diff --git a/charts/library/common-test/Chart.yaml b/charts/library/common-test/Chart.yaml index a01d9f9715f..d7effa50b6e 100644 --- a/charts/library/common-test/Chart.yaml +++ b/charts/library/common-test/Chart.yaml @@ -7,7 +7,7 @@ apiVersion: v2 appVersion: unknown dependencies: - name: common - version: ~26.4.0 + version: ~27.0.0 repository: file://../common/ condition: "" alias: "" diff --git a/charts/library/common-test/ci/vpn-openvpn-values.yaml b/charts/library/common-test/ci/vpn-openvpn-values.yaml deleted file mode 100644 index 7566956c2ae..00000000000 --- a/charts/library/common-test/ci/vpn-openvpn-values.yaml +++ /dev/null @@ -1,80 +0,0 @@ -service: - main: - enabled: true - primary: true - ports: - main: - enabled: true - primary: true - protocol: http - port: 8080 - -workload: - main: - enabled: true - primary: true - type: Deployment - podSpec: - containers: - main: - enabled: true - primary: true - args: - - --port - - "8080" - probes: - liveness: - enabled: true - type: http - port: "{{ .Values.service.main.ports.main.port }}" - readiness: - enabled: true - type: http - port: "{{ .Values.service.main.ports.main.port }}" - startup: - enabled: true - type: http - port: "{{ .Values.service.main.ports.main.port }}" - -args: - - --port - - "8080" - -# -- The common chart supports several add-ons. These can be configured under this key. -# @default -- See below -addons: - # -- The common chart supports adding a VPN add-on. It can be configured under this key. - # For more info, check out [our docs](http://docs.k8s-at-home.com/our-helm-charts/common-library-add-ons/#wireguard-vpn) - # @default -- See values.yaml - vpn: - # -- Specify the VPN type. Valid options are disabled, gluetun or tailscale - type: openvpn - - # -- OpenVPN specific configuration - # @default -- See below - openvpn: - # -- Credentials to connect to the VPN Service (used with -a) - # Only using password is enough - username: "testuser" - password: "testpass" - - # -- All variables specified here will be added to the vpn sidecar container - # See the documentation of the VPN image for all config values - env: - something: UTC - - # -- you can directly specify the config file here - config: "fdgdfsg" - - scripts: - # -- you can directly specify the upscript here - up: "sffds" - # some script - - # -- you can directly specify the downscript here - down: "fsdfds" - # some script - - # -- select pods to bind vpn addon to - targetSelector: - - main diff --git a/charts/library/common-test/ci/vpn-wireguard-values.yaml b/charts/library/common-test/ci/vpn-wireguard-values.yaml deleted file mode 100644 index 241a644e93a..00000000000 --- a/charts/library/common-test/ci/vpn-wireguard-values.yaml +++ /dev/null @@ -1,72 +0,0 @@ -service: - main: - enabled: true - primary: true - ports: - main: - enabled: true - primary: true - protocol: http - port: 8080 - -workload: - main: - enabled: true - primary: true - type: Deployment - podSpec: - containers: - main: - enabled: true - primary: true - args: - - --port - - "8080" - probes: - liveness: - enabled: true - type: http - port: "{{ .Values.service.main.ports.main.port }}" - readiness: - enabled: true - type: http - port: "{{ .Values.service.main.ports.main.port }}" - startup: - enabled: true - type: http - port: "{{ .Values.service.main.ports.main.port }}" - -args: - - --port - - "8080" - -# -- The common chart supports several add-ons. These can be configured under this key. -# @default -- See below -addons: - # -- The common chart supports adding a VPN add-on. It can be configured under this key. - # For more info, check out [our docs](http://docs.k8s-at-home.com/our-helm-charts/common-library-add-ons/#wireguard-vpn) - # @default -- See values.yaml - vpn: - # -- Specify the VPN type. Valid options are disabled, gluetun or tailscale - type: wireguard - - # -- All variables specified here will be added to the vpn sidecar container - # See the documentation of the VPN image for all config values - env: - something: UTC - - # -- you can directly specify the config file here - config: "fdgdfsg" - - scripts: - # -- you can directly specify the upscript here - up: "sffds" - # some script - - # -- you can directly specify the downscript here - down: "fsdfds" - # some script - - # -- select pods to bind vpn addon to - targetSelector: - - main diff --git a/charts/library/common-test/tests/addons/codeserver_test.yaml b/charts/library/common-test/tests/addons/codeserver_test.yaml index 743f4c354b3..d642542647a 100644 --- a/charts/library/common-test/tests/addons/codeserver_test.yaml +++ b/charts/library/common-test/tests/addons/codeserver_test.yaml @@ -314,3 +314,64 @@ tests: equal: path: spec.rules[0].http.paths[0].backend.service.port.number value: 30067 + + - it: should apply resources on the addon container + set: + workload: *workload + addons: + codeserver: + enabled: true + container: + resources: + limits: + cpu: 3333m + memory: 3333Mi + requests: + cpu: 222m + memory: 222Mi + asserts: + - documentIndex: &DeploymentDocument 0 + isKind: + of: Deployment + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[0].name + value: test-release-name-common-test-codeserver + - documentIndex: *DeploymentDocument + isSubset: + path: spec.template.spec.containers[0] + content: + resources: + limits: + cpu: 3333m + memory: 3333Mi + requests: + cpu: 222m + memory: 222Mi + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[1].name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + isSubset: + path: spec.template.spec.containers[1] + content: + resources: + limits: + cpu: 4000m + memory: 8Gi + requests: + cpu: 10m + memory: 50Mi + + - it: should fail if more than 1 workload selected + set: + addons: + codeserver: + enabled: true + targetSelector: + - workload + - other-workload + asserts: + - failedTemplate: + errorMessage: Codeserver Addon - Can only be attached to a single workload at a time diff --git a/charts/library/common-test/tests/addons/gluetun_test.yaml b/charts/library/common-test/tests/addons/gluetun_test.yaml new file mode 100644 index 00000000000..8a2f68ccd39 --- /dev/null +++ b/charts/library/common-test/tests/addons/gluetun_test.yaml @@ -0,0 +1,302 @@ +suite: addon vpn +templates: + - common.yaml +release: + name: test-release-name + namespace: test-release-namespace +tests: + - it: addon vpn gluetun enabled with config and env should pass + set: + resources: + limits: + nvidia.com/gpu: 1 + addons: + gluetun: + enabled: true + secret: + my-conf: + basePath: /gluetun/wireguard + data: + wg0.conf: | + some vpn config + with multiple lines + container: + env: + key: value + key1: value1 + key2: value2 + key3: value3 + workload: &workload + main: + enabled: true + primary: true + type: Deployment + podSpec: + containers: + container-1: + enabled: true + primary: true + probes: + liveness: + enabled: false + readiness: + enabled: false + startup: + enabled: false + service: + service-name1: + enabled: true + primary: true + ports: + port-1: + enabled: true + primary: true + port: 8080 + asserts: + - hasDocuments: + count: 3 + - documentIndex: &SecretDocument 0 + isKind: + of: Secret + - documentIndex: &DeploymentDocument 1 + isKind: + of: Deployment + - documentIndex: &ServiceDocument 2 + isKind: + of: Service + - documentIndex: *SecretDocument + equal: + path: metadata.name + value: test-release-name-common-test-gluetun-my-conf + - documentIndex: *SecretDocument + equal: + path: stringData + value: + wg0.conf: | + some vpn config + with multiple lines + - documentIndex: *DeploymentDocument + equal: + path: metadata.name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[0].name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + isSubset: + path: spec.template.spec.containers[0] + content: + resources: + limits: + cpu: 4000m + memory: 8Gi + nvidia.com/gpu: 1 + requests: + cpu: 10m + memory: 50Mi + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[1].name + value: test-release-name-common-test-gluetun + - documentIndex: *DeploymentDocument + isSubset: + path: spec.template.spec.containers[1] + content: + resources: + limits: + cpu: 4000m + memory: 8Gi + requests: + cpu: 10m + memory: 50Mi + - documentIndex: *ServiceDocument + equal: + path: metadata.name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + notContains: + path: spec.template.spec.containers[0].volumeMounts + content: &content + mountPath: /gluetun/wireguard + name: gluetun-my-conf + readOnly: false + - documentIndex: *DeploymentDocument + notContains: + path: spec.template.spec.containers[0].env + content: + name: key + value: value + - documentIndex: *DeploymentDocument + notContains: + path: spec.template.spec.containers[0].env + content: + name: key1 + value: value1 + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.containers[1].env + content: + name: key + value: value + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.containers[1].env + content: + name: key1 + value: value1 + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.containers[1].env + content: + name: key2 + value: value2 + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.containers[1].env + content: + name: key3 + value: value3 + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.containers[1].volumeMounts + content: *content + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.volumes + content: + name: gluetun-my-conf + secret: + items: + - key: wg0.conf + path: wg0.conf + optional: false + secretName: test-release-name-common-test-gluetun-my-conf + + - it: addon vpn gluetun enabled with scripts added + set: + addons: + gluetun: + enabled: true + secret: + my-conf: + basePath: /gluetun/wireguard + data: + wg0.conf: | + some vpn config + with multiple lines + scripts: + basePath: /gluetun/scripts + defaultMode: "0777" + data: + up.sh: | + echo "up" + echo "done" + down.sh: | + echo "down" + echo "done" + workload: *workload + service: + main: + enabled: true + primary: true + ports: + main: + enabled: true + primary: true + port: 8080 + asserts: + - hasDocuments: + count: 4 + - documentIndex: &SecretConfDocument 0 + isKind: + of: Secret + - documentIndex: *SecretConfDocument + equal: + path: metadata.name + value: test-release-name-common-test-gluetun-my-conf + - documentIndex: &SecretScriptsDocument 1 + isKind: + of: Secret + - documentIndex: *SecretScriptsDocument + equal: + path: metadata.name + value: test-release-name-common-test-gluetun-scripts + - documentIndex: &DeploymentDocument 2 + isKind: + of: Deployment + - documentIndex: &ServiceDocument 3 + isKind: + of: Service + - documentIndex: *SecretScriptsDocument + equal: + path: stringData + value: + up.sh: | + echo "up" + echo "done" + down.sh: | + echo "down" + echo "done" + - documentIndex: *SecretConfDocument + equal: + path: stringData + value: + wg0.conf: | + some vpn config + with multiple lines + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[0].name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.containers[1].volumeMounts + content: &content1 + mountPath: /gluetun/wireguard + name: gluetun-my-conf + readOnly: false + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.containers[1].volumeMounts + content: &content2 + mountPath: /gluetun/scripts + name: gluetun-scripts + readOnly: false + - documentIndex: *DeploymentDocument + notContains: + path: spec.template.spec.containers[0].volumeMounts + content: *content1 + - documentIndex: *DeploymentDocument + notContains: + path: spec.template.spec.containers[0].volumeMounts + content: *content2 + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[1].name + value: test-release-name-common-test-gluetun + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.volumes + content: + name: gluetun-my-conf + secret: + items: + - key: wg0.conf + path: wg0.conf + optional: false + secretName: test-release-name-common-test-gluetun-my-conf + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.volumes + content: + name: gluetun-scripts + secret: + defaultMode: 511 + items: + - key: down.sh + path: down.sh + - key: up.sh + path: up.sh + optional: false + secretName: test-release-name-common-test-gluetun-scripts diff --git a/charts/library/common-test/tests/addons/tailscale_test.yaml b/charts/library/common-test/tests/addons/tailscale_test.yaml new file mode 100644 index 00000000000..c1b95335768 --- /dev/null +++ b/charts/library/common-test/tests/addons/tailscale_test.yaml @@ -0,0 +1,282 @@ +suite: addon tailscale +templates: + - common.yaml +release: + name: test-release-name + namespace: test-release-namespace +tests: + - it: addon enabled should pass + set: + resources: + limits: + nvidia.com/gpu: 1 + workload: + main: + enabled: true + primary: true + type: Deployment + podSpec: + containers: + main: + enabled: true + primary: true + service: + main: + enabled: true + primary: true + ports: + main: + enabled: true + primary: true + port: 8080 + addons: + tailscale: + enabled: true + container: + env: + TS_AUTH_KEY: something + asserts: + - hasDocuments: + count: 2 + - documentIndex: &DeploymentDocument 0 + isKind: + of: Deployment + - documentIndex: &ServiceDocument 1 + isKind: + of: Service + - documentIndex: *ServiceDocument + equal: + path: metadata.name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + equal: + path: metadata.name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[0].name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + isSubset: + path: spec.template.spec + content: + automountServiceAccountToken: true + - documentIndex: *DeploymentDocument + isSubset: + path: spec.template.spec.containers[0] + content: + resources: + limits: + cpu: 4000m + memory: 8Gi + nvidia.com/gpu: 1 + requests: + cpu: 10m + memory: 50Mi + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[1].name + value: test-release-name-common-test-tailscale + - documentIndex: *DeploymentDocument + isSubset: + path: spec.template.spec.containers[1] + content: + resources: + limits: + cpu: 4000m + memory: 8Gi + requests: + cpu: 10m + memory: 50Mi + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.containers[1].env + content: + name: TS_AUTH_KEY + value: something + - documentIndex: *DeploymentDocument + isSubset: + path: spec.template.spec.containers[1].securityContext + content: + runAsUser: 1000 + runAsGroup: 1000 + runAsNonRoot: true + readOnlyRootFilesystem: true + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.volumes + content: + name: tailscalestate + emptyDir: {} + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.containers[1].volumeMounts + content: + name: tailscalestate + mountPath: /var/lib/tailscale + readOnly: false + + - it: addon enabled should pass with userspace to false + set: + resources: + limits: + nvidia.com/gpu: 1 + workload: + main: + enabled: true + primary: true + type: Deployment + podSpec: + containers: + main: + enabled: true + primary: true + service: + main: + enabled: true + primary: true + ports: + main: + enabled: true + primary: true + port: 8080 + addons: + tailscale: + enabled: true + container: + env: + TS_AUTH_KEY: something + TS_USERSPACE: false + asserts: + - hasDocuments: + count: 2 + - documentIndex: &DeploymentDocument 0 + isKind: + of: Deployment + - documentIndex: &ServiceDocument 1 + isKind: + of: Service + - documentIndex: *ServiceDocument + equal: + path: metadata.name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + equal: + path: metadata.name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[0].name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + isSubset: + path: spec.template.spec.containers[0] + content: + resources: + limits: + cpu: 4000m + memory: 8Gi + nvidia.com/gpu: 1 + requests: + cpu: 10m + memory: 50Mi + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[1].name + value: test-release-name-common-test-tailscale + - documentIndex: *DeploymentDocument + isSubset: + path: spec.template.spec.containers[1] + content: + resources: + limits: + cpu: 4000m + memory: 8Gi + requests: + cpu: 10m + memory: 50Mi + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.containers[1].env + content: + name: TS_AUTH_KEY + value: something + - documentIndex: *DeploymentDocument + isSubset: + path: spec.template.spec.containers[1].securityContext + content: + runAsUser: 0 + runAsGroup: 0 + runAsNonRoot: false + readOnlyRootFilesystem: false + + - it: addon enabled should pass with state set to hostpath + set: + persistence: + tailscalestate: + type: hostPath + hostPath: /test + workload: + main: + enabled: true + primary: true + type: Deployment + podSpec: + containers: + main: + enabled: true + primary: true + service: + main: + enabled: true + primary: true + ports: + main: + enabled: true + primary: true + port: 8080 + addons: + tailscale: + enabled: true + container: + env: + TS_AUTH_KEY: something + asserts: + - hasDocuments: + count: 2 + - documentIndex: &DeploymentDocument 0 + isKind: + of: Deployment + - documentIndex: &ServiceDocument 1 + isKind: + of: Service + - documentIndex: *ServiceDocument + equal: + path: metadata.name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + equal: + path: metadata.name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[0].name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[1].name + value: test-release-name-common-test-tailscale + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.volumes + content: + name: tailscalestate + hostPath: + path: /test + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.containers[1].volumeMounts + content: + name: tailscalestate + mountPath: /var/lib/tailscale + readOnly: false diff --git a/charts/library/common-test/tests/addons/vpn_test.yaml b/charts/library/common-test/tests/addons/vpn_test.yaml deleted file mode 100644 index 5d28880b79d..00000000000 --- a/charts/library/common-test/tests/addons/vpn_test.yaml +++ /dev/null @@ -1,964 +0,0 @@ -suite: addon vpn -templates: - - common.yaml -release: - name: test-release-name - namespace: test-release-namespace -tests: - - it: addon vpn gluetun enabled with config and env should pass - set: - resources: - limits: - nvidia.com/gpu: 1 - addons: - vpn: - type: gluetun - config: | - some vpn config - with multiple lines - env: - key: value - key1: value1 - envList: - - name: key2 - value: value2 - - name: key3 - value: value3 - workload: &workload - main: - enabled: true - primary: true - type: Deployment - podSpec: - containers: - main: - enabled: true - primary: true - service: - main: - enabled: true - primary: true - ports: - main: - enabled: true - primary: true - port: 8080 - asserts: - - hasDocuments: - count: 3 - - documentIndex: &SecretDocument 0 - isKind: - of: Secret - - documentIndex: &DeploymentDocument 1 - isKind: - of: Deployment - - documentIndex: &ServiceDocument 2 - isKind: - of: Service - - documentIndex: *SecretDocument - equal: - path: metadata.name - value: test-release-name-common-test-vpnconfig - - documentIndex: *SecretDocument - equal: - path: stringData - value: - vpn.conf: |- - some vpn config - with multiple lines - - documentIndex: *DeploymentDocument - equal: - path: metadata.name - value: test-release-name-common-test - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[0].name - value: test-release-name-common-test - - documentIndex: *DeploymentDocument - isSubset: - path: spec.template.spec.containers[0] - content: - resources: - limits: - cpu: 4000m - memory: 8Gi - nvidia.com/gpu: 1 - requests: - cpu: 10m - memory: 50Mi - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[1].name - value: test-release-name-common-test-vpn - - documentIndex: *DeploymentDocument - isSubset: - path: spec.template.spec.containers[1] - content: - resources: - limits: - cpu: 4000m - memory: 8Gi - requests: - cpu: 10m - memory: 50Mi - - documentIndex: *ServiceDocument - equal: - path: metadata.name - value: test-release-name-common-test - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnconfig - mountPath: /gluetun - readOnly: false - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].env - content: - name: key - value: value - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].env - content: - name: key1 - value: value1 - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: key - value: value - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: key1 - value: value1 - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: key2 - value: value2 - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: key3 - value: value3 - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].volumeMounts - content: - name: vpnconfig - mountPath: /gluetun - readOnly: false - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnconfig - secret: - secretName: test-release-name-common-test-vpnconfig - defaultMode: 0777 - optional: false - items: - - key: vpn.conf - path: vpn.conf - - - it: addon vpn gluetun enabled with scripts added - set: - addons: - vpn: - type: gluetun - config: | - some vpn config - with multiple lines - scripts: - up: | - echo "up" - echo "done" - down: | - echo "down" - echo "done" - workload: *workload - service: - main: - enabled: true - primary: true - ports: - main: - enabled: true - primary: true - port: 8080 - asserts: - - hasDocuments: - count: 4 - - documentIndex: &ConfigMapDocument 0 - isKind: - of: ConfigMap - - documentIndex: &SecretDocument 1 - isKind: - of: Secret - - documentIndex: &DeploymentDocument 2 - isKind: - of: Deployment - - documentIndex: &ServiceDocument 3 - isKind: - of: Service - - documentIndex: *SecretDocument - equal: - path: metadata.name - value: test-release-name-common-test-vpnconfig - - documentIndex: *ConfigMapDocument - equal: - path: metadata.name - value: test-release-name-common-test-vpnscripts - - documentIndex: *ConfigMapDocument - equal: - path: data - value: - up.sh: |- - echo "up" - echo "done" - down.sh: |- - echo "down" - echo "done" - - documentIndex: *SecretDocument - equal: - path: stringData - value: - vpn.conf: |- - some vpn config - with multiple lines - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[0].name - value: test-release-name-common-test - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].volumeMounts - content: - name: vpnconfig - mountPath: /gluetun - readOnly: false - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].volumeMounts - content: - name: vpnscripts - mountPath: /gluetun - readOnly: false - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnconfig - mountPath: /gluetun - readOnly: false - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnscripts - mountPath: /gluetun - readOnly: false - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[1].name - value: test-release-name-common-test-vpn - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnconfig - secret: - secretName: test-release-name-common-test-vpnconfig - defaultMode: 0777 - optional: false - items: - - key: vpn.conf - path: vpn.conf - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnscripts - configMap: - name: vpnscripts - defaultMode: 0777 - optional: false - items: - - key: up.sh - path: up.sh - - key: down.sh - path: down.sh - - - it: addon vpn gluetun enabled with existing secret - set: - addons: - vpn: - type: gluetun - existingSecret: existing-secret - workload: *workload - service: - main: - enabled: true - primary: true - ports: - main: - enabled: true - primary: true - port: 8080 - asserts: - - hasDocuments: - count: 2 - - documentIndex: &DeploymentDocument 0 - isKind: - of: Deployment - - documentIndex: &ServiceDocument 1 - isKind: - of: Service - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[0].name - value: test-release-name-common-test - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].volumeMounts - content: - name: vpnconfig - mountPath: /gluetun - readOnly: false - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnconfig - mountPath: /gluetun - readOnly: false - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[1].name - value: test-release-name-common-test-vpn - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnconfig - secret: - secretName: existing-secret - defaultMode: 0777 - optional: false - items: - - key: vpn.conf - path: vpn.conf - - - it: addon vpn gluetun enabled with configFile - set: - addons: - vpn: - type: gluetun - configFile: /path/to/file - workload: *workload - service: - main: - enabled: true - primary: true - ports: - main: - enabled: true - primary: true - port: 8080 - asserts: - - hasDocuments: - count: 3 - - documentIndex: &JobDocument 0 - isKind: - of: Job - - documentIndex: &DeploymentDocument 1 - isKind: - of: Deployment - - documentIndex: &ServiceDocument 2 - isKind: - of: Service - - documentIndex: *JobDocument - equal: - path: metadata.name - value: test-release-name-common-test-autopermissions - - documentIndex: *JobDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnconfig - hostPath: - path: /path/to/file - type: File - - documentIndex: *JobDocument - contains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnconfig - mountPath: /mounts/vpnconfig - readOnly: false - - documentIndex: *JobDocument - equal: - path: spec.template.spec.containers[0].args - value: - - |- - echo "Starting auto permissions job..." - touch /tmp/healthy - - echo "Automatically correcting ownership and permissions..." - echo "Automatically correcting ownership for /mounts/vpnconfig..." - before=$(stat -c "%u:%g" /mounts/vpnconfig) - chown -f 568:568 /mounts/vpnconfig || echo "Failed setting ownership using chown..." - - echo "Ownership before: [$before]" - echo "Ownership after: [$(stat -c "%u:%g" /mounts/vpnconfig)]" - echo "" - echo "Finished auto permissions job..." - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[0].name - value: test-release-name-common-test - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].volumeMounts - content: - name: vpnconfig - mountPath: /gluetun/vpn.conf - readOnly: false - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnconfig - mountPath: /gluetun/vpn.conf - readOnly: false - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[1].name - value: test-release-name-common-test-vpn - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnconfig - hostPath: - path: /path/to/file - type: File - - - it: addon vpn gluetun enabled with configFolder - set: - addons: - vpn: - type: gluetun - configFolder: /path/to/folder - workload: *workload - service: - main: - enabled: true - primary: true - ports: - main: - enabled: true - primary: true - port: 8080 - asserts: - - hasDocuments: - count: 3 - - documentIndex: &JobDocument 0 - isKind: - of: Job - - documentIndex: *JobDocument - equal: - path: metadata.name - value: test-release-name-common-test-autopermissions - - documentIndex: *JobDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnfolder - hostPath: - path: /path/to/folder - - documentIndex: *JobDocument - contains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnfolder - mountPath: /mounts/vpnfolder - readOnly: false - - documentIndex: *JobDocument - equal: - path: spec.template.spec.containers[0].args - value: - - |- - echo "Starting auto permissions job..." - touch /tmp/healthy - - echo "Automatically correcting ownership and permissions..." - echo "Automatically correcting ownership for /mounts/vpnfolder..." - before=$(stat -c "%u:%g" /mounts/vpnfolder) - chown -f 568:568 /mounts/vpnfolder || echo "Failed setting ownership using chown..." - - echo "Ownership before: [$before]" - echo "Ownership after: [$(stat -c "%u:%g" /mounts/vpnfolder)]" - echo "" - echo "Finished auto permissions job..." - - documentIndex: &DeploymentDocument 1 - isKind: - of: Deployment - - documentIndex: &ServiceDocument 2 - isKind: - of: Service - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[0].name - value: test-release-name-common-test - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].volumeMounts - content: - name: vpnfolder - mountPath: /gluetun - readOnly: false - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnfolder - mountPath: /gluetun - readOnly: false - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[1].name - value: test-release-name-common-test-vpn - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnfolder - hostPath: - path: /path/to/folder - - - it: tailscale addon enabled with authkey should pass - set: - resources: - limits: - nvidia.com/gpu: 1 - addons: - vpn: - type: tailscale - tailscale: - authkey: something - userspace: true - env: - key: value - key1: value1 - workload: *workload - asserts: - - hasDocuments: - count: 1 - - documentIndex: &DeploymentDocument 0 - isKind: - of: Deployment - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.automountServiceAccountToken - value: true - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[0].name - value: test-release-name-common-test - - documentIndex: *DeploymentDocument - isSubset: - path: spec.template.spec.containers[0] - content: - resources: - limits: - cpu: 4000m - memory: 8Gi - nvidia.com/gpu: 1 - requests: - cpu: 10m - memory: 50Mi - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[1].name - value: test-release-name-common-test-tailscale - - documentIndex: *DeploymentDocument - isSubset: - path: spec.template.spec.containers[1] - content: - resources: - limits: - cpu: 4000m - memory: 8Gi - requests: - cpu: 10m - memory: 50Mi - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: TS_KUBE_SECRET - value: "" - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: TS_SOCKET - value: /var/run/tailscale/tailscaled.sock - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: TS_STATE_DIR - value: /var/lib/tailscale/state - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: TS_AUTH_ONCE - value: "true" - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: TS_USERSPACE - value: "true" - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: TS_ACCEPT_DNS - value: "false" - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: TS_AUTH_KEY - value: something - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].env - content: - name: key - value: value - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].env - content: - name: key1 - value: value1 - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: key - value: value - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: key1 - value: value1 - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].volumeMounts - content: - name: tailscalestate - mountPath: /var/lib/tailscale - readOnly: false - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: tailscalestate - mountPath: /var/lib/tailscale - readOnly: false - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.volumes - content: - name: tailscalestate - emptyDir: {} - - - it: tailscale addon enabled with authkey without userspace should pass - set: - addons: - vpn: - type: tailscale - tailscale: - authkey: something - userspace: false - key1: value1 - workload: *workload - asserts: - - hasDocuments: - count: 1 - - documentIndex: &DeploymentDocument 0 - isKind: - of: Deployment - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[0].name - value: test-release-name-common-test - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[1].name - value: test-release-name-common-test-tailscale - - documentIndex: *DeploymentDocument - isSubset: - path: spec.template.spec.containers[1].securityContext - content: - privileged: false - readOnlyRootFilesystem: false - runAsNonRoot: false - runAsUser: 0 - runAsGroup: 0 - - - it: addon vpn openvpn enabled with configFile - set: - resources: - limits: - nvidia.com/gpu: 1 - addons: - vpn: - type: openvpn - configFile: /path/to/file - workload: *workload - service: - main: - enabled: true - primary: true - ports: - main: - enabled: true - primary: true - port: 8080 - asserts: - - hasDocuments: - count: 3 - - documentIndex: &JobDocument 0 - isKind: - of: Job - - documentIndex: &DeploymentDocument 1 - isKind: - of: Deployment - - documentIndex: &ServiceDocument 2 - isKind: - of: Service - - documentIndex: *JobDocument - equal: - path: metadata.name - value: test-release-name-common-test-autopermissions - - documentIndex: *JobDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnconfig - hostPath: - path: /path/to/file - type: File - - documentIndex: *JobDocument - contains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnconfig - mountPath: /mounts/vpnconfig - readOnly: false - - documentIndex: *JobDocument - equal: - path: spec.template.spec.containers[0].args - value: - - |- - echo "Starting auto permissions job..." - touch /tmp/healthy - - echo "Automatically correcting ownership and permissions..." - echo "Automatically correcting ownership for /mounts/vpnconfig..." - before=$(stat -c "%u:%g" /mounts/vpnconfig) - chown -f 568:568 /mounts/vpnconfig || echo "Failed setting ownership using chown..." - - echo "Ownership before: [$before]" - echo "Ownership after: [$(stat -c "%u:%g" /mounts/vpnconfig)]" - echo "" - echo "Finished auto permissions job..." - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[0].name - value: test-release-name-common-test - - documentIndex: *DeploymentDocument - isSubset: - path: spec.template.spec.containers[0] - content: - resources: - limits: - cpu: 4000m - memory: 8Gi - nvidia.com/gpu: 1 - requests: - cpu: 10m - memory: 50Mi - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].volumeMounts - content: - name: vpnconfig - mountPath: /vpn/vpn.conf - readOnly: false - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnconfig - mountPath: /vpn/vpn.conf - readOnly: false - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[1].name - value: test-release-name-common-test-vpn - - documentIndex: *DeploymentDocument - isSubset: - path: spec.template.spec.containers[1] - content: - resources: - limits: - cpu: 4000m - memory: 8Gi - requests: - cpu: 10m - memory: 50Mi - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnconfig - hostPath: - path: /path/to/file - type: File - - - it: addon vpn wireguard enabled with configFile - set: - resources: - limits: - nvidia.com/gpu: 1 - addons: - vpn: - type: wireguard - configFile: /path/to/file - workload: *workload - service: - main: - enabled: true - primary: true - ports: - main: - enabled: true - primary: true - port: 8080 - asserts: - - hasDocuments: - count: 3 - - documentIndex: &JobDocument 0 - isKind: - of: Job - - documentIndex: &DeploymentDocument 1 - isKind: - of: Deployment - - documentIndex: &ServiceDocument 2 - isKind: - of: Service - - documentIndex: *JobDocument - equal: - path: metadata.name - value: test-release-name-common-test-autopermissions - - documentIndex: *JobDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnconfig - hostPath: - path: /path/to/file - type: File - - documentIndex: *JobDocument - contains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnconfig - mountPath: /mounts/vpnconfig - readOnly: false - - documentIndex: *JobDocument - equal: - path: spec.template.spec.containers[0].args - value: - - |- - echo "Starting auto permissions job..." - touch /tmp/healthy - - echo "Automatically correcting ownership and permissions..." - echo "Automatically correcting ownership for /mounts/vpnconfig..." - before=$(stat -c "%u:%g" /mounts/vpnconfig) - chown -f 568:568 /mounts/vpnconfig || echo "Failed setting ownership using chown..." - - echo "Ownership before: [$before]" - echo "Ownership after: [$(stat -c "%u:%g" /mounts/vpnconfig)]" - echo "" - echo "Finished auto permissions job..." - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[0].name - value: test-release-name-common-test - - documentIndex: *DeploymentDocument - isSubset: - path: spec.template.spec.containers[0] - content: - resources: - limits: - cpu: 4000m - memory: 8Gi - nvidia.com/gpu: 1 - requests: - cpu: 10m - memory: 50Mi - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].volumeMounts - content: - name: vpnconfig - mountPath: /etc/wireguard/vpn.conf - readOnly: false - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnconfig - mountPath: /etc/wireguard/vpn.conf - readOnly: false - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[1].name - value: test-release-name-common-test-vpn - - documentIndex: *DeploymentDocument - isSubset: - path: spec.template.spec.containers[1] - content: - resources: - limits: - cpu: 4000m - memory: 8Gi - requests: - cpu: 10m - memory: 50Mi - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnconfig - hostPath: - path: /path/to/file - type: File diff --git a/charts/library/common/Chart.yaml b/charts/library/common/Chart.yaml index 4ac2350d9c9..8c1fd6b8b5b 100644 --- a/charts/library/common/Chart.yaml +++ b/charts/library/common/Chart.yaml @@ -48,4 +48,4 @@ sources: - https://hub.docker.com/_/ - https://hub.docker.com/r/mikefarah/yq type: library -version: 26.4.3 +version: 27.0.0 diff --git a/charts/library/common/templates/addons/_codeserver.tpl b/charts/library/common/templates/addons/_codeserver.tpl new file mode 100644 index 00000000000..c1187fd002b --- /dev/null +++ b/charts/library/common/templates/addons/_codeserver.tpl @@ -0,0 +1,72 @@ +{{/* +Template to render code-server addon +It will include / inject the required templates based on the given values. +*/}} +{{- define "tc.v1.common.addon.codeserver" -}} + {{- $codeSrv := $.Values.addons.codeserver -}} + + {{- if $codeSrv.enabled -}} + {{- $targetSelector := list "main" -}} + {{- if $codeSrv.targetSelector -}} + {{- $targetSelector = $codeSrv.targetSelector -}} + {{- end -}} + + {{- if gt ($targetSelector|len) 1 -}} + {{- fail "Codeserver Addon - Can only be attached to a single workload at a time" -}} + {{- end -}} + + {{/* Append the code-server container to the workloads */}} + {{- range $targetSelector -}} + {{- $workload := get $.Values.workload . -}} + {{- $_ := set $workload.podSpec.containers "codeserver" $codeSrv.container -}} + {{- end -}} + + {{/* Add the code-server service */}} + {{- if $codeSrv.service.enabled -}} + {{/* Add the code-server service */}} + {{- $hasPrimaryService := false -}} + {{- $result := (include "tc.v1.common.lib.service.hasPrimary" $) | fromJson -}} + {{- if and $result.hasEnabled $result.hasPrimary -}} + {{- $hasPrimaryService = true -}} + {{- end -}} + + {{- $svcValues := $codeSrv.service -}} + {{- $_ := set $svcValues "targetSelector" ($targetSelector|first) -}} + {{- if not $hasPrimaryService -}} + {{- $_ := set $svcValues "primary" true -}} + {{- end -}} + + {{- if not $.Values.service -}} + {{- $_ := set $.Values "service" dict -}} + {{- end -}} + + {{- $_ := set $.Values.service "codeserver" $svcValues -}} + {{- end -}} + + {{/* Add the code-server ingress */}} + {{- if $codeSrv.ingress.enabled -}} + {{- $ingressValues := $codeSrv.ingress -}} + {{- if not $ingressValues.targetSelector -}} + {{/* Assumes that both service and port are named codeserver */}} + {{- $_ := set $ingressValues "targetSelector" (dict "codeserver" "codeserver") -}} + {{- end -}} + + {{- $hasPrimaryIngress := false -}} + {{- $result := (include "tc.v1.common.lib.ingress.hasPrimary" $) | fromJson -}} + {{- if and $result.hasEnabled $result.hasPrimary -}} + {{- $hasPrimaryIngress = true -}} + {{- end -}} + + {{- if not $hasPrimaryIngress -}} + {{- $_ := set $ingressValues "primary" true -}} + {{- end -}} + + {{- if not $.Values.ingress -}} + {{- $_ := set $.Values "ingress" dict -}} + {{- end -}} + + {{/* Let spawner handle the rest */}} + {{- $_ := set $.Values.ingress "codeserver" $ingressValues -}} + {{- end -}} + {{- end -}} +{{- end -}} diff --git a/charts/library/common/templates/addons/_gluetun.tpl b/charts/library/common/templates/addons/_gluetun.tpl new file mode 100644 index 00000000000..0a6deb29a41 --- /dev/null +++ b/charts/library/common/templates/addons/_gluetun.tpl @@ -0,0 +1,69 @@ +{{/* +Template to render VPN addon +It will include / inject the required templates based on the given values. +*/}} +{{- define "tc.v1.common.addon.gluetun" -}} + {{- $glue := $.Values.addons.gluetun -}} + {{- if $glue.enabled -}} + {{- if not $glue.container.env -}} + {{- $_ := set $glue.container "env" dict -}} + {{- end -}} + + {{- $fw := $glue.container.env.FIREWALL -}} + {{- if (eq $fw "on") -}} + {{- $nets := $glue.container.env.FIREWALL_OUTBOUT_SUBNETS | splitList "," -}} + {{- $nets = mustAppend ($nets $.Values.chartContext.podCIDR $.Values.chartContext.svcCIDR) | mustUniq -}} + {{- $_ := set $glue.container.env "FIREWALL_OUTBOUND_SUBNETS" (join "," $nets) -}} + + {{- $inputPorts := $glue.container.env.FIREWALL_INPUT_PORTS | splitList "," -}} + {{- if and + $.Values.service $.Values.service.main $.Values.service.main.ports + $.Values.service.main.ports.main $.Values.service.main.ports.main.port + -}} + {{- $inputPorts = mustAppend $inputPorts $.Values.service.main.ports.main.port -}} + {{- end -}} + {{- $inputPorts = $inputPorts | mustUniq -}} + {{- $_ := set $glue.container.env "FIREWALL_INPUT_PORTS" (join "," $inputPorts) -}} + {{- end -}} + + {{- $targetSelector := list "main" -}} + {{- if $glue.targetSelector -}} + {{- $targetSelector = $glue.targetSelector -}} + {{- end -}} + + {{/* Append the vpn container to the workloads */}} + {{- range $targetSelector -}} + {{- $workload := get $.Values.workload . -}} + {{- $_ := set $workload.podSpec.containers "gluetun" $glue.container -}} + {{- end -}} + + {{/* Mount secrets */}} + {{- range $secName, $secValues := $glue.secret -}} + {{- $secretName := printf "gluetun-%s" $secName -}} + {{- if not $secValues.basePath -}} + {{- fail (printf "Gluetun - Secret [%s] does not have basePath") -}} + {{- end -}} + {{- $_ := set $secValues "enabled" true -}} + {{- $_ := set $.Values.secret $secretName $secValues -}} + + {{- $persistence := (dict + "enabled" true "type" "secret" "objectName" $secretName "targetSelector" dict "items" list + ) -}} + {{- if $secValues.defaultMode -}} + {{- $_ := set $persistence "defaultMode" $secValues.defaultMode -}} + {{- end -}} + + {{- range $key, $val := $secValues.data -}} + {{- $item := (dict "key" $key "path" $key) -}} + {{- $_ := set $persistence "items" (mustAppend $persistence.items $item) -}} + {{- end -}} + + {{- $selectorValue := (dict "gluetun" (dict "mountPath" $secValues.basePath)) -}} + {{- range $targetSelector -}} + {{- $_ := set $persistence.targetSelector . $selectorValue -}} + {{- end -}} + + {{- $_ := set $.Values.persistence $secretName $persistence -}} + {{- end -}} + {{- end -}} +{{- end -}} diff --git a/charts/library/common/templates/addons/_netshoot.tpl b/charts/library/common/templates/addons/_netshoot.tpl new file mode 100644 index 00000000000..d7b9e9c7576 --- /dev/null +++ b/charts/library/common/templates/addons/_netshoot.tpl @@ -0,0 +1,20 @@ +{{/* +Template to render code-server addon +It will include / inject the required templates based on the given values. +*/}} +{{- define "tc.v1.common.addon.netshoot" -}} + {{- $netshoot := $.Values.addons.netshoot -}} + {{- if $netshoot.enabled -}} + {{- $targetSelector := list "main" -}} + {{- if $netshoot.targetSelector -}} + {{- $targetSelector = $netshoot.targetSelector -}} + {{- end -}} + + {{- range $targetSelector -}} + {{/* Append the code-server container to the workloads */}} + {{- $workload := get $.Values.workload . -}} + {{- $_ := set $workload.podSpec.containers "netshoot" $.Values.addons.netshoot.container -}} + {{- end -}} + + {{- end -}} +{{- end -}} diff --git a/charts/library/common/templates/addons/_tailscale.tpl b/charts/library/common/templates/addons/_tailscale.tpl new file mode 100644 index 00000000000..e3d5e5e5004 --- /dev/null +++ b/charts/library/common/templates/addons/_tailscale.tpl @@ -0,0 +1,56 @@ +{{/* +Template to render VPN addon +It will include / inject the required templates based on the given values. +*/}} +{{- define "tc.v1.common.addon.tailscale" -}} + {{- $ts := $.Values.addons.tailscale -}} + {{- if $ts.enabled -}} + {{- $secContext := dict -}} + {{- $_ := set $secContext "runAsUser" 0 -}} + {{- $_ := set $secContext "runAsGroup" 0 -}} + {{- $_ := set $secContext "runAsNonRoot" true -}} + {{- $_ := set $secContext "readOnlyRootFilesystem" false -}} + + {{- if and $ts.container.env ($ts.container.env.TS_USERSPACE) -}} + {{- $_ := set $secContext "runAsUser" 1000 -}} + {{- $_ := set $secContext "runAsGroup" 1000 -}} + {{- $_ := set $secContext "runAsNonRoot" false -}} + {{- $_ := set $secContext "readOnlyRootFilesystem" true -}} + {{- end -}} + + {{- $newSecContext := $ts.container.securityContext -}} + {{- $newSecContext = mustMergeOverwrite $newSecContext $secContext -}} + {{- $_ := set $ts.container "securityContext" $newSecContext -}} + + {{- $targetSelector := list "main" -}} + {{- if $ts.targetSelector -}} + {{- $targetSelector = $ts.targetSelector -}} + {{- end -}} + + {{/* Append the vpn container to the workloads */}} + {{- range $targetSelector -}} + {{/* FIXME: https://github.com/tailscale/tailscale/issues/8188 */}} + {{- $workload := get $.Values.workload . -}} + {{- $_ := set $workload.podSpec "automountServiceAccountToken" true -}} + {{- $_ := set $workload.podSpec.containers "tailscale" $ts.container -}} + {{- end -}} + + {{- $persistence := $.Values.persistence.tailscalestate | default dict -}} + {{- $_ := set $persistence "enabled" true -}} + {{- if not $persistence.type -}} + {{- $_ := set $persistence "type" "emptyDir" -}} + {{- end -}} + {{- if not $persistence.targetSelector -}} + {{- $_ := set $persistence "targetSelector" dict -}} + {{- end -}} + + {{- $selectorValue := (dict "tailscale" (dict "mountPath" "/var/lib/tailscale")) -}} + {{- range $targetSelector -}} + {{- $_ := set $persistence.targetSelector . $selectorValue -}} + {{- end -}} + + {{/* Append the empty dir tailscale to the persistence */}} + {{- $_ := set $.Values.persistence "tailscalestate" $persistence -}} + {{- end -}} + +{{- end -}} diff --git a/charts/library/common/templates/addons/code-server/_codeserver.tpl b/charts/library/common/templates/addons/code-server/_codeserver.tpl deleted file mode 100644 index 68a49cfe82f..00000000000 --- a/charts/library/common/templates/addons/code-server/_codeserver.tpl +++ /dev/null @@ -1,72 +0,0 @@ -{{/* -Template to render code-server addon -It will include / inject the required templates based on the given values. -*/}} -{{- define "tc.v1.common.addon.codeserver" -}} -{{- $targetSelector := "main" -}} -{{- if $.Values.addons.codeserver.targetSelector -}} - {{- $targetSelector = $.Values.addons.codeserver.targetSelector -}} -{{- end -}} -{{- if .Values.addons.codeserver.enabled -}} - {{/* Append the code-server container to the workloads */}} - {{- $container := include "tc.v1.common.addon.codeserver.container" . | fromYaml -}} - {{- if $container -}} - {{- $workload := get $.Values.workload $targetSelector -}} - {{- $_ := set $workload.podSpec.containers "codeserver" $container -}} - {{- end -}} - - {{- $hasPrimaryService := false -}} - {{- range $svcName, $svcValues := .Values.service -}} - {{- $enabled := (include "tc.v1.common.lib.util.enabled" (dict - "rootCtx" $ "objectData" $svcValues - "name" $svcName "caller" "Code Server Service" - "key" "addons.codeserver.service")) -}} - - {{- if eq $enabled "true" -}} - {{- if $svcValues.primary -}} - {{- $hasPrimaryService = true -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{/* Add the code-server service */}} - {{- if .Values.addons.codeserver.service.enabled -}} - {{- $serviceValues := .Values.addons.codeserver.service -}} - {{- $_ := set $serviceValues "targetSelector" $targetSelector -}} - {{- if not $hasPrimaryService -}} - {{- $_ := set $serviceValues "primary" true -}} - {{- end -}} - {{- $_ := set .Values.service "codeserver" $serviceValues -}} - {{- end -}} - - {{/* Add the code-server ingress */}} - {{- if .Values.addons.codeserver.ingress.enabled -}} - {{- $ingressValues := .Values.addons.codeserver.ingress -}} - {{- if not $ingressValues.targetSelector -}} - {{/* Assumes that both service and port are named codeserver */}} - {{- $_ := set $ingressValues "targetSelector" (dict "codeserver" "codeserver") -}} - {{- end -}} - - {{- $hasPrimaryIngress := false -}} - {{- range $ingName, $ingValues := $.Values.ingress -}} - {{- $enabled := (include "tc.v1.common.lib.util.enabled" (dict - "rootCtx" $ "objectData" $ingValues - "name" $ingName "caller" "Code Server Ingress" - "key" "addons.codeserver.ingress")) -}} - - {{- if eq $enabled "true" -}} - {{- if $ingValues.primary -}} - {{- $hasPrimaryIngress = true -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if not $hasPrimaryIngress -}} - {{- $_ := set $ingressValues "primary" true -}} - {{- end -}} - - {{/* Let spawner handle the rest */}} - {{- $_ := set $.Values.ingress "codeserver" $ingressValues -}} - {{- end -}} -{{- end -}} -{{- end -}} diff --git a/charts/library/common/templates/addons/code-server/_container.tpl b/charts/library/common/templates/addons/code-server/_container.tpl deleted file mode 100644 index 62d5e6ed995..00000000000 --- a/charts/library/common/templates/addons/code-server/_container.tpl +++ /dev/null @@ -1,48 +0,0 @@ -{{/* -The code-server sidecar container to be inserted. -*/}} -{{- define "tc.v1.common.addon.codeserver.container" -}} -enabled: true -probes: - liveness: - enabled: true - port: {{ .Values.addons.codeserver.service.ports.codeserver.port }} - path: "/" - readiness: - enabled: true - port: {{ .Values.addons.codeserver.service.ports.codeserver.port }} - path: "/" - startup: - enabled: true - port: {{ .Values.addons.codeserver.service.ports.codeserver.port }} - path: "/" -imageSelector: "codeserverImage" -imagePullPolicy: {{ .Values.codeserverImage.pullPolicy }} -resources: - excludeExtra: true -securityContext: - runAsUser: 0 - runAsGroup: 0 - runAsNonRoot: false - readOnlyRootFilesystem: false -env: -{{- range $envList := .Values.addons.codeserver.envList -}} - {{- if and $envList.name $envList.value }} - {{ $envList.name }}: {{ $envList.value | quote }} - {{- else }} - {{- fail "Please specify name/value for codeserver environment variable" -}} - {{- end -}} -{{- end -}} -{{- with .Values.addons.codeserver.env -}} -{{- range $k, $v := . }} - {{ $k }}: {{ $v | quote }} -{{- end -}} -{{- end }} -args: -{{- range .Values.addons.codeserver.args }} -- {{ . | quote }} -{{- end }} -- "--port" -- "{{ .Values.addons.codeserver.service.ports.codeserver.port }}" -- {{ .Values.addons.codeserver.workingDir | default "/" }} -{{- end -}} diff --git a/charts/library/common/templates/addons/netshoot/_container.tpl b/charts/library/common/templates/addons/netshoot/_container.tpl deleted file mode 100644 index 8084420a69e..00000000000 --- a/charts/library/common/templates/addons/netshoot/_container.tpl +++ /dev/null @@ -1,46 +0,0 @@ -{{/* -The code-server sidecar container to be inserted. -*/}} -{{- define "tc.v1.common.addon.netshoot.container" -}} -enabled: true -command: - - /bin/sh - - -c - - sleep infinity -probes: - liveness: - enabled: false - readiness: - enabled: false - startup: - enabled: false -imageSelector: "netshootImage" -resources: - excludeExtra: true -securityContext: - runAsUser: 0 - runAsGroup: 0 - runAsNonRoot: false - readOnlyRootFilesystem: false - capabilities: - add: - - NET_ADMIN - - NET_RAW -env: -{{- range $envList := $.Values.addons.netshoot.envList -}} - {{- if and $envList.name $envList.value }} - {{ $envList.name }}: {{ $envList.value | quote }} - {{- else }} - {{- fail "Please specify name/value for netshoot environment variable" -}} - {{- end -}} -{{- end -}} -{{- with $.Values.addons.netshoot.env -}} -{{- range $k, $v := . }} - {{ $k }}: {{ $v | quote }} -{{- end -}} -{{- end }} -args: -{{- range $.Values.addons.netshoot.args }} -- {{ . | quote }} -{{- end }} -{{- end -}} diff --git a/charts/library/common/templates/addons/netshoot/_netshoot.tpl b/charts/library/common/templates/addons/netshoot/_netshoot.tpl deleted file mode 100644 index fe75c805212..00000000000 --- a/charts/library/common/templates/addons/netshoot/_netshoot.tpl +++ /dev/null @@ -1,15 +0,0 @@ -{{/* -Template to render code-server addon -It will include / inject the required templates based on the given values. -*/}} -{{- define "tc.v1.common.addon.netshoot" -}} -{{- $targetSelector := "main" -}} -{{- if .Values.addons.netshoot.enabled -}} - {{/* Append the code-server container to the workloads */}} - {{- $container := include "tc.v1.common.addon.netshoot.container" . | fromYaml -}} - {{- if $container -}} - {{- $workload := get $.Values.workload $targetSelector -}} - {{- $_ := set $workload.podSpec.containers "netshoot" $container -}} - {{- end -}} -{{- end -}} -{{- end -}} diff --git a/charts/library/common/templates/addons/vpn/_configmap.tpl b/charts/library/common/templates/addons/vpn/_configmap.tpl deleted file mode 100644 index 4b417a6c6ec..00000000000 --- a/charts/library/common/templates/addons/vpn/_configmap.tpl +++ /dev/null @@ -1,16 +0,0 @@ -{{/* -The VPN config and scripts to be included. -*/}} -{{- define "tc.v1.common.addon.vpn.configmap" -}} -enabled: true -data: -{{- with .Values.addons.vpn.scripts.up }} - up.sh: |- - {{- . | nindent 4 }} -{{- end -}} - -{{- with .Values.addons.vpn.scripts.down }} - down.sh: |- - {{- . | nindent 4 }} -{{- end -}} -{{- end -}} diff --git a/charts/library/common/templates/addons/vpn/_gluetunContainer.tpl b/charts/library/common/templates/addons/vpn/_gluetunContainer.tpl deleted file mode 100644 index d1bdbee0c1a..00000000000 --- a/charts/library/common/templates/addons/vpn/_gluetunContainer.tpl +++ /dev/null @@ -1,74 +0,0 @@ -{{/* -The gluetun sidecar container to be inserted. -*/}} -{{- define "tc.v1.common.addon.vpn.gluetun.container" -}} -enabled: true -imageSelector: gluetunImage -probes: -{{- if $.Values.addons.vpn.livenessProbe }} - liveness: - {{- toYaml . | nindent 2 }} -{{- else }} - liveness: - enabled: false -{{- end }} - readiness: - enabled: false - startup: - enabled: false -resources: - excludeExtra: true -securityContext: - runAsUser: 0 - runAsNonRoot: false - readOnlyRootFilesystem: false - runAsGroup: 568 - capabilities: - add: - - NET_ADMIN - - NET_RAW - - MKNOD - -env: - DNS_KEEP_NAMESERVER: "on" - DOT: "off" -{{- if $.Values.addons.vpn.killSwitch }} -{{- $excludednetworks := (printf "%v,%v" $.Values.chartContext.podCIDR $.Values.chartContext.svcCIDR) -}} -{{- $excludednetworksv6 := "" -}} -{{- range $.Values.addons.vpn.excludedNetworks_IPv4 -}} - {{- $excludednetworks = (printf "%v,%v" $excludednetworks .) -}} -{{- end }} -{{- range $.Values.addons.vpn.excludedNetworks_IPv6 -}} - {{- $excludednetworksv6 = (printf "%v,%v" $excludednetworksv6 .) -}} -{{- end }} - FIREWALL: "on" - FIREWALL_OUTBOUND_SUBNETS: {{ $excludednetworks | quote }} -{{- $inputPorts := list -}} -{{- if and - $.Values.service $.Values.service.main $.Values.service.main.ports - $.Values.service.main.ports.main $.Values.service.main.ports.main.port -}} - {{- $inputPorts = list $.Values.service.main.ports.main.port -}} -{{- end -}} -{{- $inputPorts = concat $inputPorts $.Values.addons.vpn.inputPorts | mustUniq }} - FIREWALL_INPUT_PORTS: {{ join "," $inputPorts }} -{{- else }} - FIREWALL: "off" -{{- end }} - -{{- with $.Values.addons.vpn.env }} - {{- . | toYaml | nindent 2 }} -{{- end -}} - -{{- range $envList := $.Values.addons.vpn.envList -}} - {{- if and $envList.name $envList.value }} - {{ $envList.name }}: {{ $envList.value | quote }} - {{- else -}} - {{- fail "Please specify name/value for VPN environment variable" -}} - {{- end -}} -{{- end -}} - -{{- with $.Values.addons.vpn.args }} -args: - {{- . | toYaml | nindent 2 }} -{{- end }} -{{- end -}} diff --git a/charts/library/common/templates/addons/vpn/_openvpnContainer.tpl b/charts/library/common/templates/addons/vpn/_openvpnContainer.tpl deleted file mode 100644 index 5975320358b..00000000000 --- a/charts/library/common/templates/addons/vpn/_openvpnContainer.tpl +++ /dev/null @@ -1,75 +0,0 @@ -{{/* -The gluetun sidecar container to be inserted. -*/}} -{{- define "tc.v1.common.addon.vpn.openvpn.container" -}} -enabled: true -imageSelector: openvpnImage -probes: -{{- if $.Values.addons.vpn.livenessProbe }} - liveness: - {{- toYaml . | nindent 2 }} -{{- else }} - liveness: - enabled: false -{{- end }} - readiness: - enabled: false - startup: - enabled: false -resources: - excludeExtra: true -securityContext: - runAsUser: 0 - runAsGroup: 0 - capabilities: - add: - - NET_ADMIN - - NET_RAW - - MKNOD - - SYS_MODULE - -env: -{{- with $.Values.addons.vpn.env }} - {{- . | toYaml | nindent 2 }} -{{- end }} - {{- if and $.Values.addons.vpn.openvpn.username $.Values.addons.vpn.openvpn.password }} - VPN_AUTH: {{ (printf "%v;%v" $.Values.addons.vpn.openvpn.username $.Values.addons.vpn.openvpn.password) }} - {{- end -}} -{{- if $.Values.addons.vpn.killSwitch }} -{{- $ipv4list := $.Values.addons.vpn.excludedNetworks_IPv4 }} - -{{- if $.Values.chartContext.podCIDR }} -{{- $ipv4list = append $ipv4list $.Values.chartContext.podCIDR }} -{{- end }} -{{- if $.Values.chartContext.svcCIDR }} -{{- $ipv4list = append $ipv4list $.Values.chartContext.svcCIDR }} -{{- end }} - - FIREWALL: "ON" - {{- range $index, $value := $ipv4list }} - ROUTE_{{ add $index 1 }}: {{ $value | quote }} - {{- end }} -{{- if $.Values.addons.vpn.excludedNetworks_IPv6 }} - {{- $excludednetworksv6 := "" -}} - {{- range $.Values.addons.vpn.excludedNetworks_IPv4 -}} - {{- $excludednetworksv6 = ( printf "%v;%v" $excludednetworksv6 . ) -}} - {{- end }} - {{- range $index, $value := $.Values.addons.vpn.excludedNetworks_IPv6 }} - ROUTE6_{{ add $index 1 }}: {{ $value | quote }} - {{- end }} -{{- end }} -{{- end -}} - -{{- range $envList := $.Values.addons.vpn.envList -}} - {{- if and $envList.name $envList.value }} - {{ $envList.name }}: {{ $envList.value | quote }} - {{- else -}} - {{- fail "Please specify name/value for VPN environment variable" -}} - {{- end -}} -{{- end -}} - -{{- with $.Values.addons.vpn.args }} -args: - {{- . | toYaml | nindent 2 }} -{{- end -}} -{{- end -}} diff --git a/charts/library/common/templates/addons/vpn/_secret.tpl b/charts/library/common/templates/addons/vpn/_secret.tpl deleted file mode 100644 index b46a5d3e967..00000000000 --- a/charts/library/common/templates/addons/vpn/_secret.tpl +++ /dev/null @@ -1,9 +0,0 @@ -{{/* -The OpenVPN config secret to be included. -*/}} -{{- define "tc.v1.common.addon.vpn.secret" -}} -enabled: true -data: - vpn.conf: |- - {{- .Values.addons.vpn.config | nindent 4 }} -{{- end -}} diff --git a/charts/library/common/templates/addons/vpn/_tailscaleContainer.tpl b/charts/library/common/templates/addons/vpn/_tailscaleContainer.tpl deleted file mode 100644 index a66564a5b3b..00000000000 --- a/charts/library/common/templates/addons/vpn/_tailscaleContainer.tpl +++ /dev/null @@ -1,89 +0,0 @@ -{{/* -The Tailscale sidecar container to be inserted. -*/}} -{{- define "tc.v1.common.addon.vpn.tailscale.container" -}} -enabled: true -imageSelector: "tailscaleImage" -probes: -{{- if $.Values.addons.vpn.livenessProbe }} - liveness: - {{- toYaml . | nindent 2 }} -{{- else }} - liveness: - enabled: false -{{- end }} - readiness: - enabled: false - startup: - enabled: false -command: - - /usr/local/bin/containerboot -resources: - excludeExtra: true -securityContext: - {{- if $.Values.addons.vpn.tailscale.userspace }} - runAsUser: 1000 - runAsGroup: 1000 - runAsNonRoot: false - readOnlyRootFilesystem: true - {{- else }} - runAsUser: 0 - runAsGroup: 0 - runAsNonRoot: true - readOnlyRootFilesystem: false - {{- end }} - capabilities: - add: - - NET_ADMIN - - NET_RAW - -{{/* -Set KUBE_SECRET to empty string to force tailscale -to use the filesystem for state tracking. -With secret for state tracking you can't always -know if the app that uses this sidecard will -use a custom ServiceAccount and will lead to falure. -*/}} -env: - TS_KUBE_SECRET: "" - TS_SOCKET: /var/run/tailscale/tailscaled.sock - TS_STATE_DIR: /var/lib/tailscale/state - TS_AUTH_ONCE: {{ $.Values.addons.vpn.tailscale.auth_once | quote }} - TS_USERSPACE: {{ $.Values.addons.vpn.tailscale.userspace | quote }} - TS_ACCEPT_DNS: {{ $.Values.addons.vpn.tailscale.accept_dns | quote }} - {{- with $.Values.addons.vpn.tailscale.outbound_http_proxy_listen }} - TS_OUTBOUND_HTTP_PROXY_LISTEN: {{ . }} - {{- end -}} - {{- with $.Values.addons.vpn.tailscale.routes }} - TS_ROUTES: {{ . }} - {{- end -}} - {{- with $.Values.addons.vpn.tailscale.dest_ip }} - TS_DEST_IP: {{ . }} - {{- end -}} - {{- with $.Values.addons.vpn.tailscale.sock5_server }} - TS_SOCKS5_SERVER: {{ . }} - {{- end -}} - {{- with $.Values.addons.vpn.tailscale.extra_args }} - TS_EXTRA_ARGS: {{ . | quote }} - {{- end -}} - {{- with $.Values.addons.vpn.tailscale.daemon_extra_args }} - TS_TAILSCALED_EXTRA_ARGS: {{ . | quote }} - {{- end -}} - {{- with $.Values.addons.vpn.tailscale.authkey }} - TS_AUTH_KEY: {{ . }} - {{- end }} - -{{- range $envList := $.Values.addons.vpn.envList -}} - {{- if and $envList.name $envList.value }} - {{ $envList.name }}: {{ $envList.value | quote }} - {{- else -}} - {{- fail "Please specify name/value for VPN environment variable" -}} - {{- end -}} -{{- end -}} - -{{- with $.Values.addons.vpn.env -}} - {{- range $k, $v := . }} - {{ $k }}: {{ $v | quote }} - {{- end -}} -{{- end }} -{{- end -}} diff --git a/charts/library/common/templates/addons/vpn/_volume.tpl b/charts/library/common/templates/addons/vpn/_volume.tpl deleted file mode 100644 index b6a8f1ac31c..00000000000 --- a/charts/library/common/templates/addons/vpn/_volume.tpl +++ /dev/null @@ -1,112 +0,0 @@ -{{/* -The volume (referencing VPN scripts) to be inserted into persistence. -*/}} -{{- define "tc.v1.common.addon.vpn.volume.scripts" -}} -{{- $basePath := (include "tc.v1.common.addon.vpn.volume.basePath" .) }} -enabled: true -type: configmap -objectName: vpnscripts -expandObjectName: false -defaultMode: "0777" -items: -{{- if .Values.addons.vpn.scripts.up }} -- key: up.sh - path: up.sh -{{- end -}} -{{- if .Values.addons.vpn.scripts.down }} -- key: down.sh - path: down.sh -{{- end }} -targetSelector: - {{- range .Values.addons.vpn.targetSelector }} - {{ . }}: - vpn: - mountPath: {{ $basePath }} - {{- end -}} -{{- end -}} - -{{/* -The volume (referencing VPN config) to be inserted into persistence. -*/}} -{{- define "tc.v1.common.addon.vpn.volume.config" -}} -{{- $basePath := (include "tc.v1.common.addon.vpn.volume.basePath" .) }} -{{- $mountPath := $basePath }} - -enabled: true -{{- if or .Values.addons.vpn.config .Values.addons.vpn.existingSecret }} -type: secret -defaultMode: "0777" -items: - - key: vpn.conf - path: vpn.conf -{{- if .Values.addons.vpn.existingSecret }} -objectName: {{ .Values.addons.vpn.existingSecret }} -expandObjectName: false -{{- else }} -objectName: vpnconfig -expandObjectName: true -{{- end -}} -{{- else }} -{{- $mountPath = (printf "%s/vpn.conf" $basePath) }} -type: hostPath -hostPath: {{ .Values.addons.vpn.configFile | default "/vpn" }} -hostPathType: "File" -autoPermissions: - enabled: true - chown: true - user: 568 - group: 568 -{{- end }} -targetSelector: - {{- range .Values.addons.vpn.targetSelector }} - {{ . }}: - vpn: - mountPath: {{ $mountPath }} - {{- end -}} -{{- end -}} - -{{/* -The volume (referencing VPN config folder) to be inserted into persistence. -*/}} -{{- define "tc.v1.common.addon.vpn.volume.folder" -}} -{{- $basePath := (include "tc.v1.common.addon.vpn.volume.basePath" .) }} -enabled: true -type: hostPath -hostPath: {{ .Values.addons.vpn.configFolder | quote }} -autoPermissions: - enabled: true - chown: true - user: 568 - group: 568 -targetSelector: - {{- range .Values.addons.vpn.targetSelector }} - {{ . }}: - vpn: - mountPath: {{ $basePath }} - {{- end -}} -{{- end -}} - - -{{/* -The empty tailscale folder -*/}} -{{- define "tc.v1.common.addon.vpn.volume.tailscale" -}} -enabled: true -type: emptyDir -targetSelector: - {{- range .Values.addons.vpn.targetSelector }} - {{ . }}: - tailscale: - mountPath: /var/lib/tailscale - {{- end -}} -{{- end -}} - -{{- define "tc.v1.common.addon.vpn.volume.basePath" -}} - {{- $basePath := "/vpn" -}} {{/* Base Path for OVPN */}} - {{- if eq .Values.addons.vpn.type "wireguard" -}} - {{- $basePath = "/etc/wireguard" -}} {{/* Base Path for Wireguard */}} - {{- else if eq .Values.addons.vpn.type "gluetun" -}} - {{- $basePath = "/gluetun" -}} {{/* Base Path for Gluetun */}} - {{- end -}} - {{- $basePath -}} -{{- end -}} diff --git a/charts/library/common/templates/addons/vpn/_vpn.tpl b/charts/library/common/templates/addons/vpn/_vpn.tpl deleted file mode 100644 index 62aad34b85e..00000000000 --- a/charts/library/common/templates/addons/vpn/_vpn.tpl +++ /dev/null @@ -1,94 +0,0 @@ -{{/* -Template to render VPN addon -It will include / inject the required templates based on the given values. -*/}} -{{- define "tc.v1.common.addon.vpn" -}} -{{- if ne "disabled" .Values.addons.vpn.type -}} - - {{- if .Values.addons.vpn.config -}} - {{/* Append the vpn config secret to the secrets */}} - {{- $secret := include "tc.v1.common.addon.vpn.secret" . | fromYaml -}} - {{- if $secret -}} - {{- $_ := set .Values.secret "vpnconfig" $secret -}} - {{- end -}} - {{- end }} - - {{- if or .Values.addons.vpn.scripts.up .Values.addons.vpn.scripts.down -}} - {{/* Append the vpn up/down scripts to the configmaps */}} - {{- $configmap := include "tc.v1.common.addon.vpn.configmap" . | fromYaml -}} - {{- if $configmap -}} - {{- $_ := set .Values.configmap "vpnscripts" $configmap -}} - {{- end -}} - {{- end }} - - {{- if or .Values.addons.vpn.configFile .Values.addons.vpn.config .Values.addons.vpn.existingSecret -}} - {{/* Append the vpn config to the persistence */}} - {{- $configper := include "tc.v1.common.addon.vpn.volume.config" . | fromYaml -}} - {{- if $configper -}} - {{- $_ := set .Values.persistence "vpnconfig" $configper -}} - {{- end -}} - {{- end -}} - - {{- if or .Values.addons.vpn.scripts.up .Values.addons.vpn.scripts.down -}} - {{/* Append the vpn scripts to the persistence */}} - {{- $scriptsper := include "tc.v1.common.addon.vpn.volume.scripts" . | fromYaml -}} - {{- if $scriptsper -}} - {{- $_ := set .Values.persistence "vpnscripts" $scriptsper -}} - {{- end -}} - {{- end -}} - - {{- if .Values.addons.vpn.configFolder -}} - {{/* Append the vpn folder to the persistence */}} - {{- $folderper := include "tc.v1.common.addon.vpn.volume.folder" . | fromYaml -}} - {{- if $folderper -}} - {{- $_ := set .Values.persistence "vpnfolder" $folderper -}} - {{- end -}} - {{- end -}} - - {{/* Ensure target Selector defaults to main pod even if unset */}} - {{- $targetSelector := list "main" -}} - {{- if $.Values.addons.codeserver.targetSelector -}} - {{- $targetSelector = $.Values.addons.codeserver.targetSelector -}} - {{- end -}} - - {{/* Append the vpn container to the containers */}} - {{- range $targetSelector -}} - {{- if eq "gluetun" $.Values.addons.vpn.type -}} - {{- $container := include "tc.v1.common.addon.vpn.gluetun.container" $ | fromYaml -}} - {{- if $container -}} - {{- $workload := get $.Values.workload . -}} - {{- $_ := set $workload.podSpec.containers "vpn" $container -}} - {{- end -}} - {{- else if eq "tailscale" $.Values.addons.vpn.type -}} - {{/* FIXME: https://github.com/tailscale/tailscale/issues/8188 */}} - {{- $_ := set $.Values.podOptions "automountServiceAccountToken" true -}} - {{- $container := include "tc.v1.common.addon.vpn.tailscale.container" $ | fromYaml -}} - {{- if $container -}} - {{- $workload := get $.Values.workload . -}} - {{- $_ := set $workload.podSpec.containers "tailscale" $container -}} - {{- end -}} - {{- else if eq "openvpn" $.Values.addons.vpn.type -}} - {{- $container := include "tc.v1.common.addon.vpn.openvpn.container" $ | fromYaml -}} - {{- if $container -}} - {{- $workload := get $.Values.workload . -}} - {{- $_ := set $workload.podSpec.containers "vpn" $container -}} - {{- end -}} - {{- else if eq "wireguard" $.Values.addons.vpn.type -}} - {{- $container := include "tc.v1.common.addon.vpn.wireguard.container" $ | fromYaml -}} - {{- if $container -}} - {{- $workload := get $.Values.workload . -}} - {{- $_ := set $workload.podSpec.containers "vpn" $container -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if eq "tailscale" $.Values.addons.vpn.type -}} - {{/* Append the empty tailscale folder to the persistence */}} - {{- $tailscaledir := include "tc.v1.common.addon.vpn.volume.tailscale" . | fromYaml -}} - {{- if $tailscaledir -}} - {{- $_ := set .Values.persistence "tailscalestate" $tailscaledir -}} - {{- end -}} - {{- end -}} - -{{- end -}} -{{- end -}} diff --git a/charts/library/common/templates/addons/vpn/_wireguardContainer.tpl