 }} -{{- end }} - -{{- /* Usage: {{ include "helm_lib_module_init_container_chown_deckhouse_volume" (list . "volume-name") }} */ -}} -{{- /* returns initContainer which chowns recursively all files and directories in passed volume */ -}} -{{- define "helm_lib_module_init_container_chown_deckhouse_volume" }} - {{- $context := index . 0 -}} - {{- $volume_name := index . 1 -}} -- name: chown-volume-{{ $volume_name }} - image: {{ include "helm_lib_module_common_image" (list $context "alpine") }} - command: ["sh", "-c", "chown -R 64535:64535 /tmp/{{ $volume_name }}"] - securityContext: - runAsNonRoot: false - runAsUser: 0 - runAsGroup: 0 - volumeMounts: - - name: {{ $volume_name }} - mountPath: /tmp/{{ $volume_name }} - resources: - requests: - {{- include "helm_lib_module_ephemeral_storage_only_logs" . | nindent 6 }} -{{- end }} - -{{- /* Usage: {{ include "helm_lib_module_init_container_check_linux_kernel" (list . ">= 4.9.17") }} */ -}} -{{- /* returns initContainer which checks the kernel version on the node for compliance to semver constraint */ -}} -{{- define "helm_lib_module_init_container_check_linux_kernel" }} - {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $semver_constraint := index . 1 -}} {{- /* Semver constraint */ -}} -- name: check-linux-kernel - image: {{ include "helm_lib_module_common_image" (list $context "checkKernelVersion") }} - {{- include "helm_lib_module_pod_security_context_run_as_user_deckhouse" . | nindent 2 }} - env: - - name: KERNEL_CONSTRAINT - value: {{ $semver_constraint | quote }} - resources: - requests: - {{- include "helm_lib_module_ephemeral_storage_only_logs" $context | nindent 6 }} -{{- end }} diff --git a/charts/helm_lib/templates/_module_labels.tpl b/charts/helm_lib/templates/_module_labels.tpl deleted file mode 100644 index 228dcf3..0000000 --- a/charts/helm_lib/templates/_module_labels.tpl +++ /dev/null @@ -1,15 +0,0 @@ -{{- /* Usage: {{ include "helm_lib_module_labels" (list . (dict "app" "test" "component" "testing")) }} */ -}} -{{- /* returns deckhouse labels */ -}} -{{- define "helm_lib_module_labels" }} - {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- /* Additional labels dict */ -}} -labels: - heritage: deckhouse - module: {{ $context.Chart.Name }} - {{- if eq (len .) 2 }} - {{- $deckhouse_additional_labels := index . 1 }} - {{- range $key, $value := $deckhouse_additional_labels }} - {{ $key }}: {{ $value | quote }} - {{- end }} - {{- end }} -{{- end }} diff --git a/charts/helm_lib/templates/_module_name.tpl b/charts/helm_lib/templates/_module_name.tpl deleted file mode 100644 index 0fecf05..0000000 --- a/charts/helm_lib/templates/_module_name.tpl +++ /dev/null @@ -1,11 +0,0 @@ -{{- define "helm_lib_module_camelcase_name" -}} - -{{- $moduleName := "" -}} -{{- if (kindIs "string" .) -}} -{{- $moduleName = . | trimAll "\"" -}} -{{- else -}} -{{- $moduleName = .Chart.Name -}} -{{- end -}} - -{{ $moduleName | replace "-" "_" | camelcase | untitle }} -{{- end -}} diff --git a/charts/helm_lib/templates/_module_public_domain.tpl b/charts/helm_lib/templates/_module_public_domain.tpl deleted file mode 100644 index bfbaae7..0000000 --- a/charts/helm_lib/templates/_module_public_domain.tpl +++ /dev/null @@ -1,11 +0,0 @@ -{{- /* Usage: {{ include "helm_lib_module_public_domain" (list . "") }} */ -}} -{{- /* returns rendered publicDomainTemplate to service fqdn */ -}} -{{- define "helm_lib_module_public_domain" }} - {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $name_portion := index . 1 -}} {{- /* Name portion */ -}} - - {{- if not (contains "%s" $context.Values.global.modules.publicDomainTemplate) }} - {{ fail "Error!!! global.modules.publicDomainTemplate must contain \"%s\" pattern to render service fqdn!" }} - {{- end }} - {{- printf $context.Values.global.modules.publicDomainTemplate $name_portion }} -{{- end }} diff --git a/charts/helm_lib/templates/_module_security_context.tpl b/charts/helm_lib/templates/_module_security_context.tpl deleted file mode 100644 index c726277..0000000 --- a/charts/helm_lib/templates/_module_security_context.tpl +++ /dev/null @@ -1,199 +0,0 @@ -{{- /* Usage: {{ include "helm_lib_module_pod_security_context_run_as_user_custom" (list . 1000 1000) }} */ -}} -{{- /* returns PodSecurityContext parameters for Pod with custom user and group */ -}} -{{- define "helm_lib_module_pod_security_context_run_as_user_custom" -}} -{{- /* Template context with .Values, .Chart, etc */ -}} -{{- /* User id */ -}} -{{- /* Group id */ -}} -securityContext: - runAsNonRoot: true - runAsUser: {{ index . 1 }} - runAsGroup: {{ index . 2 }} -{{- end }} - -{{- /* Usage: {{ include "helm_lib_module_pod_security_context_run_as_user_nobody" . }} */ -}} -{{- /* returns PodSecurityContext parameters for Pod with user and group "nobody" */ -}} -{{- define "helm_lib_module_pod_security_context_run_as_user_nobody" -}} -{{- /* Template context with .Values, .Chart, etc */ -}} -securityContext: - runAsNonRoot: true - runAsUser: 65534 - runAsGroup: 65534 -{{- end }} - -{{- /* Usage: {{ include "helm_lib_module_pod_security_context_run_as_user_nobody_with_writable_fs" . }} */ -}} -{{- /* returns PodSecurityContext parameters for Pod with user and group "nobody" with write access to mounted volumes */ -}} -{{- define "helm_lib_module_pod_security_context_run_as_user_nobody_with_writable_fs" -}} -{{- /* Template context with .Values, .Chart, etc */ -}} -securityContext: - runAsNonRoot: true - runAsUser: 65534 - runAsGroup: 65534 - fsGroup: 65534 -{{- end }} - -{{- /* Usage: {{ include "helm_lib_module_pod_security_context_run_as_user_deckhouse" . }} */ -}} -{{- /* returns PodSecurityContext parameters for Pod with user and group "deckhouse" */ -}} -{{- define "helm_lib_module_pod_security_context_run_as_user_deckhouse" -}} -{{- /* Template context with .Values, .Chart, etc */ -}} -securityContext: - runAsNonRoot: true - runAsUser: 64535 - runAsGroup: 64535 -{{- end }} - -{{- /* Usage: {{ include "helm_lib_module_pod_security_context_run_as_user_deckhouse_with_writable_fs" . }} */ -}} -{{- /* returns PodSecurityContext parameters for Pod with user and group "deckhouse" with write access to mounted volumes */ -}} -{{- define "helm_lib_module_pod_security_context_run_as_user_deckhouse_with_writable_fs" -}} -{{- /* Template context with .Values, .Chart, etc */ -}} -securityContext: - runAsNonRoot: true - runAsUser: 64535 - runAsGroup: 64535 - fsGroup: 64535 -{{- end }} - -{{- /* Usage: {{ include "helm_lib_module_container_security_context_run_as_user_deckhouse_pss_restricted" . }} */ -}} -{{- /* returns SecurityContext parameters for Container with user and group "deckhouse" plus minimal required settings to comply with the Restricted mode of the Pod Security Standards */ -}} -{{- define "helm_lib_module_container_security_context_run_as_user_deckhouse_pss_restricted" -}} -{{- /* Template context with .Values, .Chart, etc */ -}} -securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - all - runAsGroup: 64535 - runAsNonRoot: true - runAsUser: 64535 - seccompProfile: - type: RuntimeDefault -{{- end }} - -{{- /* Usage: {{ include "helm_lib_module_pod_security_context_run_as_user_root" . }} */ -}} -{{- /* returns PodSecurityContext parameters for Pod with user and group 0 */ -}} -{{- define "helm_lib_module_pod_security_context_run_as_user_root" -}} -{{- /* Template context with .Values, .Chart, etc */ -}} -securityContext: - runAsNonRoot: false - runAsUser: 0 - runAsGroup: 0 -{{- end }} - -{{- /* Usage: {{ include "helm_lib_module_pod_security_context_runtime_default" . }} */ -}} -{{- /* returns PodSecurityContext parameters for Pod with seccomp profile RuntimeDefault */ -}} -{{- define "helm_lib_module_pod_security_context_runtime_default" -}} -{{- /* Template context with .Values, .Chart, etc */ -}} -securityContext: - seccompProfile: - type: RuntimeDefault -{{- end }} - -{{- /* Usage: {{ include "helm_lib_module_container_security_context_not_allow_privilege_escalation" . }} */ -}} -{{- /* returns SecurityContext parameters for Container with allowPrivilegeEscalation false */ -}} -{{- define "helm_lib_module_container_security_context_not_allow_privilege_escalation" -}} -securityContext: - allowPrivilegeEscalation: false -{{- end }} - -{{- /* Usage: {{ include "helm_lib_module_container_security_context_read_only_root_filesystem_with_selinux" . }} */ -}} -{{- /* returns SecurityContext parameters for Container with read only root filesystem and options for SELinux compatibility*/ -}} -{{- define "helm_lib_module_container_security_context_read_only_root_filesystem_with_selinux" -}} -{{- /* Template context with .Values, .Chart, etc */ -}} -securityContext: - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - seLinuxOptions: - level: 's0' - type: 'spc_t' -{{- end }} - -{{- /* Usage: {{ include "helm_lib_module_container_security_context_read_only_root_filesystem" . }} */ -}} -{{- /* returns SecurityContext parameters for Container with read only root filesystem */ -}} -{{- define "helm_lib_module_container_security_context_read_only_root_filesystem" -}} -{{- /* Template context with .Values, .Chart, etc */ -}} -securityContext: - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false -{{- end }} - -{{- /* Usage: {{ include "helm_lib_module_container_security_context_privileged" . }} */ -}} -{{- /* returns SecurityContext parameters for Container running privileged */ -}} -{{- define "helm_lib_module_container_security_context_privileged" -}} -securityContext: - privileged: true -{{- end }} - -{{- /* Usage: {{ include "helm_lib_module_container_security_context_escalated_sys_admin_privileged" . }} */ -}} -{{- /* returns SecurityContext parameters for Container running privileged with escalation and sys_admin */ -}} -{{- define "helm_lib_module_container_security_context_escalated_sys_admin_privileged" -}} -securityContext: - allowPrivilegeEscalation: true - capabilities: - add: - - SYS_ADMIN - privileged: true -{{- end }} - -{{- /* Usage: {{ include "helm_lib_module_container_security_context_privileged_read_only_root_filesystem" . }} */ -}} -{{- /* returns SecurityContext parameters for Container running privileged with read only root filesystem */ -}} -{{- define "helm_lib_module_container_security_context_privileged_read_only_root_filesystem" -}} -{{- /* Template context with .Values, .Chart, etc */ -}} -securityContext: - privileged: true - readOnlyRootFilesystem: true -{{- end }} - -{{- /* Usage: {{ include "helm_lib_module_container_security_context_read_only_root_filesystem_capabilities_drop_all" . }} */ -}} -{{- /* returns SecurityContext for Container with read only root filesystem and all capabilities dropped */ -}} -{{- define "helm_lib_module_container_security_context_read_only_root_filesystem_capabilities_drop_all" -}} -{{- /* Template context with .Values, .Chart, etc */ -}} -securityContext: - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL -{{- end }} - -{{- /* Usage: {{ include "helm_lib_module_container_security_context_read_only_root_filesystem_capabilities_drop_all_and_add" (list . (list "KILL" "SYS_PTRACE")) }} */ -}} -{{- /* returns SecurityContext parameters for Container with read only root filesystem, all dropped and some added capabilities */ -}} -{{- define "helm_lib_module_container_security_context_read_only_root_filesystem_capabilities_drop_all_and_add" -}} -{{- /* Template context with .Values, .Chart, etc */ -}} -{{- /* List of capabilities */ -}} -securityContext: - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - add: {{ index . 1 | toJson }} -{{- end }} - -{{- /* Usage: {{ include "helm_lib_module_container_security_context_capabilities_drop_all_and_add" (list . (list "KILL" "SYS_PTRACE")) }} */ -}} -{{- /* returns SecurityContext parameters for Container with all dropped and some added capabilities */ -}} -{{- define "helm_lib_module_container_security_context_capabilities_drop_all_and_add" -}} -{{- /* Template context with .Values, .Chart, etc */ -}} -{{- /* List of capabilities */ -}} -securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - add: {{ index . 