Move eck-operator to new module
This commit is contained in:
parent
6946379ae5
commit
90e2ab60bc
@ -19,10 +19,6 @@ dependencies:
|
|||||||
- name: kubezero-lib
|
- name: kubezero-lib
|
||||||
version: ">= 0.1.6"
|
version: ">= 0.1.6"
|
||||||
repository: https://cdn.zero-downtime.net/charts/
|
repository: https://cdn.zero-downtime.net/charts/
|
||||||
- name: eck-operator
|
|
||||||
version: 2.9.0
|
|
||||||
repository: https://helm.elastic.co
|
|
||||||
condition: eck-operator.enabled
|
|
||||||
- name: fluentd
|
- name: fluentd
|
||||||
version: 0.4.3
|
version: 0.4.3
|
||||||
repository: https://fluent.github.io/helm-charts
|
repository: https://fluent.github.io/helm-charts
|
||||||
|
|||||||
@ -1,24 +0,0 @@
|
|||||||
# Patterns to ignore when building packages.
|
|
||||||
# This supports shell glob matching, relative path matching, and
|
|
||||||
# negation (prefixed with !). Only one pattern per line.
|
|
||||||
.DS_Store
|
|
||||||
# Common VCS dirs
|
|
||||||
.git/
|
|
||||||
.gitignore
|
|
||||||
.bzr/
|
|
||||||
.bzrignore
|
|
||||||
.hg/
|
|
||||||
.hgignore
|
|
||||||
.svn/
|
|
||||||
# Common backup files
|
|
||||||
*.swp
|
|
||||||
*.bak
|
|
||||||
*.tmp
|
|
||||||
*.orig
|
|
||||||
*~
|
|
||||||
# Various IDEs
|
|
||||||
.project
|
|
||||||
.idea/
|
|
||||||
*.tmproj
|
|
||||||
.vscode/
|
|
||||||
templates/tests
|
|
||||||
@ -1,21 +0,0 @@
|
|||||||
apiVersion: v2
|
|
||||||
appVersion: 2.9.0
|
|
||||||
description: Elastic Cloud on Kubernetes (ECK) operator
|
|
||||||
home: https://github.com/elastic/cloud-on-k8s
|
|
||||||
icon: https://helm.elastic.co/icons/eck.png
|
|
||||||
keywords:
|
|
||||||
- Logstash
|
|
||||||
- Elasticsearch
|
|
||||||
- Kibana
|
|
||||||
- APM Server
|
|
||||||
- Beats
|
|
||||||
- Enterprise Search
|
|
||||||
- Elastic Stack
|
|
||||||
- Operator
|
|
||||||
kubeVersion: '>=1.21.0-0'
|
|
||||||
maintainers:
|
|
||||||
- email: eck@elastic.co
|
|
||||||
name: Elastic
|
|
||||||
name: eck-operator
|
|
||||||
type: application
|
|
||||||
version: 2.9.0
|
|
||||||
@ -1,93 +0,0 @@
|
|||||||
Elastic License 2.0
|
|
||||||
|
|
||||||
URL: https://www.elastic.co/licensing/elastic-license
|
|
||||||
|
|
||||||
## Acceptance
|
|
||||||
|
|
||||||
By using the software, you agree to all of the terms and conditions below.
|
|
||||||
|
|
||||||
## Copyright License
|
|
||||||
|
|
||||||
The licensor grants you a non-exclusive, royalty-free, worldwide,
|
|
||||||
non-sublicensable, non-transferable license to use, copy, distribute, make
|
|
||||||
available, and prepare derivative works of the software, in each case subject to
|
|
||||||
the limitations and conditions below.
|
|
||||||
|
|
||||||
## Limitations
|
|
||||||
|
|
||||||
You may not provide the software to third parties as a hosted or managed
|
|
||||||
service, where the service provides users with access to any substantial set of
|
|
||||||
the features or functionality of the software.
|
|
||||||
|
|
||||||
You may not move, change, disable, or circumvent the license key functionality
|
|
||||||
in the software, and you may not remove or obscure any functionality in the
|
|
||||||
software that is protected by the license key.
|
|
||||||
|
|
||||||
You may not alter, remove, or obscure any licensing, copyright, or other notices
|
|
||||||
of the licensor in the software. Any use of the licensor’s trademarks is subject
|
|
||||||
to applicable law.
|
|
||||||
|
|
||||||
## Patents
|
|
||||||
|
|
||||||
The licensor grants you a license, under any patent claims the licensor can
|
|
||||||
license, or becomes able to license, to make, have made, use, sell, offer for
|
|
||||||
sale, import and have imported the software, in each case subject to the
|
|
||||||
limitations and conditions in this license. This license does not cover any
|
|
||||||
patent claims that you cause to be infringed by modifications or additions to
|
|
||||||
the software. If you or your company make any written claim that the software
|
|
||||||
infringes or contributes to infringement of any patent, your patent license for
|
|
||||||
the software granted under these terms ends immediately. If your company makes
|
|
||||||
such a claim, your patent license ends immediately for work on behalf of your
|
|
||||||
company.
|
|
||||||
|
|
||||||
## Notices
|
|
||||||
|
|
||||||
You must ensure that anyone who gets a copy of any part of the software from you
|
|
||||||
also gets a copy of these terms.
|
|
||||||
|
|
||||||
If you modify the software, you must include in any modified copies of the
|
|
||||||
software prominent notices stating that you have modified the software.
|
|
||||||
|
|
||||||
## No Other Rights
|
|
||||||
|
|
||||||
These terms do not imply any licenses other than those expressly granted in
|
|
||||||
these terms.
|
|
||||||
|
|
||||||
## Termination
|
|
||||||
|
|
||||||
If you use the software in violation of these terms, such use is not licensed,
|
|
||||||
and your licenses will automatically terminate. If the licensor provides you
|
|
||||||
with a notice of your violation, and you cease all violation of this license no
|
|
||||||
later than 30 days after you receive that notice, your licenses will be
|
|
||||||
reinstated retroactively. However, if you violate these terms after such
|
|
||||||
reinstatement, any additional violation of these terms will cause your licenses
|
|
||||||
to terminate automatically and permanently.
|
|
||||||
|
|
||||||
## No Liability
|
|
||||||
|
|
||||||
*As far as the law allows, the software comes as is, without any warranty or
|
|
||||||
condition, and the licensor will not be liable to you for any damages arising
|
|
||||||
out of these terms or the use or nature of the software, under any kind of
|
|
||||||
legal claim.*
|
|
||||||
|
|
||||||
## Definitions
|
|
||||||
|
|
||||||
The **licensor** is the entity offering these terms, and the **software** is the
|
|
||||||
software the licensor makes available under these terms, including any portion
|
|
||||||
of it.
|
|
||||||
|
|
||||||
**you** refers to the individual or entity agreeing to these terms.
|
|
||||||
|
|
||||||
**your company** is any legal entity, sole proprietorship, or other kind of
|
|
||||||
organization that you work for, plus all organizations that have control over,
|
|
||||||
are under the control of, or are under common control with that
|
|
||||||
organization. **control** means ownership of substantially all the assets of an
|
|
||||||
entity, or the power to direct its management and policies by vote, contract, or
|
|
||||||
otherwise. Control can be direct or indirect.
|
|
||||||
|
|
||||||
**your licenses** are all the licenses granted to you for the software under
|
|
||||||
these terms.
|
|
||||||
|
|
||||||
**use** means anything you do with the software requiring one of your licenses.
|
|
||||||
|
|
||||||
**trademark** means trademarks, service marks, and similar rights.
|
|
||||||
@ -1,20 +0,0 @@
|
|||||||
# ECK Operator Helm Chart
|
|
||||||
|
|
||||||
[](https://artifacthub.io/packages/helm/elastic/eck-operator)
|
|
||||||
|
|
||||||
A Helm chart to install the ECK Operator: the official Kubernetes operator from Elastic to orchestrate Elasticsearch, Kibana, APM Server, Enterprise Search, and Beats on Kubernetes.
|
|
||||||
|
|
||||||
For more information about the ECK Operator, see:
|
|
||||||
- [Documentation](https://www.elastic.co/guide/en/cloud-on-k8s/current/index.html)
|
|
||||||
- [GitHub repo](https://github.com/elastic/cloud-on-k8s)
|
|
||||||
|
|
||||||
|
|
||||||
## Requirements
|
|
||||||
|
|
||||||
- Supported Kubernetes versions are listed in the documentation: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s_supported_versions.html
|
|
||||||
- Helm >= 3.2.0
|
|
||||||
|
|
||||||
|
|
||||||
## Usage
|
|
||||||
|
|
||||||
Refer to the documentation at https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-install-helm.html
|
|
||||||
File diff suppressed because it is too large
Load Diff
@ -1,6 +0,0 @@
|
|||||||
managedNamespaces: []
|
|
||||||
|
|
||||||
createClusterScopedResources: true
|
|
||||||
|
|
||||||
webhook:
|
|
||||||
enabled: true
|
|
||||||
@ -1,11 +0,0 @@
|
|||||||
managedNamespaces: []
|
|
||||||
|
|
||||||
createClusterScopedResources: true
|
|
||||||
|
|
||||||
webhook:
|
|
||||||
enabled: true
|
|
||||||
|
|
||||||
podAnnotations:
|
|
||||||
sidecar.istio.io/inject: "true"
|
|
||||||
traffic.sidecar.istio.io/includeInboundPorts: "*"
|
|
||||||
traffic.sidecar.istio.io/excludeInboundPorts: "9443"
|
|
||||||
@ -1,12 +0,0 @@
|
|||||||
managedNamespaces: ["elastic-system"]
|
|
||||||
|
|
||||||
createClusterScopedResources: false
|
|
||||||
|
|
||||||
config:
|
|
||||||
# no RBAC access to cluster-wide storage classes, hence disable storage class validation
|
|
||||||
validateStorageClass: false
|
|
||||||
|
|
||||||
installCRDs: false
|
|
||||||
|
|
||||||
webhook:
|
|
||||||
enabled: false
|
|
||||||
@ -1,18 +0,0 @@
|
|||||||
managedNamespaces: ["team-a", "team-b"]
|
|
||||||
|
|
||||||
createClusterScopedResources: true
|
|
||||||
|
|
||||||
refs:
|
|
||||||
enforceRBAC: true
|
|
||||||
|
|
||||||
webhook:
|
|
||||||
enabled: true
|
|
||||||
namespaceSelector:
|
|
||||||
matchExpressions:
|
|
||||||
- key: "eck.k8s.elastic.co/tenant"
|
|
||||||
operator: In
|
|
||||||
values: ["team-a", "team-b"]
|
|
||||||
|
|
||||||
|
|
||||||
softMultiTenancy:
|
|
||||||
enabled: true
|
|
||||||
@ -1,2 +0,0 @@
|
|||||||
1. Inspect the operator logs by running the following command:
|
|
||||||
kubectl logs -n {{ .Release.Namespace }} sts/{{ .Release.Name }}
|
|
||||||
@ -1,366 +0,0 @@
|
|||||||
{{/*
|
|
||||||
Expand the name of the chart.
