mirror of
https://github.com/edgelesssys/constellation.git
synced 2025-08-01 11:36:10 -04:00
cli: move cli/internal libraries (#2623)
* cli: move internal packages Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * cli: fix buildfiles Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * bazel: fix exclude dir Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * cli: move back libraries that will not be used by TF provider Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> --------- Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
This commit is contained in:
Moritz Sanft
GitHub
parent
d3ce6ffcc1
commit
968cdc1a38
741 changed files with 122 additions and 101 deletions
|
|
@ -0,0 +1,150 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: constellation-operator-controller-manager
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
helm.sh/chart: constellation-operator-0.0.0
|
||||
app.kubernetes.io/name: constellation-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: constellation-operator-controller-manager
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
helm.sh/chart: constellation-operator-0.0.0
|
||||
app.kubernetes.io/name: constellation-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
control-plane: controller-manager
|
||||
app.kubernetes.io/name: constellation-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
app.kubernetes.io/name: constellation-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
annotations:
|
||||
kubectl.kubernetes.io/default-container: manager
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- --secure-listen-address=0.0.0.0:8443
|
||||
- --upstream=http://127.0.0.1:8080/
|
||||
- --logtostderr=true
|
||||
- --v=0
|
||||
env:
|
||||
- name: KUBERNETES_CLUSTER_DOMAIN
|
||||
value: cluster.local
|
||||
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
|
||||
name: kube-rbac-proxy
|
||||
ports:
|
||||
- containerPort: 8443
|
||||
name: https
|
||||
protocol: TCP
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 5m
|
||||
memory: 64Mi
|
||||
- args:
|
||||
- --health-probe-bind-address=:8081
|
||||
- --metrics-bind-address=127.0.0.1:8080
|
||||
- --leader-elect
|
||||
command:
|
||||
- /node-operator
|
||||
env:
|
||||
- name: KUBERNETES_CLUSTER_DOMAIN
|
||||
value: cluster.local
|
||||
- name: CONSTEL_CSP
|
||||
value: QEMU
|
||||
- name: constellation-uid
|
||||
value: "42424242424242"
|
||||
image: constellationOperatorImage
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8081
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
name: manager
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 8081
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 64Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
volumeMounts:
|
||||
- mountPath: /etc/kubernetes/pki/etcd
|
||||
name: etcd-certs
|
||||
- mountPath: /host/usr/lib/os-release
|
||||
name: usr-lib-os-release
|
||||
- mountPath: /etc/os-release
|
||||
name: etc-os-release
|
||||
- mountPath: /etc/azure
|
||||
name: azureconfig
|
||||
readOnly: true
|
||||
- mountPath: /etc/gce
|
||||
name: gceconf
|
||||
readOnly: true
|
||||
- mountPath: /etc/constellation-upgrade-agent.sock
|
||||
name: upgrade-agent-socket
|
||||
readOnly: true
|
||||
nodeSelector:
|
||||
node-role.kubernetes.io/control-plane: ""
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
serviceAccountName: constellation-operator-controller-manager
|
||||
terminationGracePeriodSeconds: 10
|
||||
tolerations:
|
||||
- effect: NoSchedule
|
||||
key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
- effect: NoSchedule
|
||||
key: node-role.kubernetes.io/master
|
||||
operator: Exists
|
||||
volumes:
|
||||
- hostPath:
|
||||
path: /etc/kubernetes/pki/etcd
|
||||
type: Directory
|
||||
name: etcd-certs
|
||||
- hostPath:
|
||||
path: /usr/lib/os-release
|
||||
type: File
|
||||
name: usr-lib-os-release
|
||||
- hostPath:
|
||||
path: /etc/os-release
|
||||
type: File
|
||||
name: etc-os-release
|
||||
- name: azureconfig
|
||||
secret:
|
||||
optional: true
|
||||
secretName: azureconfig
|
||||
- configMap:
|
||||
name: gceconf
|
||||
optional: true
|
||||
name: gceconf
|
||||
- name: upgrade-agent-socket
|
||||
hostPath:
|
||||
path: /run/constellation-upgrade-agent.sock
|
||||
type: Socket
|
||||
|
|
@ -0,0 +1,61 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: constellation-operator-leader-election-role
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
helm.sh/chart: constellation-operator-0.0.0
|
||||
app.kubernetes.io/name: constellation-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: constellation-operator-leader-election-rolebinding
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
helm.sh/chart: constellation-operator-0.0.0
|
||||
app.kubernetes.io/name: constellation-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: 'constellation-operator-leader-election-role'
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: 'constellation-operator-controller-manager'
|
||||
namespace: 'testNamespace'
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: constellation-operator-manager-config
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
helm.sh/chart: constellation-operator-0.0.0
|
||||
app.kubernetes.io/name: constellation-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
data:
|
||||
controller_manager_config.yaml: |
|
||||
apiVersion: controller-runtime.sigs.k8s.io/v1alpha1
|
||||
health:
|
||||
healthProbeBindAddress: ":8081"
|
||||
kind: ControllerManagerConfig
|
||||
leaderElection:
|
||||
leaderElect: true
|
||||
resourceName: "38cc1645.edgeless.systems"
|
||||
metrics:
|
||||
bindAddress: "127.0.0.1:8080"
|
||||
webhook:
|
||||
port: 9443
|
||||
|
|
@ -0,0 +1,222 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: constellation-operator-manager-role
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
helm.sh/chart: constellation-operator-0.0.0
|
||||
app.kubernetes.io/name: constellation-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes/status
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- nodemaintenance.medik8s.io
|
||||
resources:
|
||||
- nodemaintenances
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- update.edgeless.systems
|
||||
resources:
|
||||
- autoscalingstrategies
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- update.edgeless.systems
|
||||
resources:
|
||||
- autoscalingstrategies/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- update.edgeless.systems
