Skip to content

Commit f46f534

Browse files
kreeuwijkkreeuwijk
authored
VMO Namespace Management 1.0.3 (#145)
1 parent 6262cdb commit f46f534

File tree

13 files changed

+431
-0
lines changed

13 files changed

+431
-0
lines changed

‎packs/vmo-ns-mgmt-1.0.3/README.md‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# VMO Namespace Management
2+
3+
## Overview
4+
The VMO Namespace Management pack enables centralized administration of VMO namespaces, including quotas and RBAC permissions.
5+
6+
With this pack you can centrally manage the namespaces used for running virtual machines on all your VMO clusters:
7+
* Define a list of namespaces that should be able to run VMs and deploy VMs from golden images
8+
* Set quotas for CPU, Memory, Storage and custom resources on namespaces
9+
* Set VMO-specific or custom RBAC permissions on namespaces
10+
* Filter quotas or RBAC permissions to only apply to specific Palette clusters
11+
12+
## Kubernetes compatibility
13+
Kubernetes versions supported by VMO (1.28+).
14+
15+
## CloudTypes supported:
16+
Supported on all cloud types, but only relevant to cloud types supported by VMO.
17+
18+
## Parameters
19+
20+
The table lists commonly used parameters you can configure when adding this pack.
21+
22+
| Parameter | Description | Required | Default |
23+
|-----------------------------|-------------|----------|---------|
24+
| `goldenImagesNamespace` | Namespace that contains your VMO golden images. Should match the setting by the same name in the VMO pack. | Yes | `vmo-golden-images` |
25+
| `vmEnabledNamespaces` | A list of namespaces that you want to enable for VMO. If the namespace does not exist, it will be created. If you remove a namespace from the list, it will not be removed from the cluster; you will need to manually clean it up when necessary. | Yes | |
26+
| `quotas` | A list of quota definitions that limit the amount of resources that can be consumed in a each namespace. | Yes | Empty list |
27+
| `quotas.[].namespace` | The name of the namespace to define the quota for. | Yes | |
28+
| `quotas.[].clusters` | A list of clusters that the quota should apply to. | No | |
29+
| `quotas.[].limits` | The resource limits quota you want to apply. We recommend using this to set CPU quota: ensure to leave some headroom for CPU overhead (15 millicore per VM) and live migration (at least twice the CPU of the biggest VM). | No | |
30+
| `quotas.[].requests` | The resource requests quota you want to apply. We recommend using this to set Memory and Storage quota: ensure to leave some headroom for overhead (~315MB per VM) and live migration (at least twice the memory of the biggest VM). | No | |
31+
| `rbac` | A list of RBAC definitions that control what users can do in each namespace. | Yes | Empty list |
32+
| `rbac.[].namespace` | The name of the namespace to define the RBAC permissions for. | Yes | |
33+
| `rbac.[].clusters` | A list of clusters that the RBAC permissions should apply to. | No | |
34+
| `rbac.[].admins` | Define this block if you want to give users/teams the `spectro-vm-admin` permission for the namespace. | No | |
35+
| `rbac.[].admins.groups` | A list of Palette Teams (case sensitive!) that should receive the `spectro-vm-admin` permission for the namespace. | No | |
36+
| `rbac.[].admins.users` | A list of Palette Users, by email address (case sensitive!), that should receive the `spectro-vm-admin` permission for the namespace. | No | |
37+
| `rbac.[].powerusers` | Define this block if you want to give users/teams the `spectro-vm-poweruser` permission for the namespace. | No | |
38+
| `rbac.[].powerusers.groups` | A list of Palette Teams (case sensitive!) that should receive the `spectro-vm-poweruser` permission for the namespace. | No | |
39+
| `rbac.[].powerusers.users` | A list of Palette Users, by email address (case sensitive!), that should receive the `spectro-vm-poweruser` permission for the namespace. | No | |
40+
| `rbac.[].users` | Define this block if you want to give users/teams the `spectro-vm-user` permission for the namespace. | No | |
41+
| `rbac.[].users.groups` | A list of Palette Teams (case sensitive!) that should receive the `spectro-vm-user` permission for the namespace. | No | |
42+
| `rbac.[].users.users` | A list of Palette Users, by email address (case sensitive!), that should receive the `spectro-vm-user` permission for the namespace. | No | |
43+
| `rbac.[].viewers` | Define this block if you want to give users/teams the `spectro-vm-viewer` permission for the namespace. | No | |
44+
| `rbac.[].viewers.groups` | A list of Palette Teams (case sensitive!) that should receive the `spectro-vm-viewer` permission for the namespace. | No | |
45+
| `rbac.[].viewers.users` | A list of Palette Users, by email address (case sensitive!), that should receive the `spectro-vm-viewer` permission for the namespace. | No | |
46+
| `rbac.[].custom` | Define this list if you want to give users/teams a custom permission (of type ClusterRole) for the namespace. | No | |
47+
| `rbac.[].custom.[].role` | The name of the custom ClusterRole that want assign to users/teams for the namespace. | No | |
48+
| `rbac.[].custom.[].groups` | A list of Palette Teams (case sensitive!) that should receive the custom ClusterRole for the namespace. | No | |
49+
| `rbac.[].custom.[].users` | A list of Palette Users, by email address (case sensitive!), that should receive the custom ClusterRole for the namespace. | No | |
50+
51+
52+
## Presets
53+
None
54+
55+
56+
## References:
57+
* [VMO Roles and Permissions](https://docs.spectrocloud.com/vm-management/rbac/vm-roles-permissions/)

