From fab135ba057d2615817765dc72812e58126da340 Mon Sep 17 00:00:00 2001 From: Aleksandr Zimin Date: Wed, 25 Sep 2024 15:04:00 +0300 Subject: [PATCH] [controller] Fix CSI NFS v3(tcp) support (#37) Signed-off-by: Aleksandr Zimin --- .werf/bundle.yaml | 2 +- charts/deckhouse_lib_helm-1.22.0.tgz | Bin 24121 -> 0 bytes charts/helm_lib/Chart.yaml | 5 + charts/helm_lib/LICENSE | 201 +++ charts/helm_lib/README.md | 1167 +++++++++++++++++ .../templates/_api_version_and_kind.tpl | 36 + charts/helm_lib/templates/_csi_controller.tpl | 763 +++++++++++ charts/helm_lib/templates/_csi_node.tpl | 206 +++ .../templates/_enable_ds_eviction.tpl | 6 + charts/helm_lib/templates/_envs_for_proxy.tpl | 30 + .../helm_lib/templates/_high_availability.tpl | 39 + .../helm_lib/templates/_kube_rbac_proxy.tpl | 21 + .../templates/_module_documentation_uri.tpl | 15 + .../templates/_module_ephemeral_storage.tpl | 15 + .../_module_generate_common_name.tpl | 13 + charts/helm_lib/templates/_module_https.tpl | 160 +++ charts/helm_lib/templates/_module_image.tpl | 76 ++ .../templates/_module_ingress_class.tpl | 13 + .../templates/_module_init_container.tpl | 56 + charts/helm_lib/templates/_module_labels.tpl | 15 + charts/helm_lib/templates/_module_name.tpl | 11 + .../templates/_module_public_domain.tpl | 11 + .../templates/_module_security_context.tpl | 199 +++ .../templates/_module_storage_class.tpl | 38 + .../_monitoring_grafana_dashboards.tpl | 68 + .../_monitoring_prometheus_rules.tpl | 96 ++ charts/helm_lib/templates/_node_affinity.tpl | 256 ++++ .../templates/_pod_disruption_budget.tpl | 6 + charts/helm_lib/templates/_priority_class.tpl | 9 + .../templates/_resources_management.tpl | 160 +++ .../templates/_spec_for_high_availability.tpl | 138 ++ images/csi-nfs/werf.inc.yaml | 13 +- images/wait-rpcbind/src/cmd/main.go | 70 + images/wait-rpcbind/src/go.mod | 3 + images/wait-rpcbind/src/go.sum | 0 images/wait-rpcbind/werf.inc.yaml | 36 + templates/csi/controller.yaml | 61 + 37 files changed, 4007 insertions(+), 7 deletions(-) delete mode 100644 charts/deckhouse_lib_helm-1.22.0.tgz create mode 100644 charts/helm_lib/Chart.yaml create mode 100644 charts/helm_lib/LICENSE create mode 100644 charts/helm_lib/README.md create mode 100644 charts/helm_lib/templates/_api_version_and_kind.tpl create mode 100644 charts/helm_lib/templates/_csi_controller.tpl create mode 100644 charts/helm_lib/templates/_csi_node.tpl create mode 100644 charts/helm_lib/templates/_enable_ds_eviction.tpl create mode 100644 charts/helm_lib/templates/_envs_for_proxy.tpl create mode 100644 charts/helm_lib/templates/_high_availability.tpl create mode 100644 charts/helm_lib/templates/_kube_rbac_proxy.tpl create mode 100644 charts/helm_lib/templates/_module_documentation_uri.tpl create mode 100644 charts/helm_lib/templates/_module_ephemeral_storage.tpl create mode 100644 charts/helm_lib/templates/_module_generate_common_name.tpl create mode 100644 charts/helm_lib/templates/_module_https.tpl create mode 100644 charts/helm_lib/templates/_module_image.tpl create mode 100644 charts/helm_lib/templates/_module_ingress_class.tpl create mode 100644 charts/helm_lib/templates/_module_init_container.tpl create mode 100644 charts/helm_lib/templates/_module_labels.tpl create mode 100644 charts/helm_lib/templates/_module_name.tpl create mode 100644 charts/helm_lib/templates/_module_public_domain.tpl create mode 100644 charts/helm_lib/templates/_module_security_context.tpl create mode 100644 charts/helm_lib/templates/_module_storage_class.tpl create mode 100644 charts/helm_lib/templates/_monitoring_grafana_dashboards.tpl create mode 100644 charts/helm_lib/templates/_monitoring_prometheus_rules.tpl create mode 100644 charts/helm_lib/templates/_node_affinity.tpl create mode 100644 charts/helm_lib/templates/_pod_disruption_budget.tpl create mode 100644 charts/helm_lib/templates/_priority_class.tpl create mode 100644 charts/helm_lib/templates/_resources_management.tpl create mode 100644 charts/helm_lib/templates/_spec_for_high_availability.tpl create mode 100644 images/wait-rpcbind/src/cmd/main.go create mode 100644 images/wait-rpcbind/src/go.mod create mode 100644 images/wait-rpcbind/src/go.sum create mode 100644 images/wait-rpcbind/werf.inc.yaml diff --git a/.werf/bundle.yaml b/.werf/bundle.yaml index dbeaadf..caa6e06 100644 --- a/.werf/bundle.yaml +++ b/.werf/bundle.yaml @@ -2,7 +2,7 @@ --- image: bundle from: registry.deckhouse.io/base_images/scratch@sha256:b054705fcc9f2205777d80a558d920c0b4209efdc3163c22b5bfcb5dda1db5fc -fromCacheVersion: "2024-05-14.1" +fromCacheVersion: "2024-09-22.1" import: # Rendering .werf/images-digests.yaml is required! - image: images-digests diff --git a/charts/deckhouse_lib_helm-1.22.0.tgz b/charts/deckhouse_lib_helm-1.22.0.tgz deleted file mode 100644 index 7a6b077dc75833f62190350aa20b469f08b953f1..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 24121 zcmV)$K#sp3iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0POwyb{jXcD2(sF^%R(PW{s4eNL_rJ(HUp`6iG>RV$1p@C)u+y z`8r@XNMhUsIsjTS$M#z1AtZsDOP^c;Zg+ffCw^N=; z5+-yMPDwJ`JDFmkhI2ei{%bwI{r&y@XHTBM|L*VaSO0ha@Zj*j4xT(a+<*M!@w2DT z|7-u?>HhxX|3dp~!r%GJq{8CA_V0|V%G~edhg13^5t4Ftgl-PEVj?3!Qw4v2N0J%J z6ip;jWR@ma5fqa#WmLbHXv_sVb^3#5JkAm#hg%HK$Pub5)|Q&57=i;^rRDA1!8hHrVehBM6Qm`Ei9w4G3?&=7qQaWTl?b z@J#uL8s2){`fPu{q)g8CGytl;>VRT1k0-Vz~OB;?+D zunzW{3#9J^I@0Thh1_}((3xlqT~Md*Zsfx zX8mn8B7zY`oDb6u;q09vg5l({_#&tiHhhKu#YNL|%DC8R9;Ugytb128!3iTin{gIW z-7sW49Ala|;&PwZ$jpw8kL?5UYXW+;?Kvp2KK59 zl(_SZT~7|Li!biPWfk)pIBjC4#BC`8Ucm25zwMnktz%sSug$FZ+|qG_NdT(y_uDO| zj+n^om01fxAJ7y_6xaYT+#{MUhg@0c)4eiwO5 z;Id832_BI|)&#p9(@3EJr)f}++Jjpz-X-?xiwi*N&x{R)2+b%vP7;1g;v@T{BKwxv zbT0HlNPl%2iqH(dt3ieN<>CG;e^8odHWTd3dv9u+77#W;svD%0xtoPrXT-Ma%}2x9 z!=~7M35~EcLK4KdnD3}mT+Cn68C6H|B@1hRvfv#oML$?$e6xEL6q<;9)Qn`i5LX! zvIfA6afM+k%Nt+-!c2Y7 zCq(Q?Ed{f=8tnMvUrzDi(`Pc9`P_M?({-KxO}SJTMCp*~2o@IY^O#8+n4ps+({a={ zR7mv`RnzaxC$=F($d_4?Tmv~d`vX+jyBi2Hp;C$YR)bB;RWucp3##T}lwhfKRAp&G z3hn|qmx{~=ks)dj2?`Nx;4A2}qGOt|Fdmc8X=DQu7db8iQ}KidqXG>OF`ExGRvo@l zH63IOwmxw}|4rgLBIm!CnHlII%f@cau$@qA1yUY|l0=!2w!ssMj43)JpE(6EUz zl1Oq#EFqR*CW#1h{b<8g=&d#);)X`#IEr}2lyRYvr1ov@TWd<_g}%)`wLbl`pc;rL zI1V{W=AqzRg=3l!qmyL@Jm+f%iLpGj$>0a{TgDafn`1HY%*X%*gMl&jo!+`93{ zk3qTp&5Ng%Ct5vl919}li!Zj1PfxGTuCI3jZ=PD+fbb{+2xEd(Cdgod6_GFA*w!z! z)u`Z-O3+9R96*PptT)|IVLKxKkkzTNDmoZT?G#>+cj`%niiBWox?z}8&YB3VG#TU` z_Qe<57ss#8t}l;I&UPvvnc+8xaEc?U=2bb{#{+)Lh!A8vNXQLIUL5+O?%1oT@(E1` z#^DW|gUfkolg=$Hnh(@etE;T4jayRp)rPPeU+2ugv1*b(N9aadq9e2yNvi*UD0%d@ z_Sxm@(@=}A`rS8z&yKu@2#qO8;(P{P{7Shb2bGubk#>(qxyK)B#5FqdF1%+#K!x(Q zH{K$AUBp^|L=9ppJm53k*Z|%u3|z5jAbm0g`7I+-$ujAk_Kl=dG9v;fp^nq=goFv7 z$WXhc5EL#z2m78iJ2>>>$}wVGq3z|o)53MDR@(coTliF#28ENgTU7YePN2MazPtyh zZe!lb{CkZyWicD9QFW(rQ>N&_1pEO^K+na%*75IwY+dRry2HNz)JCGT1GT)3sAMVp zK1_u4Nq;a652j(EY3R4U-or9<7>xE+bg!d|HlNyX)HZdOHy#bCNxu&RQi?Gel87E` z$@*={AIO^Y-_KgsqPR{d?KgdDOVN-N(a%=&8tGG|(g9&{$|+MXzS#cm_4S+Z{Bq~W zM_r_eZE9#*w5tzHZ|q5hRVIg1E|mxI!G+&x&@HnCyKstMY?Q2N5qtb>%^#}T4t`5idGw}c>`w_!)b!uwS6ryFefEvyCajJ<5AqEc z2s4ziw~XI1BnXzAp_}V;N(4dWEn#%a*zY1sT|y6aeK8c8k8EH#9>JEPpPcb|BF z_~+PGILIbOIMOa~xkGE_tA;eFJpbvsv^Cw3&SUItErsVUsXN0Zb9S~Kp%=w(>rrW6 zy!!4MhA22Md9=4Tp=z3qh7q6b70K3m9VM)MUoyBk~wOkc(alh+J+u&4fG`c zTfwtb9-*Iu;Fm4m7oeYmRC6sAVai${XmUfu2wqQ!3U+nCEa87|v5KbpA7*!0|0^a5 zQ6%_fc~nt?>8vL{lhE7;i%C-I1GWatx-{F{4WP|?NEGTNs2=2!8^Ws8c1YXGVHX8y z3lDZZVYrAH+ugQ#2RG|N0Y0O~Yd59^2qH-tkJr@|{XsoK$5BM2M2cI-ZT5?1nmdd$$Nr|{X3Bi&`|5!R2VM$`d z+14X;tB1B8i$uYvzt%S=)I24>4$)Z-6bpi4k_r-GMPfu58si%-G(|4~S#1P2_#p?a zajfQ^$PHTS^-CVfda0VFjW`!EWq!BU@f)eE0r?|zsV$q7d6l1&>+@@4u}*BJ97xQ! z(J=MYeWrUb%|;28Q*Cx0X&G8`hg_Z=qHN5?%9u& zd-evUo)|_X;kUrGWmwDQ7AJ2t&shp=L-wGY(iBBgOtmgH3vZ|~7!k^BJf;!VgF?5B z^8*LyhGHGjE3C*kORkAR+qt~KZBB?nmptA6x-zN%8l2*2 zOwDue^PL`=p7OXs;x(K5#}!y6SxNF^*gYHoAzWS7q&icI;6E3ke-_?-$stiV@vTRBZms`pdB1L<{7&3@kx%^l_3ABtZ;i{! zePB1v6;^`ONM*NE-u&9}=iv75MOi<4uU|;v^KkkFJr6$rzI^^?BJ>4t-*_xHUjlH!W71y!KY!cyX?w~4{B7H(on`+02HgO2wfD8Z7;xJx#fTs>fCy zik>g7zv}8m_AGZ!^l&mCt*_)cCNs{i$)~S)uK606F)_#kirzJo7ltFNmQQ}VRJCX5 zoTX^qFo~4{&(%)X(lL}Tt`z9XPT??3FGA=X~>|H8|$z841 zMi?NT5`neM&^fETMCdJ<9|4k*vD(wpueF7$3^fEA#ff%kXYQNV}P~x7s^`k85gBc78rd9n_SLqJE+R%Z9a;sw*#737K&l zS}cK~Z*gJ4c~cEz1NzRTuiNVlH#)1$m2?R6BT1CVFcv%wagr?Z7^NZ)jnQVmS}=?1 zK%HElhi4b3m#@z+-c(D(=pZ~HDi;!*s7SGzzW8GM^y>V_v#apx?A!4A^~v|)*02niZG=2EEQ1{N%VTG{Zqf$J(NFy(UI_p>{0mOp6VW~ z5_&GIa-)IfD4n4=F>rhV7UgD2CayH}ixr=iab7?3UtS3*S~WH4Dvi;=VKcI2s<`Cs zm&Ckim^fS2uIv@NP-`W4iYM4yh#q`RO<@P1xo#U)8k8})p%Ll$C?+>8WgMCpmRbee zyZXszU;pGj&AKzPc|E(8}M5bY7tTe*v?!=PCXkH8~HPivCi=xiQ7hGKm zBK_Dr-_8xe{uY3QOup1eUxd>Ci-_2Lu1@7Me-G6-ee80T^dw8&a`1E1_ z_db3-He1U|P_M(Z_a!=xWAxpdH<#h%)$9NM$1eQ)+WY}Wk1t-^KM1>_f-`f#84IfY zwK-y*`;iLhn52Zo5^;up1_F>IN>MhEzihiS)Y3Xt%%e=h2V1*$b5Ojs*LuOlH6~z~ zs#)?V#RAWWB0>&~=aBX(Hu)ZKFFVC5BEbM@HDXXXAP^9s;C=j*WOm!?NH zfu+$>-%(JqQBv1y6P4_gm0X*!>UcV&^#$Xm`Oynxwt^21pAYwk`@@3(1qaXmHavX# zWN804Sc)S1@RZLmWy|rx|CJke}Nxiziz0ct1;kO|Eo6^ZNw0EkS>RGFVfQ#b4Cr_VL z05O}Z`s;1;dBwteiA1#>DLf-dge3{JCHAt2cDxiYb9wIfWM0J>=>9qO zhJBFNuyy{d^ue&&K4%g{=Kg>_&fhRzykM~>GHB+}*67yy(Aew`*H3FdyhZk0;gOZ# z$z_5WIhWtTkT`ZD;%-#gzq+z&O-5H;fu=aL%cubwb_{MPJ8aZ<7u`;2G}QxJ!BR|& zMsqabd5Q(X62aY|odep(youS=A8K^jfGuEL*{+aEP&Nrl0n{fQR4b9Vsj;*)F_j@S z_=Cor-SOYsY($`r_MH|07sP)DPoExCamlC3imFVF~Y-0 zs3Y{j8oD-PFs4zl#NnZu@UVRa#OHGeMVg1Pkr|lV=tC|9Jn&lLz~MAHN>I8vIYUx6ja zB-l&1?8#dPiZZGAEKe=oj)+i$8D@AwM0cK6C-wIgy=!a>qjw_>+o-ZQgKJ!w-JF>_1F~SFZup zZT}CR9UNBkKlYzIeOUjwmtTMT?@!ko!boG?k!cKTIi|5$N(m4bc2T7}tD^x~^8)!= zQft4M@tAn)A@{OHTr#O`Tf|0EmEF+B#wPm`1v5CGUA}AB@b{weiy^%8F_f>dFMZ#= zJmkSEReBn<=JR=&)`rKQE)@bMzoFoiN}E^kMTuz*uW9oc@N{eh*Jop2m}J^QVHy%E zycXts`&jT990*xZsjU2E$8fl3^{tK`M->t3l?l!4S^RS;GgD8cKGr^?G2rWr`6@Um zcnO+r#fQ^~og{hE2zE*!43G#b6#U(M`jw^1`^F_Wcp{_{%`l5GTrUoHk5)bh((MI^ zilY(_AJ7=nq{d2-{7_=AgEOB<6x65;8d&YtjFukimPL&Ze;9w>Lash(Ais@thr5$P z-N2ZVxJFTXzKdr#Axq|qnwMDKR#!&w!qL@BSNdS@r#pRw;l{b8+}5uv{7RXX-~^_t zCw^{0@R}v_bN0j4d9brn!VNwA1AEK(EklLaj-0nD^<6W0n8l`&OL-Lb)f%=PoG3wuI*DN-lcOD#F!lN>bncP1JqbW`j!X_k? zJh{<>y*8Rw@1hPY8|*g|Tir=KmB8HjB*8O9o<0tAOvbZ#oM557PfRCN;e;psdy zTSE&|l99c{C^Q=(kkHeWr)*jqasO<$pFA8JEIt5$2L`2wai>BkWiAtcO4Yy1t88m$t#xkbv%Pm(d@z6d?8q%Tuk}a;evo&TUHjlvB}FB2Buyn{axIP zRPD}FtT5E{`QMUvY;~?=*nGj{wydB1$|p57lVudYw>>E7!F||(?vZ@(2}g3%GF2PN zgU<78z08AYU8JMdeL>KHx^*QH)>{0Pn^`6m8WB_@Mf?3$rvEd~$^B7(z4rg1I^d@E z|M#CiKX_W(|KC4+*#EzeUw_X8O5i7a<@urmZG<{gzTn&5{>NfkcrNbF9;bBGL)qDU zKuXZragw0mpKxc9LzdUjEU{CH=^V5bBDc~?_e48?!t|W=F=|Az436zQCWd3`j-S`5 zsZ^LR(AT&kLti3u=|BrrfAVK9Kf;wmD8G;GG)e z6q`gvA9Cw$CEj#)T^tKOv!@i6*pM&N@H;e+cefsakwI`Dpjo?|Jq7_rcT059>eo@mpfzQQp7r$ft6< zd^(QY!y0tw|1WyNtvci@278eziwedyq{~)wV62d8&)?Y z7S#ZBcBm6wck*o;`iHH8&+pgM{!>+4a=5euSYZF39voKBe;+bj72$*F2%svJkyoj<0uNH08G}WPHTqd1x+L@&aV@0D|Mr*x0`Z%hneJz!C`( zWkS*$lFWfUxU3U$>tlNr5GB&fyD=F1`KiT>^eABM-kVRngbo)Qn_LWcPnX6ruwr@t zzWf;gE3OAyYF6#t3!9{rt>FVKMoSLoT(r;nc;!GF=7nx%Vn zqJm$xTJA;^89SC2oLzCQj!ZS-;`tAfh$FOLJor}dEHzK67X%Kx1eBUY$~W&d)3{Z; z;;eePS!bfkg8D3#%b`|WByQ5T!qor%$4;G>|A681p)IVYFKv2YIX+klJ2vQtLGP@yA ztw}0@X;I;CsXCdT#$cyM z_Tj=?&2xiQR#IDH)?SU9-!Xl5b#eAGJb8U_{pRY}U5o8qp;MP*DT{t%e9e`Jc(HT{!`4;ricUE&uE3ljjffzx(+0cZ%f%>mk~XX{2MAG!0Oo^8J{U zGs2X8MA;F|rW_8|kkk1KO@Y~Ed&i!JR(Dl%RxWXJKzp4G<@UP&xT_*rPd#iAZdalf`UPSf-pcIP|g$j zfHJ12N=Wsv>8I|Jd;Rqq|E1EB>)-!9d|bW%;qc(#Vf^3AuYdg4SYLFh!ms(g4~^Fe zz|scXql?DB#jH;#SRtt%5yJ1YtLEzJ2}SOEn)u`EpeJts)c7b*x%oW|8%&7OCDdBw=0Tz;1U+UFL`VX zvpvwPQNg~_MDQ%_5NAObPBM3(kk#IjFZ2sk&yS-NPR_E{Y=~;xv_tMp+J)})^u7_Y9UFU(j_s)9q z^zqYbXTh^g_szYHL{GZ+HW<6O{Cv9DACH^tbHTaVQ19-qrMnD)o9!5vN>WKADW{RF zw*wTNkXl^1-+pOnUIjk2q)$O#;$%@&?#P~jLkIVx0epbS&qV}UcXaJD|68z z_BNW_cv!o%1;Me&#L$B}g!H<(RAgo>u_TZPvqq_Fgyvp0jSv+G!AfyBm25t|K6|Ng zLz)s+bVL)X=6CCrzTB?ev=JP?X31Qewr_Hzx%XMr>v}kXEX<*8n{bnm8xe`i>b>4#Bpr?F+kV0Uwq3OzTVT%aF&go;E{p|Fb#%2<-!2`C;3O$2JJM)V z68EakyiO)RGZ)ol0yMGC1{}Y9`N=gS#4HYR90#b#D>QZNzdwKZGC+YgRF`kAj!(`y z6A9N8zU+cBIsE}E&u8xH>5`7!t7;WeTE`Z}OD$hMZsh0FXrXgXX^fS`N z`%$^iPqF@Rnse99&`lVzT~H~1@AUk1W194NZmO=bf7-VEe6Jq)KKB3n<$u_dK%1%m z^7zS&_P8jR|BUYo43v(dG zFO*}C`;vDlW|DFSRrW(Z9w)l{j$YVx`vRgpuHqdwfLrJx@Pdn~2JUX70seOe*I88_ z&#~sT{`^L!Q_}RoO%w;^B9rcN$DD+I7bcbpA}(P41^9_Y=V-iYV%^~UQ$nGZm?Wy) zJAoY<#%`A`s+*+mfEuqsXu4;k;p<{_l%?H= z>GDk>-i8OF*rafLtFTTdq+b44inOtim%Ym zQ6>ao@YgRLQ(rw}Ra1g;90P-c*==UQXCBzS3KS0sqS9_o;{^TB|M|aq&Ktw@IVTkE zCZ6*QMVRT=h?+&`6bnUhlFZSBFe0#`Y*G-^9g6mr(V~cS4aZZom`F?n&v#YmZg})YkThE@NJom(6$fd z1CnV%6)aK(dja}@62f-S!49g4t_sCr?*n4Ylh{;-l?50a#|LHTJ0ATu{!Ou(?pimQ z`+itu7=D}Zk*$bal1#Aoztq5Xu*Ut&<)E z9e^~Sr3W50`u_%j|72Ku62g;i1Tvu!spIJ(7*n2o5q$5eu+m8~@2qU;n;jbyH5hwI z*(4!_9jjjfSVHbP-&38PwyDDxG8>&zA@j*ybpq%QfSU5Pj{r9W$}-Zxu0igtgP{C@ zqwWR5X{ssDpVkkt{a}ioxIQXf>uFTb`5w#o;YQYCsW(ZQjXGBd&CI^uo zVmqz_*4N=drz9J6bJ_lHGZaG<6di1qkpg2R0`x`xrZE&W7w=+ZKo@$_+3j^YdW2ZT zdKeqODpe)wE<+xXw~ARHpA6)2RGq*;Tu*AKS0rzb|3-8pEAZ)!SOjD?{$; z)^Cm4FA$>j)rXbgkO7t#L#k0$q?{}-JR3OLN&e;a7Q`QL+QwfX6_`5t$mt6Y!pu0MtmRr+3?^E2G4uwPoX<)8> z+2F8D=asphuyN6#X)&PU$44k&F!)IqjEYuHj~Wc5WQUMLm@ z!t0Z(ah-c7H;trHs(4KI3?#y5pjbP^a0tO5%hQ;LZ1%2 z{~aDS;GSj4+6aI<3m4Gvc+)gIUQEN2P1EpX$E~gGeW|tO602y6$h%Y!XLD|#yJMSARqmc{TXzrF>F0-8>81sWD$5JJ$o&E ztDP=vgYA?@aP8~iS#hr#@^6{nZfp7hDSi!g;dUDL>`I1BdnsGEvI6YN?Y(=5?ME?* z;ST%w%6+ZD3`Kdj-sj0{KlFDdYdffVqOYykMB9k=?}CP&4R-9-W#ux*+SX{9{6K4t zr?K0AmOGHp_xfUc2W@Z9@Vjk|O&T;H)<3<_j)e=;29G3Rs@iBLs4}1tHC!}V+SzT} z?5$YG^55;ovecLP)@#YmF0>KN^>3c{=dr12P=u;?T@^3|hYNdL{lnCPE0rRK!QZh$0B7!PKIVcIfcst8_G7gF zgyrqUQ_W&UyU?ihFK$=qXq@P-JfHQJX1$eQXwbdHT_@}JH_u#twVbDVPR_+(iDmQE z6e;NFnFUMc%PEz@VnS3XA(RXioe`d?P?CtV*jG0Drc>48e`Qi3+tOST0kt#%Hli+0 z?X6i0XzQbKchxt?Oq;g70TOebDMOaLT2d|WkjubqQLDw7bv>i~%CbdHcMY+Td;R&x zkJ3*xbj=(b@Aal?taq>fG9Hrb5~z@4BD zW>_jB0#puz%w*F=!5MqY_$|xnM*j@{eDlu$Dv&pqtsRy!Jv}>qWvy#jAlkRxa`86d zIF=|T5Jz#=Q&1(z+{Y!_xg09@XV+a*&ps?@a?f@VX9V%_5u68NE^QLt#m;JBTDT(NqMi)FLCp=^7>-iN= zNQ0=f2CE&DdtahePdj-`27)J~yk-3UeZ$=Nb)RpN#(Zq9K%zVO z=+jo31v*N(fJHM;FLO(=Q+;FU*?CacKZ?3Gszk+1S-(*3^Zs0+AWAX~;uQb_uKKEU z`M8NjBzQ7N6U@j4hn?ei1ySD@i5syD3zuYE)TMYr1THGf^^Um~%)mXk0oqnsnh-Rs z1SD!Y$QUgC;e`I1#P%W2)WDup8l-}c5;BvuyDn-WUkTwoOq^Ga_&h=zn^^tpuIb;qNqVgmuvc z+O#ZbKba5v(w5_BC$G&YduHIMI1TiZ9lA$oLT`vfDG@UY+u72rG)@T|;)lX`b`il; zwqbLmFl9=j?M&K-5zfppf$kwy*b6@}aLN|u+UDAoZLOaP(lS!^zC_2C+M|MQYVKaP zAw|K4Sy`~maW*>EIiqYM zh?D~x)FnjJRI8cL!tE|1)3xkJGVM^TWIGpyf1xYLrR)-yyt(cxNd zp42=g)d09yx>ShFQZ+~BB1U5YC+2bSk@Xb6WC^*ric={7mnGJkh_z5heq%jeQaW*jATY%CQcQsp& zs8T0n_@%S4SfcMr!fGC?C9Sdgbpt1j`jruB3LGjl1sY;0Q>TUfMHxGNb+5cfP?`!< zmG2u&6RFA12fHSXGE*9h#3s&OVmqOEV$!{t;G*%xYtoJLlTB|iI9Yw|3lglY_RATI zxQIC;aUPIZg!_Myay%Ghup7M&LQ(qpWh{g&Zm z3z?J>AlA<-^b~DnkUmp)fMR96kq$3h$l7|++y7Y9kImux=hllkLmTOVwT~okm#JI& zP1BFhP4-Q?ztuVin(GLrw75Me&dHrzoc~3FRfB1CD)_rOQrv`YC}Px`2Ih-Cuoe%2 z3Lfhj#L3Aklp`>a`=%G@d&Dx$Q?!aG%CSv(Q=`x^o+V9~3EA;!Z<(){z9pI-)2Ou}N3c-RsiG-?>ce8sn(hDp0n7zwIqgcDz(K#kZy z5FF2~UEsq0BZG^m;S5bCY7^cyC{&r`l@+QYwTeQOBVfjrVYZ_U&(wgA2QigzJ6g@i zjEnieiKnBb2GplrO5;AwGA0O)rg|dV#VAp?T)Z7*4BudyK4)Go`X&A8DR10*vN)nkO}D+NDV^BJU!SDlc?hze+B(-?&gQU5VT#-PFPvCX|h+ zf`cCkmum1^#zi)3Ycl2{A_K|?LJF5cGPEKBJK;WG;uG|gAXFI43 zF+}e0HKWZdo9FUtuY;;R3K$%Mn#pa8Lrljmoi5&;|DEzUjHwhEoYoIVSv(=j-u}O^ z{^$Oa{c8UA;p4-H`k(jm>oMHYcofE%%s7*z`My=R<#2iWHJagf$aD4Gr%uX{8xv%P zejWAY6Juuh-46vdN9bVx&;KEnef#|ujDJD7x%*?an;*zHB&2&a@ax0NacGZP5H9<*?3c!*?s#Hj)gb5Z}m7ZpHd5At7mCreQ81%1x ziIB^YxIE5jtx)zed533dLVnqvDwWEky}i=ZJ?2rS>43(2HwSxm3wZC~V1GcRGMnaJ zLd;anl1IfAaW0DtcGL$sBL#yywJPstt$k9h^q%*gTSD-Ygc0)XcO!oFOO@L|4O6Y)c&arqadL( zS{YXL`6P&Ik>7p^|{q2TQ5>h;wTa>=H-V=2Ul zW^in!CO5FAA57BfppxQS4>_8WMwa&dHz^KfN}_xcUj!q@^uhz$``-fOVc4jKd}v7xgO&42GE|04KVV4Y`XBE zHkIlIic?h?Kn$j+V(}ij4c-*h6uo|{POcip`;HBtK7QOX z#YQiALZi7R$^88aY=s8gU`36=$TQI#y9JEAKjD$Rw|Y=KzNnC0sEV~eGyLw@Wd9#o zLl>o48$A#?;CHB;$P8e>8n^OcodteZ{c=XxlIX#)u7th*Wq!6RHcPoj=*l|zV-|yJ zk(Kj_U40n59*={&l{Q>1w)?w|mEldplx<3ql$feW5ob37Bw%eA7I6)YxV)nvc%l(Kj?FQYw50O ziI@IvL(%2>#{Won4**-fXIf}lwOigU?3SVh`e4N0EO$H0^kBbQ2>VqB?1kXJT?qc$ zZtx2+yjh6h%|Z+dkz6iBa@hyTLOf>+@tpO6J@NEK`DQW7H_M~!i~Vvj_RBkA?@P$pVnWW=MMx)2Q1Sc~Tq6+tzd!E}{`SlN z?~6v#7W=KHxux|8V=iV`9eE6SQ^*#V*2AOeNz&VFL_#sbQ3xjr{Pop_R3guB`7;1> z8odIl({U|8U0_^()4vw{!g&de#~hm2st29#8>PgUoXv2p8tM^?mGVaoYAh3h|*;bpdKJ~Wjz5TlP|7A*|aLh$GrITrB)97fj zWHI0c`~L@r`_HQPza2h5eAxfLk6#a?kn%XhOwqg$w9yD$)G06B%%F%==C*>Cg}Ri- z$bm8ob)DH3NpT=BI3O4ks||T_LHNSEk_KA=BA zr!2wo#=EE_(8KkJqM3&GZDk<~{0E!Ezhmf#}^*HO0%OTNLrT@)B3Z%`Iz6$)p zvbBn}FUqZl`HMP&jk>o|jRmM+chaJavV{x@bB7ISpC zzyGB5qp4Eq(ca$e?d=c)njsgHy~LoBdypvm=IrX#H9EdHMJKN>PS4+*zrMIe-@Lv; zKU|;fqN}sZtJkMLoao29(CYO3`pwn(*FWed0N`MVPV?)0<L%Cb_=-daNKFOL zCR6k`#BDKVm#kQ&i;Egz5l`oWPNoX+TSf%p0uiRDnj@U4DHpbyid#@^_yVf$QHdr3 zGsp*0MbCN!kO@xE8Gx=4kul96P)`t!0E(l6#Rw;f1p{Zd%_~ZzL2Z-ab`ciD%Zx*# z`L5G{CJg$RHOru|qG6m5aB=?gT zuBhN+b*t4Y&nJ$_E-EDoTQH`&{7kJ^B}kRGoCpOg04)L}m$$4|7!m ziKdv*2)hBI1ZL9YU08*JCyD)Yj4(3d0dTuz1}%&Vn>vi8P?HgevusWXgL0d3nPK00 znH0hNMh`P~XC$T=Vn2`VpSXBiGYYp{yakHE4rxs*h5%)bjeGzY(OI@;I3}nl7h}f1 zXP0&n6!o%&F|{h;+%7ol#<-#p$<3P$Z)1&Hn-!(BZvhE8YAuLu%#ckcHwOrz=u+%% z0Wo*N(0ArKjh#XYr$o>jtmq9v0mvOU;#wdwsA_=5(JTYYy@h0C;0VtTEa;&aYaCkp z1)mvPrBOk5!JSx8PpdEnB!)`5I6;EkQ0Pjn#f&REP7q1(hzs`@7p|NA(PV*XF9&BS zLHZcoPI&@@0=c7-4Sim>$IecTOT&K`RmEqeXDWl4smU!o2f+w3!!#eCB*g+WMau=) zm=QseIZ7yd3xXR_271EqjO@5hhqCfx9D$SA^?YP5)EZH6T?!u;y?&xix%KglJzgCH z`H=PSCnJReF8dci;>BEyVS@AzT%>l_+4*MC~fsQ!%5=Iw#-H|s;u#F zafiK{BuX+M&khAZ1a`a@R=8dUch~7H{6IxpWk9d>eMF`>86!S!4_^9tdlck61$pMa z_V>A2=3@j~-hwk4?do0_;RN*PR_N~-1Roi*(nop}_(CUzptPKnECvh6U+#9gqTF`* zI5_iYLNiSDyc(`bkh{Li%0nSj^;h~PoJyGy?Ls2(k+y~De(m{8w35eKzR-6)Gg8t5 zPuf~;F_lp!!OH{28Q4o3M*ajAuW(J|ofATtSEr8=XELQx#xt4B(F}{XB+iYJj*eW& zMI@atu>F)lAAw*SHBlR@;DRfJkv~?4L462U;_IAkHv$)iJiY+6eVkR0LT#QAAq)u; z5wPT=c?nN32qpO~BTOY4ZNx>&jl0$XuQ&XRAvzqQZ*^Fu(Vpb&yT}S%XU4f&U2UAq zc*D%M$^=JK_#7u{J{Su^b`ceV-0%pB!B)Mwo&T9z`pj&L?CNkZ)p}gBbcH!jvr$5$WUdu8 zP4IlTc#;xfT&;vBHn8yLZGM=a+hPcoYZx2cIoKA{L65x-y2RS({sDSt+m^h=62bLa zHbkO%afTg~8eYBLo8h-)*OXk^L_rn-gS;|v7R9aZ3g_#F=zOgE zKc5RpMU~d+yi*jN*we2QtY3qXvlI92!eQmHwct_?Kwt=xdNUnAnZGGR7$x{tW>jfb z6EZPQ0IQt%A||L<#V!K}KEV(!?Nqyf6BV5^cWk--m_ekfro@C|WleM;lbej%k>VyA z#Tc_L&qYLs#NP4TQ=J@dc@7`g*^AjUeWkwBiAZwM06l$t8tUg(?84)w3bCOKKs5Cf--Ir1G^fFo3w2 zLqMAnq1lA%Az;J_RX8qWBls$#Wue78+GyqdZzq1btAmTzZ_ZE70tB04THbotSscim zm~}sYba^JAVWiX~3;pGRa#K%?1i>-PF$<+5jbe2N6@2kqqXw42Faj*>_K~Xxrdh&` zas_3>3MB+fJ)QDb>Fp=QXoVZ4*F8Wu!m=aYKaZEH$Mf9%v@#dEYQDW_rS`0}F!1 z5WSh&?OIk+Ln{@pzae-qQ|Ww>4=3K_RYxdga_rawi#0E;&F5|d$Fcsm(DNN%BRwdN zbSt4gBVpG_U(&dwIxwHYOd};M&SoxbEoqE1EN1@ay0dE2K)~LW3yp&bR;$p++}5Z> zR@FZvn6`b3MiCXW3J6_D>M+xhfgvWD5hhm7ve>^4H0~?wAZj@WWacP zMSR>q&2BMlToL`|sffQimk%X?r%`*Wc?AKr-Kvro&ZF*#&rB$-^{BKglh0HtGl5cv zJcY@Q-3c&r)glU%L-Yenh?LN2pX5u}HK*CiH_i7w0nsUpRcXd;MF{J9+=Fe4*y93&rNV0d$Z2r|LK>?>909(FI_ z*$};P0f@U&#l_JvC+3<52)Vr-AuV{jp=QDtw~c{kM0yd8)DuE+L!smm{K*BfI&2y{ zrF9hV7OPHnn(EHPfKCX4C5QYL)1{Dbi^UwMp$x@DMuLuPSLBlpI-<SvQ(ozgch4 z-~x=Ko)6I}l`wT8Lbv(}3oVy;=ox5W$aYw=NH9Efz(AUS;=hsfSKb^n%?)49E&`-x#SH~A`&d;vV z>nnd-{`EKL_~IYv`}2#_T|}ta0e%NJ2^E}Buq&~*Oj?W}SSQ8KPR-G+5fvqsaa3$9 zyg7gK@@yAfyuKKmUwm_Qe(~+utFwzYyXe)~)ya3q7jKTgK7V=s<{zL!-<-d>IJ-9K z1IHG|<^OGN59$%r$AFeK6U!NIoYjz70lIXdbOgWPjb{$}6#>@)K>Vnf$@KjJ8 zo&&>Ul)+jl=wD%Rz4cPF+9+iuI?7CY6Ha549mTHH>S;zIdL28>J+Iw33~JG=RA z_ikw^H(&W#sPEe*P>?7l2^~Q|2gFSTmoneCa3~eRk&>`G-aI~x^(?s$F3`wzSwaD^ zT@iq;#WOr9ui@*jT}nWa8~}Ib7mI9^MKsodt=US@0gPGGr8sdworR93Sc`}VgoW8N z*IqpL)iO&|b)pN>%yJu(nJ1Ll&h+f6zhbc6xhL+Z(rhQ(DC~su_?9OA+TmLy6;D$< zA-fP0WSa0Xrb#A@H^Rv{V?}TSPOu>pB;vD~R$gBo1~HL4yP$_~Z**lL&cetS({X%5 zVUu)h(>J7~RtPS+!Gbp<;BP~89BH4RrQj^D#_U~dpm$`(sLIDs*S(aL$A%cFXL_F_w}DJ$&pU>TZ4Acr>@cM#0crOQ4Wx9?ai*+USLiIW0zk z&n`~2Uu{Z*gZIammuDBJ=l^}AyAW0j(lnXd^aVe4Prn0FZu7k)gwUIwAMDyRit=iL z3#&Ozh%mX#W;VB5%;d+EB(X$i~X{wy^EQxi9pVMJy2cFyZ_GTete9jbpmv4l^q}~uP zL_ZOP6UmVvrnOxsbyghO8ohCse898|!pzh;W4ErdZ^_BAU`0XDN%#L@l+m8(5(|d#6p2c2y>=0a{x9 zh`s4jS#x&%Tu`*F8|3MhJO4|Aa8nU&1B~agE9WkPr_9bk!7Ap;lt(w-grARKp$wN+ z>zoc_YxO(Nroo`P52EFteVtk7fOmyUDo*;K4kR&PJRvf|5sa{Qg04n5YT>9_tt!G{M1*z1C3?DBI(+7$ zFLdhfnxG#9tsyoY6_&PF!c0&fWm}sHvf@&hYjcxG8?xG!BVocPGSsd*B=3~K4agUM zQ|+17@AOmvKJJAjZ(U*bTf1q5PT;@+)W2@y*KII`=5Ru&qq+vEeG zHMkAE|GEc+4q}>`RRv_a9Kp?nt%9<80n@G~rv3Ld1XQ8Cc6mDns=V@q(Ujk^kns_Z z=iv=cvc}F|{83vcHhow`Y|A06e%BW#iQa|@W!by%EfI_~D$}BGDzY}!#oAb)Jd16j!x8mTj9^jd|depQHMaDub z!%XI7UYfA?`?96O7Jh9sZ56!c%e&z<&RtK9wVe*fO&z-`s8uP;hr%kf)uU})>fZ=_sCAGC2ko4<{hDTD7S&k*0u#=1}A;l1br*;7&DAcv7C-L z7IB?|iD?qXu1Q#&mXx8;l8_az*YlHV2X=ne8-5k4q->IqqOA|8`mRAjmx9lTnvzVS zt1KaP`J{P+Q0NBDB57|`rMKF$3rfeg<|?gFMgpfK)bS3_lvZ5M;x?F_-#FP^@R%T1 zJ-WVt$`la{Cw207RlG5a~^dg5TC^xG_je$UFU)Pr=%WoXGtNiYiS9z788qmhO*-BTK z`-m2|uG+jM?n+;XsQI&A7~M^)3vsxHy`Z+-F1Qd$%XhtSHr|`J5M$$4ReYV-9r-9a z8&;wAxQNGx-J`iv@avRBus6JTSGVm3kkTk>X;Wor={psCBujtX3ww|1-wTQ80i%PK z6;Ln2wDsr_DsTVmM~_ertGva(wS|u37=8EV&1HCb_4>d6u?zpcHh)0w+{J7A2Vpl< za0V%QH&{Rlx2#+}wS{7m5*ACu8T#2=I3V?5JPhw!x z6@b-8rnK$W)~}7FTFd;~OSOKrUmlAI&?2|C256Zwu^{)_h^mOboC~qFl~>C(H?;(F zA_GLn$VS45N;IXDX)-U$bnTk*!~gSt{%`(qz!kaBA>X?zlrI$H@E6iYJrii2V%_?g(r3yC{LP|HEFo(oJlk zI{_RDOL0Vkbt}+?gKW!~&tDfhbFueU;1HW4@L~)XeqJy$$+Oy4rln?0FsBlM5Skv{+s-YZe8j(j$@Onn_?+R>`Xy1-W@RmOAOKg>;ajH zISGq^Dr7Wb35hObG(ZRY?Ka@d!%7*Nkr6d_H&+eW;uNTLN>rG;%t_o&ig11dFx^RV zIV)>*n;j`(%`$Gv^zz28$ocyD>`WN z$FTl;kaD5N_g5RSnaDyf2^TWonx$E!w&gOk`KMs+%qtY=*e%c&4*n(kg&Z{$>riA~1}g5U)0@*Dz1YwsG8*_lTccGzK$t`}6XS*?bHHKBJend`0ul)*kzQ5kvLtz(Ns_$Q0l}rhQRZ-^{O>n{j#P$)WD> z?1l(iY7SGT?j(*X(Vi&2dV!t{|28~$zJZXZi3LD&tQ?Jdf=r+O#Ke6cmllSu>)-(7mH$M1MiZ@rJI;F99RA+OP7*qKk5o; zAMEe%!++K-<{vZ<+L;Xy`WD#Gf2=4|<8@Y(X+@ZUfwj~ET2J~myhgL?X`%Is4PI*K z1Zw+8*!P-2opk45m$IU(a`mZ&oqLY;h&KnfUd8mlekS7Dka~KI-n)jj^Y*EwE;v_f zk?;Om1*XaRM56JJ(5)sJNg^H9p;U0#DZDa3PYuj<$jPU1!