b/charts/library/common/templates/addons/vpn/_wireguardContainer.tpl deleted file mode 100644 index 81b34647af1..00000000000 --- a/charts/library/common/templates/addons/vpn/_wireguardContainer.tpl +++ /dev/null @@ -1,68 +0,0 @@ -{{/* -The gluetun sidecar container to be inserted. -*/}} -{{- define "tc.v1.common.addon.vpn.wireguard.container" -}} -enabled: true -imageSelector: wireguardImage -probes: -{{- if $.Values.addons.vpn.livenessProbe }} - liveness: - {{- toYaml . | nindent 2 }} -{{- else }} - liveness: - enabled: false -{{- end }} - readiness: - enabled: false - startup: - enabled: false -resources: - excludeExtra: true -securityContext: - runAsUser: 568 - runAsGroup: 568 - readOnlyRootFilesystem: false - allowPrivilegeEscalation: true - capabilities: - add: - - AUDIT_WRITE - - NET_ADMIN - - SETUID - - SETGID - - SYS_MODULE - -env: -{{- with $.Values.addons.vpn.env }} - {{- . | toYaml | nindent 2 }} -{{- end }} - SEPARATOR: ";" - IPTABLES_BACKEND: "nft" -{{- if $.Values.addons.vpn.killSwitch }} - KILLSWITCH: "true" - {{- $excludednetworksv4 := ( printf "%v;%v" $.Values.chartContext.podCIDR $.Values.chartContext.svcCIDR ) -}} - {{- range $.Values.addons.vpn.excludedNetworks_IPv4 -}} - {{- $excludednetworksv4 = ( printf "%v;%v" $excludednetworksv4 . ) -}} - {{- end }} - KILLSWITCH_EXCLUDEDNETWORKS_IPV4: {{ $excludednetworksv4 | quote }} -{{- if $.Values.addons.vpn.excludedNetworks_IPv6 -}} - {{- $excludednetworksv6 := "" -}} - {{- range $.Values.addons.vpn.excludedNetworks_IPv4 -}} - {{- $excludednetworksv6 = ( printf "%v;%v" $excludednetworksv6 . ) -}} - {{- end }} - KILLSWITCH_EXCLUDEDNETWORKS_IPV6: {{ $.Values.addons.vpn.excludedNetworks_IPv6 | quote }} -{{- end -}} -{{- end -}} - -{{- range $envList := $.Values.addons.vpn.envList -}} - {{- if and $envList.name $envList.value }} - {{ $envList.name }}: {{ $envList.value | quote }} - {{- else -}} - {{- fail "Please specify name/value for VPN environment variable" -}} - {{- end -}} -{{- end -}} - -{{- with $.Values.addons.vpn.args }} -args: - {{- . | toYaml | nindent 2 }} -{{- end -}} -{{- end -}} diff --git a/charts/library/common/templates/lib/ingress/_validation.tpl b/charts/library/common/templates/lib/ingress/_validation.tpl index 1f9f76ea689..1b0383662a3 100644 --- a/charts/library/common/templates/lib/ingress/_validation.tpl +++ b/charts/library/common/templates/lib/ingress/_validation.tpl @@ -144,8 +144,17 @@ objectData: {{/* Call this template: {{ include "tc.v1.common.lib.ingress.primaryValidation" $ -}} */}} - {{- define "tc.v1.common.lib.ingress.primaryValidation" -}} + {{- $result := (include "tc.v1.common.lib.ingress.hasPrimary" $) | fromJson -}} + + {{/* Require at least one primary ingress, if any enabled */}} + {{- if and $result.hasEnabled (not $result.hasPrimary) -}} + {{- fail "Ingress - At least one enabled ingress must be primary" -}} + {{- end -}} + +{{- end -}} + +{{- define "tc.v1.common.lib.ingress.hasPrimary" -}} {{/* Initialize values */}} {{- $hasPrimary := false -}} @@ -176,9 +185,5 @@ objectData: {{- end -}} {{- end -}} - {{/* Require at least one primary ingress, if any enabled */}} - {{- if and $hasEnabled (not $hasPrimary) -}} - {{- fail "Ingress - At least one enabled ingress must be primary" -}} - {{- end -}} - + {{- (dict "hasPrimary" $hasPrimary "hasEnabled" $hasEnabled) | toJson -}} {{- end -}} diff --git a/charts/library/common/templates/lib/pod/_podSecurityContext.tpl b/charts/library/common/templates/lib/pod/_podSecurityContext.tpl index 87db62d58b4..878c2f425ee 100644 --- a/charts/library/common/templates/lib/pod/_podSecurityContext.tpl +++ b/charts/library/common/templates/lib/pod/_podSecurityContext.tpl @@ -26,9 +26,9 @@ objectData: The object data to be used to render the Pod. {{- $deviceAdded := false -}} {{- $hostUsers := false -}} {{- $hostUserPersistence := (list "configmap" "secret" "emptyDir" "downwardAPI" "projected") -}} - {{- $podSelected := false -}} {{- range $persistenceName, $persistenceValues := $rootCtx.Values.persistence -}} + {{- $podSelected := false -}} {{- $enabled := (include "tc.v1.common.lib.util.enabled" (dict "rootCtx" $rootCtx "objectData" $persistenceValues "name" $persistenceName "caller" "Pod Security Context" @@ -40,7 +40,7 @@ objectData: The object data to be used to render the Pod. {{- if mustHas $objectData.shortName ($persistenceValues.targetSelector | keys) -}} {{- $podSelected = true -}} {{- end -}} - {{- else if $objectData.podPrimary -}} + {{- else if $objectData.primary -}} {{- $podSelected = true -}} {{- end -}} {{- end -}} diff --git a/charts/library/common/templates/lib/service/_validation.tpl b/charts/library/common/templates/lib/service/_validation.tpl index 66e9c736cc4..10fcf36191c 100644 --- a/charts/library/common/templates/lib/service/_validation.tpl +++ b/charts/library/common/templates/lib/service/_validation.tpl @@ -65,12 +65,22 @@ objectData: */}} {{- define "tc.v1.common.lib.service.primaryValidation" -}} + {{- $result := (include "tc.v1.common.lib.service.hasPrimary" $) | fromJson -}} + + {{/* Require at least one primary service, if any enabled */}} + {{- if and $result.hasEnabled (not $result.hasPrimary) -}} + {{- fail "Service - At least one enabled service must be primary" -}} + {{- end -}} + +{{- end -}} + +{{- define "tc.v1.common.lib.service.hasPrimary" -}} + {{- $objectData := .objectData -}} - {{/* Initialize values */}} {{- $hasPrimary := false -}} {{- $hasEnabled := false -}} - {{- range $name, $service := .Values.service -}} + {{- range $name, $service := $.Values.service -}} {{- $enabled := "false" -}} {{- if not (kindIs "invalid" $service.enabled) -}} @@ -99,24 +109,30 @@ objectData: {{- end -}} {{- end -}} - {{/* Require at least one primary service, if any enabled */}} - {{- if and $hasEnabled (not $hasPrimary) -}} - {{- fail "Service - At least one enabled service must be primary" -}} - {{- end -}} - + {{- (dict "hasPrimary" $hasPrimary "hasEnabled" $hasEnabled) | toJson -}} {{- end -}} + {{/* Service Port Primary Validation */}} {{/* Call this template: {{ include "tc.v1.common.lib.service.primaryValidation" (dict "objectData" $objectData -}} objectData: The ports of the service. */}} - {{- define "tc.v1.common.lib.servicePort.primaryValidation" -}} {{- $objectData := .objectData -}} + {{- $result := (include "tc.v1.common.lib.servicePort.hasPrimary" (dict "objectData" $objectData)) | fromJson -}} + + {{/* Require at least one primary service, if any enabled */}} + {{- if and $result.hasEnabled (not $result.hasPrimary) -}} + {{- fail "Service - At least one enabled port in service must be primary" -}} + {{- end -}} + +{{- end -}} + +{{- define "tc.v1.common.lib.servicePort.hasPrimary" -}} + {{- $objectData := .objectData -}} - {{/* Initialize values */}} {{- $hasPrimary := false -}} {{- $hasEnabled := false -}} @@ -141,9 +157,5 @@ objectData: {{- end -}} {{- end -}} - {{/* Require at least one primary service, if any enabled */}} - {{- if and $hasEnabled (not $hasPrimary) -}} - {{- fail "Service - At least one enabled port in service must be primary" -}} - {{- end -}} - + {{- (dict "hasPrimary" $hasPrimary "hasEnabled" $hasEnabled) | toJson -}} {{- end -}} diff --git a/charts/library/common/templates/loader/_init.tpl b/charts/library/common/templates/loader/_init.tpl index 9ac6e491e00..6a2f78eaac1 100644 --- a/charts/library/common/templates/loader/_init.tpl +++ b/charts/library/common/templates/loader/_init.tpl @@ -32,13 +32,18 @@ {{- include "tc.v1.common.addon.codeserver" . }} {{- end -}} - {{/* Enable VPN add-on if required */}} - {{- if ne "disabled" .Values.addons.vpn.type -}} - {{- include "tc.v1.common.addon.vpn" . }} + {{/* Enable gluetun add-on if required */}} + {{- if and .Values.addons.gluetun .Values.addons.gluetun.enabled -}} + {{- include "tc.v1.common.addon.gluetun" . }} + {{- end -}} + + {{/* Enable tailscale add-on if required */}} + {{- if and .Values.addons.tailscale .Values.addons.tailscale.enabled -}} + {{- include "tc.v1.common.addon.tailscale" . }} {{- end -}} {{/* Enable netshoot add-on if required */}} - {{- if .Values.addons.netshoot.enabled }} + {{- if and .Values.addons.netshoot .Values.addons.netshoot.enabled }} {{- include "tc.v1.common.addon.netshoot" . }} {{- end -}} diff --git a/charts/library/common/templates/values/_init.tpl b/charts/library/common/templates/values/_init.tpl index 0ae6a642574..f36747dc37b 100644 --- a/charts/library/common/templates/values/_init.tpl +++ b/charts/library/common/templates/values/_init.tpl @@ -20,6 +20,11 @@ {{- $dependencyValues := omit $dependencyValues "podOptions " -}} {{- $mergedValues = mustMergeOverwrite $mergedValues $dependencyValues -}} {{- end -}} + {{- range $mergedValues.addons -}} + {{- if .enabled -}} + {{- $mergedValues = mustMergeOverwrite $mergedValues . -}} + {{- end -}} + {{- end -}} {{- end -}} {{- $_ := set . "Values" (mustDeepCopy $mergedValues) -}} {{- end -}} diff --git a/charts/library/common/values.yaml b/charts/library/common/values.yaml index 3293462981a..fa9c6b52070 100644 --- a/charts/library/common/values.yaml +++ b/charts/library/common/values.yaml @@ -804,114 +804,158 @@ metrics: # -- The common chart supports several add-ons. These can be configured under this key. # @default -- See below addons: - # -- The common chart supports adding a VPN add-on. It can be configured under this key. - # @default -- See values.yaml - vpn: - # -- Specify the VPN type. Valid options are disabled, gluetun, openvpn, wireguard or tailscale - # OpenVPN and Wireguard are considered deprecated - type: disabled - - # -- Tailscale specific configuration - # @default -- See below - # See more info for the configuration - # https://github.com/tailscale/tailscale/blob/main/docs/k8s/run.sh - tailscale: - # -- Auth key to connect to the VPN Service - authkey: "" - # As a sidecar, it should only need to run in userspace - userspace: true - auth_once: true - accept_dns: false - routes: "" - dest_ip: "" - sock5_server: "" - extra_args: "" - daemon_extra_args: "" - outbound_http_proxy_listen: "" - # -- Annotations for tailscale sidecar - annotations: {} - - # -- OpenVPN specific configuration - # @default -- See below - openvpn: - # -- Credentials to connect to the VPN Service (used with -a) - # Only using password is enough - username: "" - password: "" - - # -- All variables specified here will be added to the vpn sidecar container - # See the documentation of the VPN image for all config values - env: {} - # TZ: UTC - - # -- All variables specified here will be added to the vpn sidecar container - # See the documentation of the VPN image for all config values - envList: [] - # - name: someenv - # value: somevalue - - # -- you can directly specify the config file here - config: "" - - scripts: - # -- you can directly specify the upscript here - up: "" - # some script - - # -- you can directly specify the downscript here - down: "" - # some script - - # -- Provide a customized vpn configuration file location to be used by the VPN. - configFile: "" - - # -- Provide a customized vpn configuration folder location to be added to the VPN container - # The config file needs to be mounted seperately - # the upscript and downscript need to be named: upscript.sh and downscript.sh respectively - configFolder: "" - - # -- Provide an existing secret for vpn config storage - existingSecret: "" - - # -- select pods to bind vpn addon to - # Add "codeserver" to