Skip to content

Commit 2190d0f

Browse files
devopstalesdevopstales
committed
Merge branch 'main' of github.com:devopstales/helm-charts
2 parents 2811f6a + 14528ed commit 2190d0f

17 files changed

Lines changed: 565 additions & 1 deletion

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ This repository contains [Helm](https://helm.sh) charts for various projects
88
* [Trivy Scanner Operator](charts/trivy-scanner/) - :warning: Deprecated
99
* [Trivy Operator](charts/trivy-operator/)
1010
* [PushProx](charts/PushProx)
11+
* [Permission Manager](charts/permission-manager/)
1112

1213
## Usage
1314

‎charts/permission-manager/Chart.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: v2
2+
name: permission-manager
3+
description: A Helm chart for Kubernetes
4+
5+
# A chart can be either an 'application' or a 'library' chart.
6+
#
7+
# Application charts are a collection of templates that can be packaged into versioned archives
8+
# to be deployed.
9+
#
10+
# Library charts provide useful utilities or functions for the chart developer. They're included as
11+
# a dependency of application charts to inject those utilities and functions into the rendering
12+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
13+
type: application
14+
15+
# This is the chart version. This version number should be incremented each time you make changes
16+
# to the chart and its templates, including the app version.
17+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18+
version: 1.7.1-rc1
19+
20+
# This is the version number of the application being deployed. This version number should be
21+
# incremented each time you make changes to the application. Versions are not expected to
22+
# follow Semantic Versioning. They should reflect the version the application is using.
23+
appVersion: 1.7.1-rc1

‎charts/permission-manager/templates/ClusterRole.yaml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: {{ include "permission-manager.serviceAccountName" . }}
5+
labels:
6+
{{- include "permission-manager.labels" . | nindent 4 }}
7+
rules:
8+
# Allow full management of all the Permission Manager resources
9+
- apiGroups: [ "permissionmanager.user" ]
10+
resources:
11+
- "*"
12+
verbs: [ "get", "list", "create", "update", "delete", "watch" ]
13+
# Allow full management of the RBAC resources
14+
- apiGroups:
15+
- "rbac.authorization.k8s.io"
16+
resources:
17+
- "clusterrolebindings"
18+
- "clusterroles"
19+
- "rolebindings"
20+
- "roles"
21+
verbs: [ "get", "list", "create", "update", "delete", "bind", "watch" ]
22+
- apiGroups: [""]
23+
resources:
24+
- "serviceaccounts"
25+
- "secrets"
26+
verbs: [ "get", "list", "create", "update", "delete", "watch" ]
27+
# Allow full management of certificates CSR, including their approval
28+
- apiGroups: [ "certificates.k8s.io" ]
29+
resources:
30+
- "certificatesigningrequests"
31+
- "certificatesigningrequests/approval"
32+
verbs: [ "get", "list", "create", "update", "delete", "watch" ]
33+
# Support legacy versions, before signerName was added
34+
# (see https://github.com/kubernetes/kubernetes/pull/88246)
35+
- apiGroups: [ "certificates.k8s.io" ]
36+
resources:
37+
- "signers"
38+
resourceNames:
39+
- "kubernetes.io/legacy-unknown"
40+
- "kubernetes.io/kube-apiserver-client"
41+
verbs: [ "approve" ]
42+
# Allow to get and list Namespaces
43+
- apiGroups: [ "" ]
44+
resources:
45+
- "namespaces"
46+
verbs: [ "get", "list" ]
47+

‎charts/permission-manager/templates/ClusterRoleBinding.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
name: {{ include "permission-manager.serviceAccountName" . }}
5+
roleRef:
6+
kind: ClusterRole
7+
name: {{ include "permission-manager.serviceAccountName" . }}
8+
apiGroup: rbac.authorization.k8s.io
9+
subjects:
10+
- kind: ServiceAccount
11+
name: {{ include "permission-manager.serviceAccountName" . }}
12+
namespace: {{ .Release.Namespace }}

‎charts/permission-manager/templates/NOTES.txt‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
1. Get the application URL by running these commands:
2+
{{- if .Values.ingress.enabled }}
3+
{{- range $host := .Values.ingress.hosts }}
4+
{{- range .paths }}
5+
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ . }}
6+
{{- end }}
7+
{{- end }}
8+
{{- else if contains "NodePort" .Values.service.type }}
9+
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "permission-manager.fullname" . }})
10+
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
11+
echo http://$NODE_IP:$NODE_PORT
12+
{{- else if contains "LoadBalancer" .Values.service.type }}
13+
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
14+
You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "permission-manager.fullname" . }}'
15+
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "permission-manager.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
16+
echo http://$SERVICE_IP:{{ .Values.service.port }}
17+
{{- else if contains "ClusterIP" .Values.service.type }}
18+
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "permission-manager.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
19+
echo "Visit http://127.0.0.1:8080 to use your application"
20+
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:80
21+
{{- end }}

‎charts/permission-manager/templates/_helpers.tpl‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{{/* vim: set filetype=mustache: */}}
2+
{{/*
3+
Expand the name of the chart.
4+
*/}}
5+
{{- define "permission-manager.name" -}}
6+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
7+
{{- end }}
8+
9+
{{/*
10+
Create a default fully qualified app name.
11+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
12+
If release name contains chart name it will be used as a full name.
13+
*/}}
14+
{{- define "permission-manager.fullname" -}}
15+
{{- if .Values.fullnameOverride }}
16+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
17+
{{- else }}
18+
{{- $name := default .Chart.Name .Values.nameOverride }}
19+
{{- if contains $name .Release.Name }}
20+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
21+
{{- else }}
22+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
23+
{{- end }}
24+
{{- end }}
25+
{{- end }}
26+
27+
{{/*
28+
Create chart name and version as used by the chart label.
29+
*/}}
30+
{{- define "permission-manager.chart" -}}
31+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
32+
{{- end }}
33+
34+
{{/*
35+
Common labels
36+
*/}}
37+
{{- define "permission-manager.labels" -}}
38+
helm.sh/chart: {{ include "permission-manager.chart" . }}
39+
{{ include "permission-manager.selectorLabels" . }}
40+
{{- if .Chart.AppVersion }}
41+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
42+
{{- end }}
43+
app.kubernetes.io/managed-by: {{ .Release.Service }}
44+
{{- end }}
45+
46+
{{/*
47+
Selector labels
48+
*/}}
49+
{{- define "permission-manager.selectorLabels" -}}
50+
app.kubernetes.io/name: {{ include "permission-manager.name" . }}
51+
app.kubernetes.io/instance: {{ .Release.Name }}
52+
{{- end }}
53+
54+
{{/*
55+
Create the name of the service account to use
56+
*/}}
57+
{{- define "permission-manager.serviceAccountName" -}}
58+
{{- if .Values.serviceAccount.create }}
59+
{{- default (include "permission-manager.fullname" .) .Values.serviceAccount.name }}
60+
{{- else }}
61+
{{- default "default" .Values.serviceAccount.name }}
62+
{{- end }}
63+
{{- end }}

‎charts/permission-manager/templates/crd.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: "apiextensions.k8s.io/v1"
2+
kind: "CustomResourceDefinition"
3+
metadata:
4+
name: "permissionmanagerusers.permissionmanager.user"
5+
spec:
6+
group: "permissionmanager.user"
7+
versions:
8+
- name: "v1alpha1"
9+
served: true
10+
storage: true
11+
schema:
12+
openAPIV3Schema:
13+
type: object
14+
properties:
15+
spec:
16+
type: object
17+
properties:
18+
name:
19+
type: string
20+
minLength: 2
21+
scope: "Cluster"
22+
names:
23+
plural: "permissionmanagerusers"
24+
singular: "permissionmanageruser"
25+
kind: "Permissionmanageruser"

