diff --git a/charts/cf-vcluster/.helmignore b/charts/cf-vcluster/.helmignore new file mode 100644 index 0000000..ff00645 --- /dev/null +++ b/charts/cf-vcluster/.helmignore @@ -0,0 +1,26 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ + +# Adding schema.json file to exclude to reduce issues with Helm provider in Crossplane, strongly suggest to enable it while developing +charts/vcluster/values.schema.json diff --git a/charts/cf-vcluster/Chart.yaml b/charts/cf-vcluster/Chart.yaml new file mode 100644 index 0000000..05e03d3 --- /dev/null +++ b/charts/cf-vcluster/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: cf-vcluster +description: Umbrella chart over vCluster adjusted for Codefresh use cases - mainly in Crossplane compositions +type: application +version: 0.28.0-0 +appVersion: "0.28.0" +dependencies: + - name: vcluster + version: 0.28.0 +maintainers: + - name: codefresh + url: https://codefresh-io.github.io/ diff --git a/charts/cf-vcluster/README.md b/charts/cf-vcluster/README.md new file mode 100644 index 0000000..1441576 --- /dev/null +++ b/charts/cf-vcluster/README.md @@ -0,0 +1,58 @@ +# cf-vcluster + +![Version: 0.28.0-0](https://img.shields.io/badge/Version-0.28.0--0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.28.0](https://img.shields.io/badge/AppVersion-0.28.0-informational?style=flat-square) + +Umbrella chart over vCluster adjusted for Codefresh use cases - mainly in Crossplane compositions + +## Maintainers + +| Name | Email | Url | +| ---- | ------ | --- | +| codefresh | | | + +## Requirements + +| Repository | Name | Version | +|------------|------|---------| +| | vcluster | 0.28.0 | + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| global.ingress.internal.annotations."nginx.ingress.kubernetes.io/backend-protocol" | string | `"HTTPS"` | | +| global.ingress.internal.annotations."nginx.ingress.kubernetes.io/ssl-passthrough" | string | `"true"` | | +| global.ingress.internal.annotations."nginx.ingress.kubernetes.io/ssl-redirect" | string | `"true"` | | +| global.ingress.internal.backendServiceOverride | object | `{}` | Possibility to override backend service name for ingress. If not set default vcluster backend service will be used | +| global.ingress.internal.enabled | bool | `false` | | +| global.ingress.internal.host.domain | string | `"corp.local"` | | +| global.ingress.internal.host.name | string | `"{{ .Release.Name }}"` | | +| global.ingress.internal.ingressClassName | string | `"nginx-internal"` | | +| global.ingress.public.annotations."nginx.ingress.kubernetes.io/backend-protocol" | string | `"HTTPS"` | | +| global.ingress.public.annotations."nginx.ingress.kubernetes.io/ssl-passthrough" | string | `"true"` | | +| global.ingress.public.annotations."nginx.ingress.kubernetes.io/ssl-redirect" | string | `"true"` | | +| global.ingress.public.backendServiceOverride | object | `{}` | Possibility to override backend service name for ingress. If not set default vcluster backend service will be used | +| global.ingress.public.enabled | bool | `false` | | +| global.ingress.public.host.domain | string | `"example.com"` | | +| global.ingress.public.host.name | string | `"{{ .Release.Name }}"` | | +| global.ingress.public.ingressClassName | string | `"nginx-public"` | | +| vcluster.controlPlane.distro.k8s.apiServer.extraArgs[0] | string | `"--oidc-issuer-url=https://dexidp.shared-services.cf-infra.com"` | | +| vcluster.controlPlane.distro.k8s.apiServer.extraArgs[1] | string | `"--oidc-client-id=vcluster-login"` | | +| vcluster.controlPlane.distro.k8s.apiServer.extraArgs[2] | string | `"--oidc-username-claim=email"` | | +| vcluster.controlPlane.distro.k8s.apiServer.extraArgs[3] | string | `"--oidc-groups-claim=groups"` | | +| vcluster.controlPlane.distro.k8s.enabled | bool | `true` | | +| vcluster.controlPlane.proxy.extraSANs[0] | string | `"{{ tpl (printf \"%s.%s.%s\" .Release.Name .Release.Namespace \".cluster.svc.local\") . }}"` | | +| vcluster.controlPlane.proxy.extraSANs[1] | string | `"{{ tpl (printf \"%s.%s\" .Values.global.ingress.internal.host.name .Values.global.ingress.internal.host.domain) . }}"` | | +| vcluster.controlPlane.proxy.extraSANs[2] | string | `"{{ tpl (printf \"%s.%s\" .Values.global.ingress.public.host.name .Values.global.ingress.public.host.domain) . }}"` | | +| vcluster.experimental.deploy.vcluster.manifests | string | `"---\nkind: ClusterRoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: oidc-cluster-admin\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: cluster-admin\nsubjects:\n- kind: Group\n name: rnd@codefresh.io\n---\nkind: ClusterRoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: oidc-cluster-admin-octopus\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: cluster-admin\nsubjects:\n- kind: Group\n name: 787d1a9a-e488-4a77-bb6c-f4b2fdfd8cea # Codefresh R&D Team\n- kind: Group\n name: 607a9f67-422c-4ca2-b8c4-d0be213b9650 # Codefresh SA Team\n- kind: Group\n name: f8de82e2-cdb6-480a-8f37-9f958ea5fef5 # Codefresh Support Team\n- kind: Group\n name: 16b3fb37-58f2-4786-8ca8-6f58d0410687 # Codefresh OSS Team\n- kind: Group\n name: dc35779f-57d5-4dff-90c0-34c6e93fe7e7 # Codefresh OSS Team\n---\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: codefresh-pipelines-integration-cluster-admin\n namespace: kube-system\n---\napiVersion: v1\nkind: Secret\nmetadata:\n name: codefresh-pipelines-integration-cluster-admin-token\n namespace: kube-system\n annotations:\n kubernetes.io/service-account.name: codefresh-pipelines-integration-cluster-admin\ntype: kubernetes.io/service-account-token\n---\nkind: ClusterRoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: codefresh-pipelines-integration-cluster-admin\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: cluster-admin\nsubjects:\n- kind: ServiceAccount\n name: codefresh-pipelines-integration-cluster-admin\n namespace: kube-system"` | | +| vcluster.rbac.clusterRole.enabled | bool | `true` | | +| vcluster.sync.fromHost.ingressClasses.enabled | bool | `true` | | +| vcluster.sync.fromHost.nodes.enabled | bool | `true` | | +| vcluster.sync.toHost.ingresses.enabled | bool | `true` | | +| vcluster.sync.toHost.persistentVolumeClaims.enabled | bool | `true` | | +| vcluster.sync.toHost.persistentVolumes.enabled | bool | `true` | | +| vcluster.sync.toHost.serviceAccounts.enabled | bool | `true` | | +| vcluster.sync.toHost.storageClasses.enabled | bool | `true` | | + +---------------------------------------------- +Autogenerated from chart metadata using [helm-docs v1.9.1](https://github.com/norwoodj/helm-docs/releases/v1.9.1) diff --git a/charts/cf-vcluster/charts/vcluster/.helmignore b/charts/cf-vcluster/charts/vcluster/.helmignore new file mode 100644 index 0000000..b6a3eb5 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/.helmignore @@ -0,0 +1,24 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store + +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ + +# Common backup files +*.swp +*.bak +*.tmp +*~ + +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/charts/cf-vcluster/charts/vcluster/Chart.yaml b/charts/cf-vcluster/charts/vcluster/Chart.yaml new file mode 100644 index 0000000..d093ecf --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/Chart.yaml @@ -0,0 +1,26 @@ +apiVersion: v2 +appVersion: 0.28.0 +description: vcluster - Virtual Kubernetes Clusters +home: https://vcluster.com +icon: https://static.loft.sh/branding/logos/vcluster/vertical/vcluster_vertical.svg +keywords: +- developer +- development +- sharing +- share +- multi-tenancy +- tenancy +- cluster +- space +- namespace +- vcluster +- vclusters +maintainers: +- email: info@loft.sh + name: Loft Labs, Inc. + url: https://twitter.com/loft_sh +name: vcluster +sources: +- https://github.com/loft-sh/vcluster +type: application +version: 0.28.0 diff --git a/charts/cf-vcluster/charts/vcluster/README.md b/charts/cf-vcluster/charts/vcluster/README.md new file mode 100644 index 0000000..caed9a9 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/README.md @@ -0,0 +1,432 @@ +# vcluster + +![Version: 0.28.0](https://img.shields.io/badge/Version-0.28.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.28.0](https://img.shields.io/badge/AppVersion-0.28.0-informational?style=flat-square) + +vcluster - Virtual Kubernetes Clusters + +**Homepage:** + +## Maintainers + +| Name | Email | Url | +| ---- | ------ | --- | +| Loft Labs, Inc. | | | + +## Source Code + +* + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| controlPlane.advanced.cloudControllerManager.enabled | bool | `true` | | +| controlPlane.advanced.defaultImageRegistry | string | `""` | | +| controlPlane.advanced.globalMetadata.annotations | object | `{}` | | +| controlPlane.advanced.headlessService.annotations | object | `{}` | | +| controlPlane.advanced.headlessService.labels | object | `{}` | | +| controlPlane.advanced.konnectivity.agent.enabled | bool | `true` | | +| controlPlane.advanced.konnectivity.agent.extraArgs | list | `[]` | | +| controlPlane.advanced.konnectivity.agent.extraEnv | list | `[]` | | +| controlPlane.advanced.konnectivity.agent.image | string | `""` | | +| controlPlane.advanced.konnectivity.agent.imagePullPolicy | string | `""` | | +| controlPlane.advanced.konnectivity.agent.nodeSelector | object | `{}` | | +| controlPlane.advanced.konnectivity.agent.replicas | int | `1` | | +| controlPlane.advanced.konnectivity.agent.tolerations | list | `[]` | | +| controlPlane.advanced.konnectivity.server.enabled | bool | `true` | | +| controlPlane.advanced.konnectivity.server.extraArgs | list | `[]` | | +| controlPlane.advanced.registry.anonymousPull | bool | `true` | | +| controlPlane.advanced.registry.config | object | `{}` | | +| controlPlane.advanced.registry.enabled | bool | `false` | | +| controlPlane.advanced.serviceAccount.annotations | object | `{}` | | +| controlPlane.advanced.serviceAccount.enabled | bool | `true` | | +| controlPlane.advanced.serviceAccount.imagePullSecrets | list | `[]` | | +| controlPlane.advanced.serviceAccount.labels | object | `{}` | | +| controlPlane.advanced.serviceAccount.name | string | `""` | | +| controlPlane.advanced.virtualScheduler.enabled | bool | `false` | | +| controlPlane.advanced.workloadServiceAccount.annotations | object | `{}` | | +| controlPlane.advanced.workloadServiceAccount.enabled | bool | `true` | | +| controlPlane.advanced.workloadServiceAccount.imagePullSecrets | list | `[]` | | +| controlPlane.advanced.workloadServiceAccount.labels | object | `{}` | | +| controlPlane.advanced.workloadServiceAccount.name | string | `""` | | +| controlPlane.backingStore.database.embedded.enabled | bool | `false` | | +| controlPlane.backingStore.database.embedded.extraArgs | list | `[]` | | +| controlPlane.backingStore.database.external.caFile | string | `""` | | +| controlPlane.backingStore.database.external.certFile | string | `""` | | +| controlPlane.backingStore.database.external.connector | string | `""` | | +| controlPlane.backingStore.database.external.dataSource | string | `""` | | +| controlPlane.backingStore.database.external.enabled | bool | `false` | | +| controlPlane.backingStore.database.external.extraArgs | list | `[]` | | +| controlPlane.backingStore.database.external.keyFile | string | `""` | | +| controlPlane.backingStore.etcd.deploy.enabled | bool | `false` | | +| controlPlane.backingStore.etcd.deploy.headlessService.annotations | object | `{}` | | +| controlPlane.backingStore.etcd.deploy.service.annotations | object | `{}` | | +| controlPlane.backingStore.etcd.deploy.service.enabled | bool | `true` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.annotations | object | `{}` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.enableServiceLinks | bool | `true` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.enabled | bool | `true` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.env | list | `[]` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.extraArgs | list | `[]` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.highAvailability.replicas | int | `1` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.image.registry | string | `"registry.k8s.io"` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.image.repository | string | `"etcd"` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.image.tag | string | `"3.5.21-0"` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.imagePullPolicy | string | `""` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.labels | object | `{}` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.persistence.addVolumeMounts | list | `[]` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.persistence.addVolumes | list | `[]` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.persistence.volumeClaim.accessModes[0] | string | `"ReadWriteOnce"` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.persistence.volumeClaim.enabled | bool | `true` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.persistence.volumeClaim.retentionPolicy | string | `"Retain"` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.persistence.volumeClaim.size | string | `"5Gi"` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.persistence.volumeClaim.storageClass | string | `""` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.persistence.volumeClaimTemplates | list | `[]` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.pods.annotations | object | `{}` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.pods.labels | object | `{}` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.resources.requests.cpu | string | `"20m"` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.resources.requests.memory | string | `"150Mi"` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.scheduling.affinity | object | `{}` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.scheduling.nodeSelector | object | `{}` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.scheduling.podManagementPolicy | string | `"Parallel"` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.scheduling.priorityClassName | string | `""` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.scheduling.tolerations | list | `[]` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.scheduling.topologySpreadConstraints | list | `[]` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.security.containerSecurityContext | object | `{}` | | +| controlPlane.backingStore.etcd.deploy.statefulSet.security.podSecurityContext | object | `{}` | | +| controlPlane.backingStore.etcd.embedded.enabled | bool | `false` | | +| controlPlane.backingStore.etcd.embedded.extraArgs | list | `[]` | | +| controlPlane.backingStore.etcd.embedded.migrateFromDeployedEtcd | bool | `false` | | +| controlPlane.backingStore.etcd.external.enabled | bool | `false` | | +| controlPlane.backingStore.etcd.external.endpoint | string | `""` | | +| controlPlane.backingStore.etcd.external.tls.caFile | string | `""` | | +| controlPlane.backingStore.etcd.external.tls.certFile | string | `""` | | +| controlPlane.backingStore.etcd.external.tls.keyFile | string | `""` | | +| controlPlane.coredns.deployment.affinity | object | `{}` | | +| controlPlane.coredns.deployment.annotations | object | `{}` | | +| controlPlane.coredns.deployment.image | string | `""` | | +| controlPlane.coredns.deployment.labels | object | `{}` | | +| controlPlane.coredns.deployment.nodeSelector | object | `{}` | | +| controlPlane.coredns.deployment.pods.annotations | object | `{}` | | +| controlPlane.coredns.deployment.pods.labels | object | `{}` | | +| controlPlane.coredns.deployment.replicas | int | `1` | | +| controlPlane.coredns.deployment.resources.limits.cpu | string | `"1000m"` | | +| controlPlane.coredns.deployment.resources.limits.memory | string | `"170Mi"` | | +| controlPlane.coredns.deployment.resources.requests.cpu | string | `"20m"` | | +| controlPlane.coredns.deployment.resources.requests.memory | string | `"64Mi"` | | +| controlPlane.coredns.deployment.tolerations | list | `[]` | | +| controlPlane.coredns.deployment.topologySpreadConstraints[0].labelSelector.matchLabels.k8s-app | string | `"vcluster-kube-dns"` | | +| controlPlane.coredns.deployment.topologySpreadConstraints[0].maxSkew | int | `1` | | +| controlPlane.coredns.deployment.topologySpreadConstraints[0].topologyKey | string | `"kubernetes.io/hostname"` | | +| controlPlane.coredns.deployment.topologySpreadConstraints[0].whenUnsatisfiable | string | `"DoNotSchedule"` | | +| controlPlane.coredns.embedded | bool | `false` | | +| controlPlane.coredns.enabled | bool | `true` | | +| controlPlane.coredns.overwriteConfig | string | `""` | | +| controlPlane.coredns.overwriteManifests | string | `""` | | +| controlPlane.coredns.priorityClassName | string | `""` | | +| controlPlane.coredns.security.containerSecurityContext | object | `{}` | | +| controlPlane.coredns.security.podSecurityContext | object | `{}` | | +| controlPlane.coredns.service.annotations | object | `{}` | | +| controlPlane.coredns.service.labels | object | `{}` | | +| controlPlane.coredns.service.spec.type | string | `"ClusterIP"` | | +| controlPlane.distro.k3s.command | list | `[]` | | +| controlPlane.distro.k3s.enabled | bool | `false` | | +| controlPlane.distro.k3s.extraArgs | list | `[]` | | +| controlPlane.distro.k3s.image.registry | string | `""` | | +| controlPlane.distro.k3s.image.repository | string | `"rancher/k3s"` | | +| controlPlane.distro.k3s.image.tag | string | `"v1.33.3-k3s1"` | | +| controlPlane.distro.k3s.imagePullPolicy | string | `""` | | +| controlPlane.distro.k3s.resources.limits.cpu | string | `"100m"` | | +| controlPlane.distro.k3s.resources.limits.memory | string | `"256Mi"` | | +| controlPlane.distro.k3s.resources.requests.cpu | string | `"40m"` | | +| controlPlane.distro.k3s.resources.requests.memory | string | `"64Mi"` | | +| controlPlane.distro.k3s.securityContext | object | `{}` | | +| controlPlane.distro.k8s.apiServer.command | list | `[]` | | +| controlPlane.distro.k8s.apiServer.enabled | bool | `true` | | +| controlPlane.distro.k8s.apiServer.extraArgs | list | `[]` | | +| controlPlane.distro.k8s.controllerManager.command | list | `[]` | | +| controlPlane.distro.k8s.controllerManager.enabled | bool | `true` | | +| controlPlane.distro.k8s.controllerManager.extraArgs | list | `[]` | | +| controlPlane.distro.k8s.enabled | bool | `false` | | +| controlPlane.distro.k8s.env | list | `[]` | | +| controlPlane.distro.k8s.image.registry | string | `"ghcr.io"` | | +| controlPlane.distro.k8s.image.repository | string | `"loft-sh/kubernetes"` | | +| controlPlane.distro.k8s.image.tag | string | `"v1.33.4"` | | +| controlPlane.distro.k8s.imagePullPolicy | string | `""` | | +| controlPlane.distro.k8s.resources.limits.cpu | string | `"100m"` | | +| controlPlane.distro.k8s.resources.limits.memory | string | `"256Mi"` | | +| controlPlane.distro.k8s.resources.requests.cpu | string | `"40m"` | | +| controlPlane.distro.k8s.resources.requests.memory | string | `"64Mi"` | | +| controlPlane.distro.k8s.scheduler.command | list | `[]` | | +| controlPlane.distro.k8s.scheduler.enabled | bool | `false` | | +| controlPlane.distro.k8s.scheduler.extraArgs | list | `[]` | | +| controlPlane.distro.k8s.securityContext | object | `{}` | | +| controlPlane.distro.k8s.version | string | `""` | | +| controlPlane.ingress.annotations."nginx.ingress.kubernetes.io/backend-protocol" | string | `"HTTPS"` | | +| controlPlane.ingress.annotations."nginx.ingress.kubernetes.io/ssl-passthrough" | string | `"true"` | | +| controlPlane.ingress.annotations."nginx.ingress.kubernetes.io/ssl-redirect" | string | `"true"` | | +| controlPlane.ingress.enabled | bool | `false` | | +| controlPlane.ingress.host | string | `"my-host.com"` | | +| controlPlane.ingress.labels | object | `{}` | | +| controlPlane.ingress.pathType | string | `"ImplementationSpecific"` | | +| controlPlane.ingress.spec.tls | list | `[]` | | +| controlPlane.proxy.bindAddress | string | `"0.0.0.0"` | | +| controlPlane.proxy.extraSANs | list | `[]` | | +| controlPlane.proxy.port | int | `8443` | | +| controlPlane.service.annotations | object | `{}` | | +| controlPlane.service.enabled | bool | `true` | | +| controlPlane.service.httpsNodePort | int | `0` | | +| controlPlane.service.kubeletNodePort | int | `0` | | +| controlPlane.service.labels | object | `{}` | | +| controlPlane.service.spec.type | string | `"ClusterIP"` | | +| controlPlane.serviceMonitor.annotations | object | `{}` | | +| controlPlane.serviceMonitor.enabled | bool | `false` | | +| controlPlane.serviceMonitor.labels | object | `{}` | | +| controlPlane.standalone.dataDir | string | `"/var/lib/vcluster"` | | +| controlPlane.standalone.joinNode.containerd.enabled | bool | `true` | | +| controlPlane.standalone.joinNode.enabled | bool | `true` | | +| controlPlane.statefulSet.annotations | object | `{}` | | +| controlPlane.statefulSet.args | list | `[]` | | +| controlPlane.statefulSet.command | list | `[]` | | +| controlPlane.statefulSet.enableServiceLinks | bool | `true` | | +| controlPlane.statefulSet.env | list | `[]` | | +| controlPlane.statefulSet.highAvailability.leaseDuration | int | `60` | | +| controlPlane.statefulSet.highAvailability.renewDeadline | int | `40` | | +| controlPlane.statefulSet.highAvailability.replicas | int | `1` | | +| controlPlane.statefulSet.highAvailability.retryPeriod | int | `15` | | +| controlPlane.statefulSet.image.registry | string | `"ghcr.io"` | | +| controlPlane.statefulSet.image.repository | string | `"loft-sh/vcluster-pro"` | | +| controlPlane.statefulSet.image.tag | string | `""` | | +| controlPlane.statefulSet.imagePullPolicy | string | `""` | | +| controlPlane.statefulSet.labels | object | `{}` | | +| controlPlane.statefulSet.persistence.addVolumeMounts | list | `[]` | | +| controlPlane.statefulSet.persistence.addVolumes | list | `[]` | | +| controlPlane.statefulSet.persistence.binariesVolume[0].emptyDir | object | `{}` | | +| controlPlane.statefulSet.persistence.binariesVolume[0].name | string | `"binaries"` | | +| controlPlane.statefulSet.persistence.dataVolume | list | `[]` | | +| controlPlane.statefulSet.persistence.volumeClaim.accessModes[0] | string | `"ReadWriteOnce"` | | +| controlPlane.statefulSet.persistence.volumeClaim.enabled | string | `"auto"` | | +| controlPlane.statefulSet.persistence.volumeClaim.retentionPolicy | string | `"Retain"` | | +| controlPlane.statefulSet.persistence.volumeClaim.size | string | `"5Gi"` | | +| controlPlane.statefulSet.persistence.volumeClaim.storageClass | string | `""` | | +| controlPlane.statefulSet.persistence.volumeClaimTemplates | list | `[]` | | +| controlPlane.statefulSet.pods.annotations | object | `{}` | | +| controlPlane.statefulSet.pods.labels | object | `{}` | | +| controlPlane.statefulSet.probes.livenessProbe.enabled | bool | `true` | | +| controlPlane.statefulSet.probes.livenessProbe.failureThreshold | int | `60` | | +| controlPlane.statefulSet.probes.livenessProbe.initialDelaySeconds | int | `60` | | +| controlPlane.statefulSet.probes.livenessProbe.periodSeconds | int | `2` | | +| controlPlane.statefulSet.probes.livenessProbe.timeoutSeconds | int | `3` | | +| controlPlane.statefulSet.probes.readinessProbe.enabled | bool | `true` | | +| controlPlane.statefulSet.probes.readinessProbe.failureThreshold | int | `60` | | +| controlPlane.statefulSet.probes.readinessProbe.periodSeconds | int | `2` | | +| controlPlane.statefulSet.probes.readinessProbe.timeoutSeconds | int | `3` | | +| controlPlane.statefulSet.probes.startupProbe.enabled | bool | `true` | | +| controlPlane.statefulSet.probes.startupProbe.failureThreshold | int | `300` | | +| controlPlane.statefulSet.probes.startupProbe.periodSeconds | int | `6` | | +| controlPlane.statefulSet.probes.startupProbe.timeoutSeconds | int | `3` | | +| controlPlane.statefulSet.resources.limits.ephemeral-storage | string | `"8Gi"` | | +| controlPlane.statefulSet.resources.limits.memory | string | `"2Gi"` | | +| controlPlane.statefulSet.resources.requests.cpu | string | `"200m"` | | +| controlPlane.statefulSet.resources.requests.ephemeral-storage | string | `"1Gi"` | | +| controlPlane.statefulSet.resources.requests.memory | string | `"256Mi"` | | +| controlPlane.statefulSet.scheduling.affinity | object | `{}` | | +| controlPlane.statefulSet.scheduling.nodeSelector | object | `{}` | | +| controlPlane.statefulSet.scheduling.podManagementPolicy | string | `"Parallel"` | | +| controlPlane.statefulSet.scheduling.priorityClassName | string | `""` | | +| controlPlane.statefulSet.scheduling.tolerations | list | `[]` | | +| controlPlane.statefulSet.scheduling.topologySpreadConstraints | list | `[]` | | +| controlPlane.statefulSet.security.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | | +| controlPlane.statefulSet.security.containerSecurityContext.runAsGroup | int | `0` | | +| controlPlane.statefulSet.security.containerSecurityContext.runAsUser | int | `0` | | +| controlPlane.statefulSet.security.podSecurityContext | object | `{}` | | +| controlPlane.statefulSet.workingDir | string | `""` | | +| deploy.cni.flannel.enabled | bool | `true` | | +| deploy.ingressNginx.defaultIngressClass | bool | `true` | | +| deploy.ingressNginx.enabled | bool | `false` | | +| deploy.kubeProxy.config | object | `{}` | | +| deploy.kubeProxy.enabled | bool | `true` | | +| deploy.kubeProxy.extraArgs | list | `[]` | | +| deploy.kubeProxy.extraEnv | list | `[]` | | +| deploy.kubeProxy.image | string | `""` | | +| deploy.kubeProxy.imagePullPolicy | string | `""` | | +| deploy.kubeProxy.nodeSelector | object | `{}` | | +| deploy.kubeProxy.tolerations | list | `[]` | | +| deploy.localPathProvisioner.enabled | bool | `true` | | +| deploy.metallb.enabled | bool | `false` | | +| deploy.metallb.ipAddressPool.addresses | list | `[]` | | +| deploy.metallb.ipAddressPool.l2Advertisement | bool | `true` | | +| deploy.metricsServer.enabled | bool | `false` | | +| experimental.deploy.host.manifests | string | `""` | | +| experimental.deploy.host.manifestsTemplate | string | `""` | | +| experimental.deploy.vcluster.helm | list | `[]` | | +| experimental.deploy.vcluster.manifests | string | `""` | | +| experimental.deploy.vcluster.manifestsTemplate | string | `""` | | +| experimental.syncSettings.setOwner | bool | `true` | | +| experimental.syncSettings.targetNamespace | string | `""` | | +| exportKubeConfig.context | string | `""` | | +| exportKubeConfig.insecure | bool | `false` | | +| exportKubeConfig.secret.name | string | `""` | | +| exportKubeConfig.secret.namespace | string | `""` | | +| exportKubeConfig.server | string | `""` | | +| exportKubeConfig.serviceAccount.clusterRole | string | `""` | | +| exportKubeConfig.serviceAccount.name | string | `""` | | +| exportKubeConfig.serviceAccount.namespace | string | `""` | | +| external | object | `{}` | | +| integrations.certManager.enabled | bool | `false` | | +| integrations.certManager.sync.fromHost.clusterIssuers.enabled | bool | `true` | | +| integrations.certManager.sync.fromHost.clusterIssuers.selector.labels | object | `{}` | | +| integrations.certManager.sync.toHost.certificates.enabled | bool | `true` | | +| integrations.certManager.sync.toHost.issuers.enabled | bool | `true` | | +| integrations.externalSecrets.enabled | bool | `false` | | +| integrations.externalSecrets.sync.clusterStores.enabled | bool | `false` | | +| integrations.externalSecrets.sync.clusterStores.selector.labels | object | `{}` | | +| integrations.externalSecrets.sync.externalSecrets.enabled | bool | `true` | | +| integrations.externalSecrets.sync.fromHost.clusterStores.enabled | bool | `false` | | +| integrations.externalSecrets.sync.fromHost.clusterStores.selector.matchLabels | object | `{}` | | +| integrations.externalSecrets.sync.stores.enabled | bool | `false` | | +| integrations.externalSecrets.sync.toHost.externalSecrets.selector.matchLabels | object | `{}` | | +| integrations.externalSecrets.sync.toHost.stores.enabled | bool | `false` | | +| integrations.externalSecrets.sync.toHost.stores.selector.matchLabels | object | `{}` | | +| integrations.externalSecrets.webhook.enabled | bool | `false` | | +| integrations.istio.enabled | bool | `false` | | +| integrations.istio.sync.toHost.destinationRules.enabled | bool | `true` | | +| integrations.istio.sync.toHost.gateways.enabled | bool | `true` | | +| integrations.istio.sync.toHost.virtualServices.enabled | bool | `true` | | +| integrations.kubeVirt.enabled | bool | `false` | | +| integrations.kubeVirt.sync.dataVolumes.enabled | bool | `false` | | +| integrations.kubeVirt.sync.virtualMachineClones.enabled | bool | `true` | | +| integrations.kubeVirt.sync.virtualMachineInstanceMigrations.enabled | bool | `true` | | +| integrations.kubeVirt.sync.virtualMachineInstances.enabled | bool | `true` | | +| integrations.kubeVirt.sync.virtualMachinePools.enabled | bool | `true` | | +| integrations.kubeVirt.sync.virtualMachines.enabled | bool | `true` | | +| integrations.kubeVirt.webhook.enabled | bool | `true` | | +| integrations.metricsServer.enabled | bool | `false` | | +| integrations.metricsServer.nodes | bool | `true` | | +| integrations.metricsServer.pods | bool | `true` | | +| logging.encoding | string | `"console"` | | +| networking.advanced.clusterDomain | string | `"cluster.local"` | | +| networking.advanced.fallbackHostCluster | bool | `false` | | +| networking.advanced.proxyKubelets.byHostname | bool | `true` | | +| networking.advanced.proxyKubelets.byIP | bool | `true` | | +| networking.podCIDR | string | `"10.244.0.0/16"` | | +| networking.replicateServices.fromHost | list | `[]` | | +| networking.replicateServices.toHost | list | `[]` | | +| networking.resolveDNS | list | `[]` | | +| plugins | object | `{}` | | +| policies.centralAdmission.mutatingWebhooks | list | `[]` | | +| policies.centralAdmission.validatingWebhooks | list | `[]` | | +| policies.limitRange.annotations | object | `{}` | | +| policies.limitRange.default.cpu | string | `"1"` | | +| policies.limitRange.default.ephemeral-storage | string | `"8Gi"` | | +| policies.limitRange.default.memory | string | `"512Mi"` | | +| policies.limitRange.defaultRequest.cpu | string | `"100m"` | | +| policies.limitRange.defaultRequest.ephemeral-storage | string | `"3Gi"` | | +| policies.limitRange.defaultRequest.memory | string | `"128Mi"` | | +| policies.limitRange.enabled | string | `"auto"` | | +| policies.limitRange.labels | object | `{}` | | +| policies.limitRange.max | object | `{}` | | +| policies.limitRange.min | object | `{}` | | +| policies.networkPolicy.annotations | object | `{}` | | +| policies.networkPolicy.enabled | bool | `false` | | +| policies.networkPolicy.extraControlPlaneRules | list | `[]` | | +| policies.networkPolicy.extraWorkloadRules | list | `[]` | | +| policies.networkPolicy.fallbackDns | string | `"8.8.8.8"` | | +| policies.networkPolicy.labels | object | `{}` | | +| policies.networkPolicy.outgoingConnections.ipBlock.cidr | string | `"0.0.0.0/0"` | | +| policies.networkPolicy.outgoingConnections.ipBlock.except[0] | string | `"100.64.0.0/10"` | | +| policies.networkPolicy.outgoingConnections.ipBlock.except[1] | string | `"127.0.0.0/8"` | | +| policies.networkPolicy.outgoingConnections.ipBlock.except[2] | string | `"10.0.0.0/8"` | | +| policies.networkPolicy.outgoingConnections.ipBlock.except[3] | string | `"172.16.0.0/12"` | | +| policies.networkPolicy.outgoingConnections.ipBlock.except[4] | string | `"192.168.0.0/16"` | | +| policies.networkPolicy.outgoingConnections.platform | bool | `true` | | +| policies.resourceQuota.annotations | object | `{}` | | +| policies.resourceQuota.enabled | string | `"auto"` | | +| policies.resourceQuota.labels | object | `{}` | | +| policies.resourceQuota.quota."limits.cpu" | int | `20` | | +| policies.resourceQuota.quota."limits.ephemeral-storage" | string | `"160Gi"` | | +| policies.resourceQuota.quota."limits.memory" | string | `"40Gi"` | | +| policies.resourceQuota.quota."requests.cpu" | int | `10` | | +| policies.resourceQuota.quota."requests.ephemeral-storage" | string | `"60Gi"` | | +| policies.resourceQuota.quota."requests.memory" | string | `"20Gi"` | | +| policies.resourceQuota.quota."requests.storage" | string | `"100Gi"` | | +| policies.resourceQuota.quota."services.loadbalancers" | int | `1` | | +| policies.resourceQuota.quota."services.nodeports" | int | `0` | | +| policies.resourceQuota.quota.count/configmaps | int | `100` | | +| policies.resourceQuota.quota.count/endpoints | int | `40` | | +| policies.resourceQuota.quota.count/persistentvolumeclaims | int | `20` | | +| policies.resourceQuota.quota.count/pods | int | `20` | | +| policies.resourceQuota.quota.count/secrets | int | `100` | | +| policies.resourceQuota.quota.count/services | int | `20` | | +| policies.resourceQuota.scopeSelector.matchExpressions | list | `[]` | | +| policies.resourceQuota.scopes | list | `[]` | | +| privateNodes.autoNodes.dynamic | list | `[]` | | +| privateNodes.autoNodes.static | list | `[]` | | +| privateNodes.autoUpgrade.concurrency | int | `1` | | +| privateNodes.autoUpgrade.enabled | bool | `true` | | +| privateNodes.enabled | bool | `false` | | +| privateNodes.joinNode.containerd.enabled | bool | `true` | | +| privateNodes.kubelet.config | object | `{}` | | +| privateNodes.vpn.enabled | bool | `false` | | +| privateNodes.vpn.nodeToNode.enabled | bool | `false` | | +| rbac.clusterRole.enabled | string | `"auto"` | | +| rbac.clusterRole.extraRules | list | `[]` | | +| rbac.clusterRole.overwriteRules | list | `[]` | | +| rbac.role.enabled | bool | `true` | | +| rbac.role.extraRules | list | `[]` | | +| rbac.role.overwriteRules | list | `[]` | | +| sync.fromHost.configMaps.enabled | bool | `false` | | +| sync.fromHost.configMaps.mappings.byName | object | `{}` | | +| sync.fromHost.csiDrivers.enabled | string | `"auto"` | | +| sync.fromHost.csiNodes.enabled | string | `"auto"` | | +| sync.fromHost.csiStorageCapacities.enabled | string | `"auto"` | | +| sync.fromHost.events.enabled | bool | `true` | | +| sync.fromHost.ingressClasses.enabled | bool | `false` | | +| sync.fromHost.nodes.clearImageStatus | bool | `false` | | +| sync.fromHost.nodes.enabled | bool | `false` | | +| sync.fromHost.nodes.selector.all | bool | `false` | | +| sync.fromHost.nodes.selector.labels | object | `{}` | | +| sync.fromHost.nodes.syncBackChanges | bool | `false` | | +| sync.fromHost.priorityClasses.enabled | bool | `false` | | +| sync.fromHost.runtimeClasses.enabled | bool | `false` | | +| sync.fromHost.secrets.enabled | bool | `false` | | +| sync.fromHost.secrets.mappings.byName | object | `{}` | | +| sync.fromHost.storageClasses.enabled | string | `"auto"` | | +| sync.fromHost.volumeSnapshotClasses.enabled | bool | `false` | | +| sync.toHost.configMaps.all | bool | `false` | | +| sync.toHost.configMaps.enabled | bool | `true` | | +| sync.toHost.endpoints.enabled | bool | `true` | | +| sync.toHost.ingresses.enabled | bool | `false` | | +| sync.toHost.namespaces.enabled | bool | `false` | | +| sync.toHost.namespaces.mappingsOnly | bool | `false` | | +| sync.toHost.networkPolicies.enabled | bool | `false` | | +| sync.toHost.persistentVolumeClaims.enabled | bool | `true` | | +| sync.toHost.persistentVolumes.enabled | bool | `false` | | +| sync.toHost.podDisruptionBudgets.enabled | bool | `false` | | +| sync.toHost.pods.enabled | bool | `true` | | +| sync.toHost.pods.enforceTolerations | list | `[]` | | +| sync.toHost.pods.hybridScheduling.enabled | bool | `false` | | +| sync.toHost.pods.hybridScheduling.hostSchedulers | list | `[]` | | +| sync.toHost.pods.priorityClassName | string | `""` | | +| sync.toHost.pods.rewriteHosts.enabled | bool | `true` | | +| sync.toHost.pods.rewriteHosts.initContainer.image.registry | string | `"mirror.gcr.io"` | | +| sync.toHost.pods.rewriteHosts.initContainer.image.repository | string | `"library/alpine"` | | +| sync.toHost.pods.rewriteHosts.initContainer.image.tag | string | `"3.20"` | | +| sync.toHost.pods.rewriteHosts.initContainer.resources.limits.cpu | string | `"30m"` | | +| sync.toHost.pods.rewriteHosts.initContainer.resources.limits.memory | string | `"64Mi"` | | +| sync.toHost.pods.rewriteHosts.initContainer.resources.requests.cpu | string | `"30m"` | | +| sync.toHost.pods.rewriteHosts.initContainer.resources.requests.memory | string | `"64Mi"` | | +| sync.toHost.pods.runtimeClassName | string | `""` | | +| sync.toHost.pods.translateImage | object | `{}` | | +| sync.toHost.pods.useSecretsForSATokens | bool | `false` | | +| sync.toHost.priorityClasses.enabled | bool | `false` | | +| sync.toHost.secrets.all | bool | `false` | | +| sync.toHost.secrets.enabled | bool | `true` | | +| sync.toHost.serviceAccounts.enabled | bool | `false` | | +| sync.toHost.services.enabled | bool | `true` | | +| sync.toHost.storageClasses.enabled | bool | `false` | | +| sync.toHost.volumeSnapshotContents.enabled | bool | `false` | | +| sync.toHost.volumeSnapshots.enabled | bool | `false` | | +| telemetry.enabled | bool | `true` | | + +---------------------------------------------- +Autogenerated from chart metadata using [helm-docs v1.9.1](https://github.com/norwoodj/helm-docs/releases/v1.9.1) diff --git a/charts/cf-vcluster/charts/vcluster/templates/_backingstore.tpl b/charts/cf-vcluster/charts/vcluster/templates/_backingstore.tpl new file mode 100644 index 0000000..4061f47 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/_backingstore.tpl @@ -0,0 +1,36 @@ +{{/* + is deploy etcd enabled? +*/}} +{{- define "vcluster.database.embedded.enabled" -}} +{{- $backingStores := 0 -}} +{{- if .Values.controlPlane.backingStore.etcd.embedded.enabled -}} +{{- $backingStores = add1 $backingStores -}} +{{- end -}} +{{- if .Values.controlPlane.backingStore.etcd.deploy.enabled -}} +{{- $backingStores = add1 $backingStores -}} +{{- end -}} +{{- if .Values.controlPlane.backingStore.etcd.external.enabled -}} +{{- $backingStores = add1 $backingStores -}} +{{- end -}} +{{- if .Values.controlPlane.backingStore.database.embedded.enabled -}} +{{- $backingStores = add1 $backingStores -}} +{{- end -}} +{{- if .Values.controlPlane.backingStore.database.external.enabled -}} +{{- $backingStores = add1 $backingStores -}} +{{- end -}} +{{- if gt $backingStores 1 -}} +{{- fail "you can only enable one backingStore at the same time" -}} +{{- else if or (eq $backingStores 0) .Values.controlPlane.backingStore.database.embedded.enabled -}} +{{- true -}} +{{- end -}} +{{- end -}} + +{{/* + migrate from deployed etcd? +*/}} +{{- define "vcluster.etcd.embedded.migrate" -}} +{{- if and .Values.controlPlane.backingStore.etcd.embedded.enabled .Values.controlPlane.backingStore.etcd.embedded.migrateFromDeployedEtcd -}} +{{- true -}} +{{- end -}} +{{- end -}} + diff --git a/charts/cf-vcluster/charts/vcluster/templates/_distro.tpl b/charts/cf-vcluster/charts/vcluster/templates/_distro.tpl new file mode 100644 index 0000000..a0e2f02 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/_distro.tpl @@ -0,0 +1,27 @@ +{{- define "vcluster.distro.env" -}} +{{- if and (eq (include "vcluster.distro" .) "k3s") .Values.controlPlane.distro.k3s.env -}} +{{ toYaml .Values.controlPlane.distro.k3s.env }} +{{- else if and (eq (include "vcluster.distro" .) "k8s") .Values.controlPlane.distro.k8s.env -}} +{{ toYaml .Values.controlPlane.distro.k8s.env }} +{{- end -}} +{{- end -}} + +{{/* + vCluster Distro +*/}} +{{- define "vcluster.distro" -}} +{{- $distros := 0 -}} +{{- if .Values.controlPlane.distro.k3s.enabled -}} +k3s +{{- $distros = add1 $distros -}} +{{- end -}} +{{- if .Values.controlPlane.distro.k8s.enabled -}} +k8s +{{- $distros = add1 $distros -}} +{{- end -}} +{{- if eq $distros 0 -}} +k8s +{{- else if gt $distros 1 -}} +{{- fail "you can only enable one distro at the same time" -}} +{{- end -}} +{{- end -}} diff --git a/charts/cf-vcluster/charts/vcluster/templates/_exportKubeConfig.tpl b/charts/cf-vcluster/charts/vcluster/templates/_exportKubeConfig.tpl new file mode 100644 index 0000000..c8e2fbd --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/_exportKubeConfig.tpl @@ -0,0 +1,37 @@ +{{- define "vcluster.exportKubeConfig.validate" }} +{{- /* + Verify that exportKubeConfig.secret and exportKubeConfig.additionalSecrets are + not set at the same time. +*/}} +{{- $secretSet := false }} +{{- if .Values.exportKubeConfig.secret }} +{{- $secretSet = or (.Values.exportKubeConfig.secret.name | trim | ne "") (.Values.exportKubeConfig.secret.namespace | trim | ne "") }} +{{- end }} +{{- $additionalSecretsSet := false }} +{{- if .Values.exportKubeConfig.additionalSecrets }} +{{- $additionalSecretsSet = gt (len .Values.exportKubeConfig.additionalSecrets) 0 }} +{{- end }} +{{- if and $secretSet $additionalSecretsSet }} +{{- fail "exportKubeConfig.secret and exportKubeConfig.additionalSecrets cannot be set at the same time" }} +{{- end }} +{{- /* + Verify that additional secrets have name or namespace set. +*/}} +{{- range $_, $additionalSecret := .Values.exportKubeConfig.additionalSecrets }} +{{- $nameSet := false }} +{{- $namespaceSet := false }} +{{- if $additionalSecret.name }} +{{- if $additionalSecret.name | trim | ne "" }} +{{- $nameSet = true }} +{{- end }} +{{- end }} +{{- if $additionalSecret.namespace }} +{{- if $additionalSecret.namespace | trim | ne "" }} +{{- $namespaceSet = true }} +{{- end }} +{{- end }} +{{- if not (or $nameSet $namespaceSet) }} +{{- fail (cat "additional secret must have name and/or namespace set, found:" (toJson $additionalSecret)) }} +{{- end }} +{{- end }} +{{- end }} diff --git a/charts/cf-vcluster/charts/vcluster/templates/_helper.tpl b/charts/cf-vcluster/charts/vcluster/templates/_helper.tpl new file mode 100644 index 0000000..680bbbb --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/_helper.tpl @@ -0,0 +1,17 @@ +{{- define "vcluster.controlPlane.image" -}} +{{- $tag := .Chart.Version -}} +{{- if .Values.controlPlane.statefulSet.image.tag -}} +{{- $tag = .Values.controlPlane.statefulSet.image.tag -}} +{{- end -}} +{{- include "vcluster.image" (dict "defaultImageRegistry" .Values.controlPlane.advanced.defaultImageRegistry "tag" $tag "registry" .Values.controlPlane.statefulSet.image.registry "repository" .Values.controlPlane.statefulSet.image.repository) -}} +{{- end -}} + +{{- define "vcluster.image" -}} +{{- if .defaultImageRegistry -}} +{{ .defaultImageRegistry }}/{{ .repository }}:{{ .tag }} +{{- else if .registry -}} +{{ .registry }}/{{ .repository }}:{{ .tag }} +{{- else -}} +{{ .repository }}:{{ .tag }} +{{- end -}} +{{- end -}} diff --git a/charts/cf-vcluster/charts/vcluster/templates/_init-containers.tpl b/charts/cf-vcluster/charts/vcluster/templates/_init-containers.tpl new file mode 100644 index 0000000..a936100 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/_init-containers.tpl @@ -0,0 +1,181 @@ +{{- define "vcluster.initContainers" -}} +{{- if eq (include "vcluster.distro" .) "k3s" -}} +{{ include "vcluster.k3s.initContainers" . }} +{{- else if eq (include "vcluster.distro" .) "k8s" -}} +{{ include "vcluster.k8s.initContainers" . }} +{{- end -}} +{{- end -}} + +{{/* Bump $defaultTag value whenever k8s version is bumped */}} +{{- define "vcluster.k8s.image.tag" -}} +{{- if not (empty .Values.controlPlane.distro.k8s.version) -}} +{{- if .Values.privateNodes.enabled -}} +{{ .Values.controlPlane.distro.k8s.version }}-full +{{- else -}} +{{ .Values.controlPlane.distro.k8s.version }} +{{- end -}} +{{- else -}} +{{- if .Values.privateNodes.enabled -}} +{{ .Values.controlPlane.distro.k8s.image.tag }}-full +{{- else -}} +{{ .Values.controlPlane.distro.k8s.image.tag }} +{{- end -}} +{{- end -}} +{{- end -}} + +{{- define "vcluster.k8s.initContainers" -}} +{{- include "vcluster.oldPlugins.initContainers" . }} +{{- include "vcluster.plugins.initContainers" . }} +- name: kubernetes + image: "{{ include "vcluster.image" (dict "defaultImageRegistry" .Values.controlPlane.advanced.defaultImageRegistry "registry" .Values.controlPlane.distro.k8s.image.registry "repository" .Values.controlPlane.distro.k8s.image.repository "tag" (include "vcluster.k8s.image.tag" .)) }}" + volumeMounts: + - mountPath: /binaries + name: binaries + command: + - cp + args: + - -r + - /kubernetes/. + - /binaries/ + {{- if .Values.controlPlane.distro.k8s.imagePullPolicy }} + imagePullPolicy: {{ .Values.controlPlane.distro.k8s.imagePullPolicy }} + {{- end }} + securityContext: +{{ toYaml .Values.controlPlane.distro.k8s.securityContext | indent 4 }} + resources: +{{ toYaml .Values.controlPlane.distro.k8s.resources | indent 4 }} +{{- end -}} + +{{- define "vcluster.k3s.initContainers" -}} +{{- include "vcluster.oldPlugins.initContainers" . }} +{{- include "vcluster.plugins.initContainers" . }} +- name: vcluster + image: "{{ include "vcluster.image" (dict "defaultImageRegistry" .Values.controlPlane.advanced.defaultImageRegistry "registry" .Values.controlPlane.distro.k3s.image.registry "repository" .Values.controlPlane.distro.k3s.image.repository "tag" .Values.controlPlane.distro.k3s.image.tag) }}" + command: + - /bin/sh + args: + - -c + - "cp /bin/k3s /binaries/k3s" + {{- if .Values.controlPlane.distro.k3s.imagePullPolicy }} + imagePullPolicy: {{ .Values.controlPlane.distro.k3s.imagePullPolicy }} + {{- end }} + securityContext: +{{ toYaml .Values.controlPlane.distro.k3s.securityContext | indent 4 }} + volumeMounts: + - name: binaries + mountPath: /binaries + resources: +{{ toYaml .Values.controlPlane.distro.k3s.resources | indent 4 }} +{{- end -}} + +{{/* + Plugin init container definition +*/}} +{{- define "vcluster.plugins.initContainers" -}} +{{- range $key, $container := .Values.plugins }} +{{- if not $container.image }} +{{- continue }} +{{- end }} +- {{- if $.Values.controlPlane.advanced.defaultImageRegistry }} + image: {{ $.Values.controlPlane.advanced.defaultImageRegistry }}/{{ $container.image }} + {{- else }} + image: {{ $container.image }} + {{- end }} + {{- if $container.name }} + name: {{ $container.name | quote }} + {{- else }} + name: {{ $key | quote }} + {{- end }} + {{- if $container.imagePullPolicy }} + imagePullPolicy: {{ $container.imagePullPolicy }} + {{- end }} + {{- if or $container.command $container.args }} + {{- if $container.command }} + command: + {{- range $commandIndex, $command := $container.command }} + - {{ $command | quote }} + {{- end }} + {{- end }} + {{- if $container.args }} + args: + {{- range $argIndex, $arg := $container.args }} + - {{ $arg | quote }} + {{- end }} + {{- end }} + {{- else }} + command: ["sh"] + args: ["-c", "cp -r /plugin /plugins/{{ $key }}"] + {{- end }} + {{- if $container.securityContext }} + securityContext: +{{ toYaml $container.securityContext | indent 4 }} + {{- end }} + {{- if $container.volumeMounts }} + volumeMounts: +{{ toYaml $container.volumeMounts | indent 4 }} + {{- else }} + volumeMounts: + - mountPath: /plugins + name: plugins + {{- end }} + {{- if $container.resources }} + resources: +{{ toYaml $container.resources | indent 4 }} + {{- end }} +{{- end }} +{{- end -}} + +{{/* + Old Plugin init container definition +*/}} +{{- define "vcluster.oldPlugins.initContainers" -}} +{{- range $key, $container := .Values.plugin }} +{{- if or (ne $container.version "v2") (not $container.image) -}} +{{- continue -}} +{{- end -}} +- {{- if $.Values.controlPlane.advanced.defaultImageRegistry }} + image: {{ $.Values.controlPlane.advanced.defaultImageRegistry }}/{{ $container.image }} + {{- else }} + image: {{ $container.image }} + {{- end }} + {{- if $container.name }} + name: {{ $container.name | quote }} + {{- else }} + name: {{ $key | quote }} + {{- end }} + {{- if $container.imagePullPolicy }} + imagePullPolicy: {{ $container.imagePullPolicy }} + {{- end }} + {{- if or $container.command $container.args }} + {{- if $container.command }} + command: + {{- range $commandIndex, $command := $container.command }} + - {{ $command | quote }} + {{- end }} + {{- end }} + {{- if $container.args }} + args: + {{- range $argIndex, $arg := $container.args }} + - {{ $arg | quote }} + {{- end }} + {{- end }} + {{- else }} + command: ["sh"] + args: ["-c", "cp -r /plugin /plugins/{{ $key }}"] + {{- end }} + securityContext: +{{ toYaml $container.securityContext | indent 4 }} + {{- if $container.volumeMounts }} + volumeMounts: +{{ toYaml $container.volumeMounts | indent 4 }} + {{- else }} + volumeMounts: + - mountPath: /plugins + name: plugins + {{- end }} + {{- if $container.resources }} + resources: +{{ toYaml $container.resources | indent 4 }} + {{- end }} +{{- end }} +{{- end -}} diff --git a/charts/cf-vcluster/charts/vcluster/templates/_persistence.tpl b/charts/cf-vcluster/charts/vcluster/templates/_persistence.tpl new file mode 100644 index 0000000..ed65f03 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/_persistence.tpl @@ -0,0 +1,41 @@ +{{/* + ControlPlane Kind +*/}} +{{- define "vcluster.kind" -}} +{{ if or (include "vcluster.persistence.volumeClaim.enabled" .) .Values.controlPlane.backingStore.etcd.embedded.enabled }}StatefulSet{{ else }}Deployment{{ end }} +{{- end -}} + +{{/* + StatefulSet Persistence Options +*/}} +{{- define "vcluster.persistence" -}} +{{- if .Values.controlPlane.statefulSet.persistence.volumeClaimTemplates }} +volumeClaimTemplates: +{{ toYaml .Values.controlPlane.statefulSet.persistence.volumeClaimTemplates | indent 2 }} +{{- else if include "vcluster.persistence.volumeClaim.enabled" . }} +volumeClaimTemplates: +- metadata: + name: data + spec: + accessModes: {{ .Values.controlPlane.statefulSet.persistence.volumeClaim.accessModes }} + {{- if .Values.controlPlane.statefulSet.persistence.volumeClaim.storageClass }} + storageClassName: {{ .Values.controlPlane.statefulSet.persistence.volumeClaim.storageClass }} + {{- end }} + resources: + requests: + storage: {{ .Values.controlPlane.statefulSet.persistence.volumeClaim.size }} +{{- end }} +{{- end -}} + +{{/* + is persistence enabled? +*/}} +{{- define "vcluster.persistence.volumeClaim.enabled" -}} +{{- if .Values.controlPlane.statefulSet.persistence.volumeClaimTemplates -}} +{{- true -}} +{{- else if eq (toString .Values.controlPlane.statefulSet.persistence.volumeClaim.enabled) "true" -}} +{{- true -}} +{{- else if and (eq (toString .Values.controlPlane.statefulSet.persistence.volumeClaim.enabled) "auto") (or (include "vcluster.database.embedded.enabled" .) .Values.controlPlane.backingStore.etcd.embedded.enabled) -}} +{{- true -}} +{{- end -}} +{{- end -}} diff --git a/charts/cf-vcluster/charts/vcluster/templates/_plugin.tpl b/charts/cf-vcluster/charts/vcluster/templates/_plugin.tpl new file mode 100644 index 0000000..c5dc668 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/_plugin.tpl @@ -0,0 +1,126 @@ +{{/* + Plugin volume mount definition +*/}} +{{- define "vcluster.plugins.volumeMounts" -}} +{{- $pluginFound := false -}} +{{- range $key, $container := .Values.plugin }} +{{- if or (ne $container.version "v2") (not $container.image) }} +{{- continue }} +{{- end }} +{{ $pluginFound = true }} +- mountPath: /plugins + name: plugins +{{- break }} +{{- end }} +{{- if eq $pluginFound false }} +{{- range $key, $container := .Values.plugins }} +{{- if not $container.image }} +{{- continue }} +{{- end }} +- mountPath: /plugins + name: plugins +{{- break }} +{{- end }} +{{- end }} +{{- end -}} + +{{/* + Plugin volume definition +*/}} +{{- define "vcluster.plugins.volumes" -}} +{{- $pluginFound := false -}} +{{- range $key, $container := .Values.plugin }} +{{- if or (ne $container.version "v2") (not $container.image) }} +{{- continue }} +{{- end }} +{{ $pluginFound = true }} +- name: plugins + emptyDir: {} +{{- break }} +{{- end }} +{{- if eq $pluginFound false }} +{{- range $key, $container := .Values.plugins }} +{{- if not $container.image }} +{{- continue }} +{{- end }} +- name: plugins + emptyDir: {} +{{- break }} +{{- end }} +{{- end }} +{{- end -}} + +{{/* + Sidecar container definition for the legacy syncer parts +*/}} +{{- define "vcluster.legacyPlugins.containers" -}} +{{- $counter := -1 -}} +{{- range $key, $container := .Values.plugin }} +{{- if eq $container.version "v2" }} +{{ continue }} +{{- end }} +{{- $counter = add1 $counter }} +- {{- if $.Values.controlPlane.advanced.defaultImageRegistry }} + image: {{ $.Values.controlPlane.advanced.defaultImageRegistry }}/{{ $container.image }} + {{- else }} + image: {{ $container.image }} + {{- end }} + {{- if $container.name }} + name: {{ $container.name | quote }} + {{- else }} + name: {{ $key | quote }} + {{- end }} + {{- if $container.imagePullPolicy }} + imagePullPolicy: {{ $container.imagePullPolicy }} + {{- end }} + {{- if $container.workingDir }} + workingDir: {{ $container.workingDir }} + {{- end }} + {{- if $container.command }} + command: + {{- range $commandIndex, $command := $container.command }} + - {{ $command | quote }} + {{- end }} + {{- end }} + {{- if $container.args }} + args: + {{- range $argIndex, $arg := $container.args }} + - {{ $arg | quote }} + {{- end }} + {{- end }} + {{- if $container.terminationMessagePath }} + terminationMessagePath: {{ $container.terminationMessagePath }} + {{- end }} + {{- if $container.terminationMessagePolicy }} + terminationMessagePolicy: {{ $container.terminationMessagePolicy }} + {{- end }} + env: + - name: VCLUSTER_PLUGIN_ADDRESS + value: "localhost:{{ add 14000 $counter }}" + - name: VCLUSTER_PLUGIN_NAME + value: "{{ $key }}" + {{- if $container.env }} +{{ toYaml $container.env | indent 4 }} + {{- end }} + envFrom: +{{ toYaml $container.envFrom | indent 4 }} + securityContext: +{{ toYaml $container.securityContext | indent 4 }} + lifecycle: +{{ toYaml $container.lifecycle | indent 4 }} + livenessProbe: +{{ toYaml $container.livenessProbe | indent 4 }} + readinessProbe: +{{ toYaml $container.readinessProbe | indent 4 }} + startupProbe: +{{ toYaml $container.startupProbe | indent 4 }} + volumeDevices: +{{ toYaml $container.volumeDevices | indent 4 }} + volumeMounts: +{{ toYaml $container.volumeMounts | indent 4 }} + {{- if $container.resources }} + resources: +{{ toYaml $container.resources | indent 4 }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/cf-vcluster/charts/vcluster/templates/_rbac.tpl b/charts/cf-vcluster/charts/vcluster/templates/_rbac.tpl new file mode 100644 index 0000000..60eb6da --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/_rbac.tpl @@ -0,0 +1,240 @@ +{{- define "vcluster.clusterRoleName" -}} +{{- printf "vc-%s-v-%s" .Release.Name .Release.Namespace | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{- define "vcluster.clusterRoleNameMultinamespace" -}} +{{- printf "vc-mn-%s-v-%s" .Release.Name .Release.Namespace | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* + Whether to create a cluster role or not +*/}} +{{- define "vcluster.createClusterRole" -}} +{{- if eq (toString .Values.rbac.clusterRole.enabled) "true" -}} +{{- true -}} +{{- else if eq (toString .Values.rbac.clusterRole.enabled) "auto" -}} +{{- if or + .Values.rbac.clusterRole.overwriteRules + (not (empty (include "vcluster.rbac.clusterRoleExtraRules" . ))) + (not (empty (include "vcluster.plugin.clusterRoleExtraRules" . ))) + .Values.networking.replicateServices.fromHost + .Values.pro + .Values.sync.toHost.storageClasses.enabled + .Values.sync.toHost.persistentVolumes.enabled + .Values.sync.toHost.priorityClasses.enabled + .Values.sync.fromHost.priorityClasses.enabled + .Values.sync.toHost.volumeSnapshotContents.enabled + .Values.sync.fromHost.volumeSnapshotClasses.enabled + (and (eq (include "vcluster.distro" .) "k8s") .Values.controlPlane.distro.k8s.scheduler.enabled) + .Values.controlPlane.advanced.virtualScheduler.enabled + .Values.sync.toHost.pods.hybridScheduling.enabled + .Values.sync.fromHost.ingressClasses.enabled + .Values.sync.fromHost.runtimeClasses.enabled + (eq (toString .Values.sync.fromHost.storageClasses.enabled) "true") + (eq (toString .Values.sync.fromHost.csiNodes.enabled) "true") + (eq (toString .Values.sync.fromHost.csiDrivers.enabled) "true") + (eq (toString .Values.sync.fromHost.csiStorageCapacities.enabled) "true") + .Values.sync.fromHost.nodes.enabled + .Values.sync.toHost.customResources + .Values.sync.fromHost.customResources + .Values.integrations.kubeVirt.enabled + .Values.integrations.externalSecrets.enabled + (and .Values.integrations.certManager.enabled .Values.integrations.certManager.sync.fromHost.clusterIssuers.enabled) + (and .Values.integrations.metricsServer.enabled .Values.integrations.metricsServer.nodes) + .Values.sync.fromHost.configMaps.enabled + .Values.sync.fromHost.secrets.enabled + .Values.integrations.istio.enabled + .Values.sync.toHost.namespaces.enabled + -}} +{{- true -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* + Role rules defined on global level +*/}} +{{- define "vcluster.rbac.roleExtraRules" -}} +{{- if .Values.rbac.role.extraRules }} +{{- range $ruleIndex, $rule := .Values.rbac.role.extraRules }} +- {{ toJson $rule }} +{{- end }} +{{- end }} +{{- end -}} + +{{/* + Role rules defined by plugins +*/}} +{{- define "vcluster.plugin.roleExtraRules" -}} +{{- range $key, $container := .Values.plugin }} +{{- if $container.rbac }} +{{- if $container.rbac.role }} +{{- if $container.rbac.role.extraRules }} +{{- range $ruleIndex, $rule := $container.rbac.role.extraRules }} +- {{ toJson $rule }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- range $key, $container := .Values.plugins }} +{{- if $container.rbac }} +{{- if $container.rbac.role }} +{{- if $container.rbac.role.extraRules }} +{{- range $ruleIndex, $rule := $container.rbac.role.extraRules }} +- {{ toJson $rule }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end -}} + +{{/* + Cluster role rules defined by plugins +*/}} +{{- define "vcluster.plugin.clusterRoleExtraRules" -}} +{{- range $key, $container := .Values.plugin }} +{{- if $container.rbac }} +{{- if $container.rbac.clusterRole }} +{{- if $container.rbac.clusterRole.extraRules }} +{{- range $ruleIndex, $rule := $container.rbac.clusterRole.extraRules }} +- {{ toJson $rule }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- range $key, $container := .Values.plugins }} +{{- if $container.rbac }} +{{- if $container.rbac.clusterRole }} +{{- if $container.rbac.clusterRole.extraRules }} +{{- range $ruleIndex, $rule := $container.rbac.clusterRole.extraRules }} +- {{ toJson $rule }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end -}} + +{{/* + Role rules defined in generic syncer +*/}} +{{- define "vcluster.customResources.roleExtraRules" -}} +{{- if .Values.sync.toHost.customResources }} +{{- range $crdName, $rule := .Values.sync.toHost.customResources }} +{{- if $rule.enabled }} +{{- $crdNameWithoutVersion := (split "/" $crdName)._0 -}} # Takes part before "/" +- resources: [ "{{ (splitn "." 2 $crdNameWithoutVersion)._0 }}" ] + apiGroups: [ "{{ (splitn "." 2 $crdNameWithoutVersion)._1 }}" ] + verbs: ["create", "delete", "patch", "update", "get", "list", "watch"] +{{- end }} +{{- end }} +{{- end }} +{{- end -}} + +{{/* + Cluster role rules defined in generic syncer +*/}} +{{- define "vcluster.customResources.clusterRoleExtraRules" -}} +{{- if .Values.sync.fromHost.customResources }} +{{- range $crdName, $rule := .Values.sync.fromHost.customResources }} +{{- if $rule.enabled }} +{{- $crdNameWithoutVersion := (split "/" $crdName)._0 -}} # Takes part before "/" +- resources: [ "{{ (splitn "." 2 $crdNameWithoutVersion)._0 }}" ] + apiGroups: [ "{{ (splitn "." 2 $crdNameWithoutVersion)._1 }}" ] + verbs: ["get", "list", "watch"] +{{- end }} +{{- end }} +{{- end }} +{{- end -}} + +{{/* + Cluster Role rules defined on global level +*/}} +{{- define "vcluster.rbac.clusterRoleExtraRules" -}} +{{- if .Values.rbac.clusterRole.extraRules }} +{{- range $ruleIndex, $rule := .Values.rbac.clusterRole.extraRules }} +- {{ toJson $rule }} +{{- end }} +{{- end }} +{{- end -}} + +{{/* + Whether to create a role and role binding to access the platform API key secret +*/}} +{{- define "vcluster.rbac.createPlatformSecretRole" -}} +{{- $createRBAC := dig "platform" "apiKey" "createRBAC" true .Values.external -}} +{{- if and $createRBAC (ne (include "vcluster.rbac.platformSecretNamespace" .) .Release.Namespace) }} +{{- true -}} +{{- end }} +{{- end -}} + +{{/* + Namespace containing the vCluster platform secret +*/}} +{{- define "vcluster.rbac.platformSecretNamespace" -}} +{{- dig "platform" "apiKey" "namespace" .Release.Namespace .Values.external | default .Release.Namespace -}} +{{- end -}} + +{{/* + Name specifies the secret name containing the vCluster platform licenses and tokens +*/}} +{{- define "vcluster.rbac.platformSecretName" -}} +{{- dig "platform" "apiKey" "secretName" "vcluster-platform-api-key" .Values.external | quote -}} +{{- end -}} + +{{- define "vcluster.rbac.platformRoleName" -}} +{{- printf "vc-%s-v-%s-platform-role" .Release.Name .Release.Namespace | trunc 63 | trimSuffix "-" -}} +{{- end -}} + + +{{- define "vcluster.rbac.platformRoleBindingName" -}} +{{- printf "vc-%s-v-%s-platform-role-binding" .Release.Name .Release.Namespace | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* + Cluster role rules needed for fromHost sync (containing namespaces + configmaps/secret/other core resources) +*/}} +{{- define "vcluster.rbac.rulesForFromHostSyncerForGivenCoreResource" -}} +{{- $root := index . 0 -}} +{{- $mappings := index . 1 -}} +{{- $kind := index . 2 -}} +{{- $enabled := index . 3 -}} +{{- if and $enabled $mappings -}} +{{- $namespaces := list -}} +{{- $objNames := list -}} +{{- $addResourceNames := true -}} +{{- range $key, $val := $mappings -}} + {{- $sourceNs := splitList "/" $key | first -}} + {{- $sourceObjName := splitList "/" $key | last }} + {{- if eq $sourceNs "" -}} + {{- $namespaces = append $namespaces (quote $root.Release.Namespace) -}} + {{- else -}} + {{- $namespaces = append $namespaces (quote $sourceNs) -}} + {{- end -}} + {{- if eq $sourceObjName "*" -}} + {{- $addResourceNames = false -}} + {{- else -}} + {{- $objNames = append $objNames (quote $sourceObjName) -}} + {{- end -}} +{{- end -}} +{{- $objList := $objNames | uniq | sortAlpha -}} +{{- $nsList := $namespaces | uniq | sortAlpha -}} +- apiGroups: [""] + resources: [ "namespaces" ] + resourceNames: [ {{ join "," $nsList }} ] + verbs: ["get", "list", "watch"] +- apiGroups: [""] + resources: [ {{ $kind | quote }} ] + verbs: ["list", "watch"] +- apiGroups: [""] + resources: [ {{ $kind | quote }} ] + verbs: ["get"] +{{- if $addResourceNames }} + resourceNames: [ {{ join "," $objList }} ] +{{- end }} +{{- end }} +{{- end }} + diff --git a/charts/cf-vcluster/charts/vcluster/templates/_vclusterconfighash.tpl b/charts/cf-vcluster/charts/vcluster/templates/_vclusterconfighash.tpl new file mode 100644 index 0000000..f7bdc30 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/_vclusterconfighash.tpl @@ -0,0 +1,4 @@ +{{- define "vcluster.vClusterConfigHash" -}} +{{- $vals := deepCopy .Values -}} +{{- (unset $vals.privateNodes "autoNodes") | toYaml | b64enc | sha256sum | quote -}} +{{- end -}} \ No newline at end of file diff --git a/charts/cf-vcluster/charts/vcluster/templates/clusterrole.yaml b/charts/cf-vcluster/charts/vcluster/templates/clusterrole.yaml new file mode 100644 index 0000000..30e27a6 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/clusterrole.yaml @@ -0,0 +1,142 @@ +{{- if (include "vcluster.createClusterRole" . ) -}} +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ template "vcluster.clusterRoleName" . }} + labels: + app: vcluster + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" + {{- if .Values.controlPlane.advanced.globalMetadata.annotations }} + annotations: +{{ toYaml .Values.controlPlane.advanced.globalMetadata.annotations | indent 4 }} + {{- end }} +rules: + {{- if .Values.rbac.clusterRole.overwriteRules }} +{{ toYaml .Values.rbac.clusterRole.overwriteRules | indent 2 }} + {{- else }} + {{- if .Values.pro }} + - apiGroups: ["cluster.loft.sh", "storage.loft.sh"] + resources: ["features", "virtualclusters"] + verbs: ["get", "list", "watch"] + - apiGroups: ["management.loft.sh"] + resources: ["virtualclusterinstances"] + verbs: ["get"] + {{- end }} + {{- if or .Values.pro .Values.sync.fromHost.nodes.enabled }} + - apiGroups: [""] + resources: ["pods", "nodes", "nodes/status", "nodes/metrics", "nodes/stats", "nodes/proxy"] + verbs: ["get", "watch", "list"] + {{- end }} + {{- if and .Values.sync.fromHost.nodes.enabled .Values.sync.fromHost.nodes.syncBackChanges }} + - apiGroups: [""] + resources: ["nodes", "nodes/status"] + verbs: ["update", "patch"] + {{- end }} + {{- if or + (and (eq (include "vcluster.distro" .) "k8s") .Values.controlPlane.distro.k8s.scheduler.enabled) + .Values.controlPlane.advanced.virtualScheduler.enabled + .Values.sync.toHost.pods.hybridScheduling.enabled + }} + - apiGroups: ["storage.k8s.io"] + resources: ["storageclasses", "csinodes", "csidrivers", "csistoragecapacities"] + verbs: ["get", "watch", "list"] + {{- end }} + {{- if eq (toString .Values.sync.fromHost.storageClasses.enabled) "true" }} + - apiGroups: ["storage.k8s.io"] + resources: ["storageclasses"] + verbs: ["get", "watch", "list"] + {{- end }} + {{- if eq (toString .Values.sync.fromHost.csiNodes.enabled) "true" }} + - apiGroups: ["storage.k8s.io"] + resources: ["csinodes"] + verbs: ["get", "watch", "list"] + {{- end }} + {{- if eq (toString .Values.sync.fromHost.csiDrivers.enabled) "true" }} + - apiGroups: ["storage.k8s.io"] + resources: ["csidrivers"] + verbs: ["get", "watch", "list"] + {{- end }} + {{- if eq (toString .Values.sync.fromHost.csiStorageCapacities.enabled) "true" }} + - apiGroups: ["storage.k8s.io"] + resources: ["csistoragecapacities"] + verbs: ["get", "watch", "list"] + {{- end }} + {{- if .Values.sync.toHost.persistentVolumes.enabled }} + - apiGroups: [""] + resources: ["persistentvolumes"] + verbs: ["create", "delete", "patch", "update", "get", "watch", "list"] + {{- end }} + {{- if .Values.sync.fromHost.ingressClasses.enabled }} + - apiGroups: ["networking.k8s.io"] + resources: ["ingressclasses"] + verbs: ["get", "watch", "list"] + {{- end }} + {{- if .Values.sync.fromHost.runtimeClasses.enabled }} + - apiGroups: ["node.k8s.io"] + resources: ["runtimeclasses"] + verbs: ["get", "watch", "list"] + {{- end }} + {{- if .Values.sync.toHost.storageClasses.enabled }} + - apiGroups: ["storage.k8s.io"] + resources: ["storageclasses"] + verbs: ["create", "delete", "patch", "update", "get", "watch", "list"] + {{- end }} + {{- if or .Values.sync.toHost.priorityClasses.enabled .Values.sync.fromHost.priorityClasses.enabled }} + - apiGroups: ["scheduling.k8s.io"] + resources: ["priorityclasses"] + verbs: ["create", "delete", "patch", "update", "get", "list", "watch"] + {{- end }} + {{- if .Values.sync.fromHost.volumeSnapshotClasses.enabled }} + - apiGroups: ["snapshot.storage.k8s.io"] + resources: ["volumesnapshotclasses"] + verbs: ["get", "list", "watch"] + {{- end }} + {{- if .Values.sync.toHost.volumeSnapshotContents.enabled }} + - apiGroups: ["snapshot.storage.k8s.io"] + resources: ["volumesnapshotcontents"] + verbs: ["create", "delete", "patch", "update", "get", "list", "watch"] + {{- end }} + {{- if .Values.networking.replicateServices.fromHost }} + - apiGroups: [""] + resources: ["services", "endpoints"] + verbs: ["get", "watch", "list"] + {{- end }} + {{- if .Values.sync.toHost.namespaces.enabled }} + - apiGroups: [""] + resources: ["namespaces", "serviceaccounts"] + verbs: ["create", "delete", "patch", "update", "get", "watch", "list"] + {{- end }} + {{- if (and .Values.integrations.metricsServer.enabled .Values.integrations.metricsServer.nodes) }} + - apiGroups: ["metrics.k8s.io"] + resources: ["nodes"] + verbs: ["get", "list"] + {{- end }} + {{- if or (and .Values.integrations.kubeVirt.enabled .Values.integrations.kubeVirt.webhook.enabled) (and .Values.integrations.externalSecrets.enabled .Values.integrations.externalSecrets.webhook.enabled ) }} + - apiGroups: ["admissionregistration.k8s.io"] + resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"] + verbs: ["get", "list", "watch"] + {{- end }} + {{- if or .Values.integrations.kubeVirt.enabled .Values.integrations.externalSecrets.enabled .Values.integrations.certManager.enabled .Values.sync.toHost.customResources .Values.sync.fromHost.customResources .Values.integrations.istio.enabled }} + - apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"] + verbs: ["get", "list", "watch"] + {{- end }} + {{- if and .Values.integrations.externalSecrets.enabled (or .Values.integrations.externalSecrets.sync.clusterStores.enabled .Values.integrations.externalSecrets.sync.fromHost.clusterStores.enabled) }} + - apiGroups: ["external-secrets.io"] + resources: ["clustersecretstores"] + verbs: ["get", "list", "watch"] + {{- end }} + {{- if and .Values.integrations.certManager.enabled .Values.integrations.certManager.sync.fromHost.clusterIssuers.enabled }} + - apiGroups: ["cert-manager.io"] + resources: ["clusterissuers"] + verbs: ["get", "list", "watch"] + {{- end }} + {{- include "vcluster.rbac.rulesForFromHostSyncerForGivenCoreResource" (list $ .Values.sync.fromHost.configMaps.mappings.byName "configmaps" .Values.sync.fromHost.configMaps.enabled ) | nindent 2 }} + {{- include "vcluster.rbac.rulesForFromHostSyncerForGivenCoreResource" (list $ .Values.sync.fromHost.secrets.mappings.byName "secrets" .Values.sync.fromHost.secrets.enabled ) | nindent 2 }} + {{- include "vcluster.customResources.clusterRoleExtraRules" . | indent 2 }} + {{- include "vcluster.plugin.clusterRoleExtraRules" . | indent 2 }} + {{- include "vcluster.rbac.clusterRoleExtraRules" . | indent 2 }} + {{- end }} +{{- end }} diff --git a/charts/cf-vcluster/charts/vcluster/templates/clusterrolebinding.yaml b/charts/cf-vcluster/charts/vcluster/templates/clusterrolebinding.yaml new file mode 100644 index 0000000..a1166ea --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/clusterrolebinding.yaml @@ -0,0 +1,27 @@ +{{- if (include "vcluster.createClusterRole" . ) -}} +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ template "vcluster.clusterRoleName" . }} + labels: + app: vcluster + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" + {{- if .Values.controlPlane.advanced.globalMetadata.annotations }} + annotations: +{{ toYaml .Values.controlPlane.advanced.globalMetadata.annotations | indent 4 }} + {{- end }} +subjects: + - kind: ServiceAccount + {{- if .Values.controlPlane.advanced.serviceAccount.name }} + name: {{ .Values.controlPlane.advanced.serviceAccount.name }} + {{- else }} + name: vc-{{ .Release.Name }} + {{- end }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ template "vcluster.clusterRoleName" . }} + apiGroup: rbac.authorization.k8s.io +{{- end }} diff --git a/charts/cf-vcluster/charts/vcluster/templates/config-secret.yaml b/charts/cf-vcluster/charts/vcluster/templates/config-secret.yaml new file mode 100644 index 0000000..e306f88 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/config-secret.yaml @@ -0,0 +1,17 @@ +apiVersion: v1 +kind: Secret +metadata: + name: "vc-config-{{ .Release.Name }}" + namespace: {{ .Release.Namespace }} + labels: + app: vcluster + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" + {{- if .Values.controlPlane.advanced.globalMetadata.annotations }} + annotations: +{{ toYaml .Values.controlPlane.advanced.globalMetadata.annotations | indent 4 }} + {{- end }} +type: Opaque +data: + config.yaml: {{ tpl (.Values | toYaml) . | b64enc | quote }} diff --git a/charts/cf-vcluster/charts/vcluster/templates/etcd-headless-service.yaml b/charts/cf-vcluster/charts/vcluster/templates/etcd-headless-service.yaml new file mode 100644 index 0000000..0836322 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/etcd-headless-service.yaml @@ -0,0 +1,32 @@ +{{- if or .Values.controlPlane.backingStore.etcd.deploy.enabled (include "vcluster.etcd.embedded.migrate" .) }} +apiVersion: v1 +kind: Service +metadata: + name: {{ .Release.Name }}-etcd-headless + namespace: {{ .Release.Namespace }} + labels: + app: vcluster-etcd + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" + {{- $annotations := merge dict .Values.controlPlane.advanced.globalMetadata.annotations .Values.controlPlane.backingStore.etcd.deploy.headlessService.annotations }} + {{- if $annotations }} + annotations: +{{ toYaml $annotations | indent 4 }} + {{- end }} +spec: + publishNotReadyAddresses: true + ports: + - name: etcd + port: 2379 + targetPort: 2379 + protocol: TCP + - name: peer + port: 2380 + targetPort: 2380 + protocol: TCP + clusterIP: None + selector: + app: vcluster-etcd + release: "{{ .Release.Name }}" +{{- end }} diff --git a/charts/cf-vcluster/charts/vcluster/templates/etcd-service.yaml b/charts/cf-vcluster/charts/vcluster/templates/etcd-service.yaml new file mode 100644 index 0000000..5ead3e6 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/etcd-service.yaml @@ -0,0 +1,33 @@ +{{- if or .Values.controlPlane.backingStore.etcd.deploy.enabled (include "vcluster.etcd.embedded.migrate" .) }} +{{- if .Values.controlPlane.backingStore.etcd.deploy.service.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ .Release.Name }}-etcd + namespace: {{ .Release.Namespace }} + labels: + app: vcluster-etcd + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" + {{- $annotations := merge dict .Values.controlPlane.advanced.globalMetadata.annotations .Values.controlPlane.backingStore.etcd.deploy.service.annotations }} + {{- if $annotations }} + annotations: +{{ toYaml $annotations | indent 4 }} + {{- end }} +spec: + type: ClusterIP + ports: + - name: etcd + port: 2379 + targetPort: 2379 + protocol: TCP + - name: peer + port: 2380 + targetPort: 2380 + protocol: TCP + selector: + app: vcluster-etcd + release: {{ .Release.Name }} +{{- end }} +{{- end }} diff --git a/charts/cf-vcluster/charts/vcluster/templates/etcd-statefulset.yaml b/charts/cf-vcluster/charts/vcluster/templates/etcd-statefulset.yaml new file mode 100644 index 0000000..fb2bac1 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/etcd-statefulset.yaml @@ -0,0 +1,211 @@ +{{- if or .Values.controlPlane.backingStore.etcd.deploy.enabled (include "vcluster.etcd.embedded.migrate" .) }} +{{- if .Values.controlPlane.backingStore.etcd.deploy.statefulSet.enabled }} +{{- $externalEtcd := .Values.controlPlane.backingStore.etcd.deploy.statefulSet }} +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: {{ .Release.Name }}-etcd + namespace: {{ .Release.Namespace }} + labels: + app: vcluster-etcd + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +{{- if $externalEtcd.labels }} +{{ toYaml $externalEtcd.labels | indent 4 }} +{{- end }} + {{- $annotations := merge dict .Values.controlPlane.advanced.globalMetadata.annotations $externalEtcd.annotations }} + {{- if $annotations }} + annotations: +{{ toYaml $annotations | indent 4 }} + {{- end }} +spec: + replicas: {{ $externalEtcd.highAvailability.replicas }} + podManagementPolicy: {{ $externalEtcd.scheduling.podManagementPolicy }} + serviceName: {{ .Release.Name }}-etcd-headless + {{- if eq $externalEtcd.persistence.volumeClaim.retentionPolicy "Delete" }} + {{- if ge (int .Capabilities.KubeVersion.Minor) 27 }} + persistentVolumeClaimRetentionPolicy: + whenDeleted: {{ $externalEtcd.persistence.volumeClaim.retentionPolicy }} + {{- end }} + {{- end }} + selector: + matchLabels: + app: vcluster-etcd + release: {{ .Release.Name }} + {{- if $externalEtcd.persistence.volumeClaimTemplates }} + volumeClaimTemplates: +{{ toYaml $externalEtcd.persistence.volumeClaimTemplates | indent 4 }} + {{- else if $externalEtcd.persistence.volumeClaim.enabled }} + volumeClaimTemplates: + - metadata: + name: data + spec: + accessModes: {{ $externalEtcd.persistence.volumeClaim.accessModes }} + {{- if $externalEtcd.persistence.volumeClaim.storageClass }} + storageClassName: {{ $externalEtcd.persistence.volumeClaim.storageClass }} + {{- end }} + resources: + requests: + storage: {{ $externalEtcd.persistence.volumeClaim.size }} + {{- end }} + template: + metadata: + {{- if $externalEtcd.pods.annotations }} + annotations: +{{ toYaml $externalEtcd.pods.annotations | indent 8 }} + {{- end }} + labels: + app: vcluster-etcd + release: {{ .Release.Name }} + {{- range $k, $v := $externalEtcd.pods.labels }} + {{ $k }}: {{ $v | quote }} + {{- end }} + spec: + terminationGracePeriodSeconds: 10 + {{- if $externalEtcd.scheduling.affinity }} + affinity: +{{ toYaml $externalEtcd.scheduling.affinity | indent 8 }} + {{- else }} + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + # if possible avoid scheduling more than one pod on one node + - weight: 100 + podAffinityTerm: + labelSelector: + matchExpressions: + - key: app + operator: In + values: + - vcluster-etcd + - key: release + operator: In + values: + - {{ .Release.Name }} + topologyKey: "kubernetes.io/hostname" + # if possible avoid scheduling pod onto node that is in the same zone as one or more vcluster pods are running + - weight: 50 + podAffinityTerm: + labelSelector: + matchExpressions: + - key: app + operator: In + values: + - vcluster-etcd + - key: release + operator: In + values: + - {{ .Release.Name }} + topologyKey: topology.kubernetes.io/zone + {{- end }} + {{- if $externalEtcd.scheduling.topologySpreadConstraints }} + topologySpreadConstraints: +{{ toYaml $externalEtcd.scheduling.topologySpreadConstraints | indent 8 }} + {{- end }} + nodeSelector: +{{ toYaml $externalEtcd.scheduling.nodeSelector | indent 8 }} + tolerations: +{{ toYaml $externalEtcd.scheduling.tolerations | indent 8 }} + automountServiceAccountToken: false + {{- if .Values.controlPlane.advanced.serviceAccount.name }} + serviceAccountName: {{ .Values.controlPlane.advanced.serviceAccount.name }} + {{- else }} + serviceAccountName: vc-{{ .Release.Name }} + {{- end }} + volumes: + - name: certs + secret: + secretName: {{ .Release.Name }}-certs + {{- if $externalEtcd.persistence.addVolumes }} +{{ toYaml $externalEtcd.persistence.addVolumes | indent 8 }} + {{- end }} + {{- if not $externalEtcd.persistence.volumeClaim.enabled }} + - name: data + emptyDir: {} + {{- end }} + {{- if $externalEtcd.scheduling.priorityClassName }} + priorityClassName: {{ $externalEtcd.scheduling.priorityClassName }} + {{- end }} + {{- if $externalEtcd.security.podSecurityContext }} + securityContext: +{{ toYaml $externalEtcd.security.podSecurityContext | indent 8 }} + {{- end }} + enableServiceLinks: {{ .Values.controlPlane.backingStore.etcd.deploy.statefulSet.enableServiceLinks }} + containers: + - name: etcd + image: '{{ include "vcluster.image" (dict "defaultImageRegistry" .Values.controlPlane.advanced.defaultImageRegistry "registry" $externalEtcd.image.registry "repository" $externalEtcd.image.repository "tag" $externalEtcd.image.tag) }}' + command: + - etcd + - '--cert-file=/run/config/pki/etcd-server.crt' + - '--client-cert-auth=true' + - '--data-dir=/var/lib/etcd' + - '--advertise-client-urls=https://$(NAME).{{ .Release.Name }}-etcd-headless.{{ .Release.Namespace }}:2379' + - '--initial-advertise-peer-urls=https://$(NAME).{{ .Release.Name }}-etcd-headless.{{ .Release.Namespace }}:2380' + {{- $releaseName := .Release.Name -}} + {{- $releaseNamespace := .Release.Namespace }} + - '--initial-cluster={{ range $index := untilStep 0 (int $externalEtcd.highAvailability.replicas) 1 }}{{ if (ne (int $index) 0) }},{{ end }}{{ $releaseName }}-etcd-{{ $index }}=https://{{ $releaseName }}-etcd-{{ $index }}.{{ $releaseName }}-etcd-headless.{{ $releaseNamespace }}:2380{{ end }}' + - '--initial-cluster-token={{ .Release.Name }}' + - '--initial-cluster-state=new' + - '--listen-client-urls=https://0.0.0.0:2379' + - '--listen-metrics-urls=http://0.0.0.0:2381' + - '--listen-peer-urls=https://0.0.0.0:2380' + - '--key-file=/run/config/pki/etcd-server.key' + - '--name=$(NAME)' + - '--peer-cert-file=/run/config/pki/etcd-peer.crt' + - '--peer-client-cert-auth=true' + - '--peer-key-file=/run/config/pki/etcd-peer.key' + - '--peer-trusted-ca-file=/run/config/pki/etcd-ca.crt' + - '--snapshot-count=10000' + - '--trusted-ca-file=/run/config/pki/etcd-ca.crt' + {{- range $f := $externalEtcd.extraArgs }} + - {{ $f | quote }} + {{- end }} + {{- if $externalEtcd.security.containerSecurityContext }} + securityContext: +{{ toYaml $externalEtcd.security.containerSecurityContext | indent 10 }} + {{- end }} + env: + - name: NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + {{- if $externalEtcd.env }} +{{ toYaml $externalEtcd.env | indent 10 }} + {{- end }} + volumeMounts: + - name: data + mountPath: /var/lib/etcd + - mountPath: /run/config/pki + name: certs + readOnly: true + {{- if $externalEtcd.persistence.addVolumeMounts }} +{{ toYaml $externalEtcd.persistence.addVolumeMounts | indent 10 }} + {{- end }} + resources: +{{ toYaml $externalEtcd.resources | indent 10 }} + livenessProbe: + httpGet: + path: /livez + port: 2381 + scheme: HTTP + initialDelaySeconds: 10 + timeoutSeconds: 15 + periodSeconds: 10 + successThreshold: 1 + failureThreshold: 8 + startupProbe: + httpGet: + path: /readyz + port: 2381 + scheme: HTTP + initialDelaySeconds: 10 + timeoutSeconds: 15 + periodSeconds: 10 + successThreshold: 1 + failureThreshold: 24 + {{- if $externalEtcd.imagePullPolicy }} + imagePullPolicy: {{ $externalEtcd.imagePullPolicy }} + {{- end }} +{{- end }} +{{- end }} diff --git a/charts/cf-vcluster/charts/vcluster/templates/headless-service.yaml b/charts/cf-vcluster/charts/vcluster/templates/headless-service.yaml new file mode 100644 index 0000000..4606a15 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/headless-service.yaml @@ -0,0 +1,41 @@ +{{- if eq (include "vcluster.kind" .) "StatefulSet" }} +apiVersion: v1 +kind: Service +metadata: + name: {{ .Release.Name }}-headless + namespace: {{ .Release.Namespace }} + labels: + app: vcluster + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" + {{- if .Values.controlPlane.advanced.headlessService.labels }} +{{ toYaml .Values.controlPlane.advanced.headlessService.labels | indent 4 }} + {{- end }} + {{- $annotations := merge dict .Values.controlPlane.advanced.headlessService.annotations .Values.controlPlane.advanced.globalMetadata.annotations }} + {{- if $annotations }} + annotations: +{{ toYaml $annotations | indent 4 }} + {{- end }} +spec: + publishNotReadyAddresses: true + ports: + - name: https + port: 443 + targetPort: 8443 + protocol: TCP + {{- if .Values.controlPlane.backingStore.etcd.embedded.enabled }} + - name: etcd + port: 2379 + targetPort: 2379 + protocol: TCP + - name: peer + port: 2380 + targetPort: 2380 + protocol: TCP + {{- end }} + clusterIP: None + selector: + app: vcluster + release: "{{ .Release.Name }}" +{{- end }} diff --git a/charts/cf-vcluster/charts/vcluster/templates/ingress.yaml b/charts/cf-vcluster/charts/vcluster/templates/ingress.yaml new file mode 100644 index 0000000..3530887 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/ingress.yaml @@ -0,0 +1,37 @@ +{{- if .Values.controlPlane.ingress.enabled }} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + {{- $annotations := merge dict .Values.controlPlane.ingress.annotations .Values.controlPlane.advanced.globalMetadata.annotations }} + {{- if $annotations }} + annotations: + {{- toYaml $annotations | nindent 4 }} + {{- end }} + name: {{ .Release.Name }} + namespace: {{ .Release.Namespace }} + labels: + app: vcluster + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" + {{- if .Values.controlPlane.ingress.labels }} +{{ toYaml .Values.controlPlane.ingress.labels | indent 4 }} + {{- end }} +spec: + {{- with .Values.controlPlane.ingress.spec }} + {{- tpl (toYaml .) $ | nindent 2 }} + {{- end }} + {{- if not .Values.controlPlane.ingress.spec.rules }} + rules: + - host: {{ .Values.controlPlane.ingress.host | quote }} + http: + paths: + - backend: + service: + name: {{ .Release.Name }} + port: + name: https + path: / + pathType: {{ .Values.controlPlane.ingress.pathType }} + {{- end }} +{{- end }} diff --git a/charts/cf-vcluster/charts/vcluster/templates/limitrange.yaml b/charts/cf-vcluster/charts/vcluster/templates/limitrange.yaml new file mode 100644 index 0000000..a40f415 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/limitrange.yaml @@ -0,0 +1,49 @@ +{{- if or (eq (toString .Values.policies.limitRange.enabled) "true") (eq (toString .Values.policies.resourceQuota.enabled) "true") }} +{{- if not (eq (toString .Values.policies.limitRange.enabled) "false") }} +apiVersion: v1 +kind: LimitRange +metadata: + name: vc-{{ .Release.Name }} + {{- if .Values.experimental.syncSettings.targetNamespace }} + namespace: {{ .Values.experimental.syncSettings.targetNamespace }} + {{- else }} + namespace: {{ .Release.Namespace }} + {{- end }} + labels: + app: vcluster + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" + {{- if .Values.policies.limitRange.labels }} +{{ toYaml .Values.policies.limitRange.labels | indent 4 }} + {{- end }} + {{- $annotations := merge dict .Values.controlPlane.advanced.globalMetadata.annotations .Values.policies.limitRange.annotations }} + {{- if $annotations }} + annotations: +{{ toYaml $annotations | indent 4 }} + {{- end }} +spec: + limits: + - default: + {{- range $key, $val := .Values.policies.limitRange.default }} + {{ $key }}: {{ $val | quote }} + {{- end }} + defaultRequest: + {{- range $key, $val := .Values.policies.limitRange.defaultRequest }} + {{ $key }}: {{ $val | quote }} + {{- end }} + {{- if .Values.policies.limitRange.min }} + min: + {{- range $key, $val := .Values.policies.limitRange.min }} + {{ $key }}: {{ $val | quote }} + {{- end }} + {{- end }} + {{- if .Values.policies.limitRange.max }} + max: + {{- range $key, $val := .Values.policies.limitRange.max }} + {{ $key }}: {{ $val | quote }} + {{- end }} + {{- end }} + type: Container +{{- end }} +{{- end }} diff --git a/charts/cf-vcluster/charts/vcluster/templates/manifests.yaml b/charts/cf-vcluster/charts/vcluster/templates/manifests.yaml new file mode 100644 index 0000000..44d5310 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/manifests.yaml @@ -0,0 +1,7 @@ +{{- if .Values.experimental.deploy.host.manifests }} +{{ .Values.experimental.deploy.host.manifests }} +{{- end }} +{{- if .Values.experimental.deploy.host.manifestsTemplate }} +--- +{{ tpl .Values.experimental.deploy.host.manifestsTemplate . }} +{{- end }} diff --git a/charts/cf-vcluster/charts/vcluster/templates/networkpolicy.yaml b/charts/cf-vcluster/charts/vcluster/templates/networkpolicy.yaml new file mode 100644 index 0000000..c773ba8 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/networkpolicy.yaml @@ -0,0 +1,112 @@ +{{- if .Values.policies.networkPolicy.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: vc-work-{{ .Release.Name }} + {{- if .Values.experimental.syncSettings.targetNamespace }} + namespace: {{ .Values.experimental.syncSettings.targetNamespace }} + {{- else }} + namespace: {{ .Release.Namespace }} + {{- end }} + labels: + app: vcluster + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" + {{- if .Values.policies.networkPolicy.labels }} +{{ toYaml .Values.policies.networkPolicy.labels | indent 4 }} + {{- end }} + {{- $annotations := merge dict .Values.controlPlane.advanced.globalMetadata.annotations .Values.policies.networkPolicy.annotations }} + {{- if $annotations }} + annotations: +{{ toYaml $annotations | indent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: + vcluster.loft.sh/managed-by: {{ .Release.Name }} + egress: + # Allows outgoing connections to the vcluster control plane + - ports: + - port: 443 + - port: 8443 + to: + - podSelector: + matchLabels: + release: {{ .Release.Name }} + # Allows outgoing connections to DNS server + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + # Allows outgoing connections to the internet or + # other vcluster workloads + - to: + - podSelector: + matchLabels: + vcluster.loft.sh/managed-by: {{ .Release.Name }} + - ipBlock: + cidr: {{ .Values.policies.networkPolicy.outgoingConnections.ipBlock.cidr }} + except: + {{- range .Values.policies.networkPolicy.outgoingConnections.ipBlock.except }} + - {{ . }} + {{- end }} + {{- if .Values.policies.networkPolicy.extraWorkloadRules }} +{{ toYaml .Values.policies.networkPolicy.extraWorkloadRules | indent 4 }} + {{- end }} + policyTypes: + - Egress +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: vc-cp-{{ .Release.Name }} + namespace: {{ .Release.Namespace }} + labels: + app: vcluster + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" + {{- if .Values.policies.networkPolicy.labels }} +{{ toYaml .Values.policies.networkPolicy.labels | indent 4 }} + {{- end }} + {{- $annotations := merge dict .Values.controlPlane.advanced.globalMetadata.annotations .Values.policies.networkPolicy.annotations }} + {{- if $annotations }} + annotations: +{{ toYaml $annotations | indent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: + release: {{ .Release.Name }} + egress: + # Allows outgoing connections to all pods with + # port 443, 8443 or 6443. This is needed for host Kubernetes + # access + - ports: + - port: 443 + - port: 8443 + - port: 6443 + # Allows outgoing connections to all vcluster workloads + # or kube system dns server + - to: + - podSelector: {} + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: 'kube-system' + podSelector: + matchLabels: + k8s-app: kube-dns + {{- if .Values.policies.networkPolicy.outgoingConnections.platform }} + - podSelector: + matchLabels: + app: loft + namespaceSelector: {} + {{- end }} + {{- if .Values.policies.networkPolicy.extraControlPlaneRules }} +{{ toYaml .Values.policies.networkPolicy.extraControlPlaneRules | indent 4 }} + {{- end }} + policyTypes: + - Egress + {{- end }} diff --git a/charts/cf-vcluster/charts/vcluster/templates/platform-rbac.yaml b/charts/cf-vcluster/charts/vcluster/templates/platform-rbac.yaml new file mode 100644 index 0000000..9d3f3a4 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/platform-rbac.yaml @@ -0,0 +1,31 @@ +{{- if include "vcluster.rbac.createPlatformSecretRole" . }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "vcluster.rbac.platformRoleName" . }} + namespace: {{ include "vcluster.rbac.platformSecretNamespace" .}} +rules: +- apiGroups: [""] + resources: ["secrets"] + verbs: ["get"] + resourceNames: + - {{ include "vcluster.rbac.platformSecretName" . }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "vcluster.rbac.platformRoleBindingName" . }} + namespace: {{ include "vcluster.rbac.platformSecretNamespace" .}} +subjects: + - kind: ServiceAccount + {{- if .Values.controlPlane.advanced.serviceAccount.name }} + name: {{ .Values.controlPlane.advanced.serviceAccount.name }} + {{- else }} + name: vc-{{ .Release.Name }} + {{- end }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: Role + name: {{ include "vcluster.rbac.platformRoleName" . }} + apiGroup: rbac.authorization.k8s.io +{{- end }} diff --git a/charts/cf-vcluster/charts/vcluster/templates/resourcequota.yaml b/charts/cf-vcluster/charts/vcluster/templates/resourcequota.yaml new file mode 100644 index 0000000..5424239 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/resourcequota.yaml @@ -0,0 +1,44 @@ +{{- if or (eq (toString .Values.policies.resourceQuota.enabled) "true") (eq (toString .Values.policies.limitRange.enabled) "true") }} +{{- if not (eq (toString .Values.policies.resourceQuota.enabled) "false") }} +apiVersion: v1 +kind: ResourceQuota +metadata: + name: vc-{{ .Release.Name }} + {{- if .Values.experimental.syncSettings.targetNamespace }} + namespace: {{ .Values.experimental.syncSettings.targetNamespace }} + {{- else }} + namespace: {{ .Release.Namespace }} + {{- end }} + labels: + app: vcluster + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" + {{- if .Values.policies.resourceQuota.labels }} +{{ toYaml .Values.policies.resourceQuota.labels | indent 4 }} + {{- end }} + {{- $annotations := merge dict .Values.controlPlane.advanced.globalMetadata.annotations .Values.policies.resourceQuota.annotations }} + {{- if $annotations }} + annotations: +{{ toYaml $annotations | indent 4 }} + {{- end }} +spec: + {{- if .Values.policies.resourceQuota.quota }} + hard: + {{- range $key, $val := .Values.policies.resourceQuota.quota }} + {{ $key }}: {{ $val | quote }} + {{- end }} + {{- end }} + + {{- if .Values.policies.resourceQuota.scopeSelector.matchExpressions }} + scopeSelector: + matchExpressions: +{{- toYaml .Values.policies.resourceQuota.scopeSelector.matchExpressions | nindent 6 }} + {{- end }} + + {{- if .Values.policies.resourceQuota.scopes }} + scopes: +{{- toYaml .Values.policies.resourceQuota.scopes | nindent 4 }} + {{- end}} +{{- end }} +{{- end }} diff --git a/charts/cf-vcluster/charts/vcluster/templates/role.yaml b/charts/cf-vcluster/charts/vcluster/templates/role.yaml new file mode 100644 index 0000000..bbace33 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/role.yaml @@ -0,0 +1,140 @@ +{{- if .Values.rbac.role.enabled }} +{{- if .Values.sync.toHost.namespaces.enabled }} +kind: ClusterRole +{{- else -}} +kind: Role +{{- end }} +apiVersion: rbac.authorization.k8s.io/v1 +metadata: +{{- if .Values.sync.toHost.namespaces.enabled }} + name: {{ template "vcluster.clusterRoleNameMultinamespace" . }} +{{- else }} + name: vc-{{ .Release.Name }} + namespace: {{ .Release.Namespace }} +{{- end }} + labels: + app: vcluster + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" + {{- if .Values.controlPlane.advanced.globalMetadata.annotations }} + annotations: +{{ toYaml .Values.controlPlane.advanced.globalMetadata.annotations | indent 4 }} + {{- end }} +rules: + {{- if .Values.rbac.role.overwriteRules }} +{{ toYaml .Values.rbac.role.overwriteRules | indent 2 }} + {{- else }} + {{- if .Values.privateNodes.enabled}} + - apiGroups: [""] + resources: ["secrets", "configmaps"] + verbs: ["create", "delete", "patch", "update", "get", "list", "watch"] + - apiGroups: [""] + resources: ["services", "pods", "persistentvolumeclaims"] + verbs: ["get", "list", "watch"] + {{- else }} + - apiGroups: [""] + resources: ["configmaps", "secrets", "services", "pods", "pods/attach", "pods/portforward", "pods/exec", "persistentvolumeclaims"] + verbs: ["create", "delete", "patch", "update", "get", "list", "watch"] + - apiGroups: [""] + resources: ["pods/status", "pods/ephemeralcontainers"] + verbs: ["patch", "update"] + {{- end }} + - apiGroups: ["apps"] + resources: ["statefulsets", "replicasets", "deployments"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["endpoints", "events", "pods/log"] + verbs: ["get", "list", "watch"] + {{- if .Values.sync.toHost.endpoints.enabled }} + - apiGroups: [""] + resources: ["endpoints"] + verbs: ["create", "delete", "patch", "update"] + {{- end }} + {{- if or .Values.privateNodes.enabled (gt (int .Values.controlPlane.statefulSet.highAvailability.replicas) 1) }} + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["create", "delete", "patch", "update", "get", "list", "watch"] + {{- end }} + {{- if (and .Values.integrations.metricsServer.enabled .Values.integrations.metricsServer.pods) }} + - apiGroups: ["metrics.k8s.io"] + resources: ["pods"] + verbs: ["get", "list"] + {{- end }} + {{- if .Values.sync.toHost.ingresses.enabled}} + - apiGroups: ["networking.k8s.io"] + resources: ["ingresses"] + verbs: ["create", "delete", "patch", "update", "get", "list", "watch"] + {{- end }} + {{- if .Values.sync.toHost.networkPolicies.enabled }} + - apiGroups: ["networking.k8s.io"] + resources: ["networkpolicies"] + verbs: ["create", "delete", "patch", "update", "get", "list", "watch"] + {{- end }} + {{- if .Values.sync.toHost.volumeSnapshots.enabled }} + - apiGroups: ["snapshot.storage.k8s.io"] + resources: ["volumesnapshots"] + verbs: ["create", "delete", "patch", "update", "get", "list", "watch"] + {{- end }} + {{- if .Values.sync.toHost.serviceAccounts.enabled }} + - apiGroups: [""] + resources: ["serviceaccounts"] + verbs: ["create", "delete", "patch", "update", "get", "list", "watch"] + {{- end }} + {{- if .Values.sync.toHost.podDisruptionBudgets.enabled }} + - apiGroups: ["policy"] + resources: ["poddisruptionbudgets"] + verbs: ["create", "delete", "patch", "update", "get", "list", "watch"] + {{- end }} + {{- if .Values.integrations.kubeVirt.enabled }} + - apiGroups: ["subresources.kubevirt.io"] + resources: ["*"] + verbs: ["create", "delete", "patch", "update", "get", "list", "watch"] + - apiGroups: ["pool.kubevirt.io"] + resources: ["virtualmachinepools", "virtualmachinepools/status"] + verbs: ["create", "delete", "patch", "update", "get", "list", "watch"] + - apiGroups: ["clone.kubevirt.io"] + resources: ["virtualmachineclones", "virtualmachineclones/status"] + verbs: ["create", "delete", "patch", "update", "get", "list", "watch"] + - apiGroups: ["cdi.kubevirt.io"] + resources: ["datavolumes", "datavolumes/status"] + verbs: ["create", "delete", "patch", "update", "get", "list", "watch"] + - apiGroups: ["kubevirt.io"] + resources: ["virtualmachines", "virtualmachines/status", "virtualmachineinstances", "virtualmachineinstances/status", "virtualmachineinstancemigrations", "virtualmachineinstancemigrations/status"] + verbs: ["create", "delete", "patch", "update", "get", "list", "watch"] + {{- end }} + {{- if .Values.integrations.externalSecrets.enabled }} + - apiGroups: ["external-secrets.io"] + resources: ["externalsecrets"] + verbs: ["create", "delete", "patch", "update", "get", "list", "watch"] + {{- if or .Values.integrations.externalSecrets.sync.stores.enabled .Values.integrations.externalSecrets.sync.toHost.stores.enabled }} + - apiGroups: ["external-secrets.io"] + resources: ["secretstores"] + verbs: ["create", "delete", "patch", "update", "get", "list", "watch"] + {{- end }} + {{- end }} + {{- if .Values.integrations.certManager.enabled }} + {{- if .Values.integrations.certManager.sync.toHost.certificates.enabled }} + - apiGroups: ["cert-manager.io"] + resources: ["certificates"] + verbs: ["create", "delete", "patch", "update", "get", "list", "watch"] + {{- end }} + {{- if .Values.integrations.certManager.sync.toHost.issuers.enabled }} + - apiGroups: ["cert-manager.io"] + resources: ["issuers"] + verbs: ["create", "delete", "patch", "update", "get", "list", "watch"] + {{- end }} + {{- end }} + {{- if .Values.integrations.istio.enabled }} + - apiGroups: [ "networking.istio.io" ] + resources: [ "destinationrules", "gateways", "serviceentries", "virtualservices" ] + verbs: [ "create", "delete", "patch", "update", "get", "list", "watch" ] + - apiGroups: [ "gateway.networking.k8s.io" ] + resources: [ "referencegrants" ] + verbs: [ "create", "delete", "patch", "update", "get", "list", "watch" ] + {{- end }} + {{- include "vcluster.customResources.roleExtraRules" . | indent 2 }} + {{- include "vcluster.plugin.roleExtraRules" . | indent 2 }} + {{- include "vcluster.rbac.roleExtraRules" . | indent 2 }} + {{- end }} +{{- end }} diff --git a/charts/cf-vcluster/charts/vcluster/templates/rolebinding.yaml b/charts/cf-vcluster/charts/vcluster/templates/rolebinding.yaml new file mode 100644 index 0000000..58d6e7b --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/rolebinding.yaml @@ -0,0 +1,41 @@ +{{- if .Values.rbac.role.enabled }} +{{- if .Values.sync.toHost.namespaces.enabled}} +kind: ClusterRoleBinding +{{- else -}} +kind: RoleBinding +{{- end }} +apiVersion: rbac.authorization.k8s.io/v1 +metadata: +{{- if .Values.sync.toHost.namespaces.enabled }} + name: {{ template "vcluster.clusterRoleNameMultinamespace" . }} +{{- else }} + name: vc-{{ .Release.Name }} + namespace: {{ .Release.Namespace }} +{{- end }} + labels: + app: vcluster + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" + {{- if .Values.controlPlane.advanced.globalMetadata.annotations }} + annotations: +{{ toYaml .Values.controlPlane.advanced.globalMetadata.annotations | indent 4 }} + {{- end }} +subjects: + - kind: ServiceAccount + {{- if .Values.controlPlane.advanced.serviceAccount.name }} + name: {{ .Values.controlPlane.advanced.serviceAccount.name }} + {{- else }} + name: vc-{{ .Release.Name }} + {{- end }} + namespace: {{ .Release.Namespace }} +roleRef: +{{- if .Values.sync.toHost.namespaces.enabled }} + kind: ClusterRole + name: {{ template "vcluster.clusterRoleNameMultinamespace" . }} +{{- else }} + kind: Role + name: vc-{{ .Release.Name }} +{{- end }} + apiGroup: rbac.authorization.k8s.io +{{- end }} diff --git a/charts/cf-vcluster/charts/vcluster/templates/service-monitor.yaml b/charts/cf-vcluster/charts/vcluster/templates/service-monitor.yaml new file mode 100644 index 0000000..71996c9 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/service-monitor.yaml @@ -0,0 +1,95 @@ +{{- if .Values.controlPlane.serviceMonitor.