1 | toJson }} -{{- end }} - -{{- /* Usage: {{ include "helm_lib_module_container_security_context_capabilities_drop_all_and_run_as_user_custom" (list . 1000 1000) }} */ -}} -{{- /* returns SecurityContext parameters for Container with read only root filesystem, all dropped, and custom user ID */ -}} -{{- define "helm_lib_module_container_security_context_capabilities_drop_all_and_run_as_user_custom" -}} -{{- /* Template context with .Values, .Chart, etc */ -}} -{{- /* User id */ -}} -{{- /* Group id */ -}} -securityContext: - runAsUser: {{ index . 1 }} - runAsGroup: {{ index . 2 }} - runAsNonRoot: true - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL -{{- end }} diff --git a/charts/helm_lib/templates/_module_storage_class.tpl b/charts/helm_lib/templates/_module_storage_class.tpl deleted file mode 100644 index cf761a5..0000000 --- a/charts/helm_lib/templates/_module_storage_class.tpl +++ /dev/null @@ -1,38 +0,0 @@ -{{- /* Usage: {{ include "helm_lib_module_storage_class_annotations" (list $ $index $storageClass.name) }} */ -}} -{{- /* return module StorageClass annotations */ -}} -{{- define "helm_lib_module_storage_class_annotations" -}} - {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $sc_index := index . 1 -}} {{- /* Storage class index */ -}} - {{- $sc_name := index . 2 -}} {{- /* Storage class name */ -}} - {{- $module_values := (index $context.Values (include "helm_lib_module_camelcase_name" $context)) -}} - {{- $annotations := dict -}} - - {{- $volume_expansion_mode_offline := false -}} - {{- range $module_name := list "cloud-provider-azure" "cloud-provider-yandex" "cloud-provider-vsphere" "cloud-provider-vcd"}} - {{- if has $module_name $context.Values.global.enabledModules }} - {{- $volume_expansion_mode_offline = true }} - {{- end }} - {{- end }} - - {{- if $volume_expansion_mode_offline }} - {{- $_ := set $annotations "storageclass.deckhouse.io/volume-expansion-mode" "offline" }} - {{- end }} - - {{- if hasKey $module_values.internal "defaultStorageClass" }} - {{- if eq $module_values.internal.defaultStorageClass $sc_name }} - {{- $_ := set $annotations "storageclass.kubernetes.io/is-default-class" "true" }} - {{- end }} - {{- else }} - {{- if eq $sc_index 0 }} - {{- if $context.Values.global.discovery.defaultStorageClass }} - {{- if eq $context.Values.global.discovery.defaultStorageClass $sc_name }} - {{- $_ := set $annotations "storageclass.kubernetes.io/is-default-class" "true" }} - {{- end }} - {{- else }} - {{- $_ := set $annotations "storageclass.kubernetes.io/is-default-class" "true" }} - {{- end }} - {{- end }} - {{- end }} - -{{- (dict "annotations" $annotations) | toYaml -}} -{{- end -}} diff --git a/charts/helm_lib/templates/_monitoring_grafana_dashboards.tpl b/charts/helm_lib/templates/_monitoring_grafana_dashboards.tpl deleted file mode 100644 index ebbcefb..0000000 --- a/charts/helm_lib/templates/_monitoring_grafana_dashboards.tpl +++ /dev/null @@ -1,68 +0,0 @@ -{{- /* Usage: {{ include "helm_lib_grafana_dashboard_definitions_recursion" (list . [current dir]) }} */ -}} -{{- /* returns all the dashboard-definintions from / */ -}} -{{- /* current dir is optional — used for recursion but you can use it for partially generating dashboards */ -}} -{{- define "helm_lib_grafana_dashboard_definitions_recursion" -}} - {{- $context := index . 0 }} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $rootDir := index . 1 }} {{- /* Dashboards root dir */ -}} - {{- /* Dashboards current dir */ -}} - - {{- $currentDir := "" }} - {{- if gt (len .) 2 }} {{- $currentDir = index . 2 }} {{- else }} {{- $currentDir = $rootDir }} {{- end }} - - {{- $currentDirIndex := (sub ($currentDir | splitList "/" | len) 1) }} - {{- $rootDirIndex := (sub ($rootDir | splitList "/" | len) 1) }} - {{- $folderNamesIndex := (add1 $rootDirIndex) }} - - {{- range $path, $_ := $context.Files.Glob (print $currentDir "/*.json") }} - {{- $fileName := ($path | splitList "/" | last ) }} - {{- $definition := ($context.Files.Get $path) }} - - {{- $folder := (index ($currentDir | splitList "/") $folderNamesIndex | replace "-" " " | title) }} - {{- $resourceName := (regexReplaceAllLiteral "\\.json$" $path "") }} - {{- $resourceName = ($resourceName | replace " " "-" | replace "." "-" | replace "_" "-") }} - {{- $resourceName = (slice ($resourceName | splitList "/") $folderNamesIndex | join "-") }} - {{- $resourceName = (printf "%s-%s" $context.Chart.Name $resourceName) }} - -{{ include "helm_lib_single_dashboard" (list $context $resourceName $folder $definition) }} - {{- end }} - - {{- $subDirs := list }} - {{- range $path, $_ := ($context.Files.Glob (print $currentDir "/**.json")) }} - {{- $pathSlice := ($path | splitList "/") }} - {{- $subDirs = append $subDirs (slice $pathSlice 0 (add $currentDirIndex 2) | join "/") }} - {{- end }} - - {{- range $subDir := ($subDirs | uniq) }} -{{ include "helm_lib_grafana_dashboard_definitions_recursion" (list $context $rootDir $subDir) }} - {{- end }} -{{- end }} - - -{{- /* Usage: {{ include "helm_lib_grafana_dashboard_definitions" . }} */ -}} -{{- /* returns dashboard-definintions from monitoring/grafana-dashboards/ */ -}} -{{- define "helm_lib_grafana_dashboard_definitions" -}} - {{- $context := . }} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- if ( $context.Values.global.enabledModules | has "prometheus-crd" ) }} -{{- include "helm_lib_grafana_dashboard_definitions_recursion" (list $context "monitoring/grafana-dashboards") }} - {{- end }} -{{- end }} - - -{{- /* Usage: {{ include "helm_lib_single_dashboard" (list . "dashboard-name" "folder" $dashboard) }} */ -}} -{{- /* renders a single dashboard */ -}} -{{- define "helm_lib_single_dashboard" -}} - {{- $context := index . 0 }} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $resourceName := index . 1 }} {{- /* Dashboard name */ -}} - {{- $folder := index . 2 }} {{- /* Folder */ -}} - {{- $definition := index . 