feat(common): BREAKING CHANGE refactor add-on system (#31167)
**Description** This PR updates the add-on system to allow for more end-user flexibility It basically moves add-on container configuration to values.yaml, to expose all container options to end users. Fixes: #27351 Fixes: #31876 **⚙️ Type of change** - [ ] ⚙️ Feature/App addition - [ ] 🪛 Bugfix - [ ] ⚠️ Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] 🔃 Refactor of current code **🧪 How Has This Been Tested?** <!-- Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration --> **📃 Notes:** <!-- Please enter any other relevant information here --> **✔️ Checklist:** - [ ] ⚖️ My code follows the style guidelines of this project - [ ] 👀 I have performed a self-review of my own code - [ ] #️⃣ I have commented my code, particularly in hard-to-understand areas - [ ] 📄 I have made corresponding changes to the documentation - [ ] ⚠️ My changes generate no new warnings - [ ] 🧪 I have added tests to this description that prove my fix is effective or that my feature works - [ ] ⬆️ I increased versions for any altered app according to semantic versioning - [ ] I made sure the title starts with `feat(chart-name):`, `fix(chart-name):` or `chore(chart-name):` **➕ App addition** If this PR is an app addition please make sure you have done the following. - [ ] 🖼️ I have added an icon in the Chart's root directory called `icon.png` --- _Please don't blindly check all the boxes. Read them and only check those that apply. Those checkboxes are there for the reviewer to see what is this all about and the status of this PR with a quick glance._ --------- Signed-off-by: Kjeld Schouten <info@kjeldschouten.nl> Signed-off-by: Stavros Kois <47820033+stavros-k@users.noreply.github.com> Co-authored-by: kqmaverick <kqmaverick@gmail.com> Co-authored-by: Stavros Kois <s.kois@outlook.com> Co-authored-by: Stavros Kois <47820033+stavros-k@users.noreply.github.com>
This commit is contained in:
Kjeld Schouten
co-authored by
kqmaverick
Stavros Kois
Stavros Kois
kqmaverick
Stavros Kois
Stavros Kois
parent
78377b9443
commit
b62e536593
@@ -48,4 +48,4 @@ sources:
|
||||
- https://hub.docker.com/_/
|
||||
- https://hub.docker.com/r/mikefarah/yq
|
||||
type: library
|
||||
version: 26.4.3
|
||||
version: 27.0.0
|
||||
|
||||
@@ -0,0 +1,72 @@
|
||||
{{/*
|
||||
Template to render code-server addon
|
||||
It will include / inject the required templates based on the given values.
|
||||
*/}}
|
||||
{{- define "tc.v1.common.addon.codeserver" -}}
|
||||
{{- $codeSrv := $.Values.addons.codeserver -}}
|
||||
|
||||
{{- if $codeSrv.enabled -}}
|
||||
{{- $targetSelector := list "main" -}}
|
||||
{{- if $codeSrv.targetSelector -}}
|
||||
{{- $targetSelector = $codeSrv.targetSelector -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if gt ($targetSelector|len) 1 -}}
|
||||
{{- fail "Codeserver Addon - Can only be attached to a single workload at a time" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Append the code-server container to the workloads */}}
|
||||
{{- range $targetSelector -}}
|
||||
{{- $workload := get $.Values.workload . -}}
|
||||
{{- $_ := set $workload.podSpec.containers "codeserver" $codeSrv.container -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Add the code-server service */}}
|
||||
{{- if $codeSrv.service.enabled -}}
|
||||
{{/* Add the code-server service */}}
|
||||
{{- $hasPrimaryService := false -}}
|
||||
{{- $result := (include "tc.v1.common.lib.service.hasPrimary" $) | fromJson -}}
|
||||
{{- if and $result.hasEnabled $result.hasPrimary -}}
|
||||
{{- $hasPrimaryService = true -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- $svcValues := $codeSrv.service -}}
|
||||
{{- $_ := set $svcValues "targetSelector" ($targetSelector|first) -}}
|
||||
{{- if not $hasPrimaryService -}}
|
||||
{{- $_ := set $svcValues "primary" true -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if not $.Values.service -}}
|
||||
{{- $_ := set $.Values "service" dict -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- $_ := set $.Values.service "codeserver" $svcValues -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Add the code-server ingress */}}
|
||||
{{- if $codeSrv.ingress.enabled -}}
|
||||
{{- $ingressValues := $codeSrv.ingress -}}
|
||||
{{- if not $ingressValues.targetSelector -}}
|
||||
{{/* Assumes that both service and port are named codeserver */}}
|
||||
{{- $_ := set $ingressValues "targetSelector" (dict "codeserver" "codeserver") -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- $hasPrimaryIngress := false -}}
|
||||
{{- $result := (include "tc.v1.common.lib.ingress.hasPrimary" $) | fromJson -}}
|
||||
{{- if and $result.hasEnabled $result.hasPrimary -}}
|
||||
{{- $hasPrimaryIngress = true -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if not $hasPrimaryIngress -}}
|
||||
{{- $_ := set $ingressValues "primary" true -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if not $.Values.ingress -}}
|
||||
{{- $_ := set $.Values "ingress" dict -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Let spawner handle the rest */}}
|
||||
{{- $_ := set $.Values.ingress "codeserver" $ingressValues -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,69 @@
|
||||
{{/*
|
||||
Template to render VPN addon
|
||||
It will include / inject the required templates based on the given values.
|
||||
*/}}
|
||||
{{- define "tc.v1.common.addon.gluetun" -}}
|
||||
{{- $glue := $.Values.addons.gluetun -}}
|
||||
{{- if $glue.enabled -}}
|
||||
{{- if not $glue.container.env -}}
|
||||
{{- $_ := set $glue.container "env" dict -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- $fw := $glue.container.env.FIREWALL -}}
|
||||
{{- if (eq $fw "on") -}}
|
||||
{{- $nets := $glue.container.env.FIREWALL_OUTBOUT_SUBNETS | splitList "," -}}
|
||||
{{- $nets = mustAppend ($nets $.Values.chartContext.podCIDR $.Values.chartContext.svcCIDR) | mustUniq -}}
|
||||
{{- $_ := set $glue.container.env "FIREWALL_OUTBOUND_SUBNETS" (join "," $nets) -}}
|
||||
|
||||
{{- $inputPorts := $glue.container.env.FIREWALL_INPUT_PORTS | splitList "," -}}
|
||||
{{- if and
|
||||
$.Values.service $.Values.service.main $.Values.service.main.ports
|
||||
$.Values.service.main.ports.main $.Values.service.main.ports.main.port
|
||||
-}}
|
||||
{{- $inputPorts = mustAppend $inputPorts $.Values.service.main.ports.main.port -}}
|
||||
{{- end -}}
|
||||
{{- $inputPorts = $inputPorts | mustUniq -}}
|
||||
{{- $_ := set $glue.container.env "FIREWALL_INPUT_PORTS" (join "," $inputPorts) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- $targetSelector := list "main" -}}
|
||||
{{- if $glue.targetSelector -}}
|
||||
{{- $targetSelector = $glue.targetSelector -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Append the vpn container to the workloads */}}
|
||||
{{- range $targetSelector -}}
|
||||
{{- $workload := get $.Values.workload . -}}
|
||||
{{- $_ := set $workload.podSpec.containers "gluetun" $glue.container -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Mount secrets */}}
|
||||
{{- range $secName, $secValues := $glue.secret -}}
|
||||
{{- $secretName := printf "gluetun-%s" $secName -}}
|
||||
{{- if not $secValues.basePath -}}
|
||||
{{- fail (printf "Gluetun - Secret [%s] does not have basePath") -}}
|
||||
{{- end -}}
|
||||
{{- $_ := set $secValues "enabled" true -}}
|
||||
{{- $_ := set $.Values.secret $secretName $secValues -}}
|
||||
|
||||
{{- $persistence := (dict
|
||||
"enabled" true "type" "secret" "objectName" $secretName "targetSelector" dict "items" list
|
||||
) -}}
|
||||
{{- if $secValues.defaultMode -}}
|
||||
{{- $_ := set $persistence "defaultMode" $secValues.defaultMode -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- range $key, $val := $secValues.data -}}
|
||||
{{- $item := (dict "key" $key "path" $key) -}}
|
||||
{{- $_ := set $persistence "items" (mustAppend $persistence.items $item) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- $selectorValue := (dict "gluetun" (dict "mountPath" $secValues.basePath)) -}}
|
||||
{{- range $targetSelector -}}
|
||||
{{- $_ := set $persistence.targetSelector . $selectorValue -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- $_ := set $.Values.persistence $secretName $persistence -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,20 @@
|
||||
{{/*
|
||||
Template to render code-server addon
|
||||
It will include / inject the required templates based on the given values.
