jhlim
/
nd002test
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

rnacher init

This commit is contained in:
root 2024-10-14 05:21:48 +00:00
parent 5bfbf1250e
commit c2201fb097
3390 changed files with 643997 additions and 52 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
on-premise/cicd/gitea/1_configure/5_secret.yaml
View File

@ -63,12 +63,12 @@ stringData:
security: INSTALL_LOCK=true
server: |-
APP_DATA_PATH=/data
DOMAIN=gitea.nativedeck.com
DOMAIN=gitea.inje-private.com
ENABLE_PPROF=false
HTTP_PORT=3000
PROTOCOL=http
ROOT_URL=http://gitea.nativedeck.com
SSH_DOMAIN=gitea.nativedeck.com
ROOT_URL=http://gitea.inje-private.com
SSH_DOMAIN=gitea.inje-private.com
SSH_LISTEN_PORT=2222
SSH_PORT=22
START_SSH_SERVER=true
@ -178,7 +178,7 @@ stringData:
local section="$(basename "${config_file}")"
if [[ $section == '_generals_' ]]; then
env2ini::log " [ini root]"
section=''
else
env2ini::log " ${section}"

3
on-premise/cicd/gitea/1_configure/6_pvc.yaml
View File

@ -8,6 +8,7 @@ spec:
accessModes:
- ReadWriteOnce
volumeMode: Filesystem
storageClassName: sc-monitoring
resources:
requests:
storage: 200Gi # default: 10Gi
storage: 50Gi # default: 10Gi

815
on-premise/cicd/gitea/3_apply/1 Normal file
View File

@ -0,0 +1,815 @@
# Source: gitea/charts/postgresql-ha/templates/pgpool/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: release-name-postgresql-ha-pgpool
namespace: gitea
labels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/version: 4.5.2
app.kubernetes.io/component: pgpool
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/component: pgpool
template:
metadata:
labels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/version: 4.5.2
app.kubernetes.io/component: pgpool
spec:
automountServiceAccountToken: false
affinity:
podAffinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- podAffinityTerm:
labelSelector:
matchLabels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/component: pgpool
topologyKey: kubernetes.io/hostname
weight: 1
nodeAffinity:
securityContext:
fsGroup: 1001
fsGroupChangePolicy: Always
supplementalGroups: []
sysctls: []
serviceAccountName: release-name-postgresql-ha
# Auxiliary vars to populate environment variables
containers:
- name: pgpool
image: reg.inje-private.com/bitnami/pgpool:4.5.2-debian-12-r2
imagePullPolicy: "IfNotPresent"
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
readOnlyRootFilesystem: true
runAsGroup: 1001
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
env:
- name: BITNAMI_DEBUG
value: "false"
- name: PGPOOL_BACKEND_NODES
value: 0:release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless:5432,1:release-name-postgresql-ha-postgresql-1.release-name-postgresql-ha-postgresql-headless:5432,2:release-name-postgresql-ha-postgresql-2.release-name-postgresql-ha-postgresql-headless:5432,
- name: PGPOOL_SR_CHECK_USER
value: "repmgr"
- name: PGPOOL_SR_CHECK_PASSWORD
valueFrom:
secretKeyRef:
name: release-name-postgresql-ha-postgresql
key: repmgr-password
- name: PGPOOL_SR_CHECK_DATABASE
value: "postgres"
- name: PGPOOL_ENABLE_LDAP
value: "no"
- name: PGPOOL_POSTGRES_USERNAME
value: "gitea"
- name: PGPOOL_POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: release-name-postgresql-ha-postgresql
key: password
- name: PGPOOL_ADMIN_USERNAME
value: "admin"
- name: PGPOOL_ADMIN_PASSWORD
valueFrom:
secretKeyRef:
name: release-name-postgresql-ha-pgpool
key: admin-password
- name: PGPOOL_AUTHENTICATION_METHOD
value: "scram-sha-256"
- name: PGPOOL_ENABLE_LOAD_BALANCING
value: "yes"
- name: PGPOOL_DISABLE_LOAD_BALANCE_ON_WRITE
value: "transaction"
- name: PGPOOL_ENABLE_LOG_CONNECTIONS
value: "no"
- name: PGPOOL_ENABLE_LOG_HOSTNAME
value: "yes"
- name: PGPOOL_ENABLE_LOG_PER_NODE_STATEMENT
value: "no"
- name: PGPOOL_RESERVED_CONNECTIONS
value: '1'
- name: PGPOOL_CHILD_LIFE_TIME
value: ""
- name: PGPOOL_ENABLE_TLS
value: "no"
- name: PGPOOL_HEALTH_CHECK_PSQL_TIMEOUT
value: "6"
envFrom:
ports:
- name: postgresql
containerPort: 5432
protocol: TCP
livenessProbe:
failureThreshold: 5
initialDelaySeconds: 30
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 5
exec:
command:
- /opt/bitnami/scripts/pgpool/healthcheck.sh
readinessProbe:
failureThreshold: 5
initialDelaySeconds: 5
periodSeconds: 5
successThreshold: 1
timeoutSeconds: 5
exec:
command:
- bash
- -ec
- PGPASSWORD=${PGPOOL_POSTGRES_PASSWORD} psql -U "gitea" -d "gitea" -h /opt/bitnami/pgpool/tmp -tA -c "SELECT 1" >/dev/null
resources:
limits:
cpu: 375m
ephemeral-storage: 2Gi
memory: 384Mi
requests:
cpu: 250m
ephemeral-storage: 50Mi
memory: 256Mi
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/pgpool/etc
subPath: app-etc-dir
- name: empty-dir
mountPath: /opt/bitnami/pgpool/conf
subPath: app-conf-dir
- name: empty-dir
mountPath: /opt/bitnami/pgpool/tmp
subPath: app-tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/pgpool/logs
subPath: app-logs-dir
volumes:
- name: empty-dir
emptyDir: {}
---
# Source: gitea/templates/gitea/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: release-name-gitea
namespace: gitea
annotations:
labels:
app: gitea
app.kubernetes.io/name: gitea
app.kubernetes.io/instance: release-name
app.kubernetes.io/version: "1.22.1"
version: "1.22.1"
spec:
replicas: 1
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 0
maxSurge: 100%
selector:
matchLabels:
app.kubernetes.io/name: gitea
app.kubernetes.io/instance: release-name
template:
metadata:
annotations:
checksum/config: 00fd8064076a446a896870db4974c6590fcf51561cf391547e559011465a57d8
labels:
app: gitea
app.kubernetes.io/name: gitea
app.kubernetes.io/instance: release-name
app.kubernetes.io/version: "1.22.1"
version: "1.22.1"
spec:
securityContext:
fsGroup: 1000
initContainers:
- name: init-directories
image: "reg.inje-private.com/nnd002/gitea/gitea:1.22.1-rootless"
imagePullPolicy: IfNotPresent
command: ["/usr/sbin/init_directory_structure.sh"]
env:
- name: GITEA_APP_INI
value: /data/gitea/conf/app.ini
- name: GITEA_CUSTOM
value: /data/gitea
- name: GITEA_WORK_DIR
value: /data
- name: GITEA_TEMP
value: /tmp/gitea
volumeMounts:
- name: init
mountPath: /usr/sbin
- name: temp
mountPath: /tmp
- name: data
mountPath: /data
securityContext:
{}
resources:
limits: {}
requests:
cpu: 100m
memory: 128Mi
- name: init-app-ini
image: "gitea/gitea:1.22.1-rootless"
imagePullPolicy: IfNotPresent
command: ["/usr/sbin/config_environment.sh"]
env:
- name: GITEA_APP_INI
value: /data/gitea/conf/app.ini
- name: GITEA_CUSTOM
value: /data/gitea
- name: GITEA_WORK_DIR
value: /data
- name: GITEA_TEMP
value: /tmp/gitea
volumeMounts:
- name: config
mountPath: /usr/sbin
- name: temp
mountPath: /tmp
- name: data
mountPath: /data
- name: inline-config-sources
mountPath: /env-to-ini-mounts/inlines/
securityContext:
{}
resources:
limits: {}
requests:
cpu: 100m
memory: 128Mi
- name: configure-gitea
image: "gitea/gitea:1.22.1-rootless"
command: ["/usr/sbin/configure_gitea.sh"]
imagePullPolicy: IfNotPresent
securityContext:
runAsUser: 1000
env:
- name: GITEA_APP_INI
value: /data/gitea/conf/app.ini
- name: GITEA_CUSTOM
value: /data/gitea
- name: GITEA_WORK_DIR
value: /data
- name: GITEA_TEMP
value: /tmp/gitea
- name: HOME
value: /data/gitea/git
- name: GITEA_ADMIN_USERNAME
value: "gitea_admin"
- name: GITEA_ADMIN_PASSWORD
value: "ijinc123!" # sdjo
- name: GITEA_ADMIN_PASSWORD_MODE
value: keepUpdated
volumeMounts:
- name: init
mountPath: /usr/sbin
- name: temp
mountPath: /tmp
- name: data
mountPath: /data
resources:
limits: {}
requests:
cpu: 100m
memory: 128Mi
terminationGracePeriodSeconds: 60
containers:
- name: gitea
image: "gitea/gitea:1.22.1-rootless"
imagePullPolicy: IfNotPresent
env:
# SSH Port values have to be set here as well for openssh configuration
- name: SSH_LISTEN_PORT
value: "2222"
- name: SSH_PORT
value: "22"
- name: GITEA_APP_INI
value: /data/gitea/conf/app.ini
- name: GITEA_CUSTOM
value: /data/gitea
- name: GITEA_WORK_DIR
value: /data
- name: GITEA_TEMP
value: /tmp/gitea
- name: TMPDIR
value: /tmp/gitea
- name: HOME
value: /data/gitea/git
ports:
- name: ssh
containerPort: 2222
- name: http
containerPort: 3000
livenessProbe:
failureThreshold: 10
initialDelaySeconds: 200
periodSeconds: 10
successThreshold: 1
tcpSocket:
port: http
timeoutSeconds: 1
readinessProbe:
failureThreshold: 3
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
tcpSocket:
port: http
timeoutSeconds: 1
resources:
{}
securityContext:
{}
volumeMounts:
- name: temp
mountPath: /tmp
- name: data
mountPath: /data
volumes:
- name: init
secret:
secretName: release-name-gitea-init
defaultMode: 110
- name: config
secret:
secretName: release-name-gitea
defaultMode: 110
- name: inline-config-sources
secret:
secretName: release-name-gitea-inline-config
- name: temp
emptyDir: {}
- name: data
persistentVolumeClaim:
claimName: gitea-shared-storage
---
# Source: gitea/charts/postgresql-ha/templates/postgresql/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: release-name-postgresql-ha-postgresql
namespace: "gitea"
labels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/version: 16.3.0
app.kubernetes.io/component: postgresql
role: data
spec:
replicas: 3
podManagementPolicy: "Parallel"
serviceName: release-name-postgresql-ha-postgresql-headless
updateStrategy:
type: RollingUpdate
selector:
matchLabels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/component: postgresql
role: data
template:
metadata:
labels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/version: 16.3.0
app.kubernetes.io/component: postgresql
role: data
spec:
automountServiceAccountToken: false
affinity:
podAffinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- podAffinityTerm:
labelSelector:
matchLabels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/component: postgresql
topologyKey: kubernetes.io/hostname
weight: 1
nodeAffinity:
securityContext:
fsGroup: 1001
fsGroupChangePolicy: Always
supplementalGroups: []
sysctls: []
serviceAccountName: release-name-postgresql-ha
hostNetwork: false
hostIPC: false
containers:
- name: postgresql
image: docker.io/bitnami/postgresql-repmgr:16.3.0-debian-12-r15
imagePullPolicy: "IfNotPresent"
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
readOnlyRootFilesystem: true
runAsGroup: 1001
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
lifecycle:
preStop:
exec:
command:
- /pre-stop.sh
- "25"
# Auxiliary vars to populate environment variables
env:
- name: BITNAMI_DEBUG
value: "false"
# PostgreSQL configuration
- name: POSTGRESQL_VOLUME_DIR
value: "/bitnami/postgresql"
- name: PGDATA
value: "/bitnami/postgresql/data"
- name: POSTGRES_POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: release-name-postgresql-ha-postgresql
key: postgres-password
- name: POSTGRES_USER
value: "gitea"
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: release-name-postgresql-ha-postgresql
key: password
- name: POSTGRES_DB
value: "gitea"
- name: POSTGRESQL_LOG_HOSTNAME
value: "true"
- name: POSTGRESQL_LOG_CONNECTIONS
value: "false"
- name: POSTGRESQL_LOG_DISCONNECTIONS
value: "false"
- name: POSTGRESQL_PGAUDIT_LOG_CATALOG
value: "off"
- name: POSTGRESQL_CLIENT_MIN_MESSAGES
value: "error"
- name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
value: "pgaudit, repmgr"
- name: POSTGRESQL_ENABLE_TLS
value: "no"
- name: POSTGRESQL_PORT_NUMBER
value: "5432"
# Repmgr configuration
- name: REPMGR_PORT_NUMBER
value: "5432"
- name: REPMGR_PRIMARY_PORT
value: "5432"
- name: MY_POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: REPMGR_UPGRADE_EXTENSION
value: "no"
- name: REPMGR_PGHBA_TRUST_ALL
value: "no"
- name: REPMGR_MOUNTED_CONF_DIR
value: "/bitnami/repmgr/conf"
- name: REPMGR_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: REPMGR_PARTNER_NODES
value: release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,release-name-postgresql-ha-postgresql-1.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,release-name-postgresql-ha-postgresql-2.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,
- name: REPMGR_PRIMARY_HOST
value: "release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
- name: REPMGR_NODE_NAME
value: "$(MY_POD_NAME)"
- name: REPMGR_NODE_NETWORK_NAME
value: "$(MY_POD_NAME).release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
- name: REPMGR_NODE_TYPE
value: "data"
- name: REPMGR_LOG_LEVEL
value: "NOTICE"
- name: REPMGR_CONNECT_TIMEOUT
value: "5"
- name: REPMGR_RECONNECT_ATTEMPTS
value: "2"
- name: REPMGR_RECONNECT_INTERVAL
value: "3"
- name: REPMGR_USERNAME
value: "repmgr"
- name: REPMGR_PASSWORD
valueFrom:
secretKeyRef:
name: release-name-postgresql-ha-postgresql
key: repmgr-password
- name: REPMGR_DATABASE
value: "repmgr"
- name: REPMGR_FENCE_OLD_PRIMARY
value: "no"
- name: REPMGR_CHILD_NODES_CHECK_INTERVAL
value: "5"
- name: REPMGR_CHILD_NODES_CONNECTED_MIN_COUNT
value: "1"
- name: REPMGR_CHILD_NODES_DISCONNECT_TIMEOUT
value: "30"
envFrom:
ports:
- name: postgresql
containerPort: 5432
protocol: TCP
livenessProbe:
failureThreshold: 6
initialDelaySeconds: 30
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 5
exec:
command:
- bash
- -ec
- 'PGPASSWORD=$POSTGRES_PASSWORD psql -w -U "gitea" -d "gitea" -h 127.0.0.1 -p 5432 -c "SELECT 1"'
readinessProbe:
failureThreshold: 6
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 5
exec:
command:
- bash
- -ec
- |
exec pg_isready -U "postgres" -h 127.0.0.1 -p 5432
[ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ]
resources:
limits:
cpu: 375m
ephemeral-storage: 2Gi
memory: 384Mi
requests:
cpu: 250m
ephemeral-storage: 50Mi
memory: 256Mi
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/postgresql/conf
subPath: app-conf-dir
- name: empty-dir
mountPath: /opt/bitnami/postgresql/tmp
subPath: app-tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/repmgr/conf
subPath: repmgr-conf-dir
- name: empty-dir
mountPath: /opt/bitnami/repmgr/tmp
subPath: repmgr-tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/repmgr/logs
subPath: repmgr-logs-dir
- name: data
mountPath: /bitnami/postgresql
- name: hooks-scripts
mountPath: /pre-stop.sh
subPath: pre-stop.sh
- name: hooks-scripts
mountPath: /readiness-probe.sh
subPath: readiness-probe.sh
volumes:
- name: empty-dir
emptyDir: {}
- name: hooks-scripts
configMap:
name: release-name-postgresql-ha-postgresql-hooks-scripts
defaultMode: 0755
volumeClaimTemplates:
- apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: data
spec:
accessModes:
- "ReadWriteOnce"
resources:
requests:
storage: "8Gi"
---
# Source: gitea/charts/redis-cluster/templates/redis-statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: release-name-redis-cluster
namespace: "gitea"
labels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: redis-cluster
app.kubernetes.io/version: 7.2.5
spec:
updateStrategy:
rollingUpdate:
partition: 0
type: RollingUpdate
selector:
matchLabels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: redis-cluster
replicas: 3
serviceName: release-name-redis-cluster-headless
podManagementPolicy: Parallel
template:
metadata:
labels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: redis-cluster
app.kubernetes.io/version: 7.2.5
annotations:
checksum/scripts: f4443ed238f1b19ab40555e6ba2aea56daba79e8270549f884b9b31cf8e0e2ee
checksum/secret: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
checksum/config: 958b865b26062946819f240fe4e5fd268b7c3203b944549981f1bd7fdc7947eb
spec:
hostNetwork: false
enableServiceLinks: false
securityContext:
fsGroup: 1001
fsGroupChangePolicy: Always
supplementalGroups: []
sysctls: []
serviceAccountName: release-name-redis-cluster
automountServiceAccountToken: false
affinity:
podAffinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- podAffinityTerm:
labelSelector:
matchLabels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: redis-cluster
topologyKey: kubernetes.io/hostname
weight: 1
nodeAffinity:
containers:
- name: release-name-redis-cluster
image: docker.io/bitnami/redis-cluster:7.2.5-debian-12-r2
imagePullPolicy: "IfNotPresent"
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
readOnlyRootFilesystem: true
runAsGroup: 1001
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
command: ['/bin/bash', '-c']
args:
- |
# Backwards compatibility change
if ! [[ -f /opt/bitnami/redis/etc/redis.conf ]]; then
echo COPYING FILE
cp /opt/bitnami/redis/etc/redis-default.conf /opt/bitnami/redis/etc/redis.conf
fi
pod_index=($(echo "$POD_NAME" | tr "-" "\n"))
pod_index="${pod_index[-1]}"
if [[ "$pod_index" == "0" ]]; then
export REDIS_CLUSTER_CREATOR="yes"
export REDIS_CLUSTER_REPLICAS="0"
fi
/opt/bitnami/scripts/redis-cluster/entrypoint.sh /opt/bitnami/scripts/redis-cluster/run.sh
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: REDIS_NODES
value: "release-name-redis-cluster-0.release-name-redis-cluster-headless release-name-redis-cluster-1.release-name-redis-cluster-headless release-name-redis-cluster-2.release-name-redis-cluster-headless "
- name: ALLOW_EMPTY_PASSWORD
value: "yes"
- name: REDIS_AOF_ENABLED
value: "yes"
- name: REDIS_TLS_ENABLED
value: "no"
- name: REDIS_PORT_NUMBER
value: "6379"
ports:
- name: tcp-redis
containerPort: 6379
- name: tcp-redis-bus
containerPort: 16379
livenessProbe:
initialDelaySeconds: 5
periodSeconds: 5
# One second longer than command timeout should prevent generation of zombie processes.
timeoutSeconds: 6
successThreshold: 1
failureThreshold: 5
exec:
command:
- sh
- -c
- /scripts/ping_liveness_local.sh 5
readinessProbe:
initialDelaySeconds: 5
periodSeconds: 5
# One second longer than command timeout should prevent generation of zombie processes.
timeoutSeconds: 2
successThreshold: 1
failureThreshold: 5
exec:
command:
- sh
- -c
- /scripts/ping_readiness_local.sh 1
resources:
limits:
cpu: 150m
ephemeral-storage: 2Gi
memory: 192Mi
requests:
cpu: 100m
ephemeral-storage: 50Mi
memory: 128Mi
volumeMounts:
- name: scripts
mountPath: /scripts
- name: redis-data
mountPath: /bitnami/redis/data
subPath:
- name: default-config
mountPath: /opt/bitnami/redis/etc/redis-default.conf
subPath: redis-default.conf
- name: empty-dir
mountPath: /opt/bitnami/redis/etc/
subPath: app-conf-dir
- name: empty-dir
mountPath: /opt/bitnami/redis/tmp
subPath: app-tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/redis/logs
subPath: app-logs-dir
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
volumes:
- name: scripts
configMap:
name: release-name-redis-cluster-scripts
defaultMode: 0755
- name: default-config
configMap:
name: release-name-redis-cluster-default
- name: empty-dir
emptyDir: {}
volumeClaimTemplates:
- metadata:
name: redis-data
labels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: redis-cluster
spec:
accessModes:
- "ReadWriteOnce"
resources:
requests:
storage: "8Gi"

16
on-premise/cicd/gitea/3_apply/deploy.yaml
View File

@ -49,7 +49,7 @@ spec:
# Auxiliary vars to populate environment variables
containers:
- name: pgpool
image: docker.io/bitnami/pgpool:4.5.2-debian-12-r2
image: reg.inje-private.com/nnd002/bitnami/pgpool:4.5.2-debian-12-r2
imagePullPolicy: "IfNotPresent"
securityContext:
allowPrivilegeEscalation: false
@ -207,7 +207,7 @@ spec:
fsGroup: 1000
initContainers:
- name: init-directories
image: "gitea/gitea:1.22.1-rootless"
image: "reg.inje-private.com/nnd002/gitea/gitea:1.22.1-rootless"
imagePullPolicy: IfNotPresent
command: ["/usr/sbin/init_directory_structure.sh"]
env:
@ -235,7 +235,7 @@ spec:
cpu: 100m
memory: 128Mi
- name: init-app-ini
image: "gitea/gitea:1.22.1-rootless"
image: "reg.inje-private.com/nnd002/gitea/gitea:1.22.1-rootless"
imagePullPolicy: IfNotPresent
command: ["/usr/sbin/config_environment.sh"]
env:
@ -265,7 +265,7 @@ spec:
cpu: 100m
memory: 128Mi
- name: configure-gitea
image: "gitea/gitea:1.22.1-rootless"
image: "reg.inje-private.com/nnd002/gitea/gitea:1.22.1-rootless"
command: ["/usr/sbin/configure_gitea.sh"]
imagePullPolicy: IfNotPresent
securityContext:
@ -303,7 +303,7 @@ spec:
terminationGracePeriodSeconds: 60
containers:
- name: gitea
image: "gitea/gitea:1.22.1-rootless"
image: "reg.inje-private.com/nnd002/gitea/gitea:1.22.1-rootless"
imagePullPolicy: IfNotPresent
env:
# SSH Port values have to be set here as well for openssh configuration
@ -432,7 +432,7 @@ spec:
hostIPC: false
containers:
- name: postgresql
image: docker.io/bitnami/postgresql-repmgr:16.3.0-debian-12-r15
image: reg.inje-private.com/nnd002/bitnami/postgresql-repmgr:16.3.0-debian-12-r15
imagePullPolicy: "IfNotPresent"
securityContext:
allowPrivilegeEscalation: false
@ -629,7 +629,7 @@ spec:
requests:
storage: "8Gi"
---
# Source: gitea/charts/redis-cluster/templates/redis-statefulset.yaml
# Source: cdgitea/charts/redis-cluster/templates/redis-statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
@ -688,7 +688,7 @@ spec:
containers:
- name: release-name-redis-cluster
image: docker.io/bitnami/redis-cluster:7.2.5-debian-12-r2
image: reg.inje-private.com/nnd002/bitnami/redis-cluster:7.2.5-debian-12-r2
imagePullPolicy: "IfNotPresent"
securityContext:
allowPrivilegeEscalation: false

6
on-premise/cicd/gitea/3_apply/ing.yaml
View File

@ -9,7 +9,7 @@ metadata:
spec:
ingressClassName: nginx
rules:
- host: gitea.nativedeck.com
- host: gitea.inje-private.com
http:
paths:
- path: /
@ -21,6 +21,6 @@ spec:
number: 3000
tls:
- hosts:
- "gitea.nativedeck.com"
secretName: secret-gitea-ssl
- "gitea.inje-private.com"
secretName: gitea-ssl

5
on-premise/logging/fluentbit_v3.1.7/1_configure/init.yaml
View File

@ -1,3 +1,8 @@
apiVersion: v1
kind: Namespace
metadata:
name: logging
---
# Source: fluent-bit/templates/serviceaccount.yaml
apiVersion: v1

69
on-premise/logging/fluentbit_v3.1.7/2_config/custom.yaml Normal file
View File

@ -0,0 +1,69 @@
# Source: fluent-bit/templates/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: fluent-bit
namespace: logging
labels:
helm.sh/chart: fluent-bit-0.47.9
app.kubernetes.io/name: fluent-bit
app.kubernetes.io/instance: fluent-bit
app.kubernetes.io/version: "3.1.7"
app.kubernetes.io/managed-by: Helm
data:
custom_parsers.conf: |
[PARSER]
Name docker_no_time
Format json
Time_Keep Off
Time_Key time
Time_Format %Y-%m-%dT%H:%M:%S.%L
fluent-bit.conf: |
[SERVICE]
Daemon Off
Flush 1
Log_Level info
Parsers_File /fluent-bit/etc/parsers.conf
Parsers_File /fluent-bit/etc/conf/custom_parsers.conf
HTTP_Server On
HTTP_Listen 0.0.0.0
HTTP_Port 2020
Health_Check On
[INPUT]
Name tail
Path /var/log/containers/*.log
multiline.parser docker, cri
# DB /var/fluent-bit/state/flb_log.db
Tag kube.*
Mem_Buf_Limit 5MB
Skip_Long_Lines On
[FILTER]
Name kubernetes
Match kube.*
Merge_Log On
Keep_Log Off
K8S-Logging.Parser On
K8S-Logging.Exclude On
# [FILTER]
# Name record_modifier
# Match kube.*
# Record namespace ${_score}
[OUTPUT]
Name es
Match kube.*
Host 172.17.128.246
HTTP_User admin
HTTP_Passwd admin
Index fluent-bit10--%Y.%m.%d
Logstash_Format On
Logstash_Prefix_Key $kubernetes['namespace_name']
Suppress_Type_Name On
tls On
tls.Verify Off
Retry_Limit False

2
on-premise/logging/fluentbit_v3.1.7/3_apply/default.yaml
View File

@ -51,7 +51,7 @@ spec:
dnsPolicy: ClusterFirst
containers:
- name: fluent-bit
image: "cr.fluentbit.io/fluent/fluent-bit:3.1.7"
image: "reg.inje-private.com/nnd002/fluent/fluent-bit:3.1.7"
imagePullPolicy: IfNotPresent
command:
- /fluent-bit/bin/fluent-bit

2
on-premise/logging/fluentbit_v3.1.7/3_apply/test.yaml
View File

@ -14,7 +14,7 @@ metadata:
spec:
containers:
- name: wget
image: "busybox:latest"
image: "reg.inje-private.com/nnd002/busybox:latest"
imagePullPolicy: Always
command: ["sh"]
args: ["-c", "wget -O- fluent-bit:2020"]

6
on-premise/logging/openSearch/ing-opensearch-dashboard.yaml
View File

@ -6,7 +6,7 @@ metadata:
spec:
ingressClassName: nginx
rules:
- host: os-dash.nativedeck.com
- host: os-dash.inje-private.com
http:
paths:
- backend:
@ -18,5 +18,5 @@ spec:
pathType: Prefix
tls:
- hosts:
- os-dash.nativedeck.com
secretName: secret-logging-ssl
- os-dash.inje-private.com
secretName: logging-ssl

20
on-premise/logging/openSearch/openSearch-dashboard_2.11.1.yaml
View File

@ -88,11 +88,11 @@ spec:
runAsNonRoot: true
runAsUser: 1000
#image: "opensearchproject/opensearch-dashboards:2.13.0"
image: "opensearchproject/opensearch-dashboards:2.11.1"
image: "reg.inje-private.com/nnd002/opensearchproject/opensearch-dashboards:2.11.1"
imagePullPolicy: "IfNotPresent"
readinessProbe:
failureThreshold: 10
initialDelaySeconds: 10
initialDelaySeconds: 30
periodSeconds: 20
successThreshold: 1
tcpSocket:
@ -100,7 +100,7 @@ spec:
timeoutSeconds: 5
livenessProbe:
failureThreshold: 10
initialDelaySeconds: 10
initialDelaySeconds: 30
periodSeconds: 20
successThreshold: 1
tcpSocket:
@ -108,7 +108,7 @@ spec:
timeoutSeconds: 5
startupProbe:
failureThreshold: 20
initialDelaySeconds: 10
initialDelaySeconds: 30
periodSeconds: 10
successThreshold: 1
tcpSocket:
@ -116,7 +116,7 @@ spec:
timeoutSeconds: 5
env:
- name: OPENSEARCH_HOSTS
value: "https://10.163.1.66:9200"
value: "https://172.17.128.246:9200"
#value: "https://opensearch-cluster-master:9200"
- name: SERVER_HOST
value: "0.0.0.0"
@ -137,4 +137,12 @@ spec:
requests:
cpu: 100m
memory: 512M
#volumeMounts:
volumeMounts:
- name: tls-secret
mountPath: /etc/opensearch/certs
readOnly: true
volumes:
- name: tls-secret
secret:
secretName: logging-ssl

2
on-premise/main/harbor_2.9.1/1.init.yaml
View File

@ -24,7 +24,7 @@ data:
CORE_LOCAL_URL: http://127.0.0.1:8080
CORE_URL: http://harbor-core:80
DATABASE_TYPE: postgresql
EXT_ENDPOINT: https://harbor.icurfer.com
EXT_ENDPOINT: https://harbor.inje-private.com
HTTP_PROXY: ""
HTTPS_PROXY: ""
JOBSERVICE_URL: http://harbor-jobservice

