first gpu-live commit
This commit is contained in:
root
commit
d0fd70f414
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,672 @@
|
||||||
|
apiVersion: v1 # ns 용 추가 by ljh
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: argocd
|
||||||
|
labels:
|
||||||
|
name: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: application-controller
|
||||||
|
app.kubernetes.io/name: argocd-application-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-application-controller
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: applicationset-controller
|
||||||
|
app.kubernetes.io/name: argocd-applicationset-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-applicationset-controller
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: dex-server
|
||||||
|
app.kubernetes.io/name: argocd-dex-server
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-dex-server
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: notifications-controller
|
||||||
|
app.kubernetes.io/name: argocd-notifications-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-notifications-controller
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: redis
|
||||||
|
app.kubernetes.io/name: argocd-redis
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-redis
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: repo-server
|
||||||
|
app.kubernetes.io/name: argocd-repo-server
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-repo-server
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: server
|
||||||
|
app.kubernetes.io/name: argocd-server
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-server
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: application-controller
|
||||||
|
app.kubernetes.io/name: argocd-application-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-application-controller
|
||||||
|
namespace: argocd
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
- configmaps
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- argoproj.io
|
||||||
|
resources:
|
||||||
|
- applications
|
||||||
|
- appprojects
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- update
|
||||||
|
- patch
|
||||||
|
- delete
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- list
|
||||||
|
- apiGroups:
|
||||||
|
- apps
|
||||||
|
resources:
|
||||||
|
- deployments
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: applicationset-controller
|
||||||
|
app.kubernetes.io/name: argocd-applicationset-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-applicationset-controller
|
||||||
|
namespace: argocd
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- argoproj.io
|
||||||
|
resources:
|
||||||
|
- applications
|
||||||
|
- applicationsets
|
||||||
|
- applicationsets/finalizers
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- argoproj.io
|
||||||
|
resources:
|
||||||
|
- appprojects
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- argoproj.io
|
||||||
|
resources:
|
||||||
|
- applicationsets/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
- configmaps
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- apps
|
||||||
|
- extensions
|
||||||
|
resources:
|
||||||
|
- deployments
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: dex-server
|
||||||
|
app.kubernetes.io/name: argocd-dex-server
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-dex-server
|
||||||
|
namespace: argocd
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
- configmaps
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: notifications-controller
|
||||||
|
app.kubernetes.io/name: argocd-notifications-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-notifications-controller
|
||||||
|
namespace: argocd
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- argoproj.io
|
||||||
|
resources:
|
||||||
|
- applications
|
||||||
|
- appprojects
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- update
|
||||||
|
- patch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- configmaps
|
||||||
|
- secrets
|
||||||
|
verbs:
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resourceNames:
|
||||||
|
- argocd-notifications-cm
|
||||||
|
resources:
|
||||||
|
- configmaps
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resourceNames:
|
||||||
|
- argocd-notifications-secret
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: redis
|
||||||
|
app.kubernetes.io/name: argocd-redis
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-redis
|
||||||
|
namespace: argocd
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resourceNames:
|
||||||
|
- argocd-redis
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: server
|
||||||
|
app.kubernetes.io/name: argocd-server
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-server
|
||||||
|
namespace: argocd
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
- configmaps
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- update
|
||||||
|
- patch
|
||||||
|
- delete
|
||||||
|
- apiGroups:
|
||||||
|
- argoproj.io
|
||||||
|
resources:
|
||||||
|
- applications
|
||||||
|
- appprojects
|
||||||
|
- applicationsets
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- update
|
||||||
|
- delete
|
||||||
|
- patch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- list
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: application-controller
|
||||||
|
app.kubernetes.io/name: argocd-application-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-application-controller
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- '*'
|
||||||
|
resources:
|
||||||
|
- '*'
|
||||||
|
verbs:
|
||||||
|
- '*'
|
||||||
|
- nonResourceURLs:
|
||||||
|
- '*'
|
||||||
|
verbs:
|
||||||
|
- '*'
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: applicationset-controller
|
||||||
|
app.kubernetes.io/name: argocd-applicationset-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-applicationset-controller
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- argoproj.io
|
||||||
|
resources:
|
||||||
|
- applications
|
||||||
|
- applicationsets
|
||||||
|
- applicationsets/finalizers
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- argoproj.io
|
||||||
|
resources:
|
||||||
|
- applicationsets/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- argoproj.io
|
||||||
|
resources:
|
||||||
|
- appprojects
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- configmaps
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- update
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- apps
|
||||||
|
- extensions
|
||||||
|
resources:
|
||||||
|
- deployments
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- coordination.k8s.io
|
||||||
|
resources:
|
||||||
|
- leases
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: server
|
||||||
|
app.kubernetes.io/name: argocd-server
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-server
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- '*'
|
||||||
|
resources:
|
||||||
|
- '*'
|
||||||
|
verbs:
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- list
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- pods
|
||||||
|
- pods/log
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- argoproj.io
|
||||||
|
resources:
|
||||||
|
- applications
|
||||||
|
- applicationsets
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- batch
|
||||||
|
resources:
|
||||||
|
- jobs
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- apiGroups:
|
||||||
|
- argoproj.io
|
||||||
|
resources:
|
||||||
|
- workflows
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: application-controller
|
||||||
|
app.kubernetes.io/name: argocd-application-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-application-controller
|
||||||
|
namespace: argocd
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: argocd-application-controller
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: argocd-application-controller
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: applicationset-controller
|
||||||
|
app.kubernetes.io/name: argocd-applicationset-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-applicationset-controller
|
||||||
|
namespace: argocd
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: argocd-applicationset-controller
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: argocd-applicationset-controller
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: dex-server
|
||||||
|
app.kubernetes.io/name: argocd-dex-server
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-dex-server
|
||||||
|
namespace: argocd
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: argocd-dex-server
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: argocd-dex-server
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: notifications-controller
|
||||||
|
app.kubernetes.io/name: argocd-notifications-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-notifications-controller
|
||||||
|
namespace: argocd
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: argocd-notifications-controller
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: argocd-notifications-controller
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: redis
|
||||||
|
app.kubernetes.io/name: argocd-redis
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-redis
|
||||||
|
namespace: argocd
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: argocd-redis
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: argocd-redis
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: server
|
||||||
|
app.kubernetes.io/name: argocd-server
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-server
|
||||||
|
namespace: argocd
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: argocd-server
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: argocd-server
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: application-controller
|
||||||
|
app.kubernetes.io/name: argocd-application-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-application-controller
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: argocd-application-controller
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: argocd-application-controller
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: applicationset-controller
|
||||||
|
app.kubernetes.io/name: argocd-applicationset-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-applicationset-controller
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: argocd-applicationset-controller
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: argocd-applicationset-controller
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: server
|
||||||
|
app.kubernetes.io/name: argocd-server
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-server
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: argocd-server
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: argocd-server
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: notifications-controller
|
||||||
|
app.kubernetes.io/name: argocd-notifications-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-notifications-secret
|
||||||
|
namespace: argocd
|
||||||
|
type: Opaque
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: argocd-secret
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-secret
|
||||||
|
namespace: argocd
|
||||||
|
type: Opaque
|
||||||
|
|
@ -0,0 +1,81 @@
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: argocd-cm
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-cm
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: argocd-cmd-params-cm
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-cmd-params-cm
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: argocd-gpg-keys-cm
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-gpg-keys-cm
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: notifications-controller
|
||||||
|
app.kubernetes.io/name: argocd-notifications-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-notifications-cm
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: argocd-rbac-cm
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-rbac-cm
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
data:
|
||||||
|
ssh_known_hosts: |
|
||||||
|
# This file was automatically generated by hack/update-ssh-known-hosts.sh. DO NOT EDIT
|
||||||
|
[ssh.github.com]:443 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
|
||||||
|
[ssh.github.com]:443 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
|
||||||
|
[ssh.github.com]:443 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=
|
||||||
|
bitbucket.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPIQmuzMBuKdWeF4+a2sjSSpBK0iqitSQ+5BM9KhpexuGt20JpTVM7u5BDZngncgrqDMbWdxMWWOGtZ9UgbqgZE=
|
||||||
|
bitbucket.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIazEu89wgQZ4bqs3d63QSMzYVa0MuJ2e2gKTKqu+UUO
|
||||||
|
bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQeJzhupRu0u0cdegZIa8e86EG2qOCsIsD1Xw0xSeiPDlCr7kq97NLmMbpKTX6Esc30NuoqEEHCuc7yWtwp8dI76EEEB1VqY9QJq6vk+aySyboD5QF61I/1WeTwu+deCbgKMGbUijeXhtfbxSxm6JwGrXrhBdofTsbKRUsrN1WoNgUa8uqN1Vx6WAJw1JHPhglEGGHea6QICwJOAr/6mrui/oB7pkaWKHj3z7d1IC4KWLtY47elvjbaTlkN04Kc/5LFEirorGYVbt15kAUlqGM65pk6ZBxtaO3+30LVlORZkxOh+LKL/BvbZ/iRNhItLqNyieoQj/uh/7Iv4uyH/cV/0b4WDSd3DptigWq84lJubb9t/DnZlrJazxyDCulTmKdOR7vs9gMTo+uoIrPSb8ScTtvw65+odKAlBj59dhnVp9zd7QUojOpXlL62Aw56U4oO+FALuevvMjiWeavKhJqlR7i5n9srYcrNV7ttmDw7kf/97P5zauIhxcjX+xHv4M=
|
||||||
|
github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
|
||||||
|
github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
|
||||||
|
github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=
|
||||||
|
gitlab.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFSMqzJeV9rUzU4kWitGjeR4PWSa29SPqJ1fVkhtj3Hw9xjLVXVYrU9QlYWrOLXBpQ6KWjbjTDTdDkoohFzgbEY=
|
||||||
|
gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf
|
||||||
|
gitlab.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bNKTBSpIYDEGk9KxsGh3mySTRgMtXL583qmBpzeQ+jqCMRgBqB98u3z++J1sKlXHWfM9dyhSevkMwSbhoR8XIq/U0tCNyokEi/ueaBMCvbcTHhO7FcwzY92WK4Yt0aGROY5qX2UKSeOvuP4D6TPqKF1onrSzH9bx9XUf2lEdWT/ia1NEKjunUqu1xOB/StKDHMoX4/OKyIzuS0q/T1zOATthvasJFoPrAjkohTyaDUz2LN5JoH839hViyEG82yB+MjcFV5MU3N1l1QL3cVUCh93xSaua1N85qivl+siMkPGbO5xR/En4iEY6K2XPASUEMaieWVNTRCtJ4S8H+9
|
||||||
|
ssh.dev.azure.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H
|
||||||
|
vs-ssh.visualstudio.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: argocd-ssh-known-hosts-cm
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-ssh-known-hosts-cm
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: argocd-tls-certs-cm
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-tls-certs-cm
|
||||||
|
namespace: argocd
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,28 @@
|
||||||
|
# Offloading setting.
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: Ingress
|
||||||
|
metadata:
|
||||||
|
name: ing-argocd
|
||||||
|
namespace: argocd
|
||||||
|
annotations:
|
||||||
|
#nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||||
|
nginx.ingress.kubernetes.io/backend-protocol: "https"
|
||||||
|
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||||
|
spec:
|
||||||
|
ingressClassName: nginx
|
||||||
|
rules:
|
||||||
|
- host: argocd.nhngpuaas.com # 사전 생성된 인증서의 도메인적용.
|
||||||
|
http:
|
||||||
|
paths:
|
||||||
|
- path: /
|
||||||
|
pathType: Prefix
|
||||||
|
backend:
|
||||||
|
service:
|
||||||
|
name: argocd-server
|
||||||
|
port:
|
||||||
|
number: 443
|
||||||
|
tls:
|
||||||
|
- hosts:
|
||||||
|
- "argocd.nhngpuaas.com"
|
||||||
|
secretName: nhngpuaas-ssl
|
||||||
|
|
||||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,28 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# 원본 YAML 파일
|
||||||
|
input_file="argocd_v2.12.3_add_ns.yaml"
|
||||||
|
|
||||||
|
# CRD가 저장될 파일
|
||||||
|
crd_file="crds.yaml"
|
||||||
|
|
||||||
|
# CRD를 제외한 나머지 리소스를 저장할 파일
|
||||||
|
output_file="deployment_without_crds.yaml"
|
||||||
|
|
||||||
|
# CRD 분리
|
||||||
|
awk '
|
||||||
|
BEGIN { in_crd = 0 }
|
||||||
|
/\r$/ { sub(/\r$/, ""); } # 줄 끝에 있는 \r 제거
|
||||||
|
/^---/ {
|
||||||
|
if (in_crd) {
|
||||||
|
in_crd = 0
|
||||||
|
} else if ($0 ~ /^---/) {
|
||||||
|
if (!in_crd) print "---" > "'$output_file'"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
/^apiVersion: apiextensions.k8s.io\/v1/ { in_crd = 1; print "---" > "'$crd_file'" }
|
||||||
|
in_crd { print > "'$crd_file'" }
|
||||||
|
!in_crd && $0 !~ /^---/ { print > "'$output_file'" }
|
||||||
|
' "$input_file"
|
||||||
|
|
||||||
|
echo "CRD 부분은 $crd_file에 저장되었고, 나머지 리소스는 $output_file에 저장되었습니다."
|
||||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,5 @@
|
||||||
|
# kustomization.yaml
|
||||||
|
namespace: argocd
|
||||||
|
|
||||||
|
resources:
|
||||||
|
- argocd_v2.12.3.yaml
|
||||||
|
|
@ -0,0 +1,27 @@
|
||||||
|
# This section includes base Calico installation configuration.
|
||||||
|
# For more information, see: https://docs.tigera.io/calico/latest/reference/installation/api#operator.tigera.io/v1.Installation
|
||||||
|
apiVersion: operator.tigera.io/v1
|
||||||
|
kind: Installation
|
||||||
|
metadata:
|
||||||
|
name: default
|
||||||
|
spec:
|
||||||
|
# Configures Calico networking.
|
||||||
|
calicoNetwork:
|
||||||
|
ipPools:
|
||||||
|
- name: default-ipv4-ippool
|
||||||
|
blockSize: 24
|
||||||
|
cidr: 10.1.0.0/16
|
||||||
|
encapsulation: VXLAN # openstack 에서는 VXLAN을 사용해야해안다 byljh
|
||||||
|
natOutgoing: Enabled
|
||||||
|
nodeSelector: all()
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# This section configures the Calico API server.
|
||||||
|
# For more information, see: https://docs.tigera.io/calico/latest/reference/installation/api#operator.tigera.io/v1.APIServer
|
||||||
|
apiVersion: operator.tigera.io/v1
|
||||||
|
kind: APIServer
|
||||||
|
metadata:
|
||||||
|
name: default
|
||||||
|
spec: {}
|
||||||
|
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,37 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# 사용할 Secret 이름
|
||||||
|
SECRET_NAME="nhngpuaas-ssl"
|
||||||
|
|
||||||
|
# 인증서/키 파일 경로
|
||||||
|
CERT_FILE="./nhngpuaas.crt"
|
||||||
|
KEY_FILE="./nhngpuaas.key"
|
||||||
|
|
||||||
|
# 대상 네임스페이스 목록
|
||||||
|
NAMESPACES=(
|
||||||
|
default
|
||||||
|
istio-system
|
||||||
|
monitoring
|
||||||
|
argocd
|
||||||
|
harbor
|
||||||
|
logging
|
||||||
|
gitea
|
||||||
|
ingress-nginx
|
||||||
|
)
|
||||||
|
|
||||||
|
# 각 네임스페이스에 Secret 생성
|
||||||
|
for ns in "${NAMESPACES[@]}"; do
|
||||||
|
echo "<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> [$ns] Creating secret $SECRET_NAME..."
|
||||||
|
|
||||||
|
# 네임스페이스 존재하지 않으면 생성 (선택사항)
|
||||||
|
kubectl get ns "$ns" >/dev/null 2>&1 || kubectl create ns "$ns"
|
||||||
|
|
||||||
|
kubectl create secret tls "$SECRET_NAME" \
|
||||||
|
--cert="$CERT_FILE" \
|
||||||
|
--key="$KEY_FILE" \
|
||||||
|
-n "$ns" \
|
||||||
|
--dry-run=client -o yaml | kubectl apply -f -
|
||||||
|
|
||||||
|
echo "✅ [$ns] Secret created or updated."
|
||||||
|
done
|
||||||
|
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIIDfzCCAmegAwIBAgIUQa05TRFmk2PSrxVRD+AOeesYJ6wwDQYJKoZIhvcNAQEL
|
||||||
|
BQAwPTELMAkGA1UEBhMCS1IxDjAMBgNVBAgMBVNlb3VsMQwwCgYDVQQKDANOSE4x
|
||||||
|
EDAOBgNVBAMMB05ITi5jb20wHhcNMjUwNTIzMDIxMDEyWhcNMjcwNTIzMDIxMDEy
|
||||||
|
WjBHMQswCQYDVQQGEwJLUjEOMAwGA1UECAwFU2VvdWwxDjAMBgNVBAoMBWlqaW5j
|
||||||
|
MRgwFgYDVQQDDA8qLm5obmdwdWFhcy5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IB
|
||||||
|
DwAwggEKAoIBAQClbE1iJA9VAYPwy19lT+oGZ+FT1hdU7C5Iz4bzMc+xLfE+Cq7T
|
||||||
|
Ev6AmADLrKpbFaGichOwSgjQ33EtU9Z0W/OSwvHauX/0nezCH6BOqQ7J6Oyoi7nV
|
||||||
|
W2hTEcUCZFApOmldoO3RMIt/wlryWAz9cxFQQveo3ndNllJToL+u60GoNa+yJr7b
|
||||||
|
bKNZ/NWTFWm9ge1JmAY8eiiZQI+EAGGFohwWvMnYI/l+G2CkYZfrOFF3lZ1Wbk0V
|
||||||
|
zmmB197hzsg4H6PPwb5cwVp5j83erWVGSaUnNn4VLMBHFk0U+VfZRGpisC6nkZJW
|
||||||
|
dItnV5ERt0yTW5uwc5cwzHnsrmyCtPgEgYBzAgMBAAGjbTBrMCkGA1UdEQQiMCCC
|
||||||
|
DW5obmdwdWFhcy5jb22CDyoubmhuZ3B1YWFzLmNvbTAdBgNVHQ4EFgQUp9kzMmey
|
||||||
|
D3HKSjaUBVS549R9SbcwHwYDVR0jBBgwFoAU4It9UBfp9qnoU1HiRqxgIyIV0e8w
|
||||||
|
DQYJKoZIhvcNAQELBQADggEBALCttQL1wb17yERkYl2+ESeUPDB/JAQQCRy67kG3
|
||||||
|
h2ttZyXEmnhWSLKuPaJjPZvq8jlx3VgmugOc/Vhi4I3j6JYrBTyU/M6RaB1Hn2uY
|
||||||
|
S5edLZ6nG4uf88ndwrLFhCPr0bwB+cPWiu1RPQ0/Is4SfDxJEkRYJPb2xqySqYEE
|
||||||
|
RtIhGO8SIBnWjWP9EIykIALsem7xHwZCh8q4X28YsB91IATSQpEWlddggoQVZNF+
|
||||||
|
hsJkZ+M+MMvZzWiyu+uWRs2wD6DJfDl6Zp7PTwN8eTm5k5tKeGkXa2XsA8YSjXnJ
|
||||||
|
9aV135P7KXBANN0bsngQHeh0mgl5sTTeGV+HeMq69FG71SM=
|
||||||
|
-----END CERTIFICATE-----
|
||||||
|
|
@ -0,0 +1,28 @@
|
||||||
|
-----BEGIN PRIVATE KEY-----
|
||||||
|
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQClbE1iJA9VAYPw
|
||||||
|
y19lT+oGZ+FT1hdU7C5Iz4bzMc+xLfE+Cq7TEv6AmADLrKpbFaGichOwSgjQ33Et
|
||||||
|
U9Z0W/OSwvHauX/0nezCH6BOqQ7J6Oyoi7nVW2hTEcUCZFApOmldoO3RMIt/wlry
|
||||||
|
WAz9cxFQQveo3ndNllJToL+u60GoNa+yJr7bbKNZ/NWTFWm9ge1JmAY8eiiZQI+E
|
||||||
|
AGGFohwWvMnYI/l+G2CkYZfrOFF3lZ1Wbk0VzmmB197hzsg4H6PPwb5cwVp5j83e
|
||||||
|
rWVGSaUnNn4VLMBHFk0U+VfZRGpisC6nkZJWdItnV5ERt0yTW5uwc5cwzHnsrmyC
|
||||||
|
tPgEgYBzAgMBAAECggEANOXeFP0M/hTe+Tg/iCk239eGIYX7rgdcgaIDOG98R982
|
||||||
|
Hq3R2+NeCQcScg8D5t6S8lxiWWRDT2+0RFdj44+n4w19w4DAHxwFIsp0O9MpzH00
|
||||||
|
eG09/rEdOjsbcblcPOLV4L/ebJ+GbFNdO9PWS5HpPm47vf9tzRy9tMpZoXjPZRdJ
|
||||||
|
gXwQFzE+j7YfwXrtOwOBznJpX/6W0y7Id3uQzxCnISbRm9m85BGkaPqeWUw28Q8g
|
||||||
|
CK2C/moIR5/xX77eEDhIvdgHPwrUYCpfcBbp07i+I9gWjJ9/3dg277WrA1zXDWbl
|
||||||
|
vhvctveTCTg5OXLz7bV4MUSS8wO5qh+YDENBu5TpOQKBgQC5PtybPRdYJ2sZjDs7
|
||||||
|
jQs13hHMBJdjPYxBV3BUuabDTHBMlsr5h1UFmZRJWQCkJFSVw49cq+9pbsOUr2Wo
|
||||||
|
TGhqfE4TgUrShnJxEQa7vCQrkWZ9tgCP4szNQ9CReQkyMVPTxrX14SWqROorkPiC
|
||||||
|
JjiuST8+NSxOfqTeJdHEkajApQKBgQDkmzcQUJ04t05+phXFZ9PZfVTzyoI/EF0t
|
||||||
|
M4NOQHzN4MnDFUH6EPVUnxkAlqg0BaXwy1L9gmyFPWD3apYzwfV8m3onGaOQgCVF
|
||||||
|
Ucs8iHdFg//hoQBUVnVLY5p3xNPiNH0Q+X02RxsJb5bjGCdyy+lbYeTC0qvNfpxP
|
||||||
|
ltWFCbAZNwKBgDoNYyEbIge0QrH86ksdRlgZQcaH4dFt5lhLyJ4kmAg4GjFGSFGu
|
||||||
|
gYyBtqDNzY+i+wb8BB9smliWJ6Ce3uLBHy/PyMAAEqyrCY45YbzPlx44MMBQmxh8
|
||||||
|
YOYqzF/qaGFcaALEER3+8sjLU/9XLSnMRJMJzVH3Y+0tbwlXHMfXReUpAoGBALp4
|
||||||
|
6ZeDSlvDGmIwc73MjX/wveUGoOt0G60NQeQIskT1QV7B7klen99gz3ItchLNMKiU
|
||||||
|
EaP8SSz9/iSTauXZJrd301Illcf+32gF6jP8VN39aDHRtIUW6SKPoqZjhToU+pdo
|
||||||
|
CvzFT4aI4ZloUHVRY45I8eMBGWbMChDZxl14o45NAoGAF4yTmXpohD6NWiy7uWlv
|
||||||
|
32z/Fen/rbFsLDILM3FB6cmn+stQzXz7QEP9F69wNl79Bp/LXnmQQpGUT632UxCE
|
||||||
|
4qQ9jrb9lGE2vXHB5K6JnIENnv4fr82YaHT3ZqW1pgLKNlAbiHcyy5yYNWPz/q4Y
|
||||||
|
4Pl1kGw+hlKNljqmh+hJBic=
|
||||||
|
-----END PRIVATE KEY-----
|
||||||
|
|
@ -0,0 +1,28 @@
|
||||||
|
-----BEGIN PRIVATE KEY-----
|
||||||
|
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC4lmwhc546lw/v
|
||||||
|
UzfzZMQbDBN7iizU/ESY+KePEsooXqfBQte2x4/DDZOdKLYt3AAjy9rKI+annN01
|
||||||
|
TvKmo9vkwiixzLKqppsbbGO0k6ClakiLtv/fpw/cLetPSerjSiLaUzjvIPyfm0gs
|
||||||
|
elgUaijq7AJSgLPlRrJg2u738wj0pa2EAVwVyDzx+bpec7UKPNUl+i+4q2h8cIBs
|
||||||
|
c+a1UjeyL76haExAUBbS5WTXrPYJtaFe4/5gAhebLfP4pzuoWO8WFHyUgZLtoGDe
|
||||||
|
vfPTpj8laY5CYsVTSKuFdzMJ3E/TrizBUIu/aXSv4AYd+cjsreu7fm3E4+VgV1vd
|
||||||
|
azmnfEgFAgMBAAECggEAKjSyyr9N+aWaziUgEPYEZQ7Q0ZmZgKWh5bxNS8iHEs35
|
||||||
|
25W2DyP4Oig7jV7GsRuxqH2vLDMjRUX3yn2fu/yRhe/jMCxW2fA4XP/emGZ8//Wa
|
||||||
|
Wt/gB7qCRNz3Be0n2QqVh4gp53uKZ9Awo4Lh6uEPNA/8w/KLr6wHk1/b7jPS42Ut
|
||||||
|
7Jt7+Ac7q97l2kdT/M6vd5JOVzaf4ILqwBrrwRyPh/Hr3WdW/5h3qibrqINySqvo
|
||||||
|
cSTo+sZgqu2N64LDhyNlhjbTBHop77ZYAHaBulvFgEtWJW8ZKn+QEG7liwINUtV/
|
||||||
|
4+Zo0Pl8AmXsBmM6hRYr0pOq8V1lUN/h8IPuyZkXzQKBgQD+pBhT7dbcxtKoXNor
|
||||||
|
Vdke4otI18ynt2GCgOkvDPDFiNe8hj/mvoA03kLGCmGd8Ew904ZHQwcvJjhdBaBe
|
||||||
|
jgU2RQRLTp4a75zaotdR/ObLVpma+Fv2QGQUoMwAaLw+WZF73kBC0fsTLr7wMhIm
|
||||||
|
w+nzxhe4buy2qpIRkue0GDlPxwKBgQC5kp3NYRFGseZGwgLNrbcgkjozMyEE8t0V
|
||||||
|
9OANmwQJwQoti2UAtsxBpe/+8R39d8vFsI0nnXX9KDt/uzyXZx6qYzVyu5etmmkk
|
||||||
|
tMbex2XrON75/Ws753h9rX0oT/v/sdv/4Bpef2gchbEYK9hPlo0LvvJpDmm8Ba9f
|
||||||
|
+wrWQRJB0wKBgQDMOivQ1IZpF4VIxv+rlfTHUobHa1yWfvtTwbRDqitJIpF0gG+r
|
||||||
|
zsngnQoM77KPC3T6eTXO3bFbXVoDMUoHy/veJMhm5azkiZzRtZzgAufP2arkoaCQ
|
||||||
|
BeC+sqArC9U+ZHPMVtpPPT4TioBVALOSJ7rxasUHhN+ROYhhU+NFi9AbbQKBgQCX
|
||||||
|
5N2LfTdR4U22fxkiV118qJRA0knlrhCu5yf5mvfcMAjvrJh41CcuWO+vgpbkoIjH
|
||||||
|
gLKZSXaJR8Qj0hNPbhWYq+nUxp3peGk1pU7ejOHsfjls8DQ07Usfu8ClHYsMCP4l
|
||||||
|
W77ZuHl0Vy3UthaxVm6OvbXXrfd38kNRUb/WDZ8vBwKBgExY/zaIxJ0VSgzYarpN
|
||||||
|
a1VlQqtIJ8WJqK7nPhI57uWHdamIF/0vlO4D6mrrAzCzHH708IgL6JCRdMQF7wTg
|
||||||
|
Fxu9hBde2JmiO8isAp6CN25k/vC30VZjwVLBojsS45saxKAgFZjxbUbwZ7t7oezY
|
||||||
|
qriDXpuwa6Nc5ti9FEcwhnFJ
|
||||||
|
-----END PRIVATE KEY-----
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIIDWzCCAkOgAwIBAgIUZgMNWnLaR14UjuTKbgLrLBI3vpkwDQYJKoZIhvcNAQEL
|
||||||
|
BQAwPTELMAkGA1UEBhMCS1IxDjAMBgNVBAgMBVNlb3VsMQwwCgYDVQQKDANOSE4x
|
||||||
|
EDAOBgNVBAMMB05ITi5jb20wHhcNMjUwNTIzMDIwOTA5WhcNMzUwNTIxMDIwOTA5
|
||||||
|
WjA9MQswCQYDVQQGEwJLUjEOMAwGA1UECAwFU2VvdWwxDDAKBgNVBAoMA05ITjEQ
|
||||||
|
MA4GA1UEAwwHTkhOLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
|
||||||
|
ALiWbCFznjqXD+9TN/NkxBsME3uKLNT8RJj4p48Syihep8FC17bHj8MNk50oti3c
|
||||||
|
ACPL2soj5qec3TVO8qaj2+TCKLHMsqqmmxtsY7SToKVqSIu2/9+nD9wt609J6uNK
|
||||||
|
ItpTOO8g/J+bSCx6WBRqKOrsAlKAs+VGsmDa7vfzCPSlrYQBXBXIPPH5ul5ztQo8
|
||||||
|
1SX6L7iraHxwgGxz5rVSN7IvvqFoTEBQFtLlZNes9gm1oV7j/mACF5st8/inO6hY
|
||||||
|
7xYUfJSBku2gYN6989OmPyVpjkJixVNIq4V3MwncT9OuLMFQi79pdK/gBh35yOyt
|
||||||
|
67t+bcTj5WBXW91rOad8SAUCAwEAAaNTMFEwHQYDVR0OBBYEFOCLfVAX6fap6FNR
|
||||||
|
4kasYCMiFdHvMB8GA1UdIwQYMBaAFOCLfVAX6fap6FNR4kasYCMiFdHvMA8GA1Ud
|
||||||
|
EwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBALMRGDtpp2prXRs796gk7Va1
|
||||||
|
5VXc3jplJhLeTP1XlTYa0ARSjCRgyUQfSHRfl9nVm2msyuMukKvRKiQwahXknzO9
|
||||||
|
enEnxP1MI/RZ6ygxYul8IPcAutzCsJA9uFn5E5enHRbgVuonUcdoHVszxT6afnco
|
||||||
|
21+MYdkat8iV1h3VW1vo6OoMJmUQ2uPo9q50OOA3UZJQRds0+vOKxdX+UZdvCZwr
|
||||||
|
5WgQvzVUJyTlqDdjHyWJl6ReBdnvHJ2iVAc3Zb/uJeBcb/6DLQfDdXjtyJvPYEWk
|
||||||
|
YtVWgBQmR1eeanNe2UJsSghu30ePqqtwEpOhDlD+12bkPOz9nWBCApM8l6P/uRw=
|
||||||
|
-----END CERTIFICATE-----
|
||||||
|
|
@ -0,0 +1,35 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# 전송할 파일들
|
||||||
|
FILES=("nhngpuaas.crt" "nhngpuaas.key")
|
||||||
|
|
||||||
|
# 대상 서버 목록 (user@host 형식)
|
||||||
|
SERVERS=(
|
||||||
|
"ubuntu@master1"
|
||||||
|
"ubuntu@master2"
|
||||||
|
"ubuntu@master3"
|
||||||
|
"ubuntu@nd-worker1"
|
||||||
|
"ubuntu@nd-worker2"
|
||||||
|
"ubuntu@nd-worker3"
|
||||||
|
"ubuntu@svc-worker1"
|
||||||
|
"ubuntu@svc-worker2"
|
||||||
|
"ubuntu@gpu-1"
|
||||||
|
"ubuntu@gpu-2"
|
||||||
|
"ubuntu@gpu-3"
|
||||||
|
"ubuntu@gpu-4"
|
||||||
|
)
|
||||||
|
|
||||||
|
# 복사할 대상 디렉터리 (리모트 서버 기준)
|
||||||
|
DEST_DIR="/home/ubuntu/"
|
||||||
|
|
||||||
|
# 루프 돌면서 각 서버로 복사
|
||||||
|
for SERVER in "${SERVERS[@]}"; do
|
||||||
|
echo "<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> [$SERVER] 전송 시작..."
|
||||||
|
scp "${FILES[@]}" "$SERVER:$DEST_DIR"
|
||||||
|
if [ $? -eq 0 ]; then
|
||||||
|
echo "✅ [$SERVER] 전송 성공"
|
||||||
|
else
|
||||||
|
echo "❌ [$SERVER] 전송 실패"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
|
@ -0,0 +1,16 @@
|
||||||
|
-----BEGIN CERTIFICATE REQUEST-----
|
||||||
|
MIICjDCCAXQCAQAwRzELMAkGA1UEBhMCS1IxDjAMBgNVBAgMBVNlb3VsMQ4wDAYD
|
||||||
|
VQQKDAVpamluYzEYMBYGA1UEAwwPKi5uaG5ncHVhYXMuY29tMIIBIjANBgkqhkiG
|
||||||
|
9w0BAQEFAAOCAQ8AMIIBCgKCAQEApWxNYiQPVQGD8MtfZU/qBmfhU9YXVOwuSM+G
|
||||||
|
8zHPsS3xPgqu0xL+gJgAy6yqWxWhonITsEoI0N9xLVPWdFvzksLx2rl/9J3swh+g
|
||||||
|
TqkOyejsqIu51VtoUxHFAmRQKTppXaDt0TCLf8Ja8lgM/XMRUEL3qN53TZZSU6C/
|
||||||
|
rutBqDWvsia+22yjWfzVkxVpvYHtSZgGPHoomUCPhABhhaIcFrzJ2CP5fhtgpGGX
|
||||||
|
6zhRd5WdVm5NFc5pgdfe4c7IOB+jz8G+XMFaeY/N3q1lRkmlJzZ+FSzARxZNFPlX
|
||||||
|
2URqYrAup5GSVnSLZ1eREbdMk1ubsHOXMMx57K5sgrT4BIGAcwIDAQABoAAwDQYJ
|
||||||
|
KoZIhvcNAQELBQADggEBAInHaWXSKqj2Lq2iuEfi1xL3BxBXdZzvg+FNKmMcmycR
|
||||||
|
62e4Qetoednw9bMSOFfTz/DJk2zu6OBKN8LbLDyA7QAfxHvfzFOPIkATw9BODwPT
|
||||||
|
tGdeInwHIbxwzGmZR3NaH91XtQ/EnHQHqfgn1JAmE72PXs/jwdKMDAHeoVSyQZbU
|
||||||
|
XCtrzJl9Jdq4bXKKCaz8tNGo8pZ/1/E5AZyRtr3qjA+pBaMLInNdy5oVupBxWEtg
|
||||||
|
hWWaUA3wkSHLmFD9L5TXJGflAyJ+RfW0X2qnOeCHZj5GdwHmS/XHsm/VrSltC7x/
|
||||||
|
jVC7CWG2p4rLcLu/CixPWzx3tDVVFJECi88D3X8YcfU=
|
||||||
|
-----END CERTIFICATE REQUEST-----
|
||||||
|
|
@ -0,0 +1,60 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: logging
|
||||||
|
|
||||||
|
---
|
||||||
|
# Source: fluent-bit/templates/serviceaccount.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: fluent-bit
|
||||||
|
namespace: logging
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: fluent-bit-0.47.9
|
||||||
|
app.kubernetes.io/name: fluent-bit
|
||||||
|
app.kubernetes.io/instance: fluent-bit
|
||||||
|
app.kubernetes.io/version: "3.1.7"
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
---
|
||||||
|
# Source: fluent-bit/templates/clusterrole.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: fluent-bit
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: fluent-bit-0.47.9
|
||||||
|
app.kubernetes.io/name: fluent-bit
|
||||||
|
app.kubernetes.io/instance: fluent-bit
|
||||||
|
app.kubernetes.io/version: "3.1.7"
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- namespaces
|
||||||
|
- pods
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
---
|
||||||
|
# Source: fluent-bit/templates/clusterrolebinding.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: fluent-bit
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: fluent-bit-0.47.9
|
||||||
|
app.kubernetes.io/name: fluent-bit
|
||||||
|
app.kubernetes.io/instance: fluent-bit
|
||||||
|
app.kubernetes.io/version: "3.1.7"
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: fluent-bit
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: fluent-bit
|
||||||
|
namespace: logging
|
||||||
|
|
@ -0,0 +1,69 @@
|
||||||
|
# Source: fluent-bit/templates/configmap.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: fluent-bit
|
||||||
|
namespace: logging
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: fluent-bit-0.47.9
|
||||||
|
app.kubernetes.io/name: fluent-bit
|
||||||
|
app.kubernetes.io/instance: fluent-bit
|
||||||
|
app.kubernetes.io/version: "3.1.7"
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
data:
|
||||||
|
custom_parsers.conf: |
|
||||||
|
[PARSER]
|
||||||
|
Name docker_no_time
|
||||||
|
Format json
|
||||||
|
Time_Keep Off
|
||||||
|
Time_Key time
|
||||||
|
Time_Format %Y-%m-%dT%H:%M:%S.%L
|
||||||
|
fluent-bit.conf: |
|
||||||
|
[SERVICE]
|
||||||
|
Daemon Off
|
||||||
|
Flush 1
|
||||||
|
Log_Level info
|
||||||
|
Parsers_File /fluent-bit/etc/parsers.conf
|
||||||
|
Parsers_File /fluent-bit/etc/conf/custom_parsers.conf
|
||||||
|
HTTP_Server On
|
||||||
|
HTTP_Listen 0.0.0.0
|
||||||
|
HTTP_Port 2020
|
||||||
|
Health_Check On
|
||||||
|
|
||||||
|
[INPUT]
|
||||||
|
Name tail
|
||||||
|
Path /var/log/containers/*.log
|
||||||
|
multiline.parser docker, cri
|
||||||
|
# DB /var/fluent-bit/state/flb_log.db
|
||||||
|
Tag kube.*
|
||||||
|
Mem_Buf_Limit 5MB
|
||||||
|
Skip_Long_Lines On
|
||||||
|
|
||||||
|
|
||||||
|
[FILTER]
|
||||||
|
Name kubernetes
|
||||||
|
Match kube.*
|
||||||
|
Merge_Log On
|
||||||
|
Keep_Log Off
|
||||||
|
K8S-Logging.Parser On
|
||||||
|
K8S-Logging.Exclude On
|
||||||
|
|
||||||
|
# [FILTER]
|
||||||
|
# Name record_modifier
|
||||||
|
# Match kube.*
|
||||||
|
# Record namespace ${_score}
|
||||||
|
|
||||||
|
[OUTPUT]
|
||||||
|
Name es
|
||||||
|
Match kube.*
|
||||||
|
Host 172.17.128.246
|
||||||
|
HTTP_User admin
|
||||||
|
HTTP_Passwd admin
|
||||||
|
Index fluent-bit10--%Y.%m.%d
|
||||||
|
Logstash_Format On
|
||||||
|
Logstash_Prefix_Key $kubernetes['namespace_name']
|
||||||
|
Suppress_Type_Name On
|
||||||
|
tls On
|
||||||
|
tls.Verify Off
|
||||||
|
Retry_Limit False
|
||||||
|
|
||||||
|
|
@ -0,0 +1,69 @@
|
||||||
|
# Source: fluent-bit/templates/configmap.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: fluent-bit
|
||||||
|
namespace: logging
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: fluent-bit-0.47.9
|
||||||
|
app.kubernetes.io/name: fluent-bit
|
||||||
|
app.kubernetes.io/instance: fluent-bit
|
||||||
|
app.kubernetes.io/version: "3.1.7"
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
data:
|
||||||
|
custom_parsers.conf: |
|
||||||
|
[PARSER]
|
||||||
|
Name docker_no_time
|
||||||
|
Format json
|
||||||
|
Time_Keep Off
|
||||||
|
Time_Key time
|
||||||
|
Time_Format %Y-%m-%dT%H:%M:%S.%L
|
||||||
|
|
||||||
|
fluent-bit.conf: |
|
||||||
|
[SERVICE]
|
||||||
|
Daemon Off
|
||||||
|
Flush 1
|
||||||
|
Log_Level info
|
||||||
|
Parsers_File /fluent-bit/etc/parsers.conf
|
||||||
|
Parsers_File /fluent-bit/etc/conf/custom_parsers.conf
|
||||||
|
HTTP_Server On
|
||||||
|
HTTP_Listen 0.0.0.0
|
||||||
|
HTTP_Port 2020
|
||||||
|
Health_Check On
|
||||||
|
|
||||||
|
[INPUT]
|
||||||
|
Name tail
|
||||||
|
Path /var/log/containers/*.log
|
||||||
|
multiline.parser docker, cri
|
||||||
|
Tag kube.*
|
||||||
|
Mem_Buf_Limit 5MB
|
||||||
|
Skip_Long_Lines On
|
||||||
|
|
||||||
|
[INPUT]
|
||||||
|
Name systemd
|
||||||
|
Tag host.*
|
||||||
|
Systemd_Filter _SYSTEMD_UNIT=kubelet.service
|
||||||
|
Read_From_Tail On
|
||||||
|
|
||||||
|
[FILTER]
|
||||||
|
Name kubernetes
|
||||||
|
Match kube.*
|
||||||
|
Merge_Log On
|
||||||
|
Keep_Log Off
|
||||||
|
K8S-Logging.Parser On
|
||||||
|
K8S-Logging.Exclude On
|
||||||
|
|
||||||
|
[OUTPUT]
|
||||||
|
Name es
|
||||||
|
Match kube.*
|
||||||
|
Host elasticsearch-master
|
||||||
|
Logstash_Format On
|
||||||
|
Retry_Limit False
|
||||||
|
|
||||||
|
[OUTPUT]
|
||||||
|
Name es
|
||||||
|
Match host.*
|
||||||
|
Host elasticsearch-master
|
||||||
|
Logstash_Format On
|
||||||
|
Logstash_Prefix node
|
||||||
|
Retry_Limit False
|
||||||
|
|
@ -0,0 +1,73 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: fluent-bit
|
||||||
|
namespace: logging
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: fluentbit
|
||||||
|
app.kubernetes.io/instance: fluent-bit
|
||||||
|
app.kubernetes.io/version: "3.1.7"
|
||||||
|
data:
|
||||||
|
custom_parsers.conf: |
|
||||||
|
[PARSER]
|
||||||
|
Name cri
|
||||||
|
Format regex
|
||||||
|
Regex ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<message>.*)$
|
||||||
|
Time_Key time
|
||||||
|
Time_Format %Y-%m-%dT%H:%M:%S.%L%z
|
||||||
|
Decode_Field_As json message
|
||||||
|
|
||||||
|
[PARSER]
|
||||||
|
Name svcname
|
||||||
|
Format regex
|
||||||
|
Regex /sample-(?<servicename>.+)-dp-[^-]+-[^-]+_(?<namespace>.+)_.+-con-[^-]+.log$
|
||||||
|
|
||||||
|
fluent-bit.conf: |
|
||||||
|
[SERVICE]
|
||||||
|
Flush 5
|
||||||
|
Log_Level info
|
||||||
|
Daemon off
|
||||||
|
Parsers_File /fluent-bit/etc/parsers.conf
|
||||||
|
Parsers_File /fluent-bit/etc/conf/custom_parsers.conf
|
||||||
|
HTTP_Server On
|
||||||
|
HTTP_Listen 0.0.0.0
|
||||||
|
HTTP_Port 2020
|
||||||
|
Health_Check On
|
||||||
|
storage.path /var/fluent-bit/state/flb-storage/
|
||||||
|
storage.sync normal
|
||||||
|
storage.checksum off
|
||||||
|
storage.backlog.mem_limit 5M
|
||||||
|
|
||||||
|
@INCLUDE input-kubernetes.conf
|
||||||
|
# @INCLUDE filter-kubernetes.conf
|
||||||
|
@INCLUDE output-file.conf
|
||||||
|
|
||||||
|
input-kubernetes.conf: |
|
||||||
|
[INPUT]
|
||||||
|
Name tail
|
||||||
|
Parser cri
|
||||||
|
Path /var/log/containers/blog-*-dp-*-*_blog_*-con-*.log
|
||||||
|
DB /var/fluent-bit/state/flb_log.db
|
||||||
|
Tag blog.<service_name>
|
||||||
|
Tag_Regex /blog-(?<service_name>.+)-dp-[^-]+-[^-]+_blog_.+-con-[^-]+.log$
|
||||||
|
Mem_Buf_Limit 5MB
|
||||||
|
Skip_Long_Lines On
|
||||||
|
Refresh_Interval 10
|
||||||
|
Path_key svc_name
|
||||||
|
|
||||||
|
filter-kubernetes.conf: |
|
||||||
|
[FILTER]
|
||||||
|
Name parser
|
||||||
|
Match blog.*
|
||||||
|
Key_name svc_name
|
||||||
|
reserve_data On
|
||||||
|
Parser svcname
|
||||||
|
|
||||||
|
output-file.conf: |
|
||||||
|
[OUTPUT]
|
||||||
|
Name file
|
||||||
|
Match blog.*
|
||||||
|
Path /home/ubuntu
|
||||||
|
file fluentbit-scrape.txt
|
||||||
|
|
||||||
|
|
||||||
|
|
@ -0,0 +1,36 @@
|
||||||
|
# Source: fluent-bit/templates/configmap.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: fluent-bit
|
||||||
|
namespace: logging
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: fluent-bit-0.47.10
|
||||||
|
app.kubernetes.io/name: fluent-bit
|
||||||
|
app.kubernetes.io/instance: fluent-bit
|
||||||
|
app.kubernetes.io/version: "3.1.7"
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
data:
|
||||||
|
fluent-bit.conf: |
|
||||||
|
[SERVICE]
|
||||||
|
Daemon Off
|
||||||
|
Flush 1
|
||||||
|
Log_Level warn
|
||||||
|
Parsers_File /fluent-bit/etc/parsers.conf
|
||||||
|
HTTP_Server On
|
||||||
|
HTTP_Listen 0.0.0.0
|
||||||
|
HTTP_Port 2020
|
||||||
|
Health_Check On
|
||||||
|
storage.path /var/fluent-bit/state/flb-storage/
|
||||||
|
storage.sync normal
|
||||||
|
storage.checksum off
|
||||||
|
storage.backlog.mem_limit 5M
|
||||||
|
|
||||||
|
[INPUT]
|
||||||
|
Name tail
|
||||||
|
Path /var/log/containers/*.log
|
||||||
|
Parser cri
|
||||||
|
Tag kube.*
|
||||||
|
Mem_Buf_Limit 5MB
|
||||||
|
Skip_Long_Lines On
|
||||||
|
|
||||||
|
|
@ -0,0 +1,66 @@
|
||||||
|
# Source: fluent-bit/templates/configmap.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: fluent-bit
|
||||||
|
namespace: logging
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: fluent-bit-0.47.10
|
||||||
|
app.kubernetes.io/name: fluent-bit
|
||||||
|
app.kubernetes.io/instance: fluent-bit
|
||||||
|
app.kubernetes.io/version: "3.1.7"
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
data:
|
||||||
|
fluent-bit.conf: |
|
||||||
|
[SERVICE]
|
||||||
|
Daemon Off
|
||||||
|
Flush 1
|
||||||
|
Log_Level warn
|
||||||
|
Parsers_File /fluent-bit/etc/parsers.conf
|
||||||
|
HTTP_Server On
|
||||||
|
HTTP_Listen 0.0.0.0
|
||||||
|
HTTP_Port 2020
|
||||||
|
Health_Check On
|
||||||
|
storage.path /var/fluent-bit/state/flb-storage/
|
||||||
|
storage.sync normal
|
||||||
|
storage.checksum off
|
||||||
|
storage.backlog.mem_limit 5M
|
||||||
|
|
||||||
|
[INPUT]
|
||||||
|
Name tail
|
||||||
|
Path /var/log/containers/sample-*-dp-*-con-*.log
|
||||||
|
Parser cri
|
||||||
|
Tag normal.<service_name>.<namespace_name>
|
||||||
|
Tag_Regex /sample-(?<service_name>.+)-dp-(.+)_(?<namespace_name>.+)_(.+)-con-(.+).log$
|
||||||
|
Mem_Buf_Limit 5MB
|
||||||
|
Skip_Long_Lines On
|
||||||
|
|
||||||
|
[INPUT]
|
||||||
|
Name tail
|
||||||
|
Path /var/log/containers/sample-*-mdp-*-con-*.log
|
||||||
|
Parser cri
|
||||||
|
Tag multi.<service_name>.<namespace_name>
|
||||||
|
Tag_Regex /sample-(?<service_name>.+)-mdp-(.+)_(?<namespace_name>.+)_(.+)-con-(.+).log$
|
||||||
|
Mem_Buf_Limit 5MB
|
||||||
|
Skip_Long_Lines On
|
||||||
|
|
||||||
|
[FILTER]
|
||||||
|
name multiline
|
||||||
|
match multi.*
|
||||||
|
multiline.key_content message
|
||||||
|
multiline.parser java
|
||||||
|
|
||||||
|
[OUTPUT]
|
||||||
|
Name es
|
||||||
|
Match *
|
||||||
|
Host 172.17.128.239
|
||||||
|
Port 9200
|
||||||
|
Index Multiline
|
||||||
|
Type _doc
|
||||||
|
Include_Tag_Key true
|
||||||
|
Tag_key @svc_name
|
||||||
|
Suppress_Type_Name On
|
||||||
|
HTTP_User admin
|
||||||
|
HTTP_Passwd admin
|
||||||
|
tls On
|
||||||
|
tls.verify Off
|
||||||
|
|
@ -0,0 +1,56 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: fluent-bit-config
|
||||||
|
namespace: fluent-bit
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: fluentbit
|
||||||
|
data:
|
||||||
|
fluent-bit.conf: |
|
||||||
|
[SERVICE]
|
||||||
|
Flush 5
|
||||||
|
Log_Level warn
|
||||||
|
Daemon off
|
||||||
|
Parsers_File parsers.conf
|
||||||
|
storage.path /var/fluent-bit/state/flb-storage/
|
||||||
|
storage.sync normal
|
||||||
|
storage.checksum off
|
||||||
|
storage.backlog.mem_limit 5M
|
||||||
|
|
||||||
|
@INCLUDE userapp-log.conf
|
||||||
|
|
||||||
|
userapp-log.conf: |
|
||||||
|
[INPUT]
|
||||||
|
Name tail
|
||||||
|
Parser cri
|
||||||
|
Path /var/log/containers/pub-*-dp-*-*_nnd-logging_*-con-*.log
|
||||||
|
DB /var/fluent-bit/state/flb_log.db
|
||||||
|
Tag pub.<service_name>
|
||||||
|
Tag_Regex /pub-(?<service_name>.+)-dp-[^-]+-[^-]+_nnd_logging_.+-con-[^-]+.log$
|
||||||
|
Mem_Buf_Limit 5MB
|
||||||
|
Skip_Long_Lines On
|
||||||
|
Refresh_Interval 10
|
||||||
|
|
||||||
|
[OUTPUT]
|
||||||
|
Name es
|
||||||
|
Host 10.1.81.11
|
||||||
|
Port 9200
|
||||||
|
Match pub.*
|
||||||
|
HTTP_User admin
|
||||||
|
HTTP_Passwd ijinc123!