3 }} {{/* Dashboard definition */}} ---- -apiVersion: deckhouse.io/v1 -kind: GrafanaDashboardDefinition -metadata: - name: d8-{{ $resourceName }} - {{- include "helm_lib_module_labels" (list $context (dict "prometheus.deckhouse.io/grafana-dashboard" "")) | nindent 2 }} -spec: - folder: "{{ $folder }}" - definition: | - {{- $definition | nindent 4 }} -{{- end }} diff --git a/charts/helm_lib/templates/_monitoring_prometheus_rules.tpl b/charts/helm_lib/templates/_monitoring_prometheus_rules.tpl deleted file mode 100644 index 794fe30..0000000 --- a/charts/helm_lib/templates/_monitoring_prometheus_rules.tpl +++ /dev/null @@ -1,96 +0,0 @@ -{{- /* Usage: {{ include "helm_lib_prometheus_rules_recursion" (list . [current dir]) }} */ -}} -{{- /* returns all the prometheus rules from / */ -}} -{{- /* current dir is optional — used for recursion but you can use it for partially generating rules */ -}} -{{- define "helm_lib_prometheus_rules_recursion" -}} - {{- $context := index . 0 }} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $namespace := index . 1 }} {{- /* Namespace for creating rules */ -}} - {{- $rootDir := index . 2 }} {{- /* Rules root dir */ -}} - {{- $currentDir := "" }} {{- /* Current dir (optional) */ -}} - {{- if gt (len .) 3 }} {{- $currentDir = index . 3 }} {{- else }} {{- $currentDir = $rootDir }} {{- end }} - {{- $currentDirIndex := (sub ($currentDir | splitList "/" | len) 1) }} - {{- $rootDirIndex := (sub ($rootDir | splitList "/" | len) 1) }} - {{- $folderNamesIndex := (add1 $rootDirIndex) }} - - {{- range $path, $_ := $context.Files.Glob (print $currentDir "/*.{yaml,tpl}") }} - {{- $fileName := ($path | splitList "/" | last ) }} - {{- $definition := "" }} - {{- if eq ($path | splitList "." | last) "tpl" -}} - {{- $definition = tpl ($context.Files.Get $path) $context }} - {{- else }} - {{- $definition = $context.Files.Get $path }} - {{- end }} - - {{- $definition = $definition | replace "__SCRAPE_INTERVAL__" (printf "%ds" ($context.Values.global.discovery.prometheusScrapeInterval | default 30)) | replace "__SCRAPE_INTERVAL_X_2__" (printf "%ds" (mul ($context.Values.global.discovery.prometheusScrapeInterval | default 30) 2)) | replace "__SCRAPE_INTERVAL_X_3__" (printf "%ds" (mul ($context.Values.global.discovery.prometheusScrapeInterval | default 30) 3)) | replace "__SCRAPE_INTERVAL_X_4__" (printf "%ds" (mul ($context.Values.global.discovery.prometheusScrapeInterval | default 30) 4)) }} - -{{/* Patch expression based on `d8_ignore_on_update` annotation*/}} - - - {{ $definition = printf "Rules:\n%s" ($definition | nindent 2) }} - {{- $definitionStruct := ( $definition | fromYaml )}} - {{- if $definitionStruct.Error }} - {{- fail ($definitionStruct.Error | toString) }} - {{- end }} - {{- range $rule := $definitionStruct.Rules }} - - {{- range $dedicatedRule := $rule.rules }} - {{- if $dedicatedRule.annotations }} - {{- if (eq (get $dedicatedRule.annotations "d8_ignore_on_update") "true") }} - {{- $_ := set $dedicatedRule "expr" (printf "(%s) and ON() ((max(d8_is_updating) != 1) or ON() absent(d8_is_updating))" $dedicatedRule.expr) }} - {{- end }} - {{- end }} - {{- end }} - - {{- end }} - - {{ $definition = $definitionStruct.Rules | toYaml }} - - {{- $resourceName := (regexReplaceAllLiteral "\\.(yaml|tpl)$" $path "") }} - {{- $resourceName = ($resourceName | replace " " "-" | replace "." "-" | replace "_" "-") }} - {{- $resourceName = (slice ($resourceName | splitList "/") $folderNamesIndex | join "-") }} - {{- $resourceName = (printf "%s-%s" $context.Chart.Name $resourceName) }} ---- -apiVersion: monitoring.coreos.com/v1 -kind: PrometheusRule -metadata: - name: {{ $resourceName }} - namespace: {{ $namespace }} - {{- include "helm_lib_module_labels" (list $context (dict "app" "prometheus" "prometheus" "main" "component" "rules")) | nindent 2 }} -spec: - groups: - {{- $definition | nindent 4 }} - {{- end }} - - {{- $subDirs := list }} - {{- range $path, $_ := ($context.Files.Glob (print $currentDir "/**.{yaml,tpl}")) }} - {{- $pathSlice := ($path | splitList "/") }} - {{- $subDirs = append $subDirs (slice $pathSlice 0 (add $currentDirIndex 2) | join "/") }} - {{- end }} - - {{- range $subDir := ($subDirs | uniq) }} -{{ include "helm_lib_prometheus_rules_recursion" (list $context $namespace $rootDir $subDir) }} - {{- end }} -{{- end }} - - -{{- /* Usage: {{ include "helm_lib_prometheus_rules" (list . ) }} */ -}} -{{- /* returns all the prometheus rules from monitoring/prometheus-rules/ */ -}} -{{- define "helm_lib_prometheus_rules" -}} - {{- $context := index . 0 }} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $namespace := index . 1 }} {{- /* Namespace for creating rules */ -}} - {{- if ( $context.Values.global.enabledModules | has "operator-prometheus-crd" ) }} -{{- include "helm_lib_prometheus_rules_recursion" (list $context $namespace "monitoring/prometheus-rules") }} - {{- end }} -{{- end }} - -{{- /* Usage: {{ include "helm_lib_prometheus_target_scrape_timeout_seconds" (list . ) }} */ -}} -{{- /* returns adjust timeout value to scrape interval / */ -}} -{{- define "helm_lib_prometheus_target_scrape_timeout_seconds" -}} - {{- $context := index . 0 }} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $timeout := index . 1 }} {{- /* Target timeout in seconds */ -}} - {{- $scrape_interval := (int $context.Values.global.discovery.prometheusScrapeInterval | default 30) }} - {{- if gt $timeout $scrape_interval -}} -{{ $scrape_interval }}s - {{- else -}} -{{ $timeout }}s - {{- end }} -{{- end }} diff --git a/charts/helm_lib/templates/_node_affinity.tpl b/charts/helm_lib/templates/_node_affinity.tpl deleted file mode 100644 index cbdd0f9..0000000 --- a/charts/helm_lib/templates/_node_affinity.tpl +++ /dev/null @@ -1,256 +0,0 @@ -{{- /* Verify node selector strategy. */ -}} -{{- define "helm_lib_internal_check_node_selector_strategy" -}} - {{ if not (has . (list "frontend" "monitoring" "system" "master" )) }} - {{- fail (printf "unknown strategy \"%v\"" .) }} - {{- end }} - {{- . -}} -{{- end }} - -{{- /* Returns node selector for workloads depend on strategy. */ -}} -{{- define "helm_lib_node_selector" }} - {{- $context := index . 