Skip to content

Commit 2ea5b81

Browse files
arooshaparooshap
authored
Automating deployment of crons and service account for all namespaces. (#1650)
* Automating deployment of crons and service account for all namespaces. * Fixing issue with naming
1 parent 489efd4 commit 2ea5b81

File tree

9 files changed

+268
-0
lines changed

9 files changed

+268
-0
lines changed

‎helm/crons/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎helm/crons/Chart.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: v2
2+
name: crons
3+
description: A Helm chart for Kubernetes
4+
5+
# A chart can be either an 'application' or a 'library' chart.
6+
#
7+
# Application charts are a collection of templates that can be packaged into versioned archives
8+
# to be deployed.
9+
#
10+
# Library charts provide useful utilities or functions for the chart developer. They're included as
11+
# a dependency of application charts to inject those utilities and functions into the rendering
12+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
13+
type: application
14+
15+
# This is the chart version. This version number should be incremented each time you make changes
16+
# to the chart and its templates, including the app version.
17+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18+
version: 0.1.0
19+
20+
# This is the version number of the application being deployed. This version number should be
21+
# incremented each time you make changes to the application. Versions are not expected to
22+
# follow Semantic Versioning. They should reflect the version the application is using.
23+
# It is recommended to use it with quotes.
24+
appVersion: "1.16.0"

‎helm/crons/templates/_helpers.tpl‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "crons.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "crons.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "crons.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "crons.labels" -}}
37+
helm.sh/chart: {{ include "crons.chart" . }}
38+
{{ include "crons.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "crons.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "crons.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}
52+
53+
{{/*
54+
Create the name of the service account to use
55+
*/}}
56+
{{- define "crons.serviceAccountName" -}}
57+
{{- if .Values.serviceAccount.create }}
58+
{{- default (include "crons.fullname" .) .Values.serviceAccount.name }}
59+
{{- else }}
60+
{{- default "default" .Values.serviceAccount.name }}
61+
{{- end }}
62+
{{- end }}

‎helm/crons/templates/cron-proxy-ms-unmerged.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
apiVersion: batch/v1
2+
kind: CronJob
3+
metadata:
4+
name: cron-proxy-ms-unmerged
5+
namespace: dmwm
6+
spec:
7+
schedule: "5 */6 * * *"
8+
concurrencyPolicy: Forbid
9+
startingDeadlineSeconds: 300
10+
successfulJobsHistoryLimit: 1
11+
failedJobsHistoryLimit: 1
12+
jobTemplate:
13+
spec:
14+
backoffLimit: 2
15+
ttlSecondsAfterFinished: 600
16+
template:
17+
spec:
18+
serviceAccountName: proxy-account
19+
containers:
20+
- name: proxy
21+
image: registry.cern.ch/cmsweb/proxy-ms-unmerged:latest
22+
args:
23+
- /bin/sh
24+
- -c
25+
- echo "run proxy.sh"; ls -al ; echo "### /etc/robots"; ls -la /etc/robots; echo "### /tmp"; ls -al /tmp; cat /data/proxy.sh; /data/proxy.sh; echo "### /tmp"; ls -al /tmp;
26+
volumeMounts:
27+
- name: robot-secrets
28+
mountPath: /etc/robots
29+
restartPolicy: Never
30+
volumes:
31+
- name: proxy-secrets-ms-unmerged
32+
secret:
33+
secretName: proxy-secrets-ms-unmerged
34+
- name: robot-secrets
35+
secret:
36+
secretName: robot-secrets