|
|
||||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
|
||||||
*/}}
|
|
||||||
{{- define "eck-operator.name" -}}
|
|
||||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Create a default fully qualified app name.
|
|
||||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
|
||||||
If release name contains chart name it will be used as a full name.
|
|
||||||
*/}}
|
|
||||||
{{- define "eck-operator.fullname" -}}
|
|
||||||
{{- if .Values.fullnameOverride }}
|
|
||||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
|
||||||
{{- else }}
|
|
||||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
|
||||||
{{- if contains $name .Release.Name }}
|
|
||||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
|
||||||
{{- else }}
|
|
||||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Create chart name and version as used by the chart label.
|
|
||||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
|
||||||
*/}}
|
|
||||||
{{- define "eck-operator.chart" -}}
|
|
||||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Common labels
|
|
||||||
*/}}
|
|
||||||
{{- define "eck-operator.labels" -}}
|
|
||||||
{{- include "eck-operator.selectorLabels" . }}
|
|
||||||
{{- if .Chart.AppVersion }}
|
|
||||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
|
||||||
{{- end }}
|
|
||||||
helm.sh/chart: {{ include "eck-operator.chart" . }}
|
|
||||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Selector labels
|
|
||||||
*/}}
|
|
||||||
{{- define "eck-operator.selectorLabels" -}}
|
|
||||||
{{- if .Values.global.manifestGen }}
|
|
||||||
control-plane: elastic-operator
|
|
||||||
{{- else }}
|
|
||||||
app.kubernetes.io/name: {{ include "eck-operator.name" . }}
|
|
||||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Create the name of the service account to use
|
|
||||||
*/}}
|
|
||||||
{{- define "eck-operator.serviceAccountName" -}}
|
|
||||||
{{- if .Values.serviceAccount.create }}
|
|
||||||
{{- default (include "eck-operator.fullname" .) .Values.serviceAccount.name }}
|
|
||||||
{{- else }}
|
|
||||||
{{- default "default" .Values.serviceAccount.name }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Determine effective Kubernetes version
|
|
||||||
*/}}
|
|
||||||
{{- define "eck-operator.effectiveKubeVersion" -}}
|
|
||||||
{{- if .Values.global.manifestGen -}}
|
|
||||||
{{- semver .Values.global.kubeVersion -}}
|
|
||||||
{{- else -}}
|
|
||||||
{{- .Capabilities.KubeVersion.Version -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Determine the name for the webhook
|
|
||||||
*/}}
|
|
||||||
{{- define "eck-operator.webhookName" -}}
|
|
||||||
{{- if .Values.global.manifestGen -}}
|
|
||||||
elastic-webhook.k8s.elastic.co
|
|
||||||
{{- else -}}
|
|
||||||
{{- $name := include "eck-operator.name" . -}}
|
|
||||||
{{ printf "%s.%s.k8s.elastic.co" $name .Release.Namespace }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Determine the name for the webhook secret
|
|
||||||
*/}}
|
|
||||||
{{- define "eck-operator.webhookSecretName" -}}
|
|
||||||
{{- if .Values.global.manifestGen -}}
|
|
||||||
elastic-webhook-server-cert
|
|
||||||
{{- else -}}
|
|
||||||
{{- $name := include "eck-operator.name" . -}}
|
|
||||||
{{ printf "%s-webhook-cert" $name | trunc 63 }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Determine the name for the webhook service
|
|
||||||
*/}}
|
|
||||||
{{- define "eck-operator.webhookServiceName" -}}
|
|
||||||
{{- if .Values.global.manifestGen -}}
|
|
||||||
elastic-webhook-server
|
|
||||||
{{- else -}}
|
|
||||||
{{- $name := include "eck-operator.name" . -}}
|
|
||||||
{{ printf "%s-webhook" $name | trunc 63 }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
RBAC permissions
|
|
||||||
NOTE - any changes made to RBAC permissions below require
|
|
||||||
updating docs/operating-eck/eck-permissions.asciidoc file.
|
|
||||||
*/}}
|
|
||||||
{{- define "eck-operator.rbacRules" -}}
|
|
||||||
- apiGroups:
|
|
||||||
- "authorization.k8s.io"
|
|
||||||
resources:
|
|
||||||
- subjectaccessreviews
|
|
||||||
verbs:
|
|
||||||
- create
|
|
||||||
- apiGroups:
|
|
||||||
- coordination.k8s.io
|
|
||||||
resources:
|
|
||||||
- leases
|
|
||||||
verbs:
|
|
||||||
- create
|
|
||||||
- apiGroups:
|
|
||||||
- coordination.k8s.io
|
|
||||||
resources:
|
|
||||||
- leases
|
|
||||||
resourceNames:
|
|
||||||
- elastic-operator-leader
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- watch
|
|
||||||
- update
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- endpoints
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- pods
|
|
||||||
- events
|
|
||||||
- persistentvolumeclaims
|
|
||||||
- secrets
|
|
||||||
- services
|
|
||||||
- configmaps
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- create
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
- delete
|
|
||||||
- apiGroups:
|
|
||||||
- apps
|
|
||||||
resources:
|
|
||||||
- deployments
|
|
||||||
- statefulsets
|
|
||||||
- daemonsets
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- create
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
- delete
|
|
||||||
- apiGroups:
|
|
||||||
- policy
|
|
||||||
resources:
|
|
||||||
- poddisruptionbudgets
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- create
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
- delete
|
|
||||||
- apiGroups:
|
|
||||||
- elasticsearch.k8s.elastic.co
|
|
||||||
resources:
|
|
||||||
- elasticsearches
|
|
||||||
- elasticsearches/status
|
|
||||||
- elasticsearches/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- create
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
- apiGroups:
|
|
||||||
- autoscaling.k8s.elastic.co
|
|
||||||
resources:
|
|
||||||
- elasticsearchautoscalers
|
|
||||||
- elasticsearchautoscalers/status
|
|
||||||
- elasticsearchautoscalers/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- create
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
- apiGroups:
|
|
||||||
- kibana.k8s.elastic.co
|
|
||||||
resources:
|
|
||||||
- kibanas
|
|
||||||
- kibanas/status
|
|
||||||
- kibanas/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- create
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
- apiGroups:
|
|
||||||
- apm.k8s.elastic.co
|
|
||||||
resources:
|
|
||||||
- apmservers
|
|
||||||
- apmservers/status
|
|
||||||
- apmservers/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- create
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
- apiGroups:
|
|
||||||
- enterprisesearch.k8s.elastic.co
|
|
||||||
resources:
|
|
||||||
- enterprisesearches
|
|
||||||
- enterprisesearches/status
|
|
||||||
- enterprisesearches/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- create
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
- apiGroups:
|
|
||||||
- beat.k8s.elastic.co
|
|
||||||
resources:
|
|
||||||
- beats
|
|
||||||
- beats/status
|
|
||||||
- beats/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- create
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
- apiGroups:
|
|
||||||
- agent.k8s.elastic.co
|
|
||||||
resources:
|
|
||||||
- agents
|
|
||||||
- agents/status
|
|
||||||
- agents/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- create
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
- apiGroups:
|
|
||||||
- maps.k8s.elastic.co
|
|
||||||
resources:
|
|
||||||
- elasticmapsservers
|
|
||||||
- elasticmapsservers/status
|
|
||||||
- elasticmapsservers/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- create
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
- apiGroups:
|
|
||||||
- stackconfigpolicy.k8s.elastic.co
|
|
||||||
resources:
|
|
||||||
- stackconfigpolicies
|
|
||||||
- stackconfigpolicies/status
|
|
||||||
- stackconfigpolicies/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- create
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
- apiGroups:
|
|
||||||
- logstash.k8s.elastic.co
|
|
||||||
resources:
|
|
||||||
- logstashes
|
|
||||||
- logstashes/status
|
|
||||||
- logstashes/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- create
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
RBAC permissions on non-namespaced resources
|
|
||||||
*/}}
|
|
||||||
{{- define "eck-operator.clusterWideRbacRules" -}}
|
|
||||||
- apiGroups:
|
|
||||||
- storage.k8s.io
|
|
||||||
resources:
|
|
||||||
- storageclasses
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- apiGroups:
|
|
||||||
- admissionregistration.k8s.io
|
|
||||||
resources:
|
|
||||||
- validatingwebhookconfigurations
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- create
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
- delete
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
RBAC permissions to read node labels
|
|
||||||
*/}}
|
|
||||||
{{- define "eck-operator.readNodeLabelsRbacRule" -}}
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- nodes
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
{{- end -}}
|
|
||||||
@ -1,96 +0,0 @@
|
|||||||
{{- if .Values.createClusterScopedResources -}}
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRole
|
|
||||||
metadata:
|
|
||||||
name: {{ include "eck-operator.fullname" . }}
|
|
||||||
labels:
|
|
||||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
|
||||||
rules:
|
|
||||||
{{ template "eck-operator.rbacRules" . | toYaml | indent 2 }}
|
|
||||||
{{ template "eck-operator.clusterWideRbacRules" . | toYaml | indent 2 }}
|
|
||||||
{{ if .Values.config.exposedNodeLabels }}
|
|
||||||