|
||||||
|
Index pub_injeinc_os
|
||||||
|
Type _doc
|
||||||
|
Include_Tag_Key true
|
||||||
|
Tag_key @svc_name
|
||||||
|
Suppress_Type_Name On
|
||||||
|
|
||||||
|
|
||||||
|
parsers.conf: |
|
||||||
|
[PARSER]
|
||||||
|
Name cri
|
||||||
|
Format regex
|
||||||
|
Regex ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<message>.*)$
|
||||||
|
Time_Key time
|
||||||
|
Time_Format %Y-%m-%dT%H:%M:%S.%L%z
|
||||||
|
Decode_Field_As json message
|
||||||
|
|
||||||
|
|
@ -0,0 +1,137 @@
|
||||||
|
# Source: fluent-bit/templates/service.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: fluent-bit
|
||||||
|
namespace: logging
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: fluent-bit-0.47.9
|
||||||
|
app.kubernetes.io/name: fluent-bit
|
||||||
|
app.kubernetes.io/instance: fluent-bit
|
||||||
|
app.kubernetes.io/version: "3.1.7"
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- port: 2020
|
||||||
|
targetPort: http
|
||||||
|
protocol: TCP
|
||||||
|
name: http
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: fluent-bit
|
||||||
|
app.kubernetes.io/instance: fluent-bit
|
||||||
|
---
|
||||||
|
# Source: fluent-bit/templates/daemonset.yaml
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: DaemonSet
|
||||||
|
metadata:
|
||||||
|
name: fluent-bit
|
||||||
|
namespace: logging
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: fluent-bit-0.47.9
|
||||||
|
app.kubernetes.io/name: fluent-bit
|
||||||
|
app.kubernetes.io/instance: fluent-bit
|
||||||
|
app.kubernetes.io/version: "3.1.7"
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: fluent-bit
|
||||||
|
app.kubernetes.io/instance: fluent-bit
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: fluent-bit
|
||||||
|
app.kubernetes.io/instance: fluent-bit
|
||||||
|
annotations:
|
||||||
|
checksum/config: 19631ad1090fbeaf145be8a25d43bf24621413639593494df4b243914c27e763
|
||||||
|
spec:
|
||||||
|
serviceAccountName: fluent-bit
|
||||||
|
hostNetwork: false
|
||||||
|
dnsPolicy: ClusterFirst
|
||||||
|
containers:
|
||||||
|
- name: fluent-bit
|
||||||
|
image: "harbor.nativedeck.com/nd002-rc.1/fluent/fluent-bit:3.1.7-debug"
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
command:
|
||||||
|
- /fluent-bit/bin/fluent-bit
|
||||||
|
args:
|
||||||
|
- --workdir=/fluent-bit/etc
|
||||||
|
- --config=/fluent-bit/etc/conf/fluent-bit.conf
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
containerPort: 2020
|
||||||
|
protocol: TCP
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /
|
||||||
|
port: http
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /api/v1/health
|
||||||
|
port: http
|
||||||
|
volumeMounts:
|
||||||
|
- name: config
|
||||||
|
mountPath: /fluent-bit/etc/conf
|
||||||
|
- mountPath: /var/log
|
||||||
|
name: varlog
|
||||||
|
- mountPath: /var/lib/docker/containers
|
||||||
|
name: varlibdockercontainers
|
||||||
|
readOnly: true
|
||||||
|
- mountPath: /etc/machine-id
|
||||||
|
name: etcmachineid
|
||||||
|
readOnly: true
|
||||||
|
# Custom Add
|
||||||
|
- name: runlogjournal
|
||||||
|
mountPath: /run/log/journal
|
||||||
|
readOnly: true
|
||||||
|
# - name: dmesg
|
||||||
|
# mountPath: /var/log/dmesg
|
||||||
|
# readOnly: true
|
||||||
|
- name: mnt
|
||||||
|
mountPath: /mnt
|
||||||
|
readOnly: true
|
||||||
|
- name: fluentbitstate
|
||||||
|
mountPath: /var/fluent-bit/state
|
||||||
|
- name: file-save
|
||||||
|
mountPath: /home/ubuntu
|
||||||
|
# https://docs.fluentbit.io/manual/pipeline/filters/kubernetes
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 500Mi
|
||||||
|
requests:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 500Mi
|
||||||
|
volumes:
|
||||||
|
- name: config
|
||||||
|
configMap:
|
||||||
|
name: fluent-bit
|
||||||
|
- name: varlog
|
||||||
|
hostPath:
|
||||||
|
path: /var/log
|
||||||
|
- name: varlibdockercontainers
|
||||||
|
hostPath:
|
||||||
|
path: /var/lib/docker/containers
|
||||||
|
- name: etcmachineid
|
||||||
|
hostPath:
|
||||||
|
path: /etc/machine-id
|
||||||
|
type: File
|
||||||
|
# Custom Add
|
||||||
|
## for cash
|
||||||
|
- name: fluentbitstate
|
||||||
|
hostPath:
|
||||||
|
path: /var/fluent-bit/state
|
||||||
|
- name: runlogjournal # 있음
|
||||||
|
hostPath:
|
||||||
|
path: /run/log/journal
|
||||||
|
# - name: dmesg # 있음
|
||||||
|
# hostPath:
|
||||||
|
# path: /var/log/dmesg
|
||||||
|
- name: mnt # 있음
|
||||||
|
hostPath:
|
||||||
|
path: /mnt
|
||||||
|
- name: file-save # 있음
|
||||||
|
hostPath:
|
||||||
|
path: /home/ubuntu
|
||||||
|
|
||||||
|
|
@ -0,0 +1,132 @@
|
||||||
|
# Source: fluent-bit/templates/service.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: fluent-bit
|
||||||
|
namespace: logging
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: fluent-bit-0.47.9
|
||||||
|
app.kubernetes.io/name: fluent-bit
|
||||||
|
app.kubernetes.io/instance: fluent-bit
|
||||||
|
app.kubernetes.io/version: "3.1.7"
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- port: 2020
|
||||||
|
targetPort: http
|
||||||
|
protocol: TCP
|
||||||
|
name: http
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: fluent-bit
|
||||||
|
app.kubernetes.io/instance: fluent-bit
|
||||||
|
---
|
||||||
|
# Source: fluent-bit/templates/daemonset.yaml
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: DaemonSet
|
||||||
|
metadata:
|
||||||
|
name: fluent-bit
|
||||||
|
namespace: logging
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: fluent-bit-0.47.9
|
||||||
|
app.kubernetes.io/name: fluent-bit
|
||||||
|
app.kubernetes.io/instance: fluent-bit
|
||||||
|
app.kubernetes.io/version: "3.1.7"
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: fluent-bit
|
||||||
|
app.kubernetes.io/instance: fluent-bit
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: fluent-bit
|
||||||
|
app.kubernetes.io/instance: fluent-bit
|
||||||
|
annotations:
|
||||||
|
checksum/config: 19631ad1090fbeaf145be8a25d43bf24621413639593494df4b243914c27e763
|
||||||
|
spec:
|
||||||
|
serviceAccountName: fluent-bit
|
||||||
|
hostNetwork: false
|
||||||
|
dnsPolicy: ClusterFirst
|
||||||
|
containers:
|
||||||
|
- name: fluent-bit
|
||||||
|
image: "cr.fluentbit.io/fluent/fluent-bit:3.1.7"
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
command:
|
||||||
|
- /fluent-bit/bin/fluent-bit
|
||||||
|
args:
|
||||||
|
- --workdir=/fluent-bit/etc
|
||||||
|
- --config=/fluent-bit/etc/conf/fluent-bit.conf
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
containerPort: 2020
|
||||||
|
protocol: TCP
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /
|
||||||
|
port: http
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /api/v1/health
|
||||||
|
port: http
|
||||||
|
volumeMounts:
|
||||||
|
- name: config
|
||||||
|
mountPath: /fluent-bit/etc/conf
|
||||||
|
- mountPath: /var/log
|
||||||
|
name: varlog
|
||||||
|
- mountPath: /var/lib/docker/containers
|
||||||
|
name: varlibdockercontainers
|
||||||
|
readOnly: true
|
||||||
|
- mountPath: /etc/machine-id
|
||||||
|
name: etcmachineid
|
||||||
|
readOnly: true
|
||||||
|
# Custom Add
|
||||||
|
- name: runlogjournal
|
||||||
|
mountPath: /run/log/journal
|
||||||
|
readOnly: true
|
||||||
|
# - name: dmesg
|
||||||
|
# mountPath: /var/log/dmesg
|
||||||
|
# readOnly: true
|
||||||
|
- name: mnt
|
||||||
|
mountPath: /mnt
|
||||||
|
readOnly: true
|
||||||
|
- name: fluentbitstate
|
||||||
|
mountPath: /var/fluent-bit/state
|
||||||
|
# https://docs.fluentbit.io/manual/pipeline/filters/kubernetes
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 500Mi
|
||||||
|
requests:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 500Mi
|
||||||
|
volumes:
|
||||||
|
- name: config
|
||||||
|
configMap:
|
||||||
|
name: fluent-bit
|
||||||
|
- name: varlog
|
||||||
|
hostPath:
|
||||||
|
path: /var/log
|
||||||
|
- name: varlibdockercontainers
|
||||||
|
hostPath:
|
||||||
|
path: /var/lib/docker/containers
|
||||||
|
- name: etcmachineid
|
||||||
|
hostPath:
|
||||||
|
path: /etc/machine-id
|
||||||
|
type: File
|
||||||
|
# Custom Add
|
||||||
|
## for cash
|
||||||
|
- name: fluentbitstate
|
||||||
|
hostPath:
|
||||||
|
path: /var/fluent-bit/state
|
||||||
|
- name: runlogjournal # 있음
|
||||||
|
hostPath:
|
||||||
|
path: /run/log/journal
|
||||||
|
# - name: dmesg # 있음
|
||||||
|
# hostPath:
|
||||||
|
# path: /var/log/dmesg
|
||||||
|
- name: mnt # 있음
|
||||||
|
hostPath:
|
||||||
|
path: /mnt
|
||||||
|
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
# Source: fluent-bit/templates/tests/test-connection.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Pod
|
||||||
|
metadata:
|
||||||
|
name: "fluent-bit-test-connection"
|
||||||
|
namespace: logging
|
||||||
|
labels:
|
||||||
|
helm.sh/chart: fluent-bit-0.47.9
|
||||||
|
app.kubernetes.io/version: "3.1.7"
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
annotations:
|
||||||
|
helm.sh/hook: test
|
||||||
|
helm.sh/hook-delete-policy: hook-succeeded
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: wget
|
||||||
|
image: "harbor.nativedeck.com/nd002-rc.1/busybox:latest"
|
||||||
|
imagePullPolicy: Always
|
||||||
|
command: ["sh"]
|
||||||
|
args: ["-c", "wget -O- fluent-bit:2020"]
|
||||||
|
restartPolicy: Never
|
||||||
|
|
@ -0,0 +1,6 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: gitea
|
||||||
|
labels:
|
||||||
|
kubernetes.io/metadata.name: gitea
|
||||||
|
|
@ -0,0 +1,79 @@
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/pgpool/networkpolicy.yaml
|
||||||
|
kind: NetworkPolicy
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-pgpool
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
role: data
|
||||||
|
spec:
|
||||||
|
podSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
egress:
|
||||||
|
- {}
|
||||||
|
ingress:
|
||||||
|
- ports:
|
||||||
|
- port: 5432
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/postgresql/networkpolicy.yaml
|
||||||
|
kind: NetworkPolicy
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: data
|
||||||
|
spec:
|
||||||
|
podSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
egress:
|
||||||
|
- {}
|
||||||
|
ingress:
|
||||||
|
- ports:
|
||||||
|
- port: 5432
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/redis-cluster/templates/networkpolicy.yaml
|
||||||
|
kind: NetworkPolicy
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: release-name-redis-cluster
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
app.kubernetes.io/version: 7.2.5
|
||||||
|
spec:
|
||||||
|
podSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
egress:
|
||||||
|
- {}
|
||||||
|
ingress:
|
||||||
|
# Allow inbound connections
|
||||||
|
- ports:
|
||||||
|
- port: 6379
|
||||||
|
- port: 16379
|
||||||
|
|
@ -0,0 +1,77 @@
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/pgpool/pdb.yaml
|
||||||
|
apiVersion: policy/v1
|
||||||
|
kind: PodDisruptionBudget
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-pgpool
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 4.5.2
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
spec:
|
||||||
|
maxUnavailable: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/postgresql/pdb.yaml
|
||||||
|
apiVersion: policy/v1
|
||||||
|
kind: PodDisruptionBudget
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
spec:
|
||||||
|
maxUnavailable: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/postgresql/witness-pdb.yaml
|
||||||
|
apiVersion: policy/v1
|
||||||
|
kind: PodDisruptionBudget
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-postgresql-witness
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: witness
|
||||||
|
spec:
|
||||||
|
maxUnavailable: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: witness
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/redis-cluster/templates/poddisruptionbudget.yaml
|
||||||
|
apiVersion: policy/v1
|
||||||
|
kind: PodDisruptionBudget
|
||||||
|
metadata:
|
||||||
|
name: release-name-redis-cluster
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
app.kubernetes.io/version: 7.2.5
|
||||||
|
spec:
|
||||||
|
maxUnavailable: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
matchExpressions:
|
||||||
|
- {key: job-name, operator: NotIn, values: [release-name-redis-cluster-cluster-update]}
|
||||||
|
|
@ -0,0 +1,23 @@
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/serviceaccount.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/redis-cluster/templates/redis-serviceaccount.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: release-name-redis-cluster
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
app.kubernetes.io/version: 7.2.5
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
|
@ -0,0 +1,384 @@
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/pgpool/secrets.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-pgpool
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 4.5.2
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
type: Opaque
|
||||||
|
data:
|
||||||
|
admin-password: "aWppbmMxMjMh"
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/postgresql/secrets.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
namespace: "gitea"
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
type: Opaque
|
||||||
|
data:
|
||||||
|
postgres-password: "aWppbmMxMjMh"
|
||||||
|
password: "Z2l0ZWE="
|
||||||
|
repmgr-password: "aWppbmMxMjMh"
|
||||||
|
---
|
||||||
|
# Source: gitea/templates/gitea/config.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: release-name-gitea-inline-config
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app: gitea
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "1.22.1"
|
||||||
|
version: "1.22.1"
|
||||||
|
type: Opaque
|
||||||
|
stringData:
|
||||||
|
_generals_: ""
|
||||||
|
cache: |-
|
||||||
|
ADAPTER=redis
|
||||||
|
HOST=redis+cluster://:@release-name-redis-cluster-headless.gitea.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||||
|
database: |-
|
||||||
|
DB_TYPE=postgres
|
||||||
|
HOST=release-name-postgresql-ha-pgpool.gitea.svc.cluster.local:5432
|
||||||
|
NAME=gitea
|
||||||
|
PASSWD=gitea
|
||||||
|
USER=gitea
|
||||||
|
indexer: ISSUE_INDEXER_TYPE=db
|
||||||
|
metrics: ENABLED=false
|
||||||
|
queue: |-
|
||||||
|
CONN_STR=redis+cluster://:@release-name-redis-cluster-headless.gitea.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||||
|
TYPE=redis
|
||||||
|
repository: ROOT=/data/git/gitea-repositories
|
||||||
|
security: INSTALL_LOCK=true
|
||||||
|
server: |-
|
||||||
|
APP_DATA_PATH=/data
|
||||||
|
DOMAIN=gitea.nhngpuaas.com
|
||||||
|
ENABLE_PPROF=false
|
||||||
|
HTTP_PORT=3000
|
||||||
|
PROTOCOL=http
|
||||||
|
ROOT_URL=https://gitea.nhngpuaas.com
|
||||||
|
SSH_DOMAIN=gitea.nhngpuaas.com
|
||||||
|
SSH_LISTEN_PORT=2222
|
||||||
|
SSH_PORT=22
|
||||||
|
START_SSH_SERVER=true
|
||||||
|
session: |-
|
||||||
|
PROVIDER=redis
|
||||||
|
PROVIDER_CONFIG=redis+cluster://:@release-name-redis-cluster-headless.gitea.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||||
|
---
|
||||||
|
# Source: gitea/templates/gitea/config.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: release-name-gitea
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app: gitea
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "1.22.1"
|
||||||
|
version: "1.22.1"
|
||||||
|
type: Opaque
|
||||||
|
stringData:
|
||||||
|
assertions: |
|
||||||
|
config_environment.sh: |-
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
function env2ini::log() {
|
||||||
|
printf "${1}\n"
|
||||||
|
}
|
||||||
|
|
||||||
|
function env2ini::read_config_to_env() {
|
||||||
|
local section="${1}"
|
||||||
|
local line="${2}"
|
||||||
|
|
||||||
|
if [[ -z "${line}" ]]; then
|
||||||
|
# skip empty line
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
# 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
|
||||||
|
local setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
|
||||||
|
|
||||||
|
if [[ -z "${setting}" ]]; then
|
||||||
|
env2ini::log ' ! invalid setting'
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
local value=''
|
||||||
|
local regex="^${setting}(\s*)=(\s*)(.*)"
|
||||||
|
if [[ $line =~ $regex ]]; then
|
||||||
|
value="${BASH_REMATCH[3]}"
|
||||||
|
else
|
||||||
|
env2ini::log ' ! invalid setting'
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
env2ini::log " + '${setting}'"
|
||||||
|
|
||||||
|
if [[ -z "${section}" ]]; then
|
||||||
|
export "GITEA____${setting^^}=${value}" # '^^' makes the variable content uppercase
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
local masked_section="${section//./_0X2E_}" # '//' instructs to replace all matches
|
||||||
|
masked_section="${masked_section//-/_0X2D_}"
|
||||||
|
|
||||||
|
export "GITEA__${masked_section^^}__${setting^^}=${value}" # '^^' makes the variable content uppercase
|
||||||
|
}
|
||||||
|
|
||||||
|
function env2ini::reload_preset_envs() {
|
||||||
|
env2ini::log "Reloading preset envs..."
|
||||||
|
|
||||||
|
while read -r line; do
|
||||||
|
if [[ -z "${line}" ]]; then
|
||||||
|
# skip empty line
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
# 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
|
||||||
|
local setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
|
||||||
|
|
||||||
|
if [[ -z "${setting}" ]]; then
|
||||||
|
env2ini::log ' ! invalid setting'
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
local value=''
|
||||||
|
local regex="^${setting}(\s*)=(\s*)(.*)"
|
||||||
|
if [[ $line =~ $regex ]]; then
|
||||||
|
value="${BASH_REMATCH[3]}"
|
||||||
|
else
|
||||||
|
env2ini::log ' ! invalid setting'
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
env2ini::log " + '${setting}'"
|
||||||
|
|
||||||
|
export "${setting^^}=${value}" # '^^' makes the variable content uppercase
|
||||||
|
done < "/tmp/existing-envs"
|
||||||
|
|
||||||
|
rm /tmp/existing-envs
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
function env2ini::process_config_file() {
|
||||||
|
local config_file="${1}"
|
||||||
|
local section="$(basename "${config_file}")"
|
||||||
|
|
||||||
|
if [[ $section == '_generals_' ]]; then
|
||||||
|
|
||||||
|
section=''
|
||||||
|
else
|
||||||
|
env2ini::log " ${section}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
while read -r line; do
|
||||||
|
env2ini::read_config_to_env "${section}" "${line}"
|
||||||
|
done < <(awk 1 "${config_file}") # Helm .toYaml trims the trailing new line which breaks line processing; awk 1 ... adds it back while reading
|
||||||
|
}
|
||||||
|
|
||||||
|
function env2ini::load_config_sources() {
|
||||||
|
local path="${1}"
|
||||||
|
|
||||||
|
if [[ -d "${path}" ]]; then
|
||||||
|
env2ini::log "Processing $(basename "${path}")..."
|
||||||
|
|
||||||
|
while read -d '' configFile; do
|
||||||
|
env2ini::process_config_file "${configFile}"
|
||||||
|
done < <(find "${path}" -type l -not -name '..data' -print0)
|
||||||
|
|
||||||
|
env2ini::log "\n"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
function env2ini::generate_initial_secrets() {
|
||||||
|
# These environment variables will either be
|
||||||
|
# - overwritten with user defined values,
|
||||||
|
# - initially used to set up Gitea
|
||||||
|
# Anyway, they won't harm existing app.ini files
|
||||||
|
|
||||||
|
export GITEA__SECURITY__INTERNAL_TOKEN=$(gitea generate secret INTERNAL_TOKEN)
|
||||||
|
export GITEA__SECURITY__SECRET_KEY=$(gitea generate secret SECRET_KEY)
|
||||||
|
export GITEA__OAUTH2__JWT_SECRET=$(gitea generate secret JWT_SECRET)
|
||||||
|
export GITEA__SERVER__LFS_JWT_SECRET=$(gitea generate secret LFS_JWT_SECRET)
|
||||||
|
|
||||||
|
env2ini::log "...Initial secrets generated\n"
|
||||||
|
}
|
||||||
|
|
||||||
|
# save existing envs prior to script execution. Necessary to keep order of preexisting and custom envs
|
||||||
|
env | (grep -e '^GITEA__' || [[ $? == 1 ]]) > /tmp/existing-envs
|
||||||
|
|
||||||
|
# MUST BE CALLED BEFORE OTHER CONFIGURATION
|
||||||
|
env2ini::generate_initial_secrets
|
||||||
|
|
||||||
|
env2ini::load_config_sources '/env-to-ini-mounts/inlines/'
|
||||||
|
env2ini::load_config_sources '/env-to-ini-mounts/additionals/'
|
||||||
|
|
||||||
|
# load existing envs to override auto generated envs
|
||||||
|
env2ini::reload_preset_envs
|
||||||
|
|
||||||
|
env2ini::log "=== All configuration sources loaded ===\n"
|
||||||
|
|
||||||
|
# safety to prevent rewrite of secret keys if an app.ini already exists
|
||||||
|
if [ -f ${GITEA_APP_INI} ]; then
|
||||||
|
env2ini::log 'An app.ini file already exists. To prevent overwriting secret keys, these settings are dropped and remain unchanged:'
|
||||||
|
env2ini::log ' - security.INTERNAL_TOKEN'
|
||||||
|
env2ini::log ' - security.SECRET_KEY'
|
||||||
|
env2ini::log ' - oauth2.JWT_SECRET'
|
||||||
|
env2ini::log ' - server.LFS_JWT_SECRET'
|
||||||
|
|
||||||
|
unset GITEA__SECURITY__INTERNAL_TOKEN
|
||||||
|
unset GITEA__SECURITY__SECRET_KEY
|
||||||
|
unset GITEA__OAUTH2__JWT_SECRET
|
||||||
|
unset GITEA__SERVER__LFS_JWT_SECRET
|
||||||
|
fi
|
||||||
|
|
||||||
|
environment-to-ini -o $GITEA_APP_INI
|
||||||
|
---
|
||||||
|
# Source: gitea/templates/gitea/init.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: release-name-gitea-init
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app: gitea
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "1.22.1"
|
||||||
|
version: "1.22.1"
|
||||||
|
type: Opaque
|
||||||
|
stringData:
|
||||||
|
configure_gpg_environment.sh: |-
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
set -eu
|
||||||
|
|
||||||
|
gpg --batch --import /raw/private.asc
|
||||||
|
init_directory_structure.sh: |-
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
set -x
|
||||||
|
mkdir -p /data/git/.ssh
|
||||||
|
chmod -R 700 /data/git/.ssh
|
||||||
|
[ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf
|
||||||
|
|
||||||
|
# prepare temp directory structure
|
||||||
|
mkdir -p "${GITEA_TEMP}"
|
||||||
|
chmod ug+rwx "${GITEA_TEMP}"
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
configure_gitea.sh: |-
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
echo '==== BEGIN GITEA CONFIGURATION ===='
|
||||||
|
|
||||||
|
{ # try
|
||||||
|
gitea migrate
|
||||||
|
} || { # catch
|
||||||
|
echo "Gitea migrate might fail due to database connection...This init-container will try again in a few seconds"
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
|
function test_redis_connection() {
|
||||||
|
local RETRY=0
|
||||||
|
local MAX=30
|
||||||
|
|
||||||
|
echo 'Wait for redis to become avialable...'
|
||||||
|
until [ "${RETRY}" -ge "${MAX}" ]; do
|
||||||
|
nc -vz -w2 release-name-redis-cluster-headless.gitea.svc.cluster.local 6379 && break
|
||||||
|
RETRY=$[${RETRY}+1]
|
||||||
|
echo "...not ready yet (${RETRY}/${MAX})"
|
||||||
|
done
|
||||||
|
|
||||||
|
if [ "${RETRY}" -ge "${MAX}" ]; then
|
||||||
|
echo "Redis not reachable after '${MAX}' attempts!"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
test_redis_connection
|
||||||
|
function configure_admin_user() {
|
||||||
|
local full_admin_list=$(gitea admin user list --admin)
|
||||||
|
local actual_user_table=''
|
||||||
|
|
||||||
|
# We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
|
||||||
|
local regex="(.*)(ID\s+Username\s+Email\s+IsActive.*)"
|
||||||
|
if [[ "${full_admin_list}" =~ $regex ]]; then
|
||||||
|
actual_user_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
|
||||||
|
else
|
||||||
|
# This code block should never be reached, as long as the output table header remains the same.
|
||||||
|
# If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
|
||||||
|
|
||||||
|
echo "ERROR: 'configure_admin_user' was not able to determine the current list of admin users."
|
||||||
|
echo " Please review the output of 'gitea admin user list --admin' shown below."
|
||||||
|
echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-chart/issues."
|
||||||
|
echo "DEBUG: Output of 'gitea admin user list --admin'"
|
||||||
|
echo "--"
|
||||||
|
echo "${full_admin_list}"
|
||||||
|
echo "--"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
local ACCOUNT_ID=$(echo "${actual_user_table}" | grep -E "\s+${GITEA_ADMIN_USERNAME}\s+" | awk -F " " "{printf \$1}")
|
||||||
|
if [[ -z "${ACCOUNT_ID}" ]]; then
|
||||||
|
local -a create_args
|
||||||
|
create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email "gitea@local.domain")
|
||||||
|
if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = initialOnlyRequireReset ]]; then
|
||||||
|
create_args+=(--must-change-password=true)
|
||||||
|
else
|
||||||
|
create_args+=(--must-change-password=false)
|
||||||
|
fi
|
||||||
|
echo "No admin user '${GITEA_ADMIN_USERNAME}' found. Creating now..."
|
||||||
|
gitea admin user create "${create_args[@]}"
|
||||||
|
echo '...created.'
|
||||||
|
else
|
||||||
|
if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = keepUpdated ]]; then
|
||||||
|
echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist. Running update to sync password..."
|
||||||
|
# See https://gitea.com/gitea/helm-chart/issues/673
|
||||||
|
# --must-change-password argument was added to change-password, defaulting to true, counter to the previous behavior
|
||||||
|
# which acted as if it were provided with =false. If the argument is present in this version of gitea, then we
|
||||||
|
# should add it to prevent requiring frequent admin password resets.
|
||||||
|
local -a change_args
|
||||||
|
change_args=(--username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}")
|
||||||
|
if gitea admin user change-password --help | grep -qF -- '--must-change-password'; then
|
||||||
|
change_args+=(--must-change-password=false)
|
||||||
|
fi
|
||||||
|
gitea admin user change-password "${change_args[@]}"
|
||||||
|
echo '...password sync done.'
|
||||||
|
else
|
||||||
|
echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist, but update mode is set to '${GITEA_ADMIN_PASSWORD_MODE}'. Skipping."
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
configure_admin_user
|
||||||
|
|
||||||
|
function configure_ldap() {
|
||||||
|
echo 'no ldap configuration... skipping.'
|
||||||
|
}
|
||||||
|
|
||||||
|
configure_ldap
|
||||||
|
|
||||||
|
function configure_oauth() {
|
||||||
|
echo 'no oauth configuration... skipping.'
|
||||||
|
}
|
||||||
|
|
||||||
|
configure_oauth
|
||||||
|
|
||||||
|
echo '==== END GITEA CONFIGURATION ===='
|
||||||
|
|
@ -0,0 +1,14 @@
|
||||||
|
# Source: gitea/templates/gitea/pvc.yaml
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
apiVersion: v1
|
||||||
|
metadata:
|
||||||
|
name: gitea-shared-storage
|
||||||
|
namespace: gitea
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
volumeMode: Filesystem
|
||||||
|
# storageClassName: sc-monitoring
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 100Gi # default: 10Gi
|
||||||
|
|
@ -0,0 +1,6 @@
|
||||||
|
# Need To Change
|
||||||
|
## Secret File
|
||||||
|
* DOMAIN
|
||||||
|
* ROOT_URL
|
||||||
|
* SSH_DOMAIN
|
||||||
|
* ###-password : aWppbmMxMjMh
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,820 @@
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/pgpool/deployment.yaml
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-pgpool
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 4.5.2
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 4.5.2
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
spec:
|
||||||
|
nodeSelector:
|
||||||
|
nodegroup: nd
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
affinity:
|
||||||
|
podAffinity:
|
||||||
|
podAntiAffinity:
|
||||||
|
preferredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
- podAffinityTerm:
|
||||||
|
labelSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
topologyKey: kubernetes.io/hostname
|
||||||
|
weight: 1
|
||||||
|
nodeAffinity:
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 1001
|
||||||
|
fsGroupChangePolicy: Always
|
||||||
|
supplementalGroups: []
|
||||||
|
sysctls: []
|
||||||
|
serviceAccountName: release-name-postgresql-ha
|
||||||
|
# Auxiliary vars to populate environment variables
|
||||||
|
containers:
|
||||||
|
- name: pgpool
|
||||||
|
image: docker.io/bitnami/pgpool:4.5.2-debian-12-r2
|
||||||
|
imagePullPolicy: "IfNotPresent"
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
privileged: false
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsGroup: 1001
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1001
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
env:
|
||||||
|
- name: BITNAMI_DEBUG
|
||||||
|
value: "false"
|
||||||
|
- name: PGPOOL_BACKEND_NODES
|
||||||
|
value: 0:release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless:5432,1:release-name-postgresql-ha-postgresql-1.release-name-postgresql-ha-postgresql-headless:5432,2:release-name-postgresql-ha-postgresql-2.release-name-postgresql-ha-postgresql-headless:5432,
|
||||||
|
- name: PGPOOL_SR_CHECK_USER
|
||||||
|
value: "repmgr"
|
||||||
|
- name: PGPOOL_SR_CHECK_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
key: repmgr-password
|
||||||
|
- name: PGPOOL_SR_CHECK_DATABASE
|
||||||
|
value: "postgres"
|
||||||
|
- name: PGPOOL_ENABLE_LDAP
|
||||||
|
value: "no"
|
||||||
|
- name: PGPOOL_POSTGRES_USERNAME
|
||||||
|
value: "gitea"
|
||||||
|
- name: PGPOOL_POSTGRES_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
key: password
|
||||||
|
- name: PGPOOL_ADMIN_USERNAME
|
||||||
|
value: "admin"
|
||||||
|
- name: PGPOOL_ADMIN_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: release-name-postgresql-ha-pgpool
|
||||||
|
key: admin-password
|
||||||
|
- name: PGPOOL_AUTHENTICATION_METHOD
|
||||||
|
value: "scram-sha-256"
|
||||||
|
- name: PGPOOL_ENABLE_LOAD_BALANCING
|
||||||
|
value: "yes"
|
||||||
|
- name: PGPOOL_DISABLE_LOAD_BALANCE_ON_WRITE
|
||||||
|
value: "transaction"
|
||||||
|
- name: PGPOOL_ENABLE_LOG_CONNECTIONS
|
||||||
|
value: "no"
|
||||||
|
- name: PGPOOL_ENABLE_LOG_HOSTNAME
|
||||||
|
value: "yes"
|
||||||
|
- name: PGPOOL_ENABLE_LOG_PER_NODE_STATEMENT
|
||||||
|
value: "no"
|
||||||
|
- name: PGPOOL_RESERVED_CONNECTIONS
|
||||||
|
value: '1'
|
||||||
|
- name: PGPOOL_CHILD_LIFE_TIME
|
||||||
|
value: ""
|
||||||
|
- name: PGPOOL_ENABLE_TLS
|
||||||
|
value: "no"
|
||||||
|
- name: PGPOOL_HEALTH_CHECK_PSQL_TIMEOUT
|
||||||
|
value: "6"
|
||||||
|
envFrom:
|
||||||
|
ports:
|
||||||
|
- name: postgresql
|
||||||
|
containerPort: 5432
|
||||||
|
protocol: TCP
|
||||||
|
livenessProbe:
|
||||||
|
failureThreshold: 5
|
||||||
|
initialDelaySeconds: 30
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 5
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /opt/bitnami/scripts/pgpool/healthcheck.sh
|
||||||
|
readinessProbe:
|
||||||
|
failureThreshold: 5
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 5
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 5
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- bash
|
||||||
|
- -ec
|
||||||
|
- PGPASSWORD=${PGPOOL_POSTGRES_PASSWORD} psql -U "gitea" -d "gitea" -h /opt/bitnami/pgpool/tmp -tA -c "SELECT 1" >/dev/null
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 375m
|
||||||
|
ephemeral-storage: 2Gi
|
||||||
|
memory: 384Mi
|
||||||
|
requests:
|
||||||
|
cpu: 250m
|
||||||
|
ephemeral-storage: 50Mi
|
||||||
|
memory: 256Mi
|
||||||
|
volumeMounts:
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/pgpool/etc
|
||||||
|
subPath: app-etc-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/pgpool/conf
|
||||||
|
subPath: app-conf-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/pgpool/tmp
|
||||||
|
subPath: app-tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/pgpool/logs
|
||||||
|
subPath: app-logs-dir
|
||||||
|
volumes:
|
||||||
|
- name: empty-dir
|
||||||
|
emptyDir: {}
|
||||||
|
---
|
||||||
|
# Source: gitea/templates/gitea/deployment.yaml
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: release-name-gitea
|
||||||
|
namespace: gitea
|
||||||
|
annotations:
|
||||||
|
labels:
|
||||||
|
app: gitea
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "1.22.1"
|
||||||
|
version: "1.22.1"
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
strategy:
|
||||||
|
type: RollingUpdate
|
||||||
|
rollingUpdate:
|
||||||
|
maxUnavailable: 0
|
||||||
|
maxSurge: 100%
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
checksum/config: 00fd8064076a446a896870db4974c6590fcf51561cf391547e559011465a57d8
|
||||||
|
labels:
|
||||||
|
app: gitea
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "1.22.1"
|
||||||
|
version: "1.22.1"
|
||||||
|
spec:
|
||||||
|
nodeSelector:
|
||||||
|
nodegroup: nd
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 1000
|
||||||
|
initContainers:
|
||||||
|
- name: init-directories
|
||||||
|
image: "gitea/gitea:1.22.1-rootless"
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
command: ["/usr/sbin/init_directory_structure.sh"]
|
||||||
|
env:
|
||||||
|
- name: GITEA_APP_INI
|
||||||
|
value: /data/gitea/conf/app.ini
|
||||||
|
- name: GITEA_CUSTOM
|
||||||
|
value: /data/gitea
|
||||||
|
- name: GITEA_WORK_DIR
|
||||||
|
value: /data
|
||||||
|
- name: GITEA_TEMP
|
||||||
|
value: /tmp/gitea
|
||||||
|
volumeMounts:
|
||||||
|
- name: init
|
||||||
|
mountPath: /usr/sbin
|
||||||
|
- name: temp
|
||||||
|
mountPath: /tmp
|
||||||
|
- name: data
|
||||||
|
mountPath: /data
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
{}
|
||||||
|
resources:
|
||||||
|
limits: {}
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
- name: init-app-ini
|
||||||
|
image: "gitea/gitea:1.22.1-rootless"
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
command: ["/usr/sbin/config_environment.sh"]
|
||||||
|
env:
|
||||||
|
- name: GITEA_APP_INI
|
||||||
|
value: /data/gitea/conf/app.ini
|
||||||
|
- name: GITEA_CUSTOM
|
||||||
|
value: /data/gitea
|
||||||
|
- name: GITEA_WORK_DIR
|
||||||
|
value: /data
|
||||||
|
- name: GITEA_TEMP
|
||||||
|
value: /tmp/gitea
|
||||||
|
volumeMounts:
|
||||||
|
- name: config
|
||||||
|
mountPath: /usr/sbin
|
||||||
|
- name: temp
|
||||||
|
mountPath: /tmp
|
||||||
|
- name: data
|
||||||
|
mountPath: /data
|
||||||
|
- name: inline-config-sources
|
||||||
|
mountPath: /env-to-ini-mounts/inlines/
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
{}
|
||||||
|
resources:
|
||||||
|
limits: {}
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
- name: configure-gitea
|
||||||
|
image: "gitea/gitea:1.22.1-rootless"
|
||||||
|
command: ["/usr/sbin/configure_gitea.sh"]
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
securityContext:
|
||||||
|
runAsUser: 1000
|
||||||
|
env:
|
||||||
|
- name: GITEA_APP_INI
|
||||||
|
value: /data/gitea/conf/app.ini
|
||||||
|
- name: GITEA_CUSTOM
|
||||||
|
value: /data/gitea
|
||||||
|
- name: GITEA_WORK_DIR
|
||||||
|
value: /data
|
||||||
|
- name: GITEA_TEMP
|
||||||
|
value: /tmp/gitea
|
||||||
|
- name: HOME
|
||||||
|
value: /data/gitea/git
|
||||||
|
- name: GITEA_ADMIN_USERNAME
|
||||||
|
value: "gitea_admin"
|
||||||
|
- name: GITEA_ADMIN_PASSWORD
|
||||||
|
value: "nhn!@#123" # sdjo
|
||||||
|
- name: GITEA_ADMIN_PASSWORD_MODE
|
||||||
|
value: keepUpdated
|
||||||
|
volumeMounts:
|
||||||
|
- name: init
|
||||||
|
mountPath: /usr/sbin
|
||||||
|
- name: temp
|
||||||
|
mountPath: /tmp
|
||||||
|
- name: data
|
||||||
|
mountPath: /data
|
||||||
|
|
||||||
|
resources:
|
||||||
|
limits: {}
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
terminationGracePeriodSeconds: 60
|
||||||
|
containers:
|
||||||
|
- name: gitea
|
||||||
|
image: "gitea/gitea:1.22.1-rootless"
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
env:
|
||||||
|
# SSH Port values have to be set here as well for openssh configuration
|
||||||
|
- name: SSH_LISTEN_PORT
|
||||||
|
value: "2222"
|
||||||
|
- name: SSH_PORT
|
||||||
|
value: "22"
|
||||||
|
- name: GITEA_APP_INI
|
||||||
|
value: /data/gitea/conf/app.ini
|
||||||
|
- name: GITEA_CUSTOM
|
||||||
|
value: /data/gitea
|
||||||
|
- name: GITEA_WORK_DIR
|
||||||
|
value: /data
|
||||||
|
- name: GITEA_TEMP
|
||||||
|
value: /tmp/gitea
|
||||||
|
- name: TMPDIR
|
||||||
|
value: /tmp/gitea
|
||||||
|
- name: HOME
|
||||||
|
value: /data/gitea/git
|
||||||
|
ports:
|
||||||
|
- name: ssh
|
||||||
|
containerPort: 2222
|
||||||
|
- name: http
|
||||||
|
containerPort: 3000
|
||||||
|
livenessProbe:
|
||||||
|
failureThreshold: 10
|
||||||
|
initialDelaySeconds: 200
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
timeoutSeconds: 1
|
||||||
|
readinessProbe:
|
||||||
|
failureThreshold: 3
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
timeoutSeconds: 1
|
||||||
|
resources:
|
||||||
|
{}
|
||||||
|
securityContext:
|
||||||
|
{}
|
||||||
|
volumeMounts:
|
||||||
|
- name: temp
|
||||||
|
mountPath: /tmp
|
||||||
|
- name: data
|
||||||
|
mountPath: /data
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
- name: init
|
||||||
|
secret:
|
||||||
|
secretName: release-name-gitea-init
|
||||||
|
defaultMode: 110
|
||||||
|
- name: config
|
||||||
|
secret:
|
||||||
|
secretName: release-name-gitea
|
||||||
|
defaultMode: 110
|
||||||
|
- name: inline-config-sources
|
||||||
|
secret:
|
||||||
|
secretName: release-name-gitea-inline-config
|
||||||
|
- name: temp
|
||||||
|
emptyDir: {}
|
||||||
|
- name: data
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: gitea-shared-storage
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/postgresql/statefulset.yaml
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: StatefulSet
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
namespace: "gitea"
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: data
|
||||||
|
spec:
|
||||||
|
replicas: 3
|
||||||
|
podManagementPolicy: "Parallel"
|
||||||
|
serviceName: release-name-postgresql-ha-postgresql-headless
|
||||||
|
updateStrategy:
|
||||||
|
type: RollingUpdate
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: data
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: data
|
||||||
|
spec:
|
||||||
|
nodeSelector:
|
||||||
|
nodegroup: nd
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
affinity:
|
||||||
|
podAffinity:
|
||||||
|
|
||||||
|
podAntiAffinity:
|
||||||
|
preferredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
- podAffinityTerm:
|
||||||
|
labelSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
topologyKey: kubernetes.io/hostname
|
||||||
|
weight: 1
|
||||||
|
nodeAffinity:
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 1001
|
||||||
|
fsGroupChangePolicy: Always
|
||||||
|
supplementalGroups: []
|
||||||
|
sysctls: []
|
||||||
|
serviceAccountName: release-name-postgresql-ha
|
||||||
|
hostNetwork: false
|
||||||
|
hostIPC: false
|
||||||
|
containers:
|
||||||
|
- name: postgresql
|
||||||
|
image: docker.io/bitnami/postgresql-repmgr:16.3.0-debian-12-r15
|
||||||
|
imagePullPolicy: "IfNotPresent"
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
privileged: false
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsGroup: 1001
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1001
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
lifecycle:
|
||||||
|
preStop:
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /pre-stop.sh
|
||||||
|
- "25"
|
||||||
|
# Auxiliary vars to populate environment variables
|
||||||
|
env:
|
||||||
|
- name: BITNAMI_DEBUG
|
||||||
|
value: "false"
|
||||||
|
# PostgreSQL configuration
|
||||||
|
- name: POSTGRESQL_VOLUME_DIR
|
||||||
|
value: "/bitnami/postgresql"
|
||||||
|
- name: PGDATA
|
||||||
|
value: "/bitnami/postgresql/data"
|
||||||
|
- name: POSTGRES_POSTGRES_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
key: postgres-password
|
||||||
|
- name: POSTGRES_USER
|
||||||
|
value: "gitea"
|
||||||
|
- name: POSTGRES_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
key: password
|
||||||
|
- name: POSTGRES_DB
|
||||||
|
value: "gitea"
|
||||||
|
- name: POSTGRESQL_LOG_HOSTNAME
|
||||||
|
value: "true"
|
||||||
|
- name: POSTGRESQL_LOG_CONNECTIONS
|
||||||
|
value: "false"
|
||||||
|
- name: POSTGRESQL_LOG_DISCONNECTIONS
|
||||||
|
value: "false"
|
||||||
|
- name: POSTGRESQL_PGAUDIT_LOG_CATALOG
|
||||||
|
value: "off"
|
||||||
|
- name: POSTGRESQL_CLIENT_MIN_MESSAGES
|
||||||
|
value: "error"
|
||||||
|
- name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
|
||||||
|
value: "pgaudit, repmgr"
|
||||||
|
- name: POSTGRESQL_ENABLE_TLS
|
||||||
|
value: "no"
|
||||||
|
- name: POSTGRESQL_PORT_NUMBER
|
||||||
|
value: "5432"
|
||||||
|
# Repmgr configuration
|
||||||
|
- name: REPMGR_PORT_NUMBER
|
||||||
|
value: "5432"
|
||||||
|
- name: REPMGR_PRIMARY_PORT
|
||||||
|
value: "5432"
|
||||||
|
- name: MY_POD_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
- name: REPMGR_UPGRADE_EXTENSION
|
||||||
|
value: "no"
|
||||||
|
- name: REPMGR_PGHBA_TRUST_ALL
|
||||||
|
value: "no"
|
||||||
|
- name: REPMGR_MOUNTED_CONF_DIR
|
||||||
|
value: "/bitnami/repmgr/conf"
|
||||||
|
- name: REPMGR_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
- name: REPMGR_PARTNER_NODES
|
||||||
|
value: release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,release-name-postgresql-ha-postgresql-1.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,release-name-postgresql-ha-postgresql-2.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,
|
||||||
|
- name: REPMGR_PRIMARY_HOST
|
||||||
|
value: "release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
|
||||||
|
- name: REPMGR_NODE_NAME
|
||||||
|
value: "$(MY_POD_NAME)"
|
||||||
|
- name: REPMGR_NODE_NETWORK_NAME
|
||||||
|
value: "$(MY_POD_NAME).release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
|
||||||
|
- name: REPMGR_NODE_TYPE
|
||||||
|
value: "data"
|
||||||
|
- name: REPMGR_LOG_LEVEL
|
||||||
|
value: "NOTICE"
|
||||||
|
- name: REPMGR_CONNECT_TIMEOUT
|
||||||
|
value: "5"
|
||||||
|
- name: REPMGR_RECONNECT_ATTEMPTS
|
||||||
|
value: "2"
|
||||||
|
- name: REPMGR_RECONNECT_INTERVAL
|
||||||
|
value: "3"
|
||||||
|
- name: REPMGR_USERNAME
|
||||||
|
value: "repmgr"
|
||||||
|
- name: REPMGR_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
key: repmgr-password
|
||||||
|
- name: REPMGR_DATABASE
|
||||||
|
value: "repmgr"
|
||||||
|
- name: REPMGR_FENCE_OLD_PRIMARY
|
||||||
|
value: "no"
|
||||||
|
- name: REPMGR_CHILD_NODES_CHECK_INTERVAL
|
||||||
|
value: "5"
|
||||||
|
- name: REPMGR_CHILD_NODES_CONNECTED_MIN_COUNT
|
||||||
|
value: "1"
|
||||||
|
- name: REPMGR_CHILD_NODES_DISCONNECT_TIMEOUT
|
||||||
|
value: "30"
|
||||||
|
envFrom:
|
||||||
|
ports:
|
||||||
|
- name: postgresql
|
||||||
|
containerPort: 5432
|
||||||
|
protocol: TCP
|
||||||
|
livenessProbe:
|
||||||
|
failureThreshold: 6
|
||||||
|
initialDelaySeconds: 30
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 5
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- bash
|
||||||
|
- -ec
|
||||||
|
- 'PGPASSWORD=$POSTGRES_PASSWORD psql -w -U "gitea" -d "gitea" -h 127.0.0.1 -p 5432 -c "SELECT 1"'
|
||||||
|
readinessProbe:
|
||||||
|
failureThreshold: 6
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 5
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- bash
|
||||||
|
- -ec
|
||||||
|
- |
|
||||||
|
exec pg_isready -U "postgres" -h 127.0.0.1 -p 5432
|
||||||
|
[ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ]
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 375m
|
||||||
|
ephemeral-storage: 2Gi
|
||||||
|
memory: 384Mi
|
||||||
|
requests:
|
||||||
|
cpu: 250m
|
||||||
|
ephemeral-storage: 50Mi
|
||||||
|
memory: 256Mi
|
||||||
|
volumeMounts:
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/postgresql/conf
|
||||||
|
subPath: app-conf-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/postgresql/tmp
|
||||||
|
subPath: app-tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/repmgr/conf
|
||||||
|
subPath: repmgr-conf-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/repmgr/tmp
|
||||||
|
subPath: repmgr-tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/repmgr/logs
|
||||||
|
subPath: repmgr-logs-dir
|
||||||
|
- name: data
|
||||||
|
mountPath: /bitnami/postgresql
|
||||||
|
- name: hooks-scripts
|
||||||
|
mountPath: /pre-stop.sh
|
||||||
|
subPath: pre-stop.sh
|
||||||
|
- name: hooks-scripts
|
||||||
|
mountPath: /readiness-probe.sh
|
||||||
|
subPath: readiness-probe.sh
|
||||||
|
volumes:
|
||||||
|
- name: empty-dir
|
||||||
|
emptyDir: {}
|
||||||
|
- name: hooks-scripts
|
||||||
|
configMap:
|
||||||
|
name: release-name-postgresql-ha-postgresql-hooks-scripts
|
||||||
|
defaultMode: 0755
|
||||||
|
volumeClaimTemplates:
|
||||||
|
- apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: data
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- "ReadWriteOnce"
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: "8Gi"
|
||||||
|
---
|
||||||
|
# Source: cdgitea/charts/redis-cluster/templates/redis-statefulset.yaml
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: StatefulSet
|
||||||
|
metadata:
|
||||||
|
name: release-name-redis-cluster
|
||||||
|
namespace: "gitea"
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
app.kubernetes.io/version: 7.2.5
|
||||||
|
spec:
|
||||||
|
updateStrategy:
|
||||||
|
rollingUpdate:
|
||||||
|
partition: 0
|
||||||
|
type: RollingUpdate
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
replicas: 3
|
||||||
|
serviceName: release-name-redis-cluster-headless
|
||||||
|
podManagementPolicy: Parallel
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
app.kubernetes.io/version: 7.2.5
|
||||||
|
annotations:
|
||||||
|
checksum/scripts: f4443ed238f1b19ab40555e6ba2aea56daba79e8270549f884b9b31cf8e0e2ee
|
||||||
|
checksum/secret: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
|
||||||
|
checksum/config: 958b865b26062946819f240fe4e5fd268b7c3203b944549981f1bd7fdc7947eb
|
||||||
|
spec:
|
||||||
|
nodeSelector:
|
||||||
|
nodegroup: nd
|
||||||
|
hostNetwork: false
|
||||||
|
enableServiceLinks: false
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 1001
|
||||||
|
fsGroupChangePolicy: Always
|
||||||
|
supplementalGroups: []
|
||||||
|
sysctls: []
|
||||||
|
serviceAccountName: release-name-redis-cluster
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
affinity:
|
||||||
|
podAffinity:
|
||||||
|
|
||||||
|
podAntiAffinity:
|
||||||
|
preferredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
- podAffinityTerm:
|
||||||
|
labelSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
topologyKey: kubernetes.io/hostname
|
||||||
|
weight: 1
|
||||||
|
nodeAffinity:
|
||||||
|
|
||||||
|
containers:
|
||||||
|
- name: release-name-redis-cluster
|
||||||
|
image: docker.io/bitnami/redis-cluster:7.2.5-debian-12-r2
|
||||||
|
imagePullPolicy: "IfNotPresent"
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
privileged: false
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsGroup: 1001
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1001
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
command: ['/bin/bash', '-c']
|
||||||
|
args:
|
||||||
|
- |
|
||||||
|
# Backwards compatibility change
|
||||||
|
if ! [[ -f /opt/bitnami/redis/etc/redis.conf ]]; then
|
||||||
|
echo COPYING FILE
|
||||||
|
cp /opt/bitnami/redis/etc/redis-default.conf /opt/bitnami/redis/etc/redis.conf
|
||||||
|
fi
|
||||||
|
pod_index=($(echo "$POD_NAME" | tr "-" "\n"))
|
||||||
|
pod_index="${pod_index[-1]}"
|
||||||
|
if [[ "$pod_index" == "0" ]]; then
|
||||||
|
export REDIS_CLUSTER_CREATOR="yes"
|
||||||
|
export REDIS_CLUSTER_REPLICAS="0"
|
||||||
|
fi
|
||||||
|
/opt/bitnami/scripts/redis-cluster/entrypoint.sh /opt/bitnami/scripts/redis-cluster/run.sh
|
||||||
|
env:
|
||||||
|
- name: POD_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
- name: REDIS_NODES
|
||||||
|
value: "release-name-redis-cluster-0.release-name-redis-cluster-headless release-name-redis-cluster-1.release-name-redis-cluster-headless release-name-redis-cluster-2.release-name-redis-cluster-headless "
|
||||||
|
- name: ALLOW_EMPTY_PASSWORD
|
||||||
|
value: "yes"
|
||||||
|
- name: REDIS_AOF_ENABLED
|
||||||
|
value: "yes"
|
||||||
|
- name: REDIS_TLS_ENABLED
|
||||||
|
value: "no"
|
||||||
|
- name: REDIS_PORT_NUMBER
|
||||||
|
value: "6379"
|
||||||
|
ports:
|
||||||
|
- name: tcp-redis
|
||||||
|
containerPort: 6379
|
||||||
|
- name: tcp-redis-bus
|
||||||
|
containerPort: 16379
|
||||||
|
livenessProbe:
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 5
|
||||||
|
# One second longer than command timeout should prevent generation of zombie processes.
|
||||||
|
timeoutSeconds: 6
|
||||||
|
successThreshold: 1
|
||||||
|
failureThreshold: 5
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- sh
|
||||||
|
- -c
|
||||||
|
- /scripts/ping_liveness_local.sh 5
|
||||||
|
readinessProbe:
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 5
|
||||||
|
# One second longer than command timeout should prevent generation of zombie processes.
|
||||||
|
timeoutSeconds: 2
|
||||||
|
successThreshold: 1
|
||||||
|
failureThreshold: 5
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- sh
|
||||||
|
- -c
|
||||||
|
- /scripts/ping_readiness_local.sh 1
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 150m
|
||||||
|
ephemeral-storage: 2Gi
|
||||||
|
memory: 192Mi
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
ephemeral-storage: 50Mi
|
||||||
|
memory: 128Mi
|
||||||
|
volumeMounts:
|
||||||
|
- name: scripts
|
||||||
|
mountPath: /scripts
|
||||||
|
- name: redis-data
|
||||||
|
mountPath: /bitnami/redis/data
|
||||||
|
subPath:
|
||||||
|
- name: default-config
|
||||||
|
mountPath: /opt/bitnami/redis/etc/redis-default.conf
|
||||||
|
subPath: redis-default.conf
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/redis/etc/
|
||||||
|
subPath: app-conf-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/redis/tmp
|
||||||
|
subPath: app-tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/redis/logs
|
||||||
|
subPath: app-logs-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
volumes:
|
||||||
|
- name: scripts
|
||||||
|
configMap:
|
||||||
|
name: release-name-redis-cluster-scripts
|
||||||
|
defaultMode: 0755
|
||||||
|
- name: default-config
|
||||||
|
configMap:
|
||||||
|
name: release-name-redis-cluster-default
|
||||||
|
- name: empty-dir
|
||||||
|
emptyDir: {}
|
||||||
|
volumeClaimTemplates:
|
||||||
|
- metadata:
|
||||||
|
name: redis-data
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- "ReadWriteOnce"
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: "8Gi"
|
||||||
|
|
@ -0,0 +1,26 @@
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: Ingress
|
||||||
|
metadata:
|
||||||
|
name: ing-gitea
|
||||||
|
namespace: gitea
|
||||||
|
annotations:
|
||||||
|
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||||
|
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
||||||
|
spec:
|
||||||
|
ingressClassName: nginx
|
||||||
|
rules:
|
||||||
|
- host: gitea.nhngpuaas.com
|
||||||
|
http:
|
||||||
|
paths:
|
||||||
|
- path: /
|
||||||
|
pathType: Prefix
|
||||||
|
backend:
|
||||||
|
service:
|
||||||
|
name: release-name-gitea-http
|
||||||
|
port:
|
||||||
|
number: 3000
|
||||||
|
tls:
|
||||||
|
- hosts:
|
||||||
|
- "gitea.nhngpuaas.com"
|
||||||
|
secretName: nhngpuaas-ssl
|
||||||
|
|
||||||
|
|
@ -0,0 +1,172 @@
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/pgpool/service.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-pgpool
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 4.5.2
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
sessionAffinity: None
|
||||||
|
ports:
|
||||||
|
- name: "postgresql"
|
||||||
|
port: 5432
|
||||||
|
targetPort: postgresql
|
||||||
|
protocol: TCP
|
||||||
|
# nodePort: null
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/postgresql/service-headless.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-postgresql-headless
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
clusterIP: None
|
||||||
|
publishNotReadyAddresses: false
|
||||||
|
ports:
|
||||||
|
- name: "postgresql"
|
||||||
|
port: 5432
|
||||||
|
targetPort: postgresql
|
||||||
|
protocol: TCP
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: data
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/postgresql/service.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- name: "postgresql"
|
||||||
|
port: 5432
|
||||||
|
targetPort: postgresql
|
||||||
|
protocol: TCP
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: data
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/redis-cluster/templates/headless-svc.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: release-name-redis-cluster-headless
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
app.kubernetes.io/version: 7.2.5
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
clusterIP: None
|
||||||
|
publishNotReadyAddresses: true
|
||||||
|
ports:
|
||||||
|
- name: tcp-redis
|
||||||
|
port: 6379
|
||||||
|
targetPort: tcp-redis
|
||||||
|
- name: tcp-redis-bus
|
||||||
|
port: 16379
|
||||||
|
targetPort: tcp-redis-bus
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/redis-cluster/templates/redis-svc.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: release-name-redis-cluster
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
app.kubernetes.io/version: 7.2.5
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
sessionAffinity: None
|
||||||
|
ports:
|
||||||
|
- name: tcp-redis
|
||||||
|
port: 6379
|
||||||
|
targetPort: tcp-redis
|
||||||
|
protocol: TCP
|
||||||
|
nodePort: null
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
---
|
||||||
|
# Source: gitea/templates/gitea/http-svc.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: release-name-gitea-http
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app: gitea
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "1.22.1"
|
||||||
|
version: "1.22.1"
|
||||||
|
# annotations:
|
||||||
|
# {}
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
clusterIP: None
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
port: 3000
|
||||||
|
targetPort:
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
---
|
||||||
|
# Source: gitea/templates/gitea/ssh-svc.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: release-name-gitea-ssh
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app: gitea
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "1.22.1"
|
||||||
|
version: "1.22.1"
|
||||||
|
# annotations:
|
||||||
|
# {}
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
clusterIP: None
|
||||||
|
ports:
|
||||||
|
- name: ssh
|
||||||
|
port: 22
|
||||||
|
targetPort: 2222
|
||||||
|
protocol: TCP
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
|
@ -0,0 +1,22 @@
|
||||||
|
# Patterns to ignore when building packages.
|
||||||
|
# This supports shell glob matching, relative path matching, and
|
||||||
|
# negation (prefixed with !). Only one pattern per line.
|
||||||
|
.DS_Store
|
||||||
|
# Common VCS dirs
|
||||||
|
.git/
|
||||||
|
.gitignore
|
||||||
|
.bzr/
|
||||||
|
.bzrignore
|
||||||
|
.hg/
|
||||||
|
.hgignore
|
||||||
|
.svn/
|
||||||
|
# Common backup files
|
||||||
|
*.swp
|
||||||
|
*.bak
|
||||||
|
*.tmp
|
||||||
|
*~
|
||||||
|
# Various IDEs
|
||||||
|
.project
|
||||||
|
.idea/
|
||||||
|
*.tmproj
|
||||||
|
.vscode/
|
||||||
|
|
@ -0,0 +1,6 @@
|
||||||
|
dependencies:
|
||||||
|
- name: node-feature-discovery
|
||||||
|
repository: https://kubernetes-sigs.github.io/node-feature-discovery/charts
|
||||||
|
version: 0.17.2
|
||||||
|
digest: sha256:4c55d30d958027ef8997a2976449326de3c90049025c3ebb9bee017cad32cc3f
|
||||||
|
generated: "2025-02-25T09:08:49.128088-08:00"
|
||||||
|
|
@ -0,0 +1,23 @@
|
||||||
|
apiVersion: v2
|
||||||
|
appVersion: v25.3.0
|
||||||
|
dependencies:
|
||||||
|
- condition: nfd.enabled
|
||||||
|
name: node-feature-discovery
|
||||||
|
repository: https://kubernetes-sigs.github.io/node-feature-discovery/charts
|
||||||
|
version: v0.17.2
|
||||||
|
description: NVIDIA GPU Operator creates/configures/manages GPUs atop Kubernetes
|
||||||
|
home: https://docs.nvidia.com/datacenter/cloud-native/gpu-operator/overview.html
|
||||||
|
icon: https://assets.nvidiagrid.net/ngc/logos/GPUoperator.png
|
||||||
|
keywords:
|
||||||
|
- gpu
|
||||||
|
- cuda
|
||||||
|
- compute
|
||||||
|
- operator
|
||||||
|
- deep learning
|
||||||
|
- monitoring
|
||||||
|
- tesla
|
||||||
|
kubeVersion: '>= 1.16.0-0'
|
||||||
|
name: gpu-operator
|
||||||
|
sources:
|
||||||
|
- https://github.com/NVIDIA/gpu-operator
|
||||||
|
version: v25.3.0
|
||||||
|
|
@ -0,0 +1,23 @@
|
||||||
|
# Patterns to ignore when building packages.
|
||||||
|
# This supports shell glob matching, relative path matching, and
|
||||||
|
# negation (prefixed with !). Only one pattern per line.
|
||||||
|
.DS_Store
|
||||||
|
# Common VCS dirs
|
||||||
|
.git/
|
||||||
|
.gitignore
|
||||||
|
.bzr/
|
||||||
|
.bzrignore
|
||||||
|
.hg/
|
||||||
|
.hgignore
|
||||||
|
.svn/
|
||||||
|
# Common backup files
|
||||||
|
*.swp
|
||||||
|
*.bak
|
||||||
|
*.tmp
|
||||||
|
*.orig
|
||||||
|
*~
|
||||||
|
# Various IDEs
|
||||||
|
.project
|
||||||
|
.idea/
|
||||||
|
*.tmproj
|
||||||
|
.vscode/
|
||||||
|
|
@ -0,0 +1,14 @@
|
||||||
|
apiVersion: v2
|
||||||
|
appVersion: v0.17.2
|
||||||
|
description: 'Detects hardware features available on each node in a Kubernetes cluster,
|
||||||
|
and advertises those features using node labels. '
|
||||||
|
home: https://github.com/kubernetes-sigs/node-feature-discovery
|
||||||
|
keywords:
|
||||||
|
- feature-discovery
|
||||||
|
- feature-detection
|
||||||
|
- node-labels
|
||||||
|
name: node-feature-discovery
|
||||||
|
sources:
|
||||||
|
- https://github.com/kubernetes-sigs/node-feature-discovery
|
||||||
|
type: application
|
||||||
|
version: 0.17.2
|
||||||
|
|
@ -0,0 +1,10 @@
|
||||||
|
# Node Feature Discovery
|
||||||
|
|
||||||
|
Node Feature Discovery (NFD) is a Kubernetes add-on for detecting hardware
|
||||||
|
features and system configuration. Detected features are advertised as node
|
||||||
|
labels. NFD provides flexible configuration and extension points for a wide
|
||||||
|
range of vendor and application specific node labeling needs.
|
||||||
|
|
||||||
|
See
|
||||||
|
[NFD documentation](https://kubernetes-sigs.github.io/node-feature-discovery/v0.17/deployment/helm.html)
|
||||||
|
for deployment instructions.
|
||||||
|
|
@ -0,0 +1,711 @@
|
||||||
|
---
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
controller-gen.kubebuilder.io/version: v0.16.3
|
||||||
|
name: nodefeatures.nfd.k8s-sigs.io
|
||||||
|
spec:
|
||||||
|
group: nfd.k8s-sigs.io
|
||||||
|
names:
|
||||||
|
kind: NodeFeature
|
||||||
|
listKind: NodeFeatureList
|
||||||
|
plural: nodefeatures
|
||||||
|
singular: nodefeature
|
||||||
|
scope: Namespaced
|
||||||
|
versions:
|
||||||
|
- name: v1alpha1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: |-
|
||||||
|
NodeFeature resource holds the features discovered for one node in the
|
||||||
|
cluster.
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: |-
|
||||||
|
APIVersion defines the versioned schema of this representation of an object.
|
||||||
|
Servers should convert recognized schemas to the latest internal value, and
|
||||||
|
may reject unrecognized values.
|
||||||
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: |-
|
||||||
|
Kind is a string value representing the REST resource this object represents.
|
||||||
|
Servers may infer this from the endpoint the client submits requests to.
|
||||||
|
Cannot be updated.
|
||||||
|
In CamelCase.
|
||||||
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: Specification of the NodeFeature, containing features discovered
|
||||||
|
for a node.
|
||||||
|
properties:
|
||||||
|
features:
|
||||||
|
description: Features is the full "raw" features data that has been
|
||||||
|
discovered.
|
||||||
|
properties:
|
||||||
|
attributes:
|
||||||
|
additionalProperties:
|
||||||
|
description: AttributeFeatureSet is a set of features having
|
||||||
|
string value.
|
||||||
|
properties:
|
||||||
|
elements:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: Individual features of the feature set.
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- elements
|
||||||
|
type: object
|
||||||
|
description: Attributes contains all the attribute-type features
|
||||||
|
of the node.
|
||||||
|
type: object
|
||||||
|
flags:
|
||||||
|
additionalProperties:
|
||||||
|
description: FlagFeatureSet is a set of simple features only
|
||||||
|
containing names without values.
|
||||||
|
properties:
|
||||||
|
elements:
|
||||||
|
additionalProperties:
|
||||||
|
description: |-
|
||||||
|
Nil is a dummy empty struct for protobuf compatibility.
|
||||||
|
NOTE: protobuf definitions have been removed but this is kept for API compatibility.
|
||||||
|
type: object
|
||||||
|
description: Individual features of the feature set.
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- elements
|
||||||
|
type: object
|
||||||
|
description: Flags contains all the flag-type features of the
|
||||||
|
node.
|
||||||
|
type: object
|
||||||
|
instances:
|
||||||
|
additionalProperties:
|
||||||
|
description: InstanceFeatureSet is a set of features each of
|
||||||
|
which is an instance having multiple attributes.
|
||||||
|
properties:
|
||||||
|
elements:
|
||||||
|
description: Individual features of the feature set.
|
||||||
|
items:
|
||||||
|
description: InstanceFeature represents one instance of
|
||||||
|
a complex features, e.g. a device.
|
||||||
|
properties:
|
||||||
|
attributes:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: Attributes of the instance feature.
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- attributes
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- elements
|
||||||
|
type: object
|
||||||
|
description: Instances contains all the instance-type features
|
||||||
|
of the node.
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
labels:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: Labels is the set of node labels that are requested to
|
||||||
|
be created.
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- spec
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
---
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
controller-gen.kubebuilder.io/version: v0.16.3
|
||||||
|
name: nodefeaturegroups.nfd.k8s-sigs.io
|
||||||
|
spec:
|
||||||
|
group: nfd.k8s-sigs.io
|
||||||
|
names:
|
||||||
|
kind: NodeFeatureGroup
|
||||||
|
listKind: NodeFeatureGroupList
|
||||||
|
plural: nodefeaturegroups
|
||||||
|
shortNames:
|
||||||
|
- nfg
|
||||||
|
singular: nodefeaturegroup
|
||||||
|
scope: Namespaced
|
||||||
|
versions:
|
||||||
|
- name: v1alpha1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: NodeFeatureGroup resource holds Node pools by featureGroup
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: |-
|
||||||
|
APIVersion defines the versioned schema of this representation of an object.
|
||||||
|
Servers should convert recognized schemas to the latest internal value, and
|
||||||
|
may reject unrecognized values.
|
||||||
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: |-
|
||||||
|
Kind is a string value representing the REST resource this object represents.
|
||||||
|
Servers may infer this from the endpoint the client submits requests to.
|
||||||
|
Cannot be updated.
|
||||||
|
In CamelCase.
|
||||||
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: Spec defines the rules to be evaluated.
|
||||||
|
properties:
|
||||||
|
featureGroupRules:
|
||||||
|
description: List of rules to evaluate to determine nodes that belong
|
||||||
|
in this group.
|
||||||
|
items:
|
||||||
|
description: GroupRule defines a rule for nodegroup filtering.
|
||||||
|
properties:
|
||||||
|
matchAny:
|
||||||
|
description: MatchAny specifies a list of matchers one of which
|
||||||
|
must match.
|
||||||
|
items:
|
||||||
|
description: MatchAnyElem specifies one sub-matcher of MatchAny.
|
||||||
|
properties:
|
||||||
|
matchFeatures:
|
||||||
|
description: MatchFeatures specifies a set of matcher
|
||||||
|
terms all of which must match.
|
||||||
|
items:
|
||||||
|
description: |-
|
||||||
|
FeatureMatcherTerm defines requirements against one feature set. All
|
||||||
|
requirements (specified as MatchExpressions) are evaluated against each
|
||||||
|
element in the feature set.
|
||||||
|
properties:
|
||||||
|
feature:
|
||||||
|
description: Feature is the name of the feature
|
||||||
|
set to match against.
|
||||||
|
type: string
|
||||||
|
matchExpressions:
|
||||||
|
additionalProperties:
|
||||||
|
description: |-
|
||||||
|
MatchExpression specifies an expression to evaluate against a set of input
|
||||||
|
values. It contains an operator that is applied when matching the input and
|
||||||
|
an array of values that the operator evaluates the input against.
|
||||||
|
properties:
|
||||||
|
op:
|
||||||
|
description: Op is the operator to be applied.
|
||||||
|
enum:
|
||||||
|
- In
|
||||||
|
- NotIn
|
||||||
|
- InRegexp
|
||||||
|
- Exists
|
||||||
|
- DoesNotExist
|
||||||
|
- Gt
|
||||||
|
- Lt
|
||||||
|
- GtLt
|
||||||
|
- IsTrue
|
||||||
|
- IsFalse
|
||||||
|
type: string
|
||||||
|
value:
|
||||||
|
description: |-
|
||||||
|
Value is the list of values that the operand evaluates the input
|
||||||
|
against. Value should be empty if the operator is Exists, DoesNotExist,
|
||||||
|
IsTrue or IsFalse. Value should contain exactly one element if the
|
||||||
|
operator is Gt or Lt and exactly two elements if the operator is GtLt.
|
||||||
|
In other cases Value should contain at least one element.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- op
|
||||||
|
type: object
|
||||||
|
description: |-
|
||||||
|
MatchExpressions is the set of per-element expressions evaluated. These
|
||||||
|
match against the value of the specified elements.
|
||||||
|
type: object
|
||||||
|
matchName:
|
||||||
|
description: |-
|
||||||
|
MatchName in an expression that is matched against the name of each
|
||||||
|
element in the feature set.
|
||||||
|
properties:
|
||||||
|
op:
|
||||||
|
description: Op is the operator to be applied.
|
||||||
|
enum:
|
||||||
|
- In
|
||||||
|
- NotIn
|
||||||
|
- InRegexp
|
||||||
|
- Exists
|
||||||
|
- DoesNotExist
|
||||||
|
- Gt
|
||||||
|
- Lt
|
||||||
|
- GtLt
|
||||||
|
- IsTrue
|
||||||
|
- IsFalse
|
||||||
|
type: string
|
||||||
|
value:
|
||||||
|
description: |-
|
||||||
|
Value is the list of values that the operand evaluates the input
|
||||||
|
against. Value should be empty if the operator is Exists, DoesNotExist,
|
||||||
|
IsTrue or IsFalse. Value should contain exactly one element if the
|
||||||
|
operator is Gt or Lt and exactly two elements if the operator is GtLt.
|
||||||
|
In other cases Value should contain at least one element.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- op
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- feature
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- matchFeatures
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
matchFeatures:
|
||||||
|
description: MatchFeatures specifies a set of matcher terms
|
||||||
|
all of which must match.
|
||||||
|
items:
|
||||||
|
description: |-
|
||||||
|
FeatureMatcherTerm defines requirements against one feature set. All
|
||||||
|
requirements (specified as MatchExpressions) are evaluated against each
|
||||||
|
element in the feature set.
|
||||||
|
properties:
|
||||||
|
feature:
|
||||||
|
description: Feature is the name of the feature set to
|
||||||
|
match against.
|
||||||
|
type: string
|
||||||
|
matchExpressions:
|
||||||
|
additionalProperties:
|
||||||
|
description: |-
|
||||||
|
MatchExpression specifies an expression to evaluate against a set of input
|
||||||
|
values. It contains an operator that is applied when matching the input and
|
||||||
|
an array of values that the operator evaluates the input against.
|
||||||
|
properties:
|
||||||
|
op:
|
||||||
|
description: Op is the operator to be applied.
|
||||||
|
enum:
|
||||||
|
- In
|
||||||
|
- NotIn
|
||||||
|
- InRegexp
|
||||||
|
- Exists
|
||||||
|
- DoesNotExist
|
||||||
|
- Gt
|
||||||
|
- Lt
|
||||||
|
- GtLt
|
||||||
|
- IsTrue
|
||||||
|
- IsFalse
|
||||||
|
type: string
|
||||||
|
value:
|
||||||
|
description: |-
|
||||||
|
Value is the list of values that the operand evaluates the input
|
||||||
|
against. Value should be empty if the operator is Exists, DoesNotExist,
|
||||||
|
IsTrue or IsFalse. Value should contain exactly one element if the
|
||||||
|
operator is Gt or Lt and exactly two elements if the operator is GtLt.
|
||||||
|
In other cases Value should contain at least one element.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- op
|
||||||
|
type: object
|
||||||
|
description: |-
|
||||||
|
MatchExpressions is the set of per-element expressions evaluated. These
|
||||||
|
match against the value of the specified elements.
|
||||||
|
type: object
|
||||||
|
matchName:
|
||||||
|
description: |-
|
||||||
|
MatchName in an expression that is matched against the name of each
|
||||||
|
element in the feature set.
|
||||||
|
properties:
|
||||||
|
op:
|
||||||
|
description: Op is the operator to be applied.
|
||||||
|
enum:
|
||||||
|
- In
|
||||||
|
- NotIn
|
||||||
|
- InRegexp
|
||||||
|
- Exists
|
||||||
|
- DoesNotExist
|
||||||
|
- Gt
|
||||||
|
- Lt
|
||||||
|
- GtLt
|
||||||
|
- IsTrue
|
||||||
|
- IsFalse
|
||||||
|
type: string
|
||||||
|
value:
|
||||||
|
description: |-
|
||||||
|
Value is the list of values that the operand evaluates the input
|
||||||
|
against. Value should be empty if the operator is Exists, DoesNotExist,
|
||||||
|
IsTrue or IsFalse. Value should contain exactly one element if the
|
||||||
|
operator is Gt or Lt and exactly two elements if the operator is GtLt.
|
||||||
|
In other cases Value should contain at least one element.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- op
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- feature
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
name:
|
||||||
|
description: Name of the rule.
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- featureGroupRules
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
description: |-
|
||||||
|
Status of the NodeFeatureGroup after the most recent evaluation of the
|
||||||
|
specification.
|
||||||
|
properties:
|
||||||
|
nodes:
|
||||||
|
description: Nodes is a list of FeatureGroupNode in the cluster that
|
||||||
|
match the featureGroupRules
|
||||||
|
items:
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
description: Name of the node.
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
x-kubernetes-list-map-keys:
|
||||||
|
- name
|
||||||
|
x-kubernetes-list-type: map
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- spec
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
|
---
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
controller-gen.kubebuilder.io/version: v0.16.3
|
||||||
|
name: nodefeaturerules.nfd.k8s-sigs.io
|
||||||
|
spec:
|
||||||
|
group: nfd.k8s-sigs.io
|
||||||
|
names:
|
||||||
|
kind: NodeFeatureRule
|
||||||
|
listKind: NodeFeatureRuleList
|
||||||
|
plural: nodefeaturerules
|
||||||
|
shortNames:
|
||||||
|
- nfr
|
||||||
|
singular: nodefeaturerule
|
||||||
|
scope: Cluster
|
||||||
|
versions:
|
||||||
|
- name: v1alpha1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: |-
|
||||||
|
NodeFeatureRule resource specifies a configuration for feature-based
|
||||||
|
customization of node objects, such as node labeling.
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: |-
|
||||||
|
APIVersion defines the versioned schema of this representation of an object.
|
||||||
|
Servers should convert recognized schemas to the latest internal value, and
|
||||||
|
may reject unrecognized values.
|
||||||
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: |-
|
||||||
|
Kind is a string value representing the REST resource this object represents.
|
||||||
|
Servers may infer this from the endpoint the client submits requests to.
|
||||||
|
Cannot be updated.
|
||||||
|
In CamelCase.
|
||||||
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: Spec defines the rules to be evaluated.
|
||||||
|
properties:
|
||||||
|
rules:
|
||||||
|
description: Rules is a list of node customization rules.
|
||||||
|
items:
|
||||||
|
description: Rule defines a rule for node customization such as
|
||||||
|
labeling.
|
||||||
|
properties:
|
||||||
|
annotations:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: Annotations to create if the rule matches.
|
||||||
|
type: object
|
||||||
|
extendedResources:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: ExtendedResources to create if the rule matches.
|
||||||
|
type: object
|
||||||
|
labels:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: Labels to create if the rule matches.
|
||||||
|
type: object
|
||||||
|
labelsTemplate:
|
||||||
|
description: |-
|
||||||
|
LabelsTemplate specifies a template to expand for dynamically generating
|
||||||
|
multiple labels. Data (after template expansion) must be keys with an
|
||||||
|
optional value (<key>[=<value>]) separated by newlines.
|
||||||
|
type: string
|
||||||
|
matchAny:
|
||||||
|
description: MatchAny specifies a list of matchers one of which
|
||||||
|
must match.
|
||||||
|
items:
|
||||||
|
description: MatchAnyElem specifies one sub-matcher of MatchAny.
|
||||||
|
properties:
|
||||||
|
matchFeatures:
|
||||||
|
description: MatchFeatures specifies a set of matcher
|
||||||
|
terms all of which must match.
|
||||||
|
items:
|
||||||
|
description: |-
|
||||||
|
FeatureMatcherTerm defines requirements against one feature set. All
|
||||||
|
requirements (specified as MatchExpressions) are evaluated against each
|
||||||
|
element in the feature set.
|
||||||
|
properties:
|
||||||
|
feature:
|
||||||
|
description: Feature is the name of the feature
|
||||||
|
set to match against.
|
||||||
|
type: string
|
||||||
|
matchExpressions:
|
||||||
|
additionalProperties:
|
||||||
|
description: |-
|
||||||
|
MatchExpression specifies an expression to evaluate against a set of input
|
||||||
|
values. It contains an operator that is applied when matching the input and
|
||||||
|
an array of values that the operator evaluates the input against.
|
||||||
|
properties:
|
||||||
|
op:
|
||||||
|
description: Op is the operator to be applied.
|
||||||
|
enum:
|
||||||
|
- In
|
||||||
|
- NotIn
|
||||||
|
- InRegexp
|
||||||
|
- Exists
|
||||||
|
- DoesNotExist
|
||||||
|
- Gt
|
||||||
|
- Lt
|
||||||
|
- GtLt
|
||||||
|
- IsTrue
|
||||||
|
- IsFalse
|
||||||
|
type: string
|
||||||
|
value:
|
||||||
|
description: |-
|
||||||
|
Value is the list of values that the operand evaluates the input
|
||||||
|
against. Value should be empty if the operator is Exists, DoesNotExist,
|
||||||
|
IsTrue or IsFalse. Value should contain exactly one element if the
|
||||||
|
operator is Gt or Lt and exactly two elements if the operator is GtLt.
|
||||||
|
In other cases Value should contain at least one element.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- op
|
||||||
|
type: object
|
||||||
|
description: |-
|
||||||
|
MatchExpressions is the set of per-element expressions evaluated. These
|
||||||
|
match against the value of the specified elements.
|
||||||
|
type: object
|
||||||
|
matchName:
|
||||||
|
description: |-
|
||||||
|
MatchName in an expression that is matched against the name of each
|
||||||
|
element in the feature set.
|
||||||
|
properties:
|
||||||
|
op:
|
||||||
|
description: Op is the operator to be applied.
|
||||||
|
enum:
|
||||||
|
- In
|
||||||
|
- NotIn
|
||||||
|
- InRegexp
|
||||||
|
- Exists
|
||||||
|
- DoesNotExist
|
||||||
|
- Gt
|
||||||
|
- Lt
|
||||||
|
- GtLt
|
||||||
|
- IsTrue
|
||||||
|
- IsFalse
|
||||||
|
type: string
|
||||||
|
value:
|
||||||
|
description: |-
|
||||||
|
Value is the list of values that the operand evaluates the input
|
||||||
|
against. Value should be empty if the operator is Exists, DoesNotExist,
|
||||||
|
IsTrue or IsFalse. Value should contain exactly one element if the
|
||||||
|
operator is Gt or Lt and exactly two elements if the operator is GtLt.
|
||||||
|
In other cases Value should contain at least one element.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- op
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- feature
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- matchFeatures
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
matchFeatures:
|
||||||
|
description: MatchFeatures specifies a set of matcher terms
|
||||||
|
all of which must match.
|
||||||
|
items:
|
||||||
|
description: |-
|
||||||
|
FeatureMatcherTerm defines requirements against one feature set. All
|
||||||
|
requirements (specified as MatchExpressions) are evaluated against each
|
||||||
|
element in the feature set.
|
||||||
|
properties:
|
||||||
|
feature:
|
||||||
|
description: Feature is the name of the feature set to
|
||||||
|
match against.
|
||||||
|
type: string
|
||||||
|
matchExpressions:
|
||||||
|
additionalProperties:
|
||||||
|
description: |-
|
||||||
|
MatchExpression specifies an expression to evaluate against a set of input
|
||||||
|
values. It contains an operator that is applied when matching the input and
|
||||||
|
an array of values that the operator evaluates the input against.
|
||||||
|
properties:
|
||||||
|
op:
|
||||||
|
description: Op is the operator to be applied.
|
||||||
|
enum:
|
||||||
|
- In
|
||||||
|
- NotIn
|
||||||
|
- InRegexp
|
||||||
|
- Exists
|
||||||
|
- DoesNotExist
|
||||||
|
- Gt
|
||||||
|
- Lt
|
||||||
|
- GtLt
|
||||||
|
- IsTrue
|
||||||
|
- IsFalse
|
||||||
|
type: string
|
||||||
|
value:
|
||||||
|
description: |-
|
||||||
|
Value is the list of values that the operand evaluates the input
|
||||||
|
against. Value should be empty if the operator is Exists, DoesNotExist,
|
||||||
|
IsTrue or IsFalse. Value should contain exactly one element if the
|
||||||
|
operator is Gt or Lt and exactly two elements if the operator is GtLt.
|
||||||
|
In other cases Value should contain at least one element.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- op
|
||||||
|
type: object
|
||||||
|
description: |-
|
||||||
|
MatchExpressions is the set of per-element expressions evaluated. These
|
||||||
|
match against the value of the specified elements.
|
||||||
|
type: object
|
||||||
|
matchName:
|
||||||
|
description: |-
|
||||||
|
MatchName in an expression that is matched against the name of each
|
||||||
|
element in the feature set.
|
||||||
|
properties:
|
||||||
|
op:
|
||||||
|
description: Op is the operator to be applied.
|
||||||
|
enum:
|
||||||
|
- In
|
||||||
|
- NotIn
|
||||||
|
- InRegexp
|
||||||
|
- Exists
|
||||||
|
- DoesNotExist
|
||||||
|
- Gt
|
||||||
|
- Lt
|
||||||
|
- GtLt
|
||||||
|
- IsTrue
|
||||||
|
- IsFalse
|
||||||
|
type: string
|
||||||
|
value:
|
||||||
|
description: |-
|
||||||
|
Value is the list of values that the operand evaluates the input
|
||||||
|
against. Value should be empty if the operator is Exists, DoesNotExist,
|
||||||
|
IsTrue or IsFalse. Value should contain exactly one element if the
|
||||||
|
operator is Gt or Lt and exactly two elements if the operator is GtLt.
|
||||||
|
In other cases Value should contain at least one element.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- op
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- feature
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
name:
|
||||||
|
description: Name of the rule.
|
||||||
|
type: string
|
||||||
|
taints:
|
||||||
|
description: Taints to create if the rule matches.
|
||||||
|
items:
|
||||||
|
description: |-
|
||||||
|
The node this Taint is attached to has the "effect" on
|
||||||
|
any pod that does not tolerate the Taint.
|
||||||
|
properties:
|
||||||
|
effect:
|
||||||
|
description: |-
|
||||||
|
Required. The effect of the taint on pods
|
||||||
|
that do not tolerate the taint.
|
||||||
|
Valid effects are NoSchedule, PreferNoSchedule and NoExecute.
|
||||||
|
type: string
|
||||||
|
key:
|
||||||
|
description: Required. The taint key to be applied to
|
||||||
|
a node.
|
||||||
|
type: string
|
||||||
|
timeAdded:
|
||||||
|
description: |-
|
||||||
|
TimeAdded represents the time at which the taint was added.
|
||||||
|
It is only written for NoExecute taints.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
value:
|
||||||
|
description: The taint value corresponding to the taint
|
||||||
|
key.
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- effect
|
||||||
|
- key
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
vars:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: |-
|
||||||
|
Vars is the variables to store if the rule matches. Variables do not
|
||||||
|
directly inflict any changes in the node object. However, they can be
|
||||||
|
referenced from other rules enabling more complex rule hierarchies,
|
||||||
|
without exposing intermediary output values as labels.
|
||||||
|
type: object
|
||||||
|
varsTemplate:
|
||||||
|
description: |-
|
||||||
|
VarsTemplate specifies a template to expand for dynamically generating
|
||||||
|
multiple variables. Data (after template expansion) must be keys with an
|
||||||
|
optional value (<key>[=<value>]) separated by newlines.
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- rules
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- spec
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
|
@ -0,0 +1,107 @@
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
{{/*
|
||||||
|
Expand the name of the chart.
|
||||||
|
*/}}
|
||||||
|
{{- define "node-feature-discovery.name" -}}
|
||||||
|
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create a default fully qualified app name.
|
||||||
|
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||||
|
If release name contains chart name it will be used as a full name.
|
||||||
|
*/}}
|
||||||
|
{{- define "node-feature-discovery.fullname" -}}
|
||||||
|
{{- if .Values.fullnameOverride -}}
|
||||||
|
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||||
|
{{- if contains $name .Release.Name -}}
|
||||||
|
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Allow the release namespace to be overridden for multi-namespace deployments in combined charts
|
||||||
|
*/}}
|
||||||
|
{{- define "node-feature-discovery.namespace" -}}
|
||||||
|
{{- if .Values.namespaceOverride -}}
|
||||||
|
{{- .Values.namespaceOverride -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- .Release.Namespace -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create chart name and version as used by the chart label.
|
||||||
|
*/}}
|
||||||
|
{{- define "node-feature-discovery.chart" -}}
|
||||||
|
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Common labels
|
||||||
|
*/}}
|
||||||
|
{{- define "node-feature-discovery.labels" -}}
|
||||||
|
helm.sh/chart: {{ include "node-feature-discovery.chart" . }}
|
||||||
|
{{ include "node-feature-discovery.selectorLabels" . }}
|
||||||
|
{{- if .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||||
|
{{- end }}
|
||||||
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Selector labels
|
||||||
|
*/}}
|
||||||
|
{{- define "node-feature-discovery.selectorLabels" -}}
|
||||||
|
app.kubernetes.io/name: {{ include "node-feature-discovery.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create the name of the service account which the nfd master will use
|
||||||
|
*/}}
|
||||||
|
{{- define "node-feature-discovery.master.serviceAccountName" -}}
|
||||||
|
{{- if .Values.master.serviceAccount.create -}}
|
||||||
|
{{ default (include "node-feature-discovery.fullname" .) .Values.master.serviceAccount.name }}
|
||||||
|
{{- else -}}
|
||||||
|
{{ default "default" .Values.master.serviceAccount.name }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create the name of the service account which the nfd worker will use
|
||||||
|
*/}}
|
||||||
|
{{- define "node-feature-discovery.worker.serviceAccountName" -}}
|
||||||
|
{{- if .Values.worker.serviceAccount.create -}}
|
||||||
|
{{ default (printf "%s-worker" (include "node-feature-discovery.fullname" .)) .Values.worker.serviceAccount.name }}
|
||||||
|
{{- else -}}
|
||||||
|
{{ default "default" .Values.worker.serviceAccount.name }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create the name of the service account which topologyUpdater will use
|
||||||
|
*/}}
|
||||||
|
{{- define "node-feature-discovery.topologyUpdater.serviceAccountName" -}}
|
||||||
|
{{- if .Values.topologyUpdater.serviceAccount.create -}}
|
||||||
|
{{ default (printf "%s-topology-updater" (include "node-feature-discovery.fullname" .)) .Values.topologyUpdater.serviceAccount.name }}
|
||||||
|
{{- else -}}
|
||||||
|
{{ default "default" .Values.topologyUpdater.serviceAccount.name }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create the name of the service account which nfd-gc will use
|
||||||
|
*/}}
|
||||||
|
{{- define "node-feature-discovery.gc.serviceAccountName" -}}
|
||||||
|
{{- if .Values.gc.serviceAccount.create -}}
|
||||||
|
{{ default (printf "%s-gc" (include "node-feature-discovery.fullname" .)) .Values.gc.serviceAccount.name }}
|
||||||
|
{{- else -}}
|
||||||
|
{{ default "default" .Values.gc.serviceAccount.name }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
{{- if and .Values.master.enable .Values.master.rbac.create }}
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- namespaces
|
||||||
|
verbs:
|
||||||
|
- watch
|
||||||
|
- list
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- nodes
|
||||||
|
- nodes/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- list
|
||||||
|
- apiGroups:
|
||||||
|
- nfd.k8s-sigs.io
|
||||||
|
resources:
|
||||||
|
- nodefeatures
|
||||||
|
- nodefeaturerules
|
||||||
|
- nodefeaturegroups
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- nfd.k8s-sigs.io
|
||||||
|
resources:
|
||||||
|
- nodefeaturegroups/status
|
||||||
|
verbs:
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- coordination.k8s.io
|
||||||
|
resources:
|
||||||
|
- leases
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- apiGroups:
|
||||||
|
- coordination.k8s.io
|
||||||
|
resources:
|
||||||
|
- leases
|
||||||
|
resourceNames:
|
||||||
|
- "nfd-master.nfd.kubernetes.io"
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- update
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if and .Values.topologyUpdater.enable .Values.topologyUpdater.rbac.create }}
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-topology-updater
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- nodes
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- namespaces
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- nodes/proxy
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- pods
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- topology.node.k8s.io
|
||||||
|
resources:
|
||||||
|
- noderesourcetopologies
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- update
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if and .Values.gc.enable .Values.gc.rbac.create }}
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-gc
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- nodes
|
||||||
|
verbs:
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- nodes/proxy
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- topology.node.k8s.io
|
||||||
|
resources:
|
||||||
|
- noderesourcetopologies
|
||||||
|
verbs:
|
||||||
|
- delete
|
||||||
|
- list
|
||||||
|
- apiGroups:
|
||||||
|
- nfd.k8s-sigs.io
|
||||||
|
resources:
|
||||||
|
- nodefeatures
|
||||||
|
verbs:
|
||||||
|
- delete
|
||||||
|
- list
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,52 @@
|
||||||
|
{{- if and .Values.master.enable .Values.master.rbac.create }}
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ include "node-feature-discovery.master.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if and .Values.topologyUpdater.enable .Values.topologyUpdater.rbac.create }}
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-topology-updater
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-topology-updater
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ include "node-feature-discovery.topologyUpdater.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if and .Values.gc.enable .Values.gc.rbac.create }}
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-gc
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-gc
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ include "node-feature-discovery.gc.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,170 @@
|
||||||
|
{{- if .Values.master.enable }}
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-master
|
||||||
|
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||||
|
role: master
|
||||||
|
{{- with .Values.master.deploymentAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
replicas: {{ .Values.master.replicaCount }}
|
||||||
|
revisionHistoryLimit: {{ .Values.master.revisionHistoryLimit }}
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
{{- include "node-feature-discovery.selectorLabels" . | nindent 6 }}
|
||||||
|
role: master
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.selectorLabels" . | nindent 8 }}
|
||||||
|
role: master
|
||||||
|
annotations:
|
||||||
|
checksum/config: {{ include (print $.Template.BasePath "/nfd-master-conf.yaml") . | sha256sum }}
|
||||||
|
{{- with .Values.master.annotations }}
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
{{- with .Values.priorityClassName }}
|
||||||
|
priorityClassName: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.imagePullSecrets }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
serviceAccountName: {{ include "node-feature-discovery.master.serviceAccountName" . }}
|
||||||
|
enableServiceLinks: false
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml .Values.master.podSecurityContext | nindent 8 }}
|
||||||
|
hostNetwork: {{ .Values.master.hostNetwork }}
|
||||||
|
containers:
|
||||||
|
- name: master
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml .Values.master.securityContext | nindent 12 }}
|
||||||
|
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||||
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||||
|
startupProbe:
|
||||||
|
grpc:
|
||||||
|
port: {{ .Values.master.healthPort | default "8082" }}
|
||||||
|
{{- with .Values.master.startupProbe.initialDelaySeconds }}
|
||||||
|
initialDelaySeconds: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.master.startupProbe.failureThreshold }}
|
||||||
|
failureThreshold: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.master.startupProbe.periodSeconds }}
|
||||||
|
periodSeconds: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.master.startupProbe.timeoutSeconds }}
|
||||||
|
timeoutSeconds: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
livenessProbe:
|
||||||
|
grpc:
|
||||||
|
port: {{ .Values.master.healthPort | default "8082" }}
|
||||||
|
{{- with .Values.master.livenessProbe.initialDelaySeconds }}
|
||||||
|
initialDelaySeconds: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.master.livenessProbe.failureThreshold }}
|
||||||
|
failureThreshold: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.master.livenessProbe.periodSeconds }}
|
||||||
|
periodSeconds: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.master.livenessProbe.timeoutSeconds }}
|
||||||
|
timeoutSeconds: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
readinessProbe:
|
||||||
|
grpc:
|
||||||
|
port: {{ .Values.master.healthPort | default "8082" }}
|
||||||
|
{{- with .Values.master.readinessProbe.initialDelaySeconds }}
|
||||||
|
initialDelaySeconds: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.master.readinessProbe.failureThreshold }}
|
||||||
|
failureThreshold: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.master.readinessProbe.periodSeconds }}
|
||||||
|
periodSeconds: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.master.readinessProbe.timeoutSeconds }}
|
||||||
|
timeoutSeconds: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.master.readinessProbe.successThreshold }}
|
||||||
|
successThreshold: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
ports:
|
||||||
|
- containerPort: {{ .Values.master.metricsPort | default "8081" }}
|
||||||
|
name: metrics
|
||||||
|
- containerPort: {{ .Values.master.healthPort | default "8082" }}
|
||||||
|
name: health
|
||||||
|
env:
|
||||||
|
- name: NODE_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: spec.nodeName
|
||||||
|
{{- with .Values.master.extraEnvs }}
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end}}
|
||||||
|
command:
|
||||||
|
- "nfd-master"
|
||||||
|
resources:
|
||||||
|
{{- toYaml .Values.master.resources | nindent 12 }}
|
||||||
|
args:
|
||||||
|
{{- if .Values.master.instance | empty | not }}
|
||||||
|
- "-instance={{ .Values.master.instance }}"
|
||||||
|
{{- end }}
|
||||||
|
- "-enable-leader-election"
|
||||||
|
{{- if .Values.master.extraLabelNs | empty | not }}
|
||||||
|
- "-extra-label-ns={{- join "," .Values.master.extraLabelNs }}"
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.master.denyLabelNs | empty | not }}
|
||||||
|
- "-deny-label-ns={{- join "," .Values.master.denyLabelNs }}"
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.master.enableTaints }}
|
||||||
|
- "-enable-taints"
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.master.featureRulesController | kindIs "invalid" | not }}
|
||||||
|
- "-featurerules-controller={{ .Values.master.featureRulesController }}"
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.master.resyncPeriod }}
|
||||||
|
- "-resync-period={{ .Values.master.resyncPeriod }}"
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.master.nfdApiParallelism | empty | not }}
|
||||||
|
- "-nfd-api-parallelism={{ .Values.master.nfdApiParallelism }}"
|
||||||
|
{{- end }}
|
||||||
|
# Go over featureGates and add the feature-gate flag
|
||||||
|
{{- range $key, $value := .Values.featureGates }}
|
||||||
|
- "-feature-gates={{ $key }}={{ $value }}"
|
||||||
|
{{- end }}
|
||||||
|
- "-metrics={{ .Values.master.metricsPort | default "8081" }}"
|
||||||
|
- "-grpc-health={{ .Values.master.healthPort | default "8082" }}"
|
||||||
|
{{- with .Values.master.extraArgs }}
|
||||||
|
{{- toYaml . | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: nfd-master-conf
|
||||||
|
mountPath: "/etc/kubernetes/node-feature-discovery"
|
||||||
|
readOnly: true
|
||||||
|
volumes:
|
||||||
|
- name: nfd-master-conf
|
||||||
|
configMap:
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-master-conf
|
||||||
|
items:
|
||||||
|
- key: nfd-master.conf
|
||||||
|
path: nfd-master.conf
|
||||||
|
{{- with .Values.master.nodeSelector }}
|
||||||
|
nodeSelector:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.master.affinity }}
|
||||||
|
affinity:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.master.tolerations }}
|
||||||
|
tolerations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,88 @@
|
||||||
|
{{- if and .Values.gc.enable -}}
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-gc
|
||||||
|
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||||
|
role: gc
|
||||||
|
{{- with .Values.gc.deploymentAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
replicas: {{ .Values.gc.replicaCount | default 1 }}
|
||||||
|
revisionHistoryLimit: {{ .Values.gc.revisionHistoryLimit }}
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
{{- include "node-feature-discovery.selectorLabels" . | nindent 6 }}
|
||||||
|
role: gc
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.selectorLabels" . | nindent 8 }}
|
||||||
|
role: gc
|
||||||
|
{{- with .Values.gc.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
serviceAccountName: {{ include "node-feature-discovery.gc.serviceAccountName" . }}
|
||||||
|
dnsPolicy: ClusterFirstWithHostNet
|
||||||
|
{{- with .Values.priorityClassName }}
|
||||||
|
priorityClassName: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.imagePullSecrets }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml .Values.gc.podSecurityContext | nindent 8 }}
|
||||||
|
hostNetwork: {{ .Values.gc.hostNetwork }}
|
||||||
|
containers:
|
||||||
|
- name: gc
|
||||||
|
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||||
|
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
|
||||||
|
env:
|
||||||
|
- name: NODE_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: spec.nodeName
|
||||||
|
{{- with .Values.gc.extraEnvs }}
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end}}
|
||||||
|
command:
|
||||||
|
- "nfd-gc"
|
||||||
|
args:
|
||||||
|
{{- if .Values.gc.interval | empty | not }}
|
||||||
|
- "-gc-interval={{ .Values.gc.interval }}"
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.gc.extraArgs }}
|
||||||
|
{{- toYaml . | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
resources:
|
||||||
|
{{- toYaml .Values.gc.resources | nindent 12 }}
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop: [ "ALL" ]
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsNonRoot: true
|
||||||
|
ports:
|
||||||
|
- name: metrics
|
||||||
|
containerPort: {{ .Values.gc.metricsPort | default "8081"}}
|
||||||
|
|
||||||
|
{{- with .Values.gc.nodeSelector }}
|
||||||
|
nodeSelector:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.gc.affinity }}
|
||||||
|
affinity:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.gc.tolerations }}
|
||||||
|
tolerations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,12 @@
|
||||||
|
{{- if .Values.master.enable }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-master-conf
|
||||||
|
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||||
|
data:
|
||||||
|
nfd-master.conf: |-
|
||||||
|
{{- .Values.master.config | toYaml | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,12 @@
|
||||||
|
{{- if .Values.topologyUpdater.enable -}}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-topology-updater-conf
|
||||||
|
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||||
|
data:
|
||||||
|
nfd-topology-updater.conf: |-
|
||||||
|
{{- .Values.topologyUpdater.config | toYaml | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,12 @@
|
||||||
|
{{- if .Values.worker.enable }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-worker-conf
|
||||||
|
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||||
|
data:
|
||||||
|
nfd-worker.conf: |-
|
||||||
|
{{- .Values.worker.config | toYaml | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,94 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-prune
|
||||||
|
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
"helm.sh/hook": post-delete
|
||||||
|
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-prune
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
"helm.sh/hook": post-delete
|
||||||
|
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- nodes
|
||||||
|
- nodes/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- list
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-prune
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
"helm.sh/hook": post-delete
|
||||||
|
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-prune
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-prune
|
||||||
|
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||||
|
---
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: Job
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-prune
|
||||||
|
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
"helm.sh/hook": post-delete
|
||||||
|
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
||||||
|
spec:
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 8 }}
|
||||||
|
role: prune
|
||||||
|
spec:
|
||||||
|
serviceAccountName: {{ include "node-feature-discovery.fullname" . }}-prune
|
||||||
|
containers:
|
||||||
|
- name: nfd-master
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml .Values.master.securityContext | nindent 12 }}
|
||||||
|
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||||
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||||
|
command:
|
||||||
|
- "nfd-master"
|
||||||
|
args:
|
||||||
|
- "-prune"
|
||||||
|
{{- if .Values.master.instance | empty | not }}
|
||||||
|
- "-instance={{ .Values.master.instance }}"
|
||||||
|
{{- end }}
|
||||||
|
restartPolicy: Never
|
||||||
|
{{- with .Values.master.nodeSelector }}
|
||||||
|
nodeSelector:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.master.affinity }}
|
||||||
|
affinity:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.master.tolerations }}
|
||||||
|
tolerations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,26 @@
|
||||||
|
{{- if .Values.prometheus.enable }}
|
||||||
|
# Prometheus Monitor Service (Metrics)
|
||||||
|
apiVersion: monitoring.coreos.com/v1
|
||||||
|
kind: PodMonitor
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.selectorLabels" . | nindent 4 }}
|
||||||
|
{{- with .Values.prometheus.labels }}
|
||||||
|
{{ toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
podMetricsEndpoints:
|
||||||
|
- honorLabels: true
|
||||||
|
interval: {{ .Values.prometheus.scrapeInterval }}
|
||||||
|
path: /metrics
|
||||||
|
port: metrics
|
||||||
|
scheme: http
|
||||||
|
namespaceSelector:
|
||||||
|
matchNames:
|
||||||
|
- {{ include "node-feature-discovery.namespace" . }}
|
||||||
|
selector:
|
||||||
|
matchExpressions:
|
||||||
|
- {key: app.kubernetes.io/instance, operator: In, values: ["{{ .Release.Name }}"]}
|
||||||
|
- {key: app.kubernetes.io/name, operator: In, values: ["{{ include "node-feature-discovery.name" . }}"]}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,25 @@
|
||||||
|
{{- if and .Values.worker.enable .Values.worker.rbac.create }}
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-worker
|
||||||
|
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- nfd.k8s-sigs.io
|
||||||
|
resources:
|
||||||
|
- nodefeatures
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- update
|
||||||
|
- delete
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- pods
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,18 @@
|
||||||
|
{{- if and .Values.worker.enable .Values.worker.rbac.create }}
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-worker
|
||||||
|
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-worker
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ include "node-feature-discovery.worker.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
|
@ -0,0 +1,58 @@
|
||||||
|
{{- if and .Values.master.enable .Values.master.serviceAccount.create }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.master.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.master.serviceAccount.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if and .Values.topologyUpdater.enable .Values.topologyUpdater.serviceAccount.create }}
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.topologyUpdater.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.topologyUpdater.serviceAccount.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if and .Values.gc.enable .Values.gc.serviceAccount.create }}
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.gc.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.gc.serviceAccount.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if and .Values.worker.enable .Values.worker.serviceAccount.create }}
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.worker.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.worker.serviceAccount.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,278 @@
|
||||||
|
{{- if and .Values.topologyUpdater.enable .Values.topologyUpdater.createCRDs -}}
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
api-approved.kubernetes.io: https://github.com/kubernetes/enhancements/pull/1870
|
||||||
|
controller-gen.kubebuilder.io/version: v0.11.2
|
||||||
|
creationTimestamp: null
|
||||||
|
name: noderesourcetopologies.topology.node.k8s.io
|
||||||
|
spec:
|
||||||
|
group: topology.node.k8s.io
|
||||||
|
names:
|
||||||
|
kind: NodeResourceTopology
|
||||||
|
listKind: NodeResourceTopologyList
|
||||||
|
plural: noderesourcetopologies
|
||||||
|
shortNames:
|
||||||
|
- node-res-topo
|
||||||
|
singular: noderesourcetopology
|
||||||
|
scope: Cluster
|
||||||
|
versions:
|
||||||
|
- name: v1alpha1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: NodeResourceTopology describes node resources and their topology.
