Skip to content

Commit 1796ea3

Browse files
tmshorttmshort
committed
WIP: Consolidate deployments; add downstream ns labels, nodeSelector, tolerations
Signed-off-by: Todd Short <[email protected]>
1 parent 4d092fe commit 1796ea3

11 files changed

+445
-371
lines changed

‎helm/olmv1/templates/00-namespace.yml

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,18 @@ metadata:
55
annotations:
66
{{- include "olmv1.annotations" . | nindent 4 }}
77
{{- with .Values.namespaces.olmv1.annotations }}
8-
{{- toYaml . | nindent 4 }}
8+
{{- toYamlPretty . | nindent 4 }}
99
{{- end }}
1010
labels:
1111
app.kubernetes.io/name: olmv1
12+
pod-security.kubernetes.io/audit: {{ .Values.namespaces.olmv1.podSecurityProfile }}
13+
pod-security.kubernetes.io/audit-version: latest
14+
pod-security.kubernetes.io/enforce: {{ .Values.namespaces.olmv1.podSecurityProfile }}
15+
pod-security.kubernetes.io/enforce-version: latest
16+
pod-security.kubernetes.io/warn: {{ .Values.namespaces.olmv1.podSecurityProfile }}
17+
pod-security.kubernetes.io/warn-version: latest
1218
{{- include "olmv1.labels" . | nindent 4 }}
1319
{{- with .Values.namespaces.olmv1.labels }}
14-
{{- toYaml . | nindent 4 }}
20+
{{- toYamlPretty . | nindent 4 }}
1521
{{- end }}
1622
name: {{ .Values.namespaces.olmv1.name }}

‎helm/olmv1/templates/06-role-olmv1-system-catalogd-manager-role.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,5 +19,4 @@ rules:
1919
- get
2020
- list
2121
- watch
22-
{{- include "olmv1.catalogd.role.rules" . | nindent 2 }}
2322
{{- end }}

‎helm/olmv1/templates/08-role-olmv1-system-operator-controller-manager-role.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,5 +31,4 @@ rules:
3131
- get
3232
- list
3333
- watch
34-
{{- include "olmv1.operatorController.role.rules" . | nindent 2 }}
3534
{{- end }}

‎helm/olmv1/templates/29-deployment-olmv1-system-catalogd-controller-manager.yml

Lines changed: 6 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -33,25 +33,6 @@ spec:
3333
{{- toYamlPretty . | nindent 8 }}
3434
{{- end }}
3535
spec:
36-
{{- if .Values.components.catalogd.deployment.priorityClassName }}
37-
priorityClassName: {{ .Values.components.catalogd.deployment.priorityClassName }}
38-
{{- end }}
39-
affinity:
40-
nodeAffinity:
41-
requiredDuringSchedulingIgnoredDuringExecution:
42-
nodeSelectorTerms:
43-
- matchExpressions:
44-
- key: kubernetes.io/arch
45-
operator: In
46-
values:
47-
- amd64
48-
- arm64
49-
- ppc64le
50-
- s390x
51-
- key: kubernetes.io/os
52-
operator: In
53-
values:
54-
- linux
5536
containers:
5637
- args:
5738
{{- if not .Values.features.tilt.enabled }}
@@ -83,7 +64,6 @@ spec:
8364
{{- toYamlPretty . | nindent 12 }}
8465
{{- end }}
8566
image: "{{ .Values.components.catalogd.deployment.image }}"
86-
imagePullPolicy: {{ .Values.components.catalogd.deployment.imagePullPolicy }}
8767
{{- if not .Values.features.tilt.enabled }}
8868
livenessProbe:
8969
httpGet:
@@ -105,11 +85,6 @@ spec:
10585
requests:
10686
cpu: 100m
10787
memory: 200Mi
108-
{{- with .Values.securityContext }}
109-
securityContext:
110-
{{- toYaml . | nindent 12 }}
111-
{{- end }}
112-
terminationMessagePolicy: FallbackToLogsOnError
11388
volumeMounts:
11489
{{- if .Values.components.e2e.enabled }}
11590
- mountPath: /e2e-coverage
@@ -127,14 +102,12 @@ spec:
127102
readOnly: true
128103
{{- end }}
129104
{{- with .Values.components.catalogd.deployment.volumeMounts }}
130-
{{- toYaml . | nindent 12 }}
105+
{{- toYamlPretty . | nindent 12 }}
131106
{{- end }}
132-
{{- with .Values.podSecurityContext }}
133-
securityContext:
134-
{{- toYaml . | nindent 8 }}
135-
{{- end }}
107+
{{- with .Values.deployments.containerSpec }}
108+
{{- toYamlPretty . | nindent 10 }}
109+
{{- end }}
136110
serviceAccountName: catalogd-controller-manager
137-
terminationGracePeriodSeconds: 10
138111
volumes:
139112
{{- if .Values.components.e2e.enabled }}
140113
- name: e2e-coverage-volume
@@ -160,16 +133,7 @@ spec:
160133
{{- with .Values.components.catalogd.deployment.volumes }}
161134
{{- toYaml . | nindent 8 }}
162135
{{- end }}
163-
{{- with .Values.components.catalogd.deployment.nodeSelector }}
164-
nodeSelector:
165-
{{- toYaml . | nindent 8 }}
166-
{{- end }}
167-
{{- with .Values.components.catalogd.deployment.affinity }}
168-
affinity:
169-
{{- toYaml . | nindent 8 }}
170-
{{- end }}
171-
{{- with .Values.components.catalogd.deployment.tolerations }}
172-
tolerations:
173-
{{- toYaml . | nindent 8 }}
136+
{{- with .Values.deployments.templateSpec }}
137+
{{- toYamlPretty . | nindent 6 }}
174138
{{- end }}
175139
{{- end }}