|
||||
*/}}
|
||||
{{- define "tc.v1.common.addon.netshoot" -}}
|
||||
{{- $netshoot := $.Values.addons.netshoot -}}
|
||||
{{- if $netshoot.enabled -}}
|
||||
{{- $targetSelector := list "main" -}}
|
||||
{{- if $netshoot.targetSelector -}}
|
||||
{{- $targetSelector = $netshoot.targetSelector -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- range $targetSelector -}}
|
||||
{{/* Append the code-server container to the workloads */}}
|
||||
{{- $workload := get $.Values.workload . -}}
|
||||
{{- $_ := set $workload.podSpec.containers "netshoot" $.Values.addons.netshoot.container -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,56 @@
|
||||
{{/*
|
||||
Template to render VPN addon
|
||||
It will include / inject the required templates based on the given values.
|
||||
*/}}
|
||||
{{- define "tc.v1.common.addon.tailscale" -}}
|
||||
{{- $ts := $.Values.addons.tailscale -}}
|
||||
{{- if $ts.enabled -}}
|
||||
{{- $secContext := dict -}}
|
||||
{{- $_ := set $secContext "runAsUser" 0 -}}
|
||||
{{- $_ := set $secContext "runAsGroup" 0 -}}
|
||||
{{- $_ := set $secContext "runAsNonRoot" true -}}
|
||||
{{- $_ := set $secContext "readOnlyRootFilesystem" false -}}
|
||||
|
||||
{{- if and $ts.container.env ($ts.container.env.TS_USERSPACE) -}}
|
||||
{{- $_ := set $secContext "runAsUser" 1000 -}}
|
||||
{{- $_ := set $secContext "runAsGroup" 1000 -}}
|
||||
{{- $_ := set $secContext "runAsNonRoot" false -}}
|
||||
{{- $_ := set $secContext "readOnlyRootFilesystem" true -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- $newSecContext := $ts.container.securityContext -}}
|
||||
{{- $newSecContext = mustMergeOverwrite $newSecContext $secContext -}}
|
||||
{{- $_ := set $ts.container "securityContext" $newSecContext -}}
|
||||
|
||||
{{- $targetSelector := list "main" -}}
|
||||
{{- if $ts.targetSelector -}}
|
||||
{{- $targetSelector = $ts.targetSelector -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Append the vpn container to the workloads */}}
|
||||
{{- range $targetSelector -}}
|
||||
{{/* FIXME: https://github.com/tailscale/tailscale/issues/8188 */}}
|
||||
{{- $workload := get $.Values.workload . -}}
|
||||
{{- $_ := set $workload.podSpec "automountServiceAccountToken" true -}}
|
||||
{{- $_ := set $workload.podSpec.containers "tailscale" $ts.container -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- $persistence := $.Values.persistence.tailscalestate | default dict -}}
|
||||
{{- $_ := set $persistence "enabled" true -}}
|
||||
{{- if not $persistence.type -}}
|
||||
{{- $_ := set $persistence "type" "emptyDir" -}}
|
||||
{{- end -}}
|
||||
{{- if not $persistence.targetSelector -}}
|
||||
{{- $_ := set $persistence "targetSelector" dict -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- $selectorValue := (dict "tailscale" (dict "mountPath" "/var/lib/tailscale")) -}}
|
||||
{{- range $targetSelector -}}
|
||||
{{- $_ := set $persistence.targetSelector . $selectorValue -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Append the empty dir tailscale to the persistence */}}
|
||||
{{- $_ := set $.Values.persistence "tailscalestate" $persistence -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- end -}}
|
||||
@@ -1,72 +0,0 @@
|
||||
{{/*
|
||||
Template to render code-server addon
|
||||
It will include / inject the required templates based on the given values.
|
||||
*/}}
|
||||
{{- define "tc.v1.common.addon.codeserver" -}}
|
||||
{{- $targetSelector := "main" -}}
|
||||
{{- if $.Values.addons.codeserver.targetSelector -}}
|
||||
{{- $targetSelector = $.Values.addons.codeserver.targetSelector -}}
|
||||
{{- end -}}
|
||||
{{- if .Values.addons.codeserver.enabled -}}
|
||||
{{/* Append the code-server container to the workloads */}}
|
||||
{{- $container := include "tc.v1.common.addon.codeserver.container" . | fromYaml -}}
|
||||
{{- if $container -}}
|
||||
{{- $workload := get $.Values.workload $targetSelector -}}
|
||||
{{- $_ := set $workload.podSpec.containers "codeserver" $container -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- $hasPrimaryService := false -}}
|
||||
{{- range $svcName, $svcValues := .Values.service -}}
|
||||
{{- $enabled := (include "tc.v1.common.lib.util.enabled" (dict
|
||||
"rootCtx" $ "objectData" $svcValues
|
||||
"name" $svcName "caller" "Code Server Service"
|
||||
"key" "addons.codeserver.service")) -}}
|
||||
|
||||
{{- if eq $enabled "true" -}}
|
||||
{{- if $svcValues.primary -}}
|
||||
{{- $hasPrimaryService = true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Add the code-server service */}}
|
||||
{{- if .Values.addons.codeserver.service.enabled -}}
|
||||
{{- $serviceValues := .Values.addons.codeserver.service -}}
|
||||
{{- $_ := set $serviceValues "targetSelector" $targetSelector -}}
|
||||
{{- if not $hasPrimaryService -}}
|
||||
{{- $_ := set $serviceValues "primary" true -}}
|
||||
{{- end -}}
|
||||
{{- $_ := set .Values.service "codeserver" $serviceValues -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Add the code-server ingress */}}
|
||||
{{- if .Values.addons.codeserver.ingress.enabled -}}
|
||||
{{- $ingressValues := .Values.addons.codeserver.ingress -}}
|
||||
{{- if not $ingressValues.targetSelector -}}
|
||||
{{/* Assumes that both service and port are named codeserver */}}
|
||||
{{- $_ := set $ingressValues "targetSelector" (dict "codeserver" "codeserver") -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- $hasPrimaryIngress := false -}}
|
||||
{{- range $ingName, $ingValues := $.Values.ingress -}}
|
||||
{{- $enabled := (include "tc.v1.common.lib.util.enabled" (dict
|
||||
"rootCtx" $ "objectData" $ingValues
|
||||
"name" $ingName "caller" "Code Server Ingress"
|
||||
"key" "addons.codeserver.ingress")) -}}
|
||||
|
||||
{{- if eq $enabled "true" -}}
|
||||
{{- if $ingValues.primary -}}
|
||||
{{- $hasPrimaryIngress = true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if not $hasPrimaryIngress -}}
|
||||
{{- $_ := set $ingressValues "primary" true -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Let spawner handle the rest */}}
|
||||
{{- $_ := set $.Values.ingress "codeserver" $ingressValues -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -1,48 +0,0 @@
|
||||
{{/*
|
||||
The code-server sidecar container to be inserted.