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
topologyPolicies:
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
zones:
|
||||||
|
description: ZoneList contains an array of Zone objects.
|
||||||
|
items:
|
||||||
|
description: Zone represents a resource topology zone, e.g. socket,
|
||||||
|
node, die or core.
|
||||||
|
properties:
|
||||||
|
attributes:
|
||||||
|
description: AttributeList contains an array of AttributeInfo objects.
|
||||||
|
items:
|
||||||
|
description: AttributeInfo contains one attribute of a Zone.
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
type: string
|
||||||
|
value:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
- value
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
costs:
|
||||||
|
description: CostList contains an array of CostInfo objects.
|
||||||
|
items:
|
||||||
|
description: CostInfo describes the cost (or distance) between
|
||||||
|
two Zones.
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
type: string
|
||||||
|
value:
|
||||||
|
format: int64
|
||||||
|
type: integer
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
- value
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
name:
|
||||||
|
type: string
|
||||||
|
parent:
|
||||||
|
type: string
|
||||||
|
resources:
|
||||||
|
description: ResourceInfoList contains an array of ResourceInfo
|
||||||
|
objects.
|
||||||
|
items:
|
||||||
|
description: ResourceInfo contains information about one resource
|
||||||
|
type.
|
||||||
|
properties:
|
||||||
|
allocatable:
|
||||||
|
anyOf:
|
||||||
|
- type: integer
|
||||||
|
- type: string
|
||||||
|
description: Allocatable quantity of the resource, corresponding
|
||||||
|
to allocatable in node status, i.e. total amount of this
|
||||||
|
resource available to be used by pods.
|
||||||
|
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||||
|
x-kubernetes-int-or-string: true
|
||||||
|
available:
|
||||||
|
anyOf:
|
||||||
|
- type: integer
|
||||||
|
- type: string
|
||||||
|
description: Available is the amount of this resource currently
|
||||||
|
available for new (to be scheduled) pods, i.e. Allocatable
|
||||||
|
minus the resources reserved by currently running pods.
|
||||||
|
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||||
|
x-kubernetes-int-or-string: true
|
||||||
|
capacity:
|
||||||
|
anyOf:
|
||||||
|
- type: integer
|
||||||
|
- type: string
|
||||||
|
description: Capacity of the resource, corresponding to capacity
|
||||||
|
in node status, i.e. total amount of this resource that
|
||||||
|
the node has.
|
||||||
|
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||||
|
x-kubernetes-int-or-string: true
|
||||||
|
name:
|
||||||
|
description: Name of the resource.
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- allocatable
|
||||||
|
- available
|
||||||
|
- capacity
|
||||||
|
- name
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
type:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
- type
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- topologyPolicies
|
||||||
|
- zones
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: false
|
||||||
|
- name: v1alpha2
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: NodeResourceTopology describes node resources and their topology.
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
attributes:
|
||||||
|
description: AttributeList contains an array of AttributeInfo objects.
|
||||||
|
items:
|
||||||
|
description: AttributeInfo contains one attribute of a Zone.
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
type: string
|
||||||
|
value:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
- value
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
topologyPolicies:
|
||||||
|
description: 'DEPRECATED (to be removed in v1beta1): use top level attributes
|
||||||
|
if needed'
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
zones:
|
||||||
|
description: ZoneList contains an array of Zone objects.
|
||||||
|
items:
|
||||||
|
description: Zone represents a resource topology zone, e.g. socket,
|
||||||
|
node, die or core.
|
||||||
|
properties:
|
||||||
|
attributes:
|
||||||
|
description: AttributeList contains an array of AttributeInfo objects.
|
||||||
|
items:
|
||||||
|
description: AttributeInfo contains one attribute of a Zone.
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
type: string
|
||||||
|
value:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
- value
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
costs:
|
||||||
|
description: CostList contains an array of CostInfo objects.
|
||||||
|
items:
|
||||||
|
description: CostInfo describes the cost (or distance) between
|
||||||
|
two Zones.
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
type: string
|
||||||
|
value:
|
||||||
|
format: int64
|
||||||
|
type: integer
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
- value
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
name:
|
||||||
|
type: string
|
||||||
|
parent:
|
||||||
|
type: string
|
||||||
|
resources:
|
||||||
|
description: ResourceInfoList contains an array of ResourceInfo
|
||||||
|
objects.
|
||||||
|
items:
|
||||||
|
description: ResourceInfo contains information about one resource
|
||||||
|
type.
|
||||||
|
properties:
|
||||||
|
allocatable:
|
||||||
|
anyOf:
|
||||||
|
- type: integer
|
||||||
|
- type: string
|
||||||
|
description: Allocatable quantity of the resource, corresponding
|
||||||
|
to allocatable in node status, i.e. total amount of this
|
||||||
|
resource available to be used by pods.
|
||||||
|
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||||
|
x-kubernetes-int-or-string: true
|
||||||
|
available:
|
||||||
|
anyOf:
|
||||||
|
- type: integer
|
||||||
|
- type: string
|
||||||
|
description: Available is the amount of this resource currently
|
||||||
|
available for new (to be scheduled) pods, i.e. Allocatable
|
||||||
|
minus the resources reserved by currently running pods.
|
||||||
|
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||||
|
x-kubernetes-int-or-string: true
|
||||||
|
capacity:
|
||||||
|
anyOf:
|
||||||
|
- type: integer
|
||||||
|
- type: string
|
||||||
|
description: Capacity of the resource, corresponding to capacity
|
||||||
|
in node status, i.e. total amount of this resource that
|
||||||
|
the node has.
|
||||||
|
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||||
|
x-kubernetes-int-or-string: true
|
||||||
|
name:
|
||||||
|
description: Name of the resource.
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- allocatable
|
||||||
|
- available
|
||||||
|
- capacity
|
||||||
|
- name
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
type:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
- type
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- zones
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
status:
|
||||||
|
acceptedNames:
|
||||||
|
kind: ""
|
||||||
|
plural: ""
|
||||||
|
conditions: []
|
||||||
|
storedVersions: []
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,188 @@
|
||||||
|
{{- if .Values.topologyUpdater.enable -}}
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: DaemonSet
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-topology-updater
|
||||||
|
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||||
|
role: topology-updater
|
||||||
|
{{- with .Values.topologyUpdater.daemonsetAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
revisionHistoryLimit: {{ .Values.topologyUpdater.revisionHistoryLimit }}
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
{{- include "node-feature-discovery.selectorLabels" . | nindent 6 }}
|
||||||
|
role: topology-updater
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.selectorLabels" . | nindent 8 }}
|
||||||
|
role: topology-updater
|
||||||
|
annotations:
|
||||||
|
checksum/config: {{ include (print $.Template.BasePath "/nfd-topologyupdater-conf.yaml") . | sha256sum }}
|
||||||
|
{{- with .Values.topologyUpdater.annotations }}
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
serviceAccountName: {{ include "node-feature-discovery.topologyUpdater.serviceAccountName" . }}
|
||||||
|
dnsPolicy: ClusterFirstWithHostNet
|
||||||
|
{{- with .Values.priorityClassName }}
|
||||||
|
priorityClassName: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.imagePullSecrets }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml .Values.topologyUpdater.podSecurityContext | nindent 8 }}
|
||||||
|
hostNetwork: {{ .Values.topologyUpdater.hostNetwork }}
|
||||||
|
containers:
|
||||||
|
- name: topology-updater
|
||||||
|
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||||
|
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
|
||||||
|
livenessProbe:
|
||||||
|
grpc:
|
||||||
|
port: {{ .Values.topologyUpdater.healthPort | default "8082" }}
|
||||||
|
{{- with .Values.topologyUpdater.livenessProbe.initialDelaySeconds }}
|
||||||
|
initialDelaySeconds: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.topologyUpdater.livenessProbe.failureThreshold }}
|
||||||
|
failureThreshold: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.topologyUpdater.livenessProbe.periodSeconds }}
|
||||||
|
periodSeconds: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.topologyUpdater.livenessProbe.timeoutSeconds }}
|
||||||
|
timeoutSeconds: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
readinessProbe:
|
||||||
|
grpc:
|
||||||
|
port: {{ .Values.topologyUpdater.healthPort | default "8082" }}
|
||||||
|
{{- with .Values.topologyUpdater.readinessProbe.initialDelaySeconds }}
|
||||||
|
initialDelaySeconds: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.topologyUpdater.readinessProbe.failureThreshold }}
|
||||||
|
failureThreshold: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.topologyUpdater.readinessProbe.periodSeconds }}
|
||||||
|
periodSeconds: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.topologyUpdater.readinessProbe.timeoutSeconds }}
|
||||||
|
timeoutSeconds: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.topologyUpdater.readinessProbe.successThreshold }}
|
||||||
|
successThreshold: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
env:
|
||||||
|
- name: NODE_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: spec.nodeName
|
||||||
|
- name: NODE_ADDRESS
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: status.hostIP
|
||||||
|
{{- with .Values.topologyUpdater.extraEnvs }}
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end}}
|
||||||
|
command:
|
||||||
|
- "nfd-topology-updater"
|
||||||
|
args:
|
||||||
|
- "-podresources-socket=/host-var/lib/kubelet-podresources/kubelet.sock"
|
||||||
|
{{- if .Values.topologyUpdater.updateInterval | empty | not }}
|
||||||
|
- "-sleep-interval={{ .Values.topologyUpdater.updateInterval }}"
|
||||||
|
{{- else }}
|
||||||
|
- "-sleep-interval=3s"
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.topologyUpdater.watchNamespace | empty | not }}
|
||||||
|
- "-watch-namespace={{ .Values.topologyUpdater.watchNamespace }}"
|
||||||
|
{{- else }}
|
||||||
|
- "-watch-namespace=*"
|
||||||
|
{{- end }}
|
||||||
|
{{- if not .Values.topologyUpdater.podSetFingerprint }}
|
||||||
|
- "-pods-fingerprint=false"
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.topologyUpdater.kubeletConfigPath | empty | not }}
|
||||||
|
- "-kubelet-config-uri=file:///host-var/kubelet-config"
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.topologyUpdater.kubeletStateDir | empty }}
|
||||||
|
# Disable kubelet state tracking by giving an empty path
|
||||||
|
- "-kubelet-state-dir="
|
||||||
|
{{- end }}
|
||||||
|
- "-metrics={{ .Values.topologyUpdater.metricsPort | default "8081"}}"
|
||||||
|
- "-grpc-health={{ .Values.topologyUpdater.healthPort | default "8082" }}"
|
||||||
|
{{- with .Values.topologyUpdater.extraArgs }}
|
||||||
|
{{- toYaml . | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
ports:
|
||||||
|
- containerPort: {{ .Values.topologyUpdater.metricsPort | default "8081"}}
|
||||||
|
name: metrics
|
||||||
|
- containerPort: {{ .Values.topologyUpdater.healthPort | default "8082" }}
|
||||||
|
name: health
|
||||||
|
volumeMounts:
|
||||||
|
{{- if .Values.topologyUpdater.kubeletConfigPath | empty | not }}
|
||||||
|
- name: kubelet-config
|
||||||
|
mountPath: /host-var/kubelet-config
|
||||||
|
{{- end }}
|
||||||
|
- name: kubelet-podresources-sock
|
||||||
|
mountPath: /host-var/lib/kubelet-podresources/kubelet.sock
|
||||||
|
- name: host-sys
|
||||||
|
mountPath: /host-sys
|
||||||
|
{{- if .Values.topologyUpdater.kubeletStateDir | empty | not }}
|
||||||
|
- name: kubelet-state-files
|
||||||
|
mountPath: /host-var/lib/kubelet
|
||||||
|
readOnly: true
|
||||||
|
{{- end }}
|
||||||
|
- name: nfd-topology-updater-conf
|
||||||
|
mountPath: "/etc/kubernetes/node-feature-discovery"
|
||||||
|
readOnly: true
|
||||||
|
|
||||||
|
resources:
|
||||||
|
{{- toYaml .Values.topologyUpdater.resources | nindent 12 }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml .Values.topologyUpdater.securityContext | nindent 12 }}
|
||||||
|
volumes:
|
||||||
|
- name: host-sys
|
||||||
|
hostPath:
|
||||||
|
path: "/sys"
|
||||||
|
{{- if .Values.topologyUpdater.kubeletConfigPath | empty | not }}
|
||||||
|
- name: kubelet-config
|
||||||
|
hostPath:
|
||||||
|
path: {{ .Values.topologyUpdater.kubeletConfigPath }}
|
||||||
|
{{- end }}
|
||||||
|
- name: kubelet-podresources-sock
|
||||||
|
hostPath:
|
||||||
|
{{- if .Values.topologyUpdater.kubeletPodResourcesSockPath | empty | not }}
|
||||||
|
path: {{ .Values.topologyUpdater.kubeletPodResourcesSockPath }}
|
||||||
|
{{- else }}
|
||||||
|
path: /var/lib/kubelet/pod-resources/kubelet.sock
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.topologyUpdater.kubeletStateDir | empty | not }}
|
||||||
|
- name: kubelet-state-files
|
||||||
|
hostPath:
|
||||||
|
path: {{ .Values.topologyUpdater.kubeletStateDir }}
|
||||||
|
{{- end }}
|
||||||
|
- name: nfd-topology-updater-conf
|
||||||
|
configMap:
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-topology-updater-conf
|
||||||
|
items:
|
||||||
|
- key: nfd-topology-updater.conf
|
||||||
|
path: nfd-topology-updater.conf
|
||||||
|
|
||||||
|
{{- with .Values.topologyUpdater.nodeSelector }}
|
||||||
|
nodeSelector:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.topologyUpdater.affinity }}
|
||||||
|
affinity:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.topologyUpdater.tolerations }}
|
||||||
|
tolerations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,195 @@
|
||||||
|
{{- if .Values.worker.enable }}
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: DaemonSet
|
||||||
|
metadata:
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-worker
|
||||||
|
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||||
|
role: worker
|
||||||
|
{{- with .Values.worker.daemonsetAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
revisionHistoryLimit: {{ .Values.worker.revisionHistoryLimit }}
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
{{- include "node-feature-discovery.selectorLabels" . | nindent 6 }}
|
||||||
|
role: worker
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
{{- include "node-feature-discovery.selectorLabels" . | nindent 8 }}
|
||||||
|
role: worker
|
||||||
|
annotations:
|
||||||
|
checksum/config: {{ include (print $.Template.BasePath "/nfd-worker-conf.yaml") . | sha256sum }}
|
||||||
|
{{- with .Values.worker.annotations }}
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
dnsPolicy: ClusterFirstWithHostNet
|
||||||
|
{{- with .Values.priorityClassName }}
|
||||||
|
priorityClassName: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.imagePullSecrets }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
serviceAccountName: {{ include "node-feature-discovery.worker.serviceAccountName" . }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml .Values.worker.podSecurityContext | nindent 8 }}
|
||||||
|
hostNetwork: {{ .Values.worker.hostNetwork }}
|
||||||
|
containers:
|
||||||
|
- name: worker
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml .Values.worker.securityContext | nindent 12 }}
|
||||||
|
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||||
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||||
|
livenessProbe:
|
||||||
|
grpc:
|
||||||
|
port: {{ .Values.worker.healthPort | default "8082" }}
|
||||||
|
{{- with .Values.worker.livenessProbe.initialDelaySeconds }}
|
||||||
|
initialDelaySeconds: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.worker.livenessProbe.failureThreshold }}
|
||||||
|
failureThreshold: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.worker.livenessProbe.periodSeconds }}
|
||||||
|
periodSeconds: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.worker.livenessProbe.timeoutSeconds }}
|
||||||
|
timeoutSeconds: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
readinessProbe:
|
||||||
|
grpc:
|
||||||
|
port: {{ .Values.worker.healthPort | default "8082" }}
|
||||||
|
{{- with .Values.worker.readinessProbe.initialDelaySeconds }}
|
||||||
|
initialDelaySeconds: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.worker.readinessProbe.failureThreshold }}
|
||||||
|
failureThreshold: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.worker.readinessProbe.periodSeconds }}
|
||||||
|
periodSeconds: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.worker.readinessProbe.timeoutSeconds }}
|
||||||
|
timeoutSeconds: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.worker.readinessProbe.successThreshold }}
|
||||||
|
successThreshold: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
env:
|
||||||
|
- name: NODE_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: spec.nodeName
|
||||||
|
- name: POD_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
- name: POD_UID
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.uid
|
||||||
|
{{- with .Values.worker.extraEnvs }}
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end}}
|
||||||
|
resources:
|
||||||
|
{{- toYaml .Values.worker.resources | nindent 12 }}
|
||||||
|
command:
|
||||||
|
- "nfd-worker"
|
||||||
|
args:
|
||||||
|
# Go over featureGate and add the feature-gate flag
|
||||||
|
{{- range $key, $value := .Values.featureGates }}
|
||||||
|
- "-feature-gates={{ $key }}={{ $value }}"
|
||||||
|
{{- end }}
|
||||||
|
- "-metrics={{ .Values.worker.metricsPort | default "8081"}}"
|
||||||
|
- "-grpc-health={{ .Values.worker.healthPort | default "8082" }}"
|
||||||
|
{{- with .Values.worker.extraArgs }}
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
ports:
|
||||||
|
- containerPort: {{ .Values.worker.metricsPort | default "8081"}}
|
||||||
|
name: metrics
|
||||||
|
- containerPort: {{ .Values.worker.healthPort | default "8082" }}
|
||||||
|
name: health
|
||||||
|
volumeMounts:
|
||||||
|
- name: host-boot
|
||||||
|
mountPath: "/host-boot"
|
||||||
|
readOnly: true
|
||||||
|
- name: host-os-release
|
||||||
|
mountPath: "/host-etc/os-release"
|
||||||
|
readOnly: true
|
||||||
|
- name: host-sys
|
||||||
|
mountPath: "/host-sys"
|
||||||
|
readOnly: true
|
||||||
|
- name: host-usr-lib
|
||||||
|
mountPath: "/host-usr/lib"
|
||||||
|
readOnly: true
|
||||||
|
- name: host-lib
|
||||||
|
mountPath: "/host-lib"
|
||||||
|
readOnly: true
|
||||||
|
- name: host-proc-swaps
|
||||||
|
mountPath: "/host-proc/swaps"
|
||||||
|
readOnly: true
|
||||||
|
{{- if .Values.worker.mountUsrSrc }}
|
||||||
|
- name: host-usr-src
|
||||||
|
mountPath: "/host-usr/src"
|
||||||
|
readOnly: true
|
||||||
|
{{- end }}
|
||||||
|
- name: features-d
|
||||||
|
mountPath: "/etc/kubernetes/node-feature-discovery/features.d/"
|
||||||
|
readOnly: true
|
||||||
|
- name: nfd-worker-conf
|
||||||
|
mountPath: "/etc/kubernetes/node-feature-discovery"
|
||||||
|
readOnly: true
|
||||||
|
volumes:
|
||||||
|
- name: host-boot
|
||||||
|
hostPath:
|
||||||
|
path: "/boot"
|
||||||
|
- name: host-os-release
|
||||||
|
hostPath:
|
||||||
|
path: "/etc/os-release"
|
||||||
|
- name: host-sys
|
||||||
|
hostPath:
|
||||||
|
path: "/sys"
|
||||||
|
- name: host-usr-lib
|
||||||
|
hostPath:
|
||||||
|
path: "/usr/lib"
|
||||||
|
- name: host-lib
|
||||||
|
hostPath:
|
||||||
|
path: "/lib"
|
||||||
|
- name: host-proc-swaps
|
||||||
|
hostPath:
|
||||||
|
path: "/proc/swaps"
|
||||||
|
{{- if .Values.worker.mountUsrSrc }}
|
||||||
|
- name: host-usr-src
|
||||||
|
hostPath:
|
||||||
|
path: "/usr/src"
|
||||||
|
{{- end }}
|
||||||
|
- name: features-d
|
||||||
|
hostPath:
|
||||||
|
path: "/etc/kubernetes/node-feature-discovery/features.d/"
|
||||||
|
- name: nfd-worker-conf
|
||||||
|
configMap:
|
||||||
|
name: {{ include "node-feature-discovery.fullname" . }}-worker-conf
|
||||||
|
items:
|
||||||
|
- key: nfd-worker.conf
|
||||||
|
path: nfd-worker.conf
|
||||||
|
{{- with .Values.worker.nodeSelector }}
|
||||||
|
nodeSelector:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.worker.affinity }}
|
||||||
|
affinity:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.worker.tolerations }}
|
||||||
|
tolerations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.worker.priorityClassName }}
|
||||||
|
priorityClassName: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,599 @@
|
||||||
|
image:
|
||||||
|
repository: registry.k8s.io/nfd/node-feature-discovery
|
||||||
|
# This should be set to 'IfNotPresent' for released version
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
# tag, if defined will use the given image tag, else Chart.AppVersion will be used
|
||||||
|
# tag
|
||||||
|
imagePullSecrets: []
|
||||||
|
|
||||||
|
nameOverride: ""
|
||||||
|
fullnameOverride: ""
|
||||||
|
namespaceOverride: ""
|
||||||
|
|
||||||
|
featureGates:
|
||||||
|
NodeFeatureGroupAPI: false
|
||||||
|
|
||||||
|
priorityClassName: ""
|
||||||
|
|
||||||
|
master:
|
||||||
|
enable: true
|
||||||
|
extraArgs: []
|
||||||
|
extraEnvs: []
|
||||||
|
hostNetwork: false
|
||||||
|
config: ### <NFD-MASTER-CONF-START-DO-NOT-REMOVE>
|
||||||
|
# noPublish: false
|
||||||
|
# autoDefaultNs: true
|
||||||
|
# extraLabelNs: ["added.ns.io","added.kubernets.io"]
|
||||||
|
# denyLabelNs: ["denied.ns.io","denied.kubernetes.io"]
|
||||||
|
# enableTaints: false
|
||||||
|
# labelWhiteList: "foo"
|
||||||
|
# resyncPeriod: "2h"
|
||||||
|
# restrictions:
|
||||||
|
# disableLabels: true
|
||||||
|
# disableTaints: true
|
||||||
|
# disableExtendedResources: true
|
||||||
|
# disableAnnotations: true
|
||||||
|
# allowOverwrite: false
|
||||||
|
# denyNodeFeatureLabels: true
|
||||||
|
# nodeFeatureNamespaceSelector:
|
||||||
|
# matchLabels:
|
||||||
|
# kubernetes.io/metadata.name: "node-feature-discovery"
|
||||||
|
# matchExpressions:
|
||||||
|
# - key: "kubernetes.io/metadata.name"
|
||||||
|
# operator: "In"
|
||||||
|
# values:
|
||||||
|
# - "node-feature-discovery"
|
||||||
|
# klog:
|
||||||
|
# addDirHeader: false
|
||||||
|
# alsologtostderr: false
|
||||||
|
# logBacktraceAt:
|
||||||
|
# logtostderr: true
|
||||||
|
# skipHeaders: false
|
||||||
|
# stderrthreshold: 2
|
||||||
|
# v: 0
|
||||||
|
# vmodule:
|
||||||
|
## NOTE: the following options are not dynamically run-time configurable
|
||||||
|
## and require a nfd-master restart to take effect after being changed
|
||||||
|
# logDir:
|
||||||
|
# logFile:
|
||||||
|
# logFileMaxSize: 1800
|
||||||
|
# skipLogHeaders: false
|
||||||
|
# leaderElection:
|
||||||
|
# leaseDuration: 15s
|
||||||
|
# # this value has to be lower than leaseDuration and greater than retryPeriod*1.2
|
||||||
|
# renewDeadline: 10s
|
||||||
|
# # this value has to be greater than 0
|
||||||
|
# retryPeriod: 2s
|
||||||
|
# nfdApiParallelism: 10
|
||||||
|
### <NFD-MASTER-CONF-END-DO-NOT-REMOVE>
|
||||||
|
metricsPort: 8081
|
||||||
|
healthPort: 8082
|
||||||
|
instance:
|
||||||
|
featureApi:
|
||||||
|
resyncPeriod:
|
||||||
|
denyLabelNs: []
|
||||||
|
extraLabelNs: []
|
||||||
|
enableTaints: false
|
||||||
|
featureRulesController: null
|
||||||
|
nfdApiParallelism: null
|
||||||
|
deploymentAnnotations: {}
|
||||||
|
replicaCount: 1
|
||||||
|
|
||||||
|
podSecurityContext: {}
|
||||||
|
# fsGroup: 2000
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop: [ "ALL" ]
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsNonRoot: true
|
||||||
|
# runAsUser: 1000
|
||||||
|
|
||||||
|
serviceAccount:
|
||||||
|
# Specifies whether a service account should be created
|
||||||
|
create: true
|
||||||
|
# Annotations to add to the service account
|
||||||
|
annotations: {}
|
||||||
|
# The name of the service account to use.
|
||||||
|
# If not set and create is true, a name is generated using the fullname template
|
||||||
|
name:
|
||||||
|
|
||||||
|
# specify how many old ReplicaSets for the Deployment to retain.
|
||||||
|
revisionHistoryLimit:
|
||||||
|
|
||||||
|
rbac:
|
||||||
|
create: true
|
||||||
|
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
memory: 4Gi
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
# You may want to use the same value for `requests.memory` and `limits.memory`. The “requests” value affects scheduling to accommodate pods on nodes.
|
||||||
|
# If there is a large difference between “requests” and “limits” and nodes experience memory pressure, the kernel may invoke
|
||||||
|
# the OOM Killer, even if the memory does not exceed the “limits” threshold. This can cause unexpected pod evictions. Memory
|
||||||
|
# cannot be compressed and once allocated to a pod, it can only be reclaimed by killing the pod.
|
||||||
|
# Natan Yellin 22/09/2022 https://home.robusta.dev/blog/kubernetes-memory-limit
|
||||||
|
memory: 128Mi
|
||||||
|
|
||||||
|
nodeSelector: {}
|
||||||
|
|
||||||
|
tolerations:
|
||||||
|
- key: "node-role.kubernetes.io/master"
|
||||||
|
operator: "Equal"
|
||||||
|
value: ""
|
||||||
|
effect: "NoSchedule"
|
||||||
|
- key: "node-role.kubernetes.io/control-plane"
|
||||||
|
operator: "Equal"
|
||||||
|
value: ""
|
||||||
|
effect: "NoSchedule"
|
||||||
|
|
||||||
|
annotations: {}
|
||||||
|
|
||||||
|
affinity:
|
||||||
|
nodeAffinity:
|
||||||
|
preferredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
- weight: 1
|
||||||
|
preference:
|
||||||
|
matchExpressions:
|
||||||
|
- key: "node-role.kubernetes.io/master"
|
||||||
|
operator: In
|
||||||
|
values: [""]
|
||||||
|
- weight: 1
|
||||||
|
preference:
|
||||||
|
matchExpressions:
|
||||||
|
- key: "node-role.kubernetes.io/control-plane"
|
||||||
|
operator: In
|
||||||
|
values: [""]
|
||||||
|
|
||||||
|
startupProbe:
|
||||||
|
grpc:
|
||||||
|
port: 8082
|
||||||
|
failureThreshold: 30
|
||||||
|
# periodSeconds: 10
|
||||||
|
livenessProbe:
|
||||||
|
grpc:
|
||||||
|
port: 8082
|
||||||
|
# failureThreshold: 3
|
||||||
|
# initialDelaySeconds: 0
|
||||||
|
# periodSeconds: 10
|
||||||
|
# timeoutSeconds: 1
|
||||||
|
readinessProbe:
|
||||||
|
grpc:
|
||||||
|
port: 8082
|
||||||
|
failureThreshold: 10
|
||||||
|
# initialDelaySeconds: 0
|
||||||
|
# periodSeconds: 10
|
||||||
|
# timeoutSeconds: 1
|
||||||
|
# successThreshold: 1
|
||||||
|
|
||||||
|
worker:
|
||||||
|
enable: true
|
||||||
|
extraArgs: []
|
||||||
|
extraEnvs: []
|
||||||
|
hostNetwork: false
|
||||||
|
config: ### <NFD-WORKER-CONF-START-DO-NOT-REMOVE>
|
||||||
|
#core:
|
||||||
|
# labelWhiteList:
|
||||||
|
# noPublish: false
|
||||||
|
# noOwnerRefs: false
|
||||||
|
# sleepInterval: 60s
|
||||||
|
# featureSources: [all]
|
||||||
|
# labelSources: [all]
|
||||||
|
# klog:
|
||||||
|
# addDirHeader: false
|
||||||
|
# alsologtostderr: false
|
||||||
|
# logBacktraceAt:
|
||||||
|
# logtostderr: true
|
||||||
|
# skipHeaders: false
|
||||||
|
# stderrthreshold: 2
|
||||||
|
# v: 0
|
||||||
|
# vmodule:
|
||||||
|
## NOTE: the following options are not dynamically run-time configurable
|
||||||
|
## and require a nfd-worker restart to take effect after being changed
|
||||||
|
# logDir:
|
||||||
|
# logFile:
|
||||||
|
# logFileMaxSize: 1800
|
||||||
|
# skipLogHeaders: false
|
||||||
|
#sources:
|
||||||
|
# cpu:
|
||||||
|
# cpuid:
|
||||||
|
## NOTE: whitelist has priority over blacklist
|
||||||
|
# attributeBlacklist:
|
||||||
|
# - "AVX10"
|
||||||
|
# - "BMI1"
|
||||||
|
# - "BMI2"
|
||||||
|
# - "CLMUL"
|
||||||
|
# - "CMOV"
|
||||||
|
# - "CX16"
|
||||||
|
# - "ERMS"
|
||||||
|
# - "F16C"
|
||||||
|
# - "HTT"
|
||||||
|
# - "LZCNT"
|
||||||
|
# - "MMX"
|
||||||
|
# - "MMXEXT"
|
||||||
|
# - "NX"
|
||||||
|
# - "POPCNT"
|
||||||
|
# - "RDRAND"
|
||||||
|
# - "RDSEED"
|
||||||
|
# - "RDTSCP"
|
||||||
|
# - "SGX"
|
||||||
|
# - "SSE"
|
||||||
|
# - "SSE2"
|
||||||
|
# - "SSE3"
|
||||||
|
# - "SSE4"
|
||||||
|
# - "SSE42"
|
||||||
|
# - "SSSE3"
|
||||||
|
# - "TDX_GUEST"
|
||||||
|
# attributeWhitelist:
|
||||||
|
# kernel:
|
||||||
|
# kconfigFile: "/path/to/kconfig"
|
||||||
|
# configOpts:
|
||||||
|
# - "NO_HZ"
|
||||||
|
# - "X86"
|
||||||
|
# - "DMI"
|
||||||
|
# pci:
|
||||||
|
# deviceClassWhitelist:
|
||||||
|
# - "0200"
|
||||||
|
# - "03"
|
||||||
|
# - "12"
|
||||||
|
# deviceLabelFields:
|
||||||
|
# - "class"
|
||||||
|
# - "vendor"
|
||||||
|
# - "device"
|
||||||
|
# - "subsystem_vendor"
|
||||||
|
# - "subsystem_device"
|
||||||
|
# usb:
|
||||||
|
# deviceClassWhitelist:
|
||||||
|
# - "0e"
|
||||||
|
# - "ef"
|
||||||
|
# - "fe"
|
||||||
|
# - "ff"
|
||||||
|
# deviceLabelFields:
|
||||||
|
# - "class"
|
||||||
|
# - "vendor"
|
||||||
|
# - "device"
|
||||||
|
# custom:
|
||||||
|
# # The following feature demonstrates the capabilities of the matchFeatures
|
||||||
|
# - name: "my custom rule"
|
||||||
|
# labels:
|
||||||
|
# "vendor.io/my-ng-feature": "true"
|
||||||
|
# # matchFeatures implements a logical AND over all matcher terms in the
|
||||||
|
# # list (i.e. all of the terms, or per-feature matchers, must match)
|
||||||
|
# matchFeatures:
|
||||||
|
# - feature: cpu.cpuid
|
||||||
|
# matchExpressions:
|
||||||
|
# AVX512F: {op: Exists}
|
||||||
|
# - feature: cpu.cstate
|
||||||
|
# matchExpressions:
|
||||||
|
# enabled: {op: IsTrue}
|
||||||
|
# - feature: cpu.pstate
|
||||||
|
# matchExpressions:
|
||||||
|
# no_turbo: {op: IsFalse}
|
||||||
|
# scaling_governor: {op: In, value: ["performance"]}
|
||||||
|
# - feature: cpu.rdt
|
||||||
|
# matchExpressions:
|
||||||
|
# RDTL3CA: {op: Exists}
|
||||||
|
# - feature: cpu.sst
|
||||||
|
# matchExpressions:
|
||||||
|
# bf.enabled: {op: IsTrue}
|
||||||
|
# - feature: cpu.topology
|
||||||
|
# matchExpressions:
|
||||||
|
# hardware_multithreading: {op: IsFalse}
|
||||||
|
#
|
||||||
|
# - feature: kernel.config
|
||||||
|
# matchExpressions:
|
||||||
|
# X86: {op: Exists}
|
||||||
|
# LSM: {op: InRegexp, value: ["apparmor"]}
|
||||||
|
# - feature: kernel.loadedmodule
|
||||||
|
# matchExpressions:
|
||||||
|
# e1000e: {op: Exists}
|
||||||
|
# - feature: kernel.selinux
|
||||||
|
# matchExpressions:
|
||||||
|
# enabled: {op: IsFalse}
|
||||||
|
# - feature: kernel.version
|
||||||
|
# matchExpressions:
|
||||||
|
# major: {op: In, value: ["5"]}
|
||||||
|
# minor: {op: Gt, value: ["10"]}
|
||||||
|
#
|
||||||
|
# - feature: storage.block
|
||||||
|
# matchExpressions:
|
||||||
|
# rotational: {op: In, value: ["0"]}
|
||||||
|
# dax: {op: In, value: ["0"]}
|
||||||
|
#
|
||||||
|
# - feature: network.device
|
||||||
|
# matchExpressions:
|
||||||
|
# operstate: {op: In, value: ["up"]}
|
||||||
|
# speed: {op: Gt, value: ["100"]}
|
||||||
|
#
|
||||||
|
# - feature: memory.numa
|
||||||
|
# matchExpressions:
|
||||||
|
# node_count: {op: Gt, value: ["2"]}
|
||||||
|
# - feature: memory.nv
|
||||||
|
# matchExpressions:
|
||||||
|
# devtype: {op: In, value: ["nd_dax"]}
|
||||||
|
# mode: {op: In, value: ["memory"]}
|
||||||
|
#
|
||||||
|
# - feature: system.osrelease
|
||||||
|
# matchExpressions:
|
||||||
|
# ID: {op: In, value: ["fedora", "centos"]}
|
||||||
|
# - feature: system.name
|
||||||
|
# matchExpressions:
|
||||||
|
# nodename: {op: InRegexp, value: ["^worker-X"]}
|
||||||
|
#
|
||||||
|
# - feature: local.label
|
||||||
|
# matchExpressions:
|
||||||
|
# custom-feature-knob: {op: Gt, value: ["100"]}
|
||||||
|
#
|
||||||
|
# # The following feature demonstrates the capabilities of the matchAny
|
||||||
|
# - name: "my matchAny rule"
|
||||||
|
# labels:
|
||||||
|
# "vendor.io/my-ng-feature-2": "my-value"
|
||||||
|
# # matchAny implements a logical IF over all elements (sub-matchers) in
|
||||||
|
# # the list (i.e. at least one feature matcher must match)
|
||||||
|
# matchAny:
|
||||||
|
# - matchFeatures:
|
||||||
|
# - feature: kernel.loadedmodule
|
||||||
|
# matchExpressions:
|
||||||
|
# driver-module-X: {op: Exists}
|
||||||
|
# - feature: pci.device
|
||||||
|
# matchExpressions:
|
||||||
|
# vendor: {op: In, value: ["8086"]}
|
||||||
|
# class: {op: In, value: ["0200"]}
|
||||||
|
# - matchFeatures:
|
||||||
|
# - feature: kernel.loadedmodule
|
||||||
|
# matchExpressions:
|
||||||
|
# driver-module-Y: {op: Exists}
|
||||||
|
# - feature: usb.device
|
||||||
|
# matchExpressions:
|
||||||
|
# vendor: {op: In, value: ["8086"]}
|
||||||
|
# class: {op: In, value: ["02"]}
|
||||||
|
#
|
||||||
|
# - name: "avx wildcard rule"
|
||||||
|
# labels:
|
||||||
|
# "my-avx-feature": "true"
|
||||||
|
# matchFeatures:
|
||||||
|
# - feature: cpu.cpuid
|
||||||
|
# matchName: {op: InRegexp, value: ["^AVX512"]}
|
||||||
|
#
|
||||||
|
# # The following features demonstreate label templating capabilities
|
||||||
|
# - name: "my template rule"
|
||||||
|
# labelsTemplate: |
|
||||||
|
# {{ range .system.osrelease }}vendor.io/my-system-feature.{{ .Name }}={{ .Value }}
|
||||||
|
# {{ end }}
|
||||||
|
# matchFeatures:
|
||||||
|
# - feature: system.osrelease
|
||||||
|
# matchExpressions:
|
||||||
|
# ID: {op: InRegexp, value: ["^open.*"]}
|
||||||
|
# VERSION_ID.major: {op: In, value: ["13", "15"]}
|
||||||
|
#
|
||||||
|
# - name: "my template rule 2"
|
||||||
|
# labelsTemplate: |
|
||||||
|
# {{ range .pci.device }}vendor.io/my-pci-device.{{ .class }}-{{ .device }}=with-cpuid
|
||||||
|
# {{ end }}
|
||||||
|
# matchFeatures:
|
||||||
|
# - feature: pci.device
|
||||||
|
# matchExpressions:
|
||||||
|
# class: {op: InRegexp, value: ["^06"]}
|
||||||
|
# vendor: ["8086"]
|
||||||
|
# - feature: cpu.cpuid
|
||||||
|
# matchExpressions:
|
||||||
|
# AVX: {op: Exists}
|
||||||
|
#
|
||||||
|
# # The following examples demonstrate vars field and back-referencing
|
||||||
|
# # previous labels and vars
|
||||||
|
# - name: "my dummy kernel rule"
|
||||||
|
# labels:
|
||||||
|
# "vendor.io/my.kernel.feature": "true"
|
||||||
|
# matchFeatures:
|
||||||
|
# - feature: kernel.version
|
||||||
|
# matchExpressions:
|
||||||
|
# major: {op: Gt, value: ["2"]}
|
||||||
|
#
|
||||||
|
# - name: "my dummy rule with no labels"
|
||||||
|
# vars:
|
||||||
|
# "my.dummy.var": "1"
|
||||||
|
# matchFeatures:
|
||||||
|
# - feature: cpu.cpuid
|
||||||
|
# matchExpressions: {}
|
||||||
|
#
|
||||||
|
# - name: "my rule using backrefs"
|
||||||
|
# labels:
|
||||||
|
# "vendor.io/my.backref.feature": "true"
|
||||||
|
# matchFeatures:
|
||||||
|
# - feature: rule.matched
|
||||||
|
# matchExpressions:
|
||||||
|
# vendor.io/my.kernel.feature: {op: IsTrue}
|
||||||
|
# my.dummy.var: {op: Gt, value: ["0"]}
|
||||||
|
#
|
||||||
|
# - name: "kconfig template rule"
|
||||||
|
# labelsTemplate: |
|
||||||
|
# {{ range .kernel.config }}kconfig-{{ .Name }}={{ .Value }}
|
||||||
|
# {{ end }}
|
||||||
|
# matchFeatures:
|
||||||
|
# - feature: kernel.config
|
||||||
|
# matchName: {op: In, value: ["SWAP", "X86", "ARM"]}
|
||||||
|
### <NFD-WORKER-CONF-END-DO-NOT-REMOVE>
|
||||||
|
|
||||||
|
metricsPort: 8081
|
||||||
|
healthPort: 8082
|
||||||
|
daemonsetAnnotations: {}
|
||||||
|
podSecurityContext: {}
|
||||||
|
# fsGroup: 2000
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop: [ "ALL" ]
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsNonRoot: true
|
||||||
|
# runAsUser: 1000
|
||||||
|
|
||||||
|
livenessProbe:
|
||||||
|
grpc:
|
||||||
|
port: 8082
|
||||||
|
initialDelaySeconds: 10
|
||||||
|
# failureThreshold: 3
|
||||||
|
# periodSeconds: 10
|
||||||
|
# timeoutSeconds: 1
|
||||||
|
readinessProbe:
|
||||||
|
grpc:
|
||||||
|
port: 8082
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
failureThreshold: 10
|
||||||
|
# periodSeconds: 10
|
||||||
|
# timeoutSeconds: 1
|
||||||
|
# successThreshold: 1
|
||||||
|
|
||||||
|
serviceAccount:
|
||||||
|
# Specifies whether a service account should be created.
|
||||||
|
# We create this by default to make it easier for downstream users to apply PodSecurityPolicies.
|
||||||
|
create: true
|
||||||
|
# Annotations to add to the service account
|
||||||
|
annotations: {}
|
||||||
|
# The name of the service account to use.
|
||||||
|
# If not set and create is true, a name is generated using the fullname template
|
||||||
|
name:
|
||||||
|
|
||||||
|
# specify how many old ControllerRevisions for the DaemonSet to retain.
|
||||||
|
revisionHistoryLimit:
|
||||||
|
|
||||||
|
rbac:
|
||||||
|
create: true
|
||||||
|
|
||||||
|
# Allow users to mount the hostPath /usr/src, useful for RHCOS on s390x
|
||||||
|
# Does not work on systems without /usr/src AND a read-only /usr, such as Talos
|
||||||
|
mountUsrSrc: false
|
||||||
|
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
memory: 512Mi
|
||||||
|
requests:
|
||||||
|
cpu: 5m
|
||||||
|
memory: 64Mi
|
||||||
|
|
||||||
|
nodeSelector: {}
|
||||||
|
|
||||||
|
tolerations: []
|
||||||
|
|
||||||
|
annotations: {}
|
||||||
|
|
||||||
|
affinity: {}
|
||||||
|
|
||||||
|
priorityClassName: ""
|
||||||
|
|
||||||
|
topologyUpdater:
|
||||||
|
config: ### <NFD-TOPOLOGY-UPDATER-CONF-START-DO-NOT-REMOVE>
|
||||||
|
## key = node name, value = list of resources to be excluded.
|
||||||
|
## use * to exclude from all nodes.
|
||||||
|
## an example for how the exclude list should looks like
|
||||||
|
#excludeList:
|
||||||
|
# node1: [cpu]
|
||||||
|
# node2: [memory, example/deviceA]
|
||||||
|
# *: [hugepages-2Mi]
|
||||||
|
### <NFD-TOPOLOGY-UPDATER-CONF-END-DO-NOT-REMOVE>
|
||||||
|
|
||||||
|
enable: false
|
||||||
|
createCRDs: false
|
||||||
|
extraArgs: []
|
||||||
|
extraEnvs: []
|
||||||
|
hostNetwork: false
|
||||||
|
|
||||||
|
serviceAccount:
|
||||||
|
create: true
|
||||||
|
annotations: {}
|
||||||
|
name:
|
||||||
|
|
||||||
|
# specify how many old ControllerRevisions for the DaemonSet to retain.
|
||||||
|
revisionHistoryLimit:
|
||||||
|
|
||||||
|
rbac:
|
||||||
|
create: true
|
||||||
|
|
||||||
|
metricsPort: 8081
|
||||||
|
healthPort: 8082
|
||||||
|
kubeletConfigPath:
|
||||||
|
kubeletPodResourcesSockPath:
|
||||||
|
updateInterval: 60s
|
||||||
|
watchNamespace: "*"
|
||||||
|
kubeletStateDir: /var/lib/kubelet
|
||||||
|
|
||||||
|
podSecurityContext: {}
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop: [ "ALL" ]
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsUser: 0
|
||||||
|
|
||||||
|
livenessProbe:
|
||||||
|
grpc:
|
||||||
|
port: 8082
|
||||||
|
initialDelaySeconds: 10
|
||||||
|
# failureThreshold: 3
|
||||||
|
# periodSeconds: 10
|
||||||
|
# timeoutSeconds: 1
|
||||||
|
readinessProbe:
|
||||||
|
grpc:
|
||||||
|
port: 8082
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
failureThreshold: 10
|
||||||
|
# periodSeconds: 10
|
||||||
|
# timeoutSeconds: 1
|
||||||
|
# successThreshold: 1
|
||||||
|
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
memory: 60Mi
|
||||||
|
requests:
|
||||||
|
cpu: 50m
|
||||||
|
memory: 40Mi
|
||||||
|
|
||||||
|
nodeSelector: {}
|
||||||
|
tolerations: []
|
||||||
|
annotations: {}
|
||||||
|
daemonsetAnnotations: {}
|
||||||
|
affinity: {}
|
||||||
|
podSetFingerprint: true
|
||||||
|
|
||||||
|
gc:
|
||||||
|
enable: true
|
||||||
|
extraArgs: []
|
||||||
|
extraEnvs: []
|
||||||
|
hostNetwork: false
|
||||||
|
replicaCount: 1
|
||||||
|
|
||||||
|
serviceAccount:
|
||||||
|
create: true
|
||||||
|
annotations: {}
|
||||||
|
name:
|
||||||
|
rbac:
|
||||||
|
create: true
|
||||||
|
|
||||||
|
interval: 1h
|
||||||
|
|
||||||
|
podSecurityContext: {}
|
||||||
|
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
memory: 1Gi
|
||||||
|
requests:
|
||||||
|
cpu: 10m
|
||||||
|
memory: 128Mi
|
||||||
|
|
||||||
|
metricsPort: 8081
|
||||||
|
|
||||||
|
nodeSelector: {}
|
||||||
|
tolerations: []
|
||||||
|
annotations: {}
|
||||||
|
deploymentAnnotations: {}
|
||||||
|
affinity: {}
|
||||||
|
|
||||||
|
# specify how many old ReplicaSets for the Deployment to retain.
|
||||||
|
revisionHistoryLimit:
|
||||||
|
|
||||||
|
prometheus:
|
||||||
|
enable: false
|
||||||
|
scrapeInterval: 10s
|
||||||
|
labels: {}
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,809 @@
|
||||||
|
---
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
controller-gen.kubebuilder.io/version: v0.17.2
|
||||||
|
name: nvidiadrivers.nvidia.com
|
||||||
|
spec:
|
||||||
|
group: nvidia.com
|
||||||
|
names:
|
||||||
|
kind: NVIDIADriver
|
||||||
|
listKind: NVIDIADriverList
|
||||||
|
plural: nvidiadrivers
|
||||||
|
shortNames:
|
||||||
|
- nvd
|
||||||
|
- nvdriver
|
||||||
|
- nvdrivers
|
||||||
|
singular: nvidiadriver
|
||||||
|
scope: Cluster
|
||||||
|
versions:
|
||||||
|
- additionalPrinterColumns:
|
||||||
|
- jsonPath: .status.state
|
||||||
|
name: Status
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.creationTimestamp
|
||||||
|
name: Age
|
||||||
|
type: string
|
||||||
|
name: v1alpha1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: NVIDIADriver is the Schema for the nvidiadrivers API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: |-
|
||||||
|
APIVersion defines the versioned schema of this representation of an object.
|
||||||
|
Servers should convert recognized schemas to the latest internal value, and
|
||||||
|
may reject unrecognized values.
|
||||||
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: |-
|
||||||
|
Kind is a string value representing the REST resource this object represents.
|
||||||
|
Servers may infer this from the endpoint the client submits requests to.
|
||||||
|
Cannot be updated.
|
||||||
|
In CamelCase.
|
||||||
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: NVIDIADriverSpec defines the desired state of NVIDIADriver
|
||||||
|
properties:
|
||||||
|
annotations:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: |-
|
||||||
|
Optional: Annotations is an unstructured key value map stored with a resource that may be
|
||||||
|
set by external tools to store and retrieve arbitrary metadata. They are not
|
||||||
|
queryable and should be preserved when modifying objects.
|
||||||
|
type: object
|
||||||
|
args:
|
||||||
|
description: 'Optional: List of arguments'
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
certConfig:
|
||||||
|
description: 'Optional: Custom certificates configuration for NVIDIA
|
||||||
|
Driver container'
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
driverType:
|
||||||
|
default: gpu
|
||||||
|
description: DriverType defines NVIDIA driver type
|
||||||
|
enum:
|
||||||
|
- gpu
|
||||||
|
- vgpu
|
||||||
|
- vgpu-host-manager
|
||||||
|
type: string
|
||||||
|
x-kubernetes-validations:
|
||||||
|
- message: driverType is an immutable field. Please create a new NvidiaDriver
|
||||||
|
resource instead when you want to change this setting.
|
||||||
|
rule: self == oldSelf
|
||||||
|
env:
|
||||||
|
description: 'Optional: List of environment variables'
|
||||||
|
items:
|
||||||
|
description: EnvVar represents an environment variable present in
|
||||||
|
a Container.
