From b62e53659369093a6b58b7c71f8650b2b3967620 Mon Sep 17 00:00:00 2001 From: Kjeld Schouten Date: Sun, 2 Mar 2025 16:14:39 +0100 Subject: [PATCH] feat(common): BREAKING CHANGE refactor add-on system (#31167) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit **Description** This PR updates the add-on system to allow for more end-user flexibility It basically moves add-on container configuration to values.yaml, to expose all container options to end users. Fixes: #27351 Fixes: #31876 **โš™๏ธ Type of change** - [ ] โš™๏ธ Feature/App addition - [ ] ๐Ÿช› Bugfix - [ ] โš ๏ธ Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] ๐Ÿ”ƒ Refactor of current code **๐Ÿงช How Has This Been Tested?** **๐Ÿ“ƒ Notes:** **โœ”๏ธ Checklist:** - [ ] โš–๏ธ My code follows the style guidelines of this project - [ ] ๐Ÿ‘€ I have performed a self-review of my own code - [ ] #๏ธโƒฃ I have commented my code, particularly in hard-to-understand areas - [ ] ๐Ÿ“„ I have made corresponding changes to the documentation - [ ] โš ๏ธ My changes generate no new warnings - [ ] ๐Ÿงช I have added tests to this description that prove my fix is effective or that my feature works - [ ] โฌ†๏ธ I increased versions for any altered app according to semantic versioning - [ ] I made sure the title starts with `feat(chart-name):`, `fix(chart-name):` or `chore(chart-name):` **โž• App addition** If this PR is an app addition please make sure you have done the following. - [ ] ๐Ÿ–ผ๏ธ I have added an icon in the Chart's root directory called `icon.png` --- _Please don't blindly check all the boxes. Read them and only check those that apply. Those checkboxes are there for the reviewer to see what is this all about and the status of this PR with a quick glance._ --------- Signed-off-by: Kjeld Schouten Signed-off-by: Stavros Kois <47820033+stavros-k@users.noreply.github.com> Co-authored-by: kqmaverick Co-authored-by: Stavros Kois Co-authored-by: Stavros Kois <47820033+stavros-k@users.noreply.github.com> --- charts/library/common-test/Chart.yaml | 2 +- .../common-test/ci/vpn-openvpn-values.yaml | 80 -- .../common-test/ci/vpn-wireguard-values.yaml | 72 -- .../tests/addons/codeserver_test.yaml | 61 ++ .../tests/addons/gluetun_test.yaml | 302 ++++++ .../tests/addons/tailscale_test.yaml | 282 +++++ .../common-test/tests/addons/vpn_test.yaml | 964 ------------------ charts/library/common/Chart.yaml | 2 +- .../common/templates/addons/_codeserver.tpl | 72 ++ .../common/templates/addons/_gluetun.tpl | 69 ++ .../common/templates/addons/_netshoot.tpl | 20 + .../common/templates/addons/_tailscale.tpl | 56 + .../addons/code-server/_codeserver.tpl | 72 -- .../addons/code-server/_container.tpl | 48 - .../templates/addons/netshoot/_container.tpl | 46 - .../templates/addons/netshoot/_netshoot.tpl | 15 - .../templates/addons/vpn/_configmap.tpl | 16 - .../addons/vpn/_gluetunContainer.tpl | 74 -- .../addons/vpn/_openvpnContainer.tpl | 75 -- .../common/templates/addons/vpn/_secret.tpl | 9 - .../addons/vpn/_tailscaleContainer.tpl | 89 -- .../common/templates/addons/vpn/_volume.tpl | 112 -- .../common/templates/addons/vpn/_vpn.tpl | 94 -- .../addons/vpn/_wireguardContainer.tpl | 68 -- .../templates/lib/ingress/_validation.tpl | 17 +- .../templates/lib/pod/_podSecurityContext.tpl | 4 +- .../templates/lib/service/_validation.tpl | 40 +- .../library/common/templates/loader/_init.tpl | 13 +- .../library/common/templates/values/_init.tpl | 5 + charts/library/common/values.yaml | 267 +++-- containers/apps/openvpn-client/Dockerfile | 12 - containers/apps/openvpn-client/PLATFORM | 1 - containers/apps/wireguard/Dockerfile | 11 - containers/apps/wireguard/PLATFORM | 1 - cspell.config.yaml | 1 + website/src/content/docs/common/addons.md | 250 +++++ 36 files changed, 1336 insertions(+), 1986 deletions(-) delete mode 100644 charts/library/common-test/ci/vpn-openvpn-values.yaml delete mode 100644 charts/library/common-test/ci/vpn-wireguard-values.yaml create mode 100644 charts/library/common-test/tests/addons/gluetun_test.yaml create mode 100644 charts/library/common-test/tests/addons/tailscale_test.yaml delete mode 100644 charts/library/common-test/tests/addons/vpn_test.yaml create mode 100644 charts/library/common/templates/addons/_codeserver.tpl create mode 100644 charts/library/common/templates/addons/_gluetun.tpl create mode 100644 charts/library/common/templates/addons/_netshoot.tpl create mode 100644 charts/library/common/templates/addons/_tailscale.tpl delete mode 100644 charts/library/common/templates/addons/code-server/_codeserver.tpl delete mode 100644 charts/library/common/templates/addons/code-server/_container.tpl delete mode 100644 charts/library/common/templates/addons/netshoot/_container.tpl delete mode 100644 charts/library/common/templates/addons/netshoot/_netshoot.tpl delete mode 100644 charts/library/common/templates/addons/vpn/_configmap.tpl delete mode 100644 charts/library/common/templates/addons/vpn/_gluetunContainer.tpl delete mode 100644 charts/library/common/templates/addons/vpn/_openvpnContainer.tpl delete mode 100644 charts/library/common/templates/addons/vpn/_secret.tpl delete mode 100644 charts/library/common/templates/addons/vpn/_tailscaleContainer.tpl delete mode 100644 charts/library/common/templates/addons/vpn/_volume.tpl delete mode 100644 charts/library/common/templates/addons/vpn/_vpn.tpl delete mode 100644 charts/library/common/templates/addons/vpn/_wireguardContainer.tpl delete mode 100644 containers/apps/openvpn-client/Dockerfile delete mode 100644 containers/apps/openvpn-client/PLATFORM delete mode 100644 containers/apps/wireguard/Dockerfile delete mode 100644 containers/apps/wireguard/PLATFORM create mode 100644 website/src/content/docs/common/addons.md diff --git a/charts/library/common-test/Chart.yaml b/charts/library/common-test/Chart.yaml index a01d9f9715f..d7effa50b6e 100644 --- a/charts/library/common-test/Chart.yaml +++ b/charts/library/common-test/Chart.yaml @@ -7,7 +7,7 @@ apiVersion: v2 appVersion: unknown dependencies: - name: common - version: ~26.4.0 + version: ~27.0.0 repository: file://../common/ condition: "" alias: "" diff --git a/charts/library/common-test/ci/vpn-openvpn-values.yaml b/charts/library/common-test/ci/vpn-openvpn-values.yaml deleted file mode 100644 index 7566956c2ae..00000000000 --- a/charts/library/common-test/ci/vpn-openvpn-values.yaml +++ /dev/null @@ -1,80 +0,0 @@ -service: - main: - enabled: true - primary: true - ports: - main: - enabled: true - primary: true - protocol: http - port: 8080 - -workload: - main: - enabled: true - primary: true - type: Deployment - podSpec: - containers: - main: - enabled: true - primary: true - args: - - --port - - "8080" - probes: - liveness: - enabled: true - type: http - port: "{{ .Values.service.main.ports.main.port }}" - readiness: - enabled: true - type: http - port: "{{ .Values.service.main.ports.main.port }}" - startup: - enabled: true - type: http - port: "{{ .Values.service.main.ports.main.port }}" - -args: - - --port - - "8080" - -# -- The common chart supports several add-ons. These can be configured under this key. -# @default -- See below -addons: - # -- The common chart supports adding a VPN add-on. It can be configured under this key. - # For more info, check out [our docs](http://docs.k8s-at-home.com/our-helm-charts/common-library-add-ons/#wireguard-vpn) - # @default -- See values.yaml - vpn: - # -- Specify the VPN type. Valid options are disabled, gluetun or tailscale - type: openvpn - - # -- OpenVPN specific configuration - # @default -- See below - openvpn: - # -- Credentials to connect to the VPN Service (used with -a) - # Only using password is enough - username: "testuser" - password: "testpass" - - # -- All variables specified here will be added to the vpn sidecar container - # See the documentation of the VPN image for all config values - env: - something: UTC - - # -- you can directly specify the config file here - config: "fdgdfsg" - - scripts: - # -- you can directly specify the upscript here - up: "sffds" - # some script - - # -- you can directly specify the downscript here - down: "fsdfds" - # some script - - # -- select pods to bind vpn addon to - targetSelector: - - main diff --git a/charts/library/common-test/ci/vpn-wireguard-values.yaml b/charts/library/common-test/ci/vpn-wireguard-values.yaml deleted file mode 100644 index 241a644e93a..00000000000 --- a/charts/library/common-test/ci/vpn-wireguard-values.yaml +++ /dev/null @@ -1,72 +0,0 @@ -service: - main: - enabled: true - primary: true - ports: - main: - enabled: true - primary: true - protocol: http - port: 8080 - -workload: - main: - enabled: true - primary: true - type: Deployment - podSpec: - containers: - main: - enabled: true - primary: true - args: - - --port - - "8080" - probes: - liveness: - enabled: true - type: http - port: "{{ .Values.service.main.ports.main.port }}" - readiness: - enabled: true - type: http - port: "{{ .Values.service.main.ports.main.port }}" - startup: - enabled: true - type: http - port: "{{ .Values.service.main.ports.main.port }}" - -args: - - --port - - "8080" - -# -- The common chart supports several add-ons. These can be configured under this key. -# @default -- See below -addons: - # -- The common chart supports adding a VPN add-on. It can be configured under this key. - # For more info, check out [our docs](http://docs.k8s-at-home.com/our-helm-charts/common-library-add-ons/#wireguard-vpn) - # @default -- See values.yaml - vpn: - # -- Specify the VPN type. Valid options are disabled, gluetun or tailscale - type: wireguard - - # -- All variables specified here will be added to the vpn sidecar container - # See the documentation of the VPN image for all config values - env: - something: UTC - - # -- you can directly specify the config file here - config: "fdgdfsg" - - scripts: - # -- you can directly specify the upscript here - up: "sffds" - # some script - - # -- you can directly specify the downscript here - down: "fsdfds" - # some script - - # -- select pods to bind vpn addon to - targetSelector: - - main diff --git a/charts/library/common-test/tests/addons/codeserver_test.yaml b/charts/library/common-test/tests/addons/codeserver_test.yaml index 743f4c354b3..d642542647a 100644 --- a/charts/library/common-test/tests/addons/codeserver_test.yaml +++ b/charts/library/common-test/tests/addons/codeserver_test.yaml @@ -314,3 +314,64 @@ tests: equal: path: spec.rules[0].http.paths[0].backend.service.port.number value: 30067 + + - it: should apply resources on the addon container + set: + workload: *workload + addons: + codeserver: + enabled: true + container: + resources: + limits: + cpu: 3333m + memory: 3333Mi + requests: + cpu: 222m + memory: 222Mi + asserts: + - documentIndex: &DeploymentDocument 0 + isKind: + of: Deployment + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[0].name + value: test-release-name-common-test-codeserver + - documentIndex: *DeploymentDocument + isSubset: + path: spec.template.spec.containers[0] + content: + resources: + limits: + cpu: 3333m + memory: 3333Mi + requests: + cpu: 222m + memory: 222Mi + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[1].name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + isSubset: + path: spec.template.spec.containers[1] + content: + resources: + limits: + cpu: 4000m + memory: 8Gi + requests: + cpu: 10m + memory: 50Mi + + - it: should fail if more than 1 workload selected + set: + addons: + codeserver: + enabled: true + targetSelector: + - workload + - other-workload + asserts: + - failedTemplate: + errorMessage: Codeserver Addon - Can only be attached to a single workload at a time diff --git a/charts/library/common-test/tests/addons/gluetun_test.yaml b/charts/library/common-test/tests/addons/gluetun_test.yaml new file mode 100644 index 00000000000..8a2f68ccd39 --- /dev/null +++ b/charts/library/common-test/tests/addons/gluetun_test.yaml @@ -0,0 +1,302 @@ +suite: addon vpn +templates: + - common.yaml +release: + name: test-release-name + namespace: test-release-namespace +tests: + - it: addon vpn gluetun enabled with config and env should pass + set: + resources: + limits: + nvidia.com/gpu: 1 + addons: + gluetun: + enabled: true + secret: + my-conf: + basePath: /gluetun/wireguard + data: + wg0.conf: | + some vpn config + with multiple lines + container: + env: + key: value + key1: value1 + key2: value2 + key3: value3 + workload: &workload + main: + enabled: true + primary: true + type: Deployment + podSpec: + containers: + container-1: + enabled: true + primary: true + probes: + liveness: + enabled: false + readiness: + enabled: false + startup: + enabled: false + service: + service-name1: + enabled: true + primary: true + ports: + port-1: + enabled: true + primary: true + port: 8080 + asserts: + - hasDocuments: + count: 3 + - documentIndex: &SecretDocument 0 + isKind: + of: Secret + - documentIndex: &DeploymentDocument 1 + isKind: + of: Deployment + - documentIndex: &ServiceDocument 2 + isKind: + of: Service + - documentIndex: *SecretDocument + equal: + path: metadata.name + value: test-release-name-common-test-gluetun-my-conf + - documentIndex: *SecretDocument + equal: + path: stringData + value: + wg0.conf: | + some vpn config + with multiple lines + - documentIndex: *DeploymentDocument + equal: + path: metadata.name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[0].name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + isSubset: + path: spec.template.spec.containers[0] + content: + resources: + limits: + cpu: 4000m + memory: 8Gi + nvidia.com/gpu: 1 + requests: + cpu: 10m + memory: 50Mi + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[1].name + value: test-release-name-common-test-gluetun + - documentIndex: *DeploymentDocument + isSubset: + path: spec.template.spec.containers[1] + content: + resources: + limits: + cpu: 4000m + memory: 8Gi + requests: + cpu: 10m + memory: 50Mi + - documentIndex: *ServiceDocument + equal: + path: metadata.name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + notContains: + path: spec.template.spec.containers[0].volumeMounts + content: &content + mountPath: /gluetun/wireguard + name: gluetun-my-conf + readOnly: false + - documentIndex: *DeploymentDocument + notContains: + path: spec.template.spec.containers[0].env + content: + name: key + value: value + - documentIndex: *DeploymentDocument + notContains: + path: spec.template.spec.containers[0].env + content: + name: key1 + value: value1 + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.containers[1].env + content: + name: key + value: value + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.containers[1].env + content: + name: key1 + value: value1 + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.containers[1].env + content: + name: key2 + value: value2 + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.containers[1].env + content: + name: key3 + value: value3 + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.containers[1].volumeMounts + content: *content + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.volumes + content: + name: gluetun-my-conf + secret: + items: + - key: wg0.conf + path: wg0.conf + optional: false + secretName: test-release-name-common-test-gluetun-my-conf + + - it: addon vpn gluetun enabled with scripts added + set: + addons: + gluetun: + enabled: true + secret: + my-conf: + basePath: /gluetun/wireguard + data: + wg0.conf: | + some vpn config + with multiple lines + scripts: + basePath: /gluetun/scripts + defaultMode: "0777" + data: + up.sh: | + echo "up" + echo "done" + down.sh: | + echo "down" + echo "done" + workload: *workload + service: + main: + enabled: true + primary: true + ports: + main: + enabled: true + primary: true + port: 8080 + asserts: + - hasDocuments: + count: 4 + - documentIndex: &SecretConfDocument 0 + isKind: + of: Secret + - documentIndex: *SecretConfDocument + equal: + path: metadata.name + value: test-release-name-common-test-gluetun-my-conf + - documentIndex: &SecretScriptsDocument 1 + isKind: + of: Secret + - documentIndex: *SecretScriptsDocument + equal: + path: metadata.name + value: test-release-name-common-test-gluetun-scripts + - documentIndex: &DeploymentDocument 2 + isKind: + of: Deployment + - documentIndex: &ServiceDocument 3 + isKind: + of: Service + - documentIndex: *SecretScriptsDocument + equal: + path: stringData + value: + up.sh: | + echo "up" + echo "done" + down.sh: | + echo "down" + echo "done" + - documentIndex: *SecretConfDocument + equal: + path: stringData + value: + wg0.conf: | + some vpn config + with multiple lines + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[0].name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.containers[1].volumeMounts + content: &content1 + mountPath: /gluetun/wireguard + name: gluetun-my-conf + readOnly: false + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.containers[1].volumeMounts + content: &content2 + mountPath: /gluetun/scripts + name: gluetun-scripts + readOnly: false + - documentIndex: *DeploymentDocument + notContains: + path: spec.template.spec.containers[0].volumeMounts + content: *content1 + - documentIndex: *DeploymentDocument + notContains: + path: spec.template.spec.containers[0].volumeMounts + content: *content2 + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[1].name + value: test-release-name-common-test-gluetun + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.volumes + content: + name: gluetun-my-conf + secret: + items: + - key: wg0.conf + path: wg0.conf + optional: false + secretName: test-release-name-common-test-gluetun-my-conf + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.volumes + content: + name: gluetun-scripts + secret: + defaultMode: 511 + items: + - key: down.sh + path: down.sh + - key: up.sh + path: up.sh + optional: false + secretName: test-release-name-common-test-gluetun-scripts diff --git a/charts/library/common-test/tests/addons/tailscale_test.yaml b/charts/library/common-test/tests/addons/tailscale_test.yaml new file mode 100644 index 00000000000..c1b95335768 --- /dev/null +++ b/charts/library/common-test/tests/addons/tailscale_test.yaml @@ -0,0 +1,282 @@ +suite: addon tailscale +templates: + - common.yaml +release: + name: test-release-name + namespace: test-release-namespace +tests: + - it: addon enabled should pass + set: + resources: + limits: + nvidia.com/gpu: 1 + workload: + main: + enabled: true + primary: true + type: Deployment + podSpec: + containers: + main: + enabled: true + primary: true + service: + main: + enabled: true + primary: true + ports: + main: + enabled: true + primary: true + port: 8080 + addons: + tailscale: + enabled: true + container: + env: + TS_AUTH_KEY: something + asserts: + - hasDocuments: + count: 2 + - documentIndex: &DeploymentDocument 0 + isKind: + of: Deployment + - documentIndex: &ServiceDocument 1 + isKind: + of: Service + - documentIndex: *ServiceDocument + equal: + path: metadata.name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + equal: + path: metadata.name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[0].name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + isSubset: + path: spec.template.spec + content: + automountServiceAccountToken: true + - documentIndex: *DeploymentDocument + isSubset: + path: spec.template.spec.containers[0] + content: + resources: + limits: + cpu: 4000m + memory: 8Gi + nvidia.com/gpu: 1 + requests: + cpu: 10m + memory: 50Mi + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[1].name + value: test-release-name-common-test-tailscale + - documentIndex: *DeploymentDocument + isSubset: + path: spec.template.spec.containers[1] + content: + resources: + limits: + cpu: 4000m + memory: 8Gi + requests: + cpu: 10m + memory: 50Mi + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.containers[1].env + content: + name: TS_AUTH_KEY + value: something + - documentIndex: *DeploymentDocument + isSubset: + path: spec.template.spec.containers[1].securityContext + content: + runAsUser: 1000 + runAsGroup: 1000 + runAsNonRoot: true + readOnlyRootFilesystem: true + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.volumes + content: + name: tailscalestate + emptyDir: {} + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.containers[1].volumeMounts + content: + name: tailscalestate + mountPath: /var/lib/tailscale + readOnly: false + + - it: addon enabled should pass with userspace to false + set: + resources: + limits: + nvidia.com/gpu: 1 + workload: + main: + enabled: true + primary: true + type: Deployment + podSpec: + containers: + main: + enabled: true + primary: true + service: + main: + enabled: true + primary: true + ports: + main: + enabled: true + primary: true + port: 8080 + addons: + tailscale: + enabled: true + container: + env: + TS_AUTH_KEY: something + TS_USERSPACE: false + asserts: + - hasDocuments: + count: 2 + - documentIndex: &DeploymentDocument 0 + isKind: + of: Deployment + - documentIndex: &ServiceDocument 1 + isKind: + of: Service + - documentIndex: *ServiceDocument + equal: + path: metadata.name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + equal: + path: metadata.name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[0].name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + isSubset: + path: spec.template.spec.containers[0] + content: + resources: + limits: + cpu: 4000m + memory: 8Gi + nvidia.com/gpu: 1 + requests: + cpu: 10m + memory: 50Mi + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[1].name + value: test-release-name-common-test-tailscale + - documentIndex: *DeploymentDocument + isSubset: + path: spec.template.spec.containers[1] + content: + resources: + limits: + cpu: 4000m + memory: 8Gi + requests: + cpu: 10m + memory: 50Mi + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.containers[1].env + content: + name: TS_AUTH_KEY + value: something + - documentIndex: *DeploymentDocument + isSubset: + path: spec.template.spec.containers[1].securityContext + content: + runAsUser: 0 + runAsGroup: 0 + runAsNonRoot: false + readOnlyRootFilesystem: false + + - it: addon enabled should pass with state set to hostpath + set: + persistence: + tailscalestate: + type: hostPath + hostPath: /test + workload: + main: + enabled: true + primary: true + type: Deployment + podSpec: + containers: + main: + enabled: true + primary: true + service: + main: + enabled: true + primary: true + ports: + main: + enabled: true + primary: true + port: 8080 + addons: + tailscale: + enabled: true + container: + env: + TS_AUTH_KEY: something + asserts: + - hasDocuments: + count: 2 + - documentIndex: &DeploymentDocument 0 + isKind: + of: Deployment + - documentIndex: &ServiceDocument 1 + isKind: + of: Service + - documentIndex: *ServiceDocument + equal: + path: metadata.name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + equal: + path: metadata.name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[0].name + value: test-release-name-common-test + - documentIndex: *DeploymentDocument + equal: + path: spec.template.spec.containers[1].name + value: test-release-name-common-test-tailscale + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.volumes + content: + name: tailscalestate + hostPath: + path: /test + - documentIndex: *DeploymentDocument + contains: + path: spec.template.spec.containers[1].volumeMounts + content: + name: tailscalestate + mountPath: /var/lib/tailscale + readOnly: false diff --git a/charts/library/common-test/tests/addons/vpn_test.yaml b/charts/library/common-test/tests/addons/vpn_test.yaml deleted file mode 100644 index 5d28880b79d..00000000000 --- a/charts/library/common-test/tests/addons/vpn_test.yaml +++ /dev/null @@ -1,964 +0,0 @@ -suite: addon vpn -templates: - - common.yaml -release: - name: test-release-name - namespace: test-release-namespace -tests: - - it: addon vpn gluetun enabled with config and env should pass - set: - resources: - limits: - nvidia.com/gpu: 1 - addons: - vpn: - type: gluetun - config: | - some vpn config - with multiple lines - env: - key: value - key1: value1 - envList: - - name: key2 - value: value2 - - name: key3 - value: value3 - workload: &workload - main: - enabled: true - primary: true - type: Deployment - podSpec: - containers: - main: - enabled: true - primary: true - service: - main: - enabled: true - primary: true - ports: - main: - enabled: true - primary: true - port: 8080 - asserts: - - hasDocuments: - count: 3 - - documentIndex: &SecretDocument 0 - isKind: - of: Secret - - documentIndex: &DeploymentDocument 1 - isKind: - of: Deployment - - documentIndex: &ServiceDocument 2 - isKind: - of: Service - - documentIndex: *SecretDocument - equal: - path: metadata.name - value: test-release-name-common-test-vpnconfig - - documentIndex: *SecretDocument - equal: - path: stringData - value: - vpn.conf: |- - some vpn config - with multiple lines - - documentIndex: *DeploymentDocument - equal: - path: metadata.name - value: test-release-name-common-test - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[0].name - value: test-release-name-common-test - - documentIndex: *DeploymentDocument - isSubset: - path: spec.template.spec.containers[0] - content: - resources: - limits: - cpu: 4000m - memory: 8Gi - nvidia.com/gpu: 1 - requests: - cpu: 10m - memory: 50Mi - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[1].name - value: test-release-name-common-test-vpn - - documentIndex: *DeploymentDocument - isSubset: - path: spec.template.spec.containers[1] - content: - resources: - limits: - cpu: 4000m - memory: 8Gi - requests: - cpu: 10m - memory: 50Mi - - documentIndex: *ServiceDocument - equal: - path: metadata.name - value: test-release-name-common-test - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnconfig - mountPath: /gluetun - readOnly: false - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].env - content: - name: key - value: value - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].env - content: - name: key1 - value: value1 - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: key - value: value - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: key1 - value: value1 - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: key2 - value: value2 - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: key3 - value: value3 - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].volumeMounts - content: - name: vpnconfig - mountPath: /gluetun - readOnly: false - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnconfig - secret: - secretName: test-release-name-common-test-vpnconfig - defaultMode: 0777 - optional: false - items: - - key: vpn.conf - path: vpn.conf - - - it: addon vpn gluetun enabled with scripts added - set: - addons: - vpn: - type: gluetun - config: | - some vpn config - with multiple lines - scripts: - up: | - echo "up" - echo "done" - down: | - echo "down" - echo "done" - workload: *workload - service: - main: - enabled: true - primary: true - ports: - main: - enabled: true - primary: true - port: 8080 - asserts: - - hasDocuments: - count: 4 - - documentIndex: &ConfigMapDocument 0 - isKind: - of: ConfigMap - - documentIndex: &SecretDocument 1 - isKind: - of: Secret - - documentIndex: &DeploymentDocument 2 - isKind: - of: Deployment - - documentIndex: &ServiceDocument 3 - isKind: - of: Service - - documentIndex: *SecretDocument - equal: - path: metadata.name - value: test-release-name-common-test-vpnconfig - - documentIndex: *ConfigMapDocument - equal: - path: metadata.name - value: test-release-name-common-test-vpnscripts - - documentIndex: *ConfigMapDocument - equal: - path: data - value: - up.sh: |- - echo "up" - echo "done" - down.sh: |- - echo "down" - echo "done" - - documentIndex: *SecretDocument - equal: - path: stringData - value: - vpn.conf: |- - some vpn config - with multiple lines - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[0].name - value: test-release-name-common-test - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].volumeMounts - content: - name: vpnconfig - mountPath: /gluetun - readOnly: false - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].volumeMounts - content: - name: vpnscripts - mountPath: /gluetun - readOnly: false - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnconfig - mountPath: /gluetun - readOnly: false - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnscripts - mountPath: /gluetun - readOnly: false - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[1].name - value: test-release-name-common-test-vpn - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnconfig - secret: - secretName: test-release-name-common-test-vpnconfig - defaultMode: 0777 - optional: false - items: - - key: vpn.conf - path: vpn.conf - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnscripts - configMap: - name: vpnscripts - defaultMode: 0777 - optional: false - items: - - key: up.sh - path: up.sh - - key: down.sh - path: down.sh - - - it: addon vpn gluetun enabled with existing secret - set: - addons: - vpn: - type: gluetun - existingSecret: existing-secret - workload: *workload - service: - main: - enabled: true - primary: true - ports: - main: - enabled: true - primary: true - port: 8080 - asserts: - - hasDocuments: - count: 2 - - documentIndex: &DeploymentDocument 0 - isKind: - of: Deployment - - documentIndex: &ServiceDocument 1 - isKind: - of: Service - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[0].name - value: test-release-name-common-test - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].volumeMounts - content: - name: vpnconfig - mountPath: /gluetun - readOnly: false - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnconfig - mountPath: /gluetun - readOnly: false - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[1].name - value: test-release-name-common-test-vpn - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnconfig - secret: - secretName: existing-secret - defaultMode: 0777 - optional: false - items: - - key: vpn.conf - path: vpn.conf - - - it: addon vpn gluetun enabled with configFile - set: - addons: - vpn: - type: gluetun - configFile: /path/to/file - workload: *workload - service: - main: - enabled: true - primary: true - ports: - main: - enabled: true - primary: true - port: 8080 - asserts: - - hasDocuments: - count: 3 - - documentIndex: &JobDocument 0 - isKind: - of: Job - - documentIndex: &DeploymentDocument 1 - isKind: - of: Deployment - - documentIndex: &ServiceDocument 2 - isKind: - of: Service - - documentIndex: *JobDocument - equal: - path: metadata.name - value: test-release-name-common-test-autopermissions - - documentIndex: *JobDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnconfig - hostPath: - path: /path/to/file - type: File - - documentIndex: *JobDocument - contains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnconfig - mountPath: /mounts/vpnconfig - readOnly: false - - documentIndex: *JobDocument - equal: - path: spec.template.spec.containers[0].args - value: - - |- - echo "Starting auto permissions job..." - touch /tmp/healthy - - echo "Automatically correcting ownership and permissions..." - echo "Automatically correcting ownership for /mounts/vpnconfig..." - before=$(stat -c "%u:%g" /mounts/vpnconfig) - chown -f 568:568 /mounts/vpnconfig || echo "Failed setting ownership using chown..." - - echo "Ownership before: [$before]" - echo "Ownership after: [$(stat -c "%u:%g" /mounts/vpnconfig)]" - echo "" - echo "Finished auto permissions job..." - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[0].name - value: test-release-name-common-test - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].volumeMounts - content: - name: vpnconfig - mountPath: /gluetun/vpn.conf - readOnly: false - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnconfig - mountPath: /gluetun/vpn.conf - readOnly: false - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[1].name - value: test-release-name-common-test-vpn - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnconfig - hostPath: - path: /path/to/file - type: File - - - it: addon vpn gluetun enabled with configFolder - set: - addons: - vpn: - type: gluetun - configFolder: /path/to/folder - workload: *workload - service: - main: - enabled: true - primary: true - ports: - main: - enabled: true - primary: true - port: 8080 - asserts: - - hasDocuments: - count: 3 - - documentIndex: &JobDocument 0 - isKind: - of: Job - - documentIndex: *JobDocument - equal: - path: metadata.name - value: test-release-name-common-test-autopermissions - - documentIndex: *JobDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnfolder - hostPath: - path: /path/to/folder - - documentIndex: *JobDocument - contains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnfolder - mountPath: /mounts/vpnfolder - readOnly: false - - documentIndex: *JobDocument - equal: - path: spec.template.spec.containers[0].args - value: - - |- - echo "Starting auto permissions job..." - touch /tmp/healthy - - echo "Automatically correcting ownership and permissions..." - echo "Automatically correcting ownership for /mounts/vpnfolder..." - before=$(stat -c "%u:%g" /mounts/vpnfolder) - chown -f 568:568 /mounts/vpnfolder || echo "Failed setting ownership using chown..." - - echo "Ownership before: [$before]" - echo "Ownership after: [$(stat -c "%u:%g" /mounts/vpnfolder)]" - echo "" - echo "Finished auto permissions job..." - - documentIndex: &DeploymentDocument 1 - isKind: - of: Deployment - - documentIndex: &ServiceDocument 2 - isKind: - of: Service - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[0].name - value: test-release-name-common-test - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].volumeMounts - content: - name: vpnfolder - mountPath: /gluetun - readOnly: false - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnfolder - mountPath: /gluetun - readOnly: false - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[1].name - value: test-release-name-common-test-vpn - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnfolder - hostPath: - path: /path/to/folder - - - it: tailscale addon enabled with authkey should pass - set: - resources: - limits: - nvidia.com/gpu: 1 - addons: - vpn: - type: tailscale - tailscale: - authkey: something - userspace: true - env: - key: value - key1: value1 - workload: *workload - asserts: - - hasDocuments: - count: 1 - - documentIndex: &DeploymentDocument 0 - isKind: - of: Deployment - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.automountServiceAccountToken - value: true - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[0].name - value: test-release-name-common-test - - documentIndex: *DeploymentDocument - isSubset: - path: spec.template.spec.containers[0] - content: - resources: - limits: - cpu: 4000m - memory: 8Gi - nvidia.com/gpu: 1 - requests: - cpu: 10m - memory: 50Mi - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[1].name - value: test-release-name-common-test-tailscale - - documentIndex: *DeploymentDocument - isSubset: - path: spec.template.spec.containers[1] - content: - resources: - limits: - cpu: 4000m - memory: 8Gi - requests: - cpu: 10m - memory: 50Mi - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: TS_KUBE_SECRET - value: "" - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: TS_SOCKET - value: /var/run/tailscale/tailscaled.sock - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: TS_STATE_DIR - value: /var/lib/tailscale/state - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: TS_AUTH_ONCE - value: "true" - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: TS_USERSPACE - value: "true" - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: TS_ACCEPT_DNS - value: "false" - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: TS_AUTH_KEY - value: something - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].env - content: - name: key - value: value - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].env - content: - name: key1 - value: value1 - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: key - value: value - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].env - content: - name: key1 - value: value1 - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].volumeMounts - content: - name: tailscalestate - mountPath: /var/lib/tailscale - readOnly: false - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: tailscalestate - mountPath: /var/lib/tailscale - readOnly: false - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.volumes - content: - name: tailscalestate - emptyDir: {} - - - it: tailscale addon enabled with authkey without userspace should pass - set: - addons: - vpn: - type: tailscale - tailscale: - authkey: something - userspace: false - key1: value1 - workload: *workload - asserts: - - hasDocuments: - count: 1 - - documentIndex: &DeploymentDocument 0 - isKind: - of: Deployment - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[0].name - value: test-release-name-common-test - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[1].name - value: test-release-name-common-test-tailscale - - documentIndex: *DeploymentDocument - isSubset: - path: spec.template.spec.containers[1].securityContext - content: - privileged: false - readOnlyRootFilesystem: false - runAsNonRoot: false - runAsUser: 0 - runAsGroup: 0 - - - it: addon vpn openvpn enabled with configFile - set: - resources: - limits: - nvidia.com/gpu: 1 - addons: - vpn: - type: openvpn - configFile: /path/to/file - workload: *workload - service: - main: - enabled: true - primary: true - ports: - main: - enabled: true - primary: true - port: 8080 - asserts: - - hasDocuments: - count: 3 - - documentIndex: &JobDocument 0 - isKind: - of: Job - - documentIndex: &DeploymentDocument 1 - isKind: - of: Deployment - - documentIndex: &ServiceDocument 2 - isKind: - of: Service - - documentIndex: *JobDocument - equal: - path: metadata.name - value: test-release-name-common-test-autopermissions - - documentIndex: *JobDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnconfig - hostPath: - path: /path/to/file - type: File - - documentIndex: *JobDocument - contains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnconfig - mountPath: /mounts/vpnconfig - readOnly: false - - documentIndex: *JobDocument - equal: - path: spec.template.spec.containers[0].args - value: - - |- - echo "Starting auto permissions job..." - touch /tmp/healthy - - echo "Automatically correcting ownership and permissions..." - echo "Automatically correcting ownership for /mounts/vpnconfig..." - before=$(stat -c "%u:%g" /mounts/vpnconfig) - chown -f 568:568 /mounts/vpnconfig || echo "Failed setting ownership using chown..." - - echo "Ownership before: [$before]" - echo "Ownership after: [$(stat -c "%u:%g" /mounts/vpnconfig)]" - echo "" - echo "Finished auto permissions job..." - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[0].name - value: test-release-name-common-test - - documentIndex: *DeploymentDocument - isSubset: - path: spec.template.spec.containers[0] - content: - resources: - limits: - cpu: 4000m - memory: 8Gi - nvidia.com/gpu: 1 - requests: - cpu: 10m - memory: 50Mi - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].volumeMounts - content: - name: vpnconfig - mountPath: /vpn/vpn.conf - readOnly: false - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnconfig - mountPath: /vpn/vpn.conf - readOnly: false - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[1].name - value: test-release-name-common-test-vpn - - documentIndex: *DeploymentDocument - isSubset: - path: spec.template.spec.containers[1] - content: - resources: - limits: - cpu: 4000m - memory: 8Gi - requests: - cpu: 10m - memory: 50Mi - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnconfig - hostPath: - path: /path/to/file - type: File - - - it: addon vpn wireguard enabled with configFile - set: - resources: - limits: - nvidia.com/gpu: 1 - addons: - vpn: - type: wireguard - configFile: /path/to/file - workload: *workload - service: - main: - enabled: true - primary: true - ports: - main: - enabled: true - primary: true - port: 8080 - asserts: - - hasDocuments: - count: 3 - - documentIndex: &JobDocument 0 - isKind: - of: Job - - documentIndex: &DeploymentDocument 1 - isKind: - of: Deployment - - documentIndex: &ServiceDocument 2 - isKind: - of: Service - - documentIndex: *JobDocument - equal: - path: metadata.name - value: test-release-name-common-test-autopermissions - - documentIndex: *JobDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnconfig - hostPath: - path: /path/to/file - type: File - - documentIndex: *JobDocument - contains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnconfig - mountPath: /mounts/vpnconfig - readOnly: false - - documentIndex: *JobDocument - equal: - path: spec.template.spec.containers[0].args - value: - - |- - echo "Starting auto permissions job..." - touch /tmp/healthy - - echo "Automatically correcting ownership and permissions..." - echo "Automatically correcting ownership for /mounts/vpnconfig..." - before=$(stat -c "%u:%g" /mounts/vpnconfig) - chown -f 568:568 /mounts/vpnconfig || echo "Failed setting ownership using chown..." - - echo "Ownership before: [$before]" - echo "Ownership after: [$(stat -c "%u:%g" /mounts/vpnconfig)]" - echo "" - echo "Finished auto permissions job..." - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[0].name - value: test-release-name-common-test - - documentIndex: *DeploymentDocument - isSubset: - path: spec.template.spec.containers[0] - content: - resources: - limits: - cpu: 4000m - memory: 8Gi - nvidia.com/gpu: 1 - requests: - cpu: 10m - memory: 50Mi - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.containers[1].volumeMounts - content: - name: vpnconfig - mountPath: /etc/wireguard/vpn.conf - readOnly: false - - documentIndex: *DeploymentDocument - notContains: - path: spec.template.spec.containers[0].volumeMounts - content: - name: vpnconfig - mountPath: /etc/wireguard/vpn.conf - readOnly: false - - documentIndex: *DeploymentDocument - equal: - path: spec.template.spec.containers[1].name - value: test-release-name-common-test-vpn - - documentIndex: *DeploymentDocument - isSubset: - path: spec.template.spec.containers[1] - content: - resources: - limits: - cpu: 4000m - memory: 8Gi - requests: - cpu: 10m - memory: 50Mi - - documentIndex: *DeploymentDocument - contains: - path: spec.template.spec.volumes - content: - name: vpnconfig - hostPath: - path: /path/to/file - type: File diff --git a/charts/library/common/Chart.yaml b/charts/library/common/Chart.yaml index 4ac2350d9c9..8c1fd6b8b5b 100644 --- a/charts/library/common/Chart.yaml +++ b/charts/library/common/Chart.yaml @@ -48,4 +48,4 @@ sources: - https://hub.docker.com/_/ - https://hub.docker.com/r/mikefarah/yq type: library -version: 26.4.3 +version: 27.0.0 diff --git a/charts/library/common/templates/addons/_codeserver.tpl b/charts/library/common/templates/addons/_codeserver.tpl new file mode 100644 index 00000000000..c1187fd002b --- /dev/null +++ b/charts/library/common/templates/addons/_codeserver.tpl @@ -0,0 +1,72 @@ +{{/* +Template to render code-server addon +It will include / inject the required templates based on the given values. +*/}} +{{- define "tc.v1.common.addon.codeserver" -}} + {{- $codeSrv := $.Values.addons.codeserver -}} + + {{- if $codeSrv.enabled -}} + {{- $targetSelector := list "main" -}} + {{- if $codeSrv.targetSelector -}} + {{- $targetSelector = $codeSrv.targetSelector -}} + {{- end -}} + + {{- if gt ($targetSelector|len) 1 -}} + {{- fail "Codeserver Addon - Can only be attached to a single workload at a time" -}} + {{- end -}} + + {{/* Append the code-server container to the workloads */}} + {{- range $targetSelector -}} + {{- $workload := get $.Values.workload . -}} + {{- $_ := set $workload.podSpec.containers "codeserver" $codeSrv.container -}} + {{- end -}} + + {{/* Add the code-server service */}} + {{- if $codeSrv.service.enabled -}} + {{/* Add the code-server service */}} + {{- $hasPrimaryService := false -}} + {{- $result := (include "tc.v1.common.lib.service.hasPrimary" $) | fromJson -}} + {{- if and $result.hasEnabled $result.hasPrimary -}} + {{- $hasPrimaryService = true -}} + {{- end -}} + + {{- $svcValues := $codeSrv.service -}} + {{- $_ := set $svcValues "targetSelector" ($targetSelector|first) -}} + {{- if not $hasPrimaryService -}} + {{- $_ := set $svcValues "primary" true -}} + {{- end -}} + + {{- if not $.Values.service -}} + {{- $_ := set $.Values "service" dict -}} + {{- end -}} + + {{- $_ := set $.Values.service "codeserver" $svcValues -}} + {{- end -}} + + {{/* Add the code-server ingress */}} + {{- if $codeSrv.ingress.enabled -}} + {{- $ingressValues := $codeSrv.ingress -}} + {{- if not $ingressValues.targetSelector -}} + {{/* Assumes that both service and port are named codeserver */}} + {{- $_ := set $ingressValues "targetSelector" (dict "codeserver" "codeserver") -}} + {{- end -}} + + {{- $hasPrimaryIngress := false -}} + {{- $result := (include "tc.v1.common.lib.ingress.hasPrimary" $) | fromJson -}} + {{- if and $result.hasEnabled $result.hasPrimary -}} + {{- $hasPrimaryIngress = true -}} + {{- end -}} + + {{- if not $hasPrimaryIngress -}} + {{- $_ := set $ingressValues "primary" true -}} + {{- end -}} + + {{- if not $.Values.ingress -}} + {{- $_ := set $.Values "ingress" dict -}} + {{- end -}} + + {{/* Let spawner handle the rest */}} + {{- $_ := set $.Values.ingress "codeserver" $ingressValues -}} + {{- end -}} + {{- end -}} +{{- end -}} diff --git a/charts/library/common/templates/addons/_gluetun.tpl b/charts/library/common/templates/addons/_gluetun.tpl new file mode 100644 index 00000000000..0a6deb29a41 --- /dev/null +++ b/charts/library/common/templates/addons/_gluetun.tpl @@ -0,0 +1,69 @@ +{{/* +Template to render VPN addon +It will include / inject the required templates based on the given values. +*/}} +{{- define "tc.v1.common.addon.gluetun" -}} + {{- $glue := $.Values.addons.gluetun -}} + {{- if $glue.enabled -}} + {{- if not $glue.container.env -}} + {{- $_ := set $glue.container "env" dict -}} + {{- end -}} + + {{- $fw := $glue.container.env.FIREWALL -}} + {{- if (eq $fw "on") -}} + {{- $nets := $glue.container.env.FIREWALL_OUTBOUT_SUBNETS | splitList "," -}} + {{- $nets = mustAppend ($nets $.Values.chartContext.podCIDR $.Values.chartContext.svcCIDR) | mustUniq -}} + {{- $_ := set $glue.container.env "FIREWALL_OUTBOUND_SUBNETS" (join "," $nets) -}} + + {{- $inputPorts := $glue.container.env.FIREWALL_INPUT_PORTS | splitList "," -}} + {{- if and + $.Values.service $.Values.service.main $.Values.service.main.ports + $.Values.service.main.ports.main $.Values.service.main.ports.main.port + -}} + {{- $inputPorts = mustAppend $inputPorts $.Values.service.main.ports.main.port -}} + {{- end -}} + {{- $inputPorts = $inputPorts | mustUniq -}} + {{- $_ := set $glue.container.env "FIREWALL_INPUT_PORTS" (join "," $inputPorts) -}} + {{- end -}} + + {{- $targetSelector := list "main" -}} + {{- if $glue.targetSelector -}} + {{- $targetSelector = $glue.targetSelector -}} + {{- end -}} + + {{/* Append the vpn container to the workloads */}} + {{- range $targetSelector -}} + {{- $workload := get $.Values.workload . -}} + {{- $_ := set $workload.podSpec.containers "gluetun" $glue.container -}} + {{- end -}} + + {{/* Mount secrets */}} + {{- range $secName, $secValues := $glue.secret -}} + {{- $secretName := printf "gluetun-%s" $secName -}} + {{- if not $secValues.basePath -}} + {{- fail (printf "Gluetun - Secret [%s] does not have basePath") -}} + {{- end -}} + {{- $_ := set $secValues "enabled" true -}} + {{- $_ := set $.Values.secret $secretName $secValues -}} + + {{- $persistence := (dict + "enabled" true "type" "secret" "objectName" $secretName "targetSelector" dict "items" list + ) -}} + {{- if $secValues.defaultMode -}} + {{- $_ := set $persistence "defaultMode" $secValues.defaultMode -}} + {{- end -}} + + {{- range $key, $val := $secValues.data -}} + {{- $item := (dict "key" $key "path" $key) -}} + {{- $_ := set $persistence "items" (mustAppend $persistence.items $item) -}} + {{- end -}} + + {{- $selectorValue := (dict "gluetun" (dict "mountPath" $secValues.basePath)) -}} + {{- range $targetSelector -}} + {{- $_ := set $persistence.targetSelector . $selectorValue -}} + {{- end -}} + + {{- $_ := set $.Values.persistence $secretName $persistence -}} + {{- end -}} + {{- end -}} +{{- end -}} diff --git a/charts/library/common/templates/addons/_netshoot.tpl b/charts/library/common/templates/addons/_netshoot.tpl new file mode 100644 index 00000000000..d7b9e9c7576 --- /dev/null +++ b/charts/library/common/templates/addons/_netshoot.tpl @@ -0,0 +1,20 @@ +{{/* +Template to render code-server