Skip to content

Commit 87a3d74

Browse files
oswcaboswcab
authored
KFLUXINFRA-2511 - Add Helm Charts based ESO deployment (#8994)
Add the Helm Charts based deployment of External Secrets Operator to one staging cluster, 'stone-stg-p01', as a first step to validate the migration does not produce any issue. The version deployed is the same as the OLM version deployed in other clusters (0.11.0) to minimize the possibility of introducing any regression. Pulling the ESO Helm Chart from a remote repository fails with this error: "Error when running kustomize build for components/external-secrets-operator/helm-charts: Error: failed to untar: a file or directory with the name /home/runner/work/infra-deployments/infra-deployments/components/external-secrets-operator/helm-charts/charts/external-secrets-0.11.0/external-secrets-0.11.0.tgz already exists"" After several unsuccesful workarounds and given the recommended way of handling the charts is by 'vendoring' them [1], the ESO Helm Charts are added to this commit. [1] https://github.com/kubernetes-sigs/kustomize/blob/master/examples/chart.md#best-practice
1 parent d936e48 commit 87a3d74

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

59 files changed

+21260
-4
lines changed

‎argo-cd-apps/base/all-clusters/infra-deployments/external-secrets-operator/external-secrets-operator.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ spec:
1313
values:
1414
sourceRoot: components/external-secrets-operator
1515
environment: staging
16-
clusterDir: ""
16+
clusterDir: "base"
1717
- list:
1818
elements:
1919
- nameNormalized: stone-stage-p01

‎components/external-secrets-operator/helm-charts/custom-resources.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# Custom resources that match the OLM deployment
2+
3+
---
4+
# Custom metrics Service (matching operator-config.yaml)
5+
apiVersion: v1
6+
kind: Service
7+
metadata:
8+
name: cluster-external-secrets-metrics
9+
namespace: external-secrets-operator
10+
annotations:
11+
ignore-check.kube-linter.io/dangling-service: "False positive"
12+
labels:
13+
app.kubernetes.io/name: external-secrets
14+
app.kubernetes.io/instance: cluster
15+
spec:
16+
type: ClusterIP
17+
ports:
18+
- name: metrics
19+
port: 8080
20+
targetPort: 8080
21+
protocol: TCP
22+
selector:
23+
app.kubernetes.io/name: external-secrets
24+
app.kubernetes.io/instance: cluster
25+
---
26+
# ServiceMonitor (matching operator-config.yaml)
27+
apiVersion: monitoring.coreos.com/v1
28+
kind: ServiceMonitor
29+
metadata:
30+
name: external-secrets-operator
31+
namespace: external-secrets-operator
32+
labels:
33+
app.kubernetes.io/name: external-secrets
34+
app.kubernetes.io/instance: cluster
35+
spec:
36+
endpoints:
37+
- port: metrics
38+
scheme: http
39+
selector:
40+
matchLabels:
41+
app.kubernetes.io/name: external-secrets
42+
app.kubernetes.io/instance: cluster

‎components/external-secrets-operator/helm-charts/external-secrets/Chart.lock‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
dependencies:
2+
- name: bitwarden-sdk-server
3+
repository: oci://ghcr.io/external-secrets/charts
4+
version: v0.3.1
5+
digest: sha256:2d01e9083fc32c18dca4f9614625e0172e338a663138c2670e5b911645b6b8ee
6+
generated: "2024-09-20T12:57:07.63511+02:00"

‎components/external-secrets-operator/helm-charts/external-secrets/Chart.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: v2
2+
appVersion: v0.11.0
3+
dependencies:
4+
- condition: bitwarden-sdk-server.enabled
5+
name: bitwarden-sdk-server
6+
repository: oci://ghcr.io/external-secrets/charts
7+
version: v0.3.1
8+
description: External secret management for Kubernetes
9+
home: https://github.com/external-secrets/external-secrets
10+
icon: https://raw.githubusercontent.com/external-secrets/external-secrets/main/assets/eso-logo-large.png
11+
keywords:
12+
- kubernetes-external-secrets
13+
- secrets
14+
kubeVersion: '>= 1.19.0-0'
15+
maintainers:
16+
- email: [email protected]
17+
name: mcavoyk
18+
name: external-secrets
19+
type: application
20+
version: 0.11.0

‎components/external-secrets-operator/helm-charts/external-secrets/README.md‎

Lines changed: 226 additions & 0 deletions
Large diffs are not rendered by default.