6
on-premise/main/harbor_2.9.1/2.cert.yaml
View File

@ -4,7 +4,7 @@ metadata:
name: harbor-cacerts
namespace: harbor
data:
cert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUU5RENDQTl5Z0F3SUJBZ0lTQktsUkF1R24rM2N1R2xKS1o5aVY4Vmx4TUEwR0NTcUdTSWIzRFFFQkN3VUEKTURJeEN6QUpCZ05WQkFZVEFsVlRNUll3RkFZRFZRUUtFdzFNWlhRbmN5QkZibU55ZVhCME1Rc3dDUVlEVlFRRApFd0pTTXpBZUZ3MHlOREF6TURJeE5EQTVOVFZhRncweU5EQTFNekV4TkRBNU5UUmFNQmd4RmpBVUJnTlZCQU1NCkRTb3VhV04xY21abGNpNWpiMjB3Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRQ3oKQWVxVS9KSkJGWWJpeFQwbTRKTXU3QW5CdTVYRUFVSUhHendsR3ZjdjJXRTBxajNwU1JCeUdJWEo0eHdycnl3eAprYjgrRkxTSjh4U3Q2TXpwZjVxNTBQMm9PYklFdkMwY0drNHZuZThGVm1YckNKckNMaUtld0JBRWhFcC9IUjdYClVFSFRLVFpXTE5oUkIzNjMxZFkrcHhHU1AxeWNMblBXYkJQOUVSa2xzeUhoUnJpWHBxTmZDcGVIM3kxb3VJOUwKV3l5Yks3SUdmSkVzN1g0TE1OZ2RycEZtUzlCdTNZQ0JVMExZMlZtWVFJNVFaNkNhbisrQk51bVN6U0M4ZVRUaApJamY0Uk14R2JIUFNDYjBXb3hxM3M4RmZmQVd1a2JOSmhXSTlidXNucWxNTnRrQnREdFYxdVpaQUlLMno0cnFCCmlJbDlaS0lza3FEQUJaMWFSb0JkQWdNQkFBR2pnZ0ljTUlJQ0dEQU9CZ05WSFE4QkFmOEVCQU1DQmFBd0hRWUQKVlIwbEJCWXdGQVlJS3dZQkJRVUhBd0VHQ0NzR0FRVUZCd01DTUF3R0ExVWRFd0VCL3dRQ01BQXdIUVlEVlIwTwpCQllFRk51b3p0ZmprQ25FRGFxd01zVlBwdU5CaU5YaU1COEdBMVVkSXdRWU1CYUFGQlF1c3hlM1dGYkxybEFKClFPWWZyNTJMRk1MR01GVUdDQ3NHQVFVRkJ3RUJCRWt3UnpBaEJnZ3JCZ0VGQlFjd0FZWVZhSFIwY0RvdkwzSXoKTG04dWJHVnVZM0l1YjNKbk1DSUdDQ3NHQVFVRkJ6QUNoaFpvZEhSd09pOHZjak11YVM1c1pXNWpjaTV2Y21jdgpNQ1VHQTFVZEVRUWVNQnlDRFNvdWFXTjFjbVpsY2k1amIyMkNDMmxqZFhKbVpYSXVZMjl0TUJNR0ExVWRJQVFNCk1Bb3dDQVlHWjRFTUFRSUJNSUlCQkFZS0t3WUJCQUhXZVFJRUFnU0I5UVNCOGdEd0FIVUFPMU4zZFQ0dHVZQk8KaXpCYkJ2NUFPMmZZVDhQMHg3MEFEUzF5YitINjFCY0FBQUdOLzdidTJ3QUFCQU1BUmpCRUFpQkdEcW5xZytIcwpQUmVmYTc5TXdVZjlmUzFOYWh3SEsrRlJrVlg4REE2QUN3SWdPN2NsOU1IcC9hVVFSbkhZNFlRU01lMG5WbHhUCkpBY0RuY2syUkJQMFhBUUFkd0R1emRCazFkc2F6c1ZjdDUyMHpST2lNb2RHZkx6czNzTlJTRmxHY1IrMW13QUEKQVkzL3R1N0tBQUFFQXdCSU1FWUNJUUNTWTlxczV0ZFY2ejR5c01acG9yOXZXcmhsVXlScFNINVJIVGRQZGdlWQpsd0loQUpvblNHeVJOYmVNcEs3SW5uYVJxOVFuajB3R1hhWnVNMnZXTmlUYWFLTzBNQTBHQ1NxR1NJYjNEUUVCCkN3VUFBNElCQVFCMmlWcEttN0IxZ3p0a01Ud2QrQXBNOWh4SzkwYndWSTZxUnZLNmpsZVFJV0JCZG84Z3I0QlEKTlpPNDBWa21OaFhoY3ljQ1ZsSmlhT3JLd1J0c1VhMzVmc29BVTFCQzlodFRPT3R4TXYvb2lDZlA4aEZQNGttagpOTVFzNVZ2eFR6cmRjbWxhRmJaOWJkNVF2dko3L2hadTBnZ1ZrSUZVRXVZcWtQNFFzSHU1dXhOd01rWUY3RGUxCnVsVGY1YlFQcTJ0TEk5cTk1OUNsM2xMTTJqYklkM2h1bkRrMDFLZ2dSOWNkUmEzZnEzM2VZNkY2eWNWSVBPblMKdGhXck9melc5K2IrSFNDWHkyd3BJR0VTUTVJQU95cUdibnBBR1Z6U294UnVrNW1Wd0FqeDBaMW94eUdPRVprTgpEQUhHa21aNThIOUJpcXJ0VzBuaEMyKzN0cCtmR2kydwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlGRmpDQ0F2NmdBd0lCQWdJUkFKRXJDRXJQREJpblUvYldMaVduWDFvd0RRWUpLb1pJaHZjTkFRRUxCUUF3ClR6RUxNQWtHQTFVRUJoTUNWVk14S1RBbkJnTlZCQW9USUVsdWRHVnlibVYwSUZObFkzVnlhWFI1SUZKbGMyVmgKY21Ob0lFZHliM1Z3TVJVd0V3WURWUVFERXd4SlUxSkhJRkp2YjNRZ1dERXdIaGNOTWpBd09UQTBNREF3TURBdwpXaGNOTWpVd09URTFNVFl3TURBd1dqQXlNUXN3Q1FZRFZRUUdFd0pWVXpFV01CUUdBMVVFQ2hNTlRHVjBKM01nClJXNWpjbmx3ZERFTE1Ba0dBMVVFQXhNQ1VqTXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUsKQW9JQkFRQzdBaFVvelBhZ2xOTVBFdXlOVlpMRCtJTHhtYVo2UW9pblhTYXF0U3U1eFV5eHI0NXIrWFhJbzljUApSNVFVVlRWWGpKNm9vamtaOVlJOFFxbE9idlU3d3k3YmpjQ3dYUE5aT09mdHoybndXZ3NidnNDVUpDV0gramR4CnN4UG5IS3pobSsvYjVEdEZVa1dXcWNGVHpqVElVdTYxcnUyUDNtQnc0cVZVcTdadERwZWxRRFJySzlPOFp1dG0KTkh6NmE0dVBWeW1aK0RBWFhicHliL3VCeGEzU2hsZzlGOGZuQ2J2eEsvZUczTUhhY1YzVVJ1UE1yU1hCaUx4ZwpaM1Ztcy9FWTk2SmM1bFAvT29pMlI2WC9FeGpxbUFsM1A1MVQrYzhCNWZXbWNCY1VyMk9rLzVtems1M2NVNmNHCi9raUZIYUZwcmlWMXV4UE1VZ1AxN1ZHaGk5c1ZBZ01CQUFHamdnRUlNSUlCQkRBT0JnTlZIUThCQWY4RUJBTUMKQVlZd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3SUdDQ3NHQVFVRkJ3TUJNQklHQTFVZEV3RUIvd1FJTUFZQgpBZjhDQVFBd0hRWURWUjBPQkJZRUZCUXVzeGUzV0ZiTHJsQUpRT1lmcjUyTEZNTEdNQjhHQTFVZEl3UVlNQmFBCkZIbTBXZVo3dHVYa0FYT0FDSWpJR2xqMjZadHVNRElHQ0NzR0FRVUZCd0VCQkNZd0pEQWlCZ2dyQmdFRkJRY3cKQW9ZV2FIUjBjRG92TDNneExta3ViR1Z1WTNJdWIzSm5MekFuQmdOVkhSOEVJREFlTUJ5Z0dxQVloaFpvZEhSdwpPaTh2ZURFdVl5NXNaVzVqY2k1dmNtY3ZNQ0lHQTFVZElBUWJNQmt3Q0FZR1o0RU1BUUlCTUEwR0N5c0dBUVFCCmd0OFRBUUVCTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElDQVFDRnlrNUhQcVAzaFVTRnZOVm5lTEtZWTYxMVRSNlcKUFRObGNsUXRnYURxdyszNElMOWZ6TGR3QUxkdU8vWmVsTjdrSUorbTc0dXlBK2VpdFJZOGtjNjA3VGtDNTN3bAppa2ZtWlc0L1J2VFo4TTZVSys1VXpoSzhqQ2RMdU1HWUw2S3Z6WEdSU2dpM3lMZ2pld1F0Q1BrSVZ6NkQyUVF6CkNrY2hlQW1DSjhNcXlKdTV6bHp5Wk1qQXZubkFUNDV0UkF4ZWtyc3U5NHNRNGVnZFJDbmJXU0R0WTdraCtCSW0KbEpOWG9CMWxCTUVLSXE0UURVT1hvUmdmZnVEZ2hqZTFXckc5TUwrSGJpc3EveUZPR3dYRDlSaVg4RjZzdzZXNAphdkF1dkRzenVlNUwzc3o4NUsrRUM0WS93RlZETnZabzRUWVhhbzZaMGYrbFFLYzB0OERRWXprMU9YVnU4cnAyCnlKTUM2YWxMYkJmT0RBTFp2WUg3bjdkbzFBWmxzNEk5ZDFQNGpua0RyUW94QjNVcVE5aFZsM0xFS1E3M3hGMU8KeUs1R2hERFg4b1ZmR0tGNXUrZGVjSXNINFlhVHc3bVAzR0Z4SlNxdjMrMGxVRkpvaTVMYzVkYTE0OXA5MElkcwpoQ0V4cm9MMSs3bXJ5SWtYUGVGTTVUZ085cjBydlphQkZPdlYyejBncDM1WjArTDRXUGxidUVqTi9seFBGaW4rCkhsVWpyOGdSc0kzcWZKT1FGeS85cktJSlIwWS84T213dC84b1RXZ3kxbWRlSG1tams3ajFuWXN2QzlKU1E2WnYKTWxkbFRUS0IzemhUaFYxK1hXWXA2cmpkNUpXMXpiVldFa0xOeEU3R0pUaEVVRzNzemdCVkdQN3BTV1RVVHNxWApuTFJid0hPb3E3aEh3Zz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
cert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURuVENDQW9XZ0F3SUJBZ0lVZG82RjNaejRhT2JjazdreDJwbHdHQVJreHBZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1hqRUxNQWtHQTFVRUJoTUNTMUl4RGpBTUJnTlZCQWdNQlZObGIzVnNNUTB3Q3dZRFZRUUhEQVJIUVZOTwpNUXd3Q2dZRFZRUUtEQU5FUlZZeEVEQU9CZ05WQkFzTUIwcEJXUzVEVDFJeEVEQU9CZ05WQkFNTUIxSlBUMVF0ClEwRXdIaGNOTWpReE1ERXdNRFEwTWpJMldoY05Nall4TURFd01EUTBNakkyV2pCZU1Rc3dDUVlEVlFRR0V3SkwKVWpFT01Bd0dBMVVFQ0F3RlUyVnZkV3d4RFRBTEJnTlZCQWNNQkVkQlUwNHhEREFLQmdOVkJBb01BMFJGVmpFUQpNQTRHQTFVRUN3d0hTa0ZaTGtOUFVqRVFNQTRHQTFVRUF3d0hVazlQVkMxRFFUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFMYkZPU2dMOEUveDk3VGVBdENqWDllTnlleXZkcS9GSWV0V2l2bk0KSWtaSWhqakZleG4rQXB0azZodFU2U1JabFdvNncvcExJRmJDUlZKbWdNY0s5WVRQenJHQ1FmUjRtOGhvdnN4dQo0aWNLU2tCR0o3YWd0RWI5MU1tSzk3SjFrelNHbm5EVXhQQVRRVnFtWVhZekdiWWhXRGpROURuQ3IwV3Rrb0xECkxwZU4yVERYcW5FcFY3K0dhaEpxWmhnc1VHUkJtcDR4VWttUFpDRWFSZkNrMHg4bVkvVFUyR1NRaTl1Y0dDQm4KN2RQQ1dXeEtNemFQNFkwMm5TSlgvY3FRTmxVS0FDOGlHZ2xwdllaRno3U29hNmxaak8yZXlVbEtXQnc3RGh0eQpiUHFrdjlicEc5aWRCdTU3Y2NuZ1dML0c5SnBFMTBSMEkxUXJJK0h5aUFTRThhOENBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRkprZ3VDTVBFT1c3YzN4NnBVa3Vwb0F2RkovcU1COEdBMVVkSXdRWU1CYUFGSmtndUNNUEVPVzcKYzN4NnBVa3Vwb0F2RkovcU1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRUUzd3hoak5xZzhxUFQ1UC9MNTFKSWlaaWxGbk95cTJjOGg5L0dYVHl2Rmp1ZXB5MkFOeUtMaEJwcjlCNXhYCkVqY3JqWCtyT044OWJIRkFRamlnWTJadGVvRGNyNjhVb1d3cExETC8zU1BPTEcvTnN2TnNUTFJTQkxSK01CdE0KQUJVNzUwM0o4WSszZWY3K0N0MElmVzdWTWNnRnpheWNIaXRkZDZON0x5YTJsVW9vUnNFZmNXSjZqWXlUNEVaTgoxVjc4STEwWHE4aW56ZVFVT3JjaEhQY3Y3VHF6ay9wVG9aMWI0K3hLZFJJTExsYUo1SmQ1R1MrWVU2R3FRb2VmClNlcWlRRmlzODJxdzFFS2xCOFVxNGVFejZENXdjNnF5U0pLd25tY2FOMVNxcld4YnlHSk53TGtyWkZmQXdPNWwKc2N6WjVvdE54TTJUOFgyV2Z4MUtPZW89Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
---
apiVersion: v1
kind: Secret
@ -22,6 +22,6 @@ data:
REGISTRY_CREDENTIAL_PASSWORD: aGFyYm9yX3JlZ2lzdHJ5X3Bhc3N3b3Jk
secret: RTRQY0FxZ3RPVmdKWTBRRw==
secretKey: bm90LWEtc2VjdXJlLWtleQ==
tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUU5RENDQTl5Z0F3SUJBZ0lTQktsUkF1R24rM2N1R2xKS1o5aVY4Vmx4TUEwR0NTcUdTSWIzRFFFQkN3VUEKTURJeEN6QUpCZ05WQkFZVEFsVlRNUll3RkFZRFZRUUtFdzFNWlhRbmN5QkZibU55ZVhCME1Rc3dDUVlEVlFRRApFd0pTTXpBZUZ3MHlOREF6TURJeE5EQTVOVFZhRncweU5EQTFNekV4TkRBNU5UUmFNQmd4RmpBVUJnTlZCQU1NCkRTb3VhV04xY21abGNpNWpiMjB3Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRQ3oKQWVxVS9KSkJGWWJpeFQwbTRKTXU3QW5CdTVYRUFVSUhHendsR3ZjdjJXRTBxajNwU1JCeUdJWEo0eHdycnl3eAprYjgrRkxTSjh4U3Q2TXpwZjVxNTBQMm9PYklFdkMwY0drNHZuZThGVm1YckNKckNMaUtld0JBRWhFcC9IUjdYClVFSFRLVFpXTE5oUkIzNjMxZFkrcHhHU1AxeWNMblBXYkJQOUVSa2xzeUhoUnJpWHBxTmZDcGVIM3kxb3VJOUwKV3l5Yks3SUdmSkVzN1g0TE1OZ2RycEZtUzlCdTNZQ0JVMExZMlZtWVFJNVFaNkNhbisrQk51bVN6U0M4ZVRUaApJamY0Uk14R2JIUFNDYjBXb3hxM3M4RmZmQVd1a2JOSmhXSTlidXNucWxNTnRrQnREdFYxdVpaQUlLMno0cnFCCmlJbDlaS0lza3FEQUJaMWFSb0JkQWdNQkFBR2pnZ0ljTUlJQ0dEQU9CZ05WSFE4QkFmOEVCQU1DQmFBd0hRWUQKVlIwbEJCWXdGQVlJS3dZQkJRVUhBd0VHQ0NzR0FRVUZCd01DTUF3R0ExVWRFd0VCL3dRQ01BQXdIUVlEVlIwTwpCQllFRk51b3p0ZmprQ25FRGFxd01zVlBwdU5CaU5YaU1COEdBMVVkSXdRWU1CYUFGQlF1c3hlM1dGYkxybEFKClFPWWZyNTJMRk1MR01GVUdDQ3NHQVFVRkJ3RUJCRWt3UnpBaEJnZ3JCZ0VGQlFjd0FZWVZhSFIwY0RvdkwzSXoKTG04dWJHVnVZM0l1YjNKbk1DSUdDQ3NHQVFVRkJ6QUNoaFpvZEhSd09pOHZjak11YVM1c1pXNWpjaTV2Y21jdgpNQ1VHQTFVZEVRUWVNQnlDRFNvdWFXTjFjbVpsY2k1amIyMkNDMmxqZFhKbVpYSXVZMjl0TUJNR0ExVWRJQVFNCk1Bb3dDQVlHWjRFTUFRSUJNSUlCQkFZS0t3WUJCQUhXZVFJRUFnU0I5UVNCOGdEd0FIVUFPMU4zZFQ0dHVZQk8KaXpCYkJ2NUFPMmZZVDhQMHg3MEFEUzF5YitINjFCY0FBQUdOLzdidTJ3QUFCQU1BUmpCRUFpQkdEcW5xZytIcwpQUmVmYTc5TXdVZjlmUzFOYWh3SEsrRlJrVlg4REE2QUN3SWdPN2NsOU1IcC9hVVFSbkhZNFlRU01lMG5WbHhUCkpBY0RuY2syUkJQMFhBUUFkd0R1emRCazFkc2F6c1ZjdDUyMHpST2lNb2RHZkx6czNzTlJTRmxHY1IrMW13QUEKQVkzL3R1N0tBQUFFQXdCSU1FWUNJUUNTWTlxczV0ZFY2ejR5c01acG9yOXZXcmhsVXlScFNINVJIVGRQZGdlWQpsd0loQUpvblNHeVJOYmVNcEs3SW5uYVJxOVFuajB3R1hhWnVNMnZXTmlUYWFLTzBNQTBHQ1NxR1NJYjNEUUVCCkN3VUFBNElCQVFCMmlWcEttN0IxZ3p0a01Ud2QrQXBNOWh4SzkwYndWSTZxUnZLNmpsZVFJV0JCZG84Z3I0QlEKTlpPNDBWa21OaFhoY3ljQ1ZsSmlhT3JLd1J0c1VhMzVmc29BVTFCQzlodFRPT3R4TXYvb2lDZlA4aEZQNGttagpOTVFzNVZ2eFR6cmRjbWxhRmJaOWJkNVF2dko3L2hadTBnZ1ZrSUZVRXVZcWtQNFFzSHU1dXhOd01rWUY3RGUxCnVsVGY1YlFQcTJ0TEk5cTk1OUNsM2xMTTJqYklkM2h1bkRrMDFLZ2dSOWNkUmEzZnEzM2VZNkY2eWNWSVBPblMKdGhXck9melc5K2IrSFNDWHkyd3BJR0VTUTVJQU95cUdibnBBR1Z6U294UnVrNW1Wd0FqeDBaMW94eUdPRVprTgpEQUhHa21aNThIOUJpcXJ0VzBuaEMyKzN0cCtmR2kydwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRQ3pBZXFVL0pKQkZZYmkKeFQwbTRKTXU3QW5CdTVYRUFVSUhHendsR3ZjdjJXRTBxajNwU1JCeUdJWEo0eHdycnl3eGtiOCtGTFNKOHhTdAo2TXpwZjVxNTBQMm9PYklFdkMwY0drNHZuZThGVm1YckNKckNMaUtld0JBRWhFcC9IUjdYVUVIVEtUWldMTmhSCkIzNjMxZFkrcHhHU1AxeWNMblBXYkJQOUVSa2xzeUhoUnJpWHBxTmZDcGVIM3kxb3VJOUxXeXliSzdJR2ZKRXMKN1g0TE1OZ2RycEZtUzlCdTNZQ0JVMExZMlZtWVFJNVFaNkNhbisrQk51bVN6U0M4ZVRUaElqZjRSTXhHYkhQUwpDYjBXb3hxM3M4RmZmQVd1a2JOSmhXSTlidXNucWxNTnRrQnREdFYxdVpaQUlLMno0cnFCaUlsOVpLSXNrcURBCkJaMWFSb0JkQWdNQkFBRUNnZ0VBQmdGVTNvOG82VHlManN6VVMvQ0JsNGtpY2FpZjhnTDRkVmNTcEl4YjlGNW0KbmxidUVVY0ZkczBVK0pjaElUa0tSK3ZEcytyZ3ZLRUE2d0w4bEMwVzk5QUhvUmxnWnJ3WkI2WG43MmZYdG9EZwphMEJadXIvRCtHU1Q2bEdLMDBBRmw4TzdsWlhVR3I0bk9wNnEvN0ttM09sZ3ZrY3R1RUtacnhJOG9HM1pWTFJOCmJMTUpLMFhMdGRSZDFIUWg4ZHNycDNldndYSUwzS3dnOEpDV2xEb2FPc0tCbUdxQU5LRTY4MDVNbm5uZWk5RlEKZ01lTFRxdmJzUkRJWFdpdDM4WEZLdmRBSUhnVTB3clh1djhXUXplYitjdnd0MFlRUEpyU0lraFFHUG10TlFQUgpHYWh3cGhlNXBVRUZranlxTXQxcHB2QmZTeFhWaU0zM3hlaEdZOTNtd1FLQmdRQzJWbjJPNWlmdUJUQVVqeDVyCkxoRTdGMWpnZGdZTWJRZUFjNDdUZkdXNjA1VGNlRk5TeDdBYk9tUHduR01xUWRiT0M4dEUzZXR3MURsV1hyRjcKL3NlRmxtVmduNWRWdGQxRWNoVUUvVVlxejIweldjSGpSN1lDbktmdDRIZmM3YWVmWGZZOG50TGVDUENtQVpsVgpycTVjSFUvOENLc3RwNmdHbVdFV0I0S25IUUtCZ1FEN1V2ODBxUzd6TDBsTFNWVTEycDMrUTl6NDU3MHgybmhOCmgvS3pnWnJpZ1FXMHRLdnlpRkdndHZ6V1BGMncvOUdDVDgyRHN2R2FMSURsa2o1VUpGalczUUQzWmxERFk5dEcKYU5zTEdwSkt4UDZwaEFwSUlMSjdYUXI2QXNWVm5yZXNSRGxZMU1LQXhFZGMxUHFNUk1sWEdpdzl3amdLQXA4UQpNZ2RYTlR1NlFRS0JnSDZmQzJ4YnlpalJjM1VqZWlWR0JYTTZvRjZudDBXVHhWemZZclRjc3l5TlY5Zk91MVpHCkU3YWswdGc1VWVmN2RyYjVtN3dFUEViTEtkSWZ5akxvV0JnZHUrTGdrTkJWamdYRkQzRzZqS3FZQnlaYzAzY0kKeW8xL3ltSTN1aVV5NkcrVWFiWHBPVmcxYnlCcEJkbHBoKzJ4OFdSOWhKb2N6bU5leWZ2cFZVTEZBb0dCQU1rZwpSNG4rSnN1SXVSQWQ5S292ZFNiSmFtcHJFaloyVHJaRktJNU5Gd1ZUR1p6ZXhZaEhYWVBQVFJHcHA1VUJkTW5qClVXV202OEJsQXhZMWJkbnFhSW95dlJZLzlEd1ppcDZUUlZCaWlGWjd4ZzBrMVJHWjBSdjJmdFZMS0Y3M3NLZVUKeFl2NFlGdXFPQzNyWjBLZnZiME4vZi9Da1JRNXVzKzhLYkc1c1QzQkFvR0JBSms2VmJvK3BtSE5ab0E2cDY5MApCY2lJRFJ3ZUJXQmZ2dmJ3ek8xbiswcE9IdEF1N1ZCS3ZmSGZ1bkhjMGNkdjdTdks0RjN3NW03blJBR3cxOXFnCjFreG5PZWFlazFGMG1aZWZaNGlqajVUSWtxTnlwQldkMEZYdHk5SUwwSEhMemxQU3VDb2pRVUJ3cG5PMTJ5cTYKMC92RFA0U1p3K2hWb3JORnZzMzhDVmZjCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
tls.cert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURuVENDQW9XZ0F3SUJBZ0lVZG82RjNaejRhT2JjazdreDJwbHdHQVJreHBZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1hqRUxNQWtHQTFVRUJoTUNTMUl4RGpBTUJnTlZCQWdNQlZObGIzVnNNUTB3Q3dZRFZRUUhEQVJIUVZOTwpNUXd3Q2dZRFZRUUtEQU5FUlZZeEVEQU9CZ05WQkFzTUIwcEJXUzVEVDFJeEVEQU9CZ05WQkFNTUIxSlBUMVF0ClEwRXdIaGNOTWpReE1ERXdNRFEwTWpJMldoY05Nall4TURFd01EUTBNakkyV2pCZU1Rc3dDUVlEVlFRR0V3SkwKVWpFT01Bd0dBMVVFQ0F3RlUyVnZkV3d4RFRBTEJnTlZCQWNNQkVkQlUwNHhEREFLQmdOVkJBb01BMFJGVmpFUQpNQTRHQTFVRUN3d0hTa0ZaTGtOUFVqRVFNQTRHQTFVRUF3d0hVazlQVkMxRFFUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFMYkZPU2dMOEUveDk3VGVBdENqWDllTnlleXZkcS9GSWV0V2l2bk0KSWtaSWhqakZleG4rQXB0azZodFU2U1JabFdvNncvcExJRmJDUlZKbWdNY0s5WVRQenJHQ1FmUjRtOGhvdnN4dQo0aWNLU2tCR0o3YWd0RWI5MU1tSzk3SjFrelNHbm5EVXhQQVRRVnFtWVhZekdiWWhXRGpROURuQ3IwV3Rrb0xECkxwZU4yVERYcW5FcFY3K0dhaEpxWmhnc1VHUkJtcDR4VWttUFpDRWFSZkNrMHg4bVkvVFUyR1NRaTl1Y0dDQm4KN2RQQ1dXeEtNemFQNFkwMm5TSlgvY3FRTmxVS0FDOGlHZ2xwdllaRno3U29hNmxaak8yZXlVbEtXQnc3RGh0eQpiUHFrdjlicEc5aWRCdTU3Y2NuZ1dML0c5SnBFMTBSMEkxUXJJK0h5aUFTRThhOENBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRkprZ3VDTVBFT1c3YzN4NnBVa3Vwb0F2RkovcU1COEdBMVVkSXdRWU1CYUFGSmtndUNNUEVPVzcKYzN4NnBVa3Vwb0F2RkovcU1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRUUzd3hoak5xZzhxUFQ1UC9MNTFKSWlaaWxGbk95cTJjOGg5L0dYVHl2Rmp1ZXB5MkFOeUtMaEJwcjlCNXhYCkVqY3JqWCtyT044OWJIRkFRamlnWTJadGVvRGNyNjhVb1d3cExETC8zU1BPTEcvTnN2TnNUTFJTQkxSK01CdE0KQUJVNzUwM0o4WSszZWY3K0N0MElmVzdWTWNnRnpheWNIaXRkZDZON0x5YTJsVW9vUnNFZmNXSjZqWXlUNEVaTgoxVjc4STEwWHE4aW56ZVFVT3JjaEhQY3Y3VHF6ay9wVG9aMWI0K3hLZFJJTExsYUo1SmQ1R1MrWVU2R3FRb2VmClNlcWlRRmlzODJxdzFFS2xCOFVxNGVFejZENXdjNnF5U0pLd25tY2FOMVNxcld4YnlHSk53TGtyWkZmQXdPNWwKc2N6WjVvdE54TTJUOFgyV2Z4MUtPZW89Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBNENCZnhHTW8xb3pNWld0cXVKNmJUdndPNHhSRy9MTWFVcEF3WUlRNElJUXZtazloCmJkL24vMW85TmpWdDB2QzRqUmU0TFkxbzNUcWk0YWdCbWFWOW1CWTBjZmlRakluSTdybFFJOVpDN25zNXIyZ0gKdngrRGhzVExPQ0I1Mit1b05UdkdJdDYrRzUzbm53c3YxNmx6Qy9GU2M0ZEwzaURacjlQazJOWk55NUhFRC8yawpVQU43ejZ3bmNDRE4vNlVQdlR3aFdncmNtQmpTMjZhQjBMVzU2bk1FZzhTSHErREd2OVlhYXlySDgrYkV0RlVBCllJU2JPcCs3RTRIZVI5c011dmw3VVg5WW1RbG9DN0oxQnljaExuTGdXWlhBU0p0ODd0eW45RkpiaTI1bGVjeVIKTU9oYmxvQSt0SjgyZWlORTRuZXBxOTdXWTZpY3Jqei9aZTd5OVFJREFRQUJBb0lCQUFPNjdqVWJ6R0p6d2ZRZgpLMDNLei8xcXl3bWkvUUo0TGFRNW82QjdtdDZKckt3bURaSlJVM0JuelZTQlk2UkszdHQwVFZ1dXVwUFNCY041Ck14dWVTajZWZ2daeWsxOVBiTUZ5WXAvU0VWZWNRK3ZFTUxyUTJMVE53aThiTlVRQWdsSnVmZi8zRXBWdGxaMEwKUjk3UVFtcXN0OGxWODJDTlRlb3ovZDlSQThielRHV2o5c3FlOS9wY28rb09FV0xPWXNMeE9lWXBFSjdXejhIWQoxalhtRnpid1Jlcnp3Q3RuMVFLeDRKYU4wVWpSTkY3dEpKV2c1VEo0YTVLSkdNaHhZdE5NQ3UvaVBObjNIMnpDCnBJK2x0SmNMMkIwcXBRdzZCMHZ2d1ZHblNNS05weWlHK0dRQk5XRFZLYVR4TXZZT1g0YXpWWmkzS29nU0lETkcKaVZpaTZYa0NnWUVBNzYwN3pFQmIzSmJMakVlNGR2cUErdkJKMGpQNDNBQlNSWElSM3AyaW45VjRJMlpEbHN6NAowem9aelVpS3NYSVAvRlI0bGJHQXJMYzFwMDdSYmpJWUdRaXFzU2N6UCtqMGhDYVJpOWZoaXRVOUJBSk1lT24rCnRZbmxmZ3VZU2ZRa0t4Qk03ck90WnJNdkV2OW5aUXNDYmFGOTV4cDFNKzV2aFoxRHg5OXZ2VDBDZ1lFQTcyUUYKb1QwUko4eVlCTWs5bEYyQUwzcSsxRjQ3SUZ2VFVpd0NIS2tkL1NYd3BSaW5IQ0xwQnZBRjBFcGU0UVcrVkdiSQpEY3UyV0dVY1E0cFRpZk9TcUc2Um4rQ3RjUzViVTRYUytUR09aLzZobkFmSGYyQTh4OTg3aE9DTCtHWVU5Y2RLClFuR1czcFRxMkxkdEFDTnEzcUV0VXhMSjNOZkNyYlZ4ZVBkaTJCa0NnWUVBbTJGTVRncy9Rby9FSUFwekRUY3oKblB0Z2NGVGZOZ2xEVE9BNXMzK3dhVHhrS1ZibjVJQzNvNENjTDVpaXlZenZ6aDhaR2JxOGQ3eENuVmVjc0hycgpZbmRhNllSSFZseDVBSjljWmpPcmRXenVwSVcwL0FKKzdVUWJzbzVqeVRYc3FMcGxsYTZJY1BjalFvYXZpak1MCi9QVGdBWTRHZzRkRlozTGYrVmppUU9VQ2dZRUFnNlJHTUVlTGtvNUFub2tua3RuajdyZ2FEbUNQTlJrcDJRc1kKVWpoeHBFN2p5WFlJRjBIZlVSQldzaGJqbSt4em9LZ3dwTjE4TlpuTWRCdXlHcTlWMjhlSnp4aFhhR0RzbWI2QwpxTVFtb210MDVYK2xwaGIrOVk1OWhYR1JweFJEdkhCT0ZzR3VERkpwM3FqbmlPYnhFdUloTVlpb2R3Z3pKeUVhCitFRmFHcWtDZ1lCSnhuWU1CNzlTa1M1Z1NvTnJnNjJRV3JBcElvZ2dTTkFCNnA3Q1NJbTFldXcvYlBvYVB1aEcKL0V4c0ZGenZ2ayt2TWFycVU0VFNJYkRHcjRkRXZHRm8yM3NQYVNvcVFVZDVRbmg3RGd6RVh5RjhmUGxBV2RxTQpuTTU0aUFnZ2Fyc1paSk9CSnpvQzQveDdwVEJta3RDYkNPVnNVakpDdWZCa0luOXU0UWJjMmc9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQ==
---

22
on-premise/main/harbor_2.9.1/3.harbor.yaml
View File

@ -132,6 +132,7 @@ metadata:
spec:
accessModes:
- ReadWriteMany
storageClassName: sc-monitoring
resources:
requests:
storage: 10Gi
@ -146,6 +147,7 @@ metadata:
name: harbor-registry
namespace: harbor
spec:
storageClassName: sc-monitoring
accessModes:
- ReadWriteMany
resources:
@ -194,7 +196,7 @@ spec:
name: harbor-core
- secretRef:
name: harbor-core
image: goharbor/harbor-core:v2.9.1
image: reg.inje-private.com/nnd002/goharbor/harbor-core:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 2
@ -300,7 +302,7 @@ spec:
name: harbor-jobservice-env
- secretRef:
name: harbor-jobservice
image: goharbor/harbor-jobservice:v2.9.1
image: reg.inje-private.com/nnd002/goharbor/harbor-jobservice:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
@ -364,7 +366,7 @@ spec:
spec:
automountServiceAccountToken: false
containers:
- image: goharbor/harbor-portal:v2.9.1
- image: reg.inje-private.com/nnd002/goharbor/harbor-portal:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
@ -430,7 +432,7 @@ spec:
envFrom:
- secretRef:
name: harbor-registry
image: goharbor/registry-photon:v2.9.1
image: reg.inje-private.com/nnd002/goharbor/registry-photon:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
@ -478,7 +480,7 @@ spec:
name: harbor-registry
- secretRef:
name: harbor-registryctl
image: goharbor/harbor-registryctl:v2.9.1
image: reg.inje-private.com/nnd002/goharbor/harbor-registryctl:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
@ -558,7 +560,7 @@ spec:
envFrom:
- secretRef:
name: harbor-database
image: goharbor/harbor-db:v2.9.1
image: reg.inje-private.com/nnd002/goharbor/harbor-db:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
exec:
@ -588,7 +590,7 @@ spec:
/var/lib/postgresql/data/pgdata/ || true'
command:
- /bin/sh
image: goharbor/harbor-db:v2.9.1
image: reg.inje-private.com/nnd002/goharbor/harbor-db:v2.9.1
imagePullPolicy: IfNotPresent
name: data-migrator
volumeMounts:
@ -599,7 +601,7 @@ spec:
- chmod -R 700 /var/lib/postgresql/data/pgdata || true
command:
- /bin/sh
image: goharbor/harbor-db:v2.9.1
image: reg.inje-private.com/nnd002/goharbor/harbor-db:v2.9.1
imagePullPolicy: IfNotPresent
name: data-permissions-ensurer
volumeMounts:
@ -654,7 +656,7 @@ spec:
spec:
automountServiceAccountToken: false
containers:
- image: goharbor/redis-photon:v2.9.1
- image: reg.inje-private.com/nnd002/goharbor/redis-photon:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
initialDelaySeconds: 300
@ -767,7 +769,7 @@ spec:
secretKeyRef:
key: redisURL
name: harbor-trivy
image: goharbor/trivy-adapter-photon:v2.9.1
image: reg.inje-private.com/nnd002/goharbor/trivy-adapter-photon:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 10

10
on-premise/main/harbor_2.9.1/4.ing-harbor.yaml
View File

@ -12,12 +12,12 @@ metadata:
namespace: harbor
spec:
ingressClassName: nginx
#tls:
#- hosts:
# - "harbor.icurfer.com"
# secretName: secret-harbor-ssl
tls:
- hosts:
- "harbor.icurfer.com"
secretName: harbor-ssl
rules:
- host: harbor.icurfer.com
- host: harbor.inje-private.com
http:
paths:
- backend:

1
on-premise/main/rancher_v2.9.1/rancher/.helmignore Normal file
View File

@ -0,0 +1 @@
tests

16
on-premise/main/rancher_v2.9.1/rancher/Chart.yaml Normal file
View File

@ -0,0 +1,16 @@
apiVersion: v2
appVersion: v2.9.1
description: Install Rancher Server to manage Kubernetes clusters across providers.
home: https://rancher.com
icon: https://github.com/rancher/ui/blob/master/public/assets/images/logos/welcome-cow.svg
keywords:
- rancher
kubeVersion: < 1.32.0-0
maintainers:
- email: charts@rancher.com
name: Rancher Labs
name: rancher
sources:
- https://github.com/rancher/rancher
- https://github.com/rancher/server-chart
version: 2.9.1

208
on-premise/main/rancher_v2.9.1/rancher/README.md Normal file
View File

@ -0,0 +1,208 @@
By installing this application, you accept the [End User License Agreement & Terms & Conditions](https://www.suse.com/licensing/eula/).
# Rancher
***Rancher*** is open source software that combines everything an organization needs to adopt and run containers in production. Built on Kubernetes, Rancher makes it easy for DevOps teams to test, deploy and manage their applications.
### Introduction
This chart bootstraps a [Rancher Server](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster) on a Kubernetes cluster using the [Helm](https://helm.sh/) package manager. For a Rancher Supported Deployment please follow our [HA install instructions](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-cluster-setup/high-availability-installs).
### Prerequisites Details
*For installations covered under [Rancher Support SLA](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions) the target cluster must be **[RKE1](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher)**, **[RKE2](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke2-for-rancher)**, **[K3s](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-cluster-setup/k3s-for-rancher)**, **[AKS](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks)**, **[EKS](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks)**, or **[GKE](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke)**.*
Make sure the node(s) for the Rancher server fulfill the following requirements:
[Operating Systems and Container Runtime Requirements](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#operating-systems-and-container-runtime-requirements)
[Hardware Requirements](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#hardware-requirements)
- [CPU and Memory](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#cpu-and-memory)
- [Ingress](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#ingress)
- [Disks](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#disks)
[Networking Requirements](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#networking-requirements)
- [Node IP Addresses](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#node-ip-addresses)
- [Port Requirements](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#port-requirements)
[Install the Required CLI Tools](https://ranchermanager.docs.rancher.com/pages-for-subheaders/cli-with-rancher)
- [kubectl](https://ranchermanager.docs.rancher.com/reference-guides/cli-with-rancher/kubectl-utility) - Kubernetes command-line tool.
- [helm](https://docs.helm.sh/using_helm/#installing-helm) - Package management for Kubernetes. Refer to the [Helm version requirements](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/resources/helm-version-requirements) to choose a version of Helm to install Rancher.
For a list of best practices that we recommend for running the Rancher server in production, refer to the [best practices section](https://ranchermanager.docs.rancher.com/pages-for-subheaders/best-practices).
## Installing Rancher
For production environments, we recommend installing Rancher in a [high-availability Kubernetes installation](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-cluster-setup/high-availability-installs) so that your user base can always access Rancher Server. When installed in a Kubernetes cluster, Rancher will integrate with the cluster’s etcd database and take advantage of Kubernetes scheduling for high-availability.
Optional: Installing Rancher on a [Single-node](https://ranchermanager.docs.rancher.com/pages-for-subheaders/rancher-on-a-single-node-with-docker) Kubernetes Cluster
#### Add the Helm Chart Repository
Use [helm repo add](https://helm.sh/docs/helm/helm_repo_add/) command to add the Helm chart repository that contains charts to install Rancher. For more information about the repository choices and which is best for your use case, see Choosing a Version of Rancher.
```bash
helm repo add rancher-latest https://releases.rancher.com/server-charts/latest
```
#### Create a Namespace for Rancher
We’ll need to define a Kubernetes namespace where the resources created by the Chart should be installed. This should always be cattle-system:
```bash
kubectl create namespace cattle-system
```
#### Choose your SSL Configuration
The Rancher management server is designed to be secure by default and requires SSL/TLS configuration.
There are three recommended options for the source of the certificate used for TLS termination at the Rancher server:
- [Rancher-generated TLS certificate](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#3-choose-your-ssl-configuration)
- [Let’s Encrypt](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#3-choose-your-ssl-configuration)
- [Bring your own certificate](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#3-choose-your-ssl-configuration)
#### Install cert-manager
This step is only required to use certificates issued by Rancher’s generated CA **`(ingress.tls.source=rancher)`** or to request Let’s Encrypt issued certificates **`(ingress.tls.source=letsEncrypt)`**.
[These instructions are adapted from the official cert-manager documentation.](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#4-install-cert-manager)
#### Install Rancher with Helm and Your Chosen Certificate Option
- [Rancher to generated certificates](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#5-install-rancher-with-helm-and-your-chosen-certificate-option)
```bash
helm install rancher rancher-latest/rancher \
--namespace cattle-system \
--set hostname=rancher.my.org
```
- [Let’s Encrypt](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#5-install-rancher-with-helm-and-your-chosen-certificate-option)
```bash
helm install rancher rancher-latest/rancher \
--namespace cattle-system \
--set hostname=rancher.my.org \
--set ingress.tls.source=letsEncrypt \
--set letsEncrypt.email=me@example.org
```
- [Certificates from Files](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#5-install-rancher-with-helm-and-your-chosen-certificate-option)
```bash
helm install rancher rancher-latest/rancher \
--namespace cattle-system \
--set hostname=rancher.my.org \
--set ingress.tls.source=secret
```
*If you are using a Private CA signed certificate , add **--set privateCA=true** to the command:`*
```bash
helm install rancher rancher-latest/rancher \
--namespace cattle-system \
--set hostname=rancher.my.org \
--set ingress.tls.source=secret \
--set privateCA=true
```
#### Verify that the Rancher Server is Successfully Deployed
After adding the secrets, check if Rancher was rolled out successfully:
```bash
kubectl -n cattle-system rollout status deploy/rancher
Waiting for deployment "rancher" rollout to finish: 0 of 3 updated replicas are available...
deployment "rancher" successfully rolled out
```
If you see the following **`error: error: deployment "rancher" exceeded its progress deadline`**, you can check the status of the deployment by running the following command:
```bash
kubectl -n cattle-system get deploy rancher
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE
rancher 3 3 3 3 3m
```
It should show the same count for **`DESIRED`** and **`AVAILABLE`**.
#### Save Your Options
Make sure you save the **`--set`** options you used. You will need to use the same options when you upgrade Rancher to new versions with Helm.
#### Finishing Up
That’s it. You should have a functional Rancher server.
In a web browser, go to the DNS name that forwards traffic to your load balancer. Then you should be greeted by the colorful login page.
Doesn’t work? Take a look at the [Troubleshooting Page](https://ranchermanager.docs.rancher.com/troubleshooting/general-troubleshooting)
***All of these instructions are defined in detailed in the [Rancher Documentation](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#install-the-rancher-helm-chart).***
### Helm Chart Options for Kubernetes Installations
The full [Helm Chart Options](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-references/helm-chart-options) can be found here.
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
#### Common Options
| Parameter | Default Value | Description |
| ------------------------- | ------------- | -------------------------------------------------------------------------------------------- |
| `hostname` | " " | ***string*** - the Fully Qualified Domain Name for your Rancher Server |
| `ingress.tls.source` | "rancher" | ***string*** - Where to get the cert for the ingress. - "***rancher, letsEncrypt, secret***" |
| `letsEncrypt.email` | " " | ***string*** - Your email address |
| `letsEncrypt.environment` | "production" | ***string*** - Valid options: "***staging, production***" |
| `privateCA` | false | ***bool*** - Set to true if your cert is signed by a private CA |
#### Advanced Options
| Parameter | Default Value | Description |
| ---------------------------------------- | ------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `additionalTrustedCAs` | false | ***bool*** - [See Additional Trusted CAs Server](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-references/helm-chart-options#additional-trusted-cas) |
| `addLocal` | "true" | ***string*** - As of Rancher v2.5.0 this flag is deprecated and must be set to "true" |
| `antiAffinity` | "preferred" | ***string*** - AntiAffinity rule for Rancher pods - *"preferred, required"* |
| `replicas` | 3 | ***int*** - Number of replicas of Rancher pods |
| `auditLog.destination` | "sidecar" | ***string*** - Stream to sidecar container console or hostPath volume - *"sidecar, hostPath"* |
| `auditLog.hostPath` | "/var/log/rancher/audit" | ***string*** - log file destination on host (only applies when **auditLog.destination** is set to **hostPath**) |
| `auditLog.level` | 0 | ***int*** - set the [API Audit Log level](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#audit-log-levels). 0 is off. [0-3] |
| `auditLog.maxAge` | 1 | ***int*** - maximum number of days to retain old audit log files (only applies when **auditLog.destination** is set to **hostPath**) |
| `auditLog.maxBackup` | 1 | int - maximum number of audit log files to retain (only applies when **auditLog.destination** is set to **hostPath**) |
| `auditLog.maxSize` | 100 | ***int*** - maximum size in megabytes of the audit log file before it gets rotated (only applies when **auditLog.destination** is set to **hostPath**) |
| `auditLog.image.repository` | "rancher/mirrored-bci-micro" | ***string*** - Location for the image used to collect audit logs *Note: Available as of v2.7.0* |
| `auditLog.image.tag` | "15.4.14.3" | ***string*** - Tag for the image used to collect audit logs *Note: Available as of v2.7.0* |
| `auditLog.image.pullPolicy` | "IfNotPresent" | ***string*** - Override imagePullPolicy for auditLog images - *"Always", "Never", "IfNotPresent"* *Note: Available as of v2.7.0* |
| `busyboxImage` | "" | ***string*** - *Deprecated `auditlog.image.repository` should be used to control auditing sidecar image.* Image location for busybox image used to collect audit logs *Note: Available as of v2.2.0, and Deprecated as of v2.7.0* |
| `busyboxImagePullPolicy` | "IfNotPresent" | ***string*** - - *Deprecated `auditlog.image.pullPolicy` should be used to control auditing sidecar image.* Override imagePullPolicy for busybox images - *"Always", "Never", "IfNotPresent"* *Deprecated as of v2.7.0* |
| `debug` | false | ***bool*** - set debug flag on rancher server |
| `certmanager.version` | " " | ***string*** - set cert-manager compatibility |
| `extraEnv` | [] | ***list*** - set additional environment variables for Rancher Note: *Available as of v2.2.0* |
| `imagePullSecrets` | [] | ***list*** - list of names of Secret resource containing private registry credentials |
| `ingress.enabled` | true | ***bool*** - install ingress resource |
| `ingress.ingressClassName` | " " | ***string*** - class name of ingress if not set manually or by the ingress controller's defaults |
| `ingress.includeDefaultExtraAnnotations` | true | ***bool*** - Add default nginx annotations |
| `ingress.extraAnnotations` | {} | ***map*** - additional annotations to customize the ingress |
| `ingress.configurationSnippet` | " " | ***string*** - Add additional Nginx configuration. Can be used for proxy configuration. Note: *Available as of v2.0.15, v2.1.10 and v2.2.4* |
| `service.annotations` | {} | ***map*** - annotations to customize the service |
| `service.type` | " " | ***string*** - Override the type used for the service - *"NodePort", "LoadBalancer", "ClusterIP"* |
| `letsEncrypt.ingress.class` | " " | ***string*** - optional ingress class for the cert-manager acmesolver ingress that responds to the Let’s *Encrypt ACME challenges* |
| `proxy` | " " | ***string** - HTTP[S] proxy server for Rancher |
| `noProxy` | "127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local" | ***string*** - comma separated list of hostnames or ip address not to use the proxy |
| `resources` | {} | ***map*** - rancher pod resource requests & limits |
| `rancherImage` | "rancher/rancher" | ***string*** - rancher image source |
| `rancherImageTag` | same as chart version | ***string*** - rancher/rancher image tag |
| `rancherImagePullPolicy` | "IfNotPresent" | ***string*** - Override imagePullPolicy for rancher server images - *"Always", "Never", "IfNotPresent"* |
| `tls` | "ingress" | ***string*** - See External TLS Termination for details. - *"ingress, external"* |
| `systemDefaultRegistry` | "" | ***string*** - private registry to be used for all system Docker images, e.g., [http://registry.example.com/] *Available as of v2.3.0* |
| `useBundledSystemChart` | false | ***bool*** - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. *Available as of v2.3.0* |
| `customLogos.enabled` | false | ***bool*** - Enabled [Ember Rancher UI (cluster manager) custom logos](https://github.com/rancher/ui/tree/master/public/assets/images/logos) and [Vue Rancher UI (cluster explorer) custom logos](https://github.com/rancher/dashboard/tree/master/shell/assets/images/pl) persistence volume |
| `customLogos.volumeSubpaths.emberUi` | "ember" | ***string*** - Volume subpath for [Ember Rancher UI (cluster manager) custom logos](https://github.com/rancher/ui/tree/master/public/assets/images/logos) persistence |
| `customLogos.volumeSubpaths.vueUi` | "vue" | ***string*** - Volume subpath for [Vue Rancher UI (cluster explorer) custom logos](https://github.com/rancher/dashboard/tree/master/shell/assets/images/pl) persistence |
| `customLogos.volumeName` | "" | ***string*** - Use an existing volume. Custom logos should be copied to the proper `volume/subpath` folder by the user. Optional for persistentVolumeClaim, required for configMap |
| `customLogos.storageClass` | "" | ***string*** - Set custom logos persistentVolumeClaim storage class. Required for dynamic pv |
| `customLogos.accessMode` | "ReadWriteOnce" | ***string*** - Set custom persistentVolumeClaim access mode |
| `customLogos.size` | "1Gi" | ***string*** - Set custom persistentVolumeClaim size |

64
on-premise/main/rancher_v2.9.1/rancher/cattle-system.json Normal file
View File

@ -0,0 +1,64 @@
{
"apiVersion": "v1",
"kind": "Namespace",
"metadata": {
"annotations": {
"cattle.io/status": "{\"Conditions\":[{\"Type\":\"ResourceQuotaInit\",\"Status\":\"True\",\"Message\":\"\",\"LastUpdateTime\":\"2024-10-14T01:51:04Z\"},{\"Type\":\"InitialRolesPopulated\",\"Status\":\"True\",\"Message\":\"\",\"LastUpdateTime\":\"2024-10-14T01:51:09Z\"}]}",
"field.cattle.io/projectId": "local:p-2mvh7",
"lifecycle.cattle.io/create.namespace-auth": "true",
"management.cattle.io/no-default-sa-token": "true"
},
"creationTimestamp": "2024-10-14T01:46:51Z",
"deletionTimestamp": "2024-10-14T01:54:44Z",
"finalizers": [
],
"labels": {
"field.cattle.io/projectId": "p-2mvh7",
"kubernetes.io/metadata.name": "cattle-system"
},
"name": "cattle-system",
"resourceVersion": "4398991",
"uid": "bc99e08c-67a1-40ed-8106-9cc109e2f6a1"
},
"spec": {},
"status": {
"conditions": [
{
"lastTransitionTime": "2024-10-14T01:54:50Z",
"message": "All resources successfully discovered",
"reason": "ResourcesDiscovered",
"status": "False",
"type": "NamespaceDeletionDiscoveryFailure"
},
{
"lastTransitionTime": "2024-10-14T01:54:50Z",
"message": "All legacy kube types successfully parsed",
"reason": "ParsedGroupVersions",
"status": "False",
"type": "NamespaceDeletionGroupVersionParsingFailure"
},
{
"lastTransitionTime": "2024-10-14T01:54:50Z",
"message": "All content successfully deleted, may be waiting on finalization",
"reason": "ContentDeleted",
"status": "False",
"type": "NamespaceDeletionContentFailure"
},
{
"lastTransitionTime": "2024-10-14T01:54:50Z",
"message": "All content successfully removed",
"reason": "ContentRemoved",
"status": "False",
"type": "NamespaceContentRemaining"
},
{
"lastTransitionTime": "2024-10-14T01:54:50Z",
"message": "All content-preserving finalizers finished",
"reason": "ContentHasNoFinalizers",
"status": "False",
"type": "NamespaceFinalizersRemaining"
}
],
"phase": "Terminating"
}
}

31
on-premise/main/rancher_v2.9.1/rancher/ing.yaml Normal file
View File

@ -0,0 +1,31 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ing-rancher
namespace: cattle-system
labels:
app: release-name-rancher
release: release-name
annotations:
nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"
nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"
spec:
ingressClassName: nginx
rules:
- host: rancher.inje-private.com # hostname to access rancher server
http:
paths:
- backend:
service:
name: rancher
port:
number: 80
pathType: ImplementationSpecific
path: /
tls:
- hosts:
- rancher.inje-private.com
secretName: cattle-ssl

BIN
on-premise/main/rancher_v2.9.1/rancher/rancher-2.9.1.tgz Normal file
View File

Binary file not shown.

94
on-premise/main/rancher_v2.9.1/rancher/scripts/post-delete-hook.sh Normal file
View File

@ -0,0 +1,94 @@
#!/bin/bash
set -e
namespaces="${NAMESPACES}"
rancher_namespace="${RANCHER_NAMESPACE}"
timeout="${TIMEOUT}"
ignoreTimeoutError="${IGNORETIMEOUTERROR}"
if [[ -z ${namespaces} ]]; then
echo "No namespace is provided."
exit 1
fi
if [[ -z ${rancher_namespace} ]]; then
echo "No rancher namespace is provided."
exit 1
fi
if [[ -z ${timeout} ]]; then
echo "No timeout value is provided."
exit 1
fi
if [[ -z ${ignoreTimeoutError} ]]; then
echo "No ignoreTimeoutError value is provided."
exit 1
fi
succeeded=()
failed=()
get_pod_count() {
kubectl get pods --selector app="${1}" -n "${2}" -o json | jq '.items | length'
}
echo "Uninstalling Rancher resources in the following namespaces: ${namespaces}"
for namespace in ${namespaces}; do
for app in $(helm list -n "${namespace}" -q); do
if [[ ${app} =~ .crd$ ]]; then
echo "--- Skip the app [${app}] in the namespace [${namespace}]"
continue
fi
echo "--- Deleting the app [${app}] in the namespace [${namespace}]"
if [[ ! $(helm uninstall "${app}" -n "${namespace}") ]]; then
failed=("${failed[@]}" "${app}")
continue
fi
t=0
while true; do
if [[ $(get_pod_count "${app}" "${namespace}") -eq 0 ]]; then
echo "successfully uninstalled [${app}] in the namespace [${namespace}]"
succeeded=("${succeeded[@]}" "${app}")
break
fi
if [[ ${t} -ge ${timeout} ]]; then
echo "timeout uninstalling [${app}] in the namespace [${namespace}]"
failed=("${failed[@]}" "${app}")
break
fi
# by default, wait 120 seconds in total for an app to be uninstalled
echo "waiting 5 seconds for pods of [${app}] to be terminated ..."
sleep 5
t=$((t + 5))
done
done
# delete the helm operator pods
for pod in $(kubectl get pods -n "${namespace}" -o name); do
if [[ ${pod} =~ ^pod\/helm-operation-* ]]; then
echo "--- Deleting the pod [${pod}] in the namespace [${namespace}]"
kubectl delete "${pod}" -n "${namespace}"
fi
done
done
echo "Removing Rancher bootstrap secret in the following namespace: ${rancher_namespace}"
kubectl --ignore-not-found=true delete secret bootstrap-secret -n "${rancher_namespace}"
echo "------ Summary ------"
if [[ ${#succeeded[@]} -ne 0 ]]; then
echo "Succeeded to uninstall the following apps:" "${succeeded[@]}"
fi
if [[ ${#failed[@]} -ne 0 ]]; then
echo "Failed to uninstall the following apps:" "${failed[@]}"
if [[ "${ignoreTimeoutError}" == "false" ]]; then
exit 2
fi
else
echo "Cleanup finished successfully."
fi

22
on-premise/main/rancher_v2.9.1/rancher/templates/NOTES.txt Normal file
View File

@ -0,0 +1,22 @@
Rancher Server has been installed.
NOTE: Rancher may take several minutes to fully initialize. Please standby while Certificates are being issued, Containers are started and the Ingress rule comes up.
Check out our docs at https://rancher.com/docs/
If you provided your own bootstrap password during installation, browse to https://{{ .Values.hostname }} to get started.
If this is the first time you installed Rancher, get started by running this command and clicking the URL it generates:
```
echo https://{{ .Values.hostname }}/dashboard/?setup=$(kubectl get secret --namespace cattle-system bootstrap-secret -o go-template='{{ "{{" }}.data.bootstrapPassword|base64decode{{ "}}" }}')
```
To get just the bootstrap password on its own, run:
```
kubectl get secret --namespace cattle-system bootstrap-secret -o go-template='{{ "{{" }}.data.bootstrapPassword|base64decode{{ "}}" }}{{ "{{" }} "\n" {{ "}}" }}'
```
Happy Containering!

76
on-premise/main/rancher_v2.9.1/rancher/templates/_helpers.tpl Normal file
View File

@ -0,0 +1,76 @@
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "rancher.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "rancher.fullname" -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{/*
Create a default fully qualified chart name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "rancher.chartname" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | trunc 63 | trimSuffix "-" -}}
{{- end -}}
# Render Values in configurationSnippet
{{- define "configurationSnippet" -}}
{{- tpl (.Values.ingress.configurationSnippet) . | nindent 6 -}}
{{- end -}}
{{/*
Generate the labels.
*/}}
{{- define "rancher.labels" -}}
app: {{ template "rancher.fullname" . }}
chart: {{ template "rancher.chartname" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
{{- end }}
# Windows Support
{{/*
Windows cluster will add default taint for linux nodes,
add below linux tolerations to workloads could be scheduled to those linux nodes
*/}}
{{- define "linux-node-tolerations" -}}
- key: "cattle.io/os"
value: "linux"
effect: "NoSchedule"
operator: "Equal"
{{- end -}}
{{- define "linux-node-selector-terms" -}}
{{- $key := "kubernetes.io/os" -}}
- matchExpressions:
- key: {{ $key }}
operator: NotIn
values:
- windows
{{- end -}}
{{- define "system_default_registry" -}}
{{- if .Values.systemDefaultRegistry -}}
{{- if hasSuffix "/" .Values.systemDefaultRegistry -}}
{{- printf "%s" .Values.systemDefaultRegistry -}}
{{- else -}}
{{- printf "%s/" .Values.systemDefaultRegistry -}}
{{- end -}}
{{- end -}}
{{- end -}}

14
on-premise/main/rancher_v2.9.1/rancher/templates/clusterRoleBinding.yaml Normal file
View File

@ -0,0 +1,14 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ template "rancher.fullname" . }}
labels:
{{ include "rancher.labels" . | indent 4 }}
subjects:
- kind: ServiceAccount
name: {{ template "rancher.fullname" . }}
namespace: {{ .Release.Namespace }}
roleRef:
kind: ClusterRole
name: cluster-admin
apiGroup: rbac.authorization.k8s.io

18
on-premise/main/rancher_v2.9.1/rancher/templates/configMap.yaml Normal file
View File

@ -0,0 +1,18 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: rancher-config
labels: {{ include "rancher.labels" . | nindent 4 }}
app.kubernetes.io/part-of: "rancher"
data:
priorityClassName: {{ .Values.priorityClassName }}
{{- if and .Values.webhook (kindIs "string" .Values.webhook) }}
rancher-webhook: {{ .Values.webhook | quote }}
{{- else if .Values.webhook }}
rancher-webhook: {{ toYaml .Values.webhook | quote }}
{{- end }}
{{- if and .Values.fleet (kindIs "string" .Values.fleet) }}
fleet: {{ .Values.fleet | quote }}
{{- else if .Values.fleet }}
fleet: {{ toYaml .Values.fleet | quote }}
{{- end }}

264
on-premise/main/rancher_v2.9.1/rancher/templates/deployment.yaml Normal file
View File

@ -0,0 +1,264 @@
kind: Deployment
apiVersion: apps/v1
metadata:
name: {{ template "rancher.fullname" . }}
annotations:
{{- if (lt (int .Values.replicas) 0) }}
management.cattle.io/scale-available: "{{ sub 0 (int .Values.replicas)}}"
{{- end }}
labels:
{{ include "rancher.labels" . | indent 4 }}
spec:
{{- if (gt (int .Values.replicas) 0) }}
replicas: {{ .Values.replicas }}
{{- end }}
selector:
matchLabels:
app: {{ template "rancher.fullname" . }}
strategy:
rollingUpdate:
maxSurge: 1
{{- if (eq (int .Values.replicas) 1) }}
maxUnavailable: 0
{{- else }}
maxUnavailable: 1
{{- end }}
type: RollingUpdate
template:
metadata:
labels:
app: {{ template "rancher.fullname" . }}
release: {{ .Release.Name }}
spec:
priorityClassName: {{ .Values.priorityClassName }}
serviceAccountName: {{ template "rancher.fullname" . }}
{{- if .Values.imagePullSecrets }}
imagePullSecrets:
{{ toYaml .Values.imagePullSecrets | indent 6 }}
{{- end }}
affinity:
podAntiAffinity:
{{- if eq .Values.antiAffinity "required" }}
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchExpressions:
- key: app
operator: In
values:
- {{ template "rancher.fullname" . }}
topologyKey: {{ .Values.topologyKey | default "kubernetes.io/hostname" }}
{{- else }}
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 100
podAffinityTerm:
labelSelector:
matchExpressions:
- key: app
operator: In
values:
- {{ template "rancher.fullname" . }}
topologyKey: {{ .Values.topologyKey | default "kubernetes.io/hostname" }}
{{- end }}
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms: {{ include "linux-node-selector-terms" . | nindent 14 }}
tolerations: {{ include "linux-node-tolerations" . | nindent 8 }}
containers:
- image: {{ .Values.rancherImage }}:{{ default .Chart.AppVersion .Values.rancherImageTag }}
imagePullPolicy: {{ default "IfNotPresent" .Values.rancherImagePullPolicy }}
name: {{ template "rancher.name" . }}
ports:
- containerPort: 80
protocol: TCP
{{- if (and .Values.hostPort (gt (int .Values.hostPort) 0)) }}
- containerPort: 444
hostPort: {{ int .Values.hostPort }}
protocol: TCP
{{- end}}
args:
{{- if .Values.debug }}
- "--debug"
{{- end }}
{{- if .Values.privateCA }}
# Private CA - don't clear ca certs
{{- else if and (eq .Values.tls "ingress") (eq .Values.ingress.tls.source "rancher") }}
# Rancher self-signed - don't clear ca certs
{{- else }}
# Public trusted CA - clear ca certs
- "--no-cacerts"
{{- end }}
- "--http-listen-port=80"
- "--https-listen-port=443"
- "--add-local={{ .Values.addLocal }}"
env:
- name: CATTLE_NAMESPACE
value: {{ .Release.Namespace }}
- name: CATTLE_PEER_SERVICE
value: {{ template "rancher.fullname" . }}
{{- if .Values.features }}
- name: CATTLE_FEATURES
value: "{{ .Values.features }}"
{{- end}}
{{- if .Values.noDefaultAdmin }}
- name: CATTLE_NO_DEFAULT_ADMIN
value: "{{ .Values.noDefaultAdmin }}"
{{- end}}
{{- if gt (int .Values.auditLog.level) 0 }}
- name: AUDIT_LEVEL
value: {{ .Values.auditLog.level | quote }}
- name: AUDIT_LOG_MAXAGE
value: {{ .Values.auditLog.maxAge | quote }}
- name: AUDIT_LOG_MAXBACKUP
value: {{ .Values.auditLog.maxBackup | quote }}
- name: AUDIT_LOG_MAXSIZE
value: {{ .Values.auditLog.maxSize | quote }}
{{- end }}
{{- if .Values.proxy }}
- name: HTTP_PROXY
value: {{ .Values.proxy }}
- name: HTTPS_PROXY
value: {{ .Values.proxy }}
- name: NO_PROXY
value: {{ .Values.noProxy }}
{{- end }}
{{- if .Values.systemDefaultRegistry }}
- name: CATTLE_SYSTEM_DEFAULT_REGISTRY
value: {{ .Values.systemDefaultRegistry }}
{{- end }}
{{- if .Values.useBundledSystemChart }}
- name: CATTLE_SYSTEM_CATALOG
value: bundled
{{- end }}
{{- if .Values.restrictedAdmin }}
- name: CATTLE_RESTRICTED_DEFAULT_ADMIN
value: "true"
{{- end}}
{{- if .Values.bootstrapPassword }}
- name: CATTLE_BOOTSTRAP_PASSWORD
valueFrom:
secretKeyRef:
name: "bootstrap-secret"
key: "bootstrapPassword"
{{- end }}
{{- if .Values.agentTLSMode }}
- name: CATTLE_AGENT_TLS_MODE
value: "{{ .Values.agentTLSMode }}"
{{- end }}
{{- if .Values.extraEnv }}
{{ toYaml .Values.extraEnv | indent 8}}
{{- end }}
startupProbe:
httpGet:
path: /healthz
port: 80
timeoutSeconds: {{ .Values.startupProbe.timeoutSeconds }}
failureThreshold: {{ .Values.startupProbe.failureThreshold }}
periodSeconds: {{ .Values.startupProbe.periodSeconds }}
livenessProbe:
httpGet:
path: /healthz
port: 80
{{- with .Values.livenessProbe.initialDelaySeconds}}
initialDelaySeconds: {{ . }}
{{- end }}
timeoutSeconds: {{.Values.livenessProbe.timeoutSeconds }}
periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
failureThreshold: {{.Values.livenessProbe.failureThreshold }}
readinessProbe:
httpGet:
path: /healthz
port: 80
{{- with .Values.readinessProbe.initialDelaySeconds}}
initialDelaySeconds: {{ . }}
{{- end }}
timeoutSeconds: {{.Values.readinessProbe.timeoutSeconds }}
periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
failureThreshold: {{.Values.readinessProbe.failureThreshold }}
resources:
{{ toYaml .Values.resources | indent 10 }}
volumeMounts:
{{- if .Values.additionalTrustedCAs }}
- mountPath: /etc/pki/trust/anchors/ca-additional.pem
name: tls-ca-additional-volume
subPath: ca-additional.pem
readOnly: true
- mountPath: /etc/rancher/ssl/ca-additional.pem
name: tls-ca-additional-volume
subPath: ca-additional.pem
readOnly: true
{{- end }}
{{- if .Values.privateCA }}
# Pass CA cert into rancher for private CA
- mountPath: /etc/rancher/ssl/cacerts.pem
name: tls-ca-volume
subPath: cacerts.pem
readOnly: true
{{- end }}
{{- if and .Values.customLogos.enabled (or (eq .Values.customLogos.volumeKind "persistentVolumeClaim") (and (eq .Values.customLogos.volumeKind "configMap") (.Values.customLogos.volumeName))) }}
# Mount rancher custom-logos volume
- mountPath: /usr/share/rancher/ui/assets/images/logos
name: custom-logos
subPath: {{ .Values.customLogos.volumeSubpaths.emberUi | default "ember" | quote }}
- mountPath: /usr/share/rancher/ui-dashboard/dashboard/_nuxt/assets/images/pl
name: custom-logos
subPath: {{ .Values.customLogos.volumeSubpaths.vueUi | default "vue" | quote }}
{{- end }}
{{- if gt (int .Values.auditLog.level) 0 }}
- mountPath: /var/log/auditlog
name: audit-log
{{- end }}
{{- if eq .Values.auditLog.destination "sidecar" }}
{{- if gt (int .Values.auditLog.level) 0 }}
# Make audit logs available for Rancher log collector tools.
{{- if .Values.busyboxImage }}
- image: {{ .Values.busyboxImage}}
{{- else }}
- image: {{ .Values.auditLog.image.repository }}:{{.Values.auditLog.image.tag}}
{{- end }}
{{- if .Values.busyboxImagePullPolicy }}
imagePullPolicy: {{ .Values.busyboxImagePullPolicy }}
{{- else }}
imagePullPolicy: {{ .Values.auditLog.image.pullPolicy }}
{{- end }}
name: {{ template "rancher.name" . }}-audit-log
command: ["tail"]
args: ["-F", "/var/log/auditlog/rancher-api-audit.log"]
volumeMounts:
- mountPath: /var/log/auditlog
name: audit-log
{{- end }}
{{- end }}
volumes:
{{- if .Values.additionalTrustedCAs }}
- name: tls-ca-additional-volume
secret:
defaultMode: 0400
secretName: tls-ca-additional
{{- end }}
{{- if .Values.privateCA }}
- name: tls-ca-volume
secret:
defaultMode: 0400
secretName: tls-ca
{{- end }}
{{- if gt (int .Values.auditLog.level) 0 }}
{{- if eq .Values.auditLog.destination "hostPath" }}
- name: audit-log
hostPath:
path: {{ .Values.auditLog.hostPath }}
type: DirectoryOrCreate
{{- else }}
- name: audit-log
emptyDir: {}
{{- end }}
{{- end }}
{{- if and .Values.customLogos.enabled (or (eq .Values.customLogos.volumeKind "persistentVolumeClaim") (and (eq .Values.customLogos.volumeKind "configMap") (.Values.customLogos.volumeName))) }}
- name: custom-logos
{{- if (eq .Values.customLogos.volumeKind "persistentVolumeClaim") }}
persistentVolumeClaim:
claimName: {{ .Values.customLogos.volumeName | default (printf "%s-custom-logos" (include "rancher.fullname" .)) }}
{{- else if (eq .Values.customLogos.volumeKind "configMap") }}
configMap:
name: {{ .Values.customLogos.volumeName }}
{{- end }}
{{- end }}

66
on-premise/main/rancher_v2.9.1/rancher/templates/ingress.yaml Normal file
View File

@ -0,0 +1,66 @@
{{- if .Values.ingress.enabled }}
{{- if or (.Capabilities.APIVersions.Has "networking.k8s.io/v1/Ingress") (not (.Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/Ingress")) }}
apiVersion: networking.k8s.io/v1
{{- else }}
apiVersion: networking.k8s.io/v1beta1
{{- end }}
kind: Ingress
metadata:
name: {{ template "rancher.fullname" . }}
labels:
{{ include "rancher.labels" . | indent 4 }}
annotations:
{{- if .Values.ingress.configurationSnippet }}
nginx.ingress.kubernetes.io/configuration-snippet: |
{{- template "configurationSnippet" . }}
{{- end }}
{{- if eq .Values.tls "external" }}
nginx.ingress.kubernetes.io/ssl-redirect: "false" # turn off ssl redirect for external.
{{- else }}
{{- if ne .Values.ingress.tls.source "secret" }}
{{- $certmanagerVer := split "." .Values.certmanager.version -}}
{{- if or (.Capabilities.APIVersions.Has "certmanager.k8s.io/v1alpha1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (lt (int $certmanagerVer._1) 11)) }}
certmanager.k8s.io/issuer: {{ template "rancher.fullname" . }}
{{- else }}
cert-manager.io/issuer: {{ template "rancher.fullname" . }}
cert-manager.io/issuer-kind: Issuer
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.ingress.includeDefaultExtraAnnotations }}
nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"
nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"
{{- end }}
{{- if .Values.ingress.extraAnnotations }}
{{ toYaml .Values.ingress.extraAnnotations | indent 4 }}
{{- end }}
spec:
{{- if .Values.ingress.ingressClassName }}
ingressClassName: {{ .Values.ingress.ingressClassName }}
{{- end }}
rules:
- host: {{ .Values.hostname }} # hostname to access rancher server
http:
paths:
- backend:
{{- if or (.Capabilities.APIVersions.Has "networking.k8s.io/v1/Ingress") (not (.Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/Ingress")) }}
service:
name: {{ template "rancher.fullname" . }}
port:
number: {{ .Values.ingress.servicePort }}
{{- else }}
serviceName: {{ template "rancher.fullname" . }}
servicePort: {{ .Values.ingress.servicePort }}
{{- end }}
{{- if or (.Capabilities.APIVersions.Has "networking.k8s.io/v1/Ingress") (not (.Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/Ingress")) }}
pathType: {{ .Values.ingress.pathType }}
path: {{ .Values.ingress.path }}
{{- end }}
{{- if eq .Values.tls "ingress" }}
tls:
- hosts:
- {{ .Values.hostname }}
secretName: {{ .Values.ingress.tls.secretName }}
{{- end }}
{{- end }}

37
on-premise/main/rancher_v2.9.1/rancher/templates/issuer-letsEncrypt.yaml Normal file
View File

@ -0,0 +1,37 @@
{{- if eq .Values.tls "ingress" -}}
{{- if eq .Values.ingress.tls.source "letsEncrypt" -}}
{{- $certmanagerVer := split "." .Values.certmanager.version -}}
{{- if or (.Capabilities.APIVersions.Has "cert-manager.io/v1beta1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 16)) }}
apiVersion: cert-manager.io/v1beta1
{{- else if or (.Capabilities.APIVersions.Has "cert-manager.io/v1alpha2") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 11)) }}
apiVersion: cert-manager.io/v1alpha2
{{- else if or (.Capabilities.APIVersions.Has "certmanager.k8s.io/v1alpha1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (lt (int $certmanagerVer._1) 11)) }}
apiVersion: certmanager.k8s.io/v1alpha1
{{- else }}
apiVersion: cert-manager.io/v1
{{- end }}
kind: Issuer
metadata:
name: {{ template "rancher.fullname" . }}
labels:
{{ include "rancher.labels" . | indent 4 }}
spec:
acme:
{{- if eq .Values.letsEncrypt.environment "production" }}
server: https://acme-v02.api.letsencrypt.org/directory
{{- else }}
server: https://acme-staging-v02.api.letsencrypt.org/directory
{{- end }}
email: {{ .Values.letsEncrypt.email }}
privateKeySecretRef:
name: letsencrypt-{{ .Values.letsEncrypt.environment }}
{{- if or (.Capabilities.APIVersions.Has "certmanager.k8s.io/v1alpha1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (lt (int $certmanagerVer._1) 11)) }}
http01: {}
{{- else }}
solvers:
- http01:
ingress:
class: {{ .Values.letsEncrypt.ingress.class }}
{{- end }}
{{- end -}}
{{- end -}}

22
on-premise/main/rancher_v2.9.1/rancher/templates/issuer-rancher.yaml Normal file
View File

@ -0,0 +1,22 @@
{{- if eq .Values.tls "ingress" -}}
{{- if eq .Values.ingress.tls.source "rancher" -}}
{{- $certmanagerVer := split "." .Values.certmanager.version -}}
{{- if or (.Capabilities.APIVersions.Has "cert-manager.io/v1beta1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 16)) }}
apiVersion: cert-manager.io/v1beta1
{{- else if or (.Capabilities.APIVersions.Has "cert-manager.io/v1alpha2") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 11)) }}
apiVersion: cert-manager.io/v1alpha2
{{- else if or (.Capabilities.APIVersions.Has "certmanager.k8s.io/v1alpha1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (lt (int $certmanagerVer._1) 11)) }}
apiVersion: certmanager.k8s.io/v1alpha1
{{- else }}
apiVersion: cert-manager.io/v1
{{- end }}
kind: Issuer
metadata:
name: {{ template "rancher.fullname" . }}
labels:
{{ include "rancher.labels" . | indent 4 }}
spec:
ca:
secretName: tls-rancher
{{- end -}}
{{- end -}}

19
on-premise/main/rancher_v2.9.1/rancher/templates/post-delete-hook-cluster-role-binding.yaml Normal file
View File

@ -0,0 +1,19 @@
{{- if .Values.postDelete.enabled }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: {{ template "rancher.fullname" . }}-post-delete
labels: {{ include "rancher.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": post-delete
"helm.sh/hook-weight": "2"
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{ template "rancher.fullname" . }}-post-delete
subjects:
- kind: ServiceAccount
name: {{ template "rancher.fullname" . }}-post-delete
namespace: {{ .Release.Namespace }}
{{- end }}

39
on-premise/main/rancher_v2.9.1/rancher/templates/post-delete-hook-cluster-role.yaml Normal file
View File

@ -0,0 +1,39 @@
{{- if .Values.postDelete.enabled }}
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ template "rancher.fullname" . }}-post-delete
labels: {{ include "rancher.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": post-delete
"helm.sh/hook-weight": "1"
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
rules:
- apiGroups: [ "extensions","apps" ]
resources: [ "deployments" ]
verbs: [ "get", "list", "delete" ]
- apiGroups: [ "batch" ]
resources: [ "jobs" ]
verbs: [ "get", "list", "watch", "delete", "create" ]
- apiGroups: [ "rbac.authorization.k8s.io" ]
resources: [ "clusterroles", "clusterrolebindings", "roles", "rolebindings" ]
verbs: [ "get", "list", "delete", "create" ]
- apiGroups: [ "" ]
resources: [ "pods", "secrets", "services", "configmaps" ]
verbs: [ "get", "list", "delete" ]
- apiGroups: [ "" ]
resources: [ "serviceaccounts" ]
verbs: [ "get", "list", "delete", "create" ]
- apiGroups: [ "networking.k8s.io" ]
resources: [ "networkpolicies" ]
verbs: [ "get", "list", "delete" ]
- apiGroups: [ "admissionregistration.k8s.io" ]
resources: [ "validatingwebhookconfigurations", "mutatingwebhookconfigurations" ]
verbs: [ "get", "list", "delete" ]
- apiGroups: [ "networking.k8s.io" ]
resources: [ "ingresses" ]
verbs: [ "delete" ]
- apiGroups: [ "cert-manager.io" ]
resources: [ "issuers" ]
verbs: [ "delete" ]
{{- end }}

15
on-premise/main/rancher_v2.9.1/rancher/templates/post-delete-hook-config-map.yaml Normal file
View File

@ -0,0 +1,15 @@
{{- if .Values.postDelete.enabled }}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ template "rancher.fullname" . }}-post-delete
namespace: {{ .Release.Namespace }}
labels: {{ include "rancher.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": post-delete
"helm.sh/hook-weight": "1"
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
data:
post-delete-hook.sh: |-
{{ $.Files.Get "scripts/post-delete-hook.sh" | indent 4 }}
{{- end }}

46
on-premise/main/rancher_v2.9.1/rancher/templates/post-delete-hook-job.yaml Normal file
View File

@ -0,0 +1,46 @@
{{- if .Values.postDelete.enabled }}
apiVersion: batch/v1
kind: Job
metadata:
name: {{ template "rancher.fullname" . }}-post-delete
namespace: {{ .Release.Namespace }}
labels: {{ include "rancher.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": post-delete
"helm.sh/hook-weight": "3"
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
spec:
backoffLimit: 3
template:
metadata:
name: {{ template "rancher.fullname" . }}-post-delete
labels: {{ include "rancher.labels" . | nindent 8 }}
spec:
serviceAccountName: {{ template "rancher.fullname" . }}-post-delete
restartPolicy: OnFailure
containers:
- name: {{ template "rancher.name" . }}-post-delete
image: "{{ include "system_default_registry" . }}{{ .Values.postDelete.image.repository }}:{{ .Values.postDelete.image.tag }}"
imagePullPolicy: IfNotPresent
securityContext:
runAsUser: 0
command:
- /scripts/post-delete-hook.sh
volumeMounts:
- mountPath: /scripts
name: config-volume
env:
- name: NAMESPACES
value: {{ .Values.postDelete.namespaceList | join " " | quote }}
- name: RANCHER_NAMESPACE
value: {{ .Release.Namespace }}
- name: TIMEOUT
value: {{ .Values.postDelete.timeout | quote }}
- name: IGNORETIMEOUTERROR
value: {{ .Values.postDelete.ignoreTimeoutError | quote }}
volumes:
- name: config-volume
configMap:
name: {{ template "rancher.fullname" . }}-post-delete
defaultMode: 0777
{{- end }}

12
on-premise/main/rancher_v2.9.1/rancher/templates/post-delete-hook-service-account.yaml Normal file
View File

@ -0,0 +1,12 @@
{{- if .Values.postDelete.enabled }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ template "rancher.fullname" . }}-post-delete
namespace: {{ .Release.Namespace }}
labels: {{ include "rancher.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": post-delete
"helm.sh/hook-weight": "1"
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
{{- end }}

8
on-premise/main/rancher_v2.9.1/rancher/templates/priorityClass.yaml Normal file
View File

@ -0,0 +1,8 @@
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
name: rancher-critical
labels: {{ include "rancher.labels" . | nindent 4 }}
value: 1000000000
globalDefault: false
description: "Priority class used by pods critical to rancher's functionality."

19
on-premise/main/rancher_v2.9.1/rancher/templates/pvc.yaml Normal file
View File

@ -0,0 +1,19 @@
{{- if and (.Values.customLogos.enabled) (eq .Values.customLogos.volumeKind "persistentVolumeClaim") (not .Values.customLogos.volumeName) }}
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: {{ template "rancher.fullname" . }}-custom-logos
spec:
accessModes:
- {{ .Values.customLogos.accessMode | quote }}
resources:
requests:
storage: {{ .Values.customLogos.size | quote }}
storageClassName: {{ if .Values.customLogos.storageClass }}
{{- if (eq "-" .Values.customLogos.storageClass) -}}
""
{{- else }}
{{- .Values.customLogos.storageClass }}
{{- end -}}
{{- end }}
{{- end }}

25
on-premise/main/rancher_v2.9.1/rancher/templates/secret.yaml Normal file
View File

@ -0,0 +1,25 @@
{{/* Use the bootstrap password from values.yaml if an existing secret is not found */}}
{{- $bootstrapPassword := .Values.bootstrapPassword -}}
{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace "bootstrap-secret" -}}
{{- if $existingSecret -}}
{{- if $existingSecret.data -}}
{{- if $existingSecret.data.bootstrapPassword -}}
{{- $bootstrapPassword = $existingSecret.data.bootstrapPassword | b64dec -}}
{{- end -}}
{{- end -}}
{{- end -}}
{{/* If a bootstrap password was found in the values or an existing password was found create the secret */}}
{{- if $bootstrapPassword }}
apiVersion: v1
kind: Secret
metadata:
name: "bootstrap-secret"
namespace: {{ .Release.Namespace }}
annotations:
"helm.sh/hook": pre-install,pre-upgrade
"helm.sh/hook-weight": "-5"
"helm.sh/resource-policy": keep
type: Opaque
data:
bootstrapPassword: {{ $bootstrapPassword | b64enc | quote }}
{{- end }}

28
on-premise/main/rancher_v2.9.1/rancher/templates/service.yaml Normal file
View File

@ -0,0 +1,28 @@
apiVersion: v1
kind: Service
metadata:
{{- if .Values.service.annotations }}
annotations:
{{ toYaml .Values.service.annotations | indent 4 }}
{{- end }}
name: {{ template "rancher.fullname" . }}
labels:
{{ include "rancher.labels" . | indent 4 }}
spec:
{{- /*
If service.type is not provided this attribute is ommitted and k8s default of ClusterIP is used.
*/}}
{{- if .Values.service.type }}
type: {{ .Values.service.type }}
{{- end }}
ports:
- port: 80
targetPort: 80
protocol: TCP
name: http
- port: 443
targetPort: 444
protocol: TCP
name: https-internal
selector:
app: {{ template "rancher.fullname" . }}

6
on-premise/main/rancher_v2.9.1/rancher/templates/serviceAccount.yaml Normal file
View File

@ -0,0 +1,6 @@
kind: ServiceAccount
apiVersion: v1
metadata:
name: {{ template "rancher.fullname" . }}
labels:
{{ include "rancher.labels" . | indent 4 }}

13
on-premise/main/rancher_v2.9.1/rancher/values.schema.json Normal file
View File

@ -0,0 +1,13 @@
{
"$schema": "https://json-schema.org/draft-07/schema#",
"properties": {
"agentTLSMode": {
"type": ["string", "null"],
"enum": ["strict", "system-store", "", null],
"description": "agentTLSMode must be 'strict' or 'system-store' or null (defaults to system-store)"
}
},
"required": [],
"title": "Rancher Chart Values",
"type": "object"
}

198
on-premise/main/rancher_v2.9.1/rancher/values.yaml Normal file
View File

@ -0,0 +1,198 @@
# Additional Trusted CAs.
# Enable this flag and add your CA certs as a secret named tls-ca-additional in the namespace.
# See README.md for details.
additionalTrustedCAs: false
antiAffinity: preferred
topologyKey: kubernetes.io/hostname
# Audit Logs https://rancher.com/docs/rancher/v2.x/en/installation/api-auditing/
# The audit log is piped to the console of the rancher-audit-log container in the rancher pod.
# https://rancher.com/docs/rancher/v2.x/en/installation/api-auditing/
# destination stream to sidecar container console or hostPath volume
# level: Verbosity of logs, 0 to 3. 0 is off 3 is a lot.
auditLog:
destination: sidecar
hostPath: /var/log/rancher/audit/
level: 0
maxAge: 1
maxBackup: 1
maxSize: 100
# Image for collecting rancher audit logs.
# Important: update pkg/image/export/resolve.go when this default image is changed, so that it's reflected accordingly in rancher-images.txt generated for air-gapped setups.
image:
repository: "rancher/mirrored-bci-micro"
tag: 15.4.14.3
# Override imagePullPolicy image
# options: Always, Never, IfNotPresent
pullPolicy: "IfNotPresent"
# As of Rancher v2.5.0 this flag is deprecated and must be set to 'true' in order for Rancher to start
addLocal: "true"
# Add debug flag to Rancher server
debug: false
# When starting Rancher for the first time, bootstrap the admin as restricted-admin
restrictedAdmin: false
# Control how the Rancher agents validate TLS connections
# Valid options: strict, or system-store
# Note, for new installations empty will default to strict on 2.9+, or system-store on 2.8 or older
agentTLSMode: ""
# Extra environment variables passed to the rancher pods.
# extraEnv:
# - name: CATTLE_TLS_MIN_VERSION
# value: "1.0"
# Fully qualified name to reach your Rancher server
hostname: rancher.inje-private.com
## Optional array of imagePullSecrets containing private registry credentials
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
imagePullSecrets: []
# - name: secretName
### ingress ###
# Readme for details and instruction on adding tls secrets.
ingress:
# If set to false, ingress will not be created
# Defaults to true
# options: true, false
enabled: false # by ljh true -> false
includeDefaultExtraAnnotations: true
extraAnnotations: {}
ingressClassName: ""
# Certain ingress controllers will require the pathType or path to be set to a different value.
pathType: ImplementationSpecific
path: "/"
# backend port number
servicePort: 80
# configurationSnippet - Add additional Nginx configuration. This example statically sets a header on the ingress.
# configurationSnippet: |
# more_set_input_headers "X-Forwarded-Host: {{ .Values.hostname }}";
tls:
# options: rancher, letsEncrypt, secret
source: rancher
secretName: tls-rancher-ingress
### service ###
# Override to use NodePort or LoadBalancer service type - default is ClusterIP
service:
type: ""
annotations: {}
### LetsEncrypt config ###
# ProTip: The production environment only allows you to register a name 5 times a week.
# Use staging until you have your config right.
letsEncrypt:
# email: none@example.com
environment: production
ingress:
# options: traefik, nginx
class: ""
# If you are using certs signed by a private CA set to 'true' and set the 'tls-ca'
# in the 'rancher-system' namespace. See the README.md for details
privateCA: false
# http[s] proxy server passed into rancher server.
# proxy: http://<username>@<password>:<url>:<port>
# comma separated list of domains or ip addresses that will not use the proxy
noProxy: 127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local
# Override rancher image location for Air Gap installs
rancherImage: reg.inje-private.com/nnd002/rancher/rancher #by ljh
# rancher/rancher image tag. https://hub.docker.com/r/rancher/rancher/tags/
# Defaults to .Chart.appVersion
# rancherImageTag: v2.0.7
# Override imagePullPolicy for rancher server images
# options: Always, Never, IfNotPresent
# Defaults to IfNotPresent
# rancherImagePullPolicy: <pullPolicy>
# Number of Rancher server replicas. Setting to negative number will dynamically between 0 and the abs(replicas) based on available nodes.
# of available nodes in the cluster
replicas: 3
# Set priorityClassName to avoid eviction
priorityClassName: rancher-critical
# Set pod resource requests/limits for Rancher.
resources: {}
#
# tls
# Where to offload the TLS/SSL encryption
# - ingress (default)
# - external
tls: external # by ljh
systemDefaultRegistry: ""
# Set to use the packaged system charts
useBundledSystemChart: false
# Certmanager version compatibility
certmanager:
version: ""
# Rancher custom logos persistence
customLogos:
enabled: true # by ljh
volumeSubpaths:
emberUi: "ember"
vueUi: "vue"
## Volume kind to use for persistence: persistentVolumeClaim, configMap
volumeKind: persistentVolumeClaim
## Use an existing volume. Custom logos should be copied to the volume by the user
# volumeName: custom-logos
## Just for volumeKind: persistentVolumeClaim
## To disables dynamic provisioning, set storageClass: "" or storageClass: "-"
storageClass: "sc-monitoring" # by ljh
accessMode: ReadWriteOnce
size: 10Gi
# Rancher post-delete hook
postDelete:
enabled: false #by ljh
image:
repository: reg.inje-private.com/nnd002/rancher/shell # by ljh add registry
tag: v0.2.1
namespaceList:
- cattle-fleet-system
- cattle-system
- rancher-operator-system
# Number of seconds to wait for an app to be uninstalled
timeout: 120
# by default, the job will fail if it fail to uninstall any of the apps
ignoreTimeoutError: false
# Set a bootstrap password. If leave empty, a random password will be generated.
bootstrapPassword: ""
startupProbe:
## should be ready within 2 minutes
timeoutSeconds: 5
periodSeconds: 10
failureThreshold: 12
livenessProbe:
timeoutSeconds: 5
periodSeconds: 30
failureThreshold: 5
readinessProbe:
timeoutSeconds: 5
periodSeconds: 30
failureThreshold: 5
# helm values to use when installing the rancher-webhook chart.
# helm values set here will override all other global values used when installing the webhook such as priorityClassName and systemRegistry settings.
webhook: ""
# helm values to use when installing the fleet chart.
# helm values set here will override all other global values used when installing the fleet chart.
fleet: ""

16
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.dockerignore Normal file
View File

@ -0,0 +1,16 @@
./bin
./.dapper
./build
./dist
./.idea
./default.etcd
./package/rancher
./package/agent
./tests/MANIFEST
./tests/.idea
./tests/.cache
./tests/.tox
./tests/.venv
**/*.pyc
**/__pycache__
./management-state/

6
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.gitattributes vendored Normal file
View File

@ -0,0 +1,6 @@
# Treat all Go files in this repo as binary, with no git magic updating
# line endings. Windows users contributing to Go will need to use a
# modern version of git and editors capable of LF line endings.
*.go -text diff=golang
* text eol=lf

48
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/ISSUE_TEMPLATE/bug_report.md vendored Normal file
View File

@ -0,0 +1,48 @@
---
name: Bug report
about: Create a report to help us improve
title: "[BUG]"
labels: kind/bug
assignees: ''
---
**Rancher Server Setup**
- Rancher version:
- Installation option (Docker install/Helm Chart):
- If Helm Chart, Kubernetes Cluster and version (RKE1, RKE2, k3s, EKS, etc):
- Proxy/Cert Details:
**Information about the Cluster**
- Kubernetes version:
- Cluster Type (Local/Downstream):
- If downstream, what type of cluster? (Custom/Imported or specify provider for Hosted/Infrastructure Provider):
<!--
* Custom = Running a docker command on a node
* Imported = Running kubectl apply onto an existing k8s cluster
* Hosted = EKS, GKE, AKS, etc
* Infrastructure Provider = Rancher provisioning the nodes using different node drivers (e.g. AWS, Digital Ocean, etc)
-->
**User Information**
- What is the role of the user logged in? (Admin/Cluster Owner/Cluster Member/Project Owner/Project Member/Custom)
- If custom, define the set of permissions:
**Describe the bug**
<!--A clear and concise description of what the bug is.-->
**To Reproduce**
<!--Steps to reproduce the behavior-->
**Result**
**Expected Result**
<!--A clear and concise description of what you expected to happen.-->
**Screenshots**
<!-- If applicable, add screenshots to help explain your problem.-->
**Additional context**
<!--Add any other context about the problem here.-->

20
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/ISSUE_TEMPLATE/feature_request.md vendored Normal file
View File

@ -0,0 +1,20 @@
---
name: Feature request
about: Suggest an idea for this project
title: "[RFE] "
labels: kind/enhancement
assignees: ''
---
**Is your feature request related to a problem? Please describe.**
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
**Describe the solution you'd like**
A clear and concise description of what you want to happen.
**Describe alternatives you've considered**
A clear and concise description of any alternative solutions or features you've considered.
**Additional context**
Add any other context or screenshots about the feature request here.

25
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/ISSUE_TEMPLATE/flaky-tests.md vendored Normal file
View File

@ -0,0 +1,25 @@
---
name: Flaky Tests
about: File a report of a flaky test from drone or automation runs
title: "[flaky-test]"
labels: kind/flaky-test
assignees: ''
---
**Flaky Test**
```
<!--File what test failed in automation.
Make sure to assign the appropriate engineering team.-->
```
**Release Branch**
source branch of PR: `release/vXXX`
<!-- List which source branch in rancher/rancher that the PR was -->
**Drone Build (if applicable)**
pipeline stage URL:
<!-- Link to the specific pipeline stage/step that the drone build failed if applicable-->

18
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/actions/k3s-images/action.yml vendored Normal file
View File

@ -0,0 +1,18 @@
name: "Download K3S images"
description: "Download k3s images txt file and save airgap images"
inputs:
k3s_version:
description: "k3s version"
required: true
runs:
using: "composite"
steps:
- name: Download images txt file
shell: bash
run: curl -sLf https://github.com/rancher/k3s/releases/download/${{ inputs.k3s_version }}/k3s-images.txt -o /tmp/k3s-images.txt
- name: Create k3s images file
shell: bash
run: |
images=$(grep -e 'docker.io/rancher/mirrored-pause' -e 'docker.io/rancher/mirrored-coredns-coredns' /tmp/k3s-images.txt)
xargs -n1 docker pull <<< "${images}"
docker save -o ./k3s-airgap-images.tar ${images}

97
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/actions/setup-build-env/action.yml vendored Normal file
View File

@ -0,0 +1,97 @@
name: "Setup Dependencies Variables"
description: "Setup Dependencies Variables from other files"
outputs:
CATTLE_KDM_BRANCH:
description: "CATTLE_KDM_BRANCH from package/Dockerfile"
value: ${{ steps.vars.outputs.CATTLE_KDM_BRANCH }}
CATTLE_K3S_VERSION:
description: "CATTLE_K3S_VERSION from package/Dockerfile"
value: ${{ steps.vars.outputs.CATTLE_K3S_VERSION }}
CATTLE_HELM_VERSION:
description: "CATTLE_HELM_VERSION from package/Dockerfile"
value: ${{ steps.vars.outputs.CATTLE_HELM_VERSION }}
HELM_VERSION:
description: "HELM_VERSION from package/Dockerfile"
value: ${{ steps.vars.outputs.HELM_VERSION }}
HELM_UNITTEST_VERSION:
description: "HELM_UNITTEST_VERSION from Dockerfile.dapper"
value: ${{ steps.vars.outputs.HELM_UNITTEST_VERSION }}
RKE_VERSION:
description: "RKE_VERSION from go.mod"
value: ${{ steps.vars.outputs.RKE_VERSION }}
CATTLE_RANCHER_WEBHOOK_VERSION:
description: "CATTLE_RANCHER_WEBHOOK_VERSION from scripts/export-config"
value: ${{ steps.vars.outputs.CATTLE_RANCHER_WEBHOOK_VERSION }}
CATTLE_CSP_ADAPTER_MIN_VERSION:
description: "CATTLE_CSP_ADAPTER_MIN_VERSION from scripts/export-config"
value: ${{ steps.vars.outputs.CATTLE_CSP_ADAPTER_MIN_VERSION }}
CATTLE_FLEET_VERSION:
description: "CATTLE_FLEET_VERSION from scripts/export-config"
value: ${{ steps.vars.outputs.CATTLE_FLEET_VERSION }}
runs:
using: "composite"
steps:
- id: vars
shell: bash
run: |
source scripts/export-config
CATTLE_KDM_BRANCH=$(grep -m1 'ARG CATTLE_KDM_BRANCH=' package/Dockerfile | cut -d '=' -f2)
CATTLE_K3S_VERSION=$(grep -m1 'ENV CATTLE_K3S_VERSION' package/Dockerfile | awk '{print $3}')
HELM_VERSION=$(grep -m1 'ENV HELM_VERSION' package/Dockerfile | awk '{print $3}')
CATTLE_HELM_VERSION=$(grep -m1 'ENV CATTLE_HELM_VERSION' package/Dockerfile | awk '{print $3}')
HELM_UNITTEST_VERSION=$(grep -m1 'ENV HELM_UNITTEST_VERSION' Dockerfile.dapper | awk '{print $3}')
RKE_VERSION=$(grep -m1 'github.com/rancher/rke' go.mod | awk '{print $2}')
if [[ -z "$RKE_VERSION" ]]; then
RKE_VERSION=$(grep -m1 'github.com/rancher/rke' go.mod | awk '{print $4}')
fi
RKE_VERSION=$RKE_VERSION
CATTLE_RANCHER_WEBHOOK_VERSION=$CATTLE_RANCHER_WEBHOOK_VERSION
CATTLE_CSP_ADAPTER_MIN_VERSION=$CATTLE_CSP_ADAPTER_MIN_VERSION
CATTLE_FLEET_VERSION=$CATTLE_FLEET_VERSION
if [[ -z "$CATTLE_KDM_BRANCH" ]]; then
echo "CATTLE_KDM_BRANCH not found"
exit 1
fi
if [[ -z "$CATTLE_K3S_VERSION" ]]; then
echo "CATTLE_K3S_VERSION not found"
exit 1
fi
if [[ -z "$HELM_VERSION" ]]; then
echo "HELM_VERSION not found"
exit 1
fi
if [[ -z "$CATTLE_HELM_VERSION" ]]; then
echo "CATTLE_HELM_VERSION not found"
exit 1
fi
if [[ -z "$HELM_UNITTEST_VERSION" ]]; then
echo "HELM_UNITTEST_VERSION not found"
exit 1
fi
if [[ -z "$RKE_VERSION" ]]; then
echo "RKE_VERSION not found"
exit 1
fi
if [[ -z "$CATTLE_RANCHER_WEBHOOK_VERSION" ]]; then
echo "CATTLE_RANCHER_WEBHOOK_VERSION not found"
exit 1
fi
if [[ -z "$CATTLE_CSP_ADAPTER_MIN_VERSION" ]]; then
echo "CATTLE_CSP_ADAPTER_MIN_VERSION not found"
exit 1
fi
if [[ -z "$CATTLE_FLEET_VERSION" ]]; then
echo "CATTLE_FLEET_VERSION not found"
exit 1
fi
echo "CATTLE_KDM_BRANCH=$CATTLE_KDM_BRANCH" >> $GITHUB_OUTPUT
echo "CATTLE_K3S_VERSION=$CATTLE_K3S_VERSION" >> $GITHUB_OUTPUT
echo "HELM_VERSION=$HELM_VERSION" >> $GITHUB_OUTPUT
echo "CATTLE_HELM_VERSION=$CATTLE_HELM_VERSION" >> $GITHUB_OUTPUT
echo "HELM_UNITTEST_VERSION=$HELM_UNITTEST_VERSION" >> $GITHUB_OUTPUT
echo "RKE_VERSION=$RKE_VERSION" >> $GITHUB_OUTPUT
echo "CATTLE_RANCHER_WEBHOOK_VERSION=$CATTLE_RANCHER_WEBHOOK_VERSION" >> $GITHUB_OUTPUT
echo "CATTLE_CSP_ADAPTER_MIN_VERSION=$CATTLE_CSP_ADAPTER_MIN_VERSION" >> $GITHUB_OUTPUT
echo "CATTLE_FLEET_VERSION=$CATTLE_FLEET_VERSION" >> $GITHUB_OUTPUT

20
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/actions/setup-tag-env/action.yml vendored Normal file
View File

@ -0,0 +1,20 @@
name: "Setup TAG and HEAD_TAG env variables"
description: "Setup TAG and HEAD_TAG env variables"
runs:
using: "composite"
steps:
- shell: bash
run: |
ref_name="${{ github.ref_name }}"
TAG="${{ github.sha }}"
prefix="release/"
if [[ "$ref_name" == release/v* ]]; then
TAG=${ref_name#$prefix}-${{ github.sha }}-head
HEAD_TAG=${ref_name#$prefix}-head
echo "HEAD_TAG=$HEAD_TAG" >> "$GITHUB_ENV"
fi
if [[ "${{ github.ref }}" == refs/tags/* ]]; then
TAG="$ref_name"
fi
echo "TAG=$TAG" >> "$GITHUB_ENV"
echo "GIT_TAG=$TAG" >> "$GITHUB_ENV"

49
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/pull_request_template.md vendored Normal file
View File

@ -0,0 +1,49 @@
## Issue: <!-- link the issue or issues this PR resolves here -->
<!-- If your PR depends on changes from another pr link them here and describe why they are needed on your solution section. -->
## Problem
<!-- Describe the root cause of the issue you are resolving. This may include what behavior is observed and why it is not desirable. If this is a new feature describe why we need this feature and how it will be used. -->
## Solution
<!-- Describe what you changed to fix the issue. Relate your changes back to the original issue / feature and explain why this addresses the issue. -->
## Testing
<!-- Note: Confirm if the repro steps in the GitHub issue are valid, if not, please update the issue with accurate repro steps. -->
## Engineering Testing
### Manual Testing
<!-- Describe what manual testing you did (if no testing was done, explain why). -->
### Automated Testing
<!-- Ensure there are unit/integration/validation tests added (if possible); describe what cases they cover and do not cover. -->
* Test types added/modified:
* Unit
* Integration (Go Framework)
* Integration (v2prov Framework)
* Validation (Go Framework)
* Other - Explain: _EXPLAIN_
* None
* _REMOVE NOT APPLICABLE BULLET POINTS ABOVE_
* If "None" - Reason: _EXPLAIN THE REASON_
<!--
Non-exhaustive list of reasons:
- Lack of the framework capable of testing this fix/change
- Tight deadlines / critical priority to get fix/change in - !ensure GH issue is logged to add tests!
- No application logic is modified by this change, e.g. refactoring/cosmetic/non-code/test change
- Tests implemented in another PR elsewhere - !ensure GH PR link is added!
- Other (explain)
Note: Outside of the exceptions above, the "existing tests cover the changes" is very unlikely to be an acceptable reason as the existing tests generally don't cover the logic changes implemented by this PR
-->
* If "None" - GH Issue/PR: _LINK TO GH ISSUE/PR TO ADD TESTS_
Summary: _TODO_
## QA Testing Considerations
<!-- Highlight areas or (additional) cases that QA should test w.r.t a fresh install as well as the upgrade scenarios -->
### Regressions Considerations
<!-- Dedicated section to specifically call out any areas that with higher chance of regressions caused by this change, include estimation of probability of regressions -->
_TODO_
Existing / newly added automated tests that provide evidence there are no regressions:
* _TODO_

11
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/renovate.json vendored Normal file
View File

@ -0,0 +1,11 @@
{
"extends": [
"github>rancher/renovate-config#release"
],
"baseBranches": [
"release/v2.9"
],
"prHourlyLimit": 2,
"prConcurrentLimit": 4,
"prCreation": "status-success"
}

1
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/runs-on.yml vendored Normal file
View File

@ -0,0 +1 @@
_extends: .github-private

12
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/scripts/check-for-auto-generated-changes.sh vendored Executable file
View File

@ -0,0 +1,12 @@
#!/bin/sh
set -ue
go generate ./...
if [ -n "$(git status --porcelain)" ]; then
echo "Generated files have either been changed manually or were not updated."
echo
echo "The following generated files did differ after regeneration:"
git status --porcelain
exit 1
fi

39
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/scripts/check-for-go-mod-changes.sh vendored Executable file
View File

@ -0,0 +1,39 @@
#!/bin/sh
set -ue
for DIRECTORY in . ./pkg/apis ./pkg/client; do
cd "$DIRECTORY"
go mod tidy
go mod verify
cd "$OLDPWD"
done
if [ -n "$(git status --porcelain)" ]; then
echo "go.mod is not up to date. Please 'run go mod tidy' and commit the changes."
echo
echo "The following go files did differ after tidying them:"
git status --porcelain
exit 1
fi
# Check diff between ./go.mod and ./pkg/apis/go.mod
badmodule="false"
while read -r module tag; do
# Get tag from module in ./go.mod
roottag=$(sed '1,/^require/d' go.mod | grep "${module} " | awk '{ print $2 }')
echo "${module}:"
echo "${tag} (./pkg/apis/go.mod)"
echo "${roottag} (./go.mod)"
# Compare with tag from module in ./pkg/apis/go.mod
if [ "${tag}" != "${roottag}" ]; then
echo "${module} is different ('${tag}' vs '${roottag}')"
badmodule="true"
fi
done << EOF
$(sed '1,/require/d' pkg/apis/go.mod | head -n -1 | grep -v indirect | grep rancher | awk '{ print $1,$2 }')
EOF
if [ "${badmodule}" = "true" ]; then
echo "Diff found between ./go.mod and ./pkg/apis/go.mod"
exit 1
fi

13
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/workflows/README.md vendored Normal file
View File

@ -0,0 +1,13 @@
# Description of GitHub Actions in this repository
## Go Get (`go-get.yml`)
Go Get can be used to automate updating Go modules in this repository. It will run `make go-get` which is a helper script for running `go get -d $GOGET_MODULE@$GOGET_VERSION` in all needed places, commit and create a pull request.
If `Username of the source for this workflow run` is set, the username will be mentioned in the pull request and configured as assignee. This was added for automated workflows, where the user and URL can be used to link back to the source of the trigger.
If `URL of the source for this workflow run` is set, the URL will be mentioned in the pull request. This was added for automated workflows, where the user and URL can be used to link back to the source of the trigger.
## Replace environment variable in file (`replace-env-value.yml`)
Replace environment variable in file can be used to replace an environment variable in any file. It will run `./scripts/replace-env-value-in-file.sh`, commit and create a pull request with the changes. This is mostly used for bumping versions. This workflow should work for `KEY=VALUE` (equal sign separated) values and `KEY VALUE` (space separated) values.

99
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/workflows/go-get.yml vendored Normal file
View File

@ -0,0 +1,99 @@
name: Go get
on:
workflow_dispatch:
inputs:
goget_module:
type: string
description: "What Go module to get"
goget_version:
type: string
description: "What Go module version to get"
source_url:
type: string
description: "URL of the source for this workflow run"
source_author:
type: string
description: "Username of the source for this workflow run"
env:
GOGET_MODULE: ${{ github.event.inputs.goget_module }}
GOGET_VERSION: ${{ github.event.inputs.goget_version }}
INPUT_SOURCE_URL: ${{ github.event.inputs.source_url }}
INPUT_SOURCE_AUTHOR: ${{ github.event.inputs.source_author }}
permissions:
contents: write
pull-requests: write
jobs:
go-get:
runs-on: ubuntu-latest
steps:
- name: Check out repository code
uses: actions/checkout@v2
- name: Run go get to get Go module
run: make go-get
- name: Check for repository changes
run: |
if git diff --name-only --exit-code; then
echo "No changes found in repository after 'go get'"
echo "changes_exist=false" >> $GITHUB_ENV
else
echo "Changes found in repository after 'go get':"
git diff --name-only
echo "changes_exist=true" >> $GITHUB_ENV
fi
- name: Create branch, commit and push
if: ${{ env.changes_exist == 'true' }}
id: branch
run: |
BRANCH="githubaction-go-get-$(date +%Y-%m-%d-%H-%M-%S)"
echo "::set-output name=branch::$BRANCH"
git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
git config --global user.name "github-actions[bot]"
git checkout -b "$BRANCH"
git commit -a -m "go get ${GOGET_MODULE} ${GOGET_VERSION}"
git push origin "$BRANCH"
- name: Create Pull Request
if: ${{ env.changes_exist == 'true' }}
id: cpr
uses: actions/github-script@v5.0.0
env:
SOURCE_BRANCH: ${{ steps.branch.outputs.branch }}
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const { GOGET_MODULE, GOGET_VERSION} = process.env
let body = 'Auto-generated by GitHub Actions\n\n'
if ( `${ process.env.INPUT_SOURCE_URL }` ) {
body += `\nSource URL: ${ process.env.INPUT_SOURCE_URL }`
}
if ( `${ process.env.INPUT_SOURCE_AUTHOR }` ) {
body += `\nSource AUTHOR: @${ process.env.INPUT_SOURCE_AUTHOR}`
}
const { data: pr } = await github.rest.pulls.create({
title: `[${{ github.ref_name }}] go get ${GOGET_MODULE} ${GOGET_VERSION}`,
body: body,
owner: context.repo.owner,
repo: context.repo.repo,
base: "${{ github.ref_name }}",
head: `${ process.env.SOURCE_BRANCH }`
});
await github.rest.issues.addLabels({
...context.repo,
issue_number: pr.number,
labels: ["status/auto-created"],
});
if ( `${ process.env.INPUT_SOURCE_AUTHOR }` ) {
await github.rest.issues.addAssignees({
...context.repo,
issue_number: pr.number,
assignees: [`${ process.env.INPUT_SOURCE_AUTHOR}`],
});
}
console.log('Created new pull request');
return pr.html_url;
- name: Check outputs
if: ${{ env.changes_exist == 'true' }}
run: |
echo "Pull Request URL - ${{ steps.cpr.outputs.result }}"

160
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/workflows/integration-tests.yml vendored Normal file
View File

@ -0,0 +1,160 @@
name: Integration Tests
on:
workflow_call:
inputs:
parent_run_id:
type: string
description: "parent run_id to download images from"
required: true
permissions: {}
env:
HOST_ARCH: amd64
ARCH: amd64
PYTHON_VERSION: '3.11'
GOLANG_VERSION: '1.22'
IMAGE: ${{ github.repository_owner }}/rancher
IMAGE_AGENT: ${{ github.repository_owner }}/rancher-agent
jobs:
test:
runs-on: runs-on,runner=8cpu-linux-x64,image=legacy-cgroups-for-x64,run-id=${{ github.run_id }}
timeout-minutes: 60
env:
K3D_VERSION: v5.7.1
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Setup Environment Variables
uses: ./.github/actions/setup-tag-env
- name: Clean up Docker
run: |
docker system prune -af
docker volume prune -f
# Cleaning the runner is important to free enough space to build rancher, otherwise the build will fail
- name: Clean runner
run: |
# removes dotnet
sudo rm -rf /usr/share/dotnet
# removes haskell
sudo rm -rf /opt/ghc
# removes android sdk
sudo rm -rf /usr/local/lib/android
- id: env
name: Setup Dependencies Env Variables
uses: ./.github/actions/setup-build-env
- name: Download Docker images artifact
uses: actions/download-artifact@v4
with:
run-id: ${{ inputs.parent_run_id }}
github-token: ${{ github.token }}
path: "/tmp"
merge-multiple: true
- name: Load server image
run: |
image_server_id=$(docker load --input /tmp/rancher-linux-amd64.tar 2>&1 | grep "Loaded image" | awk '{print $NF}')
if [ -z "$image_server_id" ]; then
echo "Error: Failed to load image from tarball!"
exit 1
fi
AMD_IMAGE=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep -E "rancher/rancher:.*amd64.*$" | head -n 1)
echo "the image created is $AMD_IMAGE"
docker tag "$image_server_id" ${{ env.IMAGE }}:${{ env.TAG }}
docker image ls
docker rmi "$AMD_IMAGE"
docker image ls
- name: Load agent image
run: |
image_agent_id=$(docker load --input /tmp/rancher-agent-linux-amd64.tar 2>&1 | grep "Loaded image" | awk '{print $NF}')
if [ -z "$image_agent_id" ]; then
echo "Error: Failed to load image from tarball!"
exit 1
fi
AMD_IMAGE_AGENT=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep -E "rancher/rancher-agent:.*amd64.*$" | head -n 1)
docker tag "$image_agent_id" ${{ env.IMAGE_AGENT }}:${{ env.TAG }}
echo "the image created is $AMD_IMAGE_AGENT"
docker image ls
docker rmi "$AMD_IMAGE_AGENT"
docker image ls
- name: Install k3d
run: curl -s https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | TAG=${{ env.K3D_VERSION }} bash
- name: Uninstall existing Python versions
run: |
sudo apt-get remove -y python3
sudo apt-get autoremove -y
sudo apt-get purge -y python3
sudo apt-get clean
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "${{ env.PYTHON_VERSION }}"
- name: Check Python version
run: |
sudo rm -rf /usr/bin/python3
sudo cp $(which python3) /usr/bin/python3
python3 --version
python3 -m ensurepip --upgrade
- name: Install Python and dependencies
run: |
sudo apt-get update
sudo apt-get install -y python3-pip python3-dev libffi-dev libssl-dev
sudo pip3 install --upgrade pip
sudo pip3 install tox flake8
## Helm Setup start
- name: Uninstall Helm
run: |
sudo rm -rf /usr/local/bin/helm /usr/bin/rancher-helm /usr/bin/rancher-tiller ~/.helm /usr/local/bin/helm_v3 /usr/local/bin/tiller
- name: Set Helm 2 URL
run: echo "HELM_URL_V2=https://github.com/rancher/helm/releases/download/${{ steps.env.outputs.CATTLE_HELM_VERSION }}/rancher-helm" >> $GITHUB_ENV
- name: Set Tiller URL
run: echo "TILLER_URL=https://github.com/rancher/helm/releases/download/${{ steps.env.outputs.CATTLE_HELM_VERSION }}/rancher-tiller" >> $GITHUB_ENV
- name: Download Rancher Helm
run: sudo curl -sLf ${{ env.HELM_URL_V2 }} -o /usr/bin/rancher-helm-v2
- name: Download Rancher Tiller
run: sudo curl -sLf ${{ env.TILLER_URL }} -o /usr/bin/rancher-tiller
- name: Set permissions for Helm and Tiller
run: sudo chmod +x /usr/bin/rancher-helm-v2 /usr/bin/rancher-tiller
- name: Create symlink for Helm
run: sudo ln -s /usr/bin/rancher-helm-v2 /usr/bin/helm
- name: Create symlink for Tiller
run: sudo ln -s /usr/bin/rancher-tiller /usr/bin/tiller
- name: Initialize Helm
run: helm init -c --stable-repo-url https://charts.helm.sh/stable/
- name: Set Helm 3 URL
run: echo "HELM_URL_V3=https://get.helm.sh/helm-${{ steps.env.outputs.HELM_VERSION }}-linux-${{ env.HOST_ARCH }}.tar.gz" >> $GITHUB_ENV
- name: Create temporary directory for Helm 3
run: sudo mkdir /usr/tmp
- name: Download and extract Helm 3
run: curl ${{ env.HELM_URL_V3 }} | sudo tar xvzf - --strip-components=1 -C /usr/tmp/
- name: Move Helm 3 binary
run: sudo mv /usr/tmp/helm /usr/bin/helm_v3
- name: KDM data
run: |
mkdir -p bin
curl -sLf https://releases.rancher.com/kontainer-driver-metadata/${{ steps.env.outputs.CATTLE_KDM_BRANCH }}/data.json > bin/data.json
## Helm Setup end
- name: Set up Go
uses: actions/setup-go@v5
with:
go-version: "${{ env.GOLANG_VERSION }}"
- name: Build Integration Setup
shell: bash
run: |
./tests/v2/integration/scripts/build-integration-setup
- name: Run Tests
shell: bash
run: sudo --preserve-env GOBIN=$(which go) ./scripts/gha/tests

102
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/workflows/manual.yml vendored Normal file
View File

@ -0,0 +1,102 @@
# This is a basic workflow that is manually triggered
name: Port issue
run-name: "Port issue ${{ github.event.issue.number }}: ${{ github.event.issue.title }}"
on:
issue_comment:
types:
- created
jobs:
port-issue:
runs-on: ubuntu-latest
if: contains(github.event.comment.body, '/backport') || contains(github.event.comment.body, '/forwardport')
steps:
- name: Check org membership
env:
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
run: |
if gh api orgs/${GITHUB_REPOSITORY_OWNER}/members --paginate | jq -e --arg GITHUB_ACTOR "$GITHUB_ACTOR" '.[] | select(.login == $GITHUB_ACTOR)' > /dev/null; then
echo "${GITHUB_ACTOR} is a member"
echo "is_member=true" >> $GITHUB_ENV
else
echo "${GITHUB_ACTOR} is not a member of ${GITHUB_REPOSITORY_OWNER}" >> $GITHUB_STEP_SUMMARY
echo "is_member=false" >> $GITHUB_ENV
fi
- name: Check milestone
if: env.is_member == 'true'
env:
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
ORIGINAL_ISSUE_NUMBER: ${{ github.event.issue.number }}
COMMENT_BODY: ${{ github.event.comment.body }}
run: |
BODY_MILESTONE=$(echo "${COMMENT_BODY}" | awk '{ print $2 }')
# Sanitize input
MILESTONE=${BODY_MILESTONE//[^a-zA-Z0-9\-\.]/}
if gh api repos/${GITHUB_REPOSITORY}/milestones --paginate | jq -e --arg MILESTONE "$MILESTONE" '.[] | select(.title == $MILESTONE)' > /dev/null; then
echo "Milestone exists"
echo "milestone_exists=true" >> $GITHUB_ENV
else
echo "Milestone ${MILESTONE} does not exist" >> $GITHUB_STEP_SUMMARY
gh issue comment -R ${GITHUB_REPOSITORY} ${ORIGINAL_ISSUE_NUMBER} --body "Not creating port issue, milestone ${MILESTONE} does not exist or is not an open milestone"
echo "milestone_exists=false" >> $GITHUB_ENV
fi
- name: Port issue
if: |
env.is_member == 'true' &&
env.milestone_exists == 'true'
env:
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
ORIGINAL_ISSUE_NUMBER: ${{ github.event.issue.number }}
COMMENT_BODY: ${{ github.event.comment.body }}
run: |
declare -a additional_cmd
BODY=$(mktemp)
ORIGINAL_ISSUE=$(gh issue view -R ${GITHUB_REPOSITORY} ${ORIGINAL_ISSUE_NUMBER} --json title,body,assignees)
ORIGINAL_TITLE=$(echo "${ORIGINAL_ISSUE}" | jq -r .title)
TYPE=$(echo "${COMMENT_BODY}" | awk '{ print $1 }' | sed -e 's_/__')
MILESTONE=$(echo "${COMMENT_BODY}" | awk '{ print $2 }')
NEW_TITLE="[${TYPE}] ${ORIGINAL_TITLE}"
# rancher/rancher title
if [[ $MILESTONE =~ (v[0-9]\.[0-9]+) ]]; then
NEW_TITLE="[${TYPE} ${BASH_REMATCH[1]}] ${ORIGINAL_TITLE}"
fi
# rancher/rke2 title
# MAJOR_MINOR_MILESTONE=$(echo $MILESTONE | cut -d. -f1,2)
# NEW_TITLE="[${TYPE} release-${MAJOR_MINOR_MILESTONE}] ${ORIGINAL_TITLE}"
ORIGINAL_LABELS=$(gh issue view -R ${GITHUB_REPOSITORY} ${ORIGINAL_ISSUE_NUMBER} --json labels --jq '.labels[].name' | grep -v '^\[zube\]:' | paste -sd "," -)
if [ -n "$ORIGINAL_LABELS" ]; then
additional_cmd+=("--label")
additional_cmd+=("${ORIGINAL_LABELS}")
fi
ORIGINAL_PROJECT=$(gh issue view -R ${GITHUB_REPOSITORY} ${ORIGINAL_ISSUE_NUMBER} --json projectItems --jq '.projectItems[].title')
if [ -n "$ORIGINAL_PROJECT" ]; then
additional_cmd+=("--project")
additional_cmd+=("${ORIGINAL_PROJECT}")
fi
ASSIGNEES=$(echo "${ORIGINAL_ISSUE}" | jq -r .assignees[].login)
if [ -n "$ASSIGNEES" ]; then
echo "Checking if assignee is member before assigning"
DELIMITER=""
NEW_ASSIGNEES=""
for ASSIGNEE in $ASSIGNEES; do
if gh api orgs/${GITHUB_REPOSITORY_OWNER}/members --paginate | jq -e --arg GITHUB_ACTOR "$GITHUB_ACTOR" '.[] | select(.login == $GITHUB_ACTOR)' > /dev/null; then
echo "${ASSIGNEE} is a member, adding to assignees"
NEW_ASSIGNEES="${NEW_ASSIGNEES}${DELIMITER}${ASSIGNEE}"
DELIMITER=","
fi
done
if [ -n "$NEW_ASSIGNEES" ]; then
echo "Assignees for new issue: ${NEW_ASSIGNEES}"
additional_cmd+=("--assignee")
additional_cmd+=("${NEW_ASSIGNEES}")
fi
fi
if [ -n "$MILESTONE" ]; then
echo -e "This is a ${TYPE} issue for #${ORIGINAL_ISSUE_NUMBER}, automatically created via [GitHub Actions workflow]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID) initiated by @${GITHUB_ACTOR}\n" > $BODY
echo -e "\nOriginal issue body:\n" >> $BODY
echo "${ORIGINAL_ISSUE}" | jq -r '.body[0:65536]' >> $BODY
NEW_ISSUE=$(gh issue create -R "${GITHUB_REPOSITORY}" --title "${NEW_TITLE}" --body-file "${BODY}" -m "${MILESTONE}" "${additional_cmd[@]}")
echo "Port issue created: ${NEW_ISSUE}" >> $GITHUB_STEP_SUMMARY
fi

39
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/workflows/promote-docker-image.yml vendored Normal file
View File

@ -0,0 +1,39 @@
name: Promote docker image to latest or stable
on:
workflow_dispatch:
inputs:
tag:
type: string
description: "e.g: v2.8.4"
required: true
promote-to:
type: choice
description: "Promote to latest or stable"
options:
- "latest"
- "stable"
required: true
env:
REGISTRY: "docker.io"
IMAGE: ${{ github.repository }}
TAG: ${{ github.event.inputs.tag }}
NEW_TAG: ${{ github.event.inputs.promote-to }}
jobs:
promote:
runs-on: ubuntu-latest
container:
image: quay.io/skopeo/stable:v1.15
permissions:
contents: read
id-token: write
steps:
- name: Load Secrets from Vault
uses: rancher-eio/read-vault-secrets@main
with:
secrets: |
secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials username | DOCKER_USERNAME ;
secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials password | DOCKER_PASSWORD
- name: Skopeo login
run: echo ${{ env.DOCKER_PASSWORD }} | skopeo login ${{ env.REGISTRY }} --username ${{ env.DOCKER_USERNAME }} --password-stdin
- name: Copy image to new tag
run: skopeo copy docker://${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ env.TAG }} docker://${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ env.NEW_TAG }} --all

38
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/workflows/provisioning-tests.yml vendored Normal file
View File

@ -0,0 +1,38 @@
name: Provisioning tests
on:
pull_request:
branches:
- release/v*
jobs:
provisioning_tests:
strategy:
fail-fast: false
matrix:
include:
- V2PROV_TEST_DIST: "k3s"
V2PROV_TEST_RUN_REGEX: "^Test_(General|Provisioning)_.*$"
- V2PROV_TEST_DIST: "rke2"
V2PROV_TEST_RUN_REGEX: "^Test_(General|Provisioning)_.*$"
- V2PROV_TEST_DIST: "k3s"
V2PROV_TEST_RUN_REGEX: "^Test_Operation_.*$"
- V2PROV_TEST_DIST: "rke2"
V2PROV_TEST_RUN_REGEX: "^Test_Operation_SetA_.*$"
- V2PROV_TEST_DIST: "rke2"
V2PROV_TEST_RUN_REGEX: "^Test_Operation_SetB_.*$"
name: Provisioning tests
runs-on: runs-on,runner=8cpu-linux-x64,image=legacy-cgroups-for-x64,run-id=${{ github.run_id }}
steps:
- name: Checkout
uses: actions/checkout@v4
- name: testdata
run: mkdir -p build/testdata
- name: Install Dapper
run: |
curl -sL https://releases.rancher.com/dapper/latest/dapper-$(uname -s)-$(uname -m) > ./.dapper
chmod +x ./.dapper
- name: Run tests
run: ./.dapper provisioning-tests
env:
DRONE_BUILD_EVENT: "${{ github.event_name }}"
V2PROV_TEST_RUN_REGEX: "${{ matrix.V2PROV_TEST_RUN_REGEX }}"
V2PROV_TEST_DIST: "${{ matrix.V2PROV_TEST_DIST }}"

202
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/workflows/pull-request.yml vendored Normal file
View File

@ -0,0 +1,202 @@
name: Build Pull Request
on:
- pull_request
env:
ARCH: amd64
TAG: v2.9-${{ github.sha }}
GIT_TAG: v2.9-${{ github.sha }}
HEAD_TAG: v2.9-${{ github.sha }}
COMMIT: ${{ github.sha }}
REPOSITORY_OWNER: ${{ github.repository_owner }}
IMAGE: ${{ github.repository_owner }}/rancher
IMAGE_AGENT: ${{ github.repository_owner }}/rancher-agent
IMAGE_INSTALLER: ${{ github.repository_owner }}/system-agent-installer-rancher
jobs:
unit-tests:
uses: ./.github/workflows/unit-test.yml
build-chart:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- id: env
name: Setup Dependencies Env Variables
uses: ./.github/actions/setup-build-env
- name: Install dependencies
env:
HELM_URL: https://get.helm.sh/helm-${{ steps.env.outputs.HELM_VERSION }}-linux-amd64.tar.gz
run: |
sudo snap install yq
curl ${{ env.HELM_URL }} | tar xvzf - --strip-components=1 -C /tmp/ && \
sudo mv /tmp/helm /usr/bin/helm_v3 && \
sudo chmod +x /usr/bin/helm_v3
helm_v3 plugin install https://github.com/helm-unittest/helm-unittest.git --version ${{ steps.env.outputs.HELM_UNITTEST_VERSION }}; \
- name: Build
run: ./scripts/chart/build chart
- name: Validate
run: ./scripts/chart/validate
- name: Test
run: ./scripts/chart/test
- name: Package
run: ./scripts/chart/package
build-server:
runs-on: ubuntu-latest
strategy:
matrix:
os: [linux]
arch: [amd64, arm64]
steps:
- name: Checkout code
uses: actions/checkout@v4
# Cleaning the runner is important to free enough space to build rancher, otherwise the build will fail
- name: Clean runner
run: |
# removes dotnet
sudo rm -rf /usr/share/dotnet
# removes haskell
sudo rm -rf /opt/ghc
# removes android sdk
sudo rm -rf /usr/local/lib/android
- id: env
name: Setup Dependencies Env Variables
uses: ./.github/actions/setup-build-env
- name: Docker meta
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.IMAGE }}
flavor: |
latest=false
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Create k3s images file
uses: ./.github/actions/k3s-images
with:
k3s_version: ${{ steps.env.outputs.CATTLE_K3S_VERSION }}
- name: Download data.json
run: curl -sLf https://releases.rancher.com/kontainer-driver-metadata/${{ steps.env.outputs.CATTLE_KDM_BRANCH }}/data.json > ./data.json
- name: Build and export server
id: build
uses: docker/build-push-action@v5
with:
push: false
build-args: |
"VERSION=${{ env.TAG }}"
"COMMIT=${{ github.SHA }}"
"RKE_VERSION=${{ steps.env.outputs.RKE_VERSION }}"
"ARCH=${{ matrix.arch }}"
"CATTLE_RANCHER_WEBHOOK_VERSION=${{ steps.env.outputs.CATTLE_RANCHER_WEBHOOK_VERSION }}"
"CATTLE_CSP_ADAPTER_MIN_VERSION=${{ steps.env.outputs.CATTLE_CSP_ADAPTER_MIN_VERSION }}"
"CATTLE_FLEET_VERSION=${{ steps.env.outputs.CATTLE_FLEET_VERSION }}"
tags: ${{ env.IMAGE }}:${{ env.TAG }}-${{ matrix.arch }}
context: .
platforms: "${{ matrix.os }}/${{ matrix.arch }}"
file: ./package/Dockerfile
labels: "${{ steps.meta.outputs.labels }}"
outputs: type=docker,dest=/tmp/rancher-${{ matrix.os }}-${{ matrix.arch }}.tar
- name: Upload image
uses: actions/upload-artifact@v4
with:
name: "rancher-${{ matrix.os }}-${{ matrix.arch }}"
path: /tmp/rancher-${{ matrix.os }}-${{ matrix.arch }}.tar
if-no-files-found: error
retention-days: 1
overwrite: false
build-agent:
needs: [build-server]
runs-on: ubuntu-latest
strategy:
matrix:
os: [linux]
arch: [amd64, arm64]
services:
registry:
image: registry:2
ports:
- 5000:5000
steps:
- name: Checkout code
uses: actions/checkout@v4
# Cleaning the runner is important to free enough space to build rancher, otherwise the build will fail
- name: Clean runner
run: |
# removes dotnet
sudo rm -rf /usr/share/dotnet
# removes haskell
sudo rm -rf /opt/ghc
# removes android sdk
sudo rm -rf /usr/local/lib/android
- id: env
name: Setup Dependencies Env Variables
uses: ./.github/actions/setup-build-env
- name: Docker meta
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.IMAGE }}
flavor: |
latest=false
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
with:
driver-opts: network=host
- name: Download rancher image
uses: actions/download-artifact@v4
with:
name: "rancher-${{ matrix.os }}-${{ matrix.arch }}"
path: /tmp
- name: Load image
run: |
image_id=$(docker load --input /tmp/rancher-${{ matrix.os }}-${{ matrix.arch }}.tar 2>&1 | grep "Loaded image" | awk '{print $NF}')
if [ -z "$image_id" ]; then
echo "Error: Failed to load image from tarball!"
exit 1
fi
docker tag "$image_id" localhost:5000/${{ env.IMAGE }}:${{ env.TAG }}
docker push localhost:5000/${{ env.IMAGE }}:${{ env.TAG }}
- name: Build agent
id: build
uses: docker/build-push-action@v5
with:
push: ${{ github.event_name != 'pull_request' }}
build-args: |
"VERSION=${{ env.TAG }}"
"ARCH=${{ matrix.arch }}"
"RANCHER_TAG=${{ env.TAG }}"
"RANCHER_REPO=${{ env.REPOSITORY_OWNER }}"
"REGISTRY=localhost:5000"
"CATTLE_RANCHER_WEBHOOK_VERSION=${{ steps.env.outputs.CATTLE_RANCHER_WEBHOOK_VERSION }}"
tags: ${{ env.IMAGE_AGENT }}:${{ env.TAG }}-${{ matrix.arch }}
context: .
platforms: "${{ matrix.os }}/${{ matrix.arch }}"
file: ./package/Dockerfile.agent
labels: "${{ steps.meta.outputs.labels }}"
outputs: type=docker,dest=/tmp/rancher-agent-${{ matrix.os }}-${{ matrix.arch }}.tar
- name: Upload image
uses: actions/upload-artifact@v4
with:
name: "rancher-agent-${{ matrix.os }}-${{ matrix.arch }}"
path: /tmp/rancher-agent-${{ matrix.os }}-${{ matrix.arch }}.tar
if-no-files-found: error
retention-days: 1
overwrite: false
integration-tests:
needs: [build-agent]
uses: ./.github/workflows/integration-tests.yml
with:
parent_run_id: ${{ github.run_id }}
build-agent-windows:
strategy:
matrix:
os: [windows]
version: [2019, 2022]
runs-on: ${{ matrix.os }}-${{ matrix.version }}
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Build Windows Agent Image
run: docker build -t ${{ env.IMAGE_AGENT }}:${{ env.TAG }} --build-arg VERSION=${{ env.COMMIT }} --build-arg SERVERCORE_VERSION=ltsc${{ matrix.version }} -f package/windows/Dockerfile.agent .

593
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/workflows/push-release.yml vendored Normal file
View File

@ -0,0 +1,593 @@
name: build-docker-images
on:
push:
branches:
- "master"
- "release/v*"
tags:
- "v*"
env:
COMMIT: ${{ github.sha }}
REPOSITORY_OWNER: ${{ github.repository_owner }}
IMAGE: ${{ github.repository_owner }}/rancher
IMAGE_AGENT: ${{ github.repository_owner }}/rancher-agent
IMAGE_INSTALLER: ${{ github.repository_owner }}/system-agent-installer-rancher
jobs:
unit-tests:
uses: ./.github/workflows/unit-test.yml
build-chart:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Setup Tag Env Variables
uses: ./.github/actions/setup-tag-env
- id: env
name: Setup Dependencies Env Variables
uses: ./.github/actions/setup-build-env
- name: Install dependencies
env:
HELM_URL: https://get.helm.sh/helm-${{ steps.env.outputs.HELM_VERSION }}-linux-amd64.tar.gz
HELM_UNITTEST_VERSION: ${{ steps.env.outputs.HELM_UNITTEST_VERSION }}
run: |
sudo snap install yq
curl ${{ env.HELM_URL }} | tar xvzf - --strip-components=1 -C /tmp/ && \
sudo mv /tmp/helm /usr/bin/helm_v3 && \
sudo chmod +x /usr/bin/helm_v3
helm_v3 plugin install https://github.com/helm-unittest/helm-unittest.git --version ${{ env.HELM_UNITTEST_VERSION }}; \
- name: Build
run: ./scripts/chart/build chart
- name: Validate
run: ./scripts/chart/validate
- name: Test
run: ./scripts/chart/test
- name: Package
run: ./scripts/chart/package
- name: Upload chart
uses: actions/upload-artifact@v4
with:
name: chart
path: ./bin/chart/*
if-no-files-found: error
retention-days: 1
overwrite: true
publish-chart:
runs-on: ubuntu-latest
needs: [build-chart, push-images]
if: github.event_name == 'push' && contains(github.ref, 'tags/') # Only run on push
permissions:
contents: read
id-token: write
steps:
- name: Download chart
uses: actions/download-artifact@v4
with:
name: chart
path: ${{ runner.temp }}/charts
- name: Load Secrets from Vault
uses: rancher-eio/read-vault-secrets@main
with:
secrets: |
secret/data/github/repo/${{ github.repository }}/google-auth/rancher/credentials token | GOOGLE_AUTH ;
- name: Authenticate with Google Cloud
uses: google-github-actions/auth@v2
with:
credentials_json: ${{ env.GOOGLE_AUTH }}
- name: Upload
uses: google-github-actions/upload-cloud-storage@v2
with:
destination: releases.rancher.com/server-charts
path: ${{ runner.temp }}/charts
parent: false
process_gcloudignore: false
predefinedAcl: publicRead
headers: |-
cache-control: public,no-cache,proxy-revalidate
build-server:
runs-on: ubuntu-latest
strategy:
matrix:
os: [linux]
arch: [amd64, arm64]
steps:
- name: Checkout code
uses: actions/checkout@v4
# Cleaning the runner is important to free enough space to build rancher, otherwise the build will fail
- name: Clean runner
run: |
# removes dotnet
sudo rm -rf /usr/share/dotnet
# removes haskell
sudo rm -rf /opt/ghc
# removes android sdk
sudo rm -rf /usr/local/lib/android
- name: Setup Environment Variables
uses: ./.github/actions/setup-tag-env
- id: env
name: Setup Dependencies Env Variables
uses: ./.github/actions/setup-build-env
- name: Docker meta
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.IMAGE }}
flavor: |
latest=false
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Create k3s images file
uses: ./.github/actions/k3s-images
with:
k3s_version: ${{ steps.env.outputs.CATTLE_K3S_VERSION }}
- name: Download data.json
run: curl -sLf https://releases.rancher.com/kontainer-driver-metadata/${{ steps.env.outputs.CATTLE_KDM_BRANCH }}/data.json > ./data.json
- name: Build and export server
id: build
uses: docker/build-push-action@v5
with:
push: false
build-args: |
"VERSION=${{ env.TAG }}"
"COMMIT=${{ env.COMMIT }}"
"RKE_VERSION=${{ steps.env.outputs.RKE_VERSION }}"
"ARCH=${{ matrix.arch }}"
"CATTLE_RANCHER_WEBHOOK_VERSION=${{ steps.env.outputs.CATTLE_RANCHER_WEBHOOK_VERSION }}"
"CATTLE_CSP_ADAPTER_MIN_VERSION=${{ steps.env.outputs.CATTLE_CSP_ADAPTER_MIN_VERSION }}"
"CATTLE_FLEET_VERSION=${{ steps.env.outputs.CATTLE_FLEET_VERSION }}"
tags: ${{ env.IMAGE }}:${{ env.TAG }}-${{ matrix.arch }}
context: .
platforms: "${{ matrix.os }}/${{ matrix.arch }}"
file: ./package/Dockerfile
labels: "${{ steps.meta.outputs.labels }}"
outputs: type=docker,dest=/tmp/rancher-${{ matrix.os }}-${{ matrix.arch }}.tar
- name: Upload image
uses: actions/upload-artifact@v4
with:
name: "rancher-${{ matrix.os }}-${{ matrix.arch }}"
path: /tmp/rancher-${{ matrix.os }}-${{ matrix.arch }}.tar
if-no-files-found: error
retention-days: 1
overwrite: false
build-agent:
needs: [build-server]
runs-on: ubuntu-latest
strategy:
matrix:
os: [linux]
arch: [amd64, arm64]
services:
registry:
image: registry:2
ports:
- 5000:5000
env:
REGISTRY: "127.0.0.1:5000"
steps:
# Cleaning the runner is important to free enough space to build rancher, otherwise the build will fail
- name: Clean runner
run: |
# removes dotnet
sudo rm -rf /usr/share/dotnet
# removes haskell
sudo rm -rf /opt/ghc
# removes android sdk
sudo rm -rf /usr/local/lib/android
- name: Checkout code
uses: actions/checkout@v4
- name: Setup Environment Variables
run: |
echo "ARCH=${{ matrix.arch }}" >> "$GITHUB_ENV"
source scripts/export-config
echo "CATTLE_RANCHER_WEBHOOK_VERSION=$CATTLE_RANCHER_WEBHOOK_VERSION" >> "$GITHUB_ENV"
- name: Setup TAG Variables
uses: ./.github/actions/setup-tag-env
- name: Docker meta
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.IMAGE }}
flavor: |
latest=false
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
with:
driver-opts: network=host
- name: Download rancher image
uses: actions/download-artifact@v4
with:
name: "rancher-${{ matrix.os }}-${{ matrix.arch }}"
path: /tmp
- name: Load image
run: |
image_id=$(docker load --input /tmp/rancher-${{ matrix.os }}-${{ matrix.arch }}.tar 2>&1 | grep "Loaded image" | awk '{print $NF}')
if [ -z "$image_id" ]; then
echo "Error: Failed to load image from tarball!"
exit 1
fi
docker tag "$image_id" ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ env.TAG }}
docker push ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ env.TAG }}
- name: Build agent
id: build
uses: docker/build-push-action@v5
with:
push: false
build-args: |
"VERSION=${{ env.TAG }}"
"ARCH=${{ matrix.arch }}"
"RANCHER_TAG=${{ env.TAG }}"
"RANCHER_REPO=${{ env.REPOSITORY_OWNER }}"
"REGISTRY=${{ env.REGISTRY }}"
"CATTLE_RANCHER_WEBHOOK_VERSION=${{ env.CATTLE_RANCHER_WEBHOOK_VERSION }}"
tags: ${{ env.IMAGE_AGENT }}:${{ env.TAG }}-${{ matrix.arch }}
context: .
platforms: "${{ matrix.os }}/${{ matrix.arch }}"
file: ./package/Dockerfile.agent
labels: "${{ steps.meta.outputs.labels }}"
outputs: type=docker,dest=/tmp/rancher-agent-${{ matrix.os }}-${{ matrix.arch }}.tar
- name: Upload image
uses: actions/upload-artifact@v4
with:
name: "rancher-agent-${{ matrix.os }}-${{ matrix.arch }}"
path: /tmp/rancher-agent-${{ matrix.os }}-${{ matrix.arch }}.tar
if-no-files-found: error
retention-days: 1
overwrite: false
integration-tests:
needs: [build-agent]
uses: ./.github/workflows/integration-tests.yml
with:
parent_run_id: ${{ github.run_id }}
build-agent-windows:
needs: [integration-tests]
strategy:
matrix:
os: [windows]
version: [2019, 2022]
runs-on: ${{ matrix.os }}-${{ matrix.version }}
permissions:
contents: read
id-token: write
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Setup Environment Variables
uses: ./.github/actions/setup-tag-env
- name: Load Secrets from Vault
uses: rancher-eio/read-vault-secrets@main
with:
secrets: |
secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials username | DOCKER_USERNAME ;
secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials password | DOCKER_PASSWORD
- name: Login to Docker Hub
uses: docker/login-action@v3
with:
username: ${{ env.DOCKER_USERNAME }}
password: ${{ env.DOCKER_PASSWORD }}
- name: Build Windows Server Image
run: |
docker build -t ${{ env.IMAGE_AGENT }}:${{ env.TAG }}-windows-${{ matrix.version }} --build-arg VERSION=${{ env.TAG }} --build-arg SERVERCORE_VERSION=ltsc${{ matrix.version }} -f package/windows/Dockerfile.agent .
docker push ${{ env.IMAGE_AGENT }}:${{ env.TAG }}-windows-${{ matrix.version }}
shell: bash
push-images:
runs-on: ubuntu-latest
needs: [unit-tests, integration-tests]
permissions:
contents: read
id-token: write
strategy:
matrix:
os: [linux]
arch: [amd64, arm64]
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Download rancher image
uses: actions/download-artifact@v4
with:
pattern: "*-${{ matrix.os }}-${{ matrix.arch }}"
path: /tmp
merge-multiple: true
- name: Setup Environment Variables
uses: ./.github/actions/setup-tag-env
- name: Load Secrets from Vault
uses: rancher-eio/read-vault-secrets@main
with:
secrets: |
secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials username | DOCKER_USERNAME ;
secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials password | DOCKER_PASSWORD
- name: Docker Registry Login
uses: docker/login-action@v3
with:
username: ${{ env.DOCKER_USERNAME }}
password: ${{ env.DOCKER_PASSWORD }}
- name: Push server image
run: |
image_id=$(docker load --input /tmp/rancher-${{ matrix.os }}-${{ matrix.arch }}.tar 2>&1 | grep "Loaded image" | awk '{print $NF}')
if [ -z "$image_id" ]; then
echo "Error: Failed to load image from tarball!"
exit 1
fi
docker tag "$image_id" docker.io/${{ env.IMAGE }}:${{ env.TAG }}-${{ matrix.arch }}
docker push docker.io/${{ env.IMAGE }}:${{ env.TAG }}-${{ matrix.arch }}
- name: Push agent image
run: |
image_agent_id=$(docker load --input /tmp/rancher-agent-${{ matrix.os }}-${{ matrix.arch }}.tar 2>&1 | grep "Loaded image" | awk '{print $NF}')
if [ -z "$image_agent_id" ]; then
echo "Error: Failed to load image from tarball!"
exit 1
fi
docker tag "$image_agent_id" docker.io/${{ env.IMAGE_AGENT }}:${{ env.TAG }}-${{ matrix.arch }}
docker push docker.io/${{ env.IMAGE_AGENT }}:${{ env.TAG }}-${{ matrix.arch }}
merge-server-manifest:
runs-on: ubuntu-latest
needs: [push-images]
permissions:
contents: read
id-token: write
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Setup Environment Variables
uses: ./.github/actions/setup-tag-env
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Load Secrets from Vault
uses: rancher-eio/read-vault-secrets@main
with:
secrets: |
secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials username | DOCKER_USERNAME ;
secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials password | DOCKER_PASSWORD
- name: Login to Docker Hub
uses: docker/login-action@v3
with:
username: ${{ env.DOCKER_USERNAME }}
password: ${{ env.DOCKER_PASSWORD }}
- name: Create manifest list and push
run: |
docker buildx imagetools create -t ${{ env.IMAGE }}:${{ env.TAG }} ${{ env.IMAGE }}:${{ env.TAG }}-amd64 ${{ env.IMAGE }}:${{ env.TAG }}-arm64
- name: Create head manifest list and push
run: |
if [[ "${{ github.ref_name }}" == release/v* ]]; then
docker buildx imagetools create -t ${{ env.IMAGE }}:${{ env.HEAD_TAG }} ${{ env.IMAGE }}:${{ env.TAG }}-amd64 ${{ env.IMAGE }}:${{ env.TAG }}-arm64
fi
- name: Inspect image
run: |
docker buildx imagetools inspect ${{ env.IMAGE }}:${{ env.TAG }}
merge-agent-manifest:
runs-on: ubuntu-latest
needs: [push-images, build-agent-windows]
permissions:
contents: read
id-token: write
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Setup Environment Variables
uses: ./.github/actions/setup-tag-env
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Load Secrets from Vault
uses: rancher-eio/read-vault-secrets@main
with:
secrets: |
secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials username | DOCKER_USERNAME ;
secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials password | DOCKER_PASSWORD
- name: Login to Docker Hub
uses: docker/login-action@v3
with:
username: ${{ env.DOCKER_USERNAME }}
password: ${{ env.DOCKER_PASSWORD }}
- name: Create manifest list and push
run: |
# docker manifest is used with windows images to maintain os.version in the manifest
docker manifest create ${{ env.IMAGE_AGENT }}:${{ env.TAG }} \
${{ env.IMAGE_AGENT }}:${{ env.TAG }}-windows-2019 \
${{ env.IMAGE_AGENT }}:${{ env.TAG }}-windows-2022
docker manifest push ${{ env.IMAGE_AGENT }}:${{ env.TAG }}
docker buildx imagetools create -t ${{ env.IMAGE_AGENT }}:${{ env.TAG }} \
--append ${{ env.IMAGE_AGENT }}:${{ env.TAG }}-amd64 \
--append ${{ env.IMAGE_AGENT }}:${{ env.TAG }}-arm64
if [[ "${{ github.ref_name }}" == release/v* ]]; then
docker manifest create ${{ env.IMAGE_AGENT }}:${{ env.HEAD_TAG }} \
${{ env.IMAGE_AGENT }}:${{ env.TAG }}-windows-2019 \
${{ env.IMAGE_AGENT }}:${{ env.TAG }}-windows-2022
docker manifest push ${{ env.IMAGE_AGENT }}:${{ env.HEAD_TAG }}
docker buildx imagetools create -t ${{ env.IMAGE_AGENT }}:${{ env.HEAD_TAG }} \
--append ${{ env.IMAGE_AGENT }}:${{ env.TAG }}-amd64 \
--append ${{ env.IMAGE_AGENT }}:${{ env.TAG }}-arm64
fi
- name: Inspect image
run: |
docker buildx imagetools inspect ${{ env.IMAGE_AGENT }}:${{ env.TAG }}
build-installer:
needs:
- merge-server-manifest
- build-chart
runs-on: ubuntu-latest
strategy:
matrix:
os: [linux]
arch: [amd64, arm64]
permissions:
contents: read
id-token: write
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Setup Environment Variables
uses: ./.github/actions/setup-tag-env
- name: Setup New Environment Variables
run: |
echo "ARCH=${{ matrix.arch }}" >> "$GITHUB_ENV"
- name: Docker meta
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.IMAGE }}
flavor: |
latest=false
- name: Load Secrets from Vault
uses: rancher-eio/read-vault-secrets@main
with:
secrets: |
secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials username | DOCKER_USERNAME ;
secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials password | DOCKER_PASSWORD
- name: Docker Registry Login
uses: docker/login-action@v3
with:
username: ${{ env.DOCKER_USERNAME }}
password: ${{ env.DOCKER_PASSWORD }}
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Download chart
uses: actions/download-artifact@v4
with:
name: chart
path: ./chart
- name: Build and export agent
id: build
uses: docker/build-push-action@v5
with:
push: true
build-args: |
"VERSION=${{ env.TAG }}"
"ARCH=${{ matrix.arch }}"
"RANCHER_TAG=${{ env.TAG }}"
"RANCHER_REPO=${{ env.REPOSITORY_OWNER }}"
tags: ${{ env.IMAGE_INSTALLER }}:${{ env.TAG }}-${{ matrix.arch }}
context: .
platforms: "${{ matrix.os }}/${{ matrix.arch }}"
file: ./package/Dockerfile.installer
labels: "${{ steps.meta.outputs.labels }}"
merge-installer-manifest:
runs-on: ubuntu-latest
needs: [build-installer]
permissions:
contents: read
id-token: write
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Setup Environment Variables
uses: ./.github/actions/setup-tag-env
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Docker meta
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.IMAGE_INSTALLER }}
flavor: |
latest=false
- name: Load Secrets from Vault
uses: rancher-eio/read-vault-secrets@main
with:
secrets: |
secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials username | DOCKER_USERNAME ;
secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials password | DOCKER_PASSWORD
- name: Login to Docker Hub
uses: docker/login-action@v3
with:
username: ${{ env.DOCKER_USERNAME }}
password: ${{ env.DOCKER_PASSWORD }}
- name: Create manifest list and push
run: |
docker buildx imagetools create -t ${{ env.IMAGE_INSTALLER }}:${{ env.TAG }} ${{ env.IMAGE_INSTALLER }}:${{ env.TAG }}-amd64 ${{ env.IMAGE_INSTALLER }}:${{ env.TAG }}-arm64
if [[ "${{ github.ref_name }}" == release/v* ]]; then
docker buildx imagetools create -t ${{ env.IMAGE_INSTALLER }}:${{ env.HEAD_TAG }} ${{ env.IMAGE_INSTALLER }}:${{ env.TAG }}-amd64 ${{ env.IMAGE_INSTALLER }}:${{ env.TAG }}-arm64
fi
- name: Inspect image
run: |
docker buildx imagetools inspect ${{ env.IMAGE_INSTALLER }}:${{ env.TAG }}
create-images-files:
if: github.event_name == 'push' && contains(github.ref, 'tags/') # Only run on push
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Setup Environment Variables
uses: ./.github/actions/setup-tag-env
- id: env
name: Setup Dependencies Env Variables
uses: ./.github/actions/setup-build-env
- name: Download data.json
run: |
mkdir -p bin
curl -sLf https://releases.rancher.com/kontainer-driver-metadata/${{ steps.env.outputs.CATTLE_KDM_BRANCH }}/data.json > ./bin/data.json
- name: Create files
run: |
mkdir -p $HOME/bin
touch $HOME/bin/rancher-rke-k8s-versions.txt
- name: Create components and images files
shell: bash
run: ./scripts/create-components-images-files.sh
- name: Move files
run: |
mv $HOME/bin/* ./dist
mv ./bin/*.txt ./dist
mv ./bin/*.sh ./dist
mv ./bin/*.ps1 ./dist
- name: Create sha256sum.txt file
run: bash ./scripts/artifacts-hashes.sh
- name: Upload artifacts
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: gh release upload -R ${{ env.REPOSITORY_OWNER }}/rancher ${{ env.TAG }} ./dist/* --clobber
- name: Add release notes
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
NOTES=$(cat ./dist/rancher-components.txt)
gh release edit -R ${{ github.repository }} ${{ env.TAG }} --notes "$NOTES"
docker-image-digests:
if: github.event_name == 'push' && contains(github.ref, 'tags/') # Only run on tag
runs-on: ubuntu-latest
needs: [create-images-files]
env:
DOCKER_REGISTRY: "docker.io"
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Setup Environment Variables
uses: ./.github/actions/setup-tag-env
- name: Create dist folder
run: mkdir -p dist
- name: Setup ecm-distro-tools
uses: rancher/ecm-distro-tools@v0.38.1
with:
version: v0.38.1
- name: Create ECM Config
run: |
mkdir -p ~/.ecm-distro-tools
release config gen
mkdir -p /tmp/digests
- name: Generate Linux Digests
run: |
export LINUX_IMAGES_URL=https://github.com/${{ github.repository }}/releases/download/${{ env.TAG}}/rancher-images.txt
release generate rancher docker-images-digests \
--images-url "$LINUX_IMAGES_URL" \
--output-file /tmp/digests/rancher-images-digests-linux-amd64.txt \
--registry ${{ env.DOCKER_REGISTRY }}
cp /tmp/digests/rancher-images-digests-linux-amd64.txt /tmp/digests/rancher-images-digests-linux-arm64.txt
- name: Generate Windows Digests
run: |
export WINDOWS_IMAGES_URL=https://github.com/${{ github.repository }}/releases/download/${{ env.TAG}}/rancher-windows-images.txt
release generate rancher docker-images-digests \
--images-url "$WINDOWS_IMAGES_URL" \
--output-file /tmp/digests/rancher-images-digests-windows-ltsc2019.txt \
--registry ${{ env.DOCKER_REGISTRY }}
cp /tmp/digests/rancher-images-digests-windows-ltsc2019.txt /tmp/digests/rancher-images-digests-windows-ltsc2022.txt
- name: Upload digests
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: gh release upload -R ${{ env.REPOSITORY_OWNER }}/rancher ${{ env.TAG }} /tmp/digests/* --clobber

25
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/workflows/renovate.yml vendored Normal file
View File

@ -0,0 +1,25 @@
name: Renovate
on:
workflow_dispatch:
inputs:
logLevel:
description: "Override default log level"
required: false
default: "info"
type: string
overrideSchedule:
description: "Override all schedules"
required: false
default: "false"
type: string
# Run twice in the early morning (UTC) for initial and follow up steps (create pull request and merge)
schedule:
- cron: '30 4,6 * * *'
jobs:
call-workflow:
uses: rancher/renovate-config/.github/workflows/renovate.yml@release
with:
logLevel: ${{ inputs.logLevel || 'info' }}
overrideSchedule: ${{ github.event.inputs.overrideSchedule == 'true' && '{''schedule'':null}' || '' }}
secrets: inherit

84
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/workflows/replace-env-value.yml vendored Normal file
View File

@ -0,0 +1,84 @@
name: Replace environment variable in file
on:
workflow_dispatch:
inputs:
filepath:
type: string
description: "What file needs to be edited?"
envvar:
type: string
description: "What environment variable needs to be edited?"
envvalue:
type: string
description: "What environment variable value needs to be used?"
permissions:
contents: write
pull-requests: write
env:
INPUT_FILEPATH: ${{ github.event.inputs.filepath }}
INPUT_ENVVAR: ${{ github.event.inputs.envvar }}
INPUT_ENVVALUE: ${{ github.event.inputs.envvalue }}
jobs:
tag:
name: Replace environment variable in file
runs-on: ubuntu-latest
steps:
- name: Check out repository code
uses: actions/checkout@v2
- name: Replace tags
run: |
bash ./scripts/replace-env-value-in-file.sh ${INPUT_FILEPATH} ${INPUT_ENVVAR} ${INPUT_ENVVALUE}
- name: Check for repository changes
run: |
if git diff --name-only --exit-code; then
echo "No changes found in repository"
echo "changes_exist=false" >> $GITHUB_ENV
else
echo "Changes found in repository"
git diff --name-only
echo "changes_exist=true" >> $GITHUB_ENV
fi
- name: Create branch, commit and push
if: ${{ env.changes_exist == 'true' }}
id: branch
run: |
BRANCH="githubaction-replace-envvar-$(date +%Y-%m-%d-%H-%M-%S)"
echo "::set-output name=branch::$BRANCH"
git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
git config --global user.name "github-actions[bot]"
git checkout -b "$BRANCH"
git commit -a -m "change env var ${INPUT_ENVVAR} to ${INPUT_ENVVALUE} [CI SKIP]"
git push origin "$BRANCH"
- name: Create Pull Request
if: ${{ env.changes_exist == 'true' }}
id: cpr
uses: actions/github-script@v5.0.0
env:
SOURCE_BRANCH: ${{ steps.branch.outputs.branch }}
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const { INPUT_ENVVAR, INPUT_ENVVALUE } = process.env
const { data: pr } = await github.rest.pulls.create({
title: `[${{ github.ref_name }}] change env var ${INPUT_ENVVAR} to ${INPUT_ENVVALUE}`,
body: 'Auto-generated by GitHub Actions',
owner: context.repo.owner,
repo: context.repo.repo,
base: "${{ github.ref_name }}",
head: `${ process.env.SOURCE_BRANCH }`
});
await github.rest.issues.addLabels({
...context.repo,
issue_number: pr.number,
labels: ["status/auto-created"],
});
console.log('Created new pull request');
return pr.html_url;
- name: Check outputs
if: ${{ env.changes_exist == 'true' }}
run: |
echo "Pull Request URL - ${{ steps.cpr.outputs.result }}"
echo "::notice file=.github,line=1,col=1::Pull Request URL - ${{ steps.cpr.outputs.result }}"

26
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/workflows/stale.yml vendored Normal file
View File

@ -0,0 +1,26 @@
name: 'Close stale issues and PRs'
on:
schedule:
- cron: '30 1 * * *'
permissions:
issues: write
pull-requests: write
jobs:
stale:
runs-on: ubuntu-latest
steps:
- uses: actions/stale@v4
with:
stale-issue-message: 'This repository uses an automated workflow to automatically label issues which have not had any activity (commit/comment/label) for 60 days. This helps us manage the community issues better. If the issue is still relevant, please add a comment to the issue so the workflow can remove the label and we know it is still valid. If it is no longer relevant (or possibly fixed in the latest release), the workflow will automatically close the issue in 14 days. Thank you for your contributions.'
stale-pr-message: 'This repository uses an automated workflow to automatically label pull requests which have not had any activity (commit/comment/label) for 60 days. This helps us manage the community pull requests better. If the pull request is still relevant, please add a comment to the pull request so the workflow can remove the label and we know it is still valid. If it is no longer relevant (or possibly fixed in the latest release), the workflow will automatically close the pull request in 14 days. Thank you for your contributions.'
stale-issue-label: 'status/stale'
stale-pr-label: 'status/stale'
days-before-stale: 60
days-before-close: 14
exempt-issue-labels: 'internal,kind/bug,kind/bug-qa,kind/task,kind/feature,kind/design,kind/ci-improvements,kind/performance,kind/flaky-test,kind/tech-debt'
exempt-pr-labels: 'internal,kind/bug,kind/bug-qa,kind/task,kind/feature,kind/design,kind/ci-improvements,kind/performance,kind/flaky-test,kind/tech-debt'
exempt-all-milestones: true
exempt-all-assignees: true
operations-per-run: 2500

13
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/workflows/unit-test.yml vendored Normal file
View File

@ -0,0 +1,13 @@
name: Unit Tests
on: [workflow_dispatch, workflow_call]
jobs:
unit-test:
runs-on: ubuntu-latest
timeout-minutes: 60
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Run unit tests
run: go test -cover -tags=test ./pkg/...

96
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/workflows/update-readme.yml vendored Normal file
View File

@ -0,0 +1,96 @@
name: Update README
on: workflow_dispatch
permissions:
contents: write
pull-requests: write
jobs:
update-readme:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- name: Get chart index.yaml files
run: |
wget https://github.com/mikefarah/yq/releases/download/v4.25.1/yq_linux_amd64 -O /usr/bin/yq && chmod +x /usr/bin/yq
wget -O latest.index.yaml https://releases.rancher.com/server-charts/latest/index.yaml
wget -O stable.index.yaml https://releases.rancher.com/server-charts/stable/index.yaml
- name: Update README file
run: |
tmpfile=$(mktemp)
unset latest
unset stable
for rancher_major_minor in 2.8 2.7 2.6; do
latest2x=$(yq ".entries.rancher[].appVersion | select(test(\"^v${rancher_major_minor}\") and select(. != \"*-rc*\"))" 'latest.index.yaml' | head -1)
stable2x=$(yq ".entries.rancher[].appVersion | select(test(\"^v${rancher_major_minor}\") and select(. != \"*-rc*\"))" 'stable.index.yaml' | head -1)
[[ -z ${latest2x} ]] && [[ -z ${stable2x} ]] && continue
echo "* v${rancher_major_minor}" >> $tmpfile
if [[ -n ${latest2x} ]]; then
if [[ -n ${latest} ]]; then
echo " * Latest - ${latest2x} - \`rancher/rancher:${latest2x}\` - Read the full release [notes](https://github.com/rancher/rancher/releases/tag/${latest2x})." >> $tmpfile
else
echo " * Latest - ${latest2x} - \`rancher/rancher:${latest2x}\` / \`rancher/rancher:latest\` - Read the full release [notes](https://github.com/rancher/rancher/releases/tag/${latest2x})." >> $tmpfile
fi
fi
if [[ -n ${stable2x} ]]; then
if [[ -n ${stable} ]]; then
echo " * Stable - ${stable2x} - \`rancher/rancher:${stable2x}\` - Read the full release [notes](https://github.com/rancher/rancher/releases/tag/${stable2x})." >> $tmpfile
else
echo " * Stable - ${stable2x} - \`rancher/rancher:${stable2x}\` / \`rancher/rancher:stable\` - Read the full release [notes](https://github.com/rancher/rancher/releases/tag/${stable2x})." >> $tmpfile
fi
fi
latest=${latest2x}
stable=${stable2x}
done
sed -e '/## Latest Release/r '"$tmpfile"'' -e 's/CURRENTYEAR/'"$(date +%Y)"'/g' README-template.md > README.md
- name: Check for repository changes
run: |
if git diff --name-only --exit-code; then
echo "No changes found in repository after updating README"
echo "changes_exist=false" >> $GITHUB_ENV
else
echo "Changes found in repository after updating README:"
git diff --name-only
echo "changes_exist=true" >> $GITHUB_ENV
fi
- name: Create branch, commit and push
if: ${{ env.changes_exist == 'true' }}
id: branch
run: |
BRANCH="githubaction-update-readme-$(date +%Y-%m-%d-%H-%M-%S)"
echo "::set-output name=branch::$BRANCH"
git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
git config --global user.name "github-actions[bot]"
git checkout -b "$BRANCH"
git commit -a -m "update README with latest/stable"
git push origin "$BRANCH"
- name: Create Pull Request
if: ${{ env.changes_exist == 'true' }}
id: cpr
env:
SOURCE_BRANCH: ${{ steps.branch.outputs.branch }}
uses: actions/github-script@v5.0.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
let body = 'Auto-generated by GitHub Actions'
const { data: pr } = await github.rest.pulls.create({
title: `[${{ github.ref_name }}] update README with latest/stable`,
body: body,
owner: context.repo.owner,
repo: context.repo.repo,
base: "${{ github.ref_name }}",
head: `${ process.env.SOURCE_BRANCH }`
});
await github.rest.issues.addLabels({
...context.repo,
issue_number: pr.number,
labels: ["status/auto-created"],
});
console.log('Created new pull request');
return pr.html_url;
- name: Check outputs
if: ${{ env.changes_exist == 'true' }}
run: |
echo "Pull Request URL - ${{ steps.cpr.outputs.result }}"

40
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/workflows/validate.yml vendored Normal file
View File

@ -0,0 +1,40 @@
name: Validate
on: [pull_request, push]
jobs:
validate:
runs-on: ubuntu-latest
env:
GOLANG_CI_LINT_VERSION: v1.54.2
PYTHON_VERSION: '3.11'
GOLANG_VERSION: '1.22'
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Uninstall existing Python versions
run: |
sudo apt-get remove -y python3
sudo apt-get autoremove -y
sudo apt-get purge -y python3
sudo apt-get clean
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "${{ env.PYTHON_VERSION }}"
- name: Check Python version
run: |
sudo rm -rf /usr/bin/python3
sudo cp $(which python3) /usr/bin/python3
python3 --version
python3 -m ensurepip --upgrade
- name: Set up Go
uses: actions/setup-go@v5
with:
go-version: "${{ env.GOLANG_VERSION }}"
- name: Install Python and dependencies
run: |
sudo apt-get update
sudo apt-get install -y python3-pip python3-dev libffi-dev libssl-dev
sudo pip3 install --upgrade pip
sudo pip3 install tox flake8
- name: Validate
run: ./scripts/validate

46
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/workflows/verify-generated-code-changes.yml vendored Normal file
View File

@ -0,0 +1,46 @@
name: Verify generated code changes
on:
workflow_dispatch:
pull_request:
push:
branches:
- 'release/*'
env:
MAIN_BRANCH: origin/master
GOARCH: amd64
CGO_ENABLED: 0
SETUP_GO_VERSION: '1.22.*'
jobs:
check-changes:
runs-on: ubuntu-latest
steps:
-
uses: actions/checkout@v3
with:
fetch-depth: 0
-
uses: actions/setup-go@v4
with:
go-version: ${{ env.SETUP_GO_VERSION }}
-
uses: actions/cache@v3
with:
path: |
~/.cache/go-build
~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
restore-keys: |
${{ runner.os }}-go-
-
name: Verify go.mod status
run: ./.github/scripts/check-for-go-mod-changes.sh
-
name: Install controller-gen
run: go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.14.0
-
name: Verify auto-generated changes
run: ./.github/scripts/check-for-auto-generated-changes.sh

39
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.gitignore vendored Normal file
View File

@ -0,0 +1,39 @@
vendor
/.dapper
/bin
/dist
/build
*.swp
/.idea
/cmd/agent/agent
/package/data.json
/package/k3s-airgap-images.tar
/package/rancher
/package/rancher-namespace.yaml
/package/rancher.yaml
/package/agent
/tests/MANIFEST
/tests/integration/MANIFEST
tests/integration/MANIFEST
tests/integration/.idea/
/tests/.cache
/tests/.tox
/tests/integration/.tox/
/tests/.venv
/tests/.idea
/default.etcd
*.pyc
__pycache__
/management-state
/rancher
*.pytest_cache
.kube/
.vscode/
.DS_Store
tests/validation/.idea
all.yaml
kustomization.yaml
kontainer-engine
k3s-images.txt
k3s-airgap-images.tar
data.json

83
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.golangci.json Normal file
View File

@ -0,0 +1,83 @@
{
"linters": {
"disable-all": true,
"enable": [
"govet",
"revive",
"goimports",
"misspell",
"ineffassign",
"gofmt"
]
},
"linters-settings": {
"govet": {
"check-shadowing": false
},
"gofmt": {
"simplify": false
}
},
"run": {
"skip-dirs": [
"vendor",
"pkg/client",
"pkg/generated",
"tests/framework/clients/rancher/generated"
],
"tests": false,
"timeout": "10m"
},
"issues": {
"exclude-rules": [
{
"linters": "govet",
"text": "^(nilness|structtag)"
},
{
"path":"pkg/apis/management.cattle.io/v3/globaldns_types.go",
"text":".*lobalDns.*"
},
{
"path": "pkg/apis/management.cattle.io/v3/zz_generated_register.go",
"text":".*lobalDns.*"
},
{
"path":"pkg/apis/management.cattle.io/v3/zz_generated_list_types.go",
"text":".*lobalDns.*"
},
{
"linters": "revive",
"text": "should have comment"
},
{
"linters": "revive",
"text": "should be of the form"
},
{
"linters": "typecheck",
"text": "imported but not used as apierrors"
},
{
"linters": "revive",
"text": "unused-parameter"
},
{
"linters": "revive",
"text": "redefines-builtin-id"
},
{
"linters": "revive",
"text": "superfluous-else"
},
{
"linters": "revive",
"text": "empty-block"
},
{
"linters": "revive",
"text": "if-return: redundant if"
}
]
}
}

3
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/CONTRIBUTING.md Normal file
View File

@ -0,0 +1,3 @@
# Contributing to Rancher
Thanks for the interest to contribute to Rancher. Please see [Contributing to Rancher](https://ranchermanager.docs.rancher.com/contribute-to-rancher) to get started.

58
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/Dockerfile-windows.dapper Normal file
View File

@ -0,0 +1,58 @@
FROM library/golang:1.22
SHELL ["powershell", "-NoLogo", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]
ARG DAPPER_HOST_ARCH
ENV HOST_ARCH=${DAPPER_HOST_ARCH} ARCH=${DAPPER_HOST_ARCH}
RUN pushd c:\; \
$URL = 'https://github.com/StefanScherer/docker-cli-builder/releases/download/20.10.5/docker.exe'; \
\
Write-Host ('Downloading docker from {0} ...' -f $URL); \
curl.exe -sfL $URL -o c:\Windows\docker.exe; \
\
Write-Host 'Complete.'; \
popd;
RUN pushd c:\; \
$URL = 'https://github.com/golangci/golangci-lint/releases/download/v1.59.0/golangci-lint-1.59.0-windows-amd64.zip'; \
\
Write-Host ('Downloading golangci from {0} ...' -f $URL); \
curl.exe -sfL $URL -o c:\golangci-lint.zip; \
\
Write-Host 'Expanding ...'; \
Expand-Archive -Path c:\golangci-lint.zip -DestinationPath c:\; \
\
Write-Host 'Cleaning ...'; \
Remove-Item -Force -Recurse -Path c:\golangci-lint.zip; \
\
Write-Host 'Updating PATH ...'; \
[Environment]::SetEnvironmentVariable('PATH', ('c:\golangci-lint-1.56.0-windows-amd64\;{0}' -f $env:PATH), [EnvironmentVariableTarget]::Machine); \
\
Write-Host 'Complete.'; \
popd;
# upgrade git
RUN pushd c:\; \
$URL = 'https://github.com/git-for-windows/git/releases/download/v2.33.1.windows.1/MinGit-2.33.1-64-bit.zip'; \
\
Write-Host ('Downloading git from {0} ...' -f $URL); \
curl.exe -sfL $URL -o c:\git.zip; \
\
Write-Host 'Expanding ...'; \
Expand-Archive -Force -Path c:\git.zip -DestinationPath c:\git\.; \
\
Write-Host 'Cleaning ...'; \
Remove-Item -Force -Recurse -Path c:\git.zip; \
\
Write-Host 'Complete.'; \
popd;
ENV DAPPER_ENV REPO TAG DRONE_TAG FOSSA_API_KEY
ENV DAPPER_SOURCE /gopath/src/github.com/rancher/rancher
ENV DAPPER_OUTPUT ./bin
ENV DAPPER_DOCKER_SOCKET true
ENV HOME ${DAPPER_SOURCE}
WORKDIR ${DAPPER_SOURCE}
ENTRYPOINT ["powershell", "-NoLogo", "-NonInteractive", "-File", "./scripts/windows/entry.ps1"]
CMD ["ci"]

143
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/Dockerfile.dapper Normal file
View File

@ -0,0 +1,143 @@
FROM registry.suse.com/bci/golang:1.22
ARG DAPPER_HOST_ARCH
ENV HOST_ARCH=${DAPPER_HOST_ARCH} ARCH=${DAPPER_HOST_ARCH}
ENV CATTLE_HELM_VERSION v2.16.8-rancher2
ENV CATTLE_MACHINE_VERSION v0.15.0-rancher116
ENV CATTLE_K3S_VERSION v1.30.2+k3s2
# helm 3 version
ENV HELM_VERSION v3.15.2
ENV KUSTOMIZE_VERSION v5.4.2
ENV HELM_UNITTEST_VERSION 0.3.2
# k3d ci version
ENV K3D_VERSION v5.7.1
# kontainer-driver-metadata branch to be set for specific branch other than dev/master, logic at rancher/rancher/pkg/settings/setting.go
ENV CATTLE_KDM_BRANCH=release-v2.9
RUN zypper -n install gcc binutils glibc-devel-static ca-certificates git-core wget curl unzip tar vim less file xz gzip sed gawk iproute2 iptables jq skopeo
# use containerd from k3s image, not from bci
RUN zypper install -y -f docker && rpm -e --nodeps --noscripts containerd
# prevents `detected dubious ownership in repository` git error due to uid/gid not matching when using bind mounts
RUN git config -f /etc/gitconfig --add safe.directory /go/src/github.com/rancher/rancher
RUN curl -sLf https://github.com/rancher/machine/releases/download/${CATTLE_MACHINE_VERSION}/rancher-machine-${ARCH}.tar.gz | tar xvzf - -C /usr/bin
RUN if [ "${ARCH}" != "s390x" ]; then \
curl -s https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | TAG=${K3D_VERSION} bash; \
fi
ENV GOLANGCI_LINT v1.59.0
RUN if [ "${ARCH}" == "amd64" ]; then \
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s "${GOLANGCI_LINT}"; \
curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/spectrometer/master/install.sh | sh; \
fi
# Tool for CRD generation.
ENV CONTROLLER_GEN_VERSION v0.14.0
RUN go install sigs.k8s.io/controller-tools/cmd/controller-gen@${CONTROLLER_GEN_VERSION}
# YAML processor for release configuration.
ENV YQ_VERSION v4.44.2
RUN wget -q https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_${ARCH}.tar.gz -O - | tar xz && mv yq_linux_${ARCH} /usr/bin/yq
ENV HELM_URL_V2_amd64=https://github.com/rancher/helm/releases/download/${CATTLE_HELM_VERSION}/rancher-helm \
HELM_URL_V2_arm64=https://github.com/rancher/helm/releases/download/${CATTLE_HELM_VERSION}/rancher-helm-arm64 \
HELM_URL_V2_s390x=https://github.com/rancher/helm/releases/download/${CATTLE_HELM_VERSION}/rancher-helm-s390x \
HELM_URL_V2=HELM_URL_V2_${ARCH} \
HELM_URL_V3=https://get.helm.sh/helm-${HELM_VERSION}-linux-${ARCH}.tar.gz \
TILLER_URL_amd64=https://github.com/rancher/helm/releases/download/${CATTLE_HELM_VERSION}/rancher-tiller \
TILLER_URL_arm64=https://github.com/rancher/helm/releases/download/${CATTLE_HELM_VERSION}/rancher-tiller-arm64 \
TILLER_URL_s390x=https://github.com/rancher/helm/releases/download/${CATTLE_HELM_VERSION}/rancher-tiller-s390x \
TILLER_URL=TILLER_URL_${ARCH} \
KUSTOMIZE_URL=https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/${KUSTOMIZE_VERSION}/kustomize_${KUSTOMIZE_VERSION}_linux_${ARCH}.tar.gz
RUN curl -sLf ${KUSTOMIZE_URL} | tar -xzf - -C /usr/bin
# set up helm 2
RUN curl -sLf ${!HELM_URL_V2} -o /usr/bin/rancher-helm && \
curl -sLf ${!TILLER_URL} -o /usr/bin/rancher-tiller && \
chmod +x /usr/bin/rancher-helm /usr/bin/rancher-tiller && \
ln -s /usr/bin/rancher-helm /usr/bin/helm && \
ln -s /usr/bin/rancher-tiller /usr/bin/tiller && \
helm init -c --stable-repo-url https://charts.helm.sh/stable/
# set up helm 3
RUN mkdir /usr/tmp && \
curl ${HELM_URL_V3} | tar xvzf - --strip-components=1 -C /usr/tmp/ && \
mv /usr/tmp/helm /usr/bin/helm_v3 && \
chmod +x /usr/bin/kustomize
# Set up K3s: copy the necessary binaries from the K3s image.
COPY --from=rancher/k3s:v1.30.2-k3s2 \
/bin/blkid \
/bin/bandwidth \
/bin/cni \
/bin/conntrack \
/bin/containerd \
/bin/containerd-shim-runc-v2 \
/bin/ethtool \
/bin/firewall \
/bin/ip \
/bin/ipset \
/bin/k3s \
/bin/losetup \
/bin/pigz \
/bin/runc \
/bin/which \
/bin/aux/xtables-legacy-multi \
/usr/bin/
RUN mkdir -p /go/src/github.com/rancher/rancher/.kube
RUN ln -s /usr/bin/cni /usr/bin/bridge && \
ln -s /usr/bin/cni /usr/bin/flannel && \
ln -s /usr/bin/cni /usr/bin/host-local && \
ln -s /usr/bin/cni /usr/bin/loopback && \
ln -s /usr/bin/cni /usr/bin/portmap && \
ln -s /usr/bin/k3s /usr/bin/crictl && \
ln -s /usr/bin/k3s /usr/bin/ctr && \
ln -s /usr/bin/k3s /usr/bin/k3s-agent && \
ln -s /usr/bin/k3s /usr/bin/k3s-etcd-snapshot && \
ln -s /usr/bin/k3s /usr/bin/k3s-server && \
ln -s /usr/bin/k3s /usr/bin/kubectl && \
ln -s /usr/bin/pigz /usr/bin/unpigz && \
ln -s /usr/bin/xtables-legacy-multi /usr/bin/iptables && \
ln -s /usr/bin/xtables-legacy-multi /usr/bin/iptables-save && \
ln -s /usr/bin/xtables-legacy-multi /usr/bin/iptables-restore && \
ln -s /usr/bin/xtables-legacy-multi /usr/bin/iptables-translate && \
ln -s /usr/bin/xtables-legacy-multi /usr/bin/ip6tables && \
ln -s /usr/bin/xtables-legacy-multi /usr/bin/ip6tables-save && \
ln -s /usr/bin/xtables-legacy-multi /usr/bin/ip6tables-restore && \
ln -s /usr/bin/xtables-legacy-multi /usr/bin/ip6tables-translate && \
ln -s /etc/rancher/k3s/k3s.yaml /go/src/github.com/rancher/rancher/.kube/k3s.yaml
RUN curl -sLf https://github.com/rancher/k3s/releases/download/${CATTLE_K3S_VERSION}/k3s-images.txt -o /usr/tmp/k3s-images.txt
# Python related dependencies for the Integration/Validation tests.
RUN zypper -n install python311-pip python311-base python311 python311-devel python311-tox libffi-devel libopenssl-devel
ENV HELM_HOME /root/.helm
ENV DAPPER_ENV REPO TAG CI DRONE_BUILD_NUMBER DRONE_TAG DRONE_COMMIT DRONE_BRANCH DRONE_BUILD_EVENT SYSTEM_CHART_DEFAULT_BRANCH FOSSA_API_KEY GOGET_MODULE GOGET_VERSION RELEASE_ACTION RELEASE_TYPE POSTRELEASE_RANCHER_VERSION POSTRELEASE_RANCHER_STABLE DEBUG SOME_K8S_VERSION V2PROV_TEST_DIST V2PROV_TEST_RUN_REGEX V2PROV_DISTRO_DATA_DIR V2PROV_PROVISIONING_DATA_DIR V2PROV_SYSTEM_AGENT_DATA_DIR
ENV DAPPER_SOURCE /go/src/github.com/rancher/rancher/
ENV DAPPER_OUTPUT ./bin ./dist ./go.mod ./go.sum ./pkg/apis/go.mod ./pkg/apis/go.sum ./pkg/client/go.mod ./pkg/client/go.sum ./scripts/package ./pkg/settings/setting.go ./package/Dockerfile ./Dockerfile.dapper ./pkg/crds/yaml/generated
ENV DAPPER_DOCKER_SOCKET true
ARG CI
ARG DRONE_BUILD_NUMBER
ENV DAPPER_RUN_ARGS "-v rancher2-go16-pkg-1:/go/pkg -v rancher2-go16-cache-1:/root/.cache/go-build --privileged --label CI=${CI} --label DRONE_BUILD_NUMBER=${DRONE_BUILD_NUMBER}"
ENV GOCACHE /root/.cache/go-build
ENV HOME ${DAPPER_SOURCE}
# set up helm unittest - only needs to run on one arch. Needs to run after $HOME has been changed so we can find it later
RUN if [ "${ARCH}" == "amd64" ]; then \
helm_v3 plugin install https://github.com/helm-unittest/helm-unittest.git --version ${HELM_UNITTEST_VERSION}; \
fi
VOLUME /var/lib/rancher
VOLUME /var/lib/kubelet
WORKDIR ${DAPPER_SOURCE}
ENTRYPOINT ["./scripts/entry"]
CMD ["ci"]

178
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/LICENSE Normal file
View File

@ -0,0 +1,178 @@
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS

23
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/Makefile Normal file
View File

@ -0,0 +1,23 @@
TARGETS := $(shell ls scripts)
DEV_TARGETS := $(shell ls dev-scripts)
.dapper:
@echo Downloading dapper
@curl -sL https://releases.rancher.com/dapper/latest/dapper-`uname -s`-`uname -m` > .dapper.tmp
@@chmod +x .dapper.tmp
@./.dapper.tmp -v
@mv .dapper.tmp .dapper
$(TARGETS): .dapper
@if [ "$@" = "check-chart-kdm-source-values" ]; then \
./.dapper -q --no-out $@; \
else \
./.dapper $@; \
fi
.DEFAULT_GOAL := ci
$(DEV_TARGETS):
./dev-scripts/$@
.PHONY: $(TARGETS) $(DEV_TARGETS)

67
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/README-template.md Normal file
View File

@ -0,0 +1,67 @@
# Rancher
*This file is auto-generated from README-template.md, please make any changes there.*
[![Build Status](https://drone-publish.rancher.io/api/badges/rancher/rancher/status.svg?branch=release/v2.8)](https://drone-publish.rancher.io/rancher/rancher)
[![Docker Pulls](https://img.shields.io/docker/pulls/rancher/rancher.svg)](https://store.docker.com/community/images/rancher/rancher)
[![Go Report Card](https://goreportcard.com/badge/github.com/rancher/rancher)](https://goreportcard.com/report/github.com/rancher/rancher)
Rancher is an open source container management platform built for organizations that deploy containers in production. Rancher makes it easy to run Kubernetes everywhere, meet IT requirements, and empower DevOps teams.
## Latest Release
To get automated notifications of our latest release, you can watch the announcements category in our [forums](http://forums.rancher.com/c/announcements), or subscribe to the RSS feed `https://forums.rancher.com/c/announcements.rss`.
## Quick Start
sudo docker run -d --restart=unless-stopped -p 80:80 -p 443:443 --privileged rancher/rancher
Open your browser to https://localhost
## Installation
See [Installing/Upgrading Rancher](https://ranchermanager.docs.rancher.com/v2.8/pages-for-subheaders/installation-and-upgrade) for all installation options.
### Minimum Requirements
* Operating Systems
* Please see [Support Matrix](https://rancher.com/support-matrix/) for specific OS versions for each Rancher version. Note that the link will default to the support matrix for the latest version of Rancher. Use the left navigation menu to select a different Rancher version.
* Hardware & Software
* Please see [Installation Requirements](https://ranchermanager.docs.rancher.com/v2.8/pages-for-subheaders/installation-requirements) for hardware and software requirements.
### Using Rancher
To learn more about using Rancher, please refer to our [Rancher Documentation](https://ranchermanager.docs.rancher.com/v2.8).
## Source Code
This repo is a meta-repo used for packaging and contains the majority of Rancher codebase. For other Rancher projects and modules, [see go.mod](https://github.com/rancher/rancher/blob/release/v2.8/go.mod) for the full list.
Rancher also includes other open source libraries and projects, [see go.mod](https://github.com/rancher/rancher/blob/release/v2.8/go.mod) for the full list.
## Build configuration
Refer to the [build docs](docs/build.md) on how to customize the building and packaging of Rancher.
## Support, Discussion, and Community
If you need any help with Rancher, please join us at either our [Rancher forums](http://forums.rancher.com/) or [Slack](https://slack.rancher.io/) where most of our team hangs out at.
Please submit any Rancher bugs, issues, and feature requests to [rancher/rancher](https://github.com/rancher/rancher/issues).
For security issues, please first check our [security policy](SECURITY.md) and email security-rancher@suse.com instead of posting a public issue in GitHub. You may (but are not required to) use the GPG key located on [Keybase](https://keybase.io/rancher).
# License
Copyright (c) 2014-CURRENTYEAR [Rancher Labs, Inc.](http://rancher.com)
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
[http://www.apache.org/licenses/LICENSE-2.0](http://www.apache.org/licenses/LICENSE-2.0)
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

76
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/README.md Normal file
View File

@ -0,0 +1,76 @@
# Rancher
*This file is auto-generated from README-template.md, please make any changes there.*
[![Build Status](https://drone-publish.rancher.io/api/badges/rancher/rancher/status.svg?branch=release/v2.8)](https://drone-publish.rancher.io/rancher/rancher)
[![Docker Pulls](https://img.shields.io/docker/pulls/rancher/rancher.svg)](https://store.docker.com/community/images/rancher/rancher)
[![Go Report Card](https://goreportcard.com/badge/github.com/rancher/rancher)](https://goreportcard.com/report/github.com/rancher/rancher)
Rancher is an open source container management platform built for organizations that deploy containers in production. Rancher makes it easy to run Kubernetes everywhere, meet IT requirements, and empower DevOps teams.
## Latest Release
* v2.8
* Latest - v2.8.5 - `rancher/rancher:v2.8.5` / `rancher/rancher:latest` - Read the full release [notes](https://github.com/rancher/rancher/releases/tag/v2.8.5).
* Stable - v2.8.5 - `rancher/rancher:v2.8.5` / `rancher/rancher:stable` - Read the full release [notes](https://github.com/rancher/rancher/releases/tag/v2.8.5).
* v2.7
* Latest - v2.7.10 - `rancher/rancher:v2.7.10` - Read the full release [notes](https://github.com/rancher/rancher/releases/tag/v2.7.10).
* Stable - v2.7.10 - `rancher/rancher:v2.7.10` - Read the full release [notes](https://github.com/rancher/rancher/releases/tag/v2.7.10).
* v2.6
* Latest - v2.6.14 - `rancher/rancher:v2.6.14` - Read the full release [notes](https://github.com/rancher/rancher/releases/tag/v2.6.14).
* Stable - v2.6.14 - `rancher/rancher:v2.6.14` - Read the full release [notes](https://github.com/rancher/rancher/releases/tag/v2.6.14).
To get automated notifications of our latest release, you can watch the announcements category in our [forums](http://forums.rancher.com/c/announcements), or subscribe to the RSS feed `https://forums.rancher.com/c/announcements.rss`.
## Quick Start
sudo docker run -d --restart=unless-stopped -p 80:80 -p 443:443 --privileged rancher/rancher
Open your browser to https://localhost
## Installation
See [Installing/Upgrading Rancher](https://ranchermanager.docs.rancher.com/v2.8/pages-for-subheaders/installation-and-upgrade) for all installation options.
### Minimum Requirements
* Operating Systems
* Please see [Support Matrix](https://rancher.com/support-matrix/) for specific OS versions for each Rancher version. Note that the link will default to the support matrix for the latest version of Rancher. Use the left navigation menu to select a different Rancher version.
* Hardware & Software
* Please see [Installation Requirements](https://ranchermanager.docs.rancher.com/v2.8/pages-for-subheaders/installation-requirements) for hardware and software requirements.
### Using Rancher
To learn more about using Rancher, please refer to our [Rancher Documentation](https://ranchermanager.docs.rancher.com/v2.8).
## Source Code
This repo is a meta-repo used for packaging and contains the majority of Rancher codebase. For other Rancher projects and modules, [see go.mod](https://github.com/rancher/rancher/blob/release/v2.8/go.mod) for the full list.
Rancher also includes other open source libraries and projects, [see go.mod](https://github.com/rancher/rancher/blob/release/v2.8/go.mod) for the full list.
## Build configuration
Refer to the [build docs](docs/build.md) on how to customize the building and packaging of Rancher.
## Support, Discussion, and Community
If you need any help with Rancher, please join us at either our [Rancher forums](http://forums.rancher.com/) or [Slack](https://slack.rancher.io/) where most of our team hangs out at.
Please submit any Rancher bugs, issues, and feature requests to [rancher/rancher](https://github.com/rancher/rancher/issues).
For security issues, please first check our [security policy](SECURITY.md) and email security-rancher@suse.com instead of posting a public issue in GitHub. You may (but are not required to) use the GPG key located on [Keybase](https://keybase.io/rancher).
# License
Copyright (c) 2014-2024 [Rancher Labs, Inc.](http://rancher.com)
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
[http://www.apache.org/licenses/LICENSE-2.0](http://www.apache.org/licenses/LICENSE-2.0)
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

5
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/build.yaml Normal file
View File

@ -0,0 +1,5 @@
webhookVersion: 104.0.1+up0.5.1
provisioningCAPIVersion: 104.0.0+up0.3.0
cspAdapterMinVersion: 104.0.0+up4.0.0
defaultShellVersion: rancher/shell:v0.2.1
fleetVersion: 104.0.1+up0.10.1

10
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/channels.yaml Normal file
View File

@ -0,0 +1,10 @@
channels:
- name: latest
latestRegexp: .*
excludeRegexp: ^[^+]+-
- name: testing
latestRegexp: .*
github:
owner: rancher
repo: rancher
redirectBase: https://github.com/rancher/rancher/releases/tag/

1
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/chart/.helmignore Normal file
View File

@ -0,0 +1 @@
tests

16
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/chart/Chart.yaml Normal file
View File

@ -0,0 +1,16 @@
apiVersion: v2
name: rancher
description: Install Rancher Server to manage Kubernetes clusters across providers.
version: %VERSION%
appVersion: %APP_VERSION%
kubeVersion: < 1.31.0-0
home: https://rancher.com
icon: https://github.com/rancher/ui/blob/master/public/assets/images/logos/welcome-cow.svg
keywords:
- rancher
sources:
- https://github.com/rancher/rancher
- https://github.com/rancher/server-chart
maintainers:
- name: Rancher Labs
email: charts@rancher.com

208
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/chart/README.md Normal file
View File

@ -0,0 +1,208 @@
By installing this application, you accept the [End User License Agreement & Terms & Conditions](https://www.suse.com/licensing/eula/).
# Rancher
***Rancher*** is open source software that combines everything an organization needs to adopt and run containers in production. Built on Kubernetes, Rancher makes it easy for DevOps teams to test, deploy and manage their applications.
### Introduction
This chart bootstraps a [Rancher Server](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster) on a Kubernetes cluster using the [Helm](https://helm.sh/) package manager. For a Rancher Supported Deployment please follow our [HA install instructions](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-cluster-setup/high-availability-installs).
### Prerequisites Details
*For installations covered under [Rancher Support SLA](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions) the target cluster must be **[RKE1](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher)**, **[RKE2](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke2-for-rancher)**, **[K3s](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-cluster-setup/k3s-for-rancher)**, **[AKS](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks)**, **[EKS](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks)**, or **[GKE](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke)**.*
Make sure the node(s) for the Rancher server fulfill the following requirements:
[Operating Systems and Container Runtime Requirements](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#operating-systems-and-container-runtime-requirements)
[Hardware Requirements](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#hardware-requirements)
- [CPU and Memory](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#cpu-and-memory)
- [Ingress](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#ingress)
- [Disks](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#disks)
[Networking Requirements](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#networking-requirements)
- [Node IP Addresses](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#node-ip-addresses)
- [Port Requirements](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#port-requirements)
[Install the Required CLI Tools](https://ranchermanager.docs.rancher.com/pages-for-subheaders/cli-with-rancher)
- [kubectl](https://ranchermanager.docs.rancher.com/reference-guides/cli-with-rancher/kubectl-utility) - Kubernetes command-line tool.
- [helm](https://docs.helm.sh/using_helm/#installing-helm) - Package management for Kubernetes. Refer to the [Helm version requirements](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/resources/helm-version-requirements) to choose a version of Helm to install Rancher.
For a list of best practices that we recommend for running the Rancher server in production, refer to the [best practices section](https://ranchermanager.docs.rancher.com/pages-for-subheaders/best-practices).
## Installing Rancher
For production environments, we recommend installing Rancher in a [high-availability Kubernetes installation](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-cluster-setup/high-availability-installs) so that your user base can always access Rancher Server. When installed in a Kubernetes cluster, Rancher will integrate with the cluster’s etcd database and take advantage of Kubernetes scheduling for high-availability.
Optional: Installing Rancher on a [Single-node](https://ranchermanager.docs.rancher.com/pages-for-subheaders/rancher-on-a-single-node-with-docker) Kubernetes Cluster
#### Add the Helm Chart Repository
Use [helm repo add](https://helm.sh/docs/helm/helm_repo_add/) command to add the Helm chart repository that contains charts to install Rancher. For more information about the repository choices and which is best for your use case, see Choosing a Version of Rancher.
```bash
helm repo add rancher-latest https://releases.rancher.com/server-charts/latest
```
#### Create a Namespace for Rancher
We’ll need to define a Kubernetes namespace where the resources created by the Chart should be installed. This should always be cattle-system:
```bash
kubectl create namespace cattle-system
```
#### Choose your SSL Configuration
The Rancher management server is designed to be secure by default and requires SSL/TLS configuration.
There are three recommended options for the source of the certificate used for TLS termination at the Rancher server:
- [Rancher-generated TLS certificate](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#3-choose-your-ssl-configuration)
- [Let’s Encrypt](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#3-choose-your-ssl-configuration)
- [Bring your own certificate](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#3-choose-your-ssl-configuration)
#### Install cert-manager
This step is only required to use certificates issued by Rancher’s generated CA **`(ingress.tls.source=rancher)`** or to request Let’s Encrypt issued certificates **`(ingress.tls.source=letsEncrypt)`**.
[These instructions are adapted from the official cert-manager documentation.](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#4-install-cert-manager)
#### Install Rancher with Helm and Your Chosen Certificate Option
- [Rancher to generated certificates](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#5-install-rancher-with-helm-and-your-chosen-certificate-option)
```bash
helm install rancher rancher-latest/rancher \
--namespace cattle-system \
--set hostname=rancher.my.org
```
- [Let’s Encrypt](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#5-install-rancher-with-helm-and-your-chosen-certificate-option)
```bash
helm install rancher rancher-latest/rancher \
--namespace cattle-system \
--set hostname=rancher.my.org \
--set ingress.tls.source=letsEncrypt \
--set letsEncrypt.email=me@example.org
```
- [Certificates from Files](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#5-install-rancher-with-helm-and-your-chosen-certificate-option)
```bash
helm install rancher rancher-latest/rancher \
--namespace cattle-system \
--set hostname=rancher.my.org \
--set ingress.tls.source=secret
```
*If you are using a Private CA signed certificate , add **--set privateCA=true** to the command:`*
```bash
helm install rancher rancher-latest/rancher \
--namespace cattle-system \
--set hostname=rancher.my.org \
--set ingress.tls.source=secret \
--set privateCA=true
```
#### Verify that the Rancher Server is Successfully Deployed
After adding the secrets, check if Rancher was rolled out successfully:
```bash
kubectl -n cattle-system rollout status deploy/rancher
Waiting for deployment "rancher" rollout to finish: 0 of 3 updated replicas are available...
deployment "rancher" successfully rolled out
```
If you see the following **`error: error: deployment "rancher" exceeded its progress deadline`**, you can check the status of the deployment by running the following command:
```bash
kubectl -n cattle-system get deploy rancher
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE
rancher 3 3 3 3 3m
```
It should show the same count for **`DESIRED`** and **`AVAILABLE`**.
#### Save Your Options
Make sure you save the **`--set`** options you used. You will need to use the same options when you upgrade Rancher to new versions with Helm.
#### Finishing Up
That’s it. You should have a functional Rancher server.
In a web browser, go to the DNS name that forwards traffic to your load balancer. Then you should be greeted by the colorful login page.
Doesn’t work? Take a look at the [Troubleshooting Page](https://ranchermanager.docs.rancher.com/troubleshooting/general-troubleshooting)
***All of these instructions are defined in detailed in the [Rancher Documentation](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#install-the-rancher-helm-chart).***
### Helm Chart Options for Kubernetes Installations
The full [Helm Chart Options](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-references/helm-chart-options) can be found here.
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
#### Common Options
| Parameter | Default Value | Description |
| ------------------------- | ------------- | -------------------------------------------------------------------------------------------- |
| `hostname` | " " | ***string*** - the Fully Qualified Domain Name for your Rancher Server |
| `ingress.tls.source` | "rancher" | ***string*** - Where to get the cert for the ingress. - "***rancher, letsEncrypt, secret***" |
| `letsEncrypt.email` | " " | ***string*** - Your email address |
| `letsEncrypt.environment` | "production" | ***string*** - Valid options: "***staging, production***" |
| `privateCA` | false | ***bool*** - Set to true if your cert is signed by a private CA |
#### Advanced Options
| Parameter | Default Value | Description |
| ---------------------------------------- | ------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `additionalTrustedCAs` | false | ***bool*** - [See Additional Trusted CAs Server](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-references/helm-chart-options#additional-trusted-cas) |
| `addLocal` | "true" | ***string*** - As of Rancher v2.5.0 this flag is deprecated and must be set to "true" |
| `antiAffinity` | "preferred" | ***string*** - AntiAffinity rule for Rancher pods - *"preferred, required"* |
| `replicas` | 3 | ***int*** - Number of replicas of Rancher pods |
| `auditLog.destination` | "sidecar" | ***string*** - Stream to sidecar container console or hostPath volume - *"sidecar, hostPath"* |
| `auditLog.hostPath` | "/var/log/rancher/audit" | ***string*** - log file destination on host (only applies when **auditLog.destination** is set to **hostPath**) |
| `auditLog.level` | 0 | ***int*** - set the [API Audit Log level](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#audit-log-levels). 0 is off. [0-3] |
| `auditLog.maxAge` | 1 | ***int*** - maximum number of days to retain old audit log files (only applies when **auditLog.destination** is set to **hostPath**) |
| `auditLog.maxBackup` | 1 | int - maximum number of audit log files to retain (only applies when **auditLog.destination** is set to **hostPath**) |
| `auditLog.maxSize` | 100 | ***int*** - maximum size in megabytes of the audit log file before it gets rotated (only applies when **auditLog.destination** is set to **hostPath**) |
| `auditLog.image.repository` | "rancher/mirrored-bci-micro" | ***string*** - Location for the image used to collect audit logs *Note: Available as of v2.7.0* |
| `auditLog.image.tag` | "15.4.14.3" | ***string*** - Tag for the image used to collect audit logs *Note: Available as of v2.7.0* |
| `auditLog.image.pullPolicy` | "IfNotPresent" | ***string*** - Override imagePullPolicy for auditLog images - *"Always", "Never", "IfNotPresent"* *Note: Available as of v2.7.0* |
| `busyboxImage` | "" | ***string*** - *Deprecated `auditlog.image.repository` should be used to control auditing sidecar image.* Image location for busybox image used to collect audit logs *Note: Available as of v2.2.0, and Deprecated as of v2.7.0* |
| `busyboxImagePullPolicy` | "IfNotPresent" | ***string*** - - *Deprecated `auditlog.image.pullPolicy` should be used to control auditing sidecar image.* Override imagePullPolicy for busybox images - *"Always", "Never", "IfNotPresent"* *Deprecated as of v2.7.0* |
| `debug` | false | ***bool*** - set debug flag on rancher server |
| `certmanager.version` | " " | ***string*** - set cert-manager compatibility |
| `extraEnv` | [] | ***list*** - set additional environment variables for Rancher Note: *Available as of v2.2.0* |
| `imagePullSecrets` | [] | ***list*** - list of names of Secret resource containing private registry credentials |
| `ingress.enabled` | true | ***bool*** - install ingress resource |
| `ingress.ingressClassName` | " " | ***string*** - class name of ingress if not set manually or by the ingress controller's defaults |
| `ingress.includeDefaultExtraAnnotations` | true | ***bool*** - Add default nginx annotations |
| `ingress.extraAnnotations` | {} | ***map*** - additional annotations to customize the ingress |
| `ingress.configurationSnippet` | " " | ***string*** - Add additional Nginx configuration. Can be used for proxy configuration. Note: *Available as of v2.0.15, v2.1.10 and v2.2.4* |
| `service.annotations` | {} | ***map*** - annotations to customize the service |
| `service.type` | " " | ***string*** - Override the type used for the service - *"NodePort", "LoadBalancer", "ClusterIP"* |
| `letsEncrypt.ingress.class` | " " | ***string*** - optional ingress class for the cert-manager acmesolver ingress that responds to the Let’s *Encrypt ACME challenges* |
| `proxy` | " " | ***string** - HTTP[S] proxy server for Rancher |
| `noProxy` | "127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local" | ***string*** - comma separated list of hostnames or ip address not to use the proxy |
| `resources` | {} | ***map*** - rancher pod resource requests & limits |
| `rancherImage` | "rancher/rancher" | ***string*** - rancher image source |
| `rancherImageTag` | same as chart version | ***string*** - rancher/rancher image tag |
| `rancherImagePullPolicy` | "IfNotPresent" | ***string*** - Override imagePullPolicy for rancher server images - *"Always", "Never", "IfNotPresent"* |
| `tls` | "ingress" | ***string*** - See External TLS Termination for details. - *"ingress, external"* |
| `systemDefaultRegistry` | "" | ***string*** - private registry to be used for all system Docker images, e.g., [http://registry.example.com/] *Available as of v2.3.0* |
| `useBundledSystemChart` | false | ***bool*** - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. *Available as of v2.3.0* |
| `customLogos.enabled` | false | ***bool*** - Enabled [Ember Rancher UI (cluster manager) custom logos](https://github.com/rancher/ui/tree/master/public/assets/images/logos) and [Vue Rancher UI (cluster explorer) custom logos](https://github.com/rancher/dashboard/tree/master/shell/assets/images/pl) persistence volume |
| `customLogos.volumeSubpaths.emberUi` | "ember" | ***string*** - Volume subpath for [Ember Rancher UI (cluster manager) custom logos](https://github.com/rancher/ui/tree/master/public/assets/images/logos) persistence |
| `customLogos.volumeSubpaths.vueUi` | "vue" | ***string*** - Volume subpath for [Vue Rancher UI (cluster explorer) custom logos](https://github.com/rancher/dashboard/tree/master/shell/assets/images/pl) persistence |
| `customLogos.volumeName` | "" | ***string*** - Use an existing volume. Custom logos should be copied to the proper `volume/subpath` folder by the user. Optional for persistentVolumeClaim, required for configMap |
| `customLogos.storageClass` | "" | ***string*** - Set custom logos persistentVolumeClaim storage class. Required for dynamic pv |
| `customLogos.accessMode` | "ReadWriteOnce" | ***string*** - Set custom persistentVolumeClaim access mode |
| `customLogos.size` | "1Gi" | ***string*** - Set custom persistentVolumeClaim size |

94
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/chart/scripts/post-delete-hook.sh Executable file
View File

@ -0,0 +1,94 @@
#!/bin/bash
set -e
namespaces="${NAMESPACES}"
rancher_namespace="${RANCHER_NAMESPACE}"
timeout="${TIMEOUT}"
ignoreTimeoutError="${IGNORETIMEOUTERROR}"
if [[ -z ${namespaces} ]]; then
echo "No namespace is provided."
exit 1
fi
if [[ -z ${rancher_namespace} ]]; then
echo "No rancher namespace is provided."
exit 1
fi
if [[ -z ${timeout} ]]; then
echo "No timeout value is provided."
exit 1
fi
if [[ -z ${ignoreTimeoutError} ]]; then
echo "No ignoreTimeoutError value is provided."
exit 1
fi
succeeded=()
failed=()
get_pod_count() {
kubectl get pods --selector app="${1}" -n "${2}" -o json | jq '.items | length'
}
echo "Uninstalling Rancher resources in the following namespaces: ${namespaces}"
for namespace in ${namespaces}; do
for app in $(helm list -n "${namespace}" -q); do
if [[ ${app} =~ .crd$ ]]; then
echo "--- Skip the app [${app}] in the namespace [${namespace}]"
continue
fi
echo "--- Deleting the app [${app}] in the namespace [${namespace}]"
if [[ ! $(helm uninstall "${app}" -n "${namespace}") ]]; then
failed=("${failed[@]}" "${app}")
continue
fi
t=0
while true; do
if [[ $(get_pod_count "${app}" "${namespace}") -eq 0 ]]; then
echo "successfully uninstalled [${app}] in the namespace [${namespace}]"
succeeded=("${succeeded[@]}" "${app}")
break
fi
if [[ ${t} -ge ${timeout} ]]; then
echo "timeout uninstalling [${app}] in the namespace [${namespace}]"
failed=("${failed[@]}" "${app}")
break
fi
# by default, wait 120 seconds in total for an app to be uninstalled
echo "waiting 5 seconds for pods of [${app}] to be terminated ..."
sleep 5
t=$((t + 5))
done
done
# delete the helm operator pods
for pod in $(kubectl get pods -n "${namespace}" -o name); do
if [[ ${pod} =~ ^pod\/helm-operation-* ]]; then
echo "--- Deleting the pod [${pod}] in the namespace [${namespace}]"
kubectl delete "${pod}" -n "${namespace}"
fi
done
done
echo "Removing Rancher bootstrap secret in the following namespace: ${rancher_namespace}"
kubectl --ignore-not-found=true delete secret bootstrap-secret -n "${rancher_namespace}"
echo "------ Summary ------"
if [[ ${#succeeded[@]} -ne 0 ]]; then
echo "Succeeded to uninstall the following apps:" "${succeeded[@]}"
fi
if [[ ${#failed[@]} -ne 0 ]]; then
echo "Failed to uninstall the following apps:" "${failed[@]}"
if [[ "${ignoreTimeoutError}" == "false" ]]; then
exit 2
fi
else
echo "Cleanup finished successfully."
fi

0
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/chart/sdjo-test.yaml Normal file
View File

22
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/chart/templates/NOTES.txt Normal file
View File

@ -0,0 +1,22 @@
Rancher Server has been installed.
NOTE: Rancher may take several minutes to fully initialize. Please standby while Certificates are being issued, Containers are started and the Ingress rule comes up.
Check out our docs at https://rancher.com/docs/
If you provided your own bootstrap password during installation, browse to https://{{ .Values.hostname }} to get started.
If this is the first time you installed Rancher, get started by running this command and clicking the URL it generates:
```
echo https://{{ .Values.hostname }}/dashboard/?setup=$(kubectl get secret --namespace cattle-system bootstrap-secret -o go-template='{{ "{{" }}.data.bootstrapPassword|base64decode{{ "}}" }}')
```
To get just the bootstrap password on its own, run:
```
kubectl get secret --namespace cattle-system bootstrap-secret -o go-template='{{ "{{" }}.data.bootstrapPassword|base64decode{{ "}}" }}{{ "{{" }} "\n" {{ "}}" }}'
```
Happy Containering!

76
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/chart/templates/_helpers.tpl Normal file
View File

@ -0,0 +1,76 @@
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "rancher.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "rancher.fullname" -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{/*
Create a default fully qualified chart name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "rancher.chartname" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | trunc 63 | trimSuffix "-" -}}
{{- end -}}
# Render Values in configurationSnippet
{{- define "configurationSnippet" -}}
{{- tpl (.Values.ingress.configurationSnippet) . | nindent 6 -}}
{{- end -}}
{{/*
Generate the labels.
*/}}
{{- define "rancher.labels" -}}
app: {{ template "rancher.fullname" . }}
chart: {{ template "rancher.chartname" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
{{- end }}
# Windows Support
{{/*
Windows cluster will add default taint for linux nodes,
add below linux tolerations to workloads could be scheduled to those linux nodes
*/}}
{{- define "linux-node-tolerations" -}}
- key: "cattle.io/os"
value: "linux"
effect: "NoSchedule"
operator: "Equal"
{{- end -}}
{{- define "linux-node-selector-terms" -}}
{{- $key := "kubernetes.io/os" -}}
- matchExpressions:
- key: {{ $key }}
operator: NotIn
values:
- windows
{{- end -}}
{{- define "system_default_registry" -}}
{{- if .Values.systemDefaultRegistry -}}
{{- if hasSuffix "/" .Values.systemDefaultRegistry -}}
{{- printf "%s" .Values.systemDefaultRegistry -}}
{{- else -}}
{{- printf "%s/" .Values.systemDefaultRegistry -}}
{{- end -}}
{{- end -}}
{{- end -}}

14
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/chart/templates/clusterRoleBinding.yaml Normal file
View File

@ -0,0 +1,14 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ template "rancher.fullname" . }}
labels:
{{ include "rancher.labels" . | indent 4 }}
subjects:
- kind: ServiceAccount
name: {{ template "rancher.fullname" . }}
namespace: {{ .Release.Namespace }}
roleRef:
kind: ClusterRole
name: cluster-admin
apiGroup: rbac.authorization.k8s.io

18
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/chart/templates/configMap.yaml Normal file
View File

@ -0,0 +1,18 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: rancher-config
labels: {{ include "rancher.labels" . | nindent 4 }}
app.kubernetes.io/part-of: "rancher"
data:
priorityClassName: {{ .Values.priorityClassName }}
{{- if and .Values.webhook (kindIs "string" .Values.webhook) }}
rancher-webhook: {{ .Values.webhook | quote }}
{{- else if .Values.webhook }}
rancher-webhook: {{ toYaml .Values.webhook | quote }}
{{- end }}
{{- if and .Values.fleet (kindIs "string" .Values.fleet) }}
fleet: {{ .Values.fleet | quote }}
{{- else if .Values.fleet }}
fleet: {{ toYaml .Values.fleet | quote }}
{{- end }}

264
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/chart/templates/deployment.yaml Normal file
View File

@ -0,0 +1,264 @@
kind: Deployment
apiVersion: apps/v1
metadata:
name: {{ template "rancher.fullname" . }}
annotations:
{{- if (lt (int .Values.replicas) 0) }}
management.cattle.io/scale-available: "{{ sub 0 (int .Values.replicas)}}"
{{- end }}
labels:
{{ include "rancher.labels" . | indent 4 }}
spec:
{{- if (gt (int .Values.replicas) 0) }}
replicas: {{ .Values.replicas }}
{{- end }}
selector:
matchLabels:
app: {{ template "rancher.fullname" . }}
strategy:
rollingUpdate:
maxSurge: 1
{{- if (eq (int .Values.replicas) 1) }}
maxUnavailable: 0
{{- else }}
maxUnavailable: 1
{{- end }}
type: RollingUpdate
template:
metadata:
labels:
app: {{ template "rancher.fullname" . }}
release: {{ .Release.Name }}
spec:
priorityClassName: {{ .Values.priorityClassName }}
serviceAccountName: {{ template "rancher.fullname" . }}
{{- if .Values.imagePullSecrets }}
imagePullSecrets:
{{ toYaml .Values.imagePullSecrets | indent 6 }}
{{- end }}
affinity:
podAntiAffinity:
{{- if eq .Values.antiAffinity "required" }}
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchExpressions:
- key: app
operator: In
values:
- {{ template "rancher.fullname" . }}
topologyKey: {{ .Values.topologyKey | default "kubernetes.io/hostname" }}
{{- else }}
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 100
podAffinityTerm:
labelSelector:
matchExpressions:
- key: app
operator: In
values:
- {{ template "rancher.fullname" . }}
topologyKey: {{ .Values.topologyKey | default "kubernetes.io/hostname" }}
{{- end }}
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms: {{ include "linux-node-selector-terms" . | nindent 14 }}
tolerations: {{ include "linux-node-tolerations" . | nindent 8 }}
containers:
- image: {{ .Values.rancherImage }}:{{ default .Chart.AppVersion .Values.rancherImageTag }}
imagePullPolicy: {{ default "IfNotPresent" .Values.rancherImagePullPolicy }}
name: {{ template "rancher.name" . }}
ports:
- containerPort: 80
protocol: TCP
{{- if (and .Values.hostPort (gt (int .Values.hostPort) 0)) }}
- containerPort: 444
hostPort: {{ int .Values.hostPort }}
protocol: TCP
{{- end}}
args:
{{- if .Values.debug }}
- "--debug"
{{- end }}
{{- if .Values.privateCA }}
# Private CA - don't clear ca certs
{{- else if and (eq .Values.tls "ingress") (eq .Values.ingress.tls.source "rancher") }}
# Rancher self-signed - don't clear ca certs
{{- else }}
# Public trusted CA - clear ca certs
- "--no-cacerts"
{{- end }}
- "--http-listen-port=80"
- "--https-listen-port=443"
- "--add-local={{ .Values.addLocal }}"
env:
- name: CATTLE_NAMESPACE
value: {{ .Release.Namespace }}
- name: CATTLE_PEER_SERVICE
value: {{ template "rancher.fullname" . }}
{{- if .Values.features }}
- name: CATTLE_FEATURES
value: "{{ .Values.features }}"
{{- end}}
{{- if .Values.noDefaultAdmin }}
- name: CATTLE_NO_DEFAULT_ADMIN
value: "{{ .Values.noDefaultAdmin }}"
{{- end}}
{{- if gt (int .Values.auditLog.level) 0 }}
- name: AUDIT_LEVEL
value: {{ .Values.auditLog.level | quote }}
- name: AUDIT_LOG_MAXAGE
value: {{ .Values.auditLog.maxAge | quote }}
- name: AUDIT_LOG_MAXBACKUP
value: {{ .Values.auditLog.maxBackup | quote }}
- name: AUDIT_LOG_MAXSIZE
value: {{ .Values.auditLog.maxSize | quote }}
{{- end }}
{{- if .Values.proxy }}
- name: HTTP_PROXY
value: {{ .Values.proxy }}
- name: HTTPS_PROXY
value: {{ .Values.proxy }}
- name: NO_PROXY
value: {{ .Values.noProxy }}
{{- end }}
{{- if .Values.systemDefaultRegistry }}
- name: CATTLE_SYSTEM_DEFAULT_REGISTRY
value: {{ .Values.systemDefaultRegistry }}
{{- end }}
{{- if .Values.useBundledSystemChart }}
- name: CATTLE_SYSTEM_CATALOG
value: bundled
{{- end }}
{{- if .Values.restrictedAdmin }}
- name: CATTLE_RESTRICTED_DEFAULT_ADMIN
value: "true"
{{- end}}
{{- if .Values.bootstrapPassword }}
- name: CATTLE_BOOTSTRAP_PASSWORD
valueFrom:
secretKeyRef:
name: "bootstrap-secret"
key: "bootstrapPassword"
{{- end }}
{{- if .Values.agentTLSMode }}
- name: CATTLE_AGENT_TLS_MODE
value: "{{ .Values.agentTLSMode }}"
{{- end }}
{{- if .Values.extraEnv }}
{{ toYaml .Values.extraEnv | indent 8}}
{{- end }}
startupProbe:
httpGet:
path: /healthz
port: 80
timeoutSeconds: {{ .Values.startupProbe.timeoutSeconds }}
failureThreshold: {{ .Values.startupProbe.failureThreshold }}
periodSeconds: {{ .Values.startupProbe.periodSeconds }}
livenessProbe:
httpGet:
path: /healthz
port: 80
{{- with .Values.livenessProbe.initialDelaySeconds}}
initialDelaySeconds: {{ . }}
{{- end }}
timeoutSeconds: {{.Values.livenessProbe.timeoutSeconds }}
periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
failureThreshold: {{.Values.livenessProbe.failureThreshold }}
readinessProbe:
httpGet:
path: /healthz
port: 80
{{- with .Values.readinessProbe.initialDelaySeconds}}
initialDelaySeconds: {{ . }}
{{- end }}
timeoutSeconds: {{.Values.readinessProbe.timeoutSeconds }}
periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
failureThreshold: {{.Values.readinessProbe.failureThreshold }}
resources:
{{ toYaml .Values.resources | indent 10 }}
volumeMounts:
{{- if .Values.additionalTrustedCAs }}
- mountPath: /etc/pki/trust/anchors/ca-additional.pem
name: tls-ca-additional-volume
subPath: ca-additional.pem
readOnly: true
- mountPath: /etc/rancher/ssl/ca-additional.pem
name: tls-ca-additional-volume
subPath: ca-additional.pem
readOnly: true
{{- end }}
{{- if .Values.privateCA }}
# Pass CA cert into rancher for private CA
- mountPath: /etc/rancher/ssl/cacerts.pem
name: tls-ca-volume
subPath: cacerts.pem
readOnly: true
{{- end }}
{{- if and .Values.customLogos.enabled (or (eq .Values.customLogos.volumeKind "persistentVolumeClaim") (and (eq .Values.customLogos.volumeKind "configMap") (.Values.customLogos.volumeName))) }}
# Mount rancher custom-logos volume
- mountPath: /usr/share/rancher/ui/assets/images/logos
name: custom-logos
subPath: {{ .Values.customLogos.volumeSubpaths.emberUi | default "ember" | quote }}
- mountPath: /usr/share/rancher/ui-dashboard/dashboard/_nuxt/assets/images/pl
name: custom-logos
subPath: {{ .Values.customLogos.volumeSubpaths.vueUi | default "vue" | quote }}
{{- end }}
{{- if gt (int .Values.auditLog.level) 0 }}
- mountPath: /var/log/auditlog
name: audit-log
{{- end }}
{{- if eq .Values.auditLog.destination "sidecar" }}
{{- if gt (int .Values.auditLog.level) 0 }}
# Make audit logs available for Rancher log collector tools.
{{- if .Values.busyboxImage }}
- image: {{ .Values.busyboxImage}}
{{- else }}
- image: {{ .Values.auditLog.image.repository }}:{{.Values.auditLog.image.tag}}
{{- end }}
{{- if .Values.busyboxImagePullPolicy }}
imagePullPolicy: {{ .Values.busyboxImagePullPolicy }}
{{- else }}
imagePullPolicy: {{ .Values.auditLog.image.pullPolicy }}
{{- end }}
name: {{ template "rancher.name" . }}-audit-log
command: ["tail"]
args: ["-F", "/var/log/auditlog/rancher-api-audit.log"]
volumeMounts:
- mountPath: /var/log/auditlog
name: audit-log
{{- end }}
{{- end }}
volumes:
{{- if .Values.additionalTrustedCAs }}
- name: tls-ca-additional-volume
secret:
defaultMode: 0400
secretName: tls-ca-additional
{{- end }}
{{- if .Values.privateCA }}
- name: tls-ca-volume
secret:
defaultMode: 0400
secretName: tls-ca
{{- end }}
{{- if gt (int .Values.auditLog.level) 0 }}
{{- if eq .Values.auditLog.destination "hostPath" }}
- name: audit-log
hostPath:
path: {{ .Values.auditLog.hostPath }}
type: DirectoryOrCreate
{{- else }}
- name: audit-log
emptyDir: {}
{{- end }}
{{- end }}
{{- if and .Values.customLogos.enabled (or (eq .Values.customLogos.volumeKind "persistentVolumeClaim") (and (eq .Values.customLogos.volumeKind "configMap") (.Values.customLogos.volumeName))) }}
- name: custom-logos
{{- if (eq .Values.customLogos.volumeKind "persistentVolumeClaim") }}
persistentVolumeClaim:
claimName: {{ .Values.customLogos.volumeName | default (printf "%s-custom-logos" (include "rancher.fullname" .)) }}
{{- else if (eq .Values.customLogos.volumeKind "configMap") }}
configMap:
name: {{ .Values.customLogos.volumeName }}
{{- end }}
{{- end }}

66
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/chart/templates/ingress.yaml Normal file
View File

@ -0,0 +1,66 @@
{{- if .Values.ingress.enabled }}
{{- if or (.Capabilities.APIVersions.Has "networking.k8s.io/v1/Ingress") (not (.Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/Ingress")) }}
apiVersion: networking.k8s.io/v1
{{- else }}
apiVersion: networking.k8s.io/v1beta1
{{- end }}
kind: Ingress
metadata:
name: {{ template "rancher.fullname" . }}
labels:
{{ include "rancher.labels" . | indent 4 }}
annotations:
{{- if .Values.ingress.configurationSnippet }}
nginx.ingress.kubernetes.io/configuration-snippet: |
{{- template "configurationSnippet" . }}
{{- end }}
{{- if eq .Values.tls "external" }}
nginx.ingress.kubernetes.io/ssl-redirect: "false" # turn off ssl redirect for external.
{{- else }}
{{- if ne .Values.ingress.tls.source "secret" }}
{{- $certmanagerVer := split "." .Values.certmanager.version -}}
{{- if or (.Capabilities.APIVersions.Has "certmanager.k8s.io/v1alpha1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (lt (int $certmanagerVer._1) 11)) }}
certmanager.k8s.io/issuer: {{ template "rancher.fullname" . }}
{{- else }}
cert-manager.io/issuer: {{ template "rancher.fullname" . }}
cert-manager.io/issuer-kind: Issuer
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.ingress.includeDefaultExtraAnnotations }}
nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"
nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"
{{- end }}
{{- if .Values.ingress.extraAnnotations }}
{{ toYaml .Values.ingress.extraAnnotations | indent 4 }}
{{- end }}
spec:
{{- if .Values.ingress.ingressClassName }}
ingressClassName: {{ .Values.ingress.ingressClassName }}
{{- end }}
rules:
- host: {{ .Values.hostname }} # hostname to access rancher server
http:
paths:
- backend:
{{- if or (.Capabilities.APIVersions.Has "networking.k8s.io/v1/Ingress") (not (.Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/Ingress")) }}
service:
name: {{ template "rancher.fullname" . }}
port:
number: {{ .Values.ingress.servicePort }}
{{- else }}
serviceName: {{ template "rancher.fullname" . }}
servicePort: {{ .Values.ingress.servicePort }}
{{- end }}
{{- if or (.Capabilities.APIVersions.Has "networking.k8s.io/v1/Ingress") (not (.Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/Ingress")) }}
pathType: {{ .Values.ingress.pathType }}
path: {{ .Values.ingress.path }}
{{- end }}
{{- if eq .Values.tls "ingress" }}
tls:
- hosts:
- {{ .Values.hostname }}
secretName: {{ .Values.ingress.tls.secretName }}
{{- end }}
{{- end }}

37
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/chart/templates/issuer-letsEncrypt.yaml Normal file
View File

@ -0,0 +1,37 @@
{{- if eq .Values.tls "ingress" -}}
{{- if eq .Values.ingress.tls.source "letsEncrypt" -}}
{{- $certmanagerVer := split "." .Values.certmanager.version -}}
{{- if or (.Capabilities.APIVersions.Has "cert-manager.io/v1beta1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 16)) }}
apiVersion: cert-manager.io/v1beta1
{{- else if or (.Capabilities.APIVersions.Has "cert-manager.io/v1alpha2") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 11)) }}
apiVersion: cert-manager.io/v1alpha2
{{- else if or (.Capabilities.APIVersions.Has "certmanager.k8s.io/v1alpha1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (lt (int $certmanagerVer._1) 11)) }}
apiVersion: certmanager.k8s.io/v1alpha1
{{- else }}
apiVersion: cert-manager.io/v1
{{- end }}
kind: Issuer
metadata:
name: {{ template "rancher.fullname" . }}
labels:
{{ include "rancher.labels" . | indent 4 }}
spec:
acme:
{{- if eq .Values.letsEncrypt.environment "production" }}
server: https://acme-v02.api.letsencrypt.org/directory
{{- else }}
server: https://acme-staging-v02.api.letsencrypt.org/directory
{{- end }}
email: {{ .Values.letsEncrypt.email }}
privateKeySecretRef:
name: letsencrypt-{{ .Values.letsEncrypt.environment }}
{{- if or (.Capabilities.APIVersions.Has "certmanager.k8s.io/v1alpha1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (lt (int $certmanagerVer._1) 11)) }}
http01: {}
{{- else }}
solvers:
- http01:
ingress:
class: {{ .Values.letsEncrypt.ingress.class }}
{{- end }}
{{- end -}}
{{- end -}}

22
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/chart/templates/issuer-rancher.yaml Normal file
View File

@ -0,0 +1,22 @@
{{- if eq .Values.tls "ingress" -}}
{{- if eq .Values.ingress.tls.source "rancher" -}}
{{- $certmanagerVer := split "." .Values.certmanager.version -}}
{{- if or (.Capabilities.APIVersions.Has "cert-manager.io/v1beta1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 16)) }}
apiVersion: cert-manager.io/v1beta1
{{- else if or (.Capabilities.APIVersions.Has "cert-manager.io/v1alpha2") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 11)) }}
apiVersion: cert-manager.io/v1alpha2
{{- else if or (.Capabilities.APIVersions.Has "certmanager.k8s.io/v1alpha1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (lt (int $certmanagerVer._1) 11)) }}
apiVersion: certmanager.k8s.io/v1alpha1
{{- else }}
apiVersion: cert-manager.io/v1
{{- end }}
kind: Issuer
metadata:
name: {{ template "rancher.fullname" . }}
labels:
{{ include "rancher.labels" . | indent 4 }}
spec:
ca:
secretName: tls-rancher
{{- end -}}
{{- end -}}

19
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/chart/templates/post-delete-hook-cluster-role-binding.yaml Normal file
View File

@ -0,0 +1,19 @@
{{- if .Values.postDelete.enabled }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: {{ template "rancher.fullname" . }}-post-delete
labels: {{ include "rancher.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": post-delete
"helm.sh/hook-weight": "2"
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{ template "rancher.fullname" . }}-post-delete
subjects:
- kind: ServiceAccount
name: {{ template "rancher.fullname" . }}-post-delete
namespace: {{ .Release.Namespace }}
{{- end }}

39
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/chart/templates/post-delete-hook-cluster-role.yaml Normal file
View File

@ -0,0 +1,39 @@
{{- if .Values.postDelete.enabled }}
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ template "rancher.fullname" . }}-post-delete
labels: {{ include "rancher.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": post-delete
"helm.sh/hook-weight": "1"
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
rules:
- apiGroups: [ "extensions","apps" ]
resources: [ "deployments" ]
verbs: [ "get", "list", "delete" ]
- apiGroups: [ "batch" ]
resources: [ "jobs" ]
verbs: [ "get", "list", "watch", "delete", "create" ]
- apiGroups: [ "rbac.authorization.k8s.io" ]
resources: [ "clusterroles", "clusterrolebindings", "roles", "rolebindings" ]
verbs: [ "get", "list", "delete", "create" ]
- apiGroups: [ "" ]
resources: [ "pods", "secrets", "services", "configmaps" ]
verbs: [ "get", "list", "delete" ]
- apiGroups: [ "" ]
resources: [ "serviceaccounts" ]
verbs: [ "get", "list", "delete", "create" ]
- apiGroups: [ "networking.k8s.io" ]
resources: [ "networkpolicies" ]
verbs: [ "get", "list", "delete" ]
- apiGroups: [ "admissionregistration.k8s.io" ]
resources: [ "validatingwebhookconfigurations", "mutatingwebhookconfigurations" ]
verbs: [ "get", "list", "delete" ]
- apiGroups: [ "networking.k8s.io" ]
resources: [ "ingresses" ]
verbs: [ "delete" ]
- apiGroups: [ "cert-manager.io" ]
resources: [ "issuers" ]
verbs: [ "delete" ]
{{- end }}

15
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/chart/templates/post-delete-hook-config-map.yaml Normal file
View File

@ -0,0 +1,15 @@
{{- if .Values.postDelete.enabled }}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ template "rancher.fullname" . }}-post-delete
namespace: {{ .Release.Namespace }}
labels: {{ include "rancher.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": post-delete
"helm.sh/hook-weight": "1"
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
data:
post-delete-hook.sh: |-
{{ $.Files.Get "scripts/post-delete-hook.sh" | indent 4 }}
{{- end }}

46
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/chart/templates/post-delete-hook-job.yaml Normal file
View File

@ -0,0 +1,46 @@
{{- if .Values.postDelete.enabled }}
apiVersion: batch/v1
kind: Job
metadata:
name: {{ template "rancher.fullname" . }}-post-delete
namespace: {{ .Release.Namespace }}
labels: {{ include "rancher.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": post-delete
"helm.sh/hook-weight": "3"
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
spec:
backoffLimit: 3
template:
metadata:
name: {{ template "rancher.fullname" . }}-post-delete
labels: {{ include "rancher.labels" . | nindent 8 }}
spec:
serviceAccountName: {{ template "rancher.fullname" . }}-post-delete
restartPolicy: OnFailure
containers:
- name: {{ template "rancher.name" . }}-post-delete
image: "{{ include "system_default_registry" . }}{{ .Values.postDelete.image.repository }}:{{ .Values.postDelete.image.tag }}"
imagePullPolicy: IfNotPresent
securityContext:
runAsUser: 0
command:
- /scripts/post-delete-hook.sh
volumeMounts:
- mountPath: /scripts
name: config-volume
env:
- name: NAMESPACES
value: {{ .Values.postDelete.namespaceList | join " " | quote }}
- name: RANCHER_NAMESPACE
value: {{ .Release.Namespace }}
- name: TIMEOUT
value: {{ .Values.postDelete.timeout | quote }}
- name: IGNORETIMEOUTERROR
value: {{ .Values.postDelete.ignoreTimeoutError | quote }}
volumes:
- name: config-volume
configMap:
name: {{ template "rancher.fullname" . }}-post-delete
defaultMode: 0777
{{- end }}

12
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/chart/templates/post-delete-hook-service-account.yaml Normal file
View File

@ -0,0 +1,12 @@
{{- if .Values.postDelete.enabled }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ template "rancher.fullname" . }}-post-delete
namespace: {{ .Release.Namespace }}
labels: {{ include "rancher.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": post-delete
"helm.sh/hook-weight": "1"
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
{{- end }}

8
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/chart/templates/priorityClass.yaml Normal file
View File

@ -0,0 +1,8 @@
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
name: rancher-critical
labels: {{ include "rancher.labels" . | nindent 4 }}
value: 1000000000
globalDefault: false
description: "Priority class used by pods critical to rancher's functionality."

Some files were not shown because too many files have changed in this diff Show More