{{ template "eck-operator.readNodeLabelsRbacRule" . | toYaml | indent 2 }}
|
|
||||||
{{ end -}}
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRole
|
|
||||||
metadata:
|
|
||||||
name: "{{ include "eck-operator.name" . }}-view"
|
|
||||||
labels:
|
|
||||||
rbac.authorization.k8s.io/aggregate-to-view: "true"
|
|
||||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
|
||||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
|
||||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
|
||||||
rules:
|
|
||||||
- apiGroups: ["elasticsearch.k8s.elastic.co"]
|
|
||||||
resources: ["elasticsearches"]
|
|
||||||
verbs: ["get", "list", "watch"]
|
|
||||||
- apiGroups: ["autoscaling.k8s.elastic.co"]
|
|
||||||
resources: ["elasticsearchautoscalers"]
|
|
||||||
verbs: ["get", "list", "watch"]
|
|
||||||
- apiGroups: ["apm.k8s.elastic.co"]
|
|
||||||
resources: ["apmservers"]
|
|
||||||
verbs: ["get", "list", "watch"]
|
|
||||||
- apiGroups: ["kibana.k8s.elastic.co"]
|
|
||||||
resources: ["kibanas"]
|
|
||||||
verbs: ["get", "list", "watch"]
|
|
||||||
- apiGroups: ["enterprisesearch.k8s.elastic.co"]
|
|
||||||
resources: ["enterprisesearches"]
|
|
||||||
verbs: ["get", "list", "watch"]
|
|
||||||
- apiGroups: ["beat.k8s.elastic.co"]
|
|
||||||
resources: ["beats"]
|
|
||||||
verbs: ["get", "list", "watch"]
|
|
||||||
- apiGroups: ["agent.k8s.elastic.co"]
|
|
||||||
resources: ["agents"]
|
|
||||||
verbs: ["get", "list", "watch"]
|
|
||||||
- apiGroups: ["maps.k8s.elastic.co"]
|
|
||||||
resources: ["elasticmapsservers"]
|
|
||||||
verbs: ["get", "list", "watch"]
|
|
||||||
- apiGroups: ["stackconfigpolicy.k8s.elastic.co"]
|
|
||||||
resources: ["stackconfigpolicies"]
|
|
||||||
verbs: ["get", "list", "watch"]
|
|
||||||
- apiGroups: ["logstash.k8s.elastic.co"]
|
|
||||||
resources: ["logstashes"]
|
|
||||||
verbs: ["get", "list", "watch"]
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRole
|
|
||||||
metadata:
|
|
||||||
name: "{{ include "eck-operator.name" . }}-edit"
|
|
||||||
labels:
|
|
||||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
|
||||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
|
||||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
|
||||||
rules:
|
|
||||||
- apiGroups: ["elasticsearch.k8s.elastic.co"]
|
|
||||||
resources: ["elasticsearches"]
|
|
||||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
|
||||||
- apiGroups: ["autoscaling.k8s.elastic.co"]
|
|
||||||
resources: ["elasticsearchautoscalers"]
|
|
||||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
|
||||||
- apiGroups: ["apm.k8s.elastic.co"]
|
|
||||||
resources: ["apmservers"]
|
|
||||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
|
||||||
- apiGroups: ["kibana.k8s.elastic.co"]
|
|
||||||
resources: ["kibanas"]
|
|
||||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
|
||||||
- apiGroups: ["enterprisesearch.k8s.elastic.co"]
|
|
||||||
resources: ["enterprisesearches"]
|
|
||||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
|
||||||
- apiGroups: ["beat.k8s.elastic.co"]
|
|
||||||
resources: ["beats"]
|
|
||||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
|
||||||
- apiGroups: ["agent.k8s.elastic.co"]
|
|
||||||
resources: ["agents"]
|
|
||||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
|
||||||
- apiGroups: ["maps.k8s.elastic.co"]
|
|
||||||
resources: ["elasticmapsservers"]
|
|
||||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
|
||||||
- apiGroups: ["stackconfigpolicy.k8s.elastic.co"]
|
|
||||||
resources: ["stackconfigpolicies"]
|
|
||||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
|
||||||
- apiGroups: ["logstash.k8s.elastic.co"]
|
|
||||||
resources: ["logstashes"]
|
|
||||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
|
||||||
{{- end -}}
|
|
||||||
@ -1,62 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: {{ include "eck-operator.fullname" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
labels:
|
|
||||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
|
||||||
data:
|
|
||||||
eck.yaml: |-
|
|
||||||
log-verbosity: {{ int .Values.config.logVerbosity }}
|
|
||||||
metrics-port: {{ int .Values.config.metricsPort }}
|
|
||||||
container-registry: {{ .Values.config.containerRegistry }}
|
|
||||||
{{- with .Values.config.containerSuffix }}
|
|
||||||
container-suffix: {{ . }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.config.containerRepository }}
|
|
||||||
container-repository: {{ . }}
|
|
||||||
{{- end }}
|
|
||||||
max-concurrent-reconciles: {{ int .Values.config.maxConcurrentReconciles }}
|
|
||||||
{{- with .Values.config.passwordHashCacheSize }}
|
|
||||||
password-hash-cache-size: {{ int . }}
|
|
||||||
{{- end }}
|
|
||||||
ca-cert-validity: {{ .Values.config.caValidity }}
|
|
||||||
ca-cert-rotate-before: {{ .Values.config.caRotateBefore }}
|
|
||||||
cert-validity: {{ .Values.config.certificatesValidity }}
|
|
||||||
cert-rotate-before: {{ .Values.config.certificatesRotateBefore }}
|
|
||||||
{{- with .Values.config.exposedNodeLabels }}
|
|
||||||
exposed-node-labels: [{{ join "," . }}]
|
|
||||||
{{- end }}
|
|
||||||
set-default-security-context: {{ .Values.config.setDefaultSecurityContext }}
|
|
||||||
kube-client-timeout: {{ .Values.config.kubeClientTimeout }}
|
|
||||||
{{- with .Values.config.kubeClientQPS }}
|
|
||||||
kube-client-qps: {{ int . }}
|
|
||||||
{{- end }}
|
|
||||||
elasticsearch-client-timeout: {{ .Values.config.elasticsearchClientTimeout }}
|
|
||||||
disable-telemetry: {{ .Values.telemetry.disabled }}
|
|
||||||
distribution-channel: {{ .Values.telemetry.distributionChannel }}
|
|
||||||
{{- with .Values.telemetry.interval }}
|
|
||||||
telemetry-interval: {{ . }}
|
|
||||||
{{- end }}
|
|
||||||
validate-storage-class: {{ .Values.config.validateStorageClass }}
|
|
||||||
{{- if .Values.tracing.enabled }}
|
|
||||||
enable-tracing: true
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.refs.enforceRBAC }}
|
|
||||||
enforce-rbac-on-refs: true
|
|
||||||
{{- end }}
|
|
||||||
enable-webhook: {{ .Values.webhook.enabled }}
|
|
||||||
{{- if .Values.webhook.enabled }}
|
|
||||||
webhook-name: {{ include "eck-operator.webhookName" . }}
|
|
||||||
{{- if not .Values.webhook.manageCerts }}
|
|
||||||
manage-webhook-certs: false
|
|
||||||
webhook-cert-dir: {{ .Values.webhook.certsDir }}
|
|
||||||
{{- end }}
|
|
||||||
webhook-port: {{ .Values.webhook.port }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.managedNamespaces }}
|
|
||||||
namespaces: [{{ join "," . }}]
|
|
||||||
{{- end }}
|
|
||||||
enable-leader-election: {{ .Values.config.enableLeaderElection }}
|
|
||||||
elasticsearch-observation-interval: {{ .Values.config.elasticsearchObservationInterval }}
|
|
||||||
@ -1,13 +0,0 @@
|
|||||||
{{- if .Values.softMultiTenancy.enabled -}}
|
|
||||||
{{- range .Values.managedNamespaces }}
|
|
||||||
{{- $namespace := . }}
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: {{ $namespace }}
|
|
||||||
labels:
|
|
||||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
|
||||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
@ -1,228 +0,0 @@
|
|||||||
{{- if .Values.softMultiTenancy.enabled -}}
|
|
||||||
{{- $fullName := include "eck-operator.fullname" . -}}
|
|
||||||
{{- $name := include "eck-operator.name" . -}}
|
|
||||||
{{- range .Values.managedNamespaces -}}
|
|
||||||
{{- $namespace := . }}
|
|
||||||
---
|
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: NetworkPolicy
|
|
||||||
metadata:
|
|
||||||
name: "{{ $name }}-elasticsearch"
|
|
||||||
namespace: {{ $namespace }}
|
|
||||||
labels:
|
|
||||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
|
||||||
spec:
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
common.k8s.elastic.co/type: "elasticsearch"
|
|
||||||
egress:
|
|
||||||
# Transport port
|
|
||||||
- ports:
|
|
||||||
- port: 9300
|
|
||||||
to:
|
|
||||||
# Elasticsearch within namespace
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
common.k8s.elastic.co/type: "elasticsearch"
|
|
||||||
# DNS
|
|
||||||
- ports:
|
|
||||||
- port: 53
|
|
||||||
protocol: UDP
|
|
||||||
to: []
|
|
||||||
ingress:
|
|
||||||
# HTTP Port
|
|
||||||
- ports:
|
|
||||||
- port: 9200
|
|
||||||
from:
|
|
||||||
# Operator
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
name: "{{ $.Release.Namespace }}"
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
{{- include "eck-operator.selectorLabels" $ | nindent 14 }}
|
|
||||||
# Within namespace
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
|
||||||
# Transport port
|
|
||||||
- ports:
|
|
||||||
- port: 9300
|
|
||||||
from:
|
|
||||||
# Within namespace (from other Elasticsearch nodes)
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
common.k8s.elastic.co/type: "elasticsearch"
|
|
||||||
---
|
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: NetworkPolicy
|
|
||||||
metadata:
|
|
||||||
name: "{{ $name }}-kibana"
|
|
||||||
namespace: {{ $namespace }}
|
|
||||||
labels:
|
|
||||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
|
||||||
spec:
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
common.k8s.elastic.co/type: "kibana"
|
|
||||||
egress:
|
|
||||||
# Elasticsearch HTTP port
|
|
||||||
- ports:
|
|
||||||
- port: 9200
|
|
||||||
to:
|
|
||||||
# Elasticsearch within namespace
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
common.k8s.elastic.co/type: "elasticsearch"
|
|
||||||
# DNS
|
|
||||||
- ports:
|
|
||||||
- port: 53
|
|
||||||
protocol: UDP
|
|
||||||
to: []
|
|
||||||
ingress:
|
|
||||||
# HTTP Port
|
|
||||||
- ports:
|
|
||||||
- port: 5601
|
|
||||||
from:
|
|
||||||
# Within namespace
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
|
||||||
---
|
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: NetworkPolicy
|
|
||||||
metadata:
|
|
||||||
name: "{{ $name }}-apm-server"
|
|
||||||
namespace: {{ $namespace }}
|
|
||||||
labels:
|
|
||||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
|
||||||
spec:
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
common.k8s.elastic.co/type: "apm-server"
|
|
||||||
egress:
|
|
||||||
# Elasticsearch HTTP port
|
|
||||||
- ports:
|
|
||||||
- port: 9200
|
|
||||||
to:
|
|
||||||
# Elasticsearch within namespace
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
common.k8s.elastic.co/type: "elasticsearch"
|
|
||||||
# Kibana HTTP port
|
|
||||||
- ports:
|
|
||||||
- port: 5601
|
|
||||||
to:
|
|
||||||
# Kibana within namespace
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
common.k8s.elastic.co/type: "kibana"
|
|
||||||
# DNS
|
|
||||||
- ports:
|
|
||||||
- port: 53
|
|
||||||
protocol: UDP
|
|
||||||
to: []
|
|
||||||
ingress:
|
|
||||||
# HTTP Port
|
|
||||||
- ports:
|
|
||||||
- port: 8200
|
|
||||||
from:
|
|
||||||
# Within namespace
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
|
||||||
---
|
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: NetworkPolicy
|
|
||||||
metadata:
|
|
||||||
name: "{{ $name }}-enterprise-search"
|
|
||||||
namespace: {{ $namespace }}
|
|
||||||
labels:
|
|
||||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
|
||||||
spec:
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
common.k8s.elastic.co/type: "enterprise-search"
|
|
||||||
egress:
|
|
||||||
# Elasticsearch HTTP port
|
|
||||||
- ports:
|
|
||||||
- port: 9200
|
|
||||||
to:
|
|
||||||
# Elasticsearch within namespace
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
common.k8s.elastic.co/type: "elasticsearch"
|
|
||||||
# DNS
|
|
||||||
- ports:
|
|
||||||
- port: 53
|
|
||||||
protocol: UDP
|
|
||||||
to: []
|
|
||||||
ingress:
|
|
||||||
# HTTP Port
|
|
||||||
- ports:
|
|
||||||
- port: 3002
|
|
||||||
from:
|
|
||||||
# Within namespace
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
|
||||||
---
|
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: NetworkPolicy
|
|
||||||
metadata:
|
|
||||||
name: "{{ $name }}-beats"
|
|
||||||
namespace: {{ $namespace }}
|
|
||||||
labels:
|
|
||||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
|
||||||
spec:
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
common.k8s.elastic.co/type: "beat"
|
|
||||||
egress:
|
|
||||||
# Elasticsearch HTTP port
|
|
||||||
- ports:
|
|
||||||
- port: 9200
|
|
||||||
to:
|
|
||||||
# Elasticsearch within namespace
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
common.k8s.elastic.co/type: "elasticsearch"
|
|
||||||
# Kibana HTTP port
|
|
||||||
- ports:
|
|
||||||
- port: 5601
|
|
||||||
to:
|
|
||||||
# Kibana within namespace
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
eck.k8s.elastic.co/tenant: {{ $namespace }}
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
common.k8s.elastic.co/type: "kibana"
|
|
||||||
# DNS
|
|
||||||
- ports:
|
|
||||||
- port: 53
|
|
||||||
protocol: UDP
|
|
||||||
to: []
|
|
||||||
{{- end }}
|
|
||||||
{{- end -}}
|
|
||||||
@ -1,9 +0,0 @@
|
|||||||
{{- if (and .Values.global.manifestGen .Values.global.createOperatorNamespace) -}}
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: {{ .Release.Namespace }}
|
|
||||||
labels:
|
|
||||||
name: {{ .Release.Namespace }}
|
|
||||||
{{- end -}}
|
|
||||||
@ -1,59 +0,0 @@
|
|||||||
{{- if .Values.softMultiTenancy.enabled -}}
|
|
||||||
{{- $kubeAPIServerIP := (required "kubeAPIServerIP is required" .Values.kubeAPIServerIP) -}}
|
|
||||||
{{- $metricsPort := int .Values.config.metricsPort -}}
|
|
||||||
---
|
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: NetworkPolicy
|
|
||||||
metadata:
|
|
||||||
name: {{ include "eck-operator.fullname" . }}
|
|
||||||
namespace: {{ .Release.Namespace}}
|
|
||||||
labels:
|
|
||||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
|
||||||
spec:
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
{{- include "eck-operator.selectorLabels" . | nindent 6 }}
|
|
||||||
egress:
|
|
||||||
# DNS
|
|
||||||
- ports:
|
|
||||||
- port: 53
|
|
||||||
protocol: UDP
|
|
||||||
to: []
|
|
||||||
# API server
|
|
||||||
- ports:
|
|
||||||
- port: 443
|
|
||||||
to:
|
|
||||||
- ipBlock:
|
|
||||||
cidr: "{{ $kubeAPIServerIP }}/32"
|
|
||||||
# Elasticsearch
|
|
||||||
- ports:
|
|
||||||
- port: 9200
|
|
||||||
to:
|
|
||||||
- namespaceSelector:
|
|
||||||
matchExpressions:
|
|
||||||
- key: "eck.k8s.elastic.co/tenant"
|
|
||||||
operator: In
|
|
||||||
values:
|
|
||||||
{{- range .Values.managedNamespaces }}
|
|
||||||
- {{ . }}
|
|
||||||
{{- end }}
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
common.k8s.elastic.co/type: "elasticsearch"
|
|
||||||
{{- if or .Values.webhook.enabled (gt $metricsPort 0) }}
|
|
||||||
ingress:
|
|
||||||
{{- if .Values.webhook.enabled }}
|
|
||||||
- ports:
|
|
||||||
- port: {{ .Values.webhook.port }}
|
|
||||||
from:
|
|
||||||
- ipBlock:
|
|
||||||
cidr: "{{ $kubeAPIServerIP }}/32"
|
|
||||||
{{- end }}
|
|
||||||
{{- if gt $metricsPort 0 }}
|
|
||||||
# Metrics
|
|
||||||
- ports:
|
|
||||||
- port: {{ $metricsPort }}
|
|
||||||
from: []
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end -}}
|
|
||||||
@ -1,19 +0,0 @@
|
|||||||
{{- if .Values.podDisruptionBudget.enabled }}
|
|
||||||
apiVersion: policy/v1
|
|
||||||
kind: PodDisruptionBudget
|
|
||||||
metadata:
|
|
||||||
name: {{ include "eck-operator.fullname" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
labels:
|
|
||||||
{{- include "eck-operator.labels" . | indent 4 }}
|
|
||||||
spec:
|
|
||||||
{{- with .Values.podDisruptionBudget.minAvailable }}
|
|
||||||
minAvailable: {{ . }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.podDisruptionBudget.maxUnavailable }}
|
|
||||||
maxUnavailable: {{ . }}
|
|
||||||
{{- end }}
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
{{- include "eck-operator.selectorLabels" . | indent 6 }}
|
|
||||||
{{- end -}}
|
|
||||||
@ -1,36 +0,0 @@
|
|||||||
{{- $metricsPort := int .Values.config.metricsPort -}}
|
|
||||||
{{- if and .Values.podMonitor.enabled (gt $metricsPort 0) }}
|
|
||||||
apiVersion: monitoring.coreos.com/v1
|
|
||||||
kind: PodMonitor
|
|
||||||
metadata:
|
|
||||||
name: {{ include "eck-operator.fullname" . }}
|
|
||||||
namespace: {{ ternary .Values.podMonitor.namespace .Release.Namespace (not (empty .Values.podMonitor.namespace)) }}
|
|
||||||
labels: {{- include "eck-operator.labels" . | nindent 4 }}
|
|
||||||
{{- with .Values.podMonitor.labels }}
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.podMonitor.annotations }}
|
|
||||||
annotations: {{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
spec:
|
|
||||||
{{- with .Values.podMonitor.podTargetLabels }}
|
|
||||||
podTargetLabels: {{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
podMetricsEndpoints:
|
|
||||||
- port: metrics
|
|
||||||
path: /metrics
|
|
||||||
{{- with .Values.podMonitor.interval }}
|
|
||||||
interval: {{ . }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.podMonitor.scrapeTimeout }}
|
|
||||||
scrapeTimeout: {{ . }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.podMonitor.podMetricsEndpointConfig }}
|
|
||||||
{{- toYaml . | nindent 6 }}
|
|
||||||
{{- end }}
|
|
||||||
namespaceSelector:
|
|
||||||
matchNames:
|
|
||||||
- {{ .Release.Namespace }}
|
|
||||||
selector:
|
|
||||||
matchLabels: {{- include "eck-operator.selectorLabels" . | nindent 6 }}
|
|
||||||
{{- end }}
|
|
||||||
@ -1,80 +0,0 @@
|
|||||||
{{- $operatorNSIsManaged := has .Release.Namespace .Values.managedNamespaces -}}
|
|
||||||
{{- $fullName := include "eck-operator.fullname" . -}}
|
|
||||||
{{- $svcAccount := include "eck-operator.serviceAccountName" . }}
|
|
||||||
|
|
||||||
{{- if not .Values.createClusterScopedResources }}
|
|
||||||
{{- range .Values.managedNamespaces }}
|
|
||||||
{{- $namespace := . }}
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: Role
|
|
||||||
metadata:
|
|
||||||
name: "{{ $fullName }}"
|
|
||||||
namespace: {{ $namespace }}
|
|
||||||
labels:
|
|
||||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
|
||||||
rules:
|
|
||||||
{{ template "eck-operator.rbacRules" $ | toYaml | indent 2 }}
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: RoleBinding
|
|
||||||
metadata:
|
|
||||||
name: "{{ $fullName }}"
|
|
||||||
namespace: {{ $namespace }}
|
|
||||||
labels:
|
|
||||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: Role
|
|
||||||
name: "{{ $fullName }}"
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: {{ $svcAccount }}
|
|
||||||
namespace: {{ $.Release.Namespace }}
|
|
||||||
{{- end }} {{- /* end of range over managed namespaces */}}
|
|
||||||
{{- /* If createClusterScopedResources is false and operator namespace is not in the managed namespaces list, create additional role binding */}}
|
|
||||||
{{- if not $operatorNSIsManaged }}
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: Role
|
|
||||||
metadata:
|
|
||||||
name: {{ $fullName }}
|
|
||||||
namespace: {{ $.Release.Namespace }}
|
|
||||||
labels:
|
|
||||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
|
||||||
rules:
|
|
||||||
{{ template "eck-operator.rbacRules" $ | toYaml | indent 2 }}