(v+bh@U6B1%mS?E_Oc5 zZ!aChvm9Vs7D?CY%ZjuYGF@6I{mvAwEF2Bq>=tYAr~q%u0H!Lxl=b@TrN#u4JFKXe z@N{S4_2co=DP}8u8xZ@3CHm=vSR80vMQZM{_yWqBBvk;s!yxTGPP!(3O;Su@zTny{ zhi*;M=w{>&66$lDb)9nB^Z@I_&u3_`nh#)h2!3go0e9$lNRUR7x{SR|`ie%@em8yK zPV27UrI>q-TsMH#;4_z_SL&)y(nF5%02S++@V~+L=PzFdD7gN|b$I#a>iFbr{R^2d zH6lK)iecHl-b|0)Z@2vic24Ia>Ly0tu6HShned*UZoKVX(UeI7)vJet70rFxHDnS zGZbNF@^wwzkz%1J+&g5GY&Cy55&b&1C%46jC>TLMdu;r&?k+C+2RV$@=e`uHX0MYk zf4i}x&x&*9dluZFknY~y#k;B4t6Gf$*fr^r7@3y^-@VwVLiF|q3jvy>*kH_)n1}#< z;Z?)fkZRZwK0xRjKw5cQh`MG4s?|6u5^S%s(J<_b#t0hU^ME%v`}ATvSKjc>Gf2O> zx1nBSkwS8WASK2I$aGQJ44ilZ-FD*KsSSlH%e}kL8~a6r0W|10@~fB|MSQ=KY?n=E z!4_X;@xL;ukZoX(Eh&!7hj1C5xWNfpT11@$c%rj!)-Jd=fInx9GGuWZ%TcOTQxRjY z!ZTZ2=tpxB5t4x1d*t2^QEknr1PC(TUDCe~K=<=47jF}eV`kMCO9hyS z3uIvCFlytfM?s`ww3d28lkyFwiG=IH9QT?i%FHeriH$I}YAiQZOxoH)U;FU$OQ13q zaS?MyVl&z)bL^}~zsq@$-36IyM4H?6O#=dM^iD+On%YKGb9JXhWNAL_IoTj4F`Ofb zhyEd;BjgVv%;NTjZh$FFdmk8YVb{ai#&A;^s&%kin2$B^kppYvqFxAV9XzbDCoHHo z`uh~!GQ~nFCUuU2isKj*A^yq5`Cm*vG*lxng$NWk)&oV1qC7uU!b#IOOU!LdU|Mxpr$4tRL!okr&1wM`#wrfa zU4d2@>2*rBGnDGBZeb*8yPgdqNlUWSJi<@{c`=SouFsG1r>?llEtbd|1V&EQ4(-D1 z9B!^=97U1>Pbe1jhQNK*R6A-jXsKGWDgr-C%BZUlU7O_Kn}PeL8VNVb(^aK0@lZ*2 zCnvAgDu+(${1PCI_4TULV84i-H|@AQ{Tj{iJCw1!*igS&tq*UlN2kh_{c5v$zj~iH zXLm2$V);0KGB8i<9)Yz9yWY+F-Z^u)34VPuoXav%#Y%lsxxosji^~T#ot4O6>X|)g zgEn`{to<3`3t~UK&qFm#8 zdRWH`r0037C5Q_;I=j^veBK?|r>9)e%cj1$NikgO+14dGA~tJ)NRTlRg!L?H)JaJ` z_AF?eQhOxttNhtp%HrZLI2D}#m2W41)zPDi7k><}K%n>dd&*+}?+dr3@uosU zvDxwaSCy91rCVF>psp-H>`R)|}w*c-sm%H}ds8?7;Q+N0l_D*?x%oKH-IObKck5bi{ zr7P@~jxf7#iy4)6aPAABXNvu4yi3#N3>jQ@R^Lb7OOqOGWR$I14!Bux{^8qCCd3}p z*Ob~d4vK$0RRC1|3IR3 I;{bXB0Gzaq9smFU diff --git a/charts/helm_lib/Chart.yaml b/charts/helm_lib/Chart.yaml new file mode 100644 index 0000000..4e10745 --- /dev/null +++ b/charts/helm_lib/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v2 +type: library +name: deckhouse_lib_helm +version: 1.31.0 +description: "Helm utils template definitions for Deckhouse modules." diff --git a/charts/helm_lib/LICENSE b/charts/helm_lib/LICENSE new file mode 100644 index 0000000..13fe0e3 --- /dev/null +++ b/charts/helm_lib/LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright The Events Exporter authors + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/charts/helm_lib/README.md b/charts/helm_lib/README.md new file mode 100644 index 0000000..b9e7f66 --- /dev/null +++ b/charts/helm_lib/README.md @@ -0,0 +1,1167 @@ +# Helm library for Deckhouse modules + +## Table of contents + +| Table of contents | +|---| +| **Api Version And Kind** | +| [helm_lib_kind_exists](#helm_lib_kind_exists) | +| [helm_lib_get_api_version_by_kind](#helm_lib_get_api_version_by_kind) | +| **Enable Ds Eviction** | +| [helm_lib_prevent_ds_eviction_annotation](#helm_lib_prevent_ds_eviction_annotation) | +| **Envs For Proxy** | +| [helm_lib_envs_for_proxy](#helm_lib_envs_for_proxy) | +| **High Availability** | +| [helm_lib_is_ha_to_value](#helm_lib_is_ha_to_value) | +| [helm_lib_ha_enabled](#helm_lib_ha_enabled) | +| **Kube Rbac Proxy** | +| [helm_lib_kube_rbac_proxy_ca_certificate](#helm_lib_kube_rbac_proxy_ca_certificate) | +| **Module Documentation Uri** | +| [helm_lib_module_documentation_uri](#helm_lib_module_documentation_uri) | +| **Module Ephemeral Storage** | +| [helm_lib_module_ephemeral_storage_logs_with_extra](#helm_lib_module_ephemeral_storage_logs_with_extra) | +| [helm_lib_module_ephemeral_storage_only_logs](#helm_lib_module_ephemeral_storage_only_logs) | +| **Module Generate Common Name** | +| [helm_lib_module_generate_common_name](#helm_lib_module_generate_common_name) | +| **Module Https** | +| [helm_lib_module_uri_scheme](#helm_lib_module_uri_scheme) | +| [helm_lib_module_https_mode](#helm_lib_module_https_mode) | +| [helm_lib_module_https_cert_manager_cluster_issuer_name](#helm_lib_module_https_cert_manager_cluster_issuer_name) | +| [helm_lib_module_https_ingress_tls_enabled](#helm_lib_module_https_ingress_tls_enabled) | +| [helm_lib_module_https_copy_custom_certificate](#helm_lib_module_https_copy_custom_certificate) | +| [helm_lib_module_https_secret_name](#helm_lib_module_https_secret_name) | +| **Module Image** | +| [helm_lib_module_image](#helm_lib_module_image) | +| [helm_lib_module_image_no_fail](#helm_lib_module_image_no_fail) | +| [helm_lib_module_common_image](#helm_lib_module_common_image) | +| [helm_lib_module_common_image_no_fail](#helm_lib_module_common_image_no_fail) | +| **Module Ingress Class** | +| [helm_lib_module_ingress_class](#helm_lib_module_ingress_class) | +| **Module Init Container** | +| [helm_lib_module_init_container_chown_nobody_volume](#helm_lib_module_init_container_chown_nobody_volume) | +| [helm_lib_module_init_container_chown_deckhouse_volume](#helm_lib_module_init_container_chown_deckhouse_volume) | +| [helm_lib_module_init_container_check_linux_kernel](#helm_lib_module_init_container_check_linux_kernel) | +| **Module Labels** | +| [helm_lib_module_labels](#helm_lib_module_labels) | +| **Module Public Domain** | +| [helm_lib_module_public_domain](#helm_lib_module_public_domain) | +| **Module Security Context** | +| [helm_lib_module_pod_security_context_run_as_user_custom](#helm_lib_module_pod_security_context_run_as_user_custom) | +| [helm_lib_module_pod_security_context_run_as_user_nobody](#helm_lib_module_pod_security_context_run_as_user_nobody) | +| [helm_lib_module_pod_security_context_run_as_user_nobody_with_writable_fs](#helm_lib_module_pod_security_context_run_as_user_nobody_with_writable_fs) | +| [helm_lib_module_pod_security_context_run_as_user_deckhouse](#helm_lib_module_pod_security_context_run_as_user_deckhouse) | +| [helm_lib_module_pod_security_context_run_as_user_deckhouse_with_writable_fs](#helm_lib_module_pod_security_context_run_as_user_deckhouse_with_writable_fs) | +| [helm_lib_module_container_security_context_run_as_user_deckhouse_pss_restricted](#helm_lib_module_container_security_context_run_as_user_deckhouse_pss_restricted) | +| [helm_lib_module_pod_security_context_run_as_user_root](#helm_lib_module_pod_security_context_run_as_user_root) | +| [helm_lib_module_pod_security_context_runtime_default](#helm_lib_module_pod_security_context_runtime_default) | +| [helm_lib_module_container_security_context_not_allow_privilege_escalation](#helm_lib_module_container_security_context_not_allow_privilege_escalation) | +| [helm_lib_module_container_security_context_read_only_root_filesystem_with_selinux](#helm_lib_module_container_security_context_read_only_root_filesystem_with_selinux) | +| [helm_lib_module_container_security_context_read_only_root_filesystem](#helm_lib_module_container_security_context_read_only_root_filesystem) | +| [helm_lib_module_container_security_context_privileged](#helm_lib_module_container_security_context_privileged) | +| [helm_lib_module_container_security_context_escalated_sys_admin_privileged](#helm_lib_module_container_security_context_escalated_sys_admin_privileged) | +| [helm_lib_module_container_security_context_privileged_read_only_root_filesystem](#helm_lib_module_container_security_context_privileged_read_only_root_filesystem) | +| [helm_lib_module_container_security_context_read_only_root_filesystem_capabilities_drop_all](#helm_lib_module_container_security_context_read_only_root_filesystem_capabilities_drop_all) | +| [helm_lib_module_container_security_context_read_only_root_filesystem_capabilities_drop_all_and_add](#helm_lib_module_container_security_context_read_only_root_filesystem_capabilities_drop_all_and_add) | +| [helm_lib_module_container_security_context_capabilities_drop_all_and_add](#helm_lib_module_container_security_context_capabilities_drop_all_and_add) | +| [helm_lib_module_container_security_context_capabilities_drop_all_and_run_as_user_custom](#helm_lib_module_container_security_context_capabilities_drop_all_and_run_as_user_custom) | +| **Module Storage Class** | +| [helm_lib_module_storage_class_annotations](#helm_lib_module_storage_class_annotations) | +| **Monitoring Grafana Dashboards** | +| [helm_lib_grafana_dashboard_definitions_recursion](#helm_lib_grafana_dashboard_definitions_recursion) | +| [helm_lib_grafana_dashboard_definitions](#helm_lib_grafana_dashboard_definitions) | +| [helm_lib_single_dashboard](#helm_lib_single_dashboard) | +| **Monitoring Prometheus Rules** | +| [helm_lib_prometheus_rules_recursion](#helm_lib_prometheus_rules_recursion) | +| [helm_lib_prometheus_rules](#helm_lib_prometheus_rules) | +| [helm_lib_prometheus_target_scrape_timeout_seconds](#helm_lib_prometheus_target_scrape_timeout_seconds) | +| **Node Affinity** | +| [helm_lib_internal_check_node_selector_strategy](#helm_lib_internal_check_node_selector_strategy) | +| [helm_lib_node_selector](#helm_lib_node_selector) | +| [helm_lib_tolerations](#helm_lib_tolerations) | +| [_helm_lib_cloud_or_hybrid_cluster](#_helm_lib_cloud_or_hybrid_cluster) | +| [helm_lib_internal_check_tolerations_strategy](#helm_lib_internal_check_tolerations_strategy) | +| [_helm_lib_any_node_tolerations](#_helm_lib_any_node_tolerations) | +| [_helm_lib_wildcard_tolerations](#_helm_lib_wildcard_tolerations) | +| [_helm_lib_monitoring_tolerations](#_helm_lib_monitoring_tolerations) | +| [_helm_lib_frontend_tolerations](#_helm_lib_frontend_tolerations) | +| [_helm_lib_system_tolerations](#_helm_lib_system_tolerations) | +| [_helm_lib_additional_tolerations_uninitialized](#_helm_lib_additional_tolerations_uninitialized) | +| [_helm_lib_additional_tolerations_node_problems](#_helm_lib_additional_tolerations_node_problems) | +| [_helm_lib_additional_tolerations_storage_problems](#_helm_lib_additional_tolerations_storage_problems) | +| [_helm_lib_additional_tolerations_no_csi](#_helm_lib_additional_tolerations_no_csi) | +| [_helm_lib_additional_tolerations_cloud_provider_uninitialized](#_helm_lib_additional_tolerations_cloud_provider_uninitialized) | +| **Pod Disruption Budget** | +| [helm_lib_pdb_daemonset](#helm_lib_pdb_daemonset) | +| **Priority Class** | +| [helm_lib_priority_class](#helm_lib_priority_class) | +| **Resources Management** | +| [helm_lib_resources_management_pod_resources](#helm_lib_resources_management_pod_resources) | +| [helm_lib_resources_management_original_pod_resources](#helm_lib_resources_management_original_pod_resources) | +| [helm_lib_resources_management_vpa_spec](#helm_lib_resources_management_vpa_spec) | +| [helm_lib_resources_management_cpu_units_to_millicores](#helm_lib_resources_management_cpu_units_to_millicores) | +| [helm_lib_resources_management_memory_units_to_bytes](#helm_lib_resources_management_memory_units_to_bytes) | +| [helm_lib_vpa_kube_rbac_proxy_resources](#helm_lib_vpa_kube_rbac_proxy_resources) | +| [helm_lib_container_kube_rbac_proxy_resources](#helm_lib_container_kube_rbac_proxy_resources) | +| **Spec For High Availability** | +| [helm_lib_pod_anti_affinity_for_ha](#helm_lib_pod_anti_affinity_for_ha) | +| [helm_lib_deployment_on_master_strategy_and_replicas_for_ha](#helm_lib_deployment_on_master_strategy_and_replicas_for_ha) | +| [helm_lib_deployment_on_master_custom_strategy_and_replicas_for_ha](#helm_lib_deployment_on_master_custom_strategy_and_replicas_for_ha) | +| [helm_lib_deployment_strategy_and_replicas_for_ha](#helm_lib_deployment_strategy_and_replicas_for_ha) | + +## Api Version And Kind + +### helm_lib_kind_exists + + returns true if the specified resource kind (case-insensitive) is represented in the cluster + +#### Usage + +`{{ include "helm_lib_kind_exists" (list . "") }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- Kind name portion + + +### helm_lib_get_api_version_by_kind + + returns current apiVersion string, based on available helm capabilities, for the provided kind (not all kinds are supported) + +#### Usage + +`{{ include "helm_lib_get_api_version_by_kind" (list . "") }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- Kind name portion + +## Enable Ds Eviction + +### helm_lib_prevent_ds_eviction_annotation + + Adds `cluster-autoscaler.kubernetes.io/enable-ds-eviction` annotation to manage DaemonSet eviction by the Cluster Autoscaler. + This is important to prevent the eviction of DaemonSet pods during cluster scaling. + +#### Usage + +`{{ include "helm_lib_prevent_ds_eviction_annotation" . }} ` + + +## Envs For Proxy + +### helm_lib_envs_for_proxy + + Add HTTP_PROXY, HTTPS_PROXY and NO_PROXY environment variables for container + depends on [proxy settings](https://deckhouse.io/documentation/v1/deckhouse-configure-global.html#parameters-modules-proxy) + +#### Usage + +`{{ include "helm_lib_envs_for_proxy" . }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + +## High Availability + +### helm_lib_is_ha_to_value + + returns value "yes" if cluster is highly available, else — returns "no" + +#### Usage + +`{{ include "helm_lib_is_ha_to_value" (list . yes no) }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- Yes value +- No value + + +### helm_lib_ha_enabled + + returns empty value, which is treated by go template as false + +#### Usage + +`{{- if (include "helm_lib_ha_enabled" .) }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + +## Kube Rbac Proxy + +### helm_lib_kube_rbac_proxy_ca_certificate + + Renders configmap with kube-rbac-proxy CA certificate which uses to verify the kube-rbac-proxy clients. + +#### Usage + +`{{ include "helm_lib_kube_rbac_proxy_ca_certificate" (list . "namespace") }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- Namespace where CA configmap will be created + +## Module Documentation Uri + +### helm_lib_module_documentation_uri + + returns rendered documentation uri using publicDomainTemplate or deckhouse.io domains + +#### Usage + +`{{ include "helm_lib_module_documentation_uri" (list . "") }} ` + + +## Module Ephemeral Storage + +### helm_lib_module_ephemeral_storage_logs_with_extra + + 50Mi for container logs `log-opts.max-file * log-opts.max-size` would be added to passed value + returns ephemeral-storage size for logs with extra space + +#### Usage + +`{{ include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 }} ` + +#### Arguments + +- Extra space in mebibytes + + +### helm_lib_module_ephemeral_storage_only_logs + + 50Mi for container logs `log-opts.max-file * log-opts.max-size` would be requested + returns ephemeral-storage size for only logs + +#### Usage + +`{{ include "helm_lib_module_ephemeral_storage_only_logs" . }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + +## Module Generate Common Name + +### helm_lib_module_generate_common_name + + returns the commonName parameter for use in the Certificate custom resource(cert-manager) + +#### Usage + +`{{ include "helm_lib_module_generate_common_name" (list . "") }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- Name portion + +## Module Https + +### helm_lib_module_uri_scheme + + return module uri scheme "http" or "https" + +#### Usage + +`{{ include "helm_lib_module_uri_scheme" . }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + + +### helm_lib_module_https_mode + + returns https mode for module + +#### Usage + +`{{ if (include "helm_lib_module_https_mode" .) }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + + +### helm_lib_module_https_cert_manager_cluster_issuer_name + + returns cluster issuer name + +#### Usage + +`{{ include "helm_lib_module_https_cert_manager_cluster_issuer_name" . }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + + +### helm_lib_module_https_ingress_tls_enabled + + returns not empty string if tls should enable for ingress + +#### Usage + +`{{ if (include "helm_lib_module_https_ingress_tls_enabled" .) }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + + +### helm_lib_module_https_copy_custom_certificate + + Renders secret with [custom certificate](https://deckhouse.io/documentation/v1/deckhouse-configure-global.html#parameters-modules-https-customcertificate) + in passed namespace with passed prefix + +#### Usage + +`{{ include "helm_lib_module_https_copy_custom_certificate" (list . "namespace" "secret_name_prefix") }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- Namespace +- Secret name prefix + + +### helm_lib_module_https_secret_name + + returns custom certificate name + +#### Usage + +`{{ include "helm_lib_module_https_secret_name (list . "secret_name_prefix") }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- Secret name prefix + +## Module Image + +### helm_lib_module_image + + returns image name + +#### Usage + +`{{ include "helm_lib_module_image" (list . "") }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- Container name + + +### helm_lib_module_image_no_fail + + returns image name if found + +#### Usage + +`{{ include "helm_lib_module_image_no_fail" (list . "") }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- Container name + + +### helm_lib_module_common_image + + returns image name from common module + +#### Usage + +`{{ include "helm_lib_module_common_image" (list . "") }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- Container name + + +### helm_lib_module_common_image_no_fail + + returns image name from common module if found + +#### Usage + +`{{ include "helm_lib_module_common_image_no_fail" (list . "") }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- Container name + +## Module Ingress Class + +### helm_lib_module_ingress_class + + returns ingress class from module settings or if not exists from global config + +#### Usage + +`{{ include "helm_lib_module_ingress_class" . }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + +## Module Init Container + +### helm_lib_module_init_container_chown_nobody_volume + + ### Migration 11.12.2020: Remove this helper with all its usages after this commit reached RockSolid + returns initContainer which chowns recursively all files and directories in passed volume + +#### Usage + +`{{ include "helm_lib_module_init_container_chown_nobody_volume" (list . "volume-name") }} ` + + + +### helm_lib_module_init_container_chown_deckhouse_volume + + returns initContainer which chowns recursively all files and directories in passed volume + +#### Usage + +`{{ include "helm_lib_module_init_container_chown_deckhouse_volume" (list . "volume-name") }} ` + + + +### helm_lib_module_init_container_check_linux_kernel + + returns initContainer which checks the kernel version on the node for compliance to semver constraint + +#### Usage + +`{{ include "helm_lib_module_init_container_check_linux_kernel" (list . ">= 4.9.17") }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- Semver constraint + +## Module Labels + +### helm_lib_module_labels + + returns deckhouse labels + +#### Usage + +`{{ include "helm_lib_module_labels" (list . (dict "app" "test" "component" "testing")) }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- Additional labels dict + +## Module Public Domain + +### helm_lib_module_public_domain + + returns rendered publicDomainTemplate to service fqdn + +#### Usage + +`{{ include "helm_lib_module_public_domain" (list . "") }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- Name portion + +## Module Security Context + +### helm_lib_module_pod_security_context_run_as_user_custom + + returns PodSecurityContext parameters for Pod with custom user and group + +#### Usage + +`{{ include "helm_lib_module_pod_security_context_run_as_user_custom" (list . 