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: vc-{{ .Release.Name }} + namespace: {{ .Release.Namespace }} + labels: + app: vcluster + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + {{- if or (not .Values.controlPlane.serviceMonitor.labels) (not (hasKey .Values.controlPlane.serviceMonitor.labels "release")) }} + release: "{{ .Release.Name }}" + {{- end}} + heritage: "{{ .Release.Service }}" + {{- if .Values.controlPlane.serviceMonitor.labels }} +{{ toYaml .Values.controlPlane.serviceMonitor.labels | indent 4 }} + {{- end }} + {{- $annotations := merge dict .Values.controlPlane.serviceMonitor.annotations .Values.controlPlane.advanced.globalMetadata.annotations }} + {{- if $annotations }} + annotations: +{{ toYaml $annotations | indent 4 }} + {{- end }} +spec: + selector: + matchLabels: + app: vcluster + release: "{{ .Release.Name }}" + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + heritage: "{{ .Release.Service }}" + vcluster.loft.sh/service: "true" + endpoints: + - interval: 30s + port: https + path: /metrics + scheme: https + relabelings: + - targetLabel: endpoint + replacement: "apiserver" + tlsConfig: + ca: + secret: + name: vc-{{ .Release.Name }} + key: certificate-authority + cert: + secret: + name: vc-{{ .Release.Name }} + key: client-certificate + keySecret: + name: vc-{{ .Release.Name }} + key: client-key + {{- if eq (include "vcluster.distro" .) "k8s" }} + - interval: 30s + port: https + path: /controller-manager/metrics + scheme: https + relabelings: + - targetLabel: endpoint + replacement: "controller-manager" + tlsConfig: + ca: + secret: + name: vc-{{ .Release.Name }} + key: certificate-authority + cert: + secret: + name: vc-{{ .Release.Name }} + key: client-certificate + keySecret: + name: vc-{{ .Release.Name }} + key: client-key + {{- if or + (and (eq (include "vcluster.distro" .) "k8s") .Values.controlPlane.distro.k8s.scheduler.enabled) + .Values.controlPlane.advanced.virtualScheduler.enabled + }} + - interval: 30s + port: https + path: /scheduler/metrics + scheme: https + relabelings: + - targetLabel: endpoint + replacement: "scheduler" + tlsConfig: + ca: + secret: + name: vc-{{ .Release.Name }} + key: certificate-authority + cert: + secret: + name: vc-{{ .Release.Name }} + key: client-certificate + keySecret: + name: vc-{{ .Release.Name }} + key: client-key + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/cf-vcluster/charts/vcluster/templates/service.yaml b/charts/cf-vcluster/charts/vcluster/templates/service.yaml new file mode 100644 index 0000000..8bcceee --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/service.yaml @@ -0,0 +1,59 @@ +{{- $platform_svc_exists := lookup "v1" "Service" .Release.Namespace "loft" }} +{{- if $platform_svc_exists }} +{{- fail (printf "a vCluster platform installation exists in the namespace '%s'. Aborting install" .Release.Namespace) }} +{{- else if .Values.controlPlane.service.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ .Release.Name }} + namespace: {{ .Release.Namespace }} + labels: + app: vcluster + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" + vcluster.loft.sh/service: "true" + {{- if .Values.controlPlane.service.labels }} +{{ toYaml .Values.controlPlane.service.labels | indent 4 }} + {{- end }} + {{- $annotations := merge dict .Values.controlPlane.advanced.globalMetadata.annotations .Values.controlPlane.service.annotations }} + {{- if $annotations }} + annotations: +{{ toYaml $annotations | indent 4 }} + {{- end }} +spec: +{{ toYaml .Values.controlPlane.service.spec | indent 2 }} + {{- if not .Values.controlPlane.service.spec.ports }} + ports: + - name: https + port: 443 + targetPort: 8443 + nodePort: {{ .Values.controlPlane.service.httpsNodePort }} + protocol: TCP + {{- if .Values.privateNodes.enabled }} + {{- if .Values.controlPlane.advanced.konnectivity.server.enabled }} + - name: konnectivity + port: 8132 + protocol: TCP + {{- end }} + {{- end }} + {{- if .Values.integrations.istio.enabled }} + - name: wake-http + port: 9090 + nodePort: {{ .Values.controlPlane.service.httpsNodePort }} + protocol: TCP + {{- end }} + {{- if and .Values.networking.advanced.proxyKubelets.byHostname (not (eq .Values.controlPlane.service.spec.type "LoadBalancer")) }} + - name: kubelet + port: 10250 + targetPort: 8443 + nodePort: {{ .Values.controlPlane.service.kubeletNodePort }} + protocol: TCP + {{- end }} + {{- end }} + {{- if not .Values.controlPlane.service.spec.selector }} + selector: + app: vcluster + release: {{ .Release.Name }} + {{- end }} +{{- end }} diff --git a/charts/cf-vcluster/charts/vcluster/templates/serviceaccount.yaml b/charts/cf-vcluster/charts/vcluster/templates/serviceaccount.yaml new file mode 100644 index 0000000..6faa4d7 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/serviceaccount.yaml @@ -0,0 +1,28 @@ +{{- if .Values.controlPlane.advanced.serviceAccount.enabled }} +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- if .Values.controlPlane.advanced.serviceAccount.name }} + name: {{ .Values.controlPlane.advanced.serviceAccount.name | quote }} + {{- else }} + name: vc-{{ .Release.Name }} + {{- end }} + namespace: {{ .Release.Namespace }} + labels: + app: vcluster + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" + {{- if .Values.controlPlane.advanced.serviceAccount.labels }} +{{ toYaml .Values.controlPlane.advanced.serviceAccount.labels | indent 4 }} + {{- end }} + {{- $annotations := merge dict .Values.controlPlane.advanced.serviceAccount.annotations .Values.controlPlane.advanced.globalMetadata.annotations }} + {{- if $annotations }} + annotations: +{{- toYaml $annotations | nindent 4 }} + {{- end }} +{{- if .Values.controlPlane.advanced.serviceAccount.imagePullSecrets }} +imagePullSecrets: +{{ toYaml .Values.controlPlane.advanced.serviceAccount.imagePullSecrets | indent 2 }} +{{- end }} +{{- end }} diff --git a/charts/cf-vcluster/charts/vcluster/templates/statefulset.yaml b/charts/cf-vcluster/charts/vcluster/templates/statefulset.yaml new file mode 100644 index 0000000..b6a0228 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/statefulset.yaml @@ -0,0 +1,228 @@ +{{- include "vcluster.exportKubeConfig.validate" . }} +apiVersion: apps/v1 +kind: {{ include "vcluster.kind" . }} +metadata: + name: {{ .Release.Name }} + namespace: {{ .Release.Namespace }} + labels: + app: vcluster + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: {{ .Release.Name }} + heritage: "{{ .Release.Service }}" + {{- if .Values.controlPlane.statefulSet.labels }} +{{ toYaml .Values.controlPlane.statefulSet.labels | indent 4 }} + {{- end }} + {{- $annotations := merge dict .Values.controlPlane.statefulSet.annotations .Values.controlPlane.advanced.globalMetadata.annotations }} + {{- if $annotations }} + annotations: +{{ toYaml $annotations | indent 4 }} + {{- end }} +spec: + selector: + matchLabels: + app: vcluster + release: {{ .Release.Name | quote }} + {{- if eq (include "vcluster.kind" .) "StatefulSet" }} + {{- if ge (int .Capabilities.KubeVersion.Minor) 27 }} + persistentVolumeClaimRetentionPolicy: + whenDeleted: {{ .Values.controlPlane.statefulSet.persistence.volumeClaim.retentionPolicy }} + {{- end }} + serviceName: {{ .Release.Name }}-headless + podManagementPolicy: {{ .Values.controlPlane.statefulSet.scheduling.podManagementPolicy }} +{{ include "vcluster.persistence" . | indent 2 }} + {{- else }} + strategy: + rollingUpdate: + maxSurge: 1 + {{- if (eq (int .Values.controlPlane.statefulSet.highAvailability.replicas) 1) }} + maxUnavailable: 0 + {{- else }} + maxUnavailable: 1 + {{- end }} + type: RollingUpdate + {{- end }} + replicas: {{ .Values.controlPlane.statefulSet.highAvailability.replicas }} + template: + metadata: + annotations: + vClusterConfigHash: {{ include "vcluster.vClusterConfigHash" . }} + {{- if .Values.controlPlane.statefulSet.pods.annotations }} +{{ toYaml .Values.controlPlane.statefulSet.pods.annotations | indent 8 }} + {{- end }} + labels: + app: vcluster + release: {{ .Release.Name }} + {{- if .Values.controlPlane.statefulSet.pods.labels }} +{{ toYaml .Values.controlPlane.statefulSet.pods.labels | indent 8 }} + {{- end }} + spec: + terminationGracePeriodSeconds: 10 + {{- if .Values.controlPlane.statefulSet.scheduling.priorityClassName }} + priorityClassName: {{ .Values.controlPlane.statefulSet.scheduling.priorityClassName }} + {{- end }} + {{- if .Values.controlPlane.statefulSet.security.podSecurityContext }} + securityContext: +{{ toYaml .Values.controlPlane.statefulSet.security.podSecurityContext | indent 8 }} + {{- end }} + {{- if .Values.controlPlane.statefulSet.scheduling.nodeSelector }} + nodeSelector: +{{ toYaml .Values.controlPlane.statefulSet.scheduling.nodeSelector | indent 8 }} + {{- end }} + {{- if .Values.controlPlane.statefulSet.scheduling.affinity }} + affinity: +{{ toYaml .Values.controlPlane.statefulSet.scheduling.affinity | indent 8 }} + {{- end }} + {{- if .Values.controlPlane.statefulSet.scheduling.topologySpreadConstraints }} + topologySpreadConstraints: +{{ toYaml .Values.controlPlane.statefulSet.scheduling.topologySpreadConstraints | indent 8 }} + {{- end }} + {{- if .Values.controlPlane.statefulSet.scheduling.tolerations }} + tolerations: +{{ toYaml .Values.controlPlane.statefulSet.scheduling.tolerations | indent 8 }} + {{- end }} + {{- if .Values.controlPlane.statefulSet.scheduling.priorityClassName }} + priorityClassName: {{ .Values.controlPlane.statefulSet.scheduling.priorityClassName }} + {{- end }} + {{- if .Values.controlPlane.statefulSet.dnsPolicy }} + dnsPolicy: {{ .Values.controlPlane.statefulSet.dnsPolicy }} + {{- end }} + {{- if .Values.controlPlane.statefulSet.dnsConfig }} + dnsConfig: +{{ toYaml .Values.controlPlane.statefulSet.dnsConfig | indent 8 }} + {{- end }} + {{- if .Values.controlPlane.advanced.serviceAccount.name }} + serviceAccountName: {{ .Values.controlPlane.advanced.serviceAccount.name }} + {{- else }} + serviceAccountName: vc-{{ .Release.Name }} + {{- end }} + volumes: +{{- include "vcluster.plugins.volumes" . | indent 8 }} + - name: helm-cache + emptyDir: {} +{{ toYaml .Values.controlPlane.statefulSet.persistence.binariesVolume | indent 8 }} + - name: tmp + emptyDir: {} + - name: certs + emptyDir: {} + {{- if eq (include "vcluster.distro" .) "k3s" }} + - name: k3s-config + emptyDir: {} + {{- end }} + - name: vcluster-config + secret: + secretName: vc-config-{{ .Release.Name }} + {{- if .Values.controlPlane.statefulSet.persistence.dataVolume }} +{{ toYaml .Values.controlPlane.statefulSet.persistence.dataVolume | indent 8 }} + {{- else if not (include "vcluster.persistence.volumeClaim.enabled" .) }} + - name: data + emptyDir: {} + {{- end }} + {{- if .Values.controlPlane.statefulSet.persistence.addVolumes }} +{{ tpl (toYaml .Values.controlPlane.statefulSet.persistence.addVolumes) $ | indent 8 }} + {{- end }} + {{- if (not .Values.experimental.syncSettings.disableSync) }} + initContainers: +{{ include "vcluster.initContainers" . | indent 8 }} + {{- end }} + enableServiceLinks: {{ .Values.controlPlane.statefulSet.enableServiceLinks }} + containers: + - name: syncer + image: {{ include "vcluster.controlPlane.image" . | quote }} + imagePullPolicy: {{ .Values.controlPlane.statefulSet.imagePullPolicy }} + {{- if .Values.controlPlane.statefulSet.workingDir }} + workingDir: {{ .Values.controlPlane.statefulSet.workingDir }} + {{- end }} + {{- if .Values.controlPlane.statefulSet.command }} + command: +{{ toYaml .Values.controlPlane.statefulSet.command | indent 12 }} + {{- end }} + {{- if .Values.controlPlane.statefulSet.args }} + args: +{{ toYaml .Values.controlPlane.statefulSet.args | indent 12 }} + {{- end }} + {{- if .Values.controlPlane.statefulSet.probes.livenessProbe.enabled }} + livenessProbe: + httpGet: + path: /healthz + port: 8443 + scheme: HTTPS + initialDelaySeconds: {{ .Values.controlPlane.statefulSet.probes.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.controlPlane.statefulSet.probes.livenessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.controlPlane.statefulSet.probes.livenessProbe.timeoutSeconds }} + failureThreshold: {{ .Values.controlPlane.statefulSet.probes.livenessProbe.failureThreshold }} + {{- end }} + {{- if .Values.controlPlane.statefulSet.probes.readinessProbe.enabled }} + readinessProbe: + httpGet: + path: /readyz + port: 8443 + scheme: HTTPS + periodSeconds: {{ .Values.controlPlane.statefulSet.probes.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.controlPlane.statefulSet.probes.readinessProbe.timeoutSeconds }} + failureThreshold: {{ .Values.controlPlane.statefulSet.probes.readinessProbe.failureThreshold }} + {{- end }} + {{- if .Values.controlPlane.statefulSet.probes.startupProbe.enabled }} + startupProbe: + httpGet: + path: /readyz + port: 8443 + scheme: HTTPS + periodSeconds: {{ .Values.controlPlane.statefulSet.probes.startupProbe.periodSeconds }} + timeoutSeconds: {{ .Values.controlPlane.statefulSet.probes.startupProbe.timeoutSeconds }} + failureThreshold: {{ .Values.controlPlane.statefulSet.probes.startupProbe.failureThreshold }} + {{- end }} + {{- if .Values.controlPlane.statefulSet.security.containerSecurityContext }} + securityContext: +{{ toYaml .Values.controlPlane.statefulSet.security.containerSecurityContext | indent 12 }} + {{- end }} + resources: +{{ toYaml .Values.controlPlane.statefulSet.resources | indent 12 }} + env: + - name: VCLUSTER_NAME + value: "{{ .Release.Name }}" + {{- if .Values.logging }} + - name: LOFT_LOG_ENCODING + value: {{ default "console" .Values.logging.encoding }} + {{- end }} + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: NODE_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + {{- if .Values.controlPlane.statefulSet.env }} +{{ toYaml .Values.controlPlane.statefulSet.env | indent 12 }} + {{- end }} +{{ include "vcluster.distro.env" . | indent 12 }} + volumeMounts: +{{- include "vcluster.plugins.volumeMounts" . | indent 12 }} + - name: data + mountPath: /data + - name: binaries + mountPath: /binaries + - name: certs + mountPath: /pki + - name: helm-cache + mountPath: /.cache/helm + {{- if eq (include "vcluster.distro" .) "k3s" }} + - name: k3s-config + mountPath: /etc/rancher + {{- end }} + - name: vcluster-config + mountPath: /var/lib/vcluster + - name: tmp + mountPath: /tmp + {{- if .Values.controlPlane.statefulSet.persistence.addVolumeMounts }} +{{ toYaml .Values.controlPlane.statefulSet.persistence.addVolumeMounts | indent 12 }} + {{- end }} +{{- include "vcluster.legacyPlugins.containers" . | indent 8 }} diff --git a/charts/cf-vcluster/charts/vcluster/templates/workload-serviceaccount.yaml b/charts/cf-vcluster/charts/vcluster/templates/workload-serviceaccount.yaml new file mode 100644 index 0000000..91a24fd --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/templates/workload-serviceaccount.yaml @@ -0,0 +1,29 @@ +{{- if .Values.controlPlane.advanced.workloadServiceAccount.enabled }} +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- if .Values.controlPlane.advanced.workloadServiceAccount.name }} + name: {{ .Values.controlPlane.advanced.workloadServiceAccount.name | quote }} + {{- else }} + name: vc-workload-{{ .Release.Name }} + {{- end }} + namespace: {{ .Release.Namespace }} + labels: + app: vcluster + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" + {{- if .Values.controlPlane.advanced.workloadServiceAccount.labels }} +{{ toYaml .Values.controlPlane.advanced.workloadServiceAccount.labels | indent 4 }} + {{- end }} + {{- $annotations := merge dict .Values.controlPlane.advanced.workloadServiceAccount.annotations .Values.controlPlane.advanced.globalMetadata.annotations }} + {{- if $annotations }} + annotations: +{{- toYaml $annotations | nindent 4 }} + {{- end }} +{{- $pullSecrets := concat .Values.controlPlane.advanced.serviceAccount.imagePullSecrets .Values.controlPlane.advanced.workloadServiceAccount.imagePullSecrets }} +{{- if $pullSecrets }} +imagePullSecrets: +{{ toYaml $pullSecrets | indent 2 }} +{{- end }} +{{- end }} diff --git a/charts/cf-vcluster/charts/vcluster/tests/README.md b/charts/cf-vcluster/charts/vcluster/tests/README.md new file mode 100644 index 0000000..56e90a9 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/tests/README.md @@ -0,0 +1,14 @@ +Add [unittest plugin](https://github.com/helm-unittest/helm-unittest) via: +``` +helm plugin install https://github.com/helm-unittest/helm-unittest.git +``` + +Run tests via: +``` +helm unittest chart +``` + +To update the `values.schema.json` run: +``` +go run hack/schema/main.go +``` diff --git a/charts/cf-vcluster/charts/vcluster/tests/clusterrole_test.yaml b/charts/cf-vcluster/charts/vcluster/tests/clusterrole_test.yaml new file mode 100644 index 0000000..f878442 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/tests/clusterrole_test.yaml @@ -0,0 +1,762 @@ +suite: ClusterRoleBinding +templates: + - clusterrole.yaml + +tests: + - it: disable by default + asserts: + - hasDocuments: + count: 0 + + - it: force enable + set: + rbac: + clusterRole: + enabled: true + asserts: + - hasDocuments: + count: 1 + + - it: force disable + set: + rbac: + clusterRole: + enabled: false + extraRules: + - apiGroups: [""] + resources: ["test123"] + verbs: ["test123"] + overwriteRules: + - apiGroups: [""] + resources: ["test"] + verbs: ["test"] + asserts: + - hasDocuments: + count: 0 + + - it: enable scheduler (k8s distro explicitly enabled) + set: + controlPlane: + distro: + k8s: + enabled: true + scheduler: + enabled: true + asserts: + - hasDocuments: + count: 1 + - contains: + path: rules + content: + apiGroups: [ "storage.k8s.io" ] + resources: [ "storageclasses", "csinodes", "csidrivers", "csistoragecapacities" ] + verbs: [ "get", "watch", "list" ] + + - it: enable scheduler (k8s distro implicitly enabled) + set: + controlPlane: + distro: + k8s: + scheduler: + enabled: true + asserts: + - hasDocuments: + count: 1 + - contains: + path: rules + content: + apiGroups: [ "storage.k8s.io" ] + resources: [ "storageclasses", "csinodes", "csidrivers", "csistoragecapacities" ] + verbs: [ "get", "watch", "list" ] + + - it: enable scheduler (deprecated) + set: + controlPlane: + advanced: + virtualScheduler: + enabled: true + asserts: + - hasDocuments: + count: 1 + - contains: + path: rules + content: + apiGroups: [ "storage.k8s.io" ] + resources: [ "storageclasses", "csinodes", "csidrivers", "csistoragecapacities" ] + verbs: [ "get", "watch", "list" ] + + - it: scheduler not enabled for k3s + set: + controlPlane: + distro: + k3s: + enabled: true + k8s: + scheduler: + enabled: true + asserts: + - hasDocuments: + count: 0 + + - it: enable hybrid scheduling + set: + sync: + toHost: + pods: + hybridScheduling: + enabled: true + asserts: + - hasDocuments: + count: 1 + - contains: + path: rules + content: + apiGroups: [ "storage.k8s.io" ] + resources: [ "storageclasses", "csinodes", "csidrivers", "csistoragecapacities" ] + verbs: [ "get", "watch", "list" ] + + - it: enable csinodes + set: + sync: + fromHost: + csiNodes: + enabled: true + asserts: + - hasDocuments: + count: 1 + - contains: + path: rules + content: + apiGroups: [ "storage.k8s.io" ] + resources: [ "csinodes" ] + verbs: [ "get", "watch", "list" ] + + - it: enable by multi namespace mode + set: + rbac: + clusterRole: + enabled: auto + sync: + toHost: + namespaces: + enabled: true + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: rules + count: 1 + - contains: + path: rules + content: + apiGroups: [ "" ] + resources: [ "namespaces", "serviceaccounts"] + verbs: [ "create", "delete", "patch", "update", "get", "watch", "list" ] + + - it: override rules + set: + rbac: + clusterRole: + extraRules: + - apiGroups: [""] + resources: ["test123"] + verbs: ["test123"] + overwriteRules: + - apiGroups: [""] + resources: ["test"] + verbs: ["test"] + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: rules + count: 1 + - contains: + path: rules + content: + apiGroups: [ "" ] + resources: [ "test" ] + verbs: [ "test" ] + + - it: extra rules + set: + sync: + toHost: + priorityClasses: + enabled: true + rbac: + clusterRole: + extraRules: + - apiGroups: [ "" ] + resources: [ "test123" ] + verbs: [ "test123" ] + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: rules + count: 2 + - contains: + path: rules + content: + apiGroups: [ "" ] + resources: [ "test123" ] + verbs: [ "test123" ] + + - it: plugin rules + set: + plugin: + myTest: + rbac: + clusterRole: + extraRules: + - apiGroups: [ "" ] + resources: [ "test123" ] + verbs: [ "test123" ] + plugins: + myTest2: + rbac: + clusterRole: + extraRules: + - apiGroups: [ "" ] + resources: [ "test1234" ] + verbs: [ "test1234" ] + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: rules + count: 2 + - contains: + path: rules + content: + apiGroups: [ "" ] + resources: [ "test123" ] + verbs: [ "test123" ] + - contains: + path: rules + content: + apiGroups: [ "" ] + resources: [ "test1234" ] + verbs: [ "test1234" ] + + - it: replicate services + set: + networking: + replicateServices: + fromHost: + - from: test + to: other-test + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: rules + count: 1 + - contains: + path: rules + content: + apiGroups: [ "" ] + resources: [ "services", "endpoints" ] + verbs: [ "get", "watch", "list" ] + + - it: real nodes + set: + sync: + fromHost: + nodes: + enabled: true + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: rules + count: 1 + - contains: + path: rules + content: + apiGroups: [ "" ] + resources: [ "pods", "nodes", "nodes/status", "nodes/metrics", "nodes/stats", "nodes/proxy" ] + verbs: [ "get", "watch", "list" ] + + - it: virtual scheduler + set: + controlPlane: + advanced: + virtualScheduler: + enabled: true + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: rules + count: 1 + - contains: + path: rules + content: + apiGroups: ["storage.k8s.io"] + resources: ["storageclasses", "csinodes", "csidrivers", "csistoragecapacities"] + verbs: ["get", "watch", "list"] + + - it: legacy pro + set: + pro: true + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: rules + count: 3 + - contains: + path: rules + content: + apiGroups: [ "" ] + resources: [ "pods", "nodes", "nodes/status", "nodes/metrics", "nodes/stats", "nodes/proxy" ] + verbs: [ "get", "watch", "list" ] + - contains: + path: rules + content: + apiGroups: [ "cluster.loft.sh", "storage.loft.sh" ] + resources: [ "features", "virtualclusters" ] + verbs: [ "get", "list", "watch" ] + - contains: + path: rules + content: + apiGroups: ["management.loft.sh"] + resources: ["virtualclusterinstances"] + verbs: ["get"] + + - it: metrics proxy + set: + integrations: + metricsServer: + enabled: true + nodes: true + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - contains: + path: rules + content: + apiGroups: [ "metrics.k8s.io" ] + resources: [ "nodes" ] + verbs: [ "get", "list" ] + + - it: externalSecrets + set: + integrations: + externalSecrets: + enabled: true + webhook: + enabled: false + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: rules + count: 1 + - contains: + path: rules + content: + apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"] + verbs: ["get", "list", "watch"] + - it: kubeVirt + set: + integrations: + kubeVirt: + enabled: true + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: rules + count: 2 + - contains: + path: rules + content: + apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"] + verbs: ["get", "list", "watch"] + - contains: + path: rules + content: + apiGroups: ["admissionregistration.k8s.io"] + resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"] + verbs: ["get", "list", "watch"] + - it: certManger enabled + set: + integrations: + certManager: + enabled: true + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: rules + count: 2 + - contains: + path: rules + content: + apiGroups: ["cert-manager.io"] + resources: ["clusterissuers"] + verbs: ["get", "list", "watch"] + - it: crd sync to host + set: + sync: + toHost: + customResources: + test.test-group: + enabled: true + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: rules + count: 1 + - contains: + path: rules + content: + apiGroups: [ "apiextensions.k8s.io" ] + resources: [ "customresourcedefinitions" ] + verbs: [ "get", "list", "watch" ] + + - it: crd sync from host + set: + sync: + fromHost: + customResources: + test.test-group: + enabled: true + scope: Cluster + test.test-versioned-group/v1alpha1: + enabled: true + scope: Cluster + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: rules + count: 3 + - contains: + path: rules + content: + apiGroups: [ "test-group" ] + resources: [ "test" ] + verbs: [ "get", "list", "watch" ] + - contains: + path: rules + content: + apiGroups: [ "test-versioned-group" ] + resources: [ "test" ] + verbs: [ "get", "list", "watch" ] + - contains: + path: rules + content: + apiGroups: [ "apiextensions.k8s.io" ] + resources: [ "customresourcedefinitions" ] + verbs: [ "get", "list", "watch" ] + - it: eso clusterstore sync + set: + integrations: + externalSecrets: + enabled: true + webhook: + enabled: true + sync: + clusterStores: + enabled: true + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - contains: + path: rules + content: + apiGroups: ["admissionregistration.k8s.io"] + resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"] + verbs: ["get", "list", "watch"] + - contains: + path: rules + content: + apiGroups: [ "external-secrets.io" ] + resources: [ "clustersecretstores" ] + verbs: ["get", "list", "watch"] + + - it: fromHost sync configmaps disabled + set: + sync: + fromHost: + configMaps: + enabled: false + asserts: + - hasDocuments: + count: 0 + + - it: fromHost sync configmaps enabled with wildcard namespace + set: + sync: + fromHost: + configMaps: + enabled: true + mappings: + byName: + "": "my-ns/*" + my-ns/*: "my-ns-2/*" + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: rules + count: 3 + - contains: + path: rules + content: + apiGroups: [ "" ] + resourceNames: ["NAMESPACE", "my-ns"] + resources: [ "namespaces" ] + verbs: [ "get", "list", "watch" ] + - contains: + path: rules + content: + apiGroups: [ "" ] + resources: [ "configmaps" ] + verbs: [ "list", "watch" ] + - contains: + path: rules + content: + apiGroups: [ "" ] + resources: [ "configmaps" ] + verbs: [ "get" ] + + - it: fromHost sync configmaps enabled with wildcard name + set: + sync: + fromHost: + configMaps: + enabled: true + mappings: + byName: + "my-ns/*": "my-ns-4/*" + my-ns-2/*: "my-ns-3/*" + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: rules + count: 3 + - contains: + path: rules + content: + apiGroups: [ "" ] + resourceNames: ["my-ns", "my-ns-2"] + resources: [ "namespaces" ] + verbs: [ "get", "list", "watch" ] + - contains: + path: rules + content: + apiGroups: [ "" ] + resources: [ "configmaps" ] + verbs: [ "list", "watch" ] + - contains: + path: rules + content: + apiGroups: [ "" ] + resources: [ "configmaps" ] + verbs: [ "get" ] + + - it: fromHost sync configmaps enabled without wildcards + set: + sync: + fromHost: + configMaps: + enabled: true + mappings: + byName: + "my-ns/my-cm": "my-ns-2/my-cm-2" + my-ns-3/my-cm-2: "my-ns-4/my-cm4" + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: rules + count: 3 + - contains: + path: rules + content: + apiGroups: [ "" ] + resourceNames: [ "my-ns", "my-ns-3" ] + resources: [ "namespaces" ] + verbs: [ "get", "list", "watch" ] + - contains: + path: rules + content: + apiGroups: [ "" ] + resources: [ "configmaps" ] + verbs: [ "list", "watch" ] + - contains: + path: rules + content: + apiGroups: [ "" ] + resourceNames: [ "my-cm", "my-cm-2" ] + resources: [ "configmaps" ] + verbs: [ "get"] + + - it: fromHost sync secrets disabled + set: + sync: + fromHost: + secrets: + enabled: false + asserts: + - hasDocuments: + count: 0 + + - it: fromHost sync secrets enabled with wildcard namespace + set: + sync: + fromHost: + secrets: + enabled: true + mappings: + byName: + "": "my-ns/*" + my-ns/*: "my-ns-2/*" + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: rules + count: 3 + - contains: + path: rules + content: + apiGroups: [ "" ] + resourceNames: ["NAMESPACE", "my-ns"] + resources: [ "namespaces" ] + verbs: [ "get", "list", "watch" ] + - contains: + path: rules + content: + apiGroups: [ "" ] + resources: [ "secrets" ] + verbs: [ "list", "watch" ] + - contains: + path: rules + content: + apiGroups: [ "" ] + resources: [ "secrets" ] + verbs: [ "get"] + + - it: fromHost sync secrets enabled with wildcard name + set: + sync: + fromHost: + secrets: + enabled: true + mappings: + byName: + "my-ns/*": "my-ns-4/*" + my-ns-2/*: "my-ns-3/*" + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: rules + count: 3 + - contains: + path: rules + content: + apiGroups: [ "" ] + resourceNames: ["my-ns", "my-ns-2"] + resources: [ "namespaces" ] + verbs: [ "get", "list", "watch" ] + - contains: + path: rules + content: + apiGroups: [ "" ] + resources: [ "secrets" ] + verbs: [ "list", "watch" ] + - contains: + path: rules + content: + apiGroups: [ "" ] + resources: [ "secrets" ] + verbs: [ "get" ] + + - it: fromHost sync secrets enabled without wildcards + set: + sync: + fromHost: + secrets: + enabled: true + mappings: + byName: + "my-ns/my-secret": "my-ns-2/my-secret-2" + my-ns-3/my-secret-2: "my-ns-4/my-secret-4" + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: rules + count: 3 + - contains: + path: rules + content: + apiGroups: [ "" ] + resourceNames: [ "my-ns", "my-ns-3" ] + resources: [ "namespaces" ] + verbs: [ "get", "list", "watch" ] + - contains: + path: rules + content: + apiGroups: [ "" ] + resources: [ "secrets" ] + verbs: [ "list", "watch" ] + - contains: + path: rules + content: + apiGroups: [ "" ] + resourceNames: [ "my-secret", "my-secret-2" ] + resources: [ "secrets" ] + verbs: [ "get" ] + - it: istio enabled + set: + integrations: + istio: + enabled: true + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: rules + count: 1 + - contains: + path: rules + content: + apiGroups: [ "apiextensions.k8s.io" ] + resources: [ "customresourcedefinitions" ] + verbs: [ "get", "list", "watch" ] diff --git a/charts/cf-vcluster/charts/vcluster/tests/clusterrolebinding_test.yaml b/charts/cf-vcluster/charts/vcluster/tests/clusterrolebinding_test.yaml new file mode 100644 index 0000000..8b743c1 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/tests/clusterrolebinding_test.yaml @@ -0,0 +1,129 @@ +suite: ClusterRoleBinding +templates: + - clusterrolebinding.yaml + +tests: + - it: disable by default + asserts: + - hasDocuments: + count: 0 + + - it: enable by multi namespace mode + set: + sync: + toHost: + namespaces: + enabled: true + asserts: + - hasDocuments: + count: 1 + + - it: enable by from syncer + set: + sync: + fromHost: + ingressClasses: + enabled: true + asserts: + - hasDocuments: + count: 1 + + - it: enable by plugins + set: + plugins: + test: + rbac: + clusterRole: + extraRules: + - apiGroups: [""] + resources: ["test"] + verbs: ["test"] + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + + - it: enable by plugin + set: + plugin: + test: + rbac: + clusterRole: + extraRules: + - apiGroups: [""] + resources: ["test"] + verbs: ["test"] + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + + - it: enable by legacy api key + set: + pro: true + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - equal: + path: kind + value: ClusterRoleBinding + - equal: + path: metadata.name + value: vc-my-release-v-my-namespace + - notExists: + path: metadata.namespace + + - it: enable by extra rules + set: + rbac: + clusterRole: + extraRules: + - apiGroups: [""] + resources: ["test"] + verbs: ["test"] + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - equal: + path: kind + value: ClusterRoleBinding + - equal: + path: metadata.name + value: vc-my-release-v-my-namespace + - notExists: + path: metadata.namespace + + - it: enable by overwrite rules + set: + rbac: + clusterRole: + overwriteRules: + - apiGroups: [""] + resources: ["test"] + verbs: ["test"] + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - equal: + path: kind + value: ClusterRoleBinding + - equal: + path: metadata.name + value: vc-my-release-v-my-namespace + - notExists: + path: metadata.namespace + + diff --git a/charts/cf-vcluster/charts/vcluster/tests/etcd-headless-service_test.yaml b/charts/cf-vcluster/charts/vcluster/tests/etcd-headless-service_test.yaml new file mode 100644 index 0000000..45159d7 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/tests/etcd-headless-service_test.yaml @@ -0,0 +1,96 @@ +suite: External etcd headless Service +templates: + - etcd-headless-service.yaml + +tests: + - it: check disabled + asserts: + - hasDocuments: + count: 0 + + - it: enable for k3s & defaults + release: + name: my-release + namespace: my-namespace + set: + controlPlane: + backingStore: + etcd: + deploy: + enabled: true + headlessService: + annotations: + test: test + distro: + k3s: + enabled: true + asserts: + - hasDocuments: + count: 1 + - equal: + path: metadata.name + value: my-release-etcd-headless + - equal: + path: metadata.namespace + value: my-namespace + - equal: + path: metadata.annotations.test + value: test + + - it: enable for k8s & defaults + release: + name: my-release + namespace: my-namespace + set: + controlPlane: + backingStore: + etcd: + deploy: + enabled: true + headlessService: + annotations: + test: test + distro: + k8s: + enabled: true + asserts: + - hasDocuments: + count: 1 + - equal: + path: metadata.name + value: my-release-etcd-headless + - equal: + path: metadata.namespace + value: my-namespace + - equal: + path: metadata.annotations.test + value: test + + - it: enable for k8s & defaults + release: + name: my-release + namespace: my-namespace + set: + controlPlane: + backingStore: + etcd: + deploy: + enabled: true + headlessService: + annotations: + test: test + distro: + k8s: + enabled: true + asserts: + - hasDocuments: + count: 1 + - equal: + path: metadata.name + value: my-release-etcd-headless + - equal: + path: metadata.namespace + value: my-namespace + - equal: + path: metadata.annotations.test + value: test diff --git a/charts/cf-vcluster/charts/vcluster/tests/etcd-service_test.yaml b/charts/cf-vcluster/charts/vcluster/tests/etcd-service_test.yaml new file mode 100644 index 0000000..fb44431 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/tests/etcd-service_test.yaml @@ -0,0 +1,38 @@ +suite: External etcd Service +templates: + - etcd-service.yaml + +tests: + - it: check disabled + asserts: + - hasDocuments: + count: 0 + + - it: enable for k8s & defaults + release: + name: my-release + namespace: my-namespace + set: + controlPlane: + backingStore: + etcd: + deploy: + enabled: true + service: + annotations: + test: test + distro: + k8s: + enabled: true + asserts: + - hasDocuments: + count: 1 + - equal: + path: metadata.name + value: my-release-etcd + - equal: + path: metadata.namespace + value: my-namespace + - equal: + path: metadata.annotations.test + value: test diff --git a/charts/cf-vcluster/charts/vcluster/tests/etcd-statefulset_test.yaml b/charts/cf-vcluster/charts/vcluster/tests/etcd-statefulset_test.yaml new file mode 100644 index 0000000..4d48b2f --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/tests/etcd-statefulset_test.yaml @@ -0,0 +1,194 @@ +suite: External etcd StatefulSet +templates: + - etcd-statefulset.yaml + +tests: + - it: check disabled + asserts: + - hasDocuments: + count: 0 + + - it: check disabled for external etcd + set: + controlPlane: + backingStore: + etcd: + external: + enabled: true + asserts: + - hasDocuments: + count: 0 + + - it: check default image registry + set: + controlPlane: + backingStore: + etcd: + deploy: + enabled: true + statefulSet: + image: + tag: "123" + advanced: + defaultImageRegistry: fabi.com + asserts: + - hasDocuments: + count: 1 + - equal: + path: spec.template.spec.containers[0].image + value: fabi.com/etcd:123 + + - it: disables serviceLinks for backingStore etcd pod + set: + controlPlane: + backingStore: + etcd: + deploy: + enabled: true + statefulSet: + enabled: true + enableServiceLinks: false + asserts: + - hasDocuments: + count: 1 + - equal: + path: spec.template.spec.enableServiceLinks + value: false + + - it: change image registry + set: + controlPlane: + backingStore: + etcd: + deploy: + enabled: true + statefulSet: + image: + registry: fabi.com + tag: "123" + asserts: + - hasDocuments: + count: 1 + - equal: + path: spec.template.spec.containers[0].image + value: fabi.com/etcd:123 + + - it: check specified storage class is used + set: + controlPlane: + backingStore: + etcd: + deploy: + enabled: true + statefulSet: + persistence: + volumeClaim: + storageClass: test-sc + asserts: + - hasDocuments: + count: 1 + - equal: + path: spec.volumeClaimTemplates[0].spec.storageClassName + value: test-sc + + - it: enabled for k3s & non persistent + set: + controlPlane: + backingStore: + etcd: + deploy: + enabled: true + statefulSet: + extraArgs: + - "extra-arg" + env: + - name: my-new-env + persistence: + volumeClaim: + enabled: false + addVolumes: + - name: my-new-volume + addVolumeMounts: + - name: my-new-volume + asserts: + - hasDocuments: + count: 1 + - contains: + path: spec.template.spec.volumes + content: + name: "data" + emptyDir: {} + count: 1 + - notExists: + path: spec.volumeClaimTemplates + - contains: + path: spec.template.spec.volumes + content: + name: "my-new-volume" + count: 1 + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: "my-new-volume" + count: 1 + - contains: + path: spec.template.spec.containers[0].env + content: + name: "my-new-env" + count: 1 + - contains: + path: spec.template.spec.containers[0].command + content: "extra-arg" + count: 1 + + - it: enable for k8s & defaults + release: + name: my-release + namespace: my-namespace + set: + controlPlane: + backingStore: + etcd: + deploy: + enabled: true + statefulSet: + highAvailability: + replicas: 3 + annotations: + test: test + distro: + k8s: + enabled: true + asserts: + - hasDocuments: + count: 1 + - equal: + path: metadata.name + value: my-release-etcd + - equal: + path: metadata.namespace + value: my-namespace + - equal: + path: metadata.annotations.test + value: test + - equal: + path: spec.replicas + value: 3 + - lengthEqual: + path: spec.volumeClaimTemplates + count: 1 + - lengthEqual: + path: spec.template.spec.volumes + count: 1 + - lengthEqual: + path: spec.template.spec.containers[0].volumeMounts + count: 2 + - lengthEqual: + path: spec.template.spec.containers[0].env + count: 1 + - notExists: + path: spec.template.spec.containers[0].args + - contains: + path: spec.template.spec.containers[0].command + content: "--initial-cluster=my-release-etcd-0=https://my-release-etcd-0.my-release-etcd-headless.my-namespace:2380,my-release-etcd-1=https://my-release-etcd-1.my-release-etcd-headless.my-namespace:2380,my-release-etcd-2=https://my-release-etcd-2.my-release-etcd-headless.my-namespace:2380" + count: 1 diff --git a/charts/cf-vcluster/charts/vcluster/tests/headless-service_test.yaml b/charts/cf-vcluster/charts/vcluster/tests/headless-service_test.yaml new file mode 100644 index 0000000..7763af3 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/tests/headless-service_test.yaml @@ -0,0 +1,88 @@ +suite: ControlPlane StatefulSet +templates: + - headless-service.yaml + +tests: + - it: should create if k8s + set: + controlPlane: + distro: + k8s: + enabled: true + asserts: + - hasDocuments: + count: 1 + + - it: should not create if stateless + set: + controlPlane: + backingStore: + etcd: + deploy: + enabled: true + asserts: + - hasDocuments: + count: 0 + + - it: should not create if stateless 2 + set: + controlPlane: + backingStore: + database: + external: + enabled: true + asserts: + - hasDocuments: + count: 0 + + - it: name + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: spec.ports + count: 1 + - equal: + path: metadata.name + value: my-release-headless + - equal: + path: metadata.namespace + value: my-namespace + + - it: embedded-etcd + set: + controlPlane: + backingStore: + etcd: + embedded: + enabled: true + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: spec.ports + count: 3 + - equal: + path: spec.ports[1].name + value: etcd + - equal: + path: spec.ports[2].name + value: peer + + - it: embedded-database + set: + controlPlane: + backingStore: + database: + embedded: + enabled: true + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: spec.ports + count: 1 + diff --git a/charts/cf-vcluster/charts/vcluster/tests/ingress_test.yaml b/charts/cf-vcluster/charts/vcluster/tests/ingress_test.yaml new file mode 100644 index 0000000..5f8ba61 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/tests/ingress_test.yaml @@ -0,0 +1,84 @@ +suite: ControlPlane Ingress +templates: + - ingress.yaml + +tests: + - it: should not create ingress by default + asserts: + - hasDocuments: + count: 0 + + - it: ingress defaults + set: + controlPlane: + ingress: + enabled: true + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - equal: + path: metadata.name + value: my-release + - equal: + path: metadata.namespace + value: my-namespace + + - it: overwrite ingress tls + set: + controlPlane: + ingress: + enabled: true + host: my-host + spec: + tls: + - hosts: + - ingress-demo.example.com + secretName: ingress-demo-tls + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: spec.tls + count: 1 + - equal: + path: spec.rules[0].host + value: my-host + - contains: + path: spec.tls + count: 1 + content: + hosts: + - ingress-demo.example.com + secretName: ingress-demo-tls + + - it: template ingress spec + set: + controlPlane: + ingress: + enabled: true + host: my-host + spec: + tls: + - hosts: + - ingress-demo.example.com + secretName: '{{ .Release.Name }}-ingress-demo-tls' + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: spec.tls + count: 1 + - equal: + path: spec.rules[0].host + value: my-host + - contains: + path: spec.tls + count: 1 + content: + hosts: + - ingress-demo.example.com + secretName: RELEASE-NAME-ingress-demo-tls + diff --git a/charts/cf-vcluster/charts/vcluster/tests/limitrange_test.yaml b/charts/cf-vcluster/charts/vcluster/tests/limitrange_test.yaml new file mode 100644 index 0000000..bf6cd9d --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/tests/limitrange_test.yaml @@ -0,0 +1,94 @@ +suite: LimitRange +templates: + - limitrange.yaml + +tests: + - it: should not create limit range by default + asserts: + - hasDocuments: + count: 0 + + - it: check defaults + release: + name: my-release + namespace: my-namespace + set: + policies: + limitRange: + enabled: true + asserts: + - hasDocuments: + count: 1 + - equal: + path: metadata.name + value: vc-my-release + - equal: + path: metadata.namespace + value: my-namespace + - lengthEqual: + path: spec.limits + count: 1 + + - it: check enabled + release: + name: my-release + namespace: my-namespace + set: + policies: + resourceQuota: + enabled: true + asserts: + - hasDocuments: + count: 1 + + - it: check disabled + release: + name: my-release + namespace: my-namespace + set: + policies: + resourceQuota: + enabled: true + limitRange: + enabled: false + asserts: + - hasDocuments: + count: 0 + + - it: check disabled both false + release: + name: my-release + namespace: my-namespace + set: + policies: + resourceQuota: + enabled: false + limitRange: + enabled: false + asserts: + - hasDocuments: + count: 0 + + - it: check disabled both false + release: + name: my-release + namespace: my-namespace + set: + policies: + limitRange: + enabled: true + min: + cpu: 1 + max: + memory: 256Mi + asserts: + - hasDocuments: + count: 1 + - equal: + path: spec.limits[0].min.cpu + value: "1" + - equal: + path: spec.limits[0].max.memory + value: "256Mi" + + diff --git a/charts/cf-vcluster/charts/vcluster/tests/manifests_test.yaml b/charts/cf-vcluster/charts/vcluster/tests/manifests_test.yaml new file mode 100644 index 0000000..974b40d --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/tests/manifests_test.yaml @@ -0,0 +1,94 @@ +suite: Manifests +templates: + - manifests.yaml + +tests: + - it: should not create manifests by default + asserts: + - hasDocuments: + count: 0 + + - it: check defaults + release: + name: my-release + namespace: my-namespace + set: + experimental: + deploy: + vcluster: + manifests: |- + apiVersion: v1 + kind: Pod + metadata: + name: nginx + labels: + app: nginx + spec: + containers: + - image: nginx + name: nginx + asserts: + - hasDocuments: + count: 0 + + - it: check defaults + release: + name: my-release + namespace: my-namespace + set: + experimental: + deploy: + host: + manifests: |- + apiVersion: v1 + kind: Pod + metadata: + name: nginx + labels: + app: nginx + spec: + containers: + - image: nginx + name: nginx + asserts: + - hasDocuments: + count: 1 + - equal: + path: kind + value: Pod + - equal: + path: spec.containers[0].name + value: nginx + + - it: check defaults + release: + name: my-release + namespace: my-namespace + set: + experimental: + deploy: + host: + manifestsTemplate: |- + apiVersion: v1 + kind: Pod + metadata: + name: nginx + namespace: {{ .Release.Namespace }} + labels: + app: nginx + spec: + containers: + - image: nginx + name: nginx + asserts: + - hasDocuments: + count: 1 + - equal: + path: kind + value: Pod + - equal: + path: metadata.namespace + value: my-namespace + - equal: + path: spec.containers[0].name + value: nginx diff --git a/charts/cf-vcluster/charts/vcluster/tests/networkpolicy_test.yaml b/charts/cf-vcluster/charts/vcluster/tests/networkpolicy_test.yaml new file mode 100644 index 0000000..d1bb2dc --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/tests/networkpolicy_test.yaml @@ -0,0 +1,123 @@ +suite: NetworkPolicy +templates: + - networkpolicy.yaml + +tests: + - it: should not create network policy by default + asserts: + - hasDocuments: + count: 0 + + - it: check defaults + release: + name: my-release + namespace: my-namespace + set: + policies: + networkPolicy: + enabled: true + asserts: + - hasDocuments: + count: 2 + - documentIndex: 0 + equal: + path: metadata.name + value: vc-work-my-release + - documentIndex: 0 + equal: + path: spec.egress[2].to[1].ipBlock.cidr + value: 0.0.0.0/0 + - documentIndex: 1 + equal: + path: metadata.name + value: vc-cp-my-release + - documentIndex: 0 + equal: + path: metadata.namespace + value: my-namespace + - documentIndex: 1 + equal: + path: metadata.namespace + value: my-namespace + - documentIndex: 0 + lengthEqual: + path: spec.egress + count: 3 + - documentIndex: 1 + lengthEqual: + path: spec.egress + count: 2 + + - it: check extra control plane rules + release: + name: my-release + namespace: my-namespace + set: + policies: + networkPolicy: + enabled: true + extraControlPlaneRules: + - ports: + - port: 443 + - port: 8443 + - port: 6443 + asserts: + - hasDocuments: + count: 2 + - documentIndex: 0 + lengthEqual: + path: spec.egress + count: 3 + - documentIndex: 1 + lengthEqual: + path: spec.egress + count: 3 + - documentIndex: 1 + equal: + path: spec.egress[2].ports[0].port + value: 443 + - documentIndex: 1 + equal: + path: spec.egress[2].ports[1].port + value: 8443 + - documentIndex: 1 + equal: + path: spec.egress[2].ports[2].port + value: 6443 + + - it: check extra workload rules + release: + name: my-release + namespace: my-namespace + set: + policies: + networkPolicy: + enabled: true + extraWorkloadRules: + - ports: + - port: 443 + - port: 8443 + - port: 6443 + asserts: + - hasDocuments: + count: 2 + - documentIndex: 0 + lengthEqual: + path: spec.egress + count: 4 + - documentIndex: 1 + lengthEqual: + path: spec.egress + count: 2 + - documentIndex: 0 + equal: + path: spec.egress[3].ports[0].port + value: 443 + - documentIndex: 0 + equal: + path: spec.egress[3].ports[1].port + value: 8443 + - documentIndex: 0 + equal: + path: spec.egress[3].ports[2].port + value: 6443 diff --git a/charts/cf-vcluster/charts/vcluster/tests/platform-secret-role_test.yaml b/charts/cf-vcluster/charts/vcluster/tests/platform-secret-role_test.yaml new file mode 100644 index 0000000..2285918 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/tests/platform-secret-role_test.yaml @@ -0,0 +1,118 @@ +suite: Platform Secret Role +templates: + - platform-rbac.yaml + +tests: + - it: check explicitly disabled + set: + external: + platform: + apiKey: + namespace: "some-other-namespace" + createRBAC: false + asserts: + - hasDocuments: + count: 0 + + - it: check disabled on empty namespace + set: + external: + platform: + apiKey: + namespace: "" + asserts: + - hasDocuments: + count: 0 + + - it: check disabled on implicit same namespace + set: + external: + platform: + apiKey: + secretName: "some-other-secret" + asserts: + - hasDocuments: + count: 0 + + - it: automatically create role for specific secret for reading & patching + release: + namespace: test + set: + external: + platform: + apiKey: + secretName: "my-secret-name" + namespace: "some-other-namespace" + asserts: + - hasDocuments: + count: 2 + - documentIndex: 0 + lengthEqual: + path: rules + count: 1 + - documentIndex: 0 + equal: + path: metadata.name + value: "vc-RELEASE-NAME-v-test-platform-role" + - documentIndex: 1 + equal: + path: metadata.name + value: "vc-RELEASE-NAME-v-test-platform-role-binding" + - documentIndex: 0 + contains: + path: rules + count: 1 + content: + apiGroups: [""] + resources: ["secrets"] + verbs: ["get"] + resourceNames: ["my-secret-name"] + - documentIndex: 1 + contains: + path: subjects + count: 1 + content: + kind: ServiceAccount + name: vc-RELEASE-NAME + namespace: test + + - it: automatically create role for default secret for reading & patching + release: + namespace: test + set: + external: + platform: + apiKey: + namespace: "some-other-namespace" + asserts: + - hasDocuments: + count: 2 + - documentIndex: 0 + lengthEqual: + path: rules + count: 1 + - documentIndex: 0 + equal: + path: metadata.name + value: "vc-RELEASE-NAME-v-test-platform-role" + - documentIndex: 1 + equal: + path: metadata.name + value: "vc-RELEASE-NAME-v-test-platform-role-binding" + - documentIndex: 0 + contains: + path: rules + count: 1 + content: + apiGroups: [""] + resources: ["secrets"] + verbs: ["get"] + resourceNames: ["vcluster-platform-api-key"] + - documentIndex: 1 + contains: + path: subjects + count: 1 + content: + kind: ServiceAccount + name: vc-RELEASE-NAME + namespace: test diff --git a/charts/cf-vcluster/charts/vcluster/tests/resourcequota_test.yaml b/charts/cf-vcluster/charts/vcluster/tests/resourcequota_test.yaml new file mode 100644 index 0000000..a1933b9 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/tests/resourcequota_test.yaml @@ -0,0 +1,70 @@ +suite: ResourceQuota +templates: + - resourcequota.yaml + +tests: + - it: should not create resource quota by default + asserts: + - hasDocuments: + count: 0 + + - it: check defaults + release: + name: my-release + namespace: my-namespace + set: + policies: + resourceQuota: + enabled: true + asserts: + - hasDocuments: + count: 1 + - equal: + path: metadata.name + value: vc-my-release + - equal: + path: metadata.namespace + value: my-namespace + - equal: + path: spec.hard["requests.cpu"] + value: "10" + + - it: check enabled + release: + name: my-release + namespace: my-namespace + set: + policies: + limitRange: + enabled: true + asserts: + - hasDocuments: + count: 1 + + - it: check disabled + release: + name: my-release + namespace: my-namespace + set: + policies: + resourceQuota: + enabled: false + limitRange: + enabled: true + asserts: + - hasDocuments: + count: 0 + + - it: check disabled both false + release: + name: my-release + namespace: my-namespace + set: + policies: + resourceQuota: + enabled: false + limitRange: + enabled: false + asserts: + - hasDocuments: + count: 0 diff --git a/charts/cf-vcluster/charts/vcluster/tests/role_test.yaml b/charts/cf-vcluster/charts/vcluster/tests/role_test.yaml new file mode 100644 index 0000000..9f0d07a --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/tests/role_test.yaml @@ -0,0 +1,434 @@ +suite: Role +templates: + - role.yaml + +tests: + - it: check disabled + set: + rbac: + role: + enabled: false + asserts: + - hasDocuments: + count: 0 + + - it: check overwrite rules + set: + rbac: + role: + overwriteRules: + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["create"] + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: rules + count: 1 + - contains: + path: rules + count: 1 + content: + apiGroups: [""] + resources: ["configmaps"] + verbs: ["create"] + + - it: check plugin extra rules + set: + plugin: + test123: + rbac: + role: + extraRules: + - apiGroups: [""] + resources: ["test123"] + verbs: ["test123"] + plugins: + test: + rbac: + role: + extraRules: + - apiGroups: [""] + resources: ["test"] + verbs: ["test"] + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: rules + count: 7 + - contains: + path: rules + count: 1 + content: + apiGroups: [""] + resources: ["test123"] + verbs: ["test123"] + - contains: + path: rules + count: 1 + content: + apiGroups: [""] + resources: ["test"] + verbs: ["test"] + + - it: check extra rules + set: + rbac: + role: + extraRules: + - apiGroups: [""] + resources: ["test"] + verbs: ["test"] + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: rules + count: 6 + - contains: + path: rules + count: 1 + content: + apiGroups: [""] + resources: ["test"] + verbs: ["test"] + + - it: check defaults + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - equal: + path: kind + value: Role + - equal: + path: metadata.name + value: vc-my-release + - equal: + path: metadata.namespace + value: my-namespace + + - it: multi-namespace mode + set: + sync: + toHost: + namespaces: + enabled: true + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - equal: + path: kind + value: ClusterRole + - equal: + path: metadata.name + value: vc-mn-my-release-v-my-namespace + + - it: metrics proxy + set: + integrations: + metricsServer: + enabled: true + pods: true + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - equal: + path: kind + value: Role + - contains: + path: rules + content: + apiGroups: ["metrics.k8s.io"] + resources: ["pods"] + verbs: ["get", "list"] + + - it: external secret test + set: + integrations: + externalSecrets: + enabled: true + sync: + externalSecrets: + enabled: true + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - equal: + path: kind + value: Role + - contains: + path: rules + content: + apiGroups: ["external-secrets.io"] + resources: ["externalsecrets"] + verbs: + ["create", "delete", "patch", "update", "get", "list", "watch"] + - it: certManager enabled + set: + integrations: + certManager: + enabled: true + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - equal: + path: kind + value: Role + - contains: + path: rules + content: + apiGroups: ["cert-manager.io"] + resources: ["issuers"] + verbs: + ["create", "delete", "patch", "update", "get", "list", "watch"] + - contains: + path: rules + content: + apiGroups: ["cert-manager.io"] + resources: ["certificates"] + verbs: + ["create", "delete", "patch", "update", "get", "list", "watch"] + - it: external secret test store sync + set: + integrations: + externalSecrets: + enabled: true + sync: + externalSecrets: + enabled: true + stores: + enabled: true + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - equal: + path: kind + value: Role + - contains: + path: rules + content: + apiGroups: ["external-secrets.io"] + resources: ["secretstores"] + verbs: + ["create", "delete", "patch", "update", "get", "list", "watch"] + - it: kubeVirt test + set: + integrations: + kubeVirt: + enabled: true + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - equal: + path: kind + value: Role + - contains: + path: rules + content: + apiGroups: ["kubevirt.io"] + resources: + [ + "virtualmachines", + "virtualmachines/status", + "virtualmachineinstances", + "virtualmachineinstances/status", + "virtualmachineinstancemigrations", + "virtualmachineinstancemigrations/status", + ] + verbs: + ["create", "delete", "patch", "update", "get", "list", "watch"] + - contains: + path: rules + content: + apiGroups: ["cdi.kubevirt.io"] + resources: ["datavolumes", "datavolumes/status"] + verbs: + ["create", "delete", "patch", "update", "get", "list", "watch"] + - contains: + path: rules + content: + apiGroups: ["clone.kubevirt.io"] + resources: ["virtualmachineclones", "virtualmachineclones/status"] + verbs: + ["create", "delete", "patch", "update", "get", "list", "watch"] + - contains: + path: rules + content: + apiGroups: ["pool.kubevirt.io"] + resources: ["virtualmachinepools", "virtualmachinepools/status"] + verbs: + ["create", "delete", "patch", "update", "get", "list", "watch"] + + - it: crd sync + set: + sync: + toHost: + customResources: + test.my-group: + enabled: false + test.my-group-2: + enabled: true + tests.my-group-3.com: + enabled: true + tests.my-versioned-group-1/v1alpha1: + enabled: true + tests.my-versioned-group-2.com/v1beta1: + enabled: true + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - equal: + path: kind + value: Role + - lengthEqual: + path: rules + count: 9 + - contains: + path: rules + content: + apiGroups: ["my-group-2"] + resources: ["test"] + verbs: + ["create", "delete", "patch", "update", "get", "list", "watch"] + - contains: + path: rules + content: + apiGroups: ["my-group-3.com"] + resources: ["tests"] + verbs: + ["create", "delete", "patch", "update", "get", "list", "watch"] + - contains: + path: rules + content: + apiGroups: [ "my-versioned-group-1" ] + resources: [ "tests" ] + verbs: + [ "create", "delete", "patch", "update", "get", "list", "watch" ] + - contains: + path: rules + content: + apiGroups: [ "my-versioned-group-2.com" ] + resources: [ "tests" ] + verbs: + [ "create", "delete", "patch", "update", "get", "list", "watch" ] + + - it: patches + set: + sync: + toHost: + customResources: + test.my-group-2: + enabled: true + patches: + - path: "test" + expression: "test" + release: + name: my-release + namespace: my-namespace + asserts: + - notFailedTemplate: {} + + - it: patches 2 + set: + sync: + toHost: + customResources: + test.my-group-2: + enabled: true + patches: + - path: "test" + reference: + apiVersion: "v1" + kind: "Secret" + release: + name: my-release + namespace: my-namespace + asserts: + - notFailedTemplate: {} + + - it: istio integration + set: + integrations: + istio: + enabled: true + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - equal: + path: kind + value: Role + - contains: + path: rules + content: + apiGroups: ["networking.istio.io"] + resources: ["destinationrules", "gateways", "serviceentries", "virtualservices"] + verbs: + ["create", "delete", "patch", "update", "get", "list", "watch"] + - contains: + path: rules + content: + apiGroups: ["gateway.networking.k8s.io"] + resources: ["referencegrants"] + verbs: + ["create", "delete", "patch", "update", "get", "list", "watch"] + + - it: private nodes + set: + privateNodes: + enabled: true + asserts: + - hasDocuments: + count: 1 + - equal: + path: kind + value: Role + - contains: + path: rules + content: + apiGroups: [""] + resources: ["services", "pods", "persistentvolumeclaims"] + verbs: + ["get", "list", "watch"] + - contains: + path: rules + content: + apiGroups: [""] + resources: ["secrets", "configmaps"] + verbs: + ["create", "delete", "patch", "update", "get", "list", "watch"] + - contains: + path: rules + content: + apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: + ["create", "delete", "patch", "update", "get", "list", "watch"] diff --git a/charts/cf-vcluster/charts/vcluster/tests/rolebinding_test.yaml b/charts/cf-vcluster/charts/vcluster/tests/rolebinding_test.yaml new file mode 100644 index 0000000..877c17e --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/tests/rolebinding_test.yaml @@ -0,0 +1,60 @@ +suite: RoleBinding +templates: + - rolebinding.yaml + +tests: + - it: check defaults + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - equal: + path: kind + value: RoleBinding + - equal: + path: metadata.name + value: vc-my-release + - equal: + path: metadata.namespace + value: my-namespace + - equal: + path: subjects[0].name + value: vc-my-release + - equal: + path: roleRef.kind + value: Role + - equal: + path: roleRef.name + value: vc-my-release + + - it: multi-namespace mode + set: + sync: + toHost: + namespaces: + enabled: true + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - equal: + path: kind + value: ClusterRoleBinding + - equal: + path: metadata.name + value: vc-mn-my-release-v-my-namespace + - notExists: + path: metadata.namespace + - equal: + path: subjects[0].name + value: vc-my-release + - equal: + path: roleRef.kind + value: ClusterRole + - equal: + path: roleRef.name + value: vc-mn-my-release-v-my-namespace diff --git a/charts/cf-vcluster/charts/vcluster/tests/service-monitor_test.yaml b/charts/cf-vcluster/charts/vcluster/tests/service-monitor_test.yaml new file mode 100644 index 0000000..f449d3c --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/tests/service-monitor_test.yaml @@ -0,0 +1,115 @@ +suite: ServiceMonitor +templates: + - service-monitor.yaml + +tests: + - it: should not create service monitor by default + asserts: + - hasDocuments: + count: 0 + + - it: check defaults + release: + name: my-release + namespace: my-namespace + set: + controlPlane: + serviceMonitor: + enabled: true + asserts: + - hasDocuments: + count: 1 + - equal: + path: metadata.name + value: vc-my-release + - equal: + path: metadata.namespace + value: my-namespace + - equal: + path: spec.selector.matchLabels.app + value: vcluster + - lengthEqual: + path: spec.endpoints + count: 2 + + - it: check defaults k3s + release: + name: my-release + namespace: my-namespace + set: + controlPlane: + distro: + k3s: + enabled: true + serviceMonitor: + enabled: true + asserts: + - hasDocuments: + count: 1 + - equal: + path: metadata.name + value: vc-my-release + - equal: + path: metadata.namespace + value: my-namespace + - equal: + path: spec.selector.matchLabels.app + value: vcluster + - lengthEqual: + path: spec.endpoints + count: 1 + + - it: override release label + release: + name: my-release + namespace: my-namespace + set: + controlPlane: + serviceMonitor: + enabled: true + labels: + release: kube-prometheus-stack + asserts: + - hasDocuments: + count: 1 + - equal: + path: metadata.labels.release + value: kube-prometheus-stack + + - it: check virtual scheduler + release: + name: my-release + namespace: my-namespace + set: + controlPlane: + distro: + k8s: + enabled: true + scheduler: + enabled: true + serviceMonitor: + enabled: true + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: spec.endpoints + count: 3 + + - it: check virtual scheduler (deprecated) + release: + name: my-release + namespace: my-namespace + set: + controlPlane: + advanced: + virtualScheduler: + enabled: true + serviceMonitor: + enabled: true + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: spec.endpoints + count: 3 diff --git a/charts/cf-vcluster/charts/vcluster/tests/service_test.yaml b/charts/cf-vcluster/charts/vcluster/tests/service_test.yaml new file mode 100644 index 0000000..6c22470 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/tests/service_test.yaml @@ -0,0 +1,114 @@ +suite: ControlPlane Service +templates: + - service.yaml + +tests: + - it: should not create service + set: + controlPlane: + service: + enabled: false + asserts: + - hasDocuments: + count: 0 + + - it: should not create kubelet port + set: + networking: + advanced: + proxyKubelets: + byHostname: false + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: spec.ports + count: 1 + - contains: + path: spec.ports + content: + name: https + nodePort: 0 + targetPort: 8443 + protocol: TCP + port: 443 + + - it: should not create kubelet port 2 + set: + controlPlane: + service: + spec: + type: LoadBalancer + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: spec.ports + count: 1 + - contains: + path: spec.ports + content: + name: https + nodePort: 0 + targetPort: 8443 + protocol: TCP + port: 443 + + - it: should create kubelet port + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: spec.ports + count: 2 + - contains: + path: spec.ports + content: + name: kubelet + nodePort: 0 + targetPort: 8443 + protocol: TCP + port: 10250 + + - it: service defaults + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - equal: + path: metadata.name + value: my-release + - equal: + path: metadata.namespace + value: my-namespace + - equal: + path: spec.type + value: ClusterIP + - equal: + path: spec.selector.app + value: vcluster + - lengthEqual: + path: spec.ports + count: 2 + + - it: konnectivity + release: + name: my-release + namespace: my-namespace + set: + privateNodes: + enabled: true + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: spec.ports + count: 3 + - contains: + path: spec.ports + content: + name: konnectivity + protocol: TCP + port: 8132 diff --git a/charts/cf-vcluster/charts/vcluster/tests/serviceaccount_test.yaml b/charts/cf-vcluster/charts/vcluster/tests/serviceaccount_test.yaml new file mode 100644 index 0000000..4441181 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/tests/serviceaccount_test.yaml @@ -0,0 +1,61 @@ +suite: ControlPlane ServiceAccount +templates: + - serviceaccount.yaml + +tests: + - it: should not create service account + set: + controlPlane: + advanced: + serviceAccount: + enabled: false + asserts: + - hasDocuments: + count: 0 + + - it: should create service account + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - equal: + path: metadata.name + value: vc-my-release + - equal: + path: metadata.namespace + value: my-namespace + + - it: should create service account with name + set: + controlPlane: + advanced: + serviceAccount: + name: test + asserts: + - hasDocuments: + count: 1 + - equal: + path: metadata.name + value: test + + - it: should create image pull secrets + set: + controlPlane: + advanced: + serviceAccount: + imagePullSecrets: + - name: test1 + workloadServiceAccount: + imagePullSecrets: + - name: test2 + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: imagePullSecrets + count: 1 + - equal: + path: imagePullSecrets[0].name + value: test1 diff --git a/charts/cf-vcluster/charts/vcluster/tests/statefulset_test.yaml b/charts/cf-vcluster/charts/vcluster/tests/statefulset_test.yaml new file mode 100644 index 0000000..b890c38 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/tests/statefulset_test.yaml @@ -0,0 +1,953 @@ +suite: ControlPlane StatefulSet +templates: + - statefulset.yaml + +tests: + - it: image name + set: + controlPlane: + statefulSet: + image: + registry: "custom-registry.com" + asserts: + - equal: + path: spec.template.spec.containers[0].image + value: custom-registry.com/loft-sh/vcluster-pro:0.0.1 + + - it: defaultImageRegistry + set: + controlPlane: + advanced: + defaultImageRegistry: docker.io + asserts: + - equal: + path: spec.template.spec.containers[0].image + value: docker.io/loft-sh/vcluster-pro:0.0.1 + + - it: custom tag + set: + controlPlane: + statefulSet: + image: + repository: my-repo + tag: "custom-tag" + asserts: + - equal: + path: spec.template.spec.containers[0].image + value: ghcr.io/my-repo:custom-tag + + - it: custom init container + set: + controlPlane: + distro: + k3s: + enabled: true + image: + registry: "ghcr.io" + repository: "test" + tag: "123" + asserts: + - equal: + path: spec.template.spec.initContainers[0].image + value: ghcr.io/test:123 + + - it: disables serviceLinks for sts etcd pod + set: + controlPlane: + statefulSet: + enableServiceLinks: false + asserts: + - equal: + path: spec.template.spec.enableServiceLinks + value: false + + - it: custom init container + set: + controlPlane: + distro: + k8s: + enabled: true + image: + registry: "" + repository: "k8s-api" + tag: "456" + asserts: + - equal: + path: spec.template.spec.initContainers[0].image + value: k8s-api:456 + + - it: custom init container + set: + controlPlane: + distro: + k8s: + enabled: true + image: + repository: "k8s-controller" + tag: "123" + advanced: + defaultImageRegistry: "bbb.com" + asserts: + - equal: + path: spec.template.spec.initContainers[0].image + value: bbb.com/k8s-controller:123 + + - it: name & defaults + release: + name: my-release + namespace: my-namespace + capabilities: + majorVersion: 1 + minorVersion: 29 + asserts: + - hasDocuments: + count: 1 + - equal: + path: kind + value: StatefulSet + - lengthEqual: + path: spec.template.spec.containers + count: 1 + - equal: + path: spec.template.spec.containers[0].image + value: ghcr.io/loft-sh/vcluster-pro:0.0.1 + - contains: + path: spec.template.spec.containers[0].env + content: + name: VCLUSTER_NAME + value: my-release + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: data + mountPath: /data + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: binaries + mountPath: /binaries + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: certs + mountPath: /pki + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: helm-cache + mountPath: /.cache/helm + - equal: + path: metadata.name + value: my-release + - equal: + path: metadata.namespace + value: my-namespace + - equal: + path: spec.podManagementPolicy + value: Parallel + - equal: + path: spec.persistentVolumeClaimRetentionPolicy.whenDeleted + value: Retain + - equal: + path: spec.replicas + value: 1 + - equal: + path: spec.template.metadata.labels.app + value: vcluster + - equal: + path: spec.template.spec.terminationGracePeriodSeconds + value: 10 + - equal: + path: spec.volumeClaimTemplates[0].spec.accessModes[0] + value: ReadWriteOnce + - equal: + path: spec.volumeClaimTemplates[0].spec.resources.requests.storage + value: 5Gi + + - it: fail when both backing stores are enabled + set: + controlPlane: + backingStore: + etcd: + embedded: + enabled: true + deploy: + enabled: true + asserts: + - failedTemplate: + errorMessage: "you can only enable one backingStore at the same time" + + - it: not persistent when external etcd is enabled + set: + controlPlane: + backingStore: + etcd: + deploy: + enabled: true + asserts: + - equal: + path: kind + value: Deployment + - notExists: + path: spec.volumeClaimTemplates + + - it: not persistent when k8s and external database + set: + controlPlane: + distro: + k8s: + enabled: true + backingStore: + database: + external: + enabled: true + asserts: + - equal: + path: kind + value: Deployment + - notExists: + path: spec.volumeClaimTemplates + + - it: persistent when embedded database + set: + controlPlane: + distro: + k8s: + enabled: true + backingStore: + database: + embedded: + enabled: true + asserts: + - equal: + path: kind + value: StatefulSet + - lengthEqual: + path: spec.volumeClaimTemplates + count: 1 + + - it: persistent when k8s and embedded etcd + set: + controlPlane: + backingStore: + etcd: + embedded: + enabled: true + distro: + k8s: + enabled: true + asserts: + - equal: + path: kind + value: StatefulSet + - lengthEqual: + path: spec.volumeClaimTemplates + count: 1 + + - it: persistent when embedded database + asserts: + - equal: + path: kind + value: StatefulSet + - lengthEqual: + path: spec.volumeClaimTemplates + count: 1 + + - it: plugin 1 + set: + plugins: + test: + image: test + plugin: + test123: + version: v2 + image: test + asserts: + - lengthEqual: + path: spec.template.spec.volumes + count: 6 + - lengthEqual: + path: spec.template.spec.initContainers + count: 3 + + - it: plugin volumes 2 + set: + controlPlane: + distro: + k8s: + enabled: true + plugin: + test: + version: v2 + image: test + asserts: + - equal: + path: kind + value: StatefulSet + - lengthEqual: + path: spec.template.spec.volumes + count: 6 + - lengthEqual: + path: spec.template.spec.initContainers + count: 2 + + - it: plugin volumes 3 + set: + plugin: + test: + image: test + asserts: + - lengthEqual: + path: spec.template.spec.volumes + count: 5 + - lengthEqual: + path: spec.template.spec.initContainers + count: 1 + + - it: add volumes + set: + controlPlane: + distro: + k3s: + enabled: true + statefulSet: + persistence: + addVolumes: + - name: myVolume + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: myVolume + - lengthEqual: + path: spec.template.spec.volumes + count: 7 + + - it: add templated volumes + set: + controlPlane: + distro: + k3s: + enabled: true + statefulSet: + persistence: + addVolumes: + - name: '{{ .Release.Name }}-myVolume' + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: RELEASE-NAME-myVolume + - lengthEqual: + path: spec.template.spec.volumes + count: 7 + + - it: enable k8s + set: + controlPlane: + distro: + k8s: + enabled: true + asserts: + - equal: + path: kind + value: StatefulSet + - lengthEqual: + path: spec.volumeClaimTemplates + count: 1 + + - it: enable k8s with deploy etcd + set: + controlPlane: + distro: + k8s: + enabled: true + backingStore: + etcd: + deploy: + enabled: true + asserts: + - equal: + path: kind + value: Deployment + - notExists: + path: spec.volumeClaimTemplates + - contains: + path: spec.template.spec.volumes + content: + name: data + emptyDir: {} + + - it: enable k8s + release: + name: my-release + namespace: my-namespace + set: + controlPlane: + distro: + k8s: + enabled: true + statefulSet: + persistence: + volumeClaim: + enabled: false + volumeClaimTemplates: + - metadata: + name: data + spec: + resources: + requests: + storage: 5Gi + asserts: + - equal: + path: kind + value: StatefulSet + - equal: + path: spec.serviceName + value: my-release-headless + - contains: + path: spec.volumeClaimTemplates + content: + metadata: + name: data + spec: + resources: + requests: + storage: 5Gi + + - it: enable k8s + set: + controlPlane: + distro: + k8s: + enabled: true + release: + name: my-release + namespace: my-namespace + asserts: + - equal: + path: kind + value: StatefulSet + - equal: + path: spec.serviceName + value: my-release-headless + - lengthEqual: + path: spec.volumeClaimTemplates + count: 1 + + - it: enable k8s with deploy etcd + set: + controlPlane: + distro: + k8s: + enabled: true + backingStore: + etcd: + deploy: + enabled: true + asserts: + - equal: + path: kind + value: Deployment + - notExists: + path: spec.volumeClaimTemplates + - contains: + path: spec.template.spec.volumes + content: + name: data + emptyDir: {} + + - it: append distro env + set: + controlPlane: + distro: + k3s: + enabled: true + env: + - name: KEY + value: VALUE + asserts: + - equal: + path: kind + value: StatefulSet + - contains: + path: spec.template.spec.containers[0].env + content: + name: KEY + value: VALUE + + - it: should correctly set labels on the statefulset + set: + controlPlane: + statefulSet: + labels: + my-label: my-value + + asserts: + - equal: + path: kind + value: StatefulSet + - equal: + path: metadata.labels["my-label"] + value: "my-value" + + - it: binariesVolume - should set to emptyDir by default + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: binaries + emptyDir: {} + + - it: binariesVolume - should set the specified volume type correctly + set: + controlPlane: + statefulSet: + persistence: + binariesVolume: + - name: binaries + persistentVolumeClaim: + claimName: my-pvc + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: binaries + persistentVolumeClaim: + claimName: my-pvc + + - it: dataVolume - should set the specified data volume type correctly + set: + controlPlane: + statefulSet: + persistence: + dataVolume: + - name: data + persistentVolumeClaim: + claimName: my-custom-pvc + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: data + persistentVolumeClaim: + claimName: my-custom-pvc + + - it: k8s version not set, default tag images used for apiServer and controllerManager + set: + controlPlane: + distro: + k8s: + enabled: true + asserts: + - equal: + path: spec.template.spec.initContainers[0].image + value: ghcr.io/loft-sh/kubernetes:v1.33.4 + + - it: k8s override image tag + set: + controlPlane: + distro: + k8s: + enabled: true + image: + tag: v99912 + asserts: + - equal: + path: spec.template.spec.initContainers[0].image + value: ghcr.io/loft-sh/kubernetes:v99912 + + - it: k8s version sets image tag for apiServer and controllerManager + set: + controlPlane: + distro: + k8s: + enabled: true + version: v1.35.999 + asserts: + - equal: + path: spec.template.spec.initContainers[0].image + value: ghcr.io/loft-sh/kubernetes:v1.35.999 + + - it: k8s version set and not overridden by image tag + set: + controlPlane: + distro: + k8s: + enabled: true + version: v1.30.999 + image: + tag: v99912 + + asserts: + - equal: + path: spec.template.spec.initContainers[0].image + value: ghcr.io/loft-sh/kubernetes:v1.30.999 + + - it: k8s not version set but image tags for apiServer and controllerManager set + set: + controlPlane: + distro: + k8s: + enabled: true + image: + tag: v99914 + + asserts: + - equal: + path: spec.template.spec.initContainers[0].image + value: ghcr.io/loft-sh/kubernetes:v99914 + + - it: k8s version not set, default tag images used for apiServer and controllerManager (virtual scheduler enabled) + chart: + version: "test-" + set: + controlPlane: + distro: + k8s: + enabled: true + scheduler: + enabled: true + asserts: + - equal: + path: spec.template.spec.initContainers[0].image + value: ghcr.io/loft-sh/kubernetes:v1.33.4 + + - it: k8s version not set, default tag images used for apiServer and controllerManager (virtual scheduler enabled, deprecated) + chart: + version: "test-" + set: + controlPlane: + distro: + k8s: + enabled: true + advanced: + virtualScheduler: + enabled: true + asserts: + - equal: + path: spec.template.spec.initContainers[0].image + value: ghcr.io/loft-sh/kubernetes:v1.33.4 + + - it: k8s version sets image tag for apiServer and controllerManager (virtual scheduler enabled) + set: + controlPlane: + distro: + k8s: + enabled: true + version: v1.35.999 + scheduler: + enabled: true + asserts: + - equal: + path: spec.template.spec.initContainers[0].image + value: ghcr.io/loft-sh/kubernetes:v1.35.999 + + - it: k8s version sets image tag for apiServer and controllerManager (virtual scheduler enabled, deprecated) + set: + controlPlane: + distro: + k8s: + enabled: true + version: v1.35.999 + advanced: + virtualScheduler: + enabled: true + asserts: + - equal: + path: spec.template.spec.initContainers[0].image + value: ghcr.io/loft-sh/kubernetes:v1.35.999 + + - it: k8s version set but not overridden by image tag for apiServer and controllerManager (virtual scheduler enabled) + set: + controlPlane: + distro: + k8s: + enabled: true + version: v1.30.999 + image: + tag: v99912 + scheduler: + enabled: true + asserts: + - equal: + path: spec.template.spec.initContainers[0].image + value: ghcr.io/loft-sh/kubernetes:v1.30.999 + + - it: k8s version set but not overridden by image tag for apiServer and controllerManager (virtual scheduler enabled, deprecated) + set: + controlPlane: + distro: + k8s: + enabled: true + version: v1.30.999 + image: + tag: v99912 + advanced: + virtualScheduler: + enabled: true + + asserts: + - equal: + path: spec.template.spec.initContainers[0].image + value: ghcr.io/loft-sh/kubernetes:v1.30.999 + + - it: custom dnsPolicy + set: + controlPlane: + statefulSet: + dnsPolicy: "ClusterFirst" + asserts: + - equal: + path: spec.template.spec.dnsPolicy + value: "ClusterFirst" + + - it: custom dnsConfig + set: + controlPlane: + statefulSet: + dnsConfig: + nameservers: + - 192.0.2.1 + searches: + - ns1.svc.cluster-domain.example + options: + - name: ndots + value: "2" + asserts: + - equal: + path: spec.template.spec.dnsConfig.nameservers[0] + value: "192.0.2.1" + - equal: + path: spec.template.spec.dnsConfig.searches[0] + value: "ns1.svc.cluster-domain.example" + - equal: + path: spec.template.spec.dnsConfig.options[0].name + value: "ndots" + - equal: + path: spec.template.spec.dnsConfig.options[0].value + value: "2" + + - it: must use StatefulSet for embedded etcd + set: + controlPlane: + backingStore: + etcd: + embedded: + enabled: true + + asserts: + - equal: + path: kind + value: StatefulSet + + - it: must use StatefulSet for embedded etcd without persistence + set: + controlPlane: + backingStore: + etcd: + embedded: + enabled: true + statefulSet: + persistence: + volumeClaim: + enabled: false + binariesVolume: + - name: binaries + emptyDir: + medium: Memory + + asserts: + - equal: + path: kind + value: StatefulSet + + - it: sync custom resources + set: + sync: + toHost: + customResources: + test.cert-manager.io: + enabled: true + patches: + - path: spec.dnsNames[*] + expression: "value.startsWith('www.') ? value.slice(4) : value" + reverseExpression: '"www."+value' + asserts: + - equal: + path: kind + value: StatefulSet + + - it: fails when you set both exportKubeConfig.secret and exportKubeConfig.additionalSecrets + set: + exportKubeConfig: + secret: + name: my-secret + additionalSecrets: + - name: another-secret + asserts: + - failedTemplate: + errorMessage: "exportKubeConfig.secret and exportKubeConfig.additionalSecrets cannot be set at the same time" + + - it: fails when additional secret does not have at least name or namespace + set: + exportKubeConfig: + additionalSecrets: + - name: my-secret + context: my-context + - server: my-server + asserts: + - failedTemplate: + errorMessage: "additional secret must have name and/or namespace set, found: {\"server\":\"my-server\"}" + + - it: must use Deployment for external etcd + set: + controlPlane: + backingStore: + etcd: + external: + enabled: true + asserts: + - equal: + path: kind + value: Deployment + + - it: private nodes k8s full image + set: + controlPlane: + distro: + k8s: + image: + tag: v1.35.999 + privateNodes: + enabled: true + asserts: + - equal: + path: spec.template.spec.initContainers[0].image + value: ghcr.io/loft-sh/kubernetes:v1.35.999-full + + - it: private nodes k8s full image version + set: + controlPlane: + distro: + k8s: + version: v1.35.999 + privateNodes: + enabled: true + asserts: + - equal: + path: spec.template.spec.initContainers[0].image + value: ghcr.io/loft-sh/kubernetes:v1.35.999-full + + - it: sets custom probe configuration + set: + controlPlane: + statefulSet: + probes: + livenessProbe: + enabled: true + failureThreshold: 70 + initialDelaySeconds: 70 + timeoutSeconds: 10 + periodSeconds: 9 + readinessProbe: + enabled: true + failureThreshold: 70 + timeoutSeconds: 6 + periodSeconds: 8 + startupProbe: + enabled: true + failureThreshold: 350 + timeoutSeconds: 7 + periodSeconds: 8 + asserts: + - equal: + path: spec.template.spec.containers[0].livenessProbe.failureThreshold + value: 70 + - equal: + path: spec.template.spec.containers[0].livenessProbe.initialDelaySeconds + value: 70 + - equal: + path: spec.template.spec.containers[0].livenessProbe.timeoutSeconds + value: 10 + - equal: + path: spec.template.spec.containers[0].livenessProbe.periodSeconds + value: 9 + - equal: + path: spec.template.spec.containers[0].readinessProbe.failureThreshold + value: 70 + - equal: + path: spec.template.spec.containers[0].readinessProbe.timeoutSeconds + value: 6 + - equal: + path: spec.template.spec.containers[0].readinessProbe.periodSeconds + value: 8 + - equal: + path: spec.template.spec.containers[0].startupProbe.failureThreshold + value: 350 + - equal: + path: spec.template.spec.containers[0].startupProbe.timeoutSeconds + value: 7 + - equal: + path: spec.template.spec.containers[0].startupProbe.periodSeconds + value: 8 + + + - it: uses default probe values when none are overridden + set: + controlPlane: + statefulSet: + probes: + livenessProbe: + enabled: true + readinessProbe: + enabled: true + startupProbe: + enabled: true + asserts: + - equal: + path: spec.template.spec.containers[0].livenessProbe.initialDelaySeconds + value: 60 + - equal: + path: spec.template.spec.containers[0].livenessProbe.periodSeconds + value: 2 + - equal: + path: spec.template.spec.containers[0].livenessProbe.timeoutSeconds + value: 3 + - equal: + path: spec.template.spec.containers[0].livenessProbe.failureThreshold + value: 60 + - equal: + path: spec.template.spec.containers[0].readinessProbe.periodSeconds + value: 2 + - equal: + path: spec.template.spec.containers[0].readinessProbe.timeoutSeconds + value: 3 + - equal: + path: spec.template.spec.containers[0].readinessProbe.failureThreshold + value: 60 + - equal: + path: spec.template.spec.containers[0].startupProbe.periodSeconds + value: 6 + - equal: + path: spec.template.spec.containers[0].startupProbe.timeoutSeconds + value: 3 + - equal: + path: spec.template.spec.containers[0].startupProbe.failureThreshold + value: 300 + + - it: should set logging format to json + set: + logging: + encoding: json + asserts: + - equal: + path: spec.template.spec.containers[0].env[?(@.name=="LOFT_LOG_ENCODING")].value + value: json + + - it: should set default logging format to console + asserts: + - equal: + path: spec.template.spec.containers[0].env[?(@.name=="LOFT_LOG_ENCODING")].value + value: console + diff --git a/charts/cf-vcluster/charts/vcluster/tests/workload-serviceaccount_test.yaml b/charts/cf-vcluster/charts/vcluster/tests/workload-serviceaccount_test.yaml new file mode 100644 index 0000000..8b2ced4 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/tests/workload-serviceaccount_test.yaml @@ -0,0 +1,64 @@ +suite: Workload ServiceAccount +templates: + - workload-serviceaccount.yaml + +tests: + - it: should not create service account + set: + controlPlane: + advanced: + workloadServiceAccount: + enabled: false + asserts: + - hasDocuments: + count: 0 + + - it: should create service account + release: + name: my-release + namespace: my-namespace + asserts: + - hasDocuments: + count: 1 + - equal: + path: metadata.name + value: vc-workload-my-release + - equal: + path: metadata.namespace + value: my-namespace + + - it: should create service account with name + set: + controlPlane: + advanced: + workloadServiceAccount: + name: test + asserts: + - hasDocuments: + count: 1 + - equal: + path: metadata.name + value: test + + - it: should create image pull secrets + set: + controlPlane: + advanced: + serviceAccount: + imagePullSecrets: + - name: test1 + workloadServiceAccount: + imagePullSecrets: + - name: test2 + asserts: + - hasDocuments: + count: 1 + - lengthEqual: + path: imagePullSecrets + count: 2 + - equal: + path: imagePullSecrets[0].name + value: test1 + - equal: + path: imagePullSecrets[1].name + value: test2 diff --git a/charts/cf-vcluster/charts/vcluster/values.schema.json b/charts/cf-vcluster/charts/vcluster/values.schema.json new file mode 100644 index 0000000..cd43ba0 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/values.schema.json @@ -0,0 +1,4861 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://vcluster.com/schemas/config", + "$defs": { + "APIService": { + "properties": { + "service": { + "$ref": "#/$defs/APIServiceService", + "description": "Service is a reference to the service for the API server." + } + }, + "additionalProperties": false, + "type": "object", + "description": "APIService holds configuration related to the api server" + }, + "APIServiceService": { + "properties": { + "name": { + "type": "string", + "description": "Name is the name of the host service of the apiservice." + }, + "namespace": { + "type": "string", + "description": "Namespace is the name of the host service of the apiservice." + }, + "port": { + "type": "integer", + "description": "Port is the target port on the host service to connect to." + } + }, + "additionalProperties": false, + "type": "object", + "description": "APIServiceService holds the service name and namespace of the host apiservice." + }, + "AutoSleepExclusion": { + "properties": { + "selector": { + "$ref": "#/$defs/LabelSelector" + } + }, + "additionalProperties": false, + "type": "object", + "description": "AutoSleepExclusion holds conifiguration for excluding workloads from sleeping by label(s)" + }, + "AutoUpgrade": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if auto upgrade should be enabled." + }, + "image": { + "type": "string", + "description": "Image is the image for the auto upgrade pod started by vCluster. If empty defaults to the controlPlane.statefulSet.image." + }, + "imagePullPolicy": { + "type": "string", + "description": "ImagePullPolicy is the policy how to pull the image." + }, + "nodeSelector": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "NodeSelector is the node selector for the auto upgrade. If empty will select all worker nodes." + }, + "binariesPath": { + "type": "string", + "description": "BinariesPath is the base path for the kubeadm binaries. Defaults to /usr/local/bin" + }, + "cniBinariesPath": { + "type": "string", + "description": "CNIBinariesPath is the base path for the CNI binaries. Defaults to /opt/cni/bin" + }, + "concurrency": { + "type": "integer", + "description": "Concurrency is the number of nodes that can be upgraded at the same time." + } + }, + "additionalProperties": false, + "type": "object" + }, + "AutoWakeup": { + "properties": { + "schedule": { + "type": "string" + } + }, + "additionalProperties": false, + "type": "object", + "description": "AutoWakeup holds the cron schedule to wake workloads automatically" + }, + "BackingStore": { + "properties": { + "etcd": { + "$ref": "#/$defs/Etcd", + "description": "Etcd defines that etcd should be used as the backend for the virtual cluster" + }, + "database": { + "$ref": "#/$defs/Database", + "description": "Database defines that a database backend should be used as the backend for the virtual cluster. This uses a project called kine under the hood which is a shim for bridging Kubernetes and relational databases." + } + }, + "additionalProperties": false, + "type": "object" + }, + "CNI": { + "properties": { + "flannel": { + "$ref": "#/$defs/CNIFlannel", + "description": "Flannel holds dedicated Flannel configuration." + } + }, + "additionalProperties": false, + "type": "object" + }, + "CNIFlannel": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if Flannel should be enabled." + }, + "image": { + "type": "string", + "description": "Image is the image for Flannel main container." + }, + "initImage": { + "type": "string", + "description": "InitImage is the image for Flannel init container." + }, + "imagePullPolicy": { + "type": "string", + "description": "ImagePullPolicy is the policy how to pull the image." + } + }, + "additionalProperties": false, + "type": "object" + }, + "CentralAdmission": { + "properties": { + "validatingWebhooks": { + "items": { + "$ref": "#/$defs/ValidatingWebhookConfiguration" + }, + "type": "array", + "description": "ValidatingWebhooks are validating webhooks that should be enforced in the virtual cluster" + }, + "mutatingWebhooks": { + "items": { + "$ref": "#/$defs/MutatingWebhookConfiguration" + }, + "type": "array", + "description": "MutatingWebhooks are mutating webhooks that should be enforced in the virtual cluster" + } + }, + "additionalProperties": false, + "type": "object" + }, + "CertManager": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if this option should be enabled." + }, + "sync": { + "$ref": "#/$defs/CertManagerSync", + "description": "Sync contains advanced configuration for syncing cert-manager resources." + } + }, + "additionalProperties": false, + "type": "object", + "description": "CertManager reuses a host cert-manager and makes its CRDs from it available inside the vCluster" + }, + "CertManagerSync": { + "properties": { + "toHost": { + "$ref": "#/$defs/CertManagerSyncToHost" + }, + "fromHost": { + "$ref": "#/$defs/CertManagerSyncFromHost" + } + }, + "additionalProperties": false, + "type": "object" + }, + "CertManagerSyncFromHost": { + "properties": { + "clusterIssuers": { + "$ref": "#/$defs/ClusterIssuersSyncConfig", + "description": "ClusterIssuers defines if (and which) cluster issuers should get synced from the host cluster to the virtual cluster." + } + }, + "additionalProperties": false, + "type": "object" + }, + "CertManagerSyncToHost": { + "properties": { + "certificates": { + "$ref": "#/$defs/EnableSwitch", + "description": "Certificates defines if certificates should get synced from the virtual cluster to the host cluster." + }, + "issuers": { + "$ref": "#/$defs/EnableSwitch", + "description": "Issuers defines if issuers should get synced from the virtual cluster to the host cluster." + } + }, + "additionalProperties": false, + "type": "object" + }, + "CloudControllerManager": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if the embedded cloud controller manager should be enabled. This defaults to true, but can be disabled if you want to use\nan external cloud controller manager such as AWS or GCP. The cloud controller manager is responsible for setting the node's ip addresses as well\nas the provider id for the node and other node metadata." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ClusterIssuersSyncConfig": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if this option should be enabled." + }, + "selector": { + "$ref": "#/$defs/LabelSelector", + "description": "Selector defines what cluster issuers should be imported." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ClusterStoresSyncConfig": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if this option should be enabled." + }, + "selector": { + "$ref": "#/$defs/LabelSelector", + "description": "Selector defines what cluster stores should be synced" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ContainerdJoin": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if containerd should be installed and configured by vCluster." + }, + "registry": { + "$ref": "#/$defs/ContainerdRegistry", + "description": "Registry holds configuration for how containerd should be configured to use a registries." + }, + "pauseImage": { + "type": "string", + "description": "PauseImage is the image for the pause container." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ContainerdMirror": { + "properties": { + "server": { + "type": "string", + "description": "Server is the fallback server to use for the containerd registry mirror. E.g. https://registry-1.docker.io. See https://github.com/containerd/containerd/blob/main/docs/hosts.md for more details." + }, + "caCert": { + "items": { + "type": "string" + }, + "type": "array", + "description": "CACert are paths to CA certificates to use for the containerd registry mirror." + }, + "skipVerify": { + "type": "boolean", + "description": "SkipVerify is a boolean to skip the certificate verification for the containerd registry mirror and allows http connections." + }, + "capabilities": { + "items": { + "type": "string" + }, + "type": "array", + "description": "Capabilities is a list of capabilities to enable for the containerd registry mirror. If empty, will use pull and resolve capabilities." + }, + "overridePath": { + "type": "boolean", + "description": "OverridePath is a boolean to override the path for the containerd registry mirror." + }, + "hosts": { + "items": { + "$ref": "#/$defs/ContainerdMirrorHost" + }, + "type": "array", + "description": "Hosts holds configuration for the containerd registry mirror hosts. See https://github.com/containerd/containerd/blob/main/docs/hosts.md for more details." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ContainerdMirrorHost": { + "properties": { + "server": { + "type": "string", + "description": "Server is the server to use for the containerd registry mirror host. E.g. http://192.168.31.250:5000." + }, + "caCert": { + "items": { + "type": "string" + }, + "type": "array", + "description": "CACert are paths to CA certificates to use for the containerd registry mirror host." + }, + "skipVerify": { + "type": "boolean", + "description": "SkipVerify is a boolean to skip the certificate verification for the containerd registry mirror and allows http connections." + }, + "capabilities": { + "items": { + "type": "string" + }, + "type": "array", + "description": "Capabilities is a list of capabilities to enable for the containerd registry mirror. If empty, will use pull and resolve capabilities." + }, + "overridePath": { + "type": "boolean", + "description": "OverridePath is a boolean to override the path for the containerd registry mirror." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ContainerdRegistry": { + "properties": { + "configPath": { + "type": "string", + "description": "ConfigPath is the path to the containerd registry config." + }, + "mirrors": { + "additionalProperties": { + "$ref": "#/$defs/ContainerdMirror" + }, + "type": "object", + "description": "Mirrors holds configuration for the containerd registry mirrors. E.g. myregistry.io:5000 or docker.io. See https://github.com/containerd/containerd/blob/main/docs/hosts.md for more details." + }, + "auth": { + "additionalProperties": { + "$ref": "#/$defs/ContainerdRegistryAuth" + }, + "type": "object", + "description": "Auth holds configuration for the containerd registry auth. See https://github.com/containerd/containerd/blob/main/docs/cri/registry.md#configure-registry-credentials for more details." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ContainerdRegistryAuth": { + "properties": { + "username": { + "type": "string", + "description": "Username is the username for the containerd registry." + }, + "password": { + "type": "string", + "description": "Password is the password for the containerd registry." + }, + "identityToken": { + "type": "string", + "description": "IdentityToken is the token for the containerd registry." + }, + "auth": { + "type": "string", + "description": "Auth is the auth config for the containerd registry." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ControlPlane": { + "properties": { + "endpoint": { + "type": "string", + "description": "Endpoint is the endpoint of the virtual cluster. This is used to connect to the virtual cluster." + }, + "distro": { + "$ref": "#/$defs/Distro", + "description": "Distro holds virtual cluster related distro options. A distro cannot be changed after vCluster is deployed." + }, + "standalone": { + "$ref": "#/$defs/Standalone", + "description": "Standalone holds configuration for standalone mode. Standalone mode is set automatically when no container is detected and\nalso implies privateNodes.enabled." + }, + "backingStore": { + "$ref": "#/$defs/BackingStore", + "description": "BackingStore defines which backing store to use for virtual cluster. If not defined will use embedded database as a default backing store." + }, + "coredns": { + "$ref": "#/$defs/CoreDNS", + "description": "CoreDNS defines everything related to the coredns that is deployed and used within the vCluster." + }, + "proxy": { + "$ref": "#/$defs/ControlPlaneProxy", + "description": "Proxy defines options for the virtual cluster control plane proxy that is used to do authentication and intercept requests." + }, + "hostPathMapper": { + "$ref": "#/$defs/HostPathMapper", + "description": "HostPathMapper defines if vCluster should rewrite host paths.", + "pro": true + }, + "ingress": { + "$ref": "#/$defs/ControlPlaneIngress", + "description": "Ingress defines options for vCluster ingress deployed by Helm." + }, + "service": { + "$ref": "#/$defs/ControlPlaneService", + "description": "Service defines options for vCluster service deployed by Helm." + }, + "statefulSet": { + "$ref": "#/$defs/ControlPlaneStatefulSet", + "description": "StatefulSet defines options for vCluster statefulSet deployed by Helm." + }, + "serviceMonitor": { + "$ref": "#/$defs/ServiceMonitor", + "description": "ServiceMonitor can be used to automatically create a service monitor for vCluster deployment itself." + }, + "advanced": { + "$ref": "#/$defs/ControlPlaneAdvanced", + "description": "Advanced holds additional configuration for the vCluster control plane." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ControlPlaneAdvanced": { + "properties": { + "defaultImageRegistry": { + "type": "string", + "description": "DefaultImageRegistry will be used as a prefix for all internal images deployed by vCluster or Helm. This makes it easy to\nupload all required vCluster images to a single private repository and set this value. Workload images are not affected by this." + }, + "virtualScheduler": { + "$ref": "#/$defs/EnableSwitch", + "description": "VirtualScheduler defines if a scheduler should be used within the virtual cluster or the scheduling decision for workloads will be made by the host cluster.\nDeprecated: Use ControlPlane.Distro.K8S.Scheduler instead." + }, + "serviceAccount": { + "$ref": "#/$defs/ControlPlaneServiceAccount", + "description": "ServiceAccount specifies options for the vCluster control plane service account." + }, + "workloadServiceAccount": { + "$ref": "#/$defs/ControlPlaneWorkloadServiceAccount", + "description": "WorkloadServiceAccount specifies options for the service account that will be used for the workloads that run within the virtual cluster." + }, + "headlessService": { + "$ref": "#/$defs/ControlPlaneHeadlessService", + "description": "HeadlessService specifies options for the headless service used for the vCluster StatefulSet." + }, + "konnectivity": { + "$ref": "#/$defs/Konnectivity", + "description": "Konnectivity holds dedicated konnectivity configuration. This is only available when privateNodes.enabled is true." + }, + "registry": { + "$ref": "#/$defs/Registry", + "description": "Registry allows enabling an embedded docker image registry in vCluster. This is useful for air-gapped environments or when you don't have a public registry available to distribute images." + }, + "cloudControllerManager": { + "$ref": "#/$defs/CloudControllerManager", + "description": "CloudControllerManager holds configuration for the embedded cloud controller manager. This is only available when private nodes are enabled.\nThe cloud controller manager is responsible for setting the node's ip addresses as well as the provider id for the node and other node metadata." + }, + "globalMetadata": { + "$ref": "#/$defs/ControlPlaneGlobalMetadata", + "description": "GlobalMetadata is metadata that will be added to all resources deployed by Helm." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ControlPlaneGlobalMetadata": { + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Annotations are extra annotations for this resource." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ControlPlaneHeadlessService": { + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Annotations are extra annotations for this resource." + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Labels are extra labels for this resource." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ControlPlaneHighAvailability": { + "properties": { + "replicas": { + "type": "integer", + "description": "Replicas is the amount of replicas to use for the statefulSet." + }, + "leaseDuration": { + "type": "integer", + "description": "LeaseDuration is the time to lease for the leader." + }, + "renewDeadline": { + "type": "integer", + "description": "RenewDeadline is the deadline to renew a lease for the leader." + }, + "retryPeriod": { + "type": "integer", + "description": "RetryPeriod is the time until a replica will retry to get a lease." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ControlPlaneIngress": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if the control plane ingress should be enabled" + }, + "host": { + "type": "string", + "description": "Host is the host where vCluster will be reachable" + }, + "pathType": { + "type": "string", + "description": "PathType is the path type of the ingress" + }, + "spec": { + "type": "object", + "description": "Spec allows you to configure extra ingress options." + }, + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Annotations are extra annotations for this resource." + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Labels are extra labels for this resource." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ControlPlanePersistence": { + "properties": { + "volumeClaim": { + "$ref": "#/$defs/VolumeClaim", + "description": "VolumeClaim can be used to configure the persistent volume claim." + }, + "volumeClaimTemplates": { + "items": { + "type": "object" + }, + "type": "array", + "description": "VolumeClaimTemplates defines the volumeClaimTemplates for the statefulSet" + }, + "dataVolume": { + "items": { + "type": "object" + }, + "type": "array", + "description": "Allows you to override the dataVolume. Only works correctly if volumeClaim.enabled=false." + }, + "binariesVolume": { + "items": { + "type": "object" + }, + "type": "array", + "description": "BinariesVolume defines a binaries volume that is used to retrieve\ndistro specific executables to be run by the syncer controller.\nThis volume doesn't need to be persistent." + }, + "addVolumes": { + "items": { + "type": "object" + }, + "type": "array", + "description": "AddVolumes defines extra volumes for the pod" + }, + "addVolumeMounts": { + "items": { + "$ref": "#/$defs/VolumeMount" + }, + "type": "array", + "description": "AddVolumeMounts defines extra volume mounts for the container" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ControlPlaneProbes": { + "properties": { + "livenessProbe": { + "$ref": "#/$defs/LivenessProbe", + "description": "LivenessProbe specifies if the liveness probe for the container should be enabled" + }, + "readinessProbe": { + "$ref": "#/$defs/ReadinessProbe", + "description": "ReadinessProbe specifies if the readiness probe for the container should be enabled" + }, + "startupProbe": { + "$ref": "#/$defs/StartupProbe", + "description": "StartupProbe specifies if the startup probe for the container should be enabled" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ControlPlaneProxy": { + "properties": { + "bindAddress": { + "type": "string", + "description": "BindAddress under which vCluster will expose the proxy." + }, + "port": { + "type": "integer", + "description": "Port under which vCluster will expose the proxy. Changing port is currently not supported." + }, + "extraSANs": { + "items": { + "type": "string" + }, + "type": "array", + "description": "ExtraSANs are extra hostnames to sign the vCluster proxy certificate for." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ControlPlaneScheduling": { + "properties": { + "nodeSelector": { + "type": "object", + "description": "NodeSelector is the node selector to apply to the pod." + }, + "affinity": { + "type": "object", + "description": "Affinity is the affinity to apply to the pod." + }, + "tolerations": { + "items": { + "type": "object" + }, + "type": "array", + "description": "Tolerations are the tolerations to apply to the pod." + }, + "priorityClassName": { + "type": "string", + "description": "PriorityClassName is the priority class name for the the pod." + }, + "podManagementPolicy": { + "type": "string", + "description": "PodManagementPolicy is the statefulSet pod management policy." + }, + "topologySpreadConstraints": { + "items": true, + "type": "array", + "description": "TopologySpreadConstraints are the topology spread constraints for the pod." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ControlPlaneSecurity": { + "properties": { + "podSecurityContext": { + "type": "object", + "description": "PodSecurityContext specifies security context options on the pod level." + }, + "containerSecurityContext": { + "type": "object", + "description": "ContainerSecurityContext specifies security context options on the container level." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ControlPlaneService": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if the control plane service should be enabled" + }, + "spec": { + "type": "object", + "description": "Spec allows you to configure extra service options." + }, + "kubeletNodePort": { + "type": "integer", + "description": "KubeletNodePort is the node port where the fake kubelet is exposed. Defaults to 0." + }, + "httpsNodePort": { + "type": "integer", + "description": "HTTPSNodePort is the node port where https is exposed. Defaults to 0." + }, + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Annotations are extra annotations for this resource." + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Labels are extra labels for this resource." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ControlPlaneServiceAccount": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled specifies if the service account should get deployed." + }, + "name": { + "type": "string", + "description": "Name specifies what name to use for the service account." + }, + "imagePullSecrets": { + "items": { + "$ref": "#/$defs/ImagePullSecretName" + }, + "type": "array", + "description": "ImagePullSecrets defines extra image pull secrets for the service account." + }, + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Annotations are extra annotations for this resource." + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Labels are extra labels for this resource." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ControlPlaneStatefulSet": { + "properties": { + "highAvailability": { + "$ref": "#/$defs/ControlPlaneHighAvailability", + "description": "HighAvailability holds options related to high availability." + }, + "resources": { + "$ref": "#/$defs/Resources", + "description": "Resources are the resource requests and limits for the statefulSet container." + }, + "scheduling": { + "$ref": "#/$defs/ControlPlaneScheduling", + "description": "Scheduling holds options related to scheduling." + }, + "security": { + "$ref": "#/$defs/ControlPlaneSecurity", + "description": "Security defines pod or container security context." + }, + "probes": { + "$ref": "#/$defs/ControlPlaneProbes", + "description": "Probes enables or disables the main container probes." + }, + "persistence": { + "$ref": "#/$defs/ControlPlanePersistence", + "description": "Persistence defines options around persistence for the statefulSet." + }, + "enableServiceLinks": { + "type": "boolean", + "description": "EnableServiceLinks for the StatefulSet pod" + }, + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Annotations are extra annotations for this resource." + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Labels are extra labels for this resource." + }, + "pods": { + "$ref": "#/$defs/LabelsAndAnnotations", + "description": "Additional labels or annotations for the statefulSet pods." + }, + "image": { + "$ref": "#/$defs/Image", + "description": "Image is the image for the controlPlane statefulSet container\nIt defaults to the vCluster pro repository that includes the optional pro modules that are turned off by default.\nIf you still want to use the pure OSS build, set the repository to 'loft-sh/vcluster-oss'." + }, + "imagePullPolicy": { + "type": "string", + "description": "ImagePullPolicy is the policy how to pull the image." + }, + "workingDir": { + "type": "string", + "description": "WorkingDir specifies in what folder the main process should get started." + }, + "command": { + "items": { + "type": "string" + }, + "type": "array", + "description": "Command allows you to override the main command." + }, + "args": { + "items": { + "type": "string" + }, + "type": "array", + "description": "Args allows you to override the main arguments." + }, + "env": { + "items": { + "type": "object" + }, + "type": "array", + "description": "Env are additional environment variables for the statefulSet container." + }, + "dnsPolicy": { + "type": "string", + "description": "Set DNS policy for the pod." + }, + "dnsConfig": { + "$ref": "#/$defs/PodDNSConfig", + "description": "Specifies the DNS parameters of a pod." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ControlPlaneWorkloadServiceAccount": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled specifies if the service account for the workloads should get deployed." + }, + "name": { + "type": "string", + "description": "Name specifies what name to use for the service account for the virtual cluster workloads." + }, + "imagePullSecrets": { + "items": { + "$ref": "#/$defs/ImagePullSecretName" + }, + "type": "array", + "description": "ImagePullSecrets defines extra image pull secrets for the workload service account." + }, + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Annotations are extra annotations for this resource." + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Labels are extra labels for this resource." + } + }, + "additionalProperties": false, + "type": "object" + }, + "CoreDNS": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if coredns is enabled" + }, + "embedded": { + "type": "boolean", + "description": "Embedded defines if vCluster will start the embedded coredns service within the control-plane and not as a separate deployment. This is a PRO feature.", + "pro": true + }, + "security": { + "$ref": "#/$defs/ControlPlaneSecurity", + "description": "Security defines pod or container security context." + }, + "service": { + "$ref": "#/$defs/CoreDNSService", + "description": "Service holds extra options for the coredns service deployed within the virtual cluster" + }, + "deployment": { + "$ref": "#/$defs/CoreDNSDeployment", + "description": "Deployment holds extra options for the coredns deployment deployed within the virtual cluster" + }, + "overwriteConfig": { + "type": "string", + "description": "OverwriteConfig can be used to overwrite the coredns config" + }, + "overwriteManifests": { + "type": "string", + "description": "OverwriteManifests can be used to overwrite the coredns manifests used to deploy coredns" + }, + "priorityClassName": { + "type": "string", + "description": "PriorityClassName specifies the priority class name for the CoreDNS pods." + } + }, + "additionalProperties": false, + "type": "object" + }, + "CoreDNSDeployment": { + "properties": { + "image": { + "type": "string", + "description": "Image is the coredns image to use" + }, + "replicas": { + "type": "integer", + "description": "Replicas is the amount of coredns pods to run." + }, + "nodeSelector": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "NodeSelector is the node selector to use for coredns." + }, + "affinity": { + "type": "object", + "description": "Affinity is the affinity to apply to the pod." + }, + "tolerations": { + "items": { + "type": "object" + }, + "type": "array", + "description": "Tolerations are the tolerations to apply to the pod." + }, + "resources": { + "$ref": "#/$defs/Resources", + "description": "Resources are the desired resources for coredns." + }, + "pods": { + "$ref": "#/$defs/LabelsAndAnnotations", + "description": "Pods is additional metadata for the coredns pods." + }, + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Annotations are extra annotations for this resource." + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Labels are extra labels for this resource." + }, + "topologySpreadConstraints": { + "items": true, + "type": "array", + "description": "TopologySpreadConstraints are the topology spread constraints for the CoreDNS pod." + } + }, + "additionalProperties": false, + "type": "object" + }, + "CoreDNSService": { + "properties": { + "spec": { + "type": "object", + "description": "Spec holds extra options for the coredns service" + }, + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Annotations are extra annotations for this resource." + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Labels are extra labels for this resource." + } + }, + "additionalProperties": false, + "type": "object" + }, + "Database": { + "properties": { + "embedded": { + "$ref": "#/$defs/DatabaseKine", + "description": "Embedded defines that an embedded database (sqlite) should be used as the backend for the virtual cluster" + }, + "external": { + "$ref": "#/$defs/ExternalDatabaseKine", + "description": "External defines that an external database should be used as the backend for the virtual cluster" + } + }, + "additionalProperties": false, + "type": "object" + }, + "DatabaseKine": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if the database should be used." + }, + "dataSource": { + "type": "string", + "description": "DataSource is the kine dataSource to use for the database. This depends on the database format.\nThis is optional for the embedded database. Examples:\n* mysql: mysql://username:password@tcp(hostname:3306)/k3s\n* postgres: postgres://username:password@hostname:5432/k3s" + }, + "keyFile": { + "type": "string", + "description": "KeyFile is the key file to use for the database. This is optional." + }, + "certFile": { + "type": "string", + "description": "CertFile is the cert file to use for the database. This is optional." + }, + "caFile": { + "type": "string", + "description": "CaFile is the ca file to use for the database. This is optional." + }, + "extraArgs": { + "items": { + "type": "string" + }, + "type": "array", + "description": "ExtraArgs are additional arguments to pass to Kine." + } + }, + "additionalProperties": false, + "type": "object" + }, + "DenyRule": { + "properties": { + "name": { + "type": "string", + "description": "The name of the check." + }, + "namespaces": { + "items": { + "type": "string" + }, + "type": "array", + "description": "Namespace describe a list of namespaces that will be affected by the check.\nAn empty list means that all namespaces will be affected.\nIn case of ClusterScoped rules, only the Namespace resource is affected." + }, + "rules": { + "items": { + "$ref": "#/$defs/RuleWithVerbs" + }, + "type": "array", + "description": "Rules describes on which verbs and on what resources/subresources the webhook is enforced.\nThe webhook is enforced if it matches any Rule.\nThe version of the request must match the rule version exactly. Equivalent matching is not supported." + }, + "excludedUsers": { + "items": { + "type": "string" + }, + "type": "array", + "description": "ExcludedUsers describe a list of users for which the checks will be skipped.\nImpersonation attempts on these users will still be subjected to the checks." + } + }, + "additionalProperties": false, + "type": "object" + }, + "Deploy": { + "properties": { + "kubeProxy": { + "$ref": "#/$defs/KubeProxy", + "description": "KubeProxy holds dedicated kube proxy configuration." + }, + "metallb": { + "$ref": "#/$defs/Metallb", + "description": "Metallb holds dedicated metallb configuration." + }, + "cni": { + "$ref": "#/$defs/CNI", + "description": "CNI holds dedicated CNI configuration." + }, + "localPathProvisioner": { + "$ref": "#/$defs/LocalPathProvisioner", + "description": "LocalPathProvisioner holds dedicated local path provisioner configuration." + }, + "ingressNginx": { + "$ref": "#/$defs/IngressNginx", + "description": "IngressNginx holds dedicated ingress-nginx configuration." + }, + "metricsServer": { + "$ref": "#/$defs/DeployMetricsServer", + "description": "MetricsServer holds dedicated metrics server configuration." + } + }, + "additionalProperties": false, + "type": "object" + }, + "DeployMetricsServer": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if metrics server should be enabled." + } + }, + "additionalProperties": false, + "type": "object" + }, + "Distro": { + "properties": { + "k8s": { + "$ref": "#/$defs/DistroK8s", + "description": "K8S holds K8s relevant configuration." + }, + "k3s": { + "$ref": "#/$defs/DistroK3s", + "description": "[Deprecated] K3S holds K3s relevant configuration." + } + }, + "additionalProperties": false, + "type": "object" + }, + "DistroContainerEnabled": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled signals this container should be enabled." + }, + "command": { + "items": { + "type": "string" + }, + "type": "array", + "description": "Command is the command to start the distro binary. This will override the existing command." + }, + "extraArgs": { + "items": { + "type": "string" + }, + "type": "array", + "description": "ExtraArgs are additional arguments to pass to the distro binary." + } + }, + "additionalProperties": false, + "type": "object" + }, + "DistroK3s": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled specifies if the K3s distro should be enabled. Only one distro can be enabled at the same time." + }, + "token": { + "type": "string", + "description": "Token is the K3s token to use. If empty, vCluster will choose one." + }, + "image": { + "$ref": "#/$defs/Image", + "description": "Image is the distro image" + }, + "imagePullPolicy": { + "type": "string", + "description": "ImagePullPolicy is the pull policy for the distro image" + }, + "env": { + "items": { + "type": "object" + }, + "type": "array", + "description": "Env are extra environment variables to use for the main container and NOT the init container." + }, + "resources": { + "type": "object", + "description": "Resources for the distro init container" + }, + "securityContext": { + "type": "object", + "description": "Security options can be used for the distro init container" + }, + "command": { + "items": { + "type": "string" + }, + "type": "array", + "description": "Command is the command to start the distro binary. This will override the existing command." + }, + "extraArgs": { + "items": { + "type": "string" + }, + "type": "array", + "description": "ExtraArgs are additional arguments to pass to the distro binary." + } + }, + "additionalProperties": false, + "type": "object" + }, + "DistroK8s": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled specifies if the K8s distro should be enabled. Only one distro can be enabled at the same time." + }, + "version": { + "type": "string", + "description": "[Deprecated] Version field is deprecated.\nUse controlPlane.distro.k8s.image.tag to specify the Kubernetes version instead." + }, + "apiServer": { + "$ref": "#/$defs/DistroContainerEnabled", + "description": "APIServer holds configuration specific to starting the api server." + }, + "controllerManager": { + "$ref": "#/$defs/DistroContainerEnabled", + "description": "ControllerManager holds configuration specific to starting the controller manager." + }, + "scheduler": { + "$ref": "#/$defs/DistroContainerEnabled", + "description": "Scheduler holds configuration specific to starting the scheduler." + }, + "image": { + "$ref": "#/$defs/Image", + "description": "Image is the distro image" + }, + "imagePullPolicy": { + "type": "string", + "description": "ImagePullPolicy is the pull policy for the distro image" + }, + "env": { + "items": { + "type": "object" + }, + "type": "array", + "description": "Env are extra environment variables to use for the main container and NOT the init container." + }, + "resources": { + "type": "object", + "description": "Resources for the distro init container" + }, + "securityContext": { + "type": "object", + "description": "Security options can be used for the distro init container" + } + }, + "additionalProperties": false, + "type": "object" + }, + "DynamicNodePool": { + "properties": { + "name": { + "type": "string", + "description": "Name is the name of this NodePool" + }, + "provider": { + "type": "string", + "description": "Provider is the node provider of the nodes in this pool." + }, + "requirements": { + "items": { + "$ref": "#/$defs/Requirement" + }, + "type": "array", + "description": "Requirements filter the types of nodes that can be provisioned by this pool.\nAll requirements must be met for a node type to be eligible." + }, + "taints": { + "items": { + "$ref": "#/$defs/KubeletJoinTaint" + }, + "type": "array", + "description": "Taints are the taints to apply to the nodes in this pool." + }, + "nodeLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "NodeLabels are the labels to apply to the nodes in this pool." + }, + "limits": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Limits specify the maximum resources that can be provisioned by this node pool,\nmapping to the 'limits' field in Karpenter's NodePool API." + }, + "disruption": { + "$ref": "#/$defs/DynamicNodePoolDisruption", + "description": "Disruption contains the parameters that relate to Karpenter's disruption logic" + }, + "terminationGracePeriod": { + "type": "string", + "description": "TerminationGracePeriod is the maximum duration the controller will wait before forcefully deleting the pods on a node, measured from when deletion is first initiated.\n\nWarning: this feature takes precedence over a Pod's terminationGracePeriodSeconds value, and bypasses any blocked PDBs or the karpenter.sh/do-not-disrupt annotation.\n\nThis field is intended to be used by cluster administrators to enforce that nodes can be cycled within a given time period.\nWhen set, drifted nodes will begin draining even if there are pods blocking eviction. Draining will respect PDBs and the do-not-disrupt annotation until the TGP is reached.\n\nKarpenter will preemptively delete pods so their terminationGracePeriodSeconds align with the node's terminationGracePeriod.\nIf a pod would be terminated without being granted its full terminationGracePeriodSeconds prior to the node timeout,\nthat pod will be deleted at T = node timeout - pod terminationGracePeriodSeconds.\n\nThe feature can also be used to allow maximum time limits for long-running jobs which can delay node termination with preStop hooks.\nDefaults to 30s. Set to Never to wait indefinitely for pods to be drained." + }, + "expireAfter": { + "type": "string", + "description": "The amount of time a Node can live on the cluster before being removed" + }, + "weight": { + "type": "integer", + "description": "Weight is the weight of this node pool." + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "name", + "provider" + ] + }, + "DynamicNodePoolDisruption": { + "properties": { + "consolidateAfter": { + "type": "string", + "description": "ConsolidateAfter is the duration the controller will wait\nbefore attempting to terminate nodes that are underutilized.\nRefer to ConsolidationPolicy for how underutilization is considered." + }, + "consolidationPolicy": { + "type": "string", + "description": "ConsolidationPolicy describes which nodes Karpenter can disrupt through its consolidation\nalgorithm. This policy defaults to \"WhenEmptyOrUnderutilized\" if not specified" + }, + "budgets": { + "items": { + "$ref": "#/$defs/DynamicNodePoolDisruptionBudget" + }, + "type": "array", + "description": "Budgets is a list of Budgets.\nIf there are multiple active budgets, Karpenter uses\nthe most restrictive value. If left undefined,\nthis will default to one budget with a value to 10%." + } + }, + "additionalProperties": false, + "type": "object" + }, + "DynamicNodePoolDisruptionBudget": { + "properties": { + "nodes": { + "type": "string", + "description": "Nodes dictates the maximum number of NodeClaims owned by this NodePool\nthat can be terminating at once. This is calculated by counting nodes that\nhave a deletion timestamp set, or are actively being deleted by Karpenter.\nThis field is required when specifying a budget." + }, + "schedule": { + "type": "string", + "description": "Schedule specifies when a budget begins being active, following\nthe upstream cronjob syntax. If omitted, the budget is always active.\nTimezones are not supported." + }, + "duration": { + "type": "string", + "description": "Duration determines how long a Budget is active since each Schedule hit.\nOnly minutes and hours are accepted, as cron does not work in seconds.\nIf omitted, the budget is always active.\nThis is required if Schedule is set." + } + }, + "additionalProperties": false, + "type": "object" + }, + "EnableAutoSwitchWithPatches": { + "properties": { + "enabled": { + "oneOf": [ + { + "type": "string" + }, + { + "type": "boolean" + } + ], + "description": "Enabled defines if this option should be enabled." + }, + "patches": { + "items": { + "$ref": "#/$defs/TranslatePatch" + }, + "type": "array", + "description": "Patches patch the resource according to the provided specification." + } + }, + "additionalProperties": false, + "type": "object" + }, + "EnableAutoSwitchWithPatchesAndSelector": { + "properties": { + "enabled": { + "oneOf": [ + { + "type": "string" + }, + { + "type": "boolean" + } + ], + "description": "Enabled defines if this option should be enabled." + }, + "patches": { + "items": { + "$ref": "#/$defs/TranslatePatch" + }, + "type": "array", + "description": "Patches patch the resource according to the provided specification." + }, + "selector": { + "$ref": "#/$defs/StandardLabelSelector", + "description": "Selector defines the selector to use for the resource. If not set, all resources of that type will be synced." + } + }, + "additionalProperties": false, + "type": "object" + }, + "EnableSwitch": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if this option should be enabled." + } + }, + "additionalProperties": false, + "type": "object" + }, + "EnableSwitchSelector": { + "properties": { + "selector": { + "$ref": "#/$defs/StandardLabelSelector" + }, + "enabled": { + "type": "boolean", + "description": "Enabled defines if this option should be enabled." + } + }, + "additionalProperties": false, + "type": "object" + }, + "EnableSwitchWithPatches": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if this option should be enabled." + }, + "patches": { + "items": { + "$ref": "#/$defs/TranslatePatch" + }, + "type": "array", + "description": "Patches patch the resource according to the provided specification." + } + }, + "additionalProperties": false, + "type": "object" + }, + "EnableSwitchWithPatchesAndSelector": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if this option should be enabled." + }, + "patches": { + "items": { + "$ref": "#/$defs/TranslatePatch" + }, + "type": "array", + "description": "Patches patch the resource according to the provided specification." + }, + "selector": { + "$ref": "#/$defs/StandardLabelSelector", + "description": "Selector defines the selector to use for the resource. If not set, all resources of that type will be synced." + } + }, + "additionalProperties": false, + "type": "object" + }, + "EnableSwitchWithResourcesMappings": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if this option should be enabled." + }, + "patches": { + "items": { + "$ref": "#/$defs/TranslatePatch" + }, + "type": "array", + "description": "Patches patch the resource according to the provided specification." + }, + "mappings": { + "$ref": "#/$defs/FromHostMappings", + "description": "Mappings for Namespace and Object" + } + }, + "additionalProperties": false, + "type": "object" + }, + "Etcd": { + "properties": { + "embedded": { + "$ref": "#/$defs/EtcdEmbedded", + "description": "Embedded defines to use embedded etcd as a storage backend for the virtual cluster", + "pro": true + }, + "deploy": { + "$ref": "#/$defs/EtcdDeploy", + "description": "Deploy defines to use an external etcd that is deployed by the helm chart" + }, + "external": { + "$ref": "#/$defs/EtcdExternal", + "description": "External defines to use a self-hosted external etcd that is not deployed by the helm chart" + } + }, + "additionalProperties": false, + "type": "object" + }, + "EtcdDeploy": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines that an external etcd should be deployed." + }, + "statefulSet": { + "$ref": "#/$defs/EtcdDeployStatefulSet", + "description": "StatefulSet holds options for the external etcd statefulSet." + }, + "service": { + "$ref": "#/$defs/EtcdDeployService", + "description": "Service holds options for the external etcd service." + }, + "headlessService": { + "$ref": "#/$defs/EtcdDeployHeadlessService", + "description": "HeadlessService holds options for the external etcd headless service." + } + }, + "additionalProperties": false, + "type": "object" + }, + "EtcdDeployHeadlessService": { + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Annotations are extra annotations for the external etcd headless service" + } + }, + "additionalProperties": false, + "type": "object" + }, + "EtcdDeployService": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if the etcd service should be deployed" + }, + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Annotations are extra annotations for the external etcd service" + } + }, + "additionalProperties": false, + "type": "object" + }, + "EtcdDeployStatefulSet": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if the statefulSet should be deployed" + }, + "enableServiceLinks": { + "type": "boolean", + "description": "EnableServiceLinks for the StatefulSet pod" + }, + "image": { + "$ref": "#/$defs/Image", + "description": "Image is the image to use for the external etcd statefulSet" + }, + "imagePullPolicy": { + "type": "string", + "description": "ImagePullPolicy is the pull policy for the external etcd image" + }, + "env": { + "items": { + "type": "object" + }, + "type": "array", + "description": "Env are extra environment variables" + }, + "extraArgs": { + "items": { + "type": "string" + }, + "type": "array", + "description": "ExtraArgs are appended to the etcd command." + }, + "resources": { + "$ref": "#/$defs/Resources", + "description": "Resources the etcd can consume" + }, + "pods": { + "$ref": "#/$defs/LabelsAndAnnotations", + "description": "Pods defines extra metadata for the etcd pods." + }, + "highAvailability": { + "$ref": "#/$defs/ExternalEtcdHighAvailability", + "description": "HighAvailability are high availability options" + }, + "scheduling": { + "$ref": "#/$defs/ControlPlaneScheduling", + "description": "Scheduling options for the etcd pods." + }, + "security": { + "$ref": "#/$defs/ControlPlaneSecurity", + "description": "Security options for the etcd pods." + }, + "persistence": { + "$ref": "#/$defs/ExternalEtcdPersistence", + "description": "Persistence options for the etcd pods." + }, + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Annotations are extra annotations for this resource." + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Labels are extra labels for this resource." + } + }, + "additionalProperties": false, + "type": "object" + }, + "EtcdEmbedded": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if the embedded etcd should be used.", + "pro": true + }, + "migrateFromDeployedEtcd": { + "type": "boolean", + "description": "MigrateFromDeployedEtcd signals that vCluster should migrate from the deployed external etcd to embedded etcd." + }, + "snapshotCount": { + "type": "integer", + "description": "SnapshotCount defines the number of snapshots to keep for the embedded etcd. Defaults to 10000 if less than 1." + }, + "extraArgs": { + "items": { + "type": "string" + }, + "type": "array", + "description": "ExtraArgs are additional arguments to pass to the embedded etcd." + } + }, + "additionalProperties": false, + "type": "object" + }, + "EtcdExternal": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if the external etcd should be used." + }, + "endpoint": { + "type": "string", + "description": "Endpoint holds the endpoint of the external etcd server, e.g. my-example-service:2379" + }, + "tls": { + "$ref": "#/$defs/EtcdExternalTLS", + "description": "TLS defines the tls configuration for the external etcd server" + } + }, + "additionalProperties": false, + "type": "object" + }, + "EtcdExternalTLS": { + "properties": { + "caFile": { + "type": "string", + "description": "CaFile is the path to the ca file" + }, + "certFile": { + "type": "string", + "description": "CertFile is the path to the cert file" + }, + "keyFile": { + "type": "string", + "description": "KeyFile is the path to the key file" + } + }, + "additionalProperties": false, + "type": "object", + "description": "EtcdExternalTLS defines tls for external etcd server" + }, + "Experimental": { + "properties": { + "deploy": { + "$ref": "#/$defs/ExperimentalDeploy", + "description": "Deploy allows you to configure manifests and Helm charts to deploy within the host or virtual cluster." + }, + "syncSettings": { + "$ref": "#/$defs/ExperimentalSyncSettings", + "description": "SyncSettings are advanced settings for the syncer controller." + }, + "virtualClusterKubeConfig": { + "$ref": "#/$defs/VirtualClusterKubeConfig", + "description": "VirtualClusterKubeConfig allows you to override distro specifics and specify where vCluster will find the required certificates and vCluster config.\nDeprecated: Removed in 0.29.0." + }, + "denyProxyRequests": { + "items": { + "$ref": "#/$defs/DenyRule" + }, + "type": "array", + "description": "DenyProxyRequests denies certain requests in the vCluster proxy.", + "pro": true + } + }, + "additionalProperties": false, + "type": "object" + }, + "ExperimentalDeploy": { + "properties": { + "host": { + "$ref": "#/$defs/ExperimentalDeployHost", + "description": "Host defines what manifests to deploy into the host cluster" + }, + "vcluster": { + "$ref": "#/$defs/ExperimentalDeployVCluster", + "description": "VCluster defines what manifests and charts to deploy into the vCluster" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ExperimentalDeployHelm": { + "properties": { + "chart": { + "$ref": "#/$defs/ExperimentalDeployHelmChart", + "description": "Chart defines what chart should get deployed." + }, + "release": { + "$ref": "#/$defs/ExperimentalDeployHelmRelease", + "description": "Release defines what release should get deployed." + }, + "values": { + "type": "string", + "description": "Values defines what values should get used." + }, + "timeout": { + "type": "string", + "description": "Timeout defines the timeout for Helm" + }, + "bundle": { + "type": "string", + "description": "Bundle allows to compress the Helm chart and specify this instead of an online chart" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ExperimentalDeployHelmChart": { + "properties": { + "name": { + "type": "string" + }, + "repo": { + "type": "string" + }, + "insecure": { + "type": "boolean" + }, + "version": { + "type": "string" + }, + "username": { + "type": "string" + }, + "password": { + "type": "string" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ExperimentalDeployHelmRelease": { + "properties": { + "name": { + "type": "string", + "description": "Name of the release" + }, + "namespace": { + "type": "string", + "description": "Namespace of the release" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ExperimentalDeployHost": { + "properties": { + "manifests": { + "type": "string", + "description": "Manifests are raw Kubernetes manifests that should get applied within the host cluster." + }, + "manifestsTemplate": { + "type": "string", + "description": "ManifestsTemplate is a Kubernetes manifest template that will be rendered with vCluster values before applying it within the host cluster." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ExperimentalDeployVCluster": { + "properties": { + "manifests": { + "type": "string", + "description": "Manifests are raw Kubernetes manifests that should get applied within the virtual cluster." + }, + "manifestsTemplate": { + "type": "string", + "description": "ManifestsTemplate is a Kubernetes manifest template that will be rendered with vCluster values before applying it within the virtual cluster." + }, + "helm": { + "items": { + "$ref": "#/$defs/ExperimentalDeployHelm" + }, + "type": "array", + "description": "Helm are Helm charts that should get deployed into the virtual cluster" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ExperimentalSyncSettings": { + "properties": { + "targetNamespace": { + "type": "string", + "description": "TargetNamespace is the namespace where the workloads should get synced to.\nDeprecated: Removed in 0.29.0." + }, + "setOwner": { + "type": "boolean", + "description": "SetOwner specifies if vCluster should set an owner reference on the synced objects to the vCluster service. This allows for easy garbage collection." + }, + "hostMetricsBindAddress": { + "type": "string", + "description": "HostMetricsBindAddress is the bind address for the local manager" + }, + "virtualMetricsBindAddress": { + "type": "string", + "description": "VirtualMetricsBindAddress is the bind address for the virtual manager" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ExportKubeConfig": { + "properties": { + "context": { + "type": "string", + "description": "Context is the name of the context within the generated kubeconfig to use." + }, + "server": { + "type": "string", + "description": "Override the default https://localhost:8443 and specify a custom hostname for the generated kubeconfig." + }, + "insecure": { + "type": "boolean", + "description": "If tls should get skipped for the server" + }, + "serviceAccount": { + "$ref": "#/$defs/ExportKubeConfigServiceAccount", + "description": "ServiceAccount can be used to generate a service account token instead of the default certificates." + }, + "secret": { + "$ref": "#/$defs/ExportKubeConfigSecretReference", + "description": "Declare in which host cluster secret vCluster should store the generated virtual cluster kubeconfig.\nIf this is not defined, vCluster will create it with `vc-NAME`. If you specify another name,\nvCluster creates the config in this other secret.\n\nDeprecated: Use AdditionalSecrets instead." + }, + "additionalSecrets": { + "items": { + "$ref": "#/$defs/ExportKubeConfigAdditionalSecretReference" + }, + "type": "array", + "description": "AdditionalSecrets specifies the additional host cluster secrets in which vCluster will store the\ngenerated virtual cluster kubeconfigs." + } + }, + "additionalProperties": false, + "type": "object", + "description": "ExportKubeConfig describes how vCluster should export the vCluster kubeconfig." + }, + "ExportKubeConfigAdditionalSecretReference": { + "properties": { + "context": { + "type": "string", + "description": "Context is the name of the context within the generated kubeconfig to use." + }, + "server": { + "type": "string", + "description": "Override the default https://localhost:8443 and specify a custom hostname for the generated kubeconfig." + }, + "insecure": { + "type": "boolean", + "description": "If tls should get skipped for the server" + }, + "serviceAccount": { + "$ref": "#/$defs/ExportKubeConfigServiceAccount", + "description": "ServiceAccount can be used to generate a service account token instead of the default certificates." + }, + "name": { + "type": "string", + "description": "Name is the name of the secret where the kubeconfig is stored." + }, + "namespace": { + "type": "string", + "description": "Namespace where vCluster stores the kubeconfig secret. If this is not equal to the namespace\nwhere you deployed vCluster, you need to make sure vCluster has access to this other namespace." + } + }, + "additionalProperties": false, + "type": "object", + "description": "ExportKubeConfigAdditionalSecretReference defines the additional host cluster secret in which vCluster stores the generated virtual cluster kubeconfigs." + }, + "ExportKubeConfigSecretReference": { + "properties": { + "name": { + "type": "string", + "description": "Name is the name of the secret where the kubeconfig should get stored." + }, + "namespace": { + "type": "string", + "description": "Namespace where vCluster should store the kubeconfig secret. If this is not equal to the namespace\nwhere you deployed vCluster, you need to make sure vCluster has access to this other namespace." + } + }, + "additionalProperties": false, + "type": "object", + "description": "Declare in which host cluster secret vCluster should store the generated virtual cluster kubeconfig." + }, + "ExportKubeConfigServiceAccount": { + "properties": { + "name": { + "type": "string", + "description": "Name of the service account to be used to generate a service account token instead of the default certificates." + }, + "namespace": { + "type": "string", + "description": "Namespace of the service account to be used to generate a service account token instead of the default certificates.\nIf omitted, will use the kube-system namespace." + }, + "clusterRole": { + "type": "string", + "description": "ClusterRole to assign to the service account." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ExternalConfig": { + "properties": { + "platform": { + "$ref": "#/$defs/PlatformConfig", + "type": "object", + "description": "platform holds platform configuration" + } + }, + "type": "object", + "description": "ExternalConfig holds external configuration" + }, + "ExternalDatabaseKine": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if the database should be used." + }, + "dataSource": { + "type": "string", + "description": "DataSource is the kine dataSource to use for the database. This depends on the database format.\nThis is optional for the embedded database. Examples:\n* mysql: mysql://username:password@tcp(hostname:3306)/k3s\n* postgres: postgres://username:password@hostname:5432/k3s" + }, + "keyFile": { + "type": "string", + "description": "KeyFile is the key file to use for the database. This is optional." + }, + "certFile": { + "type": "string", + "description": "CertFile is the cert file to use for the database. This is optional." + }, + "caFile": { + "type": "string", + "description": "CaFile is the ca file to use for the database. This is optional." + }, + "extraArgs": { + "items": { + "type": "string" + }, + "type": "array", + "description": "ExtraArgs are additional arguments to pass to Kine." + }, + "connector": { + "type": "string", + "description": "Connector specifies a secret located in a connected vCluster Platform that contains database server connection information\nto be used by Platform to create a database and database user for the vCluster.\nand non-privileged user. A kine endpoint should be created using the database and user on Platform registration.\nThis is optional." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ExternalEtcdHighAvailability": { + "properties": { + "replicas": { + "type": "integer", + "description": "Replicas are the amount of pods to use." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ExternalEtcdPersistence": { + "properties": { + "volumeClaim": { + "$ref": "#/$defs/ExternalEtcdPersistenceVolumeClaim", + "description": "VolumeClaim can be used to configure the persistent volume claim." + }, + "volumeClaimTemplates": { + "items": { + "type": "object" + }, + "type": "array", + "description": "VolumeClaimTemplates defines the volumeClaimTemplates for the statefulSet" + }, + "addVolumes": { + "items": { + "type": "object" + }, + "type": "array", + "description": "AddVolumes defines extra volumes for the pod" + }, + "addVolumeMounts": { + "items": { + "$ref": "#/$defs/VolumeMount" + }, + "type": "array", + "description": "AddVolumeMounts defines extra volume mounts for the container" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ExternalEtcdPersistenceVolumeClaim": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled enables deploying a persistent volume claim." + }, + "accessModes": { + "items": { + "type": "string" + }, + "type": "array", + "description": "AccessModes are the persistent volume claim access modes." + }, + "retentionPolicy": { + "type": "string", + "description": "RetentionPolicy is the persistent volume claim retention policy." + }, + "size": { + "type": "string", + "description": "Size is the persistent volume claim storage size." + }, + "storageClass": { + "type": "string", + "description": "StorageClass is the persistent volume claim storage class." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ExternalSecrets": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines whether the external secret integration is enabled or not" + }, + "version": { + "type": "string", + "description": "Version defines the version of the external secrets operator to use. If empty, the storage version will be used." + }, + "webhook": { + "$ref": "#/$defs/EnableSwitch", + "description": "Webhook defines whether the host webhooks are reused or not" + }, + "sync": { + "$ref": "#/$defs/ExternalSecretsSync", + "description": "Sync defines the syncing behavior for the integration" + } + }, + "additionalProperties": false, + "type": "object", + "description": "ExternalSecrets reuses a host external secret operator and makes certain CRDs from it available inside the vCluster" + }, + "ExternalSecretsSync": { + "properties": { + "toHost": { + "$ref": "#/$defs/ExternalSecretsSyncToHostConfig", + "description": "ToHost defines what resources are synced from the virtual cluster to the host" + }, + "fromHost": { + "$ref": "#/$defs/ExternalSecretsSyncFromHostConfig", + "description": "FromHost defines what resources are synced from the host cluster to the virtual cluster" + }, + "externalSecrets": { + "$ref": "#/$defs/EnableSwitch", + "description": "ExternalSecrets defines if external secrets should get synced from the virtual cluster to the host cluster." + }, + "stores": { + "$ref": "#/$defs/EnableSwitch", + "description": "Stores defines if secret stores should get synced from the virtual cluster to the host cluster and then bi-directionally.\nDeprecated: Use Integrations.ExternalSecrets.Sync.ToHost.Stores instead." + }, + "clusterStores": { + "$ref": "#/$defs/ClusterStoresSyncConfig", + "description": "ClusterStores defines if cluster secrets stores should get synced from the host cluster to the virtual cluster.\nDeprecated: Use Integrations.ExternalSecrets.Sync.FromHost.ClusterStores instead." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ExternalSecretsSyncFromHostConfig": { + "properties": { + "clusterStores": { + "$ref": "#/$defs/EnableSwitchSelector", + "description": "ClusterStores defines if cluster secrets stores should get synced from the host cluster to the virtual cluster." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ExternalSecretsSyncToHostConfig": { + "properties": { + "externalSecrets": { + "$ref": "#/$defs/SelectorConfig", + "description": "ExternalSecrets allows to configure if only a subset of ExternalSecrets matching a label selector should get synced from the virtual cluster to the host cluster." + }, + "stores": { + "$ref": "#/$defs/EnableSwitchSelector", + "description": "Stores defines if secret stores should get synced from the virtual cluster to the host cluster and then bi-directionally." + } + }, + "additionalProperties": false, + "type": "object" + }, + "FromHostMappings": { + "properties": { + "byName": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "ByName is a map of host-object-namespace/host-object-name: virtual-object-namespace/virtual-object-name.\nThere are several wildcards supported:\n1. To match all objects in host namespace and sync them to different namespace in vCluster:\nbyName:\n \"foo/*\": \"foo-in-virtual/*\"\n2. To match specific object in the host namespace and sync it to the same namespace with the same name:\nbyName:\n \"foo/my-object\": \"foo/my-object\"\n3. To match specific object in the host namespace and sync it to the same namespace with different name:\nbyName:\n \"foo/my-object\": \"foo/my-virtual-object\"\n4. To match all objects in the vCluster host namespace and sync them to a different namespace in vCluster:\nbyName:\n \"\": \"my-virtual-namespace/*\"\n5. To match specific objects in the vCluster host namespace and sync them to a different namespace in vCluster:\nbyName:\n \"/my-object\": \"my-virtual-namespace/my-object\"" + } + }, + "additionalProperties": false, + "type": "object" + }, + "HostPathMapper": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled specifies if the host path mapper will be used" + }, + "central": { + "type": "boolean", + "description": "Central specifies if the central host path mapper will be used" + } + }, + "additionalProperties": false, + "type": "object" + }, + "HybridScheduling": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled specifies if hybrid scheduling is enabled." + }, + "hostSchedulers": { + "items": { + "type": "string" + }, + "type": "array", + "description": "HostSchedulers is a list of schedulers that are deployed on the host cluster." + } + }, + "additionalProperties": false, + "type": "object" + }, + "IPBlock": { + "properties": { + "cidr": { + "type": "string", + "description": "cidr is a string representing the IPBlock\nValid examples are \"192.168.1.0/24\" or \"2001:db8::/64\"" + }, + "except": { + "items": { + "type": "string" + }, + "type": "array", + "description": "except is a slice of CIDRs that should not be included within an IPBlock\nValid examples are \"192.168.1.0/24\" or \"2001:db8::/64\"\nExcept values will be rejected if they are outside the cidr range\n+optional" + } + }, + "additionalProperties": false, + "type": "object" + }, + "Image": { + "properties": { + "registry": { + "type": "string", + "description": "Registry is the registry of the container image, e.g. my-registry.com or ghcr.io. This setting can be globally\noverridden via the controlPlane.advanced.defaultImageRegistry option. Empty means docker hub." + }, + "repository": { + "type": "string", + "description": "Repository is the repository of the container image, e.g. my-repo/my-image" + }, + "tag": { + "type": "string", + "description": "Tag is the tag of the container image, and is the default version." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ImagePullSecretName": { + "properties": { + "name": { + "type": "string", + "description": "Name of the image pull secret to use." + } + }, + "additionalProperties": false, + "type": "object" + }, + "IngressNginx": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if ingress-nginx should be enabled." + }, + "defaultIngressClass": { + "type": "boolean", + "description": "DefaultIngressClass defines if the deployed ingress class should be the default ingress class." + } + }, + "additionalProperties": false, + "type": "object" + }, + "Integrations": { + "properties": { + "metricsServer": { + "$ref": "#/$defs/MetricsServer", + "description": "MetricsServer reuses the metrics server from the host cluster within the vCluster." + }, + "kubeVirt": { + "$ref": "#/$defs/KubeVirt", + "description": "KubeVirt reuses a host kubevirt and makes certain CRDs from it available inside the vCluster" + }, + "externalSecrets": { + "$ref": "#/$defs/ExternalSecrets", + "description": "ExternalSecrets reuses a host external secret operator and makes certain CRDs from it available inside the vCluster.\n- ExternalSecrets will be synced from the virtual cluster to the host cluster.\n- SecretStores will be synced from the virtual cluster to the host cluster and then bi-directionally.\n- ClusterSecretStores will be synced from the host cluster to the virtual cluster." + }, + "certManager": { + "$ref": "#/$defs/CertManager", + "description": "CertManager reuses a host cert-manager and makes its CRDs from it available inside the vCluster.\n- Certificates and Issuers will be synced from the virtual cluster to the host cluster.\n- ClusterIssuers will be synced from the host cluster to the virtual cluster." + }, + "istio": { + "$ref": "#/$defs/Istio", + "description": "Istio syncs DestinationRules, Gateways and VirtualServices from virtual cluster to the host." + } + }, + "additionalProperties": false, + "type": "object", + "description": "Integrations holds config for vCluster integrations with other operators or tools running on the host cluster" + }, + "Istio": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if this option should be enabled." + }, + "sync": { + "$ref": "#/$defs/IstioSync" + } + }, + "additionalProperties": false, + "type": "object" + }, + "IstioSync": { + "properties": { + "toHost": { + "$ref": "#/$defs/IstioSyncToHost" + } + }, + "additionalProperties": false, + "type": "object" + }, + "IstioSyncToHost": { + "properties": { + "destinationRules": { + "$ref": "#/$defs/EnableSwitch" + }, + "gateways": { + "$ref": "#/$defs/EnableSwitch" + }, + "virtualServices": { + "$ref": "#/$defs/EnableSwitch" + } + }, + "additionalProperties": false, + "type": "object" + }, + "JoinConfiguration": { + "properties": { + "preInstallCommands": { + "items": { + "type": "string" + }, + "type": "array", + "description": "PreInstallCommands are commands that will be executed before containerd, kubelet etc. is installed." + }, + "preJoinCommands": { + "items": { + "type": "string" + }, + "type": "array", + "description": "PreJoinCommands are commands that will be executed before kubeadm join is executed." + }, + "postJoinCommands": { + "items": { + "type": "string" + }, + "type": "array", + "description": "PostJoinCommands are commands that will be executed after kubeadm join is executed." + }, + "containerd": { + "$ref": "#/$defs/ContainerdJoin", + "description": "Containerd holds configuration for the containerd join process." + }, + "caCertPath": { + "type": "string", + "description": "CACertPath is the path to the SSL certificate authority used to\nsecure communications between node and control-plane.\nDefaults to \"/etc/kubernetes/pki/ca.crt\"." + }, + "skipPhases": { + "items": { + "type": "string" + }, + "type": "array", + "description": "SkipPhases is a list of phases to skip during command execution.\nThe list of phases can be obtained with the \"kubeadm join --help\" command." + }, + "nodeRegistration": { + "$ref": "#/$defs/NodeRegistration", + "description": "NodeRegistration holds configuration for the node registration similar to the kubeadm node registration." + } + }, + "additionalProperties": false, + "type": "object" + }, + "Konnectivity": { + "properties": { + "server": { + "$ref": "#/$defs/KonnectivityServer", + "description": "Server holds configuration for the konnectivity server." + }, + "agent": { + "$ref": "#/$defs/KonnectivityAgent", + "description": "Agent holds configuration for the konnectivity agent." + } + }, + "additionalProperties": false, + "type": "object" + }, + "KonnectivityAgent": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if the konnectivity agent should be enabled." + }, + "replicas": { + "type": "integer", + "description": "Replicas is the number of replicas for the konnectivity agent." + }, + "image": { + "type": "string", + "description": "Image is the image for the konnectivity agent." + }, + "imagePullPolicy": { + "type": "string", + "description": "ImagePullPolicy is the policy how to pull the image." + }, + "nodeSelector": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "NodeSelector is the node selector for the konnectivity agent." + }, + "priorityClassName": { + "type": "string", + "description": "PriorityClassName is the priority class name for the konnectivity agent." + }, + "tolerations": { + "items": true, + "type": "array", + "description": "Tolerations is the tolerations for the konnectivity agent." + }, + "extraEnv": { + "items": true, + "type": "array", + "description": "ExtraEnv is the extra environment variables for the konnectivity agent." + }, + "extraArgs": { + "items": { + "type": "string" + }, + "type": "array", + "description": "ExtraArgs are additional arguments to pass to the konnectivity agent." + } + }, + "additionalProperties": false, + "type": "object" + }, + "KonnectivityServer": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if the konnectivity server should be enabled." + }, + "extraArgs": { + "items": { + "type": "string" + }, + "type": "array", + "description": "ExtraArgs are additional arguments to pass to the konnectivity server." + } + }, + "additionalProperties": false, + "type": "object" + }, + "KubeProxy": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if the kube proxy should be enabled." + }, + "image": { + "type": "string", + "description": "Image is the image for the kube-proxy." + }, + "imagePullPolicy": { + "type": "string", + "description": "ImagePullPolicy is the policy how to pull the image." + }, + "nodeSelector": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "NodeSelector is the node selector for the kube-proxy." + }, + "priorityClassName": { + "type": "string", + "description": "PriorityClassName is the priority class name for the kube-proxy." + }, + "tolerations": { + "items": true, + "type": "array", + "description": "Tolerations is the tolerations for the kube-proxy." + }, + "extraEnv": { + "items": true, + "type": "array", + "description": "ExtraEnv is the extra environment variables for the kube-proxy." + }, + "extraArgs": { + "items": { + "type": "string" + }, + "type": "array", + "description": "ExtraArgs are additional arguments to pass to the kube-proxy." + }, + "config": { + "type": "object", + "description": "Config is the config for the kube-proxy that will be merged into the default kube-proxy config. More information can be found here:\nhttps://kubernetes.io/docs/reference/config-api/kube-proxy-config.v1alpha1/#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration" + } + }, + "additionalProperties": false, + "type": "object" + }, + "KubeVirt": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled signals if the integration should be enabled" + }, + "apiService": { + "$ref": "#/$defs/APIService", + "description": "APIService holds information about where to find the virt-api service. Defaults to virt-api/kubevirt." + }, + "webhook": { + "$ref": "#/$defs/EnableSwitch", + "description": "Webhook holds configuration for enabling the webhook within the vCluster" + }, + "sync": { + "$ref": "#/$defs/KubeVirtSync", + "description": "Sync holds configuration on what resources to sync" + } + }, + "additionalProperties": false, + "type": "object", + "description": "KubeVirt reuses a host kubevirt and makes certain CRDs from it available inside the vCluster" + }, + "KubeVirtSync": { + "properties": { + "dataVolumes": { + "$ref": "#/$defs/EnableSwitch", + "description": "If DataVolumes should get synced" + }, + "virtualMachineInstanceMigrations": { + "$ref": "#/$defs/EnableSwitch", + "description": "If VirtualMachineInstanceMigrations should get synced" + }, + "virtualMachineInstances": { + "$ref": "#/$defs/EnableSwitch", + "description": "If VirtualMachineInstances should get synced" + }, + "virtualMachines": { + "$ref": "#/$defs/EnableSwitch", + "description": "If VirtualMachines should get synced" + }, + "virtualMachineClones": { + "$ref": "#/$defs/EnableSwitch", + "description": "If VirtualMachineClones should get synced" + }, + "virtualMachinePools": { + "$ref": "#/$defs/EnableSwitch", + "description": "If VirtualMachinePools should get synced" + } + }, + "additionalProperties": false, + "type": "object", + "description": "KubeVirtSync are the crds that are supported by this integration" + }, + "Kubelet": { + "properties": { + "config": { + "type": "object", + "description": "Config is the config for the kubelet that will be merged into the default kubelet config. More information can be found here:\nhttps://kubernetes.io/docs/reference/config-api/kubelet-config.v1beta1/#kubelet-config-k8s-io-v1beta1-KubeletConfiguration" + } + }, + "additionalProperties": false, + "type": "object" + }, + "KubeletExtraArg": { + "properties": { + "name": { + "type": "string", + "description": "Name is the name of the argument." + }, + "value": { + "type": "string", + "description": "Value is the value of the argument." + } + }, + "additionalProperties": false, + "type": "object", + "description": "KubeletExtraArg represents an argument with a name and a value." + }, + "KubeletJoinTaint": { + "properties": { + "key": { + "type": "string", + "description": "Required. The taint key to be applied to a node." + }, + "value": { + "type": "string", + "description": "The taint value corresponding to the taint key.\n+optional" + }, + "effect": { + "type": "string", + "description": "Required. The effect of the taint on pods\nthat do not tolerate the taint.\nValid effects are NoSchedule, PreferNoSchedule and NoExecute." + } + }, + "additionalProperties": false, + "type": "object" + }, + "LabelSelector": { + "properties": { + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Labels defines what labels should be looked for" + } + }, + "additionalProperties": false, + "type": "object" + }, + "LabelSelectorRequirement": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "additionalProperties": false, + "type": "object" + }, + "LabelsAndAnnotations": { + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Annotations are extra annotations for this resource." + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Labels are extra labels for this resource." + } + }, + "additionalProperties": false, + "type": "object" + }, + "LimitRange": { + "properties": { + "enabled": { + "oneOf": [ + { + "type": "string" + }, + { + "type": "boolean" + } + ], + "description": "Enabled defines if the limit range should be deployed by vCluster. \"auto\" means that if resourceQuota is enabled,\nthe limitRange will be enabled as well." + }, + "default": { + "type": "object", + "description": "Default are the default limits for the limit range" + }, + "defaultRequest": { + "type": "object", + "description": "DefaultRequest are the default request options for the limit range" + }, + "max": { + "type": "object", + "description": "Max are the max limits for the limit range" + }, + "min": { + "type": "object", + "description": "Min are the min limits for the limit range" + }, + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Annotations are extra annotations for this resource." + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Labels are extra labels for this resource." + } + }, + "additionalProperties": false, + "type": "object" + }, + "LivenessProbe": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if this option should be enabled." + }, + "failureThreshold": { + "type": "integer", + "description": "Number of consecutive failures for the probe to be considered failed" + }, + "initialDelaySeconds": { + "type": "integer", + "description": "Time (in seconds) to wait before starting the liveness probe" + }, + "timeoutSeconds": { + "type": "integer", + "description": "Maximum duration (in seconds) that the probe will wait for a response." + }, + "periodSeconds": { + "type": "integer", + "description": "Frequency (in seconds) to perform the probe" + } + }, + "additionalProperties": false, + "type": "object", + "description": "LivenessProbe defines the configuration for the liveness probe." + }, + "LocalPathProvisioner": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if LocalPathProvisioner should be enabled." + }, + "image": { + "type": "string", + "description": "Image is the image for local path provisioner." + }, + "imagePullPolicy": { + "type": "string", + "description": "ImagePullPolicy is the policy how to pull the image." + }, + "nodePath": { + "type": "string", + "description": "NodePath is the path on the node where to create the persistent volume directories." + } + }, + "additionalProperties": false, + "type": "object" + }, + "Logging": { + "properties": { + "encoding": { + "type": "string", + "description": "Encoding specifies the format of vCluster logs, it can either be json or console." + } + }, + "additionalProperties": false, + "type": "object", + "description": "Logging holds the log encoding details" + }, + "Metallb": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if metallb should be enabled." + }, + "controllerImage": { + "type": "string", + "description": "ControllerImage is the image for metallb controller." + }, + "speakerImage": { + "type": "string", + "description": "SpeakerImage is the image for metallb speaker." + }, + "ipAddressPool": { + "$ref": "#/$defs/MetallbIPAddressPool", + "description": "IPAddressPool is the IP address pool to use for metallb." + } + }, + "additionalProperties": false, + "type": "object" + }, + "MetallbIPAddressPool": { + "properties": { + "addresses": { + "items": { + "type": "string" + }, + "type": "array", + "description": "Addresses is a list of IP addresses to use for the IP address pool." + }, + "l2Advertisement": { + "type": "boolean", + "description": "L2Advertisement defines if L2 advertisement should be enabled for the IP address pool." + } + }, + "additionalProperties": false, + "type": "object" + }, + "MetricsServer": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled signals the metrics server integration should be enabled." + }, + "apiService": { + "$ref": "#/$defs/APIService", + "description": "APIService holds information about where to find the metrics-server service. Defaults to metrics-server/kube-system." + }, + "nodes": { + "type": "boolean", + "description": "Nodes defines if metrics-server nodes api should get proxied from host to virtual cluster." + }, + "pods": { + "type": "boolean", + "description": "Pods defines if metrics-server pods api should get proxied from host to virtual cluster." + } + }, + "additionalProperties": false, + "type": "object", + "description": "MetricsServer reuses the metrics server from the host cluster within the vCluster." + }, + "MutatingWebhook": { + "properties": { + "reinvocationPolicy": { + "type": "string", + "description": "reinvocationPolicy indicates whether this webhook should be called multiple times as part of a single admission evaluation.\nAllowed values are \"Never\" and \"IfNeeded\"." + }, + "name": { + "type": "string", + "description": "The name of the admission webhook.\nName should be fully qualified, e.g., imagepolicy.kubernetes.io, where\n\"imagepolicy\" is the name of the webhook, and kubernetes.io is the name\nof the organization." + }, + "clientConfig": { + "$ref": "#/$defs/ValidatingWebhookClientConfig", + "description": "ClientConfig defines how to communicate with the hook." + }, + "rules": { + "items": true, + "type": "array", + "description": "Rules describes what operations on what resources/subresources the webhook cares about.\nThe webhook cares about an operation if it matches _any_ Rule." + }, + "failurePolicy": { + "type": "string", + "description": "FailurePolicy defines how unrecognized errors from the admission endpoint are handled -\nallowed values are Ignore or Fail. Defaults to Fail." + }, + "matchPolicy": { + "type": "string", + "description": "matchPolicy defines how the \"rules\" list is used to match incoming requests.\nAllowed values are \"Exact\" or \"Equivalent\"." + }, + "namespaceSelector": { + "description": "NamespaceSelector decides whether to run the webhook on an object based\non whether the namespace for that object matches the selector. If the\nobject itself is a namespace, the matching is performed on\nobject.metadata.labels. If the object is another cluster scoped resource,\nit never skips the webhook." + }, + "objectSelector": { + "description": "ObjectSelector decides whether to run the webhook based on if the\nobject has matching labels. objectSelector is evaluated against both\nthe oldObject and newObject that would be sent to the webhook, and\nis considered to match if either object matches the selector." + }, + "sideEffects": { + "type": "string", + "description": "SideEffects states whether this webhook has side effects." + }, + "timeoutSeconds": { + "type": "integer", + "description": "TimeoutSeconds specifies the timeout for this webhook." + }, + "admissionReviewVersions": { + "items": { + "type": "string" + }, + "type": "array", + "description": "AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`\nversions the Webhook expects." + }, + "matchConditions": { + "items": true, + "type": "array", + "description": "MatchConditions is a list of conditions that must be met for a request to be sent to this\nwebhook. Match conditions filter requests that have already been matched by the rules,\nnamespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.\nThere are a maximum of 64 match conditions allowed." + } + }, + "additionalProperties": false, + "type": "object" + }, + "MutatingWebhookConfiguration": { + "properties": { + "kind": { + "type": "string", + "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to." + }, + "apiVersion": { + "type": "string", + "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values." + }, + "metadata": { + "$ref": "#/$defs/ObjectMeta", + "description": "Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata." + }, + "webhooks": { + "items": { + "$ref": "#/$defs/MutatingWebhook" + }, + "type": "array", + "description": "Webhooks is a list of webhooks and the affected resources and operations." + } + }, + "additionalProperties": false, + "type": "object" + }, + "NetworkPolicy": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if the network policy should be deployed by vCluster." + }, + "fallbackDns": { + "type": "string", + "description": "FallbackDNS is the fallback DNS server to use if the virtual cluster does not have a DNS server." + }, + "outgoingConnections": { + "$ref": "#/$defs/OutgoingConnections", + "description": "OutgoingConnections are the outgoing connections options for the vCluster workloads." + }, + "extraControlPlaneRules": { + "items": { + "type": "object" + }, + "type": "array", + "description": "ExtraControlPlaneRules are extra allowed rules for the vCluster control plane." + }, + "extraWorkloadRules": { + "items": { + "type": "object" + }, + "type": "array", + "description": "ExtraWorkloadRules are extra allowed rules for the vCluster workloads." + }, + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Annotations are extra annotations for this resource." + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Labels are extra labels for this resource." + } + }, + "additionalProperties": false, + "type": "object" + }, + "NetworkProxyKubelets": { + "properties": { + "byHostname": { + "type": "boolean", + "description": "ByHostname will add a special vCluster hostname to the nodes where the node can be reached at. This doesn't work\nfor all applications, e.g. Prometheus requires a node IP." + }, + "byIP": { + "type": "boolean", + "description": "ByIP will create a separate service in the host cluster for every node that will point to virtual cluster and will be used to\nroute traffic." + } + }, + "additionalProperties": false, + "type": "object" + }, + "Networking": { + "properties": { + "serviceCIDR": { + "type": "string", + "description": "ServiceCIDR holds the service cidr for the virtual cluster. This should only be set if privateNodes.enabled is true or vCluster cannot detect the host service cidr." + }, + "podCIDR": { + "type": "string", + "description": "PodCIDR holds the pod cidr for the virtual cluster. This should only be set if privateNodes.enabled is true." + }, + "replicateServices": { + "$ref": "#/$defs/ReplicateServices", + "description": "ReplicateServices allows replicating services from the host within the virtual cluster or the other way around." + }, + "resolveDNS": { + "items": { + "$ref": "#/$defs/ResolveDNS" + }, + "type": "array", + "description": "ResolveDNS allows to define extra DNS rules. This only works if embedded coredns is configured.", + "pro": true + }, + "advanced": { + "$ref": "#/$defs/NetworkingAdvanced", + "description": "Advanced holds advanced network options." + } + }, + "additionalProperties": false, + "type": "object" + }, + "NetworkingAdvanced": { + "properties": { + "clusterDomain": { + "type": "string", + "description": "ClusterDomain is the Kubernetes cluster domain to use within the virtual cluster." + }, + "fallbackHostCluster": { + "type": "boolean", + "description": "FallbackHostCluster allows to fallback dns to the host cluster. This is useful if you want to reach host services without\nany other modification. You will need to provide a namespace for the service, e.g. my-other-service.my-other-namespace" + }, + "proxyKubelets": { + "$ref": "#/$defs/NetworkProxyKubelets", + "description": "ProxyKubelets allows rewriting certain metrics and stats from the Kubelet to \"fake\" this for applications such as\nprometheus or other node exporters." + } + }, + "additionalProperties": false, + "type": "object" + }, + "NodeRegistration": { + "properties": { + "criSocket": { + "type": "string", + "description": "CRI socket is the socket for the CRI." + }, + "kubeletExtraArgs": { + "items": { + "$ref": "#/$defs/KubeletExtraArg" + }, + "type": "array", + "description": "KubeletExtraArgs passes through extra arguments to the kubelet. The arguments here are passed to the kubelet command line via the environment file\nkubeadm writes at runtime for the kubelet to source. This overrides the generic base-level configuration in the kubelet-config ConfigMap\nFlags have higher priority when parsing. These values are local and specific to the node kubeadm is executing on.\nAn argument name in this list is the flag name as it appears on the command line except without leading dash(es).\nExtra arguments will override existing default arguments. Duplicate extra arguments are allowed." + }, + "taints": { + "items": { + "$ref": "#/$defs/KubeletJoinTaint" + }, + "type": "array", + "description": "Taints are additional taints to set for the kubelet." + }, + "ignorePreflightErrors": { + "items": { + "type": "string" + }, + "type": "array", + "description": "IgnorePreflightErrors provides a slice of pre-flight errors to be ignored when the current node is registered, e.g. 'IsPrivilegedUser,Swap'.\nValue 'all' ignores errors from all checks." + }, + "imagePullPolicy": { + "type": "string", + "description": "ImagePullPolicy specifies the policy for image pulling during kubeadm \"init\" and \"join\" operations.\nThe value of this field must be one of \"Always\", \"IfNotPresent\" or \"Never\".\nIf this field is unset kubeadm will default it to \"IfNotPresent\", or pull the required images if not present on the host." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ObjectMeta": { + "properties": { + "name": { + "type": "string", + "description": "Name must be unique within a namespace. Is required when creating resources, although\nsome resources may allow a client to request the generation of an appropriate name\nautomatically. Name is primarily intended for creation idempotence and configuration\ndefinition." + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Map of string keys and values that can be used to organize and categorize\n(scope and select) objects. May match selectors of replication controllers\nand services." + }, + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Annotations is an unstructured key value map stored with a resource that may be\nset by external tools to store and retrieve arbitrary metadata." + } + }, + "additionalProperties": false, + "type": "object" + }, + "OutgoingConnections": { + "properties": { + "ipBlock": { + "$ref": "#/$defs/IPBlock", + "description": "IPBlock describes a particular CIDR (Ex. \"192.168.1.0/24\",\"2001:db8::/64\") that is allowed\nto the pods matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs\nthat should not be included within this rule." + }, + "platform": { + "type": "boolean", + "description": "Platform enables egress access towards loft platform" + } + }, + "additionalProperties": false, + "type": "object" + }, + "PlatformAPIKey": { + "properties": { + "secretName": { + "type": "string", + "description": "SecretName is the name of the secret where the platform access key is stored. This defaults to vcluster-platform-api-key if undefined." + }, + "namespace": { + "type": "string", + "description": "Namespace defines the namespace where the access key secret should be retrieved from. If this is not equal to the namespace\nwhere the vCluster instance is deployed, you need to make sure vCluster has access to this other namespace." + }, + "createRBAC": { + "type": "boolean", + "description": "CreateRBAC will automatically create the necessary RBAC roles and role bindings to allow vCluster to read the secret specified\nin the above namespace, if specified.\nThis defaults to true." + } + }, + "additionalProperties": false, + "type": "object", + "description": "PlatformAPIKey defines where to find the platform access key." + }, + "PlatformConfig": { + "properties": { + "apiKey": { + "$ref": "#/$defs/PlatformAPIKey", + "description": "APIKey defines where to find the platform access key and host. By default, vCluster will search in the following locations in this precedence:\n* environment variable called LICENSE\n* secret specified under external.platform.apiKey.secretName\n* secret called \"vcluster-platform-api-key\" in the vCluster namespace" + }, + "project": { + "type": "string", + "description": "Project specifies which platform project the vcluster should be imported to" + } + }, + "type": "object", + "description": "PlatformConfig holds platform configuration" + }, + "Plugin": { + "properties": { + "name": { + "type": "string", + "description": "Name is the name of the init-container and NOT the plugin name" + }, + "image": { + "type": "string", + "description": "Image is the container image that should be used for the plugin" + }, + "imagePullPolicy": { + "type": "string", + "description": "ImagePullPolicy is the pull policy to use for the container image" + }, + "config": { + "type": "object", + "description": "Config is the plugin config to use. This can be arbitrary config used for the plugin." + }, + "rbac": { + "$ref": "#/$defs/PluginsRBAC", + "description": "RBAC holds additional rbac configuration for the plugin" + }, + "command": { + "items": { + "type": "string" + }, + "type": "array", + "description": "Command is the command that should be used for the init container" + }, + "args": { + "items": { + "type": "string" + }, + "type": "array", + "description": "Args are the arguments that should be used for the init container" + }, + "securityContext": { + "type": "object", + "description": "SecurityContext is the container security context used for the init container" + }, + "resources": { + "type": "object", + "description": "Resources are the container resources used for the init container" + }, + "volumeMounts": { + "items": true, + "type": "array", + "description": "VolumeMounts are extra volume mounts for the init container" + }, + "version": { + "type": "string", + "description": "Version is the plugin version, this is only needed for legacy plugins." + }, + "env": { + "items": true, + "type": "array" + }, + "envFrom": { + "items": true, + "type": "array" + }, + "lifecycle": { + "type": "object" + }, + "livenessProbe": { + "type": "object" + }, + "readinessProbe": { + "type": "object" + }, + "startupProbe": { + "type": "object" + }, + "workingDir": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "additionalProperties": false, + "type": "object" + }, + "Plugins": { + "properties": { + "name": { + "type": "string", + "description": "Name is the name of the init-container and NOT the plugin name" + }, + "image": { + "type": "string", + "description": "Image is the container image that should be used for the plugin" + }, + "imagePullPolicy": { + "type": "string", + "description": "ImagePullPolicy is the pull policy to use for the container image" + }, + "config": { + "type": "object", + "description": "Config is the plugin config to use. This can be arbitrary config used for the plugin." + }, + "rbac": { + "$ref": "#/$defs/PluginsRBAC", + "description": "RBAC holds additional rbac configuration for the plugin" + }, + "command": { + "items": { + "type": "string" + }, + "type": "array", + "description": "Command is the command that should be used for the init container" + }, + "args": { + "items": { + "type": "string" + }, + "type": "array", + "description": "Args are the arguments that should be used for the init container" + }, + "securityContext": { + "type": "object", + "description": "SecurityContext is the container security context used for the init container" + }, + "resources": { + "type": "object", + "description": "Resources are the container resources used for the init container" + }, + "volumeMounts": { + "items": true, + "type": "array", + "description": "VolumeMounts are extra volume mounts for the init container" + } + }, + "additionalProperties": false, + "type": "object" + }, + "PluginsExtraRules": { + "properties": { + "extraRules": { + "items": { + "$ref": "#/$defs/RBACPolicyRule" + }, + "type": "array", + "description": "ExtraRules are extra rbac permissions roles that will be added to role or cluster role" + } + }, + "additionalProperties": false, + "type": "object" + }, + "PluginsRBAC": { + "properties": { + "role": { + "$ref": "#/$defs/PluginsExtraRules", + "description": "Role holds extra virtual cluster role permissions for the plugin" + }, + "clusterRole": { + "$ref": "#/$defs/PluginsExtraRules", + "description": "ClusterRole holds extra virtual cluster cluster role permissions required for the plugin" + } + }, + "additionalProperties": false, + "type": "object" + }, + "PodDNSConfig": { + "properties": { + "nameservers": { + "items": { + "type": "string" + }, + "type": "array", + "description": "A list of DNS name server IP addresses.\nThis will be appended to the base nameservers generated from DNSPolicy.\nDuplicated nameservers will be removed.\n+optional\n+listType=atomic" + }, + "searches": { + "items": { + "type": "string" + }, + "type": "array", + "description": "A list of DNS search domains for host-name lookup.\nThis will be appended to the base search paths generated from DNSPolicy.\nDuplicated search paths will be removed.\n+optional\n+listType=atomic" + }, + "options": { + "items": { + "$ref": "#/$defs/PodDNSConfigOption" + }, + "type": "array", + "description": "A list of DNS resolver options.\nThis will be merged with the base options generated from DNSPolicy.\nDuplicated entries will be removed. Resolution options given in Options\nwill override those that appear in the base DNSPolicy.\n+optional\n+listType=atomic" + } + }, + "additionalProperties": false, + "type": "object", + "description": "PodDNSConfig defines the DNS parameters of a pod in addition to those generated from DNSPolicy." + }, + "PodDNSConfigOption": { + "properties": { + "name": { + "type": "string", + "description": "Required." + }, + "value": { + "type": "string", + "description": "+optional" + } + }, + "additionalProperties": false, + "type": "object", + "description": "PodDNSConfigOption defines DNS resolver options of a pod." + }, + "Policies": { + "properties": { + "networkPolicy": { + "$ref": "#/$defs/NetworkPolicy", + "description": "NetworkPolicy specifies network policy options." + }, + "podSecurityStandard": { + "type": "string", + "description": "PodSecurityStandard that can be enforced can be one of: empty (\"\"), baseline, restricted or privileged" + }, + "resourceQuota": { + "$ref": "#/$defs/ResourceQuota", + "description": "ResourceQuota specifies resource quota options." + }, + "limitRange": { + "$ref": "#/$defs/LimitRange", + "description": "LimitRange specifies limit range options." + }, + "centralAdmission": { + "$ref": "#/$defs/CentralAdmission", + "description": "CentralAdmission defines what validating or mutating webhooks should be enforced within the virtual cluster.", + "pro": true + } + }, + "additionalProperties": false, + "type": "object" + }, + "PrivateNodes": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if dedicated nodes should be enabled." + }, + "kubelet": { + "$ref": "#/$defs/Kubelet", + "description": "Kubelet holds kubelet configuration that is used for all nodes." + }, + "autoUpgrade": { + "$ref": "#/$defs/AutoUpgrade", + "description": "AutoUpgrade holds configuration for auto upgrade." + }, + "joinNode": { + "$ref": "#/$defs/JoinConfiguration", + "description": "JoinNode holds configuration specifically used during joining the node (see \"kubeadm join\")." + }, + "autoNodes": { + "$ref": "#/$defs/PrivateNodesAutoNodes", + "description": "AutoNodes stores Auto Nodes configuration static and dynamic NodePools managed by Karpenter" + }, + "vpn": { + "$ref": "#/$defs/PrivateNodesVPN", + "description": "VPN holds configuration for the private nodes vpn. This can be used to connect the private nodes to the control plane or\nconnect the private nodes to each other if they are not running in the same network. Platform connection is required for the vpn to work." + } + }, + "additionalProperties": false, + "type": "object", + "description": "PrivateNodes enables private nodes for vCluster." + }, + "PrivateNodesAutoNodes": { + "properties": { + "static": { + "items": { + "$ref": "#/$defs/StaticNodePool" + }, + "type": "array", + "description": "Static defines static node pools. Static node pools have a fixed size and are not scaled automatically." + }, + "dynamic": { + "items": { + "$ref": "#/$defs/DynamicNodePool" + }, + "type": "array", + "description": "Dynamic defines dynamic node pools. Dynamic node pools are scaled automatically based on the requirements within the cluster.\nKarpenter is used under the hood to handle the scheduling of the nodes." + } + }, + "additionalProperties": false, + "type": "object", + "description": "PrivateNodesAutoNodes defines auto nodes" + }, + "PrivateNodesVPN": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if the private nodes vpn should be enabled." + }, + "nodeToNode": { + "$ref": "#/$defs/PrivateNodesVPNNodeToNode", + "description": "NodeToNode holds configuration for the node to node vpn. This can be used to connect the private nodes to each other if they are not running in the same network." + } + }, + "additionalProperties": false, + "type": "object" + }, + "PrivateNodesVPNNodeToNode": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if the node to node vpn should be enabled." + } + }, + "additionalProperties": false, + "type": "object" + }, + "RBAC": { + "properties": { + "role": { + "$ref": "#/$defs/RBACRole", + "description": "Role holds virtual cluster role configuration" + }, + "clusterRole": { + "$ref": "#/$defs/RBACClusterRole", + "description": "ClusterRole holds virtual cluster cluster role configuration" + } + }, + "additionalProperties": false, + "type": "object" + }, + "RBACClusterRole": { + "properties": { + "enabled": { + "oneOf": [ + { + "type": "string" + }, + { + "type": "boolean" + } + ], + "description": "Enabled defines if the cluster role should be enabled or disabled. If auto, vCluster automatically determines whether the virtual cluster requires a cluster role." + }, + "extraRules": { + "items": { + "type": "object" + }, + "type": "array", + "description": "ExtraRules will add rules to the cluster role." + }, + "overwriteRules": { + "items": { + "type": "object" + }, + "type": "array", + "description": "OverwriteRules will overwrite the cluster role rules completely." + } + }, + "additionalProperties": false, + "type": "object" + }, + "RBACPolicyRule": { + "properties": { + "verbs": { + "items": { + "type": "string" + }, + "type": "array", + "description": "Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs." + }, + "apiGroups": { + "items": { + "type": "string" + }, + "type": "array", + "description": "APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of\nthe enumerated resources in any API group will be allowed. \"\" represents the core API group and \"*\" represents all API groups." + }, + "resources": { + "items": { + "type": "string" + }, + "type": "array", + "description": "Resources is a list of resources this rule applies to. '*' represents all resources." + }, + "resourceNames": { + "items": { + "type": "string" + }, + "type": "array", + "description": "ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed." + }, + "nonResourceURLs": { + "items": { + "type": "string" + }, + "type": "array", + "description": "NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path\nSince non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.\nRules can either apply to API resources (such as \"pods\" or \"secrets\") or non-resource URL paths (such as \"/api\"), but not both." + } + }, + "additionalProperties": false, + "type": "object" + }, + "RBACRole": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if the role should be enabled or disabled." + }, + "extraRules": { + "items": { + "type": "object" + }, + "type": "array", + "description": "ExtraRules will add rules to the role." + }, + "overwriteRules": { + "items": { + "type": "object" + }, + "type": "array", + "description": "OverwriteRules will overwrite the role rules completely." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ReadinessProbe": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if this option should be enabled." + }, + "failureThreshold": { + "type": "integer", + "description": "Number of consecutive failures for the probe to be considered failed" + }, + "timeoutSeconds": { + "type": "integer", + "description": "Maximum duration (in seconds) that the probe will wait for a response." + }, + "periodSeconds": { + "type": "integer", + "description": "Frequency (in seconds) to perform the probe" + } + }, + "additionalProperties": false, + "type": "object", + "description": "ReadinessProbe defines the configuration for the readiness probe." + }, + "Registry": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if the embedded registry should be enabled." + }, + "anonymousPull": { + "type": "boolean", + "description": "AnonymousPull allows enabling anonymous pull for the embedded registry. This allows anybody to pull images from the registry without authentication." + }, + "config": { + "description": "Config is the regular docker registry config. See https://distribution.github.io/distribution/about/configuration/ for more details." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ReplicateServices": { + "properties": { + "toHost": { + "items": { + "$ref": "#/$defs/ServiceMapping" + }, + "type": "array", + "description": "ToHost defines the services that should get synced from virtual cluster to the host cluster. If services are\nsynced to a different namespace than the virtual cluster is in, additional permissions for the other namespace\nare required." + }, + "fromHost": { + "items": { + "$ref": "#/$defs/ServiceMapping" + }, + "type": "array", + "description": "FromHost defines the services that should get synced from the host to the virtual cluster." + } + }, + "additionalProperties": false, + "type": "object" + }, + "Requirement": { + "properties": { + "property": { + "type": "string", + "description": "Property is the property on the node type to select." + }, + "operator": { + "type": "string", + "description": "Operator is the comparison operator, such as \"In\", \"NotIn\", \"Exists\". If empty, defaults to \"In\"." + }, + "values": { + "items": { + "type": "string" + }, + "type": "array", + "description": "Values is the list of values to use for comparison. This is mutually exclusive with value." + }, + "value": { + "type": "string", + "description": "Value is the value to use for comparison. This is mutually exclusive with values." + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "property" + ], + "description": "KarpenterRequirement defines a scheduling requirement for a dynamic node pool." + }, + "ResolveDNS": { + "properties": { + "hostname": { + "type": "string", + "description": "Hostname is the hostname within the vCluster that should be resolved from." + }, + "service": { + "type": "string", + "description": "Service is the virtual cluster service that should be resolved from." + }, + "namespace": { + "type": "string", + "description": "Namespace is the virtual cluster namespace that should be resolved from." + }, + "target": { + "$ref": "#/$defs/ResolveDNSTarget", + "description": "Target is the DNS target that should get mapped to" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ResolveDNSTarget": { + "properties": { + "hostname": { + "type": "string", + "description": "Hostname to use as a DNS target" + }, + "ip": { + "type": "string", + "description": "IP to use as a DNS target" + }, + "hostService": { + "type": "string", + "description": "HostService to target, format is hostNamespace/hostService" + }, + "hostNamespace": { + "type": "string", + "description": "HostNamespace to target" + }, + "vClusterService": { + "type": "string", + "description": "VClusterService format is hostNamespace/vClusterName/vClusterNamespace/vClusterService" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ResourceQuota": { + "properties": { + "enabled": { + "oneOf": [ + { + "type": "string" + }, + { + "type": "boolean" + } + ], + "description": "Enabled defines if the resource quota should be enabled. \"auto\" means that if limitRange is enabled,\nthe resourceQuota will be enabled as well." + }, + "quota": { + "type": "object", + "description": "Quota are the quota options" + }, + "scopeSelector": { + "type": "object", + "description": "ScopeSelector is the resource quota scope selector" + }, + "scopes": { + "items": { + "type": "string" + }, + "type": "array", + "description": "Scopes are the resource quota scopes" + }, + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Annotations are extra annotations for this resource." + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Labels are extra labels for this resource." + } + }, + "additionalProperties": false, + "type": "object" + }, + "Resources": { + "properties": { + "limits": { + "type": "object", + "description": "Limits are resource limits for the container" + }, + "requests": { + "type": "object", + "description": "Requests are minimal resources that will be consumed by the container" + } + }, + "additionalProperties": false, + "type": "object" + }, + "RuleWithVerbs": { + "properties": { + "apiGroups": { + "items": { + "type": "string" + }, + "type": "array", + "description": "APIGroups is the API groups the resources belong to. '*' is all groups." + }, + "apiVersions": { + "items": { + "type": "string" + }, + "type": "array", + "description": "APIVersions is the API versions the resources belong to. '*' is all versions." + }, + "resources": { + "items": { + "type": "string" + }, + "type": "array", + "description": "Resources is a list of resources this rule applies to." + }, + "scope": { + "type": "string", + "description": "Scope specifies the scope of this rule." + }, + "operations": { + "items": { + "type": "string" + }, + "type": "array", + "description": "Verb is the kube verb associated with the request for API requests, not the http verb. This includes things like list and watch.