0 }} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $strategy := index . 1 | include "helm_lib_internal_check_node_selector_strategy" }} {{- /* strategy, one of "frontend" "monitoring" "system" "master" "any-node" "wildcard" */ -}} - {{- $module_values := dict }} - {{- if lt (len .) 3 }} - {{- $module_values = (index $context.Values (include "helm_lib_module_camelcase_name" $context)) }} - {{- else }} - {{- $module_values = index . 2 }} - {{- end }} - {{- $camel_chart_name := (include "helm_lib_module_camelcase_name" $context) }} - - {{- if eq $strategy "monitoring" }} - {{- if $module_values.nodeSelector }} -nodeSelector: {{ $module_values.nodeSelector | toJson }} - {{- else if gt (index $context.Values.global.discovery.d8SpecificNodeCountByRole $camel_chart_name | int) 0 }} -nodeSelector: - node-role.deckhouse.io/{{$context.Chart.Name}}: "" - {{- else if gt (index $context.Values.global.discovery.d8SpecificNodeCountByRole $strategy | int) 0 }} -nodeSelector: - node-role.deckhouse.io/{{$strategy}}: "" - {{- else if gt (index $context.Values.global.discovery.d8SpecificNodeCountByRole "system" | int) 0 }} -nodeSelector: - node-role.deckhouse.io/system: "" - {{- end }} - - {{- else if or (eq $strategy "frontend") (eq $strategy "system") }} - {{- if $module_values.nodeSelector }} -nodeSelector: {{ $module_values.nodeSelector | toJson }} - {{- else if gt (index $context.Values.global.discovery.d8SpecificNodeCountByRole $camel_chart_name | int) 0 }} -nodeSelector: - node-role.deckhouse.io/{{$context.Chart.Name}}: "" - {{- else if gt (index $context.Values.global.discovery.d8SpecificNodeCountByRole $strategy | int) 0 }} -nodeSelector: - node-role.deckhouse.io/{{$strategy}}: "" - {{- end }} - - {{- else if eq $strategy "master" }} - {{- if gt (index $context.Values.global.discovery "clusterMasterCount" | int) 0 }} -nodeSelector: - node-role.kubernetes.io/control-plane: "" - {{- else if gt (index $context.Values.global.discovery.d8SpecificNodeCountByRole "master" | int) 0 }} -nodeSelector: - node-role.deckhouse.io/control-plane: "" - {{- else if gt (index $context.Values.global.discovery.d8SpecificNodeCountByRole "system" | int) 0 }} -nodeSelector: - node-role.deckhouse.io/system: "" - {{- end }} - {{- end }} -{{- end }} - - -{{- /* Returns tolerations for workloads depend on strategy. */ -}} -{{- /* Usage: {{ include "helm_lib_tolerations" (tuple . "any-node" "with-uninitialized" "without-storage-problems") }} */ -}} -{{- define "helm_lib_tolerations" }} - {{- $context := index . 0 }} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $strategy := index . 1 | include "helm_lib_internal_check_tolerations_strategy" }} {{- /* base strategy, one of "frontend" "monitoring" "system" any-node" "wildcard" */ -}} - {{- $additionalStrategies := tuple }} {{- /* list of additional strategies. To add strategy list it with prefix "with-", to remove strategy list it with prefix "without-". */ -}} - {{- if eq $strategy "custom" }} - {{ if lt (len .) 3 }} - {{- fail (print "additional strategies is required") }} - {{- end }} - {{- else }} - {{- $additionalStrategies = tuple "storage-problems" }} - {{- end }} - {{- $module_values := (index $context.Values (include "helm_lib_module_camelcase_name" $context)) }} - {{- if gt (len .) 2 }} - {{- range $as := slice . 2 (len .) }} - {{- if hasPrefix "with-" $as }} - {{- $additionalStrategies = mustAppend $additionalStrategies (trimPrefix "with-" $as) }} - {{- end }} - {{- if hasPrefix "without-" $as }} - {{- $additionalStrategies = mustWithout $additionalStrategies (trimPrefix "without-" $as) }} - {{- end }} - {{- end }} - {{- end }} -tolerations: - {{- /* Wildcard: gives permissions to schedule on any node with any taints (use with caution) */ -}} - {{- if eq $strategy "wildcard" }} - {{- include "_helm_lib_wildcard_tolerations" $context }} - - {{- else }} - {{- /* Any node: any node in the cluster with any known taints */ -}} - {{- if eq $strategy "any-node" }} - {{- include "_helm_lib_any_node_tolerations" $context }} - - {{- /* Tolerations from module config: overrides below strategies, if there is any toleration specified */ -}} - {{- else if $module_values.tolerations }} - {{- $module_values.tolerations | toYaml | nindent 0 }} - - {{- /* Monitoring: Nodes for monitoring components: prometheus, grafana, kube-state-metrics, etc. */ -}} - {{- else if eq $strategy "monitoring" }} - {{- include "_helm_lib_monitoring_tolerations" $context }} - - {{- /* Frontend: Nodes for ingress-controllers */ -}} - {{- else if eq $strategy "frontend" }} - {{- include "_helm_lib_frontend_tolerations" $context }} - - {{- /* System: Nodes for system components: prometheus, dns, cert-manager */ -}} - {{- else if eq $strategy "system" }} - {{- include "_helm_lib_system_tolerations" $context }} - {{- end }} - - {{- /* Additional strategies */ -}} - {{- range $additionalStrategies -}} - {{- include (printf "_helm_lib_additional_tolerations_%s" (. | replace "-" "_")) $context }} - {{- end }} - {{- end }} -{{- end }} - - -{{- /* Check cluster type. */ -}} -{{- /* Returns not empty string if this is cloud or hybrid cluster */ -}} -{{- define "_helm_lib_cloud_or_hybrid_cluster" }} - {{- if .Values.global.clusterConfiguration }} - {{- if eq .Values.global.clusterConfiguration.clusterType "Cloud" }} - "not empty string" - {{- /* We consider non-cloud clusters with enabled cloud-provider-.