1000 1000) }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- User id +- Group id + + +### helm_lib_module_pod_security_context_run_as_user_nobody + + returns PodSecurityContext parameters for Pod with user and group "nobody" + +#### Usage + +`{{ include "helm_lib_module_pod_security_context_run_as_user_nobody" . }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + + +### helm_lib_module_pod_security_context_run_as_user_nobody_with_writable_fs + + returns PodSecurityContext parameters for Pod with user and group "nobody" with write access to mounted volumes + +#### Usage + +`{{ include "helm_lib_module_pod_security_context_run_as_user_nobody_with_writable_fs" . }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + + +### helm_lib_module_pod_security_context_run_as_user_deckhouse + + returns PodSecurityContext parameters for Pod with user and group "deckhouse" + +#### Usage + +`{{ include "helm_lib_module_pod_security_context_run_as_user_deckhouse" . }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + + +### helm_lib_module_pod_security_context_run_as_user_deckhouse_with_writable_fs + + returns PodSecurityContext parameters for Pod with user and group "deckhouse" with write access to mounted volumes + +#### Usage + +`{{ include "helm_lib_module_pod_security_context_run_as_user_deckhouse_with_writable_fs" . }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + + +### helm_lib_module_container_security_context_run_as_user_deckhouse_pss_restricted + + returns SecurityContext parameters for Container with user and group "deckhouse" plus minimal required settings to comply with the Restricted mode of the Pod Security Standards + +#### Usage + +`{{ include "helm_lib_module_container_security_context_run_as_user_deckhouse_pss_restricted" . }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + + +### helm_lib_module_pod_security_context_run_as_user_root + + returns PodSecurityContext parameters for Pod with user and group 0 + +#### Usage + +`{{ include "helm_lib_module_pod_security_context_run_as_user_root" . }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + + +### helm_lib_module_pod_security_context_runtime_default + + returns PodSecurityContext parameters for Pod with seccomp profile RuntimeDefault + +#### Usage + +`{{ include "helm_lib_module_pod_security_context_runtime_default" . }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + + +### helm_lib_module_container_security_context_not_allow_privilege_escalation + + returns SecurityContext parameters for Container with allowPrivilegeEscalation false + +#### Usage + +`{{ include "helm_lib_module_container_security_context_not_allow_privilege_escalation" . }} ` + + + +### helm_lib_module_container_security_context_read_only_root_filesystem_with_selinux + + returns SecurityContext parameters for Container with read only root filesystem and options for SELinux compatibility + +#### Usage + +`{{ include "helm_lib_module_container_security_context_read_only_root_filesystem_with_selinux" . }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + + +### helm_lib_module_container_security_context_read_only_root_filesystem + + returns SecurityContext parameters for Container with read only root filesystem + +#### Usage + +`{{ include "helm_lib_module_container_security_context_read_only_root_filesystem" . }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + + +### helm_lib_module_container_security_context_privileged + + returns SecurityContext parameters for Container running privileged + +#### Usage + +`{{ include "helm_lib_module_container_security_context_privileged" . }} ` + + + +### helm_lib_module_container_security_context_escalated_sys_admin_privileged + + returns SecurityContext parameters for Container running privileged with escalation and sys_admin + +#### Usage + +`{{ include "helm_lib_module_container_security_context_escalated_sys_admin_privileged" . }} ` + + + +### helm_lib_module_container_security_context_privileged_read_only_root_filesystem + + returns SecurityContext parameters for Container running privileged with read only root filesystem + +#### Usage + +`{{ include "helm_lib_module_container_security_context_privileged_read_only_root_filesystem" . }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + + +### helm_lib_module_container_security_context_read_only_root_filesystem_capabilities_drop_all + + returns SecurityContext for Container with read only root filesystem and all capabilities dropped + +#### Usage + +`{{ include "helm_lib_module_container_security_context_read_only_root_filesystem_capabilities_drop_all" . }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + + +### helm_lib_module_container_security_context_read_only_root_filesystem_capabilities_drop_all_and_add + + returns SecurityContext parameters for Container with read only root filesystem, all dropped and some added capabilities + +#### Usage + +`{{ include "helm_lib_module_container_security_context_read_only_root_filesystem_capabilities_drop_all_and_add" (list . (list "KILL" "SYS_PTRACE")) }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- List of capabilities + + +### helm_lib_module_container_security_context_capabilities_drop_all_and_add + + returns SecurityContext parameters for Container with all dropped and some added capabilities + +#### Usage + +`{{ include "helm_lib_module_container_security_context_capabilities_drop_all_and_add" (list . (list "KILL" "SYS_PTRACE")) }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- List of capabilities + + +### helm_lib_module_container_security_context_capabilities_drop_all_and_run_as_user_custom + + returns SecurityContext parameters for Container with read only root filesystem, all dropped, and custom user ID + +#### Usage + +`{{ include "helm_lib_module_container_security_context_capabilities_drop_all_and_run_as_user_custom" (list . 1000 1000) }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- User id +- Group id + +## Module Storage Class + +### helm_lib_module_storage_class_annotations + + return module StorageClass annotations + +#### Usage + +`{{ include "helm_lib_module_storage_class_annotations" (list $ $index $storageClass.name) }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- Storage class index +- Storage class name + +## Monitoring Grafana Dashboards + +### helm_lib_grafana_dashboard_definitions_recursion + + returns all the dashboard-definintions from / + current dir is optional — used for recursion but you can use it for partially generating dashboards + +#### Usage + +`{{ include "helm_lib_grafana_dashboard_definitions_recursion" (list . [current dir]) }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- Dashboards root dir +- Dashboards current dir + + +### helm_lib_grafana_dashboard_definitions + + returns dashboard-definintions from monitoring/grafana-dashboards/ + +#### Usage + +`{{ include "helm_lib_grafana_dashboard_definitions" . }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + + +### helm_lib_single_dashboard + + renders a single dashboard + +#### Usage + +`{{ include "helm_lib_single_dashboard" (list . "dashboard-name" "folder" $dashboard) }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- Dashboard name +- Folder +- Dashboard definition + +## Monitoring Prometheus Rules + +### helm_lib_prometheus_rules_recursion + + returns all the prometheus rules from / + current dir is optional — used for recursion but you can use it for partially generating rules + +#### Usage + +`{{ include "helm_lib_prometheus_rules_recursion" (list . [current dir]) }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- Namespace for creating rules +- Rules root dir +- Current dir (optional) + + +### helm_lib_prometheus_rules + + returns all the prometheus rules from monitoring/prometheus-rules/ + +#### Usage + +`{{ include "helm_lib_prometheus_rules" (list . ) }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- Namespace for creating rules + + +### helm_lib_prometheus_target_scrape_timeout_seconds + + returns adjust timeout value to scrape interval / + +#### Usage + +`{{ include "helm_lib_prometheus_target_scrape_timeout_seconds" (list . ) }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- Target timeout in seconds + +## Node Affinity + +### helm_lib_internal_check_node_selector_strategy + + Verify node selector strategy. + + + +### helm_lib_node_selector + + Returns node selector for workloads depend on strategy. + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- strategy, one of "frontend" "monitoring" "system" "master" "any-node" "wildcard" + + +### helm_lib_tolerations + + Returns tolerations for workloads depend on strategy. + +#### Usage + +`{{ include "helm_lib_tolerations" (tuple . "any-node" "with-uninitialized" "without-storage-problems") }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- base strategy, one of "frontend" "monitoring" "system" any-node" "wildcard" +- list of additional strategies. To add strategy list it with prefix "with-", to remove strategy list it with prefix "without-". + + +### _helm_lib_cloud_or_hybrid_cluster + + Check cluster type. + Returns not empty string if this is cloud or hybrid cluster + + + +### helm_lib_internal_check_tolerations_strategy + + Verify base strategy. + Fails if strategy not in allowed list + + + +### _helm_lib_any_node_tolerations + + Base strategy for any uncordoned node in cluster. + +#### Usage + +`{{ include "helm_lib_tolerations" (tuple . "any-node") }} ` + + + +### _helm_lib_wildcard_tolerations + + Base strategy that tolerates all. + +#### Usage + +`{{ include "helm_lib_tolerations" (tuple . "wildcard") }} ` + + + +### _helm_lib_monitoring_tolerations + + Base strategy that tolerates nodes with "dedicated.deckhouse.io: monitoring" and "dedicated.deckhouse.io: system" taints. + +#### Usage + +`{{ include "helm_lib_tolerations" (tuple . "monitoring") }} ` + + + +### _helm_lib_frontend_tolerations + + Base strategy that tolerates nodes with "dedicated.deckhouse.io: frontend" taints. + +#### Usage + +`{{ include "helm_lib_tolerations" (tuple . "frontend") }} ` + + + +### _helm_lib_system_tolerations + + Base strategy that tolerates nodes with "dedicated.deckhouse.io: system" taints. + +#### Usage + +`{{ include "helm_lib_tolerations" (tuple . "system") }} ` + + + +### _helm_lib_additional_tolerations_uninitialized + + Additional strategy "uninitialized" - used for CNI's and kube-proxy to allow cni components scheduled on node after CCM initialization. + +#### Usage + +`{{ include "helm_lib_tolerations" (tuple . "any-node" "with-uninitialized") }} ` + + + +### _helm_lib_additional_tolerations_node_problems + + Additional strategy "node-problems" - used for shedule critical components on non-ready nodes or nodes under pressure. + +#### Usage + +`{{ include "helm_lib_tolerations" (tuple . "any-node" "with-node-problems") }} ` + + + +### _helm_lib_additional_tolerations_storage_problems + + Additional strategy "storage-problems" - used for shedule critical components on nodes with drbd problems. This additional strategy enabled by default in any base strategy except "wildcard". + +#### Usage + +`{{ include "helm_lib_tolerations" (tuple . "any-node" "without-storage-problems") }} ` + + + +### _helm_lib_additional_tolerations_no_csi + + Additional strategy "no-csi" - used for any node with no CSI: any node, which was initialized by deckhouse, but have no csi-node driver registered on it. + +#### Usage + +`{{ include "helm_lib_tolerations" (tuple . "any-node" "with-no-csi") }} ` + + + +### _helm_lib_additional_tolerations_cloud_provider_uninitialized + + Additional strategy "cloud-provider-uninitialized" - used for any node which is not initialized by CCM. + +#### Usage + +`{{ include "helm_lib_tolerations" (tuple . "any-node" "with-cloud-provider-uninitialized") }} ` + + +## Pod Disruption Budget + +### helm_lib_pdb_daemonset + + Returns PDB max unavailable + +#### Usage + +`{{ include "helm_lib_pdb_daemonset" . }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + +## Priority Class + +### helm_lib_priority_class + + returns priority class if priority-class module enabled, otherwise returns nothing + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- Priority class name + +## Resources Management + +### helm_lib_resources_management_pod_resources + + returns rendered resources section based on configuration if it is + +#### Usage + +`{{ include "helm_lib_resources_management_pod_resources" (list [ephemeral storage requests]) }} ` + +#### Arguments + +list: +- VPA resource configuration [example](https://deckhouse.io/documentation/v1/modules/110-istio/configuration.html#parameters-controlplane-resourcesmanagement) +- Ephemeral storage requests + + +### helm_lib_resources_management_original_pod_resources + + returns rendered resources section based on configuration if it is present + +#### Usage + +`{{ include "helm_lib_resources_management_original_pod_resources" }} ` + +#### Arguments + +- VPA resource configuration [example](https://deckhouse.io/documentation/v1/modules/110-istio/configuration.html#parameters-controlplane-resourcesmanagement) + + +### helm_lib_resources_management_vpa_spec + + returns rendered vpa spec based on configuration and target reference + +#### Usage + +`{{ include "helm_lib_resources_management_vpa_spec" (list ) }} ` + +#### Arguments + +list: +- Target API version +- Target Kind +- Target Name +- Target container name +- VPA resource configuration [example](https://deckhouse.io/documentation/v1/modules/110-istio/configuration.html#parameters-controlplane-resourcesmanagement) + + +### helm_lib_resources_management_cpu_units_to_millicores + + helper for converting cpu units to millicores + +#### Usage + +`{{ include "helm_lib_resources_management_cpu_units_to_millicores" }} ` + + + +### helm_lib_resources_management_memory_units_to_bytes + + helper for converting memory units to bytes + +#### Usage + +`{{ include "helm_lib_resources_management_memory_units_to_bytes" }} ` + + + +### helm_lib_vpa_kube_rbac_proxy_resources + + helper for VPA resources for kube_rbac_proxy + +#### Usage + +`{{ include "helm_lib_vpa_kube_rbac_proxy_resources" . }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + + +### helm_lib_container_kube_rbac_proxy_resources + + helper for container resources for kube_rbac_proxy + +#### Usage + +`{{ include "helm_lib_container_kube_rbac_proxy_resources" . }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + +## Spec For High Availability + +### helm_lib_pod_anti_affinity_for_ha + + returns pod affinity spec + +#### Usage + +`{{ include "helm_lib_pod_anti_affinity_for_ha" (list . (dict "app" "test")) }} ` + +#### Arguments + +list: +- Template context with .Values, .Chart, etc +- Match labels for podAntiAffinity label selector + + +### helm_lib_deployment_on_master_strategy_and_replicas_for_ha + + returns deployment strategy and replicas for ha components running on master nodes + +#### Usage + +`{{ include "helm_lib_deployment_on_master_strategy_and_replicas_for_ha" }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc + + +### helm_lib_deployment_on_master_custom_strategy_and_replicas_for_ha + + returns deployment with custom strategy and replicas for ha components running on master nodes + +#### Usage + +`{{ include "helm_lib_deployment_on_master_custom_strategy_and_replicas_for_ha" (list . (dict "strategy" "strategy_type")) }} ` + + + +### helm_lib_deployment_strategy_and_replicas_for_ha + + returns deployment strategy and replicas for ha components running not on master nodes + +#### Usage + +`{{ include "helm_lib_deployment_strategy_and_replicas_for_ha" }} ` + +#### Arguments + +- Template context with .Values, .Chart, etc diff --git a/charts/helm_lib/templates/_api_version_and_kind.tpl b/charts/helm_lib/templates/_api_version_and_kind.tpl new file mode 100644 index 0000000..4de8a8a --- /dev/null +++ b/charts/helm_lib/templates/_api_version_and_kind.tpl @@ -0,0 +1,36 @@ +{{- /* Usage: {{ include "helm_lib_kind_exists" (list . "") }} */ -}} +{{- /* returns true if the specified resource kind (case-insensitive) is represented in the cluster */ -}} +{{- define "helm_lib_kind_exists" }} + {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $kind_name := index . 1 -}} {{- /* Kind name portion */ -}} + {{- if eq (len $context.Capabilities.APIVersions) 0 -}} + {{- fail "Helm reports no capabilities" -}} + {{- end -}} + {{ range $cap := $context.Capabilities.APIVersions }} + {{- if hasSuffix (lower (printf "/%s" $kind_name)) (lower $cap) }} + found + {{- break }} + {{- end }} + {{- end }} +{{- end -}} + +{{- /* Usage: {{ include "helm_lib_get_api_version_by_kind" (list . "") }} */ -}} +{{- /* returns current apiVersion string, based on available helm capabilities, for the provided kind (not all kinds are supported) */ -}} +{{- define "helm_lib_get_api_version_by_kind" }} + {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $kind_name := index . 1 -}} {{- /* Kind name portion */ -}} + {{- if eq (len $context.Capabilities.APIVersions) 0 -}} + {{- fail "Helm reports no capabilities" -}} + {{- end -}} + {{- if or (eq $kind_name "ValidatingAdmissionPolicy") (eq $kind_name "ValidatingAdmissionPolicyBinding") -}} + {{- if $context.Capabilities.APIVersions.Has "admissionregistration.k8s.io/v1/ValidatingAdmissionPolicy" -}} +admissionregistration.k8s.io/v1 + {{- else if $context.Capabilities.APIVersions.Has "admissionregistration.k8s.io/v1beta1/ValidatingAdmissionPolicy" -}} +admissionregistration.k8s.io/v1beta1 + {{- else -}} +admissionregistration.k8s.io/v1alpha1 + {{- end -}} + {{- else -}} + {{- fail (printf "Kind '%s' isn't supported by the 'helm_lib_get_api_version_by_kind' helper" $kind_name) -}} + {{- end -}} +{{- end -}} diff --git a/charts/helm_lib/templates/_csi_controller.tpl b/charts/helm_lib/templates/_csi_controller.tpl new file mode 100644 index 0000000..9bc0d8c --- /dev/null +++ b/charts/helm_lib/templates/_csi_controller.tpl @@ -0,0 +1,763 @@ +{{- define "attacher_resources" }} +cpu: 10m +memory: 25Mi +{{- end }} + +{{- define "provisioner_resources" }} +cpu: 10m +memory: 25Mi +{{- end }} + +{{- define "resizer_resources" }} +cpu: 10m +memory: 25Mi +{{- end }} + +{{- define "syncer_resources" }} +cpu: 10m +memory: 25Mi +{{- end }} + +{{- define "snapshotter_resources" }} +cpu: 10m +memory: 25Mi +{{- end }} + +{{- define "livenessprobe_resources" }} +cpu: 10m +memory: 25Mi +{{- end }} + +{{- define "controller_resources" }} +cpu: 10m +memory: 50Mi +{{- end }} + +{{- /* Usage: {{ include "helm_lib_csi_controller_manifests" (list . $config) }} */ -}} +{{- define "helm_lib_csi_controller_manifests" }} + {{- $context := index . 0 }} + + {{- $config := index . 1 }} + {{- $fullname := $config.fullname | default "csi-controller" }} + {{- $snapshotterEnabled := dig "snapshotterEnabled" true $config }} + {{- $resizerEnabled := dig "resizerEnabled" true $config }} + {{- $syncerEnabled := dig "syncerEnabled" false $config }} + {{- $topologyEnabled := dig "topologyEnabled" true $config }} + {{- $extraCreateMetadataEnabled := dig "extraCreateMetadataEnabled" false $config }} + {{- $controllerImage := $config.controllerImage | required "$config.controllerImage is required" }} + {{- $provisionerTimeout := $config.provisionerTimeout | default "600s" }} + {{- $attacherTimeout := $config.attacherTimeout | default "600s" }} + {{- $resizerTimeout := $config.resizerTimeout | default "600s" }} + {{- $snapshotterTimeout := $config.snapshotterTimeout | default "600s" }} + {{- $provisionerWorkers := $config.provisionerWorkers | default "10" }} + {{- $attacherWorkers := $config.attacherWorkers | default "10" }} + {{- $resizerWorkers := $config.resizerWorkers | default "10" }} + {{- $snapshotterWorkers := $config.snapshotterWorkers | default "10" }} + {{- $additionalControllerEnvs := $config.additionalControllerEnvs }} + {{- $additionalSyncerEnvs := $config.additionalSyncerEnvs }} + {{- $additionalControllerArgs := $config.additionalControllerArgs }} + {{- $additionalControllerVolumes := $config.additionalControllerVolumes }} + {{- $additionalControllerVolumeMounts := $config.additionalControllerVolumeMounts }} + {{- $additionalContainers := $config.additionalContainers }} + {{- $livenessProbePort := $config.livenessProbePort | default 9808 }} + {{- $initContainerCommand := $config.initContainerCommand }} + {{- $initContainerImage := $config.initContainerImage }} + {{- $initContainerVolumeMounts := $config.initContainerVolumeMounts }} + + {{- $kubernetesSemVer := semver $context.Values.global.discovery.kubernetesVersion }} + + {{- $provisionerImageName := join "" (list "csiExternalProvisioner" $kubernetesSemVer.Major $kubernetesSemVer.Minor) }} + {{- $provisionerImage := include "helm_lib_module_common_image_no_fail" (list $context $provisionerImageName) }} + + {{- $attacherImageName := join "" (list "csiExternalAttacher" $kubernetesSemVer.Major $kubernetesSemVer.Minor) }} + {{- $attacherImage := include "helm_lib_module_common_image_no_fail" (list $context $attacherImageName) }} + + {{- $resizerImageName := join "" (list "csiExternalResizer" $kubernetesSemVer.Major $kubernetesSemVer.Minor) }} + {{- $resizerImage := include "helm_lib_module_common_image_no_fail" (list $context $resizerImageName) }} + + {{- $syncerImageName := join "" (list "csiVsphereSyncer" $kubernetesSemVer.Major $kubernetesSemVer.Minor) }} + {{- $syncerImage := include "helm_lib_module_common_image_no_fail" (list $context $syncerImageName) }} + + {{- $snapshotterImageName := join "" (list "csiExternalSnapshotter" $kubernetesSemVer.Major $kubernetesSemVer.Minor) }} + {{- $snapshotterImage := include "helm_lib_module_common_image_no_fail" (list $context $snapshotterImageName) }} + + {{- $livenessprobeImageName := join "" (list "csiLivenessprobe" $kubernetesSemVer.Major $kubernetesSemVer.Minor) }} + {{- $livenessprobeImage := include "helm_lib_module_common_image_no_fail" (list $context $livenessprobeImageName) }} + + {{- if $provisionerImage }} + {{- if ($context.Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }} +--- +apiVersion: autoscaling.k8s.io/v1 +kind: VerticalPodAutoscaler +metadata: + name: {{ $fullname }} + namespace: d8-{{ $context.Chart.Name }} + {{- include "helm_lib_module_labels" (list $context (dict "app" "csi-controller" "workload-resource-policy.deckhouse.io" "master")) | nindent 2 }} +spec: + targetRef: + apiVersion: "apps/v1" + kind: Deployment + name: {{ $fullname }} + updatePolicy: + updateMode: "Auto" + resourcePolicy: + containerPolicies: + - containerName: "provisioner" + minAllowed: + {{- include "provisioner_resources" $context | nindent 8 }} + maxAllowed: + cpu: 20m + memory: 50Mi + - containerName: "attacher" + minAllowed: + {{- include "attacher_resources" $context | nindent 8 }} + maxAllowed: + cpu: 20m + memory: 50Mi + {{- if $resizerEnabled }} + - containerName: "resizer" + minAllowed: + {{- include "resizer_resources" $context | nindent 8 }} + maxAllowed: + cpu: 20m + memory: 50Mi + {{- end }} + {{- if $syncerEnabled }} + - containerName: "syncer" + minAllowed: + {{- include "syncer_resources" $context | nindent 8 }} + maxAllowed: + cpu: 20m + memory: 50Mi + {{- end }} + {{- if $snapshotterEnabled }} + - containerName: "snapshotter" + minAllowed: + {{- include "snapshotter_resources" $context | nindent 8 }} + maxAllowed: + cpu: 20m + memory: 50Mi + {{- end }} + - containerName: "livenessprobe" + minAllowed: + {{- include "livenessprobe_resources" $context | nindent 8 }} + maxAllowed: + cpu: 20m + memory: 50Mi + - containerName: "controller" + minAllowed: + {{- include "controller_resources" $context | nindent 8 }} + maxAllowed: + cpu: 20m + memory: 100Mi + {{- end }} +--- +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: {{ $fullname }} + namespace: d8-{{ $context.Chart.Name }} + {{- include "helm_lib_module_labels" (list $context (dict "app" "csi-controller")) | nindent 2 }} +spec: + maxUnavailable: 1 + selector: + matchLabels: + app: {{ $fullname }} +--- +kind: Deployment +apiVersion: apps/v1 +metadata: + name: {{ $fullname }} + namespace: d8-{{ $context.Chart.Name }} + {{- include "helm_lib_module_labels" (list $context (dict "app" "csi-controller")) | nindent 2 }} +spec: + replicas: 1 + revisionHistoryLimit: 2 + selector: + matchLabels: + app: {{ $fullname }} + strategy: + type: Recreate + template: + metadata: + labels: + app: {{ $fullname }} + {{- if hasPrefix "cloud-provider-" $context.Chart.Name }} + annotations: + cloud-config-checksum: {{ include (print $context.Template.BasePath "/cloud-controller-manager/secret.yaml") $context | sha256sum }} + {{- end }} + spec: + hostNetwork: true + dnsPolicy: ClusterFirstWithHostNet + imagePullSecrets: + - name: deckhouse-registry + {{- include "helm_lib_priority_class" (tuple $context "system-cluster-critical") | nindent 6 }} + {{- include "helm_lib_node_selector" (tuple $context "master") | nindent 6 }} + {{- include "helm_lib_tolerations" (tuple $context "any-node" "with-uninitialized") | nindent 6 }} +{{- if $context.Values.global.enabledModules | has "csi-nfs" }} + {{- include "helm_lib_module_pod_security_context_runtime_default" . | nindent 6 }} +{{- else }} + {{- include "helm_lib_module_pod_security_context_run_as_user_deckhouse" . | nindent 6 }} +{{- end }} + serviceAccountName: csi + containers: + - name: provisioner + {{- include "helm_lib_module_container_security_context_read_only_root_filesystem" . | nindent 8 }} + image: {{ $provisionerImage | quote }} + args: + - "--timeout={{ $provisionerTimeout }}" + - "--v=5" + - "--csi-address=$(ADDRESS)" + {{- if $topologyEnabled }} + - "--feature-gates=Topology=true" + - "--strict-topology" + {{- else }} + - "--feature-gates=Topology=false" + {{- end }} + - "--default-fstype=ext4" + - "--leader-election=true" + - "--leader-election-namespace=$(NAMESPACE)" + - "--enable-capacity" + - "--capacity-ownerref-level=2" + {{- if $extraCreateMetadataEnabled }} + - "--extra-create-metadata=true" + {{- end }} + - "--worker-threads={{ $provisionerWorkers }}" + env: + - name: ADDRESS + value: /csi/csi.sock + - name: POD_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.name + - name: NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + volumeMounts: + - name: socket-dir + mountPath: /csi + resources: + requests: + {{- include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 | nindent 12 }} + {{- if not ( $context.Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }} + {{- include "provisioner_resources" $context | nindent 12 }} + {{- end }} + - name: attacher + {{- include "helm_lib_module_container_security_context_read_only_root_filesystem" . | nindent 8 }} + image: {{ $attacherImage | quote }} + args: + - "--timeout={{ $attacherTimeout }}" + - "--v=5" + - "--csi-address=$(ADDRESS)" + - "--leader-election=true" + - "--leader-election-namespace=$(NAMESPACE)" + - "--worker-threads={{ $attacherWorkers }}" + env: + - name: ADDRESS + value: /csi/csi.sock + - name: NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + volumeMounts: + - name: socket-dir + mountPath: /csi + resources: + requests: + {{- include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 | nindent 12 }} + {{- if not ( $context.Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }} + {{- include "attacher_resources" $context | nindent 12 }} + {{- end }} + {{- if $resizerEnabled }} + - name: resizer + {{- include "helm_lib_module_container_security_context_read_only_root_filesystem" . | nindent 8 }} + image: {{ $resizerImage | quote }} + args: + - "--timeout={{ $resizerTimeout }}" + - "--v=5" + - "--csi-address=$(ADDRESS)" + - "--leader-election=true" + - "--leader-election-namespace=$(NAMESPACE)" + - "--workers={{ $resizerWorkers }}" + env: + - name: ADDRESS + value: /csi/csi.sock + - name: NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + volumeMounts: + - name: socket-dir + mountPath: /csi + resources: + requests: + {{- include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 | nindent 12 }} + {{- if not ( $context.Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }} + {{- include "resizer_resources" $context | nindent 12 }} + {{- end }} + {{- end }} + {{- if $syncerEnabled }} + - name: syncer + {{- include "helm_lib_module_container_security_context_read_only_root_filesystem" . | nindent 8 }} + image: {{ $syncerImage | quote }} + args: + - "--leader-election" + - "--leader-election-lease-duration=30s" + - "--leader-election-renew-deadline=20s" + - "--leader-election-retry-period=10s" + {{- if $additionalControllerArgs }} + {{- $additionalControllerArgs | toYaml | nindent 8 }} + {{- end }} + {{- if $additionalSyncerEnvs }} + env: + {{- $additionalSyncerEnvs | toYaml | nindent 8 }} + {{- end }} + {{- if $additionalControllerVolumeMounts }} + volumeMounts: + {{- $additionalControllerVolumeMounts | toYaml | nindent 8 }} + {{- end }} + resources: + requests: + {{- include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 | nindent 12 }} + {{- if not ( $context.Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }} + {{- include "syncer_resources" $context | nindent 12 }} + {{- end }} + {{- end }} + {{- if $snapshotterEnabled }} + - name: snapshotter + {{- include "helm_lib_module_container_security_context_read_only_root_filesystem" . | nindent 8 }} + image: {{ $snapshotterImage | quote }} + args: + - "--timeout={{ $snapshotterTimeout }}" + - "--v=5" + - "--csi-address=$(ADDRESS)" + - "--leader-election=true" + - "--leader-election-namespace=$(NAMESPACE)" + - "--worker-threads={{ $snapshotterWorkers }}" + env: + - name: ADDRESS + value: /csi/csi.sock + - name: NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + volumeMounts: + - name: socket-dir + mountPath: /csi + resources: + requests: + {{- include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 | nindent 12 }} + {{- if not ( $context.Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }} + {{- include "snapshotter_resources" $context | nindent 12 }} + {{- end }} + {{- end }} + - name: livenessprobe + {{- include "helm_lib_module_container_security_context_read_only_root_filesystem" . | nindent 8 }} + image: {{ $livenessprobeImage | quote }} + args: + - "--csi-address=$(ADDRESS)" + - "--http-endpoint=$(HOST_IP):{{ $livenessProbePort }}" + env: + - name: ADDRESS + value: /csi/csi.sock + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + volumeMounts: + - name: socket-dir + mountPath: /csi + resources: + requests: + {{- include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 | nindent 12 }} + {{- if not ( $context.Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }} + {{- include "livenessprobe_resources" $context | nindent 12 }} + {{- end }} + - name: controller +{{- if $context.Values.global.enabledModules | has "csi-nfs" }} + {{- include "helm_lib_module_container_security_context_escalated_sys_admin_privileged" . | nindent 8 }} +{{- else }} + {{- include "helm_lib_module_container_security_context_read_only_root_filesystem" . | nindent 8 }} +{{- end }} + image: {{ $controllerImage | quote }} + args: + {{- if $additionalControllerArgs }} + {{- $additionalControllerArgs | toYaml | nindent 8 }} + {{- end }} + {{- if $additionalControllerEnvs }} + env: + {{- $additionalControllerEnvs | toYaml | nindent 8 }} + {{- end }} + livenessProbe: + httpGet: + path: /healthz + port: {{ $livenessProbePort }} + volumeMounts: + - name: socket-dir + mountPath: /csi + {{- /* For an unknown reason vSphere csi-controller won't start without `/tmp` directory */ -}} + {{- if eq $context.Chart.Name "cloud-provider-vsphere" }} + - name: tmp + mountPath: /tmp + {{- end }} + {{- if $additionalControllerVolumeMounts }} + {{- $additionalControllerVolumeMounts | toYaml | nindent 8 }} + {{- end }} + resources: + requests: + {{- include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 | nindent 12 }} + {{- if not ( $context.Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }} + {{- include "controller_resources" $context | nindent 12 }} + {{- end }} + {{- if $additionalContainers }} + {{- $additionalContainers | toYaml | nindent 6 }} + {{- end }} + {{- if $initContainerCommand }} + initContainers: + - command: + {{- $initContainerCommand | toYaml | nindent 8 }} + image: {{ $initContainerImage }} + imagePullPolicy: IfNotPresent + name: csi-controller-init-container + {{- if $initContainerVolumeMounts }} + volumeMounts: + {{- $initContainerVolumeMounts | toYaml | nindent 8 }} + {{- end }} + resources: + requests: + {{- include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 | nindent 12 }} + {{- end }} + volumes: + - name: socket-dir + emptyDir: {} + {{- /* For an unknown reason vSphere csi-controller won't start without `/tmp` directory */ -}} + {{- if eq $context.Chart.Name "cloud-provider-vsphere" }} + - name: tmp + emptyDir: {} + {{- end }} + {{- if $additionalControllerVolumes }} + {{- $additionalControllerVolumes | toYaml | nindent 6 }} + {{- end }} + {{- end }} +{{- end }} + + +{{- /* Usage: {{ include "helm_lib_csi_controller_rbac" . }} */ -}} +{{- define "helm_lib_csi_controller_rbac" }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: csi + namespace: d8-{{ .Chart.Name }} + {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} + +# =========== +# provisioner +# =========== +# Source https://github.com/kubernetes-csi/external-provisioner/blob/master/deploy/kubernetes/rbac.yaml +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: d8:{{ .Chart.Name }}:csi:controller:external-provisioner + {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} +rules: +- apiGroups: [""] + resources: ["persistentvolumes"] + verbs: ["get", "list", "watch", "create", "delete"] +- apiGroups: [""] + resources: ["persistentvolumeclaims"] + verbs: ["get", "list", "watch", "update"] +- apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch"] +- apiGroups: ["storage.k8s.io"] + resources: ["storageclasses"] + verbs: ["get", "list", "watch"] +- apiGroups: [""] + resources: ["events"] + verbs: ["list", "watch", "create", "update", "patch"] +- apiGroups: ["snapshot.storage.k8s.io"] + resources: ["volumesnapshots"] + verbs: ["get", "list"] +- apiGroups: ["snapshot.storage.k8s.io"] + resources: ["volumesnapshotcontents"] + verbs: ["get", "list"] +- apiGroups: ["storage.k8s.io"] + resources: ["csinodes"] + verbs: ["get", "list", "watch"] +- apiGroups: [""] + resources: ["nodes"] + verbs: ["get", "list", "watch"] +# Access to volumeattachments is only needed when the CSI driver +# has the PUBLISH_UNPUBLISH_VOLUME controller capability. +# In that case, external-provisioner will watch volumeattachments +# to determine when it is safe to delete a volume. +- apiGroups: ["storage.k8s.io"] + resources: ["volumeattachments"] + verbs: ["get", "list", "watch"] +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: d8:{{ .Chart.Name }}:csi:controller:external-provisioner + {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} +subjects: +- kind: ServiceAccount + name: csi + namespace: d8-{{ .Chart.Name }} +roleRef: + kind: ClusterRole + name: d8:{{ .Chart.Name }}:csi:controller:external-provisioner + apiGroup: rbac.authorization.k8s.io +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: csi:controller:external-provisioner + namespace: d8-{{ .Chart.Name }} + {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} +rules: +# Only one of the following rules for endpoints or leases is required based on +# what is set for `--leader-election-type`. Endpoints are deprecated in favor of Leases. +- apiGroups: [""] + resources: ["endpoints"] + verbs: ["get", "watch", "list", "delete", "update", "create"] +- apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "watch", "list", "delete", "update", "create"] +# Permissions for CSIStorageCapacity are only needed enabling the publishing +# of storage capacity information. +- apiGroups: ["storage.k8s.io"] + resources: ["csistoragecapacities"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] +# The GET permissions below are needed for walking up the ownership chain +# for CSIStorageCapacity. They are sufficient for deployment via +# StatefulSet (only needs to get Pod) and Deployment (needs to get +# Pod and then ReplicaSet to find the Deployment). +- apiGroups: [""] + resources: ["pods"] + verbs: ["get"] +- apiGroups: ["apps"] + resources: ["replicasets"] + verbs: ["get"] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: csi:controller:external-provisioner + namespace: d8-{{ .Chart.Name }} + {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} +subjects: +- kind: ServiceAccount + name: csi + namespace: d8-{{ .Chart.Name }} +roleRef: + kind: Role + name: csi:controller:external-provisioner + apiGroup: rbac.authorization.k8s.io + +# ======== +# attacher +# ======== +# Source https://github.com/kubernetes-csi/external-attacher/blob/master/deploy/kubernetes/rbac.yaml +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: d8:{{ .Chart.Name }}:csi:controller:external-attacher + {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} +rules: +- apiGroups: [""] + resources: ["persistentvolumes"] + verbs: ["get", "list", "watch", "update", "patch"] +- apiGroups: ["storage.k8s.io"] + resources: ["csinodes"] + verbs: ["get", "list", "watch"] +- apiGroups: ["storage.k8s.io"] + resources: ["volumeattachments"] + verbs: ["get", "list", "watch", "update", "patch"] +- apiGroups: ["storage.k8s.io"] + resources: ["volumeattachments/status"] + verbs: ["patch"] +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: d8:{{ .Chart.Name }}:csi:controller:external-attacher + {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} +subjects: +- kind: ServiceAccount + name: csi + namespace: d8-{{ .Chart.Name }} +roleRef: + kind: ClusterRole + name: d8:{{ .Chart.Name }}:csi:controller:external-attacher + apiGroup: rbac.authorization.k8s.io +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: csi:controller:external-attacher + namespace: d8-{{ .Chart.Name }} + {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} +rules: +- apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "watch", "list", "delete", "update", "create"] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: csi:controller:external-attacher + namespace: d8-{{ .Chart.Name }} + {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} +subjects: +- kind: ServiceAccount + name: csi + namespace: d8-{{ .Chart.Name }} +roleRef: + kind: Role + name: csi:controller:external-attacher + apiGroup: rbac.authorization.k8s.io + +# ======= +# resizer +# ======= +# Source https://github.com/kubernetes-csi/external-resizer/blob/master/deploy/kubernetes/rbac.yaml +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: d8:{{ .Chart.Name }}:csi:controller:external-resizer + {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} +rules: +- apiGroups: [""] + resources: ["persistentvolumes"] + verbs: ["get", "list", "watch", "patch"] +- apiGroups: [""] + resources: ["persistentvolumeclaims"] + verbs: ["get", "list", "watch"] +- apiGroups: [""] + resources: ["pods"] + verbs: ["get", "list", "watch"] +- apiGroups: [""] + resources: ["persistentvolumeclaims/status"] + verbs: ["patch"] +- apiGroups: [""] + resources: ["events"] + verbs: ["list", "watch", "create", "update", "patch"] +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: d8:{{ .Chart.Name }}:csi:controller:external-resizer + {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} +subjects: +- kind: ServiceAccount + name: csi + namespace: d8-{{ .Chart.Name }} +roleRef: + kind: ClusterRole + name: d8:{{ .Chart.Name }}:csi:controller:external-resizer + apiGroup: rbac.authorization.k8s.io +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: csi:controller:external-resizer + namespace: d8-{{ .Chart.Name }} + {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} +rules: +- apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "watch", "list", "delete", "update", "create"] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: csi:controller:external-resizer + namespace: d8-{{ .Chart.Name }} + {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} +subjects: +- kind: ServiceAccount + name: csi + namespace: d8-{{ .Chart.Name }} +roleRef: + kind: Role + name: csi:controller:external-resizer + apiGroup: rbac.authorization.k8s.io +# ======== +# snapshotter +# ======== +# Source https://github.com/kubernetes-csi/external-snapshotter/blob/master/deploy/kubernetes/csi-snapshotter/rbac-csi-snapshotter.yaml +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: d8:{{ .Chart.Name }}:csi:controller:external-snapshotter + {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} +rules: +- apiGroups: [""] + resources: ["events"] + verbs: ["list", "watch", "create", "update", "patch"] +- apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list"] +- apiGroups: ["snapshot.storage.k8s.io"] + resources: ["volumesnapshotclasses"] + verbs: ["get", "list", "watch"] +- apiGroups: ["snapshot.storage.k8s.io"] + resources: ["volumesnapshotcontents"] + verbs: ["create", "get", "list", "watch", "update", "delete", "patch"] +- apiGroups: ["snapshot.storage.k8s.io"] + resources: ["volumesnapshotcontents/status"] + verbs: ["update", "patch"] +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: d8:{{ .Chart.Name }}:csi:controller:external-snapshotter + {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} +subjects: +- kind: ServiceAccount + name: csi + namespace: d8-{{ .Chart.Name }} +roleRef: + kind: ClusterRole + name: d8:{{ .Chart.Name }}:csi:controller:external-snapshotter + apiGroup: rbac.authorization.k8s.io +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: csi:controller:external-snapshotter + namespace: d8-{{ .Chart.Name }} + {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} +rules: +- apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "watch", "list", "delete", "update", "create"] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: csi:controller:external-snapshotter + namespace: d8-{{ .Chart.Name }} + {{- include "helm_lib_module_labels" (list . (dict "app" "csi-controller")) | nindent 2 }} +subjects: +- kind: ServiceAccount + name: csi + namespace: d8-{{ .Chart.Name }} +roleRef: + kind: Role + name: csi:controller:external-snapshotter + apiGroup: rbac.authorization.k8s.io +{{- end }} diff --git a/charts/helm_lib/templates/_csi_node.tpl b/charts/helm_lib/templates/_csi_node.tpl new file mode 100644 index 0000000..254bc40 --- /dev/null +++ b/charts/helm_lib/templates/_csi_node.tpl @@ -0,0 +1,206 @@ +{{- define "node_driver_registrar_resources" }} +cpu: 12m +memory: 25Mi +{{- end }} + +{{- define "node_resources" }} +cpu: 12m +memory: 25Mi +{{- end }} + +{{- /* Usage: {{ include "helm_lib_csi_node_manifests" (list . $config) }} */ -}} +{{- define "helm_lib_csi_node_manifests" }} + {{- $context := index . 0 }} + + {{- $config := index . 1 }} + {{- $fullname := $config.fullname | default "csi-node" }} + {{- $nodeImage := $config.nodeImage | required "$config.nodeImage is required" }} + {{- $driverFQDN := $config.driverFQDN | required "$config.driverFQDN is required" }} + {{- $serviceAccount := $config.serviceAccount | default "" }} + {{- $additionalNodeEnvs := $config.additionalNodeEnvs }} + {{- $additionalNodeArgs := $config.additionalNodeArgs }} + {{- $additionalNodeVolumes := $config.additionalNodeVolumes }} + {{- $additionalNodeVolumeMounts := $config.additionalNodeVolumeMounts }} + {{- $additionalNodeLivenessProbesCmd := $config.additionalNodeLivenessProbesCmd }} + {{- $initContainerCommand := $config.initContainerCommand }} + {{- $initContainerImage := $config.initContainerImage }} + {{- $initContainerVolumeMounts := $config.initContainerVolumeMounts }} + + {{- $kubernetesSemVer := semver $context.Values.global.discovery.kubernetesVersion }} + {{- $driverRegistrarImageName := join "" (list "csiNodeDriverRegistrar" $kubernetesSemVer.Major $kubernetesSemVer.Minor) }} + {{- $driverRegistrarImage := include "helm_lib_module_common_image_no_fail" (list $context $driverRegistrarImageName) }} + {{- if $driverRegistrarImage }} + {{- if or (include "_helm_lib_cloud_or_hybrid_cluster" $context) ($context.Values.global.enabledModules | has "ceph-csi") ($context.Values.global.enabledModules | has "csi-nfs") ($context.Values.global.enabledModules | has "csi-ceph") ($context.Values.global.enabledModules | has "csi-yadro") }} + {{- if ($context.Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }} +--- +apiVersion: autoscaling.k8s.io/v1 +kind: VerticalPodAutoscaler +metadata: + name: {{ $fullname }} + namespace: d8-{{ $context.Chart.Name }} + {{- include "helm_lib_module_labels" (list $context (dict "app" "csi-node" "workload-resource-policy.deckhouse.io" "every-node")) | nindent 2 }} +spec: + targetRef: + apiVersion: "apps/v1" + kind: DaemonSet + name: {{ $fullname }} + updatePolicy: + updateMode: "Auto" + resourcePolicy: + containerPolicies: + - containerName: "node-driver-registrar" + minAllowed: + {{- include "node_driver_registrar_resources" $context | nindent 8 }} + maxAllowed: + cpu: 25m + memory: 50Mi + - containerName: "node" + minAllowed: + {{- include "node_resources" $context | nindent 8 }} + maxAllowed: + cpu: 25m + memory: 50Mi + {{- end }} +--- +kind: DaemonSet +apiVersion: apps/v1 +metadata: + name: {{ $fullname }} + namespace: d8-{{ $context.Chart.Name }} + {{- include "helm_lib_module_labels" (list $context (dict "app" "csi-node")) | nindent 2 }} +spec: + updateStrategy: + type: RollingUpdate + selector: + matchLabels: + app: {{ $fullname }} + template: + metadata: + labels: + app: {{ $fullname }} + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - operator: In + key: node.deckhouse.io/type + values: + - CloudEphemeral + - CloudPermanent + - CloudStatic + {{- if or (eq $fullname "csi-node-rbd") (eq $fullname "csi-node-cephfs") (eq $fullname "csi-nfs") (eq $fullname "csi-yadro") }} + - Static + {{- end }} + imagePullSecrets: + - name: deckhouse-registry + {{- include "helm_lib_priority_class" (tuple $context "system-node-critical") | nindent 6 }} + {{- include "helm_lib_tolerations" (tuple $context "any-node" "with-no-csi") | nindent 6 }} + {{- include "helm_lib_module_pod_security_context_run_as_user_root" . | nindent 6 }} + hostNetwork: true + dnsPolicy: ClusterFirstWithHostNet + containers: + - name: node-driver-registrar + {{- include "helm_lib_module_container_security_context_not_allow_privilege_escalation" $context | nindent 8 }} + image: {{ $driverRegistrarImage | quote }} + args: + - "--v=5" + - "--csi-address=$(CSI_ENDPOINT)" + - "--kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)" + env: + - name: CSI_ENDPOINT + value: "/csi/csi.sock" + - name: DRIVER_REG_SOCK_PATH + value: "/var/lib/kubelet/csi-plugins/{{ $driverFQDN }}/csi.sock" + - name: KUBE_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + {{- if $additionalNodeLivenessProbesCmd }} + livenessProbe: + initialDelaySeconds: 3 + exec: + command: + {{- $additionalNodeLivenessProbesCmd | toYaml | nindent 12 }} + {{- end }} + volumeMounts: + - name: plugin-dir + mountPath: /csi + - name: registration-dir + mountPath: /registration + resources: + requests: + {{- include "helm_lib_module_ephemeral_storage_only_logs" 10 | nindent 12 }} + {{- if not ($context.Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }} + {{- include "node_driver_registrar_resources" $context | nindent 12 }} + {{- end }} + - name: node + securityContext: + privileged: true + image: {{ $nodeImage }} + args: + {{- if $additionalNodeArgs }} + {{- $additionalNodeArgs | toYaml | nindent 8 }} + {{- end }} + {{- if $additionalNodeEnvs }} + env: + {{- $additionalNodeEnvs | toYaml | nindent 8 }} + {{- end }} + volumeMounts: + - name: kubelet-dir + mountPath: /var/lib/kubelet + mountPropagation: "Bidirectional" + - name: plugin-dir + mountPath: /csi + - name: device-dir + mountPath: /dev + {{- if $additionalNodeVolumeMounts }} + {{- $additionalNodeVolumeMounts | toYaml | nindent 8 }} + {{- end }} + resources: + requests: + {{- include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 | nindent 12 }} + {{- if not ($context.Values.global.enabledModules | has "vertical-pod-autoscaler-crd") }} + {{- include "node_resources" $context | nindent 12 }} + {{- end }} + {{- if $initContainerCommand }} + initContainers: + - command: + {{- $initContainerCommand | toYaml | nindent 8 }} + image: {{ $initContainerImage }} + imagePullPolicy: IfNotPresent + name: csi-node-init-container + {{- if $initContainerVolumeMounts }} + volumeMounts: + {{- $initContainerVolumeMounts | toYaml | nindent 8 }} + {{- end }} + resources: + requests: + {{- include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 | nindent 12 }} + {{- end }} + serviceAccount: {{ $serviceAccount | quote }} + serviceAccountName: {{ $serviceAccount | quote }} + volumes: + - name: registration-dir + hostPath: + path: /var/lib/kubelet/plugins_registry/ + type: Directory + - name: kubelet-dir + hostPath: + path: /var/lib/kubelet + type: Directory + - name: plugin-dir + hostPath: + path: /var/lib/kubelet/csi-plugins/{{ $driverFQDN }}/ + type: DirectoryOrCreate + - name: device-dir + hostPath: + path: /dev + type: Directory + {{- if $additionalNodeVolumes }} + {{- $additionalNodeVolumes | toYaml | nindent 6 }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/helm_lib/templates/_enable_ds_eviction.tpl b/charts/helm_lib/templates/_enable_ds_eviction.tpl new file mode 100644 index 0000000..b912c05 --- /dev/null +++ b/charts/helm_lib/templates/_enable_ds_eviction.tpl @@ -0,0 +1,6 @@ +{{- /* Usage: {{ include "helm_lib_prevent_ds_eviction_annotation" . }} */ -}} +{{- /* Adds `cluster-autoscaler.kubernetes.io/enable-ds-eviction` annotation to manage DaemonSet eviction by the Cluster Autoscaler. */ -}} +{{- /* This is important to prevent the eviction of DaemonSet pods during cluster scaling. */ -}} +{{- define "helm_lib_prevent_ds_eviction_annotation" -}} +cluster-autoscaler.kubernetes.io/enable-ds-eviction: "false" +{{- end }} diff --git a/charts/helm_lib/templates/_envs_for_proxy.tpl b/charts/helm_lib/templates/_envs_for_proxy.tpl new file mode 100644 index 0000000..177bb1c --- /dev/null +++ b/charts/helm_lib/templates/_envs_for_proxy.tpl @@ -0,0 +1,30 @@ +{{- /* Usage: {{ include "helm_lib_envs_for_proxy" . }} */ -}} +{{- /* Add HTTP_PROXY, HTTPS_PROXY and NO_PROXY environment variables for container */ -}} +{{- /* depends on [proxy settings](https://deckhouse.io/documentation/v1/deckhouse-configure-global.html#parameters-modules-proxy) */ -}} +{{- define "helm_lib_envs_for_proxy" }} + {{- $context := . -}} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- if $context.Values.global.clusterConfiguration }} + {{- if $context.Values.global.clusterConfiguration.proxy }} + {{- if $context.Values.global.clusterConfiguration.proxy.httpProxy }} +- name: HTTP_PROXY + value: {{ $context.Values.global.clusterConfiguration.proxy.httpProxy | quote }} +- name: http_proxy + value: {{ $context.Values.global.clusterConfiguration.proxy.httpProxy | quote }} + {{- end }} + {{- if $context.Values.global.clusterConfiguration.proxy.httpsProxy }} +- name: HTTPS_PROXY + value: {{ $context.Values.global.clusterConfiguration.proxy.httpsProxy | quote }} +- name: https_proxy + value: {{ $context.Values.global.clusterConfiguration.proxy.httpsProxy | quote }} + {{- end }} + {{- $noProxy := list "127.0.0.1" "169.254.169.254" $context.Values.global.clusterConfiguration.clusterDomain $context.Values.global.clusterConfiguration.podSubnetCIDR $context.Values.global.clusterConfiguration.serviceSubnetCIDR }} + {{- if $context.Values.global.clusterConfiguration.proxy.noProxy }} + {{- $noProxy = concat $noProxy $context.Values.global.clusterConfiguration.proxy.noProxy }} + {{- end }} +- name: NO_PROXY + value: {{ $noProxy | join "," | quote }} +- name: no_proxy + value: {{ $noProxy | join "," | quote }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/helm_lib/templates/_high_availability.tpl b/charts/helm_lib/templates/_high_availability.tpl new file mode 100644 index 0000000..8c7da23 --- /dev/null +++ b/charts/helm_lib/templates/_high_availability.tpl @@ -0,0 +1,39 @@ +{{- /* Usage: {{ include "helm_lib_is_ha_to_value" (list . yes no) }} */ -}} +{{- /* returns value "yes" if cluster is highly available, else — returns "no" */ -}} +{{- define "helm_lib_is_ha_to_value" }} + {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $yes := index . 1 -}} {{- /* Yes value */ -}} + {{- $no := index . 2 -}} {{- /* No value */ -}} + + {{- $module_values := (index $context.Values (include "helm_lib_module_camelcase_name" $context)) }} + + {{- if hasKey $module_values "highAvailability" -}} + {{- if $module_values.highAvailability -}} {{- $yes -}} {{- else -}} {{- $no -}} {{- end -}} + {{- else if hasKey $context.Values.global "highAvailability" -}} + {{- if $context.Values.global.highAvailability -}} {{- $yes -}} {{- else -}} {{- $no -}} {{- end -}} + {{- else -}} + {{- if $context.Values.global.discovery.clusterControlPlaneIsHighlyAvailable -}} {{- $yes -}} {{- else -}} {{- $no -}} {{- end -}} + {{- end -}} +{{- end }} + +{{- /* Usage: {{- if (include "helm_lib_ha_enabled" .) }} */ -}} +{{- /* returns empty value, which is treated by go template as false */ -}} +{{- define "helm_lib_ha_enabled" }} + {{- $context := . -}} {{- /* Template context with .Values, .Chart, etc */ -}} + + {{- $module_values := (index $context.Values (include "helm_lib_module_camelcase_name" $context)) }} + + {{- if hasKey $module_values "highAvailability" -}} + {{- if $module_values.highAvailability -}} + "not empty string" + {{- end -}} + {{- else if hasKey $context.Values.global "highAvailability" -}} + {{- if $context.Values.global.highAvailability -}} + "not empty string" + {{- end -}} + {{- else -}} + {{- if $context.Values.global.discovery.clusterControlPlaneIsHighlyAvailable -}} + "not empty string" + {{- end -}} + {{- end -}} +{{- end -}} diff --git a/charts/helm_lib/templates/_kube_rbac_proxy.tpl b/charts/helm_lib/templates/_kube_rbac_proxy.tpl new file mode 100644 index 0000000..af9f7a4 --- /dev/null +++ b/charts/helm_lib/templates/_kube_rbac_proxy.tpl @@ -0,0 +1,21 @@ +{{- /* Usage: {{ include "helm_lib_kube_rbac_proxy_ca_certificate" (list . "namespace") }} */ -}} +{{- /* Renders configmap with kube-rbac-proxy CA certificate which uses to verify the kube-rbac-proxy clients. */ -}} +{{- define "helm_lib_kube_rbac_proxy_ca_certificate" -}} +{{- /* Template context with .Values, .Chart, etc */ -}} +{{- /* Namespace where CA configmap will be created */ -}} + {{- $context := index . 0 }} + {{- $namespace := index . 1 }} +--- +apiVersion: v1 +data: + ca.crt: | + {{ $context.Values.global.internal.modules.kubeRBACProxyCA.cert | nindent 4 }} +kind: ConfigMap +metadata: + annotations: + kubernetes.io/description: | + Contains a CA bundle that can be used to verify the kube-rbac-proxy clients. + {{- include "helm_lib_module_labels" (list $context) | nindent 2 }} + name: kube-rbac-proxy-ca.crt + namespace: {{ $namespace }} +{{- end }} diff --git a/charts/helm_lib/templates/_module_documentation_uri.tpl b/charts/helm_lib/templates/_module_documentation_uri.tpl new file mode 100644 index 0000000..a02cf45 --- /dev/null +++ b/charts/helm_lib/templates/_module_documentation_uri.tpl @@ -0,0 +1,15 @@ +{{- /* Usage: {{ include "helm_lib_module_documentation_uri" (list . "") }} */ -}} +{{- /* returns rendered documentation uri using publicDomainTemplate or deckhouse.io domains*/ -}} +{{- define "helm_lib_module_documentation_uri" }} + {{- $default_doc_prefix := "https://deckhouse.io/documentation/v1" -}} + {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $path_portion := index . 1 -}} {{- /* Path to the document */ -}} + {{- $uri := "" -}} + {{- if $context.Values.global.modules.publicDomainTemplate }} + {{- $uri = printf "%s://%s%s" (include "helm_lib_module_uri_scheme" $context) (include "helm_lib_module_public_domain" (list $context "documentation")) $path_portion -}} + {{- else }} + {{- $uri = printf "%s%s" $default_doc_prefix $path_portion -}} + {{- end -}} + + {{ $uri }} +{{- end }} diff --git a/charts/helm_lib/templates/_module_ephemeral_storage.tpl b/charts/helm_lib/templates/_module_ephemeral_storage.tpl new file mode 100644 index 0000000..4b2dd02 --- /dev/null +++ b/charts/helm_lib/templates/_module_ephemeral_storage.tpl @@ -0,0 +1,15 @@ +{{- /* Usage: {{ include "helm_lib_module_ephemeral_storage_logs_with_extra" 10 }} */ -}} +{{- /* 50Mi for container logs `log-opts.max-file * log-opts.max-size` would be added to passed value */ -}} +{{- /* returns ephemeral-storage size for logs with extra space */ -}} +{{- define "helm_lib_module_ephemeral_storage_logs_with_extra" -}} +{{- /* Extra space in mebibytes */ -}} +ephemeral-storage: {{ add . 50 }}Mi +{{- end }} + +{{- /* Usage: {{ include "helm_lib_module_ephemeral_storage_only_logs" . }} */ -}} +{{- /* 50Mi for container logs `log-opts.max-file * log-opts.max-size` would be requested */ -}} +{{- /* returns ephemeral-storage size for only logs */ -}} +{{- define "helm_lib_module_ephemeral_storage_only_logs" -}} +{{- /* Template context with .Values, .Chart, etc */ -}} +ephemeral-storage: 50Mi +{{- end }} diff --git a/charts/helm_lib/templates/_module_generate_common_name.tpl b/charts/helm_lib/templates/_module_generate_common_name.tpl new file mode 100644 index 0000000..fb142f8 --- /dev/null +++ b/charts/helm_lib/templates/_module_generate_common_name.tpl @@ -0,0 +1,13 @@ +{{- /* Usage: {{ include "helm_lib_module_generate_common_name" (list . "") }} */ -}} +{{- /* returns the commonName parameter for use in the Certificate custom resource(cert-manager) */ -}} +{{- define "helm_lib_module_generate_common_name" }} + {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $name_portion := index . 1 -}} {{- /* Name portion */ -}} + + {{- $domain := include "helm_lib_module_public_domain" (list $context $name_portion) -}} + + {{- $domain_length := len $domain -}} + {{- if le $domain_length 64 -}} +commonName: {{ $domain }} + {{- end -}} +{{- end }} diff --git a/charts/helm_lib/templates/_module_https.tpl b/charts/helm_lib/templates/_module_https.tpl new file mode 100644 index 0000000..8ee41ef --- /dev/null +++ b/charts/helm_lib/templates/_module_https.tpl @@ -0,0 +1,160 @@ +{{- /* Usage: {{ include "helm_lib_module_uri_scheme" . }} */ -}} +{{- /* return module uri scheme "http" or "https" */ -}} +{{- define "helm_lib_module_uri_scheme" -}} + {{- $context := . -}} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $mode := "" -}} + + {{- $module_values := (index $context.Values (include "helm_lib_module_camelcase_name" $context)) -}} + {{- if hasKey $module_values "https" -}} + {{- if hasKey $module_values.https "mode" -}} + {{- $mode = $module_values.https.mode -}} + {{- else }} + {{- $mode = $context.Values.global.modules.https.mode | default "" -}} + {{- end }} + {{- else }} + {{- $mode = $context.Values.global.modules.https.mode | default "" -}} + {{- end }} + + + {{- if eq "Disabled" $mode -}} + http + {{- else -}} + https + {{- end -}} +{{- end -}} + +{{- /* Usage: {{ $https_values := include "helm_lib_https_values" . | fromYaml }} */ -}} +{{- define "helm_lib_https_values" -}} + {{- $context := . -}} + {{- $module_values := (index $context.Values (include "helm_lib_module_camelcase_name" $context)) -}} + {{- $mode := "" -}} + {{- $certManagerClusterIssuerName := "" -}} + + {{- if hasKey $module_values "https" -}} + {{- if hasKey $module_values.https "mode" -}} + {{- $mode = $module_values.https.mode -}} + {{- if eq $mode "CertManager" -}} + {{- if not (hasKey $module_values.https "certManager") -}} + {{- cat ".https.certManager.clusterIssuerName is mandatory when .https.mode is set to CertManager" | fail -}} + {{- end -}} + {{- if hasKey $module_values.https.certManager "clusterIssuerName" -}} + {{- $certManagerClusterIssuerName = $module_values.https.certManager.clusterIssuerName -}} + {{- else -}} + {{- cat ".https.certManager.clusterIssuerName is mandatory when .https.mode is set to CertManager" | fail -}} + {{- end -}} + {{- end -}} + {{- else -}} + {{- cat ".https.mode is mandatory when .https is defined" | fail -}} + {{- end -}} + {{- end -}} + + {{- if empty $mode -}} + {{- $mode = $context.Values.global.modules.https.mode -}} + {{- if eq $mode "CertManager" -}} + {{- $certManagerClusterIssuerName = $context.Values.global.modules.https.certManager.clusterIssuerName -}} + {{- end -}} + {{- end -}} + + {{- if not (has $mode (list "Disabled" "CertManager" "CustomCertificate" "OnlyInURI")) -}} + {{- cat "Unknown https.mode:" $mode | fail -}} + {{- end -}} + + {{- if and (eq $mode "CertManager") (not ($context.Values.global.enabledModules | has "cert-manager")) -}} + {{- cat "https.mode has value CertManager but cert-manager module not enabled" | fail -}} + {{- end -}} + +mode: {{ $mode }} + {{- if eq $mode "CertManager" }} +certManager: + clusterIssuerName: {{ $certManagerClusterIssuerName }} + {{- end -}} + +{{- end -}} + +{{- /* Usage: {{ if (include "helm_lib_module_https_mode" .) }} */ -}} +{{- /* returns https mode for module */ -}} +{{- define "helm_lib_module_https_mode" -}} + {{- $context := . -}} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $https_values := include "helm_lib_https_values" $context | fromYaml -}} + {{- $https_values.mode -}} +{{- end -}} + +{{- /* Usage: {{ include "helm_lib_module_https_cert_manager_cluster_issuer_name" . }} */ -}} +{{- /* returns cluster issuer name */ -}} +{{- define "helm_lib_module_https_cert_manager_cluster_issuer_name" -}} + {{- $context := . -}} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $https_values := include "helm_lib_https_values" $context | fromYaml -}} + {{- $https_values.certManager.clusterIssuerName -}} +{{- end -}} + +{{- /* Usage: {{ if (include "helm_lib_module_https_cert_manager_cluster_issuer_is_dns01_challenge_solver" .) }} */ -}} +{{- define "helm_lib_module_https_cert_manager_cluster_issuer_is_dns01_challenge_solver" -}} + {{- $context := . -}} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- if has (include "helm_lib_module_https_cert_manager_cluster_issuer_name" $context) (list "route53" "cloudflare" "digitalocean" "clouddns") }} + "not empty string" + {{- end -}} +{{- end -}} + +{{- /* Usage: {{ include "helm_lib_module_https_cert_manager_acme_solver_challenge_settings" . | nindent 4 }} */ -}} +{{- define "helm_lib_module_https_cert_manager_acme_solver_challenge_settings" -}} + {{- $context := . -}} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- if (include "helm_lib_module_https_cert_manager_cluster_issuer_is_dns01_challenge_solver" $context) }} +- dns01: + provider: {{ include "helm_lib_module_https_cert_manager_cluster_issuer_name" $context }} + {{- else }} +- http01: + ingressClass: {{ include "helm_lib_module_ingress_class" $context | quote }} + {{- end }} +{{- end -}} + +{{- /* Usage: {{ if (include "helm_lib_module_https_ingress_tls_enabled" .) }} */ -}} +{{- /* returns not empty string if tls should enable for ingress */ -}} +{{- define "helm_lib_module_https_ingress_tls_enabled" -}} + {{- $context := . -}} {{- /* Template context with .Values, .Chart, etc */ -}} + + {{- $mode := include "helm_lib_module_https_mode" $context -}} + + {{- if or (eq "CertManager" $mode) (eq "CustomCertificate" $mode) -}} + not empty string + {{- end -}} +{{- end -}} + +{{- /* Usage: {{ include "helm_lib_module_https_copy_custom_certificate" (list . "namespace" "secret_name_prefix") }} */ -}} +{{- /* Renders secret with [custom certificate](https://deckhouse.io/documentation/v1/deckhouse-configure-global.html#parameters-modules-https-customcertificate) */ -}} +{{- /* in passed namespace with passed prefix */ -}} +{{- define "helm_lib_module_https_copy_custom_certificate" -}} + {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $namespace := index . 1 -}} {{- /* Namespace */ -}} + {{- $secret_name_prefix := index . 2 -}} {{- /* Secret name prefix */ -}} + {{- $mode := include "helm_lib_module_https_mode" $context -}} + {{- if eq $mode "CustomCertificate" -}} + {{- $module_values := (index $context.Values (include "helm_lib_module_camelcase_name" $context)) -}} + {{- $secret_name := include "helm_lib_module_https_secret_name" (list $context $secret_name_prefix) -}} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ $secret_name }} + namespace: {{ $namespace }} + {{- include "helm_lib_module_labels" (list $context) | nindent 2 }} +type: kubernetes.io/tls +data: {{ $module_values.internal.customCertificateData | toJson }} + {{- end -}} +{{- end -}} + +{{- /* Usage: {{ include "helm_lib_module_https_secret_name (list . "secret_name_prefix") }} */ -}} +{{- /* returns custom certificate name */ -}} +{{- define "helm_lib_module_https_secret_name" -}} + {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $secret_name_prefix := index . 