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: RoleBinding
|
|
||||||
metadata:
|
|
||||||
name: "{{ $fullName }}"
|
|
||||||
namespace: {{ $.Release.Namespace }}
|
|
||||||
labels:
|
|
||||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: Role
|
|
||||||
name: "{{ $fullName }}"
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: {{ $svcAccount }}
|
|
||||||
namespace: {{ $.Release.Namespace }}
|
|
||||||
{{- end }} {{- /* end of operator role binding if operator namespace is not managed */}}
|
|
||||||
{{- else }} {{- /* we can create cluster-scoped resources so just create a cluster role binding */}}
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRoleBinding
|
|
||||||
metadata:
|
|
||||||
name: {{ $fullName }}
|
|
||||||
labels:
|
|
||||||
{{- include "eck-operator.labels" $ | nindent 4 }}
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: ClusterRole
|
|
||||||
name: {{ $fullName }}
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: {{ $svcAccount }}
|
|
||||||
namespace: {{ $.Release.Namespace }}
|
|
||||||
{{- end }}
|
|
||||||
@ -1,14 +0,0 @@
|
|||||||
{{- if .Values.serviceAccount.create }}
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ServiceAccount
|
|
||||||
metadata:
|
|
||||||
name: {{ include "eck-operator.serviceAccountName" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
labels:
|
|
||||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
|
||||||
{{- with .Values.serviceAccount.annotations }}
|
|
||||||
annotations:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
@ -1,135 +0,0 @@
|
|||||||
{{- $metricsPort := int .Values.config.metricsPort -}}
|
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: StatefulSet
|
|
||||||
metadata:
|
|
||||||
name: {{ include "eck-operator.fullname" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
labels:
|
|
||||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
{{- include "eck-operator.selectorLabels" . | nindent 6 }}
|
|
||||||
serviceName: {{ include "eck-operator.fullname" . }}
|
|
||||||
replicas: {{ .Values.replicaCount }}
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
# Rename the fields "error" to "error.message" and "source" to "event.source"
|
|
||||||
# This is to avoid a conflict with the ECS "error" and "source" documents.
|
|
||||||
"co.elastic.logs/raw": "[{\"type\":\"container\",\"json.keys_under_root\":true,\"paths\":[\"/var/log/containers/*${data.kubernetes.container.id}.log\"],\"processors\":[{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"error\",\"to\":\"_error\"}]}},{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"_error\",\"to\":\"error.message\"}]}},{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"source\",\"to\":\"_source\"}]}},{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"_source\",\"to\":\"event.source\"}]}}]}]"
|
|
||||||
"checksum/config": {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
|
||||||
{{- with .Values.podAnnotations }}
|
|
||||||
{{- toYaml . | nindent 8 }}
|
|
||||||
{{- end }}
|
|
||||||
labels:
|
|
||||||
{{- include "eck-operator.selectorLabels" . | nindent 8 }}
|
|
||||||
{{- with .Values.podLabels }}
|
|
||||||
{{- toYaml . | nindent 8 }}
|
|
||||||
{{- end }}
|
|
||||||
spec:
|
|
||||||
terminationGracePeriodSeconds: 10
|
|
||||||
serviceAccountName: {{ include "eck-operator.serviceAccountName" . }}
|
|
||||||
{{- with .Values.priorityClassName }}
|
|
||||||
priorityClassName: {{ . }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.podSecurityContext }}
|
|
||||||
securityContext:
|
|
||||||
{{- toYaml . | nindent 8 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.imagePullSecrets }}
|
|
||||||
imagePullSecrets:
|
|
||||||
{{- toYaml . | nindent 8 }}
|
|
||||||
{{- end }}
|
|
||||||
containers:
|
|
||||||
- image: "{{ .Values.image.repository }}:{{ default .Chart.AppVersion .Values.image.tag }}"
|
|
||||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
|
||||||
name: manager
|
|
||||||
args:
|
|
||||||
- "manager"
|
|
||||||
- "--config=/conf/eck.yaml"
|
|
||||||
{{- with .Values.securityContext }}
|
|
||||||
securityContext:
|
|
||||||
{{- toYaml . | nindent 12 }}
|
|
||||||
{{- end }}
|
|
||||||
env:
|
|
||||||
- name: OPERATOR_NAMESPACE
|
|
||||||
valueFrom:
|
|
||||||
fieldRef:
|
|
||||||
fieldPath: metadata.namespace
|
|
||||||
- name: POD_IP
|
|
||||||
valueFrom:
|
|
||||||
fieldRef:
|
|
||||||
fieldPath: status.podIP
|
|
||||||
{{- if .Values.webhook.enabled }}
|
|
||||||
- name: WEBHOOK_SECRET
|
|
||||||
value: {{ include "eck-operator.webhookSecretName" . }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.env }}
|
|
||||||
{{- toYaml . | nindent 12 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.tracing.enabled -}}
|
|
||||||
{{- range $name, $value := .Values.tracing.config }}
|
|
||||||
- name: {{ $name }}
|
|
||||||
value: {{ $value }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.resources }}
|
|
||||||
resources:
|
|
||||||
{{- toYaml . | nindent 12 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if or (gt $metricsPort 0) .Values.webhook.enabled }}
|
|
||||||
ports:
|
|
||||||
{{- if (gt $metricsPort 0) }}
|
|
||||||
- containerPort: {{ .Values.config.metricsPort }}
|
|
||||||
name: metrics
|
|
||||||
protocol: TCP
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.webhook.enabled }}
|
|
||||||
- containerPort: {{ .Values.webhook.port }}
|
|
||||||
name: https-webhook
|
|
||||||
protocol: TCP
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: "/conf"
|
|
||||||
name: conf
|
|
||||||
readOnly: true
|
|
||||||
{{- if .Values.webhook.enabled }}
|
|
||||||
- mountPath: {{ .Values.webhook.certsDir }}
|
|
||||||
name: cert
|
|
||||||
readOnly: true
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.volumeMounts }}
|
|
||||||
{{- toYaml . | nindent 12 }}
|
|
||||||
{{- end }}
|
|
||||||
volumes:
|
|
||||||
- name: conf
|
|
||||||
configMap:
|
|
||||||
name: {{ include "eck-operator.fullname" . }}
|
|
||||||
{{- if .Values.webhook.enabled }}
|
|
||||||
- name: cert
|
|
||||||
secret:
|
|
||||||
defaultMode: 420
|
|
||||||
secretName: {{ include "eck-operator.webhookSecretName" . }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.volumes }}
|
|
||||||
{{- toYaml . | nindent 8 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.hostNetwork }}
|
|
||||||
hostNetwork: true
|
|
||||||
dnsPolicy: ClusterFirstWithHostNet
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.nodeSelector }}
|
|
||||||
nodeSelector:
|
|
||||||
{{- toYaml . | nindent 12 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.affinity }}
|
|
||||||
affinity:
|
|
||||||
{{- toYaml . | nindent 12 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.tolerations }}
|
|
||||||
tolerations:
|
|
||||||
{{- toYaml . | nindent 12 }}
|
|
||||||
{{- end }}
|
|
||||||
@ -1,29 +0,0 @@
|
|||||||
{{- if .Values.softMultiTenancy.enabled -}}
|
|
||||||
{{- if has .Release.Namespace .Values.managedNamespaces -}}
|
|
||||||
{{- fail "Operator namespace cannot be in managed namespaces when soft multi-tenancy is enabled" -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- if empty .Values.managedNamespaces -}}
|
|
||||||
{{- fail "Managed namespaces must be defined when soft multi-tenancy is enabled" -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- if empty .Values.kubeAPIServerIP -}}
|
|
||||||
{{- fail "Soft multi-tenancy requires kubeAPIServerIP to be defined" -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- if (not .Values.createClusterScopedResources) -}}
|
|
||||||
{{- if .Values.webhook.enabled -}}
|
|
||||||
{{- fail "Webhook cannot be enabled when cluster-scoped resource creation is disabled" -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- if .Values.config.validateStorageClass -}}
|
|
||||||
{{- fail "Storage class validation cannot be enabled when cluster-scoped resource creation is disabled" -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- if (not .Values.config.enableLeaderElection) -}}
|
|
||||||
{{- if gt (int .Values.replicaCount) 1 -}}
|
|
||||||
{{- fail "Leader election must be enabled with more than one replica" -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
@ -1,473 +0,0 @@
|
|||||||
{{- if .Values.webhook.enabled -}}
|
|
||||||
---
|
|
||||||
apiVersion: admissionregistration.k8s.io/v1
|
|
||||||
kind: ValidatingWebhookConfiguration
|
|
||||||
metadata:
|
|
||||||
name: {{ include "eck-operator.webhookName" . }}
|
|
||||||
labels:
|
|
||||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
|
||||||
{{- with .Values.webhook.certManagerCert }}
|
|
||||||
annotations:
|
|
||||||
cert-manager.io/inject-ca-from: "{{ $.Release.Namespace }}/{{ . }}"
|
|
||||||
{{- end }}
|
|
||||||
webhooks:
|
|
||||||
- clientConfig:
|
|
||||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
|
||||||
caBundle: {{ .Values.webhook.caBundle }}
|
|
||||||
{{- end }}
|
|
||||||
service:
|
|
||||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
path: /validate-agent-k8s-elastic-co-v1alpha1-agent
|
|
||||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
|
||||||
{{- with .Values.webhook.namespaceSelector }}
|
|
||||||
namespaceSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.webhook.objectSelector }}
|
|
||||||
objectSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
name: elastic-agent-validation-v1alpha1.k8s.elastic.co
|
|
||||||
matchPolicy: Exact
|
|
||||||
admissionReviewVersions: [v1,v1beta1]
|
|
||||||
sideEffects: None
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- agent.k8s.elastic.co
