Skip to content

Commit ae5a70b

Browse files
klihubaskervin
klihub
authored and
askervin
committed
helm/resource-annotator: add Helm chart.
Add a Helm chart for resource-annotator. Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>
1 parent 3c97e61 commit ae5a70b

File tree

9 files changed

+323
-0
lines changed

9 files changed

+323
-0
lines changed

‎deployment/helm/resource-annotator/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎deployment/helm/resource-annotator/Chart.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: v2
2+
appVersion: unstable
3+
description: |
4+
The resource annotator webhook creates a pod annotation with all the resource requirements
5+
present in the pod's containers for CPU and memory compute resources.
6+
name: nri-resource-annotator
7+
sources:
8+
- https://github.com/containers/nri-plugins
9+
home: https://github.com/containers/nri-plugins
10+
type: application
11+
version: v0.0.0

‎deployment/helm/resource-annotator/README.md‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# Resource Annotator Mutating Webhook
2+
3+
This chart deploys the resource annotator mutating admission webhook.
4+
This webhook can be used to provide extra information for NRI resource
5+
policy plugins about compute (CPU and memory) resource requirements of
6+
containers. The hook will put a well known annotation on the pod which
7+
describes the resources for all init container and containers by name.
8+
If found, NRI resource policy plugins will use this extra information
9+
to discover container resource requirements instead of estimating them.
10+
11+
## Prerequisites
12+
13+
- An NRI resource plugin > v0.11.0
14+
- Helm 3.0.0+
15+
16+
## Installing the Chart
17+
18+
Path to the chart: `resource-annotator`
19+
20+
At the moment the webhook does not you cert-manager. Instead you need
21+
to generate a certificate for the webhook before instantiating it and
22+
pass the certificate and its related key to helm. The below example
23+
demonstrates how this can be done.
24+
25+
```shell
26+
$ helm repo add nri-plugins https://containers.github.io/nri-plugins
27+
$ mkdir cert
28+
$ SVC=resource-annotator NS=kube-system
29+
$ openssl req -x509 -newkey rsa:2048 -sha256 -days 365 -nodes \
30+
-keyout ./cert/server-key.pem \
31+
-out ./cert/server-crt.pem \
32+
-subj "/CN=$SVC.$NS.svc" \
33+
-addext "subjectAltName=DNS:$SVC,DNS:$SVC.$NS,DNS:$SVC.$NS.svc"
34+
$ helm -n $NS install nri-webhook nri-plugins/nri-resource-annotator \
35+
--set service.secret.crt=$(base64 -w0 < ./cert/server-crt.pem) \
36+
--set service.secret.key=$(base64 -w0 < ./cert/server-key.pem)
37+
```
38+
39+
This will set up everything for the resource annotator webhook.
40+
41+
## Uninstalling the Chart
42+
43+
You can uninstall the resource annotator webhook with the following
44+
helm command.
45+
46+
```shell
47+
$ NS=kube-system
48+
$ helm -n $NS uninstall nri-webhook
49+
```
50+
51+
## Configuration options
52+
53+
The tables below present an overview of the parameters available for users to
54+
customize with their own values, along with the default values.
55+
56+
| Name | Default | Description |
57+
|-----------------------------|-------------------------------------------------------|--------------------------------|
58+
| `image.name` | ghcr.io/containers/nri-plugins/nri-resource-annotator | container image name |
59+
| `image.tag` | unstable | container image tag |
60+
| `image.pullPolicy` | Always | image pull policy |
61+
| `service.base64Crt` | no sane default, see instructions above | base64 encoded certificate |
62+
| `service.base64Key` | no sane default, see instructions above | base64 encoded certificate key |
63+
| `resources.requests.cpu` | 250m | CPU resource request |
64+
| `resources.requests.memory` | 256Mi | memory resource request |
65+
| `resources.limits.cpu` | 1 | CPU resource limit |
66+
| `resources.limits.memory` | 256Mi | memory resource limit |

‎deployment/helm/resource-annotator/templates/_helpers.tpl‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{{/*
2+
Common labels
3+
*/}}
4+
{{- define "resource-annotator.labels" -}}
5+
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
6+
app.kubernetes.io/managed-by: {{ .Release.Service }}
7+
{{ include "resource-annotator.selectorLabels" . }}
8+
{{- end -}}
9+
10+
{{/*
11+
Selector labels
12+
*/}}
13+
{{- define "resource-annotator.selectorLabels" -}}
14+
app.kubernetes.io/name: resource-annotator
15+
app.kubernetes.io/instance: {{ .Release.Name }}
16+
{{- end -}}

‎deployment/helm/resource-annotator/templates/secret.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: resource-annotator-secret
5+
namespace: {{ .Release.Namespace }}
6+
data:
7+
svc.crt: {{ .Values.service.base64Crt }}
8+
svc.key: {{ .Values.service.base64Key }}
9+
type: Opaque

‎deployment/helm/resource-annotator/templates/webhook-config.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
apiVersion: admissionregistration.k8s.io/v1
2+
kind: MutatingWebhookConfiguration
3+
metadata:
4+
name: resource-annotator
5+
webhooks:
6+
- name: resource-annotator.noderesource.dev
7+
sideEffects: None
8+
admissionReviewVersions: ["v1"]
9+
rules:
10+
- apiGroups:
11+
- "*"
12+
apiVersions:
13+
- "*"
14+
operations:
15+
- CREATE
16+
- UPDATE
17+
resources:
18+
- pods
19+
objectSelector:
20+
matchExpressions:
21+
- key: helm.sh/chart
22+
operator: NotIn
23+
values: ["{{ .Chart.Name }}-{{ .Chart.Version }}"]
24+
failurePolicy: Fail
25+
clientConfig:
26+
service:
27+
namespace: {{ .Release.Namespace }}
28+
name: resource-annotator
29+
caBundle: {{ .Values.service.base64Crt }}