‎charts/permission-manager/templates/deployment.yaml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ include "permission-manager.fullname" . }}
5+
labels:
6+
{{- include "permission-manager.labels" . | nindent 4 }}
7+
spec:
8+
{{- if not .Values.autoscaling.enabled }}
9+
replicas: {{ .Values.replicaCount }}
10+
{{- end }}
11+
selector:
12+
matchLabels:
13+
{{- include "permission-manager.selectorLabels" . | nindent 6 }}
14+
template:
15+
metadata:
16+
{{- with .Values.podAnnotations }}
17+
annotations:
18+
{{- toYaml . | nindent 8 }}
19+
{{- end }}
20+
labels:
21+
{{- include "permission-manager.selectorLabels" . | nindent 8 }}
22+
spec:
23+
{{- with .Values.imagePullSecrets }}
24+
imagePullSecrets:
25+
{{- toYaml . | nindent 8 }}
26+
{{- end }}
27+
serviceAccountName: {{ include "permission-manager.serviceAccountName" . }}
28+
securityContext:
29+
{{- toYaml .Values.podSecurityContext | nindent 8 }}
30+
containers:
31+
- name: {{ .Chart.Name }}
32+
securityContext:
33+
{{- toYaml .Values.securityContext | nindent 12 }}
34+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
35+
imagePullPolicy: {{ .Values.image.pullPolicy }}
36+
envFrom:
37+
- secretRef:
38+
name: {{ include "permission-manager.fullname" . }}
39+
ports:
40+
- name: http
41+
containerPort: 4000
42+
protocol: TCP
43+
livenessProbe:
44+
tcpSocket:
45+
port: 4000
46+
readinessProbe:
47+
tcpSocket:
48+
port: 4000
49+
resources:
50+
{{- toYaml .Values.resources | nindent 12 }}
51+
{{- with .Values.nodeSelector }}
52+
nodeSelector:
53+
{{- toYaml . | nindent 8 }}
54+
{{- end }}
55+
{{- with .Values.affinity }}
56+
affinity:
57+
{{- toYaml . | nindent 8 }}
58+
{{- end }}
59+
{{- with .Values.tolerations }}
60+
tolerations:
61+
{{- toYaml . | nindent 8 }}
62+
{{- end }}

‎charts/permission-manager/templates/hpa.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
{{- if .Values.autoscaling.enabled }}
2+
apiVersion: autoscaling/v2beta1
3+
kind: HorizontalPodAutoscaler
4+
metadata:
5+
name: {{ include "permission-manager.fullname" . }}
6+
labels:
7+
{{- include "permission-manager.labels" . | nindent 4 }}
8+
spec:
9+
scaleTargetRef:
10+
apiVersion: apps/v1
11+
kind: Deployment
12+
name: {{ include "permission-manager.fullname" . }}
13+
minReplicas: {{ .Values.autoscaling.minReplicas }}
14+
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
15+
metrics:
16+
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
17+
- type: Resource
18+
resource:
19+
name: cpu
20+
targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
21+
{{- end }}
22+
{{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
23+
- type: Resource
24+
resource:
25+
name: memory
26+
targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
27+
{{- end }}
28+
{{- end }}

‎charts/permission-manager/templates/ingress.yaml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{{- if .Values.ingress.enabled -}}
2+
{{- $fullName := include "permission-manager.fullname" . -}}
3+
{{- $svcPort := .Values.service.port -}}
4+
{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
5+
apiVersion: networking.k8s.io/v1beta1
6+
{{- else -}}
7+
apiVersion: extensions/v1beta1
8+
{{- end }}
9+
kind: Ingress
10+
metadata:
11+
name: {{ $fullName }}
12+
labels:
13+
{{- include "permission-manager.labels" . | nindent 4 }}
14+
{{- with .Values.ingress.annotations }}
15+
annotations:
16+
{{- toYaml . | nindent 4 }}
17+
{{- end }}
18+
spec:
19+
{{- if .Values.ingress.tls }}
20+
tls:
21+
{{- range .Values.ingress.tls }}
22+
- hosts:
23+
{{- range .hosts }}
24+
- {{ . | quote }}
25+
{{- end }}
26+
secretName: {{ .secretName }}
27+
{{- end }}
28+
{{- end }}
29+
rules:
30+
{{- range .Values.ingress.hosts }}
31+
- host: {{ .host | quote }}
32+
http:
33+
paths:
34+
{{- range .paths }}
35+
- path: {{ . }}
36+
backend:
37+
serviceName: {{ $fullName }}
38+
servicePort: {{ $svcPort }}
39+
{{- end }}
40+
{{- end }}
41+
{{- end }}

0 commit comments

Comments
 (0)