github.com/castai/kvisor@v1.7.1-0.20240516114728-b3572a2607b5/charts/kvisor/templates/controller.yaml (about)

     1  {{- if .Values.controller.enabled }}
     2  apiVersion: apps/v1
     3  kind: Deployment
     4  metadata:
     5    name: {{ include "kvisor.controller.fullname" . }}
     6    namespace: {{ .Release.Namespace }}
     7    labels:
     8      {{- include "kvisor.controller.labels" . | nindent 4 }}
     9  spec:
    10    replicas: {{ .Values.controller.replicas }}
    11    selector:
    12      matchLabels:
    13        {{- include "kvisor.controller.selectorLabels" . | nindent 6 }}
    14    template:
    15      metadata:
    16        annotations:
    17          checksum/config: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
    18        {{- if .Values.controller.prometheusScrape.enabled }}
    19          prometheus.io/scrape: "true"
    20          prometheus.io/port: "{{.Values.controller.httpListenPort}}"
    21        {{- end }}
    22        {{- if .Values.pyroscope.enabled }}
    23          phlare.grafana.com/scrape: "true"
    24          phlare.grafana.com/port: "{{ .Values.controller.httpListenPort }}"
    25          profiles.grafana.com/memory.scrape: "true"
    26          profiles.grafana.com/memory.port: "{{ .Values.controller.httpListenPort }}"
    27          profiles.grafana.com/cpu.scrape: "true"
    28          profiles.grafana.com/cpu.port: "{{ .Values.controller.httpListenPort }}"
    29          profiles.grafana.com/goroutine.scrape: "true"
    30          profiles.grafana.com/goroutine.port: "{{ .Values.controller.httpListenPort }}"
    31        {{- end }}
    32        {{- with .Values.controller.podAnnotations }}
    33          {{- toYaml . | nindent 8 }}
    34        {{- end }}
    35        labels:
    36          {{- include "kvisor.controller.selectorLabels" . | nindent 8 }}
    37          {{- include "kvisor.commonLabels" . | nindent 8 }}
    38      spec:
    39        serviceAccountName: {{ include "kvisor.controller.serviceAccountName" . }}
    40        dnsPolicy: {{.Values.controller.dnsPolicy}}
    41        securityContext:
    42          {{- toYaml .Values.controller.securityContext | nindent 8 }}
    43        containers:
    44          - name: controller
    45            image: "{{ .Values.image.repository }}-controller:{{ .Values.image.tag | default .Chart.AppVersion }}"
    46            imagePullPolicy: {{.Values.image.pullPolicy}}
    47            securityContext:
    48              {{- toYaml .Values.controller.containerSecurityContext | nindent 12 }}
    49            args:
    50              - "--http-listen-port={{.Values.controller.httpListenPort}}"
    51              - "--kube-server-listen-port={{.Values.controller.kubeAPIListenPort}}"
    52              - "--metrics-http-listen-port={{.Values.controller.metricsHTTPListenPort}}"
    53              - "--castai-secret-ref-name={{ include "kvisor.castaiSecretName" . }}"
    54              - "--image-scan-blobs-cache-url=http://{{ include "kvisor.controller.fullname" . }}.{{.Release.Namespace}}"
    55              - "--chart-version={{.Chart.Version}}"
    56            {{- if eq .Values.mockServer.enabled true }}
    57              - "--castai-server-insecure=true"
    58            {{- end }}
    59            {{- if eq .Values.agent.enabled true }}
    60              - "--agent-enabled=true"
    61            {{- end }}
    62          {{- range $key, $value := .Values.controller.extraArgs }}
    63              - "--{{ $key }}={{ $value }}"
    64          {{- end }}
    65            resources:
    66              {{- toYaml .Values.controller.resources | nindent 12 }}
    67            env:
    68              - name: POD_NAMESPACE
    69                valueFrom:
    70                  fieldRef:
    71                    fieldPath: metadata.namespace
    72              - name: POD_NAME
    73                valueFrom:
    74                  fieldRef:
    75                    fieldPath: metadata.name
    76              - name: CASTAI_API_GRPC_ADDR
    77                value: {{ if .Values.mockServer.enabled -}}
    78                         {{ (printf "%s:8443" (include "kvisor.castaiMockServer.service" .)) | quote }}
    79                       {{- else -}}
    80                         {{ .Values.castai.grpcAddr | quote }}
    81                       {{- end }}
    82              - name: CASTAI_CLUSTER_ID
    83                value: {{  .Values.castai.clusterID | quote }}
    84          {{- range $key, $value := .Values.controller.extraEnv }}
    85              - name: {{ $key }}
    86                value: {{ $value }}
    87          {{- end }}
    88          {{- if .Values.castai.enabled }}
    89            envFrom:
    90              - secretRef:
    91                  name: {{ include "kvisor.castaiSecretName" . }}
    92          {{- end }}
    93            ports:
    94              - name: http-server
    95                containerPort: {{ .Values.controller.httpListenPort }}
    96                protocol: TCP
    97              - name: kube-server
    98                containerPort: {{ .Values.controller.kubeAPIListenPort }}
    99                protocol: TCP
   100              - name: metrics
   101                containerPort: {{ .Values.controller.metricsHTTPListenPort }}
   102                protocol: TCP
   103            startupProbe:
   104              httpGet:
   105                path: /healthz
   106                port: http-server
   107              failureThreshold: 6
   108              periodSeconds: 10
   109            livenessProbe:
   110              httpGet:
   111                port: http-server
   112                path: /healthz
   113              periodSeconds: 5
   114            readinessProbe:
   115              httpGet:
   116                port: http-server
   117                path: /healthz
   118              periodSeconds: 5
   119        terminationGracePeriodSeconds: 10
   120        {{- with .Values.controller.nodeSelector }}
   121        nodeSelector:
   122          {{- toYaml . | nindent 8 }}
   123        {{- end }}
   124        {{- with .Values.controller.affinity }}
   125        affinity:
   126          {{- toYaml . | nindent 8 }}
   127        {{- end }}
   128        {{- with .Values.controller.tolerations }}
   129        tolerations:
   130          {{- toYaml . | nindent 8 }}
   131        {{- end }}
   132  
   133  {{- end }}
   134  ---
   135  {{- if .Values.controller.serviceAccount.create -}}
   136  apiVersion: v1
   137  kind: ServiceAccount
   138  metadata:
   139    name: {{ include "kvisor.controller.serviceAccountName" . }}
   140    namespace: {{ .Release.Namespace }}
   141    labels:
   142      {{- include "kvisor.controller.labels" . | nindent 4 }}
   143    {{- with .Values.controller.serviceAccount.annotations }}
   144    annotations:
   145      {{- toYaml . | nindent 4 }}
   146    {{- end }}
   147  ---
   148  kind: Role
   149  apiVersion: rbac.authorization.k8s.io/v1
   150  metadata:
   151    name: {{ include "kvisor.controller.fullname" . }}
   152    namespace: {{ .Release.Namespace }}
   153    labels:
   154      {{- include "kvisor.controller.labels" . | nindent 4 }}
   155    {{- with .Values.commonAnnotations }}
   156    annotations:
   157      {{- toYaml . | nindent 4 }}
   158    {{- end }}
   159  rules:
   160    # Access to manage jobs in castai-sec namespace.
   161    - apiGroups:
   162        - "batch"
   163      resources:
   164        - jobs
   165      verbs:
   166        - create
   167        - get
   168        - list
   169        - watch
   170        - delete
   171    - apiGroups:
   172        - ""
   173      resources:
   174        - pods/log
   175      verbs:
   176        - get
   177    - apiGroups:
   178        - "coordination.k8s.io"
   179      resources:
   180        - leases
   181      verbs:
   182        - get
   183        - create
   184        - update
   185        - list
   186        - watch
   187        - delete
   188    - apiGroups:
   189        - ""
   190      resources:
   191        - events
   192      verbs:
   193        - create
   194  ---
   195  kind: RoleBinding
   196  apiVersion: rbac.authorization.k8s.io/v1
   197  metadata:
   198    name: {{ include "kvisor.controller.fullname" . }}
   199    namespace: {{ .Release.Namespace }}
   200    labels:
   201        {{- include "kvisor.controller.labels" . | nindent 4 }}
   202    {{- with .Values.commonAnnotations }}
   203    annotations:
   204      {{- toYaml . | nindent 4 }}
   205    {{- end }}
   206  roleRef:
   207    apiGroup: rbac.authorization.k8s.io
   208    kind: Role
   209    name: {{ include "kvisor.controller.fullname" . }}
   210  subjects:
   211    - kind: ServiceAccount
   212      name: {{ include "kvisor.controller.serviceAccountName" . }}
   213      namespace: {{ .Release.Namespace }}
   214  ---
   215  apiVersion: rbac.authorization.k8s.io/v1
   216  kind: ClusterRole
   217  metadata:
   218    name: {{ include "kvisor.controller.fullname" . }}
   219    labels:
   220      {{- include "kvisor.controller.labels" . | nindent 4 }}
   221  rules:
   222    - apiGroups:
   223        - ""
   224      resources:
   225        - nodes
   226        - pods
   227        - events
   228        - namespaces
   229        - services
   230        - endpoints
   231      verbs:
   232        - get
   233        - list
   234        - watch
   235    - apiGroups:
   236        - "apps"
   237      resources:
   238        - deployments
   239        - replicasets
   240        - daemonsets
   241        - statefulsets
   242      verbs:
   243        - get
   244        - list
   245        - watch
   246    - apiGroups:
   247        - "batch"
   248      resources:
   249        - jobs
   250        - cronjobs
   251      verbs:
   252        - get
   253        - list
   254        - watch
   255    - apiGroups:
   256        - "networking.k8s.io"
   257      resources:
   258        - networkpolicies
   259        - ingresses
   260      verbs:
   261        - get
   262        - list
   263        - watch
   264    - apiGroups:
   265        - "rbac.authorization.k8s.io"
   266      resources:
   267        - roles
   268        - rolebindings
   269        - clusterroles
   270        - clusterrolebindings
   271      verbs:
   272        - get
   273        - list
   274        - watch
   275  ---
   276  apiVersion: rbac.authorization.k8s.io/v1
   277  kind: ClusterRoleBinding
   278  metadata:
   279    name: {{ include "kvisor.controller.fullname" . }}
   280    labels:
   281      {{- include "kvisor.controller.labels" . | nindent 4 }}
   282  roleRef:
   283    apiGroup: rbac.authorization.k8s.io
   284    kind: ClusterRole
   285    name: {{ include "kvisor.controller.fullname" . }}
   286  subjects:
   287    - kind: ServiceAccount
   288      name: {{ include "kvisor.controller.serviceAccountName" . }}
   289      namespace: {{.Release.Namespace}}
   290  {{- end }}
   291  ---
   292  apiVersion: v1
   293  kind: Service
   294  metadata:
   295    name: {{ include "kvisor.controller.fullname" . }}
   296    namespace: {{ .Release.Namespace }}
   297  spec:
   298    ports:
   299      - port: 80
   300        name: http
   301        targetPort: http-server
   302        protocol: TCP
   303      - port: {{ .Values.controller.kubeAPIListenPort }}
   304        name: kube
   305        targetPort: kube-server
   306        protocol: TCP
   307    selector:
   308      {{- include "kvisor.controller.selectorLabels" . | nindent 6 }}
   309    type: ClusterIP