feat: kubesphere 4.0 (#6115)
* feat: kubesphere 4.0 Signed-off-by: ci-bot <ci-bot@kubesphere.io> * feat: kubesphere 4.0 Signed-off-by: ci-bot <ci-bot@kubesphere.io> --------- Signed-off-by: ci-bot <ci-bot@kubesphere.io> Co-authored-by: ks-ci-bot <ks-ci-bot@example.com> Co-authored-by: joyceliu <joyceliu@yunify.com>
This commit is contained in:
KubeSphere CI Bot
committed by
GitHub
GitHub
parent
b5015ec7b9
commit
447a51f08b
@@ -1,6 +0,0 @@
|
||||
apiVersion: v2
|
||||
appVersion: 1.16.0
|
||||
description: The Gateway helm Chart creates a Nginx Ingress Controller release by render a Nginx.gateway.kubesphere.io Kind.
|
||||
name: gateway
|
||||
type: application
|
||||
version: 0.1.0
|
||||
@@ -1,287 +0,0 @@
|
||||
apiVersion: gateway.kubesphere.io/v1alpha1
|
||||
kind: Nginx
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-ingress
|
||||
spec:
|
||||
fullnameOverride: {{ .Release.Name }}
|
||||
controller:
|
||||
# To rolling upgrade from old nginx ingress controller, we have to overide the name pattern
|
||||
name: ""
|
||||
image:
|
||||
{{- with .Values.controller.image }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
watchIngressWithoutClass: true
|
||||
publishService:
|
||||
enabled: {{ eq .Values.service.type "LoadBalancer" }}
|
||||
|
||||
# Will add custom configuration options to Nginx https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/
|
||||
{{- if .Values.controller.config }}
|
||||
config: {{ toYaml .Values.controller.config | nindent 6 }}
|
||||
{{- end }}
|
||||
|
||||
{{- if hasKey .Values.deployment.annotations "servicemesh.kubesphere.io/enabled" }}
|
||||
podAnnotations:
|
||||
sidecar.istio.io/inject: {{ get .Values.deployment.annotations "servicemesh.kubesphere.io/enabled" }}
|
||||
{{- end }}
|
||||
|
||||
## Annotations to be added to the controller config configuration configmap
|
||||
##
|
||||
configAnnotations: {}
|
||||
|
||||
# Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/customization/custom-headers
|
||||
proxySetHeaders: {}
|
||||
|
||||
# Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers
|
||||
addHeaders: {}
|
||||
|
||||
# Optionally customize the pod dnsConfig.
|
||||
dnsConfig: {}
|
||||
|
||||
|
||||
# Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network
|
||||
# Ingress status was blank because there is no Service exposing the NGINX Ingress controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply
|
||||
reportNodeInternalIp: false
|
||||
|
||||
## Election ID to use for status update
|
||||
##
|
||||
electionID: ingress-controller-leader-{{ .Release.Name }}
|
||||
|
||||
## Name of the ingress class to route through this controller
|
||||
##
|
||||
ingressClass: nginx
|
||||
|
||||
# This section refers to the creation of the IngressClass resource
|
||||
# IngressClass resources are supported since k8s >= 1.18
|
||||
ingressClassResource:
|
||||
enabled: false
|
||||
default: false
|
||||
|
||||
# Parameters is a link to a custom resource containing additional
|
||||
# configuration for the controller. This is optional if the controller
|
||||
# does not require extra parameters.
|
||||
parameters: {}
|
||||
|
||||
# labels to add to the pod container metadata
|
||||
podLabels: {}
|
||||
# key: value
|
||||
|
||||
|
||||
## Limit the scope of the controller
|
||||
##
|
||||
{{- if .Values.controller.scope.enabled }}
|
||||
scope:
|
||||
enabled: true
|
||||
namespace: {{ default .Release.Namespace .Values.controller.scope.namespace }} # defaults to .Release.Namespace
|
||||
{{- end }}
|
||||
|
||||
|
||||
## Allows customization of the configmap / nginx-configmap namespace
|
||||
##
|
||||
configMapNamespace: "" # defaults to .Release.Namespace
|
||||
|
||||
## Allows customization of the tcp-services-configmap
|
||||
##
|
||||
tcp:
|
||||
configMapNamespace: "" # defaults to .Release.Namespace
|
||||
## Annotations to be added to the tcp config configmap
|
||||
annotations: {}
|
||||
|
||||
## Allows customization of the udp-services-configmap
|
||||
##
|
||||
udp:
|
||||
configMapNamespace: "" # defaults to .Release.Namespace
|
||||
## Annotations to be added to the udp config configmap
|
||||
annotations: {}
|
||||
|
||||
|
||||
## Additional command line arguments to pass to nginx-ingress-controller
|
||||
## E.g. to specify the default SSL certificate you can use
|
||||
## extraArgs:
|
||||
## default-ssl-certificate: "<namespace>/<secret_name>"
|
||||
extraArgs: {}
|
||||
|
||||
## Additional environment variables to set
|
||||
extraEnvs: []
|
||||
|
||||
kind: Deployment
|
||||
|
||||
## Annotations to be added to the controller Deployment or DaemonSet
|
||||
##
|
||||
{{- if .Values.deployment.annotations }}
|
||||
annotations: {{ toYaml .Values.deployment.annotations | nindent 6 }}
|
||||
{{- end }}
|
||||
|
||||
## Labels to be added to the controller Deployment or DaemonSet
|
||||
##
|
||||
labels: {}
|
||||
# keel.sh/policy: patch
|
||||
# keel.sh/trigger: poll
|
||||
|
||||
|
||||
## Node tolerations for server scheduling to nodes with taints
|
||||
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
|
||||
##
|
||||
tolerations: []
|
||||
# - key: "key"
|
||||
# operator: "Equal|Exists"
|
||||
# value: "value"
|
||||
# effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"
|
||||
|
||||
## Affinity and anti-affinity
|
||||
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
|
||||
##
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
podAffinityTerm:
|
||||
labelSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/name
|
||||
operator: In
|
||||
values:
|
||||
- ingress-nginx
|
||||
- key: app.kubernetes.io/instance
|
||||
operator: In
|
||||
values:
|
||||
- {{ .Release.Name }}-ingress
|
||||
- key: app.kubernetes.io/component
|
||||
operator: In
|
||||
values:
|
||||
- controller
|
||||
topologyKey: kubernetes.io/hostname
|
||||
|
||||
# # An example of required pod anti-affinity
|
||||
# podAntiAffinity:
|
||||
# requiredDuringSchedulingIgnoredDuringExecution:
|
||||
# - labelSelector:
|
||||
# matchExpressions:
|
||||
# - key: app.kubernetes.io/name
|
||||
# operator: In
|
||||
# values:
|
||||
# - ingress-nginx
|
||||
# - key: app.kubernetes.io/instance
|
||||
# operator: In
|
||||
# values:
|
||||
# - ingress-nginx
|
||||
# - key: app.kubernetes.io/component
|
||||
# operator: In
|
||||
# values:
|
||||
# - controller
|
||||
# topologyKey: "kubernetes.io/hostname"
|
||||
|
||||
## Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in.
|
||||
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
|
||||
##
|
||||
topologySpreadConstraints: []
|
||||
# - maxSkew: 1
|
||||
# topologyKey: failure-domain.beta.kubernetes.io/zone
|
||||
# whenUnsatisfiable: DoNotSchedule
|
||||
# labelSelector:
|
||||
# matchLabels:
|
||||
# app.kubernetes.io/instance: ingress-nginx-internal
|
||||
|
||||
|
||||
|
||||
replicaCount: {{.Values.deployment.replicas}}
|
||||
|
||||
minAvailable: 1
|
||||
|
||||
# Define requests resources to avoid probe issues due to CPU utilization in busy nodes
|
||||
# ref: https://github.com/kubernetes/ingress-nginx/issues/4735#issuecomment-551204903
|
||||
# Ideally, there should be no limits.
|
||||
# https://engineering.indeedblog.com/blog/2019/12/cpu-throttling-regression-fix/
|
||||
resources: {{ toYaml .Values.deployment.resources | nindent 6 }}
|
||||
|
||||
# Mutually exclusive with keda autoscaling
|
||||
autoscaling:
|
||||
enabled: false
|
||||
minReplicas: 1
|
||||
maxReplicas: 11
|
||||
targetCPUUtilizationPercentage: 50
|
||||
targetMemoryUtilizationPercentage: 50
|
||||
|
||||
## Override NGINX template
|
||||
customTemplate:
|
||||
configMapName: ""
|
||||
configMapKey: ""
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
{{- if .Values.service.annotations }}
|
||||
annotations: {{ toYaml .Values.service.annotations | nindent 8 }}
|
||||
{{- end }}
|
||||
labels: {}
|
||||
# clusterIP: ""
|
||||
|
||||
## List of IP addresses at which the controller services are available
|
||||
## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips
|
||||
##
|
||||
externalIPs: []
|
||||
|
||||
# loadBalancerIP: ""
|
||||
loadBalancerSourceRanges: []
|
||||
|
||||
## Set external traffic policy to: "Local" to preserve source IP on
|
||||
## providers supporting it
|
||||
## Ref: https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer
|
||||
# externalTrafficPolicy: ""
|
||||
|
||||
# Must be either "None" or "ClientIP" if set. Kubernetes will default to "None".
|
||||
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies
|
||||
# sessionAffinity: ""
|
||||
|
||||
|
||||
type: {{ .Values.service.type }}
|
||||
|
||||
# type: NodePort
|
||||
# nodePorts:
|
||||
# http: 32080
|
||||
# https: 32443
|
||||
# tcp:
|
||||
# 8080: 32808
|
||||
nodePorts:
|
||||
http: ""
|
||||
https: ""
|
||||
tcp: {}
|
||||
udp: {}
|
||||
|
||||
admissionWebhooks:
|
||||
enabled: false
|
||||
|
||||
metrics:
|
||||
port: 10254
|
||||
enabled: true
|
||||
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
prometheusRule:
|
||||
enabled: false
|
||||
|
||||
|
||||
## Optional array of imagePullSecrets containing private registry credentials
|
||||
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
imagePullSecrets: []
|
||||
# - name: secretName
|
||||
|
||||
# TCP service key:value pairs
|
||||
# Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md
|
||||
##
|
||||
{{- if .Values.controller.tcp }}
|
||||
tcp: {{ toYaml .Values.controller.tcp | nindent 4 }}
|
||||
{{- end }}
|
||||
# 8080: "default/example-tcp-svc:9000"
|
||||
|
||||
|
||||
# UDP service key:value pairs
|
||||
# Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md
|
||||
##
|
||||
{{- if .Values.controller.udp }}
|
||||
udp: {{ toYaml .Values.controller.udp | nindent 4 }}
|
||||
{{- end }}
|
||||
# 53: "kube-system/kube-dns:53"
|
||||
|
||||
|
||||
|
||||
@@ -1,40 +0,0 @@
|
||||
# Default values for gateway.
|
||||
|
||||
controller:
|
||||
replicas: 1
|
||||
annotations: {}
|
||||
# add custom configuration options
|
||||
config: {}
|
||||
## Limit the scope of the controller
|
||||
##
|
||||
scope:
|
||||
enabled: false
|
||||
namespace: "" # defaults to .Release.Namespace
|
||||
image:
|
||||
repository: kubesphere/nginx-ingress-controller
|
||||
tag: "v1.3.1"
|
||||
pullPolicy: IfNotPresent
|
||||
digest: ""
|
||||
# add configuration of forwarding tcp/udp traffic
|
||||
tcp: {}
|
||||
udp: {}
|
||||
|
||||
|
||||
service:
|
||||
## annotations for Services, used for config Cloud LoadBalancer
|
||||
annotations: {}
|
||||
type: LoadBalancer
|
||||
|
||||
## for nginx controller, same with controller
|
||||
deployment:
|
||||
annotations: {}
|
||||
replicas: 1
|
||||
resources:
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 90Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 90Mi
|
||||
|
||||
|
||||
@@ -7,9 +7,18 @@ type: application
|
||||
# This is the chart version. This version number should be incremented each time you make changes
|
||||
# to the chart and its templates, including the app version.
|
||||
# Versions are expected to follow Semantic Versioning (https://semver.org/)
|
||||
version: 0.1.1
|
||||
version: 1.1.0
|
||||
|
||||
# This is the version number of the application being deployed. This version number should be
|
||||
# incremented each time you make changes to the application. Versions are not expected to
|
||||
# follow Semantic Versioning. They should reflect the version the application is using.
|
||||
appVersion: "v3.2.1"
|
||||
appVersion: "v4.1.1"
|
||||
|
||||
dependencies:
|
||||
- name: redis-ha
|
||||
version: 4.26.1
|
||||
alias: redisHA
|
||||
condition: redisHA.enabled
|
||||
- name: ks-crds
|
||||
version: 1.0.0
|
||||
alias: ksCRDs
|
||||
|
||||
24
config/ks-core/charts/ks-crds/Chart.yaml
Normal file
24
config/ks-core/charts/ks-crds/Chart.yaml
Normal file
@@ -0,0 +1,24 @@
|
||||
apiVersion: v2
|
||||
name: ks-crds
|
||||
description: A Helm chart for KS's CustomResourceDefinition
|
||||
|
||||
# A chart can be either an 'application' or a 'library' chart.
|
||||
#
|
||||
# Application charts are a collection of templates that can be packaged into versioned archives
|
||||
# to be deployed.
|
||||
#
|
||||
# Library charts provide useful utilities or functions for the chart developer. They're included as
|
||||
# a dependency of application charts to inject those utilities and functions into the rendering
|
||||
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
|
||||
type: application
|
||||
|
||||
# This is the chart version. This version number should be incremented each time you make changes
|
||||
# to the chart and its templates, including the app version.
|
||||
# Versions are expected to follow Semantic Versioning (https://semver.org/)
|
||||
version: 1.0.0
|
||||
|
||||
# This is the version number of the application being deployed. This version number should be
|
||||
# incremented each time you make changes to the application. Versions are not expected to
|
||||
# follow Semantic Versioning. They should reflect the version the application is using.
|
||||
# It is recommended to use it with quotes.
|
||||
appVersion: "v4.1.0"
|
||||
@@ -7,6 +7,8 @@ metadata:
|
||||
annotations:
|
||||
api-approved.kubernetes.io: https://github.com/kubernetes-sigs/application/pull/2
|
||||
controller-gen.kubebuilder.io/version: v0.4.0
|
||||
labels:
|
||||
kubesphere.io/resource-served: 'true'
|
||||
creationTimestamp: null
|
||||
name: applications.app.k8s.io
|
||||
spec:
|
||||
@@ -529,4 +531,4 @@ status:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
storedVersions: []
|
||||
@@ -0,0 +1,115 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: applicationreleases.application.kubesphere.io
|
||||
spec:
|
||||
group: application.kubesphere.io
|
||||
names:
|
||||
kind: ApplicationRelease
|
||||
listKind: ApplicationReleaseList
|
||||
plural: applicationreleases
|
||||
shortNames:
|
||||
- apprls
|
||||
singular: applicationrelease
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .metadata.labels.kubesphere\.io/workspace
|
||||
name: workspace
|
||||
type: string
|
||||
- jsonPath: .metadata.labels.application\.kubesphere\.io/app-id
|
||||
name: app
|
||||
type: string
|
||||
- jsonPath: .metadata.labels.application\.kubesphere\.io/appversion-id
|
||||
name: appversion
|
||||
type: string
|
||||
- jsonPath: .spec.appType
|
||||
name: appType
|
||||
type: string
|
||||
- jsonPath: .metadata.labels.kubesphere\.io/cluster
|
||||
name: Cluster
|
||||
type: string
|
||||
- jsonPath: .metadata.labels.kubesphere\.io/namespace
|
||||
name: Namespace
|
||||
type: string
|
||||
- jsonPath: .status.state
|
||||
name: State
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: ApplicationRelease is the Schema for the applicationreleases
|
||||
API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ApplicationReleaseSpec defines the desired state of ApplicationRelease
|
||||
properties:
|
||||
appID:
|
||||
type: string
|
||||
appType:
|
||||
type: string
|
||||
appVersionID:
|
||||
type: string
|
||||
values:
|
||||
format: byte
|
||||
type: string
|
||||
required:
|
||||
- appID
|
||||
- appVersionID
|
||||
type: object
|
||||
status:
|
||||
description: ApplicationReleaseStatus defines the observed state of ApplicationRelease
|
||||
properties:
|
||||
installJobName:
|
||||
type: string
|
||||
lastUpdate:
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
type: string
|
||||
realTimeResources:
|
||||
items:
|
||||
description: |-
|
||||
RawMessage is a raw encoded JSON value.
|
||||
It implements Marshaler and Unmarshaler and can
|
||||
be used to delay JSON decoding or precompute a JSON encoding.
|
||||
format: byte
|
||||
type: string
|
||||
type: array
|
||||
specHash:
|
||||
type: string
|
||||
state:
|
||||
type: string
|
||||
uninstallJobName:
|
||||
type: string
|
||||
required:
|
||||
- state
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,107 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: applications.application.kubesphere.io
|
||||
spec:
|
||||
group: application.kubesphere.io
|
||||
names:
|
||||
kind: Application
|
||||
listKind: ApplicationList
|
||||
plural: applications
|
||||
shortNames:
|
||||
- app
|
||||
singular: application
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .metadata.labels.application\.kubesphere\.io/repo-name
|
||||
name: repo
|
||||
type: string
|
||||
- jsonPath: .metadata.labels.kubesphere\.io/workspace
|
||||
name: workspace
|
||||
type: string
|
||||
- jsonPath: .spec.appType
|
||||
name: appType
|
||||
type: string
|
||||
- jsonPath: .status.state
|
||||
name: State
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: Application is the Schema for the applications API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ApplicationSpec defines the desired state of Application
|
||||
properties:
|
||||
abstraction:
|
||||
type: string
|
||||
appHome:
|
||||
type: string
|
||||
appType:
|
||||
type: string
|
||||
attachments:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
icon:
|
||||
type: string
|
||||
resources:
|
||||
items:
|
||||
properties:
|
||||
Desc:
|
||||
type: string
|
||||
Group:
|
||||
type: string
|
||||
Name:
|
||||
type: string
|
||||
ParentNode:
|
||||
type: string
|
||||
Resource:
|
||||
type: string
|
||||
Version:
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
status:
|
||||
description: ApplicationStatus defines the observed state of Application
|
||||
properties:
|
||||
state:
|
||||
description: 'the state of the helm application: draft, submitted,
|
||||
passed, rejected, suspended, active'
|
||||
type: string
|
||||
updateTime:
|
||||
format: date-time
|
||||
type: string
|
||||
required:
|
||||
- updateTime
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,111 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: applicationversions.application.kubesphere.io
|
||||
spec:
|
||||
group: application.kubesphere.io
|
||||
names:
|
||||
kind: ApplicationVersion
|
||||
listKind: ApplicationVersionList
|
||||
plural: applicationversions
|
||||
shortNames:
|
||||
- appver
|
||||
singular: applicationversion
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .metadata.labels.application\.kubesphere\.io/repo-name
|
||||
name: repo
|
||||
type: string
|
||||
- jsonPath: .metadata.labels.kubesphere\.io/workspace
|
||||
name: workspace
|
||||
type: string
|
||||
- jsonPath: .metadata.labels.application\.kubesphere\.io/app-id
|
||||
name: app
|
||||
type: string
|
||||
- jsonPath: .spec.appType
|
||||
name: appType
|
||||
type: string
|
||||
- jsonPath: .status.state
|
||||
name: State
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: ApplicationVersion is the Schema for the applicationversions
|
||||
API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ApplicationVersionSpec defines the desired state of ApplicationVersion
|
||||
properties:
|
||||
appHome:
|
||||
type: string
|
||||
appType:
|
||||
type: string
|
||||
created:
|
||||
format: date-time
|
||||
type: string
|
||||
digest:
|
||||
type: string
|
||||
icon:
|
||||
type: string
|
||||
maintainer:
|
||||
items:
|
||||
description: Maintainer describes a Chart maintainer.
|
||||
properties:
|
||||
email:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
url:
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
pullUrl:
|
||||
type: string
|
||||
versionName:
|
||||
type: string
|
||||
required:
|
||||
- versionName
|
||||
type: object
|
||||
status:
|
||||
description: ApplicationVersionStatus defines the observed state of ApplicationVersion
|
||||
properties:
|
||||
message:
|
||||
type: string
|
||||
state:
|
||||
type: string
|
||||
updated:
|
||||
format: date-time
|
||||
type: string
|
||||
userName:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,65 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: categories.application.kubesphere.io
|
||||
spec:
|
||||
group: application.kubesphere.io
|
||||
names:
|
||||
kind: Category
|
||||
listKind: CategoryList
|
||||
plural: categories
|
||||
shortNames:
|
||||
- appctg
|
||||
singular: category
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .status.total
|
||||
name: total
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: Category is the Schema for the categories API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: CategorySpec defines the desired state of HelmRepo
|
||||
properties:
|
||||
icon:
|
||||
type: string
|
||||
type: object
|
||||
status:
|
||||
properties:
|
||||
total:
|
||||
type: integer
|
||||
required:
|
||||
- total
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,103 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: repos.application.kubesphere.io
|
||||
spec:
|
||||
group: application.kubesphere.io
|
||||
names:
|
||||
kind: Repo
|
||||
listKind: RepoList
|
||||
plural: repos
|
||||
shortNames:
|
||||
- repo
|
||||
singular: repo
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .metadata.labels.kubesphere\.io/workspace
|
||||
name: Workspace
|
||||
type: string
|
||||
- jsonPath: .spec.url
|
||||
name: url
|
||||
type: string
|
||||
- jsonPath: .status.state
|
||||
name: State
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: Repo is the Schema for the repoes API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: RepoSpec defines the desired state of Repo
|
||||
properties:
|
||||
credential:
|
||||
properties:
|
||||
caFile:
|
||||
description: verify certificates of HTTPS-enabled servers using
|
||||
this CA bundle
|
||||
type: string
|
||||
certFile:
|
||||
description: identify HTTPS client using this SSL certificate
|
||||
file
|
||||
type: string
|
||||
insecureSkipTLSVerify:
|
||||
description: skip tls certificate checks for the repository, default
|
||||
is ture
|
||||
type: boolean
|
||||
keyFile:
|
||||
description: identify HTTPS client using this SSL key file
|
||||
type: string
|
||||
password:
|
||||
description: chart repository password
|
||||
type: string
|
||||
username:
|
||||
description: chart repository username
|
||||
type: string
|
||||
type: object
|
||||
description:
|
||||
type: string
|
||||
syncPeriod:
|
||||
type: integer
|
||||
url:
|
||||
type: string
|
||||
required:
|
||||
- url
|
||||
type: object
|
||||
status:
|
||||
description: RepoStatus defines the observed state of Repo
|
||||
properties:
|
||||
lastUpdateTime:
|
||||
format: date-time
|
||||
type: string
|
||||
state:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -4,7 +4,6 @@ kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
creationTimestamp: null
|
||||
name: clusters.cluster.kubesphere.io
|
||||
spec:
|
||||
group: cluster.kubesphere.io
|
||||
@@ -16,15 +15,9 @@ spec:
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.joinFederation
|
||||
name: Federated
|
||||
type: boolean
|
||||
- jsonPath: .spec.provider
|
||||
name: Provider
|
||||
type: string
|
||||
- jsonPath: .spec.enable
|
||||
name: Active
|
||||
type: boolean
|
||||
- jsonPath: .status.kubernetesVersion
|
||||
name: Version
|
||||
type: string
|
||||
@@ -34,76 +27,93 @@ spec:
|
||||
description: Cluster is the schema for the clusters API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
config:
|
||||
description: Config represents the custom helm chart values used when
|
||||
installing the cluster
|
||||
format: byte
|
||||
type: string
|
||||
connection:
|
||||
description: Connection holds info to connect to the member cluster
|
||||
properties:
|
||||
externalKubernetesAPIEndpoint:
|
||||
description: External Kubernetes API Server endpoint Will be populated
|
||||
by ks-apiserver if connection type is proxy and ExternalKubeAPIEnabled
|
||||
is true.
|
||||
description: |-
|
||||
External Kubernetes API Server endpoint
|
||||
Will be populated by ks-apiserver if connection type is proxy and ExternalKubeAPIEnabled is true.
|
||||
type: string
|
||||
kubeconfig:
|
||||
description: KubeConfig content used to connect to cluster api
|
||||
server Should provide this field explicitly if connection type
|
||||
is direct. Will be populated by ks-proxy if connection type
|
||||
is proxy.
|
||||
description: |-
|
||||
KubeConfig content used to connect to cluster api server
|
||||
Should provide this field explicitly if connection type is direct.
|
||||
Will be populated by ks-proxy if connection type is proxy.
|
||||
format: byte
|
||||
type: string
|
||||
kubernetesAPIEndpoint:
|
||||
description: 'Kubernetes API Server endpoint. Example: https://10.10.0.1:6443
|
||||
description: |-
|
||||
Kubernetes API Server endpoint. Example: https://10.10.0.1:6443
|
||||
Should provide this field explicitly if connection type is direct.
|
||||
Will be populated by ks-apiserver if connection type is proxy.'
|
||||
Will be populated by ks-apiserver if connection type is proxy.
|
||||
type: string
|
||||
kubernetesAPIServerPort:
|
||||
description: KubeAPIServerPort is the port which listens for forwarding
|
||||
kube-apiserver traffic Only applicable when connection type
|
||||
is proxy.
|
||||
description: |-
|
||||
KubeAPIServerPort is the port which listens for forwarding kube-apiserver traffic
|
||||
Only applicable when connection type is proxy.
|
||||
type: integer
|
||||
kubesphereAPIEndpoint:
|
||||
description: 'KubeSphere API Server endpoint. Example: http://10.10.0.11:8080
|
||||
description: |-
|
||||
KubeSphere API Server endpoint. Example: http://10.10.0.11:8080
|
||||
Should provide this field explicitly if connection type is direct.
|
||||
Will be populated by ks-apiserver if connection type is proxy.'
|
||||
Will be populated by ks-apiserver if connection type is proxy.
|
||||
type: string
|
||||
kubesphereAPIServerPort:
|
||||
description: KubeSphereAPIServerPort is the port which listens
|
||||
for forwarding kubesphere apigateway traffic Only applicable
|
||||
when connection type is proxy.
|
||||
description: |-
|
||||
KubeSphereAPIServerPort is the port which listens for forwarding kubesphere apigateway traffic
|
||||
Only applicable when connection type is proxy.
|
||||
type: integer
|
||||
token:
|
||||
description: Token used by agents of member cluster to connect
|
||||
to host cluster proxy. This field is populated by apiserver
|
||||
only if connection type is proxy.
|
||||
description: |-
|
||||
Token used by agents of member cluster to connect to host cluster proxy.
|
||||
This field is populated by apiserver only if connection type is proxy.
|
||||
type: string
|
||||
type:
|
||||
description: type defines how host cluster will connect to host
|
||||
cluster ConnectionTypeDirect means direct connection, this requires
|
||||
kubeconfig and kubesphere apiserver endpoint provided ConnectionTypeProxy
|
||||
means using kubesphere proxy, no kubeconfig or kubesphere apiserver
|
||||
endpoint required
|
||||
description: |-
|
||||
type defines how host cluster will connect to host cluster
|
||||
ConnectionTypeDirect means direct connection, this requires
|
||||
kubeconfig and kubesphere apiserver endpoint provided
|
||||
ConnectionTypeProxy means using kubesphere proxy, no kubeconfig
|
||||
or kubesphere apiserver endpoint required
|
||||
type: string
|
||||
type: object
|
||||
enable:
|
||||
description: Desired state of the cluster
|
||||
description: |-
|
||||
Desired state of the cluster
|
||||
Deprecated: will be removed in the next version.
|
||||
type: boolean
|
||||
externalKubeAPIEnabled:
|
||||
description: ExternalKubeAPIEnabled export kubeapiserver to public
|
||||
description: ExternalKubeAPIEnabled export kube-apiserver to public
|
||||
use a lb type service if connection type is proxy
|
||||
type: boolean
|
||||
joinFederation:
|
||||
description: Join cluster as a kubefed cluster
|
||||
description: |-
|
||||
Join cluster as a kubefed cluster
|
||||
Deprecated: will be removed in the next version.
|
||||
type: boolean
|
||||
provider:
|
||||
description: Provider of the cluster, this field is just for description
|
||||
@@ -126,7 +136,7 @@ spec:
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: A human readable message indicating details about
|
||||
description: A human-readable message indicating details about
|
||||
the transition.
|
||||
type: string
|
||||
reason:
|
||||
@@ -146,9 +156,10 @@ spec:
|
||||
configz:
|
||||
additionalProperties:
|
||||
type: boolean
|
||||
description: Configz is status of components enabled in the member
|
||||
cluster. This is synchronized with member cluster every amount of
|
||||
time, like 5 minutes.
|
||||
description: |-
|
||||
Configz is status of components enabled in the member cluster. This is synchronized with member cluster
|
||||
every amount of time, like 5 minutes.
|
||||
Deprecated: this field will be removed in the future version.
|
||||
type: object
|
||||
kubeSphereVersion:
|
||||
description: GitVersion of the /kapis/version api response, this field
|
||||
@@ -159,8 +170,9 @@ spec:
|
||||
by cluster controller
|
||||
type: string
|
||||
nodeCount:
|
||||
description: Count of the kubernetes cluster nodes This field may
|
||||
not reflect the instant status of the cluster.
|
||||
description: |-
|
||||
Count of the kubernetes cluster nodes
|
||||
This field may not reflect the instant status of the cluster.
|
||||
type: integer
|
||||
region:
|
||||
description: Region is the name of the region in which all of the
|
||||
@@ -0,0 +1,66 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: labels.cluster.kubesphere.io
|
||||
spec:
|
||||
group: cluster.kubesphere.io
|
||||
names:
|
||||
kind: Label
|
||||
listKind: LabelList
|
||||
plural: labels
|
||||
singular: label
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.key
|
||||
name: Key
|
||||
type: string
|
||||
- jsonPath: .spec.value
|
||||
name: Value
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
backgroundColor:
|
||||
type: string
|
||||
clusters:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
key:
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
- value
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
@@ -0,0 +1,167 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: apiservices.extensions.kubesphere.io
|
||||
spec:
|
||||
group: extensions.kubesphere.io
|
||||
names:
|
||||
kind: APIService
|
||||
listKind: APIServiceList
|
||||
plural: apiservices
|
||||
singular: apiservice
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
APIService is a special resource used in Ks-apiserver
|
||||
declares a directional proxy path for a resource type API，
|
||||
it's similar to Kubernetes API Aggregation Layer.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
caBundle:
|
||||
format: byte
|
||||
type: string
|
||||
group:
|
||||
type: string
|
||||
insecureSkipVerify:
|
||||
type: boolean
|
||||
service:
|
||||
description: |-
|
||||
service is a reference to the service for this endpoint. Either
|
||||
service or url must be specified.
|
||||
the scheme is default to HTTPS.
|
||||
properties:
|
||||
name:
|
||||
description: |-
|
||||
name is the name of the service.
|
||||
Required
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
namespace is the namespace of the service.
|
||||
Required
|
||||
type: string
|
||||
path:
|
||||
description: path is an optional URL path at which the upstream
|
||||
will be contacted.
|
||||
type: string
|
||||
port:
|
||||
description: |-
|
||||
port is an optional service port at which the upstream will be contacted.
|
||||
`port` should be a valid port number (1-65535, inclusive).
|
||||
Defaults to 443 for backward compatibility.
|
||||
format: int32
|
||||
type: integer
|
||||
required:
|
||||
- name
|
||||
- namespace
|
||||
type: object
|
||||
url:
|
||||
description: |-
|
||||
`url` gives the location of the upstream, in standard URL form
|
||||
(`scheme://host:port/path`). Exactly one of `url` or `service`
|
||||
must be specified.
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
type: object
|
||||
status:
|
||||
properties:
|
||||
conditions:
|
||||
items:
|
||||
description: "Condition contains details for one aspect of the current
|
||||
state of this API Resource.\n---\nThis struct is intended for
|
||||
direct use as an array at the field path .status.conditions. For
|
||||
example,\n\n\n\ttype FooStatus struct{\n\t // Represents the
|
||||
observations of a foo's current state.\n\t // Known .status.conditions.type
|
||||
are: \"Available\", \"Progressing\", and \"Degraded\"\n\t //
|
||||
+patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t
|
||||
\ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\"
|
||||
patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
|
||||
\ // other fields\n\t}"
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: |-
|
||||
type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
---
|
||||
Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
|
||||
useful (see .node.status.conditions), the ability to deconflict is important.
|
||||
The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
state:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,124 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: extensionentries.extensions.kubesphere.io
|
||||
spec:
|
||||
group: extensions.kubesphere.io
|
||||
names:
|
||||
kind: ExtensionEntry
|
||||
listKind: ExtensionEntryList
|
||||
plural: extensionentries
|
||||
singular: extensionentry
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: ExtensionEntry declares an entry endpoint that needs to be injected
|
||||
into ks-console.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
entries:
|
||||
items:
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: array
|
||||
type: object
|
||||
status:
|
||||
properties:
|
||||
conditions:
|
||||
items:
|
||||
description: "Condition contains details for one aspect of the current
|
||||
state of this API Resource.\n---\nThis struct is intended for
|
||||
direct use as an array at the field path .status.conditions. For
|
||||
example,\n\n\n\ttype FooStatus struct{\n\t // Represents the
|
||||
observations of a foo's current state.\n\t // Known .status.conditions.type
|
||||
are: \"Available\", \"Progressing\", and \"Degraded\"\n\t //
|
||||
+patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t
|
||||
\ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\"
|
||||
patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
|
||||
\ // other fields\n\t}"
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: |-
|
||||
type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
---
|
||||
Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
|
||||
useful (see .node.status.conditions), the ability to deconflict is important.
|
||||
The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
state:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,219 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: jsbundles.extensions.kubesphere.io
|
||||
spec:
|
||||
group: extensions.kubesphere.io
|
||||
names:
|
||||
kind: JSBundle
|
||||
listKind: JSBundleList
|
||||
plural: jsbundles
|
||||
singular: jsbundle
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
JSBundle declares a js bundle that needs to be injected into ks-console,
|
||||
the endpoint can be provided by a service or a static file.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
raw:
|
||||
format: byte
|
||||
type: string
|
||||
rawFrom:
|
||||
properties:
|
||||
caBundle:
|
||||
format: byte
|
||||
type: string
|
||||
configMapKeyRef:
|
||||
description: Selects a key of a ConfigMap.
|
||||
properties:
|
||||
key:
|
||||
description: The key to select.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
TODO: Add other useful fields. apiVersion, kind, uid?
|
||||
type: string
|
||||
namespace:
|
||||
type: string
|
||||
optional:
|
||||
description: Specify whether the ConfigMap or its key must
|
||||
be defined
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
- namespace
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
insecureSkipVerify:
|
||||
type: boolean
|
||||
secretKeyRef:
|
||||
description: Selects a key of a Secret.
|
||||
properties:
|
||||
key:
|
||||
description: The key of the secret to select from. Must be
|
||||
a valid secret key.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
TODO: Add other useful fields. apiVersion, kind, uid?
|
||||
type: string
|
||||
namespace:
|
||||
type: string
|
||||
optional:
|
||||
description: Specify whether the Secret or its key must be
|
||||
defined
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
- namespace
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
service:
|
||||
description: |-
|
||||
service is a reference to the service for this endpoint. Either
|
||||
service or url must be specified.
|
||||
the scheme is default to HTTPS.
|
||||
properties:
|
||||
name:
|
||||
description: |-
|
||||
name is the name of the service.
|
||||
Required
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
namespace is the namespace of the service.
|
||||
Required
|
||||
type: string
|
||||
path:
|
||||
description: path is an optional URL path at which the upstream
|
||||
will be contacted.
|
||||
type: string
|
||||
port:
|
||||
description: |-
|
||||
port is an optional service port at which the upstream will be contacted.
|
||||
`port` should be a valid port number (1-65535, inclusive).
|
||||
Defaults to 443 for backward compatibility.
|
||||
format: int32
|
||||
type: integer
|
||||
required:
|
||||
- name
|
||||
- namespace
|
||||
type: object
|
||||
url:
|
||||
description: |-
|
||||
`url` gives the location of the upstream, in standard URL form
|
||||
(`scheme://host:port/path`). Exactly one of `url` or `service`
|
||||
must be specified.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
status:
|
||||
properties:
|
||||
conditions:
|
||||
items:
|
||||
description: "Condition contains details for one aspect of the current
|
||||
state of this API Resource.\n---\nThis struct is intended for
|
||||
direct use as an array at the field path .status.conditions. For
|
||||
example,\n\n\n\ttype FooStatus struct{\n\t // Represents the
|
||||
observations of a foo's current state.\n\t // Known .status.conditions.type
|
||||
are: \"Available\", \"Progressing\", and \"Degraded\"\n\t //
|
||||
+patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t
|
||||
\ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\"
|
||||
patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
|
||||
\ // other fields\n\t}"
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: |-
|
||||
type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
---
|
||||
Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
|
||||
useful (see .node.status.conditions), the ability to deconflict is important.
|
||||
The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
link:
|
||||
description: Link is the path for downloading JS file, default to
|
||||
"/dist/{jsBundleName}/index.js".