|
||||
*/}}
|
||||
{{- define "tc.v1.common.addon.codeserver.container" -}}
|
||||
enabled: true
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
port: {{ .Values.addons.codeserver.service.ports.codeserver.port }}
|
||||
path: "/"
|
||||
readiness:
|
||||
enabled: true
|
||||
port: {{ .Values.addons.codeserver.service.ports.codeserver.port }}
|
||||
path: "/"
|
||||
startup:
|
||||
enabled: true
|
||||
port: {{ .Values.addons.codeserver.service.ports.codeserver.port }}
|
||||
path: "/"
|
||||
imageSelector: "codeserverImage"
|
||||
imagePullPolicy: {{ .Values.codeserverImage.pullPolicy }}
|
||||
resources:
|
||||
excludeExtra: true
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
readOnlyRootFilesystem: false
|
||||
env:
|
||||
{{- range $envList := .Values.addons.codeserver.envList -}}
|
||||
{{- if and $envList.name $envList.value }}
|
||||
{{ $envList.name }}: {{ $envList.value | quote }}
|
||||
{{- else }}
|
||||
{{- fail "Please specify name/value for codeserver environment variable" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- with .Values.addons.codeserver.env -}}
|
||||
{{- range $k, $v := . }}
|
||||
{{ $k }}: {{ $v | quote }}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
args:
|
||||
{{- range .Values.addons.codeserver.args }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
- "--port"
|
||||
- "{{ .Values.addons.codeserver.service.ports.codeserver.port }}"
|
||||
- {{ .Values.addons.codeserver.workingDir | default "/" }}
|
||||
{{- end -}}
|
||||
@@ -1,46 +0,0 @@
|
||||
{{/*
|
||||
The code-server sidecar container to be inserted.
|
||||
*/}}
|
||||
{{- define "tc.v1.common.addon.netshoot.container" -}}
|
||||
enabled: true
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- sleep infinity
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
startup:
|
||||
enabled: false
|
||||
imageSelector: "netshootImage"
|
||||
resources:
|
||||
excludeExtra: true
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
readOnlyRootFilesystem: false
|
||||
capabilities:
|
||||
add:
|
||||
- NET_ADMIN
|
||||
- NET_RAW
|
||||
env:
|
||||
{{- range $envList := $.Values.addons.netshoot.envList -}}
|
||||
{{- if and $envList.name $envList.value }}
|
||||
{{ $envList.name }}: {{ $envList.value | quote }}
|
||||
{{- else }}
|
||||
{{- fail "Please specify name/value for netshoot environment variable" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- with $.Values.addons.netshoot.env -}}
|
||||
{{- range $k, $v := . }}
|
||||
{{ $k }}: {{ $v | quote }}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
args:
|
||||
{{- range $.Values.addons.netshoot.args }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -1,15 +0,0 @@
|
||||
{{/*
|
||||
Template to render code-server addon
|
||||
It will include / inject the required templates based on the given values.
|
||||
*/}}
|
||||
{{- define "tc.v1.common.addon.netshoot" -}}
|
||||
{{- $targetSelector := "main" -}}
|
||||
{{- if .Values.addons.netshoot.enabled -}}
|
||||
{{/* Append the code-server container to the workloads */}}
|
||||
{{- $container := include "tc.v1.common.addon.netshoot.container" . | fromYaml -}}
|
||||
{{- if $container -}}
|
||||
{{- $workload := get $.Values.workload $targetSelector -}}
|
||||
{{- $_ := set $workload.podSpec.containers "netshoot" $container -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -1,16 +0,0 @@
|
||||
{{/*
|
||||
The VPN config and scripts to be included.
|
||||
*/}}
|
||||
{{- define "tc.v1.common.addon.vpn.configmap" -}}
|
||||
enabled: true
|
||||
data:
|
||||
{{- with .Values.addons.vpn.scripts.up }}
|
||||
up.sh: |-
|
||||
{{- . | nindent 4 }}
|
||||
{{- end -}}
|
||||
|
||||
{{- with .Values.addons.vpn.scripts.down }}
|
||||
down.sh: |-
|
||||
{{- . | nindent 4 }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -1,74 +0,0 @@
|
||||
{{/*
|
||||
The gluetun sidecar container to be inserted.
|
||||
*/}}
|
||||
{{- define "tc.v1.common.addon.vpn.gluetun.container" -}}
|
||||
enabled: true
|
||||
imageSelector: gluetunImage
|
||||
probes:
|
||||
{{- if $.Values.addons.vpn.livenessProbe }}
|
||||
liveness:
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- else }}
|
||||
liveness:
|
||||
enabled: false
|
||||
{{- end }}
|
||||
readiness:
|
||||
enabled: false
|
||||
startup:
|
||||
enabled: false
|
||||
resources:
|
||||
excludeExtra: true
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsNonRoot: false
|
||||
readOnlyRootFilesystem: false
|
||||
runAsGroup: 568
|
||||
capabilities:
|
||||
add:
|
||||
- NET_ADMIN
|
||||
- NET_RAW
|
||||
- MKNOD
|
||||
|
||||
env:
|
||||
DNS_KEEP_NAMESERVER: "on"
|
||||
DOT: "off"
|
||||
{{- if $.Values.addons.vpn.killSwitch }}
|
||||
{{- $excludednetworks := (printf "%v,%v" $.Values.chartContext.podCIDR $.Values.chartContext.svcCIDR) -}}
|
||||
{{- $excludednetworksv6 := "" -}}
|
||||
{{- range $.Values.addons.vpn.excludedNetworks_IPv4 -}}
|
||||
{{- $excludednetworks = (printf "%v,%v" $excludednetworks .) -}}
|
||||
{{- end }}
|
||||
{{- range $.Values.addons.vpn.excludedNetworks_IPv6 -}}
|
||||
{{- $excludednetworksv6 = (printf "%v,%v" $excludednetworksv6 .) -}}
|
||||
{{- end }}
|
||||
FIREWALL: "on"
|
||||
FIREWALL_OUTBOUND_SUBNETS: {{ $excludednetworks | quote }}
|
||||
{{- $inputPorts := list -}}
|
||||
{{- if and
|
||||
$.Values.service $.Values.service.main $.Values.service.main.ports
|
||||
$.Values.service.main.ports.main $.Values.service.main.ports.main.port -}}
|
||||
{{- $inputPorts = list $.Values.service.main.ports.main.port -}}
|
||||
{{- end -}}
|
||||
{{- $inputPorts = concat $inputPorts $.Values.addons.vpn.inputPorts | mustUniq }}
|
||||
FIREWALL_INPUT_PORTS: {{ join "," $inputPorts }}
|
||||
{{- else }}
|
||||
FIREWALL: "off"
|
||||
{{- end }}
|
||||
|
||||
{{- with $.Values.addons.vpn.env }}
|
||||
{{- . | toYaml | nindent 2 }}
|
||||
{{- end -}}
|
||||
|
||||
{{- range $envList := $.Values.addons.vpn.envList -}}
|
||||
{{- if and $envList.name $envList.value }}
|
||||
{{ $envList.name }}: {{ $envList.value | quote }}
|
||||
{{- else -}}
|
||||
{{- fail "Please specify name/value for VPN environment variable" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- with $.Values.addons.vpn.args }}
|
||||
args:
|
||||
{{- . | toYaml | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -1,75 +0,0 @@
|
||||
{{/*
|
||||
The gluetun sidecar container to be inserted.
