Skip to content

Commit 14a9dcc

Browse files
RazikusRazikus
committed
No more deployments in friday
0 parents  commit 14a9dcc

File tree

16 files changed

+461
-0
lines changed

16 files changed

+461
-0
lines changed

‎itsfriday/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎itsfriday/Chart.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: v2
2+
name: itsfriday
3+
description: A Helm chart for Kubernetes
4+
5+
# A chart can be either an 'application' or a 'library' chart.
6+
#
7+
# Application charts are a collection of templates that can be packaged into versioned archives
8+
# to be deployed.
9+
#
10+
# Library charts provide useful utilities or functions for the chart developer. They're included as
11+
# a dependency of application charts to inject those utilities and functions into the rendering
12+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
13+
type: application
14+
15+
# This is the chart version. This version number should be incremented each time you make changes
16+
# to the chart and its templates, including the app version.
17+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18+
version: 0.1.0
19+
20+
# This is the version number of the application being deployed. This version number should be
21+
# incremented each time you make changes to the application. Versions are not expected to
22+
# follow Semantic Versioning. They should reflect the version the application is using.
23+
# It is recommended to use it with quotes.
24+
appVersion: "1.16.0"

‎itsfriday/templates/NOTES.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
ITS FRIDAY ENABLED - NO MORE DEPLOYMENTS IN FRIDAY!

‎itsfriday/templates/_helpers.tpl‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "itsfriday.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
9+
{{- define "k8s-version-minor" -}}
10+
{{- trimSuffix "." (trimPrefix "v1." (regexFind "v\\d\\.\\d{1,2}\\." .Capabilities.KubeVersion.Version)) -}}
11+
{{- end -}}
12+
13+
14+
{{- define "getInstalledTLSCert" -}}
15+
{{- $data := (lookup "v1" "Secret" .Release.Namespace (printf "%s-tls" .Chart.Name)).data -}}
16+
{{- if $data -}}
17+
{{ get $data "tls.crt" }}
18+
{{- end -}}
19+
{{- end -}}
20+
21+
{{- define "getInstalledTLSKey" -}}
22+
{{- $data := (lookup "v1" "Secret" .Release.Namespace (printf "%s-tls" .Chart.Name)).data -}}
23+
{{- if $data -}}
24+
{{ get $data "tls.key" }}
25+
{{- end -}}
26+
{{- end -}}
27+
28+
29+
{{/*
30+
Create a default fully qualified app name.
31+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
32+
If release name contains chart name it will be used as a full name.
33+
*/}}
34+
{{- define "itsfriday.fullname" -}}
35+
{{- if .Values.fullnameOverride }}
36+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
37+
{{- else }}
38+
{{- $name := default .Chart.Name .Values.nameOverride }}
39+
{{- if contains $name .Release.Name }}
40+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
41+
{{- else }}
42+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
43+
{{- end }}
44+
{{- end }}
45+
{{- end }}
46+
47+
{{/*
48+
Create chart name and version as used by the chart label.
49+
*/}}
50+
{{- define "itsfriday.chart" -}}
51+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
52+
{{- end }}
53+
54+
55+
{{/*
56+
Common labels
57+
*/}}
58+
{{- define "itsfriday.labels" -}}
59+
helm.sh/chart: {{ include "itsfriday.chart" . }}
60+
{{ include "itsfriday.selectorLabels" . }}
61+
{{- if .Chart.AppVersion }}
62+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
63+
{{- end }}
64+
app.kubernetes.io/managed-by: {{ .Release.Service }}
65+
{{- end }}
66+
67+
{{/*
68+
Selector labels
69+
*/}}
70+
{{- define "itsfriday.selectorLabels" -}}
71+
app.kubernetes.io/name: {{ include "itsfriday.name" . }}
72+
app.kubernetes.io/instance: {{ .Release.Name }}
73+
{{- end }}
74+
75+
{{/*
76+
Create the name of the service account to use
77+
*/}}
78+
{{- define "itsfriday.serviceAccountName" -}}
79+
{{- if .Values.serviceAccount.create }}
80+
{{- default (include "itsfriday.fullname" .) .Values.serviceAccount.name }}
81+
{{- else }}
82+
{{- default "default" .Values.serviceAccount.name }}
83+
{{- end }}
84+
{{- end }}

