Move eck-operator to new module
This commit is contained in:
parent
90e2ab60bc
commit
04063f8739
@ -8,6 +8,22 @@ import yaml
|
||||
def migrate(values):
|
||||
"""Actual changes here"""
|
||||
|
||||
# Cleanup
|
||||
values.pop("Domain", None)
|
||||
values.pop("clusterName", None)
|
||||
if "addons" in values:
|
||||
if not values["addons"]:
|
||||
values.pop("addons")
|
||||
|
||||
# migrate eck operator to new operator module
|
||||
try:
|
||||
if values["logging"]["eck-operator"]["enabled"]:
|
||||
if "operators" not in values:
|
||||
values["operators"] = {}
|
||||
values["operators"]["eck-operator"] = { "enabled": true }
|
||||
except KeyError:
|
||||
pass
|
||||
|
||||
return values
|
||||
|
||||
|
||||
|
||||
@ -111,7 +111,7 @@ Device plugin for [AWS Neuron](https://aws.amazon.com/machine-learning/neuron/)
|
||||
| cluster-autoscaler.extraArgs.scan-interval | string | `"30s"` | |
|
||||
| cluster-autoscaler.extraArgs.skip-nodes-with-local-storage | bool | `false` | |
|
||||
| cluster-autoscaler.image.repository | string | `"registry.k8s.io/autoscaling/cluster-autoscaler"` | |
|
||||
| cluster-autoscaler.image.tag | string | `"v1.26.4"` | |
|
||||
| cluster-autoscaler.image.tag | string | `"v1.27.3"` | |
|
||||
| cluster-autoscaler.nodeSelector."node-role.kubernetes.io/control-plane" | string | `""` | |
|
||||
| cluster-autoscaler.podDisruptionBudget | bool | `false` | |
|
||||
| cluster-autoscaler.prometheusRule.enabled | bool | `false` | |
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
# kubezero-auth
|
||||
|
||||
  
|
||||
  
|
||||
|
||||
KubeZero umbrella chart for all things Authentication and Identity management
|
||||
|
||||
|
||||
@ -153,8 +153,6 @@ jenkins:
|
||||
- podman-aws-trivy
|
||||
idleMinutes: 30
|
||||
containerCap: 2
|
||||
annotations:
|
||||
container.apparmor.security.beta.kubernetes.io/jnlp: unconfined
|
||||
resources:
|
||||
requests:
|
||||
cpu: ""
|
||||
|
||||
@ -20,4 +20,8 @@ dependencies:
|
||||
version: 2.4.0
|
||||
repository: https://opster.github.io/opensearch-k8s-operator/
|
||||
condition: opensearch-operator.enabled
|
||||
- name: eck-operator
|
||||
version: 2.9.0
|
||||
repository: https://helm.elastic.co
|
||||
condition: eck-operator.enabled
|
||||
kubeVersion: ">= 1.26.0"
|
||||
|
||||
24
charts/kubezero-operators/charts/eck-operator/.helmignore
Normal file
24
charts/kubezero-operators/charts/eck-operator/.helmignore
Normal file
@ -0,0 +1,24 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
templates/tests
|
||||
21
charts/kubezero-operators/charts/eck-operator/Chart.yaml
Normal file
21
charts/kubezero-operators/charts/eck-operator/Chart.yaml
Normal file
@ -0,0 +1,21 @@
|
||||
apiVersion: v2
|
||||
appVersion: 2.9.0
|
||||
description: Elastic Cloud on Kubernetes (ECK) operator
|
||||
home: https://github.com/elastic/cloud-on-k8s
|
||||
icon: https://helm.elastic.co/icons/eck.png
|
||||
keywords:
|
||||
- Logstash
|
||||
- Elasticsearch
|
||||
- Kibana
|
||||
- APM Server
|
||||
- Beats
|
||||
- Enterprise Search
|
||||
- Elastic Stack
|
||||
- Operator
|
||||
kubeVersion: '>=1.21.0-0'
|
||||
maintainers:
|
||||
- email: eck@elastic.co
|
||||
name: Elastic
|
||||
name: eck-operator
|
||||
type: application
|
||||
version: 2.9.0
|
||||
93
charts/kubezero-operators/charts/eck-operator/LICENSE
Normal file
93
charts/kubezero-operators/charts/eck-operator/LICENSE
Normal file
@ -0,0 +1,93 @@
|
||||
Elastic License 2.0
|
||||
|
||||
URL: https://www.elastic.co/licensing/elastic-license
|
||||
|
||||
## Acceptance
|
||||
|
||||
By using the software, you agree to all of the terms and conditions below.
|
||||
|
||||
## Copyright License
|
||||
|
||||
The licensor grants you a non-exclusive, royalty-free, worldwide,
|
||||
non-sublicensable, non-transferable license to use, copy, distribute, make
|
||||
available, and prepare derivative works of the software, in each case subject to
|
||||
the limitations and conditions below.
|
||||
|
||||
## Limitations
|
||||
|
||||
You may not provide the software to third parties as a hosted or managed
|
||||
service, where the service provides users with access to any substantial set of
|
||||
the features or functionality of the software.
|
||||
|
||||
You may not move, change, disable, or circumvent the license key functionality
|
||||
in the software, and you may not remove or obscure any functionality in the
|
||||
software that is protected by the license key.
|
||||
|
||||
You may not alter, remove, or obscure any licensing, copyright, or other notices
|
||||
of the licensor in the software. Any use of the licensor’s trademarks is subject
|
||||
to applicable law.
|
||||
|
||||
## Patents
|
||||
|
||||
The licensor grants you a license, under any patent claims the licensor can
|
||||
license, or becomes able to license, to make, have made, use, sell, offer for
|
||||
sale, import and have imported the software, in each case subject to the
|
||||
limitations and conditions in this license. This license does not cover any
|
||||
patent claims that you cause to be infringed by modifications or additions to
|
||||
the software. If you or your company make any written claim that the software
|
||||
infringes or contributes to infringement of any patent, your patent license for
|
||||
the software granted under these terms ends immediately. If your company makes
|
||||
such a claim, your patent license ends immediately for work on behalf of your
|
||||
company.
|
||||
|
||||
## Notices
|
||||
|
||||
You must ensure that anyone who gets a copy of any part of the software from you
|
||||
also gets a copy of these terms.
|
||||
|
||||
If you modify the software, you must include in any modified copies of the
|
||||
software prominent notices stating that you have modified the software.
|
||||
|
||||
## No Other Rights
|
||||
|
||||
These terms do not imply any licenses other than those expressly granted in
|
||||
these terms.