|
||||
*/}}
|
||||
{{- define "tc.v1.common.addon.vpn.openvpn.container" -}}
|
||||
enabled: true
|
||||
imageSelector: openvpnImage
|
||||
probes:
|
||||
{{- if $.Values.addons.vpn.livenessProbe }}
|
||||
liveness:
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- else }}
|
||||
liveness:
|
||||
enabled: false
|
||||
{{- end }}
|
||||
readiness:
|
||||
enabled: false
|
||||
startup:
|
||||
enabled: false
|
||||
resources:
|
||||
excludeExtra: true
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
capabilities:
|
||||
add:
|
||||
- NET_ADMIN
|
||||
- NET_RAW
|
||||
- MKNOD
|
||||
- SYS_MODULE
|
||||
|
||||
env:
|
||||
{{- with $.Values.addons.vpn.env }}
|
||||
{{- . | toYaml | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- if and $.Values.addons.vpn.openvpn.username $.Values.addons.vpn.openvpn.password }}
|
||||
VPN_AUTH: {{ (printf "%v;%v" $.Values.addons.vpn.openvpn.username $.Values.addons.vpn.openvpn.password) }}
|
||||
{{- end -}}
|
||||
{{- if $.Values.addons.vpn.killSwitch }}
|
||||
{{- $ipv4list := $.Values.addons.vpn.excludedNetworks_IPv4 }}
|
||||
|
||||
{{- if $.Values.chartContext.podCIDR }}
|
||||
{{- $ipv4list = append $ipv4list $.Values.chartContext.podCIDR }}
|
||||
{{- end }}
|
||||
{{- if $.Values.chartContext.svcCIDR }}
|
||||
{{- $ipv4list = append $ipv4list $.Values.chartContext.svcCIDR }}
|
||||
{{- end }}
|
||||
|
||||
FIREWALL: "ON"
|
||||
{{- range $index, $value := $ipv4list }}
|
||||
ROUTE_{{ add $index 1 }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if $.Values.addons.vpn.excludedNetworks_IPv6 }}
|
||||
{{- $excludednetworksv6 := "" -}}
|
||||
{{- range $.Values.addons.vpn.excludedNetworks_IPv4 -}}
|
||||
{{- $excludednetworksv6 = ( printf "%v;%v" $excludednetworksv6 . ) -}}
|
||||
{{- end }}
|
||||
{{- range $index, $value := $.Values.addons.vpn.excludedNetworks_IPv6 }}
|
||||
ROUTE6_{{ add $index 1 }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- range $envList := $.Values.addons.vpn.envList -}}
|
||||
{{- if and $envList.name $envList.value }}
|
||||
{{ $envList.name }}: {{ $envList.value | quote }}
|
||||
{{- else -}}
|
||||
{{- fail "Please specify name/value for VPN environment variable" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- with $.Values.addons.vpn.args }}
|
||||
args:
|
||||
{{- . | toYaml | nindent 2 }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -1,9 +0,0 @@
|
||||
{{/*
|
||||
The OpenVPN config secret to be included.
|
||||
*/}}
|
||||
{{- define "tc.v1.common.addon.vpn.secret" -}}
|
||||
enabled: true
|
||||
data:
|
||||
vpn.conf: |-
|
||||
{{- .Values.addons.vpn.config | nindent 4 }}
|
||||
{{- end -}}
|
||||
@@ -1,89 +0,0 @@
|
||||
{{/*
|
||||
The Tailscale sidecar container to be inserted.
|
||||
*/}}
|
||||
{{- define "tc.v1.common.addon.vpn.tailscale.container" -}}
|
||||
enabled: true
|
||||
imageSelector: "tailscaleImage"
|
||||
probes:
|
||||
{{- if $.Values.addons.vpn.livenessProbe }}
|
||||
liveness:
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- else }}
|
||||
liveness:
|
||||
enabled: false
|
||||
{{- end }}
|
||||
readiness:
|
||||
enabled: false
|
||||
startup:
|
||||
enabled: false
|
||||
command:
|
||||
- /usr/local/bin/containerboot
|
||||
resources:
|
||||
excludeExtra: true
|
||||
securityContext:
|
||||
{{- if $.Values.addons.vpn.tailscale.userspace }}
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: false
|
||||
readOnlyRootFilesystem: true
|
||||
{{- else }}
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: true
|
||||
readOnlyRootFilesystem: false
|
||||
{{- end }}
|
||||
capabilities:
|
||||
add:
|
||||
- NET_ADMIN
|
||||
- NET_RAW
|
||||
|
||||
{{/*
|
||||
Set KUBE_SECRET to empty string to force tailscale
|
||||
to use the filesystem for state tracking.
|
||||
With secret for state tracking you can't always
|
||||
know if the app that uses this sidecard will
|
||||
use a custom ServiceAccount and will lead to falure.
|
||||
*/}}
|
||||
env:
|
||||
TS_KUBE_SECRET: ""
|
||||
TS_SOCKET: /var/run/tailscale/tailscaled.sock
|
||||
TS_STATE_DIR: /var/lib/tailscale/state
|
||||
TS_AUTH_ONCE: {{ $.Values.addons.vpn.tailscale.auth_once | quote }}
|
||||
TS_USERSPACE: {{ $.Values.addons.vpn.tailscale.userspace | quote }}
|
||||
TS_ACCEPT_DNS: {{ $.Values.addons.vpn.tailscale.accept_dns | quote }}
|
||||
{{- with $.Values.addons.vpn.tailscale.outbound_http_proxy_listen }}
|
||||
TS_OUTBOUND_HTTP_PROXY_LISTEN: {{ . }}
|
||||
{{- end -}}
|
||||
{{- with $.Values.addons.vpn.tailscale.routes }}
|
||||
TS_ROUTES: {{ . }}
|
||||
{{- end -}}
|
||||
{{- with $.Values.addons.vpn.tailscale.dest_ip }}
|
||||
TS_DEST_IP: {{ . }}
|
||||
{{- end -}}
|
||||
{{- with $.Values.addons.vpn.tailscale.sock5_server }}
|
||||
TS_SOCKS5_SERVER: {{ . }}
|
||||
{{- end -}}
|
||||
{{- with $.Values.addons.vpn.tailscale.extra_args }}
|
||||
TS_EXTRA_ARGS: {{ . | quote }}
|
||||
{{- end -}}
|
||||
{{- with $.Values.addons.vpn.tailscale.daemon_extra_args }}
|
||||
TS_TAILSCALED_EXTRA_ARGS: {{ . | quote }}
|
||||
{{- end -}}
|
||||
{{- with $.Values.addons.vpn.tailscale.authkey }}
|
||||
TS_AUTH_KEY: {{ . }}
|
||||
{{- end }}
|
||||
|
||||
{{- range $envList := $.Values.addons.vpn.envList -}}
|
||||
{{- if and $envList.name $envList.value }}
|
||||
{{ $envList.name }}: {{ $envList.value | quote }}
|
||||
{{- else -}}
|
||||
{{- fail "Please specify name/value for VPN environment variable" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- with $.Values.addons.vpn.env -}}
|
||||
{{- range $k, $v := . }}
|
||||
{{ $k }}: {{ $v | quote }}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -1,112 +0,0 @@
|
||||
{{/*
|
||||
The volume (referencing VPN scripts) to be inserted into persistence.