addon +It will include / inject the required templates based on the given values. +*/}} +{{- define "tc.v1.common.addon.netshoot" -}} + {{- $netshoot := $.Values.addons.netshoot -}} + {{- if $netshoot.enabled -}} + {{- $targetSelector := list "main" -}} + {{- if $netshoot.targetSelector -}} + {{- $targetSelector = $netshoot.targetSelector -}} + {{- end -}} + + {{- range $targetSelector -}} + {{/* Append the code-server container to the workloads */}} + {{- $workload := get $.Values.workload . -}} + {{- $_ := set $workload.podSpec.containers "netshoot" $.Values.addons.netshoot.container -}} + {{- end -}} + + {{- end -}} +{{- end -}} diff --git a/charts/library/common/templates/addons/_tailscale.tpl b/charts/library/common/templates/addons/_tailscale.tpl new file mode 100644 index 00000000000..e3d5e5e5004 --- /dev/null +++ b/charts/library/common/templates/addons/_tailscale.tpl @@ -0,0 +1,56 @@ +{{/* +Template to render VPN addon +It will include / inject the required templates based on the given values. +*/}} +{{- define "tc.v1.common.addon.tailscale" -}} + {{- $ts := $.Values.addons.tailscale -}} + {{- if $ts.enabled -}} + {{- $secContext := dict -}} + {{- $_ := set $secContext "runAsUser" 0 -}} + {{- $_ := set $secContext "runAsGroup" 0 -}} + {{- $_ := set $secContext "runAsNonRoot" true -}} + {{- $_ := set $secContext "readOnlyRootFilesystem" false -}} + + {{- if and $ts.container.env ($ts.container.env.TS_USERSPACE) -}} + {{- $_ := set $secContext "runAsUser" 1000 -}} + {{- $_ := set $secContext "runAsGroup" 1000 -}} + {{- $_ := set $secContext "runAsNonRoot" false -}} + {{- $_ := set $secContext "readOnlyRootFilesystem" true -}} + {{- end -}} + + {{- $newSecContext := $ts.container.securityContext -}} + {{- $newSecContext = mustMergeOverwrite $newSecContext $secContext -}} + {{- $_ := set $ts.container "securityContext" $newSecContext -}} + + {{- $targetSelector := list "main" -}} + {{- if $ts.targetSelector -}} + {{- $targetSelector = $ts.targetSelector -}} + {{- end -}} + + {{/* Append the vpn container to the workloads */}} + {{- range $targetSelector -}} + {{/* FIXME: https://github.com/tailscale/tailscale/issues/8188 */}} + {{- $workload := get $.Values.workload . -}} + {{- $_ := set $workload.podSpec "automountServiceAccountToken" true -}} + {{- $_ := set $workload.podSpec.containers "tailscale" $ts.container -}} + {{- end -}} + + {{- $persistence := $.Values.persistence.tailscalestate | default dict -}} + {{- $_ := set $persistence "enabled" true -}} + {{- if not $persistence.type -}} + {{- $_ := set $persistence "type" "emptyDir" -}} + {{- end -}} + {{- if not $persistence.targetSelector -}} + {{- $_ := set $persistence "targetSelector" dict -}} + {{- end -}} + + {{- $selectorValue := (dict "tailscale" (dict "mountPath" "/var/lib/tailscale")) -}} + {{- range $targetSelector -}} + {{- $_ := set $persistence.targetSelector . $selectorValue -}} + {{- end -}} + + {{/* Append the empty dir tailscale to the persistence */}} + {{- $_ := set $.Values.persistence "tailscalestate" $persistence -}} + {{- end -}} + +{{- end -}} diff --git a/charts/library/common/templates/addons/code-server/_codeserver.tpl b/charts/library/common/templates/addons/code-server/_codeserver.tpl deleted file mode 100644 index 68a49cfe82f..00000000000 --- a/charts/library/common/templates/addons/code-server/_codeserver.tpl +++ /dev/null @@ -1,72 +0,0 @@ -{{/* -Template to render code-server addon -It will include / inject the required templates based on the given values. -*/}} -{{- define "tc.v1.common.addon.codeserver" -}} -{{- $targetSelector := "main" -}} -{{- if $.Values.addons.codeserver.targetSelector -}} - {{- $targetSelector = $.Values.addons.codeserver.targetSelector -}} -{{- end -}} -{{- if .Values.addons.codeserver.enabled -}} - {{/* Append the code-server container to the workloads */}} - {{- $container := include "tc.v1.common.addon.codeserver.container" . | fromYaml -}} - {{- if $container -}} - {{- $workload := get $.Values.workload $targetSelector -}} - {{- $_ := set $workload.podSpec.containers "codeserver" $container -}} - {{- end -}} - - {{- $hasPrimaryService := false -}} - {{- range $svcName, $svcValues := .Values.service -}} - {{- $enabled := (include "tc.v1.common.lib.util.enabled" (dict - "rootCtx" $ "objectData" $svcValues - "name" $svcName "caller" "Code Server Service" - "key" "addons.codeserver.service")) -}} - - {{- if eq $enabled "true" -}} - {{- if $svcValues.primary -}} - {{- $hasPrimaryService = true -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{/* Add the code-server service */}} - {{- if .Values.addons.codeserver.service.enabled -}} - {{- $serviceValues := .Values.addons.codeserver.service -}} - {{- $_ := set $serviceValues "targetSelector" $targetSelector -}} - {{- if not $hasPrimaryService -}} - {{- $_ := set $serviceValues "primary" true -}} - {{- end -}} - {{- $_ := set .Values.service "codeserver" $serviceValues -}} - {{- end -}} - - {{/* Add the code-server ingress */}} - {{- if .Values.addons.codeserver.ingress.enabled -}} - {{- $ingressValues := .Values.addons.codeserver.ingress -}} - {{- if not $ingressValues.targetSelector -}} - {{/* Assumes that both service and port are named codeserver */}} - {{- $_ := set $ingressValues "targetSelector" (dict "codeserver" "codeserver") -}} - {{- end -}} - - {{- $hasPrimaryIngress := false -}} - {{- range $ingName, $ingValues := $.Values.ingress -}} - {{- $enabled := (include "tc.v1.common.lib.util.enabled" (dict - "rootCtx" $ "objectData" $ingValues - "name" $ingName "caller" "Code Server Ingress" - "key" "addons.codeserver.ingress")) -}} - - {{- if eq $enabled "true" -}} - {{- if $ingValues.primary -}} - {{- $hasPrimaryIngress = true -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if not $hasPrimaryIngress -}} - {{- $_ := set $ingressValues "primary" true -}} - {{- end -}} - - {{/* Let spawner handle the rest */}} - {{- $_ := set $.Values.ingress "codeserver" $ingressValues -}} - {{- end -}} -{{- end -}} -{{- end -}} diff --git a/charts/library/common/templates/addons/code-server/_container.tpl b/charts/library/common/templates/addons/code-server/_container.tpl deleted file mode 100644 index 62d5e6ed995..00000000000 --- a/charts/library/common/templates/addons/code-server/_container.tpl +++ /dev/null @@ -1,48 +0,0 @@ -{{/* -The code-server sidecar container to be inserted. -*/}} -{{- define "tc.v1.common.addon.codeserver.container" -}} -enabled: true -probes: - liveness: - enabled: true - port: {{ .Values.addons.codeserver.service.ports.codeserver.port }} - path: "/" - readiness: - enabled: true - port: {{ .Values.addons.codeserver.service.ports.codeserver.port }} - path: "/" - startup: - enabled: true - port: {{ .Values.addons.codeserver.service.ports.codeserver.port }} - path: "/" -imageSelector: "codeserverImage" -imagePullPolicy: {{ .Values.codeserverImage.pullPolicy }} -resources: - excludeExtra: true -securityContext: - runAsUser: 0 - runAsGroup: 0 - runAsNonRoot: false - readOnlyRootFilesystem: false -env: -{{- range $envList := .Values.addons.codeserver.envList -}} - {{- if and $envList.name $envList.value }} - {{ $envList.name }}: {{ $envList.value | quote }} - {{- else }} - {{- fail "Please specify name/value for codeserver environment variable" -}} - {{- end -}} -{{- end -}} -{{- with .Values.addons.codeserver.env -}} -{{- range $k, $v := . }} - {{ $k }}: {{ $v | quote }} -{{- end -}} -{{- end }} -args: -{{- range .Values.addons.codeserver.args }} -- {{ . | quote }} -{{- end }} -- "--port" -- "{{ .Values.addons.codeserver.service.ports.codeserver.port }}" -- {{ .Values.addons.codeserver.workingDir | default "/" }} -{{- end -}} diff --git a/charts/library/common/templates/addons/netshoot/_container.tpl b/charts/library/common/templates/addons/netshoot/_container.tpl deleted file mode 100644 index 8084420a69e..00000000000 --- a/charts/library/common/templates/addons/netshoot/_container.tpl +++ /dev/null @@ -1,46 +0,0 @@ -{{/* -The code-server sidecar container to be inserted. -*/}} -{{- define "tc.v1.common.addon.netshoot.container" -}} -enabled: true -command: - - /bin/sh - - -c - - sleep infinity -probes: - liveness: - enabled: false - readiness: - enabled: false - startup: - enabled: false -imageSelector: "netshootImage" -resources: - excludeExtra: true -securityContext: - runAsUser: 0 - runAsGroup: 0 - runAsNonRoot: false - readOnlyRootFilesystem: false - capabilities: - add: - - NET_ADMIN - - NET_RAW -env: -{{- range $envList := $.Values.addons.netshoot.envList -}} - {{- if and $envList.name $envList.value }} - {{ $envList.name }}: {{ $envList.value | quote }} - {{- else }} - {{- fail "Please specify name/value for netshoot environment variable" -}} - {{- end -}} -{{- end -}} -{{- with $.Values.addons.netshoot.env -}} -{{- range $k, $v := . }} - {{ $k }}: {{ $v | quote }} -{{- end -}} -{{- end }} -args: -{{- range $.Values.addons.netshoot.args }} -- {{ . | quote }} -{{- end }} -{{- end -}} diff --git a/charts/library/common/templates/addons/netshoot/_netshoot.tpl b/charts/library/common/templates/addons/netshoot/_netshoot.tpl deleted file mode 100644 index fe75c805212..00000000000 --- a/charts/library/common/templates/addons/netshoot/_netshoot.tpl +++ /dev/null @@ -1,15 +0,0 @@ -{{/* -Template to render code-server addon -It will include / inject the required templates based on the given values. -*/}} -{{- define "tc.v1.common.addon.netshoot" -}} -{{- $targetSelector := "main" -}} -{{- if .Values.addons.netshoot.enabled -}} - {{/* Append the code-server container to the workloads */}} - {{- $container := include "tc.v1.common.addon.netshoot.container" . | fromYaml -}} - {{- if $container -}} - {{- $workload := get $.Values.workload $targetSelector -}} - {{- $_ := set $workload.podSpec.containers "netshoot" $container -}} - {{- end -}} -{{- end -}} -{{- end -}} diff --git a/charts/library/common/templates/addons/vpn/_configmap.tpl b/charts/library/common/templates/addons/vpn/_configmap.tpl deleted file mode 100644 index 4b417a6c6ec..00000000000 --- a/charts/library/common/templates/addons/vpn/_configmap.tpl +++ /dev/null @@ -1,16 +0,0 @@ -{{/* -The VPN config and scripts to be included. -*/}} -{{- define "tc.v1.common.addon.vpn.configmap" -}} -enabled: true -data: -{{- with .Values.addons.vpn.scripts.up }} - up.sh: |- - {{- . | nindent 4 }} -{{- end -}} - -{{- with .Values.addons.vpn.scripts.down }} - down.sh: |- - {{- . | nindent 4 }} -{{- end -}} -{{- end -}} diff --git a/charts/library/common/templates/addons/vpn/_gluetunContainer.tpl b/charts/library/common/templates/addons/vpn/_gluetunContainer.tpl deleted file mode 100644 index d1bdbee0c1a..00000000000 --- a/charts/library/common/templates/addons/vpn/_gluetunContainer.tpl +++ /dev/null @@ -1,74 +0,0 @@ -{{/* -The gluetun sidecar container to be inserted. -*/}} -{{- define "tc.v1.common.addon.vpn.gluetun.container" -}} -enabled: true -imageSelector: gluetunImage -probes: -{{- if $.Values.addons.vpn.livenessProbe }} - liveness: - {{- toYaml . | nindent 2 }} -{{- else }} - liveness: - enabled: false -{{- end }} - readiness: - enabled: false - startup: - enabled: false -resources: - excludeExtra: true -securityContext: - runAsUser: 0 - runAsNonRoot: false - readOnlyRootFilesystem: false - runAsGroup: 568 - capabilities: - add: - - NET_ADMIN - - NET_RAW - - MKNOD - -env: - DNS_KEEP_NAMESERVER: "on" - DOT: "off" -{{- if $.Values.addons.vpn.killSwitch }} -{{- $excludednetworks := (printf "%v,%v" $.Values.chartContext.podCIDR $.Values.chartContext.svcCIDR) -}} -{{- $excludednetworksv6 := "" -}} -{{- range $.Values.addons.vpn.excludedNetworks_IPv4 -}} - {{- $excludednetworks = (printf "%v,%v" $excludednetworks .) -}} -{{- end }} -{{- range $.Values.addons.vpn.excludedNetworks_IPv6 -}} - {{- $excludednetworksv6 = (printf "%v,%v" $excludednetworksv6 .) -}} -{{- end }} - FIREWALL: "on" - FIREWALL_OUTBOUND_SUBNETS: {{ $excludednetworks | quote }} -{{- $inputPorts := list -}} -{{- if and - $.Values.service $.Values.service.main $.Values.service.main.ports - $.Values.service.main.ports.main $.Values.service.main.ports.main.port -}} - {{- $inputPorts = list $.Values.service.main.ports.main.port -}} -{{- end -}} -{{- $inputPorts = concat $inputPorts $.Values.addons.vpn.inputPorts | mustUniq }} - FIREWALL_INPUT_PORTS: {{ join "," $inputPorts }} -{{- else }} - FIREWALL: "off" -{{- end }} - -{{- with $.Values.addons.vpn.env }} - {{- . | toYaml | nindent 2 }} -{{- end -}} - -{{- range $envList := $.Values.addons.vpn.envList -}} - {{- if and $envList.name $envList.value }} - {{ $envList.name }}: {{ $envList.value | quote }} - {{- else -}} - {{- fail "Please specify name/value for VPN environment variable" -}} - {{- end -}} -{{- end -}} - -{{- with $.Values.addons.vpn.args }} -args: - {{- . | toYaml | nindent 2 }} -{{- end }} -{{- end -}} diff --git a/charts/library/common/templates/addons/vpn/_openvpnContainer.tpl b/charts/library/common/templates/addons/vpn/_openvpnContainer.tpl deleted file mode 100644 index 5975320358b..00000000000 --- a/charts/library/common/templates/addons/vpn/_openvpnContainer.tpl +++ /dev/null @@ -1,75 +0,0 @@ -{{/* -The gluetun sidecar container to be inserted. -*/}} -{{- define "tc.v1.common.addon.vpn.openvpn.container" -}} -enabled: true -imageSelector: openvpnImage -probes: -{{- if $.Values.addons.vpn.livenessProbe }} - liveness: - {{- toYaml . | nindent 2 }} -{{- else }} - liveness: - enabled: false -{{- end }} - readiness: - enabled: false - startup: - enabled: false -resources: - excludeExtra: true -securityContext: - runAsUser: 0 - runAsGroup: 0 - capabilities: - add: - - NET_ADMIN - - NET_RAW - - MKNOD - - SYS_MODULE - -env: -{{- with $.Values.addons.vpn.env }} - {{- . | toYaml | nindent 2 }} -{{- end }} - {{- if and $.Values.addons.vpn.openvpn.username $.Values.addons.vpn.openvpn.password }} - VPN_AUTH: {{ (printf "%v;%v" $.Values.addons.vpn.openvpn.username $.Values.addons.vpn.openvpn.password) }} - {{- end -}} -{{- if $.Values.addons.vpn.killSwitch }} -{{- $ipv4list := $.Values.addons.vpn.excludedNetworks_IPv4 }} - -{{- if $.Values.chartContext.podCIDR }} -{{- $ipv4list = append $ipv4list $.Values.chartContext.podCIDR }} -{{- end }} -{{- if $.Values.chartContext.svcCIDR }} -{{- $ipv4list = append $ipv4list $.Values.chartContext.svcCIDR }} -{{- end }} - - FIREWALL: "ON" - {{- range $index, $value := $ipv4list }} - ROUTE_{{ add $index 1 }}: {{ $value | quote }} - {{- end }} -{{- if $.Values.addons.vpn.excludedNetworks_IPv6 }} - {{- $excludednetworksv6 := "" -}} - {{- range $.Values.addons.vpn.excludedNetworks_IPv4 -}} - {{- $excludednetworksv6 = ( printf "%v;%v" $excludednetworksv6 . ) -}} - {{- end }} - {{- range $index, $value := $.Values.addons.vpn.excludedNetworks_IPv6 }} - ROUTE6_{{ add $index 1 }}: {{ $value | quote }} - {{- end }} -{{- end }} -{{- end -}} - -{{- range $envList := $.Values.addons.vpn.envList -}} - {{- if and $envList.name $envList.value }} - {{ $envList.name }}: {{ $envList.value | quote }} - {{- else -}} - {{- fail "Please specify name/value for VPN environment variable" -}} - {{- end -}} -{{- end -}} - -{{- with $.Values.addons.vpn.args }} -args: - {{- . | toYaml | nindent 2 }} -{{- end -}} -{{- end -}} diff --git a/charts/library/common/templates/addons/vpn/_secret.tpl b/charts/library/common/templates/addons/vpn/_secret.tpl deleted file mode 100644 index b46a5d3e967..00000000000 --- a/charts/library/common/templates/addons/vpn/_secret.tpl +++ /dev/null @@ -1,9 +0,0 @@ -{{/* -The OpenVPN config secret to be included. -*/}} -{{- define "tc.v1.common.addon.vpn.secret" -}} -enabled: true -data: - vpn.conf: |- - {{- .Values.addons.vpn.config | nindent 4 }} -{{- end -}} diff --git a/charts/library/common/templates/addons/vpn/_tailscaleContainer.tpl b/charts/library/common/templates/addons/vpn/_tailscaleContainer.tpl deleted file mode 100644 index a66564a5b3b..00000000000 --- a/charts/library/common/templates/addons/vpn/_tailscaleContainer.tpl +++ /dev/null @@ -1,89 +0,0 @@ -{{/* -The Tailscale sidecar container to be inserted. -*/}} -{{- define "tc.v1.common.addon.vpn.tailscale.container" -}} -enabled: true -imageSelector: "tailscaleImage" -probes: -{{- if $.Values.addons.vpn.livenessProbe }} - liveness: - {{- toYaml . | nindent 2 }} -{{- else }} - liveness: - enabled: false -{{- end }} - readiness: - enabled: false - startup: - enabled: false -command: - - /usr/local/bin/containerboot -resources: - excludeExtra: true -securityContext: - {{- if $.Values.addons.vpn.tailscale.userspace }} - runAsUser: 1000 - runAsGroup: 1000 - runAsNonRoot: false - readOnlyRootFilesystem: true - {{- else }} - runAsUser: 0 - runAsGroup: 0 - runAsNonRoot: true - readOnlyRootFilesystem: false - {{- end }} - capabilities: - add: - - NET_ADMIN - - NET_RAW - -{{/* -Set KUBE_SECRET to empty string to force tailscale -to use the filesystem for state tracking. -With secret for state tracking you can't always -know if the app that uses this sidecard will -use a custom ServiceAccount and will lead to falure. -*/}} -env: - TS_KUBE_SECRET: "" - TS_SOCKET: /var/run/tailscale/tailscaled.sock - TS_STATE_DIR: /var/lib/tailscale/state - TS_AUTH_ONCE: {{ $.Values.addons.vpn.tailscale.auth_once | quote }} - TS_USERSPACE: {{ $.Values.addons.vpn.tailscale.userspace | quote }} - TS_ACCEPT_DNS: {{ $.Values.addons.vpn.tailscale.accept_dns | quote }} - {{- with $.Values.addons.vpn.tailscale.outbound_http_proxy_listen }} - TS_OUTBOUND_HTTP_PROXY_LISTEN: {{ . }} - {{- end -}} - {{- with $.Values.addons.vpn.tailscale.routes }} - TS_ROUTES: {{ . }} - {{- end -}} - {{- with $.Values.addons.vpn.tailscale.dest_ip }} - TS_DEST_IP: {{ . }} - {{- end -}} - {{- with $.Values.addons.vpn.tailscale.sock5_server }} - TS_SOCKS5_SERVER: {{ . }} - {{- end -}} - {{- with $.Values.addons.vpn.tailscale.extra_args }} - TS_EXTRA_ARGS: {{ . | quote }} - {{- end -}} - {{- with $.Values.addons.vpn.tailscale.daemon_extra_args }} - TS_TAILSCALED_EXTRA_ARGS: {{ . | quote }} - {{- end -}} - {{- with $.Values.addons.vpn.tailscale.authkey }} - TS_AUTH_KEY: {{ . }} - {{- end }} - -{{- range $envList := $.Values.addons.vpn.envList -}} - {{- if and $envList.name $envList.value }} - {{ $envList.name }}: {{ $envList.value | quote }} - {{- else -}} - {{- fail "Please specify name/value for VPN environment variable" -}} - {{- end -}} -{{- end -}} - -{{- with $.Values.addons.vpn.env -}} - {{- range $k, $v := . }} - {{ $k }}: {{ $v | quote }} - {{- end -}} -{{- end }} -{{- end -}} diff --git a/charts/library/common/templates/addons/vpn/_volume.tpl b/charts/library/common/templates/addons/vpn/_volume.tpl deleted file mode 100644 index b6a8f1ac31c..00000000000 --- a/charts/library/common/templates/addons/vpn/_volume.tpl +++ /dev/null @@ -1,112 +0,0 @@ -{{/* -The volume (referencing VPN scripts) to be inserted into persistence. -*/}} -{{- define "tc.v1.common.addon.vpn.volume.scripts" -}} -{{- $basePath := (include "tc.v1.common.addon.vpn.volume.basePath" .) }} -enabled: true -type: configmap -objectName: vpnscripts -expandObjectName: false -defaultMode: "0777" -items: -{{- if .Values.addons.vpn.scripts.up }} -- key: up.sh - path: up.sh -{{- end -}} -{{- if .Values.addons.vpn.scripts.down }} -- key: down.sh - path: down.sh -{{- end }} -targetSelector: - {{- range .Values.addons.vpn.targetSelector }} - {{ . }}: - vpn: - mountPath: {{ $basePath }} - {{- end -}} -{{- end -}} - -{{/* -The volume (referencing VPN config) to be inserted into persistence. -*/}} -{{- define "tc.v1.common.addon.vpn.volume.config" -}} -{{- $basePath := (include "tc.v1.common.addon.vpn.volume.basePath" .) }} -{{- $mountPath := $basePath }} - -enabled: true -{{- if or .Values.addons.vpn.config .Values.addons.vpn.existingSecret }} -type: secret -defaultMode: "0777" -items: - - key: vpn.conf - path: vpn.conf -{{- if .Values.addons.vpn.existingSecret }} -objectName: {{ .Values.addons.vpn.existingSecret }} -expandObjectName: false -{{- else }} -objectName: vpnconfig -expandObjectName: true -{{- end -}} -{{- else }} -{{- $mountPath = (printf "%s/vpn.conf" $basePath) }} -type: hostPath -hostPath: {{ .Values.addons.vpn.configFile | default "/vpn" }} -hostPathType: "File" -autoPermissions: - enabled: true - chown: true - user: 568 - group: 568 -{{- end }} -targetSelector: - {{- range .Values.addons.vpn.targetSelector }} - {{ . }}: - vpn: - mountPath: {{ $mountPath }} - {{- end -}} -{{- end -}} - -{{/* -The volume (referencing VPN config folder) to be inserted into persistence. -*/}} -{{- define "tc.v1.common.addon.vpn.volume.folder" -}} -{{- $basePath := (include "tc.v1.common.addon.vpn.volume.basePath" .) }} -enabled: true -type: hostPath -hostPath: {{ .Values.addons.vpn.configFolder | quote }} -autoPermissions: - enabled: true - chown: true - user: 568 - group: 568 -targetSelector: - {{- range .Values.addons.vpn.targetSelector }} - {{ . }}: - vpn: - mountPath: {{ $basePath }} - {{- end -}} -{{- end -}} - - -{{/* -The empty tailscale folder -*/}} -{{- define "tc.v1.common.addon.vpn.volume.tailscale" -}} -enabled: true -type: emptyDir -targetSelector: - {{- range .Values.addons.vpn.targetSelector }} - {{ . }}: - tailscale: - mountPath: /var/lib/tailscale - {{- end -}} -{{- end -}} - -{{- define "tc.v1.common.addon.vpn.volume.basePath" -}} - {{- $basePath := "/vpn" -}} {{/* Base Path for OVPN */}} - {{- if eq .Values.addons.vpn.type "wireguard" -}} - {{- $basePath = "/etc/wireguard" -}} {{/* Base Path for Wireguard */}} - {{- else if eq .Values.addons.vpn.type "gluetun" -}} - {{- $basePath = "/gluetun" -}} {{/* Base Path for Gluetun */}} - {{- end -}} - {{- $basePath -}} -{{- end -}} diff --git a/charts/library/common/templates/addons/vpn/_vpn.tpl b/charts/library/common/templates/addons/vpn/_vpn.tpl deleted file mode 100644 index 62aad34b85e..00000000000 --- a/charts/library/common/templates/addons/vpn/_vpn.tpl +++ /dev/null @@ -1,94 +0,0 @@ -{{/* -Template to render VPN addon -It will include / inject the required templates based on the given values. -*/}} -{{- define "tc.v1.common.addon.vpn" -}} -{{- if ne "disabled" .Values.addons.vpn.type -}} - - {{- if .Values.addons.vpn.config -}} - {{/* Append the vpn config secret to the secrets */}} - {{- $secret := include "tc.v1.common.addon.vpn.secret" . | fromYaml -}} - {{- if $secret -}} - {{- $_ := set .Values.secret "vpnconfig" $secret -}} - {{- end -}} - {{- end }} - - {{- if or .Values.addons.vpn.scripts.up .Values.addons.vpn.scripts.down -}} - {{/* Append the vpn up/down scripts to the configmaps */}} - {{- $configmap := include "tc.v1.common.addon.vpn.configmap" . | fromYaml -}} - {{- if $configmap -}} - {{- $_ := set .Values.configmap "vpnscripts" $configmap -}} - {{- end -}} - {{- end }} - - {{- if or .Values.addons.vpn.configFile .Values.addons.vpn.config .Values.addons.vpn.existingSecret -}} - {{/* Append the vpn config to the persistence */}} - {{- $configper := include "tc.v1.common.addon.vpn.volume.config" . | fromYaml -}} - {{- if $configper -}} - {{- $_ := set .Values.persistence "vpnconfig" $configper -}} - {{- end -}} - {{- end -}} - - {{- if or .Values.addons.vpn.scripts.up .Values.addons.vpn.scripts.down -}} - {{/* Append the vpn scripts to the persistence */}} - {{- $scriptsper := include "tc.v1.common.addon.vpn.volume.scripts" . | fromYaml -}} - {{- if $scriptsper -}} - {{- $_ := set .Values.persistence "vpnscripts" $scriptsper -}} - {{- end -}} - {{- end -}} - - {{- if .Values.addons.vpn.configFolder -}} - {{/* Append the vpn folder to the persistence */}} - {{- $folderper := include "tc.v1.common.addon.vpn.volume.folder" . | fromYaml -}} - {{- if $folderper -}} - {{- $_ := set .Values.persistence "vpnfolder" $folderper -}} - {{- end -}} - {{- end -}} - - {{/* Ensure target Selector defaults to main pod even if unset */}} - {{- $targetSelector := list "main" -}} - {{- if $.Values.addons.codeserver.targetSelector -}} - {{- $targetSelector = $.Values.addons.codeserver.targetSelector -}} - {{- end -}} - - {{/* Append the vpn container to the containers */}} - {{- range $targetSelector -}} - {{- if eq "gluetun" $.Values.addons.vpn.type -}} - {{- $container := include "tc.v1.common.addon.vpn.gluetun.container" $ | fromYaml -}} - {{- if $container -}} - {{- $workload := get $.Values.workload . -}} - {{- $_ := set $workload.podSpec.containers "vpn" $container -}} - {{- end -}} - {{- else if eq "tailscale" $.Values.addons.vpn.type -}} - {{/* FIXME: https://github.com/tailscale/tailscale/issues/8188 */}} - {{- $_ := set $.Values.podOptions "automountServiceAccountToken" true -}} - {{- $container := include "tc.v1.common.addon.vpn.tailscale.container" $ | fromYaml -}} - {{- if $container -}} - {{- $workload := get $.Values.workload . -}} - {{- $_ := set $workload.podSpec.containers "tailscale" $container -}} - {{- end -}} - {{- else if eq "openvpn" $.Values.addons.vpn.type -}} - {{- $container := include "tc.v1.common.addon.vpn.openvpn.container" $ | fromYaml -}} - {{- if $container -}} - {{- $workload := get $.Values.workload . -}} - {{- $_ := set $workload.podSpec.containers "vpn" $container -}} - {{- end -}} - {{- else if eq "wireguard" $.Values.addons.vpn.type -}} - {{- $container := include "tc.v1.common.addon.vpn.wireguard.container" $ | fromYaml -}} - {{- if $container -}} - {{- $workload := get $.Values.workload . -}} - {{- $_ := set $workload.podSpec.containers "vpn" $container -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if eq "tailscale" $.Values.addons.vpn.type -}} - {{/* Append the empty tailscale folder to the persistence */}} - {{- $tailscaledir := include "tc.v1.common.addon.vpn.volume.tailscale" . | fromYaml -}} - {{- if $tailscaledir -}} - {{- $_ := set .Values.persistence "tailscalestate" $tailscaledir -}} - {{- end -}} - {{- end -}} - -{{- end -}} -{{- end -}} diff --git a/charts/library/common/templates/addons/vpn/_wireguardContainer.tpl b/charts/library/common/templates/addons/vpn/_wireguardContainer.tpl deleted file mode 100644 index 81b34647af1..00000000000 --- a/charts/library/common/templates/addons/vpn/_wireguardContainer.tpl +++ /dev/null @@ -1,68 +0,0 @@ -{{/* -The gluetun sidecar container to be inserted. -*/}} -{{- define "tc.v1.common.addon.vpn.wireguard.container" -}} -enabled: true -imageSelector: wireguardImage -probes: -{{- if $.Values.addons.vpn.livenessProbe }} - liveness: - {{- toYaml . | nindent 2 }} -{{- else }} - liveness: - enabled: false -{{- end }} - readiness: - enabled: false - startup: - enabled: false -resources: - excludeExtra: true -securityContext: - runAsUser: 568 - runAsGroup: 568 - readOnlyRootFilesystem: false - allowPrivilegeEscalation: true - capabilities: - add: - - AUDIT_WRITE - - NET_ADMIN - - SETUID - - SETGID - - SYS_MODULE - -env: -{{- with $.Values.addons.vpn.env }} - {{- . | toYaml | nindent 2 }} -{{- end }} - SEPARATOR: ";" - IPTABLES_BACKEND: "nft" -{{- if $.Values.addons.vpn.killSwitch }} - KILLSWITCH: "true" - {{- $excludednetworksv4 := ( printf "%v;%v" $.Values.chartContext.podCIDR $.Values.chartContext.svcCIDR ) -}} - {{- range $.Values.addons.vpn.excludedNetworks_IPv4 -}} - {{- $excludednetworksv4 = ( printf "%v;%v" $excludednetworksv4 . ) -}} - {{- end }} - KILLSWITCH_EXCLUDEDNETWORKS_IPV4: {{ $excludednetworksv4 | quote }} -{{- if $.Values.addons.vpn.excludedNetworks_IPv6 -}} - {{- $excludednetworksv6 := "" -}} - {{- range $.Values.addons.vpn.excludedNetworks_IPv4 -}} - {{- $excludednetworksv6 = ( printf "%v;%v" $excludednetworksv6 . ) -}} - {{- end }} - KILLSWITCH_EXCLUDEDNETWORKS_IPV6: {{ $.Values.addons.vpn.excludedNetworks_IPv6 | quote }} -{{- end -}} -{{- end -}} - -{{- range $envList := $.Values.addons.vpn.envList -}} - {{- if and $envList.name $envList.value }} - {{ $envList.name }}: {{ $envList.value | quote }} - {{- else -}} - {{- fail "Please specify name/value for VPN environment variable" -}} - {{- end -}} -{{- end -}} - -{{- with $.Values.addons.vpn.args }} -args: - {{- . | toYaml | nindent 2 }} -{{- end -}} -{{- end -}} diff --git a/charts/library/common/templates/lib/ingress/_validation.tpl b/charts/library/common/templates/lib/ingress/_validation.tpl index 1f9f76ea689..1b0383662a3 100644 --- a/charts/library/common/templates/lib/ingress/_validation.tpl +++ b/charts/library/common/templates/lib/ingress/_validation.tpl @@ -144,8 +144,17 @@ objectData: {{/* Call this template: {{ include "tc.v1.common.lib.ingress.primaryValidation" $ -}} */}} - {{- define "tc.v1.common.lib.ingress.primaryValidation" -}} + {{- $result := (include "tc.v1.common.lib.ingress.hasPrimary" $) | fromJson -}} + + {{/* Require at least one primary ingress, if any enabled */}} + {{- if and $result.hasEnabled (not $result.hasPrimary) -}} + {{- fail "Ingress - At least one enabled ingress must be primary" -}} + {{- end -}} + +{{- end -}} + +{{- define "tc.v1.common.lib.ingress.hasPrimary" -}} {{/* Initialize values */}} {{- $hasPrimary := false -}} @@ -176,9 +185,5 @@ objectData: {{- end -}} {{- end -}} - {{/* Require at least one primary ingress, if any enabled */}} - {{- if and $hasEnabled (not $hasPrimary) -}} - {{- fail "Ingress - At least one enabled ingress must be primary" -}} - {{- end -}} - + {{- (dict "hasPrimary" $hasPrimary "hasEnabled" $hasEnabled) | toJson -}} {{- end -}} diff --git a/charts/library/common/templates/lib/pod/_podSecurityContext.tpl b/charts/library/common/templates/lib/pod/_podSecurityContext.tpl index 87db62d58b4..878c2f425ee 100644 --- a/charts/library/common/templates/lib/pod/_podSecurityContext.tpl +++ b/charts/library/common/templates/lib/pod/_podSecurityContext.tpl @@ -26,9 +26,9 @@ objectData: The object data to be used to render the Pod. {{- $deviceAdded := false -}} {{- $hostUsers := false -}} {{- $hostUserPersistence := (list "configmap" "secret" "emptyDir" "downwardAPI" "projected") -}} - {{- $podSelected := false -}} {{- range $persistenceName, $persistenceValues := $rootCtx.Values.persistence -}} + {{- $podSelected := false -}} {{- $enabled := (include "tc.v1.common.lib.util.enabled" (dict "rootCtx" $rootCtx "objectData" $persistenceValues "name" $persistenceName "caller" "Pod Security Context" @@ -40,7 +40,7 @@ objectData: The object data to be used to render the Pod. {{- if mustHas $objectData.shortName ($persistenceValues.targetSelector | keys) -}} {{- $podSelected = true -}} {{- end -}} - {{- else if $objectData.podPrimary -}} + {{- else if $objectData.primary -}} {{- $podSelected = true -}} {{- end -}} {{- end -}} diff --git a/charts/library/common/templates/lib/service/_validation.tpl b/charts/library/common/templates/lib/service/_validation.tpl index 66e9c736cc4..10fcf36191c 100644 --- a/charts/library/common/templates/lib/service/_validation.tpl +++ b/charts/library/common/templates/lib/service/_validation.tpl @@ -65,12 +65,22 @@ objectData: */}} {{- define "tc.v1.common.lib.service.primaryValidation" -}} + {{- $result := (include "tc.v1.common.lib.service.hasPrimary" $) | fromJson -}} + + {{/* Require at least one primary service, if any enabled */}} + {{- if and $result.hasEnabled (not $result.hasPrimary) -}} + {{- fail "Service - At least one enabled service must be primary" -}} + {{- end -}} + +{{- end -}} + +{{- define "tc.v1.common.lib.service.hasPrimary" -}} + {{- $objectData := .objectData -}} - {{/* Initialize values */}} {{- $hasPrimary := false -}} {{- $hasEnabled := false -}} - {{- range $name, $service := .Values.service -}} + {{- range $name, $service := $.Values.service -}} {{- $enabled := "false" -}} {{- if not (kindIs "invalid" $service.enabled) -}} @@ -99,24 +109,30 @@ objectData: {{- end -}} {{- end -}} - {{/* Require at least one primary service, if any enabled */}} - {{- if and $hasEnabled (not $hasPrimary) -}} - {{- fail "Service - At least one enabled service must be primary" -}} - {{- end -}} - + {{- (dict "hasPrimary" $hasPrimary "hasEnabled" $hasEnabled) | toJson -}} {{- end -}} + {{/* Service Port Primary Validation */}} {{/* Call this template: {{ include "tc.v1.common.lib.service.primaryValidation" (dict "objectData" $objectData -}} objectData: The ports of the service. */}} - {{- define "tc.v1.common.lib.servicePort.primaryValidation" -}} {{- $objectData := .objectData -}} + {{- $result := (include "tc.v1.common.lib.servicePort.hasPrimary" (dict "objectData" $objectData)) | fromJson -}} + + {{/* Require at least one primary service, if any enabled */}} + {{- if and $result.hasEnabled (not $result.hasPrimary) -}} + {{- fail "Service - At least one enabled port in service must be primary" -}} + {{- end -}} + +{{- end -}} + +{{- define "tc.v1.common.lib.servicePort.hasPrimary" -}} + {{- $objectData := .objectData -}} - {{/* Initialize values */}} {{- $hasPrimary := false -}} {{- $hasEnabled := false -}} @@ -141,9 +157,5 @@ objectData: {{- end -}} {{- end -}} - {{/* Require at least one primary service, if any enabled */}} - {{- if and $hasEnabled (not $hasPrimary) -}} - {{- fail "Service - At least one enabled port in service must be primary" -}} - {{- end -}} - + {{- (dict "hasPrimary" $hasPrimary "hasEnabled" $hasEnabled) | toJson -}} {{- end -}} diff --git a/charts/library/common/templates/loader/_init.tpl b/charts/library/common/templates/loader/_init.tpl index 9ac6e491e00..6a2f78eaac1 100644 --- a/charts/library/common/templates/loader/_init.tpl +++ b/charts/library/common/templates/loader/_init.tpl @@ -32,13 +32,18 @@ {{- include "tc.v1.common.addon.codeserver" . }} {{- end -}} - {{/* Enable VPN add-on if required */}} - {{- if ne "disabled" .Values.addons.vpn.type -}} - {{- include "tc.v1.common.addon.vpn" . }} + {{/* Enable gluetun add-on if required */}} + {{- if and .Values.addons.gluetun .Values.addons.gluetun.enabled -}} + {{- include "tc.v1.common.addon.gluetun" . }} + {{- end -}} + + {{/* Enable tailscale add-on if required */}} + {{- if and .Values.addons.tailscale .Values.addons.tailscale.enabled -}} + {{- include "tc.v1.common.addon.tailscale" . }} {{- end -}} {{/* Enable netshoot add-on if required */}} - {{- if .Values.addons.netshoot.enabled }} + {{- if and .Values.addons.netshoot .Values.addons.netshoot.enabled }} {{- include "tc.v1.common.addon.netshoot" . }} {{- end -}} diff --git a/charts/library/common/templates/values/_init.tpl b/charts/library/common/templates/values/_init.tpl index 0ae6a642574..f36747dc37b 100644 --- a/charts/library/common/templates/values/_init.tpl +++ b/charts/library/common/templates/values/_init.tpl @@ -20,6 +20,11 @@ {{- $dependencyValues := omit $dependencyValues "podOptions " -}} {{- $mergedValues = mustMergeOverwrite $mergedValues $dependencyValues -}} {{- end -}} + {{- range $mergedValues.addons -}} + {{- if .enabled -}} + {{- $mergedValues = mustMergeOverwrite $mergedValues . -}} + {{- end -}} + {{- end -}} {{- end -}} {{- $_ := set . "Values" (mustDeepCopy $mergedValues) -}} {{- end -}} diff --git a/charts/library/common/values.yaml b/charts/library/common/values.yaml index 3293462981a..fa9c6b52070 100644 --- a/charts/library/common/values.yaml +++ b/charts/library/common/values.yaml @@ -804,114 +804,158 @@ metrics: # -- The common chart supports several add-ons. These can be configured under this key. # @default -- See below addons: - # -- The common chart supports adding a VPN add-on. It can be configured under this key. - # @default -- See values.yaml - vpn: - # -- Specify the VPN type. Valid options are disabled, gluetun, openvpn, wireguard or tailscale - # OpenVPN and Wireguard are considered deprecated - type: disabled - - # -- Tailscale specific configuration - # @default -- See below - # See more info for the configuration - # https://github.com/tailscale/tailscale/blob/main/docs/k8s/run.sh - tailscale: - # -- Auth key to connect to the VPN Service - authkey: "" - # As a sidecar, it should only need to run in userspace - userspace: true - auth_once: true - accept_dns: false - routes: "" - dest_ip: "" - sock5_server: "" - extra_args: "" - daemon_extra_args: "" - outbound_http_proxy_listen: "" - # -- Annotations for tailscale sidecar - annotations: {} - - # -- OpenVPN specific configuration - # @default -- See below - openvpn: - # -- Credentials to connect to the VPN Service (used with -a) - # Only using password is enough - username: "" - password: "" - - # -- All variables specified here will be added to the vpn sidecar container - # See the documentation of the VPN image for all config values - env: {} - # TZ: UTC - - # -- All variables specified here will be added to the vpn sidecar container - # See the documentation of the VPN image for all config values - envList: [] - # - name: someenv - # value: somevalue - - # -- you can directly specify the config file here - config: "" - - scripts: - # -- you can directly specify the upscript here - up: "" - # some script - - # -- you can directly specify the downscript here - down: "" - # some script - - # -- Provide a customized vpn configuration file location to be used by the VPN. - configFile: "" - - # -- Provide a customized vpn configuration folder location to be added to the VPN container - # The config file needs to be mounted seperately - # the upscript and downscript need to be named: upscript.sh and downscript.sh respectively - configFolder: "" - - # -- Provide an existing secret for vpn config storage - existingSecret: "" - - # -- select pods to bind vpn addon to - # Add "codeserver" to also add the codeserver pod to VPN + gluetun: + enabled: false targetSelector: - main + secret: + # vpn-conf: + # basePath: /gluetun/wireguard + # data: + # # Effective path /gluetun/wireguard/wg0.conf + # wg0.conf: | + # some conf + # wg1.conf: | + # some conf + # scripts: + # basePath: /gluetun/scripts + # defaultMode: "0777" + # data: + # # Effective path /gluetun/scripts/up.sh + # up.sh: | + # some conf + container: + enabled: true + imageSelector: gluetunImage + probes: + liveness: + enabled: false + readiness: + enabled: false + startup: + enabled: false + resources: + excludeExtra: true + securityContext: + runAsUser: 0 + runAsNonRoot: false + readOnlyRootFilesystem: false + runAsGroup: 568 + capabilities: + add: + - NET_ADMIN + - NET_RAW + - MKNOD + env: + DOT: "off" + DNS_KEEP_NAMESERVER: "on" + FIREWALL: "off" + FIREWALL_OUTBOUND_SUBNETS: "" + FIREWALL_INPUT_PORTS: "" - ## Only for Wireguard and OpenVPN - killSwitch: true - excludedNetworks_IPv4: [] - excludedNetworks_IPv6: [] + # -- Tailscale specific configuration + # @default -- See below + # See more info for the configuration + # https://github.com/tailscale/tailscale/blob/main/docs/k8s/run.sh + tailscale: + enabled: false + targetSelector: + - main + # -- you can directly specify the config file here + config: "" + container: + enabled: true + imageSelector: "tailscaleImage" + probes: + liveness: + enabled: false + readiness: + enabled: false + startup: + enabled: false + command: + - /usr/local/bin/containerboot + resources: + excludeExtra: true + env: + # Set KUBE_SECRET to empty string to force tailscale + # to use the filesystem for state tracking. + # With secret for state tracking you can't always + # know if the app that uses this sidecard will + # use a custom ServiceAccount and will lead to falure. + TS_KUBE_SECRET: "" + TS_SOCKET: /var/run/tailscale/tailscaled.sock + TS_STATE_DIR: /var/lib/tailscale/state + TS_USERSPACE: true + TS_AUTH_ONCE: true + TS_ACCEPT_DNS: false + TS_AUTH_KEY: "" + TS_TAILSCALED_EXTRA_ARGS: "" + TS_EXTRA_ARGS: "" + TS_SOCKS5_SERVER: "" + TS_DEST_IP: "" + TS_ROUTES: "" + TS_OUTBOUND_HTTP_PROXY_LISTEN: "" + securityContext: + capabilities: + add: + - NET_ADMIN + - NET_RAW - ## For Gluetun to enable kubernetes network communication - inputPorts: [] + # -- Auth key to connect to the VPN Service + authkey: "" + # As a sidecar, it should only need to run in userspace + userspace: true + auth_once: true + accept_dns: false + routes: "" + dest_ip: "" + sock5_server: "" + extra_args: "" + daemon_extra_args: "" + outbound_http_proxy_listen: "" + # -- Annotations for tailscale sidecar + annotations: {} # -- The common library supports adding a code-server add-on to access files. It can be configured under this key. # @default -- See values.yaml codeserver: - # -- Enable running a code-server container in the pod enabled: false - - # -- Set any environment variables for code-server here - env: {} - - # -- All variables specified here will be added to the codeserver sidecar container - # See the documentation of the codeserver image for all config values - envList: [] - # - name: someenv - # value: somevalue - # -- Set codeserver command line arguments. - # Consider setting --user-data-dir to a persistent location to preserve code-server setting changes - args: - - --auth - - none + # -- Enable running a code-server container in the pod + container: + enabled: true + probes: + liveness: + enabled: true + port: 12321 + path: "/" + readiness: + enabled: true + port: 12321 + path: "/" + startup: + enabled: true + port: 12321 + path: "/" + imageSelector: "codeserverImage" + resources: + excludeExtra: true + securityContext: + runAsUser: 0 + runAsGroup: 0 + runAsNonRoot: false + readOnlyRootFilesystem: false + args: + - "--port" + - "12321" + - "/" + - --auth + - none # - --user-data-dir # - "/config/.vscode" - # -- Select a container to add the addon to - targetSelector: - # -- Specify the working dir that will be opened when code-server starts - # If not given, the app will default to the mountpah of the first specified volumeMount - workingDir: "/" + # -- Select a workload to add the addon to + targetSelector: + - "main" service: # -- Enable a service for the code-server add-on. @@ -924,6 +968,7 @@ addons: primary: true protocol: http port: 12321 + targetPort: 12321 ingress: # -- Enable an ingress for the code-server add-on. @@ -942,9 +987,33 @@ addons: netshoot: # -- Enable running a netshoot container in the pod enabled: false + container: + enabled: true + command: + - /bin/sh + - -c + - sleep infinity + probes: + liveness: + enabled: false + readiness: + enabled: false + startup: + enabled: false + imageSelector: "netshootImage" + resources: + excludeExtra: true + securityContext: + runAsUser: 0 + runAsGroup: 0 + runAsNonRoot: false + readOnlyRootFilesystem: false + capabilities: + add: + - NET_ADMIN + - NET_RAW - # -- Set any environment variables for netshoot here - env: {} +dependencies: ########################################################################## # This section contains some pre-config for frequently used dependencies # diff --git a/containers/apps/openvpn-client/Dockerfile b/containers/apps/openvpn-client/Dockerfile deleted file mode 100644 index c852e30a8c5..00000000000 --- a/containers/apps/openvpn-client/Dockerfile +++ /dev/null @@ -1,12 +0,0 @@ -FROM docker.io/dperson/openvpn-client:latest@sha256:d174047b57d51734143325ad7395210643025e6516ba60a937e9319dbb462293 - -LABEL "org.opencontainers.image.source"="https://github.com/truecharts/containers" - -ARG CONTAINER_NAME -ARG CONTAINER_VER -LABEL org.opencontainers.image.title="${CONTAINER_NAME}" -LABEL org.opencontainers.image.url="https://truecharts.org/docs/charts/${CONTAINER_NAME}" -LABEL org.opencontainers.image.version="${CONTAINER_VER}" -LABEL org.opencontainers.image.description="Container for ${CONTAINER_NAME} by TrueCharts" -LABEL org.opencontainers.image.authors="TrueCharts" -LABEL org.opencontainers.image.documentation="https://truecharts.org/docs/charts/${CONTAINER_NAME}" diff --git a/containers/apps/openvpn-client/PLATFORM b/containers/apps/openvpn-client/PLATFORM deleted file mode 100644 index 303dc7a5a77..00000000000 --- a/containers/apps/openvpn-client/PLATFORM +++ /dev/null @@ -1 +0,0 @@ -linux/amd64 diff --git a/containers/apps/wireguard/Dockerfile b/containers/apps/wireguard/Dockerfile deleted file mode 100644 index 6905b58657a..00000000000 --- a/containers/apps/wireguard/Dockerfile +++ /dev/null @@ -1,11 +0,0 @@ -FROM ghcr.io/k8s-at-home/wireguard:v1.0.20210914@sha256:4dd54954cbd06d92d8c8fc6b10871eb07a0c1869edfe7a15029f1a7d3178d432 -LABEL "org.opencontainers.image.source"="https://github.com/truecharts/containers" - -ARG CONTAINER_NAME -ARG CONTAINER_VER -LABEL org.opencontainers.image.title="${CONTAINER_NAME}" -LABEL org.opencontainers.image.url="https://truecharts.org/docs/charts/${CONTAINER_NAME}" -LABEL org.opencontainers.image.version="${CONTAINER_VER}" -LABEL org.opencontainers.image.description="Container for ${CONTAINER_NAME} by TrueCharts" -LABEL org.opencontainers.image.authors="TrueCharts" -LABEL org.opencontainers.image.documentation="https://truecharts.org/docs/charts/${CONTAINER_NAME}" diff --git a/containers/apps/wireguard/PLATFORM b/containers/apps/wireguard/PLATFORM deleted file mode 100644 index 303dc7a5a77..00000000000 --- a/containers/apps/wireguard/PLATFORM +++ /dev/null @@ -1 +0,0 @@ -linux/amd64 diff --git a/cspell.config.yaml b/cspell.config.yaml index 16460cecbbb..176cfac3d58 100644 --- a/cspell.config.yaml +++ b/cspell.config.yaml @@ -215,6 +215,7 @@ words: - neko - netbox - netdata + - Netshoot - networkv - nextcloud - nindent diff --git a/website/src/content/docs/common/addons.md b/website/src/content/docs/common/addons.md new file mode 100644 index 00000000000..ff7b433331e --- /dev/null +++ b/website/src/content/docs/common/addons.md @@ -0,0 +1,250 @@ +--- +title: Addons +--- + +:::note + +- Examples under each key are only to be used as a placement guide +- See the [Full Examples](/common/addons#full-examples) section for complete examples. + +::: + +## Appears in + +- `.Values.addons` + +:::tip + +- Replace references to `$name` with the actual name you want to use. + +::: + +--- + +## `addons` + +Addons to the workloads + +| | | +| ---------- | -------- | +| Key | `addons` | +| Type | `map` | +| Required | โŒ | +| Helm `tpl` | โŒ | +| Default | `{}` | + +Example + +```yaml +addons: {} +``` + +--- + +### `addons.$addon` + +COnfigure the addon + +:::note + +Available addons: + +- CodeServer +- Netshoot +- GlueTun +- Tailscale + +::: + +| | | +| ---------- | --------------- | +| Key | `addons.$addon` | +| Type | `map` | +| Required | โœ… | +| Helm `tpl` | โŒ | +| Default | `{}` | + +Example + +```yaml +addons: + codeserver: {} + netshoot: {} + gluetun: {} + tailscale: {} +``` + +--- + +#### `addons.$addon.enabled` + +Enables or Disables the Addon + +| | | +| ---------- | ----------------------- | +| Key | `addons.$addon.enabled` | +| Type | `bool` | +| Required | โœ… | +| Helm `tpl` | โŒ | +| Default | `false` | + +Example + +```yaml +addons: + codeserver: + enabled: true +``` + +--- + +#### `addons.$addon.targetSelector` + +Define the workloads to add the addon to + +| | | +| ---------- | ------------------------------ | +| Key | `addons.$addon.targetSelector` | +| Type | `list` of `string` | +| Required | โŒ | +| Helm `tpl` | โŒ | +| Default | `["main"]` | + +Example + +```yaml +addons: + codeserver: + targetSelector: + - main + - other-workload +``` + +--- + +#### `addons.$addon.container` + +Define additional options for the container + +:::tip + +See container options in the [container](/common/container) section. + +::: + +| | | +| ---------- | ----------------------------------------------- | +| Key | `addons.$addon.container` | +| Type | `map` | +| Required | โŒ | +| Helm `tpl` | โŒ | +| Default | Depends on the addon (See common's values.yaml) | + +Example + +```yaml +addons: + codeserver: + container: {} +``` + +--- + +#### `addons.$addon.service` + +Define additional options for the service + +:::tip + +See service options in the [service](/common/service) section. + +::: + +:::note + +Only applies to: + +- Codeserver + +::: + +| | | +| ---------- | ----------------------------------------------- | +| Key | `addons.$addon.service` | +| Type | `map` | +| Required | โŒ | +| Helm `tpl` | โŒ | +| Default | Depends on the addon (See common's values.yaml) | + +Example + +```yaml +addons: + codeserver: + service: {} +``` + +--- + +#### `addons.$addon.ingress` + +Define additional options for the ingress + +:::tip + +See ingress options in the [ingress](/common/ingress) section. + +::: + +:::note + +Only applies to: + +- Codeserver + +::: + +| | | +| ---------- | ----------------------------------------------- | +| Key | `addons.$addon.ingress` | +| Type | `map` | +| Required | โŒ | +| Helm `tpl` | โŒ | +| Default | Depends on the addon (See common's values.yaml) | + +Example + +```yaml +addons: + codeserver: + ingress: {} +``` + +--- + +## Full Examples + +```yaml +addons: + codeserver: + enabled: true + container: + resources: + limits: + cpu: 3333m + memory: 3333Mi + service: + enabled: true + ports: + codeserver: + enabled: true + port: 12345 + targetPort: 12345 + ingress: + enabled: true + hosts: + - host: code.chart-example.local + paths: + - path: / + pathType: Prefix +```