‎deployment/helm/resource-annotator/templates/webhook-deployment.yaml‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: resource-annotator
5+
namespace: {{ .Release.Namespace }}
6+
labels:
7+
{{- include "resource-annotator.labels" . | nindent 4 }}
8+
spec:
9+
replicas: 1
10+
selector:
11+
matchLabels:
12+
{{- include "resource-annotator.selectorLabels" . | nindent 6 }}
13+
template:
14+
metadata:
15+
labels:
16+
{{- include "resource-annotator.labels" . | nindent 8 }}
17+
spec:
18+
containers:
19+
- name: webhook
20+
image: {{ .Values.image.name }}:{{ .Values.image.tag | default .Chart.AppVersion }}
21+
imagePullPolicy: {{ .Values.image.pullPolicy }}
22+
volumeMounts:
23+
- name: certs
24+
mountPath: /etc/resource-annotator/certs.d/
25+
readOnly: true
26+
args:
27+
- "-cert-file=/etc/resource-annotator/certs.d/svc.crt"
28+
- "-key-file=/etc/resource-annotator/certs.d/svc.key"
29+
- "-port=8443"
30+
{{- if .Values.extraEnv }}
31+
env:
32+
{{- range $name, $value := .Values.extraEnv }}
33+
- name: {{ $name }}
34+
value: {{ quote $value }}
35+
{{- end }}
36+
{{- end }}
37+
securityContext:
38+
allowPrivilegeEscalation: false
39+
capabilities:
40+
drop: ["ALL"]
41+
readOnlyRootFilesystem: true
42+
# runAsNonRoot: true
43+
resources:
44+
{{- if .Values.resources.requests }}
45+
requests:
46+
{{- range $name, $value := .Values.resources.requests }}
47+
{{ $name }}: "{{ $value }}"
48+
{{- end }}
49+
{{- end }}
50+
{{- if .Values.resources.limits }}
51+
limits:
52+
{{- range $name, $value := .Values.resources.limits }}
53+
{{ $name }}: "{{ $value }}"
54+
{{- end }}
55+
{{- end }}
56+
livenessProbe:
57+
httpGet:
58+
scheme: HTTPS
59+
port: 8443
60+
httpHeaders:
61+
- name: "Content-Type"
62+
value: "application/json"
63+
initialDelaySeconds: 5
64+
periodSeconds: 30
65+
66+
nodeSelector:
67+
node-role.kubernetes.io/control-plane: ""
68+
tolerations:
69+
- key: "node-role.kubernetes.io/control-plane"
70+
operator: "Equal"
71+
value: ""
72+
effect: "NoSchedule"
73+
priorityClassName: system-node-critical
74+
volumes:
75+
# The webhook uses k8s secrets to store TLS secrets. For now, you need to
76+
# generate a cert/key pair and pass it to Helm, base64 encoded, using the
77+
# corresponding Helm values.
78+
- name: certs
79+
secret:
80+
secretName: resource-annotator-secret
81+
---
82+
apiVersion: v1
83+
kind: Service
84+
metadata:
85+
name: resource-annotator
86+
namespace: {{ .Release.Namespace }}
87+
spec:
88+
selector:
89+
{{- include "resource-annotator.selectorLabels" . | nindent 6 }}
90+
ports:
91+
- port: 443
92+
targetPort: 8443
93+
protocol: TCP

‎deployment/helm/resource-annotator/values.schema.json‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
{
2+
"$schema": "http://json-schema.org/schema#",
3+
"required": [
4+
"image",
5+
"service"
6+
],
7+
"properties": {
8+
"image": {
9+
"type": "object",
10+
"required": [
11+
"name",
12+
"pullPolicy"
13+
],
14+
"properties": {
15+
"name": {
16+
"type": "string"
17+
},
18+
"tag": {
19+
"type": "string"
20+
},
21+
"pullPolicy": {
22+
"type": "string",
23+
"enum": [
24+
"Never",
25+
"Always",
26+
"IfNotPresent"
27+
]
28+
}
29+
}
30+
},
31+
"service": {
32+
"type": "object",
33+
"required": [
34+
"base64Crt",
35+
"base64Key"
36+
],
37+
"properties": {
38+
"base64Crt": {
39+
"type": "string",
40+
"$comment": "base64 encoded certificate (PEM)",
41+
"pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$"
42+
},
43+
"key": {
44+
"type": "string",
45+
"$comment": "base64 encoded key (PEM)",
46+
"pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$"
47+
}
48+
}
49+
}
50+
}
51+
}

‎deployment/helm/resource-annotator/values.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# Default values for nri-plugins.
2+
# This is a YAML-formatted file.
3+
# Declare variables to be passed into your templates.
4+
---
5+
image:
6+
name: ghcr.io/containers/nri-plugins/resource-annotator
7+
# image tag, Chart.AppVersion if unset
8+
#tag: unstable
9+
pullPolicy: Always
10+
11+
service:
12+
base64Crt: UHV0IGhlcmUgeW91ciBjZXJ0aWZpY2F0ZSAoUEVNKQo=
13+
base64Key: QW5kIGhlcmUgeW91ciBjZXJ0aWZpY2F0ZSBrZXkgKFBFTSkK
14+
15+
resources:
16+
requests:
17+
cpu: 250m
18+
memory: 256Mi
19+
limits:
20+
cpu: 1
21+
memory: 256Mi
22+
23+
# Extra environment variables to inject.
24+
extraEnv:
25+
# LOGGER_DEBUG: "*"

0 commit comments

Comments
 (0)