‎packs/vmo-ns-mgmt-1.0.3/charts/vmo-ns-mgmt-1.0.3.tgz‎

1.7 KB
Binary file not shown.

‎packs/vmo-ns-mgmt-1.0.3/charts/vmo-ns-mgmt/.helmignore‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.github/
8+
.gitignore
9+
.bzr/
10+
.bzrignore
11+
.hg/
12+
.hgignore
13+
.svn/
14+
# Common backup files
15+
*.swp
16+
*.bak
17+
*.tmp
18+
*.orig
19+
*~
20+
# Various IDEs
21+
.project
22+
.idea/
23+
*.tmproj
24+
.vscode/

‎packs/vmo-ns-mgmt-1.0.3/charts/vmo-ns-mgmt/Chart.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v2
2+
name: vmo-ns-mgmt
3+
version: 1.0.3
4+
appVersion: 1.0.3

‎packs/vmo-ns-mgmt-1.0.3/charts/vmo-ns-mgmt/templates/gi-rolebinding.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: RoleBinding
3+
metadata:
4+
name: vmo-rolebinding-golden-images
5+
namespace: {{ .Values.goldenImagesNamespace | quote }}
6+
roleRef:
7+
apiGroup: rbac.authorization.k8s.io
8+
kind: Role
9+
name: vmo-role-golden-images
10+
subjects:
11+
{{- range .Values.vmEnabledNamespaces }}
12+
- kind: ServiceAccount
13+
name: default
14+
namespace: {{ . | quote }}
15+
{{- end }}

‎packs/vmo-ns-mgmt-1.0.3/charts/vmo-ns-mgmt/templates/namespace.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{{- range (without .Values.vmEnabledNamespaces list "default" "virtual-machines" .Values.goldenImagesNamespace) }}
2+
apiVersion: v1
3+
kind: Namespace
4+
metadata:
5+
name: {{ . | quote }}
6+
annotations:
7+
"helm.sh/resource-policy": "keep"
8+
---
9+
{{- end }}