1 -}} {{- /* Secret name prefix */ -}} + {{- $mode := include "helm_lib_module_https_mode" $context -}} + {{- if eq $mode "CertManager" -}} + {{- $secret_name_prefix -}} + {{- else -}} + {{- if eq $mode "CustomCertificate" -}} + {{- printf "%s-customcertificate" $secret_name_prefix -}} + {{- else -}} + {{- fail "https.mode must be CustomCertificate or CertManager" -}} + {{- end -}} + {{- end -}} +{{- end -}} diff --git a/charts/helm_lib/templates/_module_image.tpl b/charts/helm_lib/templates/_module_image.tpl new file mode 100644 index 0000000..bdf29f0 --- /dev/null +++ b/charts/helm_lib/templates/_module_image.tpl @@ -0,0 +1,76 @@ +{{- /* Usage: {{ include "helm_lib_module_image" (list . "") }} */ -}} +{{- /* returns image name */ -}} +{{- define "helm_lib_module_image" }} + {{- $context := index . 0 }} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $containerName := index . 1 | trimAll "\"" }} {{- /* Container name */ -}} + {{- $moduleName := (include "helm_lib_module_camelcase_name" $context) }} + {{- if ge (len .) 3 }} + {{- $moduleName = (include "helm_lib_module_camelcase_name" (index . 2)) }} {{- /* Optional module name */ -}} + {{- end }} + {{- $imageDigest := index $context.Values.global.modulesImages.digests $moduleName $containerName }} + {{- if not $imageDigest }} + {{- $error := (printf "Image %s.%s has no digest" $moduleName $containerName ) }} + {{- fail $error }} + {{- end }} + {{- $registryBase := $context.Values.global.modulesImages.registry.base }} + {{- /* handle external modules registry */}} + {{- if index $context.Values $moduleName }} + {{- if index $context.Values $moduleName "registry" }} + {{- if index $context.Values $moduleName "registry" "base" }} + {{- $host := trimAll "/" (index $context.Values $moduleName "registry" "base") }} + {{- $path := trimAll "/" $context.Chart.Name }} + {{- $registryBase = join "/" (list $host $path) }} + {{- end }} + {{- end }} + {{- end }} + {{- printf "%s@%s" $registryBase $imageDigest }} +{{- end }} + +{{- /* Usage: {{ include "helm_lib_module_image_no_fail" (list . "") }} */ -}} +{{- /* returns image name if found */ -}} +{{- define "helm_lib_module_image_no_fail" }} + {{- $context := index . 0 }} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $containerName := index . 1 | trimAll "\"" }} {{- /* Container name */ -}} + {{- $moduleName := (include "helm_lib_module_camelcase_name" $context) }} + {{- if ge (len .) 3 }} + {{- $moduleName = (include "helm_lib_module_camelcase_name" (index . 2)) }} {{- /* Optional module name */ -}} + {{- end }} + {{- $imageDigest := index $context.Values.global.modulesImages.digests $moduleName $containerName }} + {{- if $imageDigest }} + {{- $registryBase := $context.Values.global.modulesImages.registry.base }} + {{- if index $context.Values $moduleName }} + {{- if index $context.Values $moduleName "registry" }} + {{- if index $context.Values $moduleName "registry" "base" }} + {{- $host := trimAll "/" (index $context.Values $moduleName "registry" "base") }} + {{- $path := trimAll "/" $context.Chart.Name }} + {{- $registryBase = join "/" (list $host $path) }} + {{- end }} + {{- end }} + {{- end }} + {{- printf "%s@%s" $registryBase $imageDigest }} + {{- end }} +{{- end }} + +{{- /* Usage: {{ include "helm_lib_module_common_image" (list . "") }} */ -}} +{{- /* returns image name from common module */ -}} +{{- define "helm_lib_module_common_image" }} + {{- $context := index . 0 }} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $containerName := index . 1 | trimAll "\"" }} {{- /* Container name */ -}} + {{- $imageDigest := index $context.Values.global.modulesImages.digests "common" $containerName }} + {{- if not $imageDigest }} + {{- $error := (printf "Image %s.%s has no digest" "common" $containerName ) }} + {{- fail $error }} + {{- end }} + {{- printf "%s@%s" $context.Values.global.modulesImages.registry.base $imageDigest }} +{{- end }} + +{{- /* Usage: {{ include "helm_lib_module_common_image_no_fail" (list . "") }} */ -}} +{{- /* returns image name from common module if found */ -}} +{{- define "helm_lib_module_common_image_no_fail" }} + {{- $context := index . 0 }} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $containerName := index . 1 | trimAll "\"" }} {{- /* Container name */ -}} + {{- $imageDigest := index $context.Values.global.modulesImages.digests "common" $containerName }} + {{- if $imageDigest }} + {{- printf "%s@%s" $context.Values.global.modulesImages.registry.base $imageDigest }} + {{- end }} +{{- end }} \ No newline at end of file diff --git a/charts/helm_lib/templates/_module_ingress_class.tpl b/charts/helm_lib/templates/_module_ingress_class.tpl new file mode 100644 index 0000000..db7f50b --- /dev/null +++ b/charts/helm_lib/templates/_module_ingress_class.tpl @@ -0,0 +1,13 @@ +{{- /* Usage: {{ include "helm_lib_module_ingress_class" . }} */ -}} +{{- /* returns ingress class from module settings or if not exists from global config */ -}} +{{- define "helm_lib_module_ingress_class" -}} + {{- $context := . -}} {{- /* Template context with .Values, .Chart, etc */ -}} + + {{- $module_values := (index $context.Values (include "helm_lib_module_camelcase_name" $context)) -}} + + {{- if hasKey $module_values "ingressClass" -}} + {{- $module_values.ingressClass -}} + {{- else if hasKey $context.Values.global.modules "ingressClass" -}} + {{- $context.Values.global.modules.ingressClass -}} + {{- end -}} +{{- end -}} diff --git a/charts/helm_lib/templates/_module_init_container.tpl b/charts/helm_lib/templates/_module_init_container.tpl new file mode 100644 index 0000000..9b3fe00 --- /dev/null +++ b/charts/helm_lib/templates/_module_init_container.tpl @@ -0,0 +1,56 @@ +{{- /* ### Migration 11.12.2020: Remove this helper with all its usages after this commit reached RockSolid */ -}} +{{- /* Usage: {{ include "helm_lib_module_init_container_chown_nobody_volume" (list . "volume-name") }} */ -}} +{{- /* returns initContainer which chowns recursively all files and directories in passed volume */ -}} +{{- define "helm_lib_module_init_container_chown_nobody_volume" }} + {{- $context := index . 0 -}} + {{- $volume_name := index . 1 -}} +- name: chown-volume-{{ $volume_name }} + image: {{ include "helm_lib_module_common_image" (list $context "alpine") }} + command: ["sh", "-c", "chown -R 65534:65534 /tmp/{{ $volume_name }}"] + securityContext: + runAsNonRoot: false + runAsUser: 0 + runAsGroup: 0 + volumeMounts: + - name: {{ $volume_name }} + mountPath: /tmp/{{ $volume_name }} + resources: + requests: + {{- include "helm_lib_module_ephemeral_storage_only_logs" . | nindent 6 }} +{{- end }} + +{{- /* Usage: {{ include "helm_lib_module_init_container_chown_deckhouse_volume" (list . "volume-name") }} */ -}} +{{- /* returns initContainer which chowns recursively all files and directories in passed volume */ -}} +{{- define "helm_lib_module_init_container_chown_deckhouse_volume" }} + {{- $context := index . 0 -}} + {{- $volume_name := index . 1 -}} +- name: chown-volume-{{ $volume_name }} + image: {{ include "helm_lib_module_common_image" (list $context "alpine") }} + command: ["sh", "-c", "chown -R 64535:64535 /tmp/{{ $volume_name }}"] + securityContext: + runAsNonRoot: false + runAsUser: 0 + runAsGroup: 0 + volumeMounts: + - name: {{ $volume_name }} + mountPath: /tmp/{{ $volume_name }} + resources: + requests: + {{- include "helm_lib_module_ephemeral_storage_only_logs" . | nindent 6 }} +{{- end }} + +{{- /* Usage: {{ include "helm_lib_module_init_container_check_linux_kernel" (list . ">= 4.9.17") }} */ -}} +{{- /* returns initContainer which checks the kernel version on the node for compliance to semver constraint */ -}} +{{- define "helm_lib_module_init_container_check_linux_kernel" }} + {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $semver_constraint := index . 1 -}} {{- /* Semver constraint */ -}} +- name: check-linux-kernel + image: {{ include "helm_lib_module_common_image" (list $context "checkKernelVersion") }} + {{- include "helm_lib_module_pod_security_context_run_as_user_deckhouse" . | nindent 2 }} + env: + - name: KERNEL_CONSTRAINT + value: {{ $semver_constraint | quote }} + resources: + requests: + {{- include "helm_lib_module_ephemeral_storage_only_logs" $context | nindent 6 }} +{{- end }} diff --git a/charts/helm_lib/templates/_module_labels.tpl b/charts/helm_lib/templates/_module_labels.tpl new file mode 100644 index 0000000..228dcf3 --- /dev/null +++ b/charts/helm_lib/templates/_module_labels.tpl @@ -0,0 +1,15 @@ +{{- /* Usage: {{ include "helm_lib_module_labels" (list . (dict "app" "test" "component" "testing")) }} */ -}} +{{- /* returns deckhouse labels */ -}} +{{- define "helm_lib_module_labels" }} + {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- /* Additional labels dict */ -}} +labels: + heritage: deckhouse + module: {{ $context.Chart.Name }} + {{- if eq (len .) 2 }} + {{- $deckhouse_additional_labels := index . 1 }} + {{- range $key, $value := $deckhouse_additional_labels }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/helm_lib/templates/_module_name.tpl b/charts/helm_lib/templates/_module_name.tpl new file mode 100644 index 0000000..0fecf05 --- /dev/null +++ b/charts/helm_lib/templates/_module_name.tpl @@ -0,0 +1,11 @@ +{{- define "helm_lib_module_camelcase_name" -}} + +{{- $moduleName := "" -}} +{{- if (kindIs "string" .) -}} +{{- $moduleName = . | trimAll "\"" -}} +{{- else -}} +{{- $moduleName = .Chart.Name -}} +{{- end -}} + +{{ $moduleName | replace "-" "_" | camelcase | untitle }} +{{- end -}} diff --git a/charts/helm_lib/templates/_module_public_domain.tpl b/charts/helm_lib/templates/_module_public_domain.tpl new file mode 100644 index 0000000..bfbaae7 --- /dev/null +++ b/charts/helm_lib/templates/_module_public_domain.tpl @@ -0,0 +1,11 @@ +{{- /* Usage: {{ include "helm_lib_module_public_domain" (list . "") }} */ -}} +{{- /* returns rendered publicDomainTemplate to service fqdn */ -}} +{{- define "helm_lib_module_public_domain" }} + {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $name_portion := index . 1 -}} {{- /* Name portion */ -}} + + {{- if not (contains "%s" $context.Values.global.modules.publicDomainTemplate) }} + {{ fail "Error!!! global.modules.publicDomainTemplate must contain \"%s\" pattern to render service fqdn!" }} + {{- end }} + {{- printf $context.Values.global.modules.publicDomainTemplate $name_portion }} +{{- end }} diff --git a/charts/helm_lib/templates/_module_security_context.tpl b/charts/helm_lib/templates/_module_security_context.tpl new file mode 100644 index 0000000..c726277 --- /dev/null +++ b/charts/helm_lib/templates/_module_security_context.tpl @@ -0,0 +1,199 @@ +{{- /* Usage: {{ include "helm_lib_module_pod_security_context_run_as_user_custom" (list . 1000 1000) }} */ -}} +{{- /* returns PodSecurityContext parameters for Pod with custom user and group */ -}} +{{- define "helm_lib_module_pod_security_context_run_as_user_custom" -}} +{{- /* Template context with .Values, .Chart, etc */ -}} +{{- /* User id */ -}} +{{- /* Group id */ -}} +securityContext: + runAsNonRoot: true + runAsUser: {{ index . 1 }} + runAsGroup: {{ index . 2 }} +{{- end }} + +{{- /* Usage: {{ include "helm_lib_module_pod_security_context_run_as_user_nobody" . }} */ -}} +{{- /* returns PodSecurityContext parameters for Pod with user and group "nobody" */ -}} +{{- define "helm_lib_module_pod_security_context_run_as_user_nobody" -}} +{{- /* Template context with .Values, .Chart, etc */ -}} +securityContext: + runAsNonRoot: true + runAsUser: 65534 + runAsGroup: 65534 +{{- end }} + +{{- /* Usage: {{ include "helm_lib_module_pod_security_context_run_as_user_nobody_with_writable_fs" . }} */ -}} +{{- /* returns PodSecurityContext parameters for Pod with user and group "nobody" with write access to mounted volumes */ -}} +{{- define "helm_lib_module_pod_security_context_run_as_user_nobody_with_writable_fs" -}} +{{- /* Template context with .Values, .Chart, etc */ -}} +securityContext: + runAsNonRoot: true + runAsUser: 65534 + runAsGroup: 65534 + fsGroup: 65534 +{{- end }} + +{{- /* Usage: {{ include "helm_lib_module_pod_security_context_run_as_user_deckhouse" . }} */ -}} +{{- /* returns PodSecurityContext parameters for Pod with user and group "deckhouse" */ -}} +{{- define "helm_lib_module_pod_security_context_run_as_user_deckhouse" -}} +{{- /* Template context with .Values, .Chart, etc */ -}} +securityContext: + runAsNonRoot: true + runAsUser: 64535 + runAsGroup: 64535 +{{- end }} + +{{- /* Usage: {{ include "helm_lib_module_pod_security_context_run_as_user_deckhouse_with_writable_fs" . }} */ -}} +{{- /* returns PodSecurityContext parameters for Pod with user and group "deckhouse" with write access to mounted volumes */ -}} +{{- define "helm_lib_module_pod_security_context_run_as_user_deckhouse_with_writable_fs" -}} +{{- /* Template context with .Values, .Chart, etc */ -}} +securityContext: + runAsNonRoot: true + runAsUser: 64535 + runAsGroup: 64535 + fsGroup: 64535 +{{- end }} + +{{- /* Usage: {{ include "helm_lib_module_container_security_context_run_as_user_deckhouse_pss_restricted" . }} */ -}} +{{- /* returns SecurityContext parameters for Container with user and group "deckhouse" plus minimal required settings to comply with the Restricted mode of the Pod Security Standards */ -}} +{{- define "helm_lib_module_container_security_context_run_as_user_deckhouse_pss_restricted" -}} +{{- /* Template context with .Values, .Chart, etc */ -}} +securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - all + runAsGroup: 64535 + runAsNonRoot: true + runAsUser: 64535 + seccompProfile: + type: RuntimeDefault +{{- end }} + +{{- /* Usage: {{ include "helm_lib_module_pod_security_context_run_as_user_root" . }} */ -}} +{{- /* returns PodSecurityContext parameters for Pod with user and group 0 */ -}} +{{- define "helm_lib_module_pod_security_context_run_as_user_root" -}} +{{- /* Template context with .Values, .Chart, etc */ -}} +securityContext: + runAsNonRoot: false + runAsUser: 0 + runAsGroup: 0 +{{- end }} + +{{- /* Usage: {{ include "helm_lib_module_pod_security_context_runtime_default" . }} */ -}} +{{- /* returns PodSecurityContext parameters for Pod with seccomp profile RuntimeDefault */ -}} +{{- define "helm_lib_module_pod_security_context_runtime_default" -}} +{{- /* Template context with .Values, .Chart, etc */ -}} +securityContext: + seccompProfile: + type: RuntimeDefault +{{- end }} + +{{- /* Usage: {{ include "helm_lib_module_container_security_context_not_allow_privilege_escalation" . }} */ -}} +{{- /* returns SecurityContext parameters for Container with allowPrivilegeEscalation false */ -}} +{{- define "helm_lib_module_container_security_context_not_allow_privilege_escalation" -}} +securityContext: + allowPrivilegeEscalation: false +{{- end }} + +{{- /* Usage: {{ include "helm_lib_module_container_security_context_read_only_root_filesystem_with_selinux" . }} */ -}} +{{- /* returns SecurityContext parameters for Container with read only root filesystem and options for SELinux compatibility*/ -}} +{{- define "helm_lib_module_container_security_context_read_only_root_filesystem_with_selinux" -}} +{{- /* Template context with .Values, .Chart, etc */ -}} +securityContext: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + seLinuxOptions: + level: 's0' + type: 'spc_t' +{{- end }} + +{{- /* Usage: {{ include "helm_lib_module_container_security_context_read_only_root_filesystem" . }} */ -}} +{{- /* returns SecurityContext parameters for Container with read only root filesystem */ -}} +{{- define "helm_lib_module_container_security_context_read_only_root_filesystem" -}} +{{- /* Template context with .Values, .Chart, etc */ -}} +securityContext: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false +{{- end }} + +{{- /* Usage: {{ include "helm_lib_module_container_security_context_privileged" . }} */ -}} +{{- /* returns SecurityContext parameters for Container running privileged */ -}} +{{- define "helm_lib_module_container_security_context_privileged" -}} +securityContext: + privileged: true +{{- end }} + +{{- /* Usage: {{ include "helm_lib_module_container_security_context_escalated_sys_admin_privileged" . }} */ -}} +{{- /* returns SecurityContext parameters for Container running privileged with escalation and sys_admin */ -}} +{{- define "helm_lib_module_container_security_context_escalated_sys_admin_privileged" -}} +securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - SYS_ADMIN + privileged: true +{{- end }} + +{{- /* Usage: {{ include "helm_lib_module_container_security_context_privileged_read_only_root_filesystem" . }} */ -}} +{{- /* returns SecurityContext parameters for Container running privileged with read only root filesystem */ -}} +{{- define "helm_lib_module_container_security_context_privileged_read_only_root_filesystem" -}} +{{- /* Template context with .Values, .Chart, etc */ -}} +securityContext: + privileged: true + readOnlyRootFilesystem: true +{{- end }} + +{{- /* Usage: {{ include "helm_lib_module_container_security_context_read_only_root_filesystem_capabilities_drop_all" . }} */ -}} +{{- /* returns SecurityContext for Container with read only root filesystem and all capabilities dropped */ -}} +{{- define "helm_lib_module_container_security_context_read_only_root_filesystem_capabilities_drop_all" -}} +{{- /* Template context with .Values, .Chart, etc */ -}} +securityContext: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL +{{- end }} + +{{- /* Usage: {{ include "helm_lib_module_container_security_context_read_only_root_filesystem_capabilities_drop_all_and_add" (list . (list "KILL" "SYS_PTRACE")) }} */ -}} +{{- /* returns SecurityContext parameters for Container with read only root filesystem, all dropped and some added capabilities */ -}} +{{- define "helm_lib_module_container_security_context_read_only_root_filesystem_capabilities_drop_all_and_add" -}} +{{- /* Template context with .Values, .Chart, etc */ -}} +{{- /* List of capabilities */ -}} +securityContext: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + add: {{ index . 1 | toJson }} +{{- end }} + +{{- /* Usage: {{ include "helm_lib_module_container_security_context_capabilities_drop_all_and_add" (list . (list "KILL" "SYS_PTRACE")) }} */ -}} +{{- /* returns SecurityContext parameters for Container with all dropped and some added capabilities */ -}} +{{- define "helm_lib_module_container_security_context_capabilities_drop_all_and_add" -}} +{{- /* Template context with .Values, .Chart, etc */ -}} +{{- /* List of capabilities */ -}} +securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + add: {{ index . 1 | toJson }} +{{- end }} + +{{- /* Usage: {{ include "helm_lib_module_container_security_context_capabilities_drop_all_and_run_as_user_custom" (list . 1000 1000) }} */ -}} +{{- /* returns SecurityContext parameters for Container with read only root filesystem, all dropped, and custom user ID */ -}} +{{- define "helm_lib_module_container_security_context_capabilities_drop_all_and_run_as_user_custom" -}} +{{- /* Template context with .Values, .Chart, etc */ -}} +{{- /* User id */ -}} +{{- /* Group id */ -}} +securityContext: + runAsUser: {{ index . 1 }} + runAsGroup: {{ index . 2 }} + runAsNonRoot: true + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL +{{- end }} diff --git a/charts/helm_lib/templates/_module_storage_class.tpl b/charts/helm_lib/templates/_module_storage_class.tpl new file mode 100644 index 0000000..cf761a5 --- /dev/null +++ b/charts/helm_lib/templates/_module_storage_class.tpl @@ -0,0 +1,38 @@ +{{- /* Usage: {{ include "helm_lib_module_storage_class_annotations" (list $ $index $storageClass.name) }} */ -}} +{{- /* return module StorageClass annotations */ -}} +{{- define "helm_lib_module_storage_class_annotations" -}} + {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $sc_index := index . 1 -}} {{- /* Storage class index */ -}} + {{- $sc_name := index . 2 -}} {{- /* Storage class name */ -}} + {{- $module_values := (index $context.Values (include "helm_lib_module_camelcase_name" $context)) -}} + {{- $annotations := dict -}} + + {{- $volume_expansion_mode_offline := false -}} + {{- range $module_name := list "cloud-provider-azure" "cloud-provider-yandex" "cloud-provider-vsphere" "cloud-provider-vcd"}} + {{- if has $module_name $context.Values.global.enabledModules }} + {{- $volume_expansion_mode_offline = true }} + {{- end }} + {{- end }} + + {{- if $volume_expansion_mode_offline }} + {{- $_ := set $annotations "storageclass.deckhouse.io/volume-expansion-mode" "offline" }} + {{- end }} + + {{- if hasKey $module_values.internal "defaultStorageClass" }} + {{- if eq $module_values.internal.defaultStorageClass $sc_name }} + {{- $_ := set $annotations "storageclass.kubernetes.io/is-default-class" "true" }} + {{- end }} + {{- else }} + {{- if eq $sc_index 0 }} + {{- if $context.Values.global.discovery.defaultStorageClass }} + {{- if eq $context.Values.global.discovery.defaultStorageClass $sc_name }} + {{- $_ := set $annotations "storageclass.kubernetes.io/is-default-class" "true" }} + {{- end }} + {{- else }} + {{- $_ := set $annotations "storageclass.kubernetes.io/is-default-class" "true" }} + {{- end }} + {{- end }} + {{- end }} + +{{- (dict "annotations" $annotations) | toYaml -}} +{{- end -}} diff --git a/charts/helm_lib/templates/_monitoring_grafana_dashboards.tpl b/charts/helm_lib/templates/_monitoring_grafana_dashboards.tpl new file mode 100644 index 0000000..ebbcefb --- /dev/null +++ b/charts/helm_lib/templates/_monitoring_grafana_dashboards.tpl @@ -0,0 +1,68 @@ +{{- /* Usage: {{ include "helm_lib_grafana_dashboard_definitions_recursion" (list . [current dir]) }} */ -}} +{{- /* returns all the dashboard-definintions from / */ -}} +{{- /* current dir is optional — used for recursion but you can use it for partially generating dashboards */ -}} +{{- define "helm_lib_grafana_dashboard_definitions_recursion" -}} + {{- $context := index . 