* module as Hybrid clusters */ -}} - {{- else }} - {{- range $v := .Values.global.enabledModules }} - {{- if hasPrefix "cloud-provider-" $v }} - "not empty string" - {{- end }} - {{- end }} - {{- end }} - {{- end }} -{{- end }} - -{{- /* Verify base strategy. */ -}} -{{- /* Fails if strategy not in allowed list */ -}} -{{- define "helm_lib_internal_check_tolerations_strategy" -}} - {{ if not (has . (list "custom" "frontend" "monitoring" "system" "any-node" "wildcard" )) }} - {{- fail (printf "unknown strategy \"%v\"" .) }} - {{- end }} - {{- . -}} -{{- end }} - - -{{- /* Base strategy for any uncordoned node in cluster. */ -}} -{{- /* Usage: {{ include "helm_lib_tolerations" (tuple . "any-node") }} */ -}} -{{- define "_helm_lib_any_node_tolerations" }} -- key: node-role.kubernetes.io/master -- key: node-role.kubernetes.io/control-plane -- key: dedicated.deckhouse.io - operator: "Exists" -- key: dedicated - operator: "Exists" -- key: DeletionCandidateOfClusterAutoscaler -- key: ToBeDeletedByClusterAutoscaler - {{- if .Values.global.modules.placement.customTolerationKeys }} - {{- range $key := .Values.global.modules.placement.customTolerationKeys }} -- key: {{ $key | quote }} - operator: "Exists" - {{- end }} - {{- end }} -{{- end }} - -{{- /* Base strategy that tolerates all. */ -}} -{{- /* Usage: {{ include "helm_lib_tolerations" (tuple . "wildcard") }} */ -}} -{{- define "_helm_lib_wildcard_tolerations" }} -- operator: "Exists" -{{- end }} - -{{- /* Base strategy that tolerates nodes with "dedicated.deckhouse.io: monitoring" and "dedicated.deckhouse.io: system" taints. */ -}} -{{- /* Usage: {{ include "helm_lib_tolerations" (tuple . "monitoring") }} */ -}} -{{- define "_helm_lib_monitoring_tolerations" }} -- key: dedicated.deckhouse.io - operator: Equal - value: {{ .Chart.Name | quote }} -- key: dedicated.deckhouse.io - operator: Equal - value: "monitoring" -- key: dedicated.deckhouse.io - operator: Equal - value: "system" -{{- end }} - -{{- /* Base strategy that tolerates nodes with "dedicated.deckhouse.io: frontend" taints. */ -}} -{{- /* Usage: {{ include "helm_lib_tolerations" (tuple . "frontend") }} */ -}} -{{- define "_helm_lib_frontend_tolerations" }} -- key: dedicated.deckhouse.io - operator: Equal - value: {{ .Chart.Name | quote }} -- key: dedicated.deckhouse.io - operator: Equal - value: "frontend" -{{- end }} - -{{- /* Base strategy that tolerates nodes with "dedicated.deckhouse.io: system" taints. */ -}} -{{- /* Usage: {{ include "helm_lib_tolerations" (tuple . "system") }} */ -}} -{{- define "_helm_lib_system_tolerations" }} -- key: dedicated.deckhouse.io - operator: Equal - value: {{ .Chart.Name | quote }} -- key: dedicated.deckhouse.io - operator: Equal - value: "system" -{{- end }} - - -{{- /* Additional strategy "uninitialized" - used for CNI's and kube-proxy to allow cni components scheduled on node after CCM initialization. */ -}} -{{- /* Usage: {{ include "helm_lib_tolerations" (tuple . "any-node" "with-uninitialized") }} */ -}} -{{- define "_helm_lib_additional_tolerations_uninitialized" }} -- key: node.deckhouse.io/uninitialized - operator: "Exists" - effect: "NoSchedule" - {{- if include "_helm_lib_cloud_or_hybrid_cluster" . }} - {{- include "_helm_lib_additional_tolerations_no_csi" . }} - {{- end }} - {{- include "_helm_lib_additional_tolerations_node_problems" . }} -{{- end }} - -{{- /* Additional strategy "node-problems" - used for shedule critical components on non-ready nodes or nodes under pressure. */ -}} -{{- /* Usage: {{ include "helm_lib_tolerations" (tuple . "any-node" "with-node-problems") }} */ -}} -{{- define "_helm_lib_additional_tolerations_node_problems" }} -- key: node.kubernetes.io/not-ready -- key: node.kubernetes.io/out-of-disk -- key: node.kubernetes.io/memory-pressure -- key: node.kubernetes.io/disk-pressure -- key: node.kubernetes.io/pid-pressure -- key: node.kubernetes.io/unreachable -- key: node.kubernetes.io/network-unavailable -{{- end }} - -{{- /* Additional strategy "storage-problems" - used for shedule critical components on nodes with drbd problems. This additional strategy enabled by default in any base strategy except "wildcard". */ -}} -{{- /* Usage: {{ include "helm_lib_tolerations" (tuple . "any-node" "without-storage-problems") }} */ -}} -{{- define "_helm_lib_additional_tolerations_storage_problems" }} -- key: drbd.linbit.com/lost-quorum -- key: drbd.linbit.com/force-io-error -- key: drbd.linbit.com/ignore-fail-over -{{- end }} - -{{- /* Additional strategy "no-csi" - used for any node with no CSI: any node, which was initialized by deckhouse, but have no csi-node driver registered on it. */ -}} -{{- /* Usage: {{ include "helm_lib_tolerations" (tuple . "any-node" "with-no-csi") }} */ -}} -{{- define "_helm_lib_additional_tolerations_no_csi" }} -- key: node.deckhouse.io/csi-not-bootstrapped - operator: "Exists" - effect: "NoSchedule" -{{- end }} - -{{- /* Additional strategy "cloud-provider-uninitialized" - used for any node which is not initialized by CCM. */ -}} -{{- /* Usage: {{ include "helm_lib_tolerations" (tuple . "any-node" "with-cloud-provider-uninitialized") }} */ -}} -{{- define "_helm_lib_additional_tolerations_cloud_provider_uninitialized" }} - {{- if not .Values.global.clusterIsBootstrapped }} -- key: node.cloudprovider.kubernetes.io/uninitialized - operator: Exists - {{- end }} -{{- end }} diff --git a/charts/helm_lib/templates/_pod_disruption_budget.tpl b/charts/helm_lib/templates/_pod_disruption_budget.tpl deleted file mode 100644 index ccd4f21..0000000 --- a/charts/helm_lib/templates/_pod_disruption_budget.tpl +++ /dev/null @@ -1,6 +0,0 @@ -{{- /* Usage: {{ include "helm_lib_pdb_daemonset" . }} */ -}} -{{- /* Returns PDB max unavailable */ -}} -{{- define "helm_lib_pdb_daemonset" }} - {{- $context := . -}} {{- /* Template context with .Values, .Chart, etc */ -}} -maxUnavailable: 10% -{{- end -}} diff --git a/charts/helm_lib/templates/_priority_class.tpl b/charts/helm_lib/templates/_priority_class.tpl deleted file mode 100644 index 5935445..0000000 --- a/charts/helm_lib/templates/_priority_class.tpl +++ /dev/null @@ -1,9 +0,0 @@ -{{- /* Usage: {{ include "helm_lib_priority_class" (tuple . "priority-class-name") }} /* -}} -{{- /* returns priority class if priority-class module enabled, otherwise returns nothing */ -}} -{{- define "helm_lib_priority_class" }} - {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} - {{- $priorityClassName := index . 