‎packs/vmo-ns-mgmt-1.0.3/charts/vmo-ns-mgmt/templates/resourcequota.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{{ range $index, $cluster := (lookup "cluster.spectrocloud.com/v1alpha1" "SpectroCluster" "" "").items }}
2+
{{- range $quota := $.Values.quotas }}
3+
{{- if or (has $cluster.metadata.name $quota.clusters) (not (hasKey $quota "clusters")) }}
4+
apiVersion: v1
5+
kind: ResourceQuota
6+
metadata:
7+
name: vmo-quota
8+
namespace: {{ $quota.namespace }}
9+
spec:
10+
hard:
11+
{{- if $quota.limits -}}
12+
{{- range $key, $value := $quota.limits }}
13+
limits.{{ $key }}: {{ $value | quote }}
14+
{{- end }}
15+
{{- end }}
16+
{{- if $quota.requests -}}
17+
{{- range $key, $value := $quota.requests }}
18+
requests.{{ $key }}: {{ $value | quote }}
19+
{{- end }}
20+
{{- end }}
21+
---
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}

‎packs/vmo-ns-mgmt-1.0.3/charts/vmo-ns-mgmt/templates/role.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: Role
3+
metadata:
4+
name: vmo-role-golden-images
5+
namespace: {{ .Values.goldenImagesNamespace | quote }}
6+
rules:
7+
- apiGroups: ["cdi.kubevirt.io"]
8+
resources: ["datavolumes/source"]
9+
verbs: ["create"]

‎packs/vmo-ns-mgmt-1.0.3/charts/vmo-ns-mgmt/templates/rolebinding.yaml‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
{{ range $index, $cluster := (lookup "cluster.spectrocloud.com/v1alpha1" "SpectroCluster" "" "").items }}
2+
{{- range $rbac := $.Values.rbac -}}
3+
{{- if or (has $cluster.metadata.name $rbac.clusters) (not (hasKey $rbac "clusters")) }}
4+
{{- if $rbac.admins }}
5+
apiVersion: rbac.authorization.k8s.io/v1
6+
kind: RoleBinding
7+
metadata:
8+
name: vmo-rolebinding-admins
9+
namespace: {{ $rbac.namespace }}
10+
roleRef:
11+
apiGroup: rbac.authorization.k8s.io
12+
kind: ClusterRole
13+
name: spectro-vm-admin
14+
subjects:
15+
{{- range $group := $rbac.admins.groups }}
16+
- apiGroup: rbac.authorization.k8s.io
17+
kind: Group
18+
name: {{ $group | quote }}
19+
{{- end }}
20+
{{- range $user := $rbac.admins.users }}
21+
- apiGroup: rbac.authorization.k8s.io
22+
kind: User
23+
name: {{ $user | quote }}
24+
{{- end }}
25+
{{- end }}
26+
---
27+
{{- if $rbac.powerusers }}
28+
apiVersion: rbac.authorization.k8s.io/v1
29+
kind: RoleBinding
30+
metadata:
31+
name: vmo-rolebinding-powerusers
32+
namespace: {{ $rbac.namespace }}
33+
roleRef:
34+
apiGroup: rbac.authorization.k8s.io
35+
kind: ClusterRole
36+
name: spectro-vm-power-user
37+
subjects:
38+
{{- range $group := $rbac.powerusers.groups }}
39+
- apiGroup: rbac.authorization.k8s.io
40+
kind: Group
41+
name: {{ $group | quote }}
42+
{{- end }}
43+
{{- range $user := $rbac.powerusers.users }}
44+
- apiGroup: rbac.authorization.k8s.io
45+
kind: User
46+
name: {{ $user | quote }}
47+
{{- end }}
48+
{{- end }}
49+
---
50+
{{- if $rbac.users }}
51+
apiVersion: rbac.authorization.k8s.io/v1
52+
kind: RoleBinding
53+
metadata:
54+
name: vmo-rolebinding-users
55+
namespace: {{ $rbac.namespace }}
56+
roleRef:
57+
apiGroup: rbac.authorization.k8s.io
58+
kind: ClusterRole
59+
name: spectro-vm-user
60+
subjects:
61+
{{- range $group := $rbac.users.groups }}
62+
- apiGroup: rbac.authorization.k8s.io
63+
kind: Group
64+
name: {{ $group | quote }}
65+
{{- end }}
66+
{{- range $user := $rbac.users.users }}
67+
- apiGroup: rbac.authorization.k8s.io
68+
kind: User
69+
name: {{ $user | quote }}
70+
{{- end }}
71+
{{- end }}
72+
---
73+
{{- if $rbac.viewers }}
74+
apiVersion: rbac.authorization.k8s.io/v1
75+
kind: RoleBinding
76+
metadata:
77+
name: vmo-rolebinding-viewers
78+
namespace: {{ $rbac.namespace }}
79+
roleRef:
80+
apiGroup: rbac.authorization.k8s.io
81+
kind: ClusterRole
82+
name: spectro-vm-viewer
83+
subjects:
84+
{{- range $group := $rbac.viewers.groups }}
85+
- apiGroup: rbac.authorization.k8s.io
86+
kind: Group
87+
name: {{ $group | quote }}
88+
{{- end }}
89+
{{- range $user := $rbac.viewers.users }}
90+
- apiGroup: rbac.authorization.k8s.io
91+
kind: User
92+
name: {{ $user | quote }}
93+
{{- end }}
94+
{{- end }}
95+
---
96+
{{- if $rbac.custom }}
97+
{{- range $custom := $rbac.custom }}
98+
apiVersion: rbac.authorization.k8s.io/v1
99+
kind: RoleBinding
100+
metadata:
101+
name: vmo-rolebinding-custom-{{ $custom.role }}
102+
namespace: {{ $rbac.namespace }}
103+
roleRef:
104+
apiGroup: rbac.authorization.k8s.io
105+
kind: ClusterRole
106+
name: {{ $custom.role | quote }}
107+
subjects:
108+
{{- range $group := $custom.groups }}
109+
- apiGroup: rbac.authorization.k8s.io
110+
kind: Group
111+
name: {{ $group | quote }}
112+
{{- end }}
113+
{{- range $user := $custom.users }}
114+
- apiGroup: rbac.authorization.k8s.io
115+
kind: User
116+
name: {{ $user | quote }}
117+
{{- end }}
118+
{{- end }}
119+
{{- end }}
120+
{{- end }}
121+
{{- end }}
122+
---
123+
{{- end }}