|
||||
|
||||
## Termination
|
||||
|
||||
If you use the software in violation of these terms, such use is not licensed,
|
||||
and your licenses will automatically terminate. If the licensor provides you
|
||||
with a notice of your violation, and you cease all violation of this license no
|
||||
later than 30 days after you receive that notice, your licenses will be
|
||||
reinstated retroactively. However, if you violate these terms after such
|
||||
reinstatement, any additional violation of these terms will cause your licenses
|
||||
to terminate automatically and permanently.
|
||||
|
||||
## No Liability
|
||||
|
||||
*As far as the law allows, the software comes as is, without any warranty or
|
||||
condition, and the licensor will not be liable to you for any damages arising
|
||||
out of these terms or the use or nature of the software, under any kind of
|
||||
legal claim.*
|
||||
|
||||
## Definitions
|
||||
|
||||
The **licensor** is the entity offering these terms, and the **software** is the
|
||||
software the licensor makes available under these terms, including any portion
|
||||
of it.
|
||||
|
||||
**you** refers to the individual or entity agreeing to these terms.
|
||||
|
||||
**your company** is any legal entity, sole proprietorship, or other kind of
|
||||
organization that you work for, plus all organizations that have control over,
|
||||
are under the control of, or are under common control with that
|
||||
organization. **control** means ownership of substantially all the assets of an
|
||||
entity, or the power to direct its management and policies by vote, contract, or
|
||||
otherwise. Control can be direct or indirect.
|
||||
|
||||
**your licenses** are all the licenses granted to you for the software under
|
||||
these terms.
|
||||
|
||||
**use** means anything you do with the software requiring one of your licenses.
|
||||
|
||||
**trademark** means trademarks, service marks, and similar rights.
|
||||
20
charts/kubezero-operators/charts/eck-operator/README.md
Normal file
20
charts/kubezero-operators/charts/eck-operator/README.md
Normal file
@ -0,0 +1,20 @@
|
||||
# ECK Operator Helm Chart
|
||||
|
||||
[](https://artifacthub.io/packages/helm/elastic/eck-operator)
|
||||
|
||||
A Helm chart to install the ECK Operator: the official Kubernetes operator from Elastic to orchestrate Elasticsearch, Kibana, APM Server, Enterprise Search, and Beats on Kubernetes.
|
||||
|
||||
For more information about the ECK Operator, see:
|
||||
- [Documentation](https://www.elastic.co/guide/en/cloud-on-k8s/current/index.html)
|
||||
- [GitHub repo](https://github.com/elastic/cloud-on-k8s)
|
||||
|
||||
|
||||
## Requirements
|
||||
|
||||
- Supported Kubernetes versions are listed in the documentation: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s_supported_versions.html
|
||||
- Helm >= 3.2.0
|
||||
|
||||
|
||||
## Usage
|
||||
|
||||
Refer to the documentation at https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-install-helm.html
|
||||
10493
charts/kubezero-operators/charts/eck-operator/crds/all-crds.yaml
Normal file
10493
charts/kubezero-operators/charts/eck-operator/crds/all-crds.yaml
Normal file
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,6 @@
|
||||
managedNamespaces: []
|
||||
|
||||
createClusterScopedResources: true
|
||||
|
||||
webhook:
|
||||
enabled: true
|
||||
@ -0,0 +1,11 @@
|
||||
managedNamespaces: []
|
||||
|
||||
createClusterScopedResources: true
|
||||
|
||||
webhook:
|
||||
enabled: true
|
||||
|
||||
podAnnotations:
|
||||
sidecar.istio.io/inject: "true"
|
||||
traffic.sidecar.istio.io/includeInboundPorts: "*"
|
||||
traffic.sidecar.istio.io/excludeInboundPorts: "9443"
|
||||
@ -0,0 +1,12 @@
|
||||
managedNamespaces: ["elastic-system"]
|
||||
|
||||
createClusterScopedResources: false
|
||||
|
||||
config:
|
||||
# no RBAC access to cluster-wide storage classes, hence disable storage class validation
|
||||
validateStorageClass: false
|
||||
|
||||
installCRDs: false
|
||||
|
||||
webhook:
|
||||
enabled: false
|
||||
@ -0,0 +1,18 @@
|
||||
managedNamespaces: ["team-a", "team-b"]
|
||||
|
||||
createClusterScopedResources: true
|
||||
|
||||
refs:
|
||||
enforceRBAC: true
|
||||
|
||||
webhook:
|
||||
enabled: true
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: "eck.k8s.elastic.co/tenant"
|
||||
operator: In
|
||||
values: ["team-a", "team-b"]
|
||||
|
||||
|
||||
softMultiTenancy:
|
||||
enabled: true
|
||||
@ -0,0 +1,2 @@
|
||||
1. Inspect the operator logs by running the following command:
|
||||
kubectl logs -n {{ .Release.Namespace }} sts/{{ .Release.Name }}
|
||||
@ -0,0 +1,366 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "eck-operator.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "eck-operator.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "eck-operator.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "eck-operator.labels" -}}
|
||||
{{- include "eck-operator.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
helm.sh/chart: {{ include "eck-operator.chart" . }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "eck-operator.selectorLabels" -}}
|
||||
{{- if .Values.global.manifestGen }}
|
||||
control-plane: elastic-operator
|
||||
{{- else }}
|
||||
app.kubernetes.io/name: {{ include "eck-operator.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "eck-operator.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "eck-operator.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Determine effective Kubernetes version
|
||||
*/}}
|
||||
{{- define "eck-operator.effectiveKubeVersion" -}}
|
||||
{{- if .Values.global.manifestGen -}}
|
||||
{{- semver .Values.global.kubeVersion -}}
|
||||
{{- else -}}
|
||||
{{- .Capabilities.KubeVersion.Version -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Determine the name for the webhook
|
||||
*/}}
|
||||
{{- define "eck-operator.webhookName" -}}
|
||||
{{- if .Values.global.manifestGen -}}
|
||||
elastic-webhook.k8s.elastic.co
|
||||
{{- else -}}
|
||||
{{- $name := include "eck-operator.name" . -}}
|
||||
{{ printf "%s.%s.k8s.elastic.co" $name .Release.Namespace }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Determine the name for the webhook secret
|
||||
*/}}
|
||||
{{- define "eck-operator.webhookSecretName" -}}
|
||||
{{- if .Values.global.manifestGen -}}
|
||||
elastic-webhook-server-cert
|
||||
{{- else -}}
|
||||
{{- $name := include "eck-operator.name" . -}}
|
||||
{{ printf "%s-webhook-cert" $name | trunc 63 }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Determine the name for the webhook service
|
||||
*/}}
|
||||
{{- define "eck-operator.webhookServiceName" -}}
|
||||
{{- if .Values.global.manifestGen -}}
|
||||
elastic-webhook-server
|
||||
{{- else -}}
|
||||
{{- $name := include "eck-operator.name" . -}}
|
||||
{{ printf "%s-webhook" $name | trunc 63 }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
RBAC permissions
|
||||
NOTE - any changes made to RBAC permissions below require
|
||||
updating docs/operating-eck/eck-permissions.asciidoc file.
|
||||
*/}}
|
||||
{{- define "eck-operator.rbacRules" -}}
|
||||
- apiGroups:
|
||||
- "authorization.k8s.io"
|
||||
resources:
|
||||
- subjectaccessreviews
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
resourceNames:
|
||||
- elastic-operator-leader
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- events
|
||||
- persistentvolumeclaims
|
||||
- secrets
|
||||
- services
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
- statefulsets
|
||||
- daemonsets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- policy
|
||||
resources:
|
||||
- poddisruptionbudgets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- elasticsearch.k8s.elastic.co
|
||||
resources:
|
||||
- elasticsearches
|
||||
- elasticsearches/status
|
||||
- elasticsearches/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- autoscaling.k8s.elastic.co
|
||||
resources:
|
||||
- elasticsearchautoscalers
|
||||
- elasticsearchautoscalers/status
|
||||
- elasticsearchautoscalers/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- kibana.k8s.elastic.co
|
||||
resources:
|
||||
- kibanas
|
||||
- kibanas/status
|
||||
- kibanas/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- apm.k8s.elastic.co
|
||||
resources:
|
||||
- apmservers
|
||||
- apmservers/status
|
||||
- apmservers/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- enterprisesearch.k8s.elastic.co
|
||||
resources:
|
||||
- enterprisesearches
|
||||
- enterprisesearches/status
|
||||
- enterprisesearches/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- beat.k8s.elastic.co
|
||||
resources:
|
||||
- beats
|
||||
- beats/status
|
||||
- beats/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- agent.k8s.elastic.co
|
||||
resources:
|
||||
- agents
|
||||
- agents/status
|
||||
- agents/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- maps.k8s.elastic.co
|
||||
resources:
|
||||
- elasticmapsservers
|
||||
- elasticmapsservers/status
|
||||
- elasticmapsservers/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- stackconfigpolicy.k8s.elastic.co
|
||||
resources:
|
||||
- stackconfigpolicies
|
||||
- stackconfigpolicies/status
|
||||
- stackconfigpolicies/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- logstash.k8s.elastic.co
|
||||
resources:
|
||||
- logstashes
|
||||
- logstashes/status
|
||||
- logstashes/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
RBAC permissions on non-namespaced resources
|
||||
*/}}
|
||||
{{- define "eck-operator.clusterWideRbacRules" -}}
|
||||
- apiGroups:
|
||||
- storage.k8s.io
|
||||
resources:
|
||||
- storageclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- admissionregistration.k8s.io
|
||||
resources:
|
||||
- validatingwebhookconfigurations
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
RBAC permissions to read node labels
|
||||
*/}}
|
||||
{{- define "eck-operator.readNodeLabelsRbacRule" -}}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end -}}
|
||||
@ -0,0 +1,96 @@
|
||||
{{- if .Values.createClusterScopedResources -}}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "eck-operator.fullname" . }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
||||
rules:
|
||||
{{ template "eck-operator.rbacRules" . | toYaml | indent 2 }}
|
||||
{{ template "eck-operator.clusterWideRbacRules" . | toYaml | indent 2 }}
|
||||
{{ if .Values.config.exposedNodeLabels }}
|
||||
{{ template "eck-operator.readNodeLabelsRbacRule" . | toYaml | indent 2 }}
|
||||
{{ end -}}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: "{{ include "eck-operator.name" . }}-view"
|
||||
labels:
|
||||
rbac.authorization.k8s.io/aggregate-to-view: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ["elasticsearch.k8s.elastic.co"]
|
||||
resources: ["elasticsearches"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["autoscaling.k8s.elastic.co"]
|
||||
resources: ["elasticsearchautoscalers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["apm.k8s.elastic.co"]
|
||||
resources: ["apmservers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["kibana.k8s.elastic.co"]
|
||||
resources: ["kibanas"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["enterprisesearch.k8s.elastic.co"]
|
||||
resources: ["enterprisesearches"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["beat.k8s.elastic.co"]
|
||||
resources: ["beats"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["agent.k8s.elastic.co"]
|
||||
resources: ["agents"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["maps.k8s.elastic.co"]
|
||||
resources: ["elasticmapsservers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["stackconfigpolicy.k8s.elastic.co"]
|
||||
resources: ["stackconfigpolicies"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["logstash.k8s.elastic.co"]
|
||||
resources: ["logstashes"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: "{{ include "eck-operator.name" . }}-edit"
|
||||
labels:
|
||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ["elasticsearch.k8s.elastic.co"]
|
||||
resources: ["elasticsearches"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
- apiGroups: ["autoscaling.k8s.elastic.co"]
|
||||
resources: ["elasticsearchautoscalers"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
- apiGroups: ["apm.k8s.elastic.co"]
|
||||
resources: ["apmservers"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
- apiGroups: ["kibana.k8s.elastic.co"]
|
||||
resources: ["kibanas"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
- apiGroups: ["enterprisesearch.k8s.elastic.co"]
|
||||
resources: ["enterprisesearches"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
- apiGroups: ["beat.k8s.elastic.co"]
|
||||
resources: ["beats"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
- apiGroups: ["agent.k8s.elastic.co"]
|
||||
resources: ["agents"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
- apiGroups: ["maps.k8s.elastic.co"]
|
||||
resources: ["elasticmapsservers"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
- apiGroups: ["stackconfigpolicy.k8s.elastic.co"]
|
||||
resources: ["stackconfigpolicies"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
- apiGroups: ["logstash.k8s.elastic.co"]
|
||||
resources: ["logstashes"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
{{- end -}}
|
||||
@ -0,0 +1,62 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "eck-operator.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
||||
data:
|
||||
eck.yaml: |-
|
||||
log-verbosity: {{ int .Values.config.logVerbosity }}
|
||||
metrics-port: {{ int .Values.config.metricsPort }}
|
||||
container-registry: {{ .Values.config.containerRegistry }}
|
||||
{{- with .Values.config.containerSuffix }}
|
||||
container-suffix: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.config.containerRepository }}
|
||||
container-repository: {{ . }}
|
||||
{{- end }}
|
||||
max-concurrent-reconciles: {{ int .Values.config.maxConcurrentReconciles }}
|
||||
{{- with .Values.config.passwordHashCacheSize }}
|
||||
password-hash-cache-size: {{ int . }}
|
||||
{{- end }}
|
||||
ca-cert-validity: {{ .Values.config.caValidity }}
|
||||
ca-cert-rotate-before: {{ .Values.config.caRotateBefore }}
|
||||
cert-validity: {{ .Values.config.certificatesValidity }}
|
||||
cert-rotate-before: {{ .Values.config.certificatesRotateBefore }}
|
||||
{{- with .Values.config.exposedNodeLabels }}
|
||||
exposed-node-labels: [{{ join "," . }}]
|
||||
{{- end }}
|
||||
set-default-security-context: {{ .Values.config.setDefaultSecurityContext }}
|
||||
kube-client-timeout: {{ .Values.config.kubeClientTimeout }}
|
||||
{{- with .Values.config.kubeClientQPS }}
|
||||
kube-client-qps: {{ int . }}
|
||||
{{- end }}
|
||||
elasticsearch-client-timeout: {{ .Values.config.elasticsearchClientTimeout }}
|
||||
disable-telemetry: {{ .Values.telemetry.disabled }}
|
||||
distribution-channel: {{ .Values.telemetry.distributionChannel }}
|
||||
{{- with .Values.telemetry.interval }}
|
||||
telemetry-interval: {{ . }}
|
||||
{{- end }}
|
||||
validate-storage-class: {{ .Values.config.validateStorageClass }}
|
||||
{{- if .Values.tracing.enabled }}
|
||||
enable-tracing: true
|
||||
{{- end }}
|
||||
{{- if .Values.refs.enforceRBAC }}
|
||||
enforce-rbac-on-refs: true
|
||||
{{- end }}
|
||||
enable-webhook: {{ .Values.webhook.enabled }}
|
||||
{{- if .Values.webhook.enabled }}
|
||||
webhook-name: {{ include "eck-operator.webhookName" . }}
|
||||
{{- if not .Values.webhook.manageCerts }}
|
||||
manage-webhook-certs: false
|
||||
webhook-cert-dir: {{ .Values.webhook.certsDir }}
|
||||
{{- end }}
|
||||
webhook-port: {{ .Values.webhook.port }}
|
||||
{{- end }}
|
||||
{{- with .Values.managedNamespaces }}
|
||||
namespaces: [{{ join "," . }}]
|
||||
{{- end }}
|
||||
enable-leader-election: {{ .Values.config.enableLeaderElection }}
|
||||
elasticsearch-observation-interval: {{ .Values.config.elasticsearchObservationInterval }}
|
||||
@ -0,0 +1,13 @@
|
||||
{{- if .Values.softMultiTenancy.enabled -}}
|
||||
{{- range .Values.managedNamespaces }}
|
||||
{{- $namespace := . }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: {{ $namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@ -0,0 +1,228 @@
|
||||
{{- if .Values.softMultiTenancy.enabled -}}
|
||||
{{- $fullName := include "eck-operator.fullname" . -}}
|
||||
{{- $name := include "eck-operator.name" . -}}
|
||||
{{- range .Values.managedNamespaces -}}
|
||||
{{- $namespace := . }}
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: "{{ $name }}-elasticsearch"
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "elasticsearch"
|
||||
egress:
|
||||
# Transport port
|
||||
- ports:
|
||||
- port: 9300
|
||||
to:
|
||||
# Elasticsearch within namespace
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "elasticsearch"
|
||||
# DNS
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
to: []
|
||||
ingress:
|
||||
# HTTP Port
|
||||
- ports:
|
||||
- port: 9200
|
||||
from:
|
||||
# Operator
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
name: "{{ $.Release.Namespace }}"
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- include "eck-operator.selectorLabels" $ | nindent 14 }}
|
||||
# Within namespace
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
# Transport port
|
||||
- ports:
|
||||
- port: 9300
|
||||
from:
|
||||
# Within namespace (from other Elasticsearch nodes)
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "elasticsearch"
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: "{{ $name }}-kibana"
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "kibana"
|
||||
egress:
|
||||
# Elasticsearch HTTP port
|
||||
- ports:
|
||||
- port: 9200
|
||||
to:
|
||||
# Elasticsearch within namespace
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "elasticsearch"
|
||||
# DNS
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
to: []
|
||||
ingress:
|
||||
# HTTP Port
|
||||
- ports:
|
||||
- port: 5601
|
||||
from:
|
||||
# Within namespace
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: "{{ $name }}-apm-server"
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "apm-server"
|
||||
egress:
|
||||
# Elasticsearch HTTP port
|
||||
- ports:
|
||||
- port: 9200
|
||||
to:
|
||||
# Elasticsearch within namespace
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "elasticsearch"
|
||||
# Kibana HTTP port
|
||||
- ports:
|
||||
- port: 5601
|
||||
to:
|
||||
# Kibana within namespace
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "kibana"
|
||||
# DNS
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
to: []
|
||||
ingress:
|
||||
# HTTP Port
|
||||
- ports:
|
||||
- port: 8200
|
||||
from:
|
||||
# Within namespace
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: "{{ $name }}-enterprise-search"
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "enterprise-search"
|
||||
egress:
|
||||
# Elasticsearch HTTP port
|
||||
- ports:
|
||||
- port: 9200
|
||||
to:
|
||||
# Elasticsearch within namespace
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "elasticsearch"
|
||||
# DNS
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
to: []
|
||||
ingress:
|
||||
# HTTP Port
|
||||
- ports:
|
||||
- port: 3002
|
||||
from:
|
||||
# Within namespace
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: "{{ $name }}-beats"
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "beat"
|
||||
egress:
|
||||
# Elasticsearch HTTP port
|
||||
- ports:
|
||||
- port: 9200
|
||||
to:
|
||||
# Elasticsearch within namespace
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "elasticsearch"
|
||||
# Kibana HTTP port
|
||||
- ports:
|
||||
- port: 5601
|
||||
to:
|
||||
# Kibana within namespace
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "kibana"
|
||||
# DNS
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
to: []
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@ -0,0 +1,9 @@
|
||||
{{- if (and .Values.global.manifestGen .Values.global.createOperatorNamespace) -}}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: {{ .Release.Namespace }}
|
||||
labels:
|
||||
name: {{ .Release.Namespace }}
|
||||
{{- end -}}
|
||||
@ -0,0 +1,59 @@
|
||||
{{- if .Values.softMultiTenancy.enabled -}}
|
||||
{{- $kubeAPIServerIP := (required "kubeAPIServerIP is required" .Values.kubeAPIServerIP) -}}
|
||||
{{- $metricsPort := int .Values.config.metricsPort -}}
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: {{ include "eck-operator.fullname" . }}
|
||||
namespace: {{ .Release.Namespace}}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- include "eck-operator.selectorLabels" . | nindent 6 }}
|
||||
egress:
|
||||
# DNS
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
to: []
|
||||
# API server
|
||||
- ports:
|
||||
- port: 443
|
||||
to:
|
||||
- ipBlock:
|
||||
cidr: "{{ $kubeAPIServerIP }}/32"
|
||||
# Elasticsearch
|
||||
- ports:
|
||||
- port: 9200
|
||||
to:
|
||||
- namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: "eck.k8s.elastic.co/tenant"
|
||||
operator: In
|
||||
values:
|
||||
{{- range .Values.managedNamespaces }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
common.k8s.elastic.co/type: "elasticsearch"
|
||||
{{- if or .Values.webhook.enabled (gt $metricsPort 0) }}
|
||||
ingress:
|
||||
{{- if .Values.webhook.enabled }}
|
||||
- ports:
|
||||
- port: {{ .Values.webhook.port }}
|
||||
from:
|
||||
- ipBlock:
|
||||
cidr: "{{ $kubeAPIServerIP }}/32"
|
||||
{{- end }}
|
||||
{{- if gt $metricsPort 0 }}
|
||||
# Metrics
|
||||
- ports:
|
||||
- port: {{ $metricsPort }}
|
||||
from: []
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@ -0,0 +1,19 @@
|
||||
{{- if .Values.podDisruptionBudget.enabled }}
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "eck-operator.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" . | indent 4 }}
|
||||
spec:
|
||||
{{- with .Values.podDisruptionBudget.minAvailable }}
|
||||
minAvailable: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.podDisruptionBudget.maxUnavailable }}
|
||||
maxUnavailable: {{ . }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "eck-operator.selectorLabels" . | indent 6 }}
|
||||
{{- end -}}
|
||||
@ -0,0 +1,36 @@
|
||||
{{- $metricsPort := int .Values.config.metricsPort -}}
|
||||
{{- if and .Values.podMonitor.enabled (gt $metricsPort 0) }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PodMonitor
|
||||
metadata:
|
||||
name: {{ include "eck-operator.fullname" . }}
|
||||
namespace: {{ ternary .Values.podMonitor.namespace .Release.Namespace (not (empty .Values.podMonitor.namespace)) }}
|
||||
labels: {{- include "eck-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.podMonitor.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.podMonitor.annotations }}
|
||||
annotations: {{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.podMonitor.podTargetLabels }}
|
||||
podTargetLabels: {{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
podMetricsEndpoints:
|
||||
- port: metrics
|
||||
path: /metrics
|
||||
{{- with .Values.podMonitor.interval }}
|
||||
interval: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.podMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.podMonitor.podMetricsEndpointConfig }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ .Release.Namespace }}
|
||||
selector:
|
||||
matchLabels: {{- include "eck-operator.selectorLabels" . | nindent 6 }}
|
||||
{{- end }}
|
||||
@ -0,0 +1,80 @@
|
||||
{{- $operatorNSIsManaged := has .Release.Namespace .Values.managedNamespaces -}}
|
||||
{{- $fullName := include "eck-operator.fullname" . -}}
|
||||
{{- $svcAccount := include "eck-operator.serviceAccountName" . }}
|
||||
|
||||
{{- if not .Values.createClusterScopedResources }}
|
||||
{{- range .Values.managedNamespaces }}
|
||||
{{- $namespace := . }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: "{{ $fullName }}"
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
||||
rules:
|
||||
{{ template "eck-operator.rbacRules" $ | toYaml | indent 2 }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: "{{ $fullName }}"
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: "{{ $fullName }}"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ $svcAccount }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
{{- end }} {{- /* end of range over managed namespaces */}}
|
||||
{{- /* If createClusterScopedResources is false and operator namespace is not in the managed namespaces list, create additional role binding */}}
|
||||
{{- if not $operatorNSIsManaged }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
||||
rules:
|
||||
{{ template "eck-operator.rbacRules" $ | toYaml | indent 2 }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: "{{ $fullName }}"
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: "{{ $fullName }}"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ $svcAccount }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
{{- end }} {{- /* end of operator role binding if operator namespace is not managed */}}
|
||||
{{- else }} {{- /* we can create cluster-scoped resources so just create a cluster role binding */}}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ $fullName }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ $svcAccount }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
{{- end }}
|
||||
@ -0,0 +1,14 @@
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "eck-operator.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -0,0 +1,135 @@
|
||||
{{- $metricsPort := int .Values.config.metricsPort -}}
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ include "eck-operator.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "eck-operator.selectorLabels" . | nindent 6 }}
|
||||
serviceName: {{ include "eck-operator.fullname" . }}
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
# Rename the fields "error" to "error.message" and "source" to "event.source"
|
||||
# This is to avoid a conflict with the ECS "error" and "source" documents.
|
||||
"co.elastic.logs/raw": "[{\"type\":\"container\",\"json.keys_under_root\":true,\"paths\":[\"/var/log/containers/*${data.kubernetes.container.id}.log\"],\"processors\":[{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"error\",\"to\":\"_error\"}]}},{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"_error\",\"to\":\"error.message\"}]}},{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"source\",\"to\":\"_source\"}]}},{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"_source\",\"to\":\"event.source\"}]}}]}]"
|
||||
"checksum/config": {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "eck-operator.selectorLabels" . | nindent 8 }}
|
||||
{{- with .Values.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
terminationGracePeriodSeconds: 10
|
||||
serviceAccountName: {{ include "eck-operator.serviceAccountName" . }}
|
||||
{{- with .Values.priorityClassName }}
|
||||
priorityClassName: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- image: "{{ .Values.image.repository }}:{{ default .Chart.AppVersion .Values.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
name: manager
|
||||
args:
|
||||
- "manager"
|
||||
- "--config=/conf/eck.yaml"
|
||||
{{- with .Values.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: OPERATOR_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
{{- if .Values.webhook.enabled }}
|
||||
- name: WEBHOOK_SECRET
|
||||
value: {{ include "eck-operator.webhookSecretName" . }}
|
||||
{{- end }}
|
||||
{{- with .Values.env }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.tracing.enabled -}}
|
||||
{{- range $name, $value := .Values.tracing.config }}
|
||||
- name: {{ $name }}
|
||||
value: {{ $value }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or (gt $metricsPort 0) .Values.webhook.enabled }}
|
||||
ports:
|
||||
{{- if (gt $metricsPort 0) }}
|
||||
- containerPort: {{ .Values.config.metricsPort }}
|
||||
name: metrics
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if .Values.webhook.enabled }}
|
||||
- containerPort: {{ .Values.webhook.port }}
|
||||
name: https-webhook
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- mountPath: "/conf"
|
||||
name: conf
|
||||
readOnly: true
|
||||
{{- if .Values.webhook.enabled }}
|
||||
- mountPath: {{ .Values.webhook.certsDir }}
|
||||
name: cert
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- with .Values.volumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: conf
|
||||
configMap:
|
||||
name: {{ include "eck-operator.fullname" . }}
|
||||
{{- if .Values.webhook.enabled }}
|
||||
- name: cert
|
||||
secret:
|
||||
defaultMode: 420
|
||||
secretName: {{ include "eck-operator.webhookSecretName" . }}
|
||||
{{- end }}
|
||||
{{- with .Values.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.hostNetwork }}
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
@ -0,0 +1,29 @@
|
||||
{{- if .Values.softMultiTenancy.enabled -}}
|
||||
{{- if has .Release.Namespace .Values.managedNamespaces -}}
|
||||
{{- fail "Operator namespace cannot be in managed namespaces when soft multi-tenancy is enabled" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if empty .Values.managedNamespaces -}}
|
||||
{{- fail "Managed namespaces must be defined when soft multi-tenancy is enabled" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if empty .Values.kubeAPIServerIP -}}
|
||||
{{- fail "Soft multi-tenancy requires kubeAPIServerIP to be defined" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if (not .Values.createClusterScopedResources) -}}
|
||||
{{- if .Values.webhook.enabled -}}
|
||||
{{- fail "Webhook cannot be enabled when cluster-scoped resource creation is disabled" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.config.validateStorageClass -}}
|
||||
{{- fail "Storage class validation cannot be enabled when cluster-scoped resource creation is disabled" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if (not .Values.config.enableLeaderElection) -}}
|
||||
{{- if gt (int .Values.replicaCount) 1 -}}
|
||||
{{- fail "Leader election must be enabled with more than one replica" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@ -0,0 +1,473 @@
|
||||
{{- if .Values.webhook.enabled -}}
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: {{ include "eck-operator.webhookName" . }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
||||
{{- with .Values.webhook.certManagerCert }}
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: "{{ $.Release.Namespace }}/{{ . }}"
|
||||
{{- end }}
|
||||
webhooks:
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-agent-k8s-elastic-co-v1alpha1-agent
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-agent-validation-v1alpha1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1,v1beta1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- agent.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- agents
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-apm-k8s-elastic-co-v1-apmserver
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-apm-validation-v1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1,v1beta1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- apm.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- apmservers
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-apm-k8s-elastic-co-v1beta1-apmserver
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-apm-validation-v1beta1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1,v1beta1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- apm.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1beta1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- apmservers
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-beat-k8s-elastic-co-v1beta1-beat
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-beat-validation-v1beta1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1,v1beta1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- beat.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1beta1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- beats
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-enterprisesearch-k8s-elastic-co-v1-enterprisesearch
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-ent-validation-v1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1,v1beta1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- enterprisesearch.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- enterprisesearches
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-enterprisesearch-k8s-elastic-co-v1beta1-enterprisesearch
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-ent-validation-v1beta1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1,v1beta1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- enterprisesearch.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1beta1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- enterprisesearches
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-elasticsearch-k8s-elastic-co-v1-elasticsearch
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-es-validation-v1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1,v1beta1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- elasticsearch.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- elasticsearches
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-elasticsearch-k8s-elastic-co-v1beta1-elasticsearch
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-es-validation-v1beta1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1,v1beta1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- elasticsearch.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1beta1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- elasticsearches
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-ems-k8s-elastic-co-v1alpha1-mapsservers
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-ems-validation-v1alpha1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1,v1beta1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- maps.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- mapsservers
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-kibana-k8s-elastic-co-v1-kibana
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-kb-validation-v1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1,v1beta1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- kibana.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- kibanas
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-kibana-k8s-elastic-co-v1beta1-kibana
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-kb-validation-v1beta1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1,v1beta1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- kibana.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1beta1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- kibanas
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-autoscaling-k8s-elastic-co-v1alpha1-elasticsearchautoscaler
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-esa-validation-v1alpha1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1,v1beta1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- autoscaling.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- elasticsearchautoscalers
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-scp-k8s-elastic-co-v1alpha1-stackconfigpolicies
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-scp-validation-v1alpha1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1,v1beta1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- stackconfigpolicy.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- stackconfigpolicies
|
||||
- clientConfig:
|
||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
||||
caBundle: {{ .Values.webhook.caBundle }}
|
||||
{{- end }}
|
||||
service:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-logstash-k8s-elastic-co-v1alpha1-logstash
|
||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
||||
{{- with .Values.webhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.objectSelector }}
|
||||
objectSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: elastic-logstash-validation-v1alpha1.k8s.elastic.co
|
||||
matchPolicy: Exact
|
||||
admissionReviewVersions: [v1,v1beta1]
|
||||
sideEffects: None
|
||||
rules:
|
||||
- apiGroups:
|
||||
- logstash.k8s.elastic.co
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- logstashes
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
||||
spec:
|
||||
ports:
|
||||
- name: https
|
||||
port: 443
|
||||
targetPort: {{ .Values.webhook.port }}
|
||||
selector:
|
||||
{{- include "eck-operator.selectorLabels" . | nindent 4 }}
|
||||
{{- if .Values.webhook.manageCerts }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "eck-operator.webhookSecretName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
254
charts/kubezero-operators/charts/eck-operator/values.yaml
Normal file
254
charts/kubezero-operators/charts/eck-operator/values.yaml
Normal file
@ -0,0 +1,254 @@
|
||||
# nameOverride is the short name for the deployment. Leave empty to let Helm generate a name using chart values.
|
||||
nameOverride: "elastic-operator"
|
||||
|
||||
# fullnameOverride is the full name for the deployment. Leave empty to let Helm generate a name using chart values.
|
||||
fullnameOverride: "elastic-operator"
|
||||
|
||||
# managedNamespaces is the set of namespaces that the operator manages. Leave empty to manage all namespaces.
|
||||
managedNamespaces: []
|
||||
|
||||
# installCRDs determines whether Custom Resource Definitions (CRD) are installed by the chart.
|
||||
# Note that CRDs are global resources and require cluster admin privileges to install.
|
||||
# If you are sharing a cluster with other users who may want to install ECK on their own namespaces, setting this to true can have unintended consequences.
|
||||
# 1. Upgrades will overwrite the global CRDs and could disrupt the other users of ECK who may be running a different version.
|
||||
# 2. Uninstalling the chart will delete the CRDs and potentially cause Elastic resources deployed by other users to be removed as well.
|
||||
installCRDs: true
|
||||
|
||||
# replicaCount is the number of operator pods to run.
|
||||
replicaCount: 1
|
||||
|
||||
image:
|
||||
# repository is the container image prefixed by the registry name.
|
||||
repository: docker.elastic.co/eck/eck-operator
|
||||
# pullPolicy is the container image pull policy.
|
||||
pullPolicy: IfNotPresent
|
||||
# tag is the container image tag. If not defined, defaults to chart appVersion.
|
||||
tag: null
|
||||
|
||||
# priorityClassName defines the PriorityClass to be used by the operator pods.
|
||||
priorityClassName: ""
|
||||
|
||||
# imagePullSecrets defines the secrets to use when pulling the operator container image.
|
||||
imagePullSecrets: []
|
||||
|
||||
# resources define the container resource limits for the operator.
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 150Mi
|
||||
|
||||
# podAnnotations define the annotations that should be added to the operator pod.
|
||||
podAnnotations: {}
|
||||
|
||||
## podLabels define additional labels that should be added to the operator pod.
|
||||
podLabels: {}
|
||||
|
||||
# podSecurityContext defines the pod security context for the operator pod.
|
||||
podSecurityContext:
|
||||
runAsNonRoot: true
|
||||
|
||||
# securityContext defines the security context of the operator container.
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
|
||||
# nodeSelector defines the node selector for the operator pod.
|
||||
nodeSelector: {}
|
||||
|
||||
# tolerations defines the node tolerations for the operator pod.
|
||||
tolerations: []
|
||||
|
||||
# affinity defines the node affinity rules for the operator pod.
|
||||
affinity: {}
|
||||
|
||||
# podDisruptionBudget configures the minimum or the maxium available pods for voluntary disruptions,
|
||||
# set to either an integer (e.g. 1) or a percentage value (e.g. 25%).
|
||||
podDisruptionBudget:
|
||||
enabled: false
|
||||
minAvailable: 1
|
||||
# maxUnavailable: 3
|
||||
|
||||
# additional environment variables for the operator container.
|
||||
env: []
|
||||
|
||||
# additional volume mounts for the operator container.
|
||||
volumeMounts: []
|
||||
|
||||
# additional volumes to add to the operator pod.
|
||||
volumes: []
|
||||
|
||||
# createClusterScopedResources determines whether cluster-scoped resources (ClusterRoles, ClusterRoleBindings) should be created.
|
||||
createClusterScopedResources: true
|
||||
|
||||
serviceAccount:
|
||||
# create specifies whether a service account should be created for the operator.
|
||||
create: true
|
||||
# annotations to add to the service account
|
||||
annotations: {}
|
||||
# name of the service account to use. If not set and create is true, a name is generated using the fullname template.
|
||||
name: ""
|
||||
|
||||
tracing:
|
||||
# enabled specifies whether APM tracing is enabled for the operator.
|
||||
enabled: false
|
||||
# config is a map of APM Server configuration variables that should be set in the environment.
|
||||
config:
|
||||
ELASTIC_APM_SERVER_URL: http://localhost:8200
|
||||
ELASTIC_APM_SERVER_TIMEOUT: 30s
|
||||
|
||||
refs:
|
||||
# enforceRBAC specifies whether RBAC should be enforced for cross-namespace associations between resources.
|
||||
enforceRBAC: false
|
||||
|
||||
webhook:
|
||||
# enabled determines whether the webhook is installed.
|
||||
enabled: true
|
||||
# caBundle is the PEM-encoded CA trust bundle for the webhook certificate. Only required if manageCerts is false and certManagerCert is null.
|
||||
caBundle: Cg==
|
||||
# certManagerCert is the name of the cert-manager certificate to use with the webhook.
|
||||
certManagerCert: null
|
||||
# certsDir is the directory to mount the certificates.
|
||||
certsDir: "/tmp/k8s-webhook-server/serving-certs"
|
||||
# failurePolicy of the webhook.
|
||||
failurePolicy: Ignore
|
||||
# manageCerts determines whether the operator manages the webhook certificates automatically.
|
||||
manageCerts: true
|
||||
# namespaceSelector corresponds to the namespaceSelector property of the webhook.
|
||||
# Setting this restricts the webhook to act only on objects submitted to namespaces that match the selector.
|
||||
namespaceSelector: {}
|
||||
# objectSelector corresponds to the objectSelector property of the webhook.
|
||||
# Setting this restricts the webhook to act only on objects that match the selector.
|
||||
objectSelector: {}
|
||||
# port is the port that the validating webhook binds to.
|
||||
port: 9443
|
||||
|
||||
# hostNetwork allows a Pod to use the Node network namespace.
|
||||
# This is required to allow for communication with the kube API when using some alternate CNIs in conjunction with webhook enabled.
|
||||
# CAUTION: Proceed at your own risk. This setting has security concerns such as allowing malicious users to access workloads running on the host.
|
||||
hostNetwork: false
|
||||
|
||||
softMultiTenancy:
|
||||
# enabled determines whether the operator is installed with soft multi-tenancy extensions.
|
||||
# This requires network policies to be enabled on the Kubernetes cluster.
|
||||
enabled: false
|
||||
|
||||
# kubeAPIServerIP is required when softMultiTenancy is enabled.
|
||||
kubeAPIServerIP: null
|
||||
|
||||
telemetry:
|
||||
# disabled determines whether the operator periodically updates ECK telemetry data for Kibana to consume.
|
||||
disabled: false
|
||||
# distributionChannel denotes which distribution channel was used to install the operator.
|
||||
distributionChannel: "helm"
|
||||
|
||||
# config values for the operator.
|
||||
config:
|
||||
# logVerbosity defines the logging level. Valid values are as follows:
|
||||
# -2: Errors only
|
||||
# -1: Errors and warnings
|
||||
# 0: Errors, warnings, and information
|
||||
# number greater than 0: Errors, warnings, information, and debug details.
|
||||
logVerbosity: "0"
|
||||
|
||||
# metricsPort defines the port to expose operator metrics. Set to 0 to disable metrics reporting.
|
||||
metricsPort: "0"
|
||||
|
||||
# containerRegistry to use for pulling Elasticsearch and other application container images.
|
||||
containerRegistry: docker.elastic.co
|
||||
|
||||
# containerRepository to use for pulling Elasticsearch and other application container images.
|
||||
# containerRepository: ""
|
||||
|
||||
# containerSuffix suffix to be appended to container images by default. Cannot be combined with -ubiOnly flag
|
||||
# containerSuffix: ""
|
||||
|
||||
# maxConcurrentReconciles is the number of concurrent reconciliation operations to perform per controller.
|
||||
maxConcurrentReconciles: "3"
|
||||
|
||||
# caValidity defines the validity period of the CA certificates generated by the operator.
|
||||
caValidity: 8760h
|
||||
|
||||
# caRotateBefore defines when to rotate a CA certificate that is due to expire.
|
||||
caRotateBefore: 24h
|
||||
|
||||
# certificatesValidity defines the validity period of certificates generated by the operator.
|
||||
certificatesValidity: 8760h
|
||||
|
||||
# certificatesRotateBefore defines when to rotate a certificate that is due to expire.
|
||||
certificatesRotateBefore: 24h
|
||||
|
||||
# exposedNodeLabels is an array of regular expressions of node labels which are allowed to be copied as annotations on Elasticsearch Pods.
|
||||
exposedNodeLabels: [ "topology.kubernetes.io/.*", "failure-domain.beta.kubernetes.io/.*" ]
|
||||
|
||||
# setDefaultSecurityContext determines whether a default security context is set on application containers created by the operator.
|
||||
# *note* that the default option now is "auto-detect" to attempt to set this properly automatically when both running
|
||||
# in an openshift cluster, and a standard kubernetes cluster. Valid values are as follows:
|
||||
# "auto-detect" : auto detect
|
||||
# "true" : set pod security context when creating resources.
|
||||
# "false" : do not set pod security context when creating resources.
|
||||
setDefaultSecurityContext: "auto-detect"
|
||||
|
||||
# kubeClientTimeout sets the request timeout for Kubernetes API calls made by the operator.
|
||||
kubeClientTimeout: 60s
|
||||
|
||||
# elasticsearchClientTimeout sets the request timeout for Elasticsearch API calls made by the operator.
|
||||
elasticsearchClientTimeout: 180s
|
||||
|
||||
# validateStorageClass specifies whether storage classes volume expansion support should be verified.
|
||||
# Can be disabled if cluster-wide storage class RBAC access is not available.
|
||||
validateStorageClass: true
|
||||
|
||||
# enableLeaderElection specifies whether leader election should be enabled
|
||||
enableLeaderElection: true
|
||||
|
||||
# Interval between observations of Elasticsearch health, non-positive values disable asynchronous observation.
|
||||
elasticsearchObservationInterval: 10s
|
||||
|
||||
# Prometheus PodMonitor configuration
|
||||
# Reference: https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/api.md#podmonitor
|
||||
podMonitor:
|
||||
|
||||
# enabled determines whether a podMonitor should deployed to scrape the eck metrics.
|
||||
# This requires the prometheus operator and the config.metricsPort not to be 0
|
||||
enabled: false
|
||||
|
||||
# labels adds additional labels to the podMonitor
|
||||
labels: {}
|
||||
|
||||
# annotations adds additional annotations to the podMonitor
|
||||
annotations: {}
|
||||
|
||||
# namespace determines in which namespace the podMonitor will be deployed.
|
||||
# If not set the podMonitor will be created in the namespace where the Helm release is installed into
|
||||
# namespace: monitoring
|
||||
|
||||
# interval specifies the interval at which metrics should be scraped
|
||||
interval: 5m
|
||||
|
||||
# scrapeTimeout specifies the timeout after which the scrape is ended
|
||||
scrapeTimeout: 30s
|
||||
|
||||
# podTargetLabels transfers labels on the Kubernetes Pod onto the target.
|
||||
podTargetLabels: []
|
||||
|
||||
# podMetricsEndpointConfig allows to add an extended configuration to the podMonitor
|
||||
podMetricsEndpointConfig: {}
|
||||
# honorTimestamps: true
|
||||
|
||||
# Globals meant for internal use only
|
||||
global:
|
||||
# manifestGen specifies whether the chart is running under manifest generator.
|
||||
# This is used for tasks specific to generating the all-in-one.yaml file.
|
||||
manifestGen: false
|
||||
# createOperatorNamespace defines whether the operator namespace manifest should be generated when in manifestGen mode.
|
||||
# Usually we do want that to happen (e.g. all-in-one.yaml) but, sometimes we don't (e.g. E2E tests).
|
||||
createOperatorNamespace: true
|
||||
# kubeVersion is the effective Kubernetes version we target when generating the all-in-one.yaml.
|
||||
kubeVersion: 1.21.0
|
||||
@ -3,5 +3,15 @@ set -ex
|
||||
|
||||
. ../../scripts/lib-update.sh
|
||||
|
||||
#login_ecr_public
|
||||
ECK_VERSION=$(yq eval '.dependencies[] | select(.name=="eck-operator") | .version' Chart.yaml)
|
||||
|
||||
update_helm
|
||||
|
||||
# fix ECK crds handling to adhere to proper helm v3 support which also fixes ArgoCD applying updates on upgrades
|
||||
patch_chart eck-operator
|
||||
|
||||
mkdir charts/eck-operator/crds
|
||||
helm template charts/eck-operator/charts/eck-operator-crds --name-template logging --kube-version 1.26 > charts/eck-operator/crds/all-crds.yaml
|
||||
|
||||
rm -rf charts/eck-operator/charts
|
||||
yq eval -Mi 'del(.dependencies)' charts/eck-operator/Chart.yaml
|
||||
|
||||
@ -13,3 +13,12 @@ opensearch-operator:
|
||||
effect: NoSchedule
|
||||
nodeSelector:
|
||||
node-role.kubernetes.io/control-plane: ""
|
||||
|
||||
eck-operator:
|
||||
enabled: false
|
||||
installCRDs: false
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
effect: NoSchedule
|
||||
nodeSelector:
|
||||
node-role.kubernetes.io/control-plane: ""
|
||||
|
||||
@ -131,11 +131,6 @@ sealed-secrets:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- with index .Values "addons" "falco-control-plane" }}
|
||||
falco-control-plane:
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.global.aws }}
|
||||
# AWS only
|
||||
aws-node-termination-handler:
|
||||
|
||||
Loading…
Reference in New Issue
Block a user