first gpu-live commit
This commit is contained in:
root
commit
d0fd70f414
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,672 @@
|
|||
apiVersion: v1 # ns 용 추가 by ljh
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: argocd
|
||||
labels:
|
||||
name: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: application-controller
|
||||
app.kubernetes.io/name: argocd-application-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-application-controller
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: applicationset-controller
|
||||
app.kubernetes.io/name: argocd-applicationset-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-applicationset-controller
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: dex-server
|
||||
app.kubernetes.io/name: argocd-dex-server
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-dex-server
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: notifications-controller
|
||||
app.kubernetes.io/name: argocd-notifications-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-notifications-controller
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: redis
|
||||
app.kubernetes.io/name: argocd-redis
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-redis
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: repo-server
|
||||
app.kubernetes.io/name: argocd-repo-server
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-repo-server
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/name: argocd-server
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-server
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: application-controller
|
||||
app.kubernetes.io/name: argocd-application-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-application-controller
|
||||
namespace: argocd
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- applications
|
||||
- appprojects
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- list
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: applicationset-controller
|
||||
app.kubernetes.io/name: argocd-applicationset-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-applicationset-controller
|
||||
namespace: argocd
|
||||
rules:
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- applications
|
||||
- applicationsets
|
||||
- applicationsets/finalizers
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- appprojects
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- applicationsets/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apps
|
||||
- extensions
|
||||
resources:
|
||||
- deployments
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: dex-server
|
||||
app.kubernetes.io/name: argocd-dex-server
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-dex-server
|
||||
namespace: argocd
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: notifications-controller
|
||||
app.kubernetes.io/name: argocd-notifications-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-notifications-controller
|
||||
namespace: argocd
|
||||
rules:
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- applications
|
||||
- appprojects
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- secrets
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- argocd-notifications-cm
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- argocd-notifications-secret
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: redis
|
||||
app.kubernetes.io/name: argocd-redis
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-redis
|
||||
namespace: argocd
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- argocd-redis
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- create
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/name: argocd-server
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-server
|
||||
namespace: argocd
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- applications
|
||||
- appprojects
|
||||
- applicationsets
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- delete
|
||||
- patch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- list
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: application-controller
|
||||
app.kubernetes.io/name: argocd-application-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-application-controller
|
||||
rules:
|
||||
- apiGroups:
|
||||
- '*'
|
||||
resources:
|
||||
- '*'
|
||||
verbs:
|
||||
- '*'
|
||||
- nonResourceURLs:
|
||||
- '*'
|
||||
verbs:
|
||||
- '*'
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: applicationset-controller
|
||||
app.kubernetes.io/name: argocd-applicationset-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-applicationset-controller
|
||||
rules:
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- applications
|
||||
- applicationsets
|
||||
- applicationsets/finalizers
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- applicationsets/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- appprojects
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- update
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apps
|
||||
- extensions
|
||||
resources:
|
||||
- deployments
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/name: argocd-server
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-server
|
||||
rules:
|
||||
- apiGroups:
|
||||
- '*'
|
||||
resources:
|
||||
- '*'
|
||||
verbs:
|
||||
- delete
|
||||
- get
|
||||
- patch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- list
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- pods/log
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- applications
|
||||
- applicationsets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- batch
|
||||
resources:
|
||||
- jobs
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflows
|
||||
verbs:
|
||||
- create
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: application-controller
|
||||
app.kubernetes.io/name: argocd-application-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-application-controller
|
||||
namespace: argocd
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: argocd-application-controller
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: argocd-application-controller
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: applicationset-controller
|
||||
app.kubernetes.io/name: argocd-applicationset-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-applicationset-controller
|
||||
namespace: argocd
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: argocd-applicationset-controller
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: argocd-applicationset-controller
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: dex-server
|
||||
app.kubernetes.io/name: argocd-dex-server
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-dex-server
|
||||
namespace: argocd
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: argocd-dex-server
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: argocd-dex-server
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: notifications-controller
|
||||
app.kubernetes.io/name: argocd-notifications-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-notifications-controller
|
||||
namespace: argocd
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: argocd-notifications-controller
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: argocd-notifications-controller
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: redis
|
||||
app.kubernetes.io/name: argocd-redis
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-redis
|
||||
namespace: argocd
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: argocd-redis
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: argocd-redis
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/name: argocd-server
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-server
|
||||
namespace: argocd
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: argocd-server
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: argocd-server
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: application-controller
|
||||
app.kubernetes.io/name: argocd-application-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-application-controller
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: argocd-application-controller
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: argocd-application-controller
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: applicationset-controller
|
||||
app.kubernetes.io/name: argocd-applicationset-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-applicationset-controller
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: argocd-applicationset-controller
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: argocd-applicationset-controller
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/name: argocd-server
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-server
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: argocd-server
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: argocd-server
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: notifications-controller
|
||||
app.kubernetes.io/name: argocd-notifications-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-notifications-secret
|
||||
namespace: argocd
|
||||
type: Opaque
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: argocd-secret
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-secret
|
||||
namespace: argocd
|
||||
type: Opaque
|
||||
|
|
@ -0,0 +1,81 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: argocd-cm
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-cm
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: argocd-cmd-params-cm
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-cmd-params-cm
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: argocd-gpg-keys-cm
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-gpg-keys-cm
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: notifications-controller
|
||||
app.kubernetes.io/name: argocd-notifications-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-notifications-cm
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: argocd-rbac-cm
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-rbac-cm
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
data:
|
||||
ssh_known_hosts: |
|
||||
# This file was automatically generated by hack/update-ssh-known-hosts.sh. DO NOT EDIT
|
||||
[ssh.github.com]:443 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
|
||||
[ssh.github.com]:443 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
|
||||
[ssh.github.com]:443 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=
|
||||
bitbucket.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPIQmuzMBuKdWeF4+a2sjSSpBK0iqitSQ+5BM9KhpexuGt20JpTVM7u5BDZngncgrqDMbWdxMWWOGtZ9UgbqgZE=
|
||||
bitbucket.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIazEu89wgQZ4bqs3d63QSMzYVa0MuJ2e2gKTKqu+UUO
|
||||
bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQeJzhupRu0u0cdegZIa8e86EG2qOCsIsD1Xw0xSeiPDlCr7kq97NLmMbpKTX6Esc30NuoqEEHCuc7yWtwp8dI76EEEB1VqY9QJq6vk+aySyboD5QF61I/1WeTwu+deCbgKMGbUijeXhtfbxSxm6JwGrXrhBdofTsbKRUsrN1WoNgUa8uqN1Vx6WAJw1JHPhglEGGHea6QICwJOAr/6mrui/oB7pkaWKHj3z7d1IC4KWLtY47elvjbaTlkN04Kc/5LFEirorGYVbt15kAUlqGM65pk6ZBxtaO3+30LVlORZkxOh+LKL/BvbZ/iRNhItLqNyieoQj/uh/7Iv4uyH/cV/0b4WDSd3DptigWq84lJubb9t/DnZlrJazxyDCulTmKdOR7vs9gMTo+uoIrPSb8ScTtvw65+odKAlBj59dhnVp9zd7QUojOpXlL62Aw56U4oO+FALuevvMjiWeavKhJqlR7i5n9srYcrNV7ttmDw7kf/97P5zauIhxcjX+xHv4M=
|
||||
github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
|
||||
github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
|
||||
github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=
|
||||
gitlab.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFSMqzJeV9rUzU4kWitGjeR4PWSa29SPqJ1fVkhtj3Hw9xjLVXVYrU9QlYWrOLXBpQ6KWjbjTDTdDkoohFzgbEY=
|
||||
gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf
|
||||
gitlab.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bNKTBSpIYDEGk9KxsGh3mySTRgMtXL583qmBpzeQ+jqCMRgBqB98u3z++J1sKlXHWfM9dyhSevkMwSbhoR8XIq/U0tCNyokEi/ueaBMCvbcTHhO7FcwzY92WK4Yt0aGROY5qX2UKSeOvuP4D6TPqKF1onrSzH9bx9XUf2lEdWT/ia1NEKjunUqu1xOB/StKDHMoX4/OKyIzuS0q/T1zOATthvasJFoPrAjkohTyaDUz2LN5JoH839hViyEG82yB+MjcFV5MU3N1l1QL3cVUCh93xSaua1N85qivl+siMkPGbO5xR/En4iEY6K2XPASUEMaieWVNTRCtJ4S8H+9
|
||||
ssh.dev.azure.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H
|
||||
vs-ssh.visualstudio.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: argocd-ssh-known-hosts-cm
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-ssh-known-hosts-cm
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: argocd-tls-certs-cm
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-tls-certs-cm
|
||||
namespace: argocd
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,28 @@
|
|||
# Offloading setting.
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: ing-argocd
|
||||
namespace: argocd
|
||||
annotations:
|
||||
#nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "https"
|
||||
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
rules:
|
||||
- host: argocd.nhngpuaas.com # 사전 생성된 인증서의 도메인적용.
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: argocd-server
|
||||
port:
|
||||
number: 443
|
||||
tls:
|
||||
- hosts:
|
||||
- "argocd.nhngpuaas.com"
|
||||
secretName: nhngpuaas-ssl
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,28 @@
|
|||
#!/bin/bash
|
||||
|
||||
# 원본 YAML 파일
|
||||
input_file="argocd_v2.12.3_add_ns.yaml"
|
||||
|
||||
# CRD가 저장될 파일
|
||||
crd_file="crds.yaml"
|
||||
|
||||
# CRD를 제외한 나머지 리소스를 저장할 파일
|
||||
output_file="deployment_without_crds.yaml"
|
||||
|
||||
# CRD 분리
|
||||
awk '
|
||||
BEGIN { in_crd = 0 }
|
||||
/\r$/ { sub(/\r$/, ""); } # 줄 끝에 있는 \r 제거
|
||||
/^---/ {
|
||||
if (in_crd) {
|
||||
in_crd = 0
|
||||
} else if ($0 ~ /^---/) {
|
||||
if (!in_crd) print "---" > "'$output_file'"
|
||||
}
|
||||
}
|
||||
/^apiVersion: apiextensions.k8s.io\/v1/ { in_crd = 1; print "---" > "'$crd_file'" }
|
||||
in_crd { print > "'$crd_file'" }
|
||||
!in_crd && $0 !~ /^---/ { print > "'$output_file'" }
|
||||
' "$input_file"
|
||||
|
||||
echo "CRD 부분은 $crd_file에 저장되었고, 나머지 리소스는 $output_file에 저장되었습니다."
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,5 @@
|
|||
# kustomization.yaml
|
||||
namespace: argocd
|
||||
|
||||
resources:
|
||||
- argocd_v2.12.3.yaml
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
# This section includes base Calico installation configuration.
|
||||
# For more information, see: https://docs.tigera.io/calico/latest/reference/installation/api#operator.tigera.io/v1.Installation
|
||||
apiVersion: operator.tigera.io/v1
|
||||
kind: Installation
|
||||
metadata:
|
||||
name: default
|
||||
spec:
|
||||
# Configures Calico networking.
|
||||
calicoNetwork:
|
||||
ipPools:
|
||||
- name: default-ipv4-ippool
|
||||
blockSize: 24
|
||||
cidr: 10.1.0.0/16
|
||||
encapsulation: VXLAN # openstack 에서는 VXLAN을 사용해야해안다 byljh
|
||||
natOutgoing: Enabled
|
||||
nodeSelector: all()
|
||||
|
||||
---
|
||||
|
||||
# This section configures the Calico API server.
|
||||
# For more information, see: https://docs.tigera.io/calico/latest/reference/installation/api#operator.tigera.io/v1.APIServer
|
||||
apiVersion: operator.tigera.io/v1
|
||||
kind: APIServer
|
||||
metadata:
|
||||
name: default
|
||||
spec: {}
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,37 @@
|
|||
#!/bin/bash
|
||||
|
||||
# 사용할 Secret 이름
|
||||
SECRET_NAME="nhngpuaas-ssl"
|
||||
|
||||
# 인증서/키 파일 경로
|
||||
CERT_FILE="./nhngpuaas.crt"
|
||||
KEY_FILE="./nhngpuaas.key"
|
||||
|
||||
# 대상 네임스페이스 목록
|
||||
NAMESPACES=(
|
||||
default
|
||||
istio-system
|
||||
monitoring
|
||||
argocd
|
||||
harbor
|
||||
logging
|
||||
gitea
|
||||
ingress-nginx
|
||||
)
|
||||
|
||||
# 각 네임스페이스에 Secret 생성
|
||||
for ns in "${NAMESPACES[@]}"; do
|
||||
echo "<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> [$ns] Creating secret $SECRET_NAME..."
|
||||
|
||||
# 네임스페이스 존재하지 않으면 생성 (선택사항)
|
||||
kubectl get ns "$ns" >/dev/null 2>&1 || kubectl create ns "$ns"
|
||||
|
||||
kubectl create secret tls "$SECRET_NAME" \
|
||||
--cert="$CERT_FILE" \
|
||||
--key="$KEY_FILE" \
|
||||
-n "$ns" \
|
||||
--dry-run=client -o yaml | kubectl apply -f -
|
||||
|
||||
echo "✅ [$ns] Secret created or updated."
|
||||
done
|
||||
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIDfzCCAmegAwIBAgIUQa05TRFmk2PSrxVRD+AOeesYJ6wwDQYJKoZIhvcNAQEL
|
||||
BQAwPTELMAkGA1UEBhMCS1IxDjAMBgNVBAgMBVNlb3VsMQwwCgYDVQQKDANOSE4x
|
||||
EDAOBgNVBAMMB05ITi5jb20wHhcNMjUwNTIzMDIxMDEyWhcNMjcwNTIzMDIxMDEy
|
||||
WjBHMQswCQYDVQQGEwJLUjEOMAwGA1UECAwFU2VvdWwxDjAMBgNVBAoMBWlqaW5j
|
||||
MRgwFgYDVQQDDA8qLm5obmdwdWFhcy5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IB
|
||||
DwAwggEKAoIBAQClbE1iJA9VAYPwy19lT+oGZ+FT1hdU7C5Iz4bzMc+xLfE+Cq7T
|
||||
Ev6AmADLrKpbFaGichOwSgjQ33EtU9Z0W/OSwvHauX/0nezCH6BOqQ7J6Oyoi7nV
|
||||
W2hTEcUCZFApOmldoO3RMIt/wlryWAz9cxFQQveo3ndNllJToL+u60GoNa+yJr7b
|
||||
bKNZ/NWTFWm9ge1JmAY8eiiZQI+EAGGFohwWvMnYI/l+G2CkYZfrOFF3lZ1Wbk0V
|
||||
zmmB197hzsg4H6PPwb5cwVp5j83erWVGSaUnNn4VLMBHFk0U+VfZRGpisC6nkZJW
|
||||
dItnV5ERt0yTW5uwc5cwzHnsrmyCtPgEgYBzAgMBAAGjbTBrMCkGA1UdEQQiMCCC
|
||||
DW5obmdwdWFhcy5jb22CDyoubmhuZ3B1YWFzLmNvbTAdBgNVHQ4EFgQUp9kzMmey
|
||||
D3HKSjaUBVS549R9SbcwHwYDVR0jBBgwFoAU4It9UBfp9qnoU1HiRqxgIyIV0e8w
|
||||
DQYJKoZIhvcNAQELBQADggEBALCttQL1wb17yERkYl2+ESeUPDB/JAQQCRy67kG3
|
||||
h2ttZyXEmnhWSLKuPaJjPZvq8jlx3VgmugOc/Vhi4I3j6JYrBTyU/M6RaB1Hn2uY
|
||||
S5edLZ6nG4uf88ndwrLFhCPr0bwB+cPWiu1RPQ0/Is4SfDxJEkRYJPb2xqySqYEE
|
||||
RtIhGO8SIBnWjWP9EIykIALsem7xHwZCh8q4X28YsB91IATSQpEWlddggoQVZNF+
|
||||
hsJkZ+M+MMvZzWiyu+uWRs2wD6DJfDl6Zp7PTwN8eTm5k5tKeGkXa2XsA8YSjXnJ
|
||||
9aV135P7KXBANN0bsngQHeh0mgl5sTTeGV+HeMq69FG71SM=
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQClbE1iJA9VAYPw
|
||||
y19lT+oGZ+FT1hdU7C5Iz4bzMc+xLfE+Cq7TEv6AmADLrKpbFaGichOwSgjQ33Et
|
||||
U9Z0W/OSwvHauX/0nezCH6BOqQ7J6Oyoi7nVW2hTEcUCZFApOmldoO3RMIt/wlry
|
||||
WAz9cxFQQveo3ndNllJToL+u60GoNa+yJr7bbKNZ/NWTFWm9ge1JmAY8eiiZQI+E
|
||||
AGGFohwWvMnYI/l+G2CkYZfrOFF3lZ1Wbk0VzmmB197hzsg4H6PPwb5cwVp5j83e
|
||||
rWVGSaUnNn4VLMBHFk0U+VfZRGpisC6nkZJWdItnV5ERt0yTW5uwc5cwzHnsrmyC
|
||||
tPgEgYBzAgMBAAECggEANOXeFP0M/hTe+Tg/iCk239eGIYX7rgdcgaIDOG98R982
|
||||
Hq3R2+NeCQcScg8D5t6S8lxiWWRDT2+0RFdj44+n4w19w4DAHxwFIsp0O9MpzH00
|
||||
eG09/rEdOjsbcblcPOLV4L/ebJ+GbFNdO9PWS5HpPm47vf9tzRy9tMpZoXjPZRdJ
|
||||
gXwQFzE+j7YfwXrtOwOBznJpX/6W0y7Id3uQzxCnISbRm9m85BGkaPqeWUw28Q8g
|
||||
CK2C/moIR5/xX77eEDhIvdgHPwrUYCpfcBbp07i+I9gWjJ9/3dg277WrA1zXDWbl
|
||||
vhvctveTCTg5OXLz7bV4MUSS8wO5qh+YDENBu5TpOQKBgQC5PtybPRdYJ2sZjDs7
|
||||
jQs13hHMBJdjPYxBV3BUuabDTHBMlsr5h1UFmZRJWQCkJFSVw49cq+9pbsOUr2Wo
|
||||
TGhqfE4TgUrShnJxEQa7vCQrkWZ9tgCP4szNQ9CReQkyMVPTxrX14SWqROorkPiC
|
||||
JjiuST8+NSxOfqTeJdHEkajApQKBgQDkmzcQUJ04t05+phXFZ9PZfVTzyoI/EF0t
|
||||
M4NOQHzN4MnDFUH6EPVUnxkAlqg0BaXwy1L9gmyFPWD3apYzwfV8m3onGaOQgCVF
|
||||
Ucs8iHdFg//hoQBUVnVLY5p3xNPiNH0Q+X02RxsJb5bjGCdyy+lbYeTC0qvNfpxP
|
||||
ltWFCbAZNwKBgDoNYyEbIge0QrH86ksdRlgZQcaH4dFt5lhLyJ4kmAg4GjFGSFGu
|
||||
gYyBtqDNzY+i+wb8BB9smliWJ6Ce3uLBHy/PyMAAEqyrCY45YbzPlx44MMBQmxh8
|
||||
YOYqzF/qaGFcaALEER3+8sjLU/9XLSnMRJMJzVH3Y+0tbwlXHMfXReUpAoGBALp4
|
||||
6ZeDSlvDGmIwc73MjX/wveUGoOt0G60NQeQIskT1QV7B7klen99gz3ItchLNMKiU
|
||||
EaP8SSz9/iSTauXZJrd301Illcf+32gF6jP8VN39aDHRtIUW6SKPoqZjhToU+pdo
|
||||
CvzFT4aI4ZloUHVRY45I8eMBGWbMChDZxl14o45NAoGAF4yTmXpohD6NWiy7uWlv
|
||||
32z/Fen/rbFsLDILM3FB6cmn+stQzXz7QEP9F69wNl79Bp/LXnmQQpGUT632UxCE
|
||||
4qQ9jrb9lGE2vXHB5K6JnIENnv4fr82YaHT3ZqW1pgLKNlAbiHcyy5yYNWPz/q4Y
|
||||
4Pl1kGw+hlKNljqmh+hJBic=
|
||||
-----END PRIVATE KEY-----
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC4lmwhc546lw/v
|
||||
UzfzZMQbDBN7iizU/ESY+KePEsooXqfBQte2x4/DDZOdKLYt3AAjy9rKI+annN01
|
||||
TvKmo9vkwiixzLKqppsbbGO0k6ClakiLtv/fpw/cLetPSerjSiLaUzjvIPyfm0gs
|
||||
elgUaijq7AJSgLPlRrJg2u738wj0pa2EAVwVyDzx+bpec7UKPNUl+i+4q2h8cIBs
|
||||
c+a1UjeyL76haExAUBbS5WTXrPYJtaFe4/5gAhebLfP4pzuoWO8WFHyUgZLtoGDe
|
||||
vfPTpj8laY5CYsVTSKuFdzMJ3E/TrizBUIu/aXSv4AYd+cjsreu7fm3E4+VgV1vd
|
||||
azmnfEgFAgMBAAECggEAKjSyyr9N+aWaziUgEPYEZQ7Q0ZmZgKWh5bxNS8iHEs35
|
||||
25W2DyP4Oig7jV7GsRuxqH2vLDMjRUX3yn2fu/yRhe/jMCxW2fA4XP/emGZ8//Wa
|
||||
Wt/gB7qCRNz3Be0n2QqVh4gp53uKZ9Awo4Lh6uEPNA/8w/KLr6wHk1/b7jPS42Ut
|
||||
7Jt7+Ac7q97l2kdT/M6vd5JOVzaf4ILqwBrrwRyPh/Hr3WdW/5h3qibrqINySqvo
|
||||
cSTo+sZgqu2N64LDhyNlhjbTBHop77ZYAHaBulvFgEtWJW8ZKn+QEG7liwINUtV/
|
||||
4+Zo0Pl8AmXsBmM6hRYr0pOq8V1lUN/h8IPuyZkXzQKBgQD+pBhT7dbcxtKoXNor
|
||||
Vdke4otI18ynt2GCgOkvDPDFiNe8hj/mvoA03kLGCmGd8Ew904ZHQwcvJjhdBaBe
|
||||
jgU2RQRLTp4a75zaotdR/ObLVpma+Fv2QGQUoMwAaLw+WZF73kBC0fsTLr7wMhIm
|
||||
w+nzxhe4buy2qpIRkue0GDlPxwKBgQC5kp3NYRFGseZGwgLNrbcgkjozMyEE8t0V
|
||||
9OANmwQJwQoti2UAtsxBpe/+8R39d8vFsI0nnXX9KDt/uzyXZx6qYzVyu5etmmkk
|
||||
tMbex2XrON75/Ws753h9rX0oT/v/sdv/4Bpef2gchbEYK9hPlo0LvvJpDmm8Ba9f
|
||||
+wrWQRJB0wKBgQDMOivQ1IZpF4VIxv+rlfTHUobHa1yWfvtTwbRDqitJIpF0gG+r
|
||||
zsngnQoM77KPC3T6eTXO3bFbXVoDMUoHy/veJMhm5azkiZzRtZzgAufP2arkoaCQ
|
||||
BeC+sqArC9U+ZHPMVtpPPT4TioBVALOSJ7rxasUHhN+ROYhhU+NFi9AbbQKBgQCX
|
||||
5N2LfTdR4U22fxkiV118qJRA0knlrhCu5yf5mvfcMAjvrJh41CcuWO+vgpbkoIjH
|
||||
gLKZSXaJR8Qj0hNPbhWYq+nUxp3peGk1pU7ejOHsfjls8DQ07Usfu8ClHYsMCP4l
|
||||
W77ZuHl0Vy3UthaxVm6OvbXXrfd38kNRUb/WDZ8vBwKBgExY/zaIxJ0VSgzYarpN
|
||||
a1VlQqtIJ8WJqK7nPhI57uWHdamIF/0vlO4D6mrrAzCzHH708IgL6JCRdMQF7wTg
|
||||
Fxu9hBde2JmiO8isAp6CN25k/vC30VZjwVLBojsS45saxKAgFZjxbUbwZ7t7oezY
|
||||
qriDXpuwa6Nc5ti9FEcwhnFJ
|
||||
-----END PRIVATE KEY-----
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIDWzCCAkOgAwIBAgIUZgMNWnLaR14UjuTKbgLrLBI3vpkwDQYJKoZIhvcNAQEL
|
||||
BQAwPTELMAkGA1UEBhMCS1IxDjAMBgNVBAgMBVNlb3VsMQwwCgYDVQQKDANOSE4x
|
||||
EDAOBgNVBAMMB05ITi5jb20wHhcNMjUwNTIzMDIwOTA5WhcNMzUwNTIxMDIwOTA5
|
||||
WjA9MQswCQYDVQQGEwJLUjEOMAwGA1UECAwFU2VvdWwxDDAKBgNVBAoMA05ITjEQ
|
||||
MA4GA1UEAwwHTkhOLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
|
||||
ALiWbCFznjqXD+9TN/NkxBsME3uKLNT8RJj4p48Syihep8FC17bHj8MNk50oti3c
|
||||
ACPL2soj5qec3TVO8qaj2+TCKLHMsqqmmxtsY7SToKVqSIu2/9+nD9wt609J6uNK
|
||||
ItpTOO8g/J+bSCx6WBRqKOrsAlKAs+VGsmDa7vfzCPSlrYQBXBXIPPH5ul5ztQo8
|
||||
1SX6L7iraHxwgGxz5rVSN7IvvqFoTEBQFtLlZNes9gm1oV7j/mACF5st8/inO6hY
|
||||
7xYUfJSBku2gYN6989OmPyVpjkJixVNIq4V3MwncT9OuLMFQi79pdK/gBh35yOyt
|
||||
67t+bcTj5WBXW91rOad8SAUCAwEAAaNTMFEwHQYDVR0OBBYEFOCLfVAX6fap6FNR
|
||||
4kasYCMiFdHvMB8GA1UdIwQYMBaAFOCLfVAX6fap6FNR4kasYCMiFdHvMA8GA1Ud
|
||||
EwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBALMRGDtpp2prXRs796gk7Va1
|
||||
5VXc3jplJhLeTP1XlTYa0ARSjCRgyUQfSHRfl9nVm2msyuMukKvRKiQwahXknzO9
|
||||
enEnxP1MI/RZ6ygxYul8IPcAutzCsJA9uFn5E5enHRbgVuonUcdoHVszxT6afnco
|
||||
21+MYdkat8iV1h3VW1vo6OoMJmUQ2uPo9q50OOA3UZJQRds0+vOKxdX+UZdvCZwr
|
||||
5WgQvzVUJyTlqDdjHyWJl6ReBdnvHJ2iVAc3Zb/uJeBcb/6DLQfDdXjtyJvPYEWk
|
||||
YtVWgBQmR1eeanNe2UJsSghu30ePqqtwEpOhDlD+12bkPOz9nWBCApM8l6P/uRw=
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
#!/bin/bash
|
||||
|
||||
# 전송할 파일들
|
||||
FILES=("nhngpuaas.crt" "nhngpuaas.key")
|
||||
|
||||
# 대상 서버 목록 (user@host 형식)
|
||||
SERVERS=(
|
||||
"ubuntu@master1"
|
||||
"ubuntu@master2"
|
||||
"ubuntu@master3"
|
||||
"ubuntu@nd-worker1"
|
||||
"ubuntu@nd-worker2"
|
||||
"ubuntu@nd-worker3"
|
||||
"ubuntu@svc-worker1"
|
||||
"ubuntu@svc-worker2"
|
||||
"ubuntu@gpu-1"
|
||||
"ubuntu@gpu-2"
|
||||
"ubuntu@gpu-3"
|
||||
"ubuntu@gpu-4"
|
||||
)
|
||||
|
||||
# 복사할 대상 디렉터리 (리모트 서버 기준)
|
||||
DEST_DIR="/home/ubuntu/"
|
||||
|
||||
# 루프 돌면서 각 서버로 복사
|
||||
for SERVER in "${SERVERS[@]}"; do
|
||||
echo "<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> [$SERVER] 전송 시작..."
|
||||
scp "${FILES[@]}" "$SERVER:$DEST_DIR"
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "✅ [$SERVER] 전송 성공"
|
||||
else
|
||||
echo "❌ [$SERVER] 전송 실패"
|
||||
fi
|
||||
done
|
||||
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
-----BEGIN CERTIFICATE REQUEST-----
|
||||
MIICjDCCAXQCAQAwRzELMAkGA1UEBhMCS1IxDjAMBgNVBAgMBVNlb3VsMQ4wDAYD
|
||||
VQQKDAVpamluYzEYMBYGA1UEAwwPKi5uaG5ncHVhYXMuY29tMIIBIjANBgkqhkiG
|
||||
9w0BAQEFAAOCAQ8AMIIBCgKCAQEApWxNYiQPVQGD8MtfZU/qBmfhU9YXVOwuSM+G
|
||||
8zHPsS3xPgqu0xL+gJgAy6yqWxWhonITsEoI0N9xLVPWdFvzksLx2rl/9J3swh+g
|
||||
TqkOyejsqIu51VtoUxHFAmRQKTppXaDt0TCLf8Ja8lgM/XMRUEL3qN53TZZSU6C/
|
||||
rutBqDWvsia+22yjWfzVkxVpvYHtSZgGPHoomUCPhABhhaIcFrzJ2CP5fhtgpGGX
|
||||
6zhRd5WdVm5NFc5pgdfe4c7IOB+jz8G+XMFaeY/N3q1lRkmlJzZ+FSzARxZNFPlX
|
||||
2URqYrAup5GSVnSLZ1eREbdMk1ubsHOXMMx57K5sgrT4BIGAcwIDAQABoAAwDQYJ
|
||||
KoZIhvcNAQELBQADggEBAInHaWXSKqj2Lq2iuEfi1xL3BxBXdZzvg+FNKmMcmycR
|
||||
62e4Qetoednw9bMSOFfTz/DJk2zu6OBKN8LbLDyA7QAfxHvfzFOPIkATw9BODwPT
|
||||
tGdeInwHIbxwzGmZR3NaH91XtQ/EnHQHqfgn1JAmE72PXs/jwdKMDAHeoVSyQZbU
|
||||
XCtrzJl9Jdq4bXKKCaz8tNGo8pZ/1/E5AZyRtr3qjA+pBaMLInNdy5oVupBxWEtg
|
||||
hWWaUA3wkSHLmFD9L5TXJGflAyJ+RfW0X2qnOeCHZj5GdwHmS/XHsm/VrSltC7x/
|
||||
jVC7CWG2p4rLcLu/CixPWzx3tDVVFJECi88D3X8YcfU=
|
||||
-----END CERTIFICATE REQUEST-----
|
||||
|
|
@ -0,0 +1,60 @@
|
|||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: logging
|
||||
|
||||
---
|
||||
# Source: fluent-bit/templates/serviceaccount.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: fluent-bit
|
||||
namespace: logging
|
||||
labels:
|
||||
helm.sh/chart: fluent-bit-0.47.9
|
||||
app.kubernetes.io/name: fluent-bit
|
||||
app.kubernetes.io/instance: fluent-bit
|
||||
app.kubernetes.io/version: "3.1.7"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
---
|
||||
# Source: fluent-bit/templates/clusterrole.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: fluent-bit
|
||||
labels:
|
||||
helm.sh/chart: fluent-bit-0.47.9
|
||||
app.kubernetes.io/name: fluent-bit
|
||||
app.kubernetes.io/instance: fluent-bit
|
||||
app.kubernetes.io/version: "3.1.7"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
# Source: fluent-bit/templates/clusterrolebinding.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: fluent-bit
|
||||
labels:
|
||||
helm.sh/chart: fluent-bit-0.47.9
|
||||
app.kubernetes.io/name: fluent-bit
|
||||
app.kubernetes.io/instance: fluent-bit
|
||||
app.kubernetes.io/version: "3.1.7"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: fluent-bit
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: fluent-bit
|
||||
namespace: logging
|
||||
|
|
@ -0,0 +1,69 @@
|
|||
# Source: fluent-bit/templates/configmap.yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: fluent-bit
|
||||
namespace: logging
|
||||
labels:
|
||||
helm.sh/chart: fluent-bit-0.47.9
|
||||
app.kubernetes.io/name: fluent-bit
|
||||
app.kubernetes.io/instance: fluent-bit
|
||||
app.kubernetes.io/version: "3.1.7"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
data:
|
||||
custom_parsers.conf: |
|
||||
[PARSER]
|
||||
Name docker_no_time
|
||||
Format json
|
||||
Time_Keep Off
|
||||
Time_Key time
|
||||
Time_Format %Y-%m-%dT%H:%M:%S.%L
|
||||
fluent-bit.conf: |
|
||||
[SERVICE]
|
||||
Daemon Off
|
||||
Flush 1
|
||||
Log_Level info
|
||||
Parsers_File /fluent-bit/etc/parsers.conf
|
||||
Parsers_File /fluent-bit/etc/conf/custom_parsers.conf
|
||||
HTTP_Server On
|
||||
HTTP_Listen 0.0.0.0
|
||||
HTTP_Port 2020
|
||||
Health_Check On
|
||||
|
||||
[INPUT]
|
||||
Name tail
|
||||
Path /var/log/containers/*.log
|
||||
multiline.parser docker, cri
|
||||
# DB /var/fluent-bit/state/flb_log.db
|
||||
Tag kube.*
|
||||
Mem_Buf_Limit 5MB
|
||||
Skip_Long_Lines On
|
||||
|
||||
|
||||
[FILTER]
|
||||
Name kubernetes
|
||||
Match kube.*
|
||||
Merge_Log On
|
||||
Keep_Log Off
|
||||
K8S-Logging.Parser On
|
||||
K8S-Logging.Exclude On
|
||||
|
||||
# [FILTER]
|
||||
# Name record_modifier
|
||||
# Match kube.*
|
||||
# Record namespace ${_score}
|
||||
|
||||
[OUTPUT]
|
||||
Name es
|
||||
Match kube.*
|
||||
Host 172.17.128.246
|
||||
HTTP_User admin
|
||||
HTTP_Passwd admin
|
||||
Index fluent-bit10--%Y.%m.%d
|
||||
Logstash_Format On
|
||||
Logstash_Prefix_Key $kubernetes['namespace_name']
|
||||
Suppress_Type_Name On
|
||||
tls On
|
||||
tls.Verify Off
|
||||
Retry_Limit False
|
||||
|
||||
|
|
@ -0,0 +1,69 @@
|
|||
# Source: fluent-bit/templates/configmap.yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: fluent-bit
|
||||
namespace: logging
|
||||
labels:
|
||||
helm.sh/chart: fluent-bit-0.47.9
|
||||
app.kubernetes.io/name: fluent-bit
|
||||
app.kubernetes.io/instance: fluent-bit
|
||||
app.kubernetes.io/version: "3.1.7"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
data:
|
||||
custom_parsers.conf: |
|
||||
[PARSER]
|
||||
Name docker_no_time
|
||||
Format json
|
||||
Time_Keep Off
|
||||
Time_Key time
|
||||
Time_Format %Y-%m-%dT%H:%M:%S.%L
|
||||
|
||||
fluent-bit.conf: |
|
||||
[SERVICE]
|
||||
Daemon Off
|
||||
Flush 1
|
||||
Log_Level info
|
||||
Parsers_File /fluent-bit/etc/parsers.conf
|
||||
Parsers_File /fluent-bit/etc/conf/custom_parsers.conf
|
||||
HTTP_Server On
|
||||
HTTP_Listen 0.0.0.0
|
||||
HTTP_Port 2020
|
||||
Health_Check On
|
||||
|
||||
[INPUT]
|
||||
Name tail
|
||||
Path /var/log/containers/*.log
|
||||
multiline.parser docker, cri
|
||||
Tag kube.*
|
||||
Mem_Buf_Limit 5MB
|
||||
Skip_Long_Lines On
|
||||
|
||||
[INPUT]
|
||||
Name systemd
|
||||
Tag host.*
|
||||
Systemd_Filter _SYSTEMD_UNIT=kubelet.service
|
||||
Read_From_Tail On
|
||||
|
||||
[FILTER]
|
||||
Name kubernetes
|
||||
Match kube.*
|
||||
Merge_Log On
|
||||
Keep_Log Off
|
||||
K8S-Logging.Parser On
|
||||
K8S-Logging.Exclude On
|
||||
|
||||
[OUTPUT]
|
||||
Name es
|
||||
Match kube.*
|
||||
Host elasticsearch-master
|
||||
Logstash_Format On
|
||||
Retry_Limit False
|
||||
|
||||
[OUTPUT]
|
||||
Name es
|
||||
Match host.*
|
||||
Host elasticsearch-master
|
||||
Logstash_Format On
|
||||
Logstash_Prefix node
|
||||
Retry_Limit False
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: fluent-bit
|
||||
namespace: logging
|
||||
labels:
|
||||
app.kubernetes.io/name: fluentbit
|
||||
app.kubernetes.io/instance: fluent-bit
|
||||
app.kubernetes.io/version: "3.1.7"
|
||||
data:
|
||||
custom_parsers.conf: |
|
||||
[PARSER]
|
||||
Name cri
|
||||
Format regex
|
||||
Regex ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<message>.*)$
|
||||
Time_Key time
|
||||
Time_Format %Y-%m-%dT%H:%M:%S.%L%z
|
||||
Decode_Field_As json message
|
||||
|
||||
[PARSER]
|
||||
Name svcname
|
||||
Format regex
|
||||
Regex /sample-(?<servicename>.+)-dp-[^-]+-[^-]+_(?<namespace>.+)_.+-con-[^-]+.log$
|
||||
|
||||
fluent-bit.conf: |
|
||||
[SERVICE]
|
||||
Flush 5
|
||||
Log_Level info
|
||||
Daemon off
|
||||
Parsers_File /fluent-bit/etc/parsers.conf
|
||||
Parsers_File /fluent-bit/etc/conf/custom_parsers.conf
|
||||
HTTP_Server On
|
||||
HTTP_Listen 0.0.0.0
|
||||
HTTP_Port 2020
|
||||
Health_Check On
|
||||
storage.path /var/fluent-bit/state/flb-storage/
|
||||
storage.sync normal
|
||||
storage.checksum off
|
||||
storage.backlog.mem_limit 5M
|
||||
|
||||
@INCLUDE input-kubernetes.conf
|
||||
# @INCLUDE filter-kubernetes.conf
|
||||
@INCLUDE output-file.conf
|
||||
|
||||
input-kubernetes.conf: |
|
||||
[INPUT]
|
||||
Name tail
|
||||
Parser cri
|
||||
Path /var/log/containers/blog-*-dp-*-*_blog_*-con-*.log
|
||||
DB /var/fluent-bit/state/flb_log.db
|
||||
Tag blog.<service_name>
|
||||
Tag_Regex /blog-(?<service_name>.+)-dp-[^-]+-[^-]+_blog_.+-con-[^-]+.log$
|
||||
Mem_Buf_Limit 5MB
|
||||
Skip_Long_Lines On
|
||||
Refresh_Interval 10
|
||||
Path_key svc_name
|
||||
|
||||
filter-kubernetes.conf: |
|
||||
[FILTER]
|
||||
Name parser
|
||||
Match blog.*
|
||||
Key_name svc_name
|
||||
reserve_data On
|
||||
Parser svcname
|
||||
|
||||
output-file.conf: |
|
||||
[OUTPUT]
|
||||
Name file
|
||||
Match blog.*
|
||||
Path /home/ubuntu
|
||||
file fluentbit-scrape.txt
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,36 @@
|
|||
# Source: fluent-bit/templates/configmap.yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: fluent-bit
|
||||
namespace: logging
|
||||
labels:
|
||||
helm.sh/chart: fluent-bit-0.47.10
|
||||
app.kubernetes.io/name: fluent-bit
|
||||
app.kubernetes.io/instance: fluent-bit
|
||||
app.kubernetes.io/version: "3.1.7"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
data:
|
||||
fluent-bit.conf: |
|
||||
[SERVICE]
|
||||
Daemon Off
|
||||
Flush 1
|
||||
Log_Level warn
|
||||
Parsers_File /fluent-bit/etc/parsers.conf
|
||||
HTTP_Server On
|
||||
HTTP_Listen 0.0.0.0
|
||||
HTTP_Port 2020
|
||||
Health_Check On
|
||||
storage.path /var/fluent-bit/state/flb-storage/
|
||||
storage.sync normal
|
||||
storage.checksum off
|
||||
storage.backlog.mem_limit 5M
|
||||
|
||||
[INPUT]
|
||||
Name tail
|
||||
Path /var/log/containers/*.log
|
||||
Parser cri
|
||||
Tag kube.*
|
||||
Mem_Buf_Limit 5MB
|
||||
Skip_Long_Lines On
|
||||
|
||||
|
|
@ -0,0 +1,66 @@
|
|||
# Source: fluent-bit/templates/configmap.yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: fluent-bit
|
||||
namespace: logging
|
||||
labels:
|
||||
helm.sh/chart: fluent-bit-0.47.10
|
||||
app.kubernetes.io/name: fluent-bit
|
||||
app.kubernetes.io/instance: fluent-bit
|
||||
app.kubernetes.io/version: "3.1.7"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
data:
|
||||
fluent-bit.conf: |
|
||||
[SERVICE]
|
||||
Daemon Off
|
||||
Flush 1
|
||||
Log_Level warn
|
||||
Parsers_File /fluent-bit/etc/parsers.conf
|
||||
HTTP_Server On
|
||||
HTTP_Listen 0.0.0.0
|
||||
HTTP_Port 2020
|
||||
Health_Check On
|
||||
storage.path /var/fluent-bit/state/flb-storage/
|
||||
storage.sync normal
|
||||
storage.checksum off
|
||||
storage.backlog.mem_limit 5M
|
||||
|
||||
[INPUT]
|
||||
Name tail
|
||||
Path /var/log/containers/sample-*-dp-*-con-*.log
|
||||
Parser cri
|
||||
Tag normal.<service_name>.<namespace_name>
|
||||
Tag_Regex /sample-(?<service_name>.+)-dp-(.+)_(?<namespace_name>.+)_(.+)-con-(.+).log$
|
||||
Mem_Buf_Limit 5MB
|
||||
Skip_Long_Lines On
|
||||
|
||||
[INPUT]
|
||||
Name tail
|
||||
Path /var/log/containers/sample-*-mdp-*-con-*.log
|
||||
Parser cri
|
||||
Tag multi.<service_name>.<namespace_name>
|
||||
Tag_Regex /sample-(?<service_name>.+)-mdp-(.+)_(?<namespace_name>.+)_(.+)-con-(.+).log$
|
||||
Mem_Buf_Limit 5MB
|
||||
Skip_Long_Lines On
|
||||
|
||||
[FILTER]
|
||||
name multiline
|
||||
match multi.*
|
||||
multiline.key_content message
|
||||
multiline.parser java
|
||||
|
||||
[OUTPUT]
|
||||
Name es
|
||||
Match *
|
||||
Host 172.17.128.239
|
||||
Port 9200
|
||||
Index Multiline
|
||||
Type _doc
|
||||
Include_Tag_Key true
|
||||
Tag_key @svc_name
|
||||
Suppress_Type_Name On
|
||||
HTTP_User admin
|
||||
HTTP_Passwd admin
|
||||
tls On
|
||||
tls.verify Off
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: fluent-bit-config
|
||||
namespace: fluent-bit
|
||||
labels:
|
||||
app.kubernetes.io/name: fluentbit
|
||||
data:
|
||||
fluent-bit.conf: |
|
||||
[SERVICE]
|
||||
Flush 5
|
||||
Log_Level warn
|
||||
Daemon off
|
||||
Parsers_File parsers.conf
|
||||
storage.path /var/fluent-bit/state/flb-storage/
|
||||
storage.sync normal
|
||||
storage.checksum off
|
||||
storage.backlog.mem_limit 5M
|
||||
|
||||
@INCLUDE userapp-log.conf
|
||||
|
||||
userapp-log.conf: |
|
||||
[INPUT]
|
||||
Name tail
|
||||
Parser cri
|
||||
Path /var/log/containers/pub-*-dp-*-*_nnd-logging_*-con-*.log
|
||||
DB /var/fluent-bit/state/flb_log.db
|
||||
Tag pub.<service_name>
|
||||
Tag_Regex /pub-(?<service_name>.+)-dp-[^-]+-[^-]+_nnd_logging_.+-con-[^-]+.log$
|
||||
Mem_Buf_Limit 5MB
|
||||
Skip_Long_Lines On
|
||||
Refresh_Interval 10
|
||||
|
||||
[OUTPUT]
|
||||
Name es
|
||||
Host 10.1.81.11
|
||||
Port 9200
|
||||
Match pub.*
|
||||
HTTP_User admin
|
||||
HTTP_Passwd ijinc123!