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
description: Name of the environment variable.
|
||||||
|
type: string
|
||||||
|
value:
|
||||||
|
description: Value of the environment variable.
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
gdrcopy:
|
||||||
|
description: GDRCopy defines the spec for GDRCopy driver
|
||||||
|
properties:
|
||||||
|
args:
|
||||||
|
description: 'Optional: List of arguments'
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
enabled:
|
||||||
|
description: Enabled indicates if GDRCopy is enabled through GPU
|
||||||
|
operator
|
||||||
|
type: boolean
|
||||||
|
env:
|
||||||
|
description: 'Optional: List of environment variables'
|
||||||
|
items:
|
||||||
|
description: EnvVar represents an environment variable present
|
||||||
|
in a Container.
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
description: Name of the environment variable.
|
||||||
|
type: string
|
||||||
|
value:
|
||||||
|
description: Value of the environment variable.
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
image:
|
||||||
|
description: GDRCopy driver image name
|
||||||
|
pattern: '[a-zA-Z0-9\-]+'
|
||||||
|
type: string
|
||||||
|
imagePullPolicy:
|
||||||
|
description: Image pull policy
|
||||||
|
type: string
|
||||||
|
imagePullSecrets:
|
||||||
|
description: Image pull secrets
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
repository:
|
||||||
|
description: GDRCopy diver image repository
|
||||||
|
type: string
|
||||||
|
version:
|
||||||
|
description: GDRCopy driver image tag
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
gds:
|
||||||
|
description: GPUDirectStorage defines the spec for GDS driver
|
||||||
|
properties:
|
||||||
|
args:
|
||||||
|
description: 'Optional: List of arguments'
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
enabled:
|
||||||
|
description: Enabled indicates if GPUDirect Storage is enabled
|
||||||
|
through GPU operator
|
||||||
|
type: boolean
|
||||||
|
env:
|
||||||
|
description: 'Optional: List of environment variables'
|
||||||
|
items:
|
||||||
|
description: EnvVar represents an environment variable present
|
||||||
|
in a Container.
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
description: Name of the environment variable.
|
||||||
|
type: string
|
||||||
|
value:
|
||||||
|
description: Value of the environment variable.
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
image:
|
||||||
|
description: NVIDIA GPUDirect Storage Driver image name
|
||||||
|
pattern: '[a-zA-Z0-9\-]+'
|
||||||
|
type: string
|
||||||
|
imagePullPolicy:
|
||||||
|
description: Image pull policy
|
||||||
|
type: string
|
||||||
|
imagePullSecrets:
|
||||||
|
description: Image pull secrets
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
repository:
|
||||||
|
description: NVIDIA GPUDirect Storage Driver image repository
|
||||||
|
type: string
|
||||||
|
version:
|
||||||
|
description: NVIDIA GPUDirect Storage Driver image tag
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
image:
|
||||||
|
default: nvcr.io/nvidia/driver
|
||||||
|
description: NVIDIA Driver container image name
|
||||||
|
type: string
|
||||||
|
imagePullPolicy:
|
||||||
|
description: Image pull policy
|
||||||
|
type: string
|
||||||
|
imagePullSecrets:
|
||||||
|
description: Image pull secrets
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
kernelModuleConfig:
|
||||||
|
description: 'Optional: Kernel module configuration parameters for
|
||||||
|
the NVIDIA Driver'
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
kernelModuleType:
|
||||||
|
default: auto
|
||||||
|
description: |-
|
||||||
|
KernelModuleType represents the type of driver kernel modules to be used when installing the GPU driver.
|
||||||
|
Accepted values are auto, proprietary and open. NOTE: If auto is chosen, it means that the recommended kernel module
|
||||||
|
type is chosen based on the GPU devices on the host and the driver branch used
|
||||||
|
enum:
|
||||||
|
- auto
|
||||||
|
- open
|
||||||
|
- proprietary
|
||||||
|
type: string
|
||||||
|
labels:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: |-
|
||||||
|
Optional: Map of string keys and values that can be used to organize and categorize
|
||||||
|
(scope and select) objects. May match selectors of replication controllers
|
||||||
|
and services.
|
||||||
|
type: object
|
||||||
|
licensingConfig:
|
||||||
|
description: 'Optional: Licensing configuration for NVIDIA vGPU licensing'
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
type: string
|
||||||
|
nlsEnabled:
|
||||||
|
description: NLSEnabled indicates if NVIDIA Licensing System is
|
||||||
|
used for licensing.
|
||||||
|
type: boolean
|
||||||
|
type: object
|
||||||
|
livenessProbe:
|
||||||
|
description: NVIDIA Driver container liveness probe settings
|
||||||
|
properties:
|
||||||
|
failureThreshold:
|
||||||
|
description: |-
|
||||||
|
Minimum consecutive failures for the probe to be considered failed after having succeeded.
|
||||||
|
Defaults to 3. Minimum value is 1.
|
||||||
|
format: int32
|
||||||
|
minimum: 1
|
||||||
|
type: integer
|
||||||
|
initialDelaySeconds:
|
||||||
|
description: |-
|
||||||
|
Number of seconds after the container has started before liveness probes are initiated.
|
||||||
|
More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
|
||||||
|
format: int32
|
||||||
|
type: integer
|
||||||
|
periodSeconds:
|
||||||
|
description: |-
|
||||||
|
How often (in seconds) to perform the probe.
|
||||||
|
Default to 10 seconds. Minimum value is 1.
|
||||||
|
format: int32
|
||||||
|
minimum: 1
|
||||||
|
type: integer
|
||||||
|
successThreshold:
|
||||||
|
description: |-
|
||||||
|
Minimum consecutive successes for the probe to be considered successful after having failed.
|
||||||
|
Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
|
||||||
|
format: int32
|
||||||
|
minimum: 1
|
||||||
|
type: integer
|
||||||
|
timeoutSeconds:
|
||||||
|
description: |-
|
||||||
|
Number of seconds after which the probe times out.
|
||||||
|
Defaults to 1 second. Minimum value is 1.
|
||||||
|
More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
|
||||||
|
format: int32
|
||||||
|
minimum: 1
|
||||||
|
type: integer
|
||||||
|
type: object
|
||||||
|
manager:
|
||||||
|
description: Manager represents configuration for NVIDIA Driver Manager
|
||||||
|
initContainer
|
||||||
|
properties:
|
||||||
|
env:
|
||||||
|
description: 'Optional: List of environment variables'
|
||||||
|
items:
|
||||||
|
description: EnvVar represents an environment variable present
|
||||||
|
in a Container.
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
description: Name of the environment variable.
|
||||||
|
type: string
|
||||||
|
value:
|
||||||
|
description: Value of the environment variable.
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
image:
|
||||||
|
description: Image represents NVIDIA Driver Manager image name
|
||||||
|
pattern: '[a-zA-Z0-9\-]+'
|
||||||
|
type: string
|
||||||
|
imagePullPolicy:
|
||||||
|
description: Image pull policy
|
||||||
|
type: string
|
||||||
|
imagePullSecrets:
|
||||||
|
description: Image pull secrets
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
repository:
|
||||||
|
description: Repository represents Driver Managerrepository path
|
||||||
|
type: string
|
||||||
|
version:
|
||||||
|
description: Version represents NVIDIA Driver Manager image tag(version)
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
nodeAffinity:
|
||||||
|
description: Affinity specifies node affinity rules for driver pods
|
||||||
|
properties:
|
||||||
|
preferredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
description: |-
|
||||||
|
The scheduler will prefer to schedule pods to nodes that satisfy
|
||||||
|
the affinity expressions specified by this field, but it may choose
|
||||||
|
a node that violates one or more of the expressions. The node that is
|
||||||
|
most preferred is the one with the greatest sum of weights, i.e.
|
||||||
|
for each node that meets all of the scheduling requirements (resource
|
||||||
|
request, requiredDuringScheduling affinity expressions, etc.),
|
||||||
|
compute a sum by iterating through the elements of this field and adding
|
||||||
|
"weight" to the sum if the node matches the corresponding matchExpressions; the
|
||||||
|
node(s) with the highest sum are the most preferred.
|
||||||
|
items:
|
||||||
|
description: |-
|
||||||
|
An empty preferred scheduling term matches all objects with implicit weight 0
|
||||||
|
(i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
|
||||||
|
properties:
|
||||||
|
preference:
|
||||||
|
description: A node selector term, associated with the corresponding
|
||||||
|
weight.
|
||||||
|
properties:
|
||||||
|
matchExpressions:
|
||||||
|
description: A list of node selector requirements by
|
||||||
|
node's labels.
|
||||||
|
items:
|
||||||
|
description: |-
|
||||||
|
A node selector requirement is a selector that contains values, a key, and an operator
|
||||||
|
that relates the key and values.
|
||||||
|
properties:
|
||||||
|
key:
|
||||||
|
description: The label key that the selector applies
|
||||||
|
to.
|
||||||
|
type: string
|
||||||
|
operator:
|
||||||
|
description: |-
|
||||||
|
Represents a key's relationship to a set of values.
|
||||||
|
Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
|
||||||
|
type: string
|
||||||
|
values:
|
||||||
|
description: |-
|
||||||
|
An array of string values. If the operator is In or NotIn,
|
||||||
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||||
|
the values array must be empty. If the operator is Gt or Lt, the values
|
||||||
|
array must have a single element, which will be interpreted as an integer.
|
||||||
|
This array is replaced during a strategic merge patch.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
x-kubernetes-list-type: atomic
|
||||||
|
required:
|
||||||
|
- key
|
||||||
|
- operator
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
x-kubernetes-list-type: atomic
|
||||||
|
matchFields:
|
||||||
|
description: A list of node selector requirements by
|
||||||
|
node's fields.
|
||||||
|
items:
|
||||||
|
description: |-
|
||||||
|
A node selector requirement is a selector that contains values, a key, and an operator
|
||||||
|
that relates the key and values.
|
||||||
|
properties:
|
||||||
|
key:
|
||||||
|
description: The label key that the selector applies
|
||||||
|
to.
|
||||||
|
type: string
|
||||||
|
operator:
|
||||||
|
description: |-
|
||||||
|
Represents a key's relationship to a set of values.
|
||||||
|
Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
|
||||||
|
type: string
|
||||||
|
values:
|
||||||
|
description: |-
|
||||||
|
An array of string values. If the operator is In or NotIn,
|
||||||
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||||
|
the values array must be empty. If the operator is Gt or Lt, the values
|
||||||
|
array must have a single element, which will be interpreted as an integer.
|
||||||
|
This array is replaced during a strategic merge patch.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
x-kubernetes-list-type: atomic
|
||||||
|
required:
|
||||||
|
- key
|
||||||
|
- operator
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
x-kubernetes-list-type: atomic
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
weight:
|
||||||
|
description: Weight associated with matching the corresponding
|
||||||
|
nodeSelectorTerm, in the range 1-100.
|
||||||
|
format: int32
|
||||||
|
type: integer
|
||||||
|
required:
|
||||||
|
- preference
|
||||||
|
- weight
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
x-kubernetes-list-type: atomic
|
||||||
|
requiredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
description: |-
|
||||||
|
If the affinity requirements specified by this field are not met at
|
||||||
|
scheduling time, the pod will not be scheduled onto the node.
|
||||||
|
If the affinity requirements specified by this field cease to be met
|
||||||
|
at some point during pod execution (e.g. due to an update), the system
|
||||||
|
may or may not try to eventually evict the pod from its node.
|
||||||
|
properties:
|
||||||
|
nodeSelectorTerms:
|
||||||
|
description: Required. A list of node selector terms. The
|
||||||
|
terms are ORed.
|
||||||
|
items:
|
||||||
|
description: |-
|
||||||
|
A null or empty node selector term matches no objects. The requirements of
|
||||||
|
them are ANDed.
|
||||||
|
The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
|
||||||
|
properties:
|
||||||
|
matchExpressions:
|
||||||
|
description: A list of node selector requirements by
|
||||||
|
node's labels.
|
||||||
|
items:
|
||||||
|
description: |-
|
||||||
|
A node selector requirement is a selector that contains values, a key, and an operator
|
||||||
|
that relates the key and values.
|
||||||
|
properties:
|
||||||
|
key:
|
||||||
|
description: The label key that the selector applies
|
||||||
|
to.
|
||||||
|
type: string
|
||||||
|
operator:
|
||||||
|
description: |-
|
||||||
|
Represents a key's relationship to a set of values.
|
||||||
|
Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
|
||||||
|
type: string
|
||||||
|
values:
|
||||||
|
description: |-
|
||||||
|
An array of string values. If the operator is In or NotIn,
|
||||||
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||||
|
the values array must be empty. If the operator is Gt or Lt, the values
|
||||||
|
array must have a single element, which will be interpreted as an integer.
|
||||||
|
This array is replaced during a strategic merge patch.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
x-kubernetes-list-type: atomic
|
||||||
|
required:
|
||||||
|
- key
|
||||||
|
- operator
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
x-kubernetes-list-type: atomic
|
||||||
|
matchFields:
|
||||||
|
description: A list of node selector requirements by
|
||||||
|
node's fields.
|
||||||
|
items:
|
||||||
|
description: |-
|
||||||
|
A node selector requirement is a selector that contains values, a key, and an operator
|
||||||
|
that relates the key and values.
|
||||||
|
properties:
|
||||||
|
key:
|
||||||
|
description: The label key that the selector applies
|
||||||
|
to.
|
||||||
|
type: string
|
||||||
|
operator:
|
||||||
|
description: |-
|
||||||
|
Represents a key's relationship to a set of values.
|
||||||
|
Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
|
||||||
|
type: string
|
||||||
|
values:
|
||||||
|
description: |-
|
||||||
|
An array of string values. If the operator is In or NotIn,
|
||||||
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||||
|
the values array must be empty. If the operator is Gt or Lt, the values
|
||||||
|
array must have a single element, which will be interpreted as an integer.
|
||||||
|
This array is replaced during a strategic merge patch.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
x-kubernetes-list-type: atomic
|
||||||
|
required:
|
||||||
|
- key
|
||||||
|
- operator
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
x-kubernetes-list-type: atomic
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
type: array
|
||||||
|
x-kubernetes-list-type: atomic
|
||||||
|
required:
|
||||||
|
- nodeSelectorTerms
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
type: object
|
||||||
|
nodeSelector:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: NodeSelector specifies a selector for installation of
|
||||||
|
NVIDIA driver
|
||||||
|
type: object
|
||||||
|
priorityClassName:
|
||||||
|
description: 'Optional: Set priorityClassName'
|
||||||
|
type: string
|
||||||
|
rdma:
|
||||||
|
description: GPUDirectRDMA defines the spec for NVIDIA Peer Memory
|
||||||
|
driver
|
||||||
|
properties:
|
||||||
|
enabled:
|
||||||
|
description: Enabled indicates if GPUDirect RDMA is enabled through
|
||||||
|
GPU operator
|
||||||
|
type: boolean
|
||||||
|
useHostMofed:
|
||||||
|
description: UseHostMOFED indicates to use MOFED drivers directly
|
||||||
|
installed on the host to enable GPUDirect RDMA
|
||||||
|
type: boolean
|
||||||
|
type: object
|
||||||
|
readinessProbe:
|
||||||
|
description: NVIDIA Driver container readiness probe settings
|
||||||
|
properties:
|
||||||
|
failureThreshold:
|
||||||
|
description: |-
|
||||||
|
Minimum consecutive failures for the probe to be considered failed after having succeeded.
|
||||||
|
Defaults to 3. Minimum value is 1.
|
||||||
|
format: int32
|
||||||
|
minimum: 1
|
||||||
|
type: integer
|
||||||
|
initialDelaySeconds:
|
||||||
|
description: |-
|
||||||
|
Number of seconds after the container has started before liveness probes are initiated.
|
||||||
|
More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
|
||||||
|
format: int32
|
||||||
|
type: integer
|
||||||
|
periodSeconds:
|
||||||
|
description: |-
|
||||||
|
How often (in seconds) to perform the probe.
|
||||||
|
Default to 10 seconds. Minimum value is 1.
|
||||||
|
format: int32
|
||||||
|
minimum: 1
|
||||||
|
type: integer
|
||||||
|
successThreshold:
|
||||||
|
description: |-
|
||||||
|
Minimum consecutive successes for the probe to be considered successful after having failed.
|
||||||
|
Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
|
||||||
|
format: int32
|
||||||
|
minimum: 1
|
||||||
|
type: integer
|
||||||
|
timeoutSeconds:
|
||||||
|
description: |-
|
||||||
|
Number of seconds after which the probe times out.
|
||||||
|
Defaults to 1 second. Minimum value is 1.
|
||||||
|
More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
|
||||||
|
format: int32
|
||||||
|
minimum: 1
|
||||||
|
type: integer
|
||||||
|
type: object
|
||||||
|
repoConfig:
|
||||||
|
description: 'Optional: Custom repo configuration for NVIDIA Driver
|
||||||
|
container'
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
repository:
|
||||||
|
description: NVIDIA Driver repository
|
||||||
|
type: string
|
||||||
|
resources:
|
||||||
|
description: 'Optional: Define resources requests and limits for each
|
||||||
|
pod'
|
||||||
|
properties:
|
||||||
|
limits:
|
||||||
|
additionalProperties:
|
||||||
|
anyOf:
|
||||||
|
- type: integer
|
||||||
|
- type: string
|
||||||
|
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||||
|
x-kubernetes-int-or-string: true
|
||||||
|
description: |-
|
||||||
|
Limits describes the maximum amount of compute resources allowed.
|
||||||
|
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||||
|
type: object
|
||||||
|
requests:
|
||||||
|
additionalProperties:
|
||||||
|
anyOf:
|
||||||
|
- type: integer
|
||||||
|
- type: string
|
||||||
|
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||||
|
x-kubernetes-int-or-string: true
|
||||||
|
description: |-
|
||||||
|
Requests describes the minimum amount of compute resources required.
|
||||||
|
If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
|
||||||
|
otherwise to an implementation-defined value. Requests cannot exceed Limits.
|
||||||
|
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
startupProbe:
|
||||||
|
description: NVIDIA Driver container startup probe settings
|
||||||
|
properties:
|
||||||
|
failureThreshold:
|
||||||
|
description: |-
|
||||||
|
Minimum consecutive failures for the probe to be considered failed after having succeeded.
|
||||||
|
Defaults to 3. Minimum value is 1.
|
||||||
|
format: int32
|
||||||
|
minimum: 1
|
||||||
|
type: integer
|
||||||
|
initialDelaySeconds:
|
||||||
|
description: |-
|
||||||
|
Number of seconds after the container has started before liveness probes are initiated.
|
||||||
|
More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
|
||||||
|
format: int32
|
||||||
|
type: integer
|
||||||
|
periodSeconds:
|
||||||
|
description: |-
|
||||||
|
How often (in seconds) to perform the probe.
|
||||||
|
Default to 10 seconds. Minimum value is 1.
|
||||||
|
format: int32
|
||||||
|
minimum: 1
|
||||||
|
type: integer
|
||||||
|
successThreshold:
|
||||||
|
description: |-
|
||||||
|
Minimum consecutive successes for the probe to be considered successful after having failed.
|
||||||
|
Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
|
||||||
|
format: int32
|
||||||
|
minimum: 1
|
||||||
|
type: integer
|
||||||
|
timeoutSeconds:
|
||||||
|
description: |-
|
||||||
|
Number of seconds after which the probe times out.
|
||||||
|
Defaults to 1 second. Minimum value is 1.
|
||||||
|
More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
|
||||||
|
format: int32
|
||||||
|
minimum: 1
|
||||||
|
type: integer
|
||||||
|
type: object
|
||||||
|
tolerations:
|
||||||
|
description: 'Optional: Set tolerations'
|
||||||
|
items:
|
||||||
|
description: |-
|
||||||
|
The pod this Toleration is attached to tolerates any taint that matches
|
||||||
|
the triple <key,value,effect> using the matching operator <operator>.
|
||||||
|
properties:
|
||||||
|
effect:
|
||||||
|
description: |-
|
||||||
|
Effect indicates the taint effect to match. Empty means match all taint effects.
|
||||||
|
When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
|
||||||
|
type: string
|
||||||
|
key:
|
||||||
|
description: |-
|
||||||
|
Key is the taint key that the toleration applies to. Empty means match all taint keys.
|
||||||
|
If the key is empty, operator must be Exists; this combination means to match all values and all keys.
|
||||||
|
type: string
|
||||||
|
operator:
|
||||||
|
description: |-
|
||||||
|
Operator represents a key's relationship to the value.
|
||||||
|
Valid operators are Exists and Equal. Defaults to Equal.
|
||||||
|
Exists is equivalent to wildcard for value, so that a pod can
|
||||||
|
tolerate all taints of a particular category.
|
||||||
|
type: string
|
||||||
|
tolerationSeconds:
|
||||||
|
description: |-
|
||||||
|
TolerationSeconds represents the period of time the toleration (which must be
|
||||||
|
of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
|
||||||
|
it is not set, which means tolerate the taint forever (do not evict). Zero and
|
||||||
|
negative values will be treated as 0 (evict immediately) by the system.
|
||||||
|
format: int64
|
||||||
|
type: integer
|
||||||
|
value:
|
||||||
|
description: |-
|
||||||
|
Value is the taint value the toleration matches to.
|
||||||
|
If the operator is Exists, the value should be empty, otherwise just a regular string.
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
useOpenKernelModules:
|
||||||
|
description: |-
|
||||||
|
Deprecated: This field is no longer honored by the gpu-operator. Please use KernelModuleType instead.
|
||||||
|
UseOpenKernelModules indicates if the open GPU kernel modules should be used
|
||||||
|
type: boolean
|
||||||
|
usePrecompiled:
|
||||||
|
description: UsePrecompiled indicates if deployment of NVIDIA Driver
|
||||||
|
using pre-compiled modules is enabled
|
||||||
|
type: boolean
|
||||||
|
x-kubernetes-validations:
|
||||||
|
- message: usePrecompiled is an immutable field. Please create a new
|
||||||
|
NvidiaDriver resource instead when you want to change this setting.
|
||||||
|
rule: self == oldSelf
|
||||||
|
version:
|
||||||
|
description: NVIDIA Driver version (or just branch for precompiled
|
||||||
|
drivers)
|
||||||
|
type: string
|
||||||
|
virtualTopologyConfig:
|
||||||
|
description: 'Optional: Virtual Topology Daemon configuration for
|
||||||
|
NVIDIA vGPU drivers'
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
description: 'Optional: Config name representing virtual topology
|
||||||
|
daemon configuration file nvidia-topologyd.conf'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- driverType
|
||||||
|
- image
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
description: NVIDIADriverStatus defines the observed state of NVIDIADriver
|
||||||
|
properties:
|
||||||
|
conditions:
|
||||||
|
description: Conditions is a list of conditions representing the NVIDIADriver's
|
||||||
|
current state.
|
||||||
|
items:
|
||||||
|
description: Condition contains details for one aspect of the current
|
||||||
|
state of this API Resource.
|
||||||
|
properties:
|
||||||
|
lastTransitionTime:
|
||||||
|
description: |-
|
||||||
|
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||||
|
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: |-
|
||||||
|
message is a human readable message indicating details about the transition.
|
||||||
|
This may be an empty string.
|
||||||
|
maxLength: 32768
|
||||||
|
type: string
|
||||||
|
observedGeneration:
|
||||||
|
description: |-
|
||||||
|
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||||
|
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||||
|
with respect to the current state of the instance.
|
||||||
|
format: int64
|
||||||
|
minimum: 0
|
||||||
|
type: integer
|
||||||
|
reason:
|
||||||
|
description: |-
|
||||||
|
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||||
|
Producers of specific condition types may define expected values and meanings for this field,
|
||||||
|
and whether the values are considered a guaranteed API.
|
||||||
|
The value should be a CamelCase string.
|
||||||
|
This field may not be empty.
|
||||||
|
maxLength: 1024
|
||||||
|
minLength: 1
|
||||||
|
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||||
|
type: string
|
||||||
|
status:
|
||||||
|
description: status of the condition, one of True, False, Unknown.
|
||||||
|
enum:
|
||||||
|
- "True"
|
||||||
|
- "False"
|
||||||
|
- Unknown
|
||||||
|
type: string
|
||||||
|
type:
|
||||||
|
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||||
|
maxLength: 316
|
||||||
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- lastTransitionTime
|
||||||
|
- message
|
||||||
|
- reason
|
||||||
|
- status
|
||||||
|
- type
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
namespace:
|
||||||
|
description: Namespace indicates a namespace in which the operator
|
||||||
|
and driver are installed
|
||||||
|
type: string
|
||||||
|
state:
|
||||||
|
description: |-
|
||||||
|
INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
|
||||||
|
Important: Run "make" to regenerate code after modifying this file
|
||||||
|
State indicates status of NVIDIADriver instance
|
||||||
|
enum:
|
||||||
|
- ignored
|
||||||
|
- ready
|
||||||
|
- notReady
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- state
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
|
|
@ -0,0 +1,97 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: custom-dcgm-metric
|
||||||
|
namespace: gpu-operator
|
||||||
|
data:
|
||||||
|
dcgm-metrics.csv: |
|
||||||
|
# Format
|
||||||
|
# If line starts with a '#' it is considered a comment
|
||||||
|
# DCGM FIELD, Prometheus metric type, help message
|
||||||
|
|
||||||
|
# Clocks
|
||||||
|
DCGM_FI_DEV_SM_CLOCK, gauge, SM clock frequency (in MHz).
|
||||||
|
DCGM_FI_DEV_MEM_CLOCK, gauge, Memory clock frequency (in MHz).
|
||||||
|
|
||||||
|
# Temperature
|
||||||
|
DCGM_FI_DEV_MEMORY_TEMP, gauge, Memory temperature (in C).
|
||||||
|
DCGM_FI_DEV_GPU_TEMP, gauge, GPU temperature (in C).
|
||||||
|
|
||||||
|
# Power
|
||||||
|
DCGM_FI_DEV_POWER_USAGE, gauge, Power draw (in W).
|
||||||
|
DCGM_FI_DEV_TOTAL_ENERGY_CONSUMPTION, counter, Total energy consumption since boot (in mJ).
|
||||||
|
|
||||||
|
# PCIE
|
||||||
|
DCGM_FI_PROF_PCIE_TX_BYTES, counter, Total number of bytes transmitted through PCIe TX via NVML.
|
||||||
|
DCGM_FI_PROF_PCIE_RX_BYTES, counter, Total number of bytes received through PCIe RX via NVML.
|
||||||
|
DCGM_FI_DEV_PCIE_REPLAY_COUNTER, counter, Total number of PCIe retries.
|
||||||
|
|
||||||
|
# Utilization (the sample period varies depending on the product)
|
||||||
|
DCGM_FI_DEV_GPU_UTIL, gauge, GPU utilization (in %).
|
||||||
|
DCGM_FI_DEV_MEM_COPY_UTIL, gauge, Memory utilization (in %).
|
||||||
|
DCGM_FI_DEV_ENC_UTIL, gauge, Encoder utilization (in %).
|
||||||
|
DCGM_FI_DEV_DEC_UTIL , gauge, Decoder utilization (in %).
|
||||||
|
|
||||||
|
# Errors and violations
|
||||||
|
DCGM_FI_DEV_XID_ERRORS, gauge, Value of the last XID error encountered.
|
||||||
|
DCGM_FI_DEV_POWER_VIOLATION, counter, Throttling duration due to power constraints (in us).
|
||||||
|
DCGM_FI_DEV_THERMAL_VIOLATION, counter, Throttling duration due to thermal constraints (in us).
|
||||||
|
DCGM_FI_DEV_SYNC_BOOST_VIOLATION, counter, Throttling duration due to sync-boost constraints (in us).
|
||||||
|
DCGM_FI_DEV_BOARD_LIMIT_VIOLATION, counter, Throttling duration due to board limit constraints (in us).
|
||||||
|
DCGM_FI_DEV_LOW_UTIL_VIOLATION, counter, Throttling duration due to low utilization (in us).
|
||||||
|
DCGM_FI_DEV_RELIABILITY_VIOLATION, counter, Throttling duration due to reliability constraints (in us).
|
||||||
|
|
||||||
|
# Memory usage
|
||||||
|
DCGM_FI_DEV_FB_FREE, gauge, Framebuffer memory free (in MiB).
|
||||||
|
DCGM_FI_DEV_FB_USED, gauge, Framebuffer memory used (in MiB).
|
||||||
|
|
||||||
|
# ECC
|
||||||
|
DCGM_FI_DEV_ECC_SBE_VOL_TOTAL, counter, Total number of single-bit volatile ECC errors.
|
||||||
|
DCGM_FI_DEV_ECC_DBE_VOL_TOTAL, counter, Total number of double-bit volatile ECC errors.
|
||||||
|
DCGM_FI_DEV_ECC_SBE_AGG_TOTAL, counter, Total number of single-bit persistent ECC errors.
|
||||||
|
DCGM_FI_DEV_ECC_DBE_AGG_TOTAL, counter, Total number of double-bit persistent ECC errors.
|
||||||
|
|
||||||
|
# Retired pages
|
||||||
|
DCGM_FI_DEV_RETIRED_SBE, counter, Total number of retired pages due to single-bit errors.
|
||||||
|
DCGM_FI_DEV_RETIRED_DBE, counter, Total number of retired pages due to double-bit errors.
|
||||||
|
DCGM_FI_DEV_RETIRED_PENDING, counter, Total number of pages pending retirement.
|
||||||
|
|
||||||
|
# NVLink
|
||||||
|
DCGM_FI_DEV_NVLINK_CRC_FLIT_ERROR_COUNT_TOTAL, counter, Total number of NVLink flow-control CRC errors.
|
||||||
|
DCGM_FI_DEV_NVLINK_CRC_DATA_ERROR_COUNT_TOTAL, counter, Total number of NVLink data CRC errors.
|
||||||
|
DCGM_FI_DEV_NVLINK_REPLAY_ERROR_COUNT_TOTAL, counter, Total number of NVLink retries.
|
||||||
|
DCGM_FI_DEV_NVLINK_RECOVERY_ERROR_COUNT_TOTAL, counter, Total number of NVLink recovery errors.
|
||||||
|
DCGM_FI_DEV_NVLINK_BANDWIDTH_TOTAL, counter, Total number of NVLink bandwidth counters for all lanes.
|
||||||
|
DCGM_FI_DEV_NVLINK_BANDWIDTH_L0, counter, The number of bytes of active NVLink rx or tx data including both header and payload.
|
||||||
|
|
||||||
|
# VGPU License status
|
||||||
|
DCGM_FI_DEV_VGPU_LICENSE_STATUS, gauge, vGPU License status
|
||||||
|
|
||||||
|
# Remapped rows
|
||||||
|
DCGM_FI_DEV_UNCORRECTABLE_REMAPPED_ROWS, counter, Number of remapped rows for uncorrectable errors
|
||||||
|
DCGM_FI_DEV_CORRECTABLE_REMAPPED_ROWS, counter, Number of remapped rows for correctable errors
|
||||||
|
DCGM_FI_DEV_ROW_REMAP_FAILURE, gauge, Whether remapping of rows has failed
|
||||||
|
|
||||||
|
# Static configuration information. These appear as labels on the other metrics
|
||||||
|
DCGM_FI_DRIVER_VERSION, label, Driver Version
|
||||||
|
DCGM_FI_NVML_VERSION, label, NVML Version
|
||||||
|
DCGM_FI_DEV_BRAND, label, Device Brand
|
||||||
|
DCGM_FI_DEV_SERIAL, label, Device Serial Number
|
||||||
|
DCGM_FI_DEV_OEM_INFOROM_VER, label, OEM inforom version
|
||||||
|
DCGM_FI_DEV_ECC_INFOROM_VER, label, ECC inforom version
|
||||||
|
DCGM_FI_DEV_POWER_INFOROM_VER, label, Power management object inforom version
|
||||||
|
DCGM_FI_DEV_INFOROM_IMAGE_VER, label, Inforom image version
|
||||||
|
DCGM_FI_DEV_VBIOS_VERSION, label, VBIOS version of the device
|
||||||
|
|
||||||
|
# DCP metrics
|
||||||
|
DCGM_FI_PROF_GR_ENGINE_ACTIVE, gauge, Ratio of time the graphics engine is active.
|
||||||
|
DCGM_FI_PROF_SM_ACTIVE, gauge, The ratio of cycles an SM has at least 1 warp assigned.
|
||||||
|
DCGM_FI_PROF_SM_OCCUPANCY, gauge, The ratio of number of warps resident on an SM.
|
||||||
|
DCGM_FI_PROF_PIPE_TENSOR_ACTIVE, gauge, Ratio of cycles the tensor (HMMA) pipe is active.
|
||||||
|
DCGM_FI_PROF_DRAM_ACTIVE, gauge, Ratio of cycles the device memory interface is active sending or receiving data.
|
||||||
|
DCGM_FI_PROF_PIPE_FP64_ACTIVE, gauge, Ratio of cycles the fp64 pipes are active.
|
||||||
|
DCGM_FI_PROF_PIPE_FP32_ACTIVE, gauge, Ratio of cycles the fp32 pipes are active.
|
||||||
|
DCGM_FI_PROF_PIPE_FP16_ACTIVE, gauge, Ratio of cycles the fp16 pipes are active.
|
||||||
|
DCGM_FI_PROF_PCIE_TX_BYTES, gauge, The rate of data transmitted over the PCIe bus - including both protocol headers and data payloads - in bytes per second.
|
||||||
|
DCGM_FI_PROF_PCIE_RX_BYTES, gauge, The rate of data received over the PCIe bus - including both protocol headers and data payloads - in bytes per second.
|
||||||
|
|
||||||
|
|
@ -0,0 +1,80 @@
|
||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
{{/*
|
||||||
|
Expand the name of the chart.
|
||||||
|
*/}}
|
||||||
|
{{- define "gpu-operator.name" -}}
|
||||||
|
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create a default fully qualified app name.
|
||||||
|
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||||
|
If release name contains chart name it will be used as a full name.
|
||||||
|
*/}}
|
||||||
|
{{- define "gpu-operator.fullname" -}}
|
||||||
|
{{- if .Values.fullnameOverride -}}
|
||||||
|
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||||
|
{{- if contains $name .Release.Name -}}
|
||||||
|
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create chart name and version as used by the chart label.