|
||||
type: string
|
||||
state:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,224 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: reverseproxies.extensions.kubesphere.io
|
||||
spec:
|
||||
group: extensions.kubesphere.io
|
||||
names:
|
||||
kind: ReverseProxy
|
||||
listKind: ReverseProxyList
|
||||
plural: reverseproxies
|
||||
singular: reverseproxy
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
directives:
|
||||
properties:
|
||||
authProxy:
|
||||
description: Add auth proxy header to requests
|
||||
type: boolean
|
||||
headerDown:
|
||||
description: Sets, adds (with the + prefix), deletes (with the
|
||||
- prefix), or performs a replacement (by using two arguments,
|
||||
a search and replacement) in a response header coming downstream
|
||||
from the backend.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
headerUp:
|
||||
description: Sets, adds (with the + prefix), deletes (with the
|
||||
- prefix), or performs a replacement (by using two arguments,
|
||||
a search and replacement) in a request header going upstream
|
||||
to the backend.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
method:
|
||||
description: Changes the request's HTTP verb.
|
||||
type: string
|
||||
pathRegexp:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
rejectForwardingRedirects:
|
||||
description: Reject to forward redirect response
|
||||
type: boolean
|
||||
replace:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
rewrite:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
stripPathPrefix:
|
||||
description: Strips the given prefix from the beginning of the
|
||||
URI path.
|
||||
type: string
|
||||
stripPathSuffix:
|
||||
description: Strips the given suffix from the end of the URI path.
|
||||
type: string
|
||||
wrapTransport:
|
||||
description: ' WrapTransport indicates whether the provided Transport
|
||||
should be wrapped with default proxy transport behavior (URL
|
||||
rewriting, X-Forwarded-* header setting)'
|
||||
type: boolean
|
||||
type: object
|
||||
matcher:
|
||||
properties:
|
||||
method:
|
||||
type: string
|
||||
path:
|
||||
type: string
|
||||
required:
|
||||
- method
|
||||
- path
|
||||
type: object
|
||||
upstream:
|
||||
properties:
|
||||
caBundle:
|
||||
format: byte
|
||||
type: string
|
||||
insecureSkipVerify:
|
||||
type: boolean
|
||||
service:
|
||||
description: |-
|
||||
service is a reference to the service for this endpoint. Either
|
||||
service or url must be specified.
|
||||
the scheme is default to HTTPS.
|
||||
properties:
|
||||
name:
|
||||
description: |-
|
||||
name is the name of the service.
|
||||
Required
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
namespace is the namespace of the service.
|
||||
Required
|
||||
type: string
|
||||
path:
|
||||
description: path is an optional URL path at which the upstream
|
||||
will be contacted.
|
||||
type: string
|
||||
port:
|
||||
description: |-
|
||||
port is an optional service port at which the upstream will be contacted.
|
||||
`port` should be a valid port number (1-65535, inclusive).
|
||||
Defaults to 443 for backward compatibility.
|
||||
format: int32
|
||||
type: integer
|
||||
required:
|
||||
- name
|
||||
- namespace
|
||||
type: object
|
||||
url:
|
||||
description: |-
|
||||
`url` gives the location of the upstream, in standard URL form
|
||||
(`scheme://host:port/path`). Exactly one of `url` or `service`
|
||||
must be specified.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
status:
|
||||
properties:
|
||||
conditions:
|
||||
items:
|
||||
description: "Condition contains details for one aspect of the current
|
||||
state of this API Resource.\n---\nThis struct is intended for
|
||||
direct use as an array at the field path .status.conditions. For
|
||||
example,\n\n\n\ttype FooStatus struct{\n\t // Represents the
|
||||
observations of a foo's current state.\n\t // Known .status.conditions.type
|
||||
are: \"Available\", \"Progressing\", and \"Degraded\"\n\t //
|
||||
+patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t
|
||||
\ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\"
|
||||
patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
|
||||
\ // other fields\n\t}"
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: |-
|
||||
type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
---
|
||||
Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
|
||||
useful (see .node.status.conditions), the ability to deconflict is important.
|
||||
The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
state:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,68 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: ingressclassscopes.gateway.kubesphere.io
|
||||
spec:
|
||||
group: gateway.kubesphere.io
|
||||
names:
|
||||
kind: IngressClassScope
|
||||
listKind: IngressClassScopeList
|
||||
plural: ingressclassscopes
|
||||
singular: ingressclassscope
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
IngressClassScope is a special resource used to
|
||||
connect other gateways to the KubeSphere platform.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
ingressClass:
|
||||
properties:
|
||||
default:
|
||||
type: boolean
|
||||
name:
|
||||
type: string
|
||||
type: object
|
||||
scope:
|
||||
description: |-
|
||||
Watching scope, when both are empty, watching all namespaces,
|
||||
when neither is empty, namespaces is preferred.
|
||||
properties:
|
||||
namespaceSelector:
|
||||
type: string
|
||||
namespaces:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
type: object
|
||||
type: object
|
||||
status:
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,95 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: builtinroles.iam.kubesphere.io
|
||||
spec:
|
||||
group: iam.kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- iam
|
||||
kind: BuiltinRole
|
||||
listKind: BuiltinRoleList
|
||||
plural: builtinroles
|
||||
singular: builtinrole
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
role:
|
||||
type: object
|
||||
x-kubernetes-embedded-resource: true
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
targetSelector:
|
||||
description: |-
|
||||
A label selector is a label query over a set of resources. The result of matchLabels and
|
||||
matchExpressions are ANDed. An empty label selector matches all objects. A null
|
||||
label selector matches no objects.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements.
|
||||
The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies
|
||||
to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
required:
|
||||
- role
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,57 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: categories.iam.kubesphere.io
|
||||
spec:
|
||||
group: iam.kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- iam
|
||||
kind: Category
|
||||
listKind: CategoryList
|
||||
plural: categories
|
||||
singular: category
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: Category is the Schema for the categories API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: CategorySpec defines the desired state of Category
|
||||
properties:
|
||||
description:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
displayName:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
icon:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,97 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: clusterrolebindings.iam.kubesphere.io
|
||||
spec:
|
||||
group: iam.kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- iam
|
||||
kind: ClusterRoleBinding
|
||||
listKind: ClusterRoleBindingList
|
||||
plural: clusterrolebindings
|
||||
singular: clusterrolebinding
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
roleRef:
|
||||
description: |-
|
||||
RoleRef can only reference a WorkspaceRole.
|
||||
If the RoleRef cannot be resolved, the Authorizer must return an error.
|
||||
properties:
|
||||
apiGroup:
|
||||
description: APIGroup is the group for the resource being referenced
|
||||
type: string
|
||||
kind:
|
||||
description: Kind is the type of resource being referenced
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name of resource being referenced
|
||||
type: string
|
||||
required:
|
||||
- apiGroup
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
subjects:
|
||||
description: Subjects holds references to the objects the role applies
|
||||
to.
|
||||
items:
|
||||
description: |-
|
||||
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
||||
or a value for non-objects such as user and group names.
|
||||
properties:
|
||||
apiGroup:
|
||||
description: |-
|
||||
APIGroup holds the API group of the referenced subject.
|
||||
Defaults to "" for ServiceAccount subjects.
|
||||
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
||||
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
||||
type: string
|
||||
name:
|
||||
description: Name of the object being referenced.
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
||||
the Authorizer should report an error.
|
||||
type: string
|
||||
required:
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: array
|
||||
required:
|
||||
- roleRef
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,144 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: clusterroles.iam.kubesphere.io
|
||||
spec:
|
||||
group: iam.kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- iam
|
||||
kind: ClusterRole
|
||||
listKind: ClusterRoleList
|
||||
plural: clusterroles
|
||||
singular: clusterrole
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: ClusterRole is the Schema for the clusterroles API
|
||||
properties:
|
||||
aggregationRoleTemplates:
|
||||
description: AggregationRoleTemplates means which RoleTemplates are composed
|
||||
this Role
|
||||
properties:
|
||||
roleSelector:
|
||||
description: RoleSelectors select rules from RoleTemplate`s rules
|
||||
by labels
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements.
|
||||
The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies
|
||||
to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
templateNames:
|
||||
description: TemplateNames select rules from RoleTemplate`s rules
|
||||
by RoleTemplate name
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: set
|
||||
type: object
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
rules:
|
||||
description: Rules holds all the PolicyRules for this WorkspaceRole
|
||||
items:
|
||||
description: |-
|
||||
PolicyRule holds information that describes a policy rule, but does not contain information
|
||||
about who the rule applies to or which namespace the rule applies to.
|
||||
properties:
|
||||
apiGroups:
|
||||
description: |-
|
||||
APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of
|
||||
the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
nonResourceURLs:
|
||||
description: |-
|
||||
NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path
|
||||
Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.
|
||||
Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"), but not both.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
resourceNames:
|
||||
description: ResourceNames is an optional white list of names that
|
||||
the rule applies to. An empty set means that everything is allowed.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
resources:
|
||||
description: Resources is a list of resources this rule applies
|
||||
to. '*' represents all resources.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
verbs:
|
||||
description: Verbs is a list of Verbs that apply to ALL the ResourceKinds
|
||||
contained in this rule. '*' represents all verbs.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- verbs
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,179 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: globalrolebindings.iam.kubesphere.io
|
||||
spec:
|
||||
group: iam.kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- iam
|
||||
kind: GlobalRoleBinding
|
||||
listKind: GlobalRoleBindingList
|
||||
plural: globalrolebindings
|
||||
singular: globalrolebinding
|
||||
scope: Cluster
|
||||
versions:
|
||||
- deprecated: true
|
||||
name: v1alpha2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: GlobalRoleBinding is the Schema for the globalrolebindings API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
roleRef:
|
||||
description: |-
|
||||
RoleRef can only reference a GlobalRole.
|
||||
If the RoleRef cannot be resolved, the Authorizer must return an error.
|
||||
properties:
|
||||
apiGroup:
|
||||
description: APIGroup is the group for the resource being referenced
|
||||
type: string
|
||||
kind:
|
||||
description: Kind is the type of resource being referenced
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name of resource being referenced
|
||||
type: string
|
||||
required:
|
||||
- apiGroup
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
subjects:
|
||||
description: Subjects holds references to the objects the role applies
|
||||
to.
|
||||
items:
|
||||
description: |-
|
||||
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
||||
or a value for non-objects such as user and group names.
|
||||
properties:
|
||||
apiGroup:
|
||||
description: |-
|
||||
APIGroup holds the API group of the referenced subject.
|
||||
Defaults to "" for ServiceAccount subjects.
|
||||
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
||||
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
||||
type: string
|
||||
name:
|
||||
description: Name of the object being referenced.
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
||||
the Authorizer should report an error.
|
||||
type: string
|
||||
required:
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: array
|
||||
required:
|
||||
- roleRef
|
||||
type: object
|
||||
served: true
|
||||
storage: false
|
||||
- name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: GlobalRoleBinding is the Schema for the globalrolebindings API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
roleRef:
|
||||
description: |-
|
||||
RoleRef can only reference a GlobalRole.
|
||||
If the RoleRef cannot be resolved, the Authorizer must return an error.
|
||||
properties:
|
||||
apiGroup:
|
||||
description: APIGroup is the group for the resource being referenced
|
||||
type: string
|
||||
kind:
|
||||
description: Kind is the type of resource being referenced
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name of resource being referenced
|
||||
type: string
|
||||
required:
|
||||
- apiGroup
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
subjects:
|
||||
description: Subjects holds references to the objects the role applies
|
||||
to.
|
||||
items:
|
||||
description: |-
|
||||
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
||||
or a value for non-objects such as user and group names.
|
||||
properties:
|
||||
apiGroup:
|
||||
description: |-
|
||||
APIGroup holds the API group of the referenced subject.
|
||||
Defaults to "" for ServiceAccount subjects.
|
||||
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
||||
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
||||
type: string
|
||||
name:
|
||||
description: Name of the object being referenced.
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
||||
the Authorizer should report an error.
|
||||
type: string
|
||||
required:
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: array
|
||||
required:
|
||||
- roleRef
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,215 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: globalroles.iam.kubesphere.io
|
||||
spec:
|
||||
group: iam.kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- iam
|
||||
kind: GlobalRole
|
||||
listKind: GlobalRoleList
|
||||
plural: globalroles
|
||||
singular: globalrole
|
||||
scope: Cluster
|
||||
versions:
|
||||
- deprecated: true
|
||||
name: v1alpha2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
rules:
|
||||
description: Rules holds all the PolicyRules for this GlobalRole
|
||||
items:
|
||||
description: |-
|
||||
PolicyRule holds information that describes a policy rule, but does not contain information
|
||||
about who the rule applies to or which namespace the rule applies to.
|
||||
properties:
|
||||
apiGroups:
|
||||
description: |-
|
||||
APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of
|
||||
the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
nonResourceURLs:
|
||||
description: |-
|
||||
NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path
|
||||
Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.
|
||||
Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"), but not both.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
resourceNames:
|
||||
description: ResourceNames is an optional white list of names that
|
||||
the rule applies to. An empty set means that everything is allowed.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
resources:
|
||||
description: Resources is a list of resources this rule applies
|
||||
to. '*' represents all resources.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
verbs:
|
||||
description: Verbs is a list of Verbs that apply to ALL the ResourceKinds
|
||||
contained in this rule. '*' represents all verbs.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- verbs
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
served: true
|
||||
storage: false
|
||||
- name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: GlobalRole is the Schema for the globalroles API
|
||||
properties:
|
||||
aggregationRoleTemplates:
|
||||
description: AggregationRoleTemplates means which RoleTemplates are composed
|
||||
this Role
|
||||
properties:
|
||||
roleSelector:
|
||||
description: RoleSelectors select rules from RoleTemplate`s rules
|
||||
by labels
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements.
|
||||
The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies
|
||||
to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
templateNames:
|
||||
description: TemplateNames select rules from RoleTemplate`s rules
|
||||
by RoleTemplate name
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: set
|
||||
type: object
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
rules:
|
||||
description: Rules holds all the PolicyRules for this WorkspaceRole
|
||||
items:
|
||||
description: |-
|
||||
PolicyRule holds information that describes a policy rule, but does not contain information
|
||||
about who the rule applies to or which namespace the rule applies to.
|
||||
properties:
|
||||
apiGroups:
|
||||
description: |-
|
||||
APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of
|
||||
the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
nonResourceURLs:
|
||||
description: |-
|
||||
NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path
|
||||
Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.
|
||||
Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"), but not both.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
resourceNames:
|
||||
description: ResourceNames is an optional white list of names that
|
||||
the rule applies to. An empty set means that everything is allowed.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
resources:
|
||||
description: Resources is a list of resources this rule applies
|
||||
to. '*' represents all resources.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
verbs:
|
||||
description: Verbs is a list of Verbs that apply to ALL the ResourceKinds
|
||||
contained in this rule. '*' represents all verbs.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- verbs
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- rules
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,113 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: groupbindings.iam.kubesphere.io
|
||||
spec:
|
||||
group: iam.kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- group
|
||||
kind: GroupBinding
|
||||
listKind: GroupBindingList
|
||||
plural: groupbindings
|
||||
singular: groupbinding
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .groupRef.name
|
||||
name: Group
|
||||
type: string
|
||||
- jsonPath: .users
|
||||
name: Users
|
||||
type: string
|
||||
deprecated: true
|
||||
name: v1alpha2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: GroupBinding is the Schema for the groupbindings API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
groupRef:
|
||||
description: GroupRef defines the desired relation of GroupBinding
|
||||
properties:
|
||||
apiGroup:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
type: object
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
users:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
type: object
|
||||
served: true
|
||||
storage: false
|
||||
subresources: {}
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .groupRef.name
|
||||
name: Group
|
||||
type: string
|
||||
- jsonPath: .users
|
||||
name: Users
|
||||
type: string
|
||||
name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: GroupBinding is the Schema for the groupbindings API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
groupRef:
|
||||
description: GroupRef defines the desired relation of GroupBinding
|
||||
properties:
|
||||
apiGroup:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
type: object
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
users:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
@@ -0,0 +1,91 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: groups.iam.kubesphere.io
|
||||
spec:
|
||||
group: iam.kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- group
|
||||
kind: Group
|
||||
listKind: GroupList
|
||||
plural: groups
|
||||
singular: group
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .metadata.labels.kubesphere\.io/workspace
|
||||
name: Workspace
|
||||
type: string
|
||||
deprecated: true
|
||||
name: v1alpha2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: Group is the Schema for the groups API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: GroupSpec defines the desired state of Group
|
||||
type: object
|
||||
status:
|
||||
description: GroupStatus defines the observed state of Group
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: false
|
||||
subresources: {}
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .metadata.labels.kubesphere\.io/workspace
|
||||
name: Workspace
|
||||
type: string
|
||||
name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: Group is the Schema for the groups API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: GroupSpec defines the desired state of Group
|
||||
type: object
|
||||
status:
|
||||
description: GroupStatus defines the observed state of Group
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
@@ -0,0 +1,165 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: loginrecords.iam.kubesphere.io
|
||||
spec:
|
||||
group: iam.kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- iam
|
||||
kind: LoginRecord
|
||||
listKind: LoginRecordList
|
||||
plural: loginrecords
|
||||
singular: loginrecord
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.type
|
||||
name: Type
|
||||
type: string
|
||||
- jsonPath: .spec.provider
|
||||
name: Provider
|
||||
type: string
|
||||
- jsonPath: .spec.sourceIP
|
||||
name: From
|
||||
type: string
|
||||
- jsonPath: .spec.success
|
||||
name: Success
|
||||
type: string
|
||||
- jsonPath: .spec.reason
|
||||
name: Reason
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
deprecated: true
|
||||
name: v1alpha2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
provider:
|
||||
description: Provider of authentication, Ldap/Github etc.
|
||||
type: string
|
||||
reason:
|
||||
description: States failed login attempt reason
|
||||
type: string
|
||||
sourceIP:
|
||||
description: Source IP of client
|
||||
type: string
|
||||
success:
|
||||
description: Successful login attempt or not
|
||||
type: boolean
|
||||
type:
|
||||
description: Which authentication method used, Password/OAuth/Token
|
||||
type: string
|
||||
userAgent:
|
||||
description: User agent of login attempt
|
||||
type: string
|
||||
required:
|
||||
- provider
|
||||
- reason
|
||||
- sourceIP
|
||||
- success
|
||||
- type
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: false
|
||||
subresources: {}
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.type
|
||||
name: Type
|
||||
type: string
|
||||
- jsonPath: .spec.provider
|
||||
name: Provider
|
||||
type: string
|
||||
- jsonPath: .spec.sourceIP
|
||||
name: From
|
||||
type: string
|
||||
- jsonPath: .spec.success
|
||||
name: Success
|
||||
type: string
|
||||
- jsonPath: .spec.reason
|
||||
name: Reason
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
provider:
|
||||
description: Provider of authentication, Ldap/Github etc.
|
||||
type: string
|
||||
reason:
|
||||
description: States failed login attempt reason
|
||||
type: string
|
||||
sourceIP:
|
||||
description: Source IP of client
|
||||
type: string
|
||||
success:
|
||||
description: Successful login attempt or not
|
||||
type: boolean
|
||||
type:
|
||||
description: Which authentication method used, Password/OAuth/Token
|
||||
type: string
|
||||
userAgent:
|
||||
description: User agent of login attempt
|
||||
type: string
|
||||
required:
|
||||
- provider
|
||||
- reason
|
||||
- sourceIP
|
||||
- success
|
||||
- type
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
@@ -0,0 +1,97 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: rolebindings.iam.kubesphere.io
|
||||
spec:
|
||||
group: iam.kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- iam
|
||||
kind: RoleBinding
|
||||
listKind: RoleBindingList
|
||||
plural: rolebindings
|
||||
singular: rolebinding
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
roleRef:
|
||||
description: |-
|
||||
RoleRef can only reference a WorkspaceRole.
|
||||
If the RoleRef cannot be resolved, the Authorizer must return an error.
|
||||
properties:
|
||||
apiGroup:
|
||||
description: APIGroup is the group for the resource being referenced
|
||||
type: string
|
||||
kind:
|
||||
description: Kind is the type of resource being referenced
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name of resource being referenced
|
||||
type: string
|
||||
required:
|
||||
- apiGroup
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
subjects:
|
||||
description: Subjects holds references to the objects the role applies
|
||||
to.
|
||||
items:
|
||||
description: |-
|
||||
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
||||
or a value for non-objects such as user and group names.
|
||||
properties:
|
||||
apiGroup:
|
||||
description: |-
|
||||
APIGroup holds the API group of the referenced subject.
|
||||
Defaults to "" for ServiceAccount subjects.
|
||||
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
||||
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
||||
type: string
|
||||
name:
|
||||
description: Name of the object being referenced.
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
||||
the Authorizer should report an error.
|
||||
type: string
|
||||
required:
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: array
|
||||
required:
|
||||
- roleRef
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
144
config/ks-core/charts/ks-crds/crds/iam.kubesphere.io_roles.yaml
Normal file
144
config/ks-core/charts/ks-crds/crds/iam.kubesphere.io_roles.yaml
Normal file
@@ -0,0 +1,144 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: roles.iam.kubesphere.io
|
||||
spec:
|
||||
group: iam.kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- iam
|
||||
kind: Role
|
||||
listKind: RoleList
|
||||
plural: roles
|
||||
singular: role
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: Role is the Schema for the roles API
|
||||
properties:
|
||||
aggregationRoleTemplates:
|
||||
description: AggregationRoleTemplates means which RoleTemplates are composed
|
||||
this Role
|
||||
properties:
|
||||
roleSelector:
|
||||
description: RoleSelectors select rules from RoleTemplate`s rules
|
||||
by labels
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements.
|
||||
The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies
|
||||
to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
templateNames:
|
||||
description: TemplateNames select rules from RoleTemplate`s rules
|
||||
by RoleTemplate name
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: set
|
||||
type: object
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
rules:
|
||||
description: Rules holds all the PolicyRules for this WorkspaceRole
|
||||
items:
|
||||
description: |-
|
||||
PolicyRule holds information that describes a policy rule, but does not contain information
|
||||
about who the rule applies to or which namespace the rule applies to.
|
||||
properties:
|
||||
apiGroups:
|
||||
description: |-
|
||||
APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of
|
||||
the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
nonResourceURLs:
|
||||
description: |-
|
||||
NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path
|
||||
Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.
|
||||
Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"), but not both.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
resourceNames:
|
||||
description: ResourceNames is an optional white list of names that
|
||||
the rule applies to. An empty set means that everything is allowed.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
resources:
|
||||
description: Resources is a list of resources this rule applies
|
||||
to. '*' represents all resources.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
verbs:
|
||||
description: Verbs is a list of Verbs that apply to ALL the ResourceKinds
|
||||
contained in this rule. '*' represents all verbs.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- verbs
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,103 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: roletemplates.iam.kubesphere.io
|
||||
spec:
|
||||
group: iam.kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- iam
|
||||
kind: RoleTemplate
|
||||
listKind: RoleTemplateList
|
||||
plural: roletemplates
|
||||
singular: roletemplate
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: RoleTemplate is the Schema for the roletemplates API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: RoleTemplateSpec defines the desired state of RoleTemplate
|
||||
properties:
|
||||
description:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
displayName:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: DisplayName represent the name displays at console, this
|
||||
field
|
||||
type: object
|
||||
rules:
|
||||
items:
|
||||
description: |-
|
||||
PolicyRule holds information that describes a policy rule, but does not contain information
|
||||
about who the rule applies to or which namespace the rule applies to.
|
||||
properties:
|
||||
apiGroups:
|
||||
description: |-
|
||||
APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of
|
||||
the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
nonResourceURLs:
|
||||
description: |-
|
||||
NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path
|
||||
Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.
|
||||
Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"), but not both.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
resourceNames:
|
||||
description: ResourceNames is an optional white list of names
|
||||
that the rule applies to. An empty set means that everything
|
||||
is allowed.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
resources:
|
||||
description: Resources is a list of resources this rule applies
|
||||
to. '*' represents all resources.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
verbs:
|
||||
description: Verbs is a list of Verbs that apply to ALL the
|
||||
ResourceKinds contained in this rule. '*' represents all verbs.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- verbs
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- rules
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
205
config/ks-core/charts/ks-crds/crds/iam.kubesphere.io_users.yaml
Normal file
205
config/ks-core/charts/ks-crds/crds/iam.kubesphere.io_users.yaml
Normal file
@@ -0,0 +1,205 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: users.iam.kubesphere.io
|
||||
spec:
|
||||
group: iam.kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- iam
|
||||
kind: User
|
||||
listKind: UserList
|
||||
plural: users
|
||||
singular: user
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.email
|
||||
name: Email
|
||||
type: string
|
||||
- jsonPath: .status.state
|
||||
name: Status
|
||||
type: string
|
||||
deprecated: true
|
||||
name: v1alpha2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: User is the Schema for the users API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: UserSpec defines the desired state of User
|
||||
properties:
|
||||
description:
|
||||
description: Description of the user.
|
||||
type: string
|
||||
displayName:
|
||||
type: string
|
||||
email:
|
||||
description: Unique email address(https://www.ietf.org/rfc/rfc5322.txt).
|
||||
type: string
|
||||
groups:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
lang:
|
||||
description: The preferred written or spoken language for the user.
|
||||
type: string
|
||||
password:
|
||||
description: |-
|
||||
password will be encrypted by mutating admission webhook
|
||||
Password pattern is tricky here.
|
||||
The rule is simple: length between [6,64], at least one uppercase letter, one lowercase letter, one digit.
|
||||
The regexp in console(javascript) is quite straightforward: ^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[^]{6,64}$
|
||||
But in Go, we don't have ?= (back tracking) capability in regexp (also in CRD validation pattern)
|
||||
So we adopted an alternative scheme to achieve.
|
||||
Use 6 different regexp to combine to achieve the same effect.
|
||||
These six schemes enumerate the arrangement of numbers, uppercase letters, and lowercase letters that appear for the first time.
|
||||
- ^(.*[a-z].*[A-Z].*[0-9].*)$ stands for lowercase letter comes first, then followed by an uppercase letter, then a digit.
|
||||
- ^(.*[a-z].*[0-9].*[A-Z].*)$ stands for lowercase letter comes first, then followed by a digit, then an uppercase leeter.
|
||||
- ^(.*[A-Z].*[a-z].*[0-9].*)$ ...
|
||||
- ^(.*[A-Z].*[0-9].*[a-z].*)$ ...
|
||||
- ^(.*[0-9].*[a-z].*[A-Z].*)$ ...
|
||||
- ^(.*[0-9].*[A-Z].*[a-z].*)$ ...
|
||||
Last but not least, the bcrypt string is also included to match the encrypted password. ^(\$2[ayb]\$.{56})$
|
||||
maxLength: 64
|
||||
minLength: 8
|
||||
pattern: ^(.*[a-z].*[A-Z].*[0-9].*)$|^(.*[a-z].*[0-9].*[A-Z].*)$|^(.*[A-Z].*[a-z].*[0-9].*)$|^(.*[A-Z].*[0-9].*[a-z].*)$|^(.*[0-9].*[a-z].*[A-Z].*)$|^(.*[0-9].*[A-Z].*[a-z].*)$|^(\$2[ayb]\$.{56})$
|
||||
type: string
|
||||
required:
|
||||
- email
|
||||
type: object
|
||||
status:
|
||||
description: UserStatus defines the observed state of User
|
||||
properties:
|
||||
lastLoginTime:
|
||||
description: Last login attempt timestamp
|
||||
format: date-time
|
||||
type: string
|
||||
lastTransitionTime:
|
||||
format: date-time
|
||||
type: string
|
||||
reason:
|
||||
type: string
|
||||
state:
|
||||
description: The user status
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: false
|
||||
subresources: {}
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.email
|
||||
name: Email
|
||||
type: string
|
||||
- jsonPath: .status.state
|
||||
name: Status
|
||||
type: string
|
||||
name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: User is the Schema for the users API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: UserSpec defines the desired state of User
|
||||
properties:
|
||||
description:
|
||||
description: Description of the user.
|
||||
type: string
|
||||
displayName:
|
||||
type: string
|
||||
email:
|
||||
description: Unique email address(https://www.ietf.org/rfc/rfc5322.txt).
|
||||
type: string
|
||||
groups:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
lang:
|
||||
description: The preferred written or spoken language for the user.
|
||||
type: string
|
||||
password:
|
||||
description: |-
|
||||
password will be encrypted by mutating admission webhook
|
||||
Password pattern is tricky here.
|
||||
The rule is simple: length between [6,64], at least one uppercase letter, one lowercase letter, one digit.
|
||||
The regexp in console(javascript) is quite straightforward: ^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[^]{6,64}$
|
||||
But in Go, we don't have ?= (back tracking) capability in regexp (also in CRD validation pattern)
|
||||
So we adopted an alternative scheme to achieve.
|
||||
Use 6 different regexp to combine to achieve the same effect.
|
||||
These six schemes enumerate the arrangement of numbers, uppercase letters, and lowercase letters that appear for the first time.
|
||||
- ^(.*[a-z].*[A-Z].*[0-9].*)$ stands for lowercase letter comes first, then followed by an uppercase letter, then a digit.
|
||||
- ^(.*[a-z].*[0-9].*[A-Z].*)$ stands for lowercase letter comes first, then followed by a digit, then an uppercase leeter.
|
||||
- ^(.*[A-Z].*[a-z].*[0-9].*)$ ...
|
||||
- ^(.*[A-Z].*[0-9].*[a-z].*)$ ...
|
||||
- ^(.*[0-9].*[a-z].*[A-Z].*)$ ...
|
||||
- ^(.*[0-9].*[A-Z].*[a-z].*)$ ...
|
||||
Last but not least, the bcrypt string is also included to match the encrypted password. ^(\$2[ayb]\$.{56})$
|
||||
maxLength: 64
|
||||
minLength: 8
|
||||
pattern: ^(.*[a-z].*[A-Z].*[0-9].*)$|^(.*[a-z].*[0-9].*[A-Z].*)$|^(.*[A-Z].*[a-z].*[0-9].*)$|^(.*[A-Z].*[0-9].*[a-z].*)$|^(.*[0-9].*[a-z].*[A-Z].*)$|^(.*[0-9].*[A-Z].*[a-z].*)$|^(\$2[ayb]\$.{56})$
|
||||
type: string
|
||||
required:
|
||||
- email
|
||||
type: object
|
||||
status:
|
||||
description: UserStatus defines the observed state of User
|
||||
properties:
|
||||
lastLoginTime:
|
||||
description: Last login attempt timestamp
|
||||
format: date-time
|
||||
type: string
|
||||
lastTransitionTime:
|
||||
format: date-time
|
||||
type: string
|
||||
reason:
|
||||
type: string
|
||||
state:
|
||||
description: The user status
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
@@ -0,0 +1,191 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: workspacerolebindings.iam.kubesphere.io
|
||||
spec:
|
||||
group: iam.kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- iam
|
||||
kind: WorkspaceRoleBinding
|
||||
listKind: WorkspaceRoleBindingList
|
||||
plural: workspacerolebindings
|
||||
singular: workspacerolebinding
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .metadata.labels.kubesphere\.io/workspace
|
||||
name: Workspace
|
||||
type: string
|
||||
deprecated: true
|
||||
name: v1alpha2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: WorkspaceRoleBinding is the Schema for the workspacerolebindings
|
||||
API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
roleRef:
|
||||
description: |-
|
||||
RoleRef can only reference a WorkspaceRole.
|
||||
If the RoleRef cannot be resolved, the Authorizer must return an error.
|
||||
properties:
|
||||
apiGroup:
|
||||
description: APIGroup is the group for the resource being referenced
|
||||
type: string
|
||||
kind:
|
||||
description: Kind is the type of resource being referenced
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name of resource being referenced
|
||||
type: string
|
||||
required:
|
||||
- apiGroup
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
subjects:
|
||||
description: Subjects holds references to the objects the role applies
|
||||
to.
|
||||
items:
|
||||
description: |-
|
||||
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
||||
or a value for non-objects such as user and group names.
|
||||
properties:
|
||||
apiGroup:
|
||||
description: |-
|
||||
APIGroup holds the API group of the referenced subject.
|
||||
Defaults to "" for ServiceAccount subjects.
|
||||
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
||||
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
||||
type: string
|
||||
name:
|
||||
description: Name of the object being referenced.
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
||||
the Authorizer should report an error.
|
||||
type: string
|
||||
required:
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: array
|
||||
required:
|
||||
- roleRef
|
||||
type: object
|
||||
served: true
|
||||
storage: false
|
||||
subresources: {}
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .metadata.labels.kubesphere\.io/workspace
|
||||
name: Workspace
|
||||
type: string
|
||||
name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: WorkspaceRoleBinding is the Schema for the workspacerolebindings
|
||||
API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
roleRef:
|
||||
description: |-
|
||||
RoleRef can only reference a WorkspaceRole.
|
||||
If the RoleRef cannot be resolved, the Authorizer must return an error.
|
||||
properties:
|
||||
apiGroup:
|
||||
description: APIGroup is the group for the resource being referenced
|
||||
type: string
|
||||
kind:
|
||||
description: Kind is the type of resource being referenced
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name of resource being referenced
|
||||
type: string
|
||||
required:
|
||||
- apiGroup
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
subjects:
|
||||
description: Subjects holds references to the objects the role applies
|
||||
to.
|
||||
items:
|
||||
description: |-
|
||||
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
||||
or a value for non-objects such as user and group names.
|
||||
properties:
|
||||
apiGroup:
|
||||
description: |-
|
||||
APIGroup holds the API group of the referenced subject.
|
||||
Defaults to "" for ServiceAccount subjects.
|
||||
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
||||
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
||||
type: string
|
||||
name:
|
||||
description: Name of the object being referenced.