|
||||
Index pub_injeinc_os
|
||||
Type _doc
|
||||
Include_Tag_Key true
|
||||
Tag_key @svc_name
|
||||
Suppress_Type_Name On
|
||||
|
||||
|
||||
parsers.conf: |
|
||||
[PARSER]
|
||||
Name cri
|
||||
Format regex
|
||||
Regex ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<message>.*)$
|
||||
Time_Key time
|
||||
Time_Format %Y-%m-%dT%H:%M:%S.%L%z
|
||||
Decode_Field_As json message
|
||||
|
||||
|
|
@ -0,0 +1,137 @@
|
|||
# Source: fluent-bit/templates/service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: fluent-bit
|
||||
namespace: logging
|
||||
labels:
|
||||
helm.sh/chart: fluent-bit-0.47.9
|
||||
app.kubernetes.io/name: fluent-bit
|
||||
app.kubernetes.io/instance: fluent-bit
|
||||
app.kubernetes.io/version: "3.1.7"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- port: 2020
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
selector:
|
||||
app.kubernetes.io/name: fluent-bit
|
||||
app.kubernetes.io/instance: fluent-bit
|
||||
---
|
||||
# Source: fluent-bit/templates/daemonset.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: fluent-bit
|
||||
namespace: logging
|
||||
labels:
|
||||
helm.sh/chart: fluent-bit-0.47.9
|
||||
app.kubernetes.io/name: fluent-bit
|
||||
app.kubernetes.io/instance: fluent-bit
|
||||
app.kubernetes.io/version: "3.1.7"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: fluent-bit
|
||||
app.kubernetes.io/instance: fluent-bit
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: fluent-bit
|
||||
app.kubernetes.io/instance: fluent-bit
|
||||
annotations:
|
||||
checksum/config: 19631ad1090fbeaf145be8a25d43bf24621413639593494df4b243914c27e763
|
||||
spec:
|
||||
serviceAccountName: fluent-bit
|
||||
hostNetwork: false
|
||||
dnsPolicy: ClusterFirst
|
||||
containers:
|
||||
- name: fluent-bit
|
||||
image: "harbor.nativedeck.com/nd002-rc.1/fluent/fluent-bit:3.1.7-debug"
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
- /fluent-bit/bin/fluent-bit
|
||||
args:
|
||||
- --workdir=/fluent-bit/etc
|
||||
- --config=/fluent-bit/etc/conf/fluent-bit.conf
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 2020
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /api/v1/health
|
||||
port: http
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /fluent-bit/etc/conf
|
||||
- mountPath: /var/log
|
||||
name: varlog
|
||||
- mountPath: /var/lib/docker/containers
|
||||
name: varlibdockercontainers
|
||||
readOnly: true
|
||||
- mountPath: /etc/machine-id
|
||||
name: etcmachineid
|
||||
readOnly: true
|
||||
# Custom Add
|
||||
- name: runlogjournal
|
||||
mountPath: /run/log/journal
|
||||
readOnly: true
|
||||
# - name: dmesg
|
||||
# mountPath: /var/log/dmesg
|
||||
# readOnly: true
|
||||
- name: mnt
|
||||
mountPath: /mnt
|
||||
readOnly: true
|
||||
- name: fluentbitstate
|
||||
mountPath: /var/fluent-bit/state
|
||||
- name: file-save
|
||||
mountPath: /home/ubuntu
|
||||
# https://docs.fluentbit.io/manual/pipeline/filters/kubernetes
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 500Mi
|
||||
requests:
|
||||
cpu: 500m
|
||||
memory: 500Mi
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: fluent-bit
|
||||
- name: varlog
|
||||
hostPath:
|
||||
path: /var/log
|
||||
- name: varlibdockercontainers
|
||||
hostPath:
|
||||
path: /var/lib/docker/containers
|
||||
- name: etcmachineid
|
||||
hostPath:
|
||||
path: /etc/machine-id
|
||||
type: File
|
||||
# Custom Add
|
||||
## for cash
|
||||
- name: fluentbitstate
|
||||
hostPath:
|
||||
path: /var/fluent-bit/state
|
||||
- name: runlogjournal # 있음
|
||||
hostPath:
|
||||
path: /run/log/journal
|
||||
# - name: dmesg # 있음
|
||||
# hostPath:
|
||||
# path: /var/log/dmesg
|
||||
- name: mnt # 있음
|
||||
hostPath:
|
||||
path: /mnt
|
||||
- name: file-save # 있음
|
||||
hostPath:
|
||||
path: /home/ubuntu
|
||||
|
||||
|
|
@ -0,0 +1,132 @@
|
|||
# Source: fluent-bit/templates/service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: fluent-bit
|
||||
namespace: logging
|
||||
labels:
|
||||
helm.sh/chart: fluent-bit-0.47.9
|
||||
app.kubernetes.io/name: fluent-bit
|
||||
app.kubernetes.io/instance: fluent-bit
|
||||
app.kubernetes.io/version: "3.1.7"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- port: 2020
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
selector:
|
||||
app.kubernetes.io/name: fluent-bit
|
||||
app.kubernetes.io/instance: fluent-bit
|
||||
---
|
||||
# Source: fluent-bit/templates/daemonset.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: fluent-bit
|
||||
namespace: logging
|
||||
labels:
|
||||
helm.sh/chart: fluent-bit-0.47.9
|
||||
app.kubernetes.io/name: fluent-bit
|
||||
app.kubernetes.io/instance: fluent-bit
|
||||
app.kubernetes.io/version: "3.1.7"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: fluent-bit
|
||||
app.kubernetes.io/instance: fluent-bit
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: fluent-bit
|
||||
app.kubernetes.io/instance: fluent-bit
|
||||
annotations:
|
||||
checksum/config: 19631ad1090fbeaf145be8a25d43bf24621413639593494df4b243914c27e763
|
||||
spec:
|
||||
serviceAccountName: fluent-bit
|
||||
hostNetwork: false
|
||||
dnsPolicy: ClusterFirst
|
||||
containers:
|
||||
- name: fluent-bit
|
||||
image: "cr.fluentbit.io/fluent/fluent-bit:3.1.7"
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
- /fluent-bit/bin/fluent-bit
|
||||
args:
|
||||
- --workdir=/fluent-bit/etc
|
||||
- --config=/fluent-bit/etc/conf/fluent-bit.conf
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 2020
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /api/v1/health
|
||||
port: http
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /fluent-bit/etc/conf
|
||||
- mountPath: /var/log
|
||||
name: varlog
|
||||
- mountPath: /var/lib/docker/containers
|
||||
name: varlibdockercontainers
|
||||
readOnly: true
|
||||
- mountPath: /etc/machine-id
|
||||
name: etcmachineid
|
||||
readOnly: true
|
||||
# Custom Add
|
||||
- name: runlogjournal
|
||||
mountPath: /run/log/journal
|
||||
readOnly: true
|
||||
# - name: dmesg
|
||||
# mountPath: /var/log/dmesg
|
||||
# readOnly: true
|
||||
- name: mnt
|
||||
mountPath: /mnt
|
||||
readOnly: true
|
||||
- name: fluentbitstate
|
||||
mountPath: /var/fluent-bit/state
|
||||
# https://docs.fluentbit.io/manual/pipeline/filters/kubernetes
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 500Mi
|
||||
requests:
|
||||
cpu: 500m
|
||||
memory: 500Mi
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: fluent-bit
|
||||
- name: varlog
|
||||
hostPath:
|
||||
path: /var/log
|
||||
- name: varlibdockercontainers
|
||||
hostPath:
|
||||
path: /var/lib/docker/containers
|
||||
- name: etcmachineid
|
||||
hostPath:
|
||||
path: /etc/machine-id
|
||||
type: File
|
||||
# Custom Add
|
||||
## for cash
|
||||
- name: fluentbitstate
|
||||
hostPath:
|
||||
path: /var/fluent-bit/state
|
||||
- name: runlogjournal # 있음
|
||||
hostPath:
|
||||
path: /run/log/journal
|
||||
# - name: dmesg # 있음
|
||||
# hostPath:
|
||||
# path: /var/log/dmesg
|
||||
- name: mnt # 있음
|
||||
hostPath:
|
||||
path: /mnt
|
||||
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
# Source: fluent-bit/templates/tests/test-connection.yaml
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: "fluent-bit-test-connection"
|
||||
namespace: logging
|
||||
labels:
|
||||
helm.sh/chart: fluent-bit-0.47.9
|
||||
app.kubernetes.io/version: "3.1.7"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
annotations:
|
||||
helm.sh/hook: test
|
||||
helm.sh/hook-delete-policy: hook-succeeded
|
||||
spec:
|
||||
containers:
|
||||
- name: wget
|
||||
image: "harbor.nativedeck.com/nd002-rc.1/busybox:latest"
|
||||
imagePullPolicy: Always
|
||||
command: ["sh"]
|
||||
args: ["-c", "wget -O- fluent-bit:2020"]
|
||||
restartPolicy: Never
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: gitea
|
||||
labels:
|
||||
kubernetes.io/metadata.name: gitea
|
||||
|
|
@ -0,0 +1,79 @@
|
|||
# Source: gitea/charts/postgresql-ha/templates/pgpool/networkpolicy.yaml
|
||||
kind: NetworkPolicy
|
||||
apiVersion: networking.k8s.io/v1
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-pgpool
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: pgpool
|
||||
role: data
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: pgpool
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
egress:
|
||||
- {}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: 5432
|
||||
---
|
||||
# Source: gitea/charts/postgresql-ha/templates/postgresql/networkpolicy.yaml
|
||||
kind: NetworkPolicy
|
||||
apiVersion: networking.k8s.io/v1
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: postgresql
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
egress:
|
||||
- {}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: 5432
|
||||
---
|
||||
# Source: gitea/charts/redis-cluster/templates/networkpolicy.yaml
|
||||
kind: NetworkPolicy
|
||||
apiVersion: networking.k8s.io/v1
|
||||
metadata:
|
||||
name: release-name-redis-cluster
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
app.kubernetes.io/version: 7.2.5
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
egress:
|
||||
- {}
|
||||
ingress:
|
||||
# Allow inbound connections
|
||||
- ports:
|
||||
- port: 6379
|
||||
- port: 16379
|
||||
|
|
@ -0,0 +1,77 @@
|
|||
# Source: gitea/charts/postgresql-ha/templates/pgpool/pdb.yaml
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-pgpool
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 4.5.2
|
||||
app.kubernetes.io/component: pgpool
|
||||
spec:
|
||||
maxUnavailable: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: pgpool
|
||||
---
|
||||
# Source: gitea/charts/postgresql-ha/templates/postgresql/pdb.yaml
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: postgresql
|
||||
spec:
|
||||
maxUnavailable: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: postgresql
|
||||
---
|
||||
# Source: gitea/charts/postgresql-ha/templates/postgresql/witness-pdb.yaml
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-postgresql-witness
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: witness
|
||||
spec:
|
||||
maxUnavailable: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: witness
|
||||
---
|
||||
# Source: gitea/charts/redis-cluster/templates/poddisruptionbudget.yaml
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: release-name-redis-cluster
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
app.kubernetes.io/version: 7.2.5
|
||||
spec:
|
||||
maxUnavailable: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
matchExpressions:
|
||||
- {key: job-name, operator: NotIn, values: [release-name-redis-cluster-cluster-update]}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
# Source: gitea/charts/postgresql-ha/templates/serviceaccount.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: release-name-postgresql-ha
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
automountServiceAccountToken: false
|
||||
---
|
||||
# Source: gitea/charts/redis-cluster/templates/redis-serviceaccount.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: release-name-redis-cluster
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
app.kubernetes.io/version: 7.2.5
|
||||
automountServiceAccountToken: false
|
||||
|
|
@ -0,0 +1,384 @@
|
|||
# Source: gitea/charts/postgresql-ha/templates/pgpool/secrets.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-pgpool
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 4.5.2
|
||||
app.kubernetes.io/component: pgpool
|
||||
type: Opaque
|
||||
data:
|
||||
admin-password: "aWppbmMxMjMh"
|
||||
---
|
||||
# Source: gitea/charts/postgresql-ha/templates/postgresql/secrets.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
namespace: "gitea"
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: postgresql
|
||||
type: Opaque
|
||||
data:
|
||||
postgres-password: "aWppbmMxMjMh"
|
||||
password: "Z2l0ZWE="
|
||||
repmgr-password: "aWppbmMxMjMh"
|
||||
---
|
||||
# Source: gitea/templates/gitea/config.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: release-name-gitea-inline-config
|
||||
namespace: gitea
|
||||
labels:
|
||||
app: gitea
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "1.22.1"
|
||||
version: "1.22.1"
|
||||
type: Opaque
|
||||
stringData:
|
||||
_generals_: ""
|
||||
cache: |-
|
||||
ADAPTER=redis
|
||||
HOST=redis+cluster://:@release-name-redis-cluster-headless.gitea.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||
database: |-
|
||||
DB_TYPE=postgres
|
||||
HOST=release-name-postgresql-ha-pgpool.gitea.svc.cluster.local:5432
|
||||
NAME=gitea
|
||||
PASSWD=gitea
|
||||
USER=gitea
|
||||
indexer: ISSUE_INDEXER_TYPE=db
|
||||
metrics: ENABLED=false
|
||||
queue: |-
|
||||
CONN_STR=redis+cluster://:@release-name-redis-cluster-headless.gitea.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||
TYPE=redis
|
||||
repository: ROOT=/data/git/gitea-repositories
|
||||
security: INSTALL_LOCK=true
|
||||
server: |-
|
||||
APP_DATA_PATH=/data
|
||||
DOMAIN=gitea.nhngpuaas.com
|
||||
ENABLE_PPROF=false
|
||||
HTTP_PORT=3000
|
||||
PROTOCOL=http
|
||||
ROOT_URL=https://gitea.nhngpuaas.com
|
||||
SSH_DOMAIN=gitea.nhngpuaas.com
|
||||
SSH_LISTEN_PORT=2222
|
||||
SSH_PORT=22
|
||||
START_SSH_SERVER=true
|
||||
session: |-
|
||||
PROVIDER=redis
|
||||
PROVIDER_CONFIG=redis+cluster://:@release-name-redis-cluster-headless.gitea.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||
---
|
||||
# Source: gitea/templates/gitea/config.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: release-name-gitea
|
||||
namespace: gitea
|
||||
labels:
|
||||
app: gitea
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "1.22.1"
|
||||
version: "1.22.1"
|
||||
type: Opaque
|
||||
stringData:
|
||||
assertions: |
|
||||
config_environment.sh: |-
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
function env2ini::log() {
|
||||
printf "${1}\n"
|
||||
}
|
||||
|
||||
function env2ini::read_config_to_env() {
|
||||
local section="${1}"
|
||||
local line="${2}"
|
||||
|
||||
if [[ -z "${line}" ]]; then
|
||||
# skip empty line
|
||||
return
|
||||
fi
|
||||
|
||||
# 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
|
||||
local setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
|
||||
|
||||
if [[ -z "${setting}" ]]; then
|
||||
env2ini::log ' ! invalid setting'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
local value=''
|
||||
local regex="^${setting}(\s*)=(\s*)(.*)"
|
||||
if [[ $line =~ $regex ]]; then
|
||||
value="${BASH_REMATCH[3]}"
|
||||
else
|
||||
env2ini::log ' ! invalid setting'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
env2ini::log " + '${setting}'"
|
||||
|
||||
if [[ -z "${section}" ]]; then
|
||||
export "GITEA____${setting^^}=${value}" # '^^' makes the variable content uppercase
|
||||
return
|
||||
fi
|
||||
|
||||
local masked_section="${section//./_0X2E_}" # '//' instructs to replace all matches
|
||||
masked_section="${masked_section//-/_0X2D_}"
|
||||
|
||||
export "GITEA__${masked_section^^}__${setting^^}=${value}" # '^^' makes the variable content uppercase
|
||||
}
|
||||
|
||||
function env2ini::reload_preset_envs() {
|
||||
env2ini::log "Reloading preset envs..."
|
||||
|
||||
while read -r line; do
|
||||
if [[ -z "${line}" ]]; then
|
||||
# skip empty line
|
||||
return
|
||||
fi
|
||||
|
||||
# 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
|
||||
local setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
|
||||
|
||||
if [[ -z "${setting}" ]]; then
|
||||
env2ini::log ' ! invalid setting'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
local value=''
|
||||
local regex="^${setting}(\s*)=(\s*)(.*)"
|
||||
if [[ $line =~ $regex ]]; then
|
||||
value="${BASH_REMATCH[3]}"
|
||||
else
|
||||
env2ini::log ' ! invalid setting'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
env2ini::log " + '${setting}'"
|
||||
|
||||
export "${setting^^}=${value}" # '^^' makes the variable content uppercase
|
||||
done < "/tmp/existing-envs"
|
||||
|
||||
rm /tmp/existing-envs
|
||||
}
|
||||
|
||||
|
||||
function env2ini::process_config_file() {
|
||||
local config_file="${1}"
|
||||
local section="$(basename "${config_file}")"
|
||||
|
||||
if [[ $section == '_generals_' ]]; then
|
||||
|
||||
section=''
|
||||
else
|
||||
env2ini::log " ${section}"
|
||||
fi
|
||||
|
||||
while read -r line; do
|
||||
env2ini::read_config_to_env "${section}" "${line}"
|
||||
done < <(awk 1 "${config_file}") # Helm .toYaml trims the trailing new line which breaks line processing; awk 1 ... adds it back while reading
|
||||
}
|
||||
|
||||
function env2ini::load_config_sources() {
|
||||
local path="${1}"
|
||||
|
||||
if [[ -d "${path}" ]]; then
|
||||
env2ini::log "Processing $(basename "${path}")..."
|
||||
|
||||
while read -d '' configFile; do
|
||||
env2ini::process_config_file "${configFile}"
|
||||
done < <(find "${path}" -type l -not -name '..data' -print0)
|
||||
|
||||
env2ini::log "\n"
|
||||
fi
|
||||
}
|
||||
|
||||
function env2ini::generate_initial_secrets() {
|
||||
# These environment variables will either be
|
||||
# - overwritten with user defined values,
|
||||
# - initially used to set up Gitea
|
||||
# Anyway, they won't harm existing app.ini files
|
||||
|
||||
export GITEA__SECURITY__INTERNAL_TOKEN=$(gitea generate secret INTERNAL_TOKEN)
|
||||
export GITEA__SECURITY__SECRET_KEY=$(gitea generate secret SECRET_KEY)
|
||||
export GITEA__OAUTH2__JWT_SECRET=$(gitea generate secret JWT_SECRET)
|
||||
export GITEA__SERVER__LFS_JWT_SECRET=$(gitea generate secret LFS_JWT_SECRET)
|
||||
|
||||
env2ini::log "...Initial secrets generated\n"
|
||||
}
|
||||
|
||||
# save existing envs prior to script execution. Necessary to keep order of preexisting and custom envs
|
||||
env | (grep -e '^GITEA__' || [[ $? == 1 ]]) > /tmp/existing-envs
|
||||
|
||||
# MUST BE CALLED BEFORE OTHER CONFIGURATION
|
||||
env2ini::generate_initial_secrets
|
||||
|
||||
env2ini::load_config_sources '/env-to-ini-mounts/inlines/'
|
||||
env2ini::load_config_sources '/env-to-ini-mounts/additionals/'
|
||||
|
||||
# load existing envs to override auto generated envs
|
||||
env2ini::reload_preset_envs
|
||||
|
||||
env2ini::log "=== All configuration sources loaded ===\n"
|
||||
|
||||
# safety to prevent rewrite of secret keys if an app.ini already exists
|
||||
if [ -f ${GITEA_APP_INI} ]; then
|
||||
env2ini::log 'An app.ini file already exists. To prevent overwriting secret keys, these settings are dropped and remain unchanged:'
|
||||
env2ini::log ' - security.INTERNAL_TOKEN'
|
||||
env2ini::log ' - security.SECRET_KEY'
|
||||
env2ini::log ' - oauth2.JWT_SECRET'
|
||||
env2ini::log ' - server.LFS_JWT_SECRET'
|
||||
|
||||
unset GITEA__SECURITY__INTERNAL_TOKEN
|
||||
unset GITEA__SECURITY__SECRET_KEY
|
||||
unset GITEA__OAUTH2__JWT_SECRET
|
||||
unset GITEA__SERVER__LFS_JWT_SECRET
|
||||
fi
|
||||
|
||||
environment-to-ini -o $GITEA_APP_INI
|
||||
---
|
||||
# Source: gitea/templates/gitea/init.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: release-name-gitea-init
|
||||
namespace: gitea
|
||||
labels:
|
||||
app: gitea
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "1.22.1"
|
||||
version: "1.22.1"
|
||||
type: Opaque
|
||||
stringData:
|
||||
configure_gpg_environment.sh: |-
|
||||
#!/usr/bin/env bash
|
||||
set -eu
|
||||
|
||||
gpg --batch --import /raw/private.asc
|
||||
init_directory_structure.sh: |-
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
set -x
|
||||
mkdir -p /data/git/.ssh
|
||||
chmod -R 700 /data/git/.ssh
|
||||
[ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf
|
||||
|
||||
# prepare temp directory structure
|
||||
mkdir -p "${GITEA_TEMP}"
|
||||
chmod ug+rwx "${GITEA_TEMP}"
|
||||
|
||||
|
||||
|
||||
configure_gitea.sh: |-
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
echo '==== BEGIN GITEA CONFIGURATION ===='
|
||||
|
||||
{ # try
|
||||
gitea migrate
|
||||
} || { # catch
|
||||
echo "Gitea migrate might fail due to database connection...This init-container will try again in a few seconds"
|
||||
exit 1
|
||||
}
|
||||
function test_redis_connection() {
|
||||
local RETRY=0
|
||||
local MAX=30
|
||||
|
||||
echo 'Wait for redis to become avialable...'
|
||||
until [ "${RETRY}" -ge "${MAX}" ]; do
|
||||
nc -vz -w2 release-name-redis-cluster-headless.gitea.svc.cluster.local 6379 && break
|
||||
RETRY=$[${RETRY}+1]
|
||||
echo "...not ready yet (${RETRY}/${MAX})"
|
||||
done
|
||||
|
||||
if [ "${RETRY}" -ge "${MAX}" ]; then
|
||||
echo "Redis not reachable after '${MAX}' attempts!"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
test_redis_connection
|
||||
function configure_admin_user() {
|
||||
local full_admin_list=$(gitea admin user list --admin)
|
||||
local actual_user_table=''
|
||||
|
||||
# We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
|
||||
local regex="(.*)(ID\s+Username\s+Email\s+IsActive.*)"
|
||||
if [[ "${full_admin_list}" =~ $regex ]]; then
|
||||
actual_user_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
|
||||
else
|
||||
# This code block should never be reached, as long as the output table header remains the same.
|
||||
# If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
|
||||
|
||||
echo "ERROR: 'configure_admin_user' was not able to determine the current list of admin users."
|
||||
echo " Please review the output of 'gitea admin user list --admin' shown below."
|
||||
echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-chart/issues."
|
||||
echo "DEBUG: Output of 'gitea admin user list --admin'"
|
||||
echo "--"
|
||||
echo "${full_admin_list}"
|
||||
echo "--"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
local ACCOUNT_ID=$(echo "${actual_user_table}" | grep -E "\s+${GITEA_ADMIN_USERNAME}\s+" | awk -F " " "{printf \$1}")
|
||||
if [[ -z "${ACCOUNT_ID}" ]]; then
|
||||
local -a create_args
|
||||
create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email "gitea@local.domain")
|
||||
if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = initialOnlyRequireReset ]]; then
|
||||
create_args+=(--must-change-password=true)
|
||||
else
|
||||
create_args+=(--must-change-password=false)
|
||||
fi
|
||||
echo "No admin user '${GITEA_ADMIN_USERNAME}' found. Creating now..."
|
||||
gitea admin user create "${create_args[@]}"
|
||||
echo '...created.'
|
||||
else
|
||||
if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = keepUpdated ]]; then
|
||||
echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist. Running update to sync password..."
|
||||
# See https://gitea.com/gitea/helm-chart/issues/673
|
||||
# --must-change-password argument was added to change-password, defaulting to true, counter to the previous behavior
|
||||
# which acted as if it were provided with =false. If the argument is present in this version of gitea, then we
|
||||
# should add it to prevent requiring frequent admin password resets.
|
||||
local -a change_args
|
||||
change_args=(--username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}")
|
||||
if gitea admin user change-password --help | grep -qF -- '--must-change-password'; then
|
||||
change_args+=(--must-change-password=false)
|
||||
fi
|
||||
gitea admin user change-password "${change_args[@]}"
|
||||
echo '...password sync done.'
|
||||
else
|
||||
echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist, but update mode is set to '${GITEA_ADMIN_PASSWORD_MODE}'. Skipping."
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
configure_admin_user
|
||||
|
||||
function configure_ldap() {
|
||||
echo 'no ldap configuration... skipping.'
|
||||
}
|
||||
|
||||
configure_ldap
|
||||
|
||||
function configure_oauth() {
|
||||
echo 'no oauth configuration... skipping.'
|
||||
}
|
||||
|
||||
configure_oauth
|
||||
|
||||
echo '==== END GITEA CONFIGURATION ===='
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
# Source: gitea/templates/gitea/pvc.yaml
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: gitea-shared-storage
|
||||
namespace: gitea
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
volumeMode: Filesystem
|
||||
# storageClassName: sc-monitoring
|
||||
resources:
|
||||
requests:
|
||||
storage: 100Gi # default: 10Gi
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
# Need To Change
|
||||
## Secret File
|
||||
* DOMAIN
|
||||
* ROOT_URL
|
||||
* SSH_DOMAIN
|
||||
* ###-password : aWppbmMxMjMh
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,820 @@
|
|||
# Source: gitea/charts/postgresql-ha/templates/pgpool/deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-pgpool
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 4.5.2
|
||||
app.kubernetes.io/component: pgpool
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: pgpool
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 4.5.2
|
||||
app.kubernetes.io/component: pgpool
|
||||
spec:
|
||||
nodeSelector:
|
||||
nodegroup: nd
|
||||
automountServiceAccountToken: false
|
||||
affinity:
|
||||
podAffinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: pgpool
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
nodeAffinity:
|
||||
|
||||
securityContext:
|
||||
fsGroup: 1001
|
||||
fsGroupChangePolicy: Always
|
||||
supplementalGroups: []
|
||||
sysctls: []
|
||||
serviceAccountName: release-name-postgresql-ha
|
||||
# Auxiliary vars to populate environment variables
|
||||
containers:
|
||||
- name: pgpool
|
||||
image: docker.io/bitnami/pgpool:4.5.2-debian-12-r2
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1001
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: "false"
|
||||
- name: PGPOOL_BACKEND_NODES
|
||||
value: 0:release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless:5432,1:release-name-postgresql-ha-postgresql-1.release-name-postgresql-ha-postgresql-headless:5432,2:release-name-postgresql-ha-postgresql-2.release-name-postgresql-ha-postgresql-headless:5432,
|
||||
- name: PGPOOL_SR_CHECK_USER
|
||||
value: "repmgr"
|
||||
- name: PGPOOL_SR_CHECK_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
key: repmgr-password
|
||||
- name: PGPOOL_SR_CHECK_DATABASE
|
||||
value: "postgres"
|
||||
- name: PGPOOL_ENABLE_LDAP
|
||||
value: "no"
|
||||
- name: PGPOOL_POSTGRES_USERNAME
|
||||
value: "gitea"
|
||||
- name: PGPOOL_POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
key: password
|
||||
- name: PGPOOL_ADMIN_USERNAME
|
||||
value: "admin"
|
||||
- name: PGPOOL_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: release-name-postgresql-ha-pgpool
|
||||
key: admin-password
|
||||
- name: PGPOOL_AUTHENTICATION_METHOD
|
||||
value: "scram-sha-256"
|
||||
- name: PGPOOL_ENABLE_LOAD_BALANCING
|
||||
value: "yes"
|
||||
- name: PGPOOL_DISABLE_LOAD_BALANCE_ON_WRITE
|
||||
value: "transaction"
|
||||
- name: PGPOOL_ENABLE_LOG_CONNECTIONS
|
||||
value: "no"
|
||||
- name: PGPOOL_ENABLE_LOG_HOSTNAME
|
||||
value: "yes"
|
||||
- name: PGPOOL_ENABLE_LOG_PER_NODE_STATEMENT
|
||||
value: "no"
|
||||
- name: PGPOOL_RESERVED_CONNECTIONS
|
||||
value: '1'
|
||||
- name: PGPOOL_CHILD_LIFE_TIME
|
||||
value: ""
|
||||
- name: PGPOOL_ENABLE_TLS
|
||||
value: "no"
|
||||
- name: PGPOOL_HEALTH_CHECK_PSQL_TIMEOUT
|
||||
value: "6"
|
||||
envFrom:
|
||||
ports:
|
||||
- name: postgresql
|
||||
containerPort: 5432
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
failureThreshold: 5
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
exec:
|
||||
command:
|
||||
- /opt/bitnami/scripts/pgpool/healthcheck.sh
|
||||
readinessProbe:
|
||||
failureThreshold: 5
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
exec:
|
||||
command:
|
||||
- bash
|
||||
- -ec
|
||||
- PGPASSWORD=${PGPOOL_POSTGRES_PASSWORD} psql -U "gitea" -d "gitea" -h /opt/bitnami/pgpool/tmp -tA -c "SELECT 1" >/dev/null
|
||||
resources:
|
||||
limits:
|
||||
cpu: 375m
|
||||
ephemeral-storage: 2Gi
|
||||
memory: 384Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
ephemeral-storage: 50Mi
|
||||
memory: 256Mi
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/pgpool/etc
|
||||
subPath: app-etc-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/pgpool/conf
|
||||
subPath: app-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/pgpool/tmp
|
||||
subPath: app-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/pgpool/logs
|
||||
subPath: app-logs-dir
|
||||
volumes:
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
---
|
||||
# Source: gitea/templates/gitea/deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: release-name-gitea
|
||||
namespace: gitea
|
||||
annotations:
|
||||
labels:
|
||||
app: gitea
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "1.22.1"
|
||||
version: "1.22.1"
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 0
|
||||
maxSurge: 100%
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: 00fd8064076a446a896870db4974c6590fcf51561cf391547e559011465a57d8
|
||||
labels:
|
||||
app: gitea
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "1.22.1"
|
||||
version: "1.22.1"
|
||||
spec:
|
||||
nodeSelector:
|
||||
nodegroup: nd
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
initContainers:
|
||||
- name: init-directories
|
||||
image: "gitea/gitea:1.22.1-rootless"
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: ["/usr/sbin/init_directory_structure.sh"]
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: /usr/sbin
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
|
||||
securityContext:
|
||||
{}
|
||||
resources:
|
||||
limits: {}
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
- name: init-app-ini
|
||||
image: "gitea/gitea:1.22.1-rootless"
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: ["/usr/sbin/config_environment.sh"]
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /usr/sbin
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
- name: inline-config-sources
|
||||
mountPath: /env-to-ini-mounts/inlines/
|
||||
|
||||
securityContext:
|
||||
{}
|
||||
resources:
|
||||
limits: {}
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
- name: configure-gitea
|
||||
image: "gitea/gitea:1.22.1-rootless"
|
||||
command: ["/usr/sbin/configure_gitea.sh"]
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
- name: HOME
|
||||
value: /data/gitea/git
|
||||
- name: GITEA_ADMIN_USERNAME
|
||||
value: "gitea_admin"
|
||||
- name: GITEA_ADMIN_PASSWORD
|
||||
value: "nhn!@#123" # sdjo
|
||||
- name: GITEA_ADMIN_PASSWORD_MODE
|
||||
value: keepUpdated
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: /usr/sbin
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
|
||||
resources:
|
||||
limits: {}
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
terminationGracePeriodSeconds: 60
|
||||
containers:
|
||||
- name: gitea
|
||||
image: "gitea/gitea:1.22.1-rootless"
|
||||
imagePullPolicy: IfNotPresent
|
||||
env:
|
||||
# SSH Port values have to be set here as well for openssh configuration
|
||||
- name: SSH_LISTEN_PORT
|
||||
value: "2222"
|
||||
- name: SSH_PORT
|
||||
value: "22"
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
- name: TMPDIR
|
||||
value: /tmp/gitea
|
||||
- name: HOME
|
||||
value: /data/gitea/git
|
||||
ports:
|
||||
- name: ssh
|
||||
containerPort: 2222
|
||||
- name: http
|
||||
containerPort: 3000
|
||||
livenessProbe:
|
||||
failureThreshold: 10
|
||||
initialDelaySeconds: 200
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
tcpSocket:
|
||||
port: http
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
tcpSocket:
|
||||
port: http
|
||||
timeoutSeconds: 1
|
||||
resources:
|
||||
{}
|
||||
securityContext:
|
||||
{}
|
||||
volumeMounts:
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
|
||||
volumes:
|
||||
- name: init
|
||||
secret:
|
||||
secretName: release-name-gitea-init
|
||||
defaultMode: 110
|
||||
- name: config
|
||||
secret:
|
||||
secretName: release-name-gitea
|
||||
defaultMode: 110
|
||||
- name: inline-config-sources
|
||||
secret:
|
||||
secretName: release-name-gitea-inline-config
|
||||
- name: temp
|
||||
emptyDir: {}
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: gitea-shared-storage
|
||||
---
|
||||
# Source: gitea/charts/postgresql-ha/templates/postgresql/statefulset.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
namespace: "gitea"
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
spec:
|
||||
replicas: 3
|
||||
podManagementPolicy: "Parallel"
|
||||
serviceName: release-name-postgresql-ha-postgresql-headless
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
spec:
|
||||
nodeSelector:
|
||||
nodegroup: nd
|
||||
automountServiceAccountToken: false
|
||||
affinity:
|
||||
podAffinity:
|
||||
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: postgresql
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
nodeAffinity:
|
||||
|
||||
securityContext:
|
||||
fsGroup: 1001
|
||||
fsGroupChangePolicy: Always
|
||||
supplementalGroups: []
|
||||
sysctls: []
|
||||
serviceAccountName: release-name-postgresql-ha
|
||||
hostNetwork: false
|
||||
hostIPC: false
|
||||
containers:
|
||||
- name: postgresql
|
||||
image: docker.io/bitnami/postgresql-repmgr:16.3.0-debian-12-r15
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1001
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- /pre-stop.sh
|
||||
- "25"
|
||||
# Auxiliary vars to populate environment variables
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: "false"
|
||||
# PostgreSQL configuration
|
||||
- name: POSTGRESQL_VOLUME_DIR
|
||||
value: "/bitnami/postgresql"
|
||||
- name: PGDATA
|
||||
value: "/bitnami/postgresql/data"
|
||||
- name: POSTGRES_POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
key: postgres-password
|
||||
- name: POSTGRES_USER
|
||||
value: "gitea"
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
key: password
|
||||
- name: POSTGRES_DB
|
||||
value: "gitea"
|
||||
- name: POSTGRESQL_LOG_HOSTNAME
|
||||
value: "true"
|
||||
- name: POSTGRESQL_LOG_CONNECTIONS
|
||||
value: "false"
|
||||
- name: POSTGRESQL_LOG_DISCONNECTIONS
|
||||
value: "false"
|
||||
- name: POSTGRESQL_PGAUDIT_LOG_CATALOG
|
||||
value: "off"
|
||||
- name: POSTGRESQL_CLIENT_MIN_MESSAGES
|
||||
value: "error"
|
||||
- name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
|
||||
value: "pgaudit, repmgr"
|
||||
- name: POSTGRESQL_ENABLE_TLS
|
||||
value: "no"
|
||||
- name: POSTGRESQL_PORT_NUMBER
|
||||
value: "5432"
|
||||
# Repmgr configuration
|
||||
- name: REPMGR_PORT_NUMBER
|
||||
value: "5432"
|
||||
- name: REPMGR_PRIMARY_PORT
|
||||
value: "5432"
|
||||
- name: MY_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: REPMGR_UPGRADE_EXTENSION
|
||||
value: "no"
|
||||
- name: REPMGR_PGHBA_TRUST_ALL
|
||||
value: "no"
|
||||
- name: REPMGR_MOUNTED_CONF_DIR
|
||||
value: "/bitnami/repmgr/conf"
|
||||
- name: REPMGR_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: REPMGR_PARTNER_NODES
|
||||
value: release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,release-name-postgresql-ha-postgresql-1.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,release-name-postgresql-ha-postgresql-2.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,
|
||||
- name: REPMGR_PRIMARY_HOST
|
||||
value: "release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
|
||||
- name: REPMGR_NODE_NAME
|
||||
value: "$(MY_POD_NAME)"
|
||||
- name: REPMGR_NODE_NETWORK_NAME
|
||||
value: "$(MY_POD_NAME).release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
|
||||
- name: REPMGR_NODE_TYPE
|
||||
value: "data"
|
||||
- name: REPMGR_LOG_LEVEL
|
||||
value: "NOTICE"
|
||||
- name: REPMGR_CONNECT_TIMEOUT
|
||||
value: "5"
|
||||
- name: REPMGR_RECONNECT_ATTEMPTS
|
||||
value: "2"
|
||||
- name: REPMGR_RECONNECT_INTERVAL
|
||||
value: "3"
|
||||
- name: REPMGR_USERNAME
|
||||
value: "repmgr"
|
||||
- name: REPMGR_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
key: repmgr-password
|
||||
- name: REPMGR_DATABASE
|
||||
value: "repmgr"
|
||||
- name: REPMGR_FENCE_OLD_PRIMARY
|
||||
value: "no"
|
||||
- name: REPMGR_CHILD_NODES_CHECK_INTERVAL
|
||||
value: "5"
|
||||
- name: REPMGR_CHILD_NODES_CONNECTED_MIN_COUNT
|
||||
value: "1"
|
||||
- name: REPMGR_CHILD_NODES_DISCONNECT_TIMEOUT
|
||||
value: "30"
|
||||
envFrom:
|
||||
ports:
|
||||
- name: postgresql
|
||||
containerPort: 5432
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
failureThreshold: 6
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
exec:
|
||||
command:
|
||||
- bash
|
||||
- -ec
|
||||
- 'PGPASSWORD=$POSTGRES_PASSWORD psql -w -U "gitea" -d "gitea" -h 127.0.0.1 -p 5432 -c "SELECT 1"'
|
||||
readinessProbe:
|
||||
failureThreshold: 6
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
exec:
|
||||
command:
|
||||
- bash
|
||||
- -ec
|
||||
- |
|
||||
exec pg_isready -U "postgres" -h 127.0.0.1 -p 5432
|
||||
[ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ]
|
||||
resources:
|
||||
limits:
|
||||
cpu: 375m
|
||||
ephemeral-storage: 2Gi
|
||||
memory: 384Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
ephemeral-storage: 50Mi
|
||||
memory: 256Mi
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/postgresql/conf
|
||||
subPath: app-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/postgresql/tmp
|
||||
subPath: app-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/repmgr/conf
|
||||
subPath: repmgr-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/repmgr/tmp
|
||||
subPath: repmgr-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/repmgr/logs
|
||||
subPath: repmgr-logs-dir
|
||||
- name: data
|
||||
mountPath: /bitnami/postgresql
|
||||
- name: hooks-scripts
|
||||
mountPath: /pre-stop.sh
|
||||
subPath: pre-stop.sh
|
||||
- name: hooks-scripts
|
||||
mountPath: /readiness-probe.sh
|
||||
subPath: readiness-probe.sh
|
||||
volumes:
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
- name: hooks-scripts
|
||||
configMap:
|
||||
name: release-name-postgresql-ha-postgresql-hooks-scripts
|
||||
defaultMode: 0755
|
||||
volumeClaimTemplates:
|
||||
- apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: data
|
||||
spec:
|
||||
accessModes:
|
||||
- "ReadWriteOnce"
|
||||
resources:
|
||||
requests:
|
||||
storage: "8Gi"
|
||||
---
|
||||
# Source: cdgitea/charts/redis-cluster/templates/redis-statefulset.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: release-name-redis-cluster
|
||||
namespace: "gitea"
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
app.kubernetes.io/version: 7.2.5
|
||||
spec:
|
||||
updateStrategy:
|
||||
rollingUpdate:
|
||||
partition: 0
|
||||
type: RollingUpdate
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
replicas: 3
|
||||
serviceName: release-name-redis-cluster-headless
|
||||
podManagementPolicy: Parallel
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
app.kubernetes.io/version: 7.2.5
|
||||
annotations:
|
||||
checksum/scripts: f4443ed238f1b19ab40555e6ba2aea56daba79e8270549f884b9b31cf8e0e2ee
|
||||
checksum/secret: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
|
||||
checksum/config: 958b865b26062946819f240fe4e5fd268b7c3203b944549981f1bd7fdc7947eb
|
||||
spec:
|
||||
nodeSelector:
|
||||
nodegroup: nd
|
||||
hostNetwork: false
|
||||
enableServiceLinks: false
|
||||
|
||||
securityContext:
|
||||
fsGroup: 1001
|
||||
fsGroupChangePolicy: Always
|
||||
supplementalGroups: []
|
||||
sysctls: []
|
||||
serviceAccountName: release-name-redis-cluster
|
||||
automountServiceAccountToken: false
|
||||
affinity:
|
||||
podAffinity:
|
||||
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
nodeAffinity:
|
||||
|
||||
containers:
|
||||
- name: release-name-redis-cluster
|
||||
image: docker.io/bitnami/redis-cluster:7.2.5-debian-12-r2
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1001
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
command: ['/bin/bash', '-c']
|
||||
args:
|
||||
- |
|
||||
# Backwards compatibility change
|
||||
if ! [[ -f /opt/bitnami/redis/etc/redis.conf ]]; then
|
||||
echo COPYING FILE
|
||||
cp /opt/bitnami/redis/etc/redis-default.conf /opt/bitnami/redis/etc/redis.conf
|
||||
fi
|
||||
pod_index=($(echo "$POD_NAME" | tr "-" "\n"))
|
||||
pod_index="${pod_index[-1]}"
|
||||
if [[ "$pod_index" == "0" ]]; then
|
||||
export REDIS_CLUSTER_CREATOR="yes"
|
||||
export REDIS_CLUSTER_REPLICAS="0"
|
||||
fi
|
||||
/opt/bitnami/scripts/redis-cluster/entrypoint.sh /opt/bitnami/scripts/redis-cluster/run.sh
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: REDIS_NODES
|
||||
value: "release-name-redis-cluster-0.release-name-redis-cluster-headless release-name-redis-cluster-1.release-name-redis-cluster-headless release-name-redis-cluster-2.release-name-redis-cluster-headless "
|
||||
- name: ALLOW_EMPTY_PASSWORD
|
||||
value: "yes"
|
||||
- name: REDIS_AOF_ENABLED
|
||||
value: "yes"
|
||||
- name: REDIS_TLS_ENABLED
|
||||
value: "no"
|
||||
- name: REDIS_PORT_NUMBER
|
||||
value: "6379"
|
||||
ports:
|
||||
- name: tcp-redis
|
||||
containerPort: 6379
|
||||
- name: tcp-redis-bus
|
||||
containerPort: 16379
|
||||
livenessProbe:
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
# One second longer than command timeout should prevent generation of zombie processes.
|
||||
timeoutSeconds: 6
|
||||
successThreshold: 1
|
||||
failureThreshold: 5
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- /scripts/ping_liveness_local.sh 5
|
||||
readinessProbe:
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
# One second longer than command timeout should prevent generation of zombie processes.
|
||||
timeoutSeconds: 2
|
||||
successThreshold: 1
|
||||
failureThreshold: 5
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- /scripts/ping_readiness_local.sh 1
|
||||
resources:
|
||||
limits:
|
||||
cpu: 150m
|
||||
ephemeral-storage: 2Gi
|
||||
memory: 192Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
ephemeral-storage: 50Mi
|
||||
memory: 128Mi
|
||||
volumeMounts:
|
||||
- name: scripts
|
||||
mountPath: /scripts
|
||||
- name: redis-data
|
||||
mountPath: /bitnami/redis/data
|
||||
subPath:
|
||||
- name: default-config
|
||||
mountPath: /opt/bitnami/redis/etc/redis-default.conf
|
||||
subPath: redis-default.conf
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/redis/etc/
|
||||
subPath: app-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/redis/tmp
|
||||
subPath: app-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/redis/logs
|
||||
subPath: app-logs-dir
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
volumes:
|
||||
- name: scripts
|
||||
configMap:
|
||||
name: release-name-redis-cluster-scripts
|
||||
defaultMode: 0755
|
||||
- name: default-config
|
||||
configMap:
|
||||
name: release-name-redis-cluster-default
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: redis-data
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
spec:
|
||||
accessModes:
|
||||
- "ReadWriteOnce"
|
||||
resources:
|
||||
requests:
|
||||
storage: "8Gi"
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: ing-gitea
|
||||
namespace: gitea
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
rules:
|
||||
- host: gitea.nhngpuaas.com
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: release-name-gitea-http
|
||||
port:
|
||||
number: 3000
|
||||
tls:
|
||||
- hosts:
|
||||
- "gitea.nhngpuaas.com"
|
||||
secretName: nhngpuaas-ssl
|
||||
|
||||
|
|
@ -0,0 +1,172 @@
|
|||
# Source: gitea/charts/postgresql-ha/templates/pgpool/service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-pgpool
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 4.5.2
|
||||
app.kubernetes.io/component: pgpool
|
||||
spec:
|
||||
type: ClusterIP
|
||||
sessionAffinity: None
|
||||
ports:
|
||||
- name: "postgresql"
|
||||
port: 5432
|
||||
targetPort: postgresql
|
||||
protocol: TCP
|
||||
# nodePort: null
|
||||
selector:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: pgpool
|
||||
---
|
||||
# Source: gitea/charts/postgresql-ha/templates/postgresql/service-headless.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-postgresql-headless
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
publishNotReadyAddresses: false
|
||||
ports:
|
||||
- name: "postgresql"
|
||||
port: 5432
|
||||
targetPort: postgresql
|
||||
protocol: TCP
|
||||
selector:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
---
|
||||
# Source: gitea/charts/postgresql-ha/templates/postgresql/service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: postgresql
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: "postgresql"
|
||||
port: 5432
|
||||
targetPort: postgresql
|
||||
protocol: TCP
|
||||
selector:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
---
|
||||
# Source: gitea/charts/redis-cluster/templates/headless-svc.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: release-name-redis-cluster-headless
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
app.kubernetes.io/version: 7.2.5
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
publishNotReadyAddresses: true
|
||||
ports:
|
||||
- name: tcp-redis
|
||||
port: 6379
|
||||
targetPort: tcp-redis
|
||||
- name: tcp-redis-bus
|
||||
port: 16379
|
||||
targetPort: tcp-redis-bus
|
||||
selector:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
---
|
||||
# Source: gitea/charts/redis-cluster/templates/redis-svc.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: release-name-redis-cluster
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
app.kubernetes.io/version: 7.2.5
|
||||
spec:
|
||||
type: ClusterIP
|
||||
sessionAffinity: None
|
||||
ports:
|
||||
- name: tcp-redis
|
||||
port: 6379
|
||||
targetPort: tcp-redis
|
||||
protocol: TCP
|
||||
nodePort: null
|
||||
selector:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
---
|
||||
# Source: gitea/templates/gitea/http-svc.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: release-name-gitea-http
|
||||
namespace: gitea
|
||||
labels:
|
||||
app: gitea
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "1.22.1"
|
||||
version: "1.22.1"
|
||||
# annotations:
|
||||
# {}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
ports:
|
||||
- name: http
|
||||
port: 3000
|
||||
targetPort:
|
||||
selector:
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
---
|
||||
# Source: gitea/templates/gitea/ssh-svc.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: release-name-gitea-ssh
|
||||
namespace: gitea
|
||||
labels:
|
||||
app: gitea
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "1.22.1"
|
||||
version: "1.22.1"
|
||||
# annotations:
|
||||
# {}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
ports:
|
||||
- name: ssh
|
||||
port: 22
|
||||
targetPort: 2222
|
||||
protocol: TCP
|
||||
selector:
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
dependencies:
|
||||
- name: node-feature-discovery
|
||||
repository: https://kubernetes-sigs.github.io/node-feature-discovery/charts
|
||||
version: 0.17.2
|
||||
digest: sha256:4c55d30d958027ef8997a2976449326de3c90049025c3ebb9bee017cad32cc3f
|
||||
generated: "2025-02-25T09:08:49.128088-08:00"
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
apiVersion: v2
|
||||
appVersion: v25.3.0
|
||||
dependencies:
|
||||
- condition: nfd.enabled
|
||||
name: node-feature-discovery
|
||||
repository: https://kubernetes-sigs.github.io/node-feature-discovery/charts
|
||||
version: v0.17.2
|
||||
description: NVIDIA GPU Operator creates/configures/manages GPUs atop Kubernetes
|
||||
home: https://docs.nvidia.com/datacenter/cloud-native/gpu-operator/overview.html
|
||||
icon: https://assets.nvidiagrid.net/ngc/logos/GPUoperator.png
|
||||
keywords:
|
||||
- gpu
|
||||
- cuda
|
||||
- compute
|
||||
- operator
|
||||
- deep learning
|
||||
- monitoring
|
||||
- tesla
|
||||
kubeVersion: '>= 1.16.0-0'
|
||||
name: gpu-operator
|
||||
sources:
|
||||
- https://github.com/NVIDIA/gpu-operator
|
||||
version: v25.3.0
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
apiVersion: v2
|
||||
appVersion: v0.17.2
|
||||
description: 'Detects hardware features available on each node in a Kubernetes cluster,
|
||||
and advertises those features using node labels. '
|
||||
home: https://github.com/kubernetes-sigs/node-feature-discovery
|
||||
keywords:
|
||||
- feature-discovery
|
||||
- feature-detection
|
||||
- node-labels
|
||||
name: node-feature-discovery
|
||||
sources:
|
||||
- https://github.com/kubernetes-sigs/node-feature-discovery
|
||||
type: application
|
||||
version: 0.17.2
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
# Node Feature Discovery
|
||||
|
||||
Node Feature Discovery (NFD) is a Kubernetes add-on for detecting hardware
|
||||
features and system configuration. Detected features are advertised as node
|
||||
labels. NFD provides flexible configuration and extension points for a wide
|
||||
range of vendor and application specific node labeling needs.
|
||||
|
||||
See
|
||||
[NFD documentation](https://kubernetes-sigs.github.io/node-feature-discovery/v0.17/deployment/helm.html)
|
||||
for deployment instructions.
|
||||
|
|
@ -0,0 +1,711 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.16.3
|
||||
name: nodefeatures.nfd.k8s-sigs.io
|
||||
spec:
|
||||
group: nfd.k8s-sigs.io
|
||||
names:
|
||||
kind: NodeFeature
|
||||
listKind: NodeFeatureList
|
||||
plural: nodefeatures
|
||||
singular: nodefeature
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
NodeFeature resource holds the features discovered for one node in the
|
||||
cluster.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Specification of the NodeFeature, containing features discovered
|
||||
for a node.
|
||||
properties:
|
||||
features:
|
||||
description: Features is the full "raw" features data that has been
|
||||
discovered.
|
||||
properties:
|
||||
attributes:
|
||||
additionalProperties:
|
||||
description: AttributeFeatureSet is a set of features having
|
||||
string value.
|
||||
properties:
|
||||
elements:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Individual features of the feature set.
|
||||
type: object
|
||||
required:
|
||||
- elements
|
||||
type: object
|
||||
description: Attributes contains all the attribute-type features
|
||||
of the node.
|
||||
type: object
|
||||
flags:
|
||||
additionalProperties:
|
||||
description: FlagFeatureSet is a set of simple features only
|
||||
containing names without values.
|
||||
properties:
|
||||
elements:
|
||||
additionalProperties:
|
||||
description: |-
|
||||
Nil is a dummy empty struct for protobuf compatibility.
|
||||
NOTE: protobuf definitions have been removed but this is kept for API compatibility.
|
||||
type: object
|
||||
description: Individual features of the feature set.
|
||||
type: object
|
||||
required:
|
||||
- elements
|
||||
type: object
|
||||
description: Flags contains all the flag-type features of the
|
||||
node.
|
||||
type: object
|
||||
instances:
|
||||
additionalProperties:
|
||||
description: InstanceFeatureSet is a set of features each of
|
||||
which is an instance having multiple attributes.
|
||||
properties:
|
||||
elements:
|
||||
description: Individual features of the feature set.
|
||||
items:
|
||||
description: InstanceFeature represents one instance of
|
||||
a complex features, e.g. a device.
|
||||
properties:
|
||||
attributes:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Attributes of the instance feature.
|
||||
type: object
|
||||
required:
|
||||
- attributes
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- elements
|
||||
type: object
|
||||
description: Instances contains all the instance-type features
|
||||
of the node.
|
||||
type: object
|
||||
type: object
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Labels is the set of node labels that are requested to
|
||||
be created.
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.16.3
|
||||
name: nodefeaturegroups.nfd.k8s-sigs.io
|
||||
spec:
|
||||
group: nfd.k8s-sigs.io
|
||||
names:
|
||||
kind: NodeFeatureGroup
|
||||
listKind: NodeFeatureGroupList
|
||||
plural: nodefeaturegroups
|
||||
shortNames:
|
||||
- nfg
|
||||
singular: nodefeaturegroup
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: NodeFeatureGroup resource holds Node pools by featureGroup
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec defines the rules to be evaluated.
|
||||
properties:
|
||||
featureGroupRules:
|
||||
description: List of rules to evaluate to determine nodes that belong
|
||||
in this group.
|
||||
items:
|
||||
description: GroupRule defines a rule for nodegroup filtering.
|
||||
properties:
|
||||
matchAny:
|
||||
description: MatchAny specifies a list of matchers one of which
|
||||
must match.
|
||||
items:
|
||||
description: MatchAnyElem specifies one sub-matcher of MatchAny.
|
||||
properties:
|
||||
matchFeatures:
|
||||
description: MatchFeatures specifies a set of matcher
|
||||
terms all of which must match.
|
||||
items:
|
||||
description: |-
|
||||
FeatureMatcherTerm defines requirements against one feature set. All
|
||||
requirements (specified as MatchExpressions) are evaluated against each
|
||||
element in the feature set.
|
||||
properties:
|
||||
feature:
|
||||
description: Feature is the name of the feature
|
||||
set to match against.
|
||||
type: string
|
||||
matchExpressions:
|
||||
additionalProperties:
|
||||
description: |-
|
||||
MatchExpression specifies an expression to evaluate against a set of input
|
||||
values. It contains an operator that is applied when matching the input and
|
||||
an array of values that the operator evaluates the input against.
|
||||
properties:
|
||||
op:
|
||||
description: Op is the operator to be applied.
|
||||
enum:
|
||||
- In
|
||||
- NotIn
|
||||
- InRegexp
|
||||
- Exists
|
||||
- DoesNotExist
|
||||
- Gt
|
||||
- Lt
|
||||
- GtLt
|
||||
- IsTrue
|
||||
- IsFalse
|
||||
type: string
|
||||
value:
|
||||
description: |-
|
||||
Value is the list of values that the operand evaluates the input
|
||||
against. Value should be empty if the operator is Exists, DoesNotExist,
|
||||
IsTrue or IsFalse. Value should contain exactly one element if the
|
||||
operator is Gt or Lt and exactly two elements if the operator is GtLt.
|
||||
In other cases Value should contain at least one element.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- op
|
||||
type: object
|
||||
description: |-
|
||||
MatchExpressions is the set of per-element expressions evaluated. These
|
||||
match against the value of the specified elements.
|
||||
type: object
|
||||
matchName:
|
||||
description: |-
|
||||
MatchName in an expression that is matched against the name of each
|
||||
element in the feature set.
|
||||
properties:
|
||||
op:
|
||||
description: Op is the operator to be applied.
|
||||
enum:
|
||||
- In
|
||||
- NotIn
|
||||
- InRegexp
|
||||
- Exists
|
||||
- DoesNotExist
|
||||
- Gt
|
||||
- Lt
|
||||
- GtLt
|
||||
- IsTrue
|
||||
- IsFalse
|
||||
type: string
|
||||
value:
|
||||
description: |-
|
||||
Value is the list of values that the operand evaluates the input
|
||||
against. Value should be empty if the operator is Exists, DoesNotExist,
|
||||
IsTrue or IsFalse. Value should contain exactly one element if the
|
||||
operator is Gt or Lt and exactly two elements if the operator is GtLt.
|
||||
In other cases Value should contain at least one element.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- op
|
||||
type: object
|
||||
required:
|
||||
- feature
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- matchFeatures
|
||||
type: object
|
||||
type: array
|
||||
matchFeatures:
|
||||
description: MatchFeatures specifies a set of matcher terms
|
||||
all of which must match.
|
||||
items:
|
||||
description: |-
|
||||
FeatureMatcherTerm defines requirements against one feature set. All
|
||||
requirements (specified as MatchExpressions) are evaluated against each
|
||||
element in the feature set.
|
||||
properties:
|
||||
feature:
|
||||
description: Feature is the name of the feature set to
|
||||
match against.
|
||||
type: string
|
||||
matchExpressions:
|
||||
additionalProperties:
|
||||
description: |-
|
||||
MatchExpression specifies an expression to evaluate against a set of input
|
||||
values. It contains an operator that is applied when matching the input and
|
||||
an array of values that the operator evaluates the input against.
|
||||
properties:
|
||||
op:
|
||||
description: Op is the operator to be applied.
|
||||
enum:
|
||||
- In
|
||||
- NotIn
|
||||
- InRegexp
|
||||
- Exists
|
||||
- DoesNotExist
|
||||
- Gt
|
||||
- Lt
|
||||
- GtLt
|
||||
- IsTrue
|
||||
- IsFalse
|
||||
type: string
|
||||
value:
|
||||
description: |-
|
||||
Value is the list of values that the operand evaluates the input
|
||||
against. Value should be empty if the operator is Exists, DoesNotExist,
|
||||
IsTrue or IsFalse. Value should contain exactly one element if the
|
||||
operator is Gt or Lt and exactly two elements if the operator is GtLt.
|
||||
In other cases Value should contain at least one element.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- op
|
||||
type: object
|
||||
description: |-
|
||||
MatchExpressions is the set of per-element expressions evaluated. These
|
||||
match against the value of the specified elements.
|
||||
type: object
|
||||
matchName:
|
||||
description: |-
|
||||
MatchName in an expression that is matched against the name of each
|
||||
element in the feature set.
|
||||
properties:
|
||||
op:
|
||||
description: Op is the operator to be applied.
|
||||
enum:
|
||||
- In
|
||||
- NotIn
|
||||
- InRegexp
|
||||
- Exists
|
||||
- DoesNotExist
|
||||
- Gt
|
||||
- Lt
|
||||
- GtLt
|
||||
- IsTrue
|
||||
- IsFalse
|
||||
type: string
|
||||
value:
|
||||
description: |-
|
||||
Value is the list of values that the operand evaluates the input
|
||||
against. Value should be empty if the operator is Exists, DoesNotExist,
|
||||
IsTrue or IsFalse. Value should contain exactly one element if the
|
||||
operator is Gt or Lt and exactly two elements if the operator is GtLt.
|
||||
In other cases Value should contain at least one element.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- op
|
||||
type: object
|
||||
required:
|
||||
- feature
|
||||
type: object
|
||||
type: array
|
||||
name:
|
||||
description: Name of the rule.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- featureGroupRules
|
||||
type: object
|
||||
status:
|
||||
description: |-
|
||||
Status of the NodeFeatureGroup after the most recent evaluation of the
|
||||
specification.
|
||||
properties:
|
||||
nodes:
|
||||
description: Nodes is a list of FeatureGroupNode in the cluster that
|
||||
match the featureGroupRules
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
description: Name of the node.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- name
|
||||
x-kubernetes-list-type: map
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.16.3
|
||||
name: nodefeaturerules.nfd.k8s-sigs.io
|
||||
spec:
|
||||
group: nfd.k8s-sigs.io
|
||||
names:
|
||||
kind: NodeFeatureRule
|
||||
listKind: NodeFeatureRuleList
|
||||
plural: nodefeaturerules
|
||||
shortNames:
|
||||
- nfr
|
||||
singular: nodefeaturerule
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
NodeFeatureRule resource specifies a configuration for feature-based
|
||||
customization of node objects, such as node labeling.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec defines the rules to be evaluated.
|
||||
properties:
|
||||
rules:
|
||||
description: Rules is a list of node customization rules.
|
||||
items:
|
||||
description: Rule defines a rule for node customization such as
|
||||
labeling.
|
||||
properties:
|
||||
annotations:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Annotations to create if the rule matches.
|
||||
type: object
|
||||
extendedResources:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: ExtendedResources to create if the rule matches.
|
||||
type: object
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Labels to create if the rule matches.
|
||||
type: object
|
||||
labelsTemplate:
|
||||
description: |-
|
||||
LabelsTemplate specifies a template to expand for dynamically generating
|
||||
multiple labels. Data (after template expansion) must be keys with an
|
||||
optional value (<key>[=<value>]) separated by newlines.
|
||||
type: string
|
||||
matchAny:
|
||||
description: MatchAny specifies a list of matchers one of which
|
||||
must match.
|
||||
items:
|
||||
description: MatchAnyElem specifies one sub-matcher of MatchAny.
|
||||
properties:
|
||||
matchFeatures:
|
||||
description: MatchFeatures specifies a set of matcher
|
||||
terms all of which must match.
|
||||
items:
|
||||
description: |-
|
||||
FeatureMatcherTerm defines requirements against one feature set. All
|
||||
requirements (specified as MatchExpressions) are evaluated against each
|
||||
element in the feature set.
|
||||
properties:
|
||||
feature:
|
||||
description: Feature is the name of the feature
|
||||
set to match against.
|
||||
type: string
|
||||
matchExpressions:
|
||||
additionalProperties:
|
||||
description: |-
|
||||
MatchExpression specifies an expression to evaluate against a set of input
|
||||
values. It contains an operator that is applied when matching the input and
|
||||
an array of values that the operator evaluates the input against.
|
||||
properties:
|
||||
op:
|
||||
description: Op is the operator to be applied.
|
||||
enum:
|
||||
- In
|
||||
- NotIn
|
||||
- InRegexp
|
||||
- Exists
|
||||
- DoesNotExist
|
||||
- Gt
|
||||
- Lt
|
||||
- GtLt
|
||||
- IsTrue
|
||||
- IsFalse
|
||||
type: string
|
||||
value:
|
||||
description: |-
|
||||
Value is the list of values that the operand evaluates the input
|
||||
against. Value should be empty if the operator is Exists, DoesNotExist,
|
||||
IsTrue or IsFalse. Value should contain exactly one element if the
|
||||
operator is Gt or Lt and exactly two elements if the operator is GtLt.
|
||||
In other cases Value should contain at least one element.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- op
|
||||
type: object
|
||||
description: |-
|
||||
MatchExpressions is the set of per-element expressions evaluated. These
|
||||
match against the value of the specified elements.
|
||||
type: object
|
||||
matchName:
|
||||
description: |-
|
||||
MatchName in an expression that is matched against the name of each
|
||||
element in the feature set.
|
||||
properties:
|
||||
op:
|
||||
description: Op is the operator to be applied.
|
||||
enum:
|
||||
- In
|
||||
- NotIn
|
||||
- InRegexp
|
||||
- Exists
|
||||
- DoesNotExist
|
||||
- Gt
|
||||
- Lt
|
||||
- GtLt
|
||||
- IsTrue
|
||||
- IsFalse
|
||||
type: string
|
||||
value:
|
||||
description: |-
|
||||
Value is the list of values that the operand evaluates the input
|
||||
against. Value should be empty if the operator is Exists, DoesNotExist,
|
||||
IsTrue or IsFalse. Value should contain exactly one element if the
|
||||
operator is Gt or Lt and exactly two elements if the operator is GtLt.
|
||||
In other cases Value should contain at least one element.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- op
|
||||
type: object
|
||||
required:
|
||||
- feature
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- matchFeatures
|
||||
type: object
|
||||
type: array
|
||||
matchFeatures:
|
||||
description: MatchFeatures specifies a set of matcher terms
|
||||
all of which must match.
|
||||
items:
|
||||
description: |-
|
||||
FeatureMatcherTerm defines requirements against one feature set. All
|
||||
requirements (specified as MatchExpressions) are evaluated against each
|
||||
element in the feature set.
|
||||
properties:
|
||||
feature:
|
||||
description: Feature is the name of the feature set to
|
||||
match against.
|
||||
type: string
|
||||
matchExpressions:
|
||||
additionalProperties:
|
||||
description: |-
|
||||
MatchExpression specifies an expression to evaluate against a set of input
|
||||
values. It contains an operator that is applied when matching the input and
|
||||
an array of values that the operator evaluates the input against.
|
||||
properties:
|
||||
op:
|
||||
description: Op is the operator to be applied.
|
||||
enum:
|
||||
- In
|
||||
- NotIn
|
||||
- InRegexp
|
||||
- Exists
|
||||
- DoesNotExist
|
||||
- Gt
|
||||
- Lt
|
||||
- GtLt
|
||||
- IsTrue
|
||||
- IsFalse
|
||||
type: string
|
||||
value:
|
||||
description: |-
|
||||
Value is the list of values that the operand evaluates the input
|
||||
against. Value should be empty if the operator is Exists, DoesNotExist,
|
||||
IsTrue or IsFalse. Value should contain exactly one element if the
|
||||
operator is Gt or Lt and exactly two elements if the operator is GtLt.
|
||||
In other cases Value should contain at least one element.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- op
|
||||
type: object
|
||||
description: |-
|
||||
MatchExpressions is the set of per-element expressions evaluated. These
|
||||
match against the value of the specified elements.
|
||||
type: object
|
||||
matchName:
|
||||
description: |-
|
||||
MatchName in an expression that is matched against the name of each
|
||||
element in the feature set.
|
||||
properties:
|
||||
op:
|
||||
description: Op is the operator to be applied.
|
||||
enum:
|
||||
- In
|
||||
- NotIn
|
||||
- InRegexp
|
||||
- Exists
|
||||
- DoesNotExist
|
||||
- Gt
|
||||
- Lt
|
||||
- GtLt
|
||||
- IsTrue
|
||||
- IsFalse
|
||||
type: string
|
||||
value:
|
||||
description: |-
|
||||
Value is the list of values that the operand evaluates the input
|
||||
against. Value should be empty if the operator is Exists, DoesNotExist,
|
||||
IsTrue or IsFalse. Value should contain exactly one element if the
|
||||
operator is Gt or Lt and exactly two elements if the operator is GtLt.
|
||||
In other cases Value should contain at least one element.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- op
|
||||
type: object
|
||||
required:
|
||||
- feature
|
||||
type: object
|
||||
type: array
|
||||
name:
|
||||
description: Name of the rule.
|
||||
type: string
|
||||
taints:
|
||||
description: Taints to create if the rule matches.
|
||||
items:
|
||||
description: |-
|
||||
The node this Taint is attached to has the "effect" on
|
||||
any pod that does not tolerate the Taint.
|
||||
properties:
|
||||
effect:
|
||||
description: |-
|
||||
Required. The effect of the taint on pods
|
||||
that do not tolerate the taint.
|
||||
Valid effects are NoSchedule, PreferNoSchedule and NoExecute.
|
||||
type: string
|
||||
key:
|
||||
description: Required. The taint key to be applied to
|
||||
a node.
|
||||
type: string
|
||||
timeAdded:
|
||||
description: |-
|
||||
TimeAdded represents the time at which the taint was added.
|
||||
It is only written for NoExecute taints.
|
||||
format: date-time
|
||||
type: string
|
||||
value:
|
||||
description: The taint value corresponding to the taint
|
||||
key.
|
||||
type: string
|
||||
required:
|
||||
- effect
|
||||
- key
|
||||
type: object
|
||||
type: array
|
||||
vars:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Vars is the variables to store if the rule matches. Variables do not
|
||||
directly inflict any changes in the node object. However, they can be
|
||||
referenced from other rules enabling more complex rule hierarchies,
|
||||
without exposing intermediary output values as labels.
|
||||
type: object
|
||||
varsTemplate:
|
||||
description: |-
|
||||
VarsTemplate specifies a template to expand for dynamically generating
|
||||
multiple variables. Data (after template expansion) must be keys with an
|
||||
optional value (<key>[=<value>]) separated by newlines.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- rules
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
|
|
@ -0,0 +1,107 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "node-feature-discovery.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "node-feature-discovery.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Allow the release namespace to be overridden for multi-namespace deployments in combined charts
|
||||
*/}}
|
||||
{{- define "node-feature-discovery.namespace" -}}
|
||||
{{- if .Values.namespaceOverride -}}
|
||||
{{- .Values.namespaceOverride -}}
|
||||
{{- else -}}
|
||||
{{- .Release.Namespace -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "node-feature-discovery.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "node-feature-discovery.labels" -}}
|
||||
helm.sh/chart: {{ include "node-feature-discovery.chart" . }}
|
||||
{{ include "node-feature-discovery.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "node-feature-discovery.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "node-feature-discovery.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account which the nfd master will use
|
||||
*/}}
|
||||
{{- define "node-feature-discovery.master.serviceAccountName" -}}
|
||||
{{- if .Values.master.serviceAccount.create -}}
|
||||
{{ default (include "node-feature-discovery.fullname" .) .Values.master.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.master.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account which the nfd worker will use
|
||||
*/}}
|
||||
{{- define "node-feature-discovery.worker.serviceAccountName" -}}
|
||||
{{- if .Values.worker.serviceAccount.create -}}
|
||||
{{ default (printf "%s-worker" (include "node-feature-discovery.fullname" .)) .Values.worker.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.worker.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account which topologyUpdater will use
|
||||
*/}}
|
||||
{{- define "node-feature-discovery.topologyUpdater.serviceAccountName" -}}
|
||||
{{- if .Values.topologyUpdater.serviceAccount.create -}}
|
||||
{{ default (printf "%s-topology-updater" (include "node-feature-discovery.fullname" .)) .Values.topologyUpdater.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.topologyUpdater.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account which nfd-gc will use
|
||||
*/}}
|
||||
{{- define "node-feature-discovery.gc.serviceAccountName" -}}
|
||||
{{- if .Values.gc.serviceAccount.create -}}
|
||||
{{ default (printf "%s-gc" (include "node-feature-discovery.fullname" .)) .Values.gc.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.gc.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,140 @@
|
|||
{{- if and .Values.master.enable .Values.master.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.fullname" . }}
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
verbs:
|
||||
- watch
|
||||
- list
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
- nodes/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- list
|
||||
- apiGroups:
|
||||
- nfd.k8s-sigs.io
|
||||
resources:
|
||||
- nodefeatures
|
||||
- nodefeaturerules
|
||||
- nodefeaturegroups
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- nfd.k8s-sigs.io
|
||||
resources:
|
||||
- nodefeaturegroups/status
|
||||
verbs:
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
resourceNames:
|
||||
- "nfd-master.nfd.kubernetes.io"
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
{{- end }}
|
||||
|
||||
{{- if and .Values.topologyUpdater.enable .Values.topologyUpdater.rbac.create }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-topology-updater
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes/proxy
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- topology.node.k8s.io
|
||||
resources:
|
||||
- noderesourcetopologies
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- update
|
||||
{{- end }}
|
||||
|
||||
{{- if and .Values.gc.enable .Values.gc.rbac.create }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-gc
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes/proxy
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- topology.node.k8s.io
|
||||
resources:
|
||||
- noderesourcetopologies
|
||||
verbs:
|
||||
- delete
|
||||
- list
|
||||
- apiGroups:
|
||||
- nfd.k8s-sigs.io
|
||||
resources:
|
||||
- nodefeatures
|
||||
verbs:
|
||||
- delete
|
||||
- list
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,52 @@
|
|||
{{- if and .Values.master.enable .Values.master.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.fullname" . }}
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "node-feature-discovery.fullname" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "node-feature-discovery.master.serviceAccountName" . }}
|
||||
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||
{{- end }}
|
||||
|
||||
{{- if and .Values.topologyUpdater.enable .Values.topologyUpdater.rbac.create }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-topology-updater
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-topology-updater
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "node-feature-discovery.topologyUpdater.serviceAccountName" . }}
|
||||
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||
{{- end }}
|
||||
|
||||
{{- if and .Values.gc.enable .Values.gc.rbac.create }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-gc
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-gc
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "node-feature-discovery.gc.serviceAccountName" . }}
|
||||
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,170 @@
|
|||
{{- if .Values.master.enable }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-master
|
||||
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||
role: master
|
||||
{{- with .Values.master.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.master.replicaCount }}
|
||||
revisionHistoryLimit: {{ .Values.master.revisionHistoryLimit }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "node-feature-discovery.selectorLabels" . | nindent 6 }}
|
||||
role: master
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "node-feature-discovery.selectorLabels" . | nindent 8 }}
|
||||
role: master
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/nfd-master-conf.yaml") . | sha256sum }}
|
||||
{{- with .Values.master.annotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.priorityClassName }}
|
||||
priorityClassName: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "node-feature-discovery.master.serviceAccountName" . }}
|
||||
enableServiceLinks: false
|
||||
securityContext:
|
||||
{{- toYaml .Values.master.podSecurityContext | nindent 8 }}
|
||||
hostNetwork: {{ .Values.master.hostNetwork }}
|
||||
containers:
|
||||
- name: master
|
||||
securityContext:
|
||||
{{- toYaml .Values.master.securityContext | nindent 12 }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
startupProbe:
|
||||
grpc:
|
||||
port: {{ .Values.master.healthPort | default "8082" }}
|
||||
{{- with .Values.master.startupProbe.initialDelaySeconds }}
|
||||
initialDelaySeconds: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.master.startupProbe.failureThreshold }}
|
||||
failureThreshold: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.master.startupProbe.periodSeconds }}
|
||||
periodSeconds: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.master.startupProbe.timeoutSeconds }}
|
||||
timeoutSeconds: {{ . }}
|
||||
{{- end }}
|
||||
livenessProbe:
|
||||
grpc:
|
||||
port: {{ .Values.master.healthPort | default "8082" }}
|
||||
{{- with .Values.master.livenessProbe.initialDelaySeconds }}
|
||||
initialDelaySeconds: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.master.livenessProbe.failureThreshold }}
|
||||
failureThreshold: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.master.livenessProbe.periodSeconds }}
|
||||
periodSeconds: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.master.livenessProbe.timeoutSeconds }}
|
||||
timeoutSeconds: {{ . }}
|
||||
{{- end }}
|
||||
readinessProbe:
|
||||
grpc:
|
||||
port: {{ .Values.master.healthPort | default "8082" }}
|
||||
{{- with .Values.master.readinessProbe.initialDelaySeconds }}
|
||||
initialDelaySeconds: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.master.readinessProbe.failureThreshold }}
|
||||
failureThreshold: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.master.readinessProbe.periodSeconds }}
|
||||
periodSeconds: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.master.readinessProbe.timeoutSeconds }}
|
||||
timeoutSeconds: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.master.readinessProbe.successThreshold }}
|
||||
successThreshold: {{ . }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.master.metricsPort | default "8081" }}
|
||||
name: metrics
|
||||
- containerPort: {{ .Values.master.healthPort | default "8082" }}
|
||||
name: health
|
||||
env:
|
||||
- name: NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
{{- with .Values.master.extraEnvs }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end}}
|
||||
command:
|
||||
- "nfd-master"
|
||||
resources:
|
||||
{{- toYaml .Values.master.resources | nindent 12 }}
|
||||
args:
|
||||
{{- if .Values.master.instance | empty | not }}
|
||||
- "-instance={{ .Values.master.instance }}"
|
||||
{{- end }}
|
||||
- "-enable-leader-election"
|
||||
{{- if .Values.master.extraLabelNs | empty | not }}
|
||||
- "-extra-label-ns={{- join "," .Values.master.extraLabelNs }}"
|
||||
{{- end }}
|
||||
{{- if .Values.master.denyLabelNs | empty | not }}
|
||||
- "-deny-label-ns={{- join "," .Values.master.denyLabelNs }}"
|
||||
{{- end }}
|
||||
{{- if .Values.master.enableTaints }}
|
||||
- "-enable-taints"
|
||||
{{- end }}
|
||||
{{- if .Values.master.featureRulesController | kindIs "invalid" | not }}
|
||||
- "-featurerules-controller={{ .Values.master.featureRulesController }}"
|
||||
{{- end }}
|
||||
{{- if .Values.master.resyncPeriod }}
|
||||
- "-resync-period={{ .Values.master.resyncPeriod }}"
|
||||
{{- end }}
|
||||
{{- if .Values.master.nfdApiParallelism | empty | not }}
|
||||
- "-nfd-api-parallelism={{ .Values.master.nfdApiParallelism }}"
|
||||
{{- end }}
|
||||
# Go over featureGates and add the feature-gate flag
|
||||
{{- range $key, $value := .Values.featureGates }}
|
||||
- "-feature-gates={{ $key }}={{ $value }}"
|
||||
{{- end }}
|
||||
- "-metrics={{ .Values.master.metricsPort | default "8081" }}"
|
||||
- "-grpc-health={{ .Values.master.healthPort | default "8082" }}"
|
||||
{{- with .Values.master.extraArgs }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: nfd-master-conf
|
||||
mountPath: "/etc/kubernetes/node-feature-discovery"
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: nfd-master-conf
|
||||
configMap:
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-master-conf
|
||||
items:
|
||||
- key: nfd-master.conf
|
||||
path: nfd-master.conf
|
||||
{{- with .Values.master.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.master.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.master.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,88 @@
|
|||
{{- if and .Values.gc.enable -}}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-gc
|
||||
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||
role: gc
|
||||
{{- with .Values.gc.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.gc.replicaCount | default 1 }}
|
||||
revisionHistoryLimit: {{ .Values.gc.revisionHistoryLimit }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "node-feature-discovery.selectorLabels" . | nindent 6 }}
|
||||
role: gc
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "node-feature-discovery.selectorLabels" . | nindent 8 }}
|
||||
role: gc
|
||||
{{- with .Values.gc.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
serviceAccountName: {{ include "node-feature-discovery.gc.serviceAccountName" . }}
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
{{- with .Values.priorityClassName }}
|
||||
priorityClassName: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.gc.podSecurityContext | nindent 8 }}
|
||||
hostNetwork: {{ .Values.gc.hostNetwork }}
|
||||
containers:
|
||||
- name: gc
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
|
||||
env:
|
||||
- name: NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
{{- with .Values.gc.extraEnvs }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end}}
|
||||
command:
|
||||
- "nfd-gc"
|
||||
args:
|
||||
{{- if .Values.gc.interval | empty | not }}
|
||||
- "-gc-interval={{ .Values.gc.interval }}"
|
||||
{{- end }}
|
||||
{{- with .Values.gc.extraArgs }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.gc.resources | nindent 12 }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: [ "ALL" ]
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: {{ .Values.gc.metricsPort | default "8081"}}
|
||||
|
||||
{{- with .Values.gc.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.gc.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.gc.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
{{- if .Values.master.enable }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-master-conf
|
||||
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||
data:
|
||||
nfd-master.conf: |-
|
||||
{{- .Values.master.config | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
{{- if .Values.topologyUpdater.enable -}}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-topology-updater-conf
|
||||
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||
data:
|
||||
nfd-topology-updater.conf: |-
|
||||
{{- .Values.topologyUpdater.config | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
{{- if .Values.worker.enable }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-worker-conf
|
||||
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||
data:
|
||||
nfd-worker.conf: |-
|
||||
{{- .Values.worker.config | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,94 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-prune
|
||||
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": post-delete
|
||||
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-prune
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": post-delete
|
||||
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
- nodes/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- list
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-prune
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": post-delete
|
||||
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-prune
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-prune
|
||||
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-prune
|
||||
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": post-delete
|
||||
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 8 }}
|
||||
role: prune
|
||||
spec:
|
||||
serviceAccountName: {{ include "node-feature-discovery.fullname" . }}-prune
|
||||
containers:
|
||||
- name: nfd-master
|
||||
securityContext:
|
||||
{{- toYaml .Values.master.securityContext | nindent 12 }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command:
|
||||
- "nfd-master"
|
||||
args:
|
||||
- "-prune"
|
||||
{{- if .Values.master.instance | empty | not }}
|
||||
- "-instance={{ .Values.master.instance }}"
|
||||
{{- end }}
|
||||
restartPolicy: Never
|
||||
{{- with .Values.master.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.master.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.master.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
{{- if .Values.prometheus.enable }}
|
||||
# Prometheus Monitor Service (Metrics)
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PodMonitor
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.fullname" . }}
|
||||
labels:
|
||||
{{- include "node-feature-discovery.selectorLabels" . | nindent 4 }}
|
||||
{{- with .Values.prometheus.labels }}
|
||||
{{ toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
podMetricsEndpoints:
|
||||
- honorLabels: true
|
||||
interval: {{ .Values.prometheus.scrapeInterval }}
|
||||
path: /metrics
|
||||
port: metrics
|
||||
scheme: http
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ include "node-feature-discovery.namespace" . }}
|
||||
selector:
|
||||
matchExpressions:
|
||||
- {key: app.kubernetes.io/instance, operator: In, values: ["{{ .Release.Name }}"]}
|
||||
- {key: app.kubernetes.io/name, operator: In, values: ["{{ include "node-feature-discovery.name" . }}"]}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
{{- if and .Values.worker.enable .Values.worker.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-worker
|
||||
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- nfd.k8s-sigs.io
|
||||
resources:
|
||||
- nodefeatures
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- update
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
{{- if and .Values.worker.enable .Values.worker.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-worker
|
||||
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-worker
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "node-feature-discovery.worker.serviceAccountName" . }}
|
||||
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||
{{- end }}
|
||||
|
||||
|
|
@ -0,0 +1,58 @@
|
|||
{{- if and .Values.master.enable .Values.master.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.master.serviceAccountName" . }}
|
||||
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||
{{- with .Values.master.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if and .Values.topologyUpdater.enable .Values.topologyUpdater.serviceAccount.create }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.topologyUpdater.serviceAccountName" . }}
|
||||
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||
{{- with .Values.topologyUpdater.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if and .Values.gc.enable .Values.gc.serviceAccount.create }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.gc.serviceAccountName" . }}
|
||||
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||
{{- with .Values.gc.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if and .Values.worker.enable .Values.worker.serviceAccount.create }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.worker.serviceAccountName" . }}
|
||||
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||
{{- with .Values.worker.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,278 @@
|
|||
{{- if and .Values.topologyUpdater.enable .Values.topologyUpdater.createCRDs -}}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
api-approved.kubernetes.io: https://github.com/kubernetes/enhancements/pull/1870
|
||||
controller-gen.kubebuilder.io/version: v0.11.2
|
||||
creationTimestamp: null
|
||||
name: noderesourcetopologies.topology.node.k8s.io
|
||||
spec:
|
||||
group: topology.node.k8s.io
|
||||
names:
|
||||
kind: NodeResourceTopology
|
||||
listKind: NodeResourceTopologyList
|
||||
plural: noderesourcetopologies
|
||||
shortNames:
|
||||
- node-res-topo
|
||||
singular: noderesourcetopology
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: NodeResourceTopology describes node resources and their topology.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
topologyPolicies:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
zones:
|
||||
description: ZoneList contains an array of Zone objects.
|
||||
items:
|
||||
description: Zone represents a resource topology zone, e.g. socket,
|
||||
node, die or core.
|
||||
properties:
|
||||
attributes:
|
||||
description: AttributeList contains an array of AttributeInfo objects.
|
||||
items:
|
||||
description: AttributeInfo contains one attribute of a Zone.
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- value
|
||||
type: object
|
||||
type: array
|
||||
costs:
|
||||
description: CostList contains an array of CostInfo objects.
|
||||
items:
|
||||
description: CostInfo describes the cost (or distance) between
|
||||
two Zones.
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
value:
|
||||
format: int64
|
||||
type: integer
|
||||
required:
|
||||
- name
|
||||
- value
|
||||
type: object
|
||||
type: array
|
||||
name:
|
||||
type: string
|
||||
parent:
|
||||
type: string
|
||||
resources:
|
||||
description: ResourceInfoList contains an array of ResourceInfo
|
||||
objects.
|
||||
items:
|
||||
description: ResourceInfo contains information about one resource
|
||||
type.
|
||||
properties:
|
||||
allocatable:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: Allocatable quantity of the resource, corresponding
|
||||
to allocatable in node status, i.e. total amount of this
|
||||
resource available to be used by pods.
|
||||
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||
x-kubernetes-int-or-string: true
|
||||
available:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: Available is the amount of this resource currently
|
||||
available for new (to be scheduled) pods, i.e. Allocatable
|
||||
minus the resources reserved by currently running pods.
|
||||
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||
x-kubernetes-int-or-string: true
|
||||
capacity:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: Capacity of the resource, corresponding to capacity
|
||||
in node status, i.e. total amount of this resource that
|
||||
the node has.
|
||||
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||
x-kubernetes-int-or-string: true
|
||||
name:
|
||||
description: Name of the resource.
|
||||
type: string
|
||||
required:
|
||||
- allocatable
|
||||
- available
|
||||
- capacity
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
type:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- topologyPolicies
|
||||
- zones
|
||||
type: object
|
||||
served: true
|
||||
storage: false
|
||||
- name: v1alpha2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: NodeResourceTopology describes node resources and their topology.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
attributes:
|
||||
description: AttributeList contains an array of AttributeInfo objects.
|
||||
items:
|
||||
description: AttributeInfo contains one attribute of a Zone.
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- value
|
||||
type: object
|
||||
type: array
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
topologyPolicies:
|
||||
description: 'DEPRECATED (to be removed in v1beta1): use top level attributes
|
||||
if needed'
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
zones:
|
||||
description: ZoneList contains an array of Zone objects.
|
||||
items:
|
||||
description: Zone represents a resource topology zone, e.g. socket,
|
||||
node, die or core.
|
||||
properties:
|
||||
attributes:
|
||||
description: AttributeList contains an array of AttributeInfo objects.
|
||||
items:
|
||||
description: AttributeInfo contains one attribute of a Zone.
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- value
|
||||
type: object
|
||||
type: array
|
||||
costs:
|
||||
description: CostList contains an array of CostInfo objects.
|
||||
items:
|
||||
description: CostInfo describes the cost (or distance) between
|
||||
two Zones.
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
value:
|
||||
format: int64
|
||||
type: integer
|
||||
required:
|
||||
- name
|
||||
- value
|
||||
type: object
|
||||
type: array
|
||||
name:
|
||||
type: string
|
||||
parent:
|
||||
type: string
|
||||
resources:
|
||||
description: ResourceInfoList contains an array of ResourceInfo
|
||||
objects.
|
||||
items:
|
||||
description: ResourceInfo contains information about one resource
|
||||
type.
|
||||
properties:
|
||||
allocatable:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: Allocatable quantity of the resource, corresponding
|
||||
to allocatable in node status, i.e. total amount of this
|
||||
resource available to be used by pods.
|
||||
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||
x-kubernetes-int-or-string: true
|
||||
available:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: Available is the amount of this resource currently
|
||||
available for new (to be scheduled) pods, i.e. Allocatable
|
||||
minus the resources reserved by currently running pods.
|
||||
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||
x-kubernetes-int-or-string: true
|
||||
capacity:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: Capacity of the resource, corresponding to capacity
|
||||
in node status, i.e. total amount of this resource that
|
||||
the node has.
|
||||
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||
x-kubernetes-int-or-string: true
|
||||
name:
|
||||
description: Name of the resource.
|
||||
type: string
|
||||
required:
|
||||
- allocatable
|
||||
- available
|
||||
- capacity
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
type:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- zones
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,188 @@
|
|||
{{- if .Values.topologyUpdater.enable -}}
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-topology-updater
|
||||
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||
role: topology-updater
|
||||
{{- with .Values.topologyUpdater.daemonsetAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
revisionHistoryLimit: {{ .Values.topologyUpdater.revisionHistoryLimit }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "node-feature-discovery.selectorLabels" . | nindent 6 }}
|
||||
role: topology-updater
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "node-feature-discovery.selectorLabels" . | nindent 8 }}
|
||||
role: topology-updater
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/nfd-topologyupdater-conf.yaml") . | sha256sum }}
|
||||
{{- with .Values.topologyUpdater.annotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
serviceAccountName: {{ include "node-feature-discovery.topologyUpdater.serviceAccountName" . }}
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
{{- with .Values.priorityClassName }}
|
||||
priorityClassName: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.topologyUpdater.podSecurityContext | nindent 8 }}
|
||||
hostNetwork: {{ .Values.topologyUpdater.hostNetwork }}
|
||||
containers:
|
||||
- name: topology-updater
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
|
||||
livenessProbe:
|
||||
grpc:
|
||||
port: {{ .Values.topologyUpdater.healthPort | default "8082" }}
|
||||
{{- with .Values.topologyUpdater.livenessProbe.initialDelaySeconds }}
|
||||
initialDelaySeconds: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.topologyUpdater.livenessProbe.failureThreshold }}
|
||||
failureThreshold: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.topologyUpdater.livenessProbe.periodSeconds }}
|
||||
periodSeconds: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.topologyUpdater.livenessProbe.timeoutSeconds }}
|
||||
timeoutSeconds: {{ . }}
|
||||
{{- end }}
|
||||
readinessProbe:
|
||||
grpc:
|
||||
port: {{ .Values.topologyUpdater.healthPort | default "8082" }}
|
||||
{{- with .Values.topologyUpdater.readinessProbe.initialDelaySeconds }}
|
||||
initialDelaySeconds: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.topologyUpdater.readinessProbe.failureThreshold }}
|
||||
failureThreshold: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.topologyUpdater.readinessProbe.periodSeconds }}
|
||||
periodSeconds: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.topologyUpdater.readinessProbe.timeoutSeconds }}
|
||||
timeoutSeconds: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.topologyUpdater.readinessProbe.successThreshold }}
|
||||
successThreshold: {{ . }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
- name: NODE_ADDRESS
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.hostIP
|
||||
{{- with .Values.topologyUpdater.extraEnvs }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end}}
|
||||
command:
|
||||
- "nfd-topology-updater"
|
||||
args:
|
||||
- "-podresources-socket=/host-var/lib/kubelet-podresources/kubelet.sock"
|
||||
{{- if .Values.topologyUpdater.updateInterval | empty | not }}
|
||||
- "-sleep-interval={{ .Values.topologyUpdater.updateInterval }}"
|
||||
{{- else }}
|
||||
- "-sleep-interval=3s"
|
||||
{{- end }}
|
||||
{{- if .Values.topologyUpdater.watchNamespace | empty | not }}
|
||||
- "-watch-namespace={{ .Values.topologyUpdater.watchNamespace }}"
|
||||
{{- else }}
|
||||
- "-watch-namespace=*"
|
||||
{{- end }}
|
||||
{{- if not .Values.topologyUpdater.podSetFingerprint }}
|
||||
- "-pods-fingerprint=false"
|
||||
{{- end }}
|
||||
{{- if .Values.topologyUpdater.kubeletConfigPath | empty | not }}
|
||||
- "-kubelet-config-uri=file:///host-var/kubelet-config"
|
||||
{{- end }}
|
||||
{{- if .Values.topologyUpdater.kubeletStateDir | empty }}
|
||||
# Disable kubelet state tracking by giving an empty path
|
||||
- "-kubelet-state-dir="
|
||||
{{- end }}
|
||||
- "-metrics={{ .Values.topologyUpdater.metricsPort | default "8081"}}"
|
||||
- "-grpc-health={{ .Values.topologyUpdater.healthPort | default "8082" }}"
|
||||
{{- with .Values.topologyUpdater.extraArgs }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.topologyUpdater.metricsPort | default "8081"}}
|
||||
name: metrics
|
||||
- containerPort: {{ .Values.topologyUpdater.healthPort | default "8082" }}
|
||||
name: health
|
||||
volumeMounts:
|
||||
{{- if .Values.topologyUpdater.kubeletConfigPath | empty | not }}
|
||||
- name: kubelet-config
|
||||
mountPath: /host-var/kubelet-config
|
||||
{{- end }}
|
||||
- name: kubelet-podresources-sock
|
||||
mountPath: /host-var/lib/kubelet-podresources/kubelet.sock
|
||||
- name: host-sys
|
||||
mountPath: /host-sys
|
||||
{{- if .Values.topologyUpdater.kubeletStateDir | empty | not }}
|
||||
- name: kubelet-state-files
|
||||
mountPath: /host-var/lib/kubelet
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- name: nfd-topology-updater-conf
|
||||
mountPath: "/etc/kubernetes/node-feature-discovery"
|
||||
readOnly: true
|
||||
|
||||
resources:
|
||||
{{- toYaml .Values.topologyUpdater.resources | nindent 12 }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.topologyUpdater.securityContext | nindent 12 }}
|
||||
volumes:
|
||||
- name: host-sys
|
||||
hostPath:
|
||||
path: "/sys"
|
||||
{{- if .Values.topologyUpdater.kubeletConfigPath | empty | not }}
|
||||
- name: kubelet-config
|
||||
hostPath:
|
||||
path: {{ .Values.topologyUpdater.kubeletConfigPath }}
|
||||
{{- end }}
|
||||
- name: kubelet-podresources-sock
|
||||
hostPath:
|
||||
{{- if .Values.topologyUpdater.kubeletPodResourcesSockPath | empty | not }}
|
||||
path: {{ .Values.topologyUpdater.kubeletPodResourcesSockPath }}
|
||||
{{- else }}
|
||||
path: /var/lib/kubelet/pod-resources/kubelet.sock
|
||||
{{- end }}
|
||||
{{- if .Values.topologyUpdater.kubeletStateDir | empty | not }}
|
||||
- name: kubelet-state-files
|
||||
hostPath:
|
||||
path: {{ .Values.topologyUpdater.kubeletStateDir }}
|
||||
{{- end }}
|
||||
- name: nfd-topology-updater-conf
|
||||
configMap:
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-topology-updater-conf
|
||||
items:
|
||||
- key: nfd-topology-updater.conf
|
||||
path: nfd-topology-updater.conf
|
||||
|
||||
{{- with .Values.topologyUpdater.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.topologyUpdater.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.topologyUpdater.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,195 @@
|
|||
{{- if .Values.worker.enable }}
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-worker
|
||||
namespace: {{ include "node-feature-discovery.namespace" . }}
|
||||
labels:
|
||||
{{- include "node-feature-discovery.labels" . | nindent 4 }}
|
||||
role: worker
|
||||
{{- with .Values.worker.daemonsetAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
revisionHistoryLimit: {{ .Values.worker.revisionHistoryLimit }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "node-feature-discovery.selectorLabels" . | nindent 6 }}
|
||||
role: worker
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "node-feature-discovery.selectorLabels" . | nindent 8 }}
|
||||
role: worker
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/nfd-worker-conf.yaml") . | sha256sum }}
|
||||
{{- with .Values.worker.annotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
{{- with .Values.priorityClassName }}
|
||||
priorityClassName: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "node-feature-discovery.worker.serviceAccountName" . }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.worker.podSecurityContext | nindent 8 }}
|
||||
hostNetwork: {{ .Values.worker.hostNetwork }}
|
||||
containers:
|
||||
- name: worker
|
||||
securityContext:
|
||||
{{- toYaml .Values.worker.securityContext | nindent 12 }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
livenessProbe:
|
||||
grpc:
|
||||
port: {{ .Values.worker.healthPort | default "8082" }}
|
||||
{{- with .Values.worker.livenessProbe.initialDelaySeconds }}
|
||||
initialDelaySeconds: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.worker.livenessProbe.failureThreshold }}
|
||||
failureThreshold: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.worker.livenessProbe.periodSeconds }}
|
||||
periodSeconds: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.worker.livenessProbe.timeoutSeconds }}
|
||||
timeoutSeconds: {{ . }}
|
||||
{{- end }}
|
||||
readinessProbe:
|
||||
grpc:
|
||||
port: {{ .Values.worker.healthPort | default "8082" }}
|
||||
{{- with .Values.worker.readinessProbe.initialDelaySeconds }}
|
||||
initialDelaySeconds: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.worker.readinessProbe.failureThreshold }}
|
||||
failureThreshold: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.worker.readinessProbe.periodSeconds }}
|
||||
periodSeconds: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.worker.readinessProbe.timeoutSeconds }}
|
||||
timeoutSeconds: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.worker.readinessProbe.successThreshold }}
|
||||
successThreshold: {{ . }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_UID
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.uid
|
||||
{{- with .Values.worker.extraEnvs }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end}}
|
||||
resources:
|
||||
{{- toYaml .Values.worker.resources | nindent 12 }}
|
||||
command:
|
||||
- "nfd-worker"
|
||||
args:
|
||||
# Go over featureGate and add the feature-gate flag
|
||||
{{- range $key, $value := .Values.featureGates }}
|
||||
- "-feature-gates={{ $key }}={{ $value }}"
|
||||
{{- end }}
|
||||
- "-metrics={{ .Values.worker.metricsPort | default "8081"}}"
|
||||
- "-grpc-health={{ .Values.worker.healthPort | default "8082" }}"
|
||||
{{- with .Values.worker.extraArgs }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.worker.metricsPort | default "8081"}}
|
||||
name: metrics
|
||||
- containerPort: {{ .Values.worker.healthPort | default "8082" }}
|
||||
name: health
|
||||
volumeMounts:
|
||||
- name: host-boot
|
||||
mountPath: "/host-boot"
|
||||
readOnly: true
|
||||
- name: host-os-release
|
||||
mountPath: "/host-etc/os-release"
|
||||
readOnly: true
|
||||
- name: host-sys
|
||||
mountPath: "/host-sys"
|
||||
readOnly: true
|
||||
- name: host-usr-lib
|
||||
mountPath: "/host-usr/lib"
|
||||
readOnly: true
|
||||
- name: host-lib
|
||||
mountPath: "/host-lib"
|
||||
readOnly: true
|
||||
- name: host-proc-swaps
|
||||
mountPath: "/host-proc/swaps"
|
||||
readOnly: true
|
||||
{{- if .Values.worker.mountUsrSrc }}
|
||||
- name: host-usr-src
|
||||
mountPath: "/host-usr/src"
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- name: features-d
|
||||
mountPath: "/etc/kubernetes/node-feature-discovery/features.d/"
|
||||
readOnly: true
|
||||
- name: nfd-worker-conf
|
||||
mountPath: "/etc/kubernetes/node-feature-discovery"
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: host-boot
|
||||
hostPath:
|
||||
path: "/boot"
|
||||
- name: host-os-release
|
||||
hostPath:
|
||||
path: "/etc/os-release"
|
||||
- name: host-sys
|
||||
hostPath:
|
||||
path: "/sys"
|
||||
- name: host-usr-lib
|
||||
hostPath:
|
||||
path: "/usr/lib"
|
||||
- name: host-lib
|
||||
hostPath:
|
||||
path: "/lib"
|
||||
- name: host-proc-swaps
|
||||
hostPath:
|
||||
path: "/proc/swaps"
|
||||
{{- if .Values.worker.mountUsrSrc }}
|
||||
- name: host-usr-src
|
||||
hostPath:
|
||||
path: "/usr/src"
|
||||
{{- end }}
|
||||
- name: features-d
|
||||
hostPath:
|
||||
path: "/etc/kubernetes/node-feature-discovery/features.d/"
|
||||
- name: nfd-worker-conf
|
||||
configMap:
|
||||
name: {{ include "node-feature-discovery.fullname" . }}-worker-conf
|
||||
items:
|
||||
- key: nfd-worker.conf
|
||||
path: nfd-worker.conf
|
||||
{{- with .Values.worker.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.worker.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.worker.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.worker.priorityClassName }}
|
||||
priorityClassName: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,599 @@
|
|||
image:
|
||||
repository: registry.k8s.io/nfd/node-feature-discovery
|
||||
# This should be set to 'IfNotPresent' for released version
|
||||
pullPolicy: IfNotPresent
|
||||
# tag, if defined will use the given image tag, else Chart.AppVersion will be used
|
||||
# tag
|
||||
imagePullSecrets: []
|
||||
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
namespaceOverride: ""
|
||||
|
||||
featureGates:
|
||||
NodeFeatureGroupAPI: false
|
||||
|
||||
priorityClassName: ""
|
||||
|
||||
master:
|
||||
enable: true
|
||||
extraArgs: []
|
||||
extraEnvs: []
|
||||
hostNetwork: false
|
||||
config: ### <NFD-MASTER-CONF-START-DO-NOT-REMOVE>
|
||||
# noPublish: false
|
||||
# autoDefaultNs: true
|
||||
# extraLabelNs: ["added.ns.io","added.kubernets.io"]
|
||||
# denyLabelNs: ["denied.ns.io","denied.kubernetes.io"]
|
||||
# enableTaints: false
|
||||
# labelWhiteList: "foo"
|
||||
# resyncPeriod: "2h"
|
||||
# restrictions:
|
||||
# disableLabels: true
|
||||
# disableTaints: true
|
||||
# disableExtendedResources: true
|
||||
# disableAnnotations: true
|
||||
# allowOverwrite: false
|
||||
# denyNodeFeatureLabels: true
|
||||
# nodeFeatureNamespaceSelector:
|
||||
# matchLabels:
|
||||
# kubernetes.io/metadata.name: "node-feature-discovery"
|
||||
# matchExpressions:
|
||||
# - key: "kubernetes.io/metadata.name"
|
||||
# operator: "In"
|
||||
# values:
|
||||
# - "node-feature-discovery"
|
||||
# klog:
|
||||
# addDirHeader: false
|
||||
# alsologtostderr: false
|
||||
# logBacktraceAt:
|
||||
# logtostderr: true
|
||||
# skipHeaders: false
|
||||
# stderrthreshold: 2
|
||||
# v: 0
|
||||
# vmodule:
|
||||
## NOTE: the following options are not dynamically run-time configurable
|
||||
## and require a nfd-master restart to take effect after being changed
|
||||
# logDir:
|
||||
# logFile:
|
||||
# logFileMaxSize: 1800
|
||||
# skipLogHeaders: false
|
||||
# leaderElection:
|
||||
# leaseDuration: 15s
|
||||
# # this value has to be lower than leaseDuration and greater than retryPeriod*1.2
|
||||
# renewDeadline: 10s
|
||||
# # this value has to be greater than 0
|
||||
# retryPeriod: 2s
|
||||
# nfdApiParallelism: 10
|
||||
### <NFD-MASTER-CONF-END-DO-NOT-REMOVE>
|
||||
metricsPort: 8081
|
||||
healthPort: 8082
|
||||
instance:
|
||||
featureApi:
|
||||
resyncPeriod:
|
||||
denyLabelNs: []
|
||||
extraLabelNs: []
|
||||
enableTaints: false
|
||||
featureRulesController: null
|
||||
nfdApiParallelism: null
|
||||
deploymentAnnotations: {}
|
||||
replicaCount: 1
|
||||
|
||||
podSecurityContext: {}
|
||||
# fsGroup: 2000
|
||||
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: [ "ALL" ]
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
serviceAccount:
|
||||
# Specifies whether a service account should be created
|
||||
create: true
|
||||
# Annotations to add to the service account
|
||||
annotations: {}
|
||||
# The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name:
|
||||
|
||||
# specify how many old ReplicaSets for the Deployment to retain.
|
||||
revisionHistoryLimit:
|
||||
|
||||
rbac:
|
||||
create: true
|
||||
|
||||
resources:
|
||||
limits:
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: 100m
|
||||
# You may want to use the same value for `requests.memory` and `limits.memory`. The “requests” value affects scheduling to accommodate pods on nodes.
|
||||
# If there is a large difference between “requests” and “limits” and nodes experience memory pressure, the kernel may invoke
|
||||
# the OOM Killer, even if the memory does not exceed the “limits” threshold. This can cause unexpected pod evictions. Memory
|
||||
# cannot be compressed and once allocated to a pod, it can only be reclaimed by killing the pod.
|
||||
# Natan Yellin 22/09/2022 https://home.robusta.dev/blog/kubernetes-memory-limit
|
||||
memory: 128Mi
|
||||
|
||||
nodeSelector: {}
|
||||
|
||||
tolerations:
|
||||
- key: "node-role.kubernetes.io/master"
|
||||
operator: "Equal"
|
||||
value: ""
|
||||
effect: "NoSchedule"
|
||||
- key: "node-role.kubernetes.io/control-plane"
|
||||
operator: "Equal"
|
||||
value: ""
|
||||
effect: "NoSchedule"
|
||||
|
||||
annotations: {}
|
||||
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 1
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: "node-role.kubernetes.io/master"
|
||||
operator: In
|
||||
values: [""]
|
||||
- weight: 1
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: "node-role.kubernetes.io/control-plane"
|
||||
operator: In
|
||||
values: [""]
|
||||
|
||||
startupProbe:
|
||||
grpc:
|
||||
port: 8082
|
||||
failureThreshold: 30
|
||||
# periodSeconds: 10
|
||||
livenessProbe:
|
||||
grpc:
|
||||
port: 8082
|
||||
# failureThreshold: 3
|
||||
# initialDelaySeconds: 0
|
||||
# periodSeconds: 10
|
||||
# timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
grpc:
|
||||
port: 8082
|
||||
failureThreshold: 10
|
||||
# initialDelaySeconds: 0
|
||||
# periodSeconds: 10
|
||||
# timeoutSeconds: 1
|
||||
# successThreshold: 1
|
||||
|
||||
worker:
|
||||
enable: true
|
||||
extraArgs: []
|
||||
extraEnvs: []
|
||||
hostNetwork: false
|
||||
config: ### <NFD-WORKER-CONF-START-DO-NOT-REMOVE>
|
||||
#core:
|
||||
# labelWhiteList:
|
||||
# noPublish: false
|
||||
# noOwnerRefs: false
|
||||
# sleepInterval: 60s
|
||||
# featureSources: [all]
|
||||
# labelSources: [all]
|
||||
# klog:
|
||||
# addDirHeader: false
|
||||
# alsologtostderr: false
|
||||
# logBacktraceAt:
|
||||
# logtostderr: true
|
||||
# skipHeaders: false
|
||||
# stderrthreshold: 2
|
||||
# v: 0
|
||||
# vmodule:
|
||||
## NOTE: the following options are not dynamically run-time configurable
|
||||
## and require a nfd-worker restart to take effect after being changed
|
||||
# logDir:
|
||||
# logFile:
|
||||
# logFileMaxSize: 1800
|
||||
# skipLogHeaders: false
|
||||
#sources:
|
||||
# cpu:
|
||||
# cpuid:
|
||||
## NOTE: whitelist has priority over blacklist
|
||||
# attributeBlacklist:
|
||||
# - "AVX10"
|
||||
# - "BMI1"
|
||||
# - "BMI2"
|
||||
# - "CLMUL"
|
||||
# - "CMOV"
|
||||
# - "CX16"
|
||||
# - "ERMS"
|
||||
# - "F16C"
|
||||
# - "HTT"
|
||||
# - "LZCNT"
|
||||
# - "MMX"
|
||||
# - "MMXEXT"
|
||||
# - "NX"
|
||||
# - "POPCNT"
|
||||
# - "RDRAND"
|
||||
# - "RDSEED"
|
||||
# - "RDTSCP"
|
||||
# - "SGX"
|
||||
# - "SSE"
|
||||
# - "SSE2"
|
||||
# - "SSE3"
|
||||
# - "SSE4"
|
||||
# - "SSE42"
|
||||
# - "SSSE3"
|
||||
# - "TDX_GUEST"
|
||||
# attributeWhitelist:
|
||||
# kernel:
|
||||
# kconfigFile: "/path/to/kconfig"
|
||||
# configOpts:
|
||||
# - "NO_HZ"
|
||||
# - "X86"
|
||||
# - "DMI"
|
||||
# pci:
|
||||
# deviceClassWhitelist:
|
||||
# - "0200"
|
||||
# - "03"
|
||||
# - "12"
|
||||
# deviceLabelFields:
|
||||
# - "class"
|
||||
# - "vendor"
|
||||
# - "device"
|
||||
# - "subsystem_vendor"
|
||||
# - "subsystem_device"
|
||||
# usb:
|
||||
# deviceClassWhitelist:
|
||||
# - "0e"
|
||||
# - "ef"
|
||||
# - "fe"
|
||||
# - "ff"
|
||||
# deviceLabelFields:
|
||||
# - "class"
|
||||
# - "vendor"
|
||||
# - "device"
|
||||
# custom:
|
||||
# # The following feature demonstrates the capabilities of the matchFeatures
|
||||
# - name: "my custom rule"
|
||||
# labels:
|
||||
# "vendor.io/my-ng-feature": "true"
|
||||
# # matchFeatures implements a logical AND over all matcher terms in the
|
||||
# # list (i.e. all of the terms, or per-feature matchers, must match)
|
||||
# matchFeatures:
|
||||
# - feature: cpu.cpuid
|
||||
# matchExpressions:
|
||||
# AVX512F: {op: Exists}
|
||||
# - feature: cpu.cstate
|
||||
# matchExpressions:
|
||||
# enabled: {op: IsTrue}
|
||||
# - feature: cpu.pstate
|
||||
# matchExpressions:
|
||||
# no_turbo: {op: IsFalse}
|
||||
# scaling_governor: {op: In, value: ["performance"]}
|
||||
# - feature: cpu.rdt
|
||||
# matchExpressions:
|
||||
# RDTL3CA: {op: Exists}
|
||||
# - feature: cpu.sst
|
||||
# matchExpressions:
|
||||
# bf.enabled: {op: IsTrue}
|
||||
# - feature: cpu.topology
|
||||
# matchExpressions:
|
||||
# hardware_multithreading: {op: IsFalse}
|
||||
#
|
||||
# - feature: kernel.config
|
||||
# matchExpressions:
|
||||
# X86: {op: Exists}
|
||||
# LSM: {op: InRegexp, value: ["apparmor"]}
|
||||
# - feature: kernel.loadedmodule
|
||||
# matchExpressions:
|
||||
# e1000e: {op: Exists}
|
||||
# - feature: kernel.selinux
|
||||
# matchExpressions:
|
||||
# enabled: {op: IsFalse}
|
||||
# - feature: kernel.version
|
||||
# matchExpressions:
|
||||
# major: {op: In, value: ["5"]}
|
||||
# minor: {op: Gt, value: ["10"]}
|
||||
#
|
||||
# - feature: storage.block
|
||||
# matchExpressions:
|
||||
# rotational: {op: In, value: ["0"]}
|
||||
# dax: {op: In, value: ["0"]}
|
||||
#
|
||||
# - feature: network.device
|
||||
# matchExpressions:
|
||||
# operstate: {op: In, value: ["up"]}
|
||||
# speed: {op: Gt, value: ["100"]}
|
||||
#
|
||||
# - feature: memory.numa
|
||||
# matchExpressions:
|
||||
# node_count: {op: Gt, value: ["2"]}
|
||||
# - feature: memory.nv
|
||||
# matchExpressions:
|
||||
# devtype: {op: In, value: ["nd_dax"]}
|
||||
# mode: {op: In, value: ["memory"]}
|
||||
#
|
||||
# - feature: system.osrelease
|
||||
# matchExpressions:
|
||||
# ID: {op: In, value: ["fedora", "centos"]}
|
||||
# - feature: system.name
|
||||
# matchExpressions:
|
||||
# nodename: {op: InRegexp, value: ["^worker-X"]}
|
||||
#
|
||||
# - feature: local.label
|
||||
# matchExpressions:
|
||||
# custom-feature-knob: {op: Gt, value: ["100"]}
|
||||
#
|
||||
# # The following feature demonstrates the capabilities of the matchAny
|
||||
# - name: "my matchAny rule"
|
||||
# labels:
|
||||
# "vendor.io/my-ng-feature-2": "my-value"
|
||||
# # matchAny implements a logical IF over all elements (sub-matchers) in
|
||||
# # the list (i.e. at least one feature matcher must match)
|
||||
# matchAny:
|
||||
# - matchFeatures:
|
||||
# - feature: kernel.loadedmodule
|
||||
# matchExpressions:
|
||||
# driver-module-X: {op: Exists}
|
||||
# - feature: pci.device
|
||||
# matchExpressions:
|
||||
# vendor: {op: In, value: ["8086"]}
|
||||
# class: {op: In, value: ["0200"]}
|
||||
# - matchFeatures:
|
||||
# - feature: kernel.loadedmodule
|
||||
# matchExpressions:
|
||||
# driver-module-Y: {op: Exists}
|
||||
# - feature: usb.device
|
||||
# matchExpressions:
|
||||
# vendor: {op: In, value: ["8086"]}
|
||||
# class: {op: In, value: ["02"]}
|
||||
#
|
||||
# - name: "avx wildcard rule"
|
||||
# labels:
|
||||
# "my-avx-feature": "true"
|
||||
# matchFeatures:
|
||||
# - feature: cpu.cpuid
|
||||
# matchName: {op: InRegexp, value: ["^AVX512"]}
|
||||
#
|
||||
# # The following features demonstreate label templating capabilities
|
||||
# - name: "my template rule"
|
||||
# labelsTemplate: |
|
||||
# {{ range .system.osrelease }}vendor.io/my-system-feature.{{ .Name }}={{ .Value }}
|
||||
# {{ end }}
|
||||
# matchFeatures:
|
||||
# - feature: system.osrelease
|
||||
# matchExpressions:
|
||||
# ID: {op: InRegexp, value: ["^open.*"]}
|
||||
# VERSION_ID.major: {op: In, value: ["13", "15"]}
|
||||
#
|
||||
# - name: "my template rule 2"
|
||||
# labelsTemplate: |
|
||||
# {{ range .pci.device }}vendor.io/my-pci-device.{{ .class }}-{{ .device }}=with-cpuid
|
||||
# {{ end }}
|
||||
# matchFeatures:
|
||||
# - feature: pci.device
|
||||
# matchExpressions:
|
||||
# class: {op: InRegexp, value: ["^06"]}
|
||||
# vendor: ["8086"]
|
||||
# - feature: cpu.cpuid
|
||||
# matchExpressions:
|
||||
# AVX: {op: Exists}
|
||||
#
|
||||
# # The following examples demonstrate vars field and back-referencing
|
||||
# # previous labels and vars
|
||||
# - name: "my dummy kernel rule"
|
||||
# labels:
|
||||
# "vendor.io/my.kernel.feature": "true"
|
||||
# matchFeatures:
|
||||
# - feature: kernel.version
|
||||
# matchExpressions:
|
||||
# major: {op: Gt, value: ["2"]}
|
||||
#
|
||||
# - name: "my dummy rule with no labels"
|
||||
# vars:
|
||||
# "my.dummy.var": "1"
|
||||
# matchFeatures:
|
||||
# - feature: cpu.cpuid
|
||||
# matchExpressions: {}
|
||||
#
|
||||
# - name: "my rule using backrefs"
|
||||
# labels:
|
||||
# "vendor.io/my.backref.feature": "true"
|
||||
# matchFeatures:
|
||||
# - feature: rule.matched
|
||||
# matchExpressions:
|
||||
# vendor.io/my.kernel.feature: {op: IsTrue}
|
||||
# my.dummy.var: {op: Gt, value: ["0"]}
|
||||
#
|
||||
# - name: "kconfig template rule"
|
||||
# labelsTemplate: |
|
||||
# {{ range .kernel.config }}kconfig-{{ .Name }}={{ .Value }}
|
||||
# {{ end }}
|
||||
# matchFeatures:
|
||||
# - feature: kernel.config
|
||||
# matchName: {op: In, value: ["SWAP", "X86", "ARM"]}
|
||||
### <NFD-WORKER-CONF-END-DO-NOT-REMOVE>
|
||||
|
||||
metricsPort: 8081
|
||||
healthPort: 8082
|
||||
daemonsetAnnotations: {}
|
||||
podSecurityContext: {}
|
||||
# fsGroup: 2000
|
||||
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: [ "ALL" ]
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
livenessProbe:
|
||||
grpc:
|
||||
port: 8082
|
||||
initialDelaySeconds: 10
|
||||
# failureThreshold: 3
|
||||
# periodSeconds: 10
|
||||
# timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
grpc:
|
||||
port: 8082
|
||||
initialDelaySeconds: 5
|
||||
failureThreshold: 10
|
||||
# periodSeconds: 10
|
||||
# timeoutSeconds: 1
|
||||
# successThreshold: 1
|
||||
|
||||
serviceAccount:
|
||||
# Specifies whether a service account should be created.
|
||||
# We create this by default to make it easier for downstream users to apply PodSecurityPolicies.
|
||||
create: true
|
||||
# Annotations to add to the service account
|
||||
annotations: {}
|
||||
# The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name:
|
||||
|
||||
# specify how many old ControllerRevisions for the DaemonSet to retain.
|
||||
revisionHistoryLimit:
|
||||
|
||||
rbac:
|
||||
create: true
|
||||
|
||||
# Allow users to mount the hostPath /usr/src, useful for RHCOS on s390x
|
||||
# Does not work on systems without /usr/src AND a read-only /usr, such as Talos
|
||||
mountUsrSrc: false
|
||||
|
||||
resources:
|
||||
limits:
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 5m
|
||||
memory: 64Mi
|
||||
|
||||
nodeSelector: {}
|
||||
|
||||
tolerations: []
|
||||
|
||||
annotations: {}
|
||||
|
||||
affinity: {}
|
||||
|
||||
priorityClassName: ""
|
||||
|
||||
topologyUpdater:
|
||||
config: ### <NFD-TOPOLOGY-UPDATER-CONF-START-DO-NOT-REMOVE>
|
||||
## key = node name, value = list of resources to be excluded.
|
||||
## use * to exclude from all nodes.
|
||||
## an example for how the exclude list should looks like
|
||||
#excludeList:
|
||||
# node1: [cpu]
|
||||
# node2: [memory, example/deviceA]
|
||||
# *: [hugepages-2Mi]
|
||||
### <NFD-TOPOLOGY-UPDATER-CONF-END-DO-NOT-REMOVE>
|
||||
|
||||
enable: false
|
||||
createCRDs: false
|
||||
extraArgs: []
|
||||
extraEnvs: []
|
||||
hostNetwork: false
|
||||
|
||||
serviceAccount:
|
||||
create: true
|
||||
annotations: {}
|
||||
name:
|
||||
|
||||
# specify how many old ControllerRevisions for the DaemonSet to retain.
|
||||
revisionHistoryLimit:
|
||||
|
||||
rbac:
|
||||
create: true
|
||||
|
||||
metricsPort: 8081
|
||||
healthPort: 8082
|
||||
kubeletConfigPath:
|
||||
kubeletPodResourcesSockPath:
|
||||
updateInterval: 60s
|
||||
watchNamespace: "*"
|
||||
kubeletStateDir: /var/lib/kubelet
|
||||
|
||||
podSecurityContext: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: [ "ALL" ]
|
||||
readOnlyRootFilesystem: true
|
||||
runAsUser: 0
|
||||
|
||||
livenessProbe:
|
||||
grpc:
|
||||
port: 8082
|
||||
initialDelaySeconds: 10
|
||||
# failureThreshold: 3
|
||||
# periodSeconds: 10
|
||||
# timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
grpc:
|
||||
port: 8082
|
||||
initialDelaySeconds: 5
|
||||
failureThreshold: 10
|
||||
# periodSeconds: 10
|
||||
# timeoutSeconds: 1
|
||||
# successThreshold: 1
|
||||
|
||||
resources:
|
||||
limits:
|
||||
memory: 60Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 40Mi
|
||||
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
annotations: {}
|
||||
daemonsetAnnotations: {}
|
||||
affinity: {}
|
||||
podSetFingerprint: true
|
||||
|
||||
gc:
|
||||
enable: true
|
||||
extraArgs: []
|
||||
extraEnvs: []
|
||||
hostNetwork: false
|
||||
replicaCount: 1
|
||||
|
||||
serviceAccount:
|
||||
create: true
|
||||
annotations: {}
|
||||
name:
|
||||
rbac:
|
||||
create: true
|
||||
|
||||
interval: 1h
|
||||
|
||||
podSecurityContext: {}
|
||||
|
||||
resources:
|
||||
limits:
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 128Mi
|
||||
|
||||
metricsPort: 8081
|
||||
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
annotations: {}
|
||||
deploymentAnnotations: {}
|
||||
affinity: {}
|
||||
|
||||
# specify how many old ReplicaSets for the Deployment to retain.
|
||||
revisionHistoryLimit:
|
||||
|
||||
prometheus:
|
||||
enable: false
|
||||
scrapeInterval: 10s
|
||||
labels: {}
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,809 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.17.2
|
||||
name: nvidiadrivers.nvidia.com
|
||||
spec:
|
||||
group: nvidia.com
|
||||
names:
|
||||
kind: NVIDIADriver
|
||||
listKind: NVIDIADriverList
|
||||
plural: nvidiadrivers
|
||||
shortNames:
|
||||
- nvd
|
||||
- nvdriver
|
||||
- nvdrivers
|
||||
singular: nvidiadriver
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .status.state
|
||||
name: Status
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: NVIDIADriver is the Schema for the nvidiadrivers API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: NVIDIADriverSpec defines the desired state of NVIDIADriver
|
||||
properties:
|
||||
annotations:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Optional: Annotations is an unstructured key value map stored with a resource that may be
|
||||
set by external tools to store and retrieve arbitrary metadata. They are not
|
||||
queryable and should be preserved when modifying objects.
|
||||
type: object
|
||||
args:
|
||||
description: 'Optional: List of arguments'
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
certConfig:
|
||||
description: 'Optional: Custom certificates configuration for NVIDIA
|
||||
Driver container'
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
type: object
|
||||
driverType:
|
||||
default: gpu
|
||||
description: DriverType defines NVIDIA driver type
|
||||
enum:
|
||||
- gpu
|
||||
- vgpu
|
||||
- vgpu-host-manager
|
||||
type: string
|
||||
x-kubernetes-validations:
|
||||
- message: driverType is an immutable field. Please create a new NvidiaDriver
|
||||
resource instead when you want to change this setting.
|
||||
rule: self == oldSelf
|
||||
env:
|
||||
description: 'Optional: List of environment variables'
|
||||
items:
|
||||
description: EnvVar represents an environment variable present in
|
||||
a Container.
|
||||
properties:
|
||||
name:
|
||||
description: Name of the environment variable.
|
||||
type: string
|
||||
value:
|
||||
description: Value of the environment variable.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
gdrcopy:
|
||||
description: GDRCopy defines the spec for GDRCopy driver
|
||||
properties:
|
||||
args:
|
||||
description: 'Optional: List of arguments'
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
enabled:
|
||||
description: Enabled indicates if GDRCopy is enabled through GPU
|
||||
operator
|
||||
type: boolean
|
||||
env:
|
||||
description: 'Optional: List of environment variables'
|
||||
items:
|
||||
description: EnvVar represents an environment variable present
|
||||
in a Container.
|
||||
properties:
|
||||
name:
|
||||
description: Name of the environment variable.
|
||||
type: string
|
||||
value:
|
||||
description: Value of the environment variable.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
image:
|
||||
description: GDRCopy driver image name
|
||||
pattern: '[a-zA-Z0-9\-]+'
|
||||
type: string
|
||||
imagePullPolicy:
|
||||
description: Image pull policy
|
||||
type: string
|
||||
imagePullSecrets:
|
||||
description: Image pull secrets
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
repository:
|
||||
description: GDRCopy diver image repository
|
||||
type: string
|
||||
version:
|
||||
description: GDRCopy driver image tag
|
||||
type: string
|
||||
type: object
|
||||
gds:
|
||||
description: GPUDirectStorage defines the spec for GDS driver
|
||||
properties:
|
||||
args:
|
||||
description: 'Optional: List of arguments'
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
enabled:
|
||||
description: Enabled indicates if GPUDirect Storage is enabled
|
||||
through GPU operator
|
||||
type: boolean
|
||||
env:
|
||||
description: 'Optional: List of environment variables'
|
||||
items:
|
||||
description: EnvVar represents an environment variable present
|
||||
in a Container.
|
||||
properties:
|
||||
name:
|
||||
description: Name of the environment variable.
|
||||
type: string
|
||||
value:
|
||||
description: Value of the environment variable.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
image:
|
||||
description: NVIDIA GPUDirect Storage Driver image name
|
||||
pattern: '[a-zA-Z0-9\-]+'
|
||||
type: string
|
||||
imagePullPolicy:
|
||||
description: Image pull policy
|
||||
type: string
|
||||
imagePullSecrets:
|
||||
description: Image pull secrets
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
repository:
|
||||
description: NVIDIA GPUDirect Storage Driver image repository
|
||||
type: string
|
||||
version:
|
||||
description: NVIDIA GPUDirect Storage Driver image tag
|
||||
type: string
|
||||
type: object
|
||||
image:
|
||||
default: nvcr.io/nvidia/driver
|
||||
description: NVIDIA Driver container image name
|
||||
type: string
|
||||
imagePullPolicy:
|
||||
description: Image pull policy
|
||||
type: string
|
||||
imagePullSecrets:
|
||||
description: Image pull secrets
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
kernelModuleConfig:
|
||||
description: 'Optional: Kernel module configuration parameters for
|
||||
the NVIDIA Driver'
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
type: object
|
||||
kernelModuleType:
|
||||
default: auto
|
||||
description: |-
|
||||
KernelModuleType represents the type of driver kernel modules to be used when installing the GPU driver.
|
||||
Accepted values are auto, proprietary and open. NOTE: If auto is chosen, it means that the recommended kernel module
|
||||
type is chosen based on the GPU devices on the host and the driver branch used
|
||||
enum:
|
||||
- auto
|
||||
- open
|
||||
- proprietary
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Optional: Map of string keys and values that can be used to organize and categorize
|
||||
(scope and select) objects. May match selectors of replication controllers
|
||||
and services.
|
||||
type: object
|
||||
licensingConfig:
|
||||
description: 'Optional: Licensing configuration for NVIDIA vGPU licensing'
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
nlsEnabled:
|
||||
description: NLSEnabled indicates if NVIDIA Licensing System is
|
||||
used for licensing.
|
||||
type: boolean
|
||||
type: object
|
||||
livenessProbe:
|
||||
description: NVIDIA Driver container liveness probe settings
|
||||
properties:
|
||||
failureThreshold:
|
||||
description: |-
|
||||
Minimum consecutive failures for the probe to be considered failed after having succeeded.
|
||||
Defaults to 3. Minimum value is 1.
|
||||
format: int32
|
||||
minimum: 1
|
||||
type: integer
|
||||
initialDelaySeconds:
|
||||
description: |-
|
||||
Number of seconds after the container has started before liveness probes are initiated.
|
||||
More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
|
||||
format: int32
|
||||
type: integer
|
||||
periodSeconds:
|
||||
description: |-
|
||||
How often (in seconds) to perform the probe.
|
||||
Default to 10 seconds. Minimum value is 1.
|
||||
format: int32
|
||||
minimum: 1
|
||||
type: integer
|
||||
successThreshold:
|
||||
description: |-
|
||||
Minimum consecutive successes for the probe to be considered successful after having failed.
|
||||
Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
|
||||
format: int32
|
||||
minimum: 1
|
||||
type: integer
|
||||
timeoutSeconds:
|
||||
description: |-
|
||||
Number of seconds after which the probe times out.
|
||||
Defaults to 1 second. Minimum value is 1.
|
||||
More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
|
||||
format: int32
|
||||
minimum: 1
|
||||
type: integer
|
||||
type: object
|
||||
manager:
|
||||
description: Manager represents configuration for NVIDIA Driver Manager
|
||||
initContainer
|
||||
properties:
|
||||
env:
|
||||
description: 'Optional: List of environment variables'
|
||||
items:
|
||||
description: EnvVar represents an environment variable present
|
||||
in a Container.
|
||||
properties:
|
||||
name:
|
||||
description: Name of the environment variable.
|
||||
type: string
|
||||
value:
|
||||
description: Value of the environment variable.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
image:
|
||||
description: Image represents NVIDIA Driver Manager image name
|
||||
pattern: '[a-zA-Z0-9\-]+'
|
||||
type: string
|
||||
imagePullPolicy:
|
||||
description: Image pull policy
|
||||
type: string
|
||||
imagePullSecrets:
|
||||
description: Image pull secrets
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
repository:
|
||||
description: Repository represents Driver Managerrepository path
|
||||
type: string
|
||||
version:
|
||||
description: Version represents NVIDIA Driver Manager image tag(version)
|
||||
type: string
|
||||
type: object
|
||||
nodeAffinity:
|
||||
description: Affinity specifies node affinity rules for driver pods
|
||||
properties:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
description: |-
|
||||
The scheduler will prefer to schedule pods to nodes that satisfy
|
||||
the affinity expressions specified by this field, but it may choose
|
||||
a node that violates one or more of the expressions. The node that is
|
||||
most preferred is the one with the greatest sum of weights, i.e.
|
||||
for each node that meets all of the scheduling requirements (resource
|
||||
request, requiredDuringScheduling affinity expressions, etc.),
|
||||
compute a sum by iterating through the elements of this field and adding
|
||||
"weight" to the sum if the node matches the corresponding matchExpressions; the
|
||||
node(s) with the highest sum are the most preferred.
|
||||
items:
|
||||
description: |-
|
||||
An empty preferred scheduling term matches all objects with implicit weight 0
|
||||
(i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
|
||||
properties:
|
||||
preference:
|
||||
description: A node selector term, associated with the corresponding
|
||||
weight.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: A list of node selector requirements by
|
||||
node's labels.
|
||||
items:
|
||||
description: |-
|
||||
A node selector requirement is a selector that contains values, a key, and an operator
|
||||
that relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: The label key that the selector applies
|
||||
to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
Represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
An array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. If the operator is Gt or Lt, the values
|
||||
array must have a single element, which will be interpreted as an integer.
|
||||
This array is replaced during a strategic merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchFields:
|
||||
description: A list of node selector requirements by
|
||||
node's fields.
|
||||
items:
|
||||
description: |-
|
||||
A node selector requirement is a selector that contains values, a key, and an operator
|
||||
that relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: The label key that the selector applies
|
||||
to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
Represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
An array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. If the operator is Gt or Lt, the values
|
||||
array must have a single element, which will be interpreted as an integer.
|
||||
This array is replaced during a strategic merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
weight:
|
||||
description: Weight associated with matching the corresponding
|
||||
nodeSelectorTerm, in the range 1-100.
|
||||
format: int32
|
||||
type: integer
|
||||
required:
|
||||
- preference
|
||||
- weight
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
description: |-
|
||||
If the affinity requirements specified by this field are not met at
|
||||
scheduling time, the pod will not be scheduled onto the node.
|
||||
If the affinity requirements specified by this field cease to be met
|
||||
at some point during pod execution (e.g. due to an update), the system
|
||||
may or may not try to eventually evict the pod from its node.
|
||||
properties:
|
||||
nodeSelectorTerms:
|
||||
description: Required. A list of node selector terms. The
|
||||
terms are ORed.
|
||||
items:
|
||||
description: |-
|
||||
A null or empty node selector term matches no objects. The requirements of
|
||||
them are ANDed.
|
||||
The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: A list of node selector requirements by
|
||||
node's labels.
|
||||
items:
|
||||
description: |-
|
||||
A node selector requirement is a selector that contains values, a key, and an operator
|
||||
that relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: The label key that the selector applies
|
||||
to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
Represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
An array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. If the operator is Gt or Lt, the values
|
||||
array must have a single element, which will be interpreted as an integer.
|
||||
This array is replaced during a strategic merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchFields:
|
||||
description: A list of node selector requirements by
|
||||
node's fields.
|
||||
items:
|
||||
description: |-
|
||||
A node selector requirement is a selector that contains values, a key, and an operator
|
||||
that relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: The label key that the selector applies
|
||||
to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
Represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
An array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. If the operator is Gt or Lt, the values
|
||||
array must have a single element, which will be interpreted as an integer.
|
||||
This array is replaced during a strategic merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- nodeSelectorTerms
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: object
|
||||
nodeSelector:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: NodeSelector specifies a selector for installation of
|
||||
NVIDIA driver
|
||||
type: object
|
||||
priorityClassName:
|
||||
description: 'Optional: Set priorityClassName'
|
||||
type: string
|
||||
rdma:
|
||||
description: GPUDirectRDMA defines the spec for NVIDIA Peer Memory
|
||||
driver
|
||||
properties:
|
||||
enabled:
|
||||
description: Enabled indicates if GPUDirect RDMA is enabled through
|
||||
GPU operator
|
||||
type: boolean
|
||||
useHostMofed:
|
||||
description: UseHostMOFED indicates to use MOFED drivers directly
|
||||
installed on the host to enable GPUDirect RDMA
|
||||
type: boolean
|
||||
type: object
|
||||
readinessProbe:
|
||||
description: NVIDIA Driver container readiness probe settings
|
||||
properties:
|
||||
failureThreshold:
|
||||
description: |-
|
||||
Minimum consecutive failures for the probe to be considered failed after having succeeded.
|
||||
Defaults to 3. Minimum value is 1.
|
||||
format: int32
|
||||
minimum: 1
|
||||
type: integer
|
||||
initialDelaySeconds:
|
||||
description: |-
|
||||
Number of seconds after the container has started before liveness probes are initiated.
|
||||
More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
|
||||
format: int32
|
||||
type: integer
|
||||
periodSeconds:
|
||||
description: |-
|
||||
How often (in seconds) to perform the probe.
|
||||
Default to 10 seconds. Minimum value is 1.
|
||||
format: int32
|
||||
minimum: 1
|
||||
type: integer
|
||||
successThreshold:
|
||||
description: |-
|
||||
Minimum consecutive successes for the probe to be considered successful after having failed.
|
||||
Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
|
||||
format: int32
|
||||
minimum: 1
|
||||
type: integer
|
||||
timeoutSeconds:
|
||||
description: |-
|
||||
Number of seconds after which the probe times out.
|
||||
Defaults to 1 second. Minimum value is 1.
|
||||
More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
|
||||
format: int32
|
||||
minimum: 1
|
||||
type: integer
|
||||
type: object
|
||||
repoConfig:
|
||||
description: 'Optional: Custom repo configuration for NVIDIA Driver
|
||||
container'
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
type: object
|
||||
repository:
|
||||
description: NVIDIA Driver repository
|
||||
type: string
|
||||
resources:
|
||||
description: 'Optional: Define resources requests and limits for each
|
||||
pod'
|
||||
properties:
|
||||
limits:
|
||||
additionalProperties:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||
x-kubernetes-int-or-string: true
|
||||
description: |-
|
||||
Limits describes the maximum amount of compute resources allowed.
|
||||
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
type: object
|
||||
requests:
|
||||
additionalProperties:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||
x-kubernetes-int-or-string: true
|
||||
description: |-
|
||||
Requests describes the minimum amount of compute resources required.
|
||||
If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
|
||||
otherwise to an implementation-defined value. Requests cannot exceed Limits.
|
||||
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
type: object
|
||||
type: object
|
||||
startupProbe:
|
||||
description: NVIDIA Driver container startup probe settings
|
||||
properties:
|
||||
failureThreshold:
|
||||
description: |-
|
||||
Minimum consecutive failures for the probe to be considered failed after having succeeded.
|
||||
Defaults to 3. Minimum value is 1.
|
||||
format: int32
|
||||
minimum: 1
|
||||
type: integer
|
||||
initialDelaySeconds:
|
||||
description: |-
|
||||
Number of seconds after the container has started before liveness probes are initiated.
|
||||
More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
|
||||
format: int32
|
||||
type: integer
|
||||
periodSeconds:
|
||||
description: |-
|
||||
How often (in seconds) to perform the probe.
|
||||
Default to 10 seconds. Minimum value is 1.
|
||||
format: int32
|
||||
minimum: 1
|
||||
type: integer
|
||||
successThreshold:
|
||||
description: |-
|
||||
Minimum consecutive successes for the probe to be considered successful after having failed.
|
||||
Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
|
||||
format: int32
|
||||
minimum: 1
|
||||
type: integer
|
||||
timeoutSeconds:
|
||||
description: |-
|
||||
Number of seconds after which the probe times out.
|
||||
Defaults to 1 second. Minimum value is 1.
|
||||
More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
|
||||
format: int32
|
||||
minimum: 1
|
||||
type: integer
|
||||
type: object
|
||||
tolerations:
|
||||
description: 'Optional: Set tolerations'
|
||||
items:
|
||||
description: |-
|
||||
The pod this Toleration is attached to tolerates any taint that matches
|
||||
the triple <key,value,effect> using the matching operator <operator>.
|
||||
properties:
|
||||
effect:
|
||||
description: |-
|
||||
Effect indicates the taint effect to match. Empty means match all taint effects.
|
||||
When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
|
||||
type: string
|
||||
key:
|
||||
description: |-
|
||||
Key is the taint key that the toleration applies to. Empty means match all taint keys.
|
||||
If the key is empty, operator must be Exists; this combination means to match all values and all keys.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
Operator represents a key's relationship to the value.
|
||||
Valid operators are Exists and Equal. Defaults to Equal.
|
||||
Exists is equivalent to wildcard for value, so that a pod can
|
||||
tolerate all taints of a particular category.
|
||||
type: string
|
||||
tolerationSeconds:
|
||||
description: |-
|
||||
TolerationSeconds represents the period of time the toleration (which must be
|
||||
of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
|
||||
it is not set, which means tolerate the taint forever (do not evict). Zero and
|
||||
negative values will be treated as 0 (evict immediately) by the system.
|
||||
format: int64
|
||||
type: integer
|
||||
value:
|
||||
description: |-
|
||||
Value is the taint value the toleration matches to.
|
||||
If the operator is Exists, the value should be empty, otherwise just a regular string.
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
useOpenKernelModules:
|
||||
description: |-
|
||||
Deprecated: This field is no longer honored by the gpu-operator. Please use KernelModuleType instead.
|
||||
UseOpenKernelModules indicates if the open GPU kernel modules should be used
|
||||
type: boolean
|
||||
usePrecompiled:
|
||||
description: UsePrecompiled indicates if deployment of NVIDIA Driver
|
||||
using pre-compiled modules is enabled
|
||||
type: boolean
|
||||
x-kubernetes-validations:
|
||||
- message: usePrecompiled is an immutable field. Please create a new
|
||||
NvidiaDriver resource instead when you want to change this setting.
|
||||
rule: self == oldSelf
|
||||
version:
|
||||
description: NVIDIA Driver version (or just branch for precompiled
|
||||
drivers)
|
||||
type: string
|
||||
virtualTopologyConfig:
|
||||
description: 'Optional: Virtual Topology Daemon configuration for
|
||||
NVIDIA vGPU drivers'
|
||||
properties:
|
||||
name:
|
||||
description: 'Optional: Config name representing virtual topology
|
||||
daemon configuration file nvidia-topologyd.conf'
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- driverType
|
||||
- image
|
||||
type: object
|
||||
status:
|
||||
description: NVIDIADriverStatus defines the observed state of NVIDIADriver
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions is a list of conditions representing the NVIDIADriver's
|
||||
current state.
|
||||
items:
|
||||
description: Condition contains details for one aspect of the current
|
||||
state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
namespace:
|
||||
description: Namespace indicates a namespace in which the operator
|
||||
and driver are installed
|
||||
type: string
|
||||
state:
|
||||
description: |-
|
||||
INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
|
||||
Important: Run "make" to regenerate code after modifying this file
|
||||
State indicates status of NVIDIADriver instance
|
||||
enum:
|
||||
- ignored
|
||||
- ready
|
||||
- notReady
|
||||
type: string
|
||||
required:
|
||||
- state
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
|
|
@ -0,0 +1,97 @@
|
|||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: custom-dcgm-metric
|
||||
namespace: gpu-operator
|
||||
data:
|
||||
dcgm-metrics.csv: |
|
||||
# Format
|
||||
# If line starts with a '#' it is considered a comment
|
||||
# DCGM FIELD, Prometheus metric type, help message
|
||||
|
||||
# Clocks
|
||||
DCGM_FI_DEV_SM_CLOCK, gauge, SM clock frequency (in MHz).
|
||||
DCGM_FI_DEV_MEM_CLOCK, gauge, Memory clock frequency (in MHz).
|
||||
|
||||
# Temperature
|
||||
DCGM_FI_DEV_MEMORY_TEMP, gauge, Memory temperature (in C).
|
||||
DCGM_FI_DEV_GPU_TEMP, gauge, GPU temperature (in C).
|
||||
|
||||
# Power
|
||||
DCGM_FI_DEV_POWER_USAGE, gauge, Power draw (in W).
|
||||
DCGM_FI_DEV_TOTAL_ENERGY_CONSUMPTION, counter, Total energy consumption since boot (in mJ).
|
||||
|
||||
# PCIE
|
||||
DCGM_FI_PROF_PCIE_TX_BYTES, counter, Total number of bytes transmitted through PCIe TX via NVML.
|
||||
DCGM_FI_PROF_PCIE_RX_BYTES, counter, Total number of bytes received through PCIe RX via NVML.
|
||||
DCGM_FI_DEV_PCIE_REPLAY_COUNTER, counter, Total number of PCIe retries.
|
||||
|
||||
# Utilization (the sample period varies depending on the product)
|
||||
DCGM_FI_DEV_GPU_UTIL, gauge, GPU utilization (in %).
|
||||
DCGM_FI_DEV_MEM_COPY_UTIL, gauge, Memory utilization (in %).
|
||||
DCGM_FI_DEV_ENC_UTIL, gauge, Encoder utilization (in %).
|
||||
DCGM_FI_DEV_DEC_UTIL , gauge, Decoder utilization (in %).
|
||||
|
||||
# Errors and violations
|
||||
DCGM_FI_DEV_XID_ERRORS, gauge, Value of the last XID error encountered.
|
||||
DCGM_FI_DEV_POWER_VIOLATION, counter, Throttling duration due to power constraints (in us).
|
||||
DCGM_FI_DEV_THERMAL_VIOLATION, counter, Throttling duration due to thermal constraints (in us).
|
||||
DCGM_FI_DEV_SYNC_BOOST_VIOLATION, counter, Throttling duration due to sync-boost constraints (in us).
|
||||
DCGM_FI_DEV_BOARD_LIMIT_VIOLATION, counter, Throttling duration due to board limit constraints (in us).
|
||||
DCGM_FI_DEV_LOW_UTIL_VIOLATION, counter, Throttling duration due to low utilization (in us).
|
||||
DCGM_FI_DEV_RELIABILITY_VIOLATION, counter, Throttling duration due to reliability constraints (in us).
|
||||
|
||||
# Memory usage
|
||||
DCGM_FI_DEV_FB_FREE, gauge, Framebuffer memory free (in MiB).
|
||||
DCGM_FI_DEV_FB_USED, gauge, Framebuffer memory used (in MiB).
|
||||
|
||||
# ECC
|
||||
DCGM_FI_DEV_ECC_SBE_VOL_TOTAL, counter, Total number of single-bit volatile ECC errors.
|
||||
DCGM_FI_DEV_ECC_DBE_VOL_TOTAL, counter, Total number of double-bit volatile ECC errors.
|
||||
DCGM_FI_DEV_ECC_SBE_AGG_TOTAL, counter, Total number of single-bit persistent ECC errors.
|
||||
DCGM_FI_DEV_ECC_DBE_AGG_TOTAL, counter, Total number of double-bit persistent ECC errors.
|
||||
|
||||
# Retired pages
|
||||
DCGM_FI_DEV_RETIRED_SBE, counter, Total number of retired pages due to single-bit errors.
|
||||
DCGM_FI_DEV_RETIRED_DBE, counter, Total number of retired pages due to double-bit errors.
|
||||
DCGM_FI_DEV_RETIRED_PENDING, counter, Total number of pages pending retirement.
|
||||
|
||||
# NVLink
|
||||
DCGM_FI_DEV_NVLINK_CRC_FLIT_ERROR_COUNT_TOTAL, counter, Total number of NVLink flow-control CRC errors.
|
||||
DCGM_FI_DEV_NVLINK_CRC_DATA_ERROR_COUNT_TOTAL, counter, Total number of NVLink data CRC errors.
|
||||
DCGM_FI_DEV_NVLINK_REPLAY_ERROR_COUNT_TOTAL, counter, Total number of NVLink retries.
|
||||
DCGM_FI_DEV_NVLINK_RECOVERY_ERROR_COUNT_TOTAL, counter, Total number of NVLink recovery errors.
|
||||
DCGM_FI_DEV_NVLINK_BANDWIDTH_TOTAL, counter, Total number of NVLink bandwidth counters for all lanes.
|
||||
DCGM_FI_DEV_NVLINK_BANDWIDTH_L0, counter, The number of bytes of active NVLink rx or tx data including both header and payload.
|
||||
|
||||
# VGPU License status
|
||||
DCGM_FI_DEV_VGPU_LICENSE_STATUS, gauge, vGPU License status
|
||||
|
||||
# Remapped rows
|
||||
DCGM_FI_DEV_UNCORRECTABLE_REMAPPED_ROWS, counter, Number of remapped rows for uncorrectable errors
|
||||
DCGM_FI_DEV_CORRECTABLE_REMAPPED_ROWS, counter, Number of remapped rows for correctable errors
|
||||
DCGM_FI_DEV_ROW_REMAP_FAILURE, gauge, Whether remapping of rows has failed
|
||||
|
||||
# Static configuration information. These appear as labels on the other metrics
|
||||
DCGM_FI_DRIVER_VERSION, label, Driver Version
|
||||
DCGM_FI_NVML_VERSION, label, NVML Version
|
||||
DCGM_FI_DEV_BRAND, label, Device Brand
|
||||
DCGM_FI_DEV_SERIAL, label, Device Serial Number
|
||||
DCGM_FI_DEV_OEM_INFOROM_VER, label, OEM inforom version
|
||||
DCGM_FI_DEV_ECC_INFOROM_VER, label, ECC inforom version
|
||||
DCGM_FI_DEV_POWER_INFOROM_VER, label, Power management object inforom version
|
||||
DCGM_FI_DEV_INFOROM_IMAGE_VER, label, Inforom image version
|
||||
DCGM_FI_DEV_VBIOS_VERSION, label, VBIOS version of the device
|
||||
|
||||
# DCP metrics
|
||||
DCGM_FI_PROF_GR_ENGINE_ACTIVE, gauge, Ratio of time the graphics engine is active.
|
||||
DCGM_FI_PROF_SM_ACTIVE, gauge, The ratio of cycles an SM has at least 1 warp assigned.
|
||||
DCGM_FI_PROF_SM_OCCUPANCY, gauge, The ratio of number of warps resident on an SM.
|
||||
DCGM_FI_PROF_PIPE_TENSOR_ACTIVE, gauge, Ratio of cycles the tensor (HMMA) pipe is active.
|
||||
DCGM_FI_PROF_DRAM_ACTIVE, gauge, Ratio of cycles the device memory interface is active sending or receiving data.
|
||||
DCGM_FI_PROF_PIPE_FP64_ACTIVE, gauge, Ratio of cycles the fp64 pipes are active.
|
||||
DCGM_FI_PROF_PIPE_FP32_ACTIVE, gauge, Ratio of cycles the fp32 pipes are active.
|
||||
DCGM_FI_PROF_PIPE_FP16_ACTIVE, gauge, Ratio of cycles the fp16 pipes are active.
|
||||
DCGM_FI_PROF_PCIE_TX_BYTES, gauge, The rate of data transmitted over the PCIe bus - including both protocol headers and data payloads - in bytes per second.
|
||||
DCGM_FI_PROF_PCIE_RX_BYTES, gauge, The rate of data received over the PCIe bus - including both protocol headers and data payloads - in bytes per second.
|
||||
|
||||
|
|
@ -0,0 +1,80 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "gpu-operator.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "gpu-operator.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "gpu-operator.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
|
||||
{{- define "gpu-operator.labels" -}}
|
||||
app.kubernetes.io/name: {{ include "gpu-operator.name" . }}
|
||||
helm.sh/chart: {{ include "gpu-operator.chart" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- if .Values.operator.labels }}
|
||||
{{ toYaml .Values.operator.labels }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gpu-operator.operand-labels" -}}
|
||||
helm.sh/chart: {{ include "gpu-operator.chart" . }}
|
||||
app.kubernetes.io/managed-by: {{ include "gpu-operator.name" . }}
|
||||
{{- if .Values.daemonsets.labels }}
|
||||
{{ toYaml .Values.daemonsets.labels }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gpu-operator.matchLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "gpu-operator.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Full image name with tag
|
||||
*/}}
|
||||
{{- define "gpu-operator.fullimage" -}}
|
||||
{{- .Values.operator.repository -}}/{{- .Values.operator.image -}}:{{- .Values.operator.version | default .Chart.AppVersion -}}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Full image name with tag
|
||||
*/}}
|
||||
{{- define "driver-manager.fullimage" -}}
|
||||
{{- .Values.driver.manager.repository -}}/{{- .Values.driver.manager.image -}}:{{- .Values.driver.manager.version -}}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
{{- if .Values.operator.cleanupCRD }}
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: gpu-operator-cleanup-crd
|
||||
namespace: {{ .Release.Namespace }}
|
||||
annotations:
|
||||
"helm.sh/hook": pre-delete
|
||||
"helm.sh/hook-weight": "1"
|
||||
"helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
|
||||
labels:
|
||||
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: "gpu-operator"
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
name: gpu-operator-cleanup-crd
|
||||
labels:
|
||||
{{- include "gpu-operator.labels" . | nindent 8 }}
|
||||
app.kubernetes.io/component: "gpu-operator"
|
||||
spec:
|
||||
serviceAccountName: gpu-operator
|
||||
{{- if .Values.operator.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.operator.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.operator.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: cleanup-crd
|
||||
image: {{ include "gpu-operator.fullimage" . }}
|
||||
imagePullPolicy: {{ .Values.operator.imagePullPolicy }}
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- >
|
||||
kubectl delete clusterpolicy cluster-policy;
|
||||
kubectl delete crd clusterpolicies.nvidia.com;
|
||||
kubectl delete crd nvidiadrivers.nvidia.com --ignore-not-found=true;
|
||||
{{- if .Values.nfd.enabled -}}
|
||||
kubectl delete crd nodefeatures.nfd.k8s-sigs.io --ignore-not-found=true;
|
||||
kubectl delete crd nodefeaturegroups.nfd.k8s-sigs.io --ignore-not-found=true;
|
||||
kubectl delete crd nodefeaturerules.nfd.k8s-sigs.io --ignore-not-found=true;
|
||||
{{- end }}
|
||||
restartPolicy: OnFailure
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,680 @@
|
|||
apiVersion: nvidia.com/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: cluster-policy
|
||||
labels:
|
||||
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: "gpu-operator"
|
||||
{{- if .Values.operator.cleanupCRD }}
|
||||
# CR cleanup is handled during pre-delete hook
|
||||
# Add below annotation so that helm doesn't attempt to cleanup CR twice
|
||||
annotations:
|
||||
"helm.sh/resource-policy": keep
|
||||
{{- end }}
|
||||
spec:
|
||||
hostPaths:
|
||||
rootFS: {{ .Values.hostPaths.rootFS }}
|
||||
driverInstallDir: {{ .Values.hostPaths.driverInstallDir }}
|
||||
operator:
|
||||
{{- if .Values.operator.runtimeClass }}
|
||||
runtimeClass: {{ .Values.operator.runtimeClass }}
|
||||
{{- end }}
|
||||
{{- if .Values.operator.defaultGPUMode }}
|
||||
defaultGPUMode: {{ .Values.operator.defaultGPUMode }}
|
||||
{{- end }}
|
||||
{{- if .Values.operator.initContainer }}
|
||||
initContainer:
|
||||
{{- if .Values.operator.initContainer.repository }}
|
||||
repository: {{ .Values.operator.initContainer.repository }}
|
||||
{{- end }}
|
||||
{{- if .Values.operator.initContainer.image }}
|
||||
image: {{ .Values.operator.initContainer.image }}
|
||||
{{- end }}
|
||||
{{- if .Values.operator.initContainer.version }}
|
||||
version: {{ .Values.operator.initContainer.version | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.operator.initContainer.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.operator.initContainer.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.operator.initContainer.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.operator.initContainer.imagePullSecrets | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.operator.use_ocp_driver_toolkit }}
|
||||
use_ocp_driver_toolkit: {{ .Values.operator.use_ocp_driver_toolkit }}
|
||||
{{- end }}
|
||||
daemonsets:
|
||||
labels:
|
||||
{{- include "gpu-operator.operand-labels" . | nindent 6 }}
|
||||
{{- if .Values.daemonsets.annotations }}
|
||||
annotations: {{ toYaml .Values.daemonsets.annotations | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.daemonsets.tolerations }}
|
||||
tolerations: {{ toYaml .Values.daemonsets.tolerations | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.daemonsets.priorityClassName }}
|
||||
priorityClassName: {{ .Values.daemonsets.priorityClassName }}
|
||||
{{- end }}
|
||||
{{- if .Values.daemonsets.updateStrategy }}
|
||||
updateStrategy: {{ .Values.daemonsets.updateStrategy }}
|
||||
{{- end }}
|
||||
{{- if .Values.daemonsets.rollingUpdate }}
|
||||
rollingUpdate:
|
||||
maxUnavailable: {{ .Values.daemonsets.rollingUpdate.maxUnavailable | quote }}
|
||||
{{- end }}
|
||||
validator:
|
||||
{{- if .Values.validator.repository }}
|
||||
repository: {{ .Values.validator.repository }}
|
||||
{{- end }}
|
||||
{{- if .Values.validator.image }}
|
||||
image: {{ .Values.validator.image }}
|
||||
{{- end }}
|
||||
version: {{ .Values.validator.version | default .Chart.AppVersion | quote }}
|
||||
{{- if .Values.validator.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.validator.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.validator.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.validator.imagePullSecrets | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.validator.resources }}
|
||||
resources: {{ toYaml .Values.validator.resources | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.validator.env }}
|
||||
env: {{ toYaml .Values.validator.env | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.validator.args }}
|
||||
args: {{ toYaml .Values.validator.args | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.validator.plugin }}
|
||||
plugin:
|
||||
{{- if .Values.validator.plugin.env }}
|
||||
env: {{ toYaml .Values.validator.plugin.env | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.validator.cuda }}
|
||||
cuda:
|
||||
{{- if .Values.validator.cuda.env }}
|
||||
env: {{ toYaml .Values.validator.cuda.env | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.validator.driver }}
|
||||
driver:
|
||||
{{- if .Values.validator.driver.env }}
|
||||
env: {{ toYaml .Values.validator.driver.env | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.validator.toolkit }}
|
||||
toolkit:
|
||||
{{- if .Values.validator.toolkit.env }}
|
||||
env: {{ toYaml .Values.validator.toolkit.env | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.validator.vfioPCI }}
|
||||
vfioPCI:
|
||||
{{- if .Values.validator.vfioPCI.env }}
|
||||
env: {{ toYaml .Values.validator.vfioPCI.env | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.validator.vgpuManager }}
|
||||
vgpuManager:
|
||||
{{- if .Values.validator.vgpuManager.env }}
|
||||
env: {{ toYaml .Values.validator.vgpuManager.env | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.validator.vgpuDevices }}
|
||||
vgpuDevices:
|
||||
{{- if .Values.validator.vgpuDevices.env }}
|
||||
env: {{ toYaml .Values.validator.vgpuDevices.env | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
mig:
|
||||
{{- if .Values.mig.strategy }}
|
||||
strategy: {{ .Values.mig.strategy }}
|
||||
{{- end }}
|
||||
psa:
|
||||
enabled: {{ .Values.psa.enabled }}
|
||||
cdi:
|
||||
enabled: {{ .Values.cdi.enabled }}
|
||||
default: {{ .Values.cdi.default }}
|
||||
driver:
|
||||
enabled: {{ .Values.driver.enabled }}
|
||||
useNvidiaDriverCRD: {{ .Values.driver.nvidiaDriverCRD.enabled }}
|
||||
kernelModuleType: {{ .Values.driver.kernelModuleType }}
|
||||
usePrecompiled: {{ .Values.driver.usePrecompiled }}
|
||||
{{- if .Values.driver.repository }}
|
||||
repository: {{ .Values.driver.repository }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.image }}
|
||||
image: {{ .Values.driver.image }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.version }}
|
||||
version: {{ .Values.driver.version | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.driver.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.driver.imagePullSecrets | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.startupProbe }}
|
||||
startupProbe: {{ toYaml .Values.driver.startupProbe | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.livenessProbe }}
|
||||
livenessProbe: {{ toYaml .Values.driver.livenessProbe | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.readinessProbe }}
|
||||
readinessProbe: {{ toYaml .Values.driver.readinessProbe | nindent 6 }}
|
||||
{{- end }}
|
||||
rdma:
|
||||
enabled: {{ .Values.driver.rdma.enabled }}
|
||||
useHostMofed: {{ .Values.driver.rdma.useHostMofed }}
|
||||
manager:
|
||||
{{- if .Values.driver.manager.repository }}
|
||||
repository: {{ .Values.driver.manager.repository }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.manager.image }}
|
||||
image: {{ .Values.driver.manager.image }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.manager.version }}
|
||||
version: {{ .Values.driver.manager.version | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.manager.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.driver.manager.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.manager.env }}
|
||||
env: {{ toYaml .Values.driver.manager.env | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.repoConfig }}
|
||||
repoConfig: {{ toYaml .Values.driver.repoConfig | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.certConfig }}
|
||||
certConfig: {{ toYaml .Values.driver.certConfig | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.licensingConfig }}
|
||||
licensingConfig: {{ toYaml .Values.driver.licensingConfig | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.virtualTopology }}
|
||||
virtualTopology: {{ toYaml .Values.driver.virtualTopology | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.kernelModuleConfig }}
|
||||
kernelModuleConfig: {{ toYaml .Values.driver.kernelModuleConfig | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.resources }}
|
||||
resources: {{ toYaml .Values.driver.resources | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.env }}
|
||||
env: {{ toYaml .Values.driver.env | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.args }}
|
||||
args: {{ toYaml .Values.driver.args | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.upgradePolicy }}
|
||||
upgradePolicy:
|
||||
autoUpgrade: {{ .Values.driver.upgradePolicy.autoUpgrade | default false }}
|
||||
maxParallelUpgrades: {{ .Values.driver.upgradePolicy.maxParallelUpgrades | default 0 }}
|
||||
maxUnavailable : {{ .Values.driver.upgradePolicy.maxUnavailable | default "25%" }}
|
||||
waitForCompletion:
|
||||
timeoutSeconds: {{ .Values.driver.upgradePolicy.waitForCompletion.timeoutSeconds }}
|
||||
{{- if .Values.driver.upgradePolicy.waitForCompletion.podSelector }}
|
||||
podSelector: {{ .Values.driver.upgradePolicy.waitForCompletion.podSelector }}
|
||||
{{- end }}
|
||||
podDeletion:
|
||||
force: {{ .Values.driver.upgradePolicy.gpuPodDeletion.force | default false }}
|
||||
timeoutSeconds: {{ .Values.driver.upgradePolicy.gpuPodDeletion.timeoutSeconds }}
|
||||
deleteEmptyDir: {{ .Values.driver.upgradePolicy.gpuPodDeletion.deleteEmptyDir | default false }}
|
||||
drain:
|
||||
enable: {{ .Values.driver.upgradePolicy.drain.enable | default false }}
|
||||
force: {{ .Values.driver.upgradePolicy.drain.force | default false }}
|
||||
{{- if .Values.driver.upgradePolicy.drain.podSelector }}
|
||||
podSelector: {{ .Values.driver.upgradePolicy.drain.podSelector }}
|
||||
{{- end }}
|
||||
timeoutSeconds: {{ .Values.driver.upgradePolicy.drain.timeoutSeconds }}
|
||||
deleteEmptyDir: {{ .Values.driver.upgradePolicy.drain.deleteEmptyDir | default false}}
|
||||
{{- end }}
|
||||
vgpuManager:
|
||||
enabled: {{ .Values.vgpuManager.enabled }}
|
||||
{{- if .Values.vgpuManager.repository }}
|
||||
repository: {{ .Values.vgpuManager.repository }}
|
||||
{{- end }}
|
||||
{{- if .Values.vgpuManager.image }}
|
||||
image: {{ .Values.vgpuManager.image }}
|
||||
{{- end }}
|
||||
{{- if .Values.vgpuManager.version }}
|
||||
version: {{ .Values.vgpuManager.version | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.vgpuManager.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.vgpuManager.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.vgpuManager.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.vgpuManager.imagePullSecrets | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.vgpuManager.resources }}
|
||||
resources: {{ toYaml .Values.vgpuManager.resources | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.vgpuManager.env }}
|
||||
env: {{ toYaml .Values.vgpuManager.env | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.vgpuManager.args }}
|
||||
args: {{ toYaml .Values.vgpuManager.args | nindent 6 }}
|
||||
{{- end }}
|
||||
driverManager:
|
||||
{{- if .Values.vgpuManager.driverManager.repository }}
|
||||
repository: {{ .Values.vgpuManager.driverManager.repository }}
|
||||
{{- end }}
|
||||
{{- if .Values.vgpuManager.driverManager.image }}
|
||||
image: {{ .Values.vgpuManager.driverManager.image }}
|
||||
{{- end }}
|
||||
{{- if .Values.vgpuManager.driverManager.version }}
|
||||
version: {{ .Values.vgpuManager.driverManager.version | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.vgpuManager.driverManager.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.vgpuManager.driverManager.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.vgpuManager.driverManager.env }}
|
||||
env: {{ toYaml .Values.vgpuManager.driverManager.env | nindent 8 }}
|
||||
{{- end }}
|
||||
kataManager:
|
||||
enabled: {{ .Values.kataManager.enabled }}
|
||||
config: {{ toYaml .Values.kataManager.config | nindent 6 }}
|
||||
{{- if .Values.kataManager.repository }}
|
||||
repository: {{ .Values.kataManager.repository }}
|
||||
{{- end }}
|
||||
{{- if .Values.kataManager.image }}
|
||||
image: {{ .Values.kataManager.image }}
|
||||
{{- end }}
|
||||
{{- if .Values.kataManager.version }}
|
||||
version: {{ .Values.kataManager.version | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.kataManager.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.kataManager.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.kataManager.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.kataManager.imagePullSecrets | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.kataManager.resources }}
|
||||
resources: {{ toYaml .Values.kataManager.resources | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.kataManager.env }}
|
||||
env: {{ toYaml .Values.kataManager.env | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.kataManager.args }}
|
||||
args: {{ toYaml .Values.kataManager.args | nindent 6 }}
|
||||
{{- end }}
|
||||
vfioManager:
|
||||
enabled: {{ .Values.vfioManager.enabled }}
|
||||
{{- if .Values.vfioManager.repository }}
|
||||
repository: {{ .Values.vfioManager.repository }}
|
||||
{{- end }}
|
||||
{{- if .Values.vfioManager.image }}
|
||||
image: {{ .Values.vfioManager.image }}
|
||||
{{- end }}
|
||||
{{- if .Values.vfioManager.version }}
|
||||
version: {{ .Values.vfioManager.version | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.vfioManager.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.vfioManager.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.vfioManager.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.vfioManager.imagePullSecrets | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.vfioManager.resources }}
|
||||
resources: {{ toYaml .Values.vfioManager.resources | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.vfioManager.env }}
|
||||
env: {{ toYaml .Values.vfioManager.env | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.vfioManager.args }}
|
||||
args: {{ toYaml .Values.vfioManager.args | nindent 6 }}
|
||||
{{- end }}
|
||||
driverManager:
|
||||
{{- if .Values.vfioManager.driverManager.repository }}
|
||||
repository: {{ .Values.vfioManager.driverManager.repository }}
|
||||
{{- end }}
|
||||
{{- if .Values.vfioManager.driverManager.image }}
|
||||
image: {{ .Values.vfioManager.driverManager.image }}
|
||||
{{- end }}
|
||||
{{- if .Values.vfioManager.driverManager.version }}
|
||||
version: {{ .Values.vfioManager.driverManager.version | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.vfioManager.driverManager.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.vfioManager.driverManager.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.vfioManager.driverManager.env }}
|
||||
env: {{ toYaml .Values.vfioManager.driverManager.env | nindent 8 }}
|
||||
{{- end }}
|
||||
vgpuDeviceManager:
|
||||
enabled: {{ .Values.vgpuDeviceManager.enabled }}
|
||||
{{- if .Values.vgpuDeviceManager.repository }}
|
||||
repository: {{ .Values.vgpuDeviceManager.repository }}
|
||||
{{- end }}
|
||||
{{- if .Values.vgpuDeviceManager.image }}
|
||||
image: {{ .Values.vgpuDeviceManager.image }}
|
||||
{{- end }}
|
||||
{{- if .Values.vgpuDeviceManager.version }}
|
||||
version: {{ .Values.vgpuDeviceManager.version | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.vgpuDeviceManager.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.vgpuDeviceManager.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.vgpuDeviceManager.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.vgpuDeviceManager.imagePullSecrets | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.vgpuDeviceManager.resources }}
|
||||
resources: {{ toYaml .Values.vgpuDeviceManager.resources | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.vgpuDeviceManager.env }}
|
||||
env: {{ toYaml .Values.vgpuDeviceManager.env | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.vgpuDeviceManager.args }}
|
||||
args: {{ toYaml .Values.vgpuDeviceManager.args | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.vgpuDeviceManager.config }}
|
||||
config: {{ toYaml .Values.vgpuDeviceManager.config | nindent 6 }}
|
||||
{{- end }}
|
||||
ccManager:
|
||||
enabled: {{ .Values.ccManager.enabled }}
|
||||
defaultMode: {{ .Values.ccManager.defaultMode | quote }}
|
||||
{{- if .Values.ccManager.repository }}
|
||||
repository: {{ .Values.ccManager.repository }}
|
||||
{{- end }}
|
||||
{{- if .Values.ccManager.image }}
|
||||
image: {{ .Values.ccManager.image }}
|
||||
{{- end }}
|
||||
{{- if .Values.ccManager.version }}
|
||||
version: {{ .Values.ccManager.version | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.ccManager.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.ccManager.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.ccManager.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.ccManager.imagePullSecrets | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.ccManager.resources }}
|
||||
resources: {{ toYaml .Values.ccManager.resources | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.ccManager.env }}
|
||||
env: {{ toYaml .Values.vfioManager.env | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.ccManager.args }}
|
||||
args: {{ toYaml .Values.ccManager.args | nindent 6 }}
|
||||
{{- end }}
|
||||
toolkit:
|
||||
enabled: {{ .Values.toolkit.enabled }}
|
||||
{{- if .Values.toolkit.repository }}
|
||||
repository: {{ .Values.toolkit.repository }}
|
||||
{{- end }}
|
||||
{{- if .Values.toolkit.image }}
|
||||
image: {{ .Values.toolkit.image }}
|
||||
{{- end }}
|
||||
{{- if .Values.toolkit.version }}
|
||||
version: {{ .Values.toolkit.version | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.toolkit.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.toolkit.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.toolkit.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.toolkit.imagePullSecrets | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.toolkit.resources }}
|
||||
resources: {{ toYaml .Values.toolkit.resources | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.toolkit.env }}
|
||||
env: {{ toYaml .Values.toolkit.env | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.toolkit.installDir }}
|
||||
installDir: {{ .Values.toolkit.installDir }}
|
||||
{{- end }}
|
||||
devicePlugin:
|
||||
enabled: {{ .Values.devicePlugin.enabled }}
|
||||
{{- if .Values.devicePlugin.repository }}
|
||||
repository: {{ .Values.devicePlugin.repository }}
|
||||
{{- end }}
|
||||
{{- if .Values.devicePlugin.image }}
|
||||
image: {{ .Values.devicePlugin.image }}
|
||||
{{- end }}
|
||||
{{- if .Values.devicePlugin.version }}
|
||||
version: {{ .Values.devicePlugin.version | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.devicePlugin.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.devicePlugin.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.devicePlugin.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.devicePlugin.imagePullSecrets | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.devicePlugin.resources }}
|
||||
resources: {{ toYaml .Values.devicePlugin.resources | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.devicePlugin.env }}
|
||||
env: {{ toYaml .Values.devicePlugin.env | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.devicePlugin.args }}
|
||||
args: {{ toYaml .Values.devicePlugin.args | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.devicePlugin.config.name }}
|
||||
config:
|
||||
name: {{ .Values.devicePlugin.config.name }}
|
||||
default: {{ .Values.devicePlugin.config.default }}
|
||||
{{- end }}
|
||||
dcgm:
|
||||
enabled: {{ .Values.dcgm.enabled }}
|
||||
{{- if .Values.dcgm.repository }}
|
||||
repository: {{ .Values.dcgm.repository }}
|
||||
{{- end }}
|
||||
{{- if .Values.dcgm.image }}
|
||||
image: {{ .Values.dcgm.image }}
|
||||
{{- end }}
|
||||
{{- if .Values.dcgm.version }}
|
||||
version: {{ .Values.dcgm.version | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.dcgm.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.dcgm.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.dcgm.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.dcgm.imagePullSecrets | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.dcgm.resources }}
|
||||
resources: {{ toYaml .Values.dcgm.resources | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.dcgm.env }}
|
||||
env: {{ toYaml .Values.dcgm.env | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.dcgm.args }}
|
||||
args: {{ toYaml .Values.dcgm.args | nindent 6 }}
|
||||
{{- end }}
|
||||
dcgmExporter:
|
||||
enabled: {{ .Values.dcgmExporter.enabled }}
|
||||
{{- if .Values.dcgmExporter.repository }}
|
||||
repository: {{ .Values.dcgmExporter.repository }}
|
||||
{{- end }}
|
||||
{{- if .Values.dcgmExporter.image }}
|
||||
image: {{ .Values.dcgmExporter.image }}
|
||||
{{- end }}
|
||||
{{- if .Values.dcgmExporter.version }}
|
||||
version: {{ .Values.dcgmExporter.version | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.dcgmExporter.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.dcgmExporter.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.dcgmExporter.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.dcgmExporter.imagePullSecrets | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.dcgmExporter.resources }}
|
||||
resources: {{ toYaml .Values.dcgmExporter.resources | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.dcgmExporter.env }}
|
||||
env: {{ toYaml .Values.dcgmExporter.env | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.dcgmExporter.args }}
|
||||
args: {{ toYaml .Values.dcgmExporter.args | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if and (.Values.dcgmExporter.config) (.Values.dcgmExporter.config.name) }}
|
||||
config:
|
||||
name: {{ .Values.dcgmExporter.config.name }}
|
||||
{{- end }}
|
||||
{{- if .Values.dcgmExporter.serviceMonitor }}
|
||||
serviceMonitor: {{ toYaml .Values.dcgmExporter.serviceMonitor | nindent 6 }}
|
||||
{{- end }}
|
||||
gfd:
|
||||
enabled: {{ .Values.gfd.enabled }}
|
||||
{{- if .Values.gfd.repository }}
|
||||
repository: {{ .Values.gfd.repository }}
|
||||
{{- end }}
|
||||
{{- if .Values.gfd.image }}
|
||||
image: {{ .Values.gfd.image }}
|
||||
{{- end }}
|
||||
{{- if .Values.gfd.version }}
|
||||
version: {{ .Values.gfd.version | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.gfd.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.gfd.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.gfd.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.gfd.imagePullSecrets | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.gfd.resources }}
|
||||
resources: {{ toYaml .Values.gfd.resources | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.gfd.env }}
|
||||
env: {{ toYaml .Values.gfd.env | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.gfd.args }}
|
||||
args: {{ toYaml .Values.gfd.args | nindent 6 }}
|
||||
{{- end }}
|
||||
migManager:
|
||||
enabled: {{ .Values.migManager.enabled }}
|
||||
{{- if .Values.migManager.repository }}
|
||||
repository: {{ .Values.migManager.repository }}
|
||||
{{- end }}
|
||||
{{- if .Values.migManager.image }}
|
||||
image: {{ .Values.migManager.image }}
|
||||
{{- end }}
|
||||
{{- if .Values.migManager.version }}
|
||||
version: {{ .Values.migManager.version | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.migManager.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.migManager.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.migManager.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.migManager.imagePullSecrets | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.migManager.resources }}
|
||||
resources: {{ toYaml .Values.migManager.resources | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.migManager.env }}
|
||||
env: {{ toYaml .Values.migManager.env | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.migManager.args }}
|
||||
args: {{ toYaml .Values.migManager.args | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.migManager.config }}
|
||||
config:
|
||||
name: {{ .Values.migManager.config.name }}
|
||||
default: {{ .Values.migManager.config.default }}
|
||||
{{- end }}
|
||||
{{- if .Values.migManager.gpuClientsConfig }}
|
||||
gpuClientsConfig: {{ toYaml .Values.migManager.gpuClientsConfig | nindent 6 }}
|
||||
{{- end }}
|
||||
nodeStatusExporter:
|
||||
enabled: {{ .Values.nodeStatusExporter.enabled }}
|
||||
{{- if .Values.nodeStatusExporter.repository }}
|
||||
repository: {{ .Values.nodeStatusExporter.repository }}
|
||||
{{- end }}
|
||||
{{- if .Values.nodeStatusExporter.image }}
|
||||
image: {{ .Values.nodeStatusExporter.image }}
|
||||
{{- end }}
|
||||
version: {{ .Values.nodeStatusExporter.version | default .Chart.AppVersion | quote }}
|
||||
{{- if .Values.nodeStatusExporter.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.nodeStatusExporter.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.nodeStatusExporter.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.nodeStatusExporter.imagePullSecrets | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.nodeStatusExporter.resources }}
|
||||
resources: {{ toYaml .Values.nodeStatusExporter.resources | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.nodeStatusExporter.env }}
|
||||
env: {{ toYaml .Values.nodeStatusExporter.env | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.nodeStatusExporter.args }}
|
||||
args: {{ toYaml .Values.nodeStatusExporter.args | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.gds.enabled }}
|
||||
gds:
|
||||
enabled: {{ .Values.gds.enabled }}
|
||||
{{- if .Values.gds.repository }}
|
||||
repository: {{ .Values.gds.repository }}
|
||||
{{- end }}
|
||||
{{- if .Values.gds.image }}
|
||||
image: {{ .Values.gds.image }}
|
||||
{{- end }}
|
||||
version: {{ .Values.gds.version | quote }}
|
||||
{{- if .Values.gds.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.gds.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.gds.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.gds.imagePullSecrets | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.gds.env }}
|
||||
env: {{ toYaml .Values.gds.env | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.gds.args }}
|
||||
args: {{ toYaml .Values.gds.args | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.gdrcopy }}
|
||||
gdrcopy:
|
||||
enabled: {{ .Values.gdrcopy.enabled | default false }}
|
||||
{{- if .Values.gdrcopy.repository }}
|
||||
repository: {{ .Values.gdrcopy.repository }}
|
||||
{{- end }}
|
||||
{{- if .Values.gdrcopy.image }}
|
||||
image: {{ .Values.gdrcopy.image }}
|
||||
{{- end }}
|
||||
version: {{ .Values.gdrcopy.version | quote }}
|
||||
{{- if .Values.gdrcopy.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.gdrcopy.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.gdrcopy.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.gdrcopy.imagePullSecrets | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.gdrcopy.env }}
|
||||
env: {{ toYaml .Values.gdrcopy.env | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.gdrcopy.args }}
|
||||
args: {{ toYaml .Values.gdrcopy.args | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
sandboxWorkloads:
|
||||
enabled: {{ .Values.sandboxWorkloads.enabled }}
|
||||
{{- if .Values.sandboxWorkloads.defaultWorkload }}
|
||||
defaultWorkload: {{ .Values.sandboxWorkloads.defaultWorkload }}
|
||||
{{- end }}
|
||||
sandboxDevicePlugin:
|
||||
{{- if .Values.sandboxDevicePlugin.enabled }}
|
||||
enabled: {{ .Values.sandboxDevicePlugin.enabled }}
|
||||
{{- end }}
|
||||
{{- if .Values.sandboxDevicePlugin.repository }}
|
||||
repository: {{ .Values.sandboxDevicePlugin.repository }}
|
||||
{{- end }}
|
||||
{{- if .Values.sandboxDevicePlugin.image }}
|
||||
image: {{ .Values.sandboxDevicePlugin.image }}
|
||||
{{- end }}
|
||||
{{- if .Values.sandboxDevicePlugin.version }}
|
||||
version: {{ .Values.sandboxDevicePlugin.version | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.sandboxDevicePlugin.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.sandboxDevicePlugin.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.sandboxDevicePlugin.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.sandboxDevicePlugin.imagePullSecrets | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.sandboxDevicePlugin.resources }}
|
||||
resources: {{ toYaml .Values.sandboxDevicePlugin.resources | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.sandboxDevicePlugin.env }}
|
||||
env: {{ toYaml .Values.sandboxDevicePlugin.env | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.sandboxDevicePlugin.args }}
|
||||
args: {{ toYaml .Values.sandboxDevicePlugin.args | nindent 6 }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,155 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: gpu-operator
|
||||
labels:
|
||||
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: "gpu-operator"
|
||||
rules:
|
||||
- apiGroups:
|
||||
- config.openshift.io
|
||||
resources:
|
||||
- clusterversions
|
||||
- proxies
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- image.openshift.io
|
||||
resources:
|
||||
- imagestreams
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- security.openshift.io
|
||||
resources:
|
||||
- securitycontextconstraints
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- use
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- clusterroles
|
||||
- clusterrolebindings
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods/eviction
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- daemonsets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- nvidia.com
|
||||
resources:
|
||||
- clusterpolicies
|
||||
- clusterpolicies/finalizers
|
||||
- clusterpolicies/status
|
||||
- nvidiadrivers
|
||||
- nvidiadrivers/finalizers
|
||||
- nvidiadrivers/status
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- scheduling.k8s.io
|
||||
resources:
|
||||
- priorityclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- apiGroups:
|
||||
- node.k8s.io
|
||||
resources:
|
||||
- runtimeclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- create
|
||||
- update
|
||||
- watch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- create
|
||||
{{- if .Values.operator.cleanupCRD }}
|
||||
- delete
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: gpu-operator
|
||||
labels:
|
||||
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: "gpu-operator"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: gpu-operator
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: gpu-operator
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
{{- if .Values.dcgmExporter.config }}
|
||||
{{- if and (.Values.dcgmExporter.config.create) (not (empty .Values.dcgmExporter.config.data)) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ .Values.dcgmExporter.config.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||
data:
|
||||
dcgm-metrics.csv: |
|
||||
{{- .Values.dcgmExporter.config.data | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
{{- if and (.Values.migManager.config.create) (not (empty .Values.migManager.config.data)) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ .Values.migManager.config.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||
data: {{ toYaml .Values.migManager.config.data | nindent 2 }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,107 @@
|
|||
{{- if .Values.nfd.nodefeaturerules }}
|
||||
apiVersion: nfd.k8s-sigs.io/v1alpha1
|
||||
kind: NodeFeatureRule
|
||||
metadata:
|
||||
name: nvidia-nfd-nodefeaturerules
|
||||
spec:
|
||||
rules:
|
||||
- name: "TDX rule"
|
||||
labels:
|
||||
tdx.enabled: "true"
|
||||
matchFeatures:
|
||||
- feature: cpu.security
|
||||
matchExpressions:
|
||||
tdx.enabled: {op: IsTrue}
|
||||
- name: "TDX total keys rule"
|
||||
extendedResources:
|
||||
tdx.total_keys: "@cpu.security.tdx.total_keys"
|
||||
matchFeatures:
|
||||
- feature: cpu.security
|
||||
matchExpressions:
|
||||
tdx.enabled: {op: IsTrue}
|
||||
- name: "SEV-SNP rule"
|
||||
labels:
|
||||
sev.snp.enabled: "true"
|
||||
matchFeatures:
|
||||
- feature: cpu.security
|
||||
matchExpressions:
|
||||
sev.snp.enabled:
|
||||
op: IsTrue
|
||||
- name: "SEV-ES rule"
|
||||
labels:
|
||||
sev.es.enabled: "true"
|
||||
matchFeatures:
|
||||
- feature: cpu.security
|
||||
matchExpressions:
|
||||
sev.es.enabled:
|
||||
op: IsTrue
|
||||
- name: SEV system capacities
|
||||
extendedResources:
|
||||
sev_asids: '@cpu.security.sev.asids'
|
||||
sev_es: '@cpu.security.sev.encrypted_state_ids'
|
||||
matchFeatures:
|
||||
- feature: cpu.security
|
||||
matchExpressions:
|
||||
sev.enabled:
|
||||
op: Exists
|
||||
- name: "NVIDIA H100"
|
||||
labels:
|
||||
"nvidia.com/gpu.H100": "true"
|
||||
"nvidia.com/gpu.family": "hopper"
|
||||
matchFeatures:
|
||||
- feature: pci.device
|
||||
matchExpressions:
|
||||
vendor: {op: In, value: ["10de"]}
|
||||
device: {op: In, value: ["2339"]}
|
||||
- name: "NVIDIA H100 PCIe"
|
||||
labels:
|
||||
"nvidia.com/gpu.H100.pcie": "true"
|
||||
"nvidia.com/gpu.family": "hopper"
|
||||
matchFeatures:
|
||||
- feature: pci.device
|
||||
matchExpressions:
|
||||
vendor: {op: In, value: ["10de"]}
|
||||
device: {op: In, value: ["2331"]}
|
||||
- name: "NVIDIA H100 80GB HBM3"
|
||||
labels:
|
||||
"nvidia.com/gpu.H100.HBM3": "true"
|
||||
"nvidia.com/gpu.family": "hopper"
|
||||
matchFeatures:
|
||||
- feature: pci.device
|
||||
matchExpressions:
|
||||
vendor: {op: In, value: ["10de"]}
|
||||
device: {op: In, value: ["2330"]}
|
||||
- name: "NVIDIA H800"
|
||||
labels:
|
||||
"nvidia.com/gpu.H800": "true"
|
||||
"nvidia.com/gpu.family": "hopper"
|
||||
matchFeatures:
|
||||
- feature: pci.device
|
||||
matchExpressions:
|
||||
vendor: {op: In, value: ["10de"]}
|
||||
device: {op: In, value: ["2324"]}
|
||||
- name: "NVIDIA H800 PCIE"
|
||||
labels:
|
||||
"nvidia.com/gpu.H800.pcie": "true"
|
||||
"nvidia.com/gpu.family": "hopper"
|
||||
matchFeatures:
|
||||
- feature: pci.device
|
||||
matchExpressions:
|
||||
vendor: {op: In, value: ["10de"]}
|
||||
device: {op: In, value: ["2322"]}
|
||||
- name: "NVIDIA CC Enabled"
|
||||
labels:
|
||||
"nvidia.com/cc.capable": "true"
|
||||
matchAny: # TDX/SEV + Hopper GPU
|
||||
- matchFeatures:
|
||||
- feature: rule.matched
|
||||
matchExpressions:
|
||||
nvidia.com/gpu.family: {op: In, value: ["hopper"]}
|
||||
sev.snp.enabled: {op: IsTrue}
|
||||
- matchFeatures:
|
||||
- feature: rule.matched
|
||||
matchExpressions:
|
||||
nvidia.com/gpu.family: {op: In, value: ["hopper"]}
|
||||
tdx.enabled: {op: IsTrue}
|
||||
{{- end }}
|
||||
|
||||
|
|
@ -0,0 +1,119 @@
|
|||
{{- if and .Values.driver.nvidiaDriverCRD.enabled .Values.driver.nvidiaDriverCRD.deployDefaultCR }}
|
||||
apiVersion: nvidia.com/v1alpha1
|
||||
kind: NVIDIADriver
|
||||
metadata:
|
||||
name: default
|
||||
spec:
|
||||
repository: {{ .Values.driver.repository }}
|
||||
image: {{ .Values.driver.image }}
|
||||
version: {{ .Values.driver.version }}
|
||||
kernelModuleType: {{ .Values.driver.kernelModuleType }}
|
||||
usePrecompiled: {{ .Values.driver.usePrecompiled }}
|
||||
driverType: {{ .Values.driver.nvidiaDriverCRD.driverType | default "gpu" }}
|
||||
{{- if .Values.daemonsets.annotations }}
|
||||
annotations: {{ toYaml .Values.daemonsets.annotations | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.daemonsets.labels }}
|
||||
labels: {{ toYaml .Values.daemonsets.labels | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.nvidiaDriverCRD.nodeSelector }}
|
||||
nodeSelector: {{ toYaml .Values.driver.nvidiaDriverCRD.nodeSelector | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.driver.imagePullSecrets | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.manager }}
|
||||
manager: {{ toYaml .Values.driver.manager | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.startupProbe }}
|
||||
startupProbe: {{ toYaml .Values.driver.startupProbe | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.livenessProbe }}
|
||||
livenessProbe: {{ toYaml .Values.driver.livenessProbe | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.readinessProbe }}
|
||||
readinessProbe: {{ toYaml .Values.driver.readinessProbe | nindent 4 }}
|
||||
{{- end }}
|
||||
rdma:
|
||||
enabled: {{ .Values.driver.rdma.enabled }}
|
||||
useHostMofed: {{ .Values.driver.rdma.useHostMofed }}
|
||||
{{- if .Values.daemonsets.tolerations }}
|
||||
tolerations: {{ toYaml .Values.daemonsets.tolerations | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.repoConfig.configMapName }}
|
||||
repoConfig:
|
||||
name: {{ .Values.driver.repoConfig.configMapName }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.certConfig.name }}
|
||||
certConfig:
|
||||
name: {{ .Values.driver.certConfig.name }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.licensingConfig.configMapName }}
|
||||
licensingConfig:
|
||||
name: {{ .Values.driver.licensingConfig.configMapName }}
|
||||
nlsEnabled: {{ .Values.driver.licensingConfig.nlsEnabled | default true }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.virtualTopology.config }}
|
||||
virtualTopologyConfig:
|
||||
name: {{ .Values.driver.virtualTopology.config }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.kernelModuleConfig.name }}
|
||||
kernelModuleConfig:
|
||||
name: {{ .Values.driver.kernelModuleConfig.name }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.resources }}
|
||||
resources: {{ toYaml .Values.driver.resources | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.env }}
|
||||
env: {{ toYaml .Values.driver.env | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.driver.args }}
|
||||
args: {{ toYaml .Values.driver.args | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.gds.enabled }}
|
||||
gds:
|
||||
enabled: {{ .Values.gds.enabled }}
|
||||
{{- if .Values.gds.repository }}
|
||||
repository: {{ .Values.gds.repository }}
|
||||
{{- end }}
|
||||
{{- if .Values.gds.image }}
|
||||
image: {{ .Values.gds.image }}
|
||||
{{- end }}
|
||||
version: {{ .Values.gds.version | quote }}
|
||||
{{- if .Values.gds.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.gds.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.gds.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.gds.imagePullSecrets | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.gds.env }}
|
||||
env: {{ toYaml .Values.gds.env | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.gds.args }}
|
||||
args: {{ toYaml .Values.gds.args | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.gdrcopy }}
|
||||
gdrcopy:
|
||||
enabled: {{ .Values.gdrcopy.enabled | default false }}
|
||||
{{- if .Values.gdrcopy.repository }}
|
||||
repository: {{ .Values.gdrcopy.repository }}
|
||||
{{- end }}
|
||||
{{- if .Values.gdrcopy.image }}
|
||||
image: {{ .Values.gdrcopy.image }}
|
||||
{{- end }}
|
||||
version: {{ .Values.gdrcopy.version | quote }}
|
||||
{{- if .Values.gdrcopy.imagePullPolicy }}
|
||||
imagePullPolicy: {{ .Values.gdrcopy.imagePullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.gdrcopy.imagePullSecrets }}
|
||||
imagePullSecrets: {{ toYaml .Values.gdrcopy.imagePullSecrets | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.gdrcopy.env }}
|
||||
env: {{ toYaml .Values.gdrcopy.env | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.gdrcopy.args }}
|
||||
args: {{ toYaml .Values.gdrcopy.args | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,99 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: gpu-operator
|
||||
labels:
|
||||
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: "gpu-operator"
|
||||
nvidia.com/gpu-driver-upgrade-drain.skip: "true"
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: "gpu-operator"
|
||||
app: "gpu-operator"
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "gpu-operator.labels" . | nindent 8 }}
|
||||
app.kubernetes.io/component: "gpu-operator"
|
||||
app: "gpu-operator"
|
||||
nvidia.com/gpu-driver-upgrade-drain.skip: "true"
|
||||
annotations:
|
||||
{{- toYaml .Values.operator.annotations | nindent 8 }}
|
||||
spec:
|
||||
serviceAccountName: gpu-operator
|
||||
{{- if .Values.operator.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.operator.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.operator.priorityClassName }}
|
||||
priorityClassName: {{ .Values.operator.priorityClassName }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: gpu-operator
|
||||
image: {{ include "gpu-operator.fullimage" . }}
|
||||
imagePullPolicy: {{ .Values.operator.imagePullPolicy }}
|
||||
command: ["gpu-operator"]
|
||||
args:
|
||||
- --leader-elect
|
||||
{{- if .Values.operator.logging.develMode }}
|
||||
- --zap-devel
|
||||
{{- else }}
|
||||
{{- if .Values.operator.logging.timeEncoding }}
|
||||
- --zap-time-encoding={{- .Values.operator.logging.timeEncoding }}
|
||||
{{- end }}
|
||||
{{- if .Values.operator.logging.level }}
|
||||
- --zap-log-level={{- .Values.operator.logging.level }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: WATCH_NAMESPACE
|
||||
value: ""
|
||||
- name: OPERATOR_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: "DRIVER_MANAGER_IMAGE"
|
||||
value: "{{ include "driver-manager.fullimage" . }}"
|
||||
volumeMounts:
|
||||
- name: host-os-release
|
||||
mountPath: "/host-etc/os-release"
|
||||
readOnly: true
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8081
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 8081
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
{{- with .Values.operator.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: 8080
|
||||
volumes:
|
||||
- name: host-os-release
|
||||
hostPath:
|
||||
path: "/etc/os-release"
|
||||
{{- with .Values.operator.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.operator.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.operator.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
{{- if and (.Values.devicePlugin.config.create) (not (empty .Values.devicePlugin.config.data)) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ .Values.devicePlugin.config.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||
data: {{ toYaml .Values.devicePlugin.config.data | nindent 2 }}
|
||||
{{- end }}
|
||||
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
{{- if .Values.platform.openshift }}
|
||||
apiVersion: security.openshift.io/v1
|
||||
kind: SecurityContextConstraints
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: "gpu-operator"
|
||||
annotations:
|
||||
kubernetes.io/description: restricted denies access to all host features and requires
|
||||
pods to be run with a UID, read-only root filesystem and SELinux context that are
|
||||
allocated to the namespace. This SCC is more restrictive than the default
|
||||
restrictive SCC and it is used by default for authenticated users and operators and operands.
|
||||
name: restricted-readonly
|
||||
allowHostDirVolumePlugin: false
|
||||
allowHostIPC: false
|
||||
allowHostNetwork: false
|
||||
allowHostPID: false
|
||||
allowHostPorts: false
|
||||
allowPrivilegeEscalation: true
|
||||
allowPrivilegedContainer: false
|
||||
allowedCapabilities: []
|
||||
defaultAddCapabilities: []
|
||||
fsGroup:
|
||||
type: MustRunAs
|
||||
groups:
|
||||
- system:authenticated
|
||||
priority: 0
|
||||
readOnlyRootFilesystem: true
|
||||
requiredDropCapabilities:
|
||||
- KILL
|
||||
- MKNOD
|
||||
- SETUID
|
||||
- SETGID
|
||||
runAsUser:
|
||||
type: MustRunAsRange
|
||||
seLinuxContext:
|
||||
type: MustRunAs
|
||||
supplementalGroups:
|
||||
type: RunAsAny
|
||||
users:
|
||||
- system:serviceaccount:{{ $.Release.Namespace }}:gpu-operator
|
||||
volumes:
|
||||
- configMap
|
||||
- downwardAPI
|
||||
- emptyDir
|
||||
- persistentVolumeClaim
|
||||
- projected
|
||||
- secret
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,84 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: gpu-operator
|
||||
labels:
|
||||
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: "gpu-operator"
|
||||
rules:
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- roles
|
||||
- rolebindings
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- controllerrevisions
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- daemonsets
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- endpoints
|
||||
- pods
|
||||
- pods/eviction
|
||||
- secrets
|
||||
- services
|
||||
- services/finalizers
|
||||
- serviceaccounts
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- monitoring.coreos.com
|
||||
resources:
|
||||
- servicemonitors
|
||||
- prometheusrules
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- create
|
||||
- watch
|
||||
- update
|
||||
- delete
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
kind: RoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: gpu-operator
|
||||
labels:
|
||||
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: "gpu-operator"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: gpu-operator
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: gpu-operator
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: gpu-operator
|
||||
labels:
|
||||
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: "gpu-operator"
|
||||
|
|
@ -0,0 +1,95 @@
|
|||
{{- if .Values.operator.upgradeCRD }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: gpu-operator-upgrade-crd-hook-sa
|
||||
annotations:
|
||||
helm.sh/hook: pre-upgrade
|
||||
helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation
|
||||
helm.sh/hook-weight: "0"
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: gpu-operator-upgrade-crd-hook-role
|
||||
annotations:
|
||||
helm.sh/hook: pre-upgrade
|
||||
helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation
|
||||
helm.sh/hook-weight: "0"
|
||||
rules:
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- patch
|
||||
- update
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: gpu-operator-upgrade-crd-hook-binding
|
||||
annotations:
|
||||
helm.sh/hook: pre-upgrade
|
||||
helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation
|
||||
helm.sh/hook-weight: "0"
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: gpu-operator-upgrade-crd-hook-sa
|
||||
namespace: {{ .Release.Namespace }}
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: gpu-operator-upgrade-crd-hook-role
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: gpu-operator-upgrade-crd
|
||||
namespace: {{ .Release.Namespace }}
|
||||
annotations:
|
||||
"helm.sh/hook": pre-upgrade
|
||||
"helm.sh/hook-weight": "1"
|
||||
"helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
|
||||
labels:
|
||||
{{- include "gpu-operator.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: "gpu-operator"
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
name: gpu-operator-upgrade-crd
|
||||
labels:
|
||||
{{- include "gpu-operator.labels" . | nindent 8 }}
|
||||
app.kubernetes.io/component: "gpu-operator"
|
||||
spec:
|
||||
serviceAccountName: gpu-operator-upgrade-crd-hook-sa
|
||||
{{- if .Values.operator.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.operator.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.operator.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: upgrade-crd
|
||||
image: {{ include "gpu-operator.fullimage" . }}
|
||||
imagePullPolicy: {{ .Values.operator.imagePullPolicy }}
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- >
|
||||
kubectl apply -f /opt/gpu-operator/nvidia.com_clusterpolicies.yaml;
|
||||
kubectl apply -f /opt/gpu-operator/nvidia.com_nvidiadrivers.yaml;
|
||||
{{- if .Values.nfd.enabled }}
|
||||
kubectl apply -f /opt/gpu-operator/nfd-api-crds.yaml;
|
||||
{{- end }}
|
||||
restartPolicy: OnFailure
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,605 @@
|
|||
# Default values for gpu-operator.
|
||||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
|
||||
platform:
|
||||
openshift: false
|
||||
|
||||
nfd:
|
||||
enabled: true
|
||||
nodefeaturerules: false
|
||||
|
||||
psa:
|
||||
enabled: false
|
||||
|
||||
cdi:
|
||||
enabled: true
|
||||
default: true
|
||||
|
||||
sandboxWorkloads:
|
||||
enabled: false
|
||||
defaultWorkload: "container"
|
||||
|
||||
hostPaths:
|
||||
# rootFS represents the path to the root filesystem of the host.
|
||||
# This is used by components that need to interact with the host filesystem
|
||||
# and as such this must be a chroot-able filesystem.
|
||||
# Examples include the MIG Manager and Toolkit Container which may need to
|
||||
# stop, start, or restart systemd services
|
||||
rootFS: "/"
|
||||
|
||||
# driverInstallDir represents the root at which driver files including libraries,
|
||||
# config files, and executables can be found.
|
||||
driverInstallDir: "/run/nvidia/driver"
|
||||
|
||||
daemonsets:
|
||||
labels: {}
|
||||
annotations: {}
|
||||
priorityClassName: system-node-critical
|
||||
tolerations:
|
||||
- key: nvidia.com/gpu
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
# configuration for controlling update strategy("OnDelete" or "RollingUpdate") of GPU Operands
|
||||
# note that driver Daemonset is always set with OnDelete to avoid unintended disruptions
|
||||
updateStrategy: "RollingUpdate"
|
||||
# configuration for controlling rolling update of GPU Operands
|
||||
rollingUpdate:
|
||||
# maximum number of nodes to simultaneously apply pod updates on.
|
||||
# can be specified either as number or percentage of nodes. Default 1.
|
||||
maxUnavailable: "1"
|
||||
|
||||
validator:
|
||||
repository: nvcr.io/nvidia/cloud-native
|
||||
image: gpu-operator-validator
|
||||
# If version is not specified, then default is to use chart.AppVersion
|
||||
#version: ""
|
||||
imagePullPolicy: IfNotPresent
|
||||
imagePullSecrets: []
|
||||
env: []
|
||||
args: []
|
||||
resources: {}
|
||||
plugin:
|
||||
env:
|
||||
- name: WITH_WORKLOAD
|
||||
value: "false"
|
||||
|
||||
operator:
|
||||
repository: nvcr.io/nvidia
|
||||
image: gpu-operator
|
||||
# If version is not specified, then default is to use chart.AppVersion
|
||||
#version: ""
|
||||
imagePullPolicy: IfNotPresent
|
||||
imagePullSecrets: []
|
||||
priorityClassName: system-node-critical
|
||||
runtimeClass: nvidia
|
||||
use_ocp_driver_toolkit: false
|
||||
# cleanup CRD on chart un-install
|
||||
cleanupCRD: false
|
||||
# upgrade CRD on chart upgrade, requires --disable-openapi-validation flag
|
||||
# to be passed during helm upgrade.
|
||||
upgradeCRD: true
|
||||
initContainer:
|
||||
image: cuda
|
||||
repository: nvcr.io/nvidia
|
||||
version: 12.8.1-base-ubi9
|
||||
imagePullPolicy: IfNotPresent
|
||||
tolerations:
|
||||
- key: "node-role.kubernetes.io/master"
|
||||
operator: "Equal"
|
||||
value: ""
|
||||
effect: "NoSchedule"
|
||||
- key: "node-role.kubernetes.io/control-plane"
|
||||
operator: "Equal"
|
||||
value: ""
|
||||
effect: "NoSchedule"
|
||||
annotations:
|
||||
openshift.io/scc: restricted-readonly
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 1
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: "node-role.kubernetes.io/master"
|
||||
operator: In
|
||||
values: [""]
|
||||
- weight: 1
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: "node-role.kubernetes.io/control-plane"
|
||||
operator: In
|
||||
values: [""]
|
||||
logging:
|
||||
# Zap time encoding (one of 'epoch', 'millis', 'nano', 'iso8601', 'rfc3339' or 'rfc3339nano')
|
||||
timeEncoding: epoch
|
||||
# Zap Level to configure the verbosity of logging. Can be one of 'debug', 'info', 'error', or any integer value > 0 which corresponds to custom debug levels of increasing verbosity
|
||||
level: info
|
||||
# Development Mode defaults(encoder=consoleEncoder,logLevel=Debug,stackTraceLevel=Warn)
|
||||
# Production Mode defaults(encoder=jsonEncoder,logLevel=Info,stackTraceLevel=Error)
|
||||
develMode: false
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 350Mi
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 100Mi
|
||||
|
||||
mig:
|
||||
strategy: single
|
||||
|
||||
driver:
|
||||
enabled: true
|
||||
nvidiaDriverCRD:
|
||||
enabled: false
|
||||
deployDefaultCR: true
|
||||
driverType: gpu
|
||||
nodeSelector: {}
|
||||
kernelModuleType: "auto"
|
||||
|
||||
# NOTE: useOpenKernelModules has been deprecated and made no-op. Please use kernelModuleType instead.
|
||||
# useOpenKernelModules: false
|
||||
|
||||
# use pre-compiled packages for NVIDIA driver installation.
|
||||
# only supported for as a tech-preview feature on ubuntu22.04 kernels.
|
||||
usePrecompiled: false
|
||||
repository: nvcr.io/nvidia
|
||||
image: driver
|
||||
version: "570.124.06"
|
||||
imagePullPolicy: IfNotPresent
|
||||
imagePullSecrets: []
|
||||
startupProbe:
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
# nvidia-smi can take longer than 30s in some cases
|
||||
# ensure enough timeout is set
|
||||
timeoutSeconds: 60
|
||||
failureThreshold: 120
|
||||
rdma:
|
||||
enabled: false
|
||||
useHostMofed: false
|
||||
upgradePolicy:
|
||||
# global switch for automatic upgrade feature
|
||||
# if set to false all other options are ignored
|
||||
autoUpgrade: true
|
||||
# how many nodes can be upgraded in parallel
|
||||
# 0 means no limit, all nodes will be upgraded in parallel
|
||||
maxParallelUpgrades: 1
|
||||
# maximum number of nodes with the driver installed, that can be unavailable during
|
||||
# the upgrade. Value can be an absolute number (ex: 5) or
|
||||
# a percentage of total nodes at the start of upgrade (ex:
|
||||
# 10%). Absolute number is calculated from percentage by rounding
|
||||
# up. By default, a fixed value of 25% is used.'
|
||||
maxUnavailable: 25%
|
||||
# options for waiting on pod(job) completions
|
||||
waitForCompletion:
|
||||
timeoutSeconds: 0
|
||||
podSelector: ""
|
||||
# options for gpu pod deletion
|
||||
gpuPodDeletion:
|
||||
force: false
|
||||
timeoutSeconds: 300
|
||||
deleteEmptyDir: false
|
||||
# options for node drain (`kubectl drain`) before the driver reload
|
||||
# this is required only if default GPU pod deletions done by the operator
|
||||
# are not sufficient to re-install the driver
|
||||
drain:
|
||||
enable: false
|
||||
force: false
|
||||
podSelector: ""
|
||||
# It's recommended to set a timeout to avoid infinite drain in case non-fatal error keeps happening on retries
|
||||
timeoutSeconds: 300
|
||||
deleteEmptyDir: false
|
||||
manager:
|
||||
image: k8s-driver-manager
|
||||
repository: nvcr.io/nvidia/cloud-native
|
||||
# When choosing a different version of k8s-driver-manager, DO NOT downgrade to a version lower than v0.6.4
|
||||
# to ensure k8s-driver-manager stays compatible with gpu-operator starting from v24.3.0
|
||||
version: v0.8.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: ENABLE_GPU_POD_EVICTION
|
||||
value: "true"
|
||||
- name: ENABLE_AUTO_DRAIN
|
||||
value: "false"
|
||||
- name: DRAIN_USE_FORCE
|
||||
value: "false"
|
||||
- name: DRAIN_POD_SELECTOR_LABEL
|
||||
value: ""
|
||||
- name: DRAIN_TIMEOUT_SECONDS
|
||||
value: "0s"
|
||||
- name: DRAIN_DELETE_EMPTYDIR_DATA
|
||||
value: "false"
|
||||
env: []
|
||||
resources: {}
|
||||
# Private mirror repository configuration
|
||||
repoConfig:
|
||||
configMapName: ""
|
||||
# custom ssl key/certificate configuration
|
||||
certConfig:
|
||||
name: ""
|
||||
# vGPU licensing configuration
|
||||
licensingConfig:
|
||||
configMapName: ""
|
||||
nlsEnabled: true
|
||||
# vGPU topology daemon configuration
|
||||
virtualTopology:
|
||||
config: ""
|
||||
# kernel module configuration for NVIDIA driver
|
||||
kernelModuleConfig:
|
||||
name: ""
|
||||
|
||||
toolkit:
|
||||
enabled: true
|
||||
repository: nvcr.io/nvidia/k8s
|
||||
image: container-toolkit
|
||||
version: v1.17.5-ubuntu20.04
|
||||
imagePullPolicy: IfNotPresent
|
||||
imagePullSecrets: []
|
||||
env: []
|
||||
resources: {}
|
||||
installDir: "/usr/local/nvidia"
|
||||
|
||||
devicePlugin:
|
||||
enabled: true
|
||||
repository: nvcr.io/nvidia
|
||||
image: k8s-device-plugin
|
||||
version: v0.17.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
imagePullSecrets: []
|
||||
args: []
|
||||
env:
|
||||
- name: PASS_DEVICE_SPECS
|
||||
value: "true"
|
||||
- name: FAIL_ON_INIT_ERROR
|
||||
value: "true"
|
||||
- name: DEVICE_LIST_STRATEGY
|
||||
value: envvar
|
||||
- name: DEVICE_ID_STRATEGY
|
||||
value: uuid
|
||||
- name: NVIDIA_VISIBLE_DEVICES
|
||||
value: all
|
||||
- name: NVIDIA_DRIVER_CAPABILITIES
|
||||
value: all
|
||||
resources: {}
|
||||
# Plugin configuration
|
||||
# Use "name" to either point to an existing ConfigMap or to create a new one with a list of configurations(i.e with create=true).
|
||||
# Use "data" to build an integrated ConfigMap from a set of configurations as
|
||||
# part of this helm chart. An example of setting "data" might be:
|
||||
# config:
|
||||
# name: device-plugin-config
|
||||
# create: true
|
||||
# data:
|
||||
# default: |-
|
||||
# version: v1
|
||||
# flags:
|
||||
# migStrategy: none
|
||||
# mig-single: |-
|
||||
# version: v1
|
||||
# flags:
|
||||
# migStrategy: single
|
||||
# mig-mixed: |-
|
||||
# version: v1
|
||||
# flags:
|
||||
# migStrategy: mixed
|
||||
config:
|
||||
# Create a ConfigMap (default: false)
|
||||
create: false
|
||||
# ConfigMap name (either existing or to create a new one with create=true above)
|
||||
name: ""
|
||||
# Default config name within the ConfigMap
|
||||
default: ""
|
||||
# Data section for the ConfigMap to create (i.e only applies when create=true)
|
||||
data: {}
|
||||
# MPS related configuration for the plugin
|
||||
mps:
|
||||
# MPS root path on the host
|
||||
root: "/run/nvidia/mps"
|
||||
|
||||
# standalone dcgm hostengine
|
||||
dcgm:
|
||||
# disabled by default to use embedded nv-hostengine by exporter
|
||||
enabled: false
|
||||
repository: nvcr.io/nvidia/cloud-native
|
||||
image: dcgm
|
||||
version: 4.1.1-2-ubuntu22.04
|
||||
imagePullPolicy: IfNotPresent
|
||||
args: []
|
||||
env: []
|
||||
resources: {}
|
||||
|
||||
dcgmExporter:
|
||||
enabled: true
|
||||
repository: nvcr.io/nvidia/k8s
|
||||
image: dcgm-exporter
|
||||
version: 4.1.1-4.0.4-ubuntu22.04
|
||||
imagePullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: DCGM_EXPORTER_LISTEN
|
||||
value: ":9400"
|
||||
- name: DCGM_EXPORTER_KUBERNETES
|
||||
value: "true"
|
||||
- name: DCGM_EXPORTER_COLLECTORS
|
||||
value: "/etc/dcgm-exporter/dcp-metrics-included.csv"
|
||||
resources: {}
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
interval: 15s
|
||||
honorLabels: false
|
||||
additionalLabels: {}
|
||||
relabelings: []
|
||||
# - source_labels:
|
||||
# - __meta_kubernetes_pod_node_name
|
||||
# regex: (.*)
|
||||
# target_label: instance
|
||||
# replacement: $1
|
||||
# action: replace
|
||||
# DCGM Exporter configuration
|
||||
# This block is used to configure DCGM Exporter to emit a customized list of metrics.
|
||||
# Use "name" to either point to an existing ConfigMap or to create a new one with a
|
||||
# list of configurations (i.e with create=true).
|
||||
# When pointing to an existing ConfigMap, the ConfigMap must exist in the same namespace as the release.
|
||||
# The metrics are expected to be listed under a key called `dcgm-metrics.csv`.
|
||||
# Use "data" to build an integrated ConfigMap from a set of custom metrics as
|
||||
# part of the chart. An example of some custom metrics are shown below. Note that
|
||||
# the contents of "data" must be in CSV format and be valid DCGM Exporter metric configurations.
|
||||
# config:
|
||||
# name: custom-dcgm-exporter-metrics
|
||||
# create: true
|
||||
# data: |-
|
||||
# Format
|
||||
# If line starts with a '#' it is considered a comment
|
||||
# DCGM FIELD, Prometheus metric type, help message
|
||||
|
||||
# Clocks
|
||||
# DCGM_FI_DEV_SM_CLOCK, gauge, SM clock frequency (in MHz).
|
||||
# DCGM_FI_DEV_MEM_CLOCK, gauge, Memory clock frequency (in MHz).
|
||||
gfd:
|
||||
enabled: true
|
||||
repository: nvcr.io/nvidia
|
||||
image: k8s-device-plugin
|
||||
version: v0.17.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
imagePullSecrets: []
|
||||
env:
|
||||
- name: GFD_SLEEP_INTERVAL
|
||||
value: 60s
|
||||
- name: GFD_FAIL_ON_INIT_ERROR
|
||||
value: "true"
|
||||
resources: {}
|
||||
|
||||
migManager:
|
||||
enabled: true
|
||||
repository: nvcr.io/nvidia/cloud-native
|
||||
image: k8s-mig-manager
|
||||
version: v0.12.1-ubuntu20.04
|
||||
imagePullPolicy: IfNotPresent
|
||||
imagePullSecrets: []
|
||||
env:
|
||||
- name: WITH_REBOOT
|
||||
value: "false"
|
||||
resources: {}
|
||||
# MIG configuration
|
||||
# Use "name" to either point to an existing ConfigMap or to create a new one with a list of configurations(i.e with create=true).
|
||||
# Use "data" to build an integrated ConfigMap from a set of configurations as
|
||||
# part of this helm chart. An example of setting "data" might be:
|
||||
# config:
|
||||
# name: custom-mig-parted-configs
|
||||
# create: true
|
||||
# data:
|
||||
# config.yaml: |-
|
||||
# version: v1
|
||||
# mig-configs:
|
||||
# all-disabled:
|
||||
# - devices: all
|
||||
# mig-enabled: false
|
||||
# custom-mig:
|
||||
# - devices: [0]
|
||||
# mig-enabled: false
|
||||
# - devices: [1]
|
||||
# mig-enabled: true
|
||||
# mig-devices:
|
||||
# "1g.10gb": 7
|
||||
# - devices: [2]
|
||||
# mig-enabled: true
|
||||
# mig-devices:
|
||||
# "2g.20gb": 2
|
||||
# "3g.40gb": 1
|
||||
# - devices: [3]
|
||||
# mig-enabled: true
|
||||
# mig-devices:
|
||||
# "3g.40gb": 1
|
||||
# "4g.40gb": 1
|
||||
config:
|
||||
default: "all-disabled"
|
||||
# Create a ConfigMap (default: false)
|
||||
create: false
|
||||
# ConfigMap name (either existing or to create a new one with create=true above)
|
||||
name: ""
|
||||
# Data section for the ConfigMap to create (i.e only applies when create=true)
|
||||
data: {}
|
||||
gpuClientsConfig:
|
||||
name: ""
|
||||
|
||||
nodeStatusExporter:
|
||||
enabled: false
|
||||
repository: nvcr.io/nvidia/cloud-native
|
||||
image: gpu-operator-validator
|
||||
# If version is not specified, then default is to use chart.AppVersion
|
||||
#version: ""
|
||||
imagePullPolicy: IfNotPresent
|
||||
imagePullSecrets: []
|
||||
resources: {}
|
||||
|
||||
gds:
|
||||
enabled: false
|
||||
repository: nvcr.io/nvidia/cloud-native
|
||||
image: nvidia-fs
|
||||
version: "2.20.5"
|
||||
imagePullPolicy: IfNotPresent
|
||||
imagePullSecrets: []
|
||||
env: []
|
||||
args: []
|
||||
|
||||
gdrcopy:
|
||||
enabled: false
|
||||
repository: nvcr.io/nvidia/cloud-native
|
||||
image: gdrdrv
|
||||
version: "v2.4.4"
|
||||
imagePullPolicy: IfNotPresent
|
||||
imagePullSecrets: []
|
||||
env: []
|
||||
args: []
|
||||
|
||||
vgpuManager:
|
||||
enabled: false
|
||||
repository: ""
|
||||
image: vgpu-manager
|
||||
version: ""
|
||||
imagePullPolicy: IfNotPresent
|
||||
imagePullSecrets: []
|
||||
env: []
|
||||
resources: {}
|
||||
driverManager:
|
||||
image: k8s-driver-manager
|
||||
repository: nvcr.io/nvidia/cloud-native
|
||||
# When choosing a different version of k8s-driver-manager, DO NOT downgrade to a version lower than v0.6.4
|
||||
# to ensure k8s-driver-manager stays compatible with gpu-operator starting from v24.3.0
|
||||
version: v0.8.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: ENABLE_GPU_POD_EVICTION
|
||||
value: "false"
|
||||
- name: ENABLE_AUTO_DRAIN
|
||||
value: "false"
|
||||
|
||||
vgpuDeviceManager:
|
||||
enabled: true
|
||||
repository: nvcr.io/nvidia/cloud-native
|
||||
image: vgpu-device-manager
|
||||
version: v0.3.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
imagePullSecrets: []
|
||||
env: []
|
||||
config:
|
||||
name: ""
|
||||
default: "default"
|
||||
|
||||
vfioManager:
|
||||
enabled: true
|
||||
repository: nvcr.io/nvidia
|
||||
image: cuda
|
||||
version: 12.8.1-base-ubi9
|
||||
imagePullPolicy: IfNotPresent
|
||||
imagePullSecrets: []
|
||||
env: []
|
||||
resources: {}
|
||||
driverManager:
|
||||
image: k8s-driver-manager
|
||||
repository: nvcr.io/nvidia/cloud-native
|
||||
# When choosing a different version of k8s-driver-manager, DO NOT downgrade to a version lower than v0.6.4
|
||||
# to ensure k8s-driver-manager stays compatible with gpu-operator starting from v24.3.0
|
||||
version: v0.8.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: ENABLE_GPU_POD_EVICTION
|
||||
value: "false"
|
||||
- name: ENABLE_AUTO_DRAIN
|
||||
value: "false"
|
||||
|
||||
kataManager:
|
||||
enabled: false
|
||||
config:
|
||||
artifactsDir: "/opt/nvidia-gpu-operator/artifacts/runtimeclasses"
|
||||
runtimeClasses:
|
||||
- name: kata-nvidia-gpu
|
||||
nodeSelector: {}
|
||||
artifacts:
|
||||
url: nvcr.io/nvidia/cloud-native/kata-gpu-artifacts:ubuntu22.04-535.54.03
|
||||
pullSecret: ""
|
||||
- name: kata-nvidia-gpu-snp
|
||||
nodeSelector:
|
||||
"nvidia.com/cc.capable": "true"
|
||||
artifacts:
|
||||
url: nvcr.io/nvidia/cloud-native/kata-gpu-artifacts:ubuntu22.04-535.86.10-snp
|
||||
pullSecret: ""
|
||||
repository: nvcr.io/nvidia/cloud-native
|
||||
image: k8s-kata-manager
|
||||
version: v0.2.3
|
||||
imagePullPolicy: IfNotPresent
|
||||
imagePullSecrets: []
|
||||
env: []
|
||||
resources: {}
|
||||
|
||||
sandboxDevicePlugin:
|
||||
enabled: true
|
||||
repository: nvcr.io/nvidia
|
||||
image: kubevirt-gpu-device-plugin
|
||||
version: v1.3.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
imagePullSecrets: []
|
||||
args: []
|
||||
env: []
|
||||
resources: {}
|
||||
|
||||
ccManager:
|
||||
enabled: false
|
||||
defaultMode: "off"
|
||||
repository: nvcr.io/nvidia/cloud-native
|
||||
image: k8s-cc-manager
|
||||
version: v0.1.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
imagePullSecrets: []
|
||||
env:
|
||||
- name: CC_CAPABLE_DEVICE_IDS
|
||||
value: "0x2339,0x2331,0x2330,0x2324,0x2322,0x233d"
|
||||
resources: {}
|
||||
|
||||
node-feature-discovery:
|
||||
enableNodeFeatureApi: true
|
||||
priorityClassName: system-node-critical
|
||||
gc:
|
||||
enable: true
|
||||
replicaCount: 1
|
||||
serviceAccount:
|
||||
name: node-feature-discovery
|
||||
create: false
|
||||
worker:
|
||||
serviceAccount:
|
||||
name: node-feature-discovery
|
||||
# disable creation to avoid duplicate serviceaccount creation by master spec below
|
||||
create: false
|
||||
tolerations:
|
||||
- key: "node-role.kubernetes.io/master"
|
||||
operator: "Equal"
|
||||
value: ""
|
||||
effect: "NoSchedule"
|
||||
- key: "node-role.kubernetes.io/control-plane"
|
||||
operator: "Equal"
|
||||
value: ""
|
||||
effect: "NoSchedule"
|
||||
- key: nvidia.com/gpu
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
config:
|
||||
sources:
|
||||
pci:
|
||||
deviceClassWhitelist:
|
||||
- "02"
|
||||
- "0200"
|
||||
- "0207"
|
||||
- "0300"
|
||||
- "0302"
|
||||
deviceLabelFields:
|
||||
- vendor
|
||||
master:
|
||||
serviceAccount:
|
||||
name: node-feature-discovery
|
||||
create: true
|
||||
config:
|
||||
extraLabelNs: ["nvidia.com"]
|
||||
# noPublish: false
|
||||
# resourceLabels: ["nvidia.com/feature-1","nvidia.com/feature-2"]
|
||||
# enableTaints: false
|
||||
# labelWhiteList: "nvidia.com/gpu"
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: harbor-cacerts
|
||||
namespace: harbor
|
||||
# harbor-corer pod // /etc/core/ca
|
||||
data:
|
||||
cert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURtekNDQW9PZ0F3SUJBZ0lVTFVnOHBsdGlSTDVqSVhzL1ppQ1pacmtncElRd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1hURUxNQWtHQTFVRUJoTUNTMUl4RGpBTUJnTlZCQWdNQlZObGIzVnNNUTB3Q3dZRFZRUUhEQVJKYm1wbApNUTh3RFFZRFZRUUtEQVpwYm1OdmNuQXhEREFLQmdOVkJBc01BMlJsZGpFUU1BNEdBMVVFQXd3SGFXNXFaV2x1Cll6QWVGdzB5TkRFeU1ESXdORFEwTlRkYUZ3MHlOakV5TURJd05EUTBOVGRhTUYweEN6QUpCZ05WQkFZVEFrdFMKTVE0d0RBWURWUVFJREFWVFpXOTFiREVOTUFzR0ExVUVCd3dFU1c1cVpURVBNQTBHQTFVRUNnd0dhVzVqYjNKdwpNUXd3Q2dZRFZRUUxEQU5rWlhZeEVEQU9CZ05WQkFNTUIybHVhbVZwYm1Nd2dnRWlNQTBHQ1NxR1NJYjNEUUVCCkFRVUFBNElCRHdBd2dnRUtBb0lCQVFERmVDRU1iM3Yrbmt1OUJic1FVdUt5dGJabUN5MTdPcDZSTGxmWEZaSTAKbUxLRjZadTlTczh0cmV0VDA3eHZrY2x2YzF4b2ZJMlFWMVFmSkFDQmhqU0FaWUJTbWZhNE5oWExnNEYvcEFSQQpjbStINnR2TGtSNllvZVMvWXVJUDVQVXVxWmt6Ym9ZQWl5T0NUelYxNEhRb25OU20rOFZvSnNMemEwZEZZZklNCmtGOVVsMklFSERmQ2xrQWt1cDNFYlNyMkNTYXdLV3J4OXd2N2cvbXR3ekloL0MwKy81MXh2dFZSSVVUZk1qQlIKUVVWL1VBWEJhS0UvNHlwN1RZaWpHa21WUEJUVTRid2hmcHdNeklUMWxpSjhwaE1qTGZtbDMxd1Q5R1FWYnhyMgpXOU5NdnFQWklMVmx6c1VUcTJyOU13TU8rQ3VreVNWbWRBOXgwenc1MUNGZkFnTUJBQUdqVXpCUk1CMEdBMVVkCkRnUVdCQlFsTWo0YzFmMjg1bmlHREJRcmNlYUp5MDJtalRBZkJnTlZIU01FR0RBV2dCUWxNajRjMWYyODVuaUcKREJRcmNlYUp5MDJtalRBUEJnTlZIUk1CQWY4RUJUQURBUUgvTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFBTgpBZ0R1OEY3SGVWakZ4bU11NGZZVWZrN0czU1ZObWdacXo0MzhNanhjS2dJYmR6NnE1Q0xTNW1hSng0RitVc2VPCjZaZHBEQm1GSncrK1E4QVUvQ0tLY3dOZC83eGRzSEhEUFY0MFNNVStLc08xT0FJZjBIeFZXV3lFd0VRaW1obFgKWEJBZVJocEF5NHFTNTI1dE11RnUxeFkxOVJJME1VRlpmV05JUW1OZ0N5QWRINkIyY3Z5dmhSU2crRXdhYnV6RQpkdmN6R3JOZm1tUGphMXRZTnBQWGFpQ0hGc2h2QzlJMzZwOEhuYjNKY3VsVSswL2Y3UzRWZGhSTm1nakY1elhMCkl6Wk1TbXhnMnVmc25DNHFhS3FONU9ISi9NbGJIYTRzRFR0cHNLaWNBWUE3aUw2WjFvcmtIeTc1cUdYVlRtekMKU2xkbkxwQWw2cS9wUXg1bUpVdEwKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: harbor-core
|
||||
namespace: harbor
|
||||
type: Opaque
|
||||
data:
|
||||
CSRF_KEY: Tk9ORjNTYjZoZ2tIdlZmcXNlcTVEdjNhUlBjWDZ6Rjg=
|
||||
HARBOR_ADMIN_PASSWORD: bmhuIUAjMTIz
|
||||
# POSTGRES_PASSWORD --> init파일에 있는 것. database에서 사용하는 변수명
|
||||
POSTGRESQL_PASSWORD: bmhuIUAjMTIz # harbor-core에서 사용하는 변수명
|
||||
REGISTRY_CREDENTIAL_PASSWORD: aGFyYm9yX3JlZ2lzdHJ5X3Bhc3N3b3Jk
|
||||
secret: RTRQY0FxZ3RPVmdKWTBRRw==
|
||||
secretKey: bm90LWEtc2VjdXJlLWtleQ==
|
||||
tls.cert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURyekNDQXBlZ0F3SUJBZ0lVVzZZZlZMdkhUVEZ6ZU40R05wbmgxZW1XcXpRd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1hURUxNQWtHQTFVRUJoTUNTMUl4RGpBTUJnTlZCQWdNQlZObGIzVnNNUTB3Q3dZRFZRUUhEQVJKYm1wbApNUTh3RFFZRFZRUUtEQVpwYm1OdmNuQXhEREFLQmdOVkJBc01BMlJsZGpFUU1BNEdBMVVFQXd3SGFXNXFaV2x1Cll6QWVGdzB5TkRFeU1ESXdOakV3TlRkYUZ3MHlOakV5TURJd05qRXdOVGRhTUdVeEN6QUpCZ05WQkFZVEFrdFMKTVE0d0RBWURWUVFJREFWVFpXOTFiREVPTUF3R0ExVUVCd3dGUjBGVFFVNHhEREFLQmdOVkJBb01BMlJsWWpFTgpNQXNHQTFVRUN3d0VkR1Z6ZERFWk1CY0dBMVVFQXd3UUtpNXVZWFJwZG1Wa1pXTnJMbU52YlRDQ0FTSXdEUVlKCktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU11U1JJVUJBMWhSWmd4M3p4djVJeWljMnd3alZUcmkKa3QrQ01CNndTLzQrVDUxMkxnd29PQU9IdnQ1L0hDbEVSUVdWd280ZDN2cDR3WmQ3MktxVXM2Ym9CclZmeWU4bAo1bC84MkpGQkhqNStGWDhtTS8wYldkMHVhV1NVNDdsNHhBTzFwU3V0cXgxdkJQdlI2aC9DT0k4cEpBakVxd1llCjVLU1RGWllKOG5YWXJrbkFhRnl1dnkwZjhNcHdUbW1GWEZWeVZQbGlhZkhYUjFVWVNQUlFIcWo0TXF3VTM4OXMKSjdOOVlsMzBwMVUzVWVMRkx2Q0lEUU1UVFFzbUNSbnA3UzV1VzZETC90eXNwdnAwRVVzcDRHRXRhY3drZU84cwo0UlZqeGEyR0JiUTViSGJ2MGxZLzZBKzk5Szc5U0ZNcksvd1ptM0dSeDkvblJKWXc2OUpLZ2xVQ0F3RUFBYU5mCk1GMHdHd1lEVlIwUkJCUXdFb0lRS2k1dVlYUnBkbVZrWldOckxtTnZiVEFkQmdOVkhRNEVGZ1FVbitzL2oyMzEKcC8ycnFWWFNTSk5IVWZnNU5PQXdId1lEVlIwakJCZ3dGb0FVSlRJK0hOWDl2T1o0aGd3VUszSG1pY3ROcG8wdwpEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBR2haQVNobU05Mm9yVHo5ZndtOG9qZ25xekZ5dmlGa2lrYjU2MDI4CmZEZXV5M2d2aUZqNHk5a3hlQ1lqdjQ4ZWJ1cHlFL1oyZnJ5eVltWXNOOHNlanNLcTY2V0J1TDh0ZG9TS3ZjcFMKQU1TOU5reEhWZlJvRmFGSmgxZVQ3RzhoYVd0dTdpSUxRUzB5dXZWYkFhMGFPVzRpY3p0eXVlK0MyOXRXS3pLcAp4ZndtOEI5SzFzRVUwdEN2d1R6L2wwTlBpYXdOelNnc3UrWFkwbW1xZ0NQbG1zd2cxRkNwWTUzcHBqRE5NTzJDCnJ5bGhKbnowM2JpS2NQb0VCQlNKZFo2WGt2UG93SUV5bGZ3SWlEV3VNRjFaNzViaTBoaGFFTjRDaVJkeSt4MDkKR1NQa04zMlZ4d3dvTXhHd3A0VWJSS0g4YVR6Q2VWT0ZuaE8xbGp3MVdSR2ZRUWc9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
|
||||
tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBeTVKRWhRRURXRkZtREhmUEcva2pLSnpiRENOVk91S1MzNEl3SHJCTC9qNVBuWFl1CkRDZzRBNGUrM244Y0tVUkZCWlhDamgzZStuakJsM3ZZcXBTenB1Z0d0Vi9KN3lYbVgvellrVUVlUG40VmZ5WXoKL1J0WjNTNXBaSlRqdVhqRUE3V2xLNjJySFc4RSs5SHFIOEk0anlra0NNU3JCaDdrcEpNVmxnbnlkZGl1U2NCbwpYSzYvTFIvd3luQk9hWVZjVlhKVStXSnA4ZGRIVlJoSTlGQWVxUGd5ckJUZnoyd25zMzFpWGZTblZUZFI0c1V1CjhJZ05BeE5OQ3lZSkdlbnRMbTVib012KzNLeW0rblFSU3luZ1lTMXB6Q1I0N3l6aEZXUEZyWVlGdERsc2R1L1MKVmovb0Q3MzBydjFJVXlzci9CbWJjWkhIMytkRWxqRHIwa3FDVlFJREFRQUJBb0lCQUZaMGV5Y2xZLzlKS3BiVwo5eDJCTkY1V0oyMURRRG91NllPRTdkektzS3Q4V1NHZGhEYmppYzV1QXpESk9QT0pxK3FRVEwxQWtHYzlpN0pECkJhU0VYTHZneEtDWTJ0RDIvcHo3YkJwY1ZuVGg1VTFIczBLbU1BY1FZL0EwajNaQWhMYXltVUF3bElCK210WTcKc3p2anAxT2RmRkZBL1FVdmI1azVZaXlEY3ZaNjJwL2VaNXdDOXY4dFhjRVpIN2FpVWNKSGM1ajFrRFRpckErawpjWW5xUTJ2NHovWXJKek9Xa2tyTTNudFpOSzM0QzMrMUQrb1d6QjZHNjJJb0JCZnVxVGNJZHgwMXNvbjNIMXVYClpMNHdNbXRLZ0Z0RFJLdEpQNysxOXJsaU1qL09UWEd3WkZlS2c1RGY3T2Y2MFl1em1kVXFhNHQrMXlicHd2RkEKb0U2OW15MENnWUVBM09wcFV1RmZwZUxiRGsvdHJGY3ByNksxaTdubFA0TXowMXhySG03d3VEaS80TWp6VnlkVworZ0t0emYzRm1rNE5iYyt6aGdXblIzN2RheFlzbzVacC9Uck9GemFuNGpIKzhzNU9LWDI2WjBJZjVnQm01NmwzCmtKckU3UnAxMFF3ZE0xRkVQOWtGaFZyK2YzWm5rQ3QyNjQ3aFVWY2Jubk1CUHhZVkNWZzZmOE1DZ1lFQTYrYXoKNG12Y1dSZm1LSFd1dnovRVZPL3lRT3BxOCtkc2l3dXFRZ2xIWm5SZ0Rmc05uZ3NyK3hBaWJoVm94Q3ZZdm84dApnNVVqdXArVklEVFVqRlp6bkd1N2xVWlRyMVBQS1lCS2dtSVVqRkpYQ1JCUUd5akttUG5LYmhJb2RxUWRCV2o3CkIrOTNDeVBsMHRZVWNNMjdEL0E5TDNDaHBJVktxZ25JeHpZZXJBY0NnWUJqS1JFWHM3UUVPUHpNd3RIVFB0aW0KVHFtZ3kxTjhtNzdpaTZSRlo5VERUQzNNajBhekF5U0dXamQ3dEFKRGplOTNML2pNR3JPSVl3aXVMYWpoMFAxSQpQbUlOaDJuNkhTanNBZkNSclM3RGRLbnV5cFZtUE9vL1RVbEJpRlFEL3FVSXlOeVNzQzVMT3Bucnl0RVhwSHJmCnB5VzZKaGh1bWY2Z082QTdybytya3dLQmdIOXVEam4vWGZaYXJKK3FnbzBaR3l0dXVvUktuUi9JSWFBeTJ2UDEKSXphN0lyQXFyNzV4OW40V3h5S0VPaVhPTWJVdWpyMkhzTmM5SVVkV2dvS1VxTHNVank0aDRVN1NqUk8wRTR1LwpBNjZSUkNiSFF4Nkl1SGhPWndWeWxaMFJKZ1FvSTRLejNyQ0w0Ymcwb0xJVzBEZlo1Sk5kMmxPUEZUZ3BOT1kzCjIvVzlBb0dCQU1HRXJtczVrRWZkdDFveXYxUlBwbENSUG1yVCs4TUV1K3lyanJXSXlxWEo4SHcwd09mTlhsTXQKUzhRbFdDb0xnbmFxZU81ZWd6OGF2L2ZVNDhxbU9tTVFPUDRMbWxSSm1ZM1E3MVpCZUc5akxPUFZCZlhFeDVDTQp2d283dFhEU1JKRVdUcGp3dCtUMy9uTlZhMm9QMGNXTUg1akJ0c1ZXMnhrM3F5K0NJWVBqCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0t
|
||||
---
|
||||
|
|
@ -0,0 +1,83 @@
|
|||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
labels:
|
||||
kubernetes.io/metadata.name: harbor
|
||||
name: harbor
|
||||
spec:
|
||||
finalizers:
|
||||
- kubernetes
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: harbor-database
|
||||
namespace: harbor
|
||||
type: Opaque
|
||||
data:
|
||||
POSTGRES_PASSWORD: bmhuIUAjMTIz
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: harbor-jobservice
|
||||
namespace: harbor
|
||||
type: Opaque
|
||||
data:
|
||||
JOBSERVICE_SECRET: akVWbzlyNFJaU2R1clJqUA==
|
||||
REGISTRY_CREDENTIAL_PASSWORD: aGFyYm9yX3JlZ2lzdHJ5X3Bhc3N3b3Jk
|
||||
---
|
||||
apiVersion: v1
|
||||
data:
|
||||
REGISTRY_HTTP_SECRET: dHlCdm41MXpIakxLRm5mRw==
|
||||
REGISTRY_REDIS_PASSWORD: ""
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: harbor-registry
|
||||
namespace: harbor
|
||||
type: Opaque
|
||||
---
|
||||
apiVersion: v1
|
||||
data:
|
||||
REGISTRY_HTPASSWD: aGFyYm9yX3JlZ2lzdHJ5X3VzZXI6JDJhJDEwJG1uRkVSQkVyRmROYnNuZDVHWUxTQXVUOTRaUWxZNGkxU3BtNTk4dWlmV2pLbEJrQnJhbHEu
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: harbor-registry-htpasswd
|
||||
namespace: harbor
|
||||
type: Opaque
|
||||
---
|
||||
apiVersion: v1
|
||||
data: null
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: harbor-registryctl
|
||||
namespace: harbor
|
||||
type: Opaque
|
||||
---
|
||||
apiVersion: v1
|
||||
data:
|
||||
gitHubToken: ""
|
||||
redisURL: cmVkaXM6Ly9oYXJib3ItcmVkaXM6NjM3OS81P2lkbGVfdGltZW91dF9zZWNvbmRzPTMw
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: harbor-trivy
|
||||
namespace: harbor
|
||||
type: Opaque
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
component: jobservice
|
||||
release: harbor
|
||||
name: harbor-jobservice
|
||||
namespace: harbor
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
# storageClassName: sc-monitoring
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
component: registry
|
||||
release: harbor
|
||||
name: harbor-registry
|
||||
namespace: harbor
|
||||
spec:
|
||||
# storageClassName: sc-monitoring
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 100Gi
|
||||
|
||||
|
|
@ -0,0 +1,227 @@
|
|||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: harbor-core
|
||||
namespace: harbor
|
||||
data:
|
||||
_REDIS_URL_CORE: redis://harbor-redis:6379/0?idle_timeout_seconds=30
|
||||
_REDIS_URL_REG: redis://harbor-redis:6379/2?idle_timeout_seconds=30
|
||||
CHART_CACHE_DRIVER: redis
|
||||
CONFIG_PATH: /etc/core/app.conf
|
||||
CORE_LOCAL_URL: http://127.0.0.1:8080
|
||||
CORE_URL: http://harbor-core:80
|
||||
DATABASE_TYPE: postgresql
|
||||
EXT_ENDPOINT: https://harbor.nhngpuaas.com
|
||||
HTTP_PROXY: ""
|
||||
HTTPS_PROXY: ""
|
||||
JOBSERVICE_URL: http://harbor-jobservice
|
||||
LOG_LEVEL: info
|
||||
NO_PROXY: harbor-core,harbor-jobservice,harbor-database,harbor-registry,harbor-portal,harbor-trivy,harbor-exporter,127.0.0.1,localhost,.local,.internal
|
||||
PERMITTED_REGISTRY_TYPES_FOR_PROXY_CACHE: docker-hub,harbor,azure-acr,aws-ecr,google-gcr,quay,docker-registry,github-ghcr,jfrog-artifactory
|
||||
PORT: "8080"
|
||||
PORTAL_URL: http://harbor-portal
|
||||
POSTGRESQL_DATABASE: registry
|
||||
POSTGRESQL_HOST: harbor-database
|
||||
POSTGRESQL_MAX_IDLE_CONNS: "100"
|
||||
POSTGRESQL_MAX_OPEN_CONNS: "900"
|
||||
POSTGRESQL_PORT: "5432"
|
||||
POSTGRESQL_SSLMODE: disable
|
||||
POSTGRESQL_USERNAME: postgres
|
||||
QUOTA_UPDATE_PROVIDER: db
|
||||
REGISTRY_CONTROLLER_URL: http://harbor-registry:8080
|
||||
REGISTRY_CREDENTIAL_USERNAME: harbor_registry_user
|
||||
REGISTRY_STORAGE_PROVIDER_NAME: filesystem
|
||||
REGISTRY_URL: http://harbor-registry:5000
|
||||
TOKEN_SERVICE_URL: http://harbor-core:80/service/token
|
||||
TRIVY_ADAPTER_URL: http://harbor-trivy:8080
|
||||
WITH_TRIVY: "true"
|
||||
app.conf: |
|
||||
appname = Harbor
|
||||
runmode = prod
|
||||
enablegzip = true
|
||||
|
||||
[prod]
|
||||
httpport = 8080
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: harbor-jobservice
|
||||
namespace: harbor
|
||||
data:
|
||||
config.yml: |
|
||||
#Server listening port
|
||||
protocol: "http"
|
||||
port: 8080
|
||||
worker_pool:
|
||||
workers: 10
|
||||
backend: "redis"
|
||||
redis_pool:
|
||||
redis_url: "redis://harbor-redis:6379/1"
|
||||
namespace: "harbor_job_service_namespace"
|
||||
idle_timeout_second: 3600
|
||||
job_loggers:
|
||||
- name: "FILE"
|
||||
level: INFO
|
||||
settings: # Customized settings of logger
|
||||
base_dir: "/var/log/jobs"
|
||||
sweeper:
|
||||
duration: 14 #days
|
||||
settings: # Customized settings of sweeper
|
||||
work_dir: "/var/log/jobs"
|
||||
metric:
|
||||
enabled: false
|
||||
path: /metrics
|
||||
port: 8001
|
||||
#Loggers for the job service
|
||||
loggers:
|
||||
- name: "STD_OUTPUT"
|
||||
level: INFO
|
||||
reaper:
|
||||
# the max time to wait for a task to finish, if unfinished after max_update_hours, the task will be mark as error, but the task will continue to run, default value is 24
|
||||
max_update_hours: 24
|
||||
# the max time for execution in running state without new task created
|
||||
max_dangling_hours: 168
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: harbor-jobservice-env
|
||||
namespace: harbor
|
||||
data:
|
||||
CORE_URL: http://harbor-core:80
|
||||
HTTP_PROXY: ""
|
||||
HTTPS_PROXY: ""
|
||||
JOBSERVICE_WEBHOOK_JOB_HTTP_CLIENT_TIMEOUT: "3"
|
||||
JOBSERVICE_WEBHOOK_JOB_MAX_RETRY: "3"
|
||||
NO_PROXY: harbor-core,harbor-jobservice,harbor-database,harbor-registry,harbor-portal,harbor-trivy,harbor-exporter,127.0.0.1,localhost,.local,.internal