|
||||
*/}}
|
||||
{{- define "tc.v1.common.addon.vpn.volume.scripts" -}}
|
||||
{{- $basePath := (include "tc.v1.common.addon.vpn.volume.basePath" .) }}
|
||||
enabled: true
|
||||
type: configmap
|
||||
objectName: vpnscripts
|
||||
expandObjectName: false
|
||||
defaultMode: "0777"
|
||||
items:
|
||||
{{- if .Values.addons.vpn.scripts.up }}
|
||||
- key: up.sh
|
||||
path: up.sh
|
||||
{{- end -}}
|
||||
{{- if .Values.addons.vpn.scripts.down }}
|
||||
- key: down.sh
|
||||
path: down.sh
|
||||
{{- end }}
|
||||
targetSelector:
|
||||
{{- range .Values.addons.vpn.targetSelector }}
|
||||
{{ . }}:
|
||||
vpn:
|
||||
mountPath: {{ $basePath }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
The volume (referencing VPN config) to be inserted into persistence.
|
||||
*/}}
|
||||
{{- define "tc.v1.common.addon.vpn.volume.config" -}}
|
||||
{{- $basePath := (include "tc.v1.common.addon.vpn.volume.basePath" .) }}
|
||||
{{- $mountPath := $basePath }}
|
||||
|
||||
enabled: true
|
||||
{{- if or .Values.addons.vpn.config .Values.addons.vpn.existingSecret }}
|
||||
type: secret
|
||||
defaultMode: "0777"
|
||||
items:
|
||||
- key: vpn.conf
|
||||
path: vpn.conf
|
||||
{{- if .Values.addons.vpn.existingSecret }}
|
||||
objectName: {{ .Values.addons.vpn.existingSecret }}
|
||||
expandObjectName: false
|
||||
{{- else }}
|
||||
objectName: vpnconfig
|
||||
expandObjectName: true
|
||||
{{- end -}}
|
||||
{{- else }}
|
||||
{{- $mountPath = (printf "%s/vpn.conf" $basePath) }}
|
||||
type: hostPath
|
||||
hostPath: {{ .Values.addons.vpn.configFile | default "/vpn" }}
|
||||
hostPathType: "File"
|
||||
autoPermissions:
|
||||
enabled: true
|
||||
chown: true
|
||||
user: 568
|
||||
group: 568
|
||||
{{- end }}
|
||||
targetSelector:
|
||||
{{- range .Values.addons.vpn.targetSelector }}
|
||||
{{ . }}:
|
||||
vpn:
|
||||
mountPath: {{ $mountPath }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
The volume (referencing VPN config folder) to be inserted into persistence.
|
||||
*/}}
|
||||
{{- define "tc.v1.common.addon.vpn.volume.folder" -}}
|
||||
{{- $basePath := (include "tc.v1.common.addon.vpn.volume.basePath" .) }}
|
||||
enabled: true
|
||||
type: hostPath
|
||||
hostPath: {{ .Values.addons.vpn.configFolder | quote }}
|
||||
autoPermissions:
|
||||
enabled: true
|
||||
chown: true
|
||||
user: 568
|
||||
group: 568
|
||||
targetSelector:
|
||||
{{- range .Values.addons.vpn.targetSelector }}
|
||||
{{ . }}:
|
||||
vpn:
|
||||
mountPath: {{ $basePath }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
{{/*
|
||||
The empty tailscale folder
|
||||
*/}}
|
||||
{{- define "tc.v1.common.addon.vpn.volume.tailscale" -}}
|
||||
enabled: true
|
||||
type: emptyDir
|
||||
targetSelector:
|
||||
{{- range .Values.addons.vpn.targetSelector }}
|
||||
{{ . }}:
|
||||
tailscale:
|
||||
mountPath: /var/lib/tailscale
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "tc.v1.common.addon.vpn.volume.basePath" -}}
|
||||
{{- $basePath := "/vpn" -}} {{/* Base Path for OVPN */}}
|
||||
{{- if eq .Values.addons.vpn.type "wireguard" -}}
|
||||
{{- $basePath = "/etc/wireguard" -}} {{/* Base Path for Wireguard */}}
|
||||
{{- else if eq .Values.addons.vpn.type "gluetun" -}}
|
||||
{{- $basePath = "/gluetun" -}} {{/* Base Path for Gluetun */}}
|
||||
{{- end -}}
|
||||
{{- $basePath -}}
|
||||
{{- end -}}
|
||||
@@ -1,94 +0,0 @@
|
||||
{{/*
|
||||
Template to render VPN addon
|
||||
It will include / inject the required templates based on the given values.
|
||||
*/}}
|
||||
{{- define "tc.v1.common.addon.vpn" -}}
|
||||
{{- if ne "disabled" .Values.addons.vpn.type -}}
|
||||
|
||||
{{- if .Values.addons.vpn.config -}}
|
||||
{{/* Append the vpn config secret to the secrets */}}
|
||||
{{- $secret := include "tc.v1.common.addon.vpn.secret" . | fromYaml -}}
|
||||
{{- if $secret -}}
|
||||
{{- $_ := set .Values.secret "vpnconfig" $secret -}}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
|
||||
{{- if or .Values.addons.vpn.scripts.up .Values.addons.vpn.scripts.down -}}
|
||||
{{/* Append the vpn up/down scripts to the configmaps */}}
|
||||
{{- $configmap := include "tc.v1.common.addon.vpn.configmap" . | fromYaml -}}
|
||||
{{- if $configmap -}}
|
||||
{{- $_ := set .Values.configmap "vpnscripts" $configmap -}}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
|
||||
{{- if or .Values.addons.vpn.configFile .Values.addons.vpn.config .Values.addons.vpn.existingSecret -}}
|
||||
{{/* Append the vpn config to the persistence */}}
|
||||
{{- $configper := include "tc.v1.common.addon.vpn.volume.config" . | fromYaml -}}
|
||||
{{- if $configper -}}
|
||||
{{- $_ := set .Values.persistence "vpnconfig" $configper -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if or .Values.addons.vpn.scripts.up .Values.addons.vpn.scripts.down -}}
|
||||
{{/* Append the vpn scripts to the persistence */}}
|
||||
{{- $scriptsper := include "tc.v1.common.addon.vpn.volume.scripts" . | fromYaml -}}
|
||||
{{- if $scriptsper -}}
|
||||
{{- $_ := set .Values.persistence "vpnscripts" $scriptsper -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.addons.vpn.configFolder -}}
|
||||
{{/* Append the vpn folder to the persistence */}}
|
||||
{{- $folderper := include "tc.v1.common.addon.vpn.volume.folder" . | fromYaml -}}
|
||||
{{- if $folderper -}}
|
||||
{{- $_ := set .Values.persistence "vpnfolder" $folderper -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Ensure target Selector defaults to main pod even if unset */}}
|
||||
{{- $targetSelector := list "main" -}}
|
||||
{{- if $.Values.addons.codeserver.targetSelector -}}
|
||||
{{- $targetSelector = $.Values.addons.codeserver.targetSelector -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Append the vpn container to the containers */}}
|
||||
{{- range $targetSelector -}}
|
||||
{{- if eq "gluetun" $.Values.addons.vpn.type -}}
|
||||
{{- $container := include "tc.v1.common.addon.vpn.gluetun.container" $ | fromYaml -}}
|
||||
{{- if $container -}}
|
||||
{{- $workload := get $.Values.workload . -}}
|
||||
{{- $_ := set $workload.podSpec.containers "vpn" $container -}}
|
||||
{{- end -}}
|
||||
{{- else if eq "tailscale" $.Values.addons.vpn.type -}}
|
||||
{{/* FIXME: https://github.com/tailscale/tailscale/issues/8188 */}}
|
||||
{{- $_ := set $.Values.podOptions "automountServiceAccountToken" true -}}
|
||||
{{- $container := include "tc.v1.common.addon.vpn.tailscale.container" $ | fromYaml -}}
|
||||
{{- if $container -}}
|
||||
{{- $workload := get $.Values.workload . -}}
|
||||
{{- $_ := set $workload.podSpec.containers "tailscale" $container -}}
|
||||
{{- end -}}
|
||||
{{- else if eq "openvpn" $.Values.addons.vpn.type -}}
|
||||
{{- $container := include "tc.v1.common.addon.vpn.openvpn.container" $ | fromYaml -}}
|
||||
{{- if $container -}}
|
||||
{{- $workload := get $.Values.workload . -}}
|
||||
{{- $_ := set $workload.podSpec.containers "vpn" $container -}}
|
||||
{{- end -}}
|
||||
{{- else if eq "wireguard" $.Values.addons.vpn.type -}}
|
||||
{{- $container := include "tc.v1.common.addon.vpn.wireguard.container" $ | fromYaml -}}
|
||||
{{- if $container -}}
|
||||
{{- $workload := get $.Values.workload . -}}
|
||||
{{- $_ := set $workload.podSpec.containers "vpn" $container -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if eq "tailscale" $.Values.addons.vpn.type -}}
|
||||
{{/* Append the empty tailscale folder to the persistence */}}
|
||||
{{- $tailscaledir := include "tc.v1.common.addon.vpn.volume.tailscale" . | fromYaml -}}
|
||||
{{- if $tailscaledir -}}
|
||||
{{- $_ := set .Values.persistence "tailscalestate" $tailscaledir -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -1,68 +0,0 @@
|
||||
{{/*
|
||||
The gluetun sidecar container to be inserted.
|
||||
*/}}
|
||||
{{- define "tc.v1.common.addon.vpn.wireguard.container" -}}
|
||||
enabled: true
|
||||
imageSelector: wireguardImage
|
||||
probes:
|
||||
{{- if $.Values.addons.vpn.livenessProbe }}
|
||||
liveness:
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- else }}
|
||||
liveness:
|
||||
enabled: false
|
||||
{{- end }}
|
||||
readiness:
|
||||
enabled: false
|
||||
startup:
|
||||
enabled: false
|
||||
resources:
|
||||
excludeExtra: true
|
||||
securityContext:
|
||||
runAsUser: 568
|
||||
runAsGroup: 568
|
||||
readOnlyRootFilesystem: false
|
||||
allowPrivilegeEscalation: true
|
||||
capabilities:
|
||||
add:
|
||||
- AUDIT_WRITE
|
||||
- NET_ADMIN
|
||||
- SETUID
|
||||
- SETGID
|
||||
- SYS_MODULE
|
||||
|
||||
env:
|
||||
{{- with $.Values.addons.vpn.env }}
|
||||
{{- . | toYaml | nindent 2 }}
|
||||
{{- end }}
|
||||
SEPARATOR: ";"
|
||||
IPTABLES_BACKEND: "nft"
|
||||
{{- if $.Values.addons.vpn.killSwitch }}
|
||||
KILLSWITCH: "true"
|
||||
{{- $excludednetworksv4 := ( printf "%v;%v" $.Values.chartContext.podCIDR $.Values.chartContext.svcCIDR ) -}}
|
||||
{{- range $.Values.addons.vpn.excludedNetworks_IPv4 -}}
|
||||
{{- $excludednetworksv4 = ( printf "%v;%v" $excludednetworksv4 . ) -}}
|
||||
{{- end }}
|
||||
KILLSWITCH_EXCLUDEDNETWORKS_IPV4: {{ $excludednetworksv4 | quote }}
|
||||
{{- if $.Values.addons.vpn.excludedNetworks_IPv6 -}}
|
||||
{{- $excludednetworksv6 := "" -}}
|
||||
{{- range $.Values.addons.vpn.excludedNetworks_IPv4 -}}
|
||||
{{- $excludednetworksv6 = ( printf "%v;%v" $excludednetworksv6 . ) -}}
|
||||
{{- end }}
|
||||
KILLSWITCH_EXCLUDEDNETWORKS_IPV6: {{ $.Values.addons.vpn.excludedNetworks_IPv6 | quote }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- range $envList := $.Values.addons.vpn.envList -}}
|
||||
{{- if and $envList.name $envList.value }}
|
||||
{{ $envList.name }}: {{ $envList.value | quote }}
|
||||
{{- else -}}
|
||||
{{- fail "Please specify name/value for VPN environment variable" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- with $.Values.addons.vpn.args }}
|
||||
args:
|
||||
{{- . | toYaml | nindent 2 }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -144,8 +144,17 @@ objectData:
|
||||
{{/* Call this template:
|
||||
{{ include "tc.v1.common.lib.ingress.primaryValidation" $ -}}
|
||||
*/}}
|
||||
|
||||
{{- define "tc.v1.common.lib.ingress.primaryValidation" -}}
|
||||
{{- $result := (include "tc.v1.common.lib.ingress.hasPrimary" $) | fromJson -}}
|
||||
|
||||
{{/* Require at least one primary ingress, if any enabled */}}
|
||||
{{- if and $result.hasEnabled (not $result.hasPrimary) -}}
|
||||
{{- fail "Ingress - At least one enabled ingress must be primary" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- end -}}
|
||||
|
||||
{{- define "tc.v1.common.lib.ingress.hasPrimary" -}}
|
||||
|
||||
{{/* Initialize values */}}
|
||||
{{- $hasPrimary := false -}}
|
||||
@@ -176,9 +185,5 @@ objectData:
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Require at least one primary ingress, if any enabled */}}
|
||||
{{- if and $hasEnabled (not $hasPrimary) -}}
|
||||
{{- fail "Ingress - At least one enabled ingress must be primary" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- (dict "hasPrimary" $hasPrimary "hasEnabled" $hasEnabled) | toJson -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -26,9 +26,9 @@ objectData: The object data to be used to render the Pod.
|
||||
{{- $deviceAdded := false -}}
|
||||
{{- $hostUsers := false -}}
|
||||
{{- $hostUserPersistence := (list "configmap" "secret" "emptyDir" "downwardAPI" "projected") -}}
|
||||
{{- $podSelected := false -}}
|
||||
|
||||
{{- range $persistenceName, $persistenceValues := $rootCtx.Values.persistence -}}
|
||||
{{- $podSelected := false -}}
|
||||
{{- $enabled := (include "tc.v1.common.lib.util.enabled" (dict
|
||||
"rootCtx" $rootCtx "objectData" $persistenceValues
|
||||
"name" $persistenceName "caller" "Pod Security Context"
|
||||
@@ -40,7 +40,7 @@ objectData: The object data to be used to render the Pod.