‎packs/vmo-ns-mgmt-1.0.3/charts/vmo-ns-mgmt/values_lint.yaml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
goldenImagesNamespace: vmo-golden-images
2+
vmEnabledNamespaces:
3+
- default
4+
- virtual-machines
5+
- customer-vm-1
6+
- customer-vm-2
7+
- customer-vm-3
8+
9+
quotas:
10+
- namespace: customer-vm-1
11+
clusters:
12+
- demo-cluster1
13+
- demo-cluster2
14+
limits:
15+
cpu: 9
16+
requests:
17+
memory: 33Gi
18+
storage: 120Gi
19+
- namespace: customer-vm-2
20+
clusters:
21+
- demo-cluster1
22+
limits:
23+
cpu: 40
24+
requests:
25+
memory: 150Gi
26+
storage: 1024Gi
27+
- namespace: customer-vm-3
28+
limits:
29+
cpu: 100
30+
requests:
31+
memory: 250Gi
32+
storage: 2Ti
33+
34+
rbac:
35+
- namespace: default
36+
viewers:
37+
groups:
38+
- Viewers Group 1
39+
- Viewers Group 2
40+
- namespace: customer-vm-1
41+
clusters:
42+
- demo-cluster1
43+
- demo-cluster2
44+
admins:
45+
users:
46+
- [email protected]
47+
- [email protected]
48+
groups:
49+
- Test Group 1
50+
- Test Group 2
51+
powerusers:
52+
users: []
53+
groups: []
54+
users:
55+
users: []
56+
groups: []
57+
viewers:
58+
users: []
59+
groups: []
60+
custom:
61+
- role: admin
62+
groups:
63+
- Custom Group 1
64+
- Custom Group 2
65+
users:
66+
- [email protected]
67+
- [email protected]
68+
- role: cluster-admin
69+
groups:
70+
- Custom Group 3
71+
- Custom Group 4
72+
users:
73+
- [email protected]
74+
- [email protected]

0 commit comments

Comments
 (0)