Skip to content

Commit 5c2d291

Browse files
eliecharraeliecharra
committed
feat(CU-8695egu2z)!: update workerpool controller
This is basically a port of changes generated by spacelift-io/kube-workerpool-controller#128 to the Helm chart. To help the review, here is below the plain k8s manifest diff that I "Helmified". ```diff --- build/manifests/manifests.yaml 2025-01-09 14:51:37 +++ build/manifests/manifests.new.yaml 2025-01-09 15:54:16 @@ -2,12 +2,8 @@ kind: Namespace metadata: labels: - app.kubernetes.io/component: manager - app.kubernetes.io/created-by: spacelift-workerpool-controller - app.kubernetes.io/instance: system app.kubernetes.io/managed-by: kustomize - app.kubernetes.io/name: namespace - app.kubernetes.io/part-of: spacelift-workerpool-controller + app.kubernetes.io/name: spacelift-workerpool-controller control-plane: controller-manager name: spacelift-worker-controller-system --- @@ -5215,12 +5211,8 @@ kind: ServiceAccount metadata: labels: - app.kubernetes.io/component: rbac - app.kubernetes.io/created-by: spacelift-workerpool-controller - app.kubernetes.io/instance: controller-manager-sa app.kubernetes.io/managed-by: kustomize - app.kubernetes.io/name: serviceaccount - app.kubernetes.io/part-of: spacelift-workerpool-controller + app.kubernetes.io/name: spacelift-workerpool-controller name: spacelift-worker-controllercontroller-manager namespace: spacelift-worker-controller-system --- @@ -5228,12 +5220,8 @@ kind: Role metadata: labels: - app.kubernetes.io/component: rbac - app.kubernetes.io/created-by: spacelift-workerpool-controller - app.kubernetes.io/instance: leader-election-role - app.kubernetes.io/managed-by: kustomize - app.kubernetes.io/name: role - app.kubernetes.io/part-of: spacelift-workerpool-controller + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: spacelift-workerpool-controller name: spacelift-worker-controllerleader-election-role namespace: spacelift-worker-controller-system rules: @@ -5325,13 +5313,24 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - labels: - app.kubernetes.io/component: kube-rbac-proxy - app.kubernetes.io/created-by: spacelift-workerpool-controller - app.kubernetes.io/instance: metrics-reader - app.kubernetes.io/managed-by: kustomize - app.kubernetes.io/name: clusterrole - app.kubernetes.io/part-of: spacelift-workerpool-controller + name: spacelift-worker-controllermetrics-auth-role +rules: +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: name: spacelift-worker-controllermetrics-reader rules: - nonResourceURLs: @@ -5343,37 +5342,108 @@ kind: ClusterRole metadata: labels: - app.kubernetes.io/component: kube-rbac-proxy - app.kubernetes.io/created-by: spacelift-workerpool-controller - app.kubernetes.io/instance: proxy-role app.kubernetes.io/managed-by: kustomize - app.kubernetes.io/name: clusterrole - app.kubernetes.io/part-of: spacelift-workerpool-controller - name: spacelift-worker-controllerproxy-role + app.kubernetes.io/name: spacelift-workerpool-controller + name: spacelift-worker-controllerworker-editor-role rules: - apiGroups: - - authentication.k8s.io + - workers.spacelift.io resources: - - tokenreviews + - workers verbs: - create + - delete + - get + - list + - patch + - update + - watch - apiGroups: - - authorization.k8s.io + - workers.spacelift.io resources: - - subjectaccessreviews + - workers/status verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: spacelift-workerpool-controller + name: spacelift-worker-controllerworker-viewer-role +rules: +- apiGroups: + - workers.spacelift.io + resources: + - workers + verbs: + - get + - list + - watch +- apiGroups: + - workers.spacelift.io + resources: + - workers/status + verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: spacelift-workerpool-controller + name: spacelift-worker-controllerworkerpool-editor-role +rules: +- apiGroups: + - workers.spacelift.io + resources: + - workerpools + verbs: - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - workers.spacelift.io + resources: + - workerpools/status + verbs: + - get --- apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: spacelift-workerpool-controller + name: spacelift-worker-controllerworkerpool-viewer-role +rules: +- apiGroups: + - workers.spacelift.io + resources: + - workerpools + verbs: + - get + - list + - watch +- apiGroups: + - workers.spacelift.io + resources: + - workerpools/status + verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: labels: - app.kubernetes.io/component: rbac - app.kubernetes.io/created-by: spacelift-workerpool-controller - app.kubernetes.io/instance: leader-election-rolebinding app.kubernetes.io/managed-by: kustomize - app.kubernetes.io/name: rolebinding - app.kubernetes.io/part-of: spacelift-workerpool-controller + app.kubernetes.io/name: spacelift-workerpool-controller name: spacelift-worker-controllerleader-election-rolebinding namespace: spacelift-worker-controller-system roleRef: @@ -5389,12 +5459,8 @@ kind: ClusterRoleBinding metadata: labels: - app.kubernetes.io/component: rbac - app.kubernetes.io/created-by: spacelift-workerpool-controller - app.kubernetes.io/instance: manager-rolebinding app.kubernetes.io/managed-by: kustomize - app.kubernetes.io/name: clusterrolebinding - app.kubernetes.io/part-of: spacelift-workerpool-controller + app.kubernetes.io/name: spacelift-workerpool-controller name: spacelift-worker-controllermanager-rolebinding roleRef: apiGroup: rbac.authorization.k8s.io @@ -5408,18 +5474,11 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - labels: - app.kubernetes.io/component: kube-rbac-proxy - app.kubernetes.io/created-by: spacelift-workerpool-controller - app.kubernetes.io/instance: proxy-rolebinding - app.kubernetes.io/managed-by: kustomize - app.kubernetes.io/name: clusterrolebinding - app.kubernetes.io/part-of: spacelift-workerpool-controller - name: spacelift-worker-controllerproxy-rolebinding + name: spacelift-worker-controllermetrics-auth-rolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: spacelift-worker-controllerproxy-role + name: spacelift-worker-controllermetrics-auth-role subjects: - kind: ServiceAccount name: spacelift-worker-controllercontroller-manager @@ -5429,12 +5488,8 @@ kind: Service metadata: labels: - app.kubernetes.io/component: kube-rbac-proxy - app.kubernetes.io/created-by: spacelift-workerpool-controller - app.kubernetes.io/instance: controller-manager-metrics-service app.kubernetes.io/managed-by: kustomize - app.kubernetes.io/name: service - app.kubernetes.io/part-of: spacelift-workerpool-controller + app.kubernetes.io/name: spacelift-workerpool-controller control-plane: controller-manager name: spacelift-worker-controllercontroller-manager-metrics-service namespace: spacelift-worker-controller-system @@ -5443,7 +5498,7 @@ - name: https port: 8443 protocol: TCP - targetPort: https + targetPort: 8443 selector: control-plane: controller-manager --- @@ -5451,12 +5506,8 @@ kind: Deployment metadata: labels: - app.kubernetes.io/component: manager - app.kubernetes.io/created-by: spacelift-workerpool-controller - app.kubernetes.io/instance: controller-manager app.kubernetes.io/managed-by: kustomize - app.kubernetes.io/name: deployment - app.kubernetes.io/part-of: spacelift-workerpool-controller + app.kubernetes.io/name: spacelift-workerpool-controller control-plane: controller-manager name: spacelift-worker-controllercontroller-manager namespace: spacelift-worker-controller-system @@ -5488,32 +5539,7 @@ - linux containers: - args: - - --secure-listen-address=0.0.0.0:8443 - - --upstream=http://127.0.0.1:8080/ - - --logtostderr=true - - --v=0 - image: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1 - name: kube-rbac-proxy - ports: - - containerPort: 8443 - name: https - protocol: TCP - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 5m - memory: 64Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - - args: - - --health-probe-bind-address=:8081 - - --metrics-bind-address=127.0.0.1:8080 + - --metrics-bind-address=:8443 - --leader-elect command: - /spacelift-workerpool-controller @@ -5526,7 +5552,7 @@ periodSeconds: 20 name: manager ports: - - containerPort: 8080 + - containerPort: 8443 name: metrics - containerPort: 8081 name: health ```
1 parent 07c6ce9 commit 5c2d291

13 files changed

+769
-199
lines changed

‎spacelift-workerpool-controller/crds/worker-crd.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
22
kind: CustomResourceDefinition
33
metadata:
44
annotations:
5-
controller-gen.kubebuilder.io/version: v0.13.0
5+
controller-gen.kubebuilder.io/version: v0.16.5
66
name: workers.workers.spacelift.io
77
spec:
88
group: workers.spacelift.io

‎spacelift-workerpool-controller/crds/workerpool-crd.yaml

+525-37
Large diffs are not rendered by default.

‎spacelift-workerpool-controller/templates/deployment.yaml

+6-22
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,6 @@ kind: Deployment
33
metadata:
44
name: {{ include "spacelift-workerpool-controller.fullname" . }}-controller-manager
55
labels:
6-
app.kubernetes.io/component: manager
7-
app.kubernetes.io/created-by: spacelift-workerpool-controller
8-
app.kubernetes.io/part-of: spacelift-workerpool-controller
96
control-plane: controller-manager
107
{{- include "spacelift-workerpool-controller.labels" . | nindent 4 }}
118
spec:
@@ -40,25 +37,12 @@ spec:
4037
values:
4138
- linux
4239
containers:
43-
{{- if .Values.metricsService.enabled }}
44-
- args: {{- toYaml .Values.controllerManager.kubeRbacProxy.args | nindent 8 }}
45-
env:
46-
- name: KUBERNETES_CLUSTER_DOMAIN
47-
value: {{ quote .Values.kubernetesClusterDomain }}
48-
image: {{ .Values.controllerManager.kubeRbacProxy.image.repository }}:{{ .Values.controllerManager.kubeRbacProxy.image.tag
49-
| default .Chart.AppVersion }}
50-
name: kube-rbac-proxy
51-
ports:
52-
- containerPort: 8443
53-
name: https
54-
protocol: TCP
55-
resources: {{- toYaml .Values.controllerManager.kubeRbacProxy.resources | nindent
56-
10 }}
57-
securityContext: {{- toYaml .Values.controllerManager.kubeRbacProxy.containerSecurityContext
58-
| nindent 10 }}
59-
{{- end }}
6040
- args: {{- toYaml .Values.controllerManager.manager.args | nindent 8 }}
61-
- --metrics-bind-address={{ if .Values.metricsService.enabled }}127.0.0.1:8080{{ else }}0{{ end }}
41+
{{- if .Values.metricsService.enabled }}
42+
- --metrics-bind-address=:8443
43+
- --metrics-secure={{ .Values.metricsService.secure | toYaml}}
44+
- --enable-http2={{ .Values.metricsService.enableHTTP2 | toYaml}}
45+
{{- end }}
6246
{{- range .Values.controllerManager.namespaces }}
6347
- --namespaces={{ . }}
6448
{{- end }}
@@ -73,7 +57,7 @@ spec:
7357
- containerPort: 8081
7458
name: health
7559
{{- if .Values.metricsService.enabled }}
76-
- containerPort: 8080
60+
- containerPort: 8443
7761
name: metrics
7862
{{- end }}
7963
livenessProbe:

‎spacelift-workerpool-controller/templates/leader-election-rbac.yaml

+1-7
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,6 @@ kind: Role
33
metadata:
44
name: {{ include "spacelift-workerpool-controller.fullname" . }}-leader-election-role
55
labels:
6-
app.kubernetes.io/component: rbac
7-
app.kubernetes.io/created-by: spacelift-workerpool-controller
8-
app.kubernetes.io/part-of: spacelift-workerpool-controller
96
{{- include "spacelift-workerpool-controller.labels" . | nindent 4 }}
107
rules:
118
- apiGroups:
@@ -45,9 +42,6 @@ kind: RoleBinding
4542
metadata:
4643
name: {{ include "spacelift-workerpool-controller.fullname" . }}-leader-election-rolebinding
4744
labels:
48-
app.kubernetes.io/component: rbac
49-
app.kubernetes.io/created-by: spacelift-workerpool-controller
50-
app.kubernetes.io/part-of: spacelift-workerpool-controller
5145
{{- include "spacelift-workerpool-controller.labels" . | nindent 4 }}
5246
roleRef:
5347
apiGroup: rbac.authorization.k8s.io
@@ -56,4 +50,4 @@ roleRef:
5650
subjects:
5751
- kind: ServiceAccount
5852
name: '{{ include "spacelift-workerpool-controller.fullname" . }}-controller-manager'
59-
namespace: '{{ .Release.Namespace }}'
53+
namespace: '{{ .Release.Namespace }}'