1 }} {{- /* Priority class name */ -}} - {{- if ( $context.Values.global.enabledModules | has "priority-class") }} -priorityClassName: {{ $priorityClassName }} - {{- end }} -{{- end -}} diff --git a/charts/helm_lib/templates/_resources_management.tpl b/charts/helm_lib/templates/_resources_management.tpl deleted file mode 100644 index dff75c1..0000000 --- a/charts/helm_lib/templates/_resources_management.tpl +++ /dev/null @@ -1,160 +0,0 @@ -{{- /* Usage: {{ include "helm_lib_resources_management_pod_resources" (list [ephemeral storage requests]) }} */ -}} -{{- /* returns rendered resources section based on configuration if it is */ -}} -{{- define "helm_lib_resources_management_pod_resources" -}} - {{- $configuration := index . 0 -}} {{- /* VPA resource configuration [example](https://deckhouse.io/documentation/v1/modules/110-istio/configuration.html#parameters-controlplane-resourcesmanagement) */ -}} - {{- /* Ephemeral storage requests */ -}} - - {{- $ephemeral_storage := "50Mi" -}} - {{- if eq (len .) 2 -}} - {{- $ephemeral_storage = index . 1 -}} - {{- end -}} - - {{- $pod_resources := (include "helm_lib_resources_management_original_pod_resources" $configuration | fromYaml) -}} - {{- if not (hasKey $pod_resources "requests") -}} - {{- $_ := set $pod_resources "requests" (dict) -}} - {{- end -}} - {{- $_ := set $pod_resources.requests "ephemeral-storage" $ephemeral_storage -}} - - {{- $pod_resources | toYaml -}} -{{- end -}} - - -{{- /* Usage: {{ include "helm_lib_resources_management_original_pod_resources" }} */ -}} -{{- /* returns rendered resources section based on configuration if it is present */ -}} -{{- define "helm_lib_resources_management_original_pod_resources" -}} - {{- $configuration := . -}} {{- /* VPA resource configuration [example](https://deckhouse.io/documentation/v1/modules/110-istio/configuration.html#parameters-controlplane-resourcesmanagement) */ -}} - - {{- if $configuration -}} - {{- if eq $configuration.mode "Static" -}} -{{- $configuration.static | toYaml -}} - - {{- else if eq $configuration.mode "VPA" -}} - {{- $resources := dict "requests" (dict) "limits" (dict) -}} - - {{- if $configuration.vpa.cpu -}} - {{- if $configuration.vpa.cpu.min -}} - {{- $_ := set $resources.requests "cpu" ($configuration.vpa.cpu.min | toString) -}} - {{- end -}} - {{- if $configuration.vpa.cpu.limitRatio -}} - {{- $cpuLimitMillicores := round (mulf (include "helm_lib_resources_management_cpu_units_to_millicores" $configuration.vpa.cpu.min) $configuration.vpa.cpu.limitRatio) 0 | int64 -}} - {{- $_ := set $resources.limits "cpu" (printf "%dm" $cpuLimitMillicores) -}} - {{- end -}} - {{- end -}} - - {{- if $configuration.vpa.memory -}} - {{- if $configuration.vpa.memory.min -}} - {{- $_ := set $resources.requests "memory" ($configuration.vpa.memory.min | toString) -}} - {{- end -}} - {{- if $configuration.vpa.memory.limitRatio -}} - {{- $memoryLimitBytes := round (mulf (include "helm_lib_resources_management_memory_units_to_bytes" $configuration.vpa.memory.min) $configuration.vpa.memory.limitRatio) 0 | int64 -}} - {{- $_ := set $resources.limits "memory" (printf "%d" $memoryLimitBytes) -}} - {{- end -}} - {{- end -}} -{{- $resources | toYaml -}} - - {{- else -}} - {{- cat "ERROR: unknown resource management mode: " $configuration.mode | fail -}} - {{- end -}} - {{- end -}} -{{- end }} - - -{{- /* Usage: {{ include "helm_lib_resources_management_vpa_spec" (list ) }} */ -}} -{{- /* returns rendered vpa spec based on configuration and target reference */ -}} -{{- define "helm_lib_resources_management_vpa_spec" -}} - {{- $targetAPIVersion := index . 0 -}} {{- /* Target API version */ -}} - {{- $targetKind := index . 1 -}} {{- /* Target Kind */ -}} - {{- $targetName := index . 2 -}} {{- /* Target Name */ -}} - {{- $targetContainer := index . 3 -}} {{- /* Target container name */ -}} - {{- $configuration := index . 4 -}} {{- /* VPA resource configuration [example](https://deckhouse.io/documentation/v1/modules/110-istio/configuration.html#parameters-controlplane-resourcesmanagement) */ -}} - -targetRef: - apiVersion: {{ $targetAPIVersion }} - kind: {{ $targetKind }} - name: {{ $targetName }} - {{- if eq ($configuration.mode) "VPA" }} -updatePolicy: - updateMode: {{ $configuration.vpa.mode | quote }} -resourcePolicy: - containerPolicies: - - containerName: {{ $targetContainer }} - maxAllowed: - cpu: {{ $configuration.vpa.cpu.max | quote }} - memory: {{ $configuration.vpa.memory.max | quote }} - minAllowed: - cpu: {{ $configuration.vpa.cpu.min | quote }} - memory: {{ $configuration.vpa.memory.min | quote }} - controlledValues: RequestsAndLimits - {{- else }} -updatePolicy: - updateMode: "Off" - {{- end }} -{{- end }} - - -{{- /* Usage: {{ include "helm_lib_resources_management_cpu_units_to_millicores" }} */ -}} -{{- /* helper for converting cpu units to millicores */ -}} -{{- define "helm_lib_resources_management_cpu_units_to_millicores" -}} - {{- $units := . | toString -}} - {{- if hasSuffix "m" $units -}} - {{- trimSuffix "m" $units -}} - {{- else -}} - {{- atoi $units | mul 1000 -}} - {{- end }} -{{- end }} - - -{{- /* Usage: {{ include "helm_lib_resources_management_memory_units_to_bytes" }} */ -}} -{{- /* helper for converting memory units to bytes */ -}} -{{- define "helm_lib_resources_management_memory_units_to_bytes" }} - {{- $units := . | toString -}} - {{- if hasSuffix "k" $units -}} - {{- trimSuffix "k" $units | atoi | mul 1000 -}} - {{- else if hasSuffix "M" $units -}} - {{- trimSuffix "M" $units | atoi | mul 1000000 -}} - {{- else if hasSuffix "G" $units -}} - {{- trimSuffix "G" $units | atoi | mul 1000000000 -}} - {{- else if hasSuffix "T" $units -}} - {{- trimSuffix "T" $units | atoi | mul 1000000000000 -}} - {{- else if hasSuffix "P" $units -}} - {{- trimSuffix "P" $units | atoi | mul 1000000000000000 -}} - {{- else if hasSuffix "E" $units -}} - {{- trimSuffix "E" $units | atoi | mul 1000000000000000000 -}} - {{- else if hasSuffix "Ki" $units -}} - {{- trimSuffix "Ki" $units | atoi | mul 1024 -}} - {{- else if hasSuffix "Mi" $units -}} - {{- trimSuffix "Mi" $units | atoi | mul 1024 | mul 1024 -}} - {{- else if hasSuffix "Gi" $units -}} - {{- trimSuffix "Gi" $units | atoi | mul 1024 | mul 1024 | mul 1024 -}} - {{- else if hasSuffix "Ti" $units -}} - {{- trimSuffix "Ti" $units | atoi | mul 1024 | mul 1024 | mul 1024 | mul 1024 -}} - {{- else if hasSuffix "Pi" $units -}} - {{- trimSuffix "Pi" $units | atoi | mul 1024 | mul 1024 | mul 1024 | mul 1024 | mul 1024 -}} - {{- else if hasSuffix "Ei" $units -}} - {{- trimSuffix "Ei" $units | atoi | mul 1024 | mul 1024 | mul 1024 | mul 1024 | mul 1024 | mul 1024 -}} - {{- else if regexMatch "^[0-9]+$" $units -}} - {{- $units -}} - {{- else -}} - {{- cat "ERROR: unknown memory format:" $units | fail -}} - {{- end }} -{{- end }} - -{{- /* Usage: {{ include "helm_lib_vpa_kube_rbac_proxy_resources" . }} */ -}} -{{- /* helper for VPA resources for kube_rbac_proxy */ -}} -{{- define "helm_lib_vpa_kube_rbac_proxy_resources" }} -{{- /* Template context with .Values, .Chart, etc */ -}} -- containerName: kube-rbac-proxy - minAllowed: - {{- include "helm_lib_container_kube_rbac_proxy_resources" . | nindent 4 }} - maxAllowed: - cpu: 20m - memory: 25Mi -{{- end }} - -{{- /* Usage: {{ include "helm_lib_container_kube_rbac_proxy_resources" . }} */ -}} -{{- /* helper for container resources for kube_rbac_proxy */ -}} -{{- define "helm_lib_container_kube_rbac_proxy_resources" }} -{{- /* Template context with .Values, .Chart, etc */ -}} -cpu: 10m -memory: 25Mi -{{- end }} diff --git a/charts/helm_lib/templates/_spec_for_high_availability.tpl b/charts/helm_lib/templates/_spec_for_high_availability.tpl deleted file mode 100644 index 8bfbf9e..0000000 --- a/charts/helm_lib/templates/_spec_for_high_availability.tpl +++ /dev/null @@ -1,138 +0,0 @@ -{{- /* Usage: {{ include "helm_lib_pod_anti_affinity_for_ha" (list . (dict "app" "test")) }} */ -}} -{{- /* returns pod affinity spec */ -}} -{{- define "helm_lib_pod_anti_affinity_for_ha" }} -{{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} -{{- $labels := index . 1 }} {{- /* Match labels for podAntiAffinity label selector */ -}} - {{- if (include "helm_lib_ha_enabled" $context) }} -affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchLabels: - {{- range $key, $value := $labels }} - {{ $key }}: {{ $value | quote }} - {{- end }} - topologyKey: kubernetes.io/hostname - {{- end }} -{{- end }} - -{{- /* Usage: {{ include "helm_lib_deployment_on_master_strategy_and_replicas_for_ha" }} */ -}} -{{- /* returns deployment strategy and replicas for ha components running on master nodes */ -}} -{{- define "helm_lib_deployment_on_master_strategy_and_replicas_for_ha" }} -{{- /* Template context with .Values, .Chart, etc */ -}} - {{- if (include "helm_lib_ha_enabled" .) }} - {{- if gt (index .Values.global.discovery "clusterMasterCount" | int) 0 }} -replicas: {{ index .Values.global.discovery "clusterMasterCount" }} -strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 0 - {{- if gt (index .Values.global.discovery "clusterMasterCount" | int) 2 }} - maxUnavailable: 2 - {{- else }} - maxUnavailable: 1 - {{- end }} - {{- else if gt (index .Values.global.discovery.d8SpecificNodeCountByRole "master" | int) 0 }} -replicas: {{ index .Values.global.discovery.d8SpecificNodeCountByRole "master" }} -strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 0 - {{- if gt (index .Values.global.discovery.d8SpecificNodeCountByRole "master" | int) 2 }} - maxUnavailable: 2 - {{- else }} - maxUnavailable: 1 - {{- end }} - {{- else }} -replicas: 2 -strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 0 - maxUnavailable: 1 - {{- end }} - {{- else }} -replicas: 1 -strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 0 - maxUnavailable: 1 - {{- end }} -{{- end }} - -{{- /* Usage: {{ include "helm_lib_deployment_on_master_custom_strategy_and_replicas_for_ha" (list . (dict "strategy" "strategy_type")) }} */ -}} -{{- /* returns deployment with custom strategy and replicas for ha components running on master nodes */ -}} -{{- define "helm_lib_deployment_on_master_custom_strategy_and_replicas_for_ha" }} -{{- $context := index . 0 }} -{{- $optionalArgs := dict }} -{{- $strategy := "RollingUpdate" }} -{{- if ge (len .) 2 }} - {{- $optionalArgs = index . 1 }} -{{- end }} -{{- if hasKey $optionalArgs "strategy" }} - {{- $strategy = $optionalArgs.strategy }} -{{- end }} -{{- /* Template context with .Values, .Chart, etc */ -}} - {{- if (include "helm_lib_ha_enabled" $context) }} - {{- if gt (index $context.Values.global.discovery "clusterMasterCount" | int) 0 }} -replicas: {{ index $context.Values.global.discovery "clusterMasterCount" }} -strategy: - type: {{ $strategy }} - {{- if eq $strategy "RollingUpdate" }} - rollingUpdate: - maxSurge: 0 - {{- if gt (index $context.Values.global.discovery "clusterMasterCount" | int) 2 }} - maxUnavailable: 2 - {{- else }} - maxUnavailable: 1 - {{- end }} - {{- end }} - {{- else if gt (index $context.Values.global.discovery.d8SpecificNodeCountByRole "master" | int) 0 }} -replicas: {{ index $context.Values.global.discovery.d8SpecificNodeCountByRole "master" }} -strategy: - type: {{ $strategy }} - {{- if eq $strategy "RollingUpdate" }} - rollingUpdate: - maxSurge: 0 - {{- if gt (index $context.Values.global.discovery.d8SpecificNodeCountByRole "master" | int) 2 }} - maxUnavailable: 2 - {{- else }} - maxUnavailable: 1 - {{- end }} - {{- end }} - {{- else }} -replicas: 2 -strategy: - type: {{ $strategy }} - {{- if eq $strategy "RollingUpdate" }} - rollingUpdate: - maxSurge: 0 - maxUnavailable: 1 - {{- end }} - {{- end }} - {{- else }} -replicas: 1 -strategy: - type: {{ $strategy }} - {{- if eq $strategy "RollingUpdate" }} - rollingUpdate: - maxSurge: 0 - maxUnavailable: 1 - {{- end }} - {{- end }} -{{- end }} - -{{- /* Usage: {{ include "helm_lib_deployment_strategy_and_replicas_for_ha" }} */ -}} -{{- /* returns deployment strategy and replicas for ha components running not on master nodes */ -}} -{{- define "helm_lib_deployment_strategy_and_replicas_for_ha" }} -{{- /* Template context with .Values, .Chart, etc */ -}} -replicas: {{ include "helm_lib_is_ha_to_value" (list . 2 1) }} -{{- if (include "helm_lib_ha_enabled" .) }} -strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 0 - maxUnavailable: 1 -{{- end }} -{{- end }}