0 }} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $rootDir := index . 1 }} {{- /* Dashboards root dir */ -}} + {{- /* Dashboards current dir */ -}} + + {{- $currentDir := "" }} + {{- if gt (len .) 2 }} {{- $currentDir = index . 2 }} {{- else }} {{- $currentDir = $rootDir }} {{- end }} + + {{- $currentDirIndex := (sub ($currentDir | splitList "/" | len) 1) }} + {{- $rootDirIndex := (sub ($rootDir | splitList "/" | len) 1) }} + {{- $folderNamesIndex := (add1 $rootDirIndex) }} + + {{- range $path, $_ := $context.Files.Glob (print $currentDir "/*.json") }} + {{- $fileName := ($path | splitList "/" | last ) }} + {{- $definition := ($context.Files.Get $path) }} + + {{- $folder := (index ($currentDir | splitList "/") $folderNamesIndex | replace "-" " " | title) }} + {{- $resourceName := (regexReplaceAllLiteral "\\.json$" $path "") }} + {{- $resourceName = ($resourceName | replace " " "-" | replace "." "-" | replace "_" "-") }} + {{- $resourceName = (slice ($resourceName | splitList "/") $folderNamesIndex | join "-") }} + {{- $resourceName = (printf "%s-%s" $context.Chart.Name $resourceName) }} + +{{ include "helm_lib_single_dashboard" (list $context $resourceName $folder $definition) }} + {{- end }} + + {{- $subDirs := list }} + {{- range $path, $_ := ($context.Files.Glob (print $currentDir "/**.json")) }} + {{- $pathSlice := ($path | splitList "/") }} + {{- $subDirs = append $subDirs (slice $pathSlice 0 (add $currentDirIndex 2) | join "/") }} + {{- end }} + + {{- range $subDir := ($subDirs | uniq) }} +{{ include "helm_lib_grafana_dashboard_definitions_recursion" (list $context $rootDir $subDir) }} + {{- end }} +{{- end }} + + +{{- /* Usage: {{ include "helm_lib_grafana_dashboard_definitions" . }} */ -}} +{{- /* returns dashboard-definintions from monitoring/grafana-dashboards/ */ -}} +{{- define "helm_lib_grafana_dashboard_definitions" -}} + {{- $context := . }} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- if ( $context.Values.global.enabledModules | has "prometheus-crd" ) }} +{{- include "helm_lib_grafana_dashboard_definitions_recursion" (list $context "monitoring/grafana-dashboards") }} + {{- end }} +{{- end }} + + +{{- /* Usage: {{ include "helm_lib_single_dashboard" (list . "dashboard-name" "folder" $dashboard) }} */ -}} +{{- /* renders a single dashboard */ -}} +{{- define "helm_lib_single_dashboard" -}} + {{- $context := index . 0 }} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $resourceName := index . 1 }} {{- /* Dashboard name */ -}} + {{- $folder := index . 2 }} {{- /* Folder */ -}} + {{- $definition := index . 3 }} {{/* Dashboard definition */}} +--- +apiVersion: deckhouse.io/v1 +kind: GrafanaDashboardDefinition +metadata: + name: d8-{{ $resourceName }} + {{- include "helm_lib_module_labels" (list $context (dict "prometheus.deckhouse.io/grafana-dashboard" "")) | nindent 2 }} +spec: + folder: "{{ $folder }}" + definition: | + {{- $definition | nindent 4 }} +{{- end }} diff --git a/charts/helm_lib/templates/_monitoring_prometheus_rules.tpl b/charts/helm_lib/templates/_monitoring_prometheus_rules.tpl new file mode 100644 index 0000000..794fe30 --- /dev/null +++ b/charts/helm_lib/templates/_monitoring_prometheus_rules.tpl @@ -0,0 +1,96 @@ +{{- /* Usage: {{ include "helm_lib_prometheus_rules_recursion" (list . [current dir]) }} */ -}} +{{- /* returns all the prometheus rules from / */ -}} +{{- /* current dir is optional — used for recursion but you can use it for partially generating rules */ -}} +{{- define "helm_lib_prometheus_rules_recursion" -}} + {{- $context := index . 0 }} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $namespace := index . 1 }} {{- /* Namespace for creating rules */ -}} + {{- $rootDir := index . 2 }} {{- /* Rules root dir */ -}} + {{- $currentDir := "" }} {{- /* Current dir (optional) */ -}} + {{- if gt (len .) 3 }} {{- $currentDir = index . 3 }} {{- else }} {{- $currentDir = $rootDir }} {{- end }} + {{- $currentDirIndex := (sub ($currentDir | splitList "/" | len) 1) }} + {{- $rootDirIndex := (sub ($rootDir | splitList "/" | len) 1) }} + {{- $folderNamesIndex := (add1 $rootDirIndex) }} + + {{- range $path, $_ := $context.Files.Glob (print $currentDir "/*.{yaml,tpl}") }} + {{- $fileName := ($path | splitList "/" | last ) }} + {{- $definition := "" }} + {{- if eq ($path | splitList "." | last) "tpl" -}} + {{- $definition = tpl ($context.Files.Get $path) $context }} + {{- else }} + {{- $definition = $context.Files.Get $path }} + {{- end }} + + {{- $definition = $definition | replace "__SCRAPE_INTERVAL__" (printf "%ds" ($context.Values.global.discovery.prometheusScrapeInterval | default 30)) | replace "__SCRAPE_INTERVAL_X_2__" (printf "%ds" (mul ($context.Values.global.discovery.prometheusScrapeInterval | default 30) 2)) | replace "__SCRAPE_INTERVAL_X_3__" (printf "%ds" (mul ($context.Values.global.discovery.prometheusScrapeInterval | default 30) 3)) | replace "__SCRAPE_INTERVAL_X_4__" (printf "%ds" (mul ($context.Values.global.discovery.prometheusScrapeInterval | default 30) 4)) }} + +{{/* Patch expression based on `d8_ignore_on_update` annotation*/}} + + + {{ $definition = printf "Rules:\n%s" ($definition | nindent 2) }} + {{- $definitionStruct := ( $definition | fromYaml )}} + {{- if $definitionStruct.Error }} + {{- fail ($definitionStruct.Error | toString) }} + {{- end }} + {{- range $rule := $definitionStruct.Rules }} + + {{- range $dedicatedRule := $rule.rules }} + {{- if $dedicatedRule.annotations }} + {{- if (eq (get $dedicatedRule.annotations "d8_ignore_on_update") "true") }} + {{- $_ := set $dedicatedRule "expr" (printf "(%s) and ON() ((max(d8_is_updating) != 1) or ON() absent(d8_is_updating))" $dedicatedRule.expr) }} + {{- end }} + {{- end }} + {{- end }} + + {{- end }} + + {{ $definition = $definitionStruct.Rules | toYaml }} + + {{- $resourceName := (regexReplaceAllLiteral "\\.(yaml|tpl)$" $path "") }} + {{- $resourceName = ($resourceName | replace " " "-" | replace "." "-" | replace "_" "-") }} + {{- $resourceName = (slice ($resourceName | splitList "/") $folderNamesIndex | join "-") }} + {{- $resourceName = (printf "%s-%s" $context.Chart.Name $resourceName) }} +--- +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule +metadata: + name: {{ $resourceName }} + namespace: {{ $namespace }} + {{- include "helm_lib_module_labels" (list $context (dict "app" "prometheus" "prometheus" "main" "component" "rules")) | nindent 2 }} +spec: + groups: + {{- $definition | nindent 4 }} + {{- end }} + + {{- $subDirs := list }} + {{- range $path, $_ := ($context.Files.Glob (print $currentDir "/**.{yaml,tpl}")) }} + {{- $pathSlice := ($path | splitList "/") }} + {{- $subDirs = append $subDirs (slice $pathSlice 0 (add $currentDirIndex 2) | join "/") }} + {{- end }} + + {{- range $subDir := ($subDirs | uniq) }} +{{ include "helm_lib_prometheus_rules_recursion" (list $context $namespace $rootDir $subDir) }} + {{- end }} +{{- end }} + + +{{- /* Usage: {{ include "helm_lib_prometheus_rules" (list . ) }} */ -}} +{{- /* returns all the prometheus rules from monitoring/prometheus-rules/ */ -}} +{{- define "helm_lib_prometheus_rules" -}} + {{- $context := index . 0 }} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $namespace := index . 1 }} {{- /* Namespace for creating rules */ -}} + {{- if ( $context.Values.global.enabledModules | has "operator-prometheus-crd" ) }} +{{- include "helm_lib_prometheus_rules_recursion" (list $context $namespace "monitoring/prometheus-rules") }} + {{- end }} +{{- end }} + +{{- /* Usage: {{ include "helm_lib_prometheus_target_scrape_timeout_seconds" (list . ) }} */ -}} +{{- /* returns adjust timeout value to scrape interval / */ -}} +{{- define "helm_lib_prometheus_target_scrape_timeout_seconds" -}} + {{- $context := index . 0 }} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $timeout := index . 1 }} {{- /* Target timeout in seconds */ -}} + {{- $scrape_interval := (int $context.Values.global.discovery.prometheusScrapeInterval | default 30) }} + {{- if gt $timeout $scrape_interval -}} +{{ $scrape_interval }}s + {{- else -}} +{{ $timeout }}s + {{- end }} +{{- end }} diff --git a/charts/helm_lib/templates/_node_affinity.tpl b/charts/helm_lib/templates/_node_affinity.tpl new file mode 100644 index 0000000..cbdd0f9 --- /dev/null +++ b/charts/helm_lib/templates/_node_affinity.tpl @@ -0,0 +1,256 @@ +{{- /* Verify node selector strategy. */ -}} +{{- define "helm_lib_internal_check_node_selector_strategy" -}} + {{ if not (has . (list "frontend" "monitoring" "system" "master" )) }} + {{- fail (printf "unknown strategy \"%v\"" .) }} + {{- end }} + {{- . -}} +{{- end }} + +{{- /* Returns node selector for workloads depend on strategy. */ -}} +{{- define "helm_lib_node_selector" }} + {{- $context := index . 0 }} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $strategy := index . 1 | include "helm_lib_internal_check_node_selector_strategy" }} {{- /* strategy, one of "frontend" "monitoring" "system" "master" "any-node" "wildcard" */ -}} + {{- $module_values := dict }} + {{- if lt (len .) 3 }} + {{- $module_values = (index $context.Values (include "helm_lib_module_camelcase_name" $context)) }} + {{- else }} + {{- $module_values = index . 2 }} + {{- end }} + {{- $camel_chart_name := (include "helm_lib_module_camelcase_name" $context) }} + + {{- if eq $strategy "monitoring" }} + {{- if $module_values.nodeSelector }} +nodeSelector: {{ $module_values.nodeSelector | toJson }} + {{- else if gt (index $context.Values.global.discovery.d8SpecificNodeCountByRole $camel_chart_name | int) 0 }} +nodeSelector: + node-role.deckhouse.io/{{$context.Chart.Name}}: "" + {{- else if gt (index $context.Values.global.discovery.d8SpecificNodeCountByRole $strategy | int) 0 }} +nodeSelector: + node-role.deckhouse.io/{{$strategy}}: "" + {{- else if gt (index $context.Values.global.discovery.d8SpecificNodeCountByRole "system" | int) 0 }} +nodeSelector: + node-role.deckhouse.io/system: "" + {{- end }} + + {{- else if or (eq $strategy "frontend") (eq $strategy "system") }} + {{- if $module_values.nodeSelector }} +nodeSelector: {{ $module_values.nodeSelector | toJson }} + {{- else if gt (index $context.Values.global.discovery.d8SpecificNodeCountByRole $camel_chart_name | int) 0 }} +nodeSelector: + node-role.deckhouse.io/{{$context.Chart.Name}}: "" + {{- else if gt (index $context.Values.global.discovery.d8SpecificNodeCountByRole $strategy | int) 0 }} +nodeSelector: + node-role.deckhouse.io/{{$strategy}}: "" + {{- end }} + + {{- else if eq $strategy "master" }} + {{- if gt (index $context.Values.global.discovery "clusterMasterCount" | int) 0 }} +nodeSelector: + node-role.kubernetes.io/control-plane: "" + {{- else if gt (index $context.Values.global.discovery.d8SpecificNodeCountByRole "master" | int) 0 }} +nodeSelector: + node-role.deckhouse.io/control-plane: "" + {{- else if gt (index $context.Values.global.discovery.d8SpecificNodeCountByRole "system" | int) 0 }} +nodeSelector: + node-role.deckhouse.io/system: "" + {{- end }} + {{- end }} +{{- end }} + + +{{- /* Returns tolerations for workloads depend on strategy. */ -}} +{{- /* Usage: {{ include "helm_lib_tolerations" (tuple . "any-node" "with-uninitialized" "without-storage-problems") }} */ -}} +{{- define "helm_lib_tolerations" }} + {{- $context := index . 0 }} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $strategy := index . 1 | include "helm_lib_internal_check_tolerations_strategy" }} {{- /* base strategy, one of "frontend" "monitoring" "system" any-node" "wildcard" */ -}} + {{- $additionalStrategies := tuple }} {{- /* list of additional strategies. To add strategy list it with prefix "with-", to remove strategy list it with prefix "without-". */ -}} + {{- if eq $strategy "custom" }} + {{ if lt (len .) 3 }} + {{- fail (print "additional strategies is required") }} + {{- end }} + {{- else }} + {{- $additionalStrategies = tuple "storage-problems" }} + {{- end }} + {{- $module_values := (index $context.Values (include "helm_lib_module_camelcase_name" $context)) }} + {{- if gt (len .) 2 }} + {{- range $as := slice . 2 (len .) }} + {{- if hasPrefix "with-" $as }} + {{- $additionalStrategies = mustAppend $additionalStrategies (trimPrefix "with-" $as) }} + {{- end }} + {{- if hasPrefix "without-" $as }} + {{- $additionalStrategies = mustWithout $additionalStrategies (trimPrefix "without-" $as) }} + {{- end }} + {{- end }} + {{- end }} +tolerations: + {{- /* Wildcard: gives permissions to schedule on any node with any taints (use with caution) */ -}} + {{- if eq $strategy "wildcard" }} + {{- include "_helm_lib_wildcard_tolerations" $context }} + + {{- else }} + {{- /* Any node: any node in the cluster with any known taints */ -}} + {{- if eq $strategy "any-node" }} + {{- include "_helm_lib_any_node_tolerations" $context }} + + {{- /* Tolerations from module config: overrides below strategies, if there is any toleration specified */ -}} + {{- else if $module_values.tolerations }} + {{- $module_values.tolerations | toYaml | nindent 0 }} + + {{- /* Monitoring: Nodes for monitoring components: prometheus, grafana, kube-state-metrics, etc. */ -}} + {{- else if eq $strategy "monitoring" }} + {{- include "_helm_lib_monitoring_tolerations" $context }} + + {{- /* Frontend: Nodes for ingress-controllers */ -}} + {{- else if eq $strategy "frontend" }} + {{- include "_helm_lib_frontend_tolerations" $context }} + + {{- /* System: Nodes for system components: prometheus, dns, cert-manager */ -}} + {{- else if eq $strategy "system" }} + {{- include "_helm_lib_system_tolerations" $context }} + {{- end }} + + {{- /* Additional strategies */ -}} + {{- range $additionalStrategies -}} + {{- include (printf "_helm_lib_additional_tolerations_%s" (. | replace "-" "_")) $context }} + {{- end }} + {{- end }} +{{- end }} + + +{{- /* Check cluster type. */ -}} +{{- /* Returns not empty string if this is cloud or hybrid cluster */ -}} +{{- define "_helm_lib_cloud_or_hybrid_cluster" }} + {{- if .Values.global.clusterConfiguration }} + {{- if eq .Values.global.clusterConfiguration.clusterType "Cloud" }} + "not empty string" + {{- /* We consider non-cloud clusters with enabled cloud-provider-.* module as Hybrid clusters */ -}} + {{- else }} + {{- range $v := .Values.global.enabledModules }} + {{- if hasPrefix "cloud-provider-" $v }} + "not empty string" + {{- end }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} + +{{- /* Verify base strategy. */ -}} +{{- /* Fails if strategy not in allowed list */ -}} +{{- define "helm_lib_internal_check_tolerations_strategy" -}} + {{ if not (has . (list "custom" "frontend" "monitoring" "system" "any-node" "wildcard" )) }} + {{- fail (printf "unknown strategy \"%v\"" .) }} + {{- end }} + {{- . -}} +{{- end }} + + +{{- /* Base strategy for any uncordoned node in cluster. */ -}} +{{- /* Usage: {{ include "helm_lib_tolerations" (tuple . "any-node") }} */ -}} +{{- define "_helm_lib_any_node_tolerations" }} +- key: node-role.kubernetes.io/master +- key: node-role.kubernetes.io/control-plane +- key: dedicated.deckhouse.io + operator: "Exists" +- key: dedicated + operator: "Exists" +- key: DeletionCandidateOfClusterAutoscaler +- key: ToBeDeletedByClusterAutoscaler + {{- if .Values.global.modules.placement.customTolerationKeys }} + {{- range $key := .Values.global.modules.placement.customTolerationKeys }} +- key: {{ $key | quote }} + operator: "Exists" + {{- end }} + {{- end }} +{{- end }} + +{{- /* Base strategy that tolerates all. */ -}} +{{- /* Usage: {{ include "helm_lib_tolerations" (tuple . "wildcard") }} */ -}} +{{- define "_helm_lib_wildcard_tolerations" }} +- operator: "Exists" +{{- end }} + +{{- /* Base strategy that tolerates nodes with "dedicated.deckhouse.io: monitoring" and "dedicated.deckhouse.io: system" taints. */ -}} +{{- /* Usage: {{ include "helm_lib_tolerations" (tuple . "monitoring") }} */ -}} +{{- define "_helm_lib_monitoring_tolerations" }} +- key: dedicated.deckhouse.io + operator: Equal + value: {{ .Chart.Name | quote }} +- key: dedicated.deckhouse.io + operator: Equal + value: "monitoring" +- key: dedicated.deckhouse.io + operator: Equal + value: "system" +{{- end }} + +{{- /* Base strategy that tolerates nodes with "dedicated.deckhouse.io: frontend" taints. */ -}} +{{- /* Usage: {{ include "helm_lib_tolerations" (tuple . "frontend") }} */ -}} +{{- define "_helm_lib_frontend_tolerations" }} +- key: dedicated.deckhouse.io + operator: Equal + value: {{ .Chart.Name | quote }} +- key: dedicated.deckhouse.io + operator: Equal + value: "frontend" +{{- end }} + +{{- /* Base strategy that tolerates nodes with "dedicated.deckhouse.io: system" taints. */ -}} +{{- /* Usage: {{ include "helm_lib_tolerations" (tuple . "system") }} */ -}} +{{- define "_helm_lib_system_tolerations" }} +- key: dedicated.deckhouse.io + operator: Equal + value: {{ .Chart.Name | quote }} +- key: dedicated.deckhouse.io + operator: Equal + value: "system" +{{- end }} + + +{{- /* Additional strategy "uninitialized" - used for CNI's and kube-proxy to allow cni components scheduled on node after CCM initialization. */ -}} +{{- /* Usage: {{ include "helm_lib_tolerations" (tuple . "any-node" "with-uninitialized") }} */ -}} +{{- define "_helm_lib_additional_tolerations_uninitialized" }} +- key: node.deckhouse.io/uninitialized + operator: "Exists" + effect: "NoSchedule" + {{- if include "_helm_lib_cloud_or_hybrid_cluster" . }} + {{- include "_helm_lib_additional_tolerations_no_csi" . }} + {{- end }} + {{- include "_helm_lib_additional_tolerations_node_problems" . }} +{{- end }} + +{{- /* Additional strategy "node-problems" - used for shedule critical components on non-ready nodes or nodes under pressure. */ -}} +{{- /* Usage: {{ include "helm_lib_tolerations" (tuple . "any-node" "with-node-problems") }} */ -}} +{{- define "_helm_lib_additional_tolerations_node_problems" }} +- key: node.kubernetes.io/not-ready +- key: node.kubernetes.io/out-of-disk +- key: node.kubernetes.io/memory-pressure +- key: node.kubernetes.io/disk-pressure +- key: node.kubernetes.io/pid-pressure +- key: node.kubernetes.io/unreachable +- key: node.kubernetes.io/network-unavailable +{{- end }} + +{{- /* Additional strategy "storage-problems" - used for shedule critical components on nodes with drbd problems. This additional strategy enabled by default in any base strategy except "wildcard". */ -}} +{{- /* Usage: {{ include "helm_lib_tolerations" (tuple . "any-node" "without-storage-problems") }} */ -}} +{{- define "_helm_lib_additional_tolerations_storage_problems" }} +- key: drbd.linbit.com/lost-quorum +- key: drbd.linbit.com/force-io-error +- key: drbd.linbit.com/ignore-fail-over +{{- end }} + +{{- /* Additional strategy "no-csi" - used for any node with no CSI: any node, which was initialized by deckhouse, but have no csi-node driver registered on it. */ -}} +{{- /* Usage: {{ include "helm_lib_tolerations" (tuple . "any-node" "with-no-csi") }} */ -}} +{{- define "_helm_lib_additional_tolerations_no_csi" }} +- key: node.deckhouse.io/csi-not-bootstrapped + operator: "Exists" + effect: "NoSchedule" +{{- end }} + +{{- /* Additional strategy "cloud-provider-uninitialized" - used for any node which is not initialized by CCM. */ -}} +{{- /* Usage: {{ include "helm_lib_tolerations" (tuple . "any-node" "with-cloud-provider-uninitialized") }} */ -}} +{{- define "_helm_lib_additional_tolerations_cloud_provider_uninitialized" }} + {{- if not .Values.global.clusterIsBootstrapped }} +- key: node.cloudprovider.kubernetes.io/uninitialized + operator: Exists + {{- end }} +{{- end }} diff --git a/charts/helm_lib/templates/_pod_disruption_budget.tpl b/charts/helm_lib/templates/_pod_disruption_budget.tpl new file mode 100644 index 0000000..ccd4f21 --- /dev/null +++ b/charts/helm_lib/templates/_pod_disruption_budget.tpl @@ -0,0 +1,6 @@ +{{- /* Usage: {{ include "helm_lib_pdb_daemonset" . }} */ -}} +{{- /* Returns PDB max unavailable */ -}} +{{- define "helm_lib_pdb_daemonset" }} + {{- $context := . -}} {{- /* Template context with .Values, .Chart, etc */ -}} +maxUnavailable: 10% +{{- end -}} diff --git a/charts/helm_lib/templates/_priority_class.tpl b/charts/helm_lib/templates/_priority_class.tpl new file mode 100644 index 0000000..5935445 --- /dev/null +++ b/charts/helm_lib/templates/_priority_class.tpl @@ -0,0 +1,9 @@ +{{- /* Usage: {{ include "helm_lib_priority_class" (tuple . "priority-class-name") }} /* -}} +{{- /* returns priority class if priority-class module enabled, otherwise returns nothing */ -}} +{{- define "helm_lib_priority_class" }} + {{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} + {{- $priorityClassName := index . 