Initial v1.0.0 commit

charts/gardener-extension-shoot-cert-service/.helmignore

@@ -0,0 +1,22 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

charts/gardener-extension-shoot-cert-service/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+appVersion: "1.0"
+description: A Helm chart for the Gardener Shoot Fleet Agent extension.
+name: gardener-extension-shoot-fleet-agent
+version: 0.1.0

charts/gardener-extension-shoot-cert-service/doc.go

@@ -0,0 +1,18 @@
+// Copyright (c) 2019 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:generate ../../vendor/github.com/gardener/gardener/hack/generate-controller-registration.sh extension-shoot-fleet-agent . ../../VERSION ../../example/controller-registration.yaml Extension:shoot-fleet-agent
+
+// Package chart enables go:generate support for generating the correct controller registration.
+package chart

charts/gardener-extension-shoot-cert-service/templates/_helpers.tpl

@@ -0,0 +1,36 @@
+{{- define "name" -}}
+gardener-extension-shoot-fleet-agent
+{{- end -}}
+
+{{- define "agentconfig" -}}
+---
+apiVersion: shoot-fleet-agent-service.extensions.config.gardener.cloud/v1alpha1
+kind: FleetAgentConfig
+clientConnection:
+  kubeconfig: {{ .Values.fleetManager.kubeconfig }}
+{{- if .Values.fleetManager.labels }}
+labels: {{ .Values.fleetManager.labels | toYaml }}
+{{- end }}
+{{- end }}
+
+{{-  define "image" -}}
+  {{- if hasPrefix "sha256:" .Values.image.tag }}
+  {{- printf "%s@%s" .Values.image.repository .Values.image.tag }}
+  {{- else }}
+  {{- printf "%s:%s" .Values.image.repository .Values.image.tag }}
+  {{- end }}
+{{- end }}
+
+{{- define "priorityclassversion" -}}
+{{- if semverCompare ">= 1.14-0" .Capabilities.KubeVersion.GitVersion -}}
+scheduling.k8s.io/v1
+{{- else if semverCompare ">= 1.11-0" .Capabilities.KubeVersion.GitVersion -}}
+scheduling.k8s.io/v1beta1
+{{- else -}}
+scheduling.k8s.io/v1alpha1
+{{- end -}}
+{{- end -}}
+
+{{- define "leaderelectionid" -}}
+extension-shoot-fleet-agent-leader-election
+{{- end -}}

charts/gardener-extension-shoot-cert-service/templates/configmap-imagevector-overwrite.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.imageVectorOverwrite }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "name" . }}-imagevector-overwrite
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+data:
+  images_overwrite.yaml: |
+{{ .Values.imageVectorOverwrite | indent 4 }}
+{{- end }}

charts/gardener-extension-shoot-cert-service/templates/deployment.yaml

@@ -0,0 +1,74 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gardener-extension-shoot-fleet-agent
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: gardener-extension-shoot-fleet-agent
+    helm.sh/chart: gardener-extension-shoot-fleet-agent
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  revisionHistoryLimit: 0
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: gardener-extension-shoot-fleet-agent
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      annotations:
+        checksum/secret-fleet-service-config: {{ include "agentconfig" . | sha256sum }}
+        {{- if .Values.imageVectorOverwrite }}
+        checksum/configmap-extension-imagevector-overwrite: {{ include (print $.Template.BasePath "/configmap-imagevector-overwrite.yaml") . | sha256sum }}
+        {{- end }}
+      labels:
+        app.kubernetes.io/name: gardener-extension-shoot-fleet-agent
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      priorityClassName: gardener-extension-shoot-fleet-agent
+      serviceAccountName: gardener-extension-shoot-fleet-agent
+      containers:
+      - name: gardener-extension-shoot-fleet-agent
+        image: {{ include "image" . }}
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        command:
+        - /gardener-extension-shoot-fleet-agent
+        - --config=/etc/fleet-service/config.yaml
+        - --max-concurrent-reconciles={{ .Values.controllers.concurrentSyncs }}
+        - --healthcheck-max-concurrent-reconciles={{ .Values.controllers.healthcheck.concurrentSyncs }}
+        - --disable-controllers={{ .Values.disableControllers | join "," }}
+        - --ignore-operation-annotation={{ .Values.controllers.ignoreOperationAnnotation }}
+        - --leader-election-id={{ include "leaderelectionid" . }}
+        env:
+        - name: LEADER_ELECTION_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        {{- if .Values.imageVectorOverwrite }}
+        - name: IMAGEVECTOR_OVERWRITE
+          value: /charts_overwrite/images_overwrite.yaml
+        {{- end }}
+        {{- if .Values.resources }}
+        resources:
+{{ toYaml .Values.resources | trim | indent 10 }}
+        {{- end }}
+        volumeMounts:
+        - name: fleet-service-config
+          mountPath: /etc/fleet-service
+          readOnly: true
+        {{- if .Values.imageVectorOverwrite }}
+        - name: extension-imagevector-overwrite
+          mountPath: /charts_overwrite/
+          readOnly: true
+        {{- end }}
+      volumes:
+      - name: fleet-service-config
+        secret:
+          secretName: extension-shoot-fleet-agent-service.config
+      {{- if .Values.imageVectorOverwrite }}
+      - name: extension-imagevector-overwrite
+        configMap:
+          name: {{ include "name" .}}-imagevector-overwrite
+          defaultMode: 420
+      {{- end }}

charts/gardener-extension-shoot-cert-service/templates/fleet-config.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: extension-shoot-fleet-agent-service.config
+  namespace: {{ .Release.Namespace }}
+data:
+  config.yaml: {{ include "agentconfig" . | b64enc | trim }}

charts/gardener-extension-shoot-cert-service/templates/priorityclass.yaml

@@ -0,0 +1,7 @@
+apiVersion: {{ include "priorityclassversion" . }}
+kind: PriorityClass
+metadata:
+  name: gardener-extension-shoot-fleet-agent
+value: 1000000000
+globalDefault: true
+description: "Priority class for the Gardener extension: shoot-fleet-agent."

charts/gardener-extension-shoot-cert-service/templates/rbac-shoot-cert-service.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: extensions.gardener.cloud:extension-shoot-fleet-agent
+  labels:
+    app.kubernetes.io/name: gardener-extension-shoot-fleet-agent
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - "secrets"
+  verbs:
+  - "*"

charts/gardener-extension-shoot-cert-service/templates/rbac.yaml

@@ -0,0 +1,113 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: gardener-extension-shoot-fleet-agent
+  labels:
+    app.kubernetes.io/name: gardener-extension-shoot-fleet-agent
+    helm.sh/chart: gardener-extension-shoot-fleet-agent
+    app.kubernetes.io/instance: {{ .Release.Name }}
+rules:
+- apiGroups:
+  - extensions.gardener.cloud
+  resources:
+  - clusters
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - extensions.gardener.cloud
+  resources:
+  - extensions
+  - extensions/status
+  verbs:
+  - get
+  - list
+  - watch
+  - patch
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - create
+  - update
+  - patch
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - clusterroles
+  - clusterrolebindings
+  - roles
+  - rolebindings
+  verbs:
+  - get
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - ""
+  resources:
+  - "configmaps"
+  - "secrets"
+  - "events"
+  - "services"
+  - "pods"
+  - "serviceaccounts"
+  verbs:
+  - "*"
+- apiGroups:
+  - "apps"
+  resources:
+  - "deployments"
+  verbs:
+  - get
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - create
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  resourceNames:
+  - {{ include "leaderelectionid" . }}
+  verbs:
+  - update
+  - get
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: gardener-extension-shoot-fleet-agent
+  labels:
+    app.kubernetes.io/name: gardener-extension-shoot-fleet-agent
+    helm.sh/chart: gardener-extension-shoot-fleet-agent
+    app.kubernetes.io/instance: {{ .Release.Name }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: gardener-extension-shoot-fleet-agent
+subjects:
+- kind: ServiceAccount
+  name: gardener-extension-shoot-fleet-agent
+  namespace: {{ .Release.Namespace }}

charts/gardener-extension-shoot-cert-service/templates/serviceaccount.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: gardener-extension-shoot-fleet-agent
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: gardener-extension-shoot-fleet-agent
+    helm.sh/chart: gardener-extension-shoot-fleet-agent
+    app.kubernetes.io/instance: {{ .Release.Name }}

charts/gardener-extension-shoot-cert-service/templates/vpa.yaml

@@ -0,0 +1,22 @@
+{{- if .Values.vpa.enabled}}
+apiVersion: "autoscaling.k8s.io/v1beta2"
+kind: VerticalPodAutoscaler
+metadata:
+  name: gardener-extension-shoot-fleet-agent-vpa
+  namespace: {{ .Release.Namespace }}
+spec:
+  {{- if .Values.vpa.resourcePolicy }}
+  resourcePolicy:
+    containerPolicies:
+      - containerName: '*'
+        minAllowed:
+          cpu: {{ required ".Values.vpa.resourcePolicy.minAllowed.cpu is required" .Values.vpa.resourcePolicy.minAllowed.cpu }}
+          memory: {{ required ".Values.vpa.resourcePolicy.minAllowed.memory is required" .Values.vpa.resourcePolicy.minAllowed.memory }}
+  {{- end }}
+  targetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: gardener-extension-shoot-fleet-agent
+  updatePolicy:
+    updateMode: {{ .Values.vpa.updatePolicy.updateMode }}
+{{- end }}