‎helm/olmv1/templates/30-deployment-olmv1-system-operator-controller-controller-manager.yml

Lines changed: 5 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -32,25 +32,6 @@ spec:
3232
{{- toYamlPretty . | nindent 8 }}
3333
{{- end }}
3434
spec:
35-
{{- if .Values.components.operatorController.deployment.priorityClassName }}
36-
priorityClassName: {{ .Values.components.operatorController.deployment.priorityClassName }}
37-
{{- end }}
38-
affinity:
39-
nodeAffinity:
40-
requiredDuringSchedulingIgnoredDuringExecution:
41-
nodeSelectorTerms:
42-
- matchExpressions:
43-
- key: kubernetes.io/arch
44-
operator: In
45-
values:
46-
- amd64
47-
- arm64
48-
- ppc64le
49-
- s390x
50-
- key: kubernetes.io/os
51-
operator: In
52-
values:
53-
- linux
5435
containers:
5536
- args:
5637
- --health-probe-bind-address=:8081
@@ -92,8 +73,6 @@ spec:
9273
{{- toYamlPretty . | nindent 12 }}
9374
{{- end }}
9475
image: "{{ .Values.components.operatorController.deployment.image }}"
95-
image: quay.io/operator-framework/operator-controller:devel
96-
imagePullPolicy: {{ .Values.components.operatorController.deployment.imagePullPolicy }}
9776
{{- if not .Values.features.tilt.enabled }}
9877
livenessProbe:
9978
httpGet:
@@ -115,11 +94,6 @@ spec:
11594
requests:
11695
cpu: 10m
11796
memory: 64Mi
118-
{{- with .Values.securityContext }}
119-
securityContext:
120-
{{- toYaml . | nindent 12 }}
121-
{{- end }}
122-
terminationMessagePolicy: FallbackToLogsOnError
12397
volumeMounts:
12498
{{- if .Values.components.e2e.enabled }}
12599
- mountPath: /etc/containers
@@ -139,12 +113,10 @@ spec:
139113
{{- with .Values.components.operatorController.deployment.volumeMounts }}
140114
{{- toYaml . | nindent 12 }}
141115
{{- end }}
142-
{{- with .Values.podSecurityContext }}
143-
securityContext:
144-
{{- toYaml . | nindent 8 }}
145-
{{- end }}
116+
{{- with .Values.deployments.containerSpec }}
117+
{{- toYaml . | nindent 10 }}
118+
{{- end }}
146119
serviceAccountName: operator-controller-controller-manager
147-
terminationGracePeriodSeconds: 10
148120
volumes:
149121
{{- if .Values.components.e2e.enabled }}
150122
- configMap:
@@ -174,16 +146,7 @@ spec:
174146
{{- with .Values.components.operatorController.deployment.volumes }}
175147
{{- toYaml . | nindent 8 }}
176148
{{- end }}
177-
{{- with .Values.components.operatorController.deployment.nodeSelector }}
178-
nodeSelector:
179-
{{- toYaml . | nindent 8 }}
180-
{{- end }}
181-
{{- with .Values.components.operatorController.deployment.affinity }}
182-
affinity:
183-
{{- toYaml . | nindent 8 }}
184-
{{- end }}
185-
{{- with .Values.components.operatorController.deployment.tolerations }}
186-
tolerations:
187-
{{- toYaml . | nindent 8 }}
149+
{{- with .Values.deployments.templateSpec }}
150+
{{- toYamlPretty . | nindent 6 }}
188151
{{- end }}
189152
{{- end }}

‎helm/olmv1/templates/_helpers.tpl

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -46,24 +46,13 @@ olm.operatorframework.io/feature-set: {{ .Values.featureSet -}}{{- if .Values.co
4646
{{/*
4747
Insertion of additional rules for RBAC
4848
*/}}
49-
{{- define "olmv1.catalogd.role.rules" -}}
50-
{{- with .Values.components.catalogd.rules }}
51-
{{- toYamlPretty . }}
52-
{{- end }}
53-
{{- end }}
5449

5550
{{- define "olmv1.catalogd.clusterRole.rules" -}}
5651
{{- with .Values.components.catalogd.clusterRole.rules }}
5752
{{- toYamlPretty . }}
5853
{{- end }}
5954
{{- end }}
6055

61-
{{- define "olmv1.operatorController.role.rules" -}}
62-
{{- with .Values.components.operatorController.role.rules }}
63-
{{- toYamlPretty . }}
64-
{{- end }}
65-
{{- end }}
66-
6756
{{- define "olmv1.operatorController.clusterRole.rules" -}}
6857
{{- with .Values.components.operatorController.clusterRole.rules }}
6958
{{- toYamlPretty . }}

‎helm/olmv1/values.yaml

Lines changed: 50 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -8,16 +8,11 @@ components:
88
enabled: true
99
deployment:
1010
image: quay.io/operator-framework/operator-controller:devel
11-
imagePullPolicy: IfNotPresent
1211
volumeMounts: []
1312
volumes: []
14-
affinity: {}
15-
nodeSelector: {}
16-
tolerations: []
1713
podArguments: []
1814
podLabels: {}
1915
podAnnotations: {}
20-
priorityClassName: ""
2116
env: []
2217
service:
2318
annotations: {}
@@ -29,23 +24,16 @@ components:
2924
enabled: true
3025
deployment:
3126
image: quay.io/operator-framework/catalogd:devel
32-
imagePullPolicy: IfNotPresent
3327
volumeMounts: []
3428
volumes: []
35-
affinity: {}
36-
nodeSelector: {}
37-
tolerations: []
3829
podArguments: []
3930
podLabels: {}
4031
podAnnotations: {}
41-
priorityClassName: ""
4232
env: []
4333
service:
4434
annotations: {}
4535
clusterRole:
4636
rules: []
47-
role:
48-
rules: []
4937
webhook:
5038
annotations: {}
5139
certManager:
@@ -74,23 +62,57 @@ featureSet: standard
7462
namespaces:
7563
olmv1:
7664
name: olmv1-system
77-
labels:
78-
pod-security.kubernetes.io/enforce: restricted
79-
pod-security.kubernetes.io/enforce-version: latest
65+
podSecurityProfile: restricted
66+
labels: {}
8067
annotations: {}
8168
certManager:
8269
name: cert-manager
8370

84-
# Pod-level security context
85-
podSecurityContext:
86-
runAsNonRoot: true
87-
seccompProfile:
88-
type: RuntimeDefault
89-
90-
# Container-level security context
91-
securityContext:
92-
allowPrivilegeEscalation: false
93-
capabilities:
94-
drop:
95-
- ALL
96-
readOnlyRootFilesystem: true
71+
# Common deployment values for operator-controller and catalogd
72+
deployments:
73+
templateSpec:
74+
affinity:
75+
nodeAffinity:
76+
requiredDuringSchedulingIgnoredDuringExecution:
77+
nodeSelectorTerms:
78+
- matchExpressions:
79+
- key: kubernetes.io/arch
80+
operator: In
81+
values:
82+
- amd64
83+
- arm64
84+
- ppc64le
85+
- s390x
86+
- key: kubernetes.io/os
87+
operator: In
88+
values:
89+
- linux
90+
nodeSelector:
91+
kubernetes.io/os: linux
92+
node-role.kubernetes.io/control-plane: ""
93+
securityContext:
94+
runAsNonRoot: true
95+
seccompProfile:
96+
type: RuntimeDefault
97+
terminationGracePeriodSeconds: 10
98+
tolerations:
99+
- effect: NoSchedule
100+
key: node-role.kubernetes.io/control-plane
101+
operator: Exists
102+
- effect: NoExecute
103+
key: node.kubernetes.io/unreachable
104+
operator: Exists
105+
tolerationSeconds: 120
106+
- effect: NoExecute
107+
key: node.kubernetes.io/not-ready
108+
operator: Exists
109+
tolerationSeconds: 120
110+
containerSpec:
111+
imagePullPolicy: IfNotPresent
112+
securityContext:
113+
allowPrivilegeEscalation: false
114+
capabilities:
115+
drop:
116+
- ALL
117+
readOnlyRootFilesystem: true
118+
terminationMessagePolicy: FallbackToLogsOnError

0 commit comments

Comments
 (0)