‎helm/crons/templates/cron-proxy.yaml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{{- range $ns := .Values.namespaces }}
2+
apiVersion: batch/v1
3+
kind: CronJob
4+
metadata:
5+
name: cron-proxy
6+
namespace: {{ $ns }}
7+
spec:
8+
schedule: "5 */6 * * *"
9+
concurrencyPolicy: Forbid
10+
startingDeadlineSeconds: 300
11+
successfulJobsHistoryLimit: 1
12+
failedJobsHistoryLimit: 1
13+
jobTemplate:
14+
spec:
15+
backoffLimit: 2
16+
ttlSecondsAfterFinished: 600
17+
template:
18+
spec:
19+
serviceAccountName: proxy-account
20+
containers:
21+
- name: proxy
22+
image: registry.cern.ch/cmsweb/proxy
23+
args:
24+
- /bin/sh
25+
- -c
26+
- echo "run proxy.sh"; ls -al ; echo "### /etc/robots"; ls -la /etc/robots; echo "### /tmp"; ls -al /tmp; cat /data/proxy.sh; /data/proxy.sh; echo "### /tmp"; ls -al /tmp;
27+
volumeMounts:
28+
- name: robot-secrets
29+
mountPath: /etc/robots
30+
restartPolicy: Never
31+
volumes:
32+
- name: proxy-secrets
33+
secret:
34+
secretName: proxy-secrets
35+
- name: robot-secrets
36+
secret:
37+
secretName: robot-secrets
38+
---
39+
{{- end }}

‎helm/crons/templates/cron-token.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{{- range $ns := .Values.namespaces }}
2+
apiVersion: batch/v1
3+
kind: CronJob
4+
metadata:
5+
name: cron-token
6+
namespace: {{ $ns }}
7+
spec:
8+
schedule: "*/15 * * * *"
9+
concurrencyPolicy: Forbid
10+
startingDeadlineSeconds: 300
11+
successfulJobsHistoryLimit: 1
12+
failedJobsHistoryLimit: 1
13+
jobTemplate:
14+
spec:
15+
backoffLimit: 2
16+
ttlSecondsAfterFinished: 600
17+
template:
18+
spec:
19+
serviceAccountName: token-account
20+
containers:
21+
- name: cron
22+
image: registry.cern.ch/cmsweb/token:00.00.06-stable
23+
args:
24+
- /bin/sh
25+
- -c
26+
- echo "run token.sh"; ls -al ; echo "### /etc/client"; ls -la /etc/client; echo "### /tmp"; ls -al /tmp; cat /data/token.sh; /data/token.sh; echo "### /tmp"; ls -al /tmp;
27+
volumeMounts:
28+
- name: client-secrets
29+
mountPath: /etc/client
30+
restartPolicy: Never
31+
volumes:
32+
- name: token-secrets
33+
secret:
34+
secretName: token-secrets
35+
- name: client-secrets
36+
secret:
37+
secretName: client-secrets
38+
- name: client-secrets
39+
secret:
40+
secretName: client-secrets
41+
---
42+
{{- end }}

‎helm/crons/templates/namespaces.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{{- if .Values.createNamespaces }}
2+
{{- range $ns := .Values.namespaces }}
3+
apiVersion: v1
4+
kind: Namespace
5+
metadata:
6+
name: {{ $ns }}
7+
---
8+
{{- end }}
9+
{{- end }}
10+

‎helm/crons/templates/rbac.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
{{- $root := . -}}
2+
{{- range $ns := $root.Values.namespaces }}
3+
{{- range $sa := $root.Values.serviceAccounts }}
4+
apiVersion: v1
5+
kind: ServiceAccount
6+
metadata:
7+
name: {{ $sa }}
8+
namespace: {{ $ns }}
9+
---
10+
apiVersion: rbac.authorization.k8s.io/v1
11+
kind: RoleBinding
12+
metadata:
13+
name: {{ $sa }}
14+
namespace: {{ $ns }}
15+
subjects:
16+
- kind: ServiceAccount
17+
name: {{ $sa }}
18+
namespace: {{ $ns }}
19+
roleRef:
20+
apiGroup: rbac.authorization.k8s.io
21+
kind: ClusterRole
22+
name: edit
23+
---
24+
{{- end }}
25+
{{- end }}
26+

‎helm/crons/values.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
namespaces:
2+
- auth
3+
- http
4+
serviceAccounts:
5+
- proxy-account
6+
- token-account

0 commit comments

Comments
 (0)