‎itsfriday/templates/certwebhook.yaml‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
{{- $k8sMinor := (include "k8s-version-minor" .) -}}
2+
{{- $altNames := list -}}
3+
{{- $altNames = append $altNames (printf "%s-svc" .Chart.Name) -}}
4+
{{- $altNames = append $altNames (printf "%s-svc.%s" .Chart.Name .Release.Namespace) -}}
5+
{{- $altNames = append $altNames (printf "%s-svc.%s.svc" .Chart.Name .Release.Namespace) -}}
6+
{{- $altNames = append $altNames (printf "%s-svc.%s.svc.cluster.local" .Chart.Name .Release.Namespace) -}}
7+
{{- $certs := genSelfSignedCert (printf "%s-svc.%s.svc" .Chart.Name .Release.Namespace) nil $altNames 36500 -}}
8+
apiVersion: v1
9+
kind: Secret
10+
metadata:
11+
name: {{ .Chart.Name }}-tls
12+
namespace: {{ .Release.Namespace }}
13+
labels:
14+
{{- include "itsfriday.labels" . | nindent 4 }}
15+
type: Opaque
16+
data:
17+
tls.crt: {{ default ($certs.Cert | b64enc) (include "getInstalledTLSCert" .) }}
18+
tls.key: {{ default ($certs.Key | b64enc) (include "getInstalledTLSKey" .) }}
19+
---
20+
{{ if lt ($k8sMinor | int) 17 }}
21+
apiVersion: admissionregistration.k8s.io/v1beta1
22+
{{ else }}
23+
apiVersion: admissionregistration.k8s.io/v1
24+
{{ end }}
25+
kind: ValidatingWebhookConfiguration
26+
metadata:
27+
name: {{ .Chart.Name }}-webhook
28+
labels:
29+
{{- include "itsfriday.labels" . | nindent 4 }}
30+
annotations:
31+
"helm.sh/hook": post-delete
32+
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
33+
webhooks:
34+
- name: {{ .Chart.Name }}-svc.{{ .Release.Namespace }}.svc
35+
failurePolicy: Ignore
36+
clientConfig:
37+
service:
38+
name: {{ .Chart.Name }}-svc
39+
namespace: {{ .Release.Namespace }}
40+
path: /validate
41+
caBundle: {{ default ($certs.Cert | b64enc) (include "getInstalledTLSCert" .) }}
42+
rules: []
43+
sideEffects: None
44+
{{- if lt ($k8sMinor | int) 17 }}
45+
admissionReviewVersions: ["v1beta1"]
46+
{{- else }}
47+
admissionReviewVersions: ["v1"]
48+
{{- end }}
49+
---
50+
{{ if lt ($k8sMinor | int) 17 -}}
51+
apiVersion: admissionregistration.k8s.io/v1beta1
52+
{{ else -}}
53+
apiVersion: admissionregistration.k8s.io/v1
54+
{{ end -}}
55+
kind: ValidatingWebhookConfiguration
56+
metadata:
57+
name: {{ .Chart.Name }}-webhook
58+
labels:
59+
{{- include "itsfriday.labels" . | nindent 4 }}
60+
annotations:
61+
"helm.sh/hook": post-install, post-upgrade, post-rollback
62+
webhooks:
63+
- name: {{ .Chart.Name }}-svc.{{ .Release.Namespace }}.svc
64+
failurePolicy: {{ .Values.failurePolicy | default "Fail" }}
65+
clientConfig:
66+
service:
67+
name: {{ .Chart.Name }}-svc
68+
namespace: {{ .Release.Namespace }}
69+
path: /validate
70+
caBundle: {{ default ($certs.Cert | b64enc) (include "getInstalledTLSCert" .) }}
71+
rules:
72+
- operations: ["CREATE", "UPDATE"]
73+
apiGroups: ["*"]
74+
apiVersions: ["*"]
75+
resources: ["pods", "deployments", "replicationcontrollers", "replicasets", "daemonsets", "statefulsets", "jobs", "cronjobs"]
76+
sideEffects: None
77+
{{- if gt ($k8sMinor | int) 13 }}
78+
timeoutSeconds: 30
79+
{{- end }}
80+
{{- if lt ($k8sMinor | int) 17 }}
81+
admissionReviewVersions: ["v1beta1"]
82+
{{- else }}
83+
admissionReviewVersions: ["v1"]
84+
{{- end }}
85+
{{- if .Values.namespacedValidation }}
86+
{{- if .Values.namespacedValidation.enabled }}
87+
namespaceSelector:
88+
matchExpressions:
89+
- key: itsfriday/webhookenabled
90+
{{- if not .Values.onlyMarkedNamespaces.mode}}
91+
operator: NotIn
92+
values:
93+
- ignore
94+
{{- else if eq .Values.onlyMarkedNamespaces.mode "ignore"}}
95+
operator: NotIn
96+
values:
97+
- ignore
98+
{{- else if eq .Values.onlyMarkedNamespaces.mode "validate"}}
99+
operator: In
100+
values:
101+
- validate
102+
{{- end }}
103+
{{- end }}
104+
{{- end }}

‎itsfriday/templates/deployment.yaml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
labels:
5+
{{- include "itsfriday.labels" . | nindent 4 }}
6+
name: {{ .Chart.Name }}-deployment
7+
namespace: "{{$.Release.Namespace}}"
8+
spec:
9+
replicas: {{ .Values.replicasCount }}
10+
selector:
11+
matchLabels:
12+
app.kubernetes.io/name: {{ include "itsfriday.name" . }}
13+
app.kubernetes.io/instance: {{ .Chart.Name }}
14+
strategy:
15+
type: Recreate
16+
template:
17+
metadata:
18+
labels:
19+
app.kubernetes.io/name: {{ include "itsfriday.name" . }}
20+
app.kubernetes.io/instance: {{ .Chart.Name }}
21+
spec:
22+
serviceAccountName: {{ .Chart.Name }}-serviceaccount
23+
containers:
24+
- env:
25+
- name: APP_POD_NAME
26+
valueFrom:
27+
fieldRef:
28+
fieldPath: metadata.name
29+
image: {{$.Values.images.itsfriday }}
30+
livenessProbe:
31+
httpGet:
32+
path: /health
33+
port: 443
34+
scheme: HTTPS
35+
initialDelaySeconds: 3
36+
periodSeconds: 5
37+
readinessProbe:
38+
httpGet:
39+
path: /ready
40+
port: 443
41+
scheme: HTTPS
42+
initialDelaySeconds: 2
43+
periodSeconds: 5
44+
imagePullPolicy: Always
45+
name: {{ .Chart.Name }}
46+
resources: {}
47+
volumeMounts:
48+
- name: {{ .Chart.Name }}-certs
49+
mountPath: /app/certs
50+
readOnly: true
51+
restartPolicy: Always
52+
volumes:
53+
- name: {{ .Chart.Name }}-certs
54+
secret:
55+
secretName: {{ .Chart.Name }}-tls
56+
status: {}

‎itsfriday/templates/service.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: {{ .Chart.Name }}-svc
5+
namespace: "{{$.Release.Namespace}}"
6+
spec:
7+
ports:
8+
- name: https
9+
port: {{ .Values.service.port }}
10+
protocol: TCP
11+
targetPort: 443
12+
selector:
13+
app.kubernetes.io/name: {{ include "itsfriday.name" . }}
14+
app.kubernetes.io/instance: {{ .Chart.Name }}

‎itsfriday/templates/serviceaccount.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: {{ .Chart.Name }}-serviceaccount
5+
namespace: {{ .Release.Namespace }}
6+
labels:
7+
app.kubernetes.io/name: {{ include "itsfriday.name" . }}
8+
app.kubernetes.io/instance: {{ .Chart.Name }}

‎itsfriday/values.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
failurePolicy: "Fail"
2+
onlyMarkedNamespaces: # Only namespaces with itsfriday/webhookenabled label set to validate would be checked
3+
enabled: false
4+
mode: "validate" # validate or ignore
5+
# if validate - only namespaces with itsfriday/webhookenabled=validate would be checked
6+
# if ingnore - only namespaces with itsfriday/webhookenabled=ignore would be ignored
7+
replicasCount: 3
8+
images:
9+
itsfriday: razikus/its-friday-k8s-admission-controller:1.0.0
10+
service:
11+
port: 443

‎source/Dockerfile‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
FROM python:3.11
2+
COPY requirements.txt /requirements.txt
3+
RUN pip3 install -r /requirements.txt
4+
RUN mkdir /certs
5+
COPY app /app/app
6+
7+
WORKDIR /app
8+
9+
ENTRYPOINT ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--ssl-keyfile", "/app/certs/tls.key", "--ssl-certfile", "/app/certs/tls.crt", "--port", "443"]

0 commit comments

Comments
 (0)