|
||||
{{- if mustHas $objectData.shortName ($persistenceValues.targetSelector | keys) -}}
|
||||
{{- $podSelected = true -}}
|
||||
{{- end -}}
|
||||
{{- else if $objectData.podPrimary -}}
|
||||
{{- else if $objectData.primary -}}
|
||||
{{- $podSelected = true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -65,12 +65,22 @@ objectData:
|
||||
*/}}
|
||||
|
||||
{{- define "tc.v1.common.lib.service.primaryValidation" -}}
|
||||
{{- $result := (include "tc.v1.common.lib.service.hasPrimary" $) | fromJson -}}
|
||||
|
||||
{{/* Require at least one primary service, if any enabled */}}
|
||||
{{- if and $result.hasEnabled (not $result.hasPrimary) -}}
|
||||
{{- fail "Service - At least one enabled service must be primary" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- end -}}
|
||||
|
||||
{{- define "tc.v1.common.lib.service.hasPrimary" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
|
||||
{{/* Initialize values */}}
|
||||
{{- $hasPrimary := false -}}
|
||||
{{- $hasEnabled := false -}}
|
||||
|
||||
{{- range $name, $service := .Values.service -}}
|
||||
{{- range $name, $service := $.Values.service -}}
|
||||
{{- $enabled := "false" -}}
|
||||
|
||||
{{- if not (kindIs "invalid" $service.enabled) -}}
|
||||
@@ -99,24 +109,30 @@ objectData:
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Require at least one primary service, if any enabled */}}
|
||||
{{- if and $hasEnabled (not $hasPrimary) -}}
|
||||
{{- fail "Service - At least one enabled service must be primary" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- (dict "hasPrimary" $hasPrimary "hasEnabled" $hasEnabled) | toJson -}}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
{{/* Service Port Primary Validation */}}
|
||||
{{/* Call this template:
|
||||
{{ include "tc.v1.common.lib.service.primaryValidation" (dict "objectData" $objectData -}}
|
||||
objectData:
|
||||
The ports of the service.
|
||||
*/}}
|
||||
|
||||
{{- define "tc.v1.common.lib.servicePort.primaryValidation" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
{{- $result := (include "tc.v1.common.lib.servicePort.hasPrimary" (dict "objectData" $objectData)) | fromJson -}}
|
||||
|
||||
{{/* Require at least one primary service, if any enabled */}}
|
||||
{{- if and $result.hasEnabled (not $result.hasPrimary) -}}
|
||||
{{- fail "Service - At least one enabled port in service must be primary" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- end -}}
|
||||
|
||||
{{- define "tc.v1.common.lib.servicePort.hasPrimary" -}}
|
||||
{{- $objectData := .objectData -}}
|
||||
|
||||
{{/* Initialize values */}}
|
||||
{{- $hasPrimary := false -}}
|
||||
{{- $hasEnabled := false -}}
|
||||
|
||||
@@ -141,9 +157,5 @@ objectData:
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Require at least one primary service, if any enabled */}}
|
||||
{{- if and $hasEnabled (not $hasPrimary) -}}
|
||||
{{- fail "Service - At least one enabled port in service must be primary" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- (dict "hasPrimary" $hasPrimary "hasEnabled" $hasEnabled) | toJson -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -32,13 +32,18 @@
|
||||
{{- include "tc.v1.common.addon.codeserver" . }}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Enable VPN add-on if required */}}
|
||||
{{- if ne "disabled" .Values.addons.vpn.type -}}
|
||||
{{- include "tc.v1.common.addon.vpn" . }}
|
||||
{{/* Enable gluetun add-on if required */}}
|
||||
{{- if and .Values.addons.gluetun .Values.addons.gluetun.enabled -}}
|
||||
{{- include "tc.v1.common.addon.gluetun" . }}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Enable tailscale add-on if required */}}
|
||||
{{- if and .Values.addons.tailscale .Values.addons.tailscale.enabled -}}
|
||||
{{- include "tc.v1.common.addon.tailscale" . }}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Enable netshoot add-on if required */}}
|
||||
{{- if .Values.addons.netshoot.enabled }}
|
||||
{{- if and .Values.addons.netshoot .Values.addons.netshoot.enabled }}
|
||||
{{- include "tc.v1.common.addon.netshoot" . }}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
@@ -20,6 +20,11 @@
|
||||
{{- $dependencyValues := omit $dependencyValues "podOptions " -}}
|
||||
{{- $mergedValues = mustMergeOverwrite $mergedValues $dependencyValues -}}
|
||||
{{- end -}}
|
||||
{{- range $mergedValues.addons -}}
|
||||
{{- if .enabled -}}
|
||||
{{- $mergedValues = mustMergeOverwrite $mergedValues . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- $_ := set . "Values" (mustDeepCopy $mergedValues) -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -804,114 +804,158 @@ metrics:
|
||||
# -- The common chart supports several add-ons. These can be configured under this key.
|
||||
# @default -- See below
|
||||
addons:
|
||||
# -- The common chart supports adding a VPN add-on. It can be configured under this key.
|
||||
# @default -- See values.yaml
|
||||
vpn:
|
||||
# -- Specify the VPN type. Valid options are disabled, gluetun, openvpn, wireguard or tailscale
|
||||
# OpenVPN and Wireguard are considered deprecated
|
||||
type: disabled
|
||||
|
||||
# -- Tailscale specific configuration
|
||||
# @default -- See below
|
||||
# See more info for the configuration
|
||||
# https://github.com/tailscale/tailscale/blob/main/docs/k8s/run.sh
|
||||
tailscale:
|
||||
# -- Auth key to connect to the VPN Service
|
||||
authkey: ""
|
||||
# As a sidecar, it should only need to run in userspace
|
||||
userspace: true
|
||||
auth_once: true
|
||||
accept_dns: false
|
||||
routes: ""
|
||||
dest_ip: ""
|
||||
sock5_server: ""
|
||||
extra_args: ""
|
||||
daemon_extra_args: ""
|
||||
outbound_http_proxy_listen: ""
|
||||
# -- Annotations for tailscale sidecar
|
||||
annotations: {}
|
||||
|
||||
# -- OpenVPN specific configuration
|
||||
# @default -- See below
|
||||
openvpn:
|
||||
# -- Credentials to connect to the VPN Service (used with -a)
|
||||
# Only using password is enough
|
||||
username: ""
|
||||
password: ""
|
||||
|
||||
# -- All variables specified here will be added to the vpn sidecar container
|
||||
# See the documentation of the VPN image for all config values
|
||||
env: {}
|
||||
# TZ: UTC
|
||||
|
||||
# -- All variables specified here will be added to the vpn sidecar container
|
||||
# See the documentation of the VPN image for all config values
|
||||
envList: []
|
||||
# - name: someenv
|
||||
# value: somevalue
|
||||
|
||||
# -- you can directly specify the config file here
|
||||
config: ""
|
||||
|
||||
scripts:
|
||||
# -- you can directly specify the upscript here
|
||||
up: ""
|
||||
# some script
|
||||
|
||||
# -- you can directly specify the downscript here
|
||||
down: ""