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
||||
the Authorizer should report an error.
|
||||
type: string
|
||||
required:
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: array
|
||||
required:
|
||||
- roleRef
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
@@ -0,0 +1,229 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: workspaceroles.iam.kubesphere.io
|
||||
spec:
|
||||
group: iam.kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- iam
|
||||
kind: WorkspaceRole
|
||||
listKind: WorkspaceRoleList
|
||||
plural: workspaceroles
|
||||
singular: workspacerole
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .metadata.labels.kubesphere\.io/workspace
|
||||
name: Workspace
|
||||
type: string
|
||||
- jsonPath: .metadata.annotations.kubesphere\.io/alias-name
|
||||
name: Alias
|
||||
type: string
|
||||
deprecated: true
|
||||
name: v1alpha2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
rules:
|
||||
description: Rules holds all the PolicyRules for this WorkspaceRole
|
||||
items:
|
||||
description: |-
|
||||
PolicyRule holds information that describes a policy rule, but does not contain information
|
||||
about who the rule applies to or which namespace the rule applies to.
|
||||
properties:
|
||||
apiGroups:
|
||||
description: |-
|
||||
APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of
|
||||
the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
nonResourceURLs:
|
||||
description: |-
|
||||
NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path
|
||||
Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.
|
||||
Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"), but not both.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
resourceNames:
|
||||
description: ResourceNames is an optional white list of names that
|
||||
the rule applies to. An empty set means that everything is allowed.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
resources:
|
||||
description: Resources is a list of resources this rule applies
|
||||
to. '*' represents all resources.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
verbs:
|
||||
description: Verbs is a list of Verbs that apply to ALL the ResourceKinds
|
||||
contained in this rule. '*' represents all verbs.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- verbs
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
served: true
|
||||
storage: false
|
||||
subresources: {}
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .metadata.labels.kubesphere\.io/workspace
|
||||
name: Workspace
|
||||
type: string
|
||||
- jsonPath: .metadata.annotations.kubesphere\.io/alias-name
|
||||
name: Alias
|
||||
type: string
|
||||
name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: WorkspaceRole is the Schema for the workspaceroles API
|
||||
properties:
|
||||
aggregationRoleTemplates:
|
||||
description: AggregationRoleTemplates means which RoleTemplates are composed
|
||||
this Role
|
||||
properties:
|
||||
roleSelector:
|
||||
description: RoleSelectors select rules from RoleTemplate`s rules
|
||||
by labels
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements.
|
||||
The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies
|
||||
to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
templateNames:
|
||||
description: TemplateNames select rules from RoleTemplate`s rules
|
||||
by RoleTemplate name
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: set
|
||||
type: object
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
rules:
|
||||
description: Rules holds all the PolicyRules for this WorkspaceRole
|
||||
items:
|
||||
description: |-
|
||||
PolicyRule holds information that describes a policy rule, but does not contain information
|
||||
about who the rule applies to or which namespace the rule applies to.
|
||||
properties:
|
||||
apiGroups:
|
||||
description: |-
|
||||
APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of
|
||||
the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
nonResourceURLs:
|
||||
description: |-
|
||||
NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path
|
||||
Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.
|
||||
Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"), but not both.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
resourceNames:
|
||||
description: ResourceNames is an optional white list of names that
|
||||
the rule applies to. An empty set means that everything is allowed.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
resources:
|
||||
description: Resources is a list of resources this rule applies
|
||||
to. '*' represents all resources.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
verbs:
|
||||
description: Verbs is a list of Verbs that apply to ALL the ResourceKinds
|
||||
contained in this rule. '*' represents all verbs.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- verbs
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
@@ -0,0 +1,56 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: categories.kubesphere.io
|
||||
spec:
|
||||
group: kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- extensions
|
||||
kind: Category
|
||||
listKind: CategoryList
|
||||
plural: categories
|
||||
singular: category
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: Category can help us group the extensions.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
description:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
displayName:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
icon:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
283
config/ks-core/charts/ks-crds/crds/kubesphere.io_extensions.yaml
Normal file
283
config/ks-core/charts/ks-crds/crds/kubesphere.io_extensions.yaml
Normal file
@@ -0,0 +1,283 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: extensions.kubesphere.io
|
||||
spec:
|
||||
group: kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- extensions
|
||||
kind: Extension
|
||||
listKind: ExtensionList
|
||||
plural: extensions
|
||||
singular: extension
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .status.state
|
||||
name: State
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
Extension is synchronized from the Repository.
|
||||
An extension can contain multiple versions.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ExtensionSpec only contains basic extension information copied
|
||||
from the latest ExtensionVersion.
|
||||
properties:
|
||||
created:
|
||||
format: date-time
|
||||
type: string
|
||||
description:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
displayName:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
icon:
|
||||
type: string
|
||||
provider:
|
||||
additionalProperties:
|
||||
description: Provider describes an extension provider.
|
||||
properties:
|
||||
email:
|
||||
description: Email is an optional email address to contact the
|
||||
named provider
|
||||
type: string
|
||||
name:
|
||||
description: Name is a username or organization name
|
||||
type: string
|
||||
url:
|
||||
description: URL is an optional URL to an address for the named
|
||||
provider
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
status:
|
||||
properties:
|
||||
clusterSchedulingStatuses:
|
||||
additionalProperties:
|
||||
properties:
|
||||
conditions:
|
||||
items:
|
||||
description: "Condition contains details for one aspect of
|
||||
the current state of this API Resource.\n---\nThis struct
|
||||
is intended for direct use as an array at the field path
|
||||
.status.conditions. For example,\n\n\n\ttype FooStatus
|
||||
struct{\n\t // Represents the observations of a foo's
|
||||
current state.\n\t // Known .status.conditions.type are:
|
||||
\"Available\", \"Progressing\", and \"Degraded\"\n\t //
|
||||
+patchMergeKey=type\n\t // +patchStrategy=merge\n\t //
|
||||
+listType=map\n\t // +listMapKey=type\n\t Conditions
|
||||
[]metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\"
|
||||
patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
|
||||
\ // other fields\n\t}"
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False,
|
||||
Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: |-
|
||||
type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
---
|
||||
Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
|
||||
useful (see .node.status.conditions), the ability to deconflict is important.
|
||||
The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
configHash:
|
||||
type: string
|
||||
jobName:
|
||||
type: string
|
||||
releaseName:
|
||||
type: string
|
||||
state:
|
||||
type: string
|
||||
stateHistory:
|
||||
items:
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
format: date-time
|
||||
type: string
|
||||
state:
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- state
|
||||
type: object
|
||||
type: array
|
||||
targetNamespace:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
type: object
|
||||
description: ClusterSchedulingStatuses describes the subchart installation
|
||||
status of the extension
|
||||
type: object
|
||||
conditions:
|
||||
items:
|
||||
description: "Condition contains details for one aspect of the current
|
||||
state of this API Resource.\n---\nThis struct is intended for
|
||||
direct use as an array at the field path .status.conditions. For
|
||||
example,\n\n\n\ttype FooStatus struct{\n\t // Represents the
|
||||
observations of a foo's current state.\n\t // Known .status.conditions.type
|
||||
are: \"Available\", \"Progressing\", and \"Degraded\"\n\t //
|
||||
+patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t
|
||||
\ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\"
|
||||
patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
|
||||
\ // other fields\n\t}"
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: |-
|
||||
type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
---
|
||||
Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
|
||||
useful (see .node.status.conditions), the ability to deconflict is important.
|
||||
The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
enabled:
|
||||
type: boolean
|
||||
installedVersion:
|
||||
type: string
|
||||
plannedInstallVersion:
|
||||
type: string
|
||||
recommendedVersion:
|
||||
type: string
|
||||
state:
|
||||
type: string
|
||||
versions:
|
||||
items:
|
||||
properties:
|
||||
creationTimestamp:
|
||||
format: date-time
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- version
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
@@ -0,0 +1,170 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: extensionversions.kubesphere.io
|
||||
spec:
|
||||
group: kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- extensions
|
||||
kind: ExtensionVersion
|
||||
listKind: ExtensionVersionList
|
||||
plural: extensionversions
|
||||
singular: extensionversion
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ExtensionVersionSpec contains the details of a specific version
|
||||
extension.
|
||||
properties:
|
||||
category:
|
||||
type: string
|
||||
chartDataRef:
|
||||
description: ChartDataRef refers to a configMap which contains raw
|
||||
chart data.
|
||||
properties:
|
||||
key:
|
||||
description: The key to select.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
TODO: Add other useful fields. apiVersion, kind, uid?
|
||||
type: string
|
||||
namespace:
|
||||
type: string
|
||||
optional:
|
||||
description: Specify whether the ConfigMap or its key must be
|
||||
defined
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
- namespace
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
chartURL:
|
||||
type: string
|
||||
created:
|
||||
format: date-time
|
||||
type: string
|
||||
description:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
digest:
|
||||
type: string
|
||||
displayName:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
docs:
|
||||
type: string
|
||||
externalDependencies:
|
||||
description: ExternalDependencies
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
description: Name of the external dependency
|
||||
type: string
|
||||
required:
|
||||
description: Indicates if the dependency is required
|
||||
type: boolean
|
||||
type:
|
||||
description: Type of dependency, defaults to extension
|
||||
type: string
|
||||
version:
|
||||
description: SemVer
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- required
|
||||
- version
|
||||
type: object
|
||||
type: array
|
||||
home:
|
||||
type: string
|
||||
icon:
|
||||
type: string
|
||||
installationMode:
|
||||
default: HostOnly
|
||||
enum:
|
||||
- HostOnly
|
||||
- Multicluster
|
||||
type: string
|
||||
keywords:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
ksVersion:
|
||||
description: |-
|
||||
KSVersion is a SemVer constraint specifying the version of KubeSphere required.
|
||||
eg: >= 1.2.0, see https://github.com/Masterminds/semver for more info.
|
||||
type: string
|
||||
kubeVersion:
|
||||
description: |-
|
||||
KubeVersion is a SemVer constraint specifying the version of Kubernetes required.
|
||||
eg: >= 1.2.0, see https://github.com/Masterminds/semver for more info.
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace represents the namespace in which the extension is installed.
|
||||
If empty, it will be installed in the namespace named extension-{name}.
|
||||
type: string
|
||||
provider:
|
||||
additionalProperties:
|
||||
description: Provider describes an extension provider.
|
||||
properties:
|
||||
email:
|
||||
description: Email is an optional email address to contact the
|
||||
named provider
|
||||
type: string
|
||||
name:
|
||||
description: Name is a username or organization name
|
||||
type: string
|
||||
url:
|
||||
description: URL is an optional URL to an address for the named
|
||||
provider
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
repository:
|
||||
type: string
|
||||
screenshots:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
sources:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
version:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,336 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: installplans.kubesphere.io
|
||||
spec:
|
||||
group: kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- extensions
|
||||
kind: InstallPlan
|
||||
listKind: InstallPlanList
|
||||
plural: installplans
|
||||
singular: installplan
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .status.state
|
||||
name: State
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: InstallPlan defines how to install an extension in the cluster.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
clusterScheduling:
|
||||
properties:
|
||||
overrides:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
placement:
|
||||
properties:
|
||||
clusterSelector:
|
||||
description: |-
|
||||
A label selector is a label query over a set of resources. The result of matchLabels and
|
||||
matchExpressions are ANDed. An empty label selector matches all objects. A null
|
||||
label selector matches no objects.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector
|
||||
requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector
|
||||
applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
clusters:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: set
|
||||
type: object
|
||||
type: object
|
||||
config:
|
||||
type: string
|
||||
enabled:
|
||||
type: boolean
|
||||
extension:
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- version
|
||||
type: object
|
||||
upgradeStrategy:
|
||||
default: Manual
|
||||
type: string
|
||||
required:
|
||||
- enabled
|
||||
- extension
|
||||
type: object
|
||||
status:
|
||||
properties:
|
||||
clusterSchedulingStatuses:
|
||||
additionalProperties:
|
||||
properties:
|
||||
conditions:
|
||||
items:
|
||||
description: "Condition contains details for one aspect of
|
||||
the current state of this API Resource.\n---\nThis struct
|
||||
is intended for direct use as an array at the field path
|
||||
.status.conditions. For example,\n\n\n\ttype FooStatus
|
||||
struct{\n\t // Represents the observations of a foo's
|
||||
current state.\n\t // Known .status.conditions.type are:
|
||||
\"Available\", \"Progressing\", and \"Degraded\"\n\t //
|
||||
+patchMergeKey=type\n\t // +patchStrategy=merge\n\t //
|
||||
+listType=map\n\t // +listMapKey=type\n\t Conditions
|
||||
[]metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\"
|
||||
patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
|
||||
\ // other fields\n\t}"
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False,
|
||||
Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: |-
|
||||
type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
---
|
||||
Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
|
||||
useful (see .node.status.conditions), the ability to deconflict is important.
|
||||
The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
configHash:
|
||||
type: string
|
||||
jobName:
|
||||
type: string
|
||||
releaseName:
|
||||
type: string
|
||||
state:
|
||||
type: string
|
||||
stateHistory:
|
||||
items:
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
format: date-time
|
||||
type: string
|
||||
state:
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- state
|
||||
type: object
|
||||
type: array
|
||||
targetNamespace:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
type: object
|
||||
description: ClusterSchedulingStatuses describes the subchart installation
|
||||
status of the extension
|
||||
type: object
|
||||
conditions:
|
||||
items:
|
||||
description: "Condition contains details for one aspect of the current
|
||||
state of this API Resource.\n---\nThis struct is intended for
|
||||
direct use as an array at the field path .status.conditions. For
|
||||
example,\n\n\n\ttype FooStatus struct{\n\t // Represents the
|
||||
observations of a foo's current state.\n\t // Known .status.conditions.type
|
||||
are: \"Available\", \"Progressing\", and \"Degraded\"\n\t //
|
||||
+patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t
|
||||
\ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\"
|
||||
patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
|
||||
\ // other fields\n\t}"
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: |-
|
||||
type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
---
|
||||
Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
|
||||
useful (see .node.status.conditions), the ability to deconflict is important.
|
||||
The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
configHash:
|
||||
type: string
|
||||
enabled:
|
||||
type: boolean
|
||||
jobName:
|
||||
type: string
|
||||
releaseName:
|
||||
type: string
|
||||
state:
|
||||
type: string
|
||||
stateHistory:
|
||||
items:
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
format: date-time
|
||||
type: string
|
||||
state:
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- state
|
||||
type: object
|
||||
type: array
|
||||
targetNamespace:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
@@ -0,0 +1,80 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: repositories.kubesphere.io
|
||||
spec:
|
||||
group: kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- extensions
|
||||
kind: Repository
|
||||
listKind: RepositoryList
|
||||
plural: repositories
|
||||
singular: repository
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
Repository declared a docker image containing the extension helm chart.
|
||||
The extension manager controller will deploy and synchronizes the extensions from the image repository.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
basicAuth:
|
||||
properties:
|
||||
password:
|
||||
type: string
|
||||
username:
|
||||
type: string
|
||||
type: object
|
||||
caBundle:
|
||||
description: if the caBundle is empty, use --insecure-skip-tls-verify.
|
||||
type: string
|
||||
description:
|
||||
type: string
|
||||
image:
|
||||
type: string
|
||||
updateStrategy:
|
||||
properties:
|
||||
registryPoll:
|
||||
properties:
|
||||
interval:
|
||||
type: string
|
||||
required:
|
||||
- interval
|
||||
type: object
|
||||
type: object
|
||||
url:
|
||||
type: string
|
||||
type: object
|
||||
status:
|
||||
properties:
|
||||
lastSyncTime:
|
||||
format: date-time
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,103 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: serviceaccounts.kubesphere.io
|
||||
spec:
|
||||
group: kubesphere.io
|
||||
names:
|
||||
kind: ServiceAccount
|
||||
listKind: ServiceAccountList
|
||||
plural: serviceaccounts
|
||||
singular: serviceaccount
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
secrets:
|
||||
items:
|
||||
description: |-
|
||||
ObjectReference contains enough information to let you inspect or modify the referred object.
|
||||
---
|
||||
New uses of this type are discouraged because of difficulty describing its usage when embedded in APIs.
|
||||
1. Ignored fields. It includes many fields which are not generally honored. For instance, ResourceVersion and FieldPath are both very rarely valid in actual usage.
|
||||
2. Invalid usage help. It is impossible to add specific help for individual usage. In most embedded usages, there are particular
|
||||
restrictions like, "must refer only to types A and B" or "UID not honored" or "name must be restricted".
|
||||
Those cannot be well described when embedded.
|
||||
3. Inconsistent validation. Because the usages are different, the validation rules are different by usage, which makes it hard for users to predict what will happen.
|
||||
4. The fields are both imprecise and overly precise. Kind is not a precise mapping to a URL. This can produce ambiguity
|
||||
during interpretation and require a REST mapping. In most cases, the dependency is on the group,resource tuple
|
||||
and the version of the actual struct is irrelevant.
|
||||
5. We cannot easily change it. Because this type is embedded in many locations, updates to this type
|
||||
will affect numerous schemas. Don't make new APIs embed an underspecified API type they do not control.
|
||||
|
||||
|
||||
Instead of using this type, create a locally provided and used type that is well-focused on your reference.
|
||||
For example, ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533 .
|
||||
properties:
|
||||
apiVersion:
|
||||
description: API version of the referent.
|
||||
type: string
|
||||
fieldPath:
|
||||
description: |-
|
||||
If referring to a piece of an object instead of an entire object, this string
|
||||
should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||
For example, if the object reference is to a container within a pod, this would take on a value like:
|
||||
"spec.containers{name}" (where "name" refers to the name of the container that triggered
|
||||
the event) or if no container name is specified "spec.containers[2]" (container with
|
||||
index 2 in this pod). This syntax is chosen only to have some well-defined way of
|
||||
referencing a part of an object.
|
||||
TODO: this design is not final and this field is subject to change in the future.
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind of the referent.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
|
||||
type: string
|
||||
resourceVersion:
|
||||
description: |-
|
||||
Specific resourceVersion to which this reference is made, if any.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
|
||||
type: string
|
||||
uid:
|
||||
description: |-
|
||||
UID of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: array
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -4,7 +4,6 @@ kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
creationTimestamp: null
|
||||
name: resourcequotas.quota.kubesphere.io
|
||||
spec:
|
||||
group: quota.kubesphere.io
|
||||
@@ -20,18 +19,23 @@ spec:
|
||||
- name: v1alpha2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: WorkspaceResourceQuota sets aggregate quota restrictions enforced
|
||||
per workspace
|
||||
description: ResourceQuota sets aggregate quota restrictions enforced per
|
||||
workspace
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
@@ -48,39 +52,39 @@ spec:
|
||||
- type: string
|
||||
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||
x-kubernetes-int-or-string: true
|
||||
description: 'hard is the set of desired hard limits for each
|
||||
named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/'
|
||||
description: |-
|
||||
hard is the set of desired hard limits for each named resource.
|
||||
More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
|
||||
type: object
|
||||
scopeSelector:
|
||||
description: scopeSelector is also a collection of filters like
|
||||
scopes that must match each object tracked by a quota but expressed
|
||||
using ScopeSelectorOperator in combination with possible values.
|
||||
For a resource to match, both scopes AND scopeSelector (if specified
|
||||
in spec), must be matched.
|
||||
description: |-
|
||||
scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota
|
||||
but expressed using ScopeSelectorOperator in combination with possible values.
|
||||
For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: A list of scope selector requirements by scope
|
||||
of the resources.
|
||||
items:
|
||||
description: A scoped-resource selector requirement is a
|
||||
selector that contains values, a scope name, and an operator
|
||||
description: |-
|
||||
A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator
|
||||
that relates the scope name and values.
|
||||
properties:
|
||||
operator:
|
||||
description: Represents a scope's relationship to a
|
||||
set of values. Valid operators are In, NotIn, Exists,
|
||||
DoesNotExist.
|
||||
description: |-
|
||||
Represents a scope's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists, DoesNotExist.
|
||||
type: string
|
||||
scopeName:
|
||||
description: The name of the scope that the selector
|
||||
applies to.
|
||||
type: string
|
||||
values:
|
||||
description: An array of string values. If the operator
|
||||
is In or NotIn, the values array must be non-empty.
|
||||
If the operator is Exists or DoesNotExist, the values
|
||||
array must be empty. This array is replaced during
|
||||
a strategic merge patch.
|
||||
description: |-
|
||||
An array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty.
|
||||
This array is replaced during a strategic merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
@@ -92,9 +96,9 @@ spec:
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
scopes:
|
||||
description: A collection of filters that must match each object
|
||||
tracked by a quota. If not specified, the quota matches all
|
||||
objects.
|
||||
description: |-
|
||||
A collection of filters that must match each object tracked by a quota.
|
||||
If not specified, the quota matches all objects.
|
||||
items:
|
||||
description: A ResourceQuotaScope defines a filter that must
|
||||
match each object tracked by a quota
|
||||
@@ -127,8 +131,9 @@ spec:
|
||||
- type: string
|
||||
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||
x-kubernetes-int-or-string: true
|
||||
description: 'Hard is the set of enforced hard limits for each
|
||||
named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/'
|
||||
description: |-
|
||||
Hard is the set of enforced hard limits for each named resource.
|
||||
More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
|
||||
type: object
|
||||
namespace:
|
||||
description: Namespace the project this status applies to
|
||||
@@ -158,8 +163,9 @@ spec:
|
||||
- type: string
|
||||
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||
x-kubernetes-int-or-string: true
|
||||
description: 'Hard is the set of enforced hard limits for each
|
||||
named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/'
|
||||
description: |-
|
||||
Hard is the set of enforced hard limits for each named resource.
|
||||
More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
|
||||
type: object
|
||||
used:
|
||||
additionalProperties:
|
||||
@@ -4,7 +4,6 @@ kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
creationTimestamp: null
|
||||
name: provisionercapabilities.storage.kubesphere.io
|
||||
spec:
|
||||
group: storage.kubesphere.io
|
||||
@@ -32,14 +31,19 @@ spec:
|
||||
API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
@@ -4,7 +4,6 @@ kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
creationTimestamp: null
|
||||
name: storageclasscapabilities.storage.kubesphere.io
|
||||
spec:
|
||||
group: storage.kubesphere.io
|
||||
@@ -41,14 +40,19 @@ spec:
|
||||
API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
@@ -0,0 +1,86 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: workspaces.tenant.kubesphere.io
|
||||
spec:
|
||||
group: tenant.kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- tenant
|
||||
kind: Workspace
|
||||
listKind: WorkspaceList
|
||||
plural: workspaces
|
||||
singular: workspace
|
||||
scope: Cluster
|
||||
versions:
|
||||
- deprecated: true
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
manager:
|
||||
type: string
|
||||
networkIsolation:
|
||||
type: boolean
|
||||
type: object
|
||||
status:
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: false
|
||||
- name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: Workspace is the Schema for the workspaces API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: WorkspaceSpec defines the desired state of Workspace
|
||||
properties:
|
||||
manager:
|
||||
type: string
|
||||
type: object
|
||||
status:
|
||||
description: WorkspaceStatus defines the observed state of Workspace
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -0,0 +1,258 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
name: workspacetemplates.tenant.kubesphere.io
|
||||
spec:
|
||||
group: tenant.kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- tenant
|
||||
kind: WorkspaceTemplate
|
||||
listKind: WorkspaceTemplateList
|
||||
plural: workspacetemplates
|
||||
singular: workspacetemplate
|
||||
scope: Cluster
|
||||
versions:
|
||||
- deprecated: true
|
||||
name: v1alpha2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
overrides:
|
||||
items:
|
||||
properties:
|
||||
clusterName:
|
||||
type: string
|
||||
clusterOverrides:
|
||||
items:
|
||||
properties:
|
||||
op:
|
||||
type: string
|
||||
path:
|
||||
type: string
|
||||
value:
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
required:
|
||||
- path
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- clusterName
|
||||
type: object
|
||||
type: array
|
||||
placement:
|
||||
properties:
|
||||
clusterSelector:
|
||||
description: |-
|
||||
A label selector is a label query over a set of resources. The result of matchLabels and
|
||||
matchExpressions are ANDed. An empty label selector matches all objects. A null
|
||||
label selector matches no objects.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector
|
||||
requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector
|
||||
applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
clusters:
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- name
|
||||
x-kubernetes-list-type: map
|
||||
type: object
|
||||
template:
|
||||
properties:
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: WorkspaceSpec defines the desired state of Workspace
|
||||
properties:
|
||||
manager:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- placement
|
||||
- template
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: false
|
||||
- name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: WorkspaceTemplate is the Schema for the workspacetemplates API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
placement:
|
||||
properties:
|
||||
clusterSelector:
|
||||
description: |-
|
||||
A label selector is a label query over a set of resources. The result of matchLabels and
|
||||
matchExpressions are ANDed. An empty label selector matches all objects. A null
|
||||
label selector matches no objects.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector
|
||||
requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector
|
||||
applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
clusters:
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- name
|
||||
x-kubernetes-list-type: map
|
||||
type: object
|
||||
template:
|
||||
properties:
|
||||
metadata:
|
||||
properties:
|
||||
annotations:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
spec:
|
||||
description: WorkspaceSpec defines the desired state of Workspace
|
||||
properties:
|
||||
manager:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- placement
|
||||
- template
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
9
config/ks-core/charts/ks-crds/scripts/install.sh
Normal file
9
config/ks-core/charts/ks-crds/scripts/install.sh
Normal file
@@ -0,0 +1,9 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
CRDS_PATH=$1
|
||||
echo "ks-crds pre upgrade..."
|
||||
# shellcheck disable=SC1060
|
||||
for crd in `ls $CRDS_PATH|grep \.yaml$`; do
|
||||
echo $crd
|
||||
kubectl apply -f $CRDS_PATH/$crd
|
||||
done
|
||||
42
config/ks-core/charts/ks-crds/templates/pre-upgrade-job.yaml
Normal file
42
config/ks-core/charts/ks-crds/templates/pre-upgrade-job.yaml
Normal file
@@ -0,0 +1,42 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: "{{ .Release.Name }}-ks-crds-pre-upgrade-scripts"
|
||||
annotations:
|
||||
"helm.sh/hook": pre-upgrade
|
||||
"helm.sh/hook-weight": "-1"
|
||||
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
||||
data:
|
||||
{{ (.Files.Glob "scripts/install.sh").AsConfig | indent 2 }}
|
||||
{{ (.Files.Glob "crds/*").AsConfig | indent 2 }}
|
||||
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: "{{ .Release.Name }}-ks-crds-pre-upgrade"
|
||||
annotations:
|
||||
"helm.sh/hook": pre-upgrade
|
||||
"helm.sh/hook-weight": "10"
|
||||
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
serviceAccountName: {{ include "ks-core.serviceAccountName" . }}
|
||||
containers:
|
||||
- name: crd-install
|
||||
image: {{ template "preUpgrade.image" . }}
|
||||
command:
|
||||
- /bin/bash
|
||||
- /scripts/install.sh
|
||||
- /scripts
|
||||
volumeMounts:
|
||||
- mountPath: /scripts
|
||||
name: scripts
|
||||
resources: {{- toYaml .Values.preUpgrade.resources | nindent 12 }}
|
||||
volumes:
|
||||
- name: scripts
|
||||
configMap:
|
||||
name: "{{ .Release.Name }}-ks-crds-pre-upgrade-scripts"
|
||||
defaultMode: 420
|
||||
17
config/ks-core/charts/ks-crds/values.yaml
Normal file
17
config/ks-core/charts/ks-crds/values.yaml
Normal file
@@ -0,0 +1,17 @@
|
||||
# Default values for ks-crds.
|
||||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
|
||||
preUpgrade:
|
||||
image:
|
||||
registry: ""
|
||||
repository: kubesphereio/kubectl
|
||||
tag: "v1.27.12"
|
||||
pullPolicy: IfNotPresent
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1
|
||||
memory: 1024Mi
|
||||
requests:
|
||||
cpu: 20m
|
||||
memory: 100Mi
|
||||
21
config/ks-core/charts/redis-ha/Chart.yaml
Normal file
21
config/ks-core/charts/redis-ha/Chart.yaml
Normal file
@@ -0,0 +1,21 @@
|
||||
apiVersion: v2
|
||||
appVersion: 7.2.4
|
||||
description: This Helm chart provides a highly available Redis implementation with
|
||||
a master/slave configuration and uses Sentinel sidecars for failover management
|
||||
home: http://redis.io/
|
||||
icon: https://upload.wikimedia.org/wikipedia/en/thumb/6/6b/Redis_Logo.svg/1200px-Redis_Logo.svg.png
|
||||
keywords:
|
||||
- redis
|
||||
- keyvalue
|
||||
- database
|
||||
maintainers:
|
||||
- email: salimsalaues@gmail.com
|
||||
name: ssalaues
|
||||
- email: aaron.layfield@gmail.com
|
||||
name: dandydeveloper
|
||||
name: redis-ha
|
||||
sources:
|
||||
- https://redis.io/download
|
||||
- https://github.com/DandyDeveloper/charts/blob/master/charts/redis-ha
|
||||
- https://github.com/oliver006/redis_exporter
|
||||
version: 4.26.1
|
||||
407
config/ks-core/charts/redis-ha/README.md
Normal file
407
config/ks-core/charts/redis-ha/README.md
Normal file
@@ -0,0 +1,407 @@
|
||||
# Redis
|
||||
|
||||
[Redis](http://redis.io/) is an advanced key-value cache and store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets, sorted sets, bitmaps and hyperloglogs.
|
||||
|
||||
## TL;DR
|
||||
|
||||
```bash
|
||||
helm repo add dandydev https://dandydeveloper.github.io/charts
|
||||
helm install dandydev/redis-ha
|
||||
```
|
||||
|
||||
By default this chart install 3 pods total:
|
||||
|
||||
* one pod containing a redis master and sentinel container (optional prometheus metrics exporter sidecar available)
|
||||
* two pods each containing a redis slave and sentinel containers (optional prometheus metrics exporter sidecars available)
|
||||
|
||||
## Introduction
|
||||
|
||||
This chart bootstraps a [Redis](https://redis.io) highly available master/slave statefulset in a [Kubernetes](http://kubernetes.io) cluster using the Helm package manager.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
* Kubernetes 1.8+ with Beta APIs enabled
|
||||
* PV provisioner support in the underlying infrastructure
|
||||
|
||||
## Upgrading the Chart
|
||||
|
||||
Please note that there have been a number of changes simplifying the redis management strategy (for better failover and elections) in the 3.x version of this chart. These changes allow the use of official [redis](https://hub.docker.com/_/redis/) images that do not require special RBAC or ServiceAccount roles. As a result when upgrading from version >=2.0.1 to >=3.0.0 of this chart, `Role`, `RoleBinding`, and `ServiceAccount` resources should be deleted manually.
|
||||
|
||||
### Upgrading the chart from 3.x to 4.x
|
||||
|
||||
Starting from version `4.x` HAProxy sidecar prometheus-exporter removed and replaced by the embedded [HAProxy metrics endpoint](https://github.com/haproxy/haproxy/tree/master/contrib/prometheus-exporter), as a result when upgrading from version 3.x to 4.x section `haproxy.exporter` should be removed and the `haproxy.metrics` need to be configured for fit your needs.
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart
|
||||
|
||||
```bash
|
||||
helm repo add dandydev https://dandydeveloper.github.io/charts
|
||||
helm install dandydev/redis-ha
|
||||
```
|
||||
|
||||
The command deploys Redis on the Kubernetes cluster in the default configuration. By default this chart install one master pod containing redis master container and sentinel container along with 2 redis slave pods each containing their own sentinel sidecars. The [configuration](#configuration) section lists the parameters that can be configured during installation.
|
||||
|
||||
> **Tip**: List all releases using `helm list`
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
To uninstall/delete the deployment:
|
||||
|
||||
```bash
|
||||
helm delete <chart-name>
|
||||
```
|
||||
|
||||
The command removes all the Kubernetes components associated with the chart and deletes the release.
|
||||
|
||||
## Configuration
|
||||
|
||||
The following table lists the configurable parameters of the Redis chart and their default values.
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|:--------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:-------------------------------------------------------------------------------------------|
|
||||
| `image.repository` | Redis image repository | `redis` |
|
||||
| `image.tag` | Redis image tag | `6.2.5-alpine` |
|
||||
| `image.pullPolicy` | Redis image pull policy | `IfNotPresent` |
|
||||
| `imagePullSecrets` | Reference to one or more secrets to be used when pulling redis images | [] |
|
||||
| `tag` | Redis tag | `6.2.5-alpine` |
|
||||
| `replicas` | Number of redis master/slave pods | `3` |
|
||||
| `podManagementPolicy` | The statefulset pod management policy | `OrderedReady` |
|
||||
| `ro_replicas` | Comma separated list of slaves which never get promoted to be master. Count starts with 0. Allowed values 1-9. i.e. 3,4 - 3th and 4th redis slave never make it to be master, where master is index 0. | ``|
|
||||
| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
|
||||
| `serviceAccount.name` | The name of the ServiceAccount to create | Generated using the redis-ha.fullname template |
|
||||
| `serviceAccount.automountToken` | Opt in/out of automounting API credentials into container | `false` |
|
||||
| `serviceAnnotations` | Annotations to set on Redis HA service | `null` |
|
||||
| `serviceLabels` | Labels to set on Redis HA service | `{}` |
|
||||
| `rbac.create` | Create and use RBAC resources | `true` |
|
||||
| `redis.port` | Port to access the redis service | `6379` |
|
||||
| `redis.tlsPort` | TLS Port to access the redis service |``|
|
||||
| `redis.tlsReplication` | Configures redis with tls-replication parameter, if true sets "tls-replication yes" in redis.conf |``|
|
||||
| `redis.authClients` | It is possible to disable client side certificates authentication when "authClients" is set to "no" |``|
|
||||
| `redis.livenessProbe.initialDelaySeconds` | Initial delay in seconds for liveness probe | `30` |
|
||||
| `redis.livenessProbe.periodSeconds` | Period in seconds after which liveness probe will be repeated | `15` |
|
||||
| `redis.livenessProbe.timeoutSeconds` | Timeout seconds for liveness probe | `15` |
|
||||
| `redis.livenessProbe.successThreshold` | Success threshold for liveness probe | `1` |
|
||||
| `redis.livenessProbe.failureThreshold` | Failure threshold for liveness probe | `5` |
|
||||
| `redis.readinessProbe.initialDelaySeconds` | Initial delay in seconds for readiness probe | `30` |
|
||||
| `redis.readinessProbe.periodSeconds` | Period in seconds after which readiness probe will be repeated | `15` |
|
||||
| `redis.readinessProbe.timeoutSeconds` | Timeout seconds for readiness probe | `15` |
|
||||
| `redis.readinessProbe.successThreshold` | Success threshold for readiness probe | `1` |
|
||||
| `redis.readinessProbe.failureThreshold` | Failure threshold for readiness probe | `5` |
|
||||
| `redis.masterGroupName` | Redis convention for naming the cluster group: must match `^[\\w-\\.]+$` and can be templated | `mymaster` |
|
||||
| `redis.disableCommands` | Array with commands to disable | `["FLUSHDB","FLUSHALL"]` |
|
||||
| `redis.config` | Any valid redis config options in this section will be applied to each server (see below) | see values.yaml |
|
||||
| `redis.customConfig` | Allows for custom redis.conf files to be applied. If this is used then `redis.config` is ignored |``|
|
||||
| `redis.resources` | CPU/Memory for master/slave nodes resource requests/limits | `{}` |
|
||||
| `redis.lifecycle` | Container Lifecycle Hooks for redis container | see values.yaml |
|
||||
| `redis.annotations` | Annotations for the redis statefulset | `{}` |
|
||||
| `redis.updateStategy.type`| Update strategy for redis statefulSet | `RollingUpdate` |
|
||||
| `redis.extraVolumeMounts` | Extra volume mounts for Redis container | `[]` |
|
||||
| `sentinel.port` | Port to access the sentinel service | `26379` |
|
||||
| `sentinel.bind` | Configure the 'bind' directive to bind to a list of network interfaces | `` |
|
||||
| `sentinel.tlsPort` | TLS Port to access the sentinel service |``|
|
||||
| `sentinel.tlsReplication` | Configures sentinel with tls-replication parameter, if true sets "tls-replication yes" in sentinel.conf |``|
|
||||
| `sentinel.authClients` | It is possible to disable client side certificates authentication when "authClients" is set to "no" |``|
|
||||
| `sentinel.livenessProbe.initialDelaySeconds` | Initial delay in seconds for liveness probe | `30` |
|
||||
| `sentinel.livenessProbe.periodSeconds` | Period in seconds after which liveness probe will be repeated | `15` |
|
||||
| `sentinel.livenessProbe.timeoutSeconds` | Timeout seconds for liveness probe | `15` |
|
||||
| `sentinel.livenessProbe.successThreshold` | Success threshold for liveness probe | `1` |
|
||||
| `sentinel.livenessProbe.failureThreshold` | Failure threshold for liveness probe | `5` |
|
||||
| `sentinel.readinessProbe.initialDelaySeconds` | Initial delay in seconds for readiness probe | `30` |
|
||||
| `sentinel.readinessProbe.periodSeconds` | Period in seconds after which readiness probe will be repeated | `15` |
|
||||
| `sentinel.readinessProbe.timeoutSeconds` | Timeout seconds for readiness probe | `15` |
|
||||
| `sentinel.readinessProbe.successThreshold` | Success threshold for readiness probe | `3` |
|
||||
| `sentinel.readinessProbe.failureThreshold` | Failure threshold for readiness probe | `5` |
|
||||
| `sentinel.auth` | Enables or disables sentinel AUTH (Requires `sentinel.password` to be set) | `false` |
|
||||
| `sentinel.password` | A password that configures a `requirepass` in the conf parameters (Requires `sentinel.auth: enabled`) |``|
|
||||
| `sentinel.existingSecret` | An existing secret containing a key defined by `sentinel.authKey` that configures `requirepass` in the conf parameters (Requires `sentinel.auth: enabled`, cannot be used in conjunction with `.Values.sentinel.password`) |``|
|
||||
| `sentinel.authKey` | The key holding the sentinel password in an existing secret. | `sentinel-password` |
|
||||
| `sentinel.quorum` | Minimum number of servers necessary to maintain quorum | `2` |
|
||||
| `sentinel.config` | Valid sentinel config options in this section will be applied as config options to each sentinel (see below) | see values.yaml |
|
||||
| `sentinel.customConfig` | Allows for custom sentinel.conf files to be applied. If this is used then `sentinel.config` is ignored |``|
|
||||
| `sentinel.resources` | CPU/Memory for sentinel node resource requests/limits | `{}` |
|
||||
| `sentinel.lifecycle` | Container Lifecycle Hooks for sentinel container | `{}` |
|
||||
| `sentinel.extraVolumeMounts` | Extra volume mounts for Sentinel container | `[]` |
|
||||
| `init.resources` | CPU/Memory for init Container node resource requests/limits | `{}` |
|
||||
| `auth` | Enables or disables redis AUTH (Requires `redisPassword` to be set) | `false` |
|
||||
| `redisPassword` | A password that configures a `requirepass` and `masterauth` in the conf parameters (Requires `auth: enabled`) |``|
|
||||
| `authKey` | The key holding the redis password in an existing secret. | `auth` |
|
||||
| `existingSecret` | An existing secret containing a key defined by `authKey` that configures `requirepass` and `masterauth` in the conf parameters (Requires `auth: enabled`, cannot be used in conjunction with `.Values.redisPassword`) |``|
|
||||
| `nodeSelector` | Node labels for pod assignment | `{}` |
|
||||
| `tolerations` | Toleration labels for pod assignment | `[]` |
|
||||
| `hardAntiAffinity` | Whether the Redis server pods should be forced to run on separate nodes. | `true` |
|
||||
| `additionalAffinities` | Additional affinities to add to the Redis server pods. | `{}` |
|
||||
| `securityContext` | Security context to be added to the Redis StatefulSet. | `{runAsUser: 1000, fsGroup: 1000, runAsNonRoot: true}` |
|
||||
| `containerSecurityContext` | Security context to be added to the Redis containers. | `{ runAsNonRoot: true, allowPrivilegeEscalation: false, seccompProfile: { type: RuntimeDefault }, capabilities: { drop: [ "ALL" ] }` |
|
||||
| `affinity` | Override all other affinity settings with a string. | `""` |
|
||||
| `labels` | Labels for the Redis pod. | `{}` |
|
||||
| `configmap.labels` | Labels for the Redis configmap. | `{}` |
|
||||
| `configmapTest.image.repository` | Repository of the configmap shellcheck test image. | `koalaman/shellcheck` |
|
||||
| `configmapTest.image.tag` | Tag of the configmap shellcheck test image. | `v0.5.0` |
|
||||
| `configmapTest.resources` | Resources for the ConfigMap tests. | `{}` |
|
||||
| `persistentVolume.size` | Size for the volume | 10Gi |
|
||||
| `persistentVolume.annotations` | Annotations for the volume | `{}` |
|
||||
| `persistentVolume.labels` | Labels for the volume | `{}` |
|
||||
| `emptyDir` | Configuration of `emptyDir`, used only if persistentVolume is disabled and no hostPath specified | `{}` |
|
||||
| `exporter.enabled` | If `true`, the prometheus exporter sidecar is enabled | `false` |
|
||||
| `exporter.image` | Exporter image | `oliver006/redis_exporter` |
|
||||
| `exporter.tag` | Exporter tag | `v1.27.0` |
|
||||
| `exporter.port` | Exporter port | `9121` |
|
||||
| `exporter.portName` | Exporter port name | `exporter-port` |
|
||||
| `exporter.address` | Redis instance Hostname/Address Exists to circumvent some issues with issues in IPv6 hostname resolution | `localhost` |
|
||||
| `exporter.annotations` | Prometheus scrape annotations | `{prometheus.io/path: /metrics, prometheus.io/port: "9121", prometheus.io/scrape: "true"}` |
|
||||
| `exporter.extraArgs` | Additional args for the exporter | `{}` |
|
||||
| `exporter.script` | A custom custom Lua script that will be mounted to exporter for collection of custom metrics. Creates a ConfigMap and sets env var `REDIS_EXPORTER_SCRIPT`. | |
|
||||
| `exporter.serviceMonitor.enabled` | Use servicemonitor from prometheus operator | `false` |
|
||||
| `exporter.serviceMonitor.namespace` | Namespace the service monitor is created in | `default` |
|
||||
| `exporter.serviceMonitor.interval` | Scrape interval, If not set, the Prometheus default scrape interval is used | `nil` |
|
||||
| `exporter.serviceMonitor.telemetryPath` | Path to redis-exporter telemetry-path | `/metrics` |
|
||||
| `exporter.serviceMonitor.labels` | Labels for the servicemonitor passed to Prometheus Operator | `{}` |
|
||||
| `exporter.serviceMonitor.timeout` | How long until a scrape request times out. If not set, the Prometheus default scape timeout is used | `nil` |
|
||||
| `exporter.serviceMonitor.endpointAdditionalProperties` | Set additional properties for the ServiceMonitor endpoints such as relabeling, scrapeTimeout, tlsConfig, and more. | `{}` |
|
||||
| `haproxy.enabled` | Enabled HAProxy LoadBalancing/Proxy | `false` |
|
||||
| `haproxy.replicas` | Number of HAProxy instances | `3` |
|
||||
| `haproxy.servicePort` | Modify HAProxy service port | `6379` |
|
||||
| `haproxy.containerPort` | Modify HAProxy deployment container port | `6379`
|
||||
| `haproxy.image.repository`| HAProxy Image Repository | `haproxy` |
|
||||
| `haproxy.image.tag` | HAProxy Image Tag | `2.4.2` |
|
||||
| `haproxy.image.pullPolicy`| HAProxy Image PullPolicy | `IfNotPresent` |
|
||||
| `haproxy.imagePullSecrets`| Reference to one or more secrets to be used when pulling haproxy images | [] |
|
||||
| `haproxy.tls.enabled` | If "true" this will enable TLS termination on haproxy | `false`
|
||||
| `haproxy.tls.secretName` | Secret containing the .pem file | `""`
|
||||
| `haproxy.tls.certMountPath` | Path to mount the secret that contains the certificates. haproxy | `false`
|
||||
| `haproxy.tls.secretName` | Secret containing the .pem file | `""`
|
||||
| `haproxy.annotations` | HAProxy template annotations | `{}` |
|
||||
| `haproxy.customConfig` | Allows for custom config-haproxy.cfg file to be applied. If this is used then default config will be overwriten |``|
|
||||
| `haproxy.extraConfig` | Allows to place any additional configuration section to add to the default config-haproxy.cfg |``|
|
||||
| `haproxy.resources` | HAProxy resources | `{}` |
|
||||
| `haproxy.emptyDir` | Configuration of `emptyDir` | `{}` |
|
||||
| `haproxy.labels` | Labels for the HAProxy pod | `{}` |
|
||||
| `haproxy.serviceAccountName`| HAProxy serviceAccountName | `default`
|
||||
| `haproxy.service.type` | HAProxy service type "ClusterIP", "LoadBalancer" or "NodePort" | `ClusterIP` |
|
||||
| `haproxy.service.nodePort` | HAProxy service nodePort value (haproxy.service.type must be NodePort) | not set |
|
||||
| `haproxy.service.externalTrafficPolicy`| HAProxy service externalTrafficPolicy value (haproxy.service.type must be LoadBalancer) | not set |
|
||||
| `haproxy.service.annotations` | HAProxy service annotations | `{}` |
|
||||
| `haproxy.service.labels` | HAProxy service labels | `{}` |
|
||||
| `haproxy.service.loadBalancerIP` | HAProxy service loadbalancer IP | not set |
|
||||
| `haproxy.service.externalIPs` | HAProxy external IPs | `{}` |
|
||||
| `haproxy.stickyBalancing` | HAProxy sticky load balancing to Redis nodes. Helps with connections shutdown. | `false` |
|
||||
| `haproxy.hapreadport.enable` | Enable a read only port for redis slaves | `false` |
|
||||
| `haproxy.hapreadport.port` | Haproxy port for read only redis slaves | `6380` |
|
||||
| `haproxy.metrics.enabled` | HAProxy enable prometheus metric scraping | `false` |
|
||||
| `haproxy.metrics.port` | HAProxy prometheus metrics scraping port | `9101` |
|
||||
| `haproxy.metrics.portName` | HAProxy metrics scraping port name | `http-exporter-port` |
|
||||
| `haproxy.metrics.scrapePath` | HAProxy prometheus metrics scraping port | `/metrics` |
|
||||
| `haproxy.metrics.serviceMonitor.enabled` | Use servicemonitor from prometheus operator for HAProxy metrics | `false` |
|
||||
| `haproxy.metrics.serviceMonitor.namespace` | Namespace the service monitor for HAProxy metrics is created in | `default` |
|
||||
| `haproxy.metrics.serviceMonitor.interval` | Scrape interval, If not set, the Prometheus default scrape interval is used | `nil` |
|
||||
| `haproxy.metrics.serviceMonitor.telemetryPath` | Path to HAProxy metrics telemetry-path | `/metrics` |
|
||||
| `haproxy.metrics.serviceMonitor.labels` | Labels for the HAProxy metrics servicemonitor passed to Prometheus Operator | `{}` |
|
||||
| `haproxy.metrics.serviceMonitor.timeout` | How long until a scrape request times out. If not set, the Prometheus default scape timeout is used | `nil` |
|
||||
| `haproxy.metrics.serviceMonitor.endpointAdditionalProperties` | Set additional properties for the ServiceMonitor endpoints such as relabeling, scrapeTimeout, tlsConfig, and more. | `{}` |
|
||||
| `haproxy.init.resources` | Extra init resources | `{}` |
|
||||
| `haproxy.timeout.connect` | haproxy.cfg `timeout connect` setting | `4s` |
|
||||
| `haproxy.timeout.server` | haproxy.cfg `timeout server` setting | `30s` |
|
||||
| `haproxy.timeout.client` | haproxy.cfg `timeout client` setting | `30s` |
|
||||
| `haproxy.timeout.check` | haproxy.cfg `timeout check` setting | `2s` |
|
||||
| `haproxy.checkInterval` | haproxy.cfg `check inter` setting | `1s` |
|
||||
| `haproxy.checkFall` | haproxy.cfg `check fall` setting | `1` |
|
||||
| `haproxy.priorityClassName` | priorityClassName for `haproxy` deployment | not set |
|
||||
| `haproxy.securityContext` | Security context to be added to the HAProxy deployment. | `{runAsUser: 99, fsGroup: 99, runAsNonRoot: true}` |
|
||||
| `haproxy.containerSecurityContext` | Security context to be added to the HAProxy containers. | `{ runAsNonRoot: true, allowPrivilegeEscalation: false, seccompProfile: { type: RuntimeDefault }, capabilities: { drop: [ "ALL" ] }` |
|
||||
| `haproxy.hardAntiAffinity` | Whether the haproxy pods should be forced to run on separate nodes. | `true` |
|
||||
| `haproxy.affinity` | Override all other haproxy affinity settings with a string. | `""` |
|
||||
| `haproxy.additionalAffinities` | Additional affinities to add to the haproxy server pods. | `{}` |
|
||||
| `haproxy.tests.resources` | Pod resources for the tests against HAProxy. | `{}` |
|
||||
| `haproxy.IPv6.enabled` | Disables certain binding options to support non-IPv6 environments. | `true` |
|
||||
| `networkPolicy.enabled` | Create NetworkPolicy for Haproxy pods |`false`|
|
||||
| `networkPolicy.labels` | Labels for Haproxy NetworkPolicy |`{}`|
|
||||
| `networkPolicy.annotations` | Annotations for Haproxy NetworkPolicy |`{}`|
|
||||
| `networkPolicy.ingressRules[].selectors` | Label selector query to define resources for this ingress rule |`[]`|
|
||||
| `networkPolicy.ingressRules[].ports` | The destination ports for the ingress rule |`[{port: redis.port, protocol: TCP}, {port: sentinel.port, protocol: TCP}]`|
|
||||
| `networkPolicy.egressRules[].selectors` | Label selector query to define resources for this egress rule |`[]`|
|
||||
| `networkPolicy.egressRules[].ports` | The destination ports for the egress rule |``|
|
||||
| `podDisruptionBudget` | Pod Disruption Budget rules | `{}` |
|
||||
| `nameOverride` | Override the chart name | `""` |
|
||||
| `fullnameOverride` | Fully override the release name and chart name | `""` |
|
||||
| `priorityClassName` | priorityClassName for `redis-ha-statefulset` | not set |
|
||||
| `hostPath.path` | Use this path on the host for data storage | not set |
|
||||
| `hostPath.chown` | Run an init-container as root to set ownership on the hostPath | `true` |
|
||||
| `sysctlImage.enabled` | Enable an init container to modify Kernel settings | `false` |
|
||||
| `sysctlImage.command` | sysctlImage command to execute | [] |
|
||||
| `sysctlImage.registry` | sysctlImage Init container registry | `docker.io` |
|
||||
| `sysctlImage.repository` | sysctlImage Init container name | `busybox` |
|
||||
| `sysctlImage.tag` | sysctlImage Init container tag | `1.31.1` |
|
||||
| `sysctlImage.pullPolicy` | sysctlImage Init container pull policy | `Always` |
|
||||
| `sysctlImage.mountHostSys`| Mount the host `/sys` folder to `/host-sys` | `false` |
|
||||
| `sysctlImage.resources` | sysctlImage resources | `{}` |
|
||||
| `schedulerName` | Alternate scheduler name | `nil` |
|
||||
| `tls.secretName` | The name of secret if you want to use your own TLS certificates. The secret should contains keys named by "tls.certFile" - the certificate, "tls.keyFile" - the private key, "tls.caCertFile" - the certificate of CA and "tls.dhParamsFile" - the dh parameter file | ``|
|
||||
| `tls.certFile` | Name of certificate file | `redis.crt` |
|
||||
| `tls.keyFile` | Name of key file | `redis.key` |
|
||||
| `tls.dhParamsFile` | Name of Diffie-Hellman (DH) key exchange parameters file |`` |
|
||||
| `tls.caCertFile` | Name of CA certificate file | `ca.crt` |
|
||||
| `restore.s3.source` | Restore init container - AWS S3 location of dump - i.e. s3://bucket/dump.rdb | `false` |
|
||||
| `restore.existingSecret` | Set to true to use existingSecret for the AWS S3 or SSH credentials | `false` |
|
||||
| `topologySpreadConstraints.enabled` | Enable topology spread constraints |`false`|
|
||||
| `topologySpreadConstraints.maxSkew` | Max skew of pods tolerated |`1`|
|
||||
| `topologySpreadConstraints.topologyKey` | Topology key for spread |`topology.kubernetes.io/zone`|
|
||||
| `topologySpreadConstraints.whenUnsatisfiable` | Enforcement policy, hard or soft |`ScheduleAnyway`|
|
||||
| `restore.s3.access_key` | Restore init container - AWS AWS_ACCESS_KEY_ID to access restore.s3.source |``|
|
||||
| `restore.s3.secret_key` | Restore init container - AWS AWS_SECRET_ACCESS_KEY to access restore.s3.source |``|
|
||||
| `restore.s3.region` | Restore init container - AWS AWS_REGION to access restore.s3.source |``|
|
||||
| `restore.ssh.source` | Restore init container - SSH scp location of dump - i.e. user@server:/path/dump.rdb | `false` |
|
||||
| `restore.ssh.key` | Restore init container - SSH private key to scp restore.ssh.source to init container. Key should be in one line separated with \n. i.e. -----BEGIN RSA PRIVATE KEY-----\n...\n...\n-----END RSA PRIVATE KEY----- |`` |
|
||||
| `extraContainers` | Extra containers to include in StatefulSet |`[]`|
|
||||
| `extraInitContainers` | Extra init containers to include in StatefulSet |`[]`|
|
||||
| `extraVolumes` | Extra volumes to include in StatefulSet |`[]`|
|
||||
| `extraLabels` | Labels that should be applied to all created resources |`{}`|
|
||||
| `networkPolicy.enabled` | Create NetworkPolicy for Redis StatefulSet pods |`false`|
|
||||
| `networkPolicy.labels` | Labels for NetworkPolicy |`{}`|
|
||||
| `networkPolicy.annotations` | Annotations for NetworkPolicy |`{}`|
|
||||
| `networkPolicy.ingressRules[].selectors` | Label selector query to define resources for this ingress rule |`[]`|
|
||||
| `networkPolicy.ingressRules[].ports` | The destination ports for the ingress rule |`[{port: redis.port, protocol: TCP}, {port: sentinel.port, protocol: TCP}]`|
|
||||
| `networkPolicy.egressRules[].selectors` | Label selector query to define resources for this egress rule |`[]`|
|
||||
| `networkPolicy.egressRules[].ports` | The destination ports for the egress rule |``|
|
||||
| `splitBrainDetection.interval` | Interval between redis sentinel and server split brain checks (in seconds) |`60`|
|
||||
| `splitBrainDetection.resources` | splitBrainDetection resources |`{}`|
|
||||
|
||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
|
||||
|
||||
```bash
|
||||
$ helm repo add dandydev https://dandydeveloper.github.io/charts
|
||||
$ helm install \
|
||||
--set image=redis \
|
||||
--set tag=5.0.5-alpine \
|
||||
dandydev/redis-ha
|
||||
```
|
||||
|
||||
The above command sets the Redis server within `default` namespace.
|
||||
|
||||
Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example,
|
||||
|
||||
```bash
|
||||
helm install -f values.yaml dandydev/redis-ha
|
||||
```
|
||||
|
||||
> **Tip**: You can use the default [values.yaml](values.yaml)
|
||||
|
||||
## Custom Redis and Sentinel config options
|
||||
|
||||
This chart allows for most redis or sentinel config options to be passed as a key value pair through the `values.yaml` under `redis.config` and `sentinel.config`. See links below for all available options.
|
||||
|
||||
[Example redis.conf](http://download.redis.io/redis-stable/redis.conf)
|
||||
[Example sentinel.conf](http://download.redis.io/redis-stable/sentinel.conf)
|
||||
|
||||
For example `repl-timeout 60` would be added to the `redis.config` section of the `values.yaml` as:
|
||||
|
||||
```yml
|
||||
repl-timeout: "60"
|
||||
```
|
||||
|
||||
Note:
|
||||
|
||||
1. Some config options should be renamed by redis version，e.g.:
|
||||
|
||||
```yml
|
||||
# In redis 5.x，see https://raw.githubusercontent.com/antirez/redis/5.0/redis.conf
|
||||
min-replicas-to-write: 1
|
||||
min-replicas-max-lag: 5
|
||||
|
||||
# In redis 4.x and redis 3.x，see https://raw.githubusercontent.com/antirez/redis/4.0/redis.conf and https://raw.githubusercontent.com/antirez/redis/3.0/redis.conf
|
||||
min-slaves-to-write 1
|
||||
min-slaves-max-lag 5
|
||||
```
|
||||
|
||||
Sentinel options supported must be in the the `sentinel <option> <master-group-name> <value>` format. For example, `sentinel down-after-milliseconds 30000` would be added to the `sentinel.config` section of the `values.yaml` as:
|
||||
|
||||
```yml
|
||||
down-after-milliseconds: 30000
|
||||
```
|
||||
|
||||
If more control is needed from either the redis or sentinel config then an entire config can be defined under `redis.customConfig` or `sentinel.customConfig`. Please note that these values will override any configuration options under their respective section. For example, if you define `sentinel.customConfig` then the `sentinel.config` is ignored.
|
||||
|
||||
## Host Kernel Settings
|
||||
|
||||
Redis may require some changes in the kernel of the host machine to work as expected, in particular increasing the `somaxconn` value and disabling transparent huge pages.
|
||||
To do so, you can set up a privileged initContainer with the `sysctlImage` config values, for example:
|
||||
|
||||
```yml
|
||||
sysctlImage:
|
||||
enabled: true
|
||||
mountHostSys: true
|
||||
command:
|
||||
- /bin/sh
|
||||
- -xc
|
||||
- |-
|
||||
sysctl -w net.core.somaxconn=10000
|
||||
echo never > /host-sys/kernel/mm/transparent_hugepage/enabled
|
||||
```
|
||||
|
||||
## HAProxy startup
|
||||
|
||||
When HAProxy is enabled, it will attempt to connect to each announce-service of each redis replica instance in its init container before starting.
|
||||
It will fail if announce-service IP is not available fast enough (10 seconds max by announce-service).
|
||||
A such case could happen if the orchestator is pending the nomination of redis pods.
|
||||
Risk is limited because announce-service is using `publishNotReadyAddresses: true`, although, in such case, HAProxy pod will be rescheduled afterward by the orchestrator.
|
||||
|
||||
PodDisruptionBudgets are not configured by default, you may need to set the `haproxy.podDisruptionBudget` parameter in values.yaml to enable it.
|
||||
|
||||
## Network policies
|
||||
|
||||
If `networkPolicy.enabled` is set to `true`, then a `NetworkPolicy` resource is created with default rules to allow inter-Redis and Sentinel connectivity.
|
||||
This is a requirement for Redis Pods to come up successfully.
|
||||
|
||||
You will need to define `ingressRules` to permit your application connectivity to Redis.
|
||||
The `selectors` block should be in the format of a [label selector](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors).
|
||||
Templating is also supported in the selectors.
|
||||
See such a configuration below.
|
||||
|
||||
```yaml
|
||||
networkPolicy: true
|
||||
ingressRules:
|
||||
- selectors:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
name: my-redis-client-namespace
|
||||
podSelector:
|
||||
matchLabels:
|
||||
# template example
|
||||
app: |-
|
||||
{{- .App.Name }}
|
||||
## ports block is optional (defaults to below), define the block to override the defaults
|
||||
# ports:
|
||||
# - port: 6379
|
||||
# protocol: TCP
|
||||
# - port: 26379
|
||||
# protocol: TCP
|
||||
```
|
||||
|
||||
Should your Pod require additional egress rules, define them in a `egressRules` key which is structured identically to an `ingressRules` key.
|
||||
|
||||
## Sentinel and redis server split brain detection
|
||||
|
||||
Under not entirely known yet circumstances redis sentinel and its corresponding redis server reach a condition that this chart authors call "split brain" (for short). The observed behaviour is the following: the sentinel switches to the new re-elected master, but does not switch its redis server. Majority of original discussion on the problem has happened at the <https://github.com/DandyDeveloper/charts/issues/121>.
|
||||
|
||||
The proposed solution is currently implemented as a sidecar container that runs a bash script with the following logic:
|
||||
|
||||
1. Every `splitBrainDetection.interval` seconds a master (as known by sentinel) is determined
|
||||
1. If it is the current node: ensure the redis server's role is master as well.
|
||||
1. If it is not the current node: ensure the redis server also replicates from the same node.
|
||||
|
||||
If any of the checks above fails - the redis server reinitialisation happens (it regenerates configs the same way it's done during the pod init), and then the redis server is instructed to shutdown. Then kubernetes restarts the container immediately.
|
||||
|
||||
|
||||
# Change Log
|
||||
|
||||
## 4.14.9 - ** POTENTIAL BREAKING CHANGE. **
|
||||
Introduced the ability to change the Haproxy Deployment container pod
|
||||
- Container port in redis-haproxy-deployment.yam has been changed. Was **redis.port** To **haproxy.containerPort**. Default value is 6379.
|
||||
- Port in redis-haproxy-service.yaml has been changed. Was **redis.port** To **haproxy.servicePort**. Default value is 6379.
|
||||
|
||||
## 4.21.0 - BREAKING CHANGES (Kubernetes Deprecation)
|
||||
This version introduced the deprecation of the PSP and subsequently added fields to the securityContexts that were introduced in Kubernetes v1.19:
|
||||
|
||||
https://kubernetes.io/docs/tutorials/security/seccomp/
|
||||
|
||||
As a result, from this version onwards Kubernetes versions older than 1.19 will fail to install without the removal of `.Values.containerSecurityContext.seccompProfile` and `.Values.haproxy.containerSecurityContext.seccompProfile` (If HAProxy is enabled)
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
## Enable HAProxy to manage Load Balancing
|
||||
haproxy:
|
||||
enabled: true
|
||||
annotations:
|
||||
any.domain/key: "value"
|
||||
serviceAccount:
|
||||
create: true
|
||||
metrics:
|
||||
enabled: true
|
||||
25
config/ks-core/charts/redis-ha/templates/NOTES.txt
Normal file
25
config/ks-core/charts/redis-ha/templates/NOTES.txt
Normal file
@@ -0,0 +1,25 @@
|
||||
Redis can be accessed via {{ if ne (int .Values.redis.port) 0 }}port {{ .Values.redis.port }}{{ end }} {{ if .Values.redis.tlsPort }} tls-port {{ .Values.redis.tlsPort }}{{ end }} and Sentinel can be accessed via {{ if ne (int .Values.sentinel.port) 0 }}port {{ .Values.sentinel.port }}{{ end }} {{ if .Values.sentinel.tlsPort }} tls-port {{ .Values.sentinel.tlsPort }}{{ end }} on the following DNS name from within your cluster:
|
||||
{{ template "redis-ha.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local
|
||||
|
||||
To connect to your Redis server:
|
||||
|
||||
{{- if .Values.auth }}
|
||||
1. To retrieve the redis password:
|
||||
echo $(kubectl get secret {{ template "redis-ha.fullname" . }} -o "jsonpath={.data['auth']}" | base64 --decode)
|
||||
|
||||
2. Connect to the Redis master pod that you can use as a client. By default the {{ template "redis-ha.fullname" . }}-server-0 pod is configured as the master:
|
||||
|
||||
kubectl exec -it {{ template "redis-ha.fullname" . }}-server-0 -n {{ .Release.Namespace }} -c redis -- sh
|
||||
|
||||
3. Connect using the Redis CLI (inside container):
|
||||
|
||||
redis-cli -a <REDIS-PASS-FROM-SECRET>
|
||||
{{- else }}
|
||||
1. Run a Redis pod that you can use as a client:
|
||||
|
||||
kubectl exec -it {{ template "redis-ha.fullname" . }}-server-0 -n {{ .Release.Namespace }} -c redis -- sh
|
||||
|
||||
2. Connect using the Redis CLI:
|
||||
|
||||
redis-cli -h {{ template "redis-ha.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local
|
||||
{{- end }}
|
||||
693
config/ks-core/charts/redis-ha/templates/_configs.tpl
Normal file
693
config/ks-core/charts/redis-ha/templates/_configs.tpl
Normal file
@@ -0,0 +1,693 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{- define "config-redis.conf" }}
|
||||
{{- if .Values.redis.customConfig }}
|
||||
{{ tpl .Values.redis.customConfig . | indent 4 }}
|
||||
{{- else }}
|
||||
dir "/data"
|
||||
port {{ .Values.redis.port }}
|
||||
{{- if .Values.sentinel.tlsPort }}
|
||||
tls-port {{ .Values.redis.tlsPort }}
|
||||
tls-cert-file /tls-certs/{{ .Values.tls.certFile }}
|
||||
tls-key-file /tls-certs/{{ .Values.tls.keyFile }}
|
||||
{{- if .Values.tls.dhParamsFile }}
|
||||
tls-dh-params-file /tls-certs/{{ .Values.tls.dhParamsFile }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.caCertFile }}
|
||||
tls-ca-cert-file /tls-certs/{{ .Values.tls.caCertFile }}
|
||||
{{- end }}
|
||||
{{- if eq (default "yes" .Values.redis.authClients) "no"}}
|
||||
tls-auth-clients no
|
||||
{{- end }}
|
||||
tls-replication {{ if .Values.redis.tlsReplication }}yes{{ else }}no{{ end }}
|
||||
{{- end }}
|
||||
{{- if .Values.redis.disableCommands }}
|
||||
{{- range .Values.redis.disableCommands }}
|
||||
rename-command {{ . }} ""
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.redis.config }}
|
||||
{{ $key }} {{ $value }}
|
||||
{{- end }}
|
||||
{{- if .Values.auth }}
|
||||
requirepass replace-default-auth
|
||||
masterauth replace-default-auth
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "config-sentinel.conf" }}
|
||||
{{- if .Values.sentinel.customConfig }}
|
||||
{{ tpl .Values.sentinel.customConfig . | indent 4 }}
|
||||
{{- else }}
|
||||
dir "/data"
|
||||
port {{ .Values.sentinel.port }}
|
||||
{{- if .Values.sentinel.bind }}
|
||||
bind {{ .Values.sentinel.bind }}
|
||||
{{- end }}
|
||||
{{- if .Values.sentinel.tlsPort }}
|
||||
tls-port {{ .Values.sentinel.tlsPort }}
|
||||
tls-cert-file /tls-certs/{{ .Values.tls.certFile }}
|
||||
tls-key-file /tls-certs/{{ .Values.tls.keyFile }}
|
||||
{{- if .Values.tls.dhParamsFile }}
|
||||
tls-dh-params-file /tls-certs/{{ .Values.tls.dhParamsFile }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.caCertFile }}
|
||||
tls-ca-cert-file /tls-certs/{{ .Values.tls.caCertFile }}
|
||||
{{- end }}
|
||||
{{- if eq (default "yes" .Values.sentinel.authClients) "no"}}
|
||||
tls-auth-clients no
|
||||
{{- end }}
|
||||
tls-replication {{ if .Values.sentinel.tlsReplication }}yes{{ else }}no{{ end }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.sentinel.config }}
|
||||
{{- if eq "maxclients" $key }}
|
||||
{{ $key }} {{ $value }}
|
||||
{{- else }}
|
||||
sentinel {{ $key }} {{ template "redis-ha.masterGroupName" $ }} {{ $value }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.auth }}
|
||||
sentinel auth-pass {{ template "redis-ha.masterGroupName" . }} replace-default-auth
|
||||
{{- end }}
|
||||
{{- if .Values.sentinel.auth }}
|
||||
requirepass replace-default-sentinel-auth
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "lib.sh" }}
|
||||
sentinel_get_master() {
|
||||
set +e
|
||||
if [ "$SENTINEL_PORT" -eq 0 ]; then
|
||||
redis-cli -h "${SERVICE}" -p "${SENTINEL_TLS_PORT}" {{ if .Values.sentinel.auth }} -a "${SENTINELAUTH}" --no-auth-warning{{ end }} --tls --cacert /tls-certs/{{ .Values.tls.caCertFile }} {{ if ne (default "yes" .Values.sentinel.authClients) "no"}} --cert /tls-certs/{{ .Values.tls.certFile }} --key /tls-certs/{{ .Values.tls.keyFile }}{{ end }} sentinel get-master-addr-by-name "${MASTER_GROUP}" |\
|
||||
grep -E '((^\s*((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))\s*$)|(^\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?s*$))'
|
||||
else
|
||||
redis-cli -h "${SERVICE}" -p "${SENTINEL_PORT}" {{ if .Values.sentinel.auth }} -a "${SENTINELAUTH}" --no-auth-warning{{ end }} sentinel get-master-addr-by-name "${MASTER_GROUP}" |\
|
||||
grep -E '((^\s*((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))\s*$)|(^\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?s*$))'
|
||||
fi
|
||||
set -e
|
||||
}
|
||||
|
||||
sentinel_get_master_retry() {
|
||||
master=''
|
||||
retry=${1}
|
||||
sleep=3
|
||||
for i in $(seq 1 "${retry}"); do
|
||||
master=$(sentinel_get_master)
|
||||
if [ -n "${master}" ]; then
|
||||
break
|
||||
fi
|
||||
sleep $((sleep + i))
|
||||
done
|
||||
echo "${master}"
|
||||
}
|
||||
|
||||
identify_master() {
|
||||
echo "Identifying redis master (get-master-addr-by-name).."
|
||||
echo " using sentinel ({{ template "redis-ha.fullname" . }}), sentinel group name ({{ template "redis-ha.masterGroupName" . }})"
|
||||
MASTER="$(sentinel_get_master_retry 3)"
|
||||
if [ -n "${MASTER}" ]; then
|
||||
echo " $(date) Found redis master (${MASTER})"
|
||||
else
|
||||
echo " $(date) Did not find redis master (${MASTER})"
|
||||
fi
|
||||
}
|
||||
|
||||
sentinel_update() {
|
||||
echo "Updating sentinel config.."
|
||||
echo " evaluating sentinel id (\${SENTINEL_ID_${INDEX}})"
|
||||
eval MY_SENTINEL_ID="\$SENTINEL_ID_${INDEX}"
|
||||
echo " sentinel id (${MY_SENTINEL_ID}), sentinel grp (${MASTER_GROUP}), quorum (${QUORUM})"
|
||||
sed -i "1s/^/sentinel myid ${MY_SENTINEL_ID}\\n/" "${SENTINEL_CONF}"
|
||||
if [ "$SENTINEL_TLS_REPLICATION_ENABLED" = true ]; then
|
||||
echo " redis master (${1}:${REDIS_TLS_PORT})"
|
||||
sed -i "2s/^/sentinel monitor ${MASTER_GROUP} ${1} ${REDIS_TLS_PORT} ${QUORUM} \\n/" "${SENTINEL_CONF}"
|
||||
else
|
||||
echo " redis master (${1}:${REDIS_PORT})"
|
||||
sed -i "2s/^/sentinel monitor ${MASTER_GROUP} ${1} ${REDIS_PORT} ${QUORUM} \\n/" "${SENTINEL_CONF}"
|
||||
fi
|
||||
echo "sentinel announce-ip ${ANNOUNCE_IP}" >> ${SENTINEL_CONF}
|
||||
if [ "$SENTINEL_PORT" -eq 0 ]; then
|
||||
echo " announce (${ANNOUNCE_IP}:${SENTINEL_TLS_PORT})"
|
||||
echo "sentinel announce-port ${SENTINEL_TLS_PORT}" >> ${SENTINEL_CONF}
|
||||
else
|
||||
echo " announce (${ANNOUNCE_IP}:${SENTINEL_PORT})"
|
||||
echo "sentinel announce-port ${SENTINEL_PORT}" >> ${SENTINEL_CONF}
|
||||
fi
|
||||
}
|
||||
|
||||
redis_update() {
|
||||
echo "Updating redis config.."
|
||||
if [ "$REDIS_TLS_REPLICATION_ENABLED" = true ]; then
|
||||
echo " we are slave of redis master (${1}:${REDIS_TLS_PORT})"
|
||||
echo "slaveof ${1} ${REDIS_TLS_PORT}" >> "${REDIS_CONF}"
|
||||
echo "slave-announce-port ${REDIS_TLS_PORT}" >> ${REDIS_CONF}
|
||||
else
|
||||
echo " we are slave of redis master (${1}:${REDIS_PORT})"
|
||||
echo "slaveof ${1} ${REDIS_PORT}" >> "${REDIS_CONF}"
|
||||
echo "slave-announce-port ${REDIS_PORT}" >> ${REDIS_CONF}
|
||||
fi
|
||||
echo "slave-announce-ip ${ANNOUNCE_IP}" >> ${REDIS_CONF}
|
||||
}
|
||||
|
||||
copy_config() {
|
||||
echo "Copying default redis config.."
|
||||
echo " to '${REDIS_CONF}'"
|
||||
cp /readonly-config/redis.conf "${REDIS_CONF}"
|
||||
echo "Copying default sentinel config.."
|
||||
echo " to '${SENTINEL_CONF}'"
|
||||
cp /readonly-config/sentinel.conf "${SENTINEL_CONF}"
|
||||
}
|
||||
|
||||
setup_defaults() {
|
||||
echo "Setting up defaults.."
|
||||
echo " using statefulset index (${INDEX})"
|
||||
if [ "${INDEX}" = "0" ]; then
|
||||
echo "Setting this pod as master for redis and sentinel.."
|
||||
echo " using announce (${ANNOUNCE_IP})"
|
||||
redis_update "${ANNOUNCE_IP}"
|
||||
sentinel_update "${ANNOUNCE_IP}"
|
||||
echo " make sure ${ANNOUNCE_IP} is not a slave (slaveof no one)"
|
||||
sed -i "s/^.*slaveof.*//" "${REDIS_CONF}"
|
||||
else
|
||||
echo "Getting redis master ip.."
|
||||
echo " blindly assuming (${SERVICE}-announce-0) or (${SERVICE}-server-0) are master"
|
||||
DEFAULT_MASTER="$(getent_hosts 0 | awk '{ print $1 }')"
|
||||
if [ -z "${DEFAULT_MASTER}" ]; then
|
||||
echo "Error: Unable to resolve redis master (getent hosts)."
|
||||
exit 1
|
||||
fi
|
||||
echo " identified redis (may be redis master) ip (${DEFAULT_MASTER})"
|
||||
echo "Setting default slave config for redis and sentinel.."
|
||||
echo " using master ip (${DEFAULT_MASTER})"
|
||||
redis_update "${DEFAULT_MASTER}"
|
||||
sentinel_update "${DEFAULT_MASTER}"
|
||||
fi
|
||||
}
|
||||
|
||||
redis_ping() {
|
||||
set +e
|
||||
if [ "$REDIS_PORT" -eq 0 ]; then
|
||||
redis-cli -h "${MASTER}"{{ if .Values.auth }} -a "${AUTH}" --no-auth-warning{{ end }} -p "${REDIS_TLS_PORT}" --tls --cacert /tls-certs/{{ .Values.tls.caCertFile }} {{ if ne (default "yes" .Values.sentinel.authClients) "no"}} --cert /tls-certs/{{ .Values.tls.certFile }} --key /tls-certs/{{ .Values.tls.keyFile }}{{ end }} ping
|
||||
else
|
||||
redis-cli -h "${MASTER}"{{ if .Values.auth }} -a "${AUTH}" --no-auth-warning{{ end }} -p "${REDIS_PORT}" ping
|
||||
fi
|
||||
set -e
|
||||
}
|
||||
|
||||
redis_ping_retry() {
|
||||
ping=''
|
||||
retry=${1}
|
||||
sleep=3
|
||||
for i in $(seq 1 "${retry}"); do
|
||||
if [ "$(redis_ping)" = "PONG" ]; then
|
||||
ping='PONG'
|
||||
break
|
||||
fi
|
||||
sleep $((sleep + i))
|
||||
MASTER=$(sentinel_get_master)
|
||||
done
|
||||
echo "${ping}"
|
||||
}
|
||||
|
||||
find_master() {
|
||||
echo "Verifying redis master.."
|
||||
if [ "$REDIS_PORT" -eq 0 ]; then
|
||||
echo " ping (${MASTER}:${REDIS_TLS_PORT})"
|
||||
else
|
||||
echo " ping (${MASTER}:${REDIS_PORT})"
|
||||
fi
|
||||
if [ "$(redis_ping_retry 3)" != "PONG" ]; then
|
||||
echo " $(date) Can't ping redis master (${MASTER})"
|
||||
echo "Attempting to force failover (sentinel failover).."
|
||||
|
||||
if [ "$SENTINEL_PORT" -eq 0 ]; then
|
||||
echo " on sentinel (${SERVICE}:${SENTINEL_TLS_PORT}), sentinel grp (${MASTER_GROUP})"
|
||||
if redis-cli -h "${SERVICE}" -p "${SENTINEL_TLS_PORT}" {{ if .Values.sentinel.auth }} -a "${SENTINELAUTH}" --no-auth-warning{{ end }} --tls --cacert /tls-certs/{{ .Values.tls.caCertFile }} {{ if ne (default "yes" .Values.sentinel.authClients) "no"}} --cert /tls-certs/{{ .Values.tls.certFile }} --key /tls-certs/{{ .Values.tls.keyFile }}{{ end }} sentinel failover "${MASTER_GROUP}" | grep -q 'NOGOODSLAVE' ; then
|
||||
echo " $(date) Failover returned with 'NOGOODSLAVE'"
|
||||
echo "Setting defaults for this pod.."
|
||||
setup_defaults
|
||||
return 0
|
||||
fi
|
||||
else
|
||||
echo " on sentinel (${SERVICE}:${SENTINEL_PORT}), sentinel grp (${MASTER_GROUP})"
|
||||
if redis-cli -h "${SERVICE}" -p "${SENTINEL_PORT}" {{ if .Values.sentinel.auth }} -a "${SENTINELAUTH}" --no-auth-warning{{ end }} sentinel failover "${MASTER_GROUP}" | grep -q 'NOGOODSLAVE' ; then
|
||||
echo " $(date) Failover returned with 'NOGOODSLAVE'"
|
||||
echo "Setting defaults for this pod.."
|
||||
setup_defaults
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
|
||||
echo "Hold on for 10sec"
|
||||
sleep 10
|
||||
echo "We should get redis master's ip now. Asking (get-master-addr-by-name).."
|
||||
if [ "$SENTINEL_PORT" -eq 0 ]; then
|
||||
echo " sentinel (${SERVICE}:${SENTINEL_TLS_PORT}), sentinel grp (${MASTER_GROUP})"
|
||||
else
|
||||
echo " sentinel (${SERVICE}:${SENTINEL_PORT}), sentinel grp (${MASTER_GROUP})"
|
||||
fi
|
||||
MASTER="$(sentinel_get_master)"
|
||||
if [ "${MASTER}" ]; then
|
||||
echo " $(date) Found redis master (${MASTER})"
|
||||
echo "Updating redis and sentinel config.."
|
||||
sentinel_update "${MASTER}"
|
||||
redis_update "${MASTER}"
|
||||
else
|
||||
echo "$(date) Error: Could not failover, exiting..."
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
echo " $(date) Found reachable redis master (${MASTER})"
|
||||
echo "Updating redis and sentinel config.."
|
||||
sentinel_update "${MASTER}"
|
||||
redis_update "${MASTER}"
|
||||
fi
|
||||
}
|
||||
|
||||
redis_ro_update() {
|
||||
echo "Updating read-only redis config.."
|
||||
echo " redis.conf set 'replica-priority 0'"
|
||||
echo "replica-priority 0" >> ${REDIS_CONF}
|
||||
}
|
||||
|
||||
getent_hosts() {
|
||||
index=${1:-${INDEX}}
|
||||
service="${SERVICE}-announce-${index}"
|
||||
host=$(getent hosts "${service}")
|
||||
echo "${host}"
|
||||
}
|
||||
|
||||
identify_announce_ip() {
|
||||
echo "Identify announce ip for this pod.."
|
||||
echo " using (${SERVICE}-announce-${INDEX}) or (${SERVICE}-server-${INDEX})"
|
||||
ANNOUNCE_IP=$(getent_hosts | awk '{ print $1 }')
|
||||
echo " identified announce (${ANNOUNCE_IP})"
|
||||
}
|
||||
{{- end }}
|
||||
|
||||
{{- define "vars.sh" }}
|
||||
HOSTNAME="$(hostname)"
|
||||
{{- if .Values.ro_replicas }}
|
||||
RO_REPLICAS="{{ .Values.ro_replicas }}"
|
||||
{{- end }}
|
||||
INDEX="${HOSTNAME##*-}"
|
||||
SENTINEL_PORT={{ .Values.sentinel.port }}
|
||||
ANNOUNCE_IP=''
|
||||
MASTER=''
|
||||
MASTER_GROUP="{{ template "redis-ha.masterGroupName" . }}"
|
||||
QUORUM="{{ .Values.sentinel.quorum }}"
|
||||
REDIS_CONF=/data/conf/redis.conf
|
||||
REDIS_PORT={{ .Values.redis.port }}
|
||||
REDIS_TLS_PORT={{ .Values.redis.tlsPort }}
|
||||
SENTINEL_CONF=/data/conf/sentinel.conf
|
||||
SENTINEL_TLS_PORT={{ .Values.sentinel.tlsPort }}
|
||||
SERVICE={{ template "redis-ha.fullname" . }}
|
||||
SENTINEL_TLS_REPLICATION_ENABLED={{ default false .Values.sentinel.tlsReplication }}
|
||||
REDIS_TLS_REPLICATION_ENABLED={{ default false .Values.redis.tlsReplication }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "config-init.sh" }}
|
||||
echo "$(date) Start..."
|
||||
{{- include "vars.sh" . }}
|
||||
|
||||
set -eu
|
||||
|
||||
{{- include "lib.sh" . }}
|
||||
|
||||
mkdir -p /data/conf/
|
||||
|
||||
echo "Initializing config.."
|
||||
copy_config
|
||||
|
||||
# where is redis master
|
||||
identify_master
|
||||
|
||||
identify_announce_ip
|
||||
|
||||
if [ -z "${ANNOUNCE_IP}" ]; then
|
||||
"Error: Could not resolve the announce ip for this pod."
|
||||
exit 1
|
||||
elif [ "${MASTER}" ]; then
|
||||
find_master
|
||||
else
|
||||
setup_defaults
|
||||
fi
|
||||
|
||||
{{- if .Values.ro_replicas }}
|
||||
# works only if index is less than 10
|
||||
echo "Verifying redis read-only replica.."
|
||||
echo " we have RO_REPLICAS='${RO_REPLICAS}' with INDEX='${INDEX}'"
|
||||
if echo "${RO_REPLICAS}" | grep -q "${INDEX}" ; then
|
||||
redis_ro_update
|
||||
fi
|
||||
{{- end }}
|
||||
|
||||
if [ "${AUTH:-}" ]; then
|
||||
echo "Setting redis auth values.."
|
||||
ESCAPED_AUTH=$(echo "${AUTH}" | sed -e 's/[\/&]/\\&/g');
|
||||
sed -i "s/replace-default-auth/${ESCAPED_AUTH}/" "${REDIS_CONF}" "${SENTINEL_CONF}"
|
||||
fi
|
||||
|
||||
if [ "${SENTINELAUTH:-}" ]; then
|
||||
echo "Setting sentinel auth values"
|
||||
ESCAPED_AUTH_SENTINEL=$(echo "$SENTINELAUTH" | sed -e 's/[\/&]/\\&/g');
|
||||
sed -i "s/replace-default-sentinel-auth/${ESCAPED_AUTH_SENTINEL}/" "$SENTINEL_CONF"
|
||||
fi
|
||||
|
||||
echo "$(date) Ready..."
|
||||
{{- end }}
|
||||
|
||||
{{- define "trigger-failover-if-master.sh" }}
|
||||
{{- if or (eq (int .Values.redis.port) 0) (eq (int .Values.sentinel.port) 0) }}
|
||||
TLS_CLIENT_OPTION="--tls --cacert /tls-certs/{{ .Values.tls.caCertFile }}{{ if ne (default "yes" .Values.sentinel.authClients) "no"}} --cert /tls-certs/{{ .Values.tls.certFile }} --key /tls-certs/{{ .Values.tls.keyFile }}{{end}}"
|
||||
{{- end }}
|
||||
get_redis_role() {
|
||||
is_master=$(
|
||||
redis-cli \
|
||||
{{- if .Values.auth }}
|
||||
-a "${AUTH}" --no-auth-warning \
|
||||
{{- end }}
|
||||
-h localhost \
|
||||
{{- if (int .Values.redis.port) }}
|
||||
-p {{ .Values.redis.port }} \
|
||||
{{- else }}
|
||||
-p {{ .Values.redis.tlsPort }} ${TLS_CLIENT_OPTION} \
|
||||
{{- end}}
|
||||
info | grep -c 'role:master' || true
|
||||
)
|
||||
}
|
||||
get_redis_role
|
||||
if [[ "$is_master" -eq 1 ]]; then
|
||||
echo "This node is currently master, we trigger a failover."
|
||||
{{- $masterGroupName := include "redis-ha.masterGroupName" . }}
|
||||
response=$(
|
||||
redis-cli \
|
||||
{{- if .Values.sentinel.auth }}
|
||||
-a "${SENTINELAUTH}" --no-auth-warning \
|
||||
{{- end }}
|
||||
-h localhost \
|
||||
{{- if (int .Values.sentinel.port) }}
|
||||
-p {{ .Values.sentinel.port }} \
|
||||
{{- else }}
|
||||
-p {{ .Values.sentinel.tlsPort }} ${TLS_CLIENT_OPTION} \
|
||||
{{- end}}
|
||||
SENTINEL failover {{ $masterGroupName }}
|
||||
)
|
||||
if [[ "$response" != "OK" ]] ; then
|
||||
echo "$response"
|
||||
exit 1
|
||||
fi
|
||||
timeout=30
|
||||
while [[ "$is_master" -eq 1 && $timeout -gt 0 ]]; do
|
||||
sleep 1
|
||||
get_redis_role
|
||||
timeout=$((timeout - 1))
|
||||
done
|
||||
echo "Failover successful"
|
||||
fi
|
||||
{{- end }}
|
||||
|
||||
{{- define "fix-split-brain.sh" }}
|
||||
{{- include "vars.sh" . }}
|
||||
|
||||
ROLE=''
|
||||
REDIS_MASTER=''
|
||||
|
||||
set -eu
|
||||
|
||||
{{- include "lib.sh" . }}
|
||||
|
||||
redis_role() {
|
||||
set +e
|
||||
if [ "$REDIS_PORT" -eq 0 ]; then
|
||||
ROLE=$(redis-cli {{ if .Values.auth }} -a "${AUTH}" --no-auth-warning{{ end }} -p "${REDIS_TLS_PORT}" --tls --cacert /tls-certs/{{ .Values.tls.caCertFile }} {{ if ne (default "yes" .Values.sentinel.authClients) "no"}} --cert /tls-certs/{{ .Values.tls.certFile }} --key /tls-certs/{{ .Values.tls.keyFile }}{{ end }} info | grep role | sed 's/role://' | sed 's/\r//')
|
||||
else
|
||||
ROLE=$(redis-cli {{ if .Values.auth }} -a "${AUTH}" --no-auth-warning{{ end }} -p "${REDIS_PORT}" info | grep role | sed 's/role://' | sed 's/\r//')
|
||||
fi
|
||||
set -e
|
||||
}
|
||||
|
||||
identify_redis_master() {
|
||||
set +e
|
||||
if [ "$REDIS_PORT" -eq 0 ]; then
|
||||
REDIS_MASTER=$(redis-cli {{ if .Values.auth }} -a "${AUTH}" --no-auth-warning{{ end }} -p "${REDIS_TLS_PORT}" --tls --cacert /tls-certs/{{ .Values.tls.caCertFile }} {{ if ne (default "yes" .Values.sentinel.authClients) "no"}} --cert /tls-certs/{{ .Values.tls.certFile }} --key /tls-certs/{{ .Values.tls.keyFile }}{{ end }} info | grep master_host | sed 's/master_host://' | sed 's/\r//')
|
||||
else
|
||||
REDIS_MASTER=$(redis-cli {{ if .Values.auth }} -a "${AUTH}" --no-auth-warning{{ end }} -p "${REDIS_PORT}" info | grep master_host | sed 's/master_host://' | sed 's/\r//')
|
||||
fi
|
||||
set -e
|
||||
}
|
||||
|
||||
reinit() {
|
||||
set +e
|
||||
sh /readonly-config/init.sh
|
||||
|
||||
if [ "$REDIS_PORT" -eq 0 ]; then
|
||||
echo "shutdown" | redis-cli {{ if .Values.auth }} -a "${AUTH}" --no-auth-warning{{ end }} -p "${REDIS_TLS_PORT}" --tls --cacert /tls-certs/{{ .Values.tls.caCertFile }} {{ if ne (default "yes" .Values.sentinel.authClients) "no"}} --cert /tls-certs/{{ .Values.tls.certFile }} --key /tls-certs/{{ .Values.tls.keyFile }}{{ end }}
|
||||
else
|
||||
echo "shutdown" | redis-cli {{ if .Values.auth }} -a "${AUTH}" --no-auth-warning{{ end }} -p "${REDIS_PORT}"
|
||||
fi
|
||||
set -e
|
||||
}
|
||||
|
||||
identify_announce_ip
|
||||
|
||||
while [ -z "${ANNOUNCE_IP}" ]; do
|
||||
echo "Error: Could not resolve the announce ip for this pod."
|
||||
sleep 30
|
||||
identify_announce_ip
|
||||
done
|
||||
|
||||
while true; do
|
||||
sleep {{ .Values.splitBrainDetection.interval }}
|
||||
|
||||
# where is redis master
|
||||
identify_master
|
||||
|
||||
if [ "$MASTER" = "$ANNOUNCE_IP" ]; then
|
||||
redis_role
|
||||
if [ "$ROLE" != "master" ]; then
|
||||
reinit
|
||||
fi
|
||||
elif [ "${MASTER}" ]; then
|
||||
identify_redis_master
|
||||
if [ "$REDIS_MASTER" != "$MASTER" ]; then
|
||||
reinit
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
{{- end }}
|
||||
|
||||
{{- define "config-haproxy.cfg" }}
|
||||
{{- if .Values.haproxy.customConfig }}
|
||||
{{ tpl .Values.haproxy.customConfig . | indent 4 }}
|
||||
{{- else }}
|
||||
defaults REDIS
|
||||
mode tcp
|
||||
timeout connect {{ .Values.haproxy.timeout.connect }}
|
||||
timeout server {{ .Values.haproxy.timeout.server }}
|
||||
timeout client {{ .Values.haproxy.timeout.client }}
|
||||
timeout check {{ .Values.haproxy.timeout.check }}
|
||||
|
||||
listen health_check_http_url
|
||||
bind {{ if .Values.haproxy.IPv6.enabled }}[::]{{ end }}:8888 {{ if .Values.haproxy.IPv6.enabled }}v4v6{{ end }}
|
||||
mode http
|
||||
monitor-uri /healthz
|
||||
option dontlognull
|
||||
|
||||
{{- $root := . }}
|
||||
{{- $fullName := include "redis-ha.fullname" . }}
|
||||
{{- $replicas := int (toString .Values.replicas) }}
|
||||
{{- $masterGroupName := include "redis-ha.masterGroupName" . }}
|
||||
{{- range $i := until $replicas }}
|
||||
# Check Sentinel and whether they are nominated master
|
||||
backend check_if_redis_is_master_{{ $i }}
|
||||
mode tcp
|
||||
option tcp-check
|
||||
tcp-check connect
|
||||
{{- if $root.Values.sentinel.auth }}
|
||||
tcp-check send "AUTH ${SENTINELAUTH}"\r\n
|
||||
tcp-check expect string +OK
|
||||
{{- end }}
|
||||
tcp-check send PING\r\n
|
||||
tcp-check expect string +PONG
|
||||
tcp-check send SENTINEL\ get-master-addr-by-name\ {{ $masterGroupName }}\r\n
|
||||
tcp-check expect string REPLACE_ANNOUNCE{{ $i }}
|
||||
tcp-check send QUIT\r\n
|
||||
{{- range $i := until $replicas }}
|
||||
server R{{ $i }} {{ $fullName }}-announce-{{ $i }}:26379 check inter {{ $root.Values.haproxy.checkInterval }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
# decide redis backend to use
|
||||
#master
|
||||
frontend ft_redis_master
|
||||
{{- if .Values.haproxy.tls.enabled }}
|
||||
bind {{ if .Values.haproxy.IPv6.enabled }}[::]{{ end }}:{{ $root.Values.haproxy.containerPort }} ssl crt {{ .Values.haproxy.tls.certMountPath }}{{ .Values.haproxy.tls.keyName }} {{ if .Values.haproxy.IPv6.enabled }}v4v6{{ end }}
|
||||
{{ else }}
|
||||
bind {{ if .Values.haproxy.IPv6.enabled }}[::]{{ end }}:{{ $root.Values.redis.port }} {{ if .Values.haproxy.IPv6.enabled }}v4v6{{ end }}
|
||||
{{- end }}
|
||||
use_backend bk_redis_master
|
||||
{{- if .Values.haproxy.readOnly.enabled }}
|
||||
#slave
|
||||
frontend ft_redis_slave
|
||||
bind {{ if .Values.haproxy.IPv6.enabled }}[::]{{ end }}:{{ .Values.haproxy.readOnly.port }} {{ if .Values.haproxy.IPv6.enabled }}v4v6{{ end }}
|
||||
use_backend bk_redis_slave
|
||||
{{- end }}
|
||||
# Check all redis servers to see if they think they are master
|
||||
backend bk_redis_master
|
||||
{{- if .Values.haproxy.stickyBalancing }}
|
||||
balance source
|
||||
hash-type consistent
|
||||
{{- end }}
|
||||
mode tcp
|
||||
option tcp-check
|
||||
tcp-check connect
|
||||
{{- if .Values.auth }}
|
||||
tcp-check send "AUTH ${AUTH}"\r\n
|
||||
tcp-check expect string +OK
|
||||
{{- end }}
|
||||
tcp-check send PING\r\n
|
||||
tcp-check expect string +PONG
|
||||
tcp-check send info\ replication\r\n
|
||||
tcp-check expect string role:master
|
||||
tcp-check send QUIT\r\n
|
||||
tcp-check expect string +OK
|
||||
{{- range $i := until $replicas }}
|
||||
use-server R{{ $i }} if { srv_is_up(R{{ $i }}) } { nbsrv(check_if_redis_is_master_{{ $i }}) ge 2 }
|
||||
server R{{ $i }} {{ $fullName }}-announce-{{ $i }}:{{ $root.Values.redis.port }} check inter {{ $root.Values.haproxy.checkInterval }} fall {{ $root.Values.haproxy.checkFall }} rise 1
|
||||
{{- end }}
|
||||
{{- if .Values.haproxy.readOnly.enabled }}
|
||||
backend bk_redis_slave
|
||||
{{- if .Values.haproxy.stickyBalancing }}
|
||||
balance source
|
||||
hash-type consistent
|
||||
{{- end }}
|
||||
mode tcp
|
||||
option tcp-check
|
||||
tcp-check connect
|
||||
{{- if .Values.auth }}
|
||||
tcp-check send "AUTH ${AUTH}"\r\n
|
||||
tcp-check expect string +OK
|
||||
{{- end }}
|
||||
tcp-check send PING\r\n
|
||||
tcp-check expect string +PONG
|
||||
tcp-check send info\ replication\r\n
|
||||
tcp-check expect string role:slave
|
||||
tcp-check send QUIT\r\n
|
||||
tcp-check expect string +OK
|
||||
{{- range $i := until $replicas }}
|
||||
server R{{ $i }} {{ $fullName }}-announce-{{ $i }}:{{ $root.Values.redis.port }} check inter {{ $root.Values.haproxy.checkInterval }} fall {{ $root.Values.haproxy.checkFall }} rise 1
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.haproxy.metrics.enabled }}
|
||||
frontend stats
|
||||
mode http
|
||||
bind {{ if .Values.haproxy.IPv6.enabled }}[::]{{ end }}:{{ .Values.haproxy.metrics.port }} {{ if .Values.haproxy.IPv6.enabled }}v4v6{{ end }}
|
||||
http-request use-service prometheus-exporter if { path {{ .Values.haproxy.metrics.scrapePath }} }
|
||||
stats enable
|
||||
stats uri /stats
|
||||
stats refresh 10s
|
||||
{{- end }}
|
||||
{{- if .Values.haproxy.extraConfig }}
|
||||
# Additional configuration
|
||||
{{ .Values.haproxy.extraConfig | indent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{- define "config-haproxy_init.sh" }}
|
||||
HAPROXY_CONF=/data/haproxy.cfg
|
||||
cp /readonly/haproxy.cfg "$HAPROXY_CONF"
|
||||
{{- $fullName := include "redis-ha.fullname" . }}
|
||||
{{- $replicas := int (toString .Values.replicas) }}
|
||||
{{- range $i := until $replicas }}
|
||||
for loop in $(seq 1 10); do
|
||||
getent hosts {{ $fullName }}-announce-{{ $i }} && break
|
||||
echo "Waiting for service {{ $fullName }}-announce-{{ $i }} to be ready ($loop) ..." && sleep 1
|
||||
done
|
||||
ANNOUNCE_IP{{ $i }}=$(getent hosts "{{ $fullName }}-announce-{{ $i }}" | awk '{ print $1 }')
|
||||
if [ -z "$ANNOUNCE_IP{{ $i }}" ]; then
|
||||
echo "Could not resolve the announce ip for {{ $fullName }}-announce-{{ $i }}"
|
||||
exit 1
|
||||
fi
|
||||
sed -i "s/REPLACE_ANNOUNCE{{ $i }}/$ANNOUNCE_IP{{ $i }}/" "$HAPROXY_CONF"
|
||||
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "redis_liveness.sh" }}
|
||||
{{- if not (ne (int .Values.sentinel.port) 0) }}
|
||||
TLS_CLIENT_OPTION="--tls --cacert /tls-certs/{{ .Values.tls.caCertFile }}{{ if ne (default "yes" .Values.sentinel.authClients) "no"}} --cert /tls-certs/{{ .Values.tls.certFile }} --key /tls-certs/{{ .Values.tls.keyFile }}{{end}}"
|
||||
{{- end }}
|
||||
response=$(
|
||||
redis-cli \
|
||||
{{- if .Values.auth }}
|
||||
-a "${AUTH}" --no-auth-warning \
|
||||
{{- end }}
|
||||
-h localhost \
|
||||
{{- if ne (int .Values.redis.port) 0 }}
|
||||
-p {{ .Values.redis.port }} \
|
||||
{{- else }}
|
||||
-p {{ .Values.redis.tlsPort }} ${TLS_CLIENT_OPTION} \
|
||||
{{- end}}
|
||||
ping
|
||||
)
|
||||
if [ "$response" != "PONG" ] && [ "${response:0:7}" != "LOADING" ] ; then
|
||||
echo "$response"
|
||||
exit 1
|
||||
fi
|
||||
echo "response=$response"
|
||||
{{- end }}
|
||||
|
||||
{{- define "redis_readiness.sh" }}
|
||||
{{- if not (ne (int .Values.sentinel.port) 0) }}
|
||||
TLS_CLIENT_OPTION="--tls --cacert /tls-certs/{{ .Values.tls.caCertFile }}{{ if ne (default "yes" .Values.sentinel.authClients) "no"}} --cert /tls-certs/{{ .Values.tls.certFile }} --key /tls-certs/{{ .Values.tls.keyFile }}{{end}}"
|
||||
{{- end }}
|
||||
response=$(
|
||||
redis-cli \
|
||||
{{- if .Values.auth }}
|
||||
-a "${AUTH}" --no-auth-warning \
|
||||
{{- end }}
|
||||
-h localhost \
|
||||
{{- if ne (int .Values.redis.port) 0 }}
|
||||
-p {{ .Values.redis.port }} \
|
||||
{{- else }}
|
||||
-p {{ .Values.redis.tlsPort }} ${TLS_CLIENT_OPTION} \
|
||||
{{- end}}
|
||||
ping
|
||||
)
|
||||
if [ "$response" != "PONG" ] ; then
|
||||
echo "$response"
|
||||
exit 1
|
||||
fi
|
||||
echo "response=$response"
|
||||
{{- end }}
|
||||
|
||||
{{- define "sentinel_liveness.sh" }}
|
||||
{{- if not (ne (int .Values.sentinel.port) 0) }}
|
||||
TLS_CLIENT_OPTION="--tls --cacert /tls-certs/{{ .Values.tls.caCertFile }}{{ if ne (default "yes" .Values.sentinel.authClients) "no"}} --cert /tls-certs/{{ .Values.tls.certFile }} --key /tls-certs/{{ .Values.tls.keyFile }}{{end}}"
|
||||
{{- end }}
|
||||
response=$(
|
||||
redis-cli \
|
||||
{{- if .Values.sentinel.auth }}
|
||||
-a "${SENTINELAUTH}" --no-auth-warning \
|
||||
{{- end }}
|
||||
-h localhost \
|
||||
{{- if ne (int .Values.sentinel.port) 0 }}
|
||||
-p {{ .Values.sentinel.port }} \
|
||||
{{- else }}
|
||||
-p {{ .Values.sentinel.tlsPort }} ${TLS_CLIENT_OPTION} \
|
||||
{{- end}}
|
||||
ping
|
||||
)
|
||||
if [ "$response" != "PONG" ]; then
|
||||
echo "$response"
|
||||
exit 1
|
||||
fi
|
||||
echo "response=$response"
|
||||
{{- end }}
|
||||
|
||||
85
config/ks-core/charts/redis-ha/templates/_helpers.tpl
Normal file
85
config/ks-core/charts/redis-ha/templates/_helpers.tpl
Normal file
@@ -0,0 +1,85 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "redis-ha.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "redis-ha.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" | lower -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride | lower -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" | lower -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" | lower -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
{{- /*
|
||||
Credit: @technosophos
|
||||
https://github.com/technosophos/common-chart/
|
||||
labels.standard prints the standard Helm labels.
|
||||
The standard labels are frequently used in metadata.
|
||||
*/ -}}
|
||||
{{- define "labels.standard" -}}
|
||||
app: {{ template "redis-ha.name" . }}
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "chartref" . }}
|
||||
{{- end -}}
|
||||
|
||||
{{- /*
|
||||
Credit: @technosophos
|
||||
https://github.com/technosophos/common-chart/
|
||||
chartref prints a chart name and version.
|
||||
It does minimal escaping for use in Kubernetes labels.
|
||||
Example output:
|
||||
zookeeper-1.2.3
|
||||
wordpress-3.2.1_20170219
|
||||
*/ -}}
|
||||
{{- define "chartref" -}}
|
||||
{{- replace "+" "_" .Chart.Version | printf "%s-%s" .Chart.Name -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "redis-ha.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
{{ default (include "redis-ha.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "redis-ha.masterGroupName" -}}
|
||||
{{- $masterGroupName := tpl ( .Values.redis.masterGroupName | default "") . -}}
|
||||
{{- $validMasterGroupName := regexMatch "^[\\w-\\.]+$" $masterGroupName -}}
|
||||
{{- if $validMasterGroupName -}}
|
||||
{{ $masterGroupName }}
|
||||
{{- else -}}
|
||||
{{ required "A valid .Values.redis.masterGroupName entry is required (matching ^[\\w-\\.]+$)" ""}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for poddisruptionbudget.
|
||||
*/}}
|
||||
{{- define "redis-ha.podDisruptionBudget.apiVersion" -}}
|
||||
{{- if .Capabilities.APIVersions.Has "policy/v1" }}
|
||||
{{- print "policy/v1" -}}
|
||||
{{- else -}}
|
||||
{{- print "policy/v1beta1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
38
config/ks-core/charts/redis-ha/templates/_images.tpl
Normal file
38
config/ks-core/charts/redis-ha/templates/_images.tpl
Normal file
@@ -0,0 +1,38 @@
|
||||
{{/*
|
||||
Return the proper image name
|
||||
*/}}
|
||||
|
||||
{{- define "common.images.image" -}}
|
||||
{{- $registryName := .global.imageRegistry -}}
|
||||
{{- $repositoryName := .imageRoot.repository -}}
|
||||
{{- $separator := ":" -}}
|
||||
{{- $termination := .global.tag | toString -}}
|
||||
{{- if .imageRoot.registry }}
|
||||
{{- $registryName = .imageRoot.registry -}}
|
||||
{{- end -}}
|
||||
{{- if .imageRoot.tag }}
|
||||
{{- $termination = .imageRoot.tag | toString -}}
|
||||
{{- end -}}
|
||||
{{- if .imageRoot.digest }}
|
||||
{{- $separator = "@" -}}
|
||||
{{- $termination = .imageRoot.digest | toString -}}
|
||||
{{- end -}}
|
||||
{{- printf "%s/%s%s%s" $registryName $repositoryName $separator $termination -}}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
{{- define "image" -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "haproxy.image" -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.haproxy.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "sysctlImage" -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.sysctlImage "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "exporter.image" -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.exporter.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,15 @@
|
||||
{{- if and .Values.auth (not .Values.existingSecret) -}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "redis-ha.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{ include "labels.standard" . | indent 4 }}
|
||||
{{- range $key, $value := .Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{ .Values.authKey }}: {{ .Values.redisPassword | b64enc | quote }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,64 @@
|
||||
{{- $fullName := include "redis-ha.fullname" . }}
|
||||
{{- $namespace := .Release.Namespace -}}
|
||||
{{- $replicas := int (toString .Values.replicas) }}
|
||||
{{- $root := . }}
|
||||
{{- range $i := until $replicas }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ $fullName }}-announce-{{ $i }}
|
||||
namespace: {{ $namespace | quote}}
|
||||
labels:
|
||||
{{ include "labels.standard" $root | indent 4 }}
|
||||
{{- range $key, $value := $root.Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
{{- if (semverCompare "<=1.10-0" $.Capabilities.KubeVersion.GitVersion) }}
|
||||
service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
|
||||
{{- end }}
|
||||
{{- if $root.Values.serviceAnnotations }}
|
||||
{{ toYaml $root.Values.serviceAnnotations | indent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if (semverCompare ">=1.11-0" $.Capabilities.KubeVersion.GitVersion) }}
|
||||
publishNotReadyAddresses: true
|
||||
{{- end }}
|
||||
type: ClusterIP
|
||||
ports:
|
||||
{{- if ne (int $root.Values.redis.port) 0 }}
|
||||
- name: tcp-server
|
||||
port: {{ $root.Values.redis.port }}
|
||||
protocol: TCP
|
||||
targetPort: redis
|
||||
{{- end }}
|
||||
{{- if $root.Values.redis.tlsPort }}
|
||||
- name: server-tls
|
||||
port: {{ $root.Values.redis.tlsPort }}
|
||||
protocol: TCP
|
||||
targetPort: redis-tls
|
||||
{{- end }}
|
||||
{{- if ne (int $root.Values.sentinel.port) 0 }}
|
||||
- name: tcp-sentinel
|
||||
port: {{ $root.Values.sentinel.port }}
|
||||
protocol: TCP
|
||||
targetPort: sentinel
|
||||
{{- end }}
|
||||
{{- if $root.Values.sentinel.tlsPort }}
|
||||
- name: sentinel-tls
|
||||
port: {{ $root.Values.sentinel.tlsPort }}
|
||||
protocol: TCP
|
||||
targetPort: sentinel-tls
|
||||
{{- end }}
|
||||
{{- if $root.Values.exporter.enabled }}
|
||||
- name: http-exporter
|
||||
port: {{ $root.Values.exporter.port }}
|
||||
protocol: TCP
|
||||
targetPort: {{ $root.Values.exporter.portName }}
|
||||
{{- end }}
|
||||
selector:
|
||||
release: {{ $root.Release.Name }}
|
||||
app: {{ include "redis-ha.name" $root }}
|
||||
"statefulset.kubernetes.io/pod-name": {{ $fullName }}-server-{{ $i }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,37 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "redis-ha.fullname" . }}-configmap
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service }}
|
||||
release: {{ .Release.Name }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
|
||||
app: {{ template "redis-ha.fullname" . }}
|
||||
{{- range $key, $value := .Values.configmap.labels }}
|
||||
{{ $key }}: {{ $value | toString }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
data:
|
||||
redis.conf: |
|
||||
{{- include "config-redis.conf" . }}
|
||||
|
||||
sentinel.conf: |
|
||||
{{- include "config-sentinel.conf" . }}
|
||||
|
||||
init.sh: |
|
||||
{{- include "config-init.sh" . }}
|
||||
|
||||
fix-split-brain.sh: |
|
||||
{{- include "fix-split-brain.sh" . }}
|
||||
|
||||
{{ if .Values.haproxy.enabled }}
|
||||
haproxy.cfg: |
|
||||
{{- include "config-haproxy.cfg" . }}
|
||||
{{- end }}
|
||||
haproxy_init.sh: |
|
||||
{{- include "config-haproxy_init.sh" . }}
|
||||
trigger-failover-if-master.sh: |
|
||||
{{- include "trigger-failover-if-master.sh" . }}
|
||||
@@ -0,0 +1,14 @@
|
||||
{{- if .Values.exporter.script }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "redis-ha.fullname" . }}-exporter-script-configmap
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{ include "labels.standard" . | indent 4 }}
|
||||
{{- range $key, $value := .Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
data:
|
||||
script: {{ toYaml .Values.exporter.script | indent 2 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "redis-ha.fullname" . }}-health-configmap
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service }}
|
||||
release: {{ .Release.Name }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
|
||||
app: {{ template "redis-ha.fullname" . }}
|
||||
{{- range $key, $value := .Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
data:
|
||||
redis_liveness.sh: |
|
||||
{{- include "redis_liveness.sh" . }}
|
||||
redis_readiness.sh: |
|
||||
{{- include "redis_readiness.sh" . }}
|
||||
sentinel_liveness.sh: |
|
||||
{{- include "sentinel_liveness.sh" . }}
|
||||
@@ -0,0 +1,87 @@
|
||||
{{- if .Values.networkPolicy.enabled }}
|
||||
{{- $root := . }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: networking.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "redis-ha.fullname" . }}-network-policy
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
{{- if .Values.networkPolicy.annotations }}
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.networkPolicy.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{ include "labels.standard" . | indent 4 }}
|
||||
{{- range $key, $value := .Values.networkPolicy.labels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
release: {{ .Release.Name }}
|
||||
app: {{ template "redis-ha.name" . }}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
egress:
|
||||
- to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
release: {{ .Release.Name }}
|
||||
app: {{ template "redis-ha.name" . }}
|
||||
ports:
|
||||
- port: {{ .Values.redis.port }}
|
||||
protocol: TCP
|
||||
- port: {{ .Values.sentinel.port }}
|
||||
protocol: TCP
|
||||
- to:
|
||||
- namespaceSelector: {}
|
||||
ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
{{- range $rule := .Values.networkPolicy.egressRules }}
|
||||
- to:
|
||||
{{ (tpl (toYaml $rule.selectors) $) | indent 7 }}
|
||||
ports:
|
||||
{{ toYaml $rule.ports | indent 7 }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
release: {{ .Release.Name }}
|
||||
app: {{ template "redis-ha.name" . }}
|
||||
ports:
|
||||
- port: {{ .Values.redis.port }}
|
||||
protocol: TCP
|
||||
- port: {{ .Values.sentinel.port }}
|
||||
protocol: TCP
|
||||
{{- if .Values.haproxy.enabled }}
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
release: {{ .Release.Name }}
|
||||
app: {{ template "redis-ha.name" . }}-haproxy
|
||||
ports:
|
||||
- port: {{ .Values.redis.port }}
|
||||
protocol: TCP
|
||||
- port: {{ .Values.sentinel.port }}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- range $rule := .Values.networkPolicy.ingressRules }}
|
||||
- from:
|
||||
{{ (tpl (toYaml $rule.selectors) $) | indent 7 }}
|
||||
ports:
|
||||
{{- if $rule.ports }}
|
||||
{{ toYaml $rule.ports | indent 7 }}
|
||||
{{- else }}
|
||||
- port: {{ $root.Values.redis.port }}
|
||||
protocol: TCP
|
||||
- port: {{ $root.Values.sentinel.port }}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
21
config/ks-core/charts/redis-ha/templates/redis-ha-pdb.yaml
Normal file
21
config/ks-core/charts/redis-ha/templates/redis-ha-pdb.yaml
Normal file
@@ -0,0 +1,21 @@
|
||||
{{- if .Values.podDisruptionBudget -}}
|
||||
apiVersion: {{ template "redis-ha.podDisruptionBudget.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ template "redis-ha.fullname" . }}-pdb
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{ include "labels.standard" . | indent 4 }}
|
||||
{{- range $key, $value := .Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
# The replica label is set on StatefulSet pods but not the Test pods
|
||||
# We want to avoid including the Test pods in the budget
|
||||
{{ template "redis-ha.fullname" . }}: replica
|
||||
release: {{ .Release.Name }}
|
||||
app: {{ template "redis-ha.name" . }}
|
||||
{{ toYaml .Values.podDisruptionBudget | indent 2 }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,17 @@
|
||||
{{- if .Values.prometheusRule.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PrometheusRule
|
||||
metadata:
|
||||
name: {{ template "redis-ha.fullname" . }}
|
||||
{{- if .Values.prometheusRule.namespace }}
|
||||
namespace: {{ .Values.prometheusRule.namespace }}
|
||||
{{- end }}
|
||||
labels: {{- toYaml .Values.prometheusRule.additionalLabels | nindent 4 }}
|
||||
spec:
|
||||
groups:
|
||||
- name: {{ template "redis-ha.fullname" . }}
|
||||
{{- if .Values.prometheusRule.interval }}
|
||||
interval: {{ .Values.prometheusRule.interval }}
|
||||
{{- end }}
|
||||
rules: {{- tpl (toYaml .Values.prometheusRule.rules) . | nindent 8 }}
|
||||
{{- end }}
|
||||
19
config/ks-core/charts/redis-ha/templates/redis-ha-role.yaml
Normal file
19
config/ks-core/charts/redis-ha/templates/redis-ha-role.yaml
Normal file
@@ -0,0 +1,19 @@
|
||||
{{- if and .Values.serviceAccount.create .Values.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "redis-ha.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{ include "labels.standard" . | indent 4 }}
|
||||
{{- range $key, $value := .Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
{{- end }}
|
||||
@@ -0,0 +1,19 @@
|
||||
{{- if and .Values.serviceAccount.create .Values.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "redis-ha.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{ include "labels.standard" . | indent 4 }}
|
||||
{{- range $key, $value := .Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "redis-ha.serviceAccountName" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "redis-ha.fullname" . }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,32 @@
|
||||
{{- if not .Values.restore.existingSecret }}
|
||||
|
||||
|
||||
{{- $regexRestoreS3 := "^s3://.+|^S3://.+" -}}
|
||||
{{- $regexRestoreSSH := "^.+@.+:.+" -}}
|
||||
|
||||
{{- if or (regexFind $regexRestoreSSH (toString .Values.restore.ssh.source)) (regexFind $regexRestoreS3 (toString .Values.restore.s3.source)) }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "redis-ha.fullname" . }}-secret
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service }}
|
||||
release: {{ .Release.Name }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
|
||||
app: {{ template "redis-ha.fullname" . }}
|
||||
{{- range $key, $value := .Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{- if regexFind $regexRestoreSSH (toString .Values.restore.ssh.source) }}
|
||||
SSH_KEY: "{{ .Values.restore.ssh.key | b64enc }}"
|
||||
{{- end }}
|
||||
{{- if regexFind $regexRestoreS3 (toString .Values.restore.s3.source) }}
|
||||
AWS_SECRET_ACCESS_KEY: "{{ .Values.restore.s3.secret_key | b64enc }}"
|
||||
AWS_ACCESS_KEY_ID: "{{ .Values.restore.s3.access_key | b64enc }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
@@ -0,0 +1,57 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "redis-ha.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{ include "labels.standard" . | indent 4 }}
|
||||
{{- if .Values.exporter.enabled }}
|
||||
exporter: enabled
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.serviceLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
{{- if .Values.serviceAnnotations }}
|
||||
{{ toYaml .Values.serviceAnnotations | indent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
ports:
|
||||
{{- if ne (int .Values.redis.port) 0 }}
|
||||
- name: tcp-server
|
||||
port: {{ .Values.redis.port }}
|
||||
protocol: TCP
|
||||
targetPort: redis
|
||||
{{- end }}
|
||||
{{- if .Values.redis.tlsPort }}
|
||||
- name: server-tls
|
||||
port: {{ .Values.redis.tlsPort }}
|
||||
protocol: TCP
|
||||
targetPort: redis-tls
|
||||
{{- end }}
|
||||
{{- if ne (int .Values.sentinel.port) 0 }}
|
||||
- name: tcp-sentinel
|
||||
port: {{ .Values.sentinel.port }}
|
||||
protocol: TCP
|
||||
targetPort: sentinel
|
||||
{{- end }}
|
||||
{{- if .Values.sentinel.tlsPort }}
|
||||
- name: sentinel-tls
|
||||
port: {{ .Values.sentinel.tlsPort }}
|
||||
protocol: TCP
|
||||
targetPort: sentinel-tls
|
||||
{{- end }}
|
||||
{{- if .Values.exporter.enabled }}
|
||||
- name: http-exporter-port
|
||||
port: {{ .Values.exporter.port }}
|
||||
protocol: TCP
|
||||
targetPort: {{ .Values.exporter.portName }}
|
||||
{{- end }}
|
||||
selector:
|
||||
release: {{ .Release.Name }}
|
||||
app: {{ template "redis-ha.name" . }}
|
||||
@@ -0,0 +1,27 @@
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "redis-ha.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service }}
|
||||
release: {{ .Release.Name }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
|
||||
app: {{ template "redis-ha.fullname" . }}
|
||||
{{- range $key, $value := .Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if or .Values.auth .Values.sentinel.auth }}
|
||||
secrets:
|
||||
{{- end }}
|
||||
{{- if .Values.auth }}
|
||||
- name: {{ default (include "redis-ha.fullname" .) .Values.existingSecret }}
|
||||
{{- end }}
|
||||
{{- if .Values.sentinel.auth }}
|
||||
- name: {{ default (printf "%s-sentinel" (include "redis-ha.fullname" .)) .Values.sentinel.existingSecret }}
|
||||
{{- end }}
|
||||
{{- if .Values.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 0 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,39 @@
|
||||
{{- if and ( .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" ) ( .Values.exporter.serviceMonitor.enabled ) ( .Values.exporter.enabled ) }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ template "redis-ha.fullname" . }}
|
||||
namespace: {{ .Values.exporter.serviceMonitor.namespace | default .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{ include "labels.standard" . | indent 4 }}
|
||||
{{- range $key, $value := .Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.exporter.serviceMonitor.labels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
endpoints:
|
||||
- targetPort: {{ .Values.exporter.port }}
|
||||
{{- if .Values.exporter.serviceMonitor.interval }}
|
||||
interval: {{ .Values.exporter.serviceMonitor.interval }}
|
||||
{{- end }}
|
||||
{{- if .Values.exporter.serviceMonitor.telemetryPath }}
|
||||
path: {{ .Values.exporter.serviceMonitor.telemetryPath }}
|
||||
{{- end }}
|
||||
{{- if .Values.exporter.serviceMonitor.timeout }}
|
||||
scrapeTimeout: {{ .Values.exporter.serviceMonitor.timeout }}
|
||||
{{- end }}
|
||||
{{- with .Values.exporter.serviceMonitor.endpointAdditionalProperties }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
jobLabel: {{ template "redis-ha.fullname" . }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ .Release.Namespace | quote }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "redis-ha.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
exporter: enabled
|
||||
{{- end }}
|
||||
@@ -0,0 +1,590 @@
|
||||
{{- $regexRestoreS3 := "^s3://.+|^S3://.+" -}}
|
||||
{{- $regexRestoreSSH := "^.+@.+:.+" -}}
|
||||
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ template "redis-ha.fullname" . }}-server
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{ template "redis-ha.fullname" . }}: replica
|
||||
{{- range $key, $value := .Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{ include "labels.standard" . | indent 4 }}
|
||||
annotations:
|
||||
{{ toYaml .Values.redis.annotations | indent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
release: {{ .Release.Name }}
|
||||
app: {{ template "redis-ha.name" . }}
|
||||
serviceName: {{ template "redis-ha.fullname" . }}
|
||||
replicas: {{ .Values.replicas }}
|
||||
podManagementPolicy: {{ .Values.podManagementPolicy }}
|
||||
updateStrategy:
|
||||
type: {{ .Values.redis.updateStrategy.type }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/init-config: {{ print (include "config-redis.conf" .) (include "config-sentinel.conf" .) (include "config-init.sh" .) (include "fix-split-brain.sh" .) (include "redis_liveness.sh" .) (include "redis_readiness.sh" .) (include "sentinel_liveness.sh" .) (include "trigger-failover-if-master.sh" .)| sha256sum }}
|
||||
{{- if .Values.podAnnotations }}
|
||||
{{ toYaml .Values.podAnnotations | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if and (.Values.exporter.enabled) (not .Values.exporter.serviceMonitor.enabled) }}
|
||||
prometheus.io/port: "{{ .Values.exporter.port }}"
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/path: {{ .Values.exporter.scrapePath }}
|
||||
{{- end }}
|
||||
labels:
|
||||
release: {{ .Release.Name }}
|
||||
app: {{ template "redis-ha.name" . }}
|
||||
{{ template "redis-ha.fullname" . }}: replica
|
||||
{{- range $key, $value := .Values.labels }}
|
||||
{{ $key }}: {{ $value | toString }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.redis.terminationGracePeriodSeconds }}
|
||||
terminationGracePeriodSeconds: {{ .Values.redis.terminationGracePeriodSeconds }}
|
||||
{{- end }}
|
||||
{{- if .Values.schedulerName }}
|
||||
schedulerName: "{{ .Values.schedulerName }}"
|
||||
{{- end }}
|
||||
{{- if .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml .Values.nodeSelector | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml .Values.tolerations | indent 8 }}
|
||||
{{- end }}
|
||||
affinity:
|
||||
{{- if .Values.affinity }}
|
||||
{{- with .Values.affinity }}
|
||||
{{ tpl . $ | indent 8 }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- if .Values.additionalAffinities }}
|
||||
{{ toYaml .Values.additionalAffinities | indent 8 }}
|
||||
{{- end }}
|
||||
podAntiAffinity:
|
||||
{{- if .Values.hardAntiAffinity }}
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels:
|
||||
app: {{ template "redis-ha.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
{{ template "redis-ha.fullname" . }}: replica
|
||||
topologyKey: kubernetes.io/hostname
|
||||
{{- else }}
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app: {{ template "redis-ha.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
