Skip to content

Commit e3a0959

Browse files
eigenpauleigenpaul
committed
initial commit
Signed-off-by: Paul Hildebrandt <[email protected]>
0 parents  commit e3a0959

File tree

8 files changed

+197
-0
lines changed

8 files changed

+197
-0
lines changed

‎.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎Chart.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: v2
2+
name: csp-helper-chart
3+
description: A Helm chart to deploy SCS cluster-api-provider-v2 per-tenant resources
4+
version: 0.2.0
5+
appVersion: "0.2.0"

‎README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
This chart can be used to create a new namespace and two secrets for the clusterstacks approach. It reads clouds.yaml files in its raw form either with username and password or with an application credential. The chart is intended to be used once per Openstack-Project/Tenant. It is meant to prepare one corresponding namespace in the cluster-API management cluster (1:1 relation between openstackproject and cluster-namespace). The recommended way to invoke the chart is:
2+
3+
```
4+
helm upgrade -i <tenant>-credentials -n <tenant> --create-namespace https://github.com/SovereignCloudStack/cluster-stacks/releases/download/openstack-csp-helper-v0.2.0/openstack-csp-helper.tgz -f clouds.yaml
5+
```

‎templates/_helpers.tpl‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
{{/*
2+
Checks whether we have a regular clouds.yaml or one with application credentials.
3+
*/}}
4+
5+
{{- define "cloud_name" -}}
6+
{{- if ne
7+
( keys .Values.clouds | len )
8+
1
9+
-}}
10+
{{ fail "please provide values.yaml/clouds.yaml with exactly one cloud beneath the \".clouds\" key." }}
11+
{{- end -}}
12+
{{ keys .Values.clouds | first }}
13+
{{- end }}
14+
15+
{{- define "auth_auth_url" -}}
16+
{{ get (get (get .Values.clouds (include "cloud_name" .)) "auth") "auth_url" }}
17+
{{- end }}
18+
19+
{{- define "auth_username" -}}
20+
{{ get (get (get .Values.clouds (include "cloud_name" .)) "auth") "username" }}
21+
{{- end }}
22+
23+
{{- define "auth_password" -}}
24+
{{ get (get (get .Values.clouds (include "cloud_name" .)) "auth") "password" }}
25+
{{- end }}
26+
27+
{{- define "auth_project_id" -}}
28+
{{ get (get (get .Values.clouds (include "cloud_name" .)) "auth") "project_id" }}
29+
{{- end }}
30+
31+
{{- define "auth_project_name" -}}
32+
{{ get (get (get .Values.clouds (include "cloud_name" .)) "auth") "project_name" }}
33+
{{- end }}
34+
35+
{{- define "auth_user_domain_name" -}}
36+
{{ get (get (get .Values.clouds (include "cloud_name" .)) "auth") "user_domain_name" }}
37+
{{- end }}
38+
39+
{{- define "auth_application_credential_id" -}}
40+
{{ get (get (get .Values.clouds (include "cloud_name" .)) "auth") "application_credential_id" }}
41+
{{- end }}
42+
43+
{{- define "auth_application_credential_secret" -}}
44+
{{ get (get (get .Values.clouds (include "cloud_name" .)) "auth") "application_credential_secret" }}
45+
{{- end }}
46+
47+
{{- define "region_name" -}}
48+
{{ get (get .Values.clouds (include "cloud_name" .)) "region_name" }}
49+
{{- end }}
50+
51+
{{- define "isAppCredential" -}}
52+
{{- if and
53+
( include "auth_username" .)
54+
(not ( include "auth_application_credential_id" . ))
55+
-}}
56+
{{- else if and
57+
( not ( include "auth_username" . ))
58+
( include "auth_application_credential_id" . )
59+
-}}
60+
true
61+
{{- else }}
62+
{{ fail "please provide either username or application_credential_id, not both, not none" }}
63+
{{- end }}
64+
{{- end }}
65+
66+
{{/*
67+
Templates the cloud.conf as needed by the openstack CCM
68+
*/}}
69+
{{- define "cloud.conf" -}}
70+
[Global]
71+
auth-url={{ include "auth_auth_url" . }}
72+
region={{ include "region_name" . }}
73+
{{ if include "isAppCredential" . }}
74+
application-credential-id={{ include "auth_application_credential_id" . }}
75+
application-credential-secret={{ include "auth_application_credential_secret" . }}
76+
{{- else -}}
77+
username={{ include "auth_username" . }}
78+
password={{ include "auth_password" . }}
79+
user-domain-name={{ include "auth_user_domain_name" . }}
80+
tenant-id={{ include "auth_project_id" . }}
81+
{{ end }}
82+
83+
[LoadBalancer]
84+
manage-security-groups=true
85+
use-octavia=true
86+
enable-ingress-hostname=true
87+
create-monitor=true
88+
{{- end }}
89+
90+
91+
92+
{{/*
93+
Templates the secret that contains cloud.conf as needed by the openstack CCM
94+
*/}}
95+
{{- define "cloud-config" -}}
96+
apiVersion: v1
97+
data:
98+
cloud.conf: {{ include "cloud.conf" . | b64enc }}
99+
kind: Secret
100+
metadata:
101+
name: cloud-config
102+
namespace: kube-system
103+
type: Opaque
104+
{{- end }}

‎templates/cloud-secret.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: {{ include "cloud_name" . }}
5+
data:
6+
clouds.yaml: {{ toYaml .Values | b64enc }}
7+
type: Opaque

‎templates/cluster-resource-set.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: addons.cluster.x-k8s.io/v1beta1
2+
kind: ClusterResourceSet
3+
metadata:
4+
name: crs-{{ include "cloud_name" . }}-secret
5+
spec:
6+
strategy: "Reconcile"
7+
clusterSelector:
8+
matchLabels:
9+
managed-secret: cloud-config
10+
resources:
11+
- name: {{ include "cloud_name" . }}-workload-cluster-secret
12+
kind: Secret

‎templates/openstack-workload-cluster-secret.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: v1
2+
data:
3+
cloud-config-secret: {{ include "cloud-config" . | b64enc }}
4+
kind: Secret
5+
metadata:
6+
name: {{ include "cloud_name" . }}-workload-cluster-secret
7+
type: addons.cluster.x-k8s.io/resource-set

‎values.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# This chart is intended to be used directly with the clouds.yaml that is
2+
# produced by OpenStacks Horizon dashboard. You can directly use the clouds.yaml
3+
# as values file. This values-file here is intentionally left blank so there will be
4+
# no merged clutter when you provide yours.
5+
#
6+
# You can either use a clouds.yaml with username and password or one with application
7+
# credentials. Possible combinations are:
8+
#
9+
# Username/password
10+
# clouds:
11+
# openstack:
12+
# auth:
13+
# auth_url: https://api.gx-scs.sovereignit.cloud:5000
14+
# username: "u500924-mxmxc"
15+
# password: "golden1337"
16+
# project_id: e7622c1048ac4520a2d050ae1416b
17+
# project_name: "p500924"
18+
# user_domain_name: "d500924"
19+
# region_name: "RegionOne"
20+
# interface: "public"
21+
# identity_api_version: 3
22+
#
23+
#
24+
# Application credentials:
25+
# clouds:
26+
# openstack:
27+
# auth:
28+
# auth_url: https://keystone.services.a.regiocloud.tech
29+
# application_credential_id: "a2202990c5454f42ae2d891fa00df1a3"
30+
# application_credential_secret: ""
31+
# region_name: "RegionA"
32+
# interface: "public"
33+
# identity_api_version: 3
34+
# auth_type: "v3applicationcredential"

0 commit comments

Comments
 (0)