‎components/external-secrets-operator/helm-charts/external-secrets/charts/bitwarden-sdk-server/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎components/external-secrets-operator/helm-charts/external-secrets/charts/bitwarden-sdk-server/Chart.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: v2
2+
appVersion: v0.3.1
3+
description: A Helm chart for Kubernetes
4+
name: bitwarden-sdk-server
5+
type: application
6+
version: v0.3.1

‎components/external-secrets-operator/helm-charts/external-secrets/charts/bitwarden-sdk-server/templates/NOTES.txt‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
1. Get the application URL by running these commands:
2+
{{- if .Values.ingress.enabled }}
3+
{{- range $host := .Values.ingress.hosts }}
4+
{{- range .paths }}
5+
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
6+
{{- end }}
7+
{{- end }}
8+
{{- else if contains "NodePort" .Values.service.type }}
9+
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "bitwarden-sdk-server.fullname" . }})
10+
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
11+
echo http://$NODE_IP:$NODE_PORT
12+
{{- else if contains "LoadBalancer" .Values.service.type }}
13+
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
14+
You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "bitwarden-sdk-server.fullname" . }}'
15+
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "bitwarden-sdk-server.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
16+
echo http://$SERVICE_IP:{{ .Values.service.port }}
17+
{{- else if contains "ClusterIP" .Values.service.type }}
18+
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "bitwarden-sdk-server.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
19+
export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
20+
echo "Visit http://127.0.0.1:8080 to use your application"
21+
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
22+
{{- end }}

‎components/external-secrets-operator/helm-charts/external-secrets/charts/bitwarden-sdk-server/templates/_helpers.tpl‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "bitwarden-sdk-server.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "bitwarden-sdk-server.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "bitwarden-sdk-server.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "bitwarden-sdk-server.labels" -}}
37+
helm.sh/chart: {{ include "bitwarden-sdk-server.chart" . }}
38+
{{ include "bitwarden-sdk-server.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "bitwarden-sdk-server.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "bitwarden-sdk-server.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}
52+
53+
{{/*
54+
Create the name of the service account to use
55+
*/}}
56+
{{- define "bitwarden-sdk-server.serviceAccountName" -}}
57+
{{- if .Values.serviceAccount.create }}
58+
{{- default (include "bitwarden-sdk-server.fullname" .) .Values.serviceAccount.name }}
59+
{{- else }}
60+
{{- default "default" .Values.serviceAccount.name }}
61+
{{- end }}
62+
{{- end }}

‎components/external-secrets-operator/helm-charts/external-secrets/charts/bitwarden-sdk-server/templates/deployment.yaml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ include "bitwarden-sdk-server.fullname" . }}
5+
labels:
6+
{{- include "bitwarden-sdk-server.labels" . | nindent 4 }}
7+
spec:
8+
replicas: {{ .Values.replicaCount }}
9+
selector:
10+
matchLabels:
11+
{{- include "bitwarden-sdk-server.selectorLabels" . | nindent 6 }}
12+
template:
13+
metadata:
14+
{{- with .Values.podAnnotations }}
15+
annotations:
16+
{{- toYaml . | nindent 8 }}
17+
{{- end }}
18+
labels:
19+
{{- include "bitwarden-sdk-server.selectorLabels" . | nindent 8 }}
20+
spec:
21+
{{- with .Values.imagePullSecrets }}
22+
imagePullSecrets:
23+
{{- toYaml . | nindent 8 }}
24+
{{- end }}
25+
serviceAccountName: {{ include "bitwarden-sdk-server.serviceAccountName" . }}
26+
securityContext:
27+
{{- toYaml .Values.podSecurityContext | nindent 8 }}
28+
containers:
29+
- name: {{ .Chart.Name }}
30+
{{- if not .Values.image.tls.enabled }}
31+
args:
32+
- --insecure
33+
{{- end }}
34+
securityContext:
35+
{{- toYaml .Values.securityContext | nindent 12 }}
36+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
37+
imagePullPolicy: {{ .Values.image.pullPolicy }}
38+
{{- if .Values.image.tls.enabled }}
39+
volumeMounts:
40+
{{- toYaml .Values.image.tls.volumeMounts | nindent 10 }}
41+
{{- end}}
42+
ports:
43+
- name: http
44+
containerPort: {{ .Values.service.port }}
45+
protocol: TCP
46+
livenessProbe:
47+
httpGet:
48+
path: /live
49+
port: http
50+
{{- if .Values.image.tls.enabled }}
51+
scheme: HTTPS
52+
{{- end }}
53+
readinessProbe:
54+
httpGet:
55+
path: /ready
56+
port: http
57+
{{- if .Values.image.tls.enabled }}
58+
scheme: HTTPS
59+
{{- end }}
60+
resources:
61+
{{- toYaml .Values.resources | nindent 12 }}
62+
{{- with .Values.nodeSelector }}
63+
nodeSelector:
64+
{{- toYaml . | nindent 8 }}
65+
{{- end }}
66+
{{- with .Values.affinity }}
67+
affinity:
68+
{{- toYaml . | nindent 8 }}
69+
{{- end }}
70+
{{- with .Values.tolerations }}
71+
tolerations:
72+
{{- toYaml . | nindent 8 }}
73+
{{- end }}
74+
{{- if .Values.image.tls.enabled }}
75+
volumes:
76+
{{- toYaml .Values.image.tls.volumes | nindent 8 }}
77+
{{- end}}

0 commit comments

Comments
 (0)