\nFor non-resource requests, this is the lowercase http verb.\nIf '*' is present, the length of the slice must be one." + } + }, + "additionalProperties": false, + "type": "object" + }, + "SelectorConfig": { + "properties": { + "selector": { + "$ref": "#/$defs/StandardLabelSelector" + } + }, + "additionalProperties": false, + "type": "object" + }, + "ServiceMapping": { + "properties": { + "from": { + "type": "string", + "description": "From is the service that should get synced. Can be either in the form name or namespace/name." + }, + "to": { + "type": "string", + "description": "To is the target service that it should get synced to. Can be either in the form name or namespace/name." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ServiceMonitor": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled configures if Helm should create the service monitor." + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Labels are the extra labels to add to the service monitor." + }, + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Annotations are the extra annotations to add to the service monitor." + } + }, + "additionalProperties": false, + "type": "object" + }, + "SleepMode": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled toggles the sleep mode functionality, allowing for disabling sleep mode without removing other config" + }, + "timeZone": { + "type": "string", + "description": "Timezone represents the timezone a sleep schedule should run against, defaulting to UTC if unset" + }, + "autoSleep": { + "$ref": "#/$defs/SleepModeAutoSleep", + "description": "AutoSleep holds autoSleep details" + }, + "autoWakeup": { + "$ref": "#/$defs/AutoWakeup", + "description": "AutoWakeup holds configuration for waking the vCluster on a schedule rather than waiting for some activity." + } + }, + "additionalProperties": false, + "type": "object", + "description": "SleepMode holds configuration for native/workload only sleep mode" + }, + "SleepModeAutoSleep": { + "properties": { + "afterInactivity": { + "type": "string", + "description": "AfterInactivity represents how long a vCluster can be idle before workloads are automaticaly put to sleep" + }, + "schedule": { + "type": "string", + "description": "Schedule represents a cron schedule for when to sleep workloads" + }, + "exclude": { + "$ref": "#/$defs/AutoSleepExclusion", + "description": "Exclude holds configuration for labels that, if present, will prevent a workload from going to sleep" + } + }, + "additionalProperties": false, + "type": "object", + "description": "SleepModeAutoSleep holds configuration for allowing a vCluster to sleep its workloads automatically" + }, + "Standalone": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if standalone mode should be enabled." + }, + "dataDir": { + "type": "string", + "description": "DataDir defines the data directory for the standalone mode." + }, + "autoNodes": { + "$ref": "#/$defs/StandaloneAutoNodes", + "description": "AutoNodes automatically deploys nodes for standalone mode." + }, + "joinNode": { + "$ref": "#/$defs/StandaloneJoinNode", + "description": "JoinNode holds configuration for the standalone control plane node." + } + }, + "additionalProperties": false, + "type": "object" + }, + "StandaloneAutoNodes": { + "properties": { + "provider": { + "type": "string", + "description": "Provider is the node provider of the nodes in this pool." + }, + "quantity": { + "type": "integer", + "description": "Quantity is the number of nodes to deploy for standalone mode." + }, + "requirements": { + "items": { + "$ref": "#/$defs/Requirement" + }, + "type": "array", + "description": "Requirements filter the types of nodes that can be provisioned by this pool.\nAll requirements must be met for a node type to be eligible." + } + }, + "additionalProperties": false, + "type": "object" + }, + "StandaloneJoinNode": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if the standalone node should be joined into the cluster. If false, only the control plane binaries will be executed and no node will show up in the actual cluster." + }, + "preInstallCommands": { + "items": { + "type": "string" + }, + "type": "array", + "description": "PreInstallCommands are commands that will be executed before containerd, kubelet etc. is installed." + }, + "preJoinCommands": { + "items": { + "type": "string" + }, + "type": "array", + "description": "PreJoinCommands are commands that will be executed before kubeadm join is executed." + }, + "postJoinCommands": { + "items": { + "type": "string" + }, + "type": "array", + "description": "PostJoinCommands are commands that will be executed after kubeadm join is executed." + }, + "containerd": { + "$ref": "#/$defs/ContainerdJoin", + "description": "Containerd holds configuration for the containerd join process." + }, + "caCertPath": { + "type": "string", + "description": "CACertPath is the path to the SSL certificate authority used to\nsecure communications between node and control-plane.\nDefaults to \"/etc/kubernetes/pki/ca.crt\"." + }, + "skipPhases": { + "items": { + "type": "string" + }, + "type": "array", + "description": "SkipPhases is a list of phases to skip during command execution.\nThe list of phases can be obtained with the \"kubeadm join --help\" command." + }, + "nodeRegistration": { + "$ref": "#/$defs/NodeRegistration", + "description": "NodeRegistration holds configuration for the node registration similar to the kubeadm node registration." + } + }, + "additionalProperties": false, + "type": "object" + }, + "StandardLabelSelector": { + "properties": { + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "matchExpressions": { + "items": { + "$ref": "#/$defs/LabelSelectorRequirement" + }, + "type": "array" + } + }, + "additionalProperties": false, + "type": "object" + }, + "StartupProbe": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if this option should be enabled." + }, + "failureThreshold": { + "type": "integer", + "description": "Number of consecutive failures allowed before failing the pod" + }, + "timeoutSeconds": { + "type": "integer", + "description": "Maximum duration (in seconds) that the probe will wait for a response." + }, + "periodSeconds": { + "type": "integer", + "description": "Frequency (in seconds) to perform the probe" + } + }, + "additionalProperties": false, + "type": "object", + "description": "StartupProbe defines the configuration for the startup probe." + }, + "StaticNodePool": { + "properties": { + "name": { + "type": "string", + "description": "Name is the name of this static nodePool" + }, + "provider": { + "type": "string", + "description": "Provider is the node provider of the nodes in this pool." + }, + "requirements": { + "items": { + "$ref": "#/$defs/Requirement" + }, + "type": "array", + "description": "Requirements filter the types of nodes that can be provisioned by this pool.\nAll requirements must be met for a node type to be eligible." + }, + "taints": { + "items": { + "$ref": "#/$defs/KubeletJoinTaint" + }, + "type": "array", + "description": "Taints are the taints to apply to the nodes in this pool." + }, + "nodeLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "NodeLabels are the labels to apply to the nodes in this pool." + }, + "terminationGracePeriod": { + "type": "string", + "description": "TerminationGracePeriod is the maximum duration the controller will wait before forcefully deleting the pods on a node, measured from when deletion is first initiated.\n\nWarning: this feature takes precedence over a Pod's terminationGracePeriodSeconds value, and bypasses any blocked PDBs or the karpenter.sh/do-not-disrupt annotation.\n\nThis field is intended to be used by cluster administrators to enforce that nodes can be cycled within a given time period.\nWhen set, drifted nodes will begin draining even if there are pods blocking eviction. Draining will respect PDBs and the do-not-disrupt annotation until the TGP is reached.\n\nKarpenter will preemptively delete pods so their terminationGracePeriodSeconds align with the node's terminationGracePeriod.\nIf a pod would be terminated without being granted its full terminationGracePeriodSeconds prior to the node timeout,\nthat pod will be deleted at T = node timeout - pod terminationGracePeriodSeconds.\n\nThe feature can also be used to allow maximum time limits for long-running jobs which can delay node termination with preStop hooks.\nDefaults to 30s. Set to Never to wait indefinitely for pods to be drained." + }, + "quantity": { + "type": "integer", + "description": "Quantity is the number of desired nodes in this pool." + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "name", + "provider", + "quantity" + ] + }, + "Sync": { + "properties": { + "toHost": { + "$ref": "#/$defs/SyncToHost", + "description": "Configure resources to sync from the virtual cluster to the host cluster." + }, + "fromHost": { + "$ref": "#/$defs/SyncFromHost", + "description": "Configure what resources vCluster should sync from the host cluster to the virtual cluster." + } + }, + "additionalProperties": false, + "type": "object" + }, + "SyncAllResource": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if this option should be enabled." + }, + "all": { + "type": "boolean", + "description": "All defines if all resources of that type should get synced or only the necessary ones that are needed." + }, + "patches": { + "items": { + "$ref": "#/$defs/TranslatePatch" + }, + "type": "array", + "description": "Patches patch the resource according to the provided specification." + } + }, + "additionalProperties": false, + "type": "object" + }, + "SyncFromHost": { + "properties": { + "nodes": { + "$ref": "#/$defs/SyncNodes", + "description": "Nodes defines if nodes should get synced from the host cluster to the virtual cluster, but not back." + }, + "events": { + "$ref": "#/$defs/EnableSwitchWithPatches", + "description": "Events defines if events should get synced from the host cluster to the virtual cluster, but not back." + }, + "ingressClasses": { + "$ref": "#/$defs/EnableSwitchWithPatchesAndSelector", + "description": "IngressClasses defines if ingress classes should get synced from the host cluster to the virtual cluster, but not back." + }, + "runtimeClasses": { + "$ref": "#/$defs/EnableSwitchWithPatchesAndSelector", + "description": "RuntimeClasses defines if runtime classes should get synced from the host cluster to the virtual cluster, but not back." + }, + "priorityClasses": { + "$ref": "#/$defs/EnableSwitchWithPatchesAndSelector", + "description": "PriorityClasses defines if priority classes classes should get synced from the host cluster to the virtual cluster, but not back." + }, + "storageClasses": { + "$ref": "#/$defs/EnableAutoSwitchWithPatchesAndSelector", + "description": "StorageClasses defines if storage classes should get synced from the host cluster to the virtual cluster, but not back. If auto, is automatically enabled when the virtual scheduler is enabled." + }, + "csiNodes": { + "$ref": "#/$defs/EnableAutoSwitchWithPatches", + "description": "CSINodes defines if csi nodes should get synced from the host cluster to the virtual cluster, but not back. If auto, is automatically enabled when the virtual scheduler is enabled." + }, + "csiDrivers": { + "$ref": "#/$defs/EnableAutoSwitchWithPatches", + "description": "CSIDrivers defines if csi drivers should get synced from the host cluster to the virtual cluster, but not back. If auto, is automatically enabled when the virtual scheduler is enabled." + }, + "csiStorageCapacities": { + "$ref": "#/$defs/EnableAutoSwitchWithPatches", + "description": "CSIStorageCapacities defines if csi storage capacities should get synced from the host cluster to the virtual cluster, but not back. If auto, is automatically enabled when the virtual scheduler is enabled." + }, + "customResources": { + "additionalProperties": { + "$ref": "#/$defs/SyncFromHostCustomResource" + }, + "type": "object", + "description": "CustomResources defines what custom resources should get synced read-only to the virtual cluster from the host cluster. vCluster will automatically add any required RBAC to the vCluster cluster role." + }, + "volumeSnapshotClasses": { + "$ref": "#/$defs/EnableSwitchWithPatches", + "description": "VolumeSnapshotClasses defines if volume snapshot classes created within the virtual cluster should get synced to the host cluster." + }, + "configMaps": { + "$ref": "#/$defs/EnableSwitchWithResourcesMappings", + "description": "ConfigMaps defines if config maps in the host should get synced to the virtual cluster." + }, + "secrets": { + "$ref": "#/$defs/EnableSwitchWithResourcesMappings", + "description": "Secrets defines if secrets in the host should get synced to the virtual cluster." + } + }, + "additionalProperties": false, + "type": "object" + }, + "SyncFromHostCustomResource": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if this option should be enabled." + }, + "scope": { + "type": "string", + "description": "Scope defines the scope of the resource" + }, + "patches": { + "items": { + "$ref": "#/$defs/TranslatePatch" + }, + "type": "array", + "description": "Patches patch the resource according to the provided specification." + }, + "mappings": { + "$ref": "#/$defs/FromHostMappings", + "description": "Mappings for Namespace and Object" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "enabled", + "scope" + ] + }, + "SyncNodeSelector": { + "properties": { + "all": { + "type": "boolean", + "description": "All specifies if all nodes should get synced by vCluster from the host to the virtual cluster or only the ones where pods are assigned to." + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Labels are the node labels used to sync nodes from host cluster to virtual cluster. This will also set the node selector when syncing a pod from virtual cluster to host cluster to the same value." + } + }, + "additionalProperties": false, + "type": "object" + }, + "SyncNodes": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled specifies if syncing real nodes should be enabled. If this is disabled, vCluster will create fake nodes instead." + }, + "syncBackChanges": { + "type": "boolean", + "description": "SyncBackChanges enables syncing labels and taints from the virtual cluster to the host cluster. If this is enabled someone within the virtual cluster will be able to change the labels and taints of the host cluster node." + }, + "clearImageStatus": { + "type": "boolean", + "description": "ClearImageStatus will erase the image status when syncing a node. This allows to hide images that are pulled by the node." + }, + "selector": { + "$ref": "#/$defs/SyncNodeSelector", + "description": "Selector can be used to define more granular what nodes should get synced from the host cluster to the virtual cluster." + }, + "patches": { + "items": { + "$ref": "#/$defs/TranslatePatch" + }, + "type": "array", + "description": "Patches patch the resource according to the provided specification." + } + }, + "additionalProperties": false, + "type": "object" + }, + "SyncPods": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if pod syncing should be enabled." + }, + "translateImage": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "TranslateImage maps an image to another image that should be used instead. For example this can be used to rewrite\na certain image that is used within the virtual cluster to be another image on the host cluster" + }, + "enforceTolerations": { + "items": { + "type": "string" + }, + "type": "array", + "description": "EnforceTolerations will add the specified tolerations to all pods synced by the virtual cluster." + }, + "useSecretsForSATokens": { + "type": "boolean", + "description": "UseSecretsForSATokens will use secrets to save the generated service account tokens by virtual cluster instead of using a\npod annotation." + }, + "runtimeClassName": { + "type": "string", + "description": "RuntimeClassName is the runtime class to set for synced pods." + }, + "priorityClassName": { + "type": "string", + "description": "PriorityClassName is the priority class to set for synced pods." + }, + "rewriteHosts": { + "$ref": "#/$defs/SyncRewriteHosts", + "description": "RewriteHosts is a special option needed to rewrite statefulset containers to allow the correct FQDN. virtual cluster will add\na small container to each stateful set pod that will initially rewrite the /etc/hosts file to match the FQDN expected by\nthe virtual cluster." + }, + "patches": { + "items": { + "$ref": "#/$defs/TranslatePatch" + }, + "type": "array", + "description": "Patches patch the resource according to the provided specification." + }, + "hybridScheduling": { + "$ref": "#/$defs/HybridScheduling", + "description": "HybridScheduling is used to enable and configure hybrid scheduling for pods in the virtual cluster." + } + }, + "additionalProperties": false, + "type": "object" + }, + "SyncRewriteHosts": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled specifies if rewriting stateful set pods should be enabled." + }, + "initContainer": { + "$ref": "#/$defs/SyncRewriteHostsInitContainer", + "description": "InitContainer holds extra options for the init container used by vCluster to rewrite the FQDN for stateful set pods." + } + }, + "additionalProperties": false, + "type": "object" + }, + "SyncRewriteHostsInitContainer": { + "properties": { + "image": { + "$ref": "#/$defs/Image", + "description": "Image is the image virtual cluster should use to rewrite this FQDN." + }, + "resources": { + "$ref": "#/$defs/Resources", + "description": "Resources are the resources that should be assigned to the init container for each stateful set init container." + } + }, + "additionalProperties": false, + "type": "object" + }, + "SyncToHost": { + "properties": { + "pods": { + "$ref": "#/$defs/SyncPods", + "description": "Pods defines if pods created within the virtual cluster should get synced to the host cluster." + }, + "secrets": { + "$ref": "#/$defs/SyncAllResource", + "description": "Secrets defines if secrets created within the virtual cluster should get synced to the host cluster." + }, + "configMaps": { + "$ref": "#/$defs/SyncAllResource", + "description": "ConfigMaps defines if config maps created within the virtual cluster should get synced to the host cluster." + }, + "ingresses": { + "$ref": "#/$defs/EnableSwitchWithPatches", + "description": "Ingresses defines if ingresses created within the virtual cluster should get synced to the host cluster." + }, + "services": { + "$ref": "#/$defs/EnableSwitchWithPatches", + "description": "Services defines if services created within the virtual cluster should get synced to the host cluster." + }, + "endpoints": { + "$ref": "#/$defs/EnableSwitchWithPatches", + "description": "Endpoints defines if endpoints created within the virtual cluster should get synced to the host cluster." + }, + "networkPolicies": { + "$ref": "#/$defs/EnableSwitchWithPatches", + "description": "NetworkPolicies defines if network policies created within the virtual cluster should get synced to the host cluster." + }, + "persistentVolumeClaims": { + "$ref": "#/$defs/EnableSwitchWithPatches", + "description": "PersistentVolumeClaims defines if persistent volume claims created within the virtual cluster should get synced to the host cluster." + }, + "persistentVolumes": { + "$ref": "#/$defs/EnableSwitchWithPatches", + "description": "PersistentVolumes defines if persistent volumes created within the virtual cluster should get synced to the host cluster." + }, + "volumeSnapshots": { + "$ref": "#/$defs/EnableSwitchWithPatches", + "description": "VolumeSnapshots defines if volume snapshots created within the virtual cluster should get synced to the host cluster." + }, + "volumeSnapshotContents": { + "$ref": "#/$defs/EnableSwitchWithPatches", + "description": "VolumeSnapshotContents defines if volume snapshot contents created within the virtual cluster should get synced to the host cluster." + }, + "storageClasses": { + "$ref": "#/$defs/EnableSwitchWithPatches", + "description": "StorageClasses defines if storage classes created within the virtual cluster should get synced to the host cluster." + }, + "serviceAccounts": { + "$ref": "#/$defs/EnableSwitchWithPatches", + "description": "ServiceAccounts defines if service accounts created within the virtual cluster should get synced to the host cluster." + }, + "podDisruptionBudgets": { + "$ref": "#/$defs/EnableSwitchWithPatches", + "description": "PodDisruptionBudgets defines if pod disruption budgets created within the virtual cluster should get synced to the host cluster." + }, + "priorityClasses": { + "$ref": "#/$defs/EnableSwitchWithPatches", + "description": "PriorityClasses defines if priority classes created within the virtual cluster should get synced to the host cluster." + }, + "customResources": { + "additionalProperties": { + "$ref": "#/$defs/SyncToHostCustomResource" + }, + "type": "object", + "description": "CustomResources defines what custom resources should get synced from the virtual cluster to the host cluster. vCluster will copy the definition automatically from host cluster to virtual cluster on startup.\nvCluster will also automatically add any required RBAC permissions to the vCluster role for this to work." + }, + "namespaces": { + "$ref": "#/$defs/SyncToHostNamespaces", + "description": "Namespaces defines if namespaces created within the virtual cluster should get synced to the host cluster." + } + }, + "additionalProperties": false, + "type": "object" + }, + "SyncToHostCustomResource": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if this option should be enabled." + }, + "scope": { + "type": "string", + "description": "Scope defines the scope of the resource. If undefined, will use Namespaced. Currently only Namespaced is supported." + }, + "patches": { + "items": { + "$ref": "#/$defs/TranslatePatch" + }, + "type": "array", + "description": "Patches patch the resource according to the provided specification." + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "enabled" + ] + }, + "SyncToHostNamespaces": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled defines if this option should be enabled." + }, + "patches": { + "items": { + "$ref": "#/$defs/TranslatePatch" + }, + "type": "array", + "description": "Patches patch the resource according to the provided specification." + }, + "mappings": { + "$ref": "#/$defs/FromHostMappings", + "description": "Mappings for Namespace and Object" + }, + "mappingsOnly": { + "type": "boolean", + "description": "MappingsOnly defines if creation of namespaces not matched by mappings should be allowed." + }, + "extraLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "ExtraLabels are additional labels to add to the namespace in the host cluster." + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "enabled" + ], + "description": "SyncToHostNamespaces defines how namespaces should be synced from the virtual cluster to the host cluster." + }, + "Telemetry": { + "properties": { + "enabled": { + "type": "boolean", + "description": "Enabled specifies that the telemetry for the vCluster control plane should be enabled." + }, + "instanceCreator": { + "type": "string" + }, + "machineID": { + "type": "string" + }, + "platformUserID": { + "type": "string" + }, + "platformInstanceID": { + "type": "string" + } + }, + "additionalProperties": false, + "type": "object" + }, + "TranslatePatch": { + "properties": { + "path": { + "type": "string", + "description": "Path is the path within the patch to target. If the path is not found within the patch, the patch is not applied." + }, + "expression": { + "type": "string", + "description": "Expression transforms the value according to the given JavaScript expression." + }, + "reverseExpression": { + "type": "string", + "description": "ReverseExpression transforms the value according to the given JavaScript expression." + }, + "reference": { + "$ref": "#/$defs/TranslatePatchReference", + "description": "Reference treats the path value as a reference to another object and will rewrite it based on the chosen mode\nautomatically. In single-namespace mode this will translate the name to \"vxxxxxxxxx\" to avoid conflicts with\nother names, in multi-namespace mode this will not translate the name." + }, + "labels": { + "$ref": "#/$defs/TranslatePatchLabels", + "description": "Labels treats the path value as a labels selector." + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "path" + ] + }, + "TranslatePatchLabels": { + "properties": {}, + "additionalProperties": false, + "type": "object" + }, + "TranslatePatchReference": { + "properties": { + "apiVersion": { + "type": "string", + "description": "APIVersion is the apiVersion of the referenced object." + }, + "apiVersionPath": { + "type": "string", + "description": "APIVersionPath is optional relative path to use to determine the kind. If APIVersionPath is not found, will fallback to apiVersion." + }, + "kind": { + "type": "string", + "description": "Kind is the kind of the referenced object." + }, + "kindPath": { + "type": "string", + "description": "KindPath is the optional relative path to use to determine the kind. If KindPath is not found, will fallback to kind." + }, + "namePath": { + "type": "string", + "description": "NamePath is the optional relative path to the reference name within the object." + }, + "namespacePath": { + "type": "string", + "description": "NamespacePath is the optional relative path to the reference namespace within the object. If omitted or not found, namespacePath equals to the\nmetadata.namespace path of the object." + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "apiVersion", + "kind" + ] + }, + "ValidatingWebhook": { + "properties": { + "name": { + "type": "string", + "description": "The name of the admission webhook.\nName should be fully qualified, e.g., imagepolicy.kubernetes.io, where\n\"imagepolicy\" is the name of the webhook, and kubernetes.io is the name\nof the organization." + }, + "clientConfig": { + "$ref": "#/$defs/ValidatingWebhookClientConfig", + "description": "ClientConfig defines how to communicate with the hook." + }, + "rules": { + "items": true, + "type": "array", + "description": "Rules describes what operations on what resources/subresources the webhook cares about.\nThe webhook cares about an operation if it matches _any_ Rule." + }, + "failurePolicy": { + "type": "string", + "description": "FailurePolicy defines how unrecognized errors from the admission endpoint are handled -\nallowed values are Ignore or Fail. Defaults to Fail." + }, + "matchPolicy": { + "type": "string", + "description": "matchPolicy defines how the \"rules\" list is used to match incoming requests.\nAllowed values are \"Exact\" or \"Equivalent\"." + }, + "namespaceSelector": { + "description": "NamespaceSelector decides whether to run the webhook on an object based\non whether the namespace for that object matches the selector. If the\nobject itself is a namespace, the matching is performed on\nobject.metadata.labels. If the object is another cluster scoped resource,\nit never skips the webhook." + }, + "objectSelector": { + "description": "ObjectSelector decides whether to run the webhook based on if the\nobject has matching labels. objectSelector is evaluated against both\nthe oldObject and newObject that would be sent to the webhook, and\nis considered to match if either object matches the selector." + }, + "sideEffects": { + "type": "string", + "description": "SideEffects states whether this webhook has side effects." + }, + "timeoutSeconds": { + "type": "integer", + "description": "TimeoutSeconds specifies the timeout for this webhook." + }, + "admissionReviewVersions": { + "items": { + "type": "string" + }, + "type": "array", + "description": "AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`\nversions the Webhook expects." + }, + "matchConditions": { + "items": true, + "type": "array", + "description": "MatchConditions is a list of conditions that must be met for a request to be sent to this\nwebhook. Match conditions filter requests that have already been matched by the rules,\nnamespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.\nThere are a maximum of 64 match conditions allowed." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ValidatingWebhookClientConfig": { + "properties": { + "url": { + "type": "string", + "description": "URL gives the location of the webhook, in standard URL form\n(`scheme://host:port/path`). Exactly one of `url` or `service`\nmust be specified." + }, + "service": { + "$ref": "#/$defs/ValidatingWebhookServiceReference", + "description": "Service is a reference to the service for this webhook. Either\n`service` or `url` must be specified.\n\nIf the webhook is running within the cluster, then you should use `service`." + }, + "caBundle": { + "type": "string", + "contentEncoding": "base64", + "description": "CABundle is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.\nIf unspecified, system trust roots on the apiserver are used." + } + }, + "additionalProperties": false, + "type": "object", + "description": "ValidatingWebhookClientConfig contains the information to make a TLS connection with the webhook" + }, + "ValidatingWebhookConfiguration": { + "properties": { + "kind": { + "type": "string", + "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to." + }, + "apiVersion": { + "type": "string", + "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values." + }, + "metadata": { + "$ref": "#/$defs/ObjectMeta", + "description": "Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata." + }, + "webhooks": { + "items": { + "$ref": "#/$defs/ValidatingWebhook" + }, + "type": "array", + "description": "Webhooks is a list of webhooks and the affected resources and operations." + } + }, + "additionalProperties": false, + "type": "object" + }, + "ValidatingWebhookServiceReference": { + "properties": { + "namespace": { + "type": "string", + "description": "Namespace is the namespace of the service." + }, + "name": { + "type": "string", + "description": "Name is the name of the service." + }, + "path": { + "type": "string", + "description": "Path is an optional URL path which will be sent in any request to\nthis service." + }, + "port": { + "type": "integer", + "description": "If specified, the port on the service that hosting webhook.\nDefault to 443 for backward compatibility.\n`port` should be a valid port number (1-65535, inclusive)." + } + }, + "additionalProperties": false, + "type": "object" + }, + "VirtualClusterKubeConfig": { + "properties": { + "kubeConfig": { + "type": "string", + "description": "KubeConfig is the virtual cluster kubeconfig path." + }, + "serverCAKey": { + "type": "string", + "description": "ServerCAKey is the server ca key path." + }, + "serverCACert": { + "type": "string", + "description": "ServerCAKey is the server ca cert path." + }, + "clientCACert": { + "type": "string", + "description": "ServerCAKey is the client ca cert path." + }, + "requestHeaderCACert": { + "type": "string", + "description": "RequestHeaderCACert is the request header ca cert path." + } + }, + "additionalProperties": false, + "type": "object" + }, + "VolumeClaim": { + "properties": { + "enabled": { + "oneOf": [ + { + "type": "string" + }, + { + "type": "boolean" + } + ], + "description": "Enabled enables deploying a persistent volume claim. If auto, vCluster will automatically determine\nbased on the chosen distro and other options if this is required." + }, + "accessModes": { + "items": { + "type": "string" + }, + "type": "array", + "description": "AccessModes are the persistent volume claim access modes." + }, + "retentionPolicy": { + "type": "string", + "description": "RetentionPolicy is the persistent volume claim retention policy." + }, + "size": { + "type": "string", + "description": "Size is the persistent volume claim storage size." + }, + "storageClass": { + "type": "string", + "description": "StorageClass is the persistent volume claim storage class." + } + }, + "additionalProperties": false, + "type": "object" + }, + "VolumeMount": { + "properties": { + "name": { + "type": "string", + "description": "This must match the Name of a Volume." + }, + "readOnly": { + "type": "boolean", + "description": "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false." + }, + "mountPath": { + "type": "string", + "description": "Path within the container at which the volume should be mounted. Must\nnot contain ':'." + }, + "subPath": { + "type": "string", + "description": "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root)." + }, + "mountPropagation": { + "type": "string", + "description": "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10." + }, + "subPathExpr": { + "type": "string", + "description": "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive." + } + }, + "additionalProperties": false, + "type": "object", + "description": "VolumeMount describes a mounting of a Volume within a container." + } + }, + "properties": { + "global": { + "description": "Global values shared across all (sub)charts" + }, + "exportKubeConfig": { + "$ref": "#/$defs/ExportKubeConfig", + "description": "ExportKubeConfig describes how vCluster should export the vCluster kubeConfig file." + }, + "sync": { + "$ref": "#/$defs/Sync", + "description": "Sync describes how to sync resources from the virtual cluster to host cluster and back." + }, + "integrations": { + "$ref": "#/$defs/Integrations", + "description": "Integrations holds config for vCluster integrations with other operators or tools running on the host cluster" + }, + "deploy": { + "$ref": "#/$defs/Deploy", + "description": "Deploy holds configuration for the deployment of vCluster." + }, + "networking": { + "$ref": "#/$defs/Networking", + "description": "Networking options related to the virtual cluster." + }, + "policies": { + "$ref": "#/$defs/Policies", + "description": "Policies to enforce for the virtual cluster deployment as well as within the virtual cluster." + }, + "controlPlane": { + "$ref": "#/$defs/ControlPlane", + "description": "Configure vCluster's control plane components and deployment." + }, + "privateNodes": { + "$ref": "#/$defs/PrivateNodes", + "description": "PrivateNodes holds configuration for vCluster private nodes mode." + }, + "rbac": { + "$ref": "#/$defs/RBAC", + "description": "RBAC options for the virtual cluster." + }, + "plugins": { + "anyOf": [ + { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object" + }, + { + "type": "object" + }, + { + "type": "object" + } + ], + "additionalProperties": { + "$ref": "#/$defs/Plugins" + }, + "description": "Define which vCluster plugins to load." + }, + "experimental": { + "$ref": "#/$defs/Experimental", + "description": "Experimental features for vCluster. Configuration here might change, so be careful with this." + }, + "external": { + "$ref": "#/$defs/ExternalConfig", + "description": "External holds configuration for tools that are external to the vCluster." + }, + "telemetry": { + "$ref": "#/$defs/Telemetry", + "description": "Configuration related to telemetry gathered about vCluster usage." + }, + "serviceCIDR": { + "type": "string", + "description": "ServiceCIDR holds the service cidr for the virtual cluster. Do not use this option anymore." + }, + "pro": { + "type": "boolean", + "description": "Specifies whether to use vCluster Pro. This is automatically inferred in newer versions. Do not use that option anymore." + }, + "plugin": { + "anyOf": [ + { + "patternProperties": { + ".*": { + "type": "string" + } + }, + "type": "object" + }, + { + "type": "object" + }, + { + "type": "object" + } + ], + "additionalProperties": { + "$ref": "#/$defs/Plugin" + }, + "description": "Plugin specifies which vCluster plugins to enable. Use \"plugins\" instead. Do not use this option anymore." + }, + "sleepMode": { + "$ref": "#/$defs/SleepMode", + "description": "SleepMode holds the native sleep mode configuration for Pro clusters" + }, + "logging": { + "$ref": "#/$defs/Logging", + "description": "Logging provides structured logging options" + } + }, + "additionalProperties": false, + "type": "object", + "description": "Config is the vCluster config." +} \ No newline at end of file diff --git a/charts/cf-vcluster/charts/vcluster/values.yaml b/charts/cf-vcluster/charts/vcluster/values.yaml new file mode 100644 index 0000000..a501f13 --- /dev/null +++ b/charts/cf-vcluster/charts/vcluster/values.yaml @@ -0,0 +1,1236 @@ +# Sync describes how to sync resources from the virtual cluster to host cluster and back. +sync: + # Configure resources to sync from the virtual cluster to the host cluster. + toHost: + # Services defines if services created within the virtual cluster should get synced to the host cluster. + services: + # Enabled defines if this option should be enabled. + enabled: true + # Endpoints defines if endpoints created within the virtual cluster should get synced to the host cluster. + endpoints: + # Enabled defines if this option should be enabled. + enabled: true + # PersistentVolumeClaims defines if persistent volume claims created within the virtual cluster should get synced to the host cluster. + persistentVolumeClaims: + # Enabled defines if this option should be enabled. + enabled: true + # ConfigMaps defines if config maps created within the virtual cluster should get synced to the host cluster. + configMaps: + enabled: true + # All defines if all resources of that type should get synced or only the necessary ones that are needed. + all: false + # Secrets defines if secrets created within the virtual cluster should get synced to the host cluster. + secrets: + enabled: true + # All defines if all resources of that type should get synced or only the necessary ones that are needed. + all: false + # Pods defines if pods created within the virtual cluster should get synced to the host cluster. + pods: + # Enabled defines if pod syncing should be enabled. + enabled: true + # TranslateImage maps an image to another image that should be used instead. For example this can be used to rewrite + # a certain image that is used within the virtual cluster to be another image on the host cluster + translateImage: {} + # EnforceTolerations will add the specified tolerations to all pods synced by the virtual cluster. + enforceTolerations: [] + # HybridScheduling is used to enable and configure hybrid scheduling for pods in the virtual cluster. + hybridScheduling: + # Enabled specifies if hybrid scheduling is enabled. + enabled: false + # HostSchedulers is a list of schedulers that are deployed on the host cluster. + hostSchedulers: [] + # UseSecretsForSATokens will use secrets to save the generated service account tokens by virtual cluster instead of using a + # pod annotation. + useSecretsForSATokens: false + # RuntimeClassName is the runtime class to set for synced pods. + runtimeClassName: "" + # PriorityClassName is the priority class to set for synced pods. + priorityClassName: "" + # RewriteHosts is a special option needed to rewrite statefulset containers to allow the correct FQDN. virtual cluster will add + # a small container to each stateful set pod that will initially rewrite the /etc/hosts file to match the FQDN expected by + # the virtual cluster. + rewriteHosts: + # Enabled specifies if rewriting stateful set pods should be enabled. + enabled: true + # InitContainer holds extra options for the init container used by vCluster to rewrite the FQDN for stateful set pods. + initContainer: + # Image is the image virtual cluster should use to rewrite this FQDN. + image: + # Registry is the registry of the container image, e.g. my-registry.com or ghcr.io. This setting can be globally + # overridden via the controlPlane.advanced.defaultImageRegistry option. Empty means docker hub. + registry: "mirror.gcr.io" + # Repository is the repository of the container image, e.g. my-repo/my-image + repository: library/alpine + # Tag is the tag of the container image, and is the default version. + tag: "3.20" + # Resources are the resources that should be assigned to the init container for each stateful set init container. + resources: + # Limits are resource limits for the container + limits: + cpu: 30m + memory: 64Mi + # Requests are minimal resources that will be consumed by the container + requests: + cpu: 30m + memory: 64Mi + # Ingresses defines if ingresses created within the virtual cluster should get synced to the host cluster. + ingresses: + # Enabled defines if this option should be enabled. + enabled: false + # PriorityClasses defines if priority classes created within the virtual cluster should get synced to the host cluster. + priorityClasses: + # Enabled defines if this option should be enabled. + enabled: false + # NetworkPolicies defines if network policies created within the virtual cluster should get synced to the host cluster. + networkPolicies: + # Enabled defines if this option should be enabled. + enabled: false + # VolumeSnapshots defines if volume snapshots created within the virtual cluster should get synced to the host cluster. + volumeSnapshots: + # Enabled defines if this option should be enabled. + enabled: false + # VolumeSnapshotContents defines if volume snapshot contents created within the virtual cluster should get synced to the host cluster. + volumeSnapshotContents: + # Enabled defines if this option should be enabled. + enabled: false + # PodDisruptionBudgets defines if pod disruption budgets created within the virtual cluster should get synced to the host cluster. + podDisruptionBudgets: + # Enabled defines if this option should be enabled. + enabled: false + # ServiceAccounts defines if service accounts created within the virtual cluster should get synced to the host cluster. + serviceAccounts: + # Enabled defines if this option should be enabled. + enabled: false + # StorageClasses defines if storage classes created within the virtual cluster should get synced to the host cluster. + storageClasses: + # Enabled defines if this option should be enabled. + enabled: false + # PersistentVolumes defines if persistent volumes created within the virtual cluster should get synced to the host cluster. + persistentVolumes: + # Enabled defines if this option should be enabled. + enabled: false + # Namespaces defines if namespaces created within the virtual cluster should get synced to the host cluster. + namespaces: + # Enabled defines if this option should be enabled. + enabled: false + # MappingsOnly defines if creation of namespaces not matched by mappings should be allowed. + mappingsOnly: false + + # Configure what resources vCluster should sync from the host cluster to the virtual cluster. + fromHost: + # Events defines if events should get synced from the host cluster to the virtual cluster, but not back. + events: + # Enabled defines if this option should be enabled. + enabled: true + # ConfigMaps defines if config maps in the host should get synced to the virtual cluster. + configMaps: + # Enabled defines if this option should be enabled. + enabled: false + # Mappings for Namespace and Object + mappings: + # ByName is a map of host-object-namespace/host-object-name: virtual-object-namespace/virtual-object-name. + # There are several wildcards supported: + # 1. To match all objects in host namespace and sync them to different namespace in vCluster: + # byName: + # "foo/*": "foo-in-virtual/*" + # 2. To match specific object in the host namespace and sync it to the same namespace with the same name: + # byName: + # "foo/my-object": "foo/my-object" + # 3. To match specific object in the host namespace and sync it to the same namespace with different name: + # byName: + # "foo/my-object": "foo/my-virtual-object" + # 4. To match all objects in the vCluster host namespace and sync them to a different namespace in vCluster: + # byName: + # "": "my-virtual-namespace/*" + # 5. To match specific objects in the vCluster host namespace and sync them to a different namespace in vCluster: + # byName: + # "/my-object": "my-virtual-namespace/my-object" + byName: {} + # CSIDrivers defines if csi drivers should get synced from the host cluster to the virtual cluster, but not back. If auto, is automatically enabled when the virtual scheduler is enabled. + csiDrivers: + # Enabled defines if this option should be enabled. + enabled: auto + # CSINodes defines if csi nodes should get synced from the host cluster to the virtual cluster, but not back. If auto, is automatically enabled when the virtual scheduler is enabled. + csiNodes: + # Enabled defines if this option should be enabled. + enabled: auto + # CSIStorageCapacities defines if csi storage capacities should get synced from the host cluster to the virtual cluster, but not back. If auto, is automatically enabled when the virtual scheduler is enabled. + csiStorageCapacities: + # Enabled defines if this option should be enabled. + enabled: auto + # StorageClasses defines if storage classes should get synced from the host cluster to the virtual cluster, but not back. If auto, is automatically enabled when the virtual scheduler is enabled. + storageClasses: + # Enabled defines if this option should be enabled. + enabled: auto + # IngressClasses defines if ingress classes should get synced from the host cluster to the virtual cluster, but not back. + ingressClasses: + # Enabled defines if this option should be enabled. + enabled: false + # RuntimeClasses defines if runtime classes should get synced from the host cluster to the virtual cluster, but not back. + runtimeClasses: + # Enabled defines if this option should be enabled. + enabled: false + # PriorityClasses defines if priority classes classes should get synced from the host cluster to the virtual cluster, but not back. + priorityClasses: + # Enabled defines if this option should be enabled. + enabled: false + # Nodes defines if nodes should get synced from the host cluster to the virtual cluster, but not back. + nodes: + # Enabled specifies if syncing real nodes should be enabled. If this is disabled, vCluster will create fake nodes instead. + enabled: false + # SyncBackChanges enables syncing labels and taints from the virtual cluster to the host cluster. If this is enabled someone within the virtual cluster will be able to change the labels and taints of the host cluster node. + syncBackChanges: false + # ClearImageStatus will erase the image status when syncing a node. This allows to hide images that are pulled by the node. + clearImageStatus: false + # Selector can be used to define more granular what nodes should get synced from the host cluster to the virtual cluster. + selector: + # All specifies if all nodes should get synced by vCluster from the host to the virtual cluster or only the ones where pods are assigned to. + all: false + labels: {} + # Secrets defines if secrets in the host should get synced to the virtual cluster. + secrets: + # Enabled defines if this option should be enabled. + enabled: false + # Mappings for Namespace and Object + mappings: + # ByName is a map of host-object-namespace/host-object-name: virtual-object-namespace/virtual-object-name. + # There are several wildcards supported: + # 1. To match all objects in host namespace and sync them to different namespace in vCluster: + # byName: + # "foo/*": "foo-in-virtual/*" + # 2. To match specific object in the host namespace and sync it to the same namespace with the same name: + # byName: + # "foo/my-object": "foo/my-object" + # 3. To match specific object in the host namespace and sync it to the same namespace with different name: + # byName: + # "foo/my-object": "foo/my-virtual-object" + # 4. To match all objects in the vCluster host namespace and sync them to a different namespace in vCluster: + # byName: + # "": "my-virtual-namespace/*" + # 5. To match specific objects in the vCluster host namespace and sync them to a different namespace in vCluster: + # byName: + # "/my-object": "my-virtual-namespace/my-object" + byName: {} + # VolumeSnapshotClasses defines if volume snapshot classes created