|
||||
REGISTRY_CONTROLLER_URL: http://harbor-registry:8080
|
||||
REGISTRY_CREDENTIAL_USERNAME: harbor_registry_user
|
||||
REGISTRY_URL: http://harbor-registry:5000
|
||||
TOKEN_SERVICE_URL: http://harbor-core:80/service/token
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: harbor-portal
|
||||
namespace: harbor
|
||||
data:
|
||||
nginx.conf: |
|
||||
worker_processes auto;
|
||||
pid /tmp/nginx.pid;
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
http {
|
||||
client_body_temp_path /tmp/client_body_temp;
|
||||
proxy_temp_path /tmp/proxy_temp;
|
||||
fastcgi_temp_path /tmp/fastcgi_temp;
|
||||
uwsgi_temp_path /tmp/uwsgi_temp;
|
||||
scgi_temp_path /tmp/scgi_temp;
|
||||
server {
|
||||
listen 8080;
|
||||
listen [::]:8080;
|
||||
server_name localhost;
|
||||
root /usr/share/nginx/html;
|
||||
index index.html index.htm;
|
||||
include /etc/nginx/mime.types;
|
||||
gzip on;
|
||||
gzip_min_length 1000;
|
||||
gzip_proxied expired no-cache no-store private auth;
|
||||
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
|
||||
location /devcenter-api-2.0 {
|
||||
try_files $uri $uri/ /swagger-ui-index.html;
|
||||
}
|
||||
location / {
|
||||
try_files $uri $uri/ /index.html;
|
||||
}
|
||||
location = /index.html {
|
||||
add_header Cache-Control "no-store, no-cache, must-revalidate";
|
||||
}
|
||||
}
|
||||
}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: harbor-registry
|
||||
namespace: harbor
|
||||
data:
|
||||
config.yml: |
|
||||
version: 0.1
|
||||
log:
|
||||
level: info
|
||||
fields:
|
||||
service: registry
|
||||
storage:
|
||||
filesystem:
|
||||
rootdirectory: /storage
|
||||
cache:
|
||||
layerinfo: redis
|
||||
maintenance:
|
||||
uploadpurging:
|
||||
enabled: true
|
||||
age: 168h
|
||||
interval: 24h
|
||||
dryrun: false
|
||||
delete:
|
||||
enabled: true
|
||||
redirect:
|
||||
disable: false
|
||||
redis:
|
||||
addr: harbor-redis:6379
|
||||
db: 2
|
||||
readtimeout: 10s
|
||||
writetimeout: 10s
|
||||
dialtimeout: 10s
|
||||
pool:
|
||||
maxidle: 100
|
||||
maxactive: 500
|
||||
idletimeout: 60s
|
||||
http:
|
||||
addr: :5000
|
||||
#relativeurls: false
|
||||
relativeurls: true
|
||||
# set via environment variable
|
||||
# secret: placeholder
|
||||
debug:
|
||||
addr: localhost:5001
|
||||
auth:
|
||||
htpasswd:
|
||||
realm: harbor-registry-basic-realm
|
||||
path: /etc/registry/passwd
|
||||
validation:
|
||||
disabled: true
|
||||
compatibility:
|
||||
schema1:
|
||||
enabled: true
|
||||
ctl-config.yml: |
|
||||
---
|
||||
protocol: "http"
|
||||
port: 8080
|
||||
log_level: info
|
||||
registry_config: "/etc/registry/config.yml"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: harbor-registryctl
|
||||
namespace: harbor
|
||||
|
|
@ -0,0 +1,804 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: harbor-core
|
||||
namespace: harbor
|
||||
spec:
|
||||
ports:
|
||||
- name: http-web
|
||||
port: 80
|
||||
targetPort: 8080
|
||||
selector:
|
||||
app: harbor
|
||||
component: core
|
||||
release: harbor
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: harbor-database
|
||||
namespace: harbor
|
||||
spec:
|
||||
ports:
|
||||
- port: 5432
|
||||
selector:
|
||||
app: harbor
|
||||
component: database
|
||||
release: harbor
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: harbor-jobservice
|
||||
namespace: harbor
|
||||
spec:
|
||||
ports:
|
||||
- name: http-jobservice
|
||||
port: 80
|
||||
targetPort: 8080
|
||||
selector:
|
||||
app: harbor
|
||||
component: jobservice
|
||||
release: harbor
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: harbor-portal
|
||||
namespace: harbor
|
||||
spec:
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 8080
|
||||
selector:
|
||||
app: harbor
|
||||
component: portal
|
||||
release: harbor
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: harbor-redis
|
||||
namespace: harbor
|
||||
spec:
|
||||
ports:
|
||||
- port: 6379
|
||||
selector:
|
||||
app: harbor
|
||||
component: redis
|
||||
release: harbor
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: harbor-registry
|
||||
namespace: harbor
|
||||
spec:
|
||||
ports:
|
||||
- name: http-registry
|
||||
port: 5000
|
||||
- name: http-controller
|
||||
port: 8080
|
||||
selector:
|
||||
app: harbor
|
||||
component: registry
|
||||
release: harbor
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: harbor-trivy
|
||||
namespace: harbor
|
||||
spec:
|
||||
ports:
|
||||
- name: http-trivy
|
||||
port: 8080
|
||||
protocol: TCP
|
||||
selector:
|
||||
app: harbor
|
||||
component: trivy
|
||||
release: harbor
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
component: core
|
||||
release: harbor
|
||||
name: harbor-core
|
||||
namespace: harbor
|
||||
spec:
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app: harbor
|
||||
component: core
|
||||
release: harbor
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
component: core
|
||||
release: harbor
|
||||
spec:
|
||||
nodeSelector:
|
||||
nodegroup: nd
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
- env:
|
||||
- name: CORE_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: secret
|
||||
name: harbor-core
|
||||
- name: JOBSERVICE_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: JOBSERVICE_SECRET
|
||||
name: harbor-jobservice
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: harbor-core
|
||||
- secretRef:
|
||||
name: harbor-core
|
||||
image: goharbor/harbor-core:v2.11.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 2
|
||||
httpGet:
|
||||
path: /api/v2.0/ping
|
||||
port: 8080
|
||||
scheme: HTTP
|
||||
periodSeconds: 10
|
||||
name: core
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
readinessProbe:
|
||||
failureThreshold: 2
|
||||
httpGet:
|
||||
path: /api/v2.0/ping
|
||||
port: 8080
|
||||
scheme: HTTP
|
||||
periodSeconds: 10
|
||||
startupProbe:
|
||||
failureThreshold: 360
|
||||
httpGet:
|
||||
path: /api/v2.0/ping
|
||||
port: 8080
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
volumeMounts:
|
||||
- mountPath: /etc/core/app.conf
|
||||
name: config
|
||||
subPath: app.conf
|
||||
- mountPath: /etc/core/key
|
||||
name: secret-key
|
||||
subPath: key
|
||||
- mountPath: /etc/core/private_key.pem
|
||||
name: token-service-private-key
|
||||
subPath: tls.key
|
||||
- mountPath: /etc/core/ca
|
||||
name: ca-download
|
||||
- mountPath: /etc/core/token
|
||||
name: psc
|
||||
securityContext:
|
||||
fsGroup: 10000
|
||||
runAsUser: 10000
|
||||
terminationGracePeriodSeconds: 120
|
||||
volumes:
|
||||
- configMap:
|
||||
items:
|
||||
- key: app.conf
|
||||
path: app.conf
|
||||
name: harbor-core
|
||||
name: config
|
||||
- name: secret-key
|
||||
secret:
|
||||
items:
|
||||
- key: secretKey
|
||||
path: key
|
||||
secretName: harbor-core
|
||||
- name: token-service-private-key
|
||||
secret:
|
||||
secretName: harbor-core
|
||||
- name: ca-download
|
||||
secret:
|
||||
secretName: harbor-cacerts
|
||||
- emptyDir: {}
|
||||
name: psc
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
component: jobservice
|
||||
release: harbor
|
||||
name: harbor-jobservice
|
||||
namespace: harbor
|
||||
spec:
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app: harbor
|
||||
component: jobservice
|
||||
release: harbor
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
component: jobservice
|
||||
release: harbor
|
||||
spec:
|
||||
nodeSelector:
|
||||
nodegroup: nd
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
- env:
|
||||
- name: CORE_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: secret
|
||||
name: harbor-core
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: harbor-jobservice-env
|
||||
- secretRef:
|
||||
name: harbor-jobservice
|
||||
image: goharbor/harbor-jobservice:v2.11.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /api/v1/stats
|
||||
port: 8080
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 300
|
||||
periodSeconds: 10
|
||||
name: jobservice
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /api/v1/stats
|
||||
port: 8080
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
volumeMounts:
|
||||
- mountPath: /etc/jobservice/config.yml
|
||||
name: jobservice-config
|
||||
subPath: config.yml
|
||||
- mountPath: /var/log/jobs
|
||||
name: job-logs
|
||||
subPath: null
|
||||
securityContext:
|
||||
fsGroup: 10000
|
||||
runAsUser: 10000
|
||||
terminationGracePeriodSeconds: 120
|
||||
volumes:
|
||||
- configMap:
|
||||
name: harbor-jobservice
|
||||
name: jobservice-config
|
||||
- name: job-logs
|
||||
persistentVolumeClaim:
|
||||
claimName: harbor-jobservice
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
component: portal
|
||||
release: harbor
|
||||
name: harbor-portal
|
||||
namespace: harbor
|
||||
spec:
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app: harbor
|
||||
component: portal
|
||||
release: harbor
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
component: portal
|
||||
release: harbor
|
||||
spec:
|
||||
nodeSelector:
|
||||
nodegroup: nd
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
- image: goharbor/harbor-portal:v2.11.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 8080
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 300
|
||||
periodSeconds: 10
|
||||
name: portal
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 8080
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 1
|
||||
periodSeconds: 10
|
||||
volumeMounts:
|
||||
- mountPath: /etc/nginx/nginx.conf
|
||||
name: portal-config
|
||||
subPath: nginx.conf
|
||||
securityContext:
|
||||
fsGroup: 10000
|
||||
runAsUser: 10000
|
||||
volumes:
|
||||
- configMap:
|
||||
name: harbor-portal
|
||||
name: portal-config
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
component: registry
|
||||
release: harbor
|
||||
name: harbor-registry
|
||||
namespace: harbor
|
||||
spec:
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app: harbor
|
||||
component: registry
|
||||
release: harbor
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
component: registry
|
||||
release: harbor
|
||||
spec:
|
||||
nodeSelector:
|
||||
nodegroup: nd
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
- args:
|
||||
- serve
|
||||
- /etc/registry/config.yml
|
||||
env: null
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: harbor-registry
|
||||
image: goharbor/registry-photon:v2.11.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 5000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 300
|
||||
periodSeconds: 10
|
||||
name: registry
|
||||
ports:
|
||||
- containerPort: 5000
|
||||
- containerPort: 5001
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 5000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 1
|
||||
periodSeconds: 10
|
||||
volumeMounts:
|
||||
- mountPath: /storage
|
||||
name: registry-data
|
||||
subPath: null
|
||||
- mountPath: /etc/registry/passwd
|
||||
name: registry-htpasswd
|
||||
subPath: passwd
|
||||
- mountPath: /etc/registry/config.yml
|
||||
name: registry-config
|
||||
subPath: config.yml
|
||||
- env:
|
||||
- name: CORE_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: secret
|
||||
name: harbor-core
|
||||
- name: JOBSERVICE_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: JOBSERVICE_SECRET
|
||||
name: harbor-jobservice
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: harbor-registryctl
|
||||
- secretRef:
|
||||
name: harbor-registry
|
||||
- secretRef:
|
||||
name: harbor-registryctl
|
||||
image: goharbor/harbor-registryctl:v2.11.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /api/health
|
||||
port: 8080
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 300
|
||||
periodSeconds: 10
|
||||
name: registryctl
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /api/health
|
||||
port: 8080
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 1
|
||||
periodSeconds: 10
|
||||
volumeMounts:
|
||||
- mountPath: /storage
|
||||
name: registry-data
|
||||
subPath: null
|
||||
- mountPath: /etc/registry/config.yml
|
||||
name: registry-config
|
||||
subPath: config.yml
|
||||
- mountPath: /etc/registryctl/config.yml
|
||||
name: registry-config
|
||||
subPath: ctl-config.yml
|
||||
securityContext:
|
||||
fsGroup: 10000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
runAsUser: 10000
|
||||
terminationGracePeriodSeconds: 120
|
||||
volumes:
|
||||
- name: registry-htpasswd
|
||||
secret:
|
||||
items:
|
||||
- key: REGISTRY_HTPASSWD
|
||||
path: passwd
|
||||
secretName: harbor-registry-htpasswd
|
||||
- configMap:
|
||||
name: harbor-registry
|
||||
name: registry-config
|
||||
- name: registry-data
|
||||
persistentVolumeClaim:
|
||||
claimName: harbor-registry
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
component: database
|
||||
release: harbor
|
||||
name: harbor-database
|
||||
namespace: harbor
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: harbor
|
||||
component: database
|
||||
release: harbor
|
||||
serviceName: harbor-database
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
component: database
|
||||
release: harbor
|
||||
spec:
|
||||
nodeSelector:
|
||||
nodegroup: nd
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
- env:
|
||||
- name: PGDATA
|
||||
value: /var/lib/postgresql/data/pgdata
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: harbor-database
|
||||
image: goharbor/harbor-db:v2.11.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /docker-healthcheck.sh
|
||||
initialDelaySeconds: 300
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
name: database
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /docker-healthcheck.sh
|
||||
initialDelaySeconds: 1
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/postgresql/data
|
||||
name: database-data
|
||||
- mountPath: /dev/shm
|
||||
name: shm-volume
|
||||
initContainers:
|
||||
- args:
|
||||
- -c
|
||||
- '[ -e /var/lib/postgresql/data/postgresql.conf ] && [ ! -d /var/lib/postgresql/data/pgdata
|
||||
] && mkdir -m 0700 /var/lib/postgresql/data/pgdata && mv /var/lib/postgresql/data/*
|
||||
/var/lib/postgresql/data/pgdata/ || true'
|
||||
command:
|
||||
- /bin/sh
|
||||
image: goharbor/harbor-db:v2.11.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: data-migrator
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/postgresql/data
|
||||
name: database-data
|
||||
- args:
|
||||
- -c
|
||||
- chmod -R 700 /var/lib/postgresql/data/pgdata || true
|
||||
command:
|
||||
- /bin/sh
|
||||
image: goharbor/harbor-db:v2.11.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: data-permissions-ensurer
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/postgresql/data
|
||||
name: database-data
|
||||
securityContext:
|
||||
fsGroup: 999
|
||||
runAsUser: 999
|
||||
terminationGracePeriodSeconds: 120
|
||||
volumes:
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
sizeLimit: 512Mi
|
||||
name: shm-volume
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
annotations: null
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: database-data
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
component: redis
|
||||
release: harbor
|
||||
name: harbor-redis
|
||||
namespace: harbor
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: harbor
|
||||
component: redis
|
||||
release: harbor
|
||||
serviceName: harbor-redis
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
component: redis
|
||||
release: harbor
|
||||
spec:
|
||||
nodeSelector:
|
||||
nodegroup: nd
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
- image: goharbor/redis-photon:v2.11.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
initialDelaySeconds: 300
|
||||
periodSeconds: 10
|
||||
tcpSocket:
|
||||
port: 6379
|
||||
name: redis
|
||||
readinessProbe:
|
||||
initialDelaySeconds: 1
|
||||
periodSeconds: 10
|
||||
tcpSocket:
|
||||
port: 6379
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/redis
|
||||
name: data
|
||||
securityContext:
|
||||
fsGroup: 999
|
||||
runAsUser: 999
|
||||
terminationGracePeriodSeconds: 120
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
annotations: null
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: data
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
component: trivy
|
||||
release: harbor
|
||||
name: harbor-trivy
|
||||
namespace: harbor
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: harbor
|
||||
component: trivy
|
||||
release: harbor
|
||||
serviceName: harbor-trivy
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
component: trivy
|
||||
release: harbor
|
||||
spec:
|
||||
nodeSelector:
|
||||
nodegroup: nd
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
- env:
|
||||
- name: HTTP_PROXY
|
||||
value: ""
|
||||
- name: HTTPS_PROXY
|
||||
value: ""
|
||||
- name: NO_PROXY
|
||||
value: harbor-core,harbor-jobservice,harbor-database,harbor-registry,harbor-portal,harbor-trivy,harbor-exporter,127.0.0.1,localhost,.local,.internal
|
||||
- name: SCANNER_LOG_LEVEL
|
||||
value: info
|
||||
- name: SCANNER_TRIVY_CACHE_DIR
|
||||
value: /home/scanner/.cache/trivy
|
||||
- name: SCANNER_TRIVY_REPORTS_DIR
|
||||
value: /home/scanner/.cache/reports
|
||||
- name: SCANNER_TRIVY_DEBUG_MODE
|
||||
value: "false"
|
||||
- name: SCANNER_TRIVY_VULN_TYPE
|
||||
value: os,library
|
||||
- name: SCANNER_TRIVY_TIMEOUT
|
||||
value: 5m0s
|
||||
- name: SCANNER_TRIVY_GITHUB_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: gitHubToken
|
||||
name: harbor-trivy
|
||||
- name: SCANNER_TRIVY_SEVERITY
|
||||
value: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
|
||||
- name: SCANNER_TRIVY_IGNORE_UNFIXED
|
||||
value: "false"
|
||||
- name: SCANNER_TRIVY_SKIP_UPDATE
|
||||
value: "false"
|
||||
- name: SCANNER_TRIVY_OFFLINE_SCAN
|
||||
value: "false"
|
||||
- name: SCANNER_TRIVY_SECURITY_CHECKS
|
||||
value: vuln
|
||||
- name: SCANNER_TRIVY_INSECURE
|
||||
value: "false"
|
||||
- name: SCANNER_API_SERVER_ADDR
|
||||
value: :8080
|
||||
- name: SCANNER_REDIS_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: redisURL
|
||||
name: harbor-trivy
|
||||
- name: SCANNER_STORE_REDIS_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: redisURL
|
||||
name: harbor-trivy
|
||||
- name: SCANNER_JOB_QUEUE_REDIS_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: redisURL
|
||||
name: harbor-trivy
|
||||
image: goharbor/trivy-adapter-photon:v2.11.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 10
|
||||
httpGet:
|
||||
path: /probe/healthy
|
||||
port: api-server
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
name: trivy
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: api-server
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /probe/ready
|
||||
port: api-server
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 512Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
privileged: false
|
||||
volumeMounts:
|
||||
- mountPath: /home/scanner/.cache
|
||||
name: data
|
||||
readOnly: false
|
||||
securityContext:
|
||||
fsGroup: 10000
|
||||
runAsUser: 10000
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: data
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 50Gi
|
||||
|
|
@ -0,0 +1,64 @@
|
|||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
annotations:
|
||||
ingress.kubernetes.io/proxy-body-size: "0"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
||||
#nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
labels:
|
||||
app: harbor
|
||||
release: harbor
|
||||
name: harbor-ingress
|
||||
namespace: harbor
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
tls:
|
||||
- hosts:
|
||||
- "harbor.nhngpuaas.com"
|
||||
secretName: nhngpuaas-ssl
|
||||
rules:
|
||||
- host: harbor.nhngpuaas.com
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
service:
|
||||
name: harbor-core
|
||||
port:
|
||||
number: 80
|
||||
path: /api/
|
||||
pathType: Prefix
|
||||
- backend:
|
||||
service:
|
||||
name: harbor-core
|
||||
port:
|
||||
number: 80
|
||||
path: /service/
|
||||
pathType: Prefix
|
||||
- backend:
|
||||
service:
|
||||
name: harbor-core
|
||||
port:
|
||||
number: 80
|
||||
path: /v2/
|
||||
pathType: Prefix
|
||||
- backend:
|
||||
service:
|
||||
name: harbor-core
|
||||
port:
|
||||
number: 80
|
||||
path: /chartrepo/
|
||||
pathType: Prefix
|
||||
- backend:
|
||||
service:
|
||||
name: harbor-core
|
||||
port:
|
||||
number: 80
|
||||
path: /c/
|
||||
pathType: Prefix
|
||||
- backend:
|
||||
service:
|
||||
name: harbor-portal
|
||||
port:
|
||||
number: 80
|
||||
path: /
|
||||
pathType: Prefix
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: nginx-pod
|
||||
labels:
|
||||
app: nginx
|
||||
spec:
|
||||
containers:
|
||||
- name: nginx
|
||||
image: harbor.nhngpuaas.com/test/nginx:test
|
||||
ports:
|
||||
- containerPort: 80
|
||||
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
#!/usr/bin/python3
|
||||
import os
|
||||
import subprocess
|
||||
|
||||
pv_str = os.popen("kubectl get -n default pv | grep harbor | awk '$1 > 0 {print $1}'").read()
|
||||
print(pv_str)
|
||||
pv_list = pv_str.split('\n')
|
||||
i = 0
|
||||
for pv in pv_list:
|
||||
print(pv)
|
||||
# os.system(f"kubectl delete -n {ns} pv {pv}")
|
||||
os.system(f"kubectl delete pv {pv}")
|
||||
|
|
@ -0,0 +1,321 @@
|
|||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
name: ingress-nginx
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
automountServiceAccountToken: true
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: v1
|
||||
automountServiceAccountToken: true
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- pods
|
||||
- secrets
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingressclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resourceNames:
|
||||
- ingress-nginx-leader
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- get
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- endpoints
|
||||
- nodes
|
||||
- pods
|
||||
- secrets
|
||||
- namespaces
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingressclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- get
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
rules:
|
||||
- apiGroups:
|
||||
- admissionregistration.k8s.io
|
||||
resources:
|
||||
- validatingwebhookconfigurations
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: ingress-nginx
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: ingress-nginx-admission
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: ingress-nginx
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: ingress-nginx-admission
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
data:
|
||||
allow-snippet-annotations: "false"
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
|
||||
|
|
@ -0,0 +1,331 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
ports:
|
||||
- appProtocol: http
|
||||
name: http
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
nodePort: 30100 # by.sdjo
|
||||
- appProtocol: https
|
||||
name: https
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: https
|
||||
nodePort: 30101 # by.sdjo
|
||||
selector:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
type: NodePort
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-controller-admission
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
ports:
|
||||
- appProtocol: https
|
||||
name: https-webhook
|
||||
port: 443
|
||||
targetPort: webhook
|
||||
selector:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
minReadySeconds: 0
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- /nginx-ingress-controller
|
||||
- --election-id=ingress-nginx-leader
|
||||
- --controller-class=k8s.io/ingress-nginx
|
||||
- --ingress-class=nginx
|
||||
- --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
|
||||
- --validating-webhook=:8443
|
||||
- --validating-webhook-certificate=/usr/local/certificates/cert
|
||||
- --validating-webhook-key=/usr/local/certificates/key
|
||||
- --enable-metrics=false
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: LD_PRELOAD
|
||||
value: /usr/local/lib/libmimalloc.so
|
||||
image: registry.k8s.io/ingress-nginx/controller:v1.11.2 # by.ljh
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- /wait-shutdown
|
||||
livenessProbe:
|
||||
failureThreshold: 5
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
name: controller
|
||||
ports:
|
||||
- containerPort: 80
|
||||
name: http
|
||||
protocol: TCP
|
||||
- containerPort: 443
|
||||
name: https
|
||||
protocol: TCP
|
||||
- containerPort: 8443
|
||||
name: webhook
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 90Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
add:
|
||||
- NET_BIND_SERVICE
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: false
|
||||
runAsNonRoot: true
|
||||
runAsUser: 101
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts:
|
||||
- mountPath: /usr/local/certificates/
|
||||
name: webhook-cert
|
||||
readOnly: true
|
||||
dnsPolicy: ClusterFirst
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
nodegroup: nd
|
||||
serviceAccountName: ingress-nginx
|
||||
terminationGracePeriodSeconds: 300
|
||||
volumes:
|
||||
- name: webhook-cert
|
||||
secret:
|
||||
secretName: ingress-nginx-admission
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission-create
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission-create
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- create
|
||||
- --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
|
||||
- --namespace=$(POD_NAMESPACE)
|
||||
- --secret-name=ingress-nginx-admission
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.3 #by.ljh
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: create
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
nodegroup: nd
|
||||
restartPolicy: OnFailure
|
||||
serviceAccountName: ingress-nginx-admission
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission-patch
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission-patch
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- patch
|
||||
- --webhook-name=ingress-nginx-admission
|
||||
- --namespace=$(POD_NAMESPACE)
|
||||
- --patch-mutating=false
|
||||
- --secret-name=ingress-nginx-admission
|
||||
- --patch-failure-policy=Fail
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.3 #by.ljh
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: patch
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
nodegroup: nd
|
||||
restartPolicy: OnFailure
|
||||
serviceAccountName: ingress-nginx-admission
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: IngressClass
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: nginx
|
||||
spec:
|
||||
controller: k8s.io/ingress-nginx
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
service:
|
||||
name: ingress-nginx-controller-admission
|
||||
namespace: ingress-nginx
|
||||
path: /networking/v1/ingresses
|
||||
failurePolicy: Fail
|
||||
matchPolicy: Equivalent
|
||||
name: validate.nginx.ingress.kubernetes.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- ingresses
|
||||
sideEffects: None
|
||||
|
|
@ -0,0 +1,663 @@
|
|||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
name: ingress-nginx
|
||||
---
|
||||
apiVersion: v1
|
||||
automountServiceAccountToken: true
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: v1
|
||||
automountServiceAccountToken: true
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- pods
|
||||
- secrets
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingressclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resourceNames:
|
||||
- ingress-nginx-leader
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- get
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- endpoints
|
||||
- nodes
|
||||
- pods
|
||||
- secrets
|
||||
- namespaces
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingressclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- get
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
rules:
|
||||
- apiGroups:
|
||||
- admissionregistration.k8s.io
|
||||
resources:
|
||||
- validatingwebhookconfigurations
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: ingress-nginx
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: ingress-nginx-admission
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: ingress-nginx
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: ingress-nginx-admission
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: v1
|
||||
data:
|
||||
allow-snippet-annotations: "false"
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
ports:
|
||||
- appProtocol: http
|
||||
name: http
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
nodePort: 30100 # by.sdjo
|
||||
- appProtocol: https
|
||||
name: https
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: https
|
||||
nodePort: 30101 # by.sdjo
|
||||
selector:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
type: NodePort
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-controller-admission
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
ports:
|
||||
- appProtocol: https
|
||||
name: https-webhook
|
||||
port: 443
|
||||
targetPort: webhook
|
||||
selector:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
minReadySeconds: 0
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- /nginx-ingress-controller
|
||||
- --election-id=ingress-nginx-leader
|
||||
- --controller-class=k8s.io/ingress-nginx
|
||||
- --ingress-class=nginx
|
||||
- --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
|
||||
- --validating-webhook=:8443
|
||||
- --validating-webhook-certificate=/usr/local/certificates/cert
|
||||
- --validating-webhook-key=/usr/local/certificates/key
|
||||
- --enable-metrics=false
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: LD_PRELOAD
|
||||
value: /usr/local/lib/libmimalloc.so
|
||||
image: reg.inje-private.com/nnd002/ingress-nginx/controller:v1.11.2 # by.ljh
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- /wait-shutdown
|
||||
livenessProbe:
|
||||
failureThreshold: 5
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
name: controller
|
||||
ports:
|
||||
- containerPort: 80
|
||||
name: http
|
||||
protocol: TCP
|
||||
- containerPort: 443
|
||||
name: https
|
||||
protocol: TCP
|
||||
- containerPort: 8443
|
||||
name: webhook
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 90Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
add:
|
||||
- NET_BIND_SERVICE
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: false
|
||||
runAsNonRoot: true
|
||||
runAsUser: 101
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts:
|
||||
- mountPath: /usr/local/certificates/
|
||||
name: webhook-cert
|
||||
readOnly: true
|
||||
dnsPolicy: ClusterFirst
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
serviceAccountName: ingress-nginx
|
||||
terminationGracePeriodSeconds: 300
|
||||
volumes:
|
||||
- name: webhook-cert
|
||||
secret:
|
||||
secretName: ingress-nginx-admission
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission-create
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission-create
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- create
|
||||
- --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
|
||||
- --namespace=$(POD_NAMESPACE)
|
||||
- --secret-name=ingress-nginx-admission
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
image: reg.inje-private.com/nnd002/ingress-nginx/kube-webhook-certgen:v1.4.3 #by.ljh
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: create
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
restartPolicy: OnFailure
|
||||
serviceAccountName: ingress-nginx-admission
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission-patch
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission-patch
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- patch
|
||||
- --webhook-name=ingress-nginx-admission
|
||||
- --namespace=$(POD_NAMESPACE)
|
||||
- --patch-mutating=false
|
||||
- --secret-name=ingress-nginx-admission
|
||||
- --patch-failure-policy=Fail
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
image: reg.inje-private.com/nnd002/ingress-nginx/kube-webhook-certgen:v1.4.3 #by.ljh
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: patch
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
restartPolicy: OnFailure
|
||||
serviceAccountName: ingress-nginx-admission
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: IngressClass
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: nginx
|
||||
spec:
|
||||
controller: k8s.io/ingress-nginx
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
service:
|
||||
name: ingress-nginx-controller-admission
|
||||
namespace: ingress-nginx
|
||||
path: /networking/v1/ingresses
|
||||
failurePolicy: Fail
|
||||
matchPolicy: Equivalent
|
||||
name: validate.nginx.ingress.kubernetes.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- ingresses
|
||||
sideEffects: None
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
#!/usr/bin/python3
|
||||
|
||||
import os
|
||||
import time
|
||||
|
||||
img_list = [
|
||||
"registry.k8s.io/ingress-nginx/controller:v1.11.2@sha256:d5f8217feeac4887cb1ed21f27c2674e58be06bd8f5184cacea2a69abaf78dce",
|
||||
"registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.3@sha256:a320a50cc91bd15fd2d6fa6de58bd98c1bd64b9a6f926ce23a600d87043455a3"
|
||||
]
|
||||
|
||||
public_registry_list = [
|
||||
"registry.k8s.io",
|
||||
|
||||
]
|
||||
|
||||
registry_path = "reg.inje-private.com"
|
||||
|
||||
harbor_project_name = "nnd002"
|
||||
|
||||
for var in img_list:
|
||||
os.system(f"docker pull {var}")
|
||||
for foo in public_registry_list:
|
||||
if var.startswith(foo):
|
||||
private_img_path = var.replace(foo, f"{registry_path}/{harbor_project_name}")
|
||||
break
|
||||
private_img_path = f"{registry_path}/{harbor_project_name}/{var}"
|
||||
# else: ljh 수정
|
||||
# private_img_path = f"{registry_path}/{harbor_project_name}/{var}"
|
||||
time.sleep(1)
|
||||
# os.system(f"echo {private_img_path}")
|
||||
os.system(f"docker tag {var} {private_img_path}")
|
||||
os.system(f"docker push {private_img_path}")
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: soo-nginx
|
||||
labels:
|
||||
app: soo-nginx
|
||||
spec:
|
||||
containers:
|
||||
- name: nginx
|
||||
image: nginx
|
||||
ports:
|
||||
- containerPort: 80
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: soo-nginx
|
||||
spec:
|
||||
selector:
|
||||
app: soo-nginx
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 80
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: soo-nginx-ingress
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
rules:
|
||||
- host: soo-nginx.test
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: soo-nginx
|
||||
port:
|
||||
number: 80
|
||||
|
|
@ -0,0 +1,202 @@
|
|||
|
||||
Apache License
|
||||
Version 2.0, January 2004
|
||||
http://www.apache.org/licenses/
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
|
||||
1. Definitions.
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||
or by an individual or Legal Entity authorized to submit on behalf of
|
||||
the copyright owner. For the purposes of this definition, "submitted"
|
||||
means any form of electronic, verbal, or written communication sent
|
||||
to the Licensor or its representatives, including but not limited to
|
||||
communication on electronic mailing lists, source code control systems,
|
||||
and issue tracking systems that are managed by, or on behalf of, the
|
||||
Licensor for the purpose of discussing and improving the Work, but
|
||||
excluding communication that is conspicuously marked or otherwise
|
||||
designated in writing by the copyright owner as "Not a Contribution."
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
APPENDIX: How to apply the Apache License to your work.
|
||||
|
||||
To apply the Apache License to your work, attach the following
|
||||
boilerplate notice, with the fields enclosed by brackets "{}"
|
||||
replaced with your own identifying information. (Don't include
|
||||
the brackets!) The text should be enclosed in the appropriate
|
||||
comment syntax for the file format. We also recommend that a
|
||||
file or class name and description of purpose be included on the
|
||||
same "printed page" as the copyright notice for easier
|
||||
identification within third-party archives.
|
||||
|
||||
Copyright {yyyy} {name of copyright owner}
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue