TrueCharts Bot
79ee6f86fa
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [oci.trueforge.org/containerforge/kube-sa-proxy](https://ghcr.io/trueforge-org/kube-sa-proxy) ([source](https://redirect.github.com/Jackett/Jackett)) | digest | `c452a4d` → `3275ab7` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/18710) for more information. Add the preset `:preserveSemverRanges` to your config if you don't want to pin your dependencies. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMzAuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEzMC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImFwcC9rdWJlcm5ldGVzLWRhc2hib2FyZCIsImF1dG9tZXJnZSIsInJlbm92YXRlL2NvbnRhaW5lciIsInR5cGUvZGlnZXN0Il19-->
442 lines
12 KiB
YAML
442 lines
12 KiB
YAML
# yaml-language-server: $schema=./values.schema.json
|
|
image:
|
|
pullPolicy: IfNotPresent
|
|
repository: oci.trueforge.org/containerforge/kube-sa-proxy
|
|
tag: 1.30.2@sha256:3275ab7c8e5151b7162a470b8459a412a4af2312d279d0ef689f8aec365df4fc
|
|
|
|
webImage:
|
|
repository: docker.io/kubernetesui/dashboard-web
|
|
pullPolicy: IfNotPresent
|
|
tag: 1.7.0@sha256:cc7c31bd2d8470e3590dcb20fe980769b43054b31a5c5c0da606e9add898d85d
|
|
|
|
authImage:
|
|
repository: docker.io/kubernetesui/dashboard-auth
|
|
pullPolicy: IfNotPresent
|
|
tag: 1.4.0@sha256:53e9917898bf98ff2de91f7f9bdedd3545780eb3ac72158889ae031136e9eeff
|
|
|
|
apiImage:
|
|
repository: docker.io/kubernetesui/dashboard-api
|
|
pullPolicy: IfNotPresent
|
|
tag: 1.14.0@sha256:96a702cfd3399d9eba23b3d37b09f798a4f51fcd8c8dfa8552c7829ade9c4aff
|
|
|
|
scraperImage:
|
|
repository: docker.io/kubernetesui/dashboard-metrics-scraper
|
|
pullPolicy: IfNotPresent
|
|
tag: 1.2.2@sha256:5154b68252bd601cf85092b6413cb9db224af1ef89cb53009d2070dfccd30775
|
|
|
|
service:
|
|
main:
|
|
enabled: true
|
|
ports:
|
|
main:
|
|
enabled: true
|
|
primary: true
|
|
port: 80
|
|
targetPort: 3000
|
|
protocol: http
|
|
kubernetes-dashboard-forward:
|
|
expandObjectName: false
|
|
enabled: true
|
|
ports:
|
|
forward:
|
|
enabled: true
|
|
port: 8443
|
|
targetPort: 8443
|
|
protocol: https
|
|
selectorLabels:
|
|
app.kubernetes.io/name: kong
|
|
app.kubernetes.io/component: app
|
|
kubernetes-dashboard-web:
|
|
expandObjectName: false
|
|
enabled: true
|
|
targetSelector: web
|
|
ports:
|
|
web:
|
|
enabled: true
|
|
port: 8000
|
|
targetPort: 8000
|
|
protocol: http
|
|
kubernetes-dashboard-api:
|
|
expandObjectName: false
|
|
enabled: true
|
|
targetSelector: api
|
|
ports:
|
|
api:
|
|
enabled: true
|
|
port: 8000
|
|
targetPort: 8000
|
|
protocol: http
|
|
kubernetes-dashboard-auth:
|
|
expandObjectName: false
|
|
enabled: true
|
|
targetSelector: auth
|
|
ports:
|
|
auth:
|
|
enabled: true
|
|
port: 8000
|
|
targetPort: 8000
|
|
protocol: http
|
|
kubernetes-dashboard-scraper:
|
|
expandObjectName: false
|
|
enabled: true
|
|
targetSelector: scraper
|
|
ports:
|
|
scraper:
|
|
enabled: true
|
|
port: 8000
|
|
targetPort: 8000
|
|
protocol: http
|
|
|
|
workload:
|
|
main:
|
|
enabled: true
|
|
primary: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
main:
|
|
enabled: true
|
|
primary: true
|
|
env:
|
|
PORT: 3000
|
|
API_FILE: /var/run/secrets/kubernetes.io/serviceaccount/token
|
|
PROXY_TARGET: https://kubernetes-dashboard-forward:8443
|
|
AUTH_TOKEN_HEADER: Authorization
|
|
AUTH_TOKEN_PREFIX: Bearer
|
|
# We can potentially use this in the future...
|
|
CSRF_TOKEN: ""
|
|
probes:
|
|
liveness:
|
|
enabled: true
|
|
type: tcp
|
|
port: 3000
|
|
readiness:
|
|
enabled: true
|
|
type: tcp
|
|
port: 3000
|
|
startup:
|
|
enabled: true
|
|
type: tcp
|
|
port: 3000
|
|
web:
|
|
enabled: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
web:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: webImage
|
|
args:
|
|
- --namespace={{ .Release.Namespace }}
|
|
- --settings-config-map-name=kubernetes-dashboard-settings
|
|
# GOMAXPROCS:
|
|
# resourceFieldRef:
|
|
# resource: limits.cpu
|
|
# GOMEMLIMIT:
|
|
# valueFrom:
|
|
# resourceFieldRef:
|
|
# resource: limits.memory
|
|
probes:
|
|
liveness:
|
|
enabled: true
|
|
type: http
|
|
port: 8000
|
|
readiness:
|
|
enabled: true
|
|
type: http
|
|
port: 8000
|
|
startup:
|
|
enabled: true
|
|
type: http
|
|
port: 8000
|
|
api:
|
|
enabled: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
api:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: apiImage
|
|
args:
|
|
- --namespace={{ .Release.Namespace }}
|
|
- --metrics-scraper-service-name=kubernetes-dashboard-scraper
|
|
- --sidecar-host={{ printf "http://%v-scraper.%v.svc.cluster.local:8000" (include "tc.v1.common.lib.chart.names.fullname" $) .Release.Namespace }}
|
|
env:
|
|
CSRF_KEY:
|
|
secretKeyRef:
|
|
name: csrf
|
|
key: private.key
|
|
|
|
# GOMAXPROCS:
|
|
# resourceFieldRef:
|
|
# resource: limits.cpu
|
|
# GOMEMLIMIT:
|
|
# valueFrom:
|
|
# resourceFieldRef:
|
|
# resource: limits.memory
|
|
|
|
probes:
|
|
liveness:
|
|
enabled: true
|
|
type: http
|
|
port: 8000
|
|
path: /metrics
|
|
readiness:
|
|
enabled: true
|
|
type: http
|
|
port: 8000
|
|
path: /metrics
|
|
startup:
|
|
enabled: true
|
|
type: http
|
|
port: 8000
|
|
path: /metrics
|
|
|
|
auth:
|
|
enabled: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
auth:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: authImage
|
|
env:
|
|
CSRF_KEY:
|
|
secretKeyRef:
|
|
name: csrf
|
|
key: private.key
|
|
|
|
# GOMAXPROCS:
|
|
# resourceFieldRef:
|
|
# resource: limits.cpu
|
|
# GOMEMLIMIT:
|
|
# valueFrom:
|
|
# resourceFieldRef:
|
|
# resource: limits.memory
|
|
|
|
probes:
|
|
liveness:
|
|
enabled: true
|
|
type: tcp
|
|
port: 8000
|
|
readiness:
|
|
enabled: true
|
|
type: tcp
|
|
port: 8000
|
|
startup:
|
|
enabled: true
|
|
type: tcp
|
|
port: 8000
|
|
|
|
scraper:
|
|
enabled: true
|
|
type: Deployment
|
|
podSpec:
|
|
containers:
|
|
scraper:
|
|
enabled: true
|
|
primary: true
|
|
imageSelector: scraperImage
|
|
env:
|
|
CSRF_KEY:
|
|
secretKeyRef:
|
|
name: csrf
|
|
key: private.key
|
|
|
|
# GOMAXPROCS:
|
|
# resourceFieldRef:
|
|
# resource: limits.cpu
|
|
# GOMEMLIMIT:
|
|
# valueFrom:
|
|
# resourceFieldRef:
|
|
# resource: limits.memory
|
|
probes:
|
|
liveness:
|
|
enabled: true
|
|
type: http
|
|
port: 8000
|
|
readiness:
|
|
enabled: true
|
|
type: http
|
|
port: 8000
|
|
startup:
|
|
enabled: true
|
|
type: http
|
|
port: 8000
|
|
|
|
podOptions:
|
|
automountServiceAccountToken: true
|
|
|
|
configmap:
|
|
kubernetes-dashboard-settings:
|
|
expandObjectName: false
|
|
enabled: true
|
|
data:
|
|
settings: '{"itemsPerPage":100}'
|
|
kubedashboard-konggateway:
|
|
enabled: true
|
|
expandObjectName: false
|
|
data:
|
|
kong.yml: |
|
|
_format_version: "3.0"
|
|
services:
|
|
- name: auth
|
|
host: kubernetes-dashboard-auth
|
|
port: 8000
|
|
protocol: http
|
|
routes:
|
|
- name: authLogin
|
|
paths:
|
|
- /api/v1/login
|
|
strip_path: false
|
|
- name: authCsrf
|
|
paths:
|
|
- /api/v1/csrftoken/login
|
|
strip_path: false
|
|
- name: authMe
|
|
paths:
|
|
- /api/v1/me
|
|
strip_path: false
|
|
- name: api
|
|
host: kubernetes-dashboard-api
|
|
port: 8000
|
|
protocol: http
|
|
routes:
|
|
- name: api
|
|
paths:
|
|
- /api
|
|
strip_path: false
|
|
- name: metrics
|
|
paths:
|
|
- /metrics
|
|
strip_path: false
|
|
- name: web
|
|
host: kubernetes-dashboard-web
|
|
port: 8000
|
|
protocol: http
|
|
routes:
|
|
- name: root
|
|
paths:
|
|
- /
|
|
strip_path: false
|
|
|
|
secret:
|
|
csrf:
|
|
enabled: true
|
|
data:
|
|
private.key: dwpcRea9BZEaYQ2va/up6uL39GDFAY7bBpU4knT3wgeUNk9GPaiZjmisaKuLuEoKj5TCIQ7g+9ig07KpYc341ZbV3AJPl36YHSyx/Qv/n2yZT9XgpNoB2FM6f0gs8DquqSEuigxh/kHJREUiHQmQCk09SHmtdY3FpioU30ge69MCRmtDfvdh9XmytAb4u3uqxIfAd9BdJpGhg6m0eIAMyBtMtvZ2yzyTaZ2OuuKfspuQZe8ab2Bp+PHlK8Skq64E/RO2Uw4cnQGMqcAxatK3dEO2hmGXN2mnYXqAswKHHybAWlBUmTOrCHRncS77y2f40JOOmdhkFRDFIqgNT/yi7w==
|
|
|
|
## TODO: Split into multiple rbacs
|
|
## TODO: Implement these: https://github.com/kubernetes/dashboard/tree/master/charts/kubernetes-dashboard/templates/rbac/api
|
|
rbac:
|
|
main:
|
|
enabled: true
|
|
primary: true
|
|
clusterWide: true
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
resourceNames:
|
|
[
|
|
"kubernetes-dashboard-key-holder",
|
|
"kubernetes-dashboard-certs",
|
|
"kubernetes-dashboard-csrf",
|
|
]
|
|
verbs: ["get", "update", "delete"]
|
|
# Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
|
|
- apiGroups: [""]
|
|
resources: ["configmaps"]
|
|
resourceNames: ["kubernetes-dashboard-settings"]
|
|
verbs: ["get", "update"]
|
|
# Allow Dashboard to get metrics.
|
|
- apiGroups: [""]
|
|
resources: ["services"]
|
|
resourceNames: ["heapster", "dashboard-metrics-scraper"]
|
|
verbs: ["proxy"]
|
|
- apiGroups: [""]
|
|
resources: ["services/proxy"]
|
|
resourceNames:
|
|
[
|
|
"heapster",
|
|
"http:heapster:",
|
|
"https:heapster:",
|
|
"dashboard-metrics-scraper",
|
|
"http:dashboard-metrics-scraper",
|
|
]
|
|
verbs: ["get"]
|
|
- apiGroups: ["metrics.k8s.io"]
|
|
resources: ["pods", "nodes"]
|
|
verbs: ["get", "list", "watch"]
|
|
# Give all-access
|
|
- apiGroups: ["*"]
|
|
resources: ["*"]
|
|
verbs: ["*"]
|
|
|
|
# -- The service account the pods will use to interact with the Kubernetes API
|
|
serviceAccount:
|
|
main:
|
|
enabled: true
|
|
primary: true
|
|
targetSelectAll: true
|
|
|
|
## Required Kong sub-chart with DBless configuration to act as a gateway
|
|
## for our all containers.
|
|
kong:
|
|
enabled: true
|
|
manager:
|
|
enabled: false
|
|
## Configuration reference: https://docs.konghq.com/gateway/3.6.x/reference/configuration
|
|
env:
|
|
dns_order: LAST,A,CNAME,AAAA,SRV
|
|
plugins: "off"
|
|
nginx_worker_processes: 1
|
|
ingressController:
|
|
enabled: false
|
|
dblessConfig:
|
|
configMap: kubedashboard-konggateway
|
|
proxy:
|
|
type: ClusterIP
|
|
http:
|
|
enabled: false
|
|
## TODO Pre-configure ingress if needed
|
|
## Ingress hint:
|
|
# apiVersion: traefik.io/v1alpha1
|
|
# kind: IngressRoute
|
|
# metadata:
|
|
# name: kubdashboard-ingressroute
|
|
# namespace: kubernetes-dashboard
|
|
# spec:
|
|
# entryPoints: [websecure]
|
|
# routes:
|
|
# - kind: Rule
|
|
# match: PathPrefix(`/kubernetes-dashboard`)
|
|
# services:
|
|
# - kind: Service
|
|
# name: kubernetes-dashboard-kong-proxy
|
|
# namespace: kubernetes-dashboard
|
|
# port: kong-proxy
|
|
# middlewares:
|
|
# - name: stripkubdashboard
|
|
# namespace: kubernetes-dashboard
|
|
#
|
|
# ---
|
|
#
|
|
# apiVersion: traefik.io/v1alpha1
|
|
# kind: Middleware
|
|
# metadata:
|
|
# name: stripkubdashboard
|
|
# namespace: kubernetes-dashboard
|
|
# spec:
|
|
# stripPrefix:
|
|
# prefixes:
|
|
# - "/kubernetes-dashboard"
|
|
# forceSlash: true
|
|
|
|
# kong:
|
|
# proxy:
|
|
# http:
|
|
# enabled: true
|