{{ template "redis-ha.fullname" . }}: replica
|
||||
topologyKey: kubernetes.io/hostname
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.topologySpreadConstraints.enabled }}
|
||||
topologySpreadConstraints:
|
||||
- maxSkew: {{ .Values.topologySpreadConstraints.maxSkew | default 1 }}
|
||||
topologyKey: {{ .Values.topologySpreadConstraints.topologyKey | default "topology.kubernetes.io/zone" }}
|
||||
whenUnsatisfiable: {{ .Values.topologySpreadConstraints.whenUnsatisfiable | default "ScheduleAnyway" }}
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app: {{ template "redis-ha.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
{{ template "redis-ha.fullname" . }}: replica
|
||||
{{- end }}
|
||||
{{- if .Values.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 8 }}
|
||||
{{- end }}
|
||||
securityContext: {{ toYaml .Values.securityContext | nindent 8 }}
|
||||
serviceAccountName: {{ template "redis-ha.serviceAccountName" . }}
|
||||
automountServiceAccountToken: {{ .Values.serviceAccount.automountToken }}
|
||||
initContainers:
|
||||
{{- if .Values.sysctlImage.enabled }}
|
||||
- name: init-sysctl
|
||||
image: {{ template "sysctlImage" . }}
|
||||
imagePullPolicy: {{ .Values.sysctlImage.pullPolicy }}
|
||||
resources: {{ toYaml .Values.sysctlImage.resources | nindent 10 }}
|
||||
{{- if .Values.sysctlImage.mountHostSys }}
|
||||
volumeMounts:
|
||||
- name: host-sys
|
||||
mountPath: /host-sys
|
||||
{{- end }}
|
||||
command: {{ toYaml .Values.sysctlImage.command | nindent 10 }}
|
||||
securityContext: {{ toYaml .Values.containerSecurityContext | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if and .Values.hostPath.path .Values.hostPath.chown }}
|
||||
- name: hostpath-chown
|
||||
image: {{ template "image" . }}
|
||||
securityContext: {{ toYaml .Values.containerSecurityContext | nindent 10 }}
|
||||
command:
|
||||
- chown
|
||||
- "{{ .Values.containerSecurityContext.runAsUser }}"
|
||||
- /data
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- end }}
|
||||
- name: config-init
|
||||
image: {{ template "image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
resources:
|
||||
{{ toYaml .Values.init.resources | indent 10 }}
|
||||
command:
|
||||
- sh
|
||||
args:
|
||||
- /readonly-config/init.sh
|
||||
securityContext: {{ toYaml .Values.containerSecurityContext | nindent 10 }}
|
||||
env:
|
||||
{{- $replicas := int (toString .Values.replicas) -}}
|
||||
{{- range $i := until $replicas }}
|
||||
- name: SENTINEL_ID_{{ $i }}
|
||||
value: {{ printf "%s\n%s\nindex: %d" (include "redis-ha.name" $) ($.Release.Name) $i | sha256sum | trunc 40 }}
|
||||
{{- end }}
|
||||
{{- if .Values.auth }}
|
||||
- name: AUTH
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.existingSecret }}
|
||||
name: {{ .Values.existingSecret }}
|
||||
{{- else }}
|
||||
name: {{ template "redis-ha.fullname" . }}
|
||||
{{- end }}
|
||||
key: {{ .Values.authKey }}
|
||||
{{- end }}
|
||||
{{- if .Values.sentinel.auth }}
|
||||
- name: SENTINELAUTH
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.sentinel.existingSecret }}
|
||||
name: {{ .Values.sentinel.existingSecret }}
|
||||
{{- else }}
|
||||
name: {{ template "redis-ha.fullname" . }}-sentinel
|
||||
{{- end }}
|
||||
key: {{ .Values.sentinel.authKey }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /readonly-config
|
||||
readOnly: true
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if .Values.redis.tlsPort }}
|
||||
- mountPath: /tls-certs
|
||||
name: tls-certs
|
||||
{{- end}}
|
||||
{{ if regexFind $regexRestoreS3 (toString .Values.restore.s3.source) }}
|
||||
- name: restore-s3
|
||||
image: s3cmd/s3cmd:latest
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
resources:
|
||||
{{ toYaml .Values.init.resources | indent 10 }}
|
||||
command:
|
||||
- sh
|
||||
args:
|
||||
- "-c"
|
||||
- "timeout -t {{ .Values.restore.timeout }} \
|
||||
s3cmd get {{ if .Values.restore.s3.region }}--region {{ .Values.restore.s3.region }} {{ end }}--force '{{ .Values.restore.s3.source }}' /data/dump.rdb_ \
|
||||
&& test -s /data/dump.rdb_ \
|
||||
&& if test -s /data/dump.rdb; \
|
||||
then cp -v /data/dump.rdb /data/dump.rdb_orig; fi \
|
||||
&& mv -v /data/dump.rdb_ /data/dump.rdb"
|
||||
envFrom:
|
||||
- secretRef:
|
||||
{{- if .Values.restore.existingSecret }}
|
||||
name: {{ .Values.existingSecret }}
|
||||
{{- else }}
|
||||
name: {{ include "redis-ha.fullname" . }}-secret
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- end }}
|
||||
{{ if regexFind $regexRestoreSSH (toString .Values.restore.ssh.source) }}
|
||||
- name: restore-ssh
|
||||
image: lgatica/openssh-client:latest
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
resources:
|
||||
{{ toYaml .Values.init.resources | indent 10 }}
|
||||
command:
|
||||
- sh
|
||||
args:
|
||||
- "-c"
|
||||
- "rm -f key && echo -e \"${SSH_KEY}\" >key \
|
||||
&& chmod 400 key \
|
||||
&& timeout {{ .Values.restore.timeout }} \
|
||||
scp -i key \
|
||||
-o StrictHostKeyChecking=no \
|
||||
-o UserKnownHostsFile=/dev/null \
|
||||
'{{ .Values.restore.ssh.source }}' \
|
||||
/data/dump.rdb_ \
|
||||
&& test -s /data/dump.rdb_ \
|
||||
&& if test -s /data/dump.rdb; \
|
||||
then cp -v /data/dump.rdb /data/dump.rdb_orig; fi \
|
||||
&& mv -v /data/dump.rdb_ /data/dump.rdb"
|
||||
securityContext: {{ toYaml .Values.containerSecurityContext | nindent 10 }}
|
||||
envFrom:
|
||||
- secretRef:
|
||||
{{- if .Values.restore.existingSecret }}
|
||||
name: {{ .Values.existingSecret }}
|
||||
{{- else }}
|
||||
name: {{ include "redis-ha.fullname" . }}-secret
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- end }}
|
||||
{{- if .Values.extraInitContainers }}
|
||||
{{- toYaml .Values.extraInitContainers | nindent 6 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: redis
|
||||
image: {{ template "image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command:
|
||||
- redis-server
|
||||
args:
|
||||
- /data/conf/redis.conf
|
||||
securityContext: {{ toYaml .Values.containerSecurityContext | nindent 10 }}
|
||||
{{- if .Values.auth }}
|
||||
env:
|
||||
- name: AUTH
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.existingSecret }}
|
||||
name: {{ .Values.existingSecret }}
|
||||
{{- else }}
|
||||
name: {{ template "redis-ha.fullname" . }}
|
||||
{{- end }}
|
||||
key: {{ .Values.authKey }}
|
||||
{{- end }}
|
||||
livenessProbe:
|
||||
initialDelaySeconds: {{ .Values.redis.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.redis.livenessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.redis.livenessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.redis.livenessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.redis.livenessProbe.failureThreshold }}
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- /health/redis_liveness.sh
|
||||
readinessProbe:
|
||||
initialDelaySeconds: {{ .Values.redis.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.redis.readinessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.redis.readinessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.redis.readinessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.redis.readinessProbe.failureThreshold }}
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- /health/redis_readiness.sh
|
||||
resources:
|
||||
{{ toYaml .Values.redis.resources | indent 10 }}
|
||||
ports:
|
||||
{{- if ne (int .Values.redis.port) 0 }}
|
||||
- name: redis
|
||||
containerPort: {{ .Values.redis.port }}
|
||||
{{- end }}
|
||||
{{- if .Values.redis.tlsPort }}
|
||||
- name: redis-tls
|
||||
containerPort: {{ .Values.redis.tlsPort }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /readonly-config
|
||||
readOnly: true
|
||||
- mountPath: /data
|
||||
name: data
|
||||
{{- if .Values.redis.tlsPort }}
|
||||
- mountPath: /tls-certs
|
||||
name: tls-certs
|
||||
{{- end}}
|
||||
- mountPath: /health
|
||||
name: health
|
||||
{{- if .Values.redis.extraVolumeMounts }}
|
||||
{{- toYaml .Values.redis.extraVolumeMounts | nindent 8 }}
|
||||
{{- end }}
|
||||
lifecycle:
|
||||
{{ toYaml .Values.redis.lifecycle | indent 10 }}
|
||||
- name: sentinel
|
||||
image: {{ template "image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command:
|
||||
- redis-sentinel
|
||||
args:
|
||||
- /data/conf/sentinel.conf
|
||||
securityContext: {{ toYaml .Values.containerSecurityContext | nindent 10 }}
|
||||
{{- if or .Values.auth .Values.sentinel.auth}}
|
||||
env:
|
||||
{{- if .Values.auth }}
|
||||
- name: AUTH
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.existingSecret }}
|
||||
name: {{ .Values.existingSecret }}
|
||||
{{- else }}
|
||||
name: {{ template "redis-ha.fullname" . }}
|
||||
{{- end }}
|
||||
key: {{ .Values.authKey }}
|
||||
{{- end }}
|
||||
{{- if .Values.sentinel.auth }}
|
||||
- name: SENTINELAUTH
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.sentinel.existingSecret }}
|
||||
name: {{ .Values.sentinel.existingSecret }}
|
||||
{{- else }}
|
||||
name: {{ template "redis-ha.fullname" . }}-sentinel
|
||||
{{- end }}
|
||||
key: {{ .Values.sentinel.authKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
livenessProbe:
|
||||
initialDelaySeconds: {{ .Values.sentinel.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.sentinel.livenessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.sentinel.livenessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.sentinel.livenessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.sentinel.livenessProbe.failureThreshold }}
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- /health/sentinel_liveness.sh
|
||||
readinessProbe:
|
||||
initialDelaySeconds: {{ .Values.sentinel.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.sentinel.readinessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.sentinel.readinessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.sentinel.readinessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.sentinel.readinessProbe.failureThreshold }}
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- /health/sentinel_liveness.sh
|
||||
resources:
|
||||
{{ toYaml .Values.sentinel.resources | indent 10 }}
|
||||
ports:
|
||||
{{- if ne (int .Values.sentinel.port) 0 }}
|
||||
- name: sentinel
|
||||
containerPort: {{ .Values.sentinel.port }}
|
||||
{{- end }}
|
||||
{{- if .Values.sentinel.tlsPort }}
|
||||
- name: sentinel-tls
|
||||
containerPort: {{ .Values.sentinel.tlsPort }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- mountPath: /data
|
||||
name: data
|
||||
{{- if .Values.redis.tlsPort }}
|
||||
- mountPath: /tls-certs
|
||||
name: tls-certs
|
||||
{{- end }}
|
||||
- mountPath: /health
|
||||
name: health
|
||||
{{- if .Values.sentinel.extraVolumeMounts }}
|
||||
{{- toYaml .Values.sentinel.extraVolumeMounts | nindent 8 }}
|
||||
{{- end }}
|
||||
lifecycle:
|
||||
{{ toYaml .Values.sentinel.lifecycle | indent 10 }}
|
||||
|
||||
- name: split-brain-fix
|
||||
image: {{ template "image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command:
|
||||
- sh
|
||||
args:
|
||||
- /readonly-config/fix-split-brain.sh
|
||||
securityContext: {{ toYaml .Values.containerSecurityContext | nindent 10 }}
|
||||
env:
|
||||
{{- $replicas := int (toString .Values.replicas) -}}
|
||||
{{- range $i := until $replicas }}
|
||||
- name: SENTINEL_ID_{{ $i }}
|
||||
value: {{ printf "%s\n%s\nindex: %d" (include "redis-ha.name" $) ($.Release.Name) $i | sha256sum | trunc 40 }}
|
||||
{{- end }}
|
||||
{{- if .Values.auth }}
|
||||
- name: AUTH
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.existingSecret }}
|
||||
name: {{ .Values.existingSecret }}
|
||||
{{- else }}
|
||||
name: {{ template "redis-ha.fullname" . }}
|
||||
{{- end }}
|
||||
key: {{ .Values.authKey }}
|
||||
{{- end }}
|
||||
{{- if .Values.sentinel.auth }}
|
||||
- name: SENTINELAUTH
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.sentinel.existingSecret }}
|
||||
name: {{ .Values.sentinel.existingSecret }}
|
||||
{{- else }}
|
||||
name: {{ template "redis-ha.fullname" . }}-sentinel
|
||||
{{- end }}
|
||||
key: {{ .Values.sentinel.authKey }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.splitBrainDetection.resources | nindent 10 }}
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /readonly-config
|
||||
readOnly: true
|
||||
- mountPath: /data
|
||||
name: data
|
||||
{{- if .Values.redis.tlsPort }}
|
||||
- mountPath: /tls-certs
|
||||
name: tls-certs
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.exporter.enabled }}
|
||||
- name: redis-exporter
|
||||
image: {{ template "exporter.image" . }}
|
||||
imagePullPolicy: {{ .Values.exporter.pullPolicy }}
|
||||
args:
|
||||
{{- range $key, $value := .Values.exporter.extraArgs }}
|
||||
- --{{ $key }}={{ $value }}
|
||||
{{- end }}
|
||||
securityContext: {{ toYaml .Values.containerSecurityContext | nindent 10 }}
|
||||
env:
|
||||
- name: REDIS_ADDR
|
||||
{{- if .Values.exporter.sslEnabled }}
|
||||
value: rediss://{{ default "localhost" .Values.exporter.address }}:{{ .Values.redis.tlsPort }}
|
||||
{{- else }}
|
||||
value: redis://{{ default "localhost" .Values.exporter.address }}:{{ .Values.redis.port }}
|
||||
{{- end }}
|
||||
{{- if .Values.auth }}
|
||||
- name: REDIS_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.existingSecret }}
|
||||
name: {{ .Values.existingSecret }}
|
||||
{{- else }}
|
||||
name: {{ template "redis-ha.fullname" . }}
|
||||
{{- end }}
|
||||
key: {{ .Values.authKey }}
|
||||
{{- end }}
|
||||
{{- if .Values.exporter.script }}
|
||||
- name: REDIS_EXPORTER_SCRIPT
|
||||
value: /script/script.lua
|
||||
{{- end }}
|
||||
{{- if .Values.exporter.sslEnabled }}
|
||||
- name: REDIS_EXPORTER_TLS_CLIENT_KEY_FILE
|
||||
value: /tls-certs/{{ .Values.tls.keyFile }}
|
||||
- name: REDIS_EXPORTER_TLS_CLIENT_CERT_FILE
|
||||
value: /tls-certs/{{ .Values.tls.certFile }}
|
||||
- name: REDIS_EXPORTER_TLS_CA_CERT_FILE
|
||||
value: /tls-certs/{{ .Values.tls.caCertFile }}
|
||||
{{- end }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.exporter.scrapePath }}
|
||||
port: {{ .Values.exporter.port }}
|
||||
initialDelaySeconds: {{ .Values.exporter.livenessProbe.initialDelaySeconds }}
|
||||
timeoutSeconds: {{ .Values.exporter.livenessProbe.timeoutSeconds }}
|
||||
periodSeconds: {{ .Values.exporter.livenessProbe.periodSeconds }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.exporter.scrapePath }}
|
||||
port: {{ .Values.exporter.port }}
|
||||
initialDelaySeconds: {{ .Values.exporter.readinessProbe.initialDelaySeconds }}
|
||||
timeoutSeconds: {{ .Values.exporter.readinessProbe.timeoutSeconds }}
|
||||
periodSeconds: {{ .Values.exporter.readinessProbe.periodSeconds }}
|
||||
resources:
|
||||
{{ toYaml .Values.exporter.resources | indent 10 }}
|
||||
ports:
|
||||
- name: {{ .Values.exporter.portName }}
|
||||
containerPort: {{ .Values.exporter.port }}
|
||||
volumeMounts:
|
||||
{{- if .Values.exporter.script }}
|
||||
- mountPath: /script
|
||||
name: script-mount
|
||||
{{- end }}
|
||||
{{- if .Values.exporter.sslEnabled }}
|
||||
- mountPath: /tls-certs
|
||||
name: tls-certs
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraContainers }}
|
||||
{{- toYaml .Values.extraContainers | nindent 6 }}
|
||||
{{- end -}}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: {{ .Values.priorityClassName }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ template "redis-ha.fullname" . }}-configmap
|
||||
{{- if .Values.sysctlImage.mountHostSys }}
|
||||
- name: host-sys
|
||||
hostPath:
|
||||
path: /sys
|
||||
{{- end }}
|
||||
{{- if .Values.exporter.script }}
|
||||
- name: script-mount
|
||||
configMap:
|
||||
name: {{ template "redis-ha.fullname" . }}-exporter-script-configmap
|
||||
items:
|
||||
- key: script
|
||||
path: script.lua
|
||||
{{- end }}
|
||||
{{- if .Values.redis.tlsPort }}
|
||||
- name: tls-certs
|
||||
secret:
|
||||
{{- if .Values.tls.secretName }}
|
||||
secretName: {{ .Values.tls.secretName }}
|
||||
{{- else }}
|
||||
secretName: {{ template "redis-ha.fullname" . }}-tls-secret
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: health
|
||||
configMap:
|
||||
name: {{ template "redis-ha.fullname" . }}-health-configmap
|
||||
defaultMode: 0755
|
||||
{{- if .Values.extraVolumes }}
|
||||
{{- toYaml .Values.extraVolumes | nindent 6 }}
|
||||
{{- end -}}
|
||||
{{- if .Values.persistentVolume.enabled }}
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: data
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.persistentVolume.annotations }}
|
||||
{{ $key }}: {{ $value }}
|
||||
{{- end }}
|
||||
labels: {{- toYaml .Values.persistentVolume.labels | nindent 8 }}
|
||||
|
||||
spec:
|
||||
accessModes:
|
||||
{{- range .Values.persistentVolume.accessModes }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistentVolume.size | quote }}
|
||||
{{- if .Values.persistentVolume.storageClass }}
|
||||
{{- if (eq "-" .Values.persistentVolume.storageClass) }}
|
||||
storageClassName: ""
|
||||
{{- else }}
|
||||
storageClassName: "{{ .Values.persistentVolume.storageClass }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else if .Values.hostPath.path }}
|
||||
- name: data
|
||||
hostPath:
|
||||
path: {{ tpl .Values.hostPath.path .}}
|
||||
{{- else }}
|
||||
- name: data
|
||||
emptyDir:
|
||||
{{ toYaml .Values.emptyDir | indent 10 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,199 @@
|
||||
{{- if .Values.haproxy.enabled }}
|
||||
kind: Deployment
|
||||
apiVersion: apps/v1
|
||||
metadata:
|
||||
name: {{ template "redis-ha.fullname" . }}-haproxy
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{ include "labels.standard" . | indent 4 }}
|
||||
{{- range $key, $value := .Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.haproxy.deploymentStrategy }}
|
||||
strategy:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
revisionHistoryLimit: 1
|
||||
replicas: {{ .Values.haproxy.replicas }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "redis-ha.name" . }}-haproxy
|
||||
release: {{ .Release.Name }}
|
||||
template:
|
||||
metadata:
|
||||
name: {{ template "redis-ha.fullname" . }}-haproxy
|
||||
labels:
|
||||
app: {{ template "redis-ha.name" . }}-haproxy
|
||||
release: {{ .Release.Name }}
|
||||
{{- range $key, $value := .Values.haproxy.labels }}
|
||||
{{ $key }}: {{ $value | toString }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
{{- if and (.Values.haproxy.metrics.enabled) (not .Values.haproxy.metrics.serviceMonitor.enabled) }}
|
||||
prometheus.io/port: "{{ .Values.haproxy.metrics.port }}"
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/path: "{{ .Values.haproxy.metrics.scrapePath }}"
|
||||
{{- end }}
|
||||
checksum/config: {{ print (include "config-haproxy.cfg" .) (include "config-haproxy_init.sh" .) | sha256sum }}
|
||||
{{- if .Values.haproxy.annotations }}
|
||||
{{ toYaml .Values.haproxy.annotations | indent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
# Needed when using unmodified rbac-setup.yml
|
||||
{{ if .Values.haproxy.serviceAccount.create }}
|
||||
serviceAccountName: {{ template "redis-ha.serviceAccountName" . }}-haproxy
|
||||
{{- else }}
|
||||
serviceAccountName: {{ .Values.haproxy.serviceAccountName }}
|
||||
{{- end }}
|
||||
securityContext: {{ toYaml .Values.haproxy.securityContext | nindent 8 }}
|
||||
nodeSelector:
|
||||
{{ toYaml .Values.nodeSelector | indent 8 }}
|
||||
tolerations:
|
||||
{{ toYaml .Values.tolerations | indent 8 }}
|
||||
affinity:
|
||||
{{- if .Values.haproxy.affinity }}
|
||||
{{- with .Values.haproxy.affinity }}
|
||||
{{ tpl . $ | indent 8 }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- if .Values.haproxy.additionalAffinities }}
|
||||
{{ toYaml .Values.haproxy.additionalAffinities | indent 8 }}
|
||||
{{- end }}
|
||||
podAntiAffinity:
|
||||
{{- if .Values.haproxy.hardAntiAffinity }}
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels:
|
||||
app: {{ template "redis-ha.name" . }}-haproxy
|
||||
release: {{ .Release.Name }}
|
||||
topologyKey: kubernetes.io/hostname
|
||||
{{- else }}
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app: {{ template "redis-ha.name" . }}-haproxy
|
||||
release: {{ .Release.Name }}
|
||||
topologyKey: kubernetes.io/hostname
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.topologySpreadConstraints.enabled }}
|
||||
topologySpreadConstraints:
|
||||
- maxSkew: {{ .Values.topologySpreadConstraints.maxSkew | default 1 }}
|
||||
topologyKey: {{ .Values.topologySpreadConstraints.topologyKey | default "topology.kubernetes.io/zone" }}
|
||||
whenUnsatisfiable: {{ .Values.topologySpreadConstraints.whenUnsatisfiable | default "ScheduleAnyway" }}
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app: {{ template "redis-ha.name" . }}-haproxy
|
||||
release: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
- name: config-init
|
||||
image: {{ template "haproxy.image" . }}
|
||||
imagePullPolicy: {{ .Values.haproxy.image.pullPolicy }}
|
||||
resources:
|
||||
{{ toYaml .Values.haproxy.init.resources | indent 10 }}
|
||||
command:
|
||||
- sh
|
||||
args:
|
||||
- /readonly/haproxy_init.sh
|
||||
securityContext: {{ toYaml .Values.haproxy.containerSecurityContext | nindent 10 }}
|
||||
volumeMounts:
|
||||
- name: config-volume
|
||||
mountPath: /readonly
|
||||
readOnly: true
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if .Values.haproxy.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.haproxy.imagePullSecrets | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: haproxy
|
||||
image: {{ template "haproxy.image" . }}
|
||||
imagePullPolicy: {{ .Values.haproxy.image.pullPolicy }}
|
||||
securityContext: {{ toYaml .Values.haproxy.containerSecurityContext | nindent 10 }}
|
||||
{{- if or .Values.auth .Values.sentinel.auth}}
|
||||
env:
|
||||
{{- if .Values.auth }}
|
||||
- name: AUTH
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.existingSecret }}
|
||||
name: {{ .Values.existingSecret }}
|
||||
{{- else }}
|
||||
name: {{ template "redis-ha.fullname" . }}
|
||||
{{- end }}
|
||||
key: {{ .Values.authKey }}
|
||||
{{- end }}
|
||||
{{- if .Values.sentinel.auth }}
|
||||
- name: SENTINELAUTH
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.sentinel.existingSecret }}
|
||||
name: {{ .Values.sentinel.existingSecret }}
|
||||
{{- else }}
|
||||
name: {{ template "redis-ha.fullname" . }}-sentinel
|
||||
{{- end }}
|
||||
key: {{ .Values.sentinel.authKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8888
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8888
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 3
|
||||
ports:
|
||||
- name: redis
|
||||
containerPort: {{ default "6379" .Values.haproxy.containerPort }}
|
||||
{{- if .Values.haproxy.readOnly.enabled }}
|
||||
- name: readonlyport
|
||||
containerPort: {{ default "6380" .Values.haproxy.readOnly.port }}
|
||||
{{- end }}
|
||||
{{- if .Values.haproxy.metrics.enabled }}
|
||||
- name: metrics-port
|
||||
containerPort: {{ default "9101" .Values.haproxy.metrics.port }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ toYaml .Values.haproxy.resources | indent 10 }}
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /usr/local/etc/haproxy
|
||||
- name: shared-socket
|
||||
mountPath: /run/haproxy
|
||||
{{- if .Values.haproxy.tls.enabled }}
|
||||
- name: pemfile
|
||||
mountPath: {{ .Values.haproxy.tls.certMountPath }}
|
||||
{{- end }}
|
||||
lifecycle:
|
||||
{{ toYaml .Values.haproxy.lifecycle | indent 10 }}
|
||||
{{- if .Values.haproxy.priorityClassName }}
|
||||
priorityClassName: {{ .Values.haproxy.priorityClassName }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- if .Values.haproxy.tls.enabled }}
|
||||
- name: pemfile
|
||||
secret:
|
||||
secretName: {{ .Values.haproxy.tls.secretName }}
|
||||
{{- end }}
|
||||
- name: config-volume
|
||||
configMap:
|
||||
name: {{ template "redis-ha.fullname" . }}-configmap
|
||||
- name: shared-socket
|
||||
emptyDir:
|
||||
{{ toYaml .Values.haproxy.emptyDir | indent 10 }}
|
||||
- name: data
|
||||
emptyDir:
|
||||
{{ toYaml .Values.haproxy.emptyDir | indent 10 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,74 @@
|
||||
{{- if and .Values.haproxy.enabled .Values.haproxy.networkPolicy.enabled }}
|
||||
{{- $root := . }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: networking.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "redis-ha.fullname" . }}-haproxy-network-policy
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
{{- if .Values.haproxy.networkPolicy.annotations }}
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.haproxy.networkPolicy.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "labels.standard" . | nindent 4 }}
|
||||
{{- range $key, $value := .Values.haproxy.networkPolicy.labels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
release: {{ .Release.Name }}
|
||||
app: {{ template "redis-ha.name" . }}-haproxy
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
egress:
|
||||
- to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
release: {{ .Release.Name }}
|
||||
app: {{ template "redis-ha.name" . }}
|
||||
ports:
|
||||
- port: {{ .Values.redis.port }}
|
||||
protocol: TCP
|
||||
- port: {{ .Values.sentinel.port }}
|
||||
protocol: TCP
|
||||
- to:
|
||||
- namespaceSelector: {}
|
||||
ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
{{- range $rule := .Values.haproxy.networkPolicy.egressRules }}
|
||||
- to:
|
||||
{{- (tpl (toYaml $rule.selectors) $) | nindent 8 }}
|
||||
ports:
|
||||
{{- toYaml $rule.ports | nindent 8 }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
release: {{ .Release.Name }}
|
||||
app: {{ template "redis-ha.name" . }}
|
||||
ports:
|
||||
- port: {{ .Values.redis.port }}
|
||||
protocol: TCP
|
||||
- port: {{ .Values.sentinel.port }}
|
||||
protocol: TCP
|
||||
{{- range $rule := .Values.haproxy.networkPolicy.ingressRules }}
|
||||
- from:
|
||||
{{- (tpl (toYaml $rule.selectors) $) | nindent 8 }}
|
||||
ports:
|
||||
{{- if $rule.ports }}
|
||||
{{- toYaml $rule.ports | nindent 8 }}
|
||||
{{- end }}
|
||||
- port: {{ $root.Values.redis.port }}
|
||||
protocol: TCP
|
||||
- port: {{ $root.Values.sentinel.port }}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,18 @@
|
||||
{{- if .Values.haproxy.podDisruptionBudget -}}
|
||||
apiVersion: {{ template "redis-ha.podDisruptionBudget.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ template "redis-ha.fullname" . }}-haproxy-pdb
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{ include "labels.standard" . | indent 4 }}
|
||||
{{- range $key, $value := .Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
release: {{ .Release.Name }}
|
||||
app: {{ template "redis-ha.name" . }}-haproxy
|
||||
{{ toYaml .Values.haproxy.podDisruptionBudget | indent 2 }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,22 @@
|
||||
{{- if .Values.haproxy.enabled }}
|
||||
{{- if and .Values.haproxy.serviceAccount.create .Values.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "redis-ha.fullname" . }}-haproxy
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{ include "labels.standard" . | indent 4 }}
|
||||
component: {{ template "redis-ha.fullname" . }}-haproxy
|
||||
{{- range $key, $value := .Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,22 @@
|
||||
{{- if .Values.haproxy.enabled }}
|
||||
{{- if and .Values.haproxy.serviceAccount.create .Values.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "redis-ha.fullname" . }}-haproxy
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{ include "labels.standard" . | indent 4 }}
|
||||
component: {{ template "redis-ha.fullname" . }}-haproxy
|
||||
{{- range $key, $value := .Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "redis-ha.serviceAccountName" . }}-haproxy
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "redis-ha.fullname" . }}-haproxy
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,60 @@
|
||||
{{- if .Values.haproxy.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: redis
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{ include "labels.standard" . | indent 4 }}
|
||||
component: {{ template "redis-ha.fullname" . }}-haproxy
|
||||
{{- range $key, $value := .Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.haproxy.service.labels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
{{- if .Values.haproxy.service.annotations }}
|
||||
{{ toYaml .Values.haproxy.service.annotations | indent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ default "ClusterIP" .Values.haproxy.service.type }}
|
||||
{{- if and (eq .Values.haproxy.service.type "LoadBalancer") .Values.haproxy.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.haproxy.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.haproxy.service.type "LoadBalancer") .Values.haproxy.service.externalTrafficPolicy }}
|
||||
externalTrafficPolicy: {{ .Values.haproxy.service.externalTrafficPolicy }}
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.haproxy.service.type "LoadBalancer") .Values.haproxy.service.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges: {{ toYaml .Values.haproxy.service.loadBalancerSourceRanges | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- if .Values.haproxy.service.externalIPs }}
|
||||
externalIPs:
|
||||
{{- range $key, $value := .Values.haproxy.service.externalIPs }}
|
||||
- {{ $value }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: tcp-haproxy
|
||||
port: {{ .Values.haproxy.servicePort }}
|
||||
protocol: TCP
|
||||
targetPort: redis
|
||||
{{- if and (eq .Values.haproxy.service.type "NodePort") .Values.haproxy.service.nodePort }}
|
||||
nodePort: {{ .Values.haproxy.service.nodePort }}
|
||||
{{- end }}
|
||||
{{- if .Values.haproxy.readOnly.enabled }}
|
||||
- name: tcp-haproxyreadonly
|
||||
port: {{ .Values.haproxy.readOnly.port }}
|
||||
protocol: TCP
|
||||
targetPort: {{ .Values.haproxy.readOnly.port }}
|
||||
{{- end }}
|
||||
{{- if .Values.haproxy.metrics.enabled }}
|
||||
- name: {{ .Values.haproxy.metrics.portName }}
|
||||
port: {{ .Values.haproxy.metrics.port }}
|
||||
protocol: TCP
|
||||
targetPort: metrics-port
|
||||
{{- end }}
|
||||
selector:
|
||||
release: {{ .Release.Name }}
|
||||
app: {{ template "redis-ha.name" . }}-haproxy
|
||||
{{- end }}
|
||||
@@ -0,0 +1,15 @@
|
||||
{{- if and .Values.haproxy.serviceAccount.create .Values.haproxy.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "redis-ha.serviceAccountName" . }}-haproxy
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service }}
|
||||
release: {{ .Release.Name }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
|
||||
app: {{ template "redis-ha.fullname" . }}
|
||||
{{- range $key, $value := .Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,39 @@
|
||||
{{- if and ( .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" ) ( .Values.haproxy.metrics.serviceMonitor.enabled ) ( .Values.haproxy.metrics.enabled ) }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ template "redis-ha.fullname" . }}-haproxy
|
||||
namespace: {{ .Values.haproxy.metrics.serviceMonitor.namespace | default .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{ include "labels.standard" . | indent 4 }}
|
||||
{{- range $key, $value := .Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.haproxy.metrics.serviceMonitor.labels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
endpoints:
|
||||
- targetPort: {{ .Values.haproxy.metrics.port }}
|
||||
{{- if .Values.haproxy.metrics.serviceMonitor.interval }}
|
||||
interval: {{ .Values.haproxy.metrics.serviceMonitor.interval }}
|
||||
{{- end }}
|
||||
{{- if .Values.haproxy.metrics.serviceMonitor.telemetryPath }}
|
||||
path: {{ .Values.haproxy.metrics.serviceMonitor.telemetryPath }}
|
||||
{{- end }}
|
||||
{{- if .Values.haproxy.metrics.serviceMonitor.timeout }}
|
||||
scrapeTimeout: {{ .Values.haproxy.metrics.serviceMonitor.timeout }}
|
||||
{{- end }}
|
||||
{{- with .Values.haproxy.metrics.serviceMonitor.endpointAdditionalProperties }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
jobLabel: {{ template "redis-ha.fullname" . }}-haproxy
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ .Release.Namespace | quote }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "redis-ha.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
component: {{ template "redis-ha.fullname" . }}-haproxy
|
||||
{{- end }}
|
||||
@@ -0,0 +1,27 @@
|
||||
{{- if and .Values.redis.tlsPort (not .Values.tls.secretName) -}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
metadata:
|
||||
name: {{ template "redis-ha.fullname" . }}-tls-secret
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{ include "labels.standard" . | indent 4 }}
|
||||
{{- range $key, $value := .Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{- if .Values.tls.caCertFile }}
|
||||
{{ .Values.tls.caCertFile }}: {{ .Files.Get "certs/ca.crt" | b64enc }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.certFile }}
|
||||
{{ .Values.tls.certFile }}: {{ .Files.Get "certs/redis.crt" | b64enc }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.keyFile }}
|
||||
{{ .Values.tls.keyFile }}: {{ .Files.Get "certs/redis.key" | b64enc }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.dhParamsFile }}
|
||||
{{ .Values.tls.dhParamsFile }}: {{ .Files.Get "certs/redis.dh" | b64enc }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,15 @@
|
||||
{{- if and .Values.sentinel.auth (not .Values.sentinel.existingSecret) -}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "redis-ha.fullname" . }}-sentinel
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{ include "labels.standard" . | indent 4 }}
|
||||
{{- range $key, $value := .Values.extraLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{ .Values.sentinel.authKey }}: {{ .Values.sentinel.password | b64enc | quote }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,32 @@
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: {{ template "redis-ha.fullname" . }}-configmap-test
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{ include "labels.standard" . | indent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": test-success
|
||||
spec:
|
||||
nodeSelector: {{ toYaml .Values.nodeSelector | nindent 4 }}
|
||||
tolerations: {{ toYaml .Values.tolerations | nindent 4 }}
|
||||
containers:
|
||||
- name: check-init
|
||||
image: {{ .Values.configmapTest.image.repository }}:{{ .Values.configmapTest.image.tag }}
|
||||
args:
|
||||
- --shell=sh
|
||||
- /readonly-config/init.sh
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /readonly-config
|
||||
readOnly: true
|
||||
resources: {{ toYaml .Values.configmapTest.resources | nindent 6 }}
|
||||
securityContext: {{ toYaml .Values.containerSecurityContext | nindent 6 }}
|
||||
{{- if .Values.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 4 }}
|
||||
{{- end }}
|
||||
restartPolicy: Never
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ template "redis-ha.fullname" . }}-configmap
|
||||
@@ -0,0 +1,29 @@
|
||||
{{- if .Values.haproxy.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: {{ template "redis-ha.fullname" . }}-service-test
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{ include "labels.standard" . | indent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": test-success
|
||||
spec:
|
||||
nodeSelector:
|
||||
{{ toYaml .Values.nodeSelector | indent 4 }}
|
||||
tolerations:
|
||||
{{ toYaml .Values.tolerations | indent 4 }}
|
||||
containers:
|
||||
- name: "{{ .Release.Name }}-service-test"
|
||||
image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- redis-cli -h {{ template "redis-ha.fullname" . }}-haproxy -p {{ .Values.redis.port }} info server
|
||||
resources: {{ toYaml .Values.haproxy.tests.resources | nindent 6 }}
|
||||
securityContext: {{ toYaml .Values.containerSecurityContext | nindent 6 }}
|
||||
{{- if .Values.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 4 }}
|
||||
{{- end }}
|
||||
restartPolicy: Never
|
||||
{{- end }}
|
||||
755
config/ks-core/charts/redis-ha/values.yaml
Normal file
755
config/ks-core/charts/redis-ha/values.yaml
Normal file
@@ -0,0 +1,755 @@
|
||||
## Configure resource requests and limits
|
||||
## ref: http://kubernetes.io/docs/user-guide/compute-resources/
|
||||
##
|
||||
|
||||
global:
|
||||
imageRegistry: ""
|
||||
|
||||
image:
|
||||
registry: ""
|
||||
repository: redis
|
||||
tag: 7.2.4-alpine
|
||||
digest: ""
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
## Reference to one or more secrets to be used when pulling images
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
## This imagePullSecrets is only for redis images
|
||||
##
|
||||
imagePullSecrets: []
|
||||
# - name: "image-pull-secret"
|
||||
|
||||
## replicas number for each component
|
||||
replicas: 3
|
||||
|
||||
## Customize the statefulset pod management policy:
|
||||
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies
|
||||
podManagementPolicy: OrderedReady
|
||||
|
||||
## read-only replicas
|
||||
## indexed slaves get never promoted to be master
|
||||
## index starts with 0 - which is master on init
|
||||
## i.e. "8,9" means 8th and 9th slave will be replica with replica-priority=0
|
||||
## see also: https://redis.io/topics/sentinel
|
||||
ro_replicas: ""
|
||||
|
||||
## Kubernetes priorityClass name for the redis-ha-server pod
|
||||
# priorityClassName: ""
|
||||
|
||||
## Custom labels for the redis pod
|
||||
labels: {}
|
||||
|
||||
## Custom labels for redis service
|
||||
serviceLabels: {}
|
||||
|
||||
configmap:
|
||||
## Custom labels for the redis configmap
|
||||
labels: {}
|
||||
|
||||
configmapTest:
|
||||
## Image for redis-ha-configmap-test hook
|
||||
image:
|
||||
registry: ""
|
||||
repository: koalaman/shellcheck
|
||||
tag: v0.5.0
|
||||
pullPolicy: IfNotPresent
|
||||
## Resources for the ConfigMap test pod
|
||||
resources: {}
|
||||
|
||||
## Pods Service Account
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
|
||||
serviceAccount:
|
||||
## Specifies whether a ServiceAccount should be created
|
||||
##
|
||||
create: true
|
||||
## The name of the ServiceAccount to use.
|
||||
## If not set and create is true, a name is generated using the redis-ha.fullname template
|
||||
# name:
|
||||
## opt in/out of automounting API credentials into container
|
||||
## https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
|
||||
automountToken: false
|
||||
|
||||
## Enables a HA Proxy for better LoadBalancing / Sentinel Master support. Automatically proxies to Redis master.
|
||||
## Recommend for externally exposed Redis clusters.
|
||||
## ref: https://cbonte.github.io/haproxy-dconv/1.9/intro.html
|
||||
haproxy:
|
||||
enabled: true
|
||||
servicePort: 6379
|
||||
containerPort: 6379
|
||||
## Enable TLS termination on HAproxy, This will create a volume mount
|
||||
tls:
|
||||
enabled: false
|
||||
secretName: ""
|
||||
keyName:
|
||||
certMountPath: /tmp/
|
||||
# Enable if you want a dedicated port in haproxy for redis-slaves
|
||||
readOnly:
|
||||
enabled: false
|
||||
port: 6380
|
||||
replicas: 3
|
||||
# -- Deployment strategy for the haproxy deployment
|
||||
deploymentStrategy:
|
||||
type: RollingUpdate
|
||||
# rollingUpdate:
|
||||
# maxSurge: 25%
|
||||
# maxUnavailable: 25%
|
||||
image:
|
||||
registry: ""
|
||||
repository: haproxy
|
||||
tag: 2.9.4-alpine
|
||||
digest: ""
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
## Custom labels for the haproxy pod
|
||||
labels: {}
|
||||
|
||||
## Reference to one or more secrets to be used when pulling images
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
##
|
||||
imagePullSecrets: []
|
||||
# - name: "image-pull-secret"
|
||||
|
||||
annotations: {}
|
||||
resources: {}
|
||||
emptyDir: {}
|
||||
|
||||
## Pod Disruption Budget
|
||||
## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
|
||||
##
|
||||
podDisruptionBudget: {}
|
||||
# Use only one of the two
|
||||
# maxUnavailable: 1
|
||||
# minAvailable: 1
|
||||
|
||||
## Enable sticky sessions to Redis nodes via HAProxy
|
||||
## Very useful for long-living connections as in case of Sentry for example
|
||||
stickyBalancing: false
|
||||
## Kubernetes priorityClass name for the haproxy pod
|
||||
# priorityClassName: ""
|
||||
|
||||
## Service for HAProxy
|
||||
service:
|
||||
type: ClusterIP
|
||||
loadBalancerIP:
|
||||
externalIPs: {}
|
||||
labels: {}
|
||||
annotations: null
|
||||
|
||||
# List of CIDR's allowed to connect to LoadBalancer
|
||||
# loadBalancerSourceRanges: []
|
||||
|
||||
serviceAccountName: redis-sa
|
||||
serviceAccount:
|
||||
create: true
|
||||
## Official HAProxy embedded prometheus metrics settings.
|
||||
## Ref: https://github.com/haproxy/haproxy/tree/master/contrib/prometheus-exporter
|
||||
##
|
||||
metrics:
|
||||
enabled: false
|
||||
# prometheus port & scrape path
|
||||
port: 9101
|
||||
portName: http-exporter-port
|
||||
scrapePath: /metrics
|
||||
|
||||
serviceMonitor:
|
||||
# When set true then use a ServiceMonitor to configure scraping
|
||||
enabled: false
|
||||
# Set the namespace the ServiceMonitor should be deployed
|
||||
# namespace: "monitoring"
|
||||
# Set how frequently Prometheus should scrape
|
||||
# interval: 30s
|
||||
# Set path to redis-exporter telemtery-path
|
||||
# telemetryPath: /metrics
|
||||
# Set labels for the ServiceMonitor, use this to define your scrape label for Prometheus Operator
|
||||
labels: {}
|
||||
# Set timeout for scrape
|
||||
# timeout: 10s
|
||||
# Set additional properties for the ServiceMonitor endpoints such as relabeling, scrapeTimeout, tlsConfig, and more.
|
||||
endpointAdditionalProperties: {}
|
||||
init:
|
||||
resources: {}
|
||||
timeout:
|
||||
connect: 4s
|
||||
server: 330s
|
||||
client: 330s
|
||||
check: 2s
|
||||
checkInterval: 1s
|
||||
checkFall: 1
|
||||
|
||||
securityContext:
|
||||
runAsUser: 99
|
||||
fsGroup: 99
|
||||
runAsNonRoot: true
|
||||
|
||||
containerSecurityContext:
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
|
||||
## Whether the haproxy pods should be forced to run on separate nodes.
|
||||
hardAntiAffinity: true
|
||||
|
||||
## Additional affinities to add to the haproxy pods.
|
||||
additionalAffinities: {}
|
||||
|
||||
## Override all other affinity settings for the haproxy pods with a string.
|
||||
affinity: |
|
||||
|
||||
## Custom config-haproxy.cfg files used to override default settings. If this file is
|
||||
## specified then the config-haproxy.cfg above will be ignored.
|
||||
# customConfig: |-
|
||||
# Define configuration here
|
||||
## Place any additional configuration section to add to the default config-haproxy.cfg
|
||||
# extraConfig: |-
|
||||
# Define configuration here
|
||||
|
||||
## Container lifecycle hooks
|
||||
## Ref: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
|
||||
lifecycle: {}
|
||||
|
||||
## HAProxy test related options
|
||||
tests:
|
||||
resources: {}
|
||||
|
||||
## Enable HAProxy parameters to bind and consume IPv6 addresses. Enabled by default.
|
||||
IPv6:
|
||||
enabled: true
|
||||
|
||||
networkPolicy:
|
||||
## whether NetworkPolicy for Haproxy should be created
|
||||
enabled: false
|
||||
annotations: {}
|
||||
labels: {}
|
||||
## user defines ingress rules that Haproxy should permit into
|
||||
## uses the format defined in https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
|
||||
ingressRules: []
|
||||
# - selectors:
|
||||
# - namespaceSelector:
|
||||
# matchLabels:
|
||||
# name: my-redis-client-namespace
|
||||
# podSelector:
|
||||
# matchLabels:
|
||||
# application: redis-client
|
||||
## if ports is not defined then it defaults to the ports defined for enabled services (redis, sentinel)
|
||||
# ports:
|
||||
# - port: 6379
|
||||
# protocol: TCP
|
||||
# - port: 26379
|
||||
# protocol: TCP
|
||||
|
||||
## user can define egress rules too, uses the same structure as ingressRules
|
||||
egressRules: []
|
||||
|
||||
## Role Based Access
|
||||
## Ref: https://kubernetes.io/docs/admin/authorization/rbac/
|
||||
##
|
||||
rbac:
|
||||
create: true
|
||||
|
||||
# NOT RECOMMENDED: Additional container in which you can execute arbitrary commands to update sysctl parameters
|
||||
# You can now use securityContext.sysctls to leverage this capability
|
||||
# Ref: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/
|
||||
##
|
||||
sysctlImage:
|
||||
enabled: false
|
||||
command: []
|
||||
registry: docker.io
|
||||
repository: busybox
|
||||
tag: 1.34.1
|
||||
pullPolicy: Always
|
||||
mountHostSys: false
|
||||
resources: {}
|
||||
|
||||
## Use an alternate scheduler, e.g. "stork".
|
||||
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
|
||||
##
|
||||
# schedulerName:
|
||||
|
||||
## Redis specific configuration options
|
||||
redis:
|
||||
port: 6379
|
||||
masterGroupName: "mymaster" # must match ^[\\w-\\.]+$) and can be templated
|
||||
|
||||
## Configures redis with tls-port parameter
|
||||
# tlsPort: 6385
|
||||
|
||||
## Configures redis with tls-replication parameter, if true sets "tls-replication yes" in redis.conf
|
||||
# tlsReplication: true
|
||||
|
||||
## It is possible to disable client side certificates authentication when "authClients" is set to "no"
|
||||
# authClients: "no"
|
||||
|
||||
## Increase terminationGracePeriodSeconds to allow writing large RDB snapshots. (k8s default is 30s)
|
||||
## https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-termination-forced
|
||||
terminationGracePeriodSeconds: 60
|
||||
|
||||
# liveness probe parameters for redis container
|
||||
livenessProbe:
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 15
|
||||
timeoutSeconds: 15
|
||||
successThreshold: 1
|
||||
failureThreshold: 5
|
||||
|
||||
readinessProbe:
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 15
|
||||
timeoutSeconds: 15
|
||||
successThreshold: 1
|
||||
failureThreshold: 5
|
||||
|
||||
disableCommands:
|
||||
- FLUSHDB
|
||||
- FLUSHALL
|
||||
|
||||
config:
|
||||
## Additional redis conf options can be added below
|
||||
## For all available options see http://download.redis.io/redis-stable/redis.conf
|
||||
min-replicas-to-write: 1
|
||||
min-replicas-max-lag: 5 # Value in seconds
|
||||
maxmemory: "0" # Max memory to use for each redis instance. Default is unlimited.
|
||||
maxmemory-policy: "volatile-lru" # Max memory policy to use for each redis instance. Default is volatile-lru.
|
||||
# Determines if scheduled RDB backups are created. Default is false.
|
||||
# Please note that local (on-disk) RDBs will still be created when re-syncing with a new slave. The only way to prevent this is to enable diskless replication.
|
||||
save: "900 1"
|
||||
# When enabled, directly sends the RDB over the wire to slaves, without using the disk as intermediate storage. Default is false.
|
||||
repl-diskless-sync: "yes"
|
||||
rdbcompression: "yes"
|
||||
rdbchecksum: "yes"
|
||||
|
||||
## Custom redis.conf files used to override default settings. If this file is
|
||||
## specified then the redis.config above will be ignored.
|
||||
# customConfig: |-
|
||||
# Define configuration here
|
||||
|
||||
resources: {}
|
||||
# requests:
|
||||
# memory: 200Mi
|
||||
# cpu: 100m
|
||||
# limits:
|
||||
# memory: 700Mi
|
||||
|
||||
## Container lifecycle hooks
|
||||
## Ref: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command: ["/bin/sh", "/readonly-config/trigger-failover-if-master.sh"]
|
||||
|
||||
## annotations for the redis statefulset
|
||||
annotations: {}
|
||||
|
||||
## updateStrategy for Redis StatefulSet
|
||||
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
|
||||
## additional volumeMounts for Redis container
|
||||
extraVolumeMounts: []
|
||||
# - name: empty
|
||||
# mountPath: /empty
|
||||
|
||||
## Sentinel specific configuration options
|
||||
sentinel:
|
||||
port: 26379
|
||||
|
||||
## Configure the 'bind' directive to bind to a list of network interfaces
|
||||
# bind: 0.0.0.0
|
||||
|
||||
## Configures sentinel with tls-port parameter
|
||||
# tlsPort: 26385
|
||||
|
||||
## Configures sentinel with tls-replication parameter, if true sets "tls-replication yes" in sentinel.conf
|
||||
# tlsReplication: true
|
||||
|
||||
## It is possible to disable client side certificates authentication when "authClients" is set to "no"
|
||||
# authClients: "no"
|
||||
|
||||
## Configures sentinel with AUTH (requirepass params)
|
||||
auth: false
|
||||
|
||||
# password: password
|
||||
|
||||
## Use existing secret containing key `authKey` (ignores sentinel.password)
|
||||
# existingSecret: sentinel-secret
|
||||
|
||||
## Defines the key holding the sentinel password in existing secret.
|
||||
authKey: sentinel-password
|
||||
|
||||
# liveness probe parameters for sentinel container
|
||||
livenessProbe:
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 15
|
||||
timeoutSeconds: 15
|
||||
successThreshold: 1
|
||||
failureThreshold: 5
|
||||
|
||||
# readiness probe parameters for sentinel container
|
||||
readinessProbe:
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 15
|
||||
timeoutSeconds: 15
|
||||
successThreshold: 3
|
||||
failureThreshold: 5
|
||||
|
||||
quorum: 2
|
||||
config:
|
||||
## Additional sentinel conf options can be added below. Only options that
|
||||
## are expressed in the format simialar to 'sentinel xxx mymaster xxx' will
|
||||
## be properly templated expect maxclients option.
|
||||
## For available options see http://download.redis.io/redis-stable/sentinel.conf
|
||||
down-after-milliseconds: 10000
|
||||
## Failover timeout value in milliseconds
|
||||
failover-timeout: 180000
|
||||
parallel-syncs: 5
|
||||
maxclients: 10000
|
||||
|
||||
## Custom sentinel.conf files used to override default settings. If this file is
|
||||
## specified then the sentinel.config above will be ignored.
|
||||
# customConfig: |-
|
||||
# Define configuration here
|
||||
|
||||
resources: {}
|
||||
# requests:
|
||||
# memory: 200Mi
|
||||
# cpu: 100m
|
||||
# limits:
|
||||
# memory: 200Mi
|
||||
|
||||
## Container lifecycle hooks
|
||||
## Ref: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
|
||||
lifecycle: {}
|
||||
|
||||
## additional volumeMounts for Sentinel container
|
||||
extraVolumeMounts: []
|
||||
# - name: empty
|
||||
# mountPath: /empty
|
||||
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
fsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
|
||||
containerSecurityContext:
|
||||
runAsUser: 1000
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
|
||||
## Assuming your kubelet allows it, you can the following instructions to configure
|
||||
## specific sysctl parameters
|
||||
##
|
||||
# sysctls:
|
||||
# - name: net.core.somaxconn
|
||||
# value: '10000'
|
||||
|
||||
## Node labels, affinity, and tolerations for pod assignment
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
|
||||
nodeSelector: {}
|
||||
|
||||
## Whether the Redis server pods should be forced to run on separate nodes.
|
||||
## This is accomplished by setting their AntiAffinity with requiredDuringSchedulingIgnoredDuringExecution as opposed to preferred.
|
||||
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#inter-pod-affinity-and-anti-affinity-beta-feature
|
||||
##
|
||||
hardAntiAffinity: true
|
||||
|
||||
## Additional affinities to add to the Redis server pods.
|
||||
##
|
||||
## Example:
|
||||
## nodeAffinity:
|
||||
## preferredDuringSchedulingIgnoredDuringExecution:
|
||||
## - weight: 50
|
||||
## preference:
|
||||
## matchExpressions:
|
||||
## - key: spot
|
||||
## operator: NotIn
|
||||
## values:
|
||||
## - "true"
|
||||
##
|
||||
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
|
||||
##
|
||||
additionalAffinities:
|
||||
nodeAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: In
|
||||
values:
|
||||
- ""
|
||||
|
||||
## Override all other affinity settings for the Redis server pods with a string.
|
||||
##
|
||||
## Example:
|
||||
## affinity: |
|
||||
## podAntiAffinity:
|
||||
## requiredDuringSchedulingIgnoredDuringExecution:
|
||||
## - labelSelector:
|
||||
## matchLabels:
|
||||
## app: {{ template "redis-ha.name" . }}
|
||||
## release: {{ .Release.Name }}
|
||||
## topologyKey: kubernetes.io/hostname
|
||||
## preferredDuringSchedulingIgnoredDuringExecution:
|
||||
## - weight: 100
|
||||
## podAffinityTerm:
|
||||
## labelSelector:
|
||||
## matchLabels:
|
||||
## app: {{ template "redis-ha.name" . }}
|
||||
## release: {{ .Release.Name }}
|
||||
## topologyKey: failure-domain.beta.kubernetes.io/zone
|
||||
##
|
||||
affinity: |
|
||||
|
||||
## https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
|
||||
topologySpreadConstraints:
|
||||
enabled: false
|
||||
maxSkew: ""
|
||||
topologyKey: ""
|
||||
whenUnsatisfiable: ""
|
||||
|
||||
# Prometheus exporter specific configuration options
|
||||
exporter:
|
||||
enabled: false
|
||||
image: oliver006/redis_exporter
|
||||
tag: v1.57.0
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# prometheus port & scrape path
|
||||
port: 9121
|
||||
portName: exporter-port
|
||||
scrapePath: /metrics
|
||||
|
||||
# Address/Host for Redis instance. Default: localhost
|
||||
# Exists to circumvent issues with IPv6 dns resolution that occurs on certain environments
|
||||
##
|
||||
address: localhost
|
||||
|
||||
## Set this to true if you want to connect to redis tls port
|
||||
# sslEnabled: true
|
||||
|
||||
# cpu/memory resource limits/requests
|
||||
resources: {}
|
||||
|
||||
# Additional args for redis exporter
|
||||
extraArgs: {}
|
||||
|
||||
# Used to mount a LUA-Script via config map and use it for metrics-collection
|
||||
# script: |
|
||||
# -- Example script copied from: https://github.com/oliver006/redis_exporter/blob/master/contrib/sample_collect_script.lua
|
||||
# -- Example collect script for -script option
|
||||
# -- This returns a Lua table with alternating keys and values.
|
||||
# -- Both keys and values must be strings, similar to a HGETALL result.
|
||||
# -- More info about Redis Lua scripting: https://redis.io/commands/eval
|
||||
#
|
||||
# local result = {}
|
||||
#
|
||||
# -- Add all keys and values from some hash in db 5
|
||||
# redis.call("SELECT", 5)
|
||||
# local r = redis.call("HGETALL", "some-hash-with-stats")
|
||||
# if r ~= nil then
|
||||
# for _,v in ipairs(r) do
|
||||
# table.insert(result, v) -- alternating keys and values
|
||||
# end
|
||||
# end
|
||||
#
|
||||
# -- Set foo to 42
|
||||
# table.insert(result, "foo")
|
||||
# table.insert(result, "42") -- note the string, use tostring() if needed
|
||||
#
|
||||
# return result
|
||||
|
||||
serviceMonitor:
|
||||
# When set true then use a ServiceMonitor to configure scraping
|
||||
enabled: false
|
||||
# Set the namespace the ServiceMonitor should be deployed
|
||||
# namespace: "monitoring"
|
||||
# Set how frequently Prometheus should scrape
|
||||
# interval: 30s
|
||||
# Set path to redis-exporter telemtery-path
|
||||
# telemetryPath: /metrics
|
||||
# Set labels for the ServiceMonitor, use this to define your scrape label for Prometheus Operator
|
||||
labels: {}
|
||||
# Set timeout for scrape
|
||||
# timeout: 10s
|
||||
# Set additional properties for the ServiceMonitor endpoints such as relabeling, scrapeTimeout, tlsConfig, and more.
|
||||
endpointAdditionalProperties: {}
|
||||
|
||||
# prometheus exporter SCANS redis db which can take some time
|
||||
# allow different probe settings to not let container crashloop
|
||||
livenessProbe:
|
||||
initialDelaySeconds: 15
|
||||
timeoutSeconds: 3
|
||||
periodSeconds: 15
|
||||
|
||||
readinessProbe:
|
||||
initialDelaySeconds: 15
|
||||
timeoutSeconds: 3
|
||||
periodSeconds: 15
|
||||
successThreshold: 2
|
||||
|
||||
podDisruptionBudget: {}
|
||||
# Use only one of the two
|
||||
# maxUnavailable: 1
|
||||
# minAvailable: 1
|
||||
|
||||
## Configures redis with AUTH (requirepass & masterauth conf params)
|
||||
auth: true
|
||||
# redisPassword:
|
||||
|
||||
## Use existing secret containing key `authKey` (ignores redisPassword)
|
||||
## Can also store AWS S3 or SSH secrets in this secret
|
||||
existingSecret: redis-secret
|
||||
|
||||
## Defines the key holding the redis password in existing secret.
|
||||
authKey: auth
|
||||
|
||||
persistentVolume:
|
||||
enabled: true
|
||||
## redis-ha data Persistent Volume Storage Class
|
||||
## If defined, storageClassName: <storageClass>
|
||||
## If set to "-", storageClassName: "", which disables dynamic provisioning
|
||||
## If undefined (the default) or set to null, no storageClassName spec is
|
||||
## set, choosing the default provisioner. (gp2 on AWS, standard on
|
||||
## GKE, AWS & OpenStack)
|
||||
##
|
||||
# storageClass: "-"
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
size: 10Gi
|
||||
annotations: {}
|
||||
labels: {}
|
||||
init:
|
||||
resources: {}
|
||||
|
||||
# To use a hostPath for data, set persistentVolume.enabled to false
|
||||
# and define hostPath.path.
|
||||
# Warning: this might overwrite existing folders on the host system!
|
||||
hostPath:
|
||||
## path is evaluated as template so placeholders are replaced
|
||||
# path: "/data/{{ .Release.Name }}"
|
||||
|
||||
# if chown is true, an init-container with root permissions is launched to
|
||||
# change the owner of the hostPath folder to the user defined in the
|
||||
# security context
|
||||
chown: true
|
||||
|
||||
emptyDir: {}
|
||||
|
||||
tls:
|
||||
## Fill the name of secret if you want to use your own TLS certificates.
|
||||
## The secret should contains keys named by "tls.certFile" - the certificate, "tls.keyFile" - the private key, "tls.caCertFile" - the certificate of CA and "tls.dhParamsFile" - the dh parameter file
|
||||
## These secret will be genrated using files from certs folder if the secretName is not set and redis.tlsPort is set
|
||||
# secretName: tls-secret
|
||||
|
||||
## Name of certificate file
|
||||
certFile: redis.crt
|
||||
## Name of key file
|
||||
keyFile: redis.key
|
||||
## Name of Diffie-Hellman (DH) key exchange parameters file
|
||||
# dhParamsFile: redis.dh
|
||||
## Name of CA certificate file
|
||||
caCertFile: ca.crt
|
||||
|
||||
# restore init container is executed if restore.[s3|ssh].source is not false
|
||||
# restore init container creates /data/dump.rdb_ from original if exists
|
||||
# restore init container overrides /data/dump.rdb
|
||||
# secrets are stored into environment of init container - stored encoded on k8s
|
||||
# REQUIRED for s3 restore: AWS 'access_key' and 'secret_key' or stored in existingSecret
|
||||
# EXAMPLE source for s3 restore: 's3://bucket/dump.rdb'
|
||||
# REQUIRED for ssh restore: 'key' should be in one line including CR i.e. '-----BEGIN RSA PRIVATE KEY-----\n...\n...\n...\n-----END RSA PRIVATE KEY-----'
|
||||
# EXAMPLE source for ssh restore: 'user@server:/path/dump.rdb'
|
||||
restore:
|
||||
timeout: 600
|
||||
# Set existingSecret to true to use secret specified in existingSecret above
|
||||
existingSecret: false
|
||||
s3:
|
||||
source: false
|
||||
# If using existingSecret, that secret must contain:
|
||||
# AWS_SECRET_ACCESS_KEY: <YOUR_ACCESS_KEY:>
|
||||
# AWS_ACCESS_KEY_ID: <YOUR_KEY_ID>
|
||||
# If not set the key and ID as strings below:
|
||||
access_key: ""
|
||||
secret_key: ""
|
||||
region: ""
|
||||
ssh:
|
||||
source: false
|
||||
key: ""
|
||||
|
||||
## Custom PrometheusRule to be defined
|
||||
## The value is evaluated as a template, so, for example, the value can depend on .Release or .Chart
|
||||
## ref: https://github.com/coreos/prometheus-operator#customresourcedefinitions
|
||||
prometheusRule:
|
||||
# prometheusRule.enabled -- If true, creates a Prometheus Operator PrometheusRule.
|
||||
enabled: false
|
||||
# prometheusRule.additionalLabels -- Additional labels to be set in metadata.
|
||||
additionalLabels: {}
|
||||
# prometheusRule.namespace -- Namespace which Prometheus is running in.
|
||||
namespace:
|
||||
# prometheusRule.interval -- How often rules in the group are evaluated (falls back to `global.evaluation_interval` if not set).
|
||||
interval: 10s
|
||||
# prometheusRule.rules -- Rules spec template (see https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/api.md#rule).
|
||||
rules: []
|
||||
# Example:
|
||||
# - alert: RedisPodDown
|
||||
# expr: |
|
||||
# redis_up{job="{{ include "redis-ha.fullname" . }}"} == 0
|
||||
# for: 5m
|
||||
# labels:
|
||||
# severity: critical
|
||||
# annotations:
|
||||
# description: Redis pod {{ "{{ $labels.pod }}" }} is down
|
||||
# summary: Redis pod {{ "{{ $labels.pod }}" }} is down
|
||||
|
||||
extraInitContainers: []
|
||||
# - name: extraInit
|
||||
# image: alpine
|
||||
extraContainers: []
|
||||
# - name: extra
|
||||
# image: alpine
|
||||
extraVolumes: []
|
||||
# - name: empty
|
||||
# emptyDir: {}
|
||||
|
||||
# Labels added here are applied to all created resources
|
||||
extraLabels: {}
|
||||
|
||||
networkPolicy:
|
||||
## whether NetworkPolicy for Redis StatefulSets should be created
|
||||
## when enabled, inter-Redis connectivity is created
|
||||
enabled: false
|
||||
annotations: {}
|
||||
labels: {}
|
||||
## user defines ingress rules that Redis should permit into
|
||||
## uses the format defined in https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
|
||||
ingressRules: []
|
||||
# - selectors:
|
||||
# - namespaceSelector:
|
||||
# matchLabels:
|
||||
# name: my-redis-client-namespace
|
||||
# podSelector:
|
||||
# matchLabels:
|
||||
# application: redis-client
|
||||
## if ports is not defined then it defaults to the ports defined for enabled services (redis, sentinel)
|
||||
# ports:
|
||||
# - port: 6379
|
||||
# protocol: TCP
|
||||
# - port: 26379
|
||||
# protocol: TCP
|
||||
|
||||
## user can define egress rules too, uses the same structure as ingressRules
|
||||
egressRules: []
|
||||
|
||||
splitBrainDetection:
|
||||
interval: 60
|
||||
resources: {}
|
||||
@@ -1,167 +0,0 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
creationTimestamp: null
|
||||
name: clusterrulegroups.alerting.kubesphere.io
|
||||
spec:
|
||||
group: alerting.kubesphere.io
|
||||
names:
|
||||
kind: ClusterRuleGroup
|
||||
listKind: ClusterRuleGroupList
|
||||
plural: clusterrulegroups
|
||||
singular: clusterrulegroup
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v2beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: ClusterRuleGroup is the Schema for the ClusterRuleGroup API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ClusterRuleGroupSpec defines the desired state of ClusterRuleGroup
|
||||
properties:
|
||||
interval:
|
||||
type: string
|
||||
partial_response_strategy:
|
||||
type: string
|
||||
rules:
|
||||
items:
|
||||
properties:
|
||||
alert:
|
||||
type: string
|
||||
annotations:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
disable:
|
||||
type: boolean
|
||||
expr:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
x-kubernetes-int-or-string: true
|
||||
exprBuilder:
|
||||
description: If ExprBuilder is not nil, the configured Expr
|
||||
will be ignored
|
||||
properties:
|
||||
node:
|
||||
properties:
|
||||
comparator:
|
||||
type: string
|
||||
metricThreshold:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
cpu:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
load5m:
|
||||
type: number
|
||||
load15m:
|
||||
type: number
|
||||
load1m:
|
||||
type: number
|
||||
utilization:
|
||||
type: number
|
||||
type: object
|
||||
disk:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
inodeUtilization:
|
||||
type: number
|
||||
iopsRead:
|
||||
description: The unit is io/s
|
||||
type: number
|
||||
iopsWrite:
|
||||
description: The unit is io/s
|
||||
type: number
|
||||
spaceAvailable:
|
||||
description: The unit is bytes
|
||||
type: number
|
||||
spaceUtilization:
|
||||
type: number
|
||||
throughputRead:
|
||||
description: The unit is bytes/s
|
||||
type: number
|
||||
throughputWrite:
|
||||
description: The unit is bytes/s
|
||||
type: number
|
||||
type: object
|
||||
memory:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
available:
|
||||
description: The unit is bytes
|
||||
type: number
|
||||
utilization:
|
||||
type: number
|
||||
type: object
|
||||
network:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
receivedRate:
|
||||
description: The unit is bit/s
|
||||
type: number
|
||||
transmittedRate:
|
||||
description: The unit is bit/s
|
||||
type: number
|
||||
type: object
|
||||
pod:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
abnormalRatio:
|
||||
type: number
|
||||
utilization:
|
||||
type: number
|
||||
type: object
|
||||
type: object
|
||||
names:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- comparator
|
||||
- metricThreshold
|
||||
- names
|
||||
type: object
|
||||
type: object
|
||||
for:
|
||||
description: 'Duration is a valid time unit Supported units:
|
||||
y, w, d, h, m, s, ms Examples: `30s`, `1m`, `1h20m15s`'
|
||||
pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
severity:
|
||||
type: string
|
||||
required:
|
||||
- alert
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- rules
|
||||
type: object
|
||||
status:
|
||||
description: ClusterRuleGroupStatus defines the observed state of ClusterRuleGroup
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -1,281 +0,0 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
creationTimestamp: null
|
||||
name: globalrulegroups.alerting.kubesphere.io
|
||||
spec:
|
||||
group: alerting.kubesphere.io
|
||||
names:
|
||||
kind: GlobalRuleGroup
|
||||
listKind: GlobalRuleGroupList
|
||||
plural: globalrulegroups
|
||||
singular: globalrulegroup
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v2beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: GlobalRuleGroup is the Schema for the GlobalRuleGroup API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: GlobalRuleGroupSpec defines the desired state of GlobalRuleGroup
|
||||
properties:
|
||||
interval:
|
||||
type: string
|
||||
partial_response_strategy:
|
||||
type: string
|
||||
rules:
|
||||
items:
|
||||
properties:
|
||||
alert:
|
||||
type: string
|
||||
annotations:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
clusterSelector:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
inValues:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
matcher:
|
||||
properties:
|
||||
type:
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
type: object
|
||||
disable:
|
||||
type: boolean
|
||||
expr:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
x-kubernetes-int-or-string: true
|
||||
exprBuilder:
|
||||
description: If ExprBuilder is not nil, the configured Expr
|
||||
will be ignored
|
||||
properties:
|
||||
node:
|
||||
properties:
|
||||
comparator:
|
||||
type: string
|
||||
metricThreshold:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
cpu:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
load15m:
|
||||
type: number
|
||||
load1m:
|
||||
type: number
|
||||
load5m:
|
||||
type: number
|
||||
utilization:
|
||||
type: number
|
||||
type: object
|
||||
disk:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
inodeUtilization:
|
||||
type: number
|
||||
iopsRead:
|
||||
description: The unit is io/s
|
||||
type: number
|
||||
iopsWrite:
|
||||
description: The unit is io/s
|
||||
type: number
|
||||
spaceAvailable:
|
||||
description: The unit is bytes
|
||||
type: number
|
||||
spaceUtilization:
|
||||
type: number
|
||||
throughputRead:
|
||||
description: The unit is bytes/s
|
||||
type: number
|
||||
throughputWrite:
|
||||
description: The unit is bytes/s
|
||||
type: number
|
||||
type: object
|
||||
memory:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
available:
|
||||
description: The unit is bytes
|
||||
type: number
|
||||
utilization:
|
||||
type: number
|
||||
type: object
|
||||
network:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
receivedRate:
|
||||
description: The unit is bit/s
|
||||
type: number
|
||||
transmittedRate:
|
||||
description: The unit is bit/s
|
||||
type: number
|
||||
type: object
|
||||
pod:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
abnormalRatio:
|
||||
type: number
|
||||
utilization:
|
||||
type: number
|
||||
type: object
|
||||
type: object
|
||||
names:
|
||||
items:
|
||||
description: The cluster to which the node belongs
|
||||
must be specified.