‎spacelift-workerpool-controller/templates/manager-rbac.yaml

+71-43
Original file line numberDiff line numberDiff line change
@@ -2,59 +2,25 @@
22
- apiGroups:
33
- ""
44
resources:
5-
- pods
5+
- events
66
verbs:
77
- create
8-
- delete
9-
- get
10-
- list
11-
- watch
8+
- patch
129
- apiGroups:
1310
- ""
1411
resources:
12+
- pods
1513
- secrets
1614
verbs:
1715
- create
1816
- delete
1917
- get
2018
- list
2119
- watch
22-
- apiGroups:
23-
- ""
24-
resources:
25-
- events
26-
verbs:
27-
- create
28-
- patch
2920
- apiGroups:
3021
- workers.spacelift.io
3122
resources:
3223
- workerpools
33-
verbs:
34-
- create
35-
- delete
36-
- get
37-
- list
38-
- patch
39-
- update
40-
- watch
41-
- apiGroups:
42-
- workers.spacelift.io
43-
resources:
44-
- workerpools/finalizers
45-
verbs:
46-
- update
47-
- apiGroups:
48-
- workers.spacelift.io
49-
resources:
50-
- workerpools/status
51-
verbs:
52-
- get
53-
- patch
54-
- update
55-
- apiGroups:
56-
- workers.spacelift.io
57-
resources:
5824
- workers
5925
verbs:
6026
- create
@@ -67,12 +33,14 @@
6733
- apiGroups:
6834
- workers.spacelift.io
6935
resources:
36+
- workerpools/finalizers
7037
- workers/finalizers
7138
verbs:
7239
- update
7340
- apiGroups:
7441
- workers.spacelift.io
7542
resources:
43+
- workerpools/status
7644
- workers/status
7745
verbs:
7846
- get
@@ -95,9 +63,6 @@ kind: ClusterRoleBinding
9563
metadata:
9664
name: {{ include "spacelift-workerpool-controller.fullname" . }}-manager-rolebinding
9765
labels:
98-
app.kubernetes.io/component: rbac
99-
app.kubernetes.io/created-by: spacelift-workerpool-controller
100-
app.kubernetes.io/part-of: spacelift-workerpool-controller
10166
{{- include "spacelift-workerpool-controller.labels" . | nindent 4 }}
10267
roleRef:
10368
apiGroup: rbac.authorization.k8s.io
@@ -107,6 +72,38 @@ subjects:
10772
- kind: ServiceAccount
10873
name: '{{ include "spacelift-workerpool-controller.fullname" . }}-controller-manager'
10974
namespace: '{{ .Release.Namespace }}'
75+
{{ if .Values.metricsService.enabled }}
76+
---
77+
apiVersion: rbac.authorization.k8s.io/v1
78+
kind: ClusterRoleBinding
79+
metadata:
80+
name: {{ include "spacelift-workerpool-controller.fullname" . }}-metrics-auth-rolebinding
81+
labels:
82+
{{- include "spacelift-workerpool-controller.labels" . | nindent 4 }}
83+
roleRef:
84+
apiGroup: rbac.authorization.k8s.io
85+
kind: ClusterRole
86+
name: '{{ include "spacelift-workerpool-controller.fullname" . }}-metrics-auth-role'
87+
subjects:
88+
- kind: ServiceAccount
89+
name: '{{ include "spacelift-workerpool-controller.fullname" . }}-controller-manager'
90+
namespace: '{{ .Release.Namespace }}'
91+
---
92+
apiVersion: rbac.authorization.k8s.io/v1
93+
kind: ClusterRoleBinding
94+
metadata:
95+
name: {{ include "spacelift-workerpool-controller.fullname" . }}-metrics-reader-rolebinding
96+
labels:
97+
{{- include "spacelift-workerpool-controller.labels" . | nindent 4 }}
98+
roleRef:
99+
apiGroup: rbac.authorization.k8s.io
100+
kind: ClusterRole
101+
name: '{{ include "spacelift-workerpool-controller.fullname" . }}-metrics-reader'
102+
subjects:
103+
- kind: ServiceAccount
104+
name: '{{ include "spacelift-workerpool-controller.fullname" . }}-controller-manager'
105+
namespace: '{{ .Release.Namespace }}'
106+
{{ end }}
110107
{{ else }}
111108
{{ range $index, $namespace := .Values.controllerManager.namespaces }}
112109
---
@@ -126,9 +123,6 @@ metadata:
126123
name: {{ include "spacelift-workerpool-controller.fullname" $ }}-manager-rolebinding
127124
namespace: '{{ $namespace }}'
128125
labels:
129-
app.kubernetes.io/component: rbac
130-
app.kubernetes.io/created-by: spacelift-workerpool-controller
131-
app.kubernetes.io/part-of: spacelift-workerpool-controller
132126
{{- include "spacelift-workerpool-controller.labels" $ | nindent 4 }}
133127
roleRef:
134128
apiGroup: rbac.authorization.k8s.io
@@ -138,5 +132,39 @@ subjects:
138132
- kind: ServiceAccount
139133
name: '{{ include "spacelift-workerpool-controller.fullname" $ }}-controller-manager'
140134
namespace: '{{ $.Release.Namespace }}'
135+
{{ if .Values.metricsService.enabled }}
136+
---
137+
apiVersion: rbac.authorization.k8s.io/v1
138+
kind: RoleBinding
139+
metadata:
140+
name: {{ include "spacelift-workerpool-controller.fullname" . }}-metrics-auth-rolebinding
141+
namespace: '{{ $namespace }}'
142+
labels:
143+
{{- include "spacelift-workerpool-controller.labels" . | nindent 4 }}
144+
roleRef:
145+
apiGroup: rbac.authorization.k8s.io
146+
kind: Role
147+
name: '{{ include "spacelift-workerpool-controller.fullname" . }}-metrics-auth-role'
148+
subjects:
149+
- kind: ServiceAccount
150+
name: '{{ include "spacelift-workerpool-controller.fullname" . }}-controller-manager'
151+
namespace: '{{ .Release.Namespace }}'
152+
---
153+
apiVersion: rbac.authorization.k8s.io/v1
154+
kind: RoleBinding
155+
metadata:
156+
name: {{ include "spacelift-workerpool-controller.fullname" . }}-metrics-reader-rolebinding
157+
namespace: '{{ $namespace }}'
158+
labels:
159+
{{- include "spacelift-workerpool-controller.labels" . | nindent 4 }}
160+
roleRef:
161+
apiGroup: rbac.authorization.k8s.io
162+
kind: Role
163+
name: '{{ include "spacelift-workerpool-controller.fullname" . }}-metrics-reader'
164+
subjects:
165+
- kind: ServiceAccount
166+
name: '{{ include "spacelift-workerpool-controller.fullname" . }}-controller-manager'
167+
namespace: '{{ .Release.Namespace }}'
168+
{{ end }}
141169
{{ end }}
142170
{{ end }}