1 }} {{- /* Priority class name */ -}} + {{- if ( $context.Values.global.enabledModules | has "priority-class") }} +priorityClassName: {{ $priorityClassName }} + {{- end }} +{{- end -}} diff --git a/charts/helm_lib/templates/_resources_management.tpl b/charts/helm_lib/templates/_resources_management.tpl new file mode 100644 index 0000000..dff75c1 --- /dev/null +++ b/charts/helm_lib/templates/_resources_management.tpl @@ -0,0 +1,160 @@ +{{- /* Usage: {{ include "helm_lib_resources_management_pod_resources" (list [ephemeral storage requests]) }} */ -}} +{{- /* returns rendered resources section based on configuration if it is */ -}} +{{- define "helm_lib_resources_management_pod_resources" -}} + {{- $configuration := index . 0 -}} {{- /* VPA resource configuration [example](https://deckhouse.io/documentation/v1/modules/110-istio/configuration.html#parameters-controlplane-resourcesmanagement) */ -}} + {{- /* Ephemeral storage requests */ -}} + + {{- $ephemeral_storage := "50Mi" -}} + {{- if eq (len .) 2 -}} + {{- $ephemeral_storage = index . 1 -}} + {{- end -}} + + {{- $pod_resources := (include "helm_lib_resources_management_original_pod_resources" $configuration | fromYaml) -}} + {{- if not (hasKey $pod_resources "requests") -}} + {{- $_ := set $pod_resources "requests" (dict) -}} + {{- end -}} + {{- $_ := set $pod_resources.requests "ephemeral-storage" $ephemeral_storage -}} + + {{- $pod_resources | toYaml -}} +{{- end -}} + + +{{- /* Usage: {{ include "helm_lib_resources_management_original_pod_resources" }} */ -}} +{{- /* returns rendered resources section based on configuration if it is present */ -}} +{{- define "helm_lib_resources_management_original_pod_resources" -}} + {{- $configuration := . -}} {{- /* VPA resource configuration [example](https://deckhouse.io/documentation/v1/modules/110-istio/configuration.html#parameters-controlplane-resourcesmanagement) */ -}} + + {{- if $configuration -}} + {{- if eq $configuration.mode "Static" -}} +{{- $configuration.static | toYaml -}} + + {{- else if eq $configuration.mode "VPA" -}} + {{- $resources := dict "requests" (dict) "limits" (dict) -}} + + {{- if $configuration.vpa.cpu -}} + {{- if $configuration.vpa.cpu.min -}} + {{- $_ := set $resources.requests "cpu" ($configuration.vpa.cpu.min | toString) -}} + {{- end -}} + {{- if $configuration.vpa.cpu.limitRatio -}} + {{- $cpuLimitMillicores := round (mulf (include "helm_lib_resources_management_cpu_units_to_millicores" $configuration.vpa.cpu.min) $configuration.vpa.cpu.limitRatio) 0 | int64 -}} + {{- $_ := set $resources.limits "cpu" (printf "%dm" $cpuLimitMillicores) -}} + {{- end -}} + {{- end -}} + + {{- if $configuration.vpa.memory -}} + {{- if $configuration.vpa.memory.min -}} + {{- $_ := set $resources.requests "memory" ($configuration.vpa.memory.min | toString) -}} + {{- end -}} + {{- if $configuration.vpa.memory.limitRatio -}} + {{- $memoryLimitBytes := round (mulf (include "helm_lib_resources_management_memory_units_to_bytes" $configuration.vpa.memory.min) $configuration.vpa.memory.limitRatio) 0 | int64 -}} + {{- $_ := set $resources.limits "memory" (printf "%d" $memoryLimitBytes) -}} + {{- end -}} + {{- end -}} +{{- $resources | toYaml -}} + + {{- else -}} + {{- cat "ERROR: unknown resource management mode: " $configuration.mode | fail -}} + {{- end -}} + {{- end -}} +{{- end }} + + +{{- /* Usage: {{ include "helm_lib_resources_management_vpa_spec" (list ) }} */ -}} +{{- /* returns rendered vpa spec based on configuration and target reference */ -}} +{{- define "helm_lib_resources_management_vpa_spec" -}} + {{- $targetAPIVersion := index . 0 -}} {{- /* Target API version */ -}} + {{- $targetKind := index . 1 -}} {{- /* Target Kind */ -}} + {{- $targetName := index . 2 -}} {{- /* Target Name */ -}} + {{- $targetContainer := index . 3 -}} {{- /* Target container name */ -}} + {{- $configuration := index . 4 -}} {{- /* VPA resource configuration [example](https://deckhouse.io/documentation/v1/modules/110-istio/configuration.html#parameters-controlplane-resourcesmanagement) */ -}} + +targetRef: + apiVersion: {{ $targetAPIVersion }} + kind: {{ $targetKind }} + name: {{ $targetName }} + {{- if eq ($configuration.mode) "VPA" }} +updatePolicy: + updateMode: {{ $configuration.vpa.mode | quote }} +resourcePolicy: + containerPolicies: + - containerName: {{ $targetContainer }} + maxAllowed: + cpu: {{ $configuration.vpa.cpu.max | quote }} + memory: {{ $configuration.vpa.memory.max | quote }} + minAllowed: + cpu: {{ $configuration.vpa.cpu.min | quote }} + memory: {{ $configuration.vpa.memory.min | quote }} + controlledValues: RequestsAndLimits + {{- else }} +updatePolicy: + updateMode: "Off" + {{- end }} +{{- end }} + + +{{- /* Usage: {{ include "helm_lib_resources_management_cpu_units_to_millicores" }} */ -}} +{{- /* helper for converting cpu units to millicores */ -}} +{{- define "helm_lib_resources_management_cpu_units_to_millicores" -}} + {{- $units := . | toString -}} + {{- if hasSuffix "m" $units -}} + {{- trimSuffix "m" $units -}} + {{- else -}} + {{- atoi $units | mul 1000 -}} + {{- end }} +{{- end }} + + +{{- /* Usage: {{ include "helm_lib_resources_management_memory_units_to_bytes" }} */ -}} +{{- /* helper for converting memory units to bytes */ -}} +{{- define "helm_lib_resources_management_memory_units_to_bytes" }} + {{- $units := . | toString -}} + {{- if hasSuffix "k" $units -}} + {{- trimSuffix "k" $units | atoi | mul 1000 -}} + {{- else if hasSuffix "M" $units -}} + {{- trimSuffix "M" $units | atoi | mul 1000000 -}} + {{- else if hasSuffix "G" $units -}} + {{- trimSuffix "G" $units | atoi | mul 1000000000 -}} + {{- else if hasSuffix "T" $units -}} + {{- trimSuffix "T" $units | atoi | mul 1000000000000 -}} + {{- else if hasSuffix "P" $units -}} + {{- trimSuffix "P" $units | atoi | mul 1000000000000000 -}} + {{- else if hasSuffix "E" $units -}} + {{- trimSuffix "E" $units | atoi | mul 1000000000000000000 -}} + {{- else if hasSuffix "Ki" $units -}} + {{- trimSuffix "Ki" $units | atoi | mul 1024 -}} + {{- else if hasSuffix "Mi" $units -}} + {{- trimSuffix "Mi" $units | atoi | mul 1024 | mul 1024 -}} + {{- else if hasSuffix "Gi" $units -}} + {{- trimSuffix "Gi" $units | atoi | mul 1024 | mul 1024 | mul 1024 -}} + {{- else if hasSuffix "Ti" $units -}} + {{- trimSuffix "Ti" $units | atoi | mul 1024 | mul 1024 | mul 1024 | mul 1024 -}} + {{- else if hasSuffix "Pi" $units -}} + {{- trimSuffix "Pi" $units | atoi | mul 1024 | mul 1024 | mul 1024 | mul 1024 | mul 1024 -}} + {{- else if hasSuffix "Ei" $units -}} + {{- trimSuffix "Ei" $units | atoi | mul 1024 | mul 1024 | mul 1024 | mul 1024 | mul 1024 | mul 1024 -}} + {{- else if regexMatch "^[0-9]+$" $units -}} + {{- $units -}} + {{- else -}} + {{- cat "ERROR: unknown memory format:" $units | fail -}} + {{- end }} +{{- end }} + +{{- /* Usage: {{ include "helm_lib_vpa_kube_rbac_proxy_resources" . }} */ -}} +{{- /* helper for VPA resources for kube_rbac_proxy */ -}} +{{- define "helm_lib_vpa_kube_rbac_proxy_resources" }} +{{- /* Template context with .Values, .Chart, etc */ -}} +- containerName: kube-rbac-proxy + minAllowed: + {{- include "helm_lib_container_kube_rbac_proxy_resources" . | nindent 4 }} + maxAllowed: + cpu: 20m + memory: 25Mi +{{- end }} + +{{- /* Usage: {{ include "helm_lib_container_kube_rbac_proxy_resources" . }} */ -}} +{{- /* helper for container resources for kube_rbac_proxy */ -}} +{{- define "helm_lib_container_kube_rbac_proxy_resources" }} +{{- /* Template context with .Values, .Chart, etc */ -}} +cpu: 10m +memory: 25Mi +{{- end }} diff --git a/charts/helm_lib/templates/_spec_for_high_availability.tpl b/charts/helm_lib/templates/_spec_for_high_availability.tpl new file mode 100644 index 0000000..8bfbf9e --- /dev/null +++ b/charts/helm_lib/templates/_spec_for_high_availability.tpl @@ -0,0 +1,138 @@ +{{- /* Usage: {{ include "helm_lib_pod_anti_affinity_for_ha" (list . (dict "app" "test")) }} */ -}} +{{- /* returns pod affinity spec */ -}} +{{- define "helm_lib_pod_anti_affinity_for_ha" }} +{{- $context := index . 0 -}} {{- /* Template context with .Values, .Chart, etc */ -}} +{{- $labels := index . 1 }} {{- /* Match labels for podAntiAffinity label selector */ -}} + {{- if (include "helm_lib_ha_enabled" $context) }} +affinity: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + {{- range $key, $value := $labels }} + {{ $key }}: {{ $value | quote }} + {{- end }} + topologyKey: kubernetes.io/hostname + {{- end }} +{{- end }} + +{{- /* Usage: {{ include "helm_lib_deployment_on_master_strategy_and_replicas_for_ha" }} */ -}} +{{- /* returns deployment strategy and replicas for ha components running on master nodes */ -}} +{{- define "helm_lib_deployment_on_master_strategy_and_replicas_for_ha" }} +{{- /* Template context with .Values, .Chart, etc */ -}} + {{- if (include "helm_lib_ha_enabled" .) }} + {{- if gt (index .Values.global.discovery "clusterMasterCount" | int) 0 }} +replicas: {{ index .Values.global.discovery "clusterMasterCount" }} +strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 0 + {{- if gt (index .Values.global.discovery "clusterMasterCount" | int) 2 }} + maxUnavailable: 2 + {{- else }} + maxUnavailable: 1 + {{- end }} + {{- else if gt (index .Values.global.discovery.d8SpecificNodeCountByRole "master" | int) 0 }} +replicas: {{ index .Values.global.discovery.d8SpecificNodeCountByRole "master" }} +strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 0 + {{- if gt (index .Values.global.discovery.d8SpecificNodeCountByRole "master" | int) 2 }} + maxUnavailable: 2 + {{- else }} + maxUnavailable: 1 + {{- end }} + {{- else }} +replicas: 2 +strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 0 + maxUnavailable: 1 + {{- end }} + {{- else }} +replicas: 1 +strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 0 + maxUnavailable: 1 + {{- end }} +{{- end }} + +{{- /* Usage: {{ include "helm_lib_deployment_on_master_custom_strategy_and_replicas_for_ha" (list . (dict "strategy" "strategy_type")) }} */ -}} +{{- /* returns deployment with custom strategy and replicas for ha components running on master nodes */ -}} +{{- define "helm_lib_deployment_on_master_custom_strategy_and_replicas_for_ha" }} +{{- $context := index . 0 }} +{{- $optionalArgs := dict }} +{{- $strategy := "RollingUpdate" }} +{{- if ge (len .) 2 }} + {{- $optionalArgs = index . 1 }} +{{- end }} +{{- if hasKey $optionalArgs "strategy" }} + {{- $strategy = $optionalArgs.strategy }} +{{- end }} +{{- /* Template context with .Values, .Chart, etc */ -}} + {{- if (include "helm_lib_ha_enabled" $context) }} + {{- if gt (index $context.Values.global.discovery "clusterMasterCount" | int) 0 }} +replicas: {{ index $context.Values.global.discovery "clusterMasterCount" }} +strategy: + type: {{ $strategy }} + {{- if eq $strategy "RollingUpdate" }} + rollingUpdate: + maxSurge: 0 + {{- if gt (index $context.Values.global.discovery "clusterMasterCount" | int) 2 }} + maxUnavailable: 2 + {{- else }} + maxUnavailable: 1 + {{- end }} + {{- end }} + {{- else if gt (index $context.Values.global.discovery.d8SpecificNodeCountByRole "master" | int) 0 }} +replicas: {{ index $context.Values.global.discovery.d8SpecificNodeCountByRole "master" }} +strategy: + type: {{ $strategy }} + {{- if eq $strategy "RollingUpdate" }} + rollingUpdate: + maxSurge: 0 + {{- if gt (index $context.Values.global.discovery.d8SpecificNodeCountByRole "master" | int) 2 }} + maxUnavailable: 2 + {{- else }} + maxUnavailable: 1 + {{- end }} + {{- end }} + {{- else }} +replicas: 2 +strategy: + type: {{ $strategy }} + {{- if eq $strategy "RollingUpdate" }} + rollingUpdate: + maxSurge: 0 + maxUnavailable: 1 + {{- end }} + {{- end }} + {{- else }} +replicas: 1 +strategy: + type: {{ $strategy }} + {{- if eq $strategy "RollingUpdate" }} + rollingUpdate: + maxSurge: 0 + maxUnavailable: 1 + {{- end }} + {{- end }} +{{- end }} + +{{- /* Usage: {{ include "helm_lib_deployment_strategy_and_replicas_for_ha" }} */ -}} +{{- /* returns deployment strategy and replicas for ha components running not on master nodes */ -}} +{{- define "helm_lib_deployment_strategy_and_replicas_for_ha" }} +{{- /* Template context with .Values, .Chart, etc */ -}} +replicas: {{ include "helm_lib_is_ha_to_value" (list . 2 1) }} +{{- if (include "helm_lib_ha_enabled" .) }} +strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 0 + maxUnavailable: 1 +{{- end }} +{{- end }} diff --git a/images/csi-nfs/werf.inc.yaml b/images/csi-nfs/werf.inc.yaml index 9827165..c04afc0 100644 --- a/images/csi-nfs/werf.inc.yaml +++ b/images/csi-nfs/werf.inc.yaml @@ -35,7 +35,7 @@ shell: - chmod +x /nfsplugin --- -{{ $csiBinaries := "/bin/mount /bin/umount /sbin/mount.nfs /sbin/mount.nfs4 /sbin/umount.nfs /sbin/umount.nfs4 /bin/tar /bin/gzip /bin/cp" }} +{{ $csiBinaries := "/bin/mount /bin/umount /sbin/mount.nfs /sbin/mount.nfs4 /sbin/umount.nfs /sbin/umount.nfs4 /bin/cp" }} --- image: {{ $.ImageName }}-binaries-artifact from: {{ $.BASE_ALT_DEV }} @@ -47,18 +47,18 @@ shell: --- image: {{ $.ImageName }}-distroless-artifact -from: {{ $.BASE_ALPINE_DEV }} +from: {{ $.BASE_ALT_DEV }} final: false shell: install: - - mkdir -p /relocate/bin /relocate/sbin /relocate/etc /relocate/etc/ssl /relocate/usr/bin /relocate/usr/sbin /relocate/usr/share + - mkdir -p /relocate/bin /relocate/sbin /relocate/etc /relocate/var/lib/ssl /relocate/usr/bin /relocate/usr/sbin /relocate/usr/share - cp -pr /tmp /relocate - - cp -pr /etc/passwd /etc/group /etc/hostname /etc/hosts /etc/shadow /etc/protocols /etc/services /etc/nsswitch.conf /relocate/etc + - cp -pr /etc/passwd /etc/group /etc/hostname /etc/hosts /etc/shadow /etc/protocols /etc/services /etc/nsswitch.conf /etc/netconfig /relocate/etc - cp -pr /usr/share/ca-certificates /relocate/usr/share - cp -pr /usr/share/zoneinfo /relocate/usr/share - - cp -pr etc/ssl/cert.pem /relocate/etc/ssl - - cp -pr /etc/ssl/certs /relocate/etc/ssl + - cp -pr /var/lib/ssl/cert.pem /relocate/var/lib/ssl + - cp -pr /var/lib/ssl/certs /relocate/var/lib/ssl - echo "deckhouse:x:64535:64535:deckhouse:/:/sbin/nologin" >> /relocate/etc/passwd - echo "deckhouse:x:64535:" >> /relocate/etc/group - echo "deckhouse:!::0:::::" >> /relocate/etc/shadow @@ -96,5 +96,6 @@ import: includePaths: - 'libresolv*' - 'libnss_dns*' + - 'libnss_files*' docker: ENTRYPOINT: ["/nfsplugin"] diff --git a/images/wait-rpcbind/src/cmd/main.go b/images/wait-rpcbind/src/cmd/main.go new file mode 100644 index 0000000..521fe77 --- /dev/null +++ b/images/wait-rpcbind/src/cmd/main.go @@ -0,0 +1,70 @@ +/* +Copyright 2024 Flant JSC + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package main + +import ( + "log" + "net" + "os" + "os/signal" + "syscall" + "time" +) + +func main() { + log.Println("Waiting for socket /run/rpcbind.sock...") + + sigs := make(chan os.Signal, 1) + done := make(chan string, 1) + + signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM) + + go func() { + sig := <-sigs + log.Printf("Received signal %s, exiting.", sig.String()) + done <- sig.String() + }() + + for { + select { + case sigName := <-done: + log.Printf("Program terminated by %s signal.", sigName) + return + default: + info, err := os.Lstat("/run/rpcbind.sock") + if err == nil { + if (info.Mode() & os.ModeSocket) != 0 { + conn, err := net.DialTimeout("unix", "/run/rpcbind.sock", 1*time.Second) + if err == nil { + conn.Close() + log.Println("Socket /run/rpcbind.sock found and confirmed as rpcbind.") + return + } else { + log.Println("Unable to connect to the socket /run/rpcbind.sock, continuing to wait...") + } + } else { + log.Println("/run/rpcbind.sock found but is not a socket. Continuing to wait...") + } + } else if os.IsNotExist(err) { + log.Println("/run/rpcbind.sock does not exist, continuing to wait...") + } else { + log.Printf("Error checking socket /run/rpcbind.sock: %v", err) + } + time.Sleep(1 * time.Second) + } + } +} diff --git a/images/wait-rpcbind/src/go.mod b/images/wait-rpcbind/src/go.mod new file mode 100644 index 0000000..7f5218b --- /dev/null +++ b/images/wait-rpcbind/src/go.mod @@ -0,0 +1,3 @@ +module d8-controller + +go 1.22.2 diff --git a/images/wait-rpcbind/src/go.sum b/images/wait-rpcbind/src/go.sum new file mode 100644 index 0000000..e69de29 diff --git a/images/wait-rpcbind/werf.inc.yaml b/images/wait-rpcbind/werf.inc.yaml new file mode 100644 index 0000000..b6564f2 --- /dev/null +++ b/images/wait-rpcbind/werf.inc.yaml @@ -0,0 +1,36 @@ +{{- $_ := set . "BASE_GOLANG" "registry.deckhouse.io/base_images/golang:1.22.6-bullseye@sha256:260918a3795372a6d33225d361fe5349723be9667de865a23411b50fbcc76c5a" }} +{{- $_ := set . "BASE_SCRATCH" "registry.deckhouse.io/base_images/scratch@sha256:b054705fcc9f2205777d80a558d920c0b4209efdc3163c22b5bfcb5dda1db5fc" }} + +--- +image: {{ $.ImageName }}-golang-artifact +from: {{ $.BASE_GOLANG }} +final: false + +git: + - add: /images/wait-rpcbind/src + to: /src + stageDependencies: + setup: + - "**/*" +mount: + - fromPath: ~/go-pkg-cache + to: /go/pkg +shell: + setup: + - cd /src/cmd + - GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -ldflags="-s -w" -o wait-rpcbind + - mv wait-rpcbind /wait-rpcbind + - chmod +x /wait-rpcbind + +--- +image: {{ $.ImageName }} +from: {{ $.BASE_SCRATCH }} + +import: + - image: {{ $.ImageName }}-golang-artifact + add: /wait-rpcbind + to: /wait-rpcbind + before: setup + +docker: + ENTRYPOINT: ["/wait-rpcbind"] diff --git a/templates/csi/controller.yaml b/templates/csi/controller.yaml index 6bcae47..e3bf730 100644 --- a/templates/csi/controller.yaml +++ b/templates/csi/controller.yaml @@ -1,3 +1,18 @@ +### +### common +### +{{- define "csi_init_container_command" }} +- "/wait-rpcbind" +{{- end }} + +{{- define "csi_init_container_volume_mounts" }} +- name: run + mountPath: /run +{{- end }} + +{{- $csiInitContainerImage := include "helm_lib_module_image" (list . "waitRpcbind") }} + + ### ### controller ### @@ -30,6 +45,16 @@ type: Directory - name: tmp-dir emptyDir: {} + +{{- if .Values.csiNfs.v3support }} +- name: run-rpcbind-sock + hostPath: + path: /run/rpcbind.sock +- name: run + hostPath: + path: /run +{{- end }} + {{- end }} {{- define "csi_additional_controller_volume_mounts" }} @@ -38,6 +63,12 @@ mountPropagation: "Bidirectional" - mountPath: /tmp name: tmp-dir + +{{- if .Values.csiNfs.v3support }} +- name: run-rpcbind-sock + mountPath: /run/rpcbind.sock +{{- end }} + {{- end }} {{- $csiControllerImage := include "helm_lib_module_image" (list . "csiNfs") }} @@ -55,6 +86,12 @@ {{- $_ := set $csiControllerConfig "additionalControllerVolumes" (include "csi_additional_controller_volume" . | fromYamlArray) }} {{- $_ := set $csiControllerConfig "additionalControllerVolumeMounts" (include "csi_additional_controller_volume_mounts" . | fromYamlArray) }} +{{- if .Values.csiNfs.v3support }} +{{- $_ := set $csiControllerConfig "initContainerImage" $csiInitContainerImage }} +{{- $_ := set $csiControllerConfig "initContainerCommand" (include "csi_init_container_command" . | fromYamlArray) }} +{{- $_ := set $csiControllerConfig "initContainerVolumeMounts" (include "csi_init_container_volume_mounts" . | fromYamlArray) }} +{{- end }} + {{- include "helm_lib_csi_controller_manifests" (list . $csiControllerConfig) }} ### @@ -78,6 +115,22 @@ value: unix:///csi/csi.sock {{- end }} +{{- define "csi_additional_node_volume" }} +{{- if .Values.csiNfs.v3support }} +- name: run-rpcbind-sock + hostPath: + path: /run/rpcbind.sock +- name: run + hostPath: + path: /run +{{- end }} +{{- end }} + +{{- define "csi_additional_node_volume_mounts" }} +- name: run-rpcbind-sock + mountPath: /run/rpcbind.sock +{{- end }} + {{- $csiNodeConfig := dict }} {{- $_ := set $csiNodeConfig "fullname" "csi-nfs" }} {{- $_ := set $csiNodeConfig "nodeImage" $csiControllerImage }} @@ -86,4 +139,12 @@ {{- $_ := set $csiNodeConfig "additionalNodeArgs" (include "csi_node_args" . | fromYamlArray) }} {{- $_ := set $csiNodeConfig "additionalNodeEnvs" (include "csi_node_envs" . | fromYamlArray) }} +{{- if .Values.csiNfs.v3support }} +{{- $_ := set $csiNodeConfig "additionalNodeVolumes" (include "csi_additional_node_volume" . | fromYamlArray) }} +{{- $_ := set $csiNodeConfig "additionalNodeVolumeMounts" (include "csi_additional_node_volume_mounts" . | fromYamlArray) }} +{{- $_ := set $csiNodeConfig "initContainerImage" $csiInitContainerImage }} +{{- $_ := set $csiNodeConfig "initContainerCommand" (include "csi_init_container_command" . | fromYamlArray) }} +{{- $_ := set $csiNodeConfig "initContainerVolumeMounts" (include "csi_init_container_volume_mounts" . | fromYamlArray) }} +{{- end }} + {{- include "helm_lib_csi_node_manifests" (list . $csiNodeConfig) }}