|
|
||||||
apiVersions:
|
|
||||||
- v1alpha1
|
|
||||||
operations:
|
|
||||||
- CREATE
|
|
||||||
- UPDATE
|
|
||||||
resources:
|
|
||||||
- agents
|
|
||||||
- clientConfig:
|
|
||||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
|
||||||
caBundle: {{ .Values.webhook.caBundle }}
|
|
||||||
{{- end }}
|
|
||||||
service:
|
|
||||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
path: /validate-apm-k8s-elastic-co-v1-apmserver
|
|
||||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
|
||||||
{{- with .Values.webhook.namespaceSelector }}
|
|
||||||
namespaceSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.webhook.objectSelector }}
|
|
||||||
objectSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
name: elastic-apm-validation-v1.k8s.elastic.co
|
|
||||||
matchPolicy: Exact
|
|
||||||
admissionReviewVersions: [v1,v1beta1]
|
|
||||||
sideEffects: None
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- apm.k8s.elastic.co
|
|
||||||
apiVersions:
|
|
||||||
- v1
|
|
||||||
operations:
|
|
||||||
- CREATE
|
|
||||||
- UPDATE
|
|
||||||
resources:
|
|
||||||
- apmservers
|
|
||||||
- clientConfig:
|
|
||||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
|
||||||
caBundle: {{ .Values.webhook.caBundle }}
|
|
||||||
{{- end }}
|
|
||||||
service:
|
|
||||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
path: /validate-apm-k8s-elastic-co-v1beta1-apmserver
|
|
||||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
|
||||||
{{- with .Values.webhook.namespaceSelector }}
|
|
||||||
namespaceSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.webhook.objectSelector }}
|
|
||||||
objectSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
name: elastic-apm-validation-v1beta1.k8s.elastic.co
|
|
||||||
matchPolicy: Exact
|
|
||||||
admissionReviewVersions: [v1,v1beta1]
|
|
||||||
sideEffects: None
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- apm.k8s.elastic.co
|
|
||||||
apiVersions:
|
|
||||||
- v1beta1
|
|
||||||
operations:
|
|
||||||
- CREATE
|
|
||||||
- UPDATE
|
|
||||||
resources:
|
|
||||||
- apmservers
|
|
||||||
- clientConfig:
|
|
||||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
|
||||||
caBundle: {{ .Values.webhook.caBundle }}
|
|
||||||
{{- end }}
|
|
||||||
service:
|
|
||||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
path: /validate-beat-k8s-elastic-co-v1beta1-beat
|
|
||||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
|
||||||
{{- with .Values.webhook.namespaceSelector }}
|
|
||||||
namespaceSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.webhook.objectSelector }}
|
|
||||||
objectSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
name: elastic-beat-validation-v1beta1.k8s.elastic.co
|
|
||||||
matchPolicy: Exact
|
|
||||||
admissionReviewVersions: [v1,v1beta1]
|
|
||||||
sideEffects: None
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- beat.k8s.elastic.co
|
|
||||||
apiVersions:
|
|
||||||
- v1beta1
|
|
||||||
operations:
|
|
||||||
- CREATE
|
|
||||||
- UPDATE
|
|
||||||
resources:
|
|
||||||
- beats
|
|
||||||
- clientConfig:
|
|
||||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
|
||||||
caBundle: {{ .Values.webhook.caBundle }}
|
|
||||||
{{- end }}
|
|
||||||
service:
|
|
||||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
path: /validate-enterprisesearch-k8s-elastic-co-v1-enterprisesearch
|
|
||||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
|
||||||
{{- with .Values.webhook.namespaceSelector }}
|
|
||||||
namespaceSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.webhook.objectSelector }}
|
|
||||||
objectSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
name: elastic-ent-validation-v1.k8s.elastic.co
|
|
||||||
matchPolicy: Exact
|
|
||||||
admissionReviewVersions: [v1,v1beta1]
|
|
||||||
sideEffects: None
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- enterprisesearch.k8s.elastic.co
|
|
||||||
apiVersions:
|
|
||||||
- v1
|
|
||||||
operations:
|
|
||||||
- CREATE
|
|
||||||
- UPDATE
|
|
||||||
resources:
|
|
||||||
- enterprisesearches
|
|
||||||
- clientConfig:
|
|
||||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
|
||||||
caBundle: {{ .Values.webhook.caBundle }}
|
|
||||||
{{- end }}
|
|
||||||
service:
|
|
||||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
path: /validate-enterprisesearch-k8s-elastic-co-v1beta1-enterprisesearch
|
|
||||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
|
||||||
{{- with .Values.webhook.namespaceSelector }}
|
|
||||||
namespaceSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.webhook.objectSelector }}
|
|
||||||
objectSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
name: elastic-ent-validation-v1beta1.k8s.elastic.co
|
|
||||||
matchPolicy: Exact
|
|
||||||
admissionReviewVersions: [v1,v1beta1]
|
|
||||||
sideEffects: None
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- enterprisesearch.k8s.elastic.co
|
|
||||||
apiVersions:
|
|
||||||
- v1beta1
|
|
||||||
operations:
|
|
||||||
- CREATE
|
|
||||||
- UPDATE
|
|
||||||
resources:
|
|
||||||
- enterprisesearches
|
|
||||||
- clientConfig:
|
|
||||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
|
||||||
caBundle: {{ .Values.webhook.caBundle }}
|
|
||||||
{{- end }}
|
|
||||||
service:
|
|
||||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
path: /validate-elasticsearch-k8s-elastic-co-v1-elasticsearch
|
|
||||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
|
||||||
{{- with .Values.webhook.namespaceSelector }}
|
|
||||||
namespaceSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.webhook.objectSelector }}
|
|
||||||
objectSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
name: elastic-es-validation-v1.k8s.elastic.co
|
|
||||||
matchPolicy: Exact
|
|
||||||
admissionReviewVersions: [v1,v1beta1]
|
|
||||||
sideEffects: None
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- elasticsearch.k8s.elastic.co
|
|
||||||
apiVersions:
|
|
||||||
- v1
|
|
||||||
operations:
|
|
||||||
- CREATE
|
|
||||||
- UPDATE
|
|
||||||
resources:
|
|
||||||
- elasticsearches
|
|
||||||
- clientConfig:
|
|
||||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
|
||||||
caBundle: {{ .Values.webhook.caBundle }}
|
|
||||||
{{- end }}
|
|
||||||
service:
|
|
||||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
path: /validate-elasticsearch-k8s-elastic-co-v1beta1-elasticsearch
|
|
||||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
|
||||||
{{- with .Values.webhook.namespaceSelector }}
|
|
||||||
namespaceSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.webhook.objectSelector }}
|
|
||||||
objectSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
name: elastic-es-validation-v1beta1.k8s.elastic.co
|
|
||||||
matchPolicy: Exact
|
|
||||||
admissionReviewVersions: [v1,v1beta1]
|
|
||||||
sideEffects: None
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- elasticsearch.k8s.elastic.co
|
|
||||||
apiVersions:
|
|
||||||
- v1beta1
|
|
||||||
operations:
|
|
||||||
- CREATE
|
|
||||||
- UPDATE
|
|
||||||
resources:
|
|
||||||
- elasticsearches
|
|
||||||
- clientConfig:
|
|
||||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
|
||||||
caBundle: {{ .Values.webhook.caBundle }}
|
|
||||||
{{- end }}
|
|
||||||
service:
|
|
||||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
path: /validate-ems-k8s-elastic-co-v1alpha1-mapsservers
|
|
||||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
|
||||||
{{- with .Values.webhook.namespaceSelector }}
|
|
||||||
namespaceSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.webhook.objectSelector }}
|
|
||||||
objectSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
name: elastic-ems-validation-v1alpha1.k8s.elastic.co
|
|
||||||
matchPolicy: Exact
|
|
||||||
admissionReviewVersions: [v1,v1beta1]
|
|
||||||
sideEffects: None
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- maps.k8s.elastic.co
|
|
||||||
apiVersions:
|
|
||||||
- v1alpha1
|
|
||||||
operations:
|
|
||||||
- CREATE
|
|
||||||
- UPDATE
|
|
||||||
resources:
|
|
||||||
- mapsservers
|
|
||||||
- clientConfig:
|
|
||||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
|
||||||
caBundle: {{ .Values.webhook.caBundle }}
|
|
||||||
{{- end }}
|
|
||||||
service:
|
|
||||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
path: /validate-kibana-k8s-elastic-co-v1-kibana
|
|
||||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
|
||||||
{{- with .Values.webhook.namespaceSelector }}
|
|
||||||
namespaceSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.webhook.objectSelector }}
|
|
||||||
objectSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
name: elastic-kb-validation-v1.k8s.elastic.co
|
|
||||||
matchPolicy: Exact
|
|
||||||
admissionReviewVersions: [v1,v1beta1]
|
|
||||||
sideEffects: None
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- kibana.k8s.elastic.co
|
|
||||||
apiVersions:
|
|
||||||
- v1
|
|
||||||
operations:
|
|
||||||
- CREATE
|
|
||||||
- UPDATE
|
|
||||||
resources:
|
|
||||||
- kibanas
|
|
||||||
- clientConfig:
|
|
||||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
|
||||||
caBundle: {{ .Values.webhook.caBundle }}
|
|
||||||
{{- end }}
|
|
||||||
service:
|
|
||||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
path: /validate-kibana-k8s-elastic-co-v1beta1-kibana
|
|
||||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
|
||||||
{{- with .Values.webhook.namespaceSelector }}
|
|
||||||
namespaceSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.webhook.objectSelector }}
