From a6d0f7cfd405a85cea39fc63a34ffbbd445f37ff Mon Sep 17 00:00:00 2001 From: Andrei Kvapil Date: Wed, 24 Apr 2024 11:40:09 +0200 Subject: [PATCH 1/2] Add etcd-operator Signed-off-by: Andrei Kvapil --- .../core/platform/bundles/distro-full.yaml | 6 + .../core/platform/bundles/distro-hosted.yaml | 6 + packages/core/platform/bundles/paas-full.yaml | 6 + .../core/platform/bundles/paas-hosted.yaml | 6 + .../core/platform/templates/helmreleases.yaml | 2 + packages/extra/etcd/Chart.yaml | 2 +- packages/extra/etcd/templates/datastore.yaml | 36 + .../extra/etcd/templates/etcd-cluster.yaml | 167 +++ .../extra/etcd/templates/kamaji-etcd.yaml | 19 - packages/extra/versions_map | 3 +- packages/system/etcd-operator/.helmignore | 3 + packages/system/etcd-operator/Chart.yaml | 2 + packages/system/etcd-operator/Makefile | 8 + .../charts/etcd-operator/.helmignore | 23 + .../charts/etcd-operator/Chart.yaml | 5 + .../charts/etcd-operator/README.md | 63 + .../etcd-operator/crds/etcd-cluster.yaml | 1058 +++++++++++++++++ .../etcd-operator/templates/_helpers.tpl | 51 + .../templates/cert-manager/certificate.yml | 14 + .../templates/cert-manager/issuer.yml | 8 + .../mutatingwebhookconfiguration.yml | 29 + .../validatingwebhookconfiguration.yml | 29 + .../rbac/clusterrole-manager-role.yml | 81 ++ .../rbac/clusterrole-metrics-reader.yml | 11 + .../templates/rbac/clusterrole-proxy-role.yml | 19 + ...clusterrolebinding-manager-rolebinding.yml | 14 + .../clusterrolebinding-proxy-rolebinding.yml | 14 + .../rbac/role-leader-election-role.yml | 38 + ...olebinding-leader-election-rolebinding.yml | 14 + .../templates/workload/configmap-env.yaml | 16 + .../templates/workload/deployment.yml | 114 ++ ...ice-controller-manager-metrics-service.yml | 15 + .../workload/service-webhook-service.yml | 14 + .../templates/workload/serviceaccount.yml | 12 + .../charts/etcd-operator/values.schema.json | 284 +++++ .../charts/etcd-operator/values.yaml | 98 ++ 36 files changed, 2269 insertions(+), 21 deletions(-) create mode 100644 packages/extra/etcd/templates/datastore.yaml create mode 100644 packages/extra/etcd/templates/etcd-cluster.yaml delete mode 100644 packages/extra/etcd/templates/kamaji-etcd.yaml create mode 100644 packages/system/etcd-operator/.helmignore create mode 100644 packages/system/etcd-operator/Chart.yaml create mode 100644 packages/system/etcd-operator/Makefile create mode 100644 packages/system/etcd-operator/charts/etcd-operator/.helmignore create mode 100644 packages/system/etcd-operator/charts/etcd-operator/Chart.yaml create mode 100644 packages/system/etcd-operator/charts/etcd-operator/README.md create mode 100644 packages/system/etcd-operator/charts/etcd-operator/crds/etcd-cluster.yaml create mode 100644 packages/system/etcd-operator/charts/etcd-operator/templates/_helpers.tpl create mode 100644 packages/system/etcd-operator/charts/etcd-operator/templates/cert-manager/certificate.yml create mode 100644 packages/system/etcd-operator/charts/etcd-operator/templates/cert-manager/issuer.yml create mode 100644 packages/system/etcd-operator/charts/etcd-operator/templates/cert-manager/mutatingwebhookconfiguration.yml create mode 100644 packages/system/etcd-operator/charts/etcd-operator/templates/cert-manager/validatingwebhookconfiguration.yml create mode 100644 packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrole-manager-role.yml create mode 100644 packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrole-metrics-reader.yml create mode 100644 packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrole-proxy-role.yml create mode 100644 packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrolebinding-manager-rolebinding.yml create mode 100644 packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrolebinding-proxy-rolebinding.yml create mode 100644 packages/system/etcd-operator/charts/etcd-operator/templates/rbac/role-leader-election-role.yml create mode 100644 packages/system/etcd-operator/charts/etcd-operator/templates/rbac/rolebinding-leader-election-rolebinding.yml create mode 100644 packages/system/etcd-operator/charts/etcd-operator/templates/workload/configmap-env.yaml create mode 100644 packages/system/etcd-operator/charts/etcd-operator/templates/workload/deployment.yml create mode 100644 packages/system/etcd-operator/charts/etcd-operator/templates/workload/service-controller-manager-metrics-service.yml create mode 100644 packages/system/etcd-operator/charts/etcd-operator/templates/workload/service-webhook-service.yml create mode 100644 packages/system/etcd-operator/charts/etcd-operator/templates/workload/serviceaccount.yml create mode 100644 packages/system/etcd-operator/charts/etcd-operator/values.schema.json create mode 100644 packages/system/etcd-operator/charts/etcd-operator/values.yaml diff --git a/packages/core/platform/bundles/distro-full.yaml b/packages/core/platform/bundles/distro-full.yaml index d66d9ffc..1fd9590a 100644 --- a/packages/core/platform/bundles/distro-full.yaml +++ b/packages/core/platform/bundles/distro-full.yaml @@ -52,6 +52,12 @@ releases: privileged: true dependsOn: [cilium] +- name: etcd-operator + releaseName: etcd-operator + chart: cozy-etcd-operator + namespace: cozy-etcd-operator + dependsOn: [cilium,cert-manager] + - name: grafana-operator releaseName: grafana-operator chart: cozy-grafana-operator diff --git a/packages/core/platform/bundles/distro-hosted.yaml b/packages/core/platform/bundles/distro-hosted.yaml index a30db318..f14b65b0 100644 --- a/packages/core/platform/bundles/distro-hosted.yaml +++ b/packages/core/platform/bundles/distro-hosted.yaml @@ -26,6 +26,12 @@ releases: privileged: true dependsOn: [victoria-metrics-operator] +- name: etcd-operator + releaseName: etcd-operator + chart: cozy-etcd-operator + namespace: cozy-etcd-operator + dependsOn: [cert-manager] + - name: grafana-operator releaseName: grafana-operator chart: cozy-grafana-operator diff --git a/packages/core/platform/bundles/paas-full.yaml b/packages/core/platform/bundles/paas-full.yaml index c6268dfe..6ee2ad41 100644 --- a/packages/core/platform/bundles/paas-full.yaml +++ b/packages/core/platform/bundles/paas-full.yaml @@ -81,6 +81,12 @@ releases: privileged: true dependsOn: [cilium,kubeovn] +- name: etcd-operator + releaseName: etcd-operator + chart: cozy-etcd-operator + namespace: cozy-etcd-operator + dependsOn: [cilium,kubeovn,cert-manager] + - name: grafana-operator releaseName: grafana-operator chart: cozy-grafana-operator diff --git a/packages/core/platform/bundles/paas-hosted.yaml b/packages/core/platform/bundles/paas-hosted.yaml index 80d8e449..bc9f86a1 100644 --- a/packages/core/platform/bundles/paas-hosted.yaml +++ b/packages/core/platform/bundles/paas-hosted.yaml @@ -26,6 +26,12 @@ releases: privileged: true dependsOn: [victoria-metrics-operator] +- name: etcd-operator + releaseName: etcd-operator + chart: cozy-etcd-operator + namespace: cozy-etcd-operator + dependsOn: [cert-manager] + - name: grafana-operator releaseName: grafana-operator chart: cozy-grafana-operator diff --git a/packages/core/platform/templates/helmreleases.yaml b/packages/core/platform/templates/helmreleases.yaml index 4d074c02..5834c0be 100644 --- a/packages/core/platform/templates/helmreleases.yaml +++ b/packages/core/platform/templates/helmreleases.yaml @@ -23,9 +23,11 @@ spec: interval: 1m releaseName: {{ $x.releaseName | default $x.name }} install: + crds: CreateReplace remediation: retries: -1 upgrade: + crds: CreateReplace remediation: retries: -1 chart: diff --git a/packages/extra/etcd/Chart.yaml b/packages/extra/etcd/Chart.yaml index 60abbe31..54c171e1 100644 --- a/packages/extra/etcd/Chart.yaml +++ b/packages/extra/etcd/Chart.yaml @@ -3,4 +3,4 @@ name: etcd description: Storage for Kubernetes clusters icon: https://www.svgrepo.com/show/353714/etcd.svg type: application -version: 1.0.0 +version: 2.0.0 diff --git a/packages/extra/etcd/templates/datastore.yaml b/packages/extra/etcd/templates/datastore.yaml new file mode 100644 index 00000000..59b3e802 --- /dev/null +++ b/packages/extra/etcd/templates/datastore.yaml @@ -0,0 +1,36 @@ +--- +apiVersion: kamaji.clastix.io/v1alpha1 +kind: DataStore +metadata: + name: {{ .Release.Namespace }} + annotations: + helm.sh/hook: post-install,post-upgrade +spec: + driver: etcd + endpoints: + - etcd-0.etcd-headless.{{ .Release.Namespace }}.svc:2379 + - etcd-1.etcd-headless.{{ .Release.Namespace }}.svc:2379 + - etcd-2.etcd-headless.{{ .Release.Namespace }}.svc:2379 + tlsConfig: + certificateAuthority: + certificate: + secretReference: + keyPath: tls.crt + name: etcd-ca-tls + namespace: {{ .Release.Namespace }} + privateKey: + secretReference: + keyPath: tls.key + name: etcd-ca-tls + namespace: {{ .Release.Namespace }} + clientCertificate: + certificate: + secretReference: + keyPath: tls.crt + name: etcd-client-tls + namespace: {{ .Release.Namespace }} + privateKey: + secretReference: + keyPath: tls.key + name: etcd-client-tls + namespace: {{ .Release.Namespace }} diff --git a/packages/extra/etcd/templates/etcd-cluster.yaml b/packages/extra/etcd/templates/etcd-cluster.yaml new file mode 100644 index 00000000..0434c148 --- /dev/null +++ b/packages/extra/etcd/templates/etcd-cluster.yaml @@ -0,0 +1,167 @@ +--- +apiVersion: etcd.aenix.io/v1alpha1 +kind: EtcdCluster +metadata: + name: etcd +spec: + storage: {} + security: + tls: + peerTrustedCASecret: etcd-peer-ca-tls + peerSecret: etcd-peer-tls + serverSecret: etcd-server-tls + clientTrustedCASecret: etcd-ca-tls + clientSecret: etcd-client-tls +--- +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: etcd-selfsigning-issuer +spec: + selfSigned: {} +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: etcd-peer-ca +spec: + isCA: true + usages: + - "signing" + - "key encipherment" + - "cert sign" + commonName: etcd-peer-ca + subject: + organizations: + - ACME Inc. + organizationalUnits: + - Widgets + secretName: etcd-peer-ca-tls + privateKey: + algorithm: RSA + size: 4096 + issuerRef: + name: etcd-selfsigning-issuer + kind: Issuer + group: cert-manager.io +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: etcd-ca +spec: + isCA: true + usages: + - "signing" + - "key encipherment" + - "cert sign" + commonName: etcd-ca + subject: + organizations: + - ACME Inc. + organizationalUnits: + - Widgets + secretName: etcd-ca-tls + privateKey: + algorithm: RSA + size: 4096 + issuerRef: + name: etcd-selfsigning-issuer + kind: Issuer + group: cert-manager.io +--- +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: etcd-peer-issuer +spec: + ca: + secretName: etcd-peer-ca-tls +--- +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: etcd-issuer +spec: + ca: + secretName: etcd-ca-tls +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: etcd-server +spec: + secretName: etcd-server-tls + isCA: false + usages: + - "server auth" + - "signing" + - "key encipherment" + dnsNames: + - etcd-0 + - etcd-0.etcd-headless + - etcd-0.etcd-headless.{{ .Release.Namespace }}.svc + - etcd-1 + - etcd-1.etcd-headless + - etcd-1.etcd-headless.{{ .Release.Namespace }}.svc + - etcd-2 + - etcd-2.etcd-headless + - etcd-2.etcd-headless.{{ .Release.Namespace }}.svc + - localhost + - "127.0.0.1" + privateKey: + rotationPolicy: Always + algorithm: RSA + size: 4096 + issuerRef: + name: etcd-issuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: etcd-peer +spec: + secretName: etcd-peer-tls + isCA: false + usages: + - "server auth" + - "client auth" + - "signing" + - "key encipherment" + dnsNames: + - etcd-0 + - etcd-0.etcd-headless + - etcd-0.etcd-headless.{{ .Release.Namespace }}.svc + - etcd-1 + - etcd-1.etcd-headless + - etcd-1.etcd-headless.{{ .Release.Namespace }}.svc + - etcd-2 + - etcd-2.etcd-headless + - etcd-2.etcd-headless.{{ .Release.Namespace }}.svc + - localhost + - "127.0.0.1" + privateKey: + rotationPolicy: Always + algorithm: RSA + size: 4096 + issuerRef: + name: etcd-peer-issuer +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: etcd-client +spec: + commonName: root + secretName: etcd-client-tls + usages: + - "signing" + - "key encipherment" + - "client auth" + privateKey: + rotationPolicy: Always + algorithm: RSA + size: 4096 + issuerRef: + name: etcd-issuer + kind: Issuer diff --git a/packages/extra/etcd/templates/kamaji-etcd.yaml b/packages/extra/etcd/templates/kamaji-etcd.yaml deleted file mode 100644 index e9c63f57..00000000 --- a/packages/extra/etcd/templates/kamaji-etcd.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: kamaji-etcd -spec: - chart: - spec: - chart: cozy-kamaji-etcd - reconcileStrategy: Revision - sourceRef: - kind: HelmRepository - name: cozystack-system - namespace: cozy-system - version: '*' - interval: 1m0s - timeout: 5m0s - values: - kamaji-etcd: - fullnameOverride: etcd diff --git a/packages/extra/versions_map b/packages/extra/versions_map index 6021c238..551c0a11 100644 --- a/packages/extra/versions_map +++ b/packages/extra/versions_map @@ -1,3 +1,4 @@ -etcd 1.0.0 HEAD +etcd 1.0.0 f7eaab0 +etcd 2.0.0 HEAD ingress 1.0.0 HEAD monitoring 1.0.0 HEAD diff --git a/packages/system/etcd-operator/.helmignore b/packages/system/etcd-operator/.helmignore new file mode 100644 index 00000000..d5c178e8 --- /dev/null +++ b/packages/system/etcd-operator/.helmignore @@ -0,0 +1,3 @@ +images +hack +.gitkeep diff --git a/packages/system/etcd-operator/Chart.yaml b/packages/system/etcd-operator/Chart.yaml new file mode 100644 index 00000000..b6483c15 --- /dev/null +++ b/packages/system/etcd-operator/Chart.yaml @@ -0,0 +1,2 @@ +name: cozy-etcd-operator +version: 0.4.0 diff --git a/packages/system/etcd-operator/Makefile b/packages/system/etcd-operator/Makefile new file mode 100644 index 00000000..fc46e874 --- /dev/null +++ b/packages/system/etcd-operator/Makefile @@ -0,0 +1,8 @@ +NAME=etcd-operator +NAMESPACE=cozy-etcd-operator + +include ../../../scripts/package-system.mk + +update: + rm -rf charts + helm pull oci://ghcr.io/aenix-io/charts/etcd-operator --untar --untardir charts diff --git a/packages/system/etcd-operator/charts/etcd-operator/.helmignore b/packages/system/etcd-operator/charts/etcd-operator/.helmignore new file mode 100644 index 00000000..0e8a0eb3 --- /dev/null +++ b/packages/system/etcd-operator/charts/etcd-operator/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/packages/system/etcd-operator/charts/etcd-operator/Chart.yaml b/packages/system/etcd-operator/charts/etcd-operator/Chart.yaml new file mode 100644 index 00000000..36ad3b42 --- /dev/null +++ b/packages/system/etcd-operator/charts/etcd-operator/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v2 +appVersion: v0.2.0 +name: etcd-operator +type: application +version: 0.2.0 diff --git a/packages/system/etcd-operator/charts/etcd-operator/README.md b/packages/system/etcd-operator/charts/etcd-operator/README.md new file mode 100644 index 00000000..729dab25 --- /dev/null +++ b/packages/system/etcd-operator/charts/etcd-operator/README.md @@ -0,0 +1,63 @@ +# etcd-operator + +![Version: 0.0.0](https://img.shields.io/badge/Version-0.0.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.0.0](https://img.shields.io/badge/AppVersion-v0.0.0-informational?style=flat-square) + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| affinity | object | `{}` | | +| etcdOperator.args[0] | string | `"--health-probe-bind-address=:8081"` | | +| etcdOperator.args[1] | string | `"--metrics-bind-address=127.0.0.1:8080"` | | +| etcdOperator.args[2] | string | `"--leader-elect"` | | +| etcdOperator.envVars | object | `{}` | | +| etcdOperator.image.pullPolicy | string | `"IfNotPresent"` | | +| etcdOperator.image.repository | string | `"ghcr.io/aenix-io/etcd-operator"` | | +| etcdOperator.image.tag | string | `""` | | +| etcdOperator.livenessProbe.httpGet.path | string | `"/healthz"` | | +| etcdOperator.livenessProbe.httpGet.port | int | `8081` | | +| etcdOperator.livenessProbe.initialDelaySeconds | int | `15` | | +| etcdOperator.livenessProbe.periodSeconds | int | `20` | | +| etcdOperator.readinessProbe.httpGet.path | string | `"/readyz"` | | +| etcdOperator.readinessProbe.httpGet.port | int | `8081` | | +| etcdOperator.readinessProbe.initialDelaySeconds | int | `5` | | +| etcdOperator.readinessProbe.periodSeconds | int | `10` | | +| etcdOperator.resources.limits.cpu | string | `"500m"` | | +| etcdOperator.resources.limits.memory | string | `"128Mi"` | | +| etcdOperator.resources.requests.cpu | string | `"100m"` | | +| etcdOperator.resources.requests.memory | string | `"64Mi"` | | +| etcdOperator.securityContext.allowPrivilegeEscalation | bool | `false` | | +| etcdOperator.securityContext.capabilities.drop[0] | string | `"ALL"` | | +| etcdOperator.service.port | int | `9443` | | +| etcdOperator.service.type | string | `"ClusterIP"` | | +| fullnameOverride | string | `""` | | +| imagePullSecrets | list | `[]` | | +| kubeRbacProxy.args[0] | string | `"--secure-listen-address=0.0.0.0:8443"` | | +| kubeRbacProxy.args[1] | string | `"--upstream=http://127.0.0.1:8080/"` | | +| kubeRbacProxy.args[2] | string | `"--logtostderr=true"` | | +| kubeRbacProxy.args[3] | string | `"--v=0"` | | +| kubeRbacProxy.image.pullPolicy | string | `"IfNotPresent"` | | +| kubeRbacProxy.image.repository | string | `"gcr.io/kubebuilder/kube-rbac-proxy"` | | +| kubeRbacProxy.image.tag | string | `"v0.16.0"` | | +| kubeRbacProxy.livenessProbe | object | `{}` | | +| kubeRbacProxy.readinessProbe | object | `{}` | | +| kubeRbacProxy.resources.limits.cpu | string | `"500m"` | | +| kubeRbacProxy.resources.limits.memory | string | `"128Mi"` | | +| kubeRbacProxy.resources.requests.cpu | string | `"100m"` | | +| kubeRbacProxy.resources.requests.memory | string | `"64Mi"` | | +| kubeRbacProxy.securityContext.allowPrivilegeEscalation | bool | `false` | | +| kubeRbacProxy.securityContext.capabilities.drop[0] | string | `"ALL"` | | +| kubeRbacProxy.service.port | int | `8443` | | +| kubeRbacProxy.service.type | string | `"ClusterIP"` | | +| kubernetesClusterDomain | string | `"cluster.local"` | | +| nameOverride | string | `""` | | +| nodeSelector | object | `{}` | | +| podAnnotations | object | `{}` | | +| podLabels | object | `{}` | | +| podSecurityContext | object | `{}` | | +| replicaCount | int | `1` | | +| securityContext.runAsNonRoot | bool | `true` | | +| serviceAccount.annotations | object | `{}` | | +| serviceAccount.create | bool | `true` | | +| tolerations | list | `[]` | | + diff --git a/packages/system/etcd-operator/charts/etcd-operator/crds/etcd-cluster.yaml b/packages/system/etcd-operator/charts/etcd-operator/crds/etcd-cluster.yaml new file mode 100644 index 00000000..3abbf976 --- /dev/null +++ b/packages/system/etcd-operator/charts/etcd-operator/crds/etcd-cluster.yaml @@ -0,0 +1,1058 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: etcd-operator-system/etcd-operator-serving-cert + controller-gen.kubebuilder.io/version: v0.14.0 + name: etcdclusters.etcd.aenix.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + name: etcd-operator-webhook-service + namespace: etcd-operator-system + path: /convert + conversionReviewVersions: + - v1 + group: etcd.aenix.io + names: + kind: EtcdCluster + listKind: EtcdClusterList + plural: etcdclusters + singular: etcdcluster + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: EtcdCluster is the Schema for the etcdclusters API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: EtcdClusterSpec defines the desired state of EtcdCluster + properties: + headlessServiceTemplate: + description: HeadlessService defines the desired state of HeadlessService for etcd members. If not specified, default values will be used. + properties: + metadata: + description: EmbeddedMetadata contains metadata relevant to an EmbeddedResource. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + type: object + options: + additionalProperties: + type: string + description: Options are the extra arguments to pass to the etcd container. + example: + debug: "true" + enable-v2: "false" + type: object + podDisruptionBudgetTemplate: + description: PodDisruptionBudgetTemplate describes PDB resource to create for etcd cluster members. Nil to disable. + properties: + metadata: + description: EmbeddedMetadata contains metadata relevant to an EmbeddedResource. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + spec: + description: |- + Spec defines the desired characteristics of a PDB. + More info: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/#pod-disruption-budgets + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + MinAvailable describes maximum not ready replicas. If both are empty, controller will implicitly + calculate MaxUnavailable based on number of replicas + Mutually exclusive with MinAvailable + x-kubernetes-int-or-string: true + minAvailable: + anyOf: + - type: integer + - type: string + description: |- + MinAvailable describes minimum ready replicas. If both are empty, controller will implicitly + calculate MaxUnavailable based on number of replicas + Mutually exclusive with MaxUnavailable. + x-kubernetes-int-or-string: true + type: object + type: object + podTemplate: + description: PodTemplate defines the desired state of PodSpec for etcd members. If not specified, default values will be used. + properties: + metadata: + description: EmbeddedObjectMetadata contains metadata relevant to an EmbeddedResource + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + spec: + description: Spec follows the structure of a regular Pod spec. Overrides defined here will be strategically merged with the default pod spec, generated by the operator. + properties: {} + required: + - containers + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + replicas: + default: 3 + description: Replicas is the count of etcd instances in cluster. + format: int32 + minimum: 0 + type: integer + security: + description: Security describes security settings of etcd (authentication, certificates, rbac) + properties: + tls: + description: Section for user-managed tls certificates + properties: + clientSecret: + description: Client certificate for etcd-operator to do maintenance. It is expected to have tls.crt and tls.key fields in the secret. + type: string + clientTrustedCASecret: + description: Trusted CA for client certificates that are provided by client to etcd. It is expected to have tls.crt field in the secret. + type: string + peerSecret: + description: Certificate secret to secure peer-to-peer communication between etcd nodes. It is expected to have tls.crt and tls.key fields in the secret. + type: string + peerTrustedCASecret: + description: Trusted CA certificate secret to secure peer-to-peer communication between etcd nodes. It is expected to have tls.crt field in the secret. + type: string + serverSecret: + description: |- + Server certificate secret to secure client-server communication. Is provided to the client who connects to etcd by client port (2379 by default). + It is expected to have tls.crt and tls.key fields in the secret. + type: string + type: object + type: object + serviceTemplate: + description: Service defines the desired state of Service for etcd members. If not specified, default values will be used. + properties: + metadata: + description: EmbeddedMetadata contains metadata relevant to an EmbeddedResource. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + spec: + description: Spec defines the behavior of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations of session affinity. + properties: + clientIP: + description: clientIP contains the configurations of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic is + distributed to Service endpoints. Implementations can use this field as a + hint, but are not required to guarantee strict adherence. If the field is + not set, the implementation will apply its default routing strategy. If set + to "PreferClose", implementations should prioritize endpoints that are + topologically close (e.g., same zone). + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + storage: + description: |- + StorageSpec defines the configured storage for a etcd members. + If neither `emptyDir` nor `volumeClaimTemplate` is specified, then by default an [EmptyDir](https://kubernetes.io/docs/concepts/storage/volumes/#emptydir) will be used. + properties: + emptyDir: + description: |- + EmptyDirVolumeSource to be used by the StatefulSets. If specified, used in place of any volumeClaimTemplate. More + info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + volumeClaimTemplate: + description: A PVC spec to be used by the StatefulSets. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + description: EmbeddedMetadata contains metadata relevant to an EmbeddedResource. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Labels Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels + type: object + name: + description: |- + Name must be unique within a namespace. Is required when creating resources, although + some resources may allow a client to request the generation of an appropriate name + automatically. Name is primarily intended for creation idempotence and configuration + definition. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + type: string + type: object + spec: + description: |- + Spec defines the desired characteristics of a volume requested by a pod author. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being referenced + type: string + name: + description: Name is the name of resource being referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being referenced + type: string + name: + description: Name is the name of resource being referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over volumes to consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + (Alpha) Using this field requires the VolumeAttributesClass feature gate to be enabled. + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference to the PersistentVolume backing this claim. + type: string + type: object + status: + description: |- + Status represents the current information/status of a persistent volume claim. + Read-only. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the actual access modes the volume backing the PVC has. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + allocatedResourceStatuses: + additionalProperties: + description: |- + When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource + that it does not recognizes, then it should ignore that update and let other controllers + handle it. + type: string + description: "allocatedResourceStatuses stores status of resource being resized for the given PVC.\nKey names follow standard Kubernetes label syntax. Valid values are either:\n\t* Un-prefixed keys:\n\t\t- storage - the capacity of the volume.\n\t* Custom resources must use implementation-defined prefixed names such as \"example.com/my-custom-resource\"\nApart from above values - keys that are unprefixed or have kubernetes.io prefix are considered\nreserved and hence may not be used.\n\n\nClaimResourceStatus can be in any of following states:\n\t- ControllerResizeInProgress:\n\t\tState set when resize controller starts resizing the volume in control-plane.\n\t- ControllerResizeFailed:\n\t\tState set when resize has failed in resize controller with a terminal error.\n\t- NodeResizePending:\n\t\tState set when resize controller has finished resizing the volume but further resizing of\n\t\tvolume is needed on the node.\n\t- NodeResizeInProgress:\n\t\tState set when kubelet starts resizing the volume.\n\t- NodeResizeFailed:\n\t\tState set when resizing has failed in kubelet with a terminal error. Transient errors don't set\n\t\tNodeResizeFailed.\nFor example: if expanding a PVC for more capacity - this field can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage'] = \"ControllerResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] = \"ControllerResizeFailed\"\n - pvc.status.allocatedResourceStatus['storage'] = \"NodeResizePending\"\n - pvc.status.allocatedResourceStatus['storage'] = \"NodeResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] = \"NodeResizeFailed\"\nWhen this field is not set, it means that no resize operation is in progress for the given PVC.\n\n\nA controller that receives PVC update with previously unknown resourceName or ClaimResourceStatus\nshould ignore the update for the purpose it was designed. For example - a controller that\nonly is responsible for resizing capacity of the volume, should ignore PVC updates that change other valid\nresources associated with PVC.\n\n\nThis is an alpha field and requires enabling RecoverVolumeExpansionFailure feature." + type: object + x-kubernetes-map-type: granular + allocatedResources: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: "allocatedResources tracks the resources allocated to a PVC including its capacity.\nKey names follow standard Kubernetes label syntax. Valid values are either:\n\t* Un-prefixed keys:\n\t\t- storage - the capacity of the volume.\n\t* Custom resources must use implementation-defined prefixed names such as \"example.com/my-custom-resource\"\nApart from above values - keys that are unprefixed or have kubernetes.io prefix are considered\nreserved and hence may not be used.\n\n\nCapacity reported here may be larger than the actual capacity when a volume expansion operation\nis requested.\nFor storage quota, the larger value from allocatedResources and PVC.spec.resources is used.\nIf allocatedResources is not set, PVC.spec.resources alone is used for quota calculation.\nIf a volume expansion capacity request is lowered, allocatedResources is only\nlowered if there are no expansion operations in progress and if the actual volume capacity\nis equal or lower than the requested capacity.\n\n\nA controller that receives PVC update with previously unknown resourceName\nshould ignore the update for the purpose it was designed. For example - a controller that\nonly is responsible for resizing capacity of the volume, should ignore PVC updates that change other valid\nresources associated with PVC.\n\n\nThis is an alpha field and requires enabling RecoverVolumeExpansionFailure feature." + type: object + capacity: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: capacity represents the actual resources of the underlying volume. + type: object + conditions: + description: |- + conditions is the current Condition of persistent volume claim. If underlying persistent volume is being + resized then the Condition will be set to 'Resizing'. + items: + description: PersistentVolumeClaimCondition contains details about state of pvc + properties: + lastProbeTime: + description: lastProbeTime is the time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime is the time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: message is the human-readable message indicating details about last transition. + type: string + reason: + description: |- + reason is a unique, this should be a short, machine understandable string that gives the reason + for condition's last transition. If it reports "Resizing" that means the underlying + persistent volume is being resized. + type: string + status: + type: string + type: + description: PersistentVolumeClaimConditionType is a valid value of PersistentVolumeClaimCondition.Type + type: string + required: + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + currentVolumeAttributesClassName: + description: |- + currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using. + When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim + This is an alpha field and requires enabling VolumeAttributesClass feature. + type: string + modifyVolumeStatus: + description: |- + ModifyVolumeStatus represents the status object of ControllerModifyVolume operation. + When this is unset, there is no ModifyVolume operation being attempted. + This is an alpha field and requires enabling VolumeAttributesClass feature. + properties: + status: + description: "status is the status of the ControllerModifyVolume operation. It can be in any of following states:\n - Pending\n Pending indicates that the PersistentVolumeClaim cannot be modified due to unmet requirements, such as\n the specified VolumeAttributesClass not existing.\n - InProgress\n InProgress indicates that the volume is being modified.\n - Infeasible\n Infeasible indicates that the request has been rejected as invalid by the CSI driver. To\n\t resolve the error, a valid VolumeAttributesClass needs to be specified.\nNote: New statuses can be added in the future. Consumers should check for unknown statuses and fail appropriately." + type: string + targetVolumeAttributesClassName: + description: targetVolumeAttributesClassName is the name of the VolumeAttributesClass the PVC currently being reconciled + type: string + required: + - status + type: object + phase: + description: phase represents the current phase of PersistentVolumeClaim. + type: string + type: object + type: object + type: object + required: + - storage + type: object + status: + description: EtcdClusterStatus defines the observed state of EtcdCluster + properties: + conditions: + items: + description: "Condition contains details for one aspect of the current state of this API Resource.\n---\nThis struct is intended for direct use as an array at the field path .status.conditions. For example,\n\n\n\ttype FooStatus struct{\n\t // Represents the observations of a foo's current state.\n\t // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/packages/system/etcd-operator/charts/etcd-operator/templates/_helpers.tpl b/packages/system/etcd-operator/charts/etcd-operator/templates/_helpers.tpl new file mode 100644 index 00000000..1ada979f --- /dev/null +++ b/packages/system/etcd-operator/charts/etcd-operator/templates/_helpers.tpl @@ -0,0 +1,51 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "etcd-operator.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "etcd-operator.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "etcd-operator.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "etcd-operator.labels" -}} +helm.sh/chart: {{ include "etcd-operator.chart" . }} +{{ include "etcd-operator.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "etcd-operator.selectorLabels" -}} +app.kubernetes.io/name: {{ include "etcd-operator.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/packages/system/etcd-operator/charts/etcd-operator/templates/cert-manager/certificate.yml b/packages/system/etcd-operator/charts/etcd-operator/templates/cert-manager/certificate.yml new file mode 100644 index 00000000..5a118966 --- /dev/null +++ b/packages/system/etcd-operator/charts/etcd-operator/templates/cert-manager/certificate.yml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + labels: + {{- include "etcd-operator.labels" . | nindent 4 }} + name: {{ include "etcd-operator.fullname" . }}-serving-cert +spec: + dnsNames: + - {{ include "etcd-operator.fullname" . }}-webhook-service.{{ .Release.Namespace }}.svc + - {{ include "etcd-operator.fullname" . }}-webhook-service.{{ .Release.Namespace }}.svc.{{ .Values.kubernetesClusterDomain }} + issuerRef: + kind: Issuer + name: {{ include "etcd-operator.fullname" . }}-selfsigned-issuer + secretName: webhook-server-cert diff --git a/packages/system/etcd-operator/charts/etcd-operator/templates/cert-manager/issuer.yml b/packages/system/etcd-operator/charts/etcd-operator/templates/cert-manager/issuer.yml new file mode 100644 index 00000000..35ae8358 --- /dev/null +++ b/packages/system/etcd-operator/charts/etcd-operator/templates/cert-manager/issuer.yml @@ -0,0 +1,8 @@ +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + labels: + {{- include "etcd-operator.labels" . | nindent 4 }} + name: {{ include "etcd-operator.fullname" . }}-selfsigned-issuer +spec: + selfSigned: {} diff --git a/packages/system/etcd-operator/charts/etcd-operator/templates/cert-manager/mutatingwebhookconfiguration.yml b/packages/system/etcd-operator/charts/etcd-operator/templates/cert-manager/mutatingwebhookconfiguration.yml new file mode 100644 index 00000000..350c3c3b --- /dev/null +++ b/packages/system/etcd-operator/charts/etcd-operator/templates/cert-manager/mutatingwebhookconfiguration.yml @@ -0,0 +1,29 @@ +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "etcd-operator.fullname" . }}-serving-cert + labels: + {{- include "etcd-operator.labels" . | nindent 4 }} + name: {{ include "etcd-operator.fullname" . }}-mutating-webhook-configuration +webhooks: + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: {{ include "etcd-operator.fullname" . }}-webhook-service + namespace: {{ .Release.Namespace }} + path: /mutate-etcd-aenix-io-v1alpha1-etcdcluster + failurePolicy: Fail + name: metcdcluster.kb.io + rules: + - apiGroups: + - etcd.aenix.io + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - etcdclusters + sideEffects: None diff --git a/packages/system/etcd-operator/charts/etcd-operator/templates/cert-manager/validatingwebhookconfiguration.yml b/packages/system/etcd-operator/charts/etcd-operator/templates/cert-manager/validatingwebhookconfiguration.yml new file mode 100644 index 00000000..0c2f7c51 --- /dev/null +++ b/packages/system/etcd-operator/charts/etcd-operator/templates/cert-manager/validatingwebhookconfiguration.yml @@ -0,0 +1,29 @@ +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "etcd-operator.fullname" . }}-serving-cert + labels: + {{- include "etcd-operator.labels" . | nindent 4 }} + name: {{ include "etcd-operator.fullname" . }}-validating-webhook-configuration +webhooks: + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: {{ include "etcd-operator.fullname" . }}-webhook-service + namespace: {{ .Release.Namespace }} + path: /validate-etcd-aenix-io-v1alpha1-etcdcluster + failurePolicy: Fail + name: vetcdcluster.kb.io + rules: + - apiGroups: + - etcd.aenix.io + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - etcdclusters + sideEffects: None diff --git a/packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrole-manager-role.yml b/packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrole-manager-role.yml new file mode 100644 index 00000000..ccb982ac --- /dev/null +++ b/packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrole-manager-role.yml @@ -0,0 +1,81 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "etcd-operator.labels" . | nindent 4 }} + name: {{ include "etcd-operator.fullname" . }}-manager-role +rules: + - apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - services + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - apps + resources: + - statefulsets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - etcd.aenix.io + resources: + - etcdclusters + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - etcd.aenix.io + resources: + - etcdclusters/finalizers + verbs: + - update + - apiGroups: + - etcd.aenix.io + resources: + - etcdclusters/status + verbs: + - get + - patch + - update + - apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch diff --git a/packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrole-metrics-reader.yml b/packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrole-metrics-reader.yml new file mode 100644 index 00000000..1a2d4009 --- /dev/null +++ b/packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrole-metrics-reader.yml @@ -0,0 +1,11 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "etcd-operator.labels" . | nindent 4 }} + name: {{ include "etcd-operator.fullname" . }}-metrics-reader +rules: + - nonResourceURLs: + - /metrics + verbs: + - get diff --git a/packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrole-proxy-role.yml b/packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrole-proxy-role.yml new file mode 100644 index 00000000..2fad184a --- /dev/null +++ b/packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrole-proxy-role.yml @@ -0,0 +1,19 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "etcd-operator.labels" . | nindent 4 }} + name: {{ include "etcd-operator.fullname" . }}-proxy-role +rules: + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create diff --git a/packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrolebinding-manager-rolebinding.yml b/packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrolebinding-manager-rolebinding.yml new file mode 100644 index 00000000..486d35be --- /dev/null +++ b/packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrolebinding-manager-rolebinding.yml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + {{- include "etcd-operator.labels" . | nindent 4 }} + name: {{ include "etcd-operator.fullname" . }}-manager-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "etcd-operator.fullname" . }}-manager-role +subjects: + - kind: ServiceAccount + name: {{ include "etcd-operator.fullname" . }}-controller-manager + namespace: {{ .Release.Namespace }} diff --git a/packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrolebinding-proxy-rolebinding.yml b/packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrolebinding-proxy-rolebinding.yml new file mode 100644 index 00000000..57f8c013 --- /dev/null +++ b/packages/system/etcd-operator/charts/etcd-operator/templates/rbac/clusterrolebinding-proxy-rolebinding.yml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + {{- include "etcd-operator.labels" . | nindent 4 }} + name: {{ include "etcd-operator.fullname" . }}-proxy-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "etcd-operator.fullname" . }}-proxy-role +subjects: + - kind: ServiceAccount + name: {{ include "etcd-operator.fullname" . }}-controller-manager + namespace: {{ .Release.Namespace }} diff --git a/packages/system/etcd-operator/charts/etcd-operator/templates/rbac/role-leader-election-role.yml b/packages/system/etcd-operator/charts/etcd-operator/templates/rbac/role-leader-election-role.yml new file mode 100644 index 00000000..96b9323a --- /dev/null +++ b/packages/system/etcd-operator/charts/etcd-operator/templates/rbac/role-leader-election-role.yml @@ -0,0 +1,38 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + {{- include "etcd-operator.labels" . | nindent 4 }} + name: {{ include "etcd-operator.fullname" . }}-leader-election-role +rules: + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch diff --git a/packages/system/etcd-operator/charts/etcd-operator/templates/rbac/rolebinding-leader-election-rolebinding.yml b/packages/system/etcd-operator/charts/etcd-operator/templates/rbac/rolebinding-leader-election-rolebinding.yml new file mode 100644 index 00000000..1c58a95d --- /dev/null +++ b/packages/system/etcd-operator/charts/etcd-operator/templates/rbac/rolebinding-leader-election-rolebinding.yml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + {{- include "etcd-operator.labels" . | nindent 4 }} + name: {{ include "etcd-operator.fullname" . }}-leader-election-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "etcd-operator.fullname" . }}-leader-election-role +subjects: + - kind: ServiceAccount + name: {{ include "etcd-operator.fullname" . }}-controller-manager + namespace: {{ .Release.Namespace }} diff --git a/packages/system/etcd-operator/charts/etcd-operator/templates/workload/configmap-env.yaml b/packages/system/etcd-operator/charts/etcd-operator/templates/workload/configmap-env.yaml new file mode 100644 index 00000000..78401c4c --- /dev/null +++ b/packages/system/etcd-operator/charts/etcd-operator/templates/workload/configmap-env.yaml @@ -0,0 +1,16 @@ +{{- if .Values.etcdOperator.envVars }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "etcd-operator.labels" . }}-env + labels: + {{- include "etcd-operator.labels" . | nindent 4 }} +data: + {{- range $k, $v := .Values.etcdOperator.envVars }} + {{- if typeOf $v | eq "string" }} + {{- print (tpl $k $) ": " (tpl $v $ | quote) | nindent 2 }} + {{- else }} + {{- print (tpl $k $) ": " ($v | quote) | nindent 2 }} + {{- end }} + {{- end }} +{{- end }} diff --git a/packages/system/etcd-operator/charts/etcd-operator/templates/workload/deployment.yml b/packages/system/etcd-operator/charts/etcd-operator/templates/workload/deployment.yml new file mode 100644 index 00000000..ece5bae8 --- /dev/null +++ b/packages/system/etcd-operator/charts/etcd-operator/templates/workload/deployment.yml @@ -0,0 +1,114 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "etcd-operator.fullname" . }}-controller-manager + labels: + {{- include "etcd-operator.labels" . | nindent 4 }} +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + {{- include "etcd-operator.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "etcd-operator.labels" . | nindent 8 }} + {{- with .Values.podLabels }} + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: etcd-operator + image: {{ .Values.etcdOperator.image.repository }}:{{ .Values.etcdOperator.image.tag | default .Chart.AppVersion }} + imagePullPolicy: {{ .Values.etcdOperator.image.pullPolicy }} + {{- with .Values.etcdOperator.args }} + args: + {{- toYaml . | nindent 12 }} + {{- end }} + ports: + - containerPort: {{ .Values.etcdOperator.service.port }} + name: webhook-server + protocol: TCP + {{- with .Values.etcdOperator.livenessProbe }} + livenessProbe: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.etcdOperator.readinessProbe }} + readinessProbe: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.etcdOperator.resources }} + resources: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.etcdOperator.securityContext }} + securityContext: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- if .Values.etcdOperator.envVars }} + envFrom: + - configMapRef: + name: {{ include "etcd-operator.fullname" . }}-env + {{- end }} + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true + - name: kube-rbac-proxy + image: {{ .Values.kubeRbacProxy.image.repository }}:{{ .Values.kubeRbacProxy.image.tag }} + imagePullPolicy: {{ .Values.kubeRbacProxy.image.pullPolicy }} + {{- with .Values.kubeRbacProxy.args }} + args: + {{- toYaml . | nindent 12 }} + {{- end }} + ports: + - containerPort: {{ .Values.kubeRbacProxy.service.port }} + name: https + protocol: TCP + {{- with .Values.kubeRbacProxy.livenessProbe }} + livenessProbe: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.kubeRbacProxy.readinessProbe }} + readinessProbe: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.kubeRbacProxy.resources }} + resources: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.kubeRbacProxy.securityContext }} + securityContext: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "etcd-operator.fullname" . }}-controller-manager + terminationGracePeriodSeconds: 10 + volumes: + - name: cert + secret: + defaultMode: 420 + secretName: webhook-server-cert + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/packages/system/etcd-operator/charts/etcd-operator/templates/workload/service-controller-manager-metrics-service.yml b/packages/system/etcd-operator/charts/etcd-operator/templates/workload/service-controller-manager-metrics-service.yml new file mode 100644 index 00000000..16bdaa31 --- /dev/null +++ b/packages/system/etcd-operator/charts/etcd-operator/templates/workload/service-controller-manager-metrics-service.yml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "etcd-operator.fullname" . }}-controller-manager-metrics-service + labels: + {{- include "etcd-operator.labels" . | nindent 4 }} +spec: + type: {{ .Values.kubeRbacProxy.service.type }} + ports: + - name: https + port: {{ .Values.kubeRbacProxy.service.port }} + protocol: TCP + targetPort: https + selector: + {{- include "etcd-operator.selectorLabels" . | nindent 4 }} diff --git a/packages/system/etcd-operator/charts/etcd-operator/templates/workload/service-webhook-service.yml b/packages/system/etcd-operator/charts/etcd-operator/templates/workload/service-webhook-service.yml new file mode 100644 index 00000000..95fa30c8 --- /dev/null +++ b/packages/system/etcd-operator/charts/etcd-operator/templates/workload/service-webhook-service.yml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + {{- include "etcd-operator.labels" . | nindent 4 }} + name: {{ include "etcd-operator.fullname" . }}-webhook-service +spec: + type: {{ .Values.etcdOperator.service.type }} + ports: + - port: 443 + protocol: TCP + targetPort: {{ .Values.etcdOperator.service.port }} + selector: + {{- include "etcd-operator.selectorLabels" . | nindent 4 }} diff --git a/packages/system/etcd-operator/charts/etcd-operator/templates/workload/serviceaccount.yml b/packages/system/etcd-operator/charts/etcd-operator/templates/workload/serviceaccount.yml new file mode 100644 index 00000000..25a0f6ed --- /dev/null +++ b/packages/system/etcd-operator/charts/etcd-operator/templates/workload/serviceaccount.yml @@ -0,0 +1,12 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "etcd-operator.fullname" . }}-controller-manager + labels: + {{- include "etcd-operator.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/packages/system/etcd-operator/charts/etcd-operator/values.schema.json b/packages/system/etcd-operator/charts/etcd-operator/values.schema.json new file mode 100644 index 00000000..97400378 --- /dev/null +++ b/packages/system/etcd-operator/charts/etcd-operator/values.schema.json @@ -0,0 +1,284 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "properties": { + "affinity": { + "properties": {}, + "type": "object" + }, + "etcdOperator": { + "properties": { + "args": { + "items": { + "type": "string" + }, + "type": "array" + }, + "envVars": { + "properties": {}, + "type": "object" + }, + "image": { + "properties": { + "pullPolicy": { + "type": "string" + }, + "repository": { + "type": "string" + }, + "tag": { + "type": "string" + } + }, + "type": "object" + }, + "livenessProbe": { + "properties": { + "httpGet": { + "properties": { + "path": { + "type": "string" + }, + "port": { + "type": "integer" + } + }, + "type": "object" + }, + "initialDelaySeconds": { + "type": "integer" + }, + "periodSeconds": { + "type": "integer" + } + }, + "type": "object" + }, + "readinessProbe": { + "properties": { + "httpGet": { + "properties": { + "path": { + "type": "string" + }, + "port": { + "type": "integer" + } + }, + "type": "object" + }, + "initialDelaySeconds": { + "type": "integer" + }, + "periodSeconds": { + "type": "integer" + } + }, + "type": "object" + }, + "resources": { + "properties": { + "limits": { + "properties": { + "cpu": { + "type": "string" + }, + "memory": { + "type": "string" + } + }, + "type": "object" + }, + "requests": { + "properties": { + "cpu": { + "type": "string" + }, + "memory": { + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "securityContext": { + "properties": { + "allowPrivilegeEscalation": { + "type": "boolean" + }, + "capabilities": { + "properties": { + "drop": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "service": { + "properties": { + "port": { + "type": "integer" + }, + "type": { + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "fullnameOverride": { + "type": "string" + }, + "imagePullSecrets": { + "type": "array" + }, + "kubeRbacProxy": { + "properties": { + "args": { + "items": { + "type": "string" + }, + "type": "array" + }, + "image": { + "properties": { + "pullPolicy": { + "type": "string" + }, + "repository": { + "type": "string" + }, + "tag": { + "type": "string" + } + }, + "type": "object" + }, + "livenessProbe": { + "properties": {}, + "type": "object" + }, + "readinessProbe": { + "properties": {}, + "type": "object" + }, + "resources": { + "properties": { + "limits": { + "properties": { + "cpu": { + "type": "string" + }, + "memory": { + "type": "string" + } + }, + "type": "object" + }, + "requests": { + "properties": { + "cpu": { + "type": "string" + }, + "memory": { + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "securityContext": { + "properties": { + "allowPrivilegeEscalation": { + "type": "boolean" + }, + "capabilities": { + "properties": { + "drop": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "service": { + "properties": { + "port": { + "type": "integer" + }, + "type": { + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "kubernetesClusterDomain": { + "type": "string" + }, + "nameOverride": { + "type": "string" + }, + "nodeSelector": { + "properties": {}, + "type": "object" + }, + "podAnnotations": { + "properties": {}, + "type": "object" + }, + "podLabels": { + "properties": {}, + "type": "object" + }, + "podSecurityContext": { + "properties": {}, + "type": "object" + }, + "replicaCount": { + "type": "integer" + }, + "securityContext": { + "properties": { + "runAsNonRoot": { + "type": "boolean" + } + }, + "type": "object" + }, + "serviceAccount": { + "properties": { + "annotations": { + "properties": {}, + "type": "object" + }, + "create": { + "type": "boolean" + } + }, + "type": "object" + }, + "tolerations": { + "type": "array" + } + }, + "type": "object" +} \ No newline at end of file diff --git a/packages/system/etcd-operator/charts/etcd-operator/values.yaml b/packages/system/etcd-operator/charts/etcd-operator/values.yaml new file mode 100644 index 00000000..9c9ff75a --- /dev/null +++ b/packages/system/etcd-operator/charts/etcd-operator/values.yaml @@ -0,0 +1,98 @@ +etcdOperator: + image: + repository: ghcr.io/aenix-io/etcd-operator + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart appVersion. + tag: "" + args: + - --health-probe-bind-address=:8081 + - --metrics-bind-address=127.0.0.1:8080 + - --leader-elect + service: + type: ClusterIP + port: 9443 + envVars: {} + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 100m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + +kubeRbacProxy: + image: + repository: gcr.io/kubebuilder/kube-rbac-proxy + pullPolicy: IfNotPresent + tag: v0.16.0 + args: + - --secure-listen-address=0.0.0.0:8443 + - --upstream=http://127.0.0.1:8080/ + - --logtostderr=true + - --v=0 + service: + type: ClusterIP + port: 8443 + livenessProbe: {} + readinessProbe: {} + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 100m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + +kubernetesClusterDomain: cluster.local + +replicaCount: 1 + +imagePullSecrets: [] + +nameOverride: "" + +fullnameOverride: "" + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + +podAnnotations: {} + +podLabels: {} + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: + runAsNonRoot: true + +nodeSelector: {} + +tolerations: [] + +affinity: {} From be508fd1071b1be1287759444f085667336dccf9 Mon Sep 17 00:00:00 2001 From: Marian Koreniuk Date: Wed, 24 Apr 2024 16:21:06 +0300 Subject: [PATCH 2/2] Fix etcd-operator Makefile --- packages/system/etcd-operator/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/system/etcd-operator/Makefile b/packages/system/etcd-operator/Makefile index fc46e874..0c82cdb9 100644 --- a/packages/system/etcd-operator/Makefile +++ b/packages/system/etcd-operator/Makefile @@ -1,5 +1,5 @@ NAME=etcd-operator -NAMESPACE=cozy-etcd-operator +NAMESPACE=cozy-${NAME} include ../../../scripts/package-system.mk