‎spacelift-workerpool-controller/templates/metrics-rbac.yaml

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{{- define "metricsAuthRules" -}}
2+
- apiGroups:
3+
- authentication.k8s.io
4+
resources:
5+
- tokenreviews
6+
verbs:
7+
- create
8+
- apiGroups:
9+
- authorization.k8s.io
10+
resources:
11+
- subjectaccessreviews
12+
verbs:
13+
- create
14+
{{ end -}}
15+
{{- define "metricsReaderRules" -}}
16+
- nonResourceURLs:
17+
- /metrics
18+
verbs:
19+
- get
20+
{{ end -}}
21+
{{ if .Values.metricsService.enabled }}
22+
{{ if default .Values.controllerManager.namespaces | empty }}
23+
apiVersion: rbac.authorization.k8s.io/v1
24+
kind: ClusterRole
25+
metadata:
26+
name: {{ include "spacelift-workerpool-controller.fullname" . }}-metrics-auth-role
27+
labels:
28+
{{- include "spacelift-workerpool-controller.labels" . | nindent 4 }}
29+
rules:
30+
{{ include "metricsAuthRules" . -}}
31+
---
32+
apiVersion: rbac.authorization.k8s.io/v1
33+
kind: ClusterRole
34+
metadata:
35+
name: {{ include "spacelift-workerpool-controller.fullname" . }}-metrics-reader
36+
labels:
37+
{{- include "spacelift-workerpool-controller.labels" . | nindent 4 }}
38+
rules:
39+
{{ include "metricsReaderRules" . -}}
40+
{{ else }}
41+
{{ range $index, $namespace := .Values.controllerManager.namespaces }}
42+
---
43+
apiVersion: rbac.authorization.k8s.io/v1
44+
kind: Role
45+
metadata:
46+
namespace: '{{ $namespace }}'
47+
name: {{ include "spacelift-workerpool-controller.fullname" . }}-metrics-auth-role
48+
labels:
49+
{{- include "spacelift-workerpool-controller.labels" . | nindent 4 }}
50+
rules:
51+
{{ include "metricsAuthRules" . -}}
52+
---
53+
apiVersion: rbac.authorization.k8s.io/v1
54+
kind: Role
55+
metadata:
56+
namespace: '{{ $namespace }}'
57+
name: {{ include "spacelift-workerpool-controller.fullname" . }}-metrics-reader
58+
labels:
59+
{{- include "spacelift-workerpool-controller.labels" . | nindent 4 }}
60+
rules:
61+
{{ include "metricsReaderRules" . -}}
62+
{{ end }}
63+
{{ end }}
64+
{{ end }}

‎spacelift-workerpool-controller/templates/metrics-reader-rbac.yaml

-16
This file was deleted.

‎spacelift-workerpool-controller/templates/metrics-service.yaml

-3
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,6 @@ kind: Service
44
metadata:
55
name: {{ include "spacelift-workerpool-controller.fullname" . }}-metrics-service
66
labels:
7-
app.kubernetes.io/component: kube-rbac-proxy
8-
app.kubernetes.io/created-by: spacelift-workerpool-controller
9-
app.kubernetes.io/part-of: spacelift-workerpool-controller
107
control-plane: controller-manager
118
{{- include "spacelift-workerpool-controller.labels" . | nindent 4 }}
129
spec:

‎spacelift-workerpool-controller/templates/proxy-rbac.yaml

-42
This file was deleted.

0 commit comments

Comments
 (0)