Skip to content

Commit da9b882

Browse files
jorikvdwerfDouglas Camata
jorikvdwerf
and
Douglas Camata
authored
[charts/newrelic-metadata-injection] imported (#34)
* [charts/newrelic-metadata-injection] imported from nri-bundle * Delete OWNERS Co-authored-by: Douglas Camata <[email protected]>
1 parent e1ae3a0 commit da9b882

12 files changed

+413
-0
lines changed

‎charts/newrelic-mutation-webhook/Chart.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: v1
2+
description: A Helm chart to deploy the New Relic metadata injection webhook.
3+
name: nri-metadata-injection
4+
version: 1.0.0
5+
appVersion: 1.2.0
6+
home: https://hub.docker.com/r/newrelic/k8s-metadata-injection
7+
source:
8+
- https://github.com/newrelic/k8s-metadata-injection
9+
engine: gotpl
10+
icon: https://newrelic.com/assets/newrelic/source/NewRelic-logo-square.svg
11+
maintainers:
12+
- name: douglascamata
13+
- name: jorikvdwerf
14+
keywords:
15+
- infrastructure
16+
- newrelic
17+
- monitoring

‎charts/newrelic-mutation-webhook/README.md

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# newrelic-mutation-webhook
2+
3+
## Chart Details
4+
5+
This chart will deploy the [New Relic Infrastructure metadata injection webhook][1].
6+
7+
## Configuration
8+
9+
| Parameter | Description | Default |
10+
| ----------------------------- | ------------------------------------------------------------ | -------------------------- |
11+
| `cluster` | The cluster name for the Kubernetes cluster. | |
12+
| `injectOnlyLabeledNamespaces` | Limit the injection of metadata only to specific namespaces that match the label `newrelic-metadata-injection: enabled`. | false |
13+
| `image.repository` | The container to pull. | `newrelic/k8s-metadata-injection` |
14+
| `image.pullPolicy` | The pull policy. | `IfNotPresent` |
15+
| `image.tag` | The version of the container to pull. | `1.2.0` |
16+
| `imageJob.repository` | The job container to pull. | `newrelic/k8s-webhook-cert-manager` |
17+
| `imageJob.pullPolicy` | The job pull policy. | `IfNotPresent` |
18+
| `imageJob.tag` | The job version of the container to pull. | `1.2.1` |
19+
| `resources` | Any resources you wish to assign to the pod. | See Resources below |
20+
| `serviveAccount.create` | If true a service account would be created and assigned for the webhook and the job. | `true` |
21+
| `serviveAccount.name` | The service account to assign to the webhook and the job. If `serviveAccount.create` is true then this name will be used when creating the service account; if this value is not set or it evaluates to false, then when creating the account the returned value from the template `nr-metadata-injection.fullname` will be used as name. | |
22+
| `customTLSCertificate` | Use custom TLS certificate. Setting this options means that you will have to do some post install work as detailed in the *Manage custom certificates* section of the [official docs][1]. | `false` |
23+
| `nodeSelector` | Node label to use for scheduling | `{}` |
24+
| `tolerations` | List of node taints to tolerate (requires Kubernetes >= 1.6) | `[]` |
25+
| `affinity` | Node affinity to use for scheduling | `{}` |
26+
27+
## Example
28+
29+
Make sure you have [added the New Relic chart repository.](../../README.md#installing-charts)
30+
31+
Then, to install this chart, run the following command:
32+
33+
```sh
34+
helm install newrelic/newrelic-mutation-webhook --set cluster=my_cluster_name
35+
```
36+
37+
## Resources
38+
39+
The default set of resources assigned to the pods is shown below:
40+
41+
resources:
42+
limits:
43+
memory: 80M
44+
requests:
45+
cpu: 100m
46+
memory: 30M
47+
48+
[1]: https://docs.newrelic.com/docs/integrations/kubernetes-integration/link-your-applications/link-your-applications-kubernetes#configure-injection

‎charts/newrelic-mutation-webhook/templates/NOTES.txt

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{{- if (include "nri-metadata-injection.cluster" .) }}
2+
Your deployment of the New Relic metadata injection webhook is complete. You can check on the progress of this by running the following command:
3+
4+
kubectl get deployments -o wide -w --namespace {{ .Release.Namespace }} {{ template "nri-metadata-injection.fullname" . }}
5+
6+
{{- if .Values.customTLSCertificate }}
7+
You have configure the chart to use a custom tls certificate, make sure to read the 'Manage custom certificates' section of the official docs to find the instructions on how to finish setting up the webhook.
8+
9+
https://docs.newrelic.com/docs/integrations/kubernetes-integration/link-your-applications/link-your-applications-kubernetes#configure-injection
10+
{{- end }}
11+
12+
To validate the injection of metadata create a dummy pod containing Busybox by running:
13+
14+
kubectl create -f https://git.io/vPieo
15+
16+
Check if New Relic environment variables were injected:
17+
18+
kubectl exec busybox0 -- env | grep NEW_RELIC_METADATA_KUBERNETES
19+
20+
NEW_RELIC_METADATA_KUBERNETES_CLUSTER_NAME=fsi
21+
NEW_RELIC_METADATA_KUBERNETES_NODE_NAME=nodea
22+
NEW_RELIC_METADATA_KUBERNETES_NAMESPACE_NAME=default
23+
NEW_RELIC_METADATA_KUBERNETES_POD_NAME=busybox0
24+
NEW_RELIC_METADATA_KUBERNETES_CONTAINER_NAME=busybox
25+
26+
{{- else -}}
27+
###############################################################
28+
#### ERROR: You did not set a cluster name. ####
29+
###############################################################
30+
31+
This deployment will be incomplete until you set a cluster name.
32+
33+
Run:
34+
35+
helm upgrade {{ .Release.Name }} \
36+
--set cluster=YOUR-CLUSTER-NAME \
37+
newrelic/nri-metadata-injection
38+
39+
{{- end -}}

‎charts/newrelic-mutation-webhook/templates/_helpers.tpl

+78
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
{{/* vim: set filetype=mustache: */}}
2+
{{/*
3+
Expand the name of the chart.
4+
*/}}
5+
{{- define "nri-metadata-injection.name" -}}
6+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
7+
{{- end -}}
8+
9+
{{/*
10+
Create a default fully qualified app name.
11+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
12+
If release name contains chart name it will be used as a full name.
13+
*/}}
14+
{{- define "nri-metadata-injection.fullname" -}}
15+
{{- if .Values.fullnameOverride -}}
16+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
17+
{{- else -}}
18+
{{- $name := default .Chart.Name .Values.nameOverride -}}
19+
{{- if contains $name .Release.Name -}}
20+
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
21+
{{- else -}}
22+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
23+
{{- end -}}
24+
{{- end -}}
25+
{{- end -}}
26+
27+
{{/*
28+
Create chart name and version as used by the chart label.
29+
*/}}
30+
{{- define "nri-metadata-injection.chart" -}}
31+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
32+
{{- end -}}
33+
34+
{{/*
35+
Common app label
36+
*/}}
37+
{{- define "nri-metadata-injection.appLabel" -}}
38+
app.kubernetes.io/name: {{ include "nri-metadata-injection.name" . }}
39+
{{- end -}}
40+
41+
{{/*
42+
Common labels
43+
*/}}
44+
{{- define "nri-metadata-injection.labels" -}}
45+
{{ include "nri-metadata-injection.appLabel" . }}
46+
helm.sh/chart: {{ include "nri-metadata-injection.chart" . }}
47+
app.kubernetes.io/instance: {{ .Release.Name }}
48+
{{- if .Chart.AppVersion }}
49+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
50+
{{- end }}
51+
app.kubernetes.io/managed-by: {{ .Release.Service }}
52+
{{- end -}}
53+
54+
{{/*
55+
Create the name of the service account to use
56+
*/}}
57+
{{- define "nri-metadata-injection.serviceAccountName" -}}
58+
{{- if .Values.serviceAccount.create -}}
59+
{{ default (include "nri-metadata-injection.fullname" .) .Values.serviceAccount.name }}
60+
{{- else -}}
61+
{{ default "default" .Values.serviceAccount.name }}
62+
{{- end -}}
63+
{{- end -}}
64+
65+
{{/*
66+
Return the cluster
67+
*/}}
68+
{{- define "nri-metadata-injection.cluster" -}}
69+
{{- if .Values.global -}}
70+
{{- if .Values.global.cluster -}}
71+
{{- .Values.global.cluster -}}
72+
{{- else -}}
73+
{{- .Values.cluster | default "" -}}
74+
{{- end -}}
75+
{{- else -}}
76+
{{- .Values.cluster | default "" -}}
77+
{{- end -}}
78+
{{- end -}}

‎charts/newrelic-mutation-webhook/templates/clusterrole.yaml

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{{- if not .Values.customTLSCertificate }}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: {{ template "nri-metadata-injection.fullname" . }}
6+
labels:
7+
{{- include "nri-metadata-injection.labels" . | nindent 4 }}
8+
rules:
9+
- apiGroups: ["admissionregistration.k8s.io"]
10+
resources: ["mutatingwebhookconfigurations"]
11+
verbs: ["get", "create", "patch"]
12+
- apiGroups: ["certificates.k8s.io"]
13+
resources: ["certificatesigningrequests"]
14+
verbs: ["create", "get", "delete"]
15+
- apiGroups: ["certificates.k8s.io"]
16+
resources: ["certificatesigningrequests/approval"]
17+
verbs: ["update"]
18+
- apiGroups: [""]
19+
resources: ["secrets"]
20+
verbs: ["create", "get", "patch"]
21+
- apiGroups: [""]
22+
resources: ["configmaps"]
23+
verbs: ["get"]
24+
- apiGroups: ["certificates.k8s.io"]
25+
resources:
26+
- "signers"
27+
resourceNames:
28+
- "kubernetes.io/legacy-unknown"
29+
verbs: ["approve"]
30+
{{- end }}

‎charts/newrelic-mutation-webhook/templates/clusterrolebinding.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{{- if not .Values.customTLSCertificate }}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRoleBinding
4+
metadata:
5+
name: {{ template "nri-metadata-injection.fullname" . }}
6+
labels:
7+
{{- include "nri-metadata-injection.labels" . | nindent 4 }}
8+
roleRef:
9+
apiGroup: rbac.authorization.k8s.io
10+
kind: ClusterRole
11+
name: {{ template "nri-metadata-injection.fullname" . }}
12+
subjects:
13+
- kind: ServiceAccount
14+
name: {{ template "nri-metadata-injection.serviceAccountName" . }}
15+
namespace: {{ .Release.Namespace }}
16+
{{- end }}

‎charts/newrelic-mutation-webhook/templates/deployment.yaml

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{{- if (include "nri-metadata-injection.cluster" .) }}
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
name: {{ template "nri-metadata-injection.fullname" . }}
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
{{- include "nri-metadata-injection.labels" . | nindent 4 }}
9+
spec:
10+
replicas: 1
11+
selector:
12+
matchLabels:
13+
{{- include "nri-metadata-injection.appLabel" . | nindent 6 }}
14+
template:
15+
metadata:
16+
labels:
17+
{{- include "nri-metadata-injection.labels" . | nindent 8 }}
18+
spec:
19+
{{- if not .Values.customTLSCertificate }}
20+
serviceAccountName: {{ template "nri-metadata-injection.serviceAccountName" . }}
21+
{{- end }}
22+
containers:
23+
- name: {{ template "nri-metadata-injection.name" . }}
24+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
25+
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
26+
env:
27+
- name: clusterName
28+
value: {{ include "nri-metadata-injection.cluster" . }}
29+
volumeMounts:
30+
- name: tls-key-cert-pair
31+
mountPath: /etc/tls-key-cert-pair
32+
readinessProbe:
33+
httpGet:
34+
path: /health
35+
port: 8080
36+
initialDelaySeconds: 1
37+
periodSeconds: 1
38+
{{- if .Values.resources }}
39+
resources:
40+
{{ toYaml .Values.resources | indent 10 }}
41+
{{- end }}
42+
volumes:
43+
- name: tls-key-cert-pair
44+
secret:
45+
secretName: {{ template "nri-metadata-injection.fullname" . }}
46+
{{- if $.Values.nodeSelector }}
47+
nodeSelector:
48+
{{ toYaml $.Values.nodeSelector | indent 8 }}
49+
{{- end }}
50+
{{- if .Values.tolerations }}
51+
tolerations:
52+
{{ toYaml .Values.tolerations | indent 8 }}
53+
{{- end }}
54+
{{- if .Values.affinity }}
55+
affinity:
56+
{{ toYaml .Values.affinity | indent 8 }}
57+
{{- end }}
58+
{{- end }}

‎charts/newrelic-mutation-webhook/templates/job.yaml

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{{- if not .Values.customTLSCertificate }}
2+
apiVersion: batch/v1
3+
kind: Job
4+
metadata:
5+
name: {{ template "nri-metadata-injection.fullname" . }}-job
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
{{- include "nri-metadata-injection.labels" . | nindent 4 }}
9+
spec:
10+
template:
11+
metadata:
12+
labels:
13+
{{- include "nri-metadata-injection.labels" . | nindent 8 }}
14+
spec:
15+
serviceAccountName: {{ template "nri-metadata-injection.serviceAccountName" . }}
16+
containers:
17+
- name: {{ template "nri-metadata-injection.name" . }}-job
18+
# This is a minimal kubectl image based on Alpine Linux that sings certificates using the k8s extension api server
19+
image: "{{ .Values.jobImage.repository }}:{{ .Values.jobImage.tag }}"
20+
imagePullPolicy: "{{ .Values.jobImage.pullPolicy }}"
21+
command: ["./generate_certificate.sh"]
22+
args:
23+
- "--service"
24+
- {{ template "nri-metadata-injection.fullname" . }}
25+
- "--webhook"
26+
- {{ template "nri-metadata-injection.fullname" . }}
27+
- "--secret"
28+
- {{ template "nri-metadata-injection.fullname" . }}
29+
- "--namespace"
30+
- {{ .Release.Namespace }}
31+
restartPolicy: Never
32+
backoffLimit: 1
33+
{{- end }}

‎charts/newrelic-mutation-webhook/templates/mutationwebhookconfiguration.yaml

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: admissionregistration.k8s.io/v1beta1
2+
kind: MutatingWebhookConfiguration
3+
metadata:
4+
name: {{ template "nri-metadata-injection.fullname" . }}
5+
labels:
6+
{{- include "nri-metadata-injection.labels" . | nindent 4 }}
7+
webhooks:
8+
- name: metadata-injection.newrelic.com
9+
clientConfig:
10+
service:
11+
name: {{ template "nri-metadata-injection.fullname" . }}
12+
namespace: {{ .Release.Namespace }}
13+
path: "/mutate"
14+
caBundle: ""
15+
rules:
16+
- operations: [ "CREATE" ]
17+
apiGroups: [""]
18+
apiVersions: ["v1"]
19+
resources: ["pods"]
20+
{{- if .Values.injectOnlyLabeledNamespaces }}
21+
namespaceSelector:
22+
matchLabels:
23+
newrelic-metadata-injection: enabled
24+
{{- end }}
25+
failurePolicy: Ignore

‎charts/newrelic-mutation-webhook/templates/service.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: {{ template "nri-metadata-injection.fullname" . }}
5+
namespace: {{ .Release.Namespace }}
6+
labels:
7+
{{- include "nri-metadata-injection.labels" . | nindent 4 }}
8+
spec:
9+
ports:
10+
- port: 443
11+
targetPort: 8443
12+
selector:
13+
{{- include "nri-metadata-injection.appLabel" . | nindent 4 }}

‎charts/newrelic-mutation-webhook/templates/serviceaccount.yaml

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{{- if (and .Values.serviceAccount.create (not .Values.customTLSCertificate)) }}
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: {{ template "nri-metadata-injection.serviceAccountName" . }}
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
{{- include "nri-metadata-injection.labels" . | nindent 4 }}
9+
{{- end -}}

0 commit comments

Comments
 (0)