|
||||
# some script
|
||||
|
||||
# -- Provide a customized vpn configuration file location to be used by the VPN.
|
||||
configFile: ""
|
||||
|
||||
# -- Provide a customized vpn configuration folder location to be added to the VPN container
|
||||
# The config file needs to be mounted seperately
|
||||
# the upscript and downscript need to be named: upscript.sh and downscript.sh respectively
|
||||
configFolder: ""
|
||||
|
||||
# -- Provide an existing secret for vpn config storage
|
||||
existingSecret: ""
|
||||
|
||||
# -- select pods to bind vpn addon to
|
||||
# Add "codeserver" to also add the codeserver pod to VPN
|
||||
gluetun:
|
||||
enabled: false
|
||||
targetSelector:
|
||||
- main
|
||||
secret:
|
||||
# vpn-conf:
|
||||
# basePath: /gluetun/wireguard
|
||||
# data:
|
||||
# # Effective path /gluetun/wireguard/wg0.conf
|
||||
# wg0.conf: |
|
||||
# some conf
|
||||
# wg1.conf: |
|
||||
# some conf
|
||||
# scripts:
|
||||
# basePath: /gluetun/scripts
|
||||
# defaultMode: "0777"
|
||||
# data:
|
||||
# # Effective path /gluetun/scripts/up.sh
|
||||
# up.sh: |
|
||||
# some conf
|
||||
container:
|
||||
enabled: true
|
||||
imageSelector: gluetunImage
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
startup:
|
||||
enabled: false
|
||||
resources:
|
||||
excludeExtra: true
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsNonRoot: false
|
||||
readOnlyRootFilesystem: false
|
||||
runAsGroup: 568
|
||||
capabilities:
|
||||
add:
|
||||
- NET_ADMIN
|
||||
- NET_RAW
|
||||
- MKNOD
|
||||
env:
|
||||
DOT: "off"
|
||||
DNS_KEEP_NAMESERVER: "on"
|
||||
FIREWALL: "off"
|
||||
FIREWALL_OUTBOUND_SUBNETS: ""
|
||||
FIREWALL_INPUT_PORTS: ""
|
||||
|
||||
## Only for Wireguard and OpenVPN
|
||||
killSwitch: true
|
||||
excludedNetworks_IPv4: []
|
||||
excludedNetworks_IPv6: []
|
||||
# -- Tailscale specific configuration
|
||||
# @default -- See below
|
||||
# See more info for the configuration
|
||||
# https://github.com/tailscale/tailscale/blob/main/docs/k8s/run.sh
|
||||
tailscale:
|
||||
enabled: false
|
||||
targetSelector:
|
||||
- main
|
||||
# -- you can directly specify the config file here
|
||||
config: ""
|
||||
container:
|
||||
enabled: true
|
||||
imageSelector: "tailscaleImage"
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
startup:
|
||||
enabled: false
|
||||
command:
|
||||
- /usr/local/bin/containerboot
|
||||
resources:
|
||||
excludeExtra: true
|
||||
env:
|
||||
# Set KUBE_SECRET to empty string to force tailscale
|
||||
# to use the filesystem for state tracking.
|
||||
# With secret for state tracking you can't always
|
||||
# know if the app that uses this sidecard will
|
||||
# use a custom ServiceAccount and will lead to falure.
|
||||
TS_KUBE_SECRET: ""
|
||||
TS_SOCKET: /var/run/tailscale/tailscaled.sock
|
||||
TS_STATE_DIR: /var/lib/tailscale/state
|
||||
TS_USERSPACE: true
|
||||
TS_AUTH_ONCE: true
|
||||
TS_ACCEPT_DNS: false
|
||||
TS_AUTH_KEY: ""
|
||||
TS_TAILSCALED_EXTRA_ARGS: ""
|
||||
TS_EXTRA_ARGS: ""
|
||||
TS_SOCKS5_SERVER: ""
|
||||
TS_DEST_IP: ""
|
||||
TS_ROUTES: ""
|
||||
TS_OUTBOUND_HTTP_PROXY_LISTEN: ""
|
||||
securityContext:
|
||||
capabilities:
|
||||
add:
|
||||
- NET_ADMIN
|
||||
- NET_RAW
|
||||
|
||||
## For Gluetun to enable kubernetes network communication
|
||||
inputPorts: []
|
||||
# -- Auth key to connect to the VPN Service
|
||||
authkey: ""
|
||||
# As a sidecar, it should only need to run in userspace
|
||||
userspace: true
|
||||
auth_once: true
|
||||
accept_dns: false
|
||||
routes: ""
|
||||
dest_ip: ""
|
||||
sock5_server: ""
|
||||
extra_args: ""
|
||||
daemon_extra_args: ""
|
||||
outbound_http_proxy_listen: ""
|
||||
# -- Annotations for tailscale sidecar
|
||||
annotations: {}
|
||||
|
||||
# -- The common library supports adding a code-server add-on to access files. It can be configured under this key.
|
||||
# @default -- See values.yaml
|
||||
codeserver:
|
||||
# -- Enable running a code-server container in the pod
|
||||
enabled: false
|
||||
|
||||
# -- Set any environment variables for code-server here
|
||||
env: {}
|
||||
|
||||
# -- All variables specified here will be added to the codeserver sidecar container
|
||||
# See the documentation of the codeserver image for all config values
|
||||
envList: []
|
||||
# - name: someenv
|
||||
# value: somevalue
|
||||
# -- Set codeserver command line arguments.
|
||||
# Consider setting --user-data-dir to a persistent location to preserve code-server setting changes
|
||||
args:
|
||||
- --auth
|
||||
- none
|
||||
# -- Enable running a code-server container in the pod
|
||||
container:
|
||||
enabled: true
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
port: 12321
|
||||
path: "/"
|
||||
readiness:
|
||||
enabled: true
|
||||
port: 12321
|
||||
path: "/"
|
||||
startup:
|
||||
enabled: true
|
||||
port: 12321
|
||||
path: "/"
|
||||
imageSelector: "codeserverImage"
|
||||
resources:
|
||||
excludeExtra: true
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
readOnlyRootFilesystem: false
|
||||
args:
|
||||
- "--port"
|
||||
- "12321"
|
||||
- "/"
|
||||
- --auth
|
||||
- none
|
||||
# - --user-data-dir
|
||||
# - "/config/.vscode"
|
||||
# -- Select a container to add the addon to
|
||||
targetSelector:
|
||||
# -- Specify the working dir that will be opened when code-server starts
|
||||
# If not given, the app will default to the mountpah of the first specified volumeMount
|
||||
workingDir: "/"
|
||||
# -- Select a workload to add the addon to
|
||||
targetSelector:
|
||||
- "main"
|
||||
|
||||
service:
|
||||
# -- Enable a service for the code-server add-on.
|
||||
@@ -924,6 +968,7 @@ addons:
|
||||
primary: true
|
||||
protocol: http
|
||||
port: 12321
|
||||
targetPort: 12321
|
||||
|
||||
ingress:
|
||||
# -- Enable an ingress for the code-server add-on.
|
||||
@@ -942,9 +987,33 @@ addons:
|
||||
netshoot:
|
||||
# -- Enable running a netshoot container in the pod
|
||||
enabled: false
|
||||
container:
|
||||
enabled: true
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- sleep infinity
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
startup:
|
||||
enabled: false
|
||||
imageSelector: "netshootImage"
|
||||
resources:
|
||||
excludeExtra: true
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
readOnlyRootFilesystem: false
|
||||
capabilities:
|
||||
add:
|
||||
- NET_ADMIN
|
||||
- NET_RAW
|
||||
|
||||
# -- Set any environment variables for netshoot here
|
||||
env: {}
|
||||
dependencies:
|
||||
|
||||
##########################################################################
|
||||
# This section contains some pre-config for frequently used dependencies #
|
||||
|
||||
Reference in New Issue
Block a user