also add the codeserver pod to VPN + gluetun: + enabled: false targetSelector: - main + secret: + # vpn-conf: + # basePath: /gluetun/wireguard + # data: + # # Effective path /gluetun/wireguard/wg0.conf + # wg0.conf: | + # some conf + # wg1.conf: | + # some conf + # scripts: + # basePath: /gluetun/scripts + # defaultMode: "0777" + # data: + # # Effective path /gluetun/scripts/up.sh + # up.sh: | + # some conf + container: + enabled: true + imageSelector: gluetunImage + probes: + liveness: + enabled: false + readiness: + enabled: false + startup: + enabled: false + resources: + excludeExtra: true + securityContext: + runAsUser: 0 + runAsNonRoot: false + readOnlyRootFilesystem: false + runAsGroup: 568 + capabilities: + add: + - NET_ADMIN + - NET_RAW + - MKNOD + env: + DOT: "off" + DNS_KEEP_NAMESERVER: "on" + FIREWALL: "off" + FIREWALL_OUTBOUND_SUBNETS: "" + FIREWALL_INPUT_PORTS: "" - ## Only for Wireguard and OpenVPN - killSwitch: true - excludedNetworks_IPv4: [] - excludedNetworks_IPv6: [] + # -- Tailscale specific configuration + # @default -- See below + # See more info for the configuration + # https://github.com/tailscale/tailscale/blob/main/docs/k8s/run.sh + tailscale: + enabled: false + targetSelector: + - main + # -- you can directly specify the config file here + config: "" + container: + enabled: true + imageSelector: "tailscaleImage" + probes: + liveness: + enabled: false + readiness: + enabled: false + startup: + enabled: false + command: + - /usr/local/bin/containerboot + resources: + excludeExtra: true + env: + # Set KUBE_SECRET to empty string to force tailscale + # to use the filesystem for state tracking. + # With secret for state tracking you can't always + # know if the app that uses this sidecard will + # use a custom ServiceAccount and will lead to falure. + TS_KUBE_SECRET: "" + TS_SOCKET: /var/run/tailscale/tailscaled.sock + TS_STATE_DIR: /var/lib/tailscale/state + TS_USERSPACE: true + TS_AUTH_ONCE: true + TS_ACCEPT_DNS: false + TS_AUTH_KEY: "" + TS_TAILSCALED_EXTRA_ARGS: "" + TS_EXTRA_ARGS: "" + TS_SOCKS5_SERVER: "" + TS_DEST_IP: "" + TS_ROUTES: "" + TS_OUTBOUND_HTTP_PROXY_LISTEN: "" + securityContext: + capabilities: + add: + - NET_ADMIN + - NET_RAW - ## For Gluetun to enable kubernetes network communication - inputPorts: [] + # -- Auth key to connect to the VPN Service + authkey: "" + # As a sidecar, it should only need to run in userspace + userspace: true + auth_once: true + accept_dns: false + routes: "" + dest_ip: "" + sock5_server: "" + extra_args: "" + daemon_extra_args: "" + outbound_http_proxy_listen: "" + # -- Annotations for tailscale sidecar + annotations: {} # -- The common library supports adding a code-server add-on to access files. It can be configured under this key. # @default -- See values.yaml codeserver: - # -- Enable running a code-server container in the pod enabled: false - - # -- Set any environment variables for code-server here - env: {} - - # -- All variables specified here will be added to the codeserver sidecar container - # See the documentation of the codeserver image for all config values - envList: [] - # - name: someenv - # value: somevalue - # -- Set codeserver command line arguments. - # Consider setting --user-data-dir to a persistent location to preserve code-server setting changes - args: - - --auth - - none + # -- Enable running a code-server container in the pod + container: + enabled: true + probes: + liveness: + enabled: true + port: 12321 + path: "/" + readiness: + enabled: true + port: 12321 + path: "/" + startup: + enabled: true + port: 12321 + path: "/" + imageSelector: "codeserverImage" + resources: + excludeExtra: true + securityContext: + runAsUser: 0 + runAsGroup: 0 + runAsNonRoot: false + readOnlyRootFilesystem: false + args: + - "--port" + - "12321" + - "/" + - --auth + - none # - --user-data-dir # - "/config/.vscode" - # -- Select a container to add the addon to - targetSelector: - # -- Specify the working dir that will be opened when code-server starts - # If not given, the app will default to the mountpah of the first specified volumeMount - workingDir: "/" + # -- Select a workload to add the addon to + targetSelector: + - "main" service: # -- Enable a service for the code-server add-on. @@ -924,6 +968,7 @@ addons: primary: true protocol: http port: 12321 + targetPort: 12321 ingress: # -- Enable an ingress for the code-server add-on. @@ -942,9 +987,33 @@ addons: netshoot: # -- Enable running a netshoot container in the pod enabled: false + container: + enabled: true + command: + - /bin/sh + - -c + - sleep infinity + probes: + liveness: + enabled: false + readiness: + enabled: false + startup: + enabled: false + imageSelector: "netshootImage" + resources: + excludeExtra: true + securityContext: + runAsUser: 0 + runAsGroup: 0 + runAsNonRoot: false + readOnlyRootFilesystem: false + capabilities: + add: + - NET_ADMIN + - NET_RAW - # -- Set any environment variables for netshoot here - env: {} +dependencies: ########################################################################## # This section contains some pre-config for frequently used dependencies # diff --git a/containers/apps/openvpn-client/Dockerfile b/containers/apps/openvpn-client/Dockerfile deleted file mode 100644 index c852e30a8c5..00000000000 --- a/containers/apps/openvpn-client/Dockerfile +++ /dev/null @@ -1,12 +0,0 @@ -FROM docker.io/dperson/openvpn-client:latest@sha256:d174047b57d51734143325ad7395210643025e6516ba60a937e9319dbb462293 - -LABEL "org.opencontainers.image.source"="https://github.com/truecharts/containers" - -ARG CONTAINER_NAME -ARG CONTAINER_VER -LABEL org.opencontainers.image.title="${CONTAINER_NAME}" -LABEL org.opencontainers.image.url="https://truecharts.org/docs/charts/${CONTAINER_NAME}" -LABEL org.opencontainers.image.version="${CONTAINER_VER}" -LABEL org.opencontainers.image.description="Container for ${CONTAINER_NAME} by TrueCharts" -LABEL org.opencontainers.image.authors="TrueCharts" -LABEL org.opencontainers.image.documentation="https://truecharts.org/docs/charts/${CONTAINER_NAME}" diff --git a/containers/apps/openvpn-client/PLATFORM b/containers/apps/openvpn-client/PLATFORM deleted file mode 100644 index 303dc7a5a77..00000000000 --- a/containers/apps/openvpn-client/PLATFORM +++ /dev/null @@ -1 +0,0 @@ -linux/amd64 diff --git a/containers/apps/wireguard/Dockerfile b/containers/apps/wireguard/Dockerfile deleted file mode 100644 index 6905b58657a..00000000000 --- a/containers/apps/wireguard/Dockerfile +++ /dev/null @@ -1,11 +0,0 @@ -FROM ghcr.io/k8s-at-home/wireguard:v1.0.20210914@sha256:4dd54954cbd06d92d8c8fc6b10871eb07a0c1869edfe7a15029f1a7d3178d432 -LABEL "org.opencontainers.image.source"="https://github.com/truecharts/containers" - -ARG CONTAINER_NAME -ARG CONTAINER_VER -LABEL org.opencontainers.image.title="${CONTAINER_NAME}" -LABEL org.opencontainers.image.url="https://truecharts.org/docs/charts/${CONTAINER_NAME}" -LABEL org.opencontainers.image.version="${CONTAINER_VER}" -LABEL org.opencontainers.image.description="Container for ${CONTAINER_NAME} by TrueCharts" -LABEL org.opencontainers.image.authors="TrueCharts" -LABEL org.opencontainers.image.documentation="https://truecharts.org/docs/charts/${CONTAINER_NAME}" diff --git a/containers/apps/wireguard/PLATFORM b/containers/apps/wireguard/PLATFORM deleted file mode 100644 index 303dc7a5a77..00000000000 --- a/containers/apps/wireguard/PLATFORM +++ /dev/null @@ -1 +0,0 @@ -linux/amd64 diff --git a/cspell.config.yaml b/cspell.config.yaml index 16460cecbbb..176cfac3d58 100644 --- a/cspell.config.yaml +++ b/cspell.config.yaml @@ -215,6 +215,7 @@ words: - neko - netbox - netdata + - Netshoot - networkv - nextcloud - nindent diff --git a/website/src/content/docs/common/addons.md b/website/src/content/docs/common/addons.md new file mode 100644 index 00000000000..ff7b433331e --- /dev/null +++ b/website/src/content/docs/common/addons.md @@ -0,0 +1,250 @@ +--- +title: Addons +--- + +:::note + +- Examples under each key are only to be used as a placement guide +- See the [Full Examples](/common/addons#full-examples) section for complete examples. + +::: + +## Appears in + +- `.Values.addons` + +:::tip + +- Replace references to `$name` with the actual name you want to use. + +::: + +--- + +## `addons` + +Addons to the workloads + +| | | +| ---------- | -------- | +| Key | `addons` | +| Type | `map` | +| Required | ❌ | +| Helm `tpl` | ❌ | +| Default | `{}` | + +Example + +```yaml +addons: {} +``` + +--- + +### `addons.$addon` + +COnfigure the addon + +:::note + +Available addons: + +- CodeServer +- Netshoot +- GlueTun +- Tailscale + +::: + +| | | +| ---------- | --------------- | +| Key | `addons.$addon` | +| Type | `map` | +| Required | ✅ | +| Helm `tpl` | ❌ | +| Default | `{}` | + +Example + +```yaml +addons: + codeserver: {} + netshoot: {} + gluetun: {} + tailscale: {} +``` + +--- + +#### `addons.$addon.enabled` + +Enables or Disables the Addon + +| | | +| ---------- | ----------------------- | +| Key | `addons.$addon.enabled` | +| Type | `bool` | +| Required | ✅ | +| Helm `tpl` | ❌ | +| Default | `false` | + +Example + +```yaml +addons: + codeserver: + enabled: true +``` + +--- + +#### `addons.$addon.targetSelector` + +Define the workloads to add the addon to + +| | | +| ---------- | ------------------------------ | +| Key | `addons.$addon.targetSelector` | +| Type | `list` of `string` | +| Required | ❌ | +| Helm `tpl` | ❌ | +| Default | `["main"]` | + +Example + +```yaml +addons: + codeserver: + targetSelector: + - main + - other-workload +``` + +--- + +#### `addons.$addon.container` + +Define additional options for the container + +:::tip + +See container options in the [container](/common/container) section. + +::: + +| | | +| ---------- | ----------------------------------------------- | +| Key | `addons.$addon.container` | +| Type | `map` | +| Required | ❌ | +| Helm `tpl` | ❌ | +| Default | Depends on the addon (See common's values.yaml) | + +Example + +```yaml +addons: + codeserver: + container: {} +``` + +--- + +#### `addons.$addon.service` + +Define additional options for the service + +:::tip + +See service options in the [service](/common/service) section. + +::: + +:::note + +Only applies to: + +- Codeserver + +::: + +| | | +| ---------- | ----------------------------------------------- | +| Key | `addons.$addon.service` | +| Type | `map` | +| Required | ❌ | +| Helm `tpl` | ❌ | +| Default | Depends on the addon (See common's values.yaml) | + +Example + +```yaml +addons: + codeserver: + service: {} +``` + +--- + +#### `addons.$addon.ingress` + +Define additional options for the ingress + +:::tip + +See ingress options in the [ingress](/common/ingress) section. + +::: + +:::note + +Only applies to: + +- Codeserver + +::: + +| | | +| ---------- | ----------------------------------------------- | +| Key | `addons.$addon.ingress` | +| Type | `map` | +| Required | ❌ | +| Helm `tpl` | ❌ | +| Default | Depends on the addon (See common's values.yaml) | + +Example + +```yaml +addons: + codeserver: + ingress: {} +``` + +--- + +## Full Examples + +```yaml +addons: + codeserver: + enabled: true + container: + resources: + limits: + cpu: 3333m + memory: 3333Mi + service: + enabled: true + ports: + codeserver: + enabled: true + port: 12345 + targetPort: 12345 + ingress: + enabled: true + hosts: + - host: code.chart-example.local + paths: + - path: / + pathType: Prefix +```