Skip to content

Commit 456318e

Browse files
filariowfilariow
committed
use helm in chainsaw overlay
Signed-off-by: Francesco Ilario <[email protected]>
1 parent 760ba19 commit 456318e

File tree

7 files changed

+223
-13
lines changed

7 files changed

+223
-13
lines changed

‎.github/workflows/chainsaw-tests.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ jobs:
3737
- name: Install Dependencies
3838
shell: bash
3939
run: |
40-
kustomize build components/kyverno/chainsaw | \
40+
kustomize build --enable-helm components/kyverno/chainsaw | \
4141
kubectl apply -f - --server-side
4242
4343
- name: Install Cosign

‎components/kyverno/chainsaw/job_resources.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
- op: add
3+
path: /spec/template/spec/containers/0/resources
4+
value:
5+
requests:
6+
cpu: 100m
7+
memory: 64M
8+
limits:
9+
cpu: 400m
10+
memory: 256M

‎components/kyverno/chainsaw/kustomization.yaml

+90-11
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,96 @@
11
apiVersion: kustomize.config.k8s.io/v1beta1
22
kind: Kustomization
3+
34
namespace: konflux-kyverno
5+
46
resources:
5-
- https://github.com/kyverno/kyverno/raw/main/config/install-latest-testing.yaml
7+
- namespace.yaml
8+
9+
generators:
10+
- kyverno-helm-generator.yaml
11+
12+
replacements:
13+
# enforce serviceAccountName is used instead of serviceAccount in Jobs
14+
# TODO: these replacements can be removed when bumping to kyverno:1.14
15+
# https://github.com/kyverno/kyverno/pull/12158
16+
- source:
17+
group: batch
18+
version: v1
19+
kind: Job
20+
name: konflux-kyverno-clean-reports
21+
namespace: konflux-kyverno
22+
fieldPath: spec.template.spec.serviceAccount
23+
targets:
24+
- select:
25+
group: batch
26+
version: v1
27+
kind: Job
28+
namespace: konflux-kyverno
29+
name: konflux-kyverno-clean-reports
30+
fieldPaths:
31+
- spec.template.spec.serviceAccountName
32+
options:
33+
create: true
34+
- source:
35+
group: batch
36+
version: v1
37+
kind: Job
38+
name: konflux-kyverno-migrate-resources
39+
namespace: konflux-kyverno
40+
fieldPath: spec.template.spec.serviceAccount
41+
targets:
42+
- select:
43+
group: batch
44+
version: v1
45+
kind: Job
46+
namespace: konflux-kyverno
47+
name: konflux-kyverno-migrate-resources
48+
fieldPaths:
49+
- spec.template.spec.serviceAccountName
50+
options:
51+
create: true
52+
- source:
53+
group: batch
54+
version: v1
55+
kind: Job
56+
name: konflux-kyverno-remove-configmap
57+
namespace: konflux-kyverno
58+
fieldPath: spec.template.spec.serviceAccount
59+
targets:
60+
- select:
61+
group: batch
62+
version: v1
63+
kind: Job
64+
namespace: konflux-kyverno
65+
name: konflux-kyverno-remove-configmap
66+
fieldPaths:
67+
- spec.template.spec.serviceAccountName
68+
options:
69+
create: true
670

71+
# set resources to jobs
772
patches:
8-
- target:
9-
kind: Deployment
10-
name: kyverno-admission-controller
11-
patch: |-
12-
- op: add
13-
path: /spec/template/spec/containers/0/args/-
14-
value: --reportsServiceAccountName=system:serviceaccount:konflux-kyverno:kyverno-reports-controller
15-
- op: add
16-
path: /spec/template/spec/containers/0/args/-
17-
value: --backgroundServiceAccountName=system:serviceaccount:konflux-kyverno:kyverno-background-controller
73+
- path: job_resources.yaml
74+
target:
75+
group: batch
76+
version: v1
77+
kind: Job
78+
name: konflux-kyverno-scale-to-zero
79+
- path: job_resources.yaml
80+
target:
81+
group: batch
82+
version: v1
83+
kind: Job
84+
name: konflux-kyverno-clean-reports
85+
- path: job_resources.yaml
86+
target:
87+
group: batch
88+
version: v1
89+
kind: Job
90+
name: konflux-kyverno-migrate-resources
91+
- path: job_resources.yaml
92+
target:
93+
group: batch
94+
version: v1
95+
kind: Job
96+
name: konflux-kyverno-remove-configmap

‎components/kyverno/chainsaw/kyverno-helm-generator.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: builtin
2+
kind: HelmChartInflationGenerator
3+
metadata:
4+
name: kyverno
5+
name: kyverno
6+
repo: https://kyverno.github.io/kyverno/
7+
# TODO: when bumping to kyverno:1.14 we can remove ServiceAccountName
8+
# replacements from the kustomization.yaml file
9+
# https://github.com/kyverno/kyverno/pull/12158
10+
version: 3.3.7
11+
namespace: konflux-kyverno
12+
valuesFile: kyverno-helm-values.yaml
13+
releaseName: kyverno

‎components/kyverno/chainsaw/kyverno-helm-values.yaml

+104
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
---
2+
fullnameOverride: konflux-kyverno
3+
namespaceOverride: konflux-kyverno
4+
config:
5+
updateRequestThreshold: 1000
6+
admissionController:
7+
replicas: 1
8+
initContainer:
9+
securityContext:
10+
allowPrivilegeEscalation: false
11+
readOnlyRootFilesystem: true
12+
runAsNonRoot: true
13+
capabilities:
14+
drop:
15+
- "ALL"
16+
container:
17+
resources:
18+
limits:
19+
cpu: 500m
20+
securityContext:
21+
allowPrivilegeEscalation: false
22+
readOnlyRootFilesystem: true
23+
runAsNonRoot: true
24+
capabilities:
25+
drop:
26+
- "ALL"
27+
backgroundController:
28+
replicas: 1
29+
resources:
30+
limits:
31+
cpu: 500m
32+
securityContext:
33+
allowPrivilegeEscalation: false
34+
readOnlyRootFilesystem: true
35+
runAsNonRoot: true
36+
capabilities:
37+
drop:
38+
- "ALL"
39+
cleanupController:
40+
enabled: false
41+
resources:
42+
limits:
43+
cpu: 500m
44+
securityContext:
45+
allowPrivilegeEscalation: false
46+
readOnlyRootFilesystem: true
47+
runAsNonRoot: true
48+
capabilities:
49+
drop:
50+
- "ALL"
51+
reportsController:
52+
enabled: false
53+
resources:
54+
limits:
55+
cpu: 500m
56+
securityContext:
57+
allowPrivilegeEscalation: false
58+
readOnlyRootFilesystem: true
59+
runAsNonRoot: true
60+
capabilities:
61+
drop:
62+
- "ALL"
63+
policyReportsCleanup:
64+
securityContext:
65+
allowPrivilegeEscalation: false
66+
readOnlyRootFilesystem: true
67+
runAsNonRoot: true
68+
runAsGroup: null
69+
runAsUser: null
70+
capabilities:
71+
drop:
72+
- "ALL"
73+
webhooksCleanup:
74+
enabled: false
75+
securityContext:
76+
allowPrivilegeEscalation: false
77+
readOnlyRootFilesystem: true
78+
runAsNonRoot: true
79+
runAsGroup: null
80+
runAsUser: null
81+
capabilities:
82+
drop:
83+
- "ALL"
84+
test:
85+
securityContext:
86+
allowPrivilegeEscalation: false
87+
readOnlyRootFilesystem: true
88+
runAsNonRoot: true
89+
runAsGroup: null
90+
runAsUser: null
91+
capabilities:
92+
drop:
93+
- "ALL"
94+
crds:
95+
migration:
96+
securityContext:
97+
allowPrivilegeEscalation: false
98+
readOnlyRootFilesystem: true
99+
runAsNonRoot: true
100+
runAsGroup: null
101+
runAsUser: null
102+
capabilities:
103+
drop:
104+
- "ALL"

‎components/kyverno/chainsaw/namespace.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: konflux-kyverno

‎hack/chainsaw/chainsaw-prepare.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ set -e
66
kind create cluster --name infra-deployments-chainsaw
77

88
## Install kyverno
9-
kustomize build components/kyverno/chainsaw | \
9+
kustomize build --enable-helm components/kyverno/chainsaw | \
1010
kubectl apply -f - --server-side
1111

1212
## wait for kyverno to rollout

0 commit comments

Comments
 (0)