|
||||||
|
*/}}
|
||||||
|
{{- define "gpu-operator.chart" -}}
|
||||||
|
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Common labels
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- define "gpu-operator.labels" -}}
|
||||||
|
app.kubernetes.io/name: {{ include "gpu-operator.name" . }}
|
||||||
|
helm.sh/chart: {{ include "gpu-operator.chart" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
{{- if .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||||
|
{{- end }}
|
||||||
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||||
|
{{- if .Values.operator.labels }}
|
||||||
|
{{ toYaml .Values.operator.labels }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- define "gpu-operator.operand-labels" -}}
|
||||||
|
helm.sh/chart: {{ include "gpu-operator.chart" . }}
|
||||||
|
app.kubernetes.io/managed-by: {{ include "gpu-operator.name" . }}
|
||||||
|
{{- if .Values.daemonsets.labels }}
|
||||||
|
{{ toYaml .Values.daemonsets.labels }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- define "gpu-operator.matchLabels" -}}
|
||||||
|
app.kubernetes.io/name: {{ include "gpu-operator.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
{{- if .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||||
|
{{- end }}
|
||||||
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Full image name with tag
|
||||||
|
*/}}
|
||||||
|
{{- define "gpu-operator.fullimage" -}}
|
||||||
|
{{- .Values.operator.repository -}}/{{- .Values.operator.image -}}:{{- .Values.operator.version | default .Chart.AppVersion -}}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Full image name with tag
|
||||||
|
*/}}
|
||||||
|
{{- define "driver-manager.fullimage" -}}
|
||||||
|
{{- .Values.driver.manager.repository -}}/{{- .Values.driver.manager.image -}}:{{- .Values.driver.manager.version -}}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,50 @@
|
||||||
|
{{- if .Values.operator.cleanupCRD }}
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: Job
|
||||||
|
metadata:
|
||||||
|
name: gpu-operator-cleanup-crd
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
annotations:
|
||||||
|
"helm.sh/hook": pre-delete
|
||||||
|
"helm.sh/hook-weight": "1"
|
||||||
|
"helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
|
||||||
|
labels:
|
||||||
|
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: "gpu-operator"
|
||||||
|
spec:
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
name: gpu-operator-cleanup-crd
|
||||||
|
labels:
|
||||||
|
{{- include "gpu-operator.labels" . | nindent 8 }}
|
||||||
|
app.kubernetes.io/component: "gpu-operator"
|
||||||
|
spec:
|
||||||
|
serviceAccountName: gpu-operator
|
||||||
|
{{- if .Values.operator.imagePullSecrets }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- range .Values.operator.imagePullSecrets }}
|
||||||
|
- name: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.operator.tolerations }}
|
||||||
|
tolerations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
containers:
|
||||||
|
- name: cleanup-crd
|
||||||
|
image: {{ include "gpu-operator.fullimage" . }}
|
||||||
|
imagePullPolicy: {{ .Values.operator.imagePullPolicy }}
|
||||||
|
command:
|
||||||
|
- /bin/sh
|
||||||
|
- -c
|
||||||
|
- >
|
||||||
|
kubectl delete clusterpolicy cluster-policy;
|
||||||
|
kubectl delete crd clusterpolicies.nvidia.com;
|
||||||
|
kubectl delete crd nvidiadrivers.nvidia.com --ignore-not-found=true;
|
||||||
|
{{- if .Values.nfd.enabled -}}
|
||||||
|
kubectl delete crd nodefeatures.nfd.k8s-sigs.io --ignore-not-found=true;
|
||||||
|
kubectl delete crd nodefeaturegroups.nfd.k8s-sigs.io --ignore-not-found=true;
|
||||||
|
kubectl delete crd nodefeaturerules.nfd.k8s-sigs.io --ignore-not-found=true;
|
||||||
|
{{- end }}
|
||||||
|
restartPolicy: OnFailure
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,680 @@
|
||||||
|
apiVersion: nvidia.com/v1
|
||||||
|
kind: ClusterPolicy
|
||||||
|
metadata:
|
||||||
|
name: cluster-policy
|
||||||
|
labels:
|
||||||
|
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: "gpu-operator"
|
||||||
|
{{- if .Values.operator.cleanupCRD }}
|
||||||
|
# CR cleanup is handled during pre-delete hook
|
||||||
|
# Add below annotation so that helm doesn't attempt to cleanup CR twice
|
||||||
|
annotations:
|
||||||
|
"helm.sh/resource-policy": keep
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
hostPaths:
|
||||||
|
rootFS: {{ .Values.hostPaths.rootFS }}
|
||||||
|
driverInstallDir: {{ .Values.hostPaths.driverInstallDir }}
|
||||||
|
operator:
|
||||||
|
{{- if .Values.operator.runtimeClass }}
|
||||||
|
runtimeClass: {{ .Values.operator.runtimeClass }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.operator.defaultGPUMode }}
|
||||||
|
defaultGPUMode: {{ .Values.operator.defaultGPUMode }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.operator.initContainer }}
|
||||||
|
initContainer:
|
||||||
|
{{- if .Values.operator.initContainer.repository }}
|
||||||
|
repository: {{ .Values.operator.initContainer.repository }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.operator.initContainer.image }}
|
||||||
|
image: {{ .Values.operator.initContainer.image }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.operator.initContainer.version }}
|
||||||
|
version: {{ .Values.operator.initContainer.version | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.operator.initContainer.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ .Values.operator.initContainer.imagePullPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.operator.initContainer.imagePullSecrets }}
|
||||||
|
imagePullSecrets: {{ toYaml .Values.operator.initContainer.imagePullSecrets | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.operator.use_ocp_driver_toolkit }}
|
||||||
|
use_ocp_driver_toolkit: {{ .Values.operator.use_ocp_driver_toolkit }}
|
||||||
|
{{- end }}
|
||||||
|
daemonsets:
|
||||||
|
labels:
|
||||||
|
{{- include "gpu-operator.operand-labels" . | nindent 6 }}
|
||||||
|
{{- if .Values.daemonsets.annotations }}
|
||||||
|
annotations: {{ toYaml .Values.daemonsets.annotations | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.daemonsets.tolerations }}
|
||||||
|
tolerations: {{ toYaml .Values.daemonsets.tolerations | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.daemonsets.priorityClassName }}
|
||||||
|
priorityClassName: {{ .Values.daemonsets.priorityClassName }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.daemonsets.updateStrategy }}
|
||||||
|
updateStrategy: {{ .Values.daemonsets.updateStrategy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.daemonsets.rollingUpdate }}
|
||||||
|
rollingUpdate:
|
||||||
|
maxUnavailable: {{ .Values.daemonsets.rollingUpdate.maxUnavailable | quote }}
|
||||||
|
{{- end }}
|
||||||
|
validator:
|
||||||
|
{{- if .Values.validator.repository }}
|
||||||
|
repository: {{ .Values.validator.repository }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.validator.image }}
|
||||||
|
image: {{ .Values.validator.image }}
|
||||||
|
{{- end }}
|
||||||
|
version: {{ .Values.validator.version | default .Chart.AppVersion | quote }}
|
||||||
|
{{- if .Values.validator.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ .Values.validator.imagePullPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.validator.imagePullSecrets }}
|
||||||
|
imagePullSecrets: {{ toYaml .Values.validator.imagePullSecrets | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.validator.resources }}
|
||||||
|
resources: {{ toYaml .Values.validator.resources | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.validator.env }}
|
||||||
|
env: {{ toYaml .Values.validator.env | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.validator.args }}
|
||||||
|
args: {{ toYaml .Values.validator.args | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.validator.plugin }}
|
||||||
|
plugin:
|
||||||
|
{{- if .Values.validator.plugin.env }}
|
||||||
|
env: {{ toYaml .Values.validator.plugin.env | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.validator.cuda }}
|
||||||
|
cuda:
|
||||||
|
{{- if .Values.validator.cuda.env }}
|
||||||
|
env: {{ toYaml .Values.validator.cuda.env | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.validator.driver }}
|
||||||
|
driver:
|
||||||
|
{{- if .Values.validator.driver.env }}
|
||||||
|
env: {{ toYaml .Values.validator.driver.env | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.validator.toolkit }}
|
||||||
|
toolkit:
|
||||||
|
{{- if .Values.validator.toolkit.env }}
|
||||||
|
env: {{ toYaml .Values.validator.toolkit.env | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.validator.vfioPCI }}
|
||||||
|
vfioPCI:
|
||||||
|
{{- if .Values.validator.vfioPCI.env }}
|
||||||
|
env: {{ toYaml .Values.validator.vfioPCI.env | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.validator.vgpuManager }}
|
||||||
|
vgpuManager:
|
||||||
|
{{- if .Values.validator.vgpuManager.env }}
|
||||||
|
env: {{ toYaml .Values.validator.vgpuManager.env | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.validator.vgpuDevices }}
|
||||||
|
vgpuDevices:
|
||||||
|
{{- if .Values.validator.vgpuDevices.env }}
|
||||||
|
env: {{ toYaml .Values.validator.vgpuDevices.env | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
mig:
|
||||||
|
{{- if .Values.mig.strategy }}
|
||||||
|
strategy: {{ .Values.mig.strategy }}
|
||||||
|
{{- end }}
|
||||||
|
psa:
|
||||||
|
enabled: {{ .Values.psa.enabled }}
|
||||||
|
cdi:
|
||||||
|
enabled: {{ .Values.cdi.enabled }}
|
||||||
|
default: {{ .Values.cdi.default }}
|
||||||
|
driver:
|
||||||
|
enabled: {{ .Values.driver.enabled }}
|
||||||
|
useNvidiaDriverCRD: {{ .Values.driver.nvidiaDriverCRD.enabled }}
|
||||||
|
kernelModuleType: {{ .Values.driver.kernelModuleType }}
|
||||||
|
usePrecompiled: {{ .Values.driver.usePrecompiled }}
|
||||||
|
{{- if .Values.driver.repository }}
|
||||||
|
repository: {{ .Values.driver.repository }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.image }}
|
||||||
|
image: {{ .Values.driver.image }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.version }}
|
||||||
|
version: {{ .Values.driver.version | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ .Values.driver.imagePullPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.imagePullSecrets }}
|
||||||
|
imagePullSecrets: {{ toYaml .Values.driver.imagePullSecrets | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.startupProbe }}
|
||||||
|
startupProbe: {{ toYaml .Values.driver.startupProbe | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.livenessProbe }}
|
||||||
|
livenessProbe: {{ toYaml .Values.driver.livenessProbe | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.readinessProbe }}
|
||||||
|
readinessProbe: {{ toYaml .Values.driver.readinessProbe | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
rdma:
|
||||||
|
enabled: {{ .Values.driver.rdma.enabled }}
|
||||||
|
useHostMofed: {{ .Values.driver.rdma.useHostMofed }}
|
||||||
|
manager:
|
||||||
|
{{- if .Values.driver.manager.repository }}
|
||||||
|
repository: {{ .Values.driver.manager.repository }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.manager.image }}
|
||||||
|
image: {{ .Values.driver.manager.image }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.manager.version }}
|
||||||
|
version: {{ .Values.driver.manager.version | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.manager.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ .Values.driver.manager.imagePullPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.manager.env }}
|
||||||
|
env: {{ toYaml .Values.driver.manager.env | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.repoConfig }}
|
||||||
|
repoConfig: {{ toYaml .Values.driver.repoConfig | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.certConfig }}
|
||||||
|
certConfig: {{ toYaml .Values.driver.certConfig | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.licensingConfig }}
|
||||||
|
licensingConfig: {{ toYaml .Values.driver.licensingConfig | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.virtualTopology }}
|
||||||
|
virtualTopology: {{ toYaml .Values.driver.virtualTopology | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.kernelModuleConfig }}
|
||||||
|
kernelModuleConfig: {{ toYaml .Values.driver.kernelModuleConfig | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.resources }}
|
||||||
|
resources: {{ toYaml .Values.driver.resources | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.env }}
|
||||||
|
env: {{ toYaml .Values.driver.env | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.args }}
|
||||||
|
args: {{ toYaml .Values.driver.args | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.upgradePolicy }}
|
||||||
|
upgradePolicy:
|
||||||
|
autoUpgrade: {{ .Values.driver.upgradePolicy.autoUpgrade | default false }}
|
||||||
|
maxParallelUpgrades: {{ .Values.driver.upgradePolicy.maxParallelUpgrades | default 0 }}
|
||||||
|
maxUnavailable : {{ .Values.driver.upgradePolicy.maxUnavailable | default "25%" }}
|
||||||
|
waitForCompletion:
|
||||||
|
timeoutSeconds: {{ .Values.driver.upgradePolicy.waitForCompletion.timeoutSeconds }}
|
||||||
|
{{- if .Values.driver.upgradePolicy.waitForCompletion.podSelector }}
|
||||||
|
podSelector: {{ .Values.driver.upgradePolicy.waitForCompletion.podSelector }}
|
||||||
|
{{- end }}
|
||||||
|
podDeletion:
|
||||||
|
force: {{ .Values.driver.upgradePolicy.gpuPodDeletion.force | default false }}
|
||||||
|
timeoutSeconds: {{ .Values.driver.upgradePolicy.gpuPodDeletion.timeoutSeconds }}
|
||||||
|
deleteEmptyDir: {{ .Values.driver.upgradePolicy.gpuPodDeletion.deleteEmptyDir | default false }}
|
||||||
|
drain:
|
||||||
|
enable: {{ .Values.driver.upgradePolicy.drain.enable | default false }}
|
||||||
|
force: {{ .Values.driver.upgradePolicy.drain.force | default false }}
|
||||||
|
{{- if .Values.driver.upgradePolicy.drain.podSelector }}
|
||||||
|
podSelector: {{ .Values.driver.upgradePolicy.drain.podSelector }}
|
||||||
|
{{- end }}
|
||||||
|
timeoutSeconds: {{ .Values.driver.upgradePolicy.drain.timeoutSeconds }}
|
||||||
|
deleteEmptyDir: {{ .Values.driver.upgradePolicy.drain.deleteEmptyDir | default false}}
|
||||||
|
{{- end }}
|
||||||
|
vgpuManager:
|
||||||
|
enabled: {{ .Values.vgpuManager.enabled }}
|
||||||
|
{{- if .Values.vgpuManager.repository }}
|
||||||
|
repository: {{ .Values.vgpuManager.repository }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vgpuManager.image }}
|
||||||
|
image: {{ .Values.vgpuManager.image }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vgpuManager.version }}
|
||||||
|
version: {{ .Values.vgpuManager.version | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vgpuManager.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ .Values.vgpuManager.imagePullPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vgpuManager.imagePullSecrets }}
|
||||||
|
imagePullSecrets: {{ toYaml .Values.vgpuManager.imagePullSecrets | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vgpuManager.resources }}
|
||||||
|
resources: {{ toYaml .Values.vgpuManager.resources | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vgpuManager.env }}
|
||||||
|
env: {{ toYaml .Values.vgpuManager.env | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vgpuManager.args }}
|
||||||
|
args: {{ toYaml .Values.vgpuManager.args | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
driverManager:
|
||||||
|
{{- if .Values.vgpuManager.driverManager.repository }}
|
||||||
|
repository: {{ .Values.vgpuManager.driverManager.repository }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vgpuManager.driverManager.image }}
|
||||||
|
image: {{ .Values.vgpuManager.driverManager.image }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vgpuManager.driverManager.version }}
|
||||||
|
version: {{ .Values.vgpuManager.driverManager.version | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vgpuManager.driverManager.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ .Values.vgpuManager.driverManager.imagePullPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vgpuManager.driverManager.env }}
|
||||||
|
env: {{ toYaml .Values.vgpuManager.driverManager.env | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
kataManager:
|
||||||
|
enabled: {{ .Values.kataManager.enabled }}
|
||||||
|
config: {{ toYaml .Values.kataManager.config | nindent 6 }}
|
||||||
|
{{- if .Values.kataManager.repository }}
|
||||||
|
repository: {{ .Values.kataManager.repository }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.kataManager.image }}
|
||||||
|
image: {{ .Values.kataManager.image }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.kataManager.version }}
|
||||||
|
version: {{ .Values.kataManager.version | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.kataManager.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ .Values.kataManager.imagePullPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.kataManager.imagePullSecrets }}
|
||||||
|
imagePullSecrets: {{ toYaml .Values.kataManager.imagePullSecrets | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.kataManager.resources }}
|
||||||
|
resources: {{ toYaml .Values.kataManager.resources | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.kataManager.env }}
|
||||||
|
env: {{ toYaml .Values.kataManager.env | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.kataManager.args }}
|
||||||
|
args: {{ toYaml .Values.kataManager.args | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
vfioManager:
|
||||||
|
enabled: {{ .Values.vfioManager.enabled }}
|
||||||
|
{{- if .Values.vfioManager.repository }}
|
||||||
|
repository: {{ .Values.vfioManager.repository }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vfioManager.image }}
|
||||||
|
image: {{ .Values.vfioManager.image }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vfioManager.version }}
|
||||||
|
version: {{ .Values.vfioManager.version | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vfioManager.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ .Values.vfioManager.imagePullPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vfioManager.imagePullSecrets }}
|
||||||
|
imagePullSecrets: {{ toYaml .Values.vfioManager.imagePullSecrets | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vfioManager.resources }}
|
||||||
|
resources: {{ toYaml .Values.vfioManager.resources | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vfioManager.env }}
|
||||||
|
env: {{ toYaml .Values.vfioManager.env | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vfioManager.args }}
|
||||||
|
args: {{ toYaml .Values.vfioManager.args | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
driverManager:
|
||||||
|
{{- if .Values.vfioManager.driverManager.repository }}
|
||||||
|
repository: {{ .Values.vfioManager.driverManager.repository }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vfioManager.driverManager.image }}
|
||||||
|
image: {{ .Values.vfioManager.driverManager.image }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vfioManager.driverManager.version }}
|
||||||
|
version: {{ .Values.vfioManager.driverManager.version | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vfioManager.driverManager.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ .Values.vfioManager.driverManager.imagePullPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vfioManager.driverManager.env }}
|
||||||
|
env: {{ toYaml .Values.vfioManager.driverManager.env | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
vgpuDeviceManager:
|
||||||
|
enabled: {{ .Values.vgpuDeviceManager.enabled }}
|
||||||
|
{{- if .Values.vgpuDeviceManager.repository }}
|
||||||
|
repository: {{ .Values.vgpuDeviceManager.repository }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vgpuDeviceManager.image }}
|
||||||
|
image: {{ .Values.vgpuDeviceManager.image }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vgpuDeviceManager.version }}
|
||||||
|
version: {{ .Values.vgpuDeviceManager.version | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vgpuDeviceManager.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ .Values.vgpuDeviceManager.imagePullPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vgpuDeviceManager.imagePullSecrets }}
|
||||||
|
imagePullSecrets: {{ toYaml .Values.vgpuDeviceManager.imagePullSecrets | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vgpuDeviceManager.resources }}
|
||||||
|
resources: {{ toYaml .Values.vgpuDeviceManager.resources | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vgpuDeviceManager.env }}
|
||||||
|
env: {{ toYaml .Values.vgpuDeviceManager.env | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vgpuDeviceManager.args }}
|
||||||
|
args: {{ toYaml .Values.vgpuDeviceManager.args | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.vgpuDeviceManager.config }}
|
||||||
|
config: {{ toYaml .Values.vgpuDeviceManager.config | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
ccManager:
|
||||||
|
enabled: {{ .Values.ccManager.enabled }}
|
||||||
|
defaultMode: {{ .Values.ccManager.defaultMode | quote }}
|
||||||
|
{{- if .Values.ccManager.repository }}
|
||||||
|
repository: {{ .Values.ccManager.repository }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.ccManager.image }}
|
||||||
|
image: {{ .Values.ccManager.image }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.ccManager.version }}
|
||||||
|
version: {{ .Values.ccManager.version | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.ccManager.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ .Values.ccManager.imagePullPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.ccManager.imagePullSecrets }}
|
||||||
|
imagePullSecrets: {{ toYaml .Values.ccManager.imagePullSecrets | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.ccManager.resources }}
|
||||||
|
resources: {{ toYaml .Values.ccManager.resources | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.ccManager.env }}
|
||||||
|
env: {{ toYaml .Values.vfioManager.env | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.ccManager.args }}
|
||||||
|
args: {{ toYaml .Values.ccManager.args | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
toolkit:
|
||||||
|
enabled: {{ .Values.toolkit.enabled }}
|
||||||
|
{{- if .Values.toolkit.repository }}
|
||||||
|
repository: {{ .Values.toolkit.repository }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.toolkit.image }}
|
||||||
|
image: {{ .Values.toolkit.image }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.toolkit.version }}
|
||||||
|
version: {{ .Values.toolkit.version | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.toolkit.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ .Values.toolkit.imagePullPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.toolkit.imagePullSecrets }}
|
||||||
|
imagePullSecrets: {{ toYaml .Values.toolkit.imagePullSecrets | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.toolkit.resources }}
|
||||||
|
resources: {{ toYaml .Values.toolkit.resources | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.toolkit.env }}
|
||||||
|
env: {{ toYaml .Values.toolkit.env | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.toolkit.installDir }}
|
||||||
|
installDir: {{ .Values.toolkit.installDir }}
|
||||||
|
{{- end }}
|
||||||
|
devicePlugin:
|
||||||
|
enabled: {{ .Values.devicePlugin.enabled }}
|
||||||
|
{{- if .Values.devicePlugin.repository }}
|
||||||
|
repository: {{ .Values.devicePlugin.repository }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.devicePlugin.image }}
|
||||||
|
image: {{ .Values.devicePlugin.image }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.devicePlugin.version }}
|
||||||
|
version: {{ .Values.devicePlugin.version | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.devicePlugin.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ .Values.devicePlugin.imagePullPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.devicePlugin.imagePullSecrets }}
|
||||||
|
imagePullSecrets: {{ toYaml .Values.devicePlugin.imagePullSecrets | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.devicePlugin.resources }}
|
||||||
|
resources: {{ toYaml .Values.devicePlugin.resources | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.devicePlugin.env }}
|
||||||
|
env: {{ toYaml .Values.devicePlugin.env | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.devicePlugin.args }}
|
||||||
|
args: {{ toYaml .Values.devicePlugin.args | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.devicePlugin.config.name }}
|
||||||
|
config:
|
||||||
|
name: {{ .Values.devicePlugin.config.name }}
|
||||||
|
default: {{ .Values.devicePlugin.config.default }}
|
||||||
|
{{- end }}
|
||||||
|
dcgm:
|
||||||
|
enabled: {{ .Values.dcgm.enabled }}
|
||||||
|
{{- if .Values.dcgm.repository }}
|
||||||
|
repository: {{ .Values.dcgm.repository }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.dcgm.image }}
|
||||||
|
image: {{ .Values.dcgm.image }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.dcgm.version }}
|
||||||
|
version: {{ .Values.dcgm.version | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.dcgm.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ .Values.dcgm.imagePullPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.dcgm.imagePullSecrets }}
|
||||||
|
imagePullSecrets: {{ toYaml .Values.dcgm.imagePullSecrets | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.dcgm.resources }}
|
||||||
|
resources: {{ toYaml .Values.dcgm.resources | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.dcgm.env }}
|
||||||
|
env: {{ toYaml .Values.dcgm.env | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.dcgm.args }}
|
||||||
|
args: {{ toYaml .Values.dcgm.args | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
dcgmExporter:
|
||||||
|
enabled: {{ .Values.dcgmExporter.enabled }}
|
||||||
|
{{- if .Values.dcgmExporter.repository }}
|
||||||
|
repository: {{ .Values.dcgmExporter.repository }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.dcgmExporter.image }}
|
||||||
|
image: {{ .Values.dcgmExporter.image }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.dcgmExporter.version }}
|
||||||
|
version: {{ .Values.dcgmExporter.version | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.dcgmExporter.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ .Values.dcgmExporter.imagePullPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.dcgmExporter.imagePullSecrets }}
|
||||||
|
imagePullSecrets: {{ toYaml .Values.dcgmExporter.imagePullSecrets | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.dcgmExporter.resources }}
|
||||||
|
resources: {{ toYaml .Values.dcgmExporter.resources | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.dcgmExporter.env }}
|
||||||
|
env: {{ toYaml .Values.dcgmExporter.env | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.dcgmExporter.args }}
|
||||||
|
args: {{ toYaml .Values.dcgmExporter.args | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and (.Values.dcgmExporter.config) (.Values.dcgmExporter.config.name) }}
|
||||||
|
config:
|
||||||
|
name: {{ .Values.dcgmExporter.config.name }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.dcgmExporter.serviceMonitor }}
|
||||||
|
serviceMonitor: {{ toYaml .Values.dcgmExporter.serviceMonitor | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
gfd:
|
||||||
|
enabled: {{ .Values.gfd.enabled }}
|
||||||
|
{{- if .Values.gfd.repository }}
|
||||||
|
repository: {{ .Values.gfd.repository }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gfd.image }}
|
||||||
|
image: {{ .Values.gfd.image }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gfd.version }}
|
||||||
|
version: {{ .Values.gfd.version | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gfd.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ .Values.gfd.imagePullPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gfd.imagePullSecrets }}
|
||||||
|
imagePullSecrets: {{ toYaml .Values.gfd.imagePullSecrets | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gfd.resources }}
|
||||||
|
resources: {{ toYaml .Values.gfd.resources | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gfd.env }}
|
||||||
|
env: {{ toYaml .Values.gfd.env | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gfd.args }}
|
||||||
|
args: {{ toYaml .Values.gfd.args | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
migManager:
|
||||||
|
enabled: {{ .Values.migManager.enabled }}
|
||||||
|
{{- if .Values.migManager.repository }}
|
||||||
|
repository: {{ .Values.migManager.repository }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.migManager.image }}
|
||||||
|
image: {{ .Values.migManager.image }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.migManager.version }}
|
||||||
|
version: {{ .Values.migManager.version | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.migManager.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ .Values.migManager.imagePullPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.migManager.imagePullSecrets }}
|
||||||
|
imagePullSecrets: {{ toYaml .Values.migManager.imagePullSecrets | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.migManager.resources }}
|
||||||
|
resources: {{ toYaml .Values.migManager.resources | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.migManager.env }}
|
||||||
|
env: {{ toYaml .Values.migManager.env | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.migManager.args }}
|
||||||
|
args: {{ toYaml .Values.migManager.args | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.migManager.config }}
|
||||||
|
config:
|
||||||
|
name: {{ .Values.migManager.config.name }}
|
||||||
|
default: {{ .Values.migManager.config.default }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.migManager.gpuClientsConfig }}
|
||||||
|
gpuClientsConfig: {{ toYaml .Values.migManager.gpuClientsConfig | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
nodeStatusExporter:
|
||||||
|
enabled: {{ .Values.nodeStatusExporter.enabled }}
|
||||||
|
{{- if .Values.nodeStatusExporter.repository }}
|
||||||
|
repository: {{ .Values.nodeStatusExporter.repository }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.nodeStatusExporter.image }}
|
||||||
|
image: {{ .Values.nodeStatusExporter.image }}
|
||||||
|
{{- end }}
|
||||||
|
version: {{ .Values.nodeStatusExporter.version | default .Chart.AppVersion | quote }}
|
||||||
|
{{- if .Values.nodeStatusExporter.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ .Values.nodeStatusExporter.imagePullPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.nodeStatusExporter.imagePullSecrets }}
|
||||||
|
imagePullSecrets: {{ toYaml .Values.nodeStatusExporter.imagePullSecrets | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.nodeStatusExporter.resources }}
|
||||||
|
resources: {{ toYaml .Values.nodeStatusExporter.resources | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.nodeStatusExporter.env }}
|
||||||
|
env: {{ toYaml .Values.nodeStatusExporter.env | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.nodeStatusExporter.args }}
|
||||||
|
args: {{ toYaml .Values.nodeStatusExporter.args | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gds.enabled }}
|
||||||
|
gds:
|
||||||
|
enabled: {{ .Values.gds.enabled }}
|
||||||
|
{{- if .Values.gds.repository }}
|
||||||
|
repository: {{ .Values.gds.repository }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gds.image }}
|
||||||
|
image: {{ .Values.gds.image }}
|
||||||
|
{{- end }}
|
||||||
|
version: {{ .Values.gds.version | quote }}
|
||||||
|
{{- if .Values.gds.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ .Values.gds.imagePullPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gds.imagePullSecrets }}
|
||||||
|
imagePullSecrets: {{ toYaml .Values.gds.imagePullSecrets | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gds.env }}
|
||||||
|
env: {{ toYaml .Values.gds.env | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gds.args }}
|
||||||
|
args: {{ toYaml .Values.gds.args | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gdrcopy }}
|
||||||
|
gdrcopy:
|
||||||
|
enabled: {{ .Values.gdrcopy.enabled | default false }}
|
||||||
|
{{- if .Values.gdrcopy.repository }}
|
||||||
|
repository: {{ .Values.gdrcopy.repository }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gdrcopy.image }}
|
||||||
|
image: {{ .Values.gdrcopy.image }}
|
||||||
|
{{- end }}
|
||||||
|
version: {{ .Values.gdrcopy.version | quote }}
|
||||||
|
{{- if .Values.gdrcopy.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ .Values.gdrcopy.imagePullPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gdrcopy.imagePullSecrets }}
|
||||||
|
imagePullSecrets: {{ toYaml .Values.gdrcopy.imagePullSecrets | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gdrcopy.env }}
|
||||||
|
env: {{ toYaml .Values.gdrcopy.env | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gdrcopy.args }}
|
||||||
|
args: {{ toYaml .Values.gdrcopy.args | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
sandboxWorkloads:
|
||||||
|
enabled: {{ .Values.sandboxWorkloads.enabled }}
|
||||||
|
{{- if .Values.sandboxWorkloads.defaultWorkload }}
|
||||||
|
defaultWorkload: {{ .Values.sandboxWorkloads.defaultWorkload }}
|
||||||
|
{{- end }}
|
||||||
|
sandboxDevicePlugin:
|
||||||
|
{{- if .Values.sandboxDevicePlugin.enabled }}
|
||||||
|
enabled: {{ .Values.sandboxDevicePlugin.enabled }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.sandboxDevicePlugin.repository }}
|
||||||
|
repository: {{ .Values.sandboxDevicePlugin.repository }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.sandboxDevicePlugin.image }}
|
||||||
|
image: {{ .Values.sandboxDevicePlugin.image }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.sandboxDevicePlugin.version }}
|
||||||
|
version: {{ .Values.sandboxDevicePlugin.version | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.sandboxDevicePlugin.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ .Values.sandboxDevicePlugin.imagePullPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.sandboxDevicePlugin.imagePullSecrets }}
|
||||||
|
imagePullSecrets: {{ toYaml .Values.sandboxDevicePlugin.imagePullSecrets | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.sandboxDevicePlugin.resources }}
|
||||||
|
resources: {{ toYaml .Values.sandboxDevicePlugin.resources | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.sandboxDevicePlugin.env }}
|
||||||
|
env: {{ toYaml .Values.sandboxDevicePlugin.env | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.sandboxDevicePlugin.args }}
|
||||||
|
args: {{ toYaml .Values.sandboxDevicePlugin.args | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,155 @@
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: gpu-operator
|
||||||
|
labels:
|
||||||
|
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: "gpu-operator"
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- config.openshift.io
|
||||||
|
resources:
|
||||||
|
- clusterversions
|
||||||
|
- proxies
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- image.openshift.io
|
||||||
|
resources:
|
||||||
|
- imagestreams
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- security.openshift.io
|
||||||
|
resources:
|
||||||
|
- securitycontextconstraints
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- update
|
||||||
|
- patch
|
||||||
|
- delete
|
||||||
|
- use
|
||||||
|
- apiGroups:
|
||||||
|
- rbac.authorization.k8s.io
|
||||||
|
resources:
|
||||||
|
- clusterroles
|
||||||
|
- clusterrolebindings
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- update
|
||||||
|
- patch
|
||||||
|
- delete
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- nodes
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- update
|
||||||
|
- patch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- namespaces
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- update
|
||||||
|
- patch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- delete
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- pods
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- pods/eviction
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- apiGroups:
|
||||||
|
- apps
|
||||||
|
resources:
|
||||||
|
- daemonsets
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- nvidia.com
|
||||||
|
resources:
|
||||||
|
- clusterpolicies
|
||||||
|
- clusterpolicies/finalizers
|
||||||
|
- clusterpolicies/status
|
||||||
|
- nvidiadrivers
|
||||||
|
- nvidiadrivers/finalizers
|
||||||
|
- nvidiadrivers/status
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- update
|
||||||
|
- patch
|
||||||
|
- delete
|
||||||
|
- deletecollection
|
||||||
|
- apiGroups:
|
||||||
|
- scheduling.k8s.io
|
||||||
|
resources:
|
||||||
|
- priorityclasses
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- create
|
||||||
|
- apiGroups:
|
||||||
|
- node.k8s.io
|
||||||
|
resources:
|
||||||
|
- runtimeclasses
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- create
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- delete
|
||||||
|
- apiGroups:
|
||||||
|
- apiextensions.k8s.io
|
||||||
|
resources:
|
||||||
|
- customresourcedefinitions
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- update
|
||||||
|
- patch
|
||||||
|
- create
|
||||||
|
{{- if .Values.operator.cleanupCRD }}
|
||||||
|
- delete
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,15 @@
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: gpu-operator
|
||||||
|
labels:
|
||||||
|
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: "gpu-operator"
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: gpu-operator
|
||||||
|
namespace: {{ $.Release.Namespace }}
|
||||||
|
roleRef:
|
||||||
|
kind: ClusterRole
|
||||||
|
name: gpu-operator
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
|
@ -0,0 +1,14 @@
|
||||||
|
{{- if .Values.dcgmExporter.config }}
|
||||||
|
{{- if and (.Values.dcgmExporter.config.create) (not (empty .Values.dcgmExporter.config.data)) }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ .Values.dcgmExporter.config.name }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||||
|
data:
|
||||||
|
dcgm-metrics.csv: |
|
||||||
|
{{- .Values.dcgmExporter.config.data | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,10 @@
|
||||||
|
{{- if and (.Values.migManager.config.create) (not (empty .Values.migManager.config.data)) }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ .Values.migManager.config.name }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||||
|
data: {{ toYaml .Values.migManager.config.data | nindent 2 }}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,107 @@
|
||||||
|
{{- if .Values.nfd.nodefeaturerules }}
|
||||||
|
apiVersion: nfd.k8s-sigs.io/v1alpha1
|
||||||
|
kind: NodeFeatureRule
|
||||||
|
metadata:
|
||||||
|
name: nvidia-nfd-nodefeaturerules
|
||||||
|
spec:
|
||||||
|
rules:
|
||||||
|
- name: "TDX rule"
|
||||||
|
labels:
|
||||||
|
tdx.enabled: "true"
|
||||||
|
matchFeatures:
|
||||||
|
- feature: cpu.security
|
||||||
|
matchExpressions:
|
||||||
|
tdx.enabled: {op: IsTrue}
|
||||||
|
- name: "TDX total keys rule"
|
||||||
|
extendedResources:
|
||||||
|
tdx.total_keys: "@cpu.security.tdx.total_keys"
|
||||||
|
matchFeatures:
|
||||||
|
- feature: cpu.security
|
||||||
|
matchExpressions:
|
||||||
|
tdx.enabled: {op: IsTrue}
|
||||||
|
- name: "SEV-SNP rule"
|
||||||
|
labels:
|
||||||
|
sev.snp.enabled: "true"
|
||||||
|
matchFeatures:
|
||||||
|
- feature: cpu.security
|
||||||
|
matchExpressions:
|
||||||
|
sev.snp.enabled:
|
||||||
|
op: IsTrue
|
||||||
|
- name: "SEV-ES rule"
|
||||||
|
labels:
|
||||||
|
sev.es.enabled: "true"
|
||||||
|
matchFeatures:
|
||||||
|
- feature: cpu.security
|
||||||
|
matchExpressions:
|
||||||
|
sev.es.enabled:
|
||||||
|
op: IsTrue
|
||||||
|
- name: SEV system capacities
|
||||||
|
extendedResources:
|
||||||
|
sev_asids: '@cpu.security.sev.asids'
|
||||||
|
sev_es: '@cpu.security.sev.encrypted_state_ids'
|
||||||
|
matchFeatures:
|
||||||
|
- feature: cpu.security
|
||||||
|
matchExpressions:
|
||||||
|
sev.enabled:
|
||||||
|
op: Exists
|
||||||
|
- name: "NVIDIA H100"
|
||||||
|
labels:
|
||||||
|
"nvidia.com/gpu.H100": "true"
|
||||||
|
"nvidia.com/gpu.family": "hopper"
|
||||||
|
matchFeatures:
|
||||||
|
- feature: pci.device
|
||||||
|
matchExpressions:
|
||||||
|
vendor: {op: In, value: ["10de"]}
|
||||||
|
device: {op: In, value: ["2339"]}
|
||||||
|
- name: "NVIDIA H100 PCIe"
|
||||||
|
labels:
|
||||||
|
"nvidia.com/gpu.H100.pcie": "true"
|
||||||
|
"nvidia.com/gpu.family": "hopper"
|
||||||
|
matchFeatures:
|
||||||
|
- feature: pci.device
|
||||||
|
matchExpressions:
|
||||||
|
vendor: {op: In, value: ["10de"]}
|
||||||
|
device: {op: In, value: ["2331"]}
|
||||||
|
- name: "NVIDIA H100 80GB HBM3"
|
||||||
|
labels:
|
||||||
|
"nvidia.com/gpu.H100.HBM3": "true"
|
||||||
|
"nvidia.com/gpu.family": "hopper"
|
||||||
|
matchFeatures:
|
||||||
|
- feature: pci.device
|
||||||
|
matchExpressions:
|
||||||
|
vendor: {op: In, value: ["10de"]}
|
||||||
|
device: {op: In, value: ["2330"]}
|
||||||
|
- name: "NVIDIA H800"
|
||||||
|
labels:
|
||||||
|
"nvidia.com/gpu.H800": "true"
|
||||||
|
"nvidia.com/gpu.family": "hopper"
|
||||||
|
matchFeatures:
|
||||||
|
- feature: pci.device
|
||||||
|
matchExpressions:
|
||||||
|
vendor: {op: In, value: ["10de"]}
|
||||||
|
device: {op: In, value: ["2324"]}
|
||||||
|
- name: "NVIDIA H800 PCIE"
|
||||||
|
labels:
|
||||||
|
"nvidia.com/gpu.H800.pcie": "true"
|
||||||
|
"nvidia.com/gpu.family": "hopper"
|
||||||
|
matchFeatures:
|
||||||
|
- feature: pci.device
|
||||||
|
matchExpressions:
|
||||||
|
vendor: {op: In, value: ["10de"]}
|
||||||
|
device: {op: In, value: ["2322"]}
|
||||||
|
- name: "NVIDIA CC Enabled"
|
||||||
|
labels:
|
||||||
|
"nvidia.com/cc.capable": "true"
|
||||||
|
matchAny: # TDX/SEV + Hopper GPU
|
||||||
|
- matchFeatures:
|
||||||
|
- feature: rule.matched
|
||||||
|
matchExpressions:
|
||||||
|
nvidia.com/gpu.family: {op: In, value: ["hopper"]}
|
||||||
|
sev.snp.enabled: {op: IsTrue}
|
||||||
|
- matchFeatures:
|
||||||
|
- feature: rule.matched
|
||||||
|
matchExpressions:
|
||||||
|
nvidia.com/gpu.family: {op: In, value: ["hopper"]}
|
||||||
|
tdx.enabled: {op: IsTrue}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
|
@ -0,0 +1,119 @@
|
||||||
|
{{- if and .Values.driver.nvidiaDriverCRD.enabled .Values.driver.nvidiaDriverCRD.deployDefaultCR }}
|
||||||
|
apiVersion: nvidia.com/v1alpha1
|
||||||
|
kind: NVIDIADriver
|
||||||
|
metadata:
|
||||||
|
name: default
|
||||||
|
spec:
|
||||||
|
repository: {{ .Values.driver.repository }}
|
||||||
|
image: {{ .Values.driver.image }}
|
||||||
|
version: {{ .Values.driver.version }}
|
||||||
|
kernelModuleType: {{ .Values.driver.kernelModuleType }}
|
||||||
|
usePrecompiled: {{ .Values.driver.usePrecompiled }}
|
||||||
|
driverType: {{ .Values.driver.nvidiaDriverCRD.driverType | default "gpu" }}
|
||||||
|
{{- if .Values.daemonsets.annotations }}
|
||||||
|
annotations: {{ toYaml .Values.daemonsets.annotations | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.daemonsets.labels }}
|
||||||
|
labels: {{ toYaml .Values.daemonsets.labels | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.nvidiaDriverCRD.nodeSelector }}
|
||||||
|
nodeSelector: {{ toYaml .Values.driver.nvidiaDriverCRD.nodeSelector | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.imagePullSecrets }}
|
||||||
|
imagePullSecrets: {{ toYaml .Values.driver.imagePullSecrets | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.manager }}
|
||||||
|
manager: {{ toYaml .Values.driver.manager | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.startupProbe }}
|
||||||
|
startupProbe: {{ toYaml .Values.driver.startupProbe | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.livenessProbe }}
|
||||||
|
livenessProbe: {{ toYaml .Values.driver.livenessProbe | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.readinessProbe }}
|
||||||
|
readinessProbe: {{ toYaml .Values.driver.readinessProbe | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
rdma:
|
||||||
|
enabled: {{ .Values.driver.rdma.enabled }}
|
||||||
|
useHostMofed: {{ .Values.driver.rdma.useHostMofed }}
|
||||||
|
{{- if .Values.daemonsets.tolerations }}
|
||||||
|
tolerations: {{ toYaml .Values.daemonsets.tolerations | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.repoConfig.configMapName }}
|
||||||
|
repoConfig:
|
||||||
|
name: {{ .Values.driver.repoConfig.configMapName }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.certConfig.name }}
|
||||||
|
certConfig:
|
||||||
|
name: {{ .Values.driver.certConfig.name }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.licensingConfig.configMapName }}
|
||||||
|
licensingConfig:
|
||||||
|
name: {{ .Values.driver.licensingConfig.configMapName }}
|
||||||
|
nlsEnabled: {{ .Values.driver.licensingConfig.nlsEnabled | default true }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.virtualTopology.config }}
|
||||||
|
virtualTopologyConfig:
|
||||||
|
name: {{ .Values.driver.virtualTopology.config }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.kernelModuleConfig.name }}
|
||||||
|
kernelModuleConfig:
|
||||||
|
name: {{ .Values.driver.kernelModuleConfig.name }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.resources }}
|
||||||
|
resources: {{ toYaml .Values.driver.resources | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.env }}
|
||||||
|
env: {{ toYaml .Values.driver.env | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.driver.args }}
|
||||||
|
args: {{ toYaml .Values.driver.args | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gds.enabled }}
|
||||||
|
gds:
|
||||||
|
enabled: {{ .Values.gds.enabled }}
|
||||||
|
{{- if .Values.gds.repository }}
|
||||||
|
repository: {{ .Values.gds.repository }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gds.image }}
|
||||||
|
image: {{ .Values.gds.image }}
|
||||||
|
{{- end }}
|
||||||
|
version: {{ .Values.gds.version | quote }}
|
||||||
|
{{- if .Values.gds.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ .Values.gds.imagePullPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gds.imagePullSecrets }}
|
||||||
|
imagePullSecrets: {{ toYaml .Values.gds.imagePullSecrets | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gds.env }}
|
||||||
|
env: {{ toYaml .Values.gds.env | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gds.args }}
|
||||||
|
args: {{ toYaml .Values.gds.args | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gdrcopy }}
|
||||||
|
gdrcopy:
|
||||||
|
enabled: {{ .Values.gdrcopy.enabled | default false }}
|
||||||
|
{{- if .Values.gdrcopy.repository }}
|
||||||
|
repository: {{ .Values.gdrcopy.repository }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gdrcopy.image }}
|
||||||
|
image: {{ .Values.gdrcopy.image }}
|
||||||
|
{{- end }}
|
||||||
|
version: {{ .Values.gdrcopy.version | quote }}
|
||||||
|
{{- if .Values.gdrcopy.imagePullPolicy }}
|
||||||
|
imagePullPolicy: {{ .Values.gdrcopy.imagePullPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gdrcopy.imagePullSecrets }}
|
||||||
|
imagePullSecrets: {{ toYaml .Values.gdrcopy.imagePullSecrets | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gdrcopy.env }}
|
||||||
|
env: {{ toYaml .Values.gdrcopy.env | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.gdrcopy.args }}
|
||||||
|
args: {{ toYaml .Values.gdrcopy.args | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,99 @@
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: gpu-operator
|
||||||
|
labels:
|
||||||
|
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: "gpu-operator"
|
||||||
|
nvidia.com/gpu-driver-upgrade-drain.skip: "true"
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/component: "gpu-operator"
|
||||||
|
app: "gpu-operator"
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
{{- include "gpu-operator.labels" . | nindent 8 }}
|
||||||
|
app.kubernetes.io/component: "gpu-operator"
|
||||||
|
app: "gpu-operator"
|
||||||
|
nvidia.com/gpu-driver-upgrade-drain.skip: "true"
|
||||||
|
annotations:
|
||||||
|
{{- toYaml .Values.operator.annotations | nindent 8 }}
|
||||||
|
spec:
|
||||||
|
serviceAccountName: gpu-operator
|
||||||
|
{{- if .Values.operator.imagePullSecrets }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- range .Values.operator.imagePullSecrets }}
|
||||||
|
- name: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.operator.priorityClassName }}
|
||||||
|
priorityClassName: {{ .Values.operator.priorityClassName }}
|
||||||
|
{{- end }}
|
||||||
|
containers:
|
||||||
|
- name: gpu-operator
|
||||||
|
image: {{ include "gpu-operator.fullimage" . }}
|
||||||
|
imagePullPolicy: {{ .Values.operator.imagePullPolicy }}
|
||||||
|
command: ["gpu-operator"]
|
||||||
|
args:
|
||||||
|
- --leader-elect
|
||||||
|
{{- if .Values.operator.logging.develMode }}
|
||||||
|
- --zap-devel
|
||||||
|
{{- else }}
|
||||||
|
{{- if .Values.operator.logging.timeEncoding }}
|
||||||
|
- --zap-time-encoding={{- .Values.operator.logging.timeEncoding }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.operator.logging.level }}
|
||||||
|
- --zap-log-level={{- .Values.operator.logging.level }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
env:
|
||||||
|
- name: WATCH_NAMESPACE
|
||||||
|
value: ""
|
||||||
|
- name: OPERATOR_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
- name: "DRIVER_MANAGER_IMAGE"
|
||||||
|
value: "{{ include "driver-manager.fullimage" . }}"
|
||||||
|
volumeMounts:
|
||||||
|
- name: host-os-release
|
||||||
|
mountPath: "/host-etc/os-release"
|
||||||
|
readOnly: true
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /healthz
|
||||||
|
port: 8081
|
||||||
|
initialDelaySeconds: 15
|
||||||
|
periodSeconds: 20
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /readyz
|
||||||
|
port: 8081
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 10
|
||||||
|
{{- with .Values.operator.resources }}
|
||||||
|
resources:
|
||||||
|
{{- toYaml . | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
ports:
|
||||||
|
- name: metrics
|
||||||
|
containerPort: 8080
|
||||||
|
volumes:
|
||||||
|
- name: host-os-release
|
||||||
|
hostPath:
|
||||||
|
path: "/etc/os-release"
|
||||||
|
{{- with .Values.operator.nodeSelector }}
|
||||||
|
nodeSelector:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.operator.affinity }}
|
||||||
|
affinity:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.operator.tolerations }}
|
||||||
|
tolerations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,11 @@
|
||||||
|
{{- if and (.Values.devicePlugin.config.create) (not (empty .Values.devicePlugin.config.data)) }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ .Values.devicePlugin.config.name }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||||
|
data: {{ toYaml .Values.devicePlugin.config.data | nindent 2 }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
|
@ -0,0 +1,49 @@
|
||||||
|
{{- if .Values.platform.openshift }}
|
||||||
|
apiVersion: security.openshift.io/v1
|
||||||
|
kind: SecurityContextConstraints
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: "gpu-operator"
|
||||||
|
annotations:
|
||||||
|
kubernetes.io/description: restricted denies access to all host features and requires
|
||||||
|
pods to be run with a UID, read-only root filesystem and SELinux context that are
|
||||||
|
allocated to the namespace. This SCC is more restrictive than the default
|
||||||
|
restrictive SCC and it is used by default for authenticated users and operators and operands.
|
||||||
|
name: restricted-readonly
|
||||||
|
allowHostDirVolumePlugin: false
|
||||||
|
allowHostIPC: false
|
||||||
|
allowHostNetwork: false
|
||||||
|
allowHostPID: false
|
||||||
|
allowHostPorts: false
|
||||||
|
allowPrivilegeEscalation: true
|
||||||
|
allowPrivilegedContainer: false
|
||||||
|
allowedCapabilities: []
|
||||||
|
defaultAddCapabilities: []
|
||||||
|
fsGroup:
|
||||||
|
type: MustRunAs
|
||||||
|
groups:
|
||||||
|
- system:authenticated
|
||||||
|
priority: 0
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
requiredDropCapabilities:
|
||||||
|
- KILL
|
||||||
|
- MKNOD
|
||||||
|
- SETUID
|
||||||
|
- SETGID
|
||||||
|
runAsUser:
|
||||||
|
type: MustRunAsRange
|
||||||
|
seLinuxContext:
|
||||||
|
type: MustRunAs
|
||||||
|
supplementalGroups:
|
||||||
|
type: RunAsAny
|
||||||
|
users:
|
||||||
|
- system:serviceaccount:{{ $.Release.Namespace }}:gpu-operator
|
||||||
|
volumes:
|
||||||
|
- configMap
|
||||||
|
- downwardAPI
|
||||||
|
- emptyDir
|
||||||
|
- persistentVolumeClaim
|
||||||
|
- projected
|
||||||
|
- secret
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,84 @@
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
name: gpu-operator
|
||||||
|
labels:
|
||||||
|
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: "gpu-operator"
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- rbac.authorization.k8s.io
|
||||||
|
resources:
|
||||||
|
- roles
|
||||||
|
- rolebindings
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- update
|
||||||
|
- patch
|
||||||
|
- delete
|
||||||
|
- apiGroups:
|
||||||
|
- apps
|
||||||
|
resources:
|
||||||
|
- controllerrevisions
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- apps
|
||||||
|
resources:
|
||||||
|
- daemonsets
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- update
|
||||||
|
- patch
|
||||||
|
- delete
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- configmaps
|
||||||
|
- endpoints
|
||||||
|
- pods
|
||||||
|
- pods/eviction
|
||||||
|
- secrets
|
||||||
|
- services
|
||||||
|
- services/finalizers
|
||||||
|
- serviceaccounts
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- update
|
||||||
|
- patch
|
||||||
|
- delete
|
||||||
|
- apiGroups:
|
||||||
|
- coordination.k8s.io
|
||||||
|
resources:
|
||||||
|
- leases
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- create
|
||||||
|
- update
|
||||||
|
- patch
|
||||||
|
- delete
|
||||||
|
- apiGroups:
|
||||||
|
- monitoring.coreos.com
|
||||||
|
resources:
|
||||||
|
- servicemonitors
|
||||||
|
- prometheusrules
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- create
|
||||||
|
- watch
|
||||||
|
- update
|
||||||
|
- delete
|
||||||
|
|
@ -0,0 +1,15 @@
|
||||||
|
kind: RoleBinding
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: gpu-operator
|
||||||
|
labels:
|
||||||
|
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: "gpu-operator"
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: gpu-operator
|
||||||
|
namespace: {{ $.Release.Namespace }}
|
||||||
|
roleRef:
|
||||||
|
kind: Role
|
||||||
|
name: gpu-operator
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
|
@ -0,0 +1,7 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: gpu-operator
|
||||||
|
labels:
|
||||||
|
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: "gpu-operator"
|
||||||
|
|
@ -0,0 +1,95 @@
|
||||||
|
{{- if .Values.operator.upgradeCRD }}
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: gpu-operator-upgrade-crd-hook-sa
|
||||||
|
annotations:
|
||||||
|
helm.sh/hook: pre-upgrade
|
||||||
|
helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation
|
||||||
|
helm.sh/hook-weight: "0"
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: gpu-operator-upgrade-crd-hook-role
|
||||||
|
annotations:
|
||||||
|
helm.sh/hook: pre-upgrade
|
||||||
|
helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation
|
||||||
|
helm.sh/hook-weight: "0"
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- apiextensions.k8s.io
|
||||||
|
resources:
|
||||||
|
- customresourcedefinitions
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
---
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: gpu-operator-upgrade-crd-hook-binding
|
||||||
|
annotations:
|
||||||
|
helm.sh/hook: pre-upgrade
|
||||||
|
helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation
|
||||||
|
helm.sh/hook-weight: "0"
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: gpu-operator-upgrade-crd-hook-sa
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
roleRef:
|
||||||
|
kind: ClusterRole
|
||||||
|
name: gpu-operator-upgrade-crd-hook-role
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
---
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: Job
|
||||||
|
metadata:
|
||||||
|
name: gpu-operator-upgrade-crd
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
annotations:
|
||||||
|
"helm.sh/hook": pre-upgrade
|
||||||
|
"helm.sh/hook-weight": "1"
|
||||||
|
"helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
|
||||||
|
labels:
|
||||||
|
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: "gpu-operator"
|
||||||
|
spec:
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
name: gpu-operator-upgrade-crd
|
||||||
|
labels:
|
||||||
|
{{- include "gpu-operator.labels" . | nindent 8 }}
|
||||||
|
app.kubernetes.io/component: "gpu-operator"
|
||||||
|
spec:
|
||||||
|
serviceAccountName: gpu-operator-upgrade-crd-hook-sa
|
||||||
|
{{- if .Values.operator.imagePullSecrets }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- range .Values.operator.imagePullSecrets }}
|
||||||
|
- name: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.operator.tolerations }}
|
||||||
|
tolerations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
containers:
|
||||||
|
- name: upgrade-crd
|
||||||
|
image: {{ include "gpu-operator.fullimage" . }}
|
||||||
|
imagePullPolicy: {{ .Values.operator.imagePullPolicy }}
|
||||||
|
command:
|
||||||
|
- /bin/sh
|
||||||
|
- -c
|
||||||
|
- >
|
||||||
|
kubectl apply -f /opt/gpu-operator/nvidia.com_clusterpolicies.yaml;
|
||||||
|
kubectl apply -f /opt/gpu-operator/nvidia.com_nvidiadrivers.yaml;
|
||||||
|
{{- if .Values.nfd.enabled }}
|
||||||
|
kubectl apply -f /opt/gpu-operator/nfd-api-crds.yaml;
|
||||||
|
{{- end }}
|
||||||
|
restartPolicy: OnFailure
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,605 @@
|
||||||
|
# Default values for gpu-operator.
|
||||||
|
# This is a YAML-formatted file.
|
||||||
|
# Declare variables to be passed into your templates.
|
||||||
|
|
||||||
|
platform:
|
||||||
|
openshift: false
|
||||||
|
|
||||||
|
nfd:
|
||||||
|
enabled: true
|
||||||
|
nodefeaturerules: false
|
||||||
|
|
||||||
|
psa:
|
||||||
|
enabled: false
|
||||||
|
|
||||||
|
cdi:
|
||||||
|
enabled: true
|
||||||
|
default: true
|
||||||
|
|
||||||
|
sandboxWorkloads:
|
||||||
|
enabled: false
|
||||||
|
defaultWorkload: "container"
|
||||||
|
|
||||||
|
hostPaths:
|
||||||
|
# rootFS represents the path to the root filesystem of the host.
|
||||||
|
# This is used by components that need to interact with the host filesystem
|
||||||
|
# and as such this must be a chroot-able filesystem.
|
||||||
|
# Examples include the MIG Manager and Toolkit Container which may need to
|
||||||
|
# stop, start, or restart systemd services
|
||||||
|
rootFS: "/"
|
||||||
|
|
||||||
|
# driverInstallDir represents the root at which driver files including libraries,
|
||||||
|
# config files, and executables can be found.
|
||||||
|
driverInstallDir: "/run/nvidia/driver"
|
||||||
|
|
||||||
|
daemonsets:
|
||||||
|
labels: {}
|
||||||
|
annotations: {}
|
||||||
|
priorityClassName: system-node-critical
|
||||||
|
tolerations:
|
||||||
|
- key: nvidia.com/gpu
|
||||||
|
operator: Exists
|
||||||
|
effect: NoSchedule
|
||||||
|
# configuration for controlling update strategy("OnDelete" or "RollingUpdate") of GPU Operands
|
||||||
|
# note that driver Daemonset is always set with OnDelete to avoid unintended disruptions
|
||||||
|
updateStrategy: "RollingUpdate"
|
||||||
|
# configuration for controlling rolling update of GPU Operands
|
||||||
|
rollingUpdate:
|
||||||
|
# maximum number of nodes to simultaneously apply pod updates on.
|
||||||
|
# can be specified either as number or percentage of nodes. Default 1.
|
||||||
|
maxUnavailable: "1"
|
||||||
|
|
||||||
|
validator:
|
||||||
|
repository: nvcr.io/nvidia/cloud-native
|
||||||
|
image: gpu-operator-validator
|
||||||
|
# If version is not specified, then default is to use chart.AppVersion
|
||||||
|
#version: ""
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
imagePullSecrets: []
|
||||||
|
env: []
|
||||||
|
args: []
|
||||||
|
resources: {}
|
||||||
|
plugin:
|
||||||
|
env:
|
||||||
|
- name: WITH_WORKLOAD
|
||||||
|
value: "false"
|
||||||
|
|
||||||
|
operator:
|
||||||
|
repository: nvcr.io/nvidia
|
||||||
|
image: gpu-operator
|
||||||
|
# If version is not specified, then default is to use chart.AppVersion
|
||||||
|
#version: ""
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
imagePullSecrets: []
|
||||||
|
priorityClassName: system-node-critical
|
||||||
|
runtimeClass: nvidia
|
||||||
|
use_ocp_driver_toolkit: false
|
||||||
|
# cleanup CRD on chart un-install
|
||||||
|
cleanupCRD: false
|
||||||
|
# upgrade CRD on chart upgrade, requires --disable-openapi-validation flag
|
||||||
|
# to be passed during helm upgrade.
|
||||||
|
upgradeCRD: true
|
||||||
|
initContainer:
|
||||||
|
image: cuda
|
||||||
|
repository: nvcr.io/nvidia
|
||||||
|
version: 12.8.1-base-ubi9
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
tolerations:
|
||||||
|
- key: "node-role.kubernetes.io/master"
|
||||||
|
operator: "Equal"
|
||||||
|
value: ""
|
||||||
|
effect: "NoSchedule"
|
||||||
|
- key: "node-role.kubernetes.io/control-plane"
|
||||||
|
operator: "Equal"
|
||||||
|
value: ""
|
||||||
|
effect: "NoSchedule"
|
||||||
|
annotations:
|
||||||
|
openshift.io/scc: restricted-readonly
|
||||||
|
affinity:
|
||||||
|
nodeAffinity:
|
||||||
|
preferredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
- weight: 1
|
||||||
|
preference:
|
||||||
|
matchExpressions:
|
||||||
|
- key: "node-role.kubernetes.io/master"
|
||||||
|
operator: In
|
||||||
|
values: [""]
|
||||||
|
- weight: 1
|
||||||
|
preference:
|
||||||
|
matchExpressions:
|
||||||
|
- key: "node-role.kubernetes.io/control-plane"
|
||||||
|
operator: In
|
||||||
|
values: [""]
|
||||||
|
logging:
|
||||||
|
# Zap time encoding (one of 'epoch', 'millis', 'nano', 'iso8601', 'rfc3339' or 'rfc3339nano')
|
||||||
|
timeEncoding: epoch
|
||||||
|
# Zap Level to configure the verbosity of logging. Can be one of 'debug', 'info', 'error', or any integer value > 0 which corresponds to custom debug levels of increasing verbosity
|
||||||
|
level: info
|
||||||
|
# Development Mode defaults(encoder=consoleEncoder,logLevel=Debug,stackTraceLevel=Warn)
|
||||||
|
# Production Mode defaults(encoder=jsonEncoder,logLevel=Info,stackTraceLevel=Error)
|
||||||
|
develMode: false
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 350Mi
|
||||||
|
requests:
|
||||||
|
cpu: 200m
|
||||||
|
memory: 100Mi
|
||||||
|
|
||||||
|
mig:
|
||||||
|
strategy: single
|
||||||
|
|
||||||
|
driver:
|
||||||
|
enabled: true
|
||||||
|
nvidiaDriverCRD:
|
||||||
|
enabled: false
|
||||||
|
deployDefaultCR: true
|
||||||
|
driverType: gpu
|
||||||
|
nodeSelector: {}
|
||||||
|
kernelModuleType: "auto"
|
||||||
|
|
||||||
|
# NOTE: useOpenKernelModules has been deprecated and made no-op. Please use kernelModuleType instead.
|
||||||
|
# useOpenKernelModules: false
|
||||||
|
|
||||||
|
# use pre-compiled packages for NVIDIA driver installation.
|
||||||
|
# only supported for as a tech-preview feature on ubuntu22.04 kernels.
|
||||||
|
usePrecompiled: false
|
||||||
|
repository: nvcr.io/nvidia
|
||||||
|
image: driver
|
||||||
|
version: "570.124.06"
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
imagePullSecrets: []
|
||||||
|
startupProbe:
|
||||||
|
initialDelaySeconds: 60
|
||||||
|
periodSeconds: 10
|
||||||
|
# nvidia-smi can take longer than 30s in some cases
|
||||||
|
# ensure enough timeout is set
|
||||||
|
timeoutSeconds: 60
|
||||||
|
failureThreshold: 120
|
||||||
|
rdma:
|
||||||
|
enabled: false
|
||||||
|
useHostMofed: false
|
||||||
|
upgradePolicy:
|
||||||
|
# global switch for automatic upgrade feature
|
||||||
|
# if set to false all other options are ignored
|
||||||
|
autoUpgrade: true
|
||||||
|
# how many nodes can be upgraded in parallel
|
||||||
|
# 0 means no limit, all nodes will be upgraded in parallel
|
||||||
|
maxParallelUpgrades: 1
|
||||||
|
# maximum number of nodes with the driver installed, that can be unavailable during
|
||||||
|
# the upgrade. Value can be an absolute number (ex: 5) or
|
||||||
|
# a percentage of total nodes at the start of upgrade (ex:
|
||||||
|
# 10%). Absolute number is calculated from percentage by rounding
|
||||||
|
# up. By default, a fixed value of 25% is used.'
|
||||||
|
maxUnavailable: 25%
|
||||||
|
# options for waiting on pod(job) completions
|
||||||
|
waitForCompletion:
|
||||||
|
timeoutSeconds: 0
|
||||||
|
podSelector: ""
|
||||||
|
# options for gpu pod deletion
|
||||||
|
gpuPodDeletion:
|
||||||
|
force: false
|
||||||
|
timeoutSeconds: 300
|
||||||
|
deleteEmptyDir: false
|
||||||
|
# options for node drain (`kubectl drain`) before the driver reload
|
||||||
|
# this is required only if default GPU pod deletions done by the operator
|
||||||
|
# are not sufficient to re-install the driver
|
||||||
|
drain:
|
||||||
|
enable: false
|
||||||
|
force: false
|
||||||
|
podSelector: ""
|
||||||
|
# It's recommended to set a timeout to avoid infinite drain in case non-fatal error keeps happening on retries
|
||||||
|
timeoutSeconds: 300
|
||||||
|
deleteEmptyDir: false
|
||||||
|
manager:
|
||||||
|
image: k8s-driver-manager
|
||||||
|
repository: nvcr.io/nvidia/cloud-native
|
||||||
|
# When choosing a different version of k8s-driver-manager, DO NOT downgrade to a version lower than v0.6.4
|
||||||
|
# to ensure k8s-driver-manager stays compatible with gpu-operator starting from v24.3.0
|
||||||
|
version: v0.8.0
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
env:
|
||||||
|
- name: ENABLE_GPU_POD_EVICTION
|
||||||
|
value: "true"
|
||||||
|
- name: ENABLE_AUTO_DRAIN
|
||||||
|
value: "false"
|
||||||
|
- name: DRAIN_USE_FORCE
|
||||||
|
value: "false"
|
||||||
|
- name: DRAIN_POD_SELECTOR_LABEL
|
||||||
|
value: ""
|
||||||
|
- name: DRAIN_TIMEOUT_SECONDS
|
||||||
|
value: "0s"
|
||||||
|
- name: DRAIN_DELETE_EMPTYDIR_DATA
|
||||||
|
value: "false"
|
||||||
|
env: []
|
||||||
|
resources: {}
|
||||||
|
# Private mirror repository configuration
|
||||||
|
repoConfig:
|
||||||
|
configMapName: ""
|
||||||
|
# custom ssl key/certificate configuration
|
||||||
|
certConfig:
|
||||||
|
name: ""
|
||||||
|
# vGPU licensing configuration
|
||||||
|
licensingConfig:
|
||||||
|
configMapName: ""
|
||||||
|
nlsEnabled: true
|
||||||
|
# vGPU topology daemon configuration
|
||||||
|
virtualTopology:
|
||||||
|
config: ""
|
||||||
|
# kernel module configuration for NVIDIA driver
|
||||||
|
kernelModuleConfig:
|
||||||
|
name: ""
|
||||||
|
|
||||||
|
toolkit:
|
||||||
|
enabled: true
|
||||||
|
repository: nvcr.io/nvidia/k8s
|
||||||
|
image: container-toolkit
|
||||||
|
version: v1.17.5-ubuntu20.04
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
imagePullSecrets: []
|
||||||
|
env: []
|
||||||
|
resources: {}
|
||||||
|
installDir: "/usr/local/nvidia"
|
||||||
|
|
||||||
|
devicePlugin:
|
||||||
|
enabled: true
|
||||||
|
repository: nvcr.io/nvidia
|
||||||
|
image: k8s-device-plugin
|
||||||
|
version: v0.17.1
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
imagePullSecrets: []
|
||||||
|
args: []
|
||||||
|
env:
|
||||||
|
- name: PASS_DEVICE_SPECS
|
||||||
|
value: "true"
|
||||||
|
- name: FAIL_ON_INIT_ERROR
|
||||||
|
value: "true"
|
||||||
|
- name: DEVICE_LIST_STRATEGY
|
||||||
|
value: envvar
|
||||||
|
- name: DEVICE_ID_STRATEGY
|
||||||
|
value: uuid
|
||||||
|
- name: NVIDIA_VISIBLE_DEVICES
|
||||||
|
value: all
|
||||||
|
- name: NVIDIA_DRIVER_CAPABILITIES
|
||||||
|
value: all
|
||||||
|
resources: {}
|
||||||
|
# Plugin configuration
|
||||||
|
# Use "name" to either point to an existing ConfigMap or to create a new one with a list of configurations(i.e with create=true).
|
||||||
|
# Use "data" to build an integrated ConfigMap from a set of configurations as
|
||||||
|
# part of this helm chart. An example of setting "data" might be:
|
||||||
|
# config:
|
||||||
|
# name: device-plugin-config
|
||||||
|
# create: true
|
||||||
|
# data:
|
||||||
|
# default: |-
|
||||||
|
# version: v1
|
||||||
|
# flags:
|
||||||
|
# migStrategy: none
|
||||||
|
# mig-single: |-
|
||||||
|
# version: v1
|
||||||
|
# flags:
|
||||||
|
# migStrategy: single
|
||||||
|
# mig-mixed: |-
|
||||||
|
# version: v1
|
||||||
|
# flags:
|
||||||
|
# migStrategy: mixed
|
||||||
|
config:
|
||||||
|
# Create a ConfigMap (default: false)
|
||||||
|
create: false
|
||||||
|
# ConfigMap name (either existing or to create a new one with create=true above)
|
||||||
|
name: ""
|
||||||
|
# Default config name within the ConfigMap
|
||||||
|
default: ""
|
||||||
|
# Data section for the ConfigMap to create (i.e only applies when create=true)
|
||||||
|
data: {}
|
||||||
|
# MPS related configuration for the plugin
|
||||||
|
mps:
|
||||||
|
# MPS root path on the host
|
||||||
|
root: "/run/nvidia/mps"
|
||||||
|
|
||||||
|
# standalone dcgm hostengine
|
||||||
|
dcgm:
|
||||||
|
# disabled by default to use embedded nv-hostengine by exporter
|
||||||
|
enabled: false
|
||||||
|
repository: nvcr.io/nvidia/cloud-native
|
||||||
|
image: dcgm
|
||||||
|
version: 4.1.1-2-ubuntu22.04
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
args: []
|
||||||
|
env: []
|
||||||
|
resources: {}
|
||||||
|
|
||||||
|
dcgmExporter:
|
||||||
|
enabled: true
|
||||||
|
repository: nvcr.io/nvidia/k8s
|
||||||
|
image: dcgm-exporter
|
||||||
|
version: 4.1.1-4.0.4-ubuntu22.04
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
env:
|
||||||
|
- name: DCGM_EXPORTER_LISTEN
|
||||||
|
value: ":9400"
|
||||||
|
- name: DCGM_EXPORTER_KUBERNETES
|
||||||
|
value: "true"
|
||||||
|
- name: DCGM_EXPORTER_COLLECTORS
|
||||||
|
value: "/etc/dcgm-exporter/dcp-metrics-included.csv"
|
||||||
|
resources: {}
|
||||||
|
serviceMonitor:
|
||||||
|
enabled: false
|
||||||
|
interval: 15s
|
||||||
|
honorLabels: false
|
||||||
|
additionalLabels: {}
|
||||||
|
relabelings: []
|
||||||
|
# - source_labels:
|
||||||
|
# - __meta_kubernetes_pod_node_name
|
||||||
|
# regex: (.*)
|
||||||
|
# target_label: instance
|
||||||
|
# replacement: $1
|
||||||
|
# action: replace
|
||||||
|
# DCGM Exporter configuration
|
||||||
|
# This block is used to configure DCGM Exporter to emit a customized list of metrics.
|
||||||
|
# Use "name" to either point to an existing ConfigMap or to create a new one with a
|
||||||
|
# list of configurations (i.e with create=true).
|
||||||
|
# When pointing to an existing ConfigMap, the ConfigMap must exist in the same namespace as the release.
|
||||||
|
# The metrics are expected to be listed under a key called `dcgm-metrics.csv`.
|
||||||
|
# Use "data" to build an integrated ConfigMap from a set of custom metrics as
|
||||||
|
# part of the chart. An example of some custom metrics are shown below. Note that
|
||||||
|
# the contents of "data" must be in CSV format and be valid DCGM Exporter metric configurations.
|
||||||
|
# config:
|
||||||
|
# name: custom-dcgm-exporter-metrics
|
||||||
|
# create: true
|
||||||
|
# data: |-
|
||||||
|
# Format
|
||||||
|
# If line starts with a '#' it is considered a comment
|
||||||
|
# DCGM FIELD, Prometheus metric type, help message
|
||||||
|
|
||||||
|
# Clocks
|
||||||
|
# DCGM_FI_DEV_SM_CLOCK, gauge, SM clock frequency (in MHz).
|
||||||
|
# DCGM_FI_DEV_MEM_CLOCK, gauge, Memory clock frequency (in MHz).
|
||||||
|
gfd:
|
||||||
|
enabled: true
|
||||||
|
repository: nvcr.io/nvidia
|
||||||
|
image: k8s-device-plugin
|
||||||
|
version: v0.17.1
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
imagePullSecrets: []
|
||||||
|
env:
|
||||||
|
- name: GFD_SLEEP_INTERVAL
|
||||||
|
value: 60s
|
||||||
|
- name: GFD_FAIL_ON_INIT_ERROR
|
||||||
|
value: "true"
|
||||||
|
resources: {}
|
||||||
|
|
||||||
|
migManager:
|
||||||
|
enabled: true
|
||||||
|
repository: nvcr.io/nvidia/cloud-native
|
||||||
|
image: k8s-mig-manager
|
||||||
|
version: v0.12.1-ubuntu20.04
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
imagePullSecrets: []
|
||||||
|
env:
|
||||||
|
- name: WITH_REBOOT
|
||||||
|
value: "false"
|
||||||
|
resources: {}
|
||||||
|
# MIG configuration
|
||||||
|
# Use "name" to either point to an existing ConfigMap or to create a new one with a list of configurations(i.e with create=true).
|
||||||
|
# Use "data" to build an integrated ConfigMap from a set of configurations as
|
||||||
|
# part of this helm chart. An example of setting "data" might be:
|
||||||
|
# config:
|
||||||
|
# name: custom-mig-parted-configs
|
||||||
|
# create: true
|
||||||
|
# data:
|
||||||
|
# config.yaml: |-
|
||||||
|
# version: v1
|
||||||
|
# mig-configs:
|
||||||
|
# all-disabled:
|
||||||
|
# - devices: all
|
||||||
|
# mig-enabled: false
|
||||||
|
# custom-mig:
|
||||||
|
# - devices: [0]
|
||||||
|
# mig-enabled: false
|
||||||
|
# - devices: [1]
|
||||||
|
# mig-enabled: true
|
||||||
|
# mig-devices:
|
||||||
|
# "1g.10gb": 7
|
||||||
|
# - devices: [2]
|
||||||
|
# mig-enabled: true
|
||||||
|
# mig-devices:
|
||||||
|
# "2g.20gb": 2
|
||||||
|
# "3g.40gb": 1
|
||||||
|
# - devices: [3]
|
||||||
|
# mig-enabled: true
|
||||||
|
# mig-devices:
|
||||||
|
# "3g.40gb": 1
|
||||||
|
# "4g.40gb": 1
|
||||||
|
config:
|
||||||
|
default: "all-disabled"
|
||||||
|
# Create a ConfigMap (default: false)
|
||||||
|
create: false
|
||||||
|
# ConfigMap name (either existing or to create a new one with create=true above)
|
||||||
|
name: ""
|
||||||
|
# Data section for the ConfigMap to create (i.e only applies when create=true)
|
||||||
|
data: {}
|
||||||
|
gpuClientsConfig:
|
||||||
|
name: ""
|
||||||
|
|
||||||
|
nodeStatusExporter:
|
||||||
|
enabled: false
|
||||||
|
repository: nvcr.io/nvidia/cloud-native
|
||||||
|
image: gpu-operator-validator
|
||||||
|
# If version is not specified, then default is to use chart.AppVersion
|
||||||
|
#version: ""
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
imagePullSecrets: []
|
||||||
|
resources: {}
|
||||||
|
|
||||||
|
gds:
|
||||||
|
enabled: false
|
||||||
|
repository: nvcr.io/nvidia/cloud-native
|
||||||
|
image: nvidia-fs
|
||||||
|
version: "2.20.5"
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
imagePullSecrets: []
|
||||||
|
env: []
|
||||||
|
args: []
|
||||||
|
|
||||||
|
gdrcopy:
|
||||||
|
enabled: false
|
||||||
|
repository: nvcr.io/nvidia/cloud-native
|
||||||
|
image: gdrdrv
|
||||||
|
version: "v2.4.4"
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
imagePullSecrets: []
|
||||||
|
env: []
|
||||||
|
args: []
|
||||||
|
|
||||||
|
vgpuManager:
|
||||||
|
enabled: false
|
||||||
|
repository: ""
|
||||||
|
image: vgpu-manager
|
||||||
|
version: ""
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
imagePullSecrets: []
|
||||||
|
env: []
|
||||||
|
resources: {}
|
||||||
|
driverManager:
|
||||||
|
image: k8s-driver-manager
|
||||||
|
repository: nvcr.io/nvidia/cloud-native
|
||||||
|
# When choosing a different version of k8s-driver-manager, DO NOT downgrade to a version lower than v0.6.4
|
||||||
|
# to ensure k8s-driver-manager stays compatible with gpu-operator starting from v24.3.0
|
||||||
|
version: v0.8.0
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
env:
|
||||||
|
- name: ENABLE_GPU_POD_EVICTION
|
||||||
|
value: "false"
|
||||||
|
- name: ENABLE_AUTO_DRAIN
|
||||||
|
value: "false"
|
||||||
|
|
||||||
|
vgpuDeviceManager:
|
||||||
|
enabled: true
|
||||||
|
repository: nvcr.io/nvidia/cloud-native
|
||||||
|
image: vgpu-device-manager
|
||||||
|
version: v0.3.0
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
imagePullSecrets: []
|
||||||
|
env: []
|
||||||
|
config:
|
||||||
|
name: ""
|
||||||
|
default: "default"
|
||||||
|
|
||||||
|
vfioManager:
|
||||||
|
enabled: true
|
||||||
|
repository: nvcr.io/nvidia
|
||||||
|
image: cuda
|
||||||
|
version: 12.8.1-base-ubi9
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
imagePullSecrets: []
|
||||||
|
env: []
|
||||||
|
resources: {}
|
||||||
|
driverManager:
|
||||||
|
image: k8s-driver-manager
|
||||||
|
repository: nvcr.io/nvidia/cloud-native
|
||||||
|
# When choosing a different version of k8s-driver-manager, DO NOT downgrade to a version lower than v0.6.4
|
||||||
|
# to ensure k8s-driver-manager stays compatible with gpu-operator starting from v24.3.0
|
||||||
|
version: v0.8.0
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
env:
|
||||||
|
- name: ENABLE_GPU_POD_EVICTION
|
||||||
|
value: "false"
|
||||||
|
- name: ENABLE_AUTO_DRAIN
|
||||||
|
value: "false"
|
||||||
|
|
||||||
|
kataManager:
|
||||||
|
enabled: false
|
||||||
|
config:
|
||||||
|
artifactsDir: "/opt/nvidia-gpu-operator/artifacts/runtimeclasses"
|
||||||
|
runtimeClasses:
|
||||||
|
- name: kata-nvidia-gpu
|
||||||
|
nodeSelector: {}
|
||||||
|
artifacts:
|
||||||
|
url: nvcr.io/nvidia/cloud-native/kata-gpu-artifacts:ubuntu22.04-535.54.03
|
||||||
|
pullSecret: ""
|
||||||
|
- name: kata-nvidia-gpu-snp
|
||||||
|
nodeSelector:
|
||||||
|
"nvidia.com/cc.capable": "true"
|
||||||
|
artifacts:
|
||||||
|
url: nvcr.io/nvidia/cloud-native/kata-gpu-artifacts:ubuntu22.04-535.86.10-snp
|
||||||
|
pullSecret: ""
|
||||||
|
repository: nvcr.io/nvidia/cloud-native
|
||||||
|
image: k8s-kata-manager
|
||||||
|
version: v0.2.3
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
imagePullSecrets: []
|
||||||
|
env: []
|
||||||
|
resources: {}
|
||||||
|
|
||||||
|
sandboxDevicePlugin:
|
||||||
|
enabled: true
|
||||||
|
repository: nvcr.io/nvidia
|
||||||
|
image: kubevirt-gpu-device-plugin
|
||||||
|
version: v1.3.1
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
imagePullSecrets: []
|
||||||
|
args: []
|
||||||
|
env: []
|
||||||
|
resources: {}
|
||||||
|
|
||||||
|
ccManager:
|
||||||
|
enabled: false
|
||||||
|
defaultMode: "off"
|
||||||
|
repository: nvcr.io/nvidia/cloud-native
|
||||||
|
image: k8s-cc-manager
|
||||||
|
version: v0.1.1
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
imagePullSecrets: []
|
||||||
|
env:
|
||||||
|
- name: CC_CAPABLE_DEVICE_IDS
|
||||||
|
value: "0x2339,0x2331,0x2330,0x2324,0x2322,0x233d"
|
||||||
|
resources: {}
|
||||||
|
|
||||||
|
node-feature-discovery:
|
||||||
|
enableNodeFeatureApi: true
|
||||||
|
priorityClassName: system-node-critical
|
||||||
|
gc:
|
||||||
|
enable: true
|
||||||
|
replicaCount: 1
|
||||||
|
serviceAccount:
|
||||||
|
name: node-feature-discovery
|
||||||
|
create: false
|
||||||
|
worker:
|
||||||
|
serviceAccount:
|
||||||
|
name: node-feature-discovery
|
||||||
|
# disable creation to avoid duplicate serviceaccount creation by master spec below
|
||||||
|
create: false
|
||||||
|
tolerations:
|
||||||
|
- key: "node-role.kubernetes.io/master"
|
||||||
|
operator: "Equal"
|
||||||
|
value: ""
|
||||||
|
effect: "NoSchedule"
|
||||||
|
- key: "node-role.kubernetes.io/control-plane"
|
||||||
|
operator: "Equal"
|
||||||
|
value: ""
|
||||||
|
effect: "NoSchedule"
|
||||||
|
- key: nvidia.com/gpu
|
||||||
|
operator: Exists
|
||||||
|
effect: NoSchedule
|
||||||
|
config:
|
||||||
|
sources:
|
||||||
|
pci:
|
||||||
|
deviceClassWhitelist:
|
||||||
|
- "02"
|
||||||
|
- "0200"
|
||||||
|
- "0207"
|
||||||
|
- "0300"
|
||||||
|
- "0302"
|
||||||
|
deviceLabelFields:
|
||||||
|
- vendor
|
||||||
|
master:
|
||||||
|
serviceAccount:
|
||||||
|
name: node-feature-discovery
|
||||||
|
create: true
|
||||||
|
config:
|
||||||
|
extraLabelNs: ["nvidia.com"]
|
||||||
|
# noPublish: false
|
||||||
|
# resourceLabels: ["nvidia.com/feature-1","nvidia.com/feature-2"]
|
||||||
|
# enableTaints: false
|
||||||
|
# labelWhiteList: "nvidia.com/gpu"
|
||||||
|
|
@ -0,0 +1,29 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: harbor-cacerts
|
||||||
|
namespace: harbor
|
||||||
|
# harbor-corer pod // /etc/core/ca
|
||||||
|
data:
|
||||||
|
cert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURtekNDQW9PZ0F3SUJBZ0lVTFVnOHBsdGlSTDVqSVhzL1ppQ1pacmtncElRd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1hURUxNQWtHQTFVRUJoTUNTMUl4RGpBTUJnTlZCQWdNQlZObGIzVnNNUTB3Q3dZRFZRUUhEQVJKYm1wbApNUTh3RFFZRFZRUUtEQVpwYm1OdmNuQXhEREFLQmdOVkJBc01BMlJsZGpFUU1BNEdBMVVFQXd3SGFXNXFaV2x1Cll6QWVGdzB5TkRFeU1ESXdORFEwTlRkYUZ3MHlOakV5TURJd05EUTBOVGRhTUYweEN6QUpCZ05WQkFZVEFrdFMKTVE0d0RBWURWUVFJREFWVFpXOTFiREVOTUFzR0ExVUVCd3dFU1c1cVpURVBNQTBHQTFVRUNnd0dhVzVqYjNKdwpNUXd3Q2dZRFZRUUxEQU5rWlhZeEVEQU9CZ05WQkFNTUIybHVhbVZwYm1Nd2dnRWlNQTBHQ1NxR1NJYjNEUUVCCkFRVUFBNElCRHdBd2dnRUtBb0lCQVFERmVDRU1iM3Yrbmt1OUJic1FVdUt5dGJabUN5MTdPcDZSTGxmWEZaSTAKbUxLRjZadTlTczh0cmV0VDA3eHZrY2x2YzF4b2ZJMlFWMVFmSkFDQmhqU0FaWUJTbWZhNE5oWExnNEYvcEFSQQpjbStINnR2TGtSNllvZVMvWXVJUDVQVXVxWmt6Ym9ZQWl5T0NUelYxNEhRb25OU20rOFZvSnNMemEwZEZZZklNCmtGOVVsMklFSERmQ2xrQWt1cDNFYlNyMkNTYXdLV3J4OXd2N2cvbXR3ekloL0MwKy81MXh2dFZSSVVUZk1qQlIKUVVWL1VBWEJhS0UvNHlwN1RZaWpHa21WUEJUVTRid2hmcHdNeklUMWxpSjhwaE1qTGZtbDMxd1Q5R1FWYnhyMgpXOU5NdnFQWklMVmx6c1VUcTJyOU13TU8rQ3VreVNWbWRBOXgwenc1MUNGZkFnTUJBQUdqVXpCUk1CMEdBMVVkCkRnUVdCQlFsTWo0YzFmMjg1bmlHREJRcmNlYUp5MDJtalRBZkJnTlZIU01FR0RBV2dCUWxNajRjMWYyODVuaUcKREJRcmNlYUp5MDJtalRBUEJnTlZIUk1CQWY4RUJUQURBUUgvTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFBTgpBZ0R1OEY3SGVWakZ4bU11NGZZVWZrN0czU1ZObWdacXo0MzhNanhjS2dJYmR6NnE1Q0xTNW1hSng0RitVc2VPCjZaZHBEQm1GSncrK1E4QVUvQ0tLY3dOZC83eGRzSEhEUFY0MFNNVStLc08xT0FJZjBIeFZXV3lFd0VRaW1obFgKWEJBZVJocEF5NHFTNTI1dE11RnUxeFkxOVJJME1VRlpmV05JUW1OZ0N5QWRINkIyY3Z5dmhSU2crRXdhYnV6RQpkdmN6R3JOZm1tUGphMXRZTnBQWGFpQ0hGc2h2QzlJMzZwOEhuYjNKY3VsVSswL2Y3UzRWZGhSTm1nakY1elhMCkl6Wk1TbXhnMnVmc25DNHFhS3FONU9ISi9NbGJIYTRzRFR0cHNLaWNBWUE3aUw2WjFvcmtIeTc1cUdYVlRtekMKU2xkbkxwQWw2cS9wUXg1bUpVdEwKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: harbor-core
|
||||||
|
namespace: harbor
|
||||||
|
type: Opaque
|
||||||
|
data:
|
||||||
|
CSRF_KEY: Tk9ORjNTYjZoZ2tIdlZmcXNlcTVEdjNhUlBjWDZ6Rjg=
|
||||||
|
HARBOR_ADMIN_PASSWORD: bmhuIUAjMTIz
|
||||||
|
# POSTGRES_PASSWORD --> init파일에 있는 것. database에서 사용하는 변수명
|
||||||
|
POSTGRESQL_PASSWORD: bmhuIUAjMTIz # harbor-core에서 사용하는 변수명
|
||||||
|
REGISTRY_CREDENTIAL_PASSWORD: aGFyYm9yX3JlZ2lzdHJ5X3Bhc3N3b3Jk
|
||||||
|
secret: RTRQY0FxZ3RPVmdKWTBRRw==
|
||||||
|
secretKey: bm90LWEtc2VjdXJlLWtleQ==
|
||||||
|
tls.cert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURyekNDQXBlZ0F3SUJBZ0lVVzZZZlZMdkhUVEZ6ZU40R05wbmgxZW1XcXpRd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1hURUxNQWtHQTFVRUJoTUNTMUl4RGpBTUJnTlZCQWdNQlZObGIzVnNNUTB3Q3dZRFZRUUhEQVJKYm1wbApNUTh3RFFZRFZRUUtEQVpwYm1OdmNuQXhEREFLQmdOVkJBc01BMlJsZGpFUU1BNEdBMVVFQXd3SGFXNXFaV2x1Cll6QWVGdzB5TkRFeU1ESXdOakV3TlRkYUZ3MHlOakV5TURJd05qRXdOVGRhTUdVeEN6QUpCZ05WQkFZVEFrdFMKTVE0d0RBWURWUVFJREFWVFpXOTFiREVPTUF3R0ExVUVCd3dGUjBGVFFVNHhEREFLQmdOVkJBb01BMlJsWWpFTgpNQXNHQTFVRUN3d0VkR1Z6ZERFWk1CY0dBMVVFQXd3UUtpNXVZWFJwZG1Wa1pXTnJMbU52YlRDQ0FTSXdEUVlKCktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU11U1JJVUJBMWhSWmd4M3p4djVJeWljMnd3alZUcmkKa3QrQ01CNndTLzQrVDUxMkxnd29PQU9IdnQ1L0hDbEVSUVdWd280ZDN2cDR3WmQ3MktxVXM2Ym9CclZmeWU4bAo1bC84MkpGQkhqNStGWDhtTS8wYldkMHVhV1NVNDdsNHhBTzFwU3V0cXgxdkJQdlI2aC9DT0k4cEpBakVxd1llCjVLU1RGWllKOG5YWXJrbkFhRnl1dnkwZjhNcHdUbW1GWEZWeVZQbGlhZkhYUjFVWVNQUlFIcWo0TXF3VTM4OXMKSjdOOVlsMzBwMVUzVWVMRkx2Q0lEUU1UVFFzbUNSbnA3UzV1VzZETC90eXNwdnAwRVVzcDRHRXRhY3drZU84cwo0UlZqeGEyR0JiUTViSGJ2MGxZLzZBKzk5Szc5U0ZNcksvd1ptM0dSeDkvblJKWXc2OUpLZ2xVQ0F3RUFBYU5mCk1GMHdHd1lEVlIwUkJCUXdFb0lRS2k1dVlYUnBkbVZrWldOckxtTnZiVEFkQmdOVkhRNEVGZ1FVbitzL2oyMzEKcC8ycnFWWFNTSk5IVWZnNU5PQXdId1lEVlIwakJCZ3dGb0FVSlRJK0hOWDl2T1o0aGd3VUszSG1pY3ROcG8wdwpEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBR2haQVNobU05Mm9yVHo5ZndtOG9qZ25xekZ5dmlGa2lrYjU2MDI4CmZEZXV5M2d2aUZqNHk5a3hlQ1lqdjQ4ZWJ1cHlFL1oyZnJ5eVltWXNOOHNlanNLcTY2V0J1TDh0ZG9TS3ZjcFMKQU1TOU5reEhWZlJvRmFGSmgxZVQ3RzhoYVd0dTdpSUxRUzB5dXZWYkFhMGFPVzRpY3p0eXVlK0MyOXRXS3pLcAp4ZndtOEI5SzFzRVUwdEN2d1R6L2wwTlBpYXdOelNnc3UrWFkwbW1xZ0NQbG1zd2cxRkNwWTUzcHBqRE5NTzJDCnJ5bGhKbnowM2JpS2NQb0VCQlNKZFo2WGt2UG93SUV5bGZ3SWlEV3VNRjFaNzViaTBoaGFFTjRDaVJkeSt4MDkKR1NQa04zMlZ4d3dvTXhHd3A0VWJSS0g4YVR6Q2VWT0ZuaE8xbGp3MVdSR2ZRUWc9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
|
||||||
|
tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBeTVKRWhRRURXRkZtREhmUEcva2pLSnpiRENOVk91S1MzNEl3SHJCTC9qNVBuWFl1CkRDZzRBNGUrM244Y0tVUkZCWlhDamgzZStuakJsM3ZZcXBTenB1Z0d0Vi9KN3lYbVgvellrVUVlUG40VmZ5WXoKL1J0WjNTNXBaSlRqdVhqRUE3V2xLNjJySFc4RSs5SHFIOEk0anlra0NNU3JCaDdrcEpNVmxnbnlkZGl1U2NCbwpYSzYvTFIvd3luQk9hWVZjVlhKVStXSnA4ZGRIVlJoSTlGQWVxUGd5ckJUZnoyd25zMzFpWGZTblZUZFI0c1V1CjhJZ05BeE5OQ3lZSkdlbnRMbTVib012KzNLeW0rblFSU3luZ1lTMXB6Q1I0N3l6aEZXUEZyWVlGdERsc2R1L1MKVmovb0Q3MzBydjFJVXlzci9CbWJjWkhIMytkRWxqRHIwa3FDVlFJREFRQUJBb0lCQUZaMGV5Y2xZLzlKS3BiVwo5eDJCTkY1V0oyMURRRG91NllPRTdkektzS3Q4V1NHZGhEYmppYzV1QXpESk9QT0pxK3FRVEwxQWtHYzlpN0pECkJhU0VYTHZneEtDWTJ0RDIvcHo3YkJwY1ZuVGg1VTFIczBLbU1BY1FZL0EwajNaQWhMYXltVUF3bElCK210WTcKc3p2anAxT2RmRkZBL1FVdmI1azVZaXlEY3ZaNjJwL2VaNXdDOXY4dFhjRVpIN2FpVWNKSGM1ajFrRFRpckErawpjWW5xUTJ2NHovWXJKek9Xa2tyTTNudFpOSzM0QzMrMUQrb1d6QjZHNjJJb0JCZnVxVGNJZHgwMXNvbjNIMXVYClpMNHdNbXRLZ0Z0RFJLdEpQNysxOXJsaU1qL09UWEd3WkZlS2c1RGY3T2Y2MFl1em1kVXFhNHQrMXlicHd2RkEKb0U2OW15MENnWUVBM09wcFV1RmZwZUxiRGsvdHJGY3ByNksxaTdubFA0TXowMXhySG03d3VEaS80TWp6VnlkVworZ0t0emYzRm1rNE5iYyt6aGdXblIzN2RheFlzbzVacC9Uck9GemFuNGpIKzhzNU9LWDI2WjBJZjVnQm01NmwzCmtKckU3UnAxMFF3ZE0xRkVQOWtGaFZyK2YzWm5rQ3QyNjQ3aFVWY2Jubk1CUHhZVkNWZzZmOE1DZ1lFQTYrYXoKNG12Y1dSZm1LSFd1dnovRVZPL3lRT3BxOCtkc2l3dXFRZ2xIWm5SZ0Rmc05uZ3NyK3hBaWJoVm94Q3ZZdm84dApnNVVqdXArVklEVFVqRlp6bkd1N2xVWlRyMVBQS1lCS2dtSVVqRkpYQ1JCUUd5akttUG5LYmhJb2RxUWRCV2o3CkIrOTNDeVBsMHRZVWNNMjdEL0E5TDNDaHBJVktxZ25JeHpZZXJBY0NnWUJqS1JFWHM3UUVPUHpNd3RIVFB0aW0KVHFtZ3kxTjhtNzdpaTZSRlo5VERUQzNNajBhekF5U0dXamQ3dEFKRGplOTNML2pNR3JPSVl3aXVMYWpoMFAxSQpQbUlOaDJuNkhTanNBZkNSclM3RGRLbnV5cFZtUE9vL1RVbEJpRlFEL3FVSXlOeVNzQzVMT3Bucnl0RVhwSHJmCnB5VzZKaGh1bWY2Z082QTdybytya3dLQmdIOXVEam4vWGZaYXJKK3FnbzBaR3l0dXVvUktuUi9JSWFBeTJ2UDEKSXphN0lyQXFyNzV4OW40V3h5S0VPaVhPTWJVdWpyMkhzTmM5SVVkV2dvS1VxTHNVank0aDRVN1NqUk8wRTR1LwpBNjZSUkNiSFF4Nkl1SGhPWndWeWxaMFJKZ1FvSTRLejNyQ0w0Ymcwb0xJVzBEZlo1Sk5kMmxPUEZUZ3BOT1kzCjIvVzlBb0dCQU1HRXJtczVrRWZkdDFveXYxUlBwbENSUG1yVCs4TUV1K3lyanJXSXlxWEo4SHcwd09mTlhsTXQKUzhRbFdDb0xnbmFxZU81ZWd6OGF2L2ZVNDhxbU9tTVFPUDRMbWxSSm1ZM1E3MVpCZUc5akxPUFZCZlhFeDVDTQp2d283dFhEU1JKRVdUcGp3dCtUMy9uTlZhMm9QMGNXTUg1akJ0c1ZXMnhrM3F5K0NJWVBqCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0t
|
||||||
|
---
|
||||||
|
|
@ -0,0 +1,83 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
kubernetes.io/metadata.name: harbor
|
||||||
|
name: harbor
|
||||||
|
spec:
|
||||||
|
finalizers:
|
||||||
|
- kubernetes
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: harbor-database
|
||||||
|
namespace: harbor
|
||||||
|
type: Opaque
|
||||||
|
data:
|
||||||
|
POSTGRES_PASSWORD: bmhuIUAjMTIz
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: harbor-jobservice
|
||||||
|
namespace: harbor
|
||||||
|
type: Opaque
|
||||||
|
data:
|
||||||
|
JOBSERVICE_SECRET: akVWbzlyNFJaU2R1clJqUA==
|
||||||
|
REGISTRY_CREDENTIAL_PASSWORD: aGFyYm9yX3JlZ2lzdHJ5X3Bhc3N3b3Jk
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
data:
|
||||||
|
REGISTRY_HTTP_SECRET: dHlCdm41MXpIakxLRm5mRw==
|
||||||
|
REGISTRY_REDIS_PASSWORD: ""
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: harbor-registry
|
||||||
|
namespace: harbor
|
||||||
|
type: Opaque
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
data:
|
||||||
|
REGISTRY_HTPASSWD: aGFyYm9yX3JlZ2lzdHJ5X3VzZXI6JDJhJDEwJG1uRkVSQkVyRmROYnNuZDVHWUxTQXVUOTRaUWxZNGkxU3BtNTk4dWlmV2pLbEJrQnJhbHEu
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: harbor-registry-htpasswd
|
||||||
|
namespace: harbor
|
||||||
|
type: Opaque
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
data: null
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: harbor-registryctl
|
||||||
|
namespace: harbor
|
||||||
|
type: Opaque
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
data:
|
||||||
|
gitHubToken: ""
|
||||||
|
redisURL: cmVkaXM6Ly9oYXJib3ItcmVkaXM6NjM3OS81P2lkbGVfdGltZW91dF9zZWNvbmRzPTMw
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: harbor-trivy
|
||||||
|
namespace: harbor
|
||||||
|
type: Opaque
|
||||||
|
|
@ -0,0 +1,35 @@
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
component: jobservice
|
||||||
|
release: harbor
|
||||||
|
name: harbor-jobservice
|
||||||
|
namespace: harbor
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
# storageClassName: sc-monitoring
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 10Gi
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
component: registry
|
||||||
|
release: harbor
|
||||||
|
name: harbor-registry
|
||||||
|
namespace: harbor
|
||||||
|
spec:
|
||||||
|
# storageClassName: sc-monitoring
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 100Gi
|
||||||
|
|
||||||
|
|
@ -0,0 +1,227 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: harbor-core
|
||||||
|
namespace: harbor
|
||||||
|
data:
|
||||||
|
_REDIS_URL_CORE: redis://harbor-redis:6379/0?idle_timeout_seconds=30
|
||||||
|
_REDIS_URL_REG: redis://harbor-redis:6379/2?idle_timeout_seconds=30
|
||||||
|
CHART_CACHE_DRIVER: redis
|
||||||
|
CONFIG_PATH: /etc/core/app.conf
|
||||||
|
CORE_LOCAL_URL: http://127.0.0.1:8080
|
||||||
|
CORE_URL: http://harbor-core:80
|
||||||
|
DATABASE_TYPE: postgresql
|
||||||
|
EXT_ENDPOINT: https://harbor.nhngpuaas.com
|
||||||
|
HTTP_PROXY: ""
|
||||||
|
HTTPS_PROXY: ""
|
||||||
|
JOBSERVICE_URL: http://harbor-jobservice
|
||||||
|
LOG_LEVEL: info
|
||||||
|
NO_PROXY: harbor-core,harbor-jobservice,harbor-database,harbor-registry,harbor-portal,harbor-trivy,harbor-exporter,127.0.0.1,localhost,.local,.internal
|
||||||
|
PERMITTED_REGISTRY_TYPES_FOR_PROXY_CACHE: docker-hub,harbor,azure-acr,aws-ecr,google-gcr,quay,docker-registry,github-ghcr,jfrog-artifactory
|
||||||
|
PORT: "8080"
|
||||||
|
PORTAL_URL: http://harbor-portal
|
||||||
|
POSTGRESQL_DATABASE: registry
|
||||||
|
POSTGRESQL_HOST: harbor-database
|
||||||
|
POSTGRESQL_MAX_IDLE_CONNS: "100"
|
||||||
|
POSTGRESQL_MAX_OPEN_CONNS: "900"
|
||||||
|
POSTGRESQL_PORT: "5432"
|
||||||
|
POSTGRESQL_SSLMODE: disable
|
||||||
|
POSTGRESQL_USERNAME: postgres
|
||||||
|
QUOTA_UPDATE_PROVIDER: db
|
||||||
|
REGISTRY_CONTROLLER_URL: http://harbor-registry:8080
|
||||||
|
REGISTRY_CREDENTIAL_USERNAME: harbor_registry_user
|
||||||
|
REGISTRY_STORAGE_PROVIDER_NAME: filesystem
|
||||||
|
REGISTRY_URL: http://harbor-registry:5000
|
||||||
|
TOKEN_SERVICE_URL: http://harbor-core:80/service/token
|
||||||
|
TRIVY_ADAPTER_URL: http://harbor-trivy:8080
|
||||||
|
WITH_TRIVY: "true"
|
||||||
|
app.conf: |
|
||||||
|
appname = Harbor
|
||||||
|
runmode = prod
|
||||||
|
enablegzip = true
|
||||||
|
|
||||||
|
[prod]
|
||||||
|
httpport = 8080
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: harbor-jobservice
|
||||||
|
namespace: harbor
|
||||||
|
data:
|
||||||
|
config.yml: |
|
||||||
|
#Server listening port
|
||||||
|
protocol: "http"
|
||||||
|
port: 8080
|
||||||
|
worker_pool:
|
||||||
|
workers: 10
|
||||||
|
backend: "redis"
|
||||||
|
redis_pool:
|
||||||
|
redis_url: "redis://harbor-redis:6379/1"
|
||||||
|
namespace: "harbor_job_service_namespace"
|
||||||
|
idle_timeout_second: 3600
|
||||||
|
job_loggers:
|
||||||
|
- name: "FILE"
|
||||||
|
level: INFO
|
||||||
|
settings: # Customized settings of logger
|
||||||
|
base_dir: "/var/log/jobs"
|
||||||
|
sweeper:
|
||||||
|
duration: 14 #days
|
||||||
|
settings: # Customized settings of sweeper
|
||||||
|
work_dir: "/var/log/jobs"
|
||||||
|
metric:
|
||||||
|
enabled: false
|
||||||
|
path: /metrics
|
||||||
|
port: 8001
|
||||||
|
#Loggers for the job service
|
||||||
|
loggers:
|
||||||
|
- name: "STD_OUTPUT"
|
||||||
|
level: INFO
|
||||||
|
reaper:
|
||||||
|
# the max time to wait for a task to finish, if unfinished after max_update_hours, the task will be mark as error, but the task will continue to run, default value is 24
|
||||||
|
max_update_hours: 24
|
||||||
|
# the max time for execution in running state without new task created
|
||||||
|
max_dangling_hours: 168
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: harbor-jobservice-env
|
||||||
|
namespace: harbor
|
||||||
|
data:
|
||||||
|
CORE_URL: http://harbor-core:80
|
||||||
|
HTTP_PROXY: ""
|
||||||
|
HTTPS_PROXY: ""
|
||||||
|
JOBSERVICE_WEBHOOK_JOB_HTTP_CLIENT_TIMEOUT: "3"
|
||||||
|
JOBSERVICE_WEBHOOK_JOB_MAX_RETRY: "3"
|
||||||
|
NO_PROXY: harbor-core,harbor-jobservice,harbor-database,harbor-registry,harbor-portal,harbor-trivy,harbor-exporter,127.0.0.1,localhost,.local,.internal
|
||||||
|
REGISTRY_CONTROLLER_URL: http://harbor-registry:8080
|
||||||
|
REGISTRY_CREDENTIAL_USERNAME: harbor_registry_user
|
||||||
|
REGISTRY_URL: http://harbor-registry:5000
|
||||||
|
TOKEN_SERVICE_URL: http://harbor-core:80/service/token
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: harbor-portal
|
||||||
|
namespace: harbor
|
||||||
|
data:
|
||||||
|
nginx.conf: |
|
||||||
|
worker_processes auto;
|
||||||
|
pid /tmp/nginx.pid;
|
||||||
|
events {
|
||||||
|
worker_connections 1024;
|
||||||
|
}
|
||||||
|
http {
|
||||||
|
client_body_temp_path /tmp/client_body_temp;
|
||||||
|
proxy_temp_path /tmp/proxy_temp;
|
||||||
|
fastcgi_temp_path /tmp/fastcgi_temp;
|
||||||
|
uwsgi_temp_path /tmp/uwsgi_temp;
|
||||||
|
scgi_temp_path /tmp/scgi_temp;
|
||||||
|
server {
|
||||||
|
listen 8080;
|
||||||
|
listen [::]:8080;
|
||||||
|
server_name localhost;
|
||||||
|
root /usr/share/nginx/html;
|
||||||
|
index index.html index.htm;
|
||||||
|
include /etc/nginx/mime.types;
|
||||||
|
gzip on;
|
||||||
|
gzip_min_length 1000;
|
||||||
|
gzip_proxied expired no-cache no-store private auth;
|
||||||
|
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
|
||||||
|
location /devcenter-api-2.0 {
|
||||||
|
try_files $uri $uri/ /swagger-ui-index.html;
|
||||||
|
}
|
||||||
|
location / {
|
||||||
|
try_files $uri $uri/ /index.html;
|
||||||
|
}
|
||||||
|
location = /index.html {
|
||||||
|
add_header Cache-Control "no-store, no-cache, must-revalidate";
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: harbor-registry
|
||||||
|
namespace: harbor
|
||||||
|
data:
|
||||||
|
config.yml: |
|
||||||
|
version: 0.1
|
||||||
|
log:
|
||||||
|
level: info
|
||||||
|
fields:
|
||||||
|
service: registry
|
||||||
|
storage:
|
||||||
|
filesystem:
|
||||||
|
rootdirectory: /storage
|
||||||
|
cache:
|
||||||
|
layerinfo: redis
|
||||||
|
maintenance:
|
||||||
|
uploadpurging:
|
||||||
|
enabled: true
|
||||||
|
age: 168h
|
||||||
|
interval: 24h
|
||||||
|
dryrun: false
|
||||||
|
delete:
|
||||||
|
enabled: true
|
||||||
|
redirect:
|
||||||
|
disable: false
|
||||||
|
redis:
|
||||||
|
addr: harbor-redis:6379
|
||||||
|
db: 2
|
||||||
|
readtimeout: 10s
|
||||||
|
writetimeout: 10s
|
||||||
|
dialtimeout: 10s
|
||||||
|
pool:
|
||||||
|
maxidle: 100
|
||||||
|
maxactive: 500
|
||||||
|
idletimeout: 60s
|
||||||
|
http:
|
||||||
|
addr: :5000
|
||||||
|
#relativeurls: false
|
||||||
|
relativeurls: true
|
||||||
|
# set via environment variable
|
||||||
|
# secret: placeholder
|
||||||
|
debug:
|
||||||
|
addr: localhost:5001
|
||||||
|
auth:
|
||||||
|
htpasswd:
|
||||||
|
realm: harbor-registry-basic-realm
|
||||||
|
path: /etc/registry/passwd
|
||||||
|
validation:
|
||||||
|
disabled: true
|
||||||
|
compatibility:
|
||||||
|
schema1:
|
||||||
|
enabled: true
|
||||||
|
ctl-config.yml: |
|
||||||
|
---
|
||||||
|
protocol: "http"
|
||||||
|
port: 8080
|
||||||
|
log_level: info
|
||||||
|
registry_config: "/etc/registry/config.yml"
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: harbor-registryctl
|
||||||
|
namespace: harbor
|
||||||
|
|
@ -0,0 +1,804 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: harbor-core
|
||||||
|
namespace: harbor
|
||||||
|
spec:
|
||||||
|
ports:
|
||||||
|
- name: http-web
|
||||||
|
port: 80
|
||||||
|
targetPort: 8080
|
||||||
|
selector:
|
||||||
|
app: harbor
|
||||||
|
component: core
|
||||||
|
release: harbor
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: harbor-database
|
||||||
|
namespace: harbor
|
||||||
|
spec:
|
||||||
|
ports:
|
||||||
|
- port: 5432
|
||||||
|
selector:
|
||||||
|
app: harbor
|
||||||
|
component: database
|
||||||
|
release: harbor
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: harbor-jobservice
|
||||||
|
namespace: harbor
|
||||||
|
spec:
|
||||||
|
ports:
|
||||||
|
- name: http-jobservice
|
||||||
|
port: 80
|
||||||
|
targetPort: 8080
|
||||||
|
selector:
|
||||||
|
app: harbor
|
||||||
|
component: jobservice
|
||||||
|
release: harbor
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: harbor-portal
|
||||||
|
namespace: harbor
|
||||||
|
spec:
|
||||||
|
ports:
|
||||||
|
- port: 80
|
||||||
|
targetPort: 8080
|
||||||
|
selector:
|
||||||
|
app: harbor
|
||||||
|
component: portal
|
||||||
|
release: harbor
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: harbor-redis
|
||||||
|
namespace: harbor
|
||||||
|
spec:
|
||||||
|
ports:
|
||||||
|
- port: 6379
|
||||||
|
selector:
|
||||||
|
app: harbor
|
||||||
|
component: redis
|
||||||
|
release: harbor
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: harbor-registry
|
||||||
|
namespace: harbor
|
||||||
|
spec:
|
||||||
|
ports:
|
||||||
|
- name: http-registry
|
||||||
|
port: 5000
|
||||||
|
- name: http-controller
|
||||||
|
port: 8080
|
||||||
|
selector:
|
||||||
|
app: harbor
|
||||||
|
component: registry
|
||||||
|
release: harbor
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: harbor-trivy
|
||||||
|
namespace: harbor
|
||||||
|
spec:
|
||||||
|
ports:
|
||||||
|
- name: http-trivy
|
||||||
|
port: 8080
|
||||||
|
protocol: TCP
|
||||||
|
selector:
|
||||||
|
app: harbor
|
||||||
|
component: trivy
|
||||||
|
release: harbor
|
||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
component: core
|
||||||
|
release: harbor
|
||||||
|
name: harbor-core
|
||||||
|
namespace: harbor
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
revisionHistoryLimit: 10
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: harbor
|
||||||
|
component: core
|
||||||
|
release: harbor
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
component: core
|
||||||
|
release: harbor
|
||||||
|
spec:
|
||||||
|
nodeSelector:
|
||||||
|
nodegroup: nd
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
containers:
|
||||||
|
- env:
|
||||||
|
- name: CORE_SECRET
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
key: secret
|
||||||
|
name: harbor-core
|
||||||
|
- name: JOBSERVICE_SECRET
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
key: JOBSERVICE_SECRET
|
||||||
|
name: harbor-jobservice
|
||||||
|
envFrom:
|
||||||
|
- configMapRef:
|
||||||
|
name: harbor-core
|
||||||
|
- secretRef:
|
||||||
|
name: harbor-core
|
||||||
|
image: goharbor/harbor-core:v2.11.2
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
livenessProbe:
|
||||||
|
failureThreshold: 2
|
||||||
|
httpGet:
|
||||||
|
path: /api/v2.0/ping
|
||||||
|
port: 8080
|
||||||
|
scheme: HTTP
|
||||||
|
periodSeconds: 10
|
||||||
|
name: core
|
||||||
|
ports:
|
||||||
|
- containerPort: 8080
|
||||||
|
readinessProbe:
|
||||||
|
failureThreshold: 2
|
||||||
|
httpGet:
|
||||||
|
path: /api/v2.0/ping
|
||||||
|
port: 8080
|
||||||
|
scheme: HTTP
|
||||||
|
periodSeconds: 10
|
||||||
|
startupProbe:
|
||||||
|
failureThreshold: 360
|
||||||
|
httpGet:
|
||||||
|
path: /api/v2.0/ping
|
||||||
|
port: 8080
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: 10
|
||||||
|
periodSeconds: 10
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /etc/core/app.conf
|
||||||
|
name: config
|
||||||
|
subPath: app.conf
|
||||||
|
- mountPath: /etc/core/key
|
||||||
|
name: secret-key
|
||||||
|
subPath: key
|
||||||
|
- mountPath: /etc/core/private_key.pem
|
||||||
|
name: token-service-private-key
|
||||||
|
subPath: tls.key
|
||||||
|
- mountPath: /etc/core/ca
|
||||||
|
name: ca-download
|
||||||
|
- mountPath: /etc/core/token
|
||||||
|
name: psc
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 10000
|
||||||
|
runAsUser: 10000
|
||||||
|
terminationGracePeriodSeconds: 120
|
||||||
|
volumes:
|
||||||
|
- configMap:
|
||||||
|
items:
|
||||||
|
- key: app.conf
|
||||||
|
path: app.conf
|
||||||
|
name: harbor-core
|
||||||
|
name: config
|
||||||
|
- name: secret-key
|
||||||
|
secret:
|
||||||
|
items:
|
||||||
|
- key: secretKey
|
||||||
|
path: key
|
||||||
|
secretName: harbor-core
|
||||||
|
- name: token-service-private-key
|
||||||
|
secret:
|
||||||
|
secretName: harbor-core
|
||||||
|
- name: ca-download
|
||||||
|
secret:
|
||||||
|
secretName: harbor-cacerts
|
||||||
|
- emptyDir: {}
|
||||||
|
name: psc
|
||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
component: jobservice
|
||||||
|
release: harbor
|
||||||
|
name: harbor-jobservice
|
||||||
|
namespace: harbor
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
revisionHistoryLimit: 10
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: harbor
|
||||||
|
component: jobservice
|
||||||
|
release: harbor
|
||||||
|
strategy:
|
||||||
|
type: RollingUpdate
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
component: jobservice
|
||||||
|
release: harbor
|
||||||
|
spec:
|
||||||
|
nodeSelector:
|
||||||
|
nodegroup: nd
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
containers:
|
||||||
|
- env:
|
||||||
|
- name: CORE_SECRET
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
key: secret
|
||||||
|
name: harbor-core
|
||||||
|
envFrom:
|
||||||
|
- configMapRef:
|
||||||
|
name: harbor-jobservice-env
|
||||||
|
- secretRef:
|
||||||
|
name: harbor-jobservice
|
||||||
|
image: goharbor/harbor-jobservice:v2.11.2
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /api/v1/stats
|
||||||
|
port: 8080
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: 300
|
||||||
|
periodSeconds: 10
|
||||||
|
name: jobservice
|
||||||
|
ports:
|
||||||
|
- containerPort: 8080
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /api/v1/stats
|
||||||
|
port: 8080
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: 20
|
||||||
|
periodSeconds: 10
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /etc/jobservice/config.yml
|
||||||
|
name: jobservice-config
|
||||||
|
subPath: config.yml
|
||||||
|
- mountPath: /var/log/jobs
|
||||||
|
name: job-logs
|
||||||
|
subPath: null
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 10000
|
||||||
|
runAsUser: 10000
|
||||||
|
terminationGracePeriodSeconds: 120
|
||||||
|
volumes:
|
||||||
|
- configMap:
|
||||||
|
name: harbor-jobservice
|
||||||
|
name: jobservice-config
|
||||||
|
- name: job-logs
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: harbor-jobservice
|
||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
component: portal
|
||||||
|
release: harbor
|
||||||
|
name: harbor-portal
|
||||||
|
namespace: harbor
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
revisionHistoryLimit: 10
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: harbor
|
||||||
|
component: portal
|
||||||
|
release: harbor
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
component: portal
|
||||||
|
release: harbor
|
||||||
|
spec:
|
||||||
|
nodeSelector:
|
||||||
|
nodegroup: nd
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
containers:
|
||||||
|
- image: goharbor/harbor-portal:v2.11.2
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /
|
||||||
|
port: 8080
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: 300
|
||||||
|
periodSeconds: 10
|
||||||
|
name: portal
|
||||||
|
ports:
|
||||||
|
- containerPort: 8080
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /
|
||||||
|
port: 8080
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: 1
|
||||||
|
periodSeconds: 10
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /etc/nginx/nginx.conf
|
||||||
|
name: portal-config
|
||||||
|
subPath: nginx.conf
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 10000
|
||||||
|
runAsUser: 10000
|
||||||
|
volumes:
|
||||||
|
- configMap:
|
||||||
|
name: harbor-portal
|
||||||
|
name: portal-config
|
||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
component: registry
|
||||||
|
release: harbor
|
||||||
|
name: harbor-registry
|
||||||
|
namespace: harbor
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
revisionHistoryLimit: 10
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: harbor
|
||||||
|
component: registry
|
||||||
|
release: harbor
|
||||||
|
strategy:
|
||||||
|
type: RollingUpdate
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
component: registry
|
||||||
|
release: harbor
|
||||||
|
spec:
|
||||||
|
nodeSelector:
|
||||||
|
nodegroup: nd
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
containers:
|
||||||
|
- args:
|
||||||
|
- serve
|
||||||
|
- /etc/registry/config.yml
|
||||||
|
env: null
|
||||||
|
envFrom:
|
||||||
|
- secretRef:
|
||||||
|
name: harbor-registry
|
||||||
|
image: goharbor/registry-photon:v2.11.2
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /
|
||||||
|
port: 5000
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: 300
|
||||||
|
periodSeconds: 10
|
||||||
|
name: registry
|
||||||
|
ports:
|
||||||
|
- containerPort: 5000
|
||||||
|
- containerPort: 5001
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /
|
||||||
|
port: 5000
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: 1
|
||||||
|
periodSeconds: 10
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /storage
|
||||||
|
name: registry-data
|
||||||
|
subPath: null
|
||||||
|
- mountPath: /etc/registry/passwd
|
||||||
|
name: registry-htpasswd
|
||||||
|
subPath: passwd
|
||||||
|
- mountPath: /etc/registry/config.yml
|
||||||
|
name: registry-config
|
||||||
|
subPath: config.yml
|
||||||
|
- env:
|
||||||
|
- name: CORE_SECRET
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
key: secret
|
||||||
|
name: harbor-core
|
||||||
|
- name: JOBSERVICE_SECRET
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
key: JOBSERVICE_SECRET
|
||||||
|
name: harbor-jobservice
|
||||||
|
envFrom:
|
||||||
|
- configMapRef:
|
||||||
|
name: harbor-registryctl
|
||||||
|
- secretRef:
|
||||||
|
name: harbor-registry
|
||||||
|
- secretRef:
|
||||||
|
name: harbor-registryctl
|
||||||
|
image: goharbor/harbor-registryctl:v2.11.2
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /api/health
|
||||||
|
port: 8080
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: 300
|
||||||
|
periodSeconds: 10
|
||||||
|
name: registryctl
|
||||||
|
ports:
|
||||||
|
- containerPort: 8080
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /api/health
|
||||||
|
port: 8080
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: 1
|
||||||
|
periodSeconds: 10
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /storage
|
||||||
|
name: registry-data
|
||||||
|
subPath: null
|
||||||
|
- mountPath: /etc/registry/config.yml
|
||||||
|
name: registry-config
|
||||||
|
subPath: config.yml
|
||||||
|
- mountPath: /etc/registryctl/config.yml
|
||||||
|
name: registry-config
|
||||||
|
subPath: ctl-config.yml
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 10000
|
||||||
|
fsGroupChangePolicy: OnRootMismatch
|
||||||
|
runAsUser: 10000
|
||||||
|
terminationGracePeriodSeconds: 120
|
||||||
|
volumes:
|
||||||
|
- name: registry-htpasswd
|
||||||
|
secret:
|
||||||
|
items:
|
||||||
|
- key: REGISTRY_HTPASSWD
|
||||||
|
path: passwd
|
||||||
|
secretName: harbor-registry-htpasswd
|
||||||
|
- configMap:
|
||||||
|
name: harbor-registry
|
||||||
|
name: registry-config
|
||||||
|
- name: registry-data
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: harbor-registry
|
||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: StatefulSet
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
component: database
|
||||||
|
release: harbor
|
||||||
|
name: harbor-database
|
||||||
|
namespace: harbor
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: harbor
|
||||||
|
component: database
|
||||||
|
release: harbor
|
||||||
|
serviceName: harbor-database
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
component: database
|
||||||
|
release: harbor
|
||||||
|
spec:
|
||||||
|
nodeSelector:
|
||||||
|
nodegroup: nd
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
containers:
|
||||||
|
- env:
|
||||||
|
- name: PGDATA
|
||||||
|
value: /var/lib/postgresql/data/pgdata
|
||||||
|
envFrom:
|
||||||
|
- secretRef:
|
||||||
|
name: harbor-database
|
||||||
|
image: goharbor/harbor-db:v2.11.2
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
livenessProbe:
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /docker-healthcheck.sh
|
||||||
|
initialDelaySeconds: 300
|
||||||
|
periodSeconds: 10
|
||||||
|
timeoutSeconds: 1
|
||||||
|
name: database
|
||||||
|
readinessProbe:
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /docker-healthcheck.sh
|
||||||
|
initialDelaySeconds: 1
|
||||||
|
periodSeconds: 10
|
||||||
|
timeoutSeconds: 1
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /var/lib/postgresql/data
|
||||||
|
name: database-data
|
||||||
|
- mountPath: /dev/shm
|
||||||
|
name: shm-volume
|
||||||
|
initContainers:
|
||||||
|
- args:
|
||||||
|
- -c
|
||||||
|
- '[ -e /var/lib/postgresql/data/postgresql.conf ] && [ ! -d /var/lib/postgresql/data/pgdata
|
||||||
|
] && mkdir -m 0700 /var/lib/postgresql/data/pgdata && mv /var/lib/postgresql/data/*
|
||||||
|
/var/lib/postgresql/data/pgdata/ || true'
|
||||||
|
command:
|
||||||
|
- /bin/sh
|
||||||
|
image: goharbor/harbor-db:v2.11.2
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
name: data-migrator
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /var/lib/postgresql/data
|
||||||
|
name: database-data
|
||||||
|
- args:
|
||||||
|
- -c
|
||||||
|
- chmod -R 700 /var/lib/postgresql/data/pgdata || true
|
||||||
|
command:
|
||||||
|
- /bin/sh
|
||||||
|
image: goharbor/harbor-db:v2.11.2
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
name: data-permissions-ensurer
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /var/lib/postgresql/data
|
||||||
|
name: database-data
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 999
|
||||||
|
runAsUser: 999
|
||||||
|
terminationGracePeriodSeconds: 120
|
||||||
|
volumes:
|
||||||
|
- emptyDir:
|
||||||
|
medium: Memory
|
||||||
|
sizeLimit: 512Mi
|
||||||
|
name: shm-volume
|
||||||
|
volumeClaimTemplates:
|
||||||
|
- metadata:
|
||||||
|
annotations: null
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: database-data
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 10Gi
|
||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: StatefulSet
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
component: redis
|
||||||
|
release: harbor
|
||||||
|
name: harbor-redis
|
||||||
|
namespace: harbor
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: harbor
|
||||||
|
component: redis
|
||||||
|
release: harbor
|
||||||
|
serviceName: harbor-redis
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
component: redis
|
||||||
|
release: harbor
|
||||||
|
spec:
|
||||||
|
nodeSelector:
|
||||||
|
nodegroup: nd
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
containers:
|
||||||
|
- image: goharbor/redis-photon:v2.11.2
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
livenessProbe:
|
||||||
|
initialDelaySeconds: 300
|
||||||
|
periodSeconds: 10
|
||||||
|
tcpSocket:
|
||||||
|
port: 6379
|
||||||
|
name: redis
|
||||||
|
readinessProbe:
|
||||||
|
initialDelaySeconds: 1
|
||||||
|
periodSeconds: 10
|
||||||
|
tcpSocket:
|
||||||
|
port: 6379
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /var/lib/redis
|
||||||
|
name: data
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 999
|
||||||
|
runAsUser: 999
|
||||||
|
terminationGracePeriodSeconds: 120
|
||||||
|
volumeClaimTemplates:
|
||||||
|
- metadata:
|
||||||
|
annotations: null
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: data
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 10Gi
|
||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: StatefulSet
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
component: trivy
|
||||||
|
release: harbor
|
||||||
|
name: harbor-trivy
|
||||||
|
namespace: harbor
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: harbor
|
||||||
|
component: trivy
|
||||||
|
release: harbor
|
||||||
|
serviceName: harbor-trivy
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
component: trivy
|
||||||
|
release: harbor
|
||||||
|
spec:
|
||||||
|
nodeSelector:
|
||||||
|
nodegroup: nd
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
containers:
|
||||||
|
- env:
|
||||||
|
- name: HTTP_PROXY
|
||||||
|
value: ""
|
||||||
|
- name: HTTPS_PROXY
|
||||||
|
value: ""
|
||||||
|
- name: NO_PROXY
|
||||||
|
value: harbor-core,harbor-jobservice,harbor-database,harbor-registry,harbor-portal,harbor-trivy,harbor-exporter,127.0.0.1,localhost,.local,.internal
|
||||||
|
- name: SCANNER_LOG_LEVEL
|
||||||
|
value: info
|
||||||
|
- name: SCANNER_TRIVY_CACHE_DIR
|
||||||
|
value: /home/scanner/.cache/trivy
|
||||||
|
- name: SCANNER_TRIVY_REPORTS_DIR
|
||||||
|
value: /home/scanner/.cache/reports
|
||||||
|
- name: SCANNER_TRIVY_DEBUG_MODE
|
||||||
|
value: "false"
|
||||||
|
- name: SCANNER_TRIVY_VULN_TYPE
|
||||||
|
value: os,library
|
||||||
|
- name: SCANNER_TRIVY_TIMEOUT
|
||||||
|
value: 5m0s
|
||||||
|
- name: SCANNER_TRIVY_GITHUB_TOKEN
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
key: gitHubToken
|
||||||
|
name: harbor-trivy
|
||||||
|
- name: SCANNER_TRIVY_SEVERITY
|
||||||
|
value: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
|
||||||
|
- name: SCANNER_TRIVY_IGNORE_UNFIXED
|
||||||
|
value: "false"
|
||||||
|
- name: SCANNER_TRIVY_SKIP_UPDATE
|
||||||
|
value: "false"
|
||||||
|
- name: SCANNER_TRIVY_OFFLINE_SCAN
|
||||||
|
value: "false"
|
||||||
|
- name: SCANNER_TRIVY_SECURITY_CHECKS
|
||||||
|
value: vuln
|
||||||
|
- name: SCANNER_TRIVY_INSECURE
|
||||||
|
value: "false"
|
||||||
|
- name: SCANNER_API_SERVER_ADDR
|
||||||
|
value: :8080
|
||||||
|
- name: SCANNER_REDIS_URL
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
key: redisURL
|
||||||
|
name: harbor-trivy
|
||||||
|
- name: SCANNER_STORE_REDIS_URL
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
key: redisURL
|
||||||
|
name: harbor-trivy
|
||||||
|
- name: SCANNER_JOB_QUEUE_REDIS_URL
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
key: redisURL
|
||||||
|
name: harbor-trivy
|
||||||
|
image: goharbor/trivy-adapter-photon:v2.11.2
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
livenessProbe:
|
||||||
|
failureThreshold: 10
|
||||||
|
httpGet:
|
||||||
|
path: /probe/healthy
|
||||||
|
port: api-server
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
name: trivy
|
||||||
|
ports:
|
||||||
|
- containerPort: 8080
|
||||||
|
name: api-server
|
||||||
|
readinessProbe:
|
||||||
|
failureThreshold: 3
|
||||||
|
httpGet:
|
||||||
|
path: /probe/ready
|
||||||
|
port: api-server
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 1
|
||||||
|
memory: 1Gi
|
||||||
|
requests:
|
||||||
|
cpu: 200m
|
||||||
|
memory: 512Mi
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
privileged: false
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /home/scanner/.cache
|
||||||
|
name: data
|
||||||
|
readOnly: false
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 10000
|
||||||
|
runAsUser: 10000
|
||||||
|
volumeClaimTemplates:
|
||||||
|
- metadata:
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: data
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 50Gi
|
||||||
|
|
@ -0,0 +1,64 @@
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: Ingress
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
ingress.kubernetes.io/proxy-body-size: "0"
|
||||||
|
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
||||||
|
#nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||||
|
labels:
|
||||||
|
app: harbor
|
||||||
|
release: harbor
|
||||||
|
name: harbor-ingress
|
||||||
|
namespace: harbor
|
||||||
|
spec:
|
||||||
|
ingressClassName: nginx
|
||||||
|
tls:
|
||||||
|
- hosts:
|
||||||
|
- "harbor.nhngpuaas.com"
|
||||||
|
secretName: nhngpuaas-ssl
|
||||||
|
rules:
|
||||||
|
- host: harbor.nhngpuaas.com
|
||||||
|
http:
|
||||||
|
paths:
|
||||||
|
- backend:
|
||||||
|
service:
|
||||||
|
name: harbor-core
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
|
path: /api/
|
||||||
|
pathType: Prefix
|
||||||
|
- backend:
|
||||||
|
service:
|
||||||
|
name: harbor-core
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
|
path: /service/
|
||||||
|
pathType: Prefix
|
||||||
|
- backend:
|
||||||
|
service:
|
||||||
|
name: harbor-core
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
|
path: /v2/
|
||||||
|
pathType: Prefix
|
||||||
|
- backend:
|
||||||
|
service:
|
||||||
|
name: harbor-core
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
|
path: /chartrepo/
|
||||||
|
pathType: Prefix
|
||||||
|
- backend:
|
||||||
|
service:
|
||||||
|
name: harbor-core
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
|
path: /c/
|
||||||
|
pathType: Prefix
|
||||||
|
- backend:
|
||||||
|
service:
|
||||||
|
name: harbor-portal
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
|
path: /
|
||||||
|
pathType: Prefix
|
||||||
|
|
@ -0,0 +1,13 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Pod
|
||||||
|
metadata:
|
||||||
|
name: nginx-pod
|
||||||
|
labels:
|
||||||
|
app: nginx
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: nginx
|
||||||
|
image: harbor.nhngpuaas.com/test/nginx:test
|
||||||
|
ports:
|
||||||
|
- containerPort: 80
|
||||||
|
|
||||||
|
|
@ -0,0 +1,12 @@
|
||||||
|
#!/usr/bin/python3
|
||||||
|
import os
|
||||||
|
import subprocess
|
||||||
|
|
||||||
|
pv_str = os.popen("kubectl get -n default pv | grep harbor | awk '$1 > 0 {print $1}'").read()
|
||||||
|
print(pv_str)
|
||||||
|
pv_list = pv_str.split('\n')
|
||||||
|
i = 0
|
||||||
|
for pv in pv_list:
|
||||||
|
print(pv)
|
||||||
|
# os.system(f"kubectl delete -n {ns} pv {pv}")
|
||||||
|
os.system(f"kubectl delete pv {pv}")
|
||||||
|
|
@ -0,0 +1,321 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
name: ingress-nginx
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
automountServiceAccountToken: true
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
automountServiceAccountToken: true
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx
|
||||||
|
namespace: ingress-nginx
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- namespaces
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- configmaps
|
||||||
|
- pods
|
||||||
|
- secrets
|
||||||
|
- endpoints
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- services
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingresses
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingresses/status
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingressclasses
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- coordination.k8s.io
|
||||||
|
resourceNames:
|
||||||
|
- ingress-nginx-leader
|
||||||
|
resources:
|
||||||
|
- leases
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- coordination.k8s.io
|
||||||
|
resources:
|
||||||
|
- leases
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- patch
|
||||||
|
- apiGroups:
|
||||||
|
- discovery.k8s.io
|
||||||
|
resources:
|
||||||
|
- endpointslices
|
||||||
|
verbs:
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- get
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- create
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- configmaps
|
||||||
|
- endpoints
|
||||||
|
- nodes
|
||||||
|
- pods
|
||||||
|
- secrets
|
||||||
|
- namespaces
|
||||||
|
verbs:
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- coordination.k8s.io
|
||||||
|
resources:
|
||||||
|
- leases
|
||||||
|
verbs:
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- nodes
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- services
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingresses
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- patch
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingresses/status
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingressclasses
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- discovery.k8s.io
|
||||||
|
resources:
|
||||||
|
- endpointslices
|
||||||
|
verbs:
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- get
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- admissionregistration.k8s.io
|
||||||
|
resources:
|
||||||
|
- validatingwebhookconfigurations
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- update
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx
|
||||||
|
namespace: ingress-nginx
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: ingress-nginx
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: ingress-nginx
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: ingress-nginx
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: ingress-nginx
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
|
@ -0,0 +1,15 @@
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
data:
|
||||||
|
allow-snippet-annotations: "false"
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-controller
|
||||||
|
namespace: ingress-nginx
|
||||||
|
|
||||||
|
|
@ -0,0 +1,331 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-controller
|
||||||
|
namespace: ingress-nginx
|
||||||
|
spec:
|
||||||
|
ipFamilies:
|
||||||
|
- IPv4
|
||||||
|
ipFamilyPolicy: SingleStack
|
||||||
|
ports:
|
||||||
|
- appProtocol: http
|
||||||
|
name: http
|
||||||
|
port: 80
|
||||||
|
protocol: TCP
|
||||||
|
targetPort: http
|
||||||
|
nodePort: 30100 # by.sdjo
|
||||||
|
- appProtocol: https
|
||||||
|
name: https
|
||||||
|
port: 443
|
||||||
|
protocol: TCP
|
||||||
|
targetPort: https
|
||||||
|
nodePort: 30101 # by.sdjo
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
type: NodePort
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-controller-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
spec:
|
||||||
|
ports:
|
||||||
|
- appProtocol: https
|
||||||
|
name: https-webhook
|
||||||
|
port: 443
|
||||||
|
targetPort: webhook
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
type: ClusterIP
|
||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-controller
|
||||||
|
namespace: ingress-nginx
|
||||||
|
spec:
|
||||||
|
minReadySeconds: 0
|
||||||
|
revisionHistoryLimit: 10
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
strategy:
|
||||||
|
rollingUpdate:
|
||||||
|
maxUnavailable: 1
|
||||||
|
type: RollingUpdate
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- args:
|
||||||
|
- /nginx-ingress-controller
|
||||||
|
- --election-id=ingress-nginx-leader
|
||||||
|
- --controller-class=k8s.io/ingress-nginx
|
||||||
|
- --ingress-class=nginx
|
||||||
|
- --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
|
||||||
|
- --validating-webhook=:8443
|
||||||
|
- --validating-webhook-certificate=/usr/local/certificates/cert
|
||||||
|
- --validating-webhook-key=/usr/local/certificates/key
|
||||||
|
- --enable-metrics=false
|
||||||
|
env:
|
||||||
|
- name: POD_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
- name: POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
- name: LD_PRELOAD
|
||||||
|
value: /usr/local/lib/libmimalloc.so
|
||||||
|
image: registry.k8s.io/ingress-nginx/controller:v1.11.2 # by.ljh
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
lifecycle:
|
||||||
|
preStop:
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /wait-shutdown
|
||||||
|
livenessProbe:
|
||||||
|
failureThreshold: 5
|
||||||
|
httpGet:
|
||||||
|
path: /healthz
|
||||||
|
port: 10254
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: 10
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 1
|
||||||
|
name: controller
|
||||||
|
ports:
|
||||||
|
- containerPort: 80
|
||||||
|
name: http
|
||||||
|
protocol: TCP
|
||||||
|
- containerPort: 443
|
||||||
|
name: https
|
||||||
|
protocol: TCP
|
||||||
|
- containerPort: 8443
|
||||||
|
name: webhook
|
||||||
|
protocol: TCP
|
||||||
|
readinessProbe:
|
||||||
|
failureThreshold: 3
|
||||||
|
httpGet:
|
||||||
|
path: /healthz
|
||||||
|
port: 10254
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: 10
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 1
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 90Mi
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
add:
|
||||||
|
- NET_BIND_SERVICE
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
readOnlyRootFilesystem: false
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 101
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /usr/local/certificates/
|
||||||
|
name: webhook-cert
|
||||||
|
readOnly: true
|
||||||
|
dnsPolicy: ClusterFirst
|
||||||
|
nodeSelector:
|
||||||
|
kubernetes.io/os: linux
|
||||||
|
nodegroup: nd
|
||||||
|
serviceAccountName: ingress-nginx
|
||||||
|
terminationGracePeriodSeconds: 300
|
||||||
|
volumes:
|
||||||
|
- name: webhook-cert
|
||||||
|
secret:
|
||||||
|
secretName: ingress-nginx-admission
|
||||||
|
---
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: Job
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission-create
|
||||||
|
namespace: ingress-nginx
|
||||||
|
spec:
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission-create
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- args:
|
||||||
|
- create
|
||||||
|
- --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
|
||||||
|
- --namespace=$(POD_NAMESPACE)
|
||||||
|
- --secret-name=ingress-nginx-admission
|
||||||
|
env:
|
||||||
|
- name: POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.3 #by.ljh
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
name: create
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 65532
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
nodeSelector:
|
||||||
|
kubernetes.io/os: linux
|
||||||
|
nodegroup: nd
|
||||||
|
restartPolicy: OnFailure
|
||||||
|
serviceAccountName: ingress-nginx-admission
|
||||||
|
---
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: Job
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission-patch
|
||||||
|
namespace: ingress-nginx
|
||||||
|
spec:
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission-patch
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- args:
|
||||||
|
- patch
|
||||||
|
- --webhook-name=ingress-nginx-admission
|
||||||
|
- --namespace=$(POD_NAMESPACE)
|
||||||
|
- --patch-mutating=false
|
||||||
|
- --secret-name=ingress-nginx-admission
|
||||||
|
- --patch-failure-policy=Fail
|
||||||
|
env:
|
||||||
|
- name: POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.3 #by.ljh
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
name: patch
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 65532
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
nodeSelector:
|
||||||
|
kubernetes.io/os: linux
|
||||||
|
nodegroup: nd
|
||||||
|
restartPolicy: OnFailure
|
||||||
|
serviceAccountName: ingress-nginx-admission
|
||||||
|
---
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: IngressClass
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: nginx
|
||||||
|
spec:
|
||||||
|
controller: k8s.io/ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: admissionregistration.k8s.io/v1
|
||||||
|
kind: ValidatingWebhookConfiguration
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
webhooks:
|
||||||
|
- admissionReviewVersions:
|
||||||
|
- v1
|
||||||
|
clientConfig:
|
||||||
|
service:
|
||||||
|
name: ingress-nginx-controller-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
path: /networking/v1/ingresses
|
||||||
|
failurePolicy: Fail
|
||||||
|
matchPolicy: Equivalent
|
||||||
|
name: validate.nginx.ingress.kubernetes.io
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
apiVersions:
|
||||||
|
- v1
|
||||||
|
operations:
|
||||||
|
- CREATE
|
||||||
|
- UPDATE
|
||||||
|
resources:
|
||||||
|
- ingresses
|
||||||
|
sideEffects: None
|
||||||
|
|
@ -0,0 +1,663 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
name: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
automountServiceAccountToken: true
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
automountServiceAccountToken: true
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx
|
||||||
|
namespace: ingress-nginx
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- namespaces
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- configmaps
|
||||||
|
- pods
|
||||||
|
- secrets
|
||||||
|
- endpoints
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- services
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingresses
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingresses/status
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingressclasses
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- coordination.k8s.io
|
||||||
|
resourceNames:
|
||||||
|
- ingress-nginx-leader
|
||||||
|
resources:
|
||||||
|
- leases
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- coordination.k8s.io
|
||||||
|
resources:
|
||||||
|
- leases
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- patch
|
||||||
|
- apiGroups:
|
||||||
|
- discovery.k8s.io
|
||||||
|
resources:
|
||||||
|
- endpointslices
|
||||||
|
verbs:
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- get
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- create
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- configmaps
|
||||||
|
- endpoints
|
||||||
|
- nodes
|
||||||
|
- pods
|
||||||
|
- secrets
|
||||||
|
- namespaces
|
||||||
|
verbs:
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- coordination.k8s.io
|
||||||
|
resources:
|
||||||
|
- leases
|
||||||
|
verbs:
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- nodes
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- services
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingresses
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- patch
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingresses/status
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingressclasses
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- discovery.k8s.io
|
||||||
|
resources:
|
||||||
|
- endpointslices
|
||||||
|
verbs:
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- get
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- admissionregistration.k8s.io
|
||||||
|
resources:
|
||||||
|
- validatingwebhookconfigurations
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- update
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx
|
||||||
|
namespace: ingress-nginx
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: ingress-nginx
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: ingress-nginx
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: ingress-nginx
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: ingress-nginx
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
data:
|
||||||
|
allow-snippet-annotations: "false"
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-controller
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-controller
|
||||||
|
namespace: ingress-nginx
|
||||||
|
spec:
|
||||||
|
ipFamilies:
|
||||||
|
- IPv4
|
||||||
|
ipFamilyPolicy: SingleStack
|
||||||
|
ports:
|
||||||
|
- appProtocol: http
|
||||||
|
name: http
|
||||||
|
port: 80
|
||||||
|
protocol: TCP
|
||||||
|
targetPort: http
|
||||||
|
nodePort: 30100 # by.sdjo
|
||||||
|
- appProtocol: https
|
||||||
|
name: https
|
||||||
|
port: 443
|
||||||
|
protocol: TCP
|
||||||
|
targetPort: https
|
||||||
|
nodePort: 30101 # by.sdjo
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
type: NodePort
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-controller-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
spec:
|
||||||
|
ports:
|
||||||
|
- appProtocol: https
|
||||||
|
name: https-webhook
|
||||||
|
port: 443
|
||||||
|
targetPort: webhook
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
type: ClusterIP
|
||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-controller
|
||||||
|
namespace: ingress-nginx
|
||||||
|
spec:
|
||||||
|
minReadySeconds: 0
|
||||||
|
revisionHistoryLimit: 10
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
strategy:
|
||||||
|
rollingUpdate:
|
||||||
|
maxUnavailable: 1
|
||||||
|
type: RollingUpdate
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- args:
|
||||||
|
- /nginx-ingress-controller
|
||||||
|
- --election-id=ingress-nginx-leader
|
||||||
|
- --controller-class=k8s.io/ingress-nginx
|
||||||
|
- --ingress-class=nginx
|
||||||
|
- --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
|
||||||
|
- --validating-webhook=:8443
|
||||||
|
- --validating-webhook-certificate=/usr/local/certificates/cert
|
||||||
|
- --validating-webhook-key=/usr/local/certificates/key
|
||||||
|
- --enable-metrics=false
|
||||||
|
env:
|
||||||
|
- name: POD_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
- name: POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
- name: LD_PRELOAD
|
||||||
|
value: /usr/local/lib/libmimalloc.so
|
||||||
|
image: reg.inje-private.com/nnd002/ingress-nginx/controller:v1.11.2 # by.ljh
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
lifecycle:
|
||||||
|
preStop:
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /wait-shutdown
|
||||||
|
livenessProbe:
|
||||||
|
failureThreshold: 5
|
||||||
|
httpGet:
|
||||||
|
path: /healthz
|
||||||
|
port: 10254
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: 10
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 1
|
||||||
|
name: controller
|
||||||
|
ports:
|
||||||
|
- containerPort: 80
|
||||||
|
name: http
|
||||||
|
protocol: TCP
|
||||||
|
- containerPort: 443
|
||||||
|
name: https
|
||||||
|
protocol: TCP
|
||||||
|
- containerPort: 8443
|
||||||
|
name: webhook
|
||||||
|
protocol: TCP
|
||||||
|
readinessProbe:
|
||||||
|
failureThreshold: 3
|
||||||
|
httpGet:
|
||||||
|
path: /healthz
|
||||||
|
port: 10254
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: 10
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 1
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 90Mi
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
add:
|
||||||
|
- NET_BIND_SERVICE
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
readOnlyRootFilesystem: false
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 101
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /usr/local/certificates/
|
||||||
|
name: webhook-cert
|
||||||
|
readOnly: true
|
||||||
|
dnsPolicy: ClusterFirst
|
||||||
|
nodeSelector:
|
||||||
|
kubernetes.io/os: linux
|
||||||
|
serviceAccountName: ingress-nginx
|
||||||
|
terminationGracePeriodSeconds: 300
|
||||||
|
volumes:
|
||||||
|
- name: webhook-cert
|
||||||
|
secret:
|
||||||
|
secretName: ingress-nginx-admission
|
||||||
|
---
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: Job
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission-create
|
||||||
|
namespace: ingress-nginx
|
||||||
|
spec:
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission-create
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- args:
|
||||||
|
- create
|
||||||
|
- --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
|
||||||
|
- --namespace=$(POD_NAMESPACE)
|
||||||
|
- --secret-name=ingress-nginx-admission
|
||||||
|
env:
|
||||||
|
- name: POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
image: reg.inje-private.com/nnd002/ingress-nginx/kube-webhook-certgen:v1.4.3 #by.ljh
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
name: create
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 65532
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
nodeSelector:
|
||||||
|
kubernetes.io/os: linux
|
||||||
|
restartPolicy: OnFailure
|
||||||
|
serviceAccountName: ingress-nginx-admission
|
||||||
|
---
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: Job
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission-patch
|
||||||
|
namespace: ingress-nginx
|
||||||
|
spec:
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission-patch
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- args:
|
||||||
|
- patch
|
||||||
|
- --webhook-name=ingress-nginx-admission
|
||||||
|
- --namespace=$(POD_NAMESPACE)
|
||||||
|
- --patch-mutating=false
|
||||||
|
- --secret-name=ingress-nginx-admission
|
||||||
|
- --patch-failure-policy=Fail
|
||||||
|
env:
|
||||||
|
- name: POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
image: reg.inje-private.com/nnd002/ingress-nginx/kube-webhook-certgen:v1.4.3 #by.ljh
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
name: patch
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 65532
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
nodeSelector:
|
||||||
|
kubernetes.io/os: linux
|
||||||
|
restartPolicy: OnFailure
|
||||||
|
serviceAccountName: ingress-nginx-admission
|
||||||
|
---
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: IngressClass
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: nginx
|
||||||
|
spec:
|
||||||
|
controller: k8s.io/ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: admissionregistration.k8s.io/v1
|
||||||
|
kind: ValidatingWebhookConfiguration
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
webhooks:
|
||||||
|
- admissionReviewVersions:
|
||||||
|
- v1
|
||||||
|
clientConfig:
|
||||||
|
service:
|
||||||
|
name: ingress-nginx-controller-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
path: /networking/v1/ingresses
|
||||||
|
failurePolicy: Fail
|
||||||
|
matchPolicy: Equivalent
|
||||||
|
name: validate.nginx.ingress.kubernetes.io
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
apiVersions:
|
||||||
|
- v1
|
||||||
|
operations:
|
||||||
|
- CREATE
|
||||||
|
- UPDATE
|
||||||
|
resources:
|
||||||
|
- ingresses
|
||||||
|
sideEffects: None
|
||||||
|
|
@ -0,0 +1,32 @@
|
||||||
|
#!/usr/bin/python3
|
||||||
|
|
||||||
|
import os
|
||||||
|
import time
|
||||||
|
|
||||||
|
img_list = [
|
||||||
|
"registry.k8s.io/ingress-nginx/controller:v1.11.2@sha256:d5f8217feeac4887cb1ed21f27c2674e58be06bd8f5184cacea2a69abaf78dce",
|
||||||
|
"registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.3@sha256:a320a50cc91bd15fd2d6fa6de58bd98c1bd64b9a6f926ce23a600d87043455a3"
|
||||||
|
]
|
||||||
|
|
||||||
|
public_registry_list = [
|
||||||
|
"registry.k8s.io",
|
||||||
|
|
||||||
|
]
|
||||||
|
|
||||||
|
registry_path = "reg.inje-private.com"
|
||||||
|
|
||||||
|
harbor_project_name = "nnd002"
|
||||||
|
|
||||||
|
for var in img_list:
|
||||||
|
os.system(f"docker pull {var}")
|
||||||
|
for foo in public_registry_list:
|
||||||
|
if var.startswith(foo):
|
||||||
|
private_img_path = var.replace(foo, f"{registry_path}/{harbor_project_name}")
|
||||||
|
break
|
||||||
|
private_img_path = f"{registry_path}/{harbor_project_name}/{var}"
|
||||||
|
# else: ljh 수정
|
||||||
|
# private_img_path = f"{registry_path}/{harbor_project_name}/{var}"
|
||||||
|
time.sleep(1)
|
||||||
|
# os.system(f"echo {private_img_path}")
|
||||||
|
os.system(f"docker tag {var} {private_img_path}")
|
||||||
|
os.system(f"docker push {private_img_path}")
|
||||||
|
|
@ -0,0 +1,44 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Pod
|
||||||
|
metadata:
|
||||||
|
name: soo-nginx
|
||||||
|
labels:
|
||||||
|
app: soo-nginx
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: nginx
|
||||||
|
image: nginx
|
||||||
|
ports:
|
||||||
|
- containerPort: 80
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: soo-nginx
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
app: soo-nginx
|
||||||
|
ports:
|
||||||
|
- port: 80
|
||||||
|
targetPort: 80
|
||||||
|
type: ClusterIP
|
||||||
|
---
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: Ingress
|
||||||
|
metadata:
|
||||||
|
name: soo-nginx-ingress
|
||||||
|
annotations:
|
||||||
|
nginx.ingress.kubernetes.io/rewrite-target: /
|
||||||
|
spec:
|
||||||
|
ingressClassName: nginx
|
||||||
|
rules:
|
||||||
|
- host: soo-nginx.test
|
||||||
|
http:
|
||||||
|
paths:
|
||||||
|
- path: /
|
||||||
|
pathType: Prefix
|
||||||
|
backend:
|
||||||
|
service:
|
||||||
|
name: soo-nginx
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
|
|
@ -0,0 +1,202 @@
|
||||||
|
|
||||||
|
Apache License
|
||||||
|
Version 2.0, January 2004
|
||||||
|
http://www.apache.org/licenses/
|
||||||
|
|
||||||
|
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||||
|
|
||||||
|
1. Definitions.
|
||||||
|
|
||||||
|
"License" shall mean the terms and conditions for use, reproduction,
|
||||||
|
and distribution as defined by Sections 1 through 9 of this document.
|
||||||
|
|
||||||
|
"Licensor" shall mean the copyright owner or entity authorized by
|
||||||
|
the copyright owner that is granting the License.
|
||||||
|
|
||||||
|
"Legal Entity" shall mean the union of the acting entity and all
|
||||||
|
other entities that control, are controlled by, or are under common
|
||||||
|
control with that entity. For the purposes of this definition,
|
||||||
|
"control" means (i) the power, direct or indirect, to cause the
|
||||||
|
direction or management of such entity, whether by contract or
|
||||||
|
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||||
|
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||||
|
|
||||||
|
"You" (or "Your") shall mean an individual or Legal Entity
|
||||||
|
exercising permissions granted by this License.
|
||||||
|
|
||||||
|
"Source" form shall mean the preferred form for making modifications,
|
||||||
|
including but not limited to software source code, documentation
|
||||||
|
source, and configuration files.
|
||||||
|
|
||||||
|
"Object" form shall mean any form resulting from mechanical
|
||||||
|
transformation or translation of a Source form, including but
|
||||||
|
not limited to compiled object code, generated documentation,
|
||||||
|
and conversions to other media types.
|
||||||
|
|
||||||
|
"Work" shall mean the work of authorship, whether in Source or
|
||||||
|
Object form, made available under the License, as indicated by a
|
||||||
|
copyright notice that is included in or attached to the work
|
||||||
|
(an example is provided in the Appendix below).
|
||||||
|
|
||||||
|
"Derivative Works" shall mean any work, whether in Source or Object
|
||||||
|
form, that is based on (or derived from) the Work and for which the
|
||||||
|
editorial revisions, annotations, elaborations, or other modifications
|
||||||
|
represent, as a whole, an original work of authorship. For the purposes
|
||||||
|
of this License, Derivative Works shall not include works that remain
|
||||||
|
separable from, or merely link (or bind by name) to the interfaces of,
|
||||||
|
the Work and Derivative Works thereof.
|
||||||
|
|
||||||
|
"Contribution" shall mean any work of authorship, including
|
||||||
|
the original version of the Work and any modifications or additions
|
||||||
|
to that Work or Derivative Works thereof, that is intentionally
|
||||||
|
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||||
|
or by an individual or Legal Entity authorized to submit on behalf of
|
||||||
|
the copyright owner. For the purposes of this definition, "submitted"
|
||||||
|
means any form of electronic, verbal, or written communication sent
|
||||||
|
to the Licensor or its representatives, including but not limited to
|
||||||
|
communication on electronic mailing lists, source code control systems,
|
||||||
|
and issue tracking systems that are managed by, or on behalf of, the
|
||||||
|
Licensor for the purpose of discussing and improving the Work, but
|
||||||
|
excluding communication that is conspicuously marked or otherwise
|
||||||
|
designated in writing by the copyright owner as "Not a Contribution."
|
||||||
|
|
||||||
|
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||||
|
on behalf of whom a Contribution has been received by Licensor and
|
||||||
|
subsequently incorporated within the Work.
|
||||||
|
|
||||||
|
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||||
|
this License, each Contributor hereby grants to You a perpetual,
|
||||||
|
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||||
|
copyright license to reproduce, prepare Derivative Works of,
|
||||||
|
publicly display, publicly perform, sublicense, and distribute the
|
||||||
|
Work and such Derivative Works in Source or Object form.
|
||||||
|
|
||||||
|
3. Grant of Patent License. Subject to the terms and conditions of
|
||||||
|
this License, each Contributor hereby grants to You a perpetual,
|
||||||
|
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||||
|
(except as stated in this section) patent license to make, have made,
|
||||||
|
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||||
|
where such license applies only to those patent claims licensable
|
||||||
|
by such Contributor that are necessarily infringed by their
|
||||||
|
Contribution(s) alone or by combination of their Contribution(s)
|
||||||
|
with the Work to which such Contribution(s) was submitted. If You
|
||||||
|
institute patent litigation against any entity (including a
|
||||||
|
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||||
|
or a Contribution incorporated within the Work constitutes direct
|
||||||
|
or contributory patent infringement, then any patent licenses
|
||||||
|
granted to You under this License for that Work shall terminate
|
||||||
|
as of the date such litigation is filed.
|
||||||
|
|
||||||
|
4. Redistribution. You may reproduce and distribute copies of the
|
||||||
|
Work or Derivative Works thereof in any medium, with or without
|
||||||
|
modifications, and in Source or Object form, provided that You
|
||||||
|
meet the following conditions:
|
||||||
|
|
||||||
|
(a) You must give any other recipients of the Work or
|
||||||
|
Derivative Works a copy of this License; and
|
||||||
|
|
||||||
|
(b) You must cause any modified files to carry prominent notices
|
||||||
|
stating that You changed the files; and
|
||||||
|
|
||||||
|
(c) You must retain, in the Source form of any Derivative Works
|
||||||
|
that You distribute, all copyright, patent, trademark, and
|
||||||
|
attribution notices from the Source form of the Work,
|
||||||
|
excluding those notices that do not pertain to any part of
|
||||||
|
the Derivative Works; and
|
||||||
|
|
||||||
|
(d) If the Work includes a "NOTICE" text file as part of its
|
||||||
|
distribution, then any Derivative Works that You distribute must
|
||||||
|
include a readable copy of the attribution notices contained
|
||||||
|
within such NOTICE file, excluding those notices that do not
|
||||||
|
pertain to any part of the Derivative Works, in at least one
|
||||||
|
of the following places: within a NOTICE text file distributed
|
||||||
|
as part of the Derivative Works; within the Source form or
|
||||||
|
documentation, if provided along with the Derivative Works; or,
|
||||||
|
within a display generated by the Derivative Works, if and
|
||||||
|
wherever such third-party notices normally appear. The contents
|
||||||
|
of the NOTICE file are for informational purposes only and
|
||||||
|
do not modify the License. You may add Your own attribution
|
||||||
|
notices within Derivative Works that You distribute, alongside
|
||||||
|
or as an addendum to the NOTICE text from the Work, provided
|
||||||
|
that such additional attribution notices cannot be construed
|
||||||
|
as modifying the License.
|
||||||
|
|
||||||
|
You may add Your own copyright statement to Your modifications and
|
||||||
|
may provide additional or different license terms and conditions
|
||||||
|
for use, reproduction, or distribution of Your modifications, or
|
||||||
|
for any such Derivative Works as a whole, provided Your use,
|
||||||
|
reproduction, and distribution of the Work otherwise complies with
|
||||||
|
the conditions stated in this License.
|
||||||
|
|
||||||
|
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||||
|
any Contribution intentionally submitted for inclusion in the Work
|
||||||
|
by You to the Licensor shall be under the terms and conditions of
|
||||||
|
this License, without any additional terms or conditions.
|
||||||
|
Notwithstanding the above, nothing herein shall supersede or modify
|
||||||
|
the terms of any separate license agreement you may have executed
|
||||||
|
with Licensor regarding such Contributions.
|
||||||
|
|
||||||
|
6. Trademarks. This License does not grant permission to use the trade
|
||||||
|
names, trademarks, service marks, or product names of the Licensor,
|
||||||
|
except as required for reasonable and customary use in describing the
|
||||||
|
origin of the Work and reproducing the content of the NOTICE file.
|
||||||
|
|
||||||
|
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||||
|
agreed to in writing, Licensor provides the Work (and each
|
||||||
|
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||||
|
implied, including, without limitation, any warranties or conditions
|
||||||
|
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||||
|
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||||
|
appropriateness of using or redistributing the Work and assume any
|
||||||
|
risks associated with Your exercise of permissions under this License.
|
||||||
|
|
||||||
|
8. Limitation of Liability. In no event and under no legal theory,
|
||||||
|
whether in tort (including negligence), contract, or otherwise,
|
||||||
|
unless required by applicable law (such as deliberate and grossly
|
||||||
|
negligent acts) or agreed to in writing, shall any Contributor be
|
||||||
|
liable to You for damages, including any direct, indirect, special,
|
||||||
|
incidental, or consequential damages of any character arising as a
|
||||||
|
result of this License or out of the use or inability to use the
|
||||||
|
Work (including but not limited to damages for loss of goodwill,
|
||||||
|
work stoppage, computer failure or malfunction, or any and all
|
||||||
|
other commercial damages or losses), even if such Contributor
|
||||||
|
has been advised of the possibility of such damages.
|
||||||
|
|
||||||
|
9. Accepting Warranty or Additional Liability. While redistributing
|
||||||
|
the Work or Derivative Works thereof, You may choose to offer,
|
||||||
|
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||||
|
or other liability obligations and/or rights consistent with this
|
||||||
|
License. However, in accepting such obligations, You may act only
|
||||||
|
on Your own behalf and on Your sole responsibility, not on behalf
|
||||||
|
of any other Contributor, and only if You agree to indemnify,
|
||||||
|
defend, and hold each Contributor harmless for any liability
|
||||||
|
incurred by, or claims asserted against, such Contributor by reason
|
||||||
|
of your accepting any such warranty or additional liability.
|
||||||
|
|
||||||
|
END OF TERMS AND CONDITIONS
|
||||||
|
|
||||||
|
APPENDIX: How to apply the Apache License to your work.
|
||||||
|
|
||||||
|
To apply the Apache License to your work, attach the following
|
||||||
|
boilerplate notice, with the fields enclosed by brackets "{}"
|
||||||
|
replaced with your own identifying information. (Don't include
|
||||||
|
the brackets!) The text should be enclosed in the appropriate
|
||||||
|
comment syntax for the file format. We also recommend that a
|
||||||
|
file or class name and description of purpose be included on the
|
||||||
|
same "printed page" as the copyright notice for easier
|
||||||
|
identification within third-party archives.
|
||||||
|
|
||||||
|
Copyright {yyyy} {name of copyright owner}
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue