Skip to content

Commit f538c4c

Browse files
author
Martin Linkhorst
committed
Merge remote-tracking branch 'origin/dev' into account-id
2 parents 1c7d20e + e3bc457 commit f538c4c

File tree

10 files changed

+172
-9
lines changed

10 files changed

+172
-9
lines changed

‎cluster/cluster.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1589,7 +1589,7 @@ Resources:
15891589
DeploymentControllerRole:
15901590
Type: AWS::IAM::Role
15911591
Properties:
1592-
RoleName: "{{.Cluster.LocalID}}-deployment-service-controller"
1592+
RoleName: "{{.Cluster.ConfigItems.deployment_service_controller_role_name}}"
15931593
AssumeRolePolicyDocument: !Sub
15941594
- |
15951595
{
@@ -1654,11 +1654,11 @@ Resources:
16541654
- 'sts:AssumeRole'
16551655
Effect: Allow
16561656
Resource:
1657-
- !Sub "arn:aws:iam::${AWS::AccountId}:role/{{.Cluster.LocalID}}-deployment-service-deployment"
1657+
- !Sub "arn:aws:iam::${AWS::AccountId}:role/{{.Cluster.ConfigItems.deployment_service_deployment_role_name}}"
16581658
DeploymentControllerDeploymentRole:
16591659
Type: AWS::IAM::Role
16601660
Properties:
1661-
RoleName: "{{.Cluster.LocalID}}-deployment-service-deployment"
1661+
RoleName: "{{.Cluster.ConfigItems.deployment_service_deployment_role_name}}"
16621662
AssumeRolePolicyDocument:
16631663
Version: "2012-10-17"
16641664
Statement:
@@ -1692,7 +1692,7 @@ Resources:
16921692
DeploymentStatusServiceRole:
16931693
Type: AWS::IAM::Role
16941694
Properties:
1695-
RoleName: "{{.Cluster.LocalID}}-deployment-service-status-service"
1695+
RoleName: "{{.Cluster.ConfigItems.deployment_service_status_service_role_name}}"
16961696
AssumeRolePolicyDocument: !Sub
16971697
- |
16981698
{

‎cluster/config-defaults.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1040,6 +1040,9 @@ deployment_service_tokeninfo_url: ""
10401040
deployment_service_lightstep_token: ""
10411041
deployment_service_ml_experiments_enabled: "true"
10421042
deployment_service_ml_experiments_role_name: "{{ .Cluster.LocalID }}-deployment-service-ml-experiment-deployment"
1043+
deployment_service_controller_role_name: "{{ .Cluster.LocalID }}-deployment-service-controller"
1044+
deployment_service_deployment_role_name: "{{ .Cluster.LocalID }}-deployment-service-deployment"
1045+
deployment_service_status_service_role_name: "{{ .Cluster.LocalID }}-deployment-service-status-service"
10431046
deployment_service_cf_auto_expand_enabled: "false"
10441047
deployment_service_cf_update_source_branch_changes: "true"
10451048
deployment_service_executor_cdp_permissions: "false"
@@ -1288,3 +1291,6 @@ aws_vpc_cni_network_policy_enforcing_mode: "standard"
12881291
# aws-load-balancer-controller resource settings
12891292
aws_load_balancer_controller_cpu: "100m"
12901293
aws_load_balancer_controller_mem_max: "4Gi"
1294+
1295+
# configure if sandbox-controller should be deployed
1296+
sandbox_controller_enabled: "false"

‎cluster/manifests/01-coredns-local/daemonset-coredns.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -180,6 +180,8 @@ spec:
180180
operator: Exists
181181
- key: dedicated
182182
operator: Exists
183+
- key: "zalando.org/dedicated"
184+
operator: Exists
183185
- key: aws.amazon.com/spot
184186
operator: Exists
185187
- key: zalando.org/node-not-ready

‎cluster/manifests/deletions.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -297,6 +297,11 @@ post_apply:
297297
kind : Deployment
298298
namespace: wiz
299299
{{- end }}
300+
{{ if ne .Cluster.ConfigItems.sandbox_controller_enabled "true" }}
301+
- name: sandbox-controller
302+
namespace: kube-system
303+
kind: Deployment
304+
{{ end }}
300305
{{- if and (ne .Cluster.ConfigItems.wiz_enable_runtime_connector_broker "true") (ne .Cluster.ConfigItems.wiz_enable_runtime_connector "true") }}
301306
- name: wiz-connector-connector
302307
kind : Secret

‎cluster/manifests/deployment-service/01-config.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ data:
1919
s3-bucket-name: "{{ .Cluster.ConfigItems.deployment_service_bucket_name }}"
2020
status-service-url: "https://depl-status-{{.Cluster.Alias}}.{{.Values.hosted_zone}}"
2121
status-service-url-local: "http://deployment-status-service.ingress.cluster.local."
22-
deployment-role-arn: "arn:aws:iam::{{.Cluster.InfrastructureAccountID}}:role/{{.Cluster.LocalID}}-deployment-service-deployment"
22+
deployment-role-arn: "arn:aws:iam::{{.Cluster.InfrastructureAccountID}}:role/{{.Cluster.ConfigItems.deployment_service_deployment_role_name}}"
2323
{{- if eq .Cluster.ConfigItems.deployment_service_ml_experiments_enabled "true"}}
2424
ml-experiment-deployment-role-arn: "arn:aws:iam::{{.Cluster.InfrastructureAccountID}}:role/{{ .Cluster.ConfigItems.deployment_service_ml_experiments_role_name }}"
2525
{{- end }}

‎cluster/manifests/deployment-service/controller-rbac.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,9 @@ metadata:
88
component: "controller"
99
annotations:
1010
{{- if eq .Cluster.Provider "zalando-eks" }}
11-
eks.amazonaws.com/role-arn: "arn:aws:iam::{{.Cluster.InfrastructureAccountID}}:role/{{.Cluster.LocalID}}-deployment-service-controller"
11+
eks.amazonaws.com/role-arn: "arn:aws:iam::{{.Cluster.InfrastructureAccountID}}:role/{{.Cluster.ConfigItems.deployment_service_controller_role_name}}"
1212
{{- else }}
13-
iam.amazonaws.com/role: "{{.Cluster.LocalID}}-deployment-service-controller"
13+
iam.amazonaws.com/role: "{{.Cluster.ConfigItems.deployment_service_controller_role_name}}"
1414
{{- end }}
1515
---
1616
kind: ClusterRole

‎cluster/manifests/deployment-service/status-service-rbac.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,9 @@ metadata:
88
component: "status-service"
99
annotations:
1010
{{- if eq .Cluster.Provider "zalando-eks" }}
11-
eks.amazonaws.com/role-arn: "arn:aws:iam::{{.Cluster.InfrastructureAccountID}}:role/{{.Cluster.LocalID}}-deployment-service-status-service"
11+
eks.amazonaws.com/role-arn: "arn:aws:iam::{{.Cluster.InfrastructureAccountID}}:role/{{.Cluster.ConfigItems.deployment_service_status_service_role_name}}"
1212
{{- else }}
13-
iam.amazonaws.com/role: "{{.Cluster.LocalID}}-deployment-service-status-service"
13+
iam.amazonaws.com/role: "{{.Cluster.ConfigItems.deployment_service_status_service_role_name}}"
1414
{{- end }}
1515
---
1616
kind: ClusterRole

‎cluster/manifests/sandbox-controller/10-sandbox_crd.yaml

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{{ if eq .Cluster.ConfigItems.sandbox_controller_enabled "true" }}
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
name: sandboxes.zalando.org
6+
spec:
7+
group: zalando.org
8+
names:
9+
kind: Sandbox
10+
plural: sandboxes
11+
singular: sandbox
12+
shortNames:
13+
- sb
14+
scope: Namespaced
15+
versions:
16+
- name: v1
17+
served: true
18+
storage: true
19+
schema:
20+
openAPIV3Schema:
21+
type: object
22+
properties:
23+
spec:
24+
type: object
25+
required:
26+
- testContext
27+
- sourceHosts
28+
- target
29+
properties:
30+
testContext:
31+
type: string
32+
sourceHosts:
33+
type: array
34+
items:
35+
type: string
36+
target:
37+
type: string
38+
{{ end }}