|
|
||||||
objectSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
name: elastic-kb-validation-v1beta1.k8s.elastic.co
|
|
||||||
matchPolicy: Exact
|
|
||||||
admissionReviewVersions: [v1,v1beta1]
|
|
||||||
sideEffects: None
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- kibana.k8s.elastic.co
|
|
||||||
apiVersions:
|
|
||||||
- v1beta1
|
|
||||||
operations:
|
|
||||||
- CREATE
|
|
||||||
- UPDATE
|
|
||||||
resources:
|
|
||||||
- kibanas
|
|
||||||
- clientConfig:
|
|
||||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
|
||||||
caBundle: {{ .Values.webhook.caBundle }}
|
|
||||||
{{- end }}
|
|
||||||
service:
|
|
||||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
path: /validate-autoscaling-k8s-elastic-co-v1alpha1-elasticsearchautoscaler
|
|
||||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
|
||||||
{{- with .Values.webhook.namespaceSelector }}
|
|
||||||
namespaceSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.webhook.objectSelector }}
|
|
||||||
objectSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
name: elastic-esa-validation-v1alpha1.k8s.elastic.co
|
|
||||||
matchPolicy: Exact
|
|
||||||
admissionReviewVersions: [v1,v1beta1]
|
|
||||||
sideEffects: None
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- autoscaling.k8s.elastic.co
|
|
||||||
apiVersions:
|
|
||||||
- v1alpha1
|
|
||||||
operations:
|
|
||||||
- CREATE
|
|
||||||
- UPDATE
|
|
||||||
resources:
|
|
||||||
- elasticsearchautoscalers
|
|
||||||
- clientConfig:
|
|
||||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
|
||||||
caBundle: {{ .Values.webhook.caBundle }}
|
|
||||||
{{- end }}
|
|
||||||
service:
|
|
||||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
path: /validate-scp-k8s-elastic-co-v1alpha1-stackconfigpolicies
|
|
||||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
|
||||||
{{- with .Values.webhook.namespaceSelector }}
|
|
||||||
namespaceSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.webhook.objectSelector }}
|
|
||||||
objectSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
name: elastic-scp-validation-v1alpha1.k8s.elastic.co
|
|
||||||
matchPolicy: Exact
|
|
||||||
admissionReviewVersions: [v1,v1beta1]
|
|
||||||
sideEffects: None
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- stackconfigpolicy.k8s.elastic.co
|
|
||||||
apiVersions:
|
|
||||||
- v1alpha1
|
|
||||||
operations:
|
|
||||||
- CREATE
|
|
||||||
- UPDATE
|
|
||||||
resources:
|
|
||||||
- stackconfigpolicies
|
|
||||||
- clientConfig:
|
|
||||||
{{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }}
|
|
||||||
caBundle: {{ .Values.webhook.caBundle }}
|
|
||||||
{{- end }}
|
|
||||||
service:
|
|
||||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
path: /validate-logstash-k8s-elastic-co-v1alpha1-logstash
|
|
||||||
failurePolicy: {{ .Values.webhook.failurePolicy }}
|
|
||||||
{{- with .Values.webhook.namespaceSelector }}
|
|
||||||
namespaceSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.webhook.objectSelector }}
|
|
||||||
objectSelector:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
name: elastic-logstash-validation-v1alpha1.k8s.elastic.co
|
|
||||||
matchPolicy: Exact
|
|
||||||
admissionReviewVersions: [v1,v1beta1]
|
|
||||||
sideEffects: None
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- logstash.k8s.elastic.co
|
|
||||||
apiVersions:
|
|
||||||
- v1alpha1
|
|
||||||
operations:
|
|
||||||
- CREATE
|
|
||||||
- UPDATE
|
|
||||||
resources:
|
|
||||||
- logstashes
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: {{ include "eck-operator.webhookServiceName" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
labels:
|
|
||||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
|
||||||
spec:
|
|
||||||
ports:
|
|
||||||
- name: https
|
|
||||||
port: 443
|
|
||||||
targetPort: {{ .Values.webhook.port }}
|
|
||||||
selector:
|
|
||||||
{{- include "eck-operator.selectorLabels" . | nindent 4 }}
|
|
||||||
{{- if .Values.webhook.manageCerts }}
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
name: {{ include "eck-operator.webhookSecretName" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
labels:
|
|
||||||
{{- include "eck-operator.labels" . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end -}}
|
|
||||||
@ -1,254 +0,0 @@
|
|||||||
# nameOverride is the short name for the deployment. Leave empty to let Helm generate a name using chart values.
|
|
||||||
nameOverride: "elastic-operator"
|
|
||||||
|
|
||||||
# fullnameOverride is the full name for the deployment. Leave empty to let Helm generate a name using chart values.
|
|
||||||
fullnameOverride: "elastic-operator"
|
|
||||||
|
|
||||||
# managedNamespaces is the set of namespaces that the operator manages. Leave empty to manage all namespaces.
|
|
||||||
managedNamespaces: []
|
|
||||||
|
|
||||||
# installCRDs determines whether Custom Resource Definitions (CRD) are installed by the chart.
|
|
||||||
# Note that CRDs are global resources and require cluster admin privileges to install.
|
|
||||||
# If you are sharing a cluster with other users who may want to install ECK on their own namespaces, setting this to true can have unintended consequences.
|
|
||||||
# 1. Upgrades will overwrite the global CRDs and could disrupt the other users of ECK who may be running a different version.
|
|
||||||
# 2. Uninstalling the chart will delete the CRDs and potentially cause Elastic resources deployed by other users to be removed as well.
|
|
||||||
installCRDs: true
|
|
||||||
|
|
||||||
# replicaCount is the number of operator pods to run.
|
|
||||||
replicaCount: 1
|
|
||||||
|
|
||||||
image:
|
|
||||||
# repository is the container image prefixed by the registry name.
|
|
||||||
repository: docker.elastic.co/eck/eck-operator
|
|
||||||
# pullPolicy is the container image pull policy.
|
|
||||||
pullPolicy: IfNotPresent
|
|
||||||
# tag is the container image tag. If not defined, defaults to chart appVersion.
|
|
||||||
tag: null
|
|
||||||
|
|
||||||
# priorityClassName defines the PriorityClass to be used by the operator pods.
|
|
||||||
priorityClassName: ""
|
|
||||||
|
|
||||||
# imagePullSecrets defines the secrets to use when pulling the operator container image.
|
|
||||||
imagePullSecrets: []
|
|
||||||
|
|
||||||
# resources define the container resource limits for the operator.
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
cpu: 1
|
|
||||||
memory: 1Gi
|
|
||||||
requests:
|
|
||||||
cpu: 100m
|
|
||||||
memory: 150Mi
|
|
||||||
|
|
||||||
# podAnnotations define the annotations that should be added to the operator pod.
|
|
||||||
podAnnotations: {}
|
|
||||||
|
|
||||||
## podLabels define additional labels that should be added to the operator pod.
|
|
||||||
podLabels: {}
|
|
||||||
|
|
||||||
# podSecurityContext defines the pod security context for the operator pod.
|
|
||||||
podSecurityContext:
|
|
||||||
runAsNonRoot: true
|
|
||||||
|
|
||||||
# securityContext defines the security context of the operator container.
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- ALL
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
runAsNonRoot: true
|
|
||||||
|
|
||||||
# nodeSelector defines the node selector for the operator pod.
|
|
||||||
nodeSelector: {}
|
|
||||||
|
|
||||||
# tolerations defines the node tolerations for the operator pod.
|
|
||||||
tolerations: []
|
|
||||||
|
|
||||||
# affinity defines the node affinity rules for the operator pod.
|
|
||||||
affinity: {}
|
|
||||||
|
|
||||||
# podDisruptionBudget configures the minimum or the maxium available pods for voluntary disruptions,
|
|
||||||
# set to either an integer (e.g. 1) or a percentage value (e.g. 25%).
|
|
||||||
podDisruptionBudget:
|
|
||||||
enabled: false
|
|
||||||
minAvailable: 1
|
|
||||||
# maxUnavailable: 3
|
|
||||||
|
|
||||||
# additional environment variables for the operator container.
|
|
||||||
env: []
|
|
||||||
|
|
||||||
# additional volume mounts for the operator container.
|
|
||||||
volumeMounts: []
|
|
||||||
|
|
||||||
# additional volumes to add to the operator pod.
|
|
||||||
volumes: []
|
|
||||||
|
|
||||||
# createClusterScopedResources determines whether cluster-scoped resources (ClusterRoles, ClusterRoleBindings) should be created.
|
|
||||||
createClusterScopedResources: true
|
|
||||||
|
|
||||||
serviceAccount:
|
|
||||||
# create specifies whether a service account should be created for the operator.
|
|
||||||
create: true
|
|
||||||
# annotations to add to the service account
|
|
||||||
annotations: {}
|
|
||||||
# name of the service account to use. If not set and create is true, a name is generated using the fullname template.
|
|
||||||
name: ""
|
|
||||||
|
|
||||||
tracing:
|
|
||||||
# enabled specifies whether APM tracing is enabled for the operator.
|
|
||||||
enabled: false
|
|
||||||
# config is a map of APM Server configuration variables that should be set in the environment.
|
|
||||||
config:
|
|
||||||
ELASTIC_APM_SERVER_URL: http://localhost:8200
|
|
||||||
ELASTIC_APM_SERVER_TIMEOUT: 30s
|
|
||||||
|
|
||||||
refs:
|
|
||||||
# enforceRBAC specifies whether RBAC should be enforced for cross-namespace associations between resources.
|
|
||||||
enforceRBAC: false
|
|
||||||
|
|
||||||
webhook:
|
|
||||||
# enabled determines whether the webhook is installed.
|
|
||||||
enabled: true
|
|
||||||
# caBundle is the PEM-encoded CA trust bundle for the webhook certificate. Only required if manageCerts is false and certManagerCert is null.
|
|
||||||
caBundle: Cg==
|
|
||||||
# certManagerCert is the name of the cert-manager certificate to use with the webhook.
|
|
||||||
certManagerCert: null
|
|
||||||
# certsDir is the directory to mount the certificates.
|
|
||||||
certsDir: "/tmp/k8s-webhook-server/serving-certs"
|
|
||||||
# failurePolicy of the webhook.
|
|
||||||
failurePolicy: Ignore
|
|
||||||
# manageCerts determines whether the operator manages the webhook certificates automatically.
|
|
||||||
manageCerts: true
|
|
||||||
# namespaceSelector corresponds to the namespaceSelector property of the webhook.
|
|
||||||
# Setting this restricts the webhook to act only on objects submitted to namespaces that match the selector.
|
|
||||||
namespaceSelector: {}
|
|
||||||
# objectSelector corresponds to the objectSelector property of the webhook.
|
|
||||||
# Setting this restricts the webhook to act only on objects that match the selector.
|
|
||||||
objectSelector: {}
|
|
||||||
# port is the port that the validating webhook binds to.
|
|
||||||
port: 9443
|
|
||||||
|
|
||||||
# hostNetwork allows a Pod to use the Node network namespace.
|
|
||||||
# This is required to allow for communication with the kube API when using some alternate CNIs in conjunction with webhook enabled.
|
|
||||||
# CAUTION: Proceed at your own risk. This setting has security concerns such as allowing malicious users to access workloads running on the host.
|
|
||||||
hostNetwork: false
|
|
||||||
|
|
||||||
softMultiTenancy:
|
|
||||||
# enabled determines whether the operator is installed with soft multi-tenancy extensions.
|
|
||||||
# This requires network policies to be enabled on the Kubernetes cluster.
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
# kubeAPIServerIP is required when softMultiTenancy is enabled.
|
|
||||||
kubeAPIServerIP: null
|
|
||||||
|
|
||||||
telemetry:
|
|
||||||
# disabled determines whether the operator periodically updates ECK telemetry data for Kibana to consume.
|
|
||||||
disabled: false
|
|
||||||
# distributionChannel denotes which distribution channel was used to install the operator.
|
|
||||||
distributionChannel: "helm"
|
|
||||||
|
|
||||||
# config values for the operator.
|
|
||||||
config:
|
|
||||||
# logVerbosity defines the logging level. Valid values are as follows:
|
|
||||||
# -2: Errors only
|
|
||||||
# -1: Errors and warnings
|
|
||||||
# 0: Errors, warnings, and information
|
|
||||||
# number greater than 0: Errors, warnings, information, and debug details.
|
|
||||||
logVerbosity: "0"
|
|
||||||
|
|
||||||
# metricsPort defines the port to expose operator metrics. Set to 0 to disable metrics reporting.
|
|
||||||
metricsPort: "0"
|
|
||||||
|
|
||||||
# containerRegistry to use for pulling Elasticsearch and other application container images.
|
|
||||||
containerRegistry: docker.elastic.co
|
|
||||||
|
|
||||||
# containerRepository to use for pulling Elasticsearch and other application container images.
|
|
||||||
# containerRepository: ""
|
|
||||||
|
|
||||||
# containerSuffix suffix to be appended to container images by default. Cannot be combined with -ubiOnly flag
|
|
||||||
# containerSuffix: ""
|
|
||||||
|
|
||||||
# maxConcurrentReconciles is the number of concurrent reconciliation operations to perform per controller.
|
|
||||||
maxConcurrentReconciles: "3"
|
|
||||||
|
|
||||||
# caValidity defines the validity period of the CA certificates generated by the operator.
|
|
||||||
caValidity: 8760h
|
|
||||||
|
|
||||||
# caRotateBefore defines when to rotate a CA certificate that is due to expire.
|
|
||||||
caRotateBefore: 24h
|
|
||||||
|
|
||||||
# certificatesValidity defines the validity period of certificates generated by the operator.
|
|
||||||
certificatesValidity: 8760h
|
|
||||||
|
|
||||||
# certificatesRotateBefore defines when to rotate a certificate that is due to expire.
|
|
||||||
certificatesRotateBefore: 24h
|
|
||||||
|
|
||||||
# exposedNodeLabels is an array of regular expressions of node labels which are allowed to be copied as annotations on Elasticsearch Pods.
|
|
||||||
exposedNodeLabels: [ "topology.kubernetes.io/.*", "failure-domain.beta.kubernetes.io/.*" ]
|
|
||||||
|
|
||||||
# setDefaultSecurityContext determines whether a default security context is set on application containers created by the operator.
|
|
||||||
# *note* that the default option now is "auto-detect" to attempt to set this properly automatically when both running
|
|
||||||
# in an openshift cluster, and a standard kubernetes cluster. Valid values are as follows:
|
|
||||||
# "auto-detect" : auto detect
|
|
||||||
# "true" : set pod security context when creating resources.
|
|
||||||
# "false" : do not set pod security context when creating resources.
|
|
||||||
setDefaultSecurityContext: "auto-detect"
|
|
||||||
|
|
||||||
# kubeClientTimeout sets the request timeout for Kubernetes API calls made by the operator.
|
|
||||||
kubeClientTimeout: 60s
|
|
||||||
|
|
||||||
# elasticsearchClientTimeout sets the request timeout for Elasticsearch API calls made by the operator.
|
|
||||||
elasticsearchClientTimeout: 180s
|
|
||||||
|
|
||||||
# validateStorageClass specifies whether storage classes volume expansion support should be verified.
|
|
||||||
# Can be disabled if cluster-wide storage class RBAC access is not available.
|
|
||||||
validateStorageClass: true
|
|
||||||
|
|
||||||
# enableLeaderElection specifies whether leader election should be enabled
|
|
||||||
enableLeaderElection: true
|
|
||||||
|
|
||||||
# Interval between observations of Elasticsearch health, non-positive values disable asynchronous observation.
|
|
||||||
elasticsearchObservationInterval: 10s
|
|
||||||
|
|
||||||
# Prometheus PodMonitor configuration
|
|
||||||
# Reference: https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/api.md#podmonitor
|
|
||||||
podMonitor:
|
|
||||||
|
|
||||||
# enabled determines whether a podMonitor should deployed to scrape the eck metrics.
|
|
||||||
# This requires the prometheus operator and the config.metricsPort not to be 0
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
# labels adds additional labels to the podMonitor
|
|
||||||
labels: {}
|
|
||||||
|
|
||||||
# annotations adds additional annotations to the podMonitor
|
|
||||||
annotations: {}
|
|
||||||
|
|
||||||
# namespace determines in which namespace the podMonitor will be deployed.
|
|
||||||
# If not set the podMonitor will be created in the namespace where the Helm release is installed into
|
|
||||||
# namespace: monitoring
|
|
||||||
|
|
||||||
# interval specifies the interval at which metrics should be scraped
|
|
||||||
interval: 5m
|
|
||||||
|
|
||||||
# scrapeTimeout specifies the timeout after which the scrape is ended
|
|
||||||
scrapeTimeout: 30s
|
|
||||||
|
|
||||||
# podTargetLabels transfers labels on the Kubernetes Pod onto the target.
|
|
||||||
podTargetLabels: []
|
|
||||||
|
|
||||||
# podMetricsEndpointConfig allows to add an extended configuration to the podMonitor
|
|
||||||
podMetricsEndpointConfig: {}
|
|
||||||
# honorTimestamps: true
|
|
||||||
|
|
||||||
# Globals meant for internal use only
|
|
||||||
global:
|
|
||||||
# manifestGen specifies whether the chart is running under manifest generator.
|
|
||||||
# This is used for tasks specific to generating the all-in-one.yaml file.
|
|
||||||
manifestGen: false
|
|
||||||
# createOperatorNamespace defines whether the operator namespace manifest should be generated when in manifestGen mode.
|
|
||||||
# Usually we do want that to happen (e.g. all-in-one.yaml) but, sometimes we don't (e.g. E2E tests).
|
|
||||||
createOperatorNamespace: true
|
|
||||||
# kubeVersion is the effective Kubernetes version we target when generating the all-in-one.yaml.
|
|
||||||
kubeVersion: 1.21.0
|
|
||||||
@ -3,19 +3,11 @@ set -ex
|
|||||||
|
|
||||||
. ../../scripts/lib-update.sh
|
. ../../scripts/lib-update.sh
|
||||||
|
|
||||||
ECK_VERSION=$(yq eval '.dependencies[] | select(.name=="eck-operator") | .version' Chart.yaml)
|
update_helm
|
||||||
|
|
||||||
FLUENT_BIT_VERSION=$(yq eval '.dependencies[] | select(.name=="fluent-bit") | .version' Chart.yaml)
|
FLUENT_BIT_VERSION=$(yq eval '.dependencies[] | select(.name=="fluent-bit") | .version' Chart.yaml)
|
||||||
FLUENTD_VERSION=$(yq eval '.dependencies[] | select(.name=="fluentd") | .version' Chart.yaml)
|
FLUENTD_VERSION=$(yq eval '.dependencies[] | select(.name=="fluentd") | .version' Chart.yaml)
|
||||||
|
|
||||||
patch_chart eck-operator
|
|
||||||
|
|
||||||
# fix ECK crds handling to adhere to proper helm v3 support which also fixes ArgoCD applying updates on upgrades
|
|
||||||
mkdir charts/eck-operator/crds
|
|
||||||
helm template charts/eck-operator/charts/eck-operator-crds --name-template logging --kube-version 1.26 > charts/eck-operator/crds/all-crds.yaml
|
|
||||||
|
|
||||||
rm -rf charts/eck-operator/charts
|
|
||||||
yq eval -Mi 'del(.dependencies)' charts/eck-operator/Chart.yaml
|
|
||||||
|
|
||||||
# fluent-bit
|
# fluent-bit
|
||||||
patch_chart fluent-bit
|
patch_chart fluent-bit
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user