within the virtual cluster should get synced to the host cluster. + volumeSnapshotClasses: + # Enabled defines if this option should be enabled. + enabled: false + +# Configure vCluster's control plane components and deployment. +controlPlane: + # Distro holds virtual cluster related distro options. A distro cannot be changed after vCluster is deployed. + distro: + # K8S holds K8s relevant configuration. + k8s: + # Enabled specifies if the K8s distro should be enabled. Only one distro can be enabled at the same time. + enabled: false + # [Deprecated] Version field is deprecated. + # Use controlPlane.distro.k8s.image.tag to specify the Kubernetes version instead. + version: "" + # ImagePullPolicy is the pull policy for the distro image + imagePullPolicy: "" + # Image is the distro image + image: + # Registry is the registry of the container image, e.g. my-registry.com or ghcr.io. This setting can be globally + # overridden via the controlPlane.advanced.defaultImageRegistry option. Empty means docker hub. + registry: ghcr.io + # Repository is the repository of the container image, e.g. my-repo/my-image + repository: "loft-sh/kubernetes" + # Tag is the tag of the container image, and is the default version. + tag: "v1.33.4" + # APIServer holds configuration specific to starting the api server. + apiServer: + enabled: true + # Command is the command to start the distro binary. This will override the existing command. + command: [] + # ExtraArgs are additional arguments to pass to the distro binary. + extraArgs: [] + # ControllerManager holds configuration specific to starting the controller manager. + controllerManager: + enabled: true + # Command is the command to start the distro binary. This will override the existing command. + command: [] + # ExtraArgs are additional arguments to pass to the distro binary. + extraArgs: [] + # Scheduler holds configuration specific to starting the scheduler. + scheduler: + enabled: false + # Command is the command to start the distro binary. This will override the existing command. + command: [] + # ExtraArgs are additional arguments to pass to the distro binary. + extraArgs: [] + # Env are extra environment variables to use for the main container and NOT the init container. + env: [] + # Security options can be used for the distro init container + securityContext: {} + # Resources for the distro init container + resources: + limits: + cpu: 100m + memory: 256Mi + requests: + cpu: 40m + memory: 64Mi + # [Deprecated] K3S holds K3s relevant configuration. + k3s: + # Enabled specifies if the K3s distro should be enabled. Only one distro can be enabled at the same time. + enabled: false + # Command is the command to start the distro binary. This will override the existing command. + command: [] + # ExtraArgs are additional arguments to pass to the distro binary. + extraArgs: [] + # ImagePullPolicy is the pull policy for the distro image + imagePullPolicy: "" + # Image is the distro image + image: + # Registry is the registry of the container image, e.g. my-registry.com or ghcr.io. This setting can be globally + # overridden via the controlPlane.advanced.defaultImageRegistry option. Empty means docker hub. + registry: "" + # Repository is the repository of the container image, e.g. my-repo/my-image + repository: "rancher/k3s" + # Tag is the tag of the container image, and is the default version. + tag: "v1.33.3-k3s1" + # Security options can be used for the distro init container + securityContext: {} + # Resources for the distro init container + resources: + limits: + cpu: 100m + memory: 256Mi + requests: + cpu: 40m + memory: 64Mi + + # BackingStore defines which backing store to use for virtual cluster. If not defined will use embedded database as a default backing store. + backingStore: + # Database defines that a database backend should be used as the backend for the virtual cluster. This uses a project called kine under the hood which is a shim for bridging Kubernetes and relational databases. + database: + # Embedded defines that an embedded database (sqlite) should be used as the backend for the virtual cluster + embedded: + # Enabled defines if the database should be used. + enabled: false + # ExtraArgs are additional arguments to pass to Kine. + extraArgs: [] + # External defines that an external database should be used as the backend for the virtual cluster + external: + # Enabled defines if the database should be used. + enabled: false + # DataSource is the kine dataSource to use for the database. This depends on the database format. + # This is optional for the embedded database. Examples: + # * mysql: mysql://username:password@tcp(hostname:3306)/k3s + # * postgres: postgres://username:password@hostname:5432/k3s + dataSource: "" + # Connector specifies a secret located in a connected vCluster Platform that contains database server connection information + # to be used by Platform to create a database and database user for the vCluster. + # and non-privileged user. A kine endpoint should be created using the database and user on Platform registration. + # This is optional. + connector: "" + # CertFile is the cert file to use for the database. This is optional. + certFile: "" + # KeyFile is the key file to use for the database. This is optional. + keyFile: "" + # CaFile is the ca file to use for the database. This is optional. + caFile: "" + # ExtraArgs are additional arguments to pass to Kine. + extraArgs: [] + # Etcd defines that etcd should be used as the backend for the virtual cluster + etcd: + # Embedded defines to use embedded etcd as a storage backend for the virtual cluster + embedded: + # Enabled defines if the embedded etcd should be used. + enabled: false + # MigrateFromDeployedEtcd signals that vCluster should migrate from the deployed external etcd to embedded etcd. + migrateFromDeployedEtcd: false + # ExtraArgs are additional arguments to pass to the embedded etcd. + extraArgs: [] + # External defines to use a self-hosted external etcd that is not deployed by the helm chart + external: + # Enabled defines if the external etcd should be used. + enabled: false + # Endpoint holds the endpoint of the external etcd server, e.g. my-example-service:2379 + endpoint: "" + # TLS defines the tls configuration for the external etcd server + tls: + # CaFile is the path to the ca file + caFile: "" + # CertFile is the path to the cert file + certFile: "" + # KeyFile is the path to the key file + keyFile: "" + # Deploy defines to use an external etcd that is deployed by the helm chart + deploy: + # Enabled defines that an external etcd should be deployed. + enabled: false + # StatefulSet holds options for the external etcd statefulSet. + statefulSet: + # Enabled defines if the statefulSet should be deployed + enabled: true + # EnableServiceLinks for the StatefulSet pod + enableServiceLinks: true + annotations: {} + labels: {} + # Image is the image to use for the external etcd statefulSet + image: + # Registry is the registry of the container image, e.g. my-registry.com or ghcr.io. This setting can be globally + # overridden via the controlPlane.advanced.defaultImageRegistry option. Empty means docker hub. + registry: "registry.k8s.io" + # Repository is the repository of the container image, e.g. my-repo/my-image + repository: "etcd" + # Tag is the tag of the container image, and is the default version. + tag: "3.5.21-0" + # ImagePullPolicy is the pull policy for the external etcd image + imagePullPolicy: "" + # ExtraArgs are appended to the etcd command. + extraArgs: [] + # Env are extra environment variables + env: [] + # Resources the etcd can consume + resources: + # Requests are minimal resources that will be consumed by the container + requests: + cpu: 20m + memory: 150Mi + # Pods defines extra metadata for the etcd pods. + pods: + annotations: {} + labels: {} + # HighAvailability are high availability options + highAvailability: + # Replicas are the amount of pods to use. + replicas: 1 + # Scheduling options for the etcd pods. + scheduling: + # PodManagementPolicy is the statefulSet pod management policy. + podManagementPolicy: Parallel + # NodeSelector is the node selector to apply to the pod. + nodeSelector: {} + # Affinity is the affinity to apply to the pod. + affinity: {} + # Tolerations are the tolerations to apply to the pod. + tolerations: [] + # TopologySpreadConstraints are the topology spread constraints for the pod. + topologySpreadConstraints: [] + # PriorityClassName is the priority class name for the the pod. + priorityClassName: "" + # Security options for the etcd pods. + security: + # PodSecurityContext specifies security context options on the pod level. + podSecurityContext: {} + # ContainerSecurityContext specifies security context options on the container level. + containerSecurityContext: {} + # Persistence options for the etcd pods. + persistence: + # VolumeClaim can be used to configure the persistent volume claim. + volumeClaim: + # Enabled enables deploying a persistent volume claim. + enabled: true + # RetentionPolicy is the persistent volume claim retention policy. + retentionPolicy: Retain + # Size is the persistent volume claim storage size. + size: 5Gi + # StorageClass is the persistent volume claim storage class. + storageClass: "" + # AccessModes are the persistent volume claim access modes. + accessModes: ["ReadWriteOnce"] + # VolumeClaimTemplates defines the volumeClaimTemplates for the statefulSet + volumeClaimTemplates: [] + # AddVolumes defines extra volumes for the pod + addVolumes: [] + # AddVolumeMounts defines extra volume mounts for the container + addVolumeMounts: [] + # Service holds options for the external etcd service. + service: + enabled: true + annotations: {} + # HeadlessService holds options for the external etcd headless service. + headlessService: + annotations: {} + + # Proxy defines options for the virtual cluster control plane proxy that is used to do authentication and intercept requests. + proxy: + # BindAddress under which vCluster will expose the proxy. + bindAddress: "0.0.0.0" + # Port under which vCluster will expose the proxy. Changing port is currently not supported. + port: 8443 + # ExtraSANs are extra hostnames to sign the vCluster proxy certificate for. + extraSANs: [] + + # CoreDNS defines everything related to the coredns that is deployed and used within the vCluster. + coredns: + # Enabled defines if coredns is enabled + enabled: true + # Embedded defines if vCluster will start the embedded coredns service within the control-plane and not as a separate deployment. This is a PRO feature. + embedded: false + # OverwriteManifests can be used to overwrite the coredns manifests used to deploy coredns + overwriteManifests: "" + # OverwriteConfig can be used to overwrite the coredns config + overwriteConfig: "" + # PriorityClassName specifies the priority class name for the CoreDNS pods. + priorityClassName: "" + # Security defines pod or container security context. + security: + # PodSecurityContext specifies security context options on the pod level. + podSecurityContext: {} + # ContainerSecurityContext specifies security context options on the container level. + containerSecurityContext: {} + # Service holds extra options for the coredns service deployed within the virtual cluster + service: + annotations: {} + labels: {} + # Spec holds extra options for the coredns service + spec: + type: ClusterIP + # Deployment holds extra options for the coredns deployment deployed within the virtual cluster + deployment: + annotations: {} + labels: {} + # Image is the coredns image to use + image: "" + # Replicas is the amount of coredns pods to run. + replicas: 1 + # Pods is additional metadata for the coredns pods. + pods: + labels: {} + annotations: {} + # NodeSelector is the node selector to use for coredns. + nodeSelector: {} + # Affinity is the affinity to apply to the pod. + affinity: {} + # Tolerations are the tolerations to apply to the pod. + tolerations: [] + # Resources are the desired resources for coredns. + resources: + # Limits are resource limits for the container + limits: + cpu: 1000m + memory: 170Mi + # Requests are minimal resources that will be consumed by the container + requests: + cpu: 20m + memory: 64Mi + # TopologySpreadConstraints are the topology spread constraints for the CoreDNS pod. + topologySpreadConstraints: + - maxSkew: 1 + topologyKey: kubernetes.io/hostname + whenUnsatisfiable: DoNotSchedule + labelSelector: + matchLabels: + k8s-app: vcluster-kube-dns + + # Service defines options for vCluster service deployed by Helm. + service: + # Enabled defines if the control plane service should be enabled + enabled: true + labels: {} + annotations: {} + # KubeletNodePort is the node port where the fake kubelet is exposed. Defaults to 0. + kubeletNodePort: 0 + # HTTPSNodePort is the node port where https is exposed. Defaults to 0. + httpsNodePort: 0 + # Spec allows you to configure extra service options. + spec: + type: ClusterIP + + # Ingress defines options for vCluster ingress deployed by Helm. + ingress: + # Enabled defines if the control plane ingress should be enabled + enabled: false + # Host is the host where vCluster will be reachable + host: "my-host.com" + # PathType is the path type of the ingress + pathType: ImplementationSpecific + labels: {} + annotations: + nginx.ingress.kubernetes.io/backend-protocol: HTTPS + nginx.ingress.kubernetes.io/ssl-passthrough: "true" + nginx.ingress.kubernetes.io/ssl-redirect: "true" + # Spec allows you to configure extra ingress options. + spec: + tls: [] + + # Standalone holds configuration for standalone mode. Standalone mode is set automatically when no container is detected and + # also implies privateNodes.enabled. + standalone: + # DataDir defines the data directory for the standalone mode. + dataDir: "/var/lib/vcluster" + # JoinNode holds configuration for the standalone control plane node. + joinNode: + # Enabled defines if the standalone node should be joined into the cluster. If false, only the control plane binaries will be executed and no node will show up in the actual cluster. + enabled: true + # Containerd holds configuration for the containerd join process. + containerd: + # Enabled defines if containerd should be installed and configured by vCluster. + enabled: true + + # StatefulSet defines options for vCluster statefulSet deployed by Helm. + statefulSet: + labels: {} + annotations: {} + # ImagePullPolicy is the policy how to pull the image. + imagePullPolicy: "" + # Image is the image for the controlPlane statefulSet container + # It defaults to the vCluster pro repository that includes the optional pro modules that are turned off by default. + # If you still want to use the pure OSS build, set the repository to 'loft-sh/vcluster-oss'. + image: + # Registry is the registry of the container image, e.g. my-registry.com or ghcr.io. This setting can be globally + # overridden via the controlPlane.advanced.defaultImageRegistry option. Empty means docker hub. + registry: "ghcr.io" + # Repository is the repository of the container image, e.g. my-repo/my-image + repository: "loft-sh/vcluster-pro" + # Tag is the tag of the container image, and is the default version. + tag: "" + # WorkingDir specifies in what folder the main process should get started. + workingDir: "" + # Command allows you to override the main command. + command: [] + # Args allows you to override the main arguments. + args: [] + # Env are additional environment variables for the statefulSet container. + env: [] + # Resources are the resource requests and limits for the statefulSet container. + resources: + # Limits are resource limits for the container + limits: + ephemeral-storage: 8Gi + memory: 2Gi + # Requests are minimal resources that will be consumed by the container + requests: + ephemeral-storage: 1Gi + cpu: 200m + memory: 256Mi + # Additional labels or annotations for the statefulSet pods. + pods: + labels: {} + annotations: {} + # HighAvailability holds options related to high availability. + highAvailability: + # Replicas is the amount of replicas to use for the statefulSet. + replicas: 1 + # LeaseDuration is the time to lease for the leader. + leaseDuration: 60 + # RenewDeadline is the deadline to renew a lease for the leader. + renewDeadline: 40 + # RetryPeriod is the time until a replica will retry to get a lease. + retryPeriod: 15 + # Security defines pod or container security context. + security: + # PodSecurityContext specifies security context options on the pod level. + podSecurityContext: {} + # ContainerSecurityContext specifies security context options on the container level. + containerSecurityContext: + allowPrivilegeEscalation: false + runAsUser: 0 + runAsGroup: 0 + # Persistence defines options around persistence for the statefulSet. + persistence: + # VolumeClaim can be used to configure the persistent volume claim. + volumeClaim: + # Enabled enables deploying a persistent volume claim. If auto, vCluster will automatically determine + # based on the chosen distro and other options if this is required. + enabled: auto + # RetentionPolicy is the persistent volume claim retention policy. + retentionPolicy: Retain + # Size is the persistent volume claim storage size. + size: 5Gi + # StorageClass is the persistent volume claim storage class. + storageClass: "" + # AccessModes are the persistent volume claim access modes. + accessModes: ["ReadWriteOnce"] + # VolumeClaimTemplates defines the volumeClaimTemplates for the statefulSet + volumeClaimTemplates: [] + # AddVolumeMounts defines extra volume mounts for the container + addVolumeMounts: [] + # AddVolumes defines extra volumes for the pod + addVolumes: [] + # Allows you to override the dataVolume. Only works correctly if volumeClaim.enabled=false. + dataVolume: [] + # BinariesVolume defines a binaries volume that is used to retrieve + # distro specific executables to be run by the syncer controller. + # This volume doesn't need to be persistent. + binariesVolume: + - name: binaries + emptyDir: {} + # EnableServiceLinks for the StatefulSet pod + enableServiceLinks: true + # Scheduling holds options related to scheduling. + scheduling: + # PodManagementPolicy is the statefulSet pod management policy. + podManagementPolicy: Parallel + # TopologySpreadConstraints are the topology spread constraints for the pod. + topologySpreadConstraints: [] + # PriorityClassName is the priority class name for the the pod. + priorityClassName: "" + # NodeSelector is the node selector to apply to the pod. + nodeSelector: {} + # Affinity is the affinity to apply to the pod. + affinity: {} + # Tolerations are the tolerations to apply to the pod. + tolerations: [] + # Probes enables or disables the main container probes. + probes: + # LivenessProbe specifies if the liveness probe for the container should be enabled + livenessProbe: + # Enabled defines if this option should be enabled. + enabled: true + # Number of consecutive failures for the probe to be considered failed + failureThreshold: 60 + # Time (in seconds) to wait before starting the liveness probe + initialDelaySeconds: 60 + # Maximum duration (in seconds) that the probe will wait for a response. + timeoutSeconds: 3 + # Frequency (in seconds) to perform the probe + periodSeconds: 2 + # ReadinessProbe specifies if the readiness probe for the container should be enabled + readinessProbe: + # Enabled defines if this option should be enabled. + enabled: true + # Number of consecutive failures for the probe to be considered failed + failureThreshold: 60 + # Maximum duration (in seconds) that the probe will wait for a response. + timeoutSeconds: 3 + # Frequency (in seconds) to perform the probe + periodSeconds: 2 + # StartupProbe specifies if the startup probe for the container should be enabled + startupProbe: + # Enabled defines if this option should be enabled. + enabled: true + # Number of consecutive failures allowed before failing the pod + failureThreshold: 300 + # Maximum duration (in seconds) that the probe will wait for a response. + timeoutSeconds: 3 + # Frequency (in seconds) to perform the probe + periodSeconds: 6 + + # ServiceMonitor can be used to automatically create a service monitor for vCluster deployment itself. + serviceMonitor: + # Enabled configures if Helm should create the service monitor. + enabled: false + labels: {} + annotations: {} + + # Advanced holds additional configuration for the vCluster control plane. + advanced: + # DefaultImageRegistry will be used as a prefix for all internal images deployed by vCluster or Helm. This makes it easy to + # upload all required vCluster images to a single private repository and set this value. Workload images are not affected by this. + defaultImageRegistry: "" + # VirtualScheduler defines if a scheduler should be used within the virtual cluster or the scheduling decision for workloads will be made by the host cluster. + # Deprecated: Use ControlPlane.Distro.K8S.Scheduler instead. + virtualScheduler: + enabled: false + # ServiceAccount specifies options for the vCluster control plane service account. + serviceAccount: + # Enabled specifies if the service account should get deployed. + enabled: true + # Name specifies what name to use for the service account. + name: "" + # ImagePullSecrets defines extra image pull secrets for the service account. + imagePullSecrets: [] + labels: {} + annotations: {} + # WorkloadServiceAccount specifies options for the service account that will be used for the workloads that run within the virtual cluster. + workloadServiceAccount: + # Enabled specifies if the service account for the workloads should get deployed. + enabled: true + # Name specifies what name to use for the service account for the virtual cluster workloads. + name: "" + # ImagePullSecrets defines extra image pull secrets for the workload service account. + imagePullSecrets: [] + annotations: {} + labels: {} + # HeadlessService specifies options for the headless service used for the vCluster StatefulSet. + headlessService: + labels: {} + annotations: {} + # Konnectivity holds dedicated konnectivity configuration. This is only available when privateNodes.enabled is true. + konnectivity: + # Server holds configuration for the konnectivity server. + server: + # Enabled defines if the konnectivity server should be enabled. + enabled: true + # ExtraArgs are additional arguments to pass to the konnectivity server. + extraArgs: [] + # Agent holds configuration for the konnectivity agent. + agent: + # Enabled defines if the konnectivity agent should be enabled. + enabled: true + # Replicas is the number of replicas for the konnectivity agent. + replicas: 1 + # Image is the image for the konnectivity agent. + image: "" + # ImagePullPolicy is the policy how to pull the image. + imagePullPolicy: "" + # NodeSelector is the node selector for the konnectivity agent. + nodeSelector: {} + # Tolerations is the tolerations for the konnectivity agent. + tolerations: [] + # ExtraEnv is the extra environment variables for the konnectivity agent. + extraEnv: [] + # ExtraArgs are additional arguments to pass to the konnectivity agent. + extraArgs: [] + # CloudControllerManager holds configuration for the embedded cloud controller manager. This is only available when private nodes are enabled. + # The cloud controller manager is responsible for setting the node's ip addresses as well as the provider id for the node and other node metadata. + cloudControllerManager: + # Enabled defines if the embedded cloud controller manager should be enabled. This defaults to true, but can be disabled if you want to use + # an external cloud controller manager such as AWS or GCP. The cloud controller manager is responsible for setting the node's ip addresses as well + # as the provider id for the node and other node metadata. + enabled: true + # Registry allows enabling an embedded docker image registry in vCluster. This is useful for air-gapped environments or when you don't have a public registry available to distribute images. + registry: + # Enabled defines if the embedded registry should be enabled. + enabled: false + # AnonymousPull allows enabling anonymous pull for the embedded registry. This allows anybody to pull images from the registry without authentication. + anonymousPull: true + # Config is the regular docker registry config. See https://distribution.github.io/distribution/about/configuration/ for more details. + config: {} + # GlobalMetadata is metadata that will be added to all resources deployed by Helm. + globalMetadata: + annotations: {} + +# PrivateNodes holds configuration for vCluster private nodes mode. +privateNodes: + # Enabled defines if dedicated nodes should be enabled. + enabled: false + + # Kubelet holds kubelet configuration that is used for all nodes. + kubelet: + # Config is the config for the kubelet that will be merged into the default kubelet config. More information can be found here: + # https://kubernetes.io/docs/reference/config-api/kubelet-config.v1beta1/#kubelet-config-k8s-io-v1beta1-KubeletConfiguration + config: {} + + # AutoUpgrade holds configuration for auto upgrade. + autoUpgrade: + # Enabled defines if auto upgrade should be enabled. + enabled: true + # Concurrency is the number of nodes that can be upgraded at the same time. + concurrency: 1 + + # JoinNode holds configuration specifically used during joining the node (see "kubeadm join"). + joinNode: + # Containerd holds configuration for the containerd join process. + containerd: + # Enabled defines if containerd should be installed and configured by vCluster. + enabled: true + + # AutoNodes stores Auto Nodes configuration static and dynamic NodePools managed by Karpenter + autoNodes: + # Static defines static node pools. Static node pools have a fixed size and are not scaled automatically. + static: [] + # Dynamic defines dynamic node pools. Dynamic node pools are scaled automatically based on the requirements within the cluster. + # Karpenter is used under the hood to handle the scheduling of the nodes. + dynamic: [] + + # VPN holds configuration for the private nodes vpn. This can be used to connect the private nodes to the control plane or + # connect the private nodes to each other if they are not running in the same network. Platform connection is required for the vpn to work. + vpn: + # Enabled defines if the private nodes vpn should be enabled. + enabled: false + # NodeToNode holds configuration for the node to node vpn. This can be used to connect the private nodes to each other if they are not running in the same network. + nodeToNode: + # Enabled defines if the node to node vpn should be enabled. + enabled: false + +# Deploy holds configuration for the deployment of vCluster. +deploy: + # LocalPathProvisioner holds dedicated local path provisioner configuration. + localPathProvisioner: + # Enabled defines if LocalPathProvisioner should be enabled. + enabled: true + + # CNI holds dedicated CNI configuration. + cni: + # Flannel holds dedicated Flannel configuration. + flannel: + # Enabled defines if Flannel should be enabled. + enabled: true + + # KubeProxy holds dedicated kube proxy configuration. + kubeProxy: + # Enabled defines if the kube proxy should be enabled. + enabled: true + # Image is the image for the kube-proxy. + image: "" + # ImagePullPolicy is the policy how to pull the image. + imagePullPolicy: "" + # NodeSelector is the node selector for the kube-proxy. + nodeSelector: {} + # Tolerations is the tolerations for the kube-proxy. + tolerations: [] + # ExtraEnv is the extra environment variables for the kube-proxy. + extraEnv: [] + # ExtraArgs are additional arguments to pass to the kube-proxy. + extraArgs: [] + # Config is the config for the kube-proxy that will be merged into the default kube-proxy config. More information can be found here: + # https://kubernetes.io/docs/reference/config-api/kube-proxy-config.v1alpha1/#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration + config: {} + + # Metallb holds dedicated metallb configuration. + metallb: + # Enabled defines if metallb should be enabled. + enabled: false + # IPAddressPool is the IP address pool to use for metallb. + ipAddressPool: + # Addresses is a list of IP addresses to use for the IP address pool. + addresses: [] + # L2Advertisement defines if L2 advertisement should be enabled for the IP address pool. + l2Advertisement: true + + # IngressNginx holds dedicated ingress-nginx configuration. + ingressNginx: + # Enabled defines if ingress-nginx should be enabled. + enabled: false + # DefaultIngressClass defines if the deployed ingress class should be the default ingress class. + defaultIngressClass: true + + # MetricsServer holds dedicated metrics server configuration. + metricsServer: + # Enabled defines if metrics server should be enabled. + enabled: false + +# Integrations holds config for vCluster integrations with other operators or tools running on the host cluster +integrations: + # MetricsServer reuses the metrics server from the host cluster within the vCluster. + metricsServer: + # Enabled signals the metrics server integration should be enabled. + enabled: false + # Nodes defines if metrics-server nodes api should get proxied from host to virtual cluster. + nodes: true + # Pods defines if metrics-server pods api should get proxied from host to virtual cluster. + pods: true + + # ExternalSecrets reuses a host external secret operator and makes certain CRDs from it available inside the vCluster. + # - ExternalSecrets will be synced from the virtual cluster to the host cluster. + # - SecretStores will be synced from the virtual cluster to the host cluster and then bi-directionally. + # - ClusterSecretStores will be synced from the host cluster to the virtual cluster. + externalSecrets: + # Enabled defines whether the external secret integration is enabled or not + enabled: false + # Webhook defines whether the host webhooks are reused or not + webhook: + enabled: false + # Sync defines the syncing behavior for the integration + sync: + # ToHost defines what resources are synced from the virtual cluster to the host + toHost: + # ExternalSecrets allows to configure if only a subset of ExternalSecrets matching a label selector should get synced from the virtual cluster to the host cluster. + externalSecrets: + selector: + matchLabels: {} + # Stores defines if secret stores should get synced from the virtual cluster to the host cluster and then bi-directionally. + stores: + # Enabled defines if this option should be enabled. + enabled: false + selector: + matchLabels: {} + # FromHost defines what resources are synced from the host cluster to the virtual cluster + fromHost: + # ClusterStores defines if cluster secrets stores should get synced from the host cluster to the virtual cluster. + clusterStores: + # Enabled defines if this option should be enabled. + enabled: false + selector: + matchLabels: {} + # ExternalSecrets defines if external secrets should get synced from the virtual cluster to the host cluster. + externalSecrets: + enabled: true + # Stores defines if secret stores should get synced from the virtual cluster to the host cluster and then bi-directionally. + # Deprecated: Use Integrations.ExternalSecrets.Sync.ToHost.Stores instead. + stores: + enabled: false + # ClusterStores defines if cluster secrets stores should get synced from the host cluster to the virtual cluster. + # Deprecated: Use Integrations.ExternalSecrets.Sync.FromHost.ClusterStores instead. + clusterStores: + # Enabled defines if this option should be enabled. + enabled: false + # Selector defines what cluster stores should be synced + selector: + labels: {} + + # KubeVirt reuses a host kubevirt and makes certain CRDs from it available inside the vCluster + kubeVirt: + # Enabled signals if the integration should be enabled + enabled: false + # Webhook holds configuration for enabling the webhook within the vCluster + webhook: + enabled: true + # Sync holds configuration on what resources to sync + sync: + # If DataVolumes should get synced + dataVolumes: + enabled: false + # If VirtualMachines should get synced + virtualMachines: + enabled: true + # If VirtualMachineInstances should get synced + virtualMachineInstances: + enabled: true + # If VirtualMachinePools should get synced + virtualMachinePools: + enabled: true + # If VirtualMachineClones should get synced + virtualMachineClones: + enabled: true + # If VirtualMachineInstanceMigrations should get synced + virtualMachineInstanceMigrations: + enabled: true + + # CertManager reuses a host cert-manager and makes its CRDs from it available inside the vCluster. + # - Certificates and Issuers will be synced from the virtual cluster to the host cluster. + # - ClusterIssuers will be synced from the host cluster to the virtual cluster. + certManager: + # Enabled defines if this option should be enabled. + enabled: false + # Sync contains advanced configuration for syncing cert-manager resources. + sync: + toHost: + # Certificates defines if certificates should get synced from the virtual cluster to the host cluster. + certificates: + enabled: true + # Issuers defines if issuers should get synced from the virtual cluster to the host cluster. + issuers: + enabled: true + fromHost: + # ClusterIssuers defines if (and which) cluster issuers should get synced from the host cluster to the virtual cluster. + clusterIssuers: + # Enabled defines if this option should be enabled. + enabled: true + # Selector defines what cluster issuers should be imported. + selector: + labels: {} + + # Istio syncs DestinationRules, Gateways and VirtualServices from virtual cluster to the host. + istio: + # Enabled defines if this option should be enabled. + enabled: false + sync: + toHost: + destinationRules: + enabled: true + gateways: + enabled: true + virtualServices: + enabled: true + +# RBAC options for the virtual cluster. +rbac: + # Role holds virtual cluster role configuration + role: + # Enabled defines if the role should be enabled or disabled. + enabled: true + # OverwriteRules will overwrite the role rules completely. + overwriteRules: [] + # ExtraRules will add rules to the role. + extraRules: [] + + # ClusterRole holds virtual cluster cluster role configuration + clusterRole: + # Enabled defines if the cluster role should be enabled or disabled. If auto, vCluster automatically determines whether the virtual cluster requires a cluster role. + enabled: auto + # OverwriteRules will overwrite the cluster role rules completely. + overwriteRules: [] + # ExtraRules will add rules to the cluster role. + extraRules: [] + +# Networking options related to the virtual cluster. +networking: + # PodCIDR holds the pod cidr for the virtual cluster. This should only be set if privateNodes.enabled is true. + podCIDR: "10.244.0.0/16" + + # ReplicateServices allows replicating services from the host within the virtual cluster or the other way around. + replicateServices: + # ToHost defines the services that should get synced from virtual cluster to the host cluster. If services are + # synced to a different namespace than the virtual cluster is in, additional permissions for the other namespace + # are required. + toHost: [] + # FromHost defines the services that should get synced from the host to the virtual cluster. + fromHost: [] + + # ResolveDNS allows to define extra DNS rules. This only works if embedded coredns is configured. + resolveDNS: [] + + # Advanced holds advanced network options. + advanced: + # ClusterDomain is the Kubernetes cluster domain to use within the virtual cluster. + clusterDomain: "cluster.local" + # FallbackHostCluster allows to fallback dns to the host cluster. This is useful if you want to reach host services without + # any other modification. You will need to provide a namespace for the service, e.g. my-other-service.my-other-namespace + fallbackHostCluster: false + # ProxyKubelets allows rewriting certain metrics and stats from the Kubelet to "fake" this for applications such as + # prometheus or other node exporters. + proxyKubelets: + # ByHostname will add a special vCluster hostname to the nodes where the node can be reached at. This doesn't work + # for all applications, e.g. Prometheus requires a node IP. + byHostname: true + # ByIP will create a separate service in the host cluster for every node that will point to virtual cluster and will be used to + # route traffic. + byIP: true + +# Policies to enforce for the virtual cluster deployment as well as within the virtual cluster. +policies: + # ResourceQuota specifies resource quota options. + resourceQuota: + # Enabled defines if the resource quota should be enabled. "auto" means that if limitRange is enabled, + # the resourceQuota will be enabled as well. + enabled: auto + labels: {} + annotations: {} + # Quota are the quota options + quota: + requests.cpu: 10 + requests.memory: 20Gi + requests.storage: "100Gi" + requests.ephemeral-storage: 60Gi + limits.cpu: 20 + limits.memory: 40Gi + limits.ephemeral-storage: 160Gi + services.nodeports: 0 + services.loadbalancers: 1 + count/endpoints: 40 + count/pods: 20 + count/services: 20 + count/secrets: 100 + count/configmaps: 100 + count/persistentvolumeclaims: 20 + # ScopeSelector is the resource quota scope selector + scopeSelector: + matchExpressions: [] + # Scopes are the resource quota scopes + scopes: [] + + # LimitRange specifies limit range options. + limitRange: + # Enabled defines if the limit range should be deployed by vCluster. "auto" means that if resourceQuota is enabled, + # the limitRange will be enabled as well. + enabled: auto + labels: {} + annotations: {} + # Default are the default limits for the limit range + default: + ephemeral-storage: 8Gi + memory: 512Mi + cpu: "1" + # DefaultRequest are the default request options for the limit range + defaultRequest: + ephemeral-storage: 3Gi + memory: 128Mi + cpu: 100m + # Min are the min limits for the limit range + min: {} + # Max are the max limits for the limit range + max: {} + + # NetworkPolicy specifies network policy options. + networkPolicy: + # Enabled defines if the network policy should be deployed by vCluster. + enabled: false + labels: {} + annotations: {} + # FallbackDNS is the fallback DNS server to use if the virtual cluster does not have a DNS server. + fallbackDns: 8.8.8.8 + # ExtraControlPlaneRules are extra allowed rules for the vCluster control plane. + extraControlPlaneRules: [] + # ExtraWorkloadRules are extra allowed rules for the vCluster workloads. + extraWorkloadRules: [] + # OutgoingConnections are the outgoing connections options for the vCluster workloads. + outgoingConnections: + # Platform enables egress access towards loft platform + platform: true + # IPBlock describes a particular CIDR (Ex. "192.168.1.0/24","2001:db8::/64") that is allowed + # to the pods matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs + # that should not be included within this rule. + ipBlock: + # cidr is a string representing the IPBlock + # Valid examples are "192.168.1.0/24" or "2001:db8::/64" + cidr: 0.0.0.0/0 + # except is a slice of CIDRs that should not be included within an IPBlock + # Valid examples are "192.168.1.0/24" or "2001:db8::/64" + # Except values will be rejected if they are outside the cidr range + # +optional + except: + - 100.64.0.0/10 + - 127.0.0.0/8 + - 10.0.0.0/8 + - 172.16.0.0/12 + - 192.168.0.0/16 + + # CentralAdmission defines what validating or mutating webhooks should be enforced within the virtual cluster. + centralAdmission: + # ValidatingWebhooks are validating webhooks that should be enforced in the virtual cluster + validatingWebhooks: [] + # MutatingWebhooks are mutating webhooks that should be enforced in the virtual cluster + mutatingWebhooks: [] + +# ExportKubeConfig describes how vCluster should export the vCluster kubeConfig file. +exportKubeConfig: + # Context is the name of the context within the generated kubeconfig to use. + context: "" + + # Override the default https://localhost:8443 and specify a custom hostname for the generated kubeconfig. + server: "" + + # If tls should get skipped for the server + insecure: false + + # ServiceAccount can be used to generate a service account token instead of the default certificates. + serviceAccount: + # Name of the service account to be used to generate a service account token instead of the default certificates. + name: "" + # Namespace of the service account to be used to generate a service account token instead of the default certificates. + # If omitted, will use the kube-system namespace. + namespace: "" + # ClusterRole to assign to the service account. + clusterRole: "" + + # Declare in which host cluster secret vCluster should store the generated virtual cluster kubeconfig. + # If this is not defined, vCluster will create it with `vc-NAME`. If you specify another name, + # vCluster creates the config in this other secret. + + # Deprecated: Use AdditionalSecrets instead. + secret: + # Name is the name of the secret where the kubeconfig should get stored. + name: "" + # Namespace where vCluster should store the kubeconfig secret. If this is not equal to the namespace + # where you deployed vCluster, you need to make sure vCluster has access to this other namespace. + namespace: "" + +# External holds configuration for tools that are external to the vCluster. +external: {} + +# Define which vCluster plugins to load. +plugins: {} + +# Experimental features for vCluster. Configuration here might change, so be careful with this. +experimental: + # SyncSettings are advanced settings for the syncer controller. + syncSettings: + # TargetNamespace is the namespace where the workloads should get synced to. + # Deprecated: Removed in 0.29.0. + targetNamespace: "" + # SetOwner specifies if vCluster should set an owner reference on the synced objects to the vCluster service. This allows for easy garbage collection. + setOwner: true + + # Deploy allows you to configure manifests and Helm charts to deploy within the host or virtual cluster. + deploy: + # Host defines what manifests to deploy into the host cluster + host: + # Manifests are raw Kubernetes manifests that should get applied within the host cluster. + manifests: "" + # ManifestsTemplate is a Kubernetes manifest template that will be rendered with vCluster values before applying it within the host cluster. + manifestsTemplate: "" + # VCluster defines what manifests and charts to deploy into the vCluster + vcluster: + # Manifests are raw Kubernetes manifests that should get applied within the virtual cluster. + manifests: "" + # ManifestsTemplate is a Kubernetes manifest template that will be rendered with vCluster values before applying it within the virtual cluster. + manifestsTemplate: "" + # Helm are Helm charts that should get deployed into the virtual cluster + helm: [] + +# Configuration related to telemetry gathered about vCluster usage. +telemetry: + # Enabled specifies that the telemetry for the vCluster control plane should be enabled. + enabled: true + +# Logging provides structured logging options +logging: + # Encoding specifies the format of vCluster logs, it can either be json or console. + encoding: console diff --git a/charts/cf-vcluster/templates/_helpers.tpl b/charts/cf-vcluster/templates/_helpers.tpl new file mode 100644 index 0000000..d9a9b90 --- /dev/null +++ b/charts/cf-vcluster/templates/_helpers.tpl @@ -0,0 +1,62 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "vcluster.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "cf-vcluster.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "cf-vcluster.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "cf-vcluster.labels" -}} +helm.sh/chart: {{ include "vcluster.chart" . }} +{{ include "vcluster.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "cf-vcluster.selectorLabels" -}} +app.kubernetes.io/name: {{ include "vcluster.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "cf-vcluster.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "vcluster.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/charts/cf-vcluster/templates/ingresses.tpl b/charts/cf-vcluster/templates/ingresses.tpl new file mode 100644 index 0000000..5a76ce6 --- /dev/null +++ b/charts/cf-vcluster/templates/ingresses.tpl @@ -0,0 +1,34 @@ +{{- range $i, $val := (list "internal" "public") }} +{{- $ingress := index $.Values.global.ingress $val -}} + {{- if and $ingress.enabled }} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ printf "%s-%s" $.Release.Name $val }} + {{- if $ingress.annotations }} + annotations: + {{- $ingress.annotations | toYaml | nindent 4 }} + {{- end }} +spec: + ingressClassName: {{ $ingress.ingressClassName | quote }} + rules: + - host: {{ tpl (printf "%s.%s" $ingress.host.name $ingress.host.domain) $ }} + http: + paths: + - path: / + pathType: {{ $.Values.vcluster.controlPlane.ingress.pathType }} + backend: + {{- if $ingress.backendServiceOverride}} + service: + name: {{ $ingress.backendServiceOverride.name }} + port: + number: {{ $ingress.backendServiceOverride.port }} + {{- else }} + service: + name: {{ $.Release.Name }} + port: + name: https + {{- end }} +--- + {{ end -}} +{{ end -}} diff --git a/charts/cf-vcluster/values.test.rnd-sandbox.yaml b/charts/cf-vcluster/values.test.rnd-sandbox.yaml new file mode 100644 index 0000000..aad66cb --- /dev/null +++ b/charts/cf-vcluster/values.test.rnd-sandbox.yaml @@ -0,0 +1,8 @@ +# Test values file to deploy on rnd-sandbox vcluster host +global: + ingress: + internal: + enabled: true + className: nginx-internal + host: + domain: rnd-sandbox.cf-infra.com diff --git a/charts/cf-vcluster/values.yaml b/charts/cf-vcluster/values.yaml new file mode 100644 index 0000000..b991654 --- /dev/null +++ b/charts/cf-vcluster/values.yaml @@ -0,0 +1,133 @@ +global: + ingress: + internal: + enabled: false + annotations: + nginx.ingress.kubernetes.io/backend-protocol: HTTPS + nginx.ingress.kubernetes.io/ssl-passthrough: "true" + nginx.ingress.kubernetes.io/ssl-redirect: "true" + ingressClassName: "nginx-internal" + # -- Possibility to override backend service name for ingress. If not set default vcluster backend service will be used + backendServiceOverride: {} + # backendServiceOverride: + # name: "interceptor-service" + # port: 80 + host: + name: "{{ .Release.Name }}" + domain: corp.local + public: + enabled: false + ingressClassName: "nginx-public" + # -- Possibility to override backend service name for ingress. If not set default vcluster backend service will be used + backendServiceOverride: {} + # backendServiceOverride: + # name: "interceptor-service" + # port: 80 + annotations: + nginx.ingress.kubernetes.io/backend-protocol: HTTPS + nginx.ingress.kubernetes.io/ssl-passthrough: "true" + nginx.ingress.kubernetes.io/ssl-redirect: "true" + host: + name: "{{ .Release.Name }}" + domain: example.com + +vcluster: + controlPlane: + proxy: + extraSANs: + - "{{ tpl (printf \"%s.%s.%s\" .Release.Name .Release.Namespace \".cluster.svc.local\") . }}" + - "{{ tpl (printf \"%s.%s\" .Values.global.ingress.internal.host.name .Values.global.ingress.internal.host.domain) . }}" + - "{{ tpl (printf \"%s.%s\" .Values.global.ingress.public.host.name .Values.global.ingress.public.host.domain) . }}" + distro: + k8s: + enabled: true + apiServer: + extraArgs: + - --oidc-issuer-url=https://dexidp.shared-services.cf-infra.com + - --oidc-client-id=vcluster-login + - --oidc-username-claim=email + - --oidc-groups-claim=groups + sync: + toHost: + ingresses: + enabled: true + serviceAccounts: + enabled: true + storageClasses: + enabled: true + persistentVolumeClaims: + enabled: true + persistentVolumes: + enabled: true + fromHost: + ingressClasses: + enabled: true + nodes: + enabled: true + experimental: + deploy: + vcluster: + manifests: |- + --- + kind: ClusterRoleBinding + apiVersion: rbac.authorization.k8s.io/v1 + metadata: + name: oidc-cluster-admin + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin + subjects: + - kind: Group + name: rnd@codefresh.io + --- + kind: ClusterRoleBinding + apiVersion: rbac.authorization.k8s.io/v1 + metadata: + name: oidc-cluster-admin-octopus + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin + subjects: + - kind: Group + name: 787d1a9a-e488-4a77-bb6c-f4b2fdfd8cea # Codefresh R&D Team + - kind: Group + name: 607a9f67-422c-4ca2-b8c4-d0be213b9650 # Codefresh SA Team + - kind: Group + name: f8de82e2-cdb6-480a-8f37-9f958ea5fef5 # Codefresh Support Team + - kind: Group + name: 16b3fb37-58f2-4786-8ca8-6f58d0410687 # Codefresh OSS Team + - kind: Group + name: dc35779f-57d5-4dff-90c0-34c6e93fe7e7 # Codefresh OSS Team + --- + apiVersion: v1 + kind: ServiceAccount + metadata: + name: codefresh-pipelines-integration-cluster-admin + namespace: kube-system + --- + apiVersion: v1 + kind: Secret + metadata: + name: codefresh-pipelines-integration-cluster-admin-token + namespace: kube-system + annotations: + kubernetes.io/service-account.name: codefresh-pipelines-integration-cluster-admin + type: kubernetes.io/service-account-token + --- + kind: ClusterRoleBinding + apiVersion: rbac.authorization.k8s.io/v1 + metadata: + name: codefresh-pipelines-integration-cluster-admin + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin + subjects: + - kind: ServiceAccount + name: codefresh-pipelines-integration-cluster-admin + namespace: kube-system + rbac: + clusterRole: + enabled: true