|
||||
properties:
|
||||
cluster:
|
||||
type: string
|
||||
names:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- cluster
|
||||
- names
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- comparator
|
||||
- names
|
||||
type: object
|
||||
workload:
|
||||
properties:
|
||||
comparator:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
metricThreshold:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
cpu:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
usage:
|
||||
description: The unit is core
|
||||
type: number
|
||||
type: object
|
||||
memory:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
usage:
|
||||
description: The memory usage contains cache
|
||||
The unit is bytes
|
||||
type: number
|
||||
usageWoCache:
|
||||
description: The memory usage contains no cache
|
||||
The unit is bytes
|
||||
type: number
|
||||
type: object
|
||||
network:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
receivedRate:
|
||||
description: The unit is bit/s
|
||||
type: number
|
||||
transmittedRate:
|
||||
description: The unit is bit/s
|
||||
type: number
|
||||
type: object
|
||||
replica:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
unavailableRatio:
|
||||
type: number
|
||||
type: object
|
||||
type: object
|
||||
names:
|
||||
items:
|
||||
description: The cluster and namespace to which the
|
||||
workloads belongs must be specified.
|
||||
properties:
|
||||
cluster:
|
||||
type: string
|
||||
names:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
namespace:
|
||||
type: string
|
||||
required:
|
||||
- cluster
|
||||
- names
|
||||
- namespace
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- comparator
|
||||
- kind
|
||||
- names
|
||||
type: object
|
||||
type: object
|
||||
for:
|
||||
description: 'Duration is a valid time unit Supported units:
|
||||
y, w, d, h, m, s, ms Examples: `30s`, `1m`, `1h20m15s`'
|
||||
pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
namespaceSelector:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
inValues:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
matcher:
|
||||
properties:
|
||||
type:
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
type: object
|
||||
severity:
|
||||
type: string
|
||||
required:
|
||||
- alert
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- rules
|
||||
type: object
|
||||
status:
|
||||
description: GlobalRuleGroupStatus defines the observed state of GlobalRuleGroup
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -1,142 +0,0 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
creationTimestamp: null
|
||||
name: rulegroups.alerting.kubesphere.io
|
||||
spec:
|
||||
group: alerting.kubesphere.io
|
||||
names:
|
||||
kind: RuleGroup
|
||||
listKind: RuleGroupList
|
||||
plural: rulegroups
|
||||
singular: rulegroup
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v2beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: RuleGroup is the Schema for the RuleGroup API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: RuleGroupSpec defines the desired state of RuleGroup
|
||||
properties:
|
||||
interval:
|
||||
type: string
|
||||
partial_response_strategy:
|
||||
type: string
|
||||
rules:
|
||||
items:
|
||||
properties:
|
||||
alert:
|
||||
type: string
|
||||
annotations:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
disable:
|
||||
type: boolean
|
||||
expr:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
x-kubernetes-int-or-string: true
|
||||
exprBuilder:
|
||||
description: If ExprBuilder is not nil, the configured Expr
|
||||
will be ignored
|
||||
properties:
|
||||
workload:
|
||||
properties:
|
||||
comparator:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
metricThreshold:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
cpu:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
usage:
|
||||
description: The unit is core
|
||||
type: number
|
||||
type: object
|
||||
memory:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
usage:
|
||||
description: The memory usage contains cache
|
||||
The unit is bytes
|
||||
type: number
|
||||
usageWoCache:
|
||||
description: The memory usage contains no cache
|
||||
The unit is bytes
|
||||
type: number
|
||||
type: object
|
||||
network:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
receivedRate:
|
||||
description: The unit is bit/s
|
||||
type: number
|
||||
transmittedRate:
|
||||
description: The unit is bit/s
|
||||
type: number
|
||||
type: object
|
||||
replica:
|
||||
description: Only one of its members may be specified.
|
||||
properties:
|
||||
unavailableRatio:
|
||||
type: number
|
||||
type: object
|
||||
type: object
|
||||
names:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- comparator
|
||||
- kind
|
||||
- names
|
||||
type: object
|
||||
type: object
|
||||
for:
|
||||
description: 'Duration is a valid time unit Supported units:
|
||||
y, w, d, h, m, s, ms Examples: `30s`, `1m`, `1h20m15s`'
|
||||
pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
severity:
|
||||
type: string
|
||||
required:
|
||||
- alert
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- rules
|
||||
type: object
|
||||
status:
|
||||
description: RuleGroupStatus defines the observed state of RuleGroup
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -1,101 +0,0 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
creationTimestamp: null
|
||||
name: helmapplications.application.kubesphere.io
|
||||
spec:
|
||||
group: application.kubesphere.io
|
||||
names:
|
||||
kind: HelmApplication
|
||||
listKind: HelmApplicationList
|
||||
plural: helmapplications
|
||||
shortNames:
|
||||
- happ
|
||||
singular: helmapplication
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.name
|
||||
name: application name
|
||||
type: string
|
||||
- jsonPath: .metadata.labels.kubesphere\.io/workspace
|
||||
name: workspace
|
||||
type: string
|
||||
- jsonPath: .status.state
|
||||
name: State
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: HelmApplication is the Schema for the helmapplications API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: HelmApplicationSpec defines the desired state of HelmApplication
|
||||
properties:
|
||||
abstraction:
|
||||
description: info from frontend
|
||||
type: string
|
||||
appHome:
|
||||
type: string
|
||||
attachments:
|
||||
description: attachments id
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
description:
|
||||
description: description from chart's description or frontend
|
||||
type: string
|
||||
icon:
|
||||
description: The attachment id of the icon
|
||||
type: string
|
||||
name:
|
||||
description: the name of the helm application
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
status:
|
||||
description: HelmApplicationStatus defines the observed state of HelmApplication
|
||||
properties:
|
||||
latestVersion:
|
||||
description: If this application belong to appStore, latestVersion
|
||||
is the the latest version of the active application version. otherwise
|
||||
latestVersion is the latest version of all application version
|
||||
type: string
|
||||
state:
|
||||
description: 'the state of the helm application: draft, submitted,
|
||||
passed, rejected, suspended, active'
|
||||
type: string
|
||||
statusTime:
|
||||
format: date-time
|
||||
type: string
|
||||
updateTime:
|
||||
format: date-time
|
||||
type: string
|
||||
required:
|
||||
- statusTime
|
||||
- updateTime
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -1,221 +0,0 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
creationTimestamp: null
|
||||
name: helmapplicationversions.application.kubesphere.io
|
||||
spec:
|
||||
group: application.kubesphere.io
|
||||
names:
|
||||
kind: HelmApplicationVersion
|
||||
listKind: HelmApplicationVersionList
|
||||
plural: helmapplicationversions
|
||||
shortNames:
|
||||
- happver
|
||||
singular: helmapplicationversion
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.name
|
||||
name: application name
|
||||
type: string
|
||||
- jsonPath: .status.state
|
||||
name: State
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: HelmApplicationVersion is the Schema for the helmapplicationversions
|
||||
API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: HelmApplicationVersionSpec defines the desired state of HelmApplicationVersion
|
||||
properties:
|
||||
annotations:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Annotations are additional mappings uninterpreted by
|
||||
Helm, made available for inspection by other applications.
|
||||
type: object
|
||||
apiVersion:
|
||||
description: The API Version of this chart.
|
||||
type: string
|
||||
appVersion:
|
||||
description: The version of the application enclosed inside of this
|
||||
chart.
|
||||
type: string
|
||||
condition:
|
||||
description: The condition to check to enable chart
|
||||
type: string
|
||||
created:
|
||||
description: chart create time
|
||||
format: date-time
|
||||
type: string
|
||||
data:
|
||||
description: raw data of chart, it will !!!NOT!!! be save to etcd
|
||||
format: byte
|
||||
type: string
|
||||
dataKey:
|
||||
description: dataKey in the storage
|
||||
type: string
|
||||
dependencies:
|
||||
description: Dependencies are a list of dependencies for a chart.
|
||||
items:
|
||||
description: Dependency describes a chart upon which another chart
|
||||
depends. Dependencies can be used to express developer intent,
|
||||
or to capture the state of a chart.
|
||||
properties:
|
||||
alias:
|
||||
description: Alias usable alias to be used for the chart
|
||||
type: string
|
||||
condition:
|
||||
description: A yaml path that resolves to a boolean, used for
|
||||
enabling/disabling charts (e.g. subchart1.enabled )
|
||||
type: string
|
||||
enabled:
|
||||
description: Enabled bool determines if chart should be loaded
|
||||
type: boolean
|
||||
name:
|
||||
description: Name is the name of the dependency. This must mach
|
||||
the name in the dependency's Chart.yaml.
|
||||
type: string
|
||||
repository:
|
||||
description: The URL to the repository. Appending `index.yaml`
|
||||
to this string should result in a URL that can be used to
|
||||
fetch the repository index.
|
||||
type: string
|
||||
tags:
|
||||
description: Tags can be used to group charts for enabling/disabling
|
||||
together
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
version:
|
||||
description: Version is the version (range) of this chart. A
|
||||
lock file will always produce a single version, while a dependency
|
||||
may contain a semantic version range.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- repository
|
||||
type: object
|
||||
type: array
|
||||
deprecated:
|
||||
description: Whether or not this chart is deprecated
|
||||
type: boolean
|
||||
description:
|
||||
description: A one-sentence description of the chart
|
||||
type: string
|
||||
digest:
|
||||
description: chart digest
|
||||
type: string
|
||||
home:
|
||||
description: The URL to a relevant project page, git repo, or contact
|
||||
person
|
||||
type: string
|
||||
icon:
|
||||
description: The URL to an icon file.
|
||||
type: string
|
||||
keywords:
|
||||
description: A list of string keywords
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
kubeVersion:
|
||||
description: KubeVersion is a SemVer constraint specifying the version
|
||||
of Kubernetes required.
|
||||
type: string
|
||||
maintainers:
|
||||
description: A list of name and URL/email address combinations for
|
||||
the maintainer(s)
|
||||
items:
|
||||
description: Maintainer describes a Chart maintainer.
|
||||
properties:
|
||||
email:
|
||||
description: Email is an optional email address to contact the
|
||||
named maintainer
|
||||
type: string
|
||||
name:
|
||||
description: Name is a user name or organization name
|
||||
type: string
|
||||
url:
|
||||
description: URL is an optional URL to an address for the named
|
||||
maintainer
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
name:
|
||||
description: The name of the chart
|
||||
type: string
|
||||
sources:
|
||||
description: Source is the URL to the source code of this chart
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
tags:
|
||||
description: The tags to check to enable chart
|
||||
type: string
|
||||
type:
|
||||
description: 'Specifies the chart type: application or library'
|
||||
type: string
|
||||
urls:
|
||||
description: chart url
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
version:
|
||||
description: A SemVer 2 conformant version string of the chart
|
||||
type: string
|
||||
type: object
|
||||
status:
|
||||
description: HelmApplicationVersionStatus defines the observed state of
|
||||
HelmApplicationVersion
|
||||
properties:
|
||||
audit:
|
||||
items:
|
||||
properties:
|
||||
message:
|
||||
description: audit message
|
||||
type: string
|
||||
operator:
|
||||
description: audit operator
|
||||
type: string
|
||||
operatorType:
|
||||
type: string
|
||||
state:
|
||||
description: 'audit state: submitted, passed, draft, active,
|
||||
rejected, suspended'
|
||||
type: string
|
||||
time:
|
||||
description: audit time
|
||||
format: date-time
|
||||
type: string
|
||||
required:
|
||||
- time
|
||||
type: object
|
||||
type: array
|
||||
state:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -1,73 +0,0 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
creationTimestamp: null
|
||||
name: helmcategories.application.kubesphere.io
|
||||
spec:
|
||||
group: application.kubesphere.io
|
||||
names:
|
||||
kind: HelmCategory
|
||||
listKind: HelmCategoryList
|
||||
plural: helmcategories
|
||||
shortNames:
|
||||
- hctg
|
||||
singular: helmcategory
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.name
|
||||
name: name
|
||||
type: string
|
||||
- jsonPath: .status.total
|
||||
name: total
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: HelmCategory is the Schema for the helmcategories API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: HelmCategorySpec defines the desired state of HelmRepo
|
||||
properties:
|
||||
description:
|
||||
description: info from frontend
|
||||
type: string
|
||||
locale:
|
||||
type: string
|
||||
name:
|
||||
description: name of the category
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
status:
|
||||
properties:
|
||||
total:
|
||||
description: total helmapplications belong to this category
|
||||
type: integer
|
||||
required:
|
||||
- total
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -1,148 +0,0 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
creationTimestamp: null
|
||||
name: helmreleases.application.kubesphere.io
|
||||
spec:
|
||||
group: application.kubesphere.io
|
||||
names:
|
||||
kind: HelmRelease
|
||||
listKind: HelmReleaseList
|
||||
plural: helmreleases
|
||||
shortNames:
|
||||
- hrls
|
||||
singular: helmrelease
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.name
|
||||
name: Release Name
|
||||
type: string
|
||||
- jsonPath: .metadata.labels.kubesphere\.io/workspace
|
||||
name: Workspace
|
||||
type: string
|
||||
- jsonPath: .metadata.labels.kubesphere\.io/cluster
|
||||
name: Cluster
|
||||
type: string
|
||||
- jsonPath: .metadata.labels.kubesphere\.io/namespace
|
||||
name: Namespace
|
||||
type: string
|
||||
- jsonPath: .status.state
|
||||
name: State
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: HelmRelease is the Schema for the helmreleases API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: HelmReleaseSpec defines the desired state of HelmRelease
|
||||
properties:
|
||||
appId:
|
||||
description: id of the helmapplication
|
||||
type: string
|
||||
appVerId:
|
||||
description: application version id
|
||||
type: string
|
||||
chartAppVer:
|
||||
description: appVersion from Chart.yaml
|
||||
type: string
|
||||
chartName:
|
||||
description: The name of the chart which will be installed.
|
||||
type: string
|
||||
chartVersion:
|
||||
description: Specify the exact chart version to install. If this is
|
||||
not specified, the latest version is installed
|
||||
type: string
|
||||
description:
|
||||
description: Message got from frontend
|
||||
type: string
|
||||
name:
|
||||
description: Name of the release
|
||||
type: string
|
||||
repoId:
|
||||
description: id of the repo
|
||||
type: string
|
||||
values:
|
||||
description: helm release values.yaml
|
||||
format: byte
|
||||
type: string
|
||||
version:
|
||||
description: expected release version, when this version is not equal
|
||||
status.version, the release need upgrade this filed should be modified
|
||||
when any filed of the spec modified.
|
||||
type: integer
|
||||
required:
|
||||
- chartName
|
||||
- chartVersion
|
||||
- name
|
||||
- version
|
||||
type: object
|
||||
status:
|
||||
description: HelmReleaseStatus defines the observed state of HelmRelease
|
||||
properties:
|
||||
deployStatus:
|
||||
description: deploy status list of history, which will store at most
|
||||
10 state
|
||||
items:
|
||||
properties:
|
||||
deployTime:
|
||||
description: deploy time, upgrade time or check status time
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: A human readable message indicating details about
|
||||
why the release is in this state.
|
||||
type: string
|
||||
state:
|
||||
description: current state of the release
|
||||
type: string
|
||||
required:
|
||||
- deployTime
|
||||
- state
|
||||
type: object
|
||||
type: array
|
||||
lastDeployed:
|
||||
description: last deploy time or upgrade time
|
||||
format: date-time
|
||||
type: string
|
||||
lastUpdate:
|
||||
description: last update time
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: A human readable message indicating details about why
|
||||
the release is in this state.
|
||||
type: string
|
||||
state:
|
||||
description: current state
|
||||
type: string
|
||||
version:
|
||||
description: current release version
|
||||
type: integer
|
||||
required:
|
||||
- state
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -1,149 +0,0 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
creationTimestamp: null
|
||||
name: helmrepos.application.kubesphere.io
|
||||
spec:
|
||||
group: application.kubesphere.io
|
||||
names:
|
||||
kind: HelmRepo
|
||||
listKind: HelmRepoList
|
||||
plural: helmrepos
|
||||
shortNames:
|
||||
- hrepo
|
||||
singular: helmrepo
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.name
|
||||
name: name
|
||||
type: string
|
||||
- jsonPath: .metadata.labels.kubesphere\.io/workspace
|
||||
name: Workspace
|
||||
type: string
|
||||
- jsonPath: .spec.url
|
||||
name: url
|
||||
type: string
|
||||
- jsonPath: .status.state
|
||||
name: State
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: HelmRepo is the Schema for the helmrepoes API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: HelmRepoSpec defines the desired state of HelmRepo
|
||||
properties:
|
||||
credential:
|
||||
description: helm repo credential
|
||||
properties:
|
||||
accessKeyID:
|
||||
type: string
|
||||
caFile:
|
||||
description: verify certificates of HTTPS-enabled servers using
|
||||
this CA bundle
|
||||
type: string
|
||||
certFile:
|
||||
description: identify HTTPS client using this SSL certificate
|
||||
file
|
||||
type: string
|
||||
insecureSkipTLSVerify:
|
||||
description: skip tls certificate checks for the repository, default
|
||||
is ture
|
||||
type: boolean
|
||||
keyFile:
|
||||
description: identify HTTPS client using this SSL key file
|
||||
type: string
|
||||
password:
|
||||
description: chart repository password
|
||||
type: string
|
||||
secretAccessKey:
|
||||
type: string
|
||||
username:
|
||||
description: chart repository username
|
||||
type: string
|
||||
type: object
|
||||
description:
|
||||
description: chart repo description from frontend
|
||||
type: string
|
||||
name:
|
||||
description: name of the repo
|
||||
type: string
|
||||
syncPeriod:
|
||||
description: sync period in seconds, no sync when SyncPeriod=0, the
|
||||
minimum SyncPeriod is 180s
|
||||
type: integer
|
||||
url:
|
||||
description: helm repo url
|
||||
type: string
|
||||
version:
|
||||
description: expected repo version, when this version is not equal
|
||||
status.version, the repo need upgrade this filed should be modified
|
||||
when any filed of the spec modified.
|
||||
type: integer
|
||||
required:
|
||||
- name
|
||||
- url
|
||||
type: object
|
||||
status:
|
||||
description: HelmRepoStatus defines the observed state of HelmRepo
|
||||
properties:
|
||||
data:
|
||||
description: repo index
|
||||
type: string
|
||||
lastUpdateTime:
|
||||
description: status last update time
|
||||
format: date-time
|
||||
type: string
|
||||
state:
|
||||
description: current state of the repo, successful, failed or syncing
|
||||
type: string
|
||||
syncState:
|
||||
description: sync state list of history, which will store at most
|
||||
10 state
|
||||
items:
|
||||
properties:
|
||||
message:
|
||||
description: A human readable message indicating details about
|
||||
why the repo is in this state.
|
||||
type: string
|
||||
state:
|
||||
description: 'last sync state, valid state are: "failed", "success",
|
||||
and ""'
|
||||
type: string
|
||||
syncTime:
|
||||
format: date-time
|
||||
type: string
|
||||
required:
|
||||
- syncTime
|
||||
type: object
|
||||
type: array
|
||||
version:
|
||||
description: if status.version!=spec.Version, we need sync the repo
|
||||
now
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -1,123 +0,0 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
creationTimestamp: null
|
||||
name: gateways.gateway.kubesphere.io
|
||||
spec:
|
||||
group: gateway.kubesphere.io
|
||||
names:
|
||||
kind: Gateway
|
||||
listKind: GatewayList
|
||||
plural: gateways
|
||||
singular: gateway
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: Gateway is the Schema for the gateways API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: GatewaySpec defines the desired state of Gateway
|
||||
properties:
|
||||
controller:
|
||||
properties:
|
||||
annotations:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
config:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
replicas:
|
||||
format: int32
|
||||
type: integer
|
||||
scope:
|
||||
properties:
|
||||
enabled:
|
||||
type: boolean
|
||||
namespace:
|
||||
type: string
|
||||
type: object
|
||||
tcp:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
udp:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
deployment:
|
||||
properties:
|
||||
annotations:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
replicas:
|
||||
format: int32
|
||||
type: integer
|
||||
resources:
|
||||
description: ResourceRequirements describes the compute resource
|
||||
requirements.
|
||||
properties:
|
||||
limits:
|
||||
additionalProperties:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||
x-kubernetes-int-or-string: true
|
||||
description: 'Limits describes the maximum amount of compute
|
||||
resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
|
||||
type: object
|
||||
requests:
|
||||
additionalProperties:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||
x-kubernetes-int-or-string: true
|
||||
description: 'Requests describes the minimum amount of compute
|
||||
resources required. If Requests is omitted for a container,
|
||||
it defaults to Limits if that is explicitly specified, otherwise
|
||||
to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
service:
|
||||
properties:
|
||||
annotations:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
type:
|
||||
description: Service Type string describes ingress methods for
|
||||
a service
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
status:
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -1,123 +0,0 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
creationTimestamp: null
|
||||
name: federatedrolebindings.iam.kubesphere.io
|
||||
spec:
|
||||
group: iam.kubesphere.io
|
||||
names:
|
||||
kind: FederatedRoleBinding
|
||||
listKind: FederatedRoleBindingList
|
||||
plural: federatedrolebindings
|
||||
singular: federatedrolebinding
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
placement:
|
||||
properties:
|
||||
clusterSelector:
|
||||
properties:
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
clusters:
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
template:
|
||||
properties:
|
||||
metadata:
|
||||
type: object
|
||||
roleRef:
|
||||
description: RoleRef contains information that points to the role
|
||||
being used
|
||||
properties:
|
||||
apiGroup:
|
||||
description: APIGroup is the group for the resource being
|
||||
referenced
|
||||
type: string
|
||||
kind:
|
||||
description: Kind is the type of resource being referenced
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name of resource being referenced
|
||||
type: string
|
||||
required:
|
||||
- apiGroup
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
subjects:
|
||||
items:
|
||||
description: Subject contains a reference to the object or user
|
||||
identities a role binding applies to. This can either hold
|
||||
a direct API object reference, or a value for non-objects
|
||||
such as user and group names.
|
||||
properties:
|
||||
apiGroup:
|
||||
description: APIGroup holds the API group of the referenced
|
||||
subject. Defaults to "" for ServiceAccount subjects. Defaults
|
||||
to "rbac.authorization.k8s.io" for User and Group subjects.
|
||||
type: string
|
||||
kind:
|
||||
description: Kind of object being referenced. Values defined
|
||||
by this API group are "User", "Group", and "ServiceAccount".
|
||||
If the Authorizer does not recognized the kind value,
|
||||
the Authorizer should report an error.
|
||||
type: string
|
||||
name:
|
||||
description: Name of the object being referenced.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace of the referenced object. If the
|
||||
object kind is non-namespace, such as "User" or "Group",
|
||||
and this value is not empty the Authorizer should report
|
||||
an error.
|
||||
type: string
|
||||
required:
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: array
|
||||
required:
|
||||
- roleRef
|
||||
type: object
|
||||
required:
|
||||
- placement
|
||||
- template
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -1,119 +0,0 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
creationTimestamp: null
|
||||
name: federatedroles.iam.kubesphere.io
|
||||
spec:
|
||||
group: iam.kubesphere.io
|
||||
names:
|
||||
kind: FederatedRole
|
||||
listKind: FederatedRoleList
|
||||
plural: federatedroles
|
||||
singular: federatedrole
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
placement:
|
||||
properties:
|
||||
clusterSelector:
|
||||
properties:
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
clusters:
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
template:
|
||||
properties:
|
||||
metadata:
|
||||
type: object
|
||||
rules:
|
||||
items:
|
||||
description: PolicyRule holds information that describes a policy
|
||||
rule, but does not contain information about who the rule
|
||||
applies to or which namespace the rule applies to.
|
||||
properties:
|
||||
apiGroups:
|
||||
description: APIGroups is the name of the APIGroup that
|
||||
contains the resources. If multiple API groups are specified,
|
||||
any action requested against one of the enumerated resources
|
||||
in any API group will be allowed. "" represents the core
|
||||
API group and "*" represents all API groups.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
nonResourceURLs:
|
||||
description: NonResourceURLs is a set of partial urls that
|
||||
a user should have access to. *s are allowed, but only
|
||||
as the full, final step in the path Since non-resource
|
||||
URLs are not namespaced, this field is only applicable
|
||||
for ClusterRoles referenced from a ClusterRoleBinding.
|
||||
Rules can either apply to API resources (such as "pods"
|
||||
or "secrets") or non-resource URL paths (such as "/api"), but
|
||||
not both.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
resourceNames:
|
||||
description: ResourceNames is an optional white list of
|
||||
names that the rule applies to. An empty set means that
|
||||
everything is allowed.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
resources:
|
||||
description: Resources is a list of resources this rule
|
||||
applies to. '*' represents all resources.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
verbs:
|
||||
description: Verbs is a list of Verbs that apply to ALL
|
||||
the ResourceKinds contained in this rule. '*' represents
|
||||
all verbs.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- verbs
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
required:
|
||||
- placement
|
||||
- template
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -1,132 +0,0 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
creationTimestamp: null
|
||||
name: federatedusers.iam.kubesphere.io
|
||||
spec:
|
||||
group: iam.kubesphere.io
|
||||
names:
|
||||
kind: FederatedUser
|
||||
listKind: FederatedUserList
|
||||
plural: federatedusers
|
||||
singular: federateduser
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
placement:
|
||||
properties:
|
||||
clusterSelector:
|
||||
properties:
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
clusters:
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
template:
|
||||
properties:
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: UserSpec defines the desired state of User
|
||||
properties:
|
||||
description:
|
||||
description: Description of the user.
|
||||
type: string
|
||||
displayName:
|
||||
type: string
|
||||
email:
|
||||
description: Unique email address(https://www.ietf.org/rfc/rfc5322.txt).
|
||||
type: string
|
||||
groups:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
lang:
|
||||
description: The preferred written or spoken language for
|
||||
the user.
|
||||
type: string
|
||||
password:
|
||||
description: 'password will be encrypted by mutating admission
|
||||
webhook Password pattern is tricky here. The rule is simple:
|
||||
length between [6,64], at least one uppercase letter, one
|
||||
lowercase letter, one digit. The regexp in console(javascript)
|
||||
is quite straightforward: ^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[^]{6,64}$
|
||||
But in Go, we don''t have ?= (back tracking) capability
|
||||
in regexp (also in CRD validation pattern) So we adopted
|
||||
an alternative scheme to achieve. Use 6 different regexp
|
||||
to combine to achieve the same effect. These six schemes
|
||||
enumerate the arrangement of numbers, uppercase letters,
|
||||
and lowercase letters that appear for the first time. -
|
||||
^(.*[a-z].*[A-Z].*[0-9].*)$ stands for lowercase letter
|
||||
comes first, then followed by an uppercase letter, then
|
||||
a digit. - ^(.*[a-z].*[0-9].*[A-Z].*)$ stands for lowercase
|
||||
letter comes first, then followed by a digit, then an uppercase
|
||||
leeter. - ^(.*[A-Z].*[a-z].*[0-9].*)$ ... - ^(.*[A-Z].*[0-9].*[a-z].*)$
|
||||
... - ^(.*[0-9].*[a-z].*[A-Z].*)$ ... - ^(.*[0-9].*[A-Z].*[a-z].*)$
|
||||
... Last but not least, the bcrypt string is also included
|
||||
to match the encrypted password. ^(\$2[ayb]\$.{56})$'
|
||||
maxLength: 64
|
||||
minLength: 8
|
||||
pattern: ^(.*[a-z].*[A-Z].*[0-9].*)$|^(.*[a-z].*[0-9].*[A-Z].*)$|^(.*[A-Z].*[a-z].*[0-9].*)$|^(.*[A-Z].*[0-9].*[a-z].*)$|^(.*[0-9].*[a-z].*[A-Z].*)$|^(.*[0-9].*[A-Z].*[a-z].*)$|^(\$2[ayb]\$.{56})$
|
||||
type: string
|
||||
required:
|
||||
- email
|
||||
type: object
|
||||
status:
|
||||
description: UserStatus defines the observed state of User
|
||||
properties:
|
||||
lastLoginTime:
|
||||
description: Last login attempt timestamp
|
||||
format: date-time
|
||||
type: string
|
||||
lastTransitionTime:
|
||||
format: date-time
|
||||
type: string
|
||||
reason:
|
||||
type: string
|
||||
state:
|
||||
description: The user status
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
required:
|
||||
- placement
|
||||
- template
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -1,93 +0,0 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
creationTimestamp: null
|
||||
name: globalrolebindings.iam.kubesphere.io
|
||||
spec:
|
||||
group: iam.kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- iam
|
||||
kind: GlobalRoleBinding
|
||||
listKind: GlobalRoleBindingList
|
||||
plural: globalrolebindings
|
||||
singular: globalrolebinding
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: GlobalRoleBinding is the Schema for the globalrolebindings API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
roleRef:
|
||||
description: RoleRef can only reference a GlobalRole. If the RoleRef cannot
|
||||
be resolved, the Authorizer must return an error.
|
||||
properties:
|
||||
apiGroup:
|
||||
description: APIGroup is the group for the resource being referenced
|
||||
type: string
|
||||
kind:
|
||||
description: Kind is the type of resource being referenced
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name of resource being referenced
|
||||
type: string
|
||||
required:
|
||||
- apiGroup
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
subjects:
|
||||
description: Subjects holds references to the objects the role applies
|
||||
to.
|
||||
items:
|
||||
description: Subject contains a reference to the object or user identities
|
||||
a role binding applies to. This can either hold a direct API object
|
||||
reference, or a value for non-objects such as user and group names.
|
||||
properties:
|
||||
apiGroup:
|
||||
description: APIGroup holds the API group of the referenced subject.
|
||||
Defaults to "" for ServiceAccount subjects. Defaults to "rbac.authorization.k8s.io"
|
||||
for User and Group subjects.
|
||||
type: string
|
||||
kind:
|
||||
description: Kind of object being referenced. Values defined by
|
||||
this API group are "User", "Group", and "ServiceAccount". If the
|
||||
Authorizer does not recognized the kind value, the Authorizer
|
||||
should report an error.
|
||||
type: string
|
||||
name:
|
||||
description: Name of the object being referenced.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace of the referenced object. If the object
|
||||
kind is non-namespace, such as "User" or "Group", and this value
|
||||
is not empty the Authorizer should report an error.
|
||||
type: string
|
||||
required:
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: array
|
||||
required:
|
||||
- roleRef
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -1,87 +0,0 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
creationTimestamp: null
|
||||
name: globalroles.iam.kubesphere.io
|
||||
spec:
|
||||
group: iam.kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- iam
|
||||
kind: GlobalRole
|
||||
listKind: GlobalRoleList
|
||||
plural: globalroles
|
||||
singular: globalrole
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
rules:
|
||||
description: Rules holds all the PolicyRules for this GlobalRole
|
||||
items:
|
||||
description: PolicyRule holds information that describes a policy rule,
|
||||
but does not contain information about who the rule applies to or
|
||||
which namespace the rule applies to.
|
||||
properties:
|
||||
apiGroups:
|
||||
description: APIGroups is the name of the APIGroup that contains
|
||||
the resources. If multiple API groups are specified, any action
|
||||
requested against one of the enumerated resources in any API group
|
||||
will be allowed. "" represents the core API group and "*" represents
|
||||
all API groups.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
nonResourceURLs:
|
||||
description: NonResourceURLs is a set of partial urls that a user
|
||||
should have access to. *s are allowed, but only as the full,
|
||||
final step in the path Since non-resource URLs are not namespaced,
|
||||
this field is only applicable for ClusterRoles referenced from
|
||||
a ClusterRoleBinding. Rules can either apply to API resources
|
||||
(such as "pods" or "secrets") or non-resource URL paths (such
|
||||
as "/api"), but not both.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
resourceNames:
|
||||
description: ResourceNames is an optional white list of names that
|
||||
the rule applies to. An empty set means that everything is allowed.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
resources:
|
||||
description: Resources is a list of resources this rule applies
|
||||
to. '*' represents all resources.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
verbs:
|
||||
description: Verbs is a list of Verbs that apply to ALL the ResourceKinds
|
||||
contained in this rule. '*' represents all verbs.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- verbs
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
@@ -1,61 +0,0 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
creationTimestamp: null
|
||||
name: groupbindings.iam.kubesphere.io
|
||||
spec:
|
||||
group: iam.kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- group
|
||||
kind: GroupBinding
|
||||
listKind: GroupBindingList
|
||||
plural: groupbindings
|
||||
singular: groupbinding
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .groupRef.name
|
||||
name: Group
|
||||
type: string
|
||||
- jsonPath: .users
|
||||
name: Users
|
||||
type: string
|
||||
name: v1alpha2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: GroupBinding is the Schema for the groupbindings API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
groupRef:
|
||||
description: GroupRef defines the desired relation of GroupBinding
|
||||
properties:
|
||||
apiGroup:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
type: object
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
users:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
@@ -1,50 +0,0 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
creationTimestamp: null
|
||||
name: groups.iam.kubesphere.io
|
||||
spec:
|
||||
group: iam.kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- group
|
||||
kind: Group
|
||||
listKind: GroupList
|
||||
plural: groups
|
||||
singular: group
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .metadata.labels.kubesphere\.io/workspace
|
||||
name: Workspace
|
||||
type: string
|
||||
name: v1alpha2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: Group is the Schema for the groups API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: GroupSpec defines the desired state of Group
|
||||
type: object
|
||||
status:
|
||||
description: GroupStatus defines the observed state of Group
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
@@ -1,87 +0,0 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (unknown)
|
||||
creationTimestamp: null
|
||||
name: loginrecords.iam.kubesphere.io
|
||||
spec:
|
||||
group: iam.kubesphere.io
|
||||
names:
|
||||
categories:
|
||||
- iam
|
||||
kind: LoginRecord
|
||||
listKind: LoginRecordList
|
||||
plural: loginrecords
|
||||
singular: loginrecord
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.type
|
||||
name: Type
|
||||
type: string
|
||||
- jsonPath: .spec.provider
|
||||
name: Provider
|
||||
type: string
|
||||
- jsonPath: .spec.sourceIP
|
||||
name: From
|
||||
type: string
|
||||
- jsonPath: .spec.success
|
||||
name: Success
|
||||
type: string
|
||||
- jsonPath: .spec.reason
|
||||
name: Reason
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1alpha2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
provider:
|
||||
description: Provider of authentication, Ldap/Github etc.
|
||||
type: string
|
||||
reason:
|
||||
description: States failed login attempt reason
|
||||
type: string
|
||||
sourceIP:
|
||||
description: Source IP of client
|
||||
type: string
|
||||
success:
|
||||
description: Successful login attempt or not
|
||||
type: boolean
|
||||
type:
|
||||
description: Which authentication method used, Password/OAuth/Token
|
||||
type: string
|
||||
userAgent:
|
||||
description: User agent of login attempt
|
||||
type: string
|
||||
required:
|
||||
- provider
|
||||
- reason
|
||||
- sourceIP
|
||||
- success
|
||||
- type
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user