1+ {{- if .Values.revisionController.enable -}}
2+ apiVersion : v1
3+ kind : ServiceAccount
4+ metadata :
5+ name : {{ include "openfunction.fullname" . }}-revision-controller
6+ labels :
7+ {{- include "openfunction.labels" . | nindent 4 }}
8+ ---
9+ apiVersion : rbac.authorization.k8s.io/v1
10+ kind : Role
11+ metadata :
12+ name : {{ include "openfunction.fullname" . }}-revision-controller-leader-election-role
13+ labels :
14+ {{- include "openfunction.labels" . | nindent 4 }}
15+ rules :
16+ - apiGroups :
17+ - " "
18+ resources :
19+ - configmaps
20+ verbs :
21+ - get
22+ - list
23+ - watch
24+ - create
25+ - update
26+ - patch
27+ - delete
28+ - apiGroups :
29+ - coordination.k8s.io
30+ resources :
31+ - leases
32+ verbs :
33+ - get
34+ - list
35+ - watch
36+ - create
37+ - update
38+ - patch
39+ - delete
40+ - apiGroups :
41+ - " "
42+ resources :
43+ - events
44+ verbs :
45+ - create
46+ - patch
47+ ---
48+ apiVersion : rbac.authorization.k8s.io/v1
49+ kind : ClusterRole
50+ metadata :
51+ name : {{ include "openfunction.fullname" . }}-revision-controller-role
52+ rules :
53+ - apiGroups :
54+ - " "
55+ resources :
56+ - secrets
57+ verbs :
58+ - get
59+ - list
60+ - watch
61+ - apiGroups :
62+ - core.openfunction.io
63+ resources :
64+ - functions
65+ verbs :
66+ - get
67+ - list
68+ - watch
69+ - apiGroups :
70+ - core.openfunction.io
71+ resources :
72+ - functions/status
73+ verbs :
74+ - get
75+ - patch
76+ - update
77+ - apiGroups :
78+ - authentication.k8s.io
79+ resources :
80+ - tokenreviews
81+ verbs :
82+ - create
83+ - apiGroups :
84+ - authorization.k8s.io
85+ resources :
86+ - subjectaccessreviews
87+ verbs :
88+ - create
89+ ---
90+ apiVersion : rbac.authorization.k8s.io/v1
91+ kind : RoleBinding
92+ metadata :
93+ name : {{ include "openfunction.fullname" . }}-revision-controller-leader-election-rolebinding
94+ roleRef :
95+ apiGroup : rbac.authorization.k8s.io
96+ kind : Role
97+ name : {{ include "openfunction.fullname" . }}-revision-controller-leader-election-role
98+ subjects :
99+ - kind : ServiceAccount
100+ name : {{ include "openfunction.fullname" . }}-revision-controller
101+ namespace : ' {{ .Release.Namespace }}'
102+ ---
103+ apiVersion : rbac.authorization.k8s.io/v1
104+ kind : ClusterRoleBinding
105+ metadata :
106+ name : {{ include "openfunction.fullname" . }}-revision-controller-rolebinding
107+ roleRef :
108+ apiGroup : rbac.authorization.k8s.io
109+ kind : ClusterRole
110+ name : {{ include "openfunction.fullname" . }}-revision-controller-role
111+ subjects :
112+ - kind : ServiceAccount
113+ name : {{ include "openfunction.fullname" . }}-revision-controller
114+ namespace : ' {{ .Release.Namespace }}'
115+ ---
116+ apiVersion : apps/v1
117+ kind : Deployment
118+ metadata :
119+ labels :
120+ {{- include "openfunction.labels" . | nindent 4 }}
121+ name : {{ include "openfunction.fullname" . }}-revision-controller
122+ spec :
123+ replicas : 1
124+ selector :
125+ matchLabels :
126+ control-plane : revision-controller
127+ {{- include "openfunction.labels" . | nindent 6 }}
128+ template :
129+ metadata :
130+ labels :
131+ {{- include "openfunction.labels" . | nindent 8 }}
132+ control-plane : revision-controller
133+ spec :
134+ containers :
135+ - args :
136+ - --health-probe-bind-address=:8081
137+ - --metrics-bind-address=127.0.0.1:8080
138+ - --leader-elect
139+ - --zap-log-level=info
140+ command :
141+ - /revision-controller
142+ image : {{ .Values.revisionController.image.repository }}:{{ .Values.revisionController.image.tag }}
143+ imagePullPolicy : {{ .Values.revisionController.image.pullPolicy }}
144+ livenessProbe :
145+ httpGet :
146+ path : /healthz
147+ port : 8081
148+ initialDelaySeconds : 15
149+ periodSeconds : 20
150+ name : revision-controller
151+ readinessProbe :
152+ httpGet :
153+ path : /readyz
154+ port : 8081
155+ initialDelaySeconds : 5
156+ periodSeconds : 10
157+ resources :
158+ limits :
159+ cpu : 500m
160+ memory : 500Mi
161+ requests :
162+ cpu : 100m
163+ memory : 20Mi
164+ securityContext :
165+ allowPrivilegeEscalation : false
166+ securityContext :
167+ runAsNonRoot : true
168+ serviceAccountName : {{ include "openfunction.fullname" . }}-revision-controller
169+ terminationGracePeriodSeconds : 10
170+
171+ {{- end }}
0 commit comments