‎cluster/manifests/sandbox-controller/20-rbac.yaml

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{{ if eq .Cluster.ConfigItems.sandbox_controller_enabled "true" }}
2+
3+
apiVersion: v1
4+
kind: ServiceAccount
5+
metadata:
6+
name: sandbox-controller
7+
namespace: kube-system
8+
labels:
9+
application: sandbox-controller
10+
component: sandbox-controller
11+
---
12+
apiVersion: rbac.authorization.k8s.io/v1
13+
kind: ClusterRole
14+
metadata:
15+
name: sandbox-controller
16+
labels:
17+
application: sandbox-controller
18+
component: sandbox-controller
19+
rules:
20+
- apiGroups:
21+
- zalando.org
22+
resources:
23+
- sandboxes
24+
verbs:
25+
- get
26+
- list
27+
- watch
28+
- apiGroups:
29+
- zalando.org
30+
resources:
31+
- routegroups
32+
verbs:
33+
- list
34+
- watch
35+
- get
36+
- create
37+
- update
38+
- patch
39+
- delete
40+
- apiGroups:
41+
- networking.k8s.io
42+
resources:
43+
- ingresses
44+
verbs:
45+
- list
46+
- watch
47+
- get
48+
- create
49+
- update
50+
- patch
51+
- delete
52+
---
53+
apiVersion: rbac.authorization.k8s.io/v1
54+
kind: ClusterRoleBinding
55+
metadata:
56+
name: sandbox-controller
57+
labels:
58+
application: sandbox-controller
59+
component: sandbox-controller
60+
roleRef:
61+
apiGroup: rbac.authorization.k8s.io
62+
kind: ClusterRole
63+
name: sandbox-controller
64+
subjects:
65+
- kind: ServiceAccount
66+
name: sandbox-controller
67+
namespace: kube-system
68+
{{ end }}

‎cluster/manifests/sandbox-controller/30-deployment.yaml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# {{ $image := "container-registry.zalando.net/gwproxy/sandbox-controller:main-8" }}
2+
# {{ $version := index (split $image ":") 1 }}
3+
4+
{{ if eq .Cluster.ConfigItems.sandbox_controller_enabled "true" }}
5+
apiVersion: apps/v1
6+
kind: Deployment
7+
metadata:
8+
name: sandbox-controller
9+
namespace: kube-system
10+
labels:
11+
application: sandbox-controller
12+
version: "{{ $version }}"
13+
spec:
14+
replicas: 1
15+
selector:
16+
matchLabels:
17+
application: sandbox-controller
18+
template:
19+
metadata:
20+
labels:
21+
application: sandbox-controller
22+
version: "{{ $version }}"
23+
annotations:
24+
kubernetes-log-watcher/scalyr-parser: |
25+
[{"container": "controller", "parser": "keyValue"}]
26+
logging/destination: "{{ .Cluster.ConfigItems.log_destination_both }}"
27+
# no metrics exposed so far
28+
# prometheus.io/path: /metrics
29+
# prometheus.io/port: "7979"
30+
# prometheus.io/scrape: "true"
31+
spec:
32+
priorityClassName: "{{ .Cluster.ConfigItems.system_priority_class }}"
33+
serviceAccountName: sandbox-controller
34+
containers:
35+
- name: controller
36+
image: "{{ $image }}"
37+
resources:
38+
limits:
39+
cpu: 50m
40+
memory: 0.3Gi
41+
requests:
42+
cpu: 50m
43+
memory: 0.3Gi
44+
{{ end }}

0 commit comments

Comments
 (0)