|
||||
resources:
|
||||
- autoscalingstrategies/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- update.edgeless.systems
|
||||
resources:
|
||||
- joiningnodes
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- update.edgeless.systems
|
||||
resources:
|
||||
- joiningnodes/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- update.edgeless.systems
|
||||
resources:
|
||||
- joiningnodes/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- update.edgeless.systems
|
||||
resources:
|
||||
- nodeversion
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- update.edgeless.systems
|
||||
resources:
|
||||
- nodeversion/status
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- update.edgeless.systems
|
||||
resources:
|
||||
- nodeversions
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- update.edgeless.systems
|
||||
resources:
|
||||
- nodeversions/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- update.edgeless.systems
|
||||
resources:
|
||||
- nodeversions/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- update.edgeless.systems
|
||||
resources:
|
||||
- pendingnodes
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- update.edgeless.systems
|
||||
resources:
|
||||
- pendingnodes/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- update.edgeless.systems
|
||||
resources:
|
||||
- pendingnodes/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- update.edgeless.systems
|
||||
resources:
|
||||
- scalinggroups
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- update.edgeless.systems
|
||||
resources:
|
||||
- scalinggroups/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- update.edgeless.systems
|
||||
resources:
|
||||
- scalinggroups/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: constellation-operator-manager-rolebinding
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
helm.sh/chart: constellation-operator-0.0.0
|
||||
app.kubernetes.io/name: constellation-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: 'constellation-operator-manager-role'
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: 'constellation-operator-controller-manager'
|
||||
namespace: 'testNamespace'
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: constellation-operator-metrics-reader
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
helm.sh/chart: constellation-operator-0.0.0
|
||||
app.kubernetes.io/name: constellation-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
rules:
|
||||
- nonResourceURLs:
|
||||
- /metrics
|
||||
verbs:
|
||||
- get
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: constellation-operator-controller-manager-metrics-service
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
helm.sh/chart: constellation-operator-0.0.0
|
||||
app.kubernetes.io/name: constellation-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
control-plane: controller-manager
|
||||
app.kubernetes.io/name: constellation-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
ports:
|
||||
- name: https
|
||||
port: 8443
|
||||
protocol: TCP
|
||||
targetPort: https
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: constellation-operator-proxy-role
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
helm.sh/chart: constellation-operator-0.0.0
|
||||
app.kubernetes.io/name: constellation-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
rules:
|
||||
- apiGroups:
|
||||
- authentication.k8s.io
|
||||
resources:
|
||||
- tokenreviews
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- authorization.k8s.io
|
||||
resources:
|
||||
- subjectaccessreviews
|
||||
verbs:
|
||||
- create
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: constellation-operator-proxy-rolebinding
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
helm.sh/chart: constellation-operator-0.0.0
|
||||
app.kubernetes.io/name: constellation-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: 'constellation-operator-proxy-role'
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: 'constellation-operator-controller-manager'
|
||||
namespace: 'testNamespace'
|
||||
|
|
@ -0,0 +1,112 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: node-maintenance-operator-controller-manager
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
node-maintenance-operator: ""
|
||||
helm.sh/chart: node-maintenance-operator-0.0.0
|
||||
app.kubernetes.io/name: node-maintenance-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: node-maintenance-operator-controller-manager
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
node-maintenance-operator: ""
|
||||
helm.sh/chart: node-maintenance-operator-0.0.0
|
||||
app.kubernetes.io/name: node-maintenance-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
control-plane: controller-manager
|
||||
node-maintenance-operator: ""
|
||||
app.kubernetes.io/name: node-maintenance-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
node-maintenance-operator: ""
|
||||
app.kubernetes.io/name: node-maintenance-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
annotations:
|
||||
kubectl.kubernetes.io/default-container: manager
|
||||
spec:
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: node-role.kubernetes.io/master
|
||||
operator: Exists
|
||||
- matchExpressions:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
containers:
|
||||
- args:
|
||||
- --health-probe-bind-address=:8081
|
||||
- --metrics-bind-address=:8080
|
||||
- --leader-elect
|
||||
command:
|
||||
- /manager
|
||||
env:
|
||||
- name: OPERATOR_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: KUBERNETES_CLUSTER_DOMAIN
|
||||
value: cluster.local
|
||||
image: nodeMaintenanceOperatorImage
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8081
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
name: manager
|
||||
ports:
|
||||
- containerPort: 9443
|
||||
name: webhook-server
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 8081
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
resources:
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 100Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 20Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
volumeMounts:
|
||||
- mountPath: /tmp/k8s-webhook-server/serving-certs
|
||||
name: cert
|
||||
readOnly: true
|
||||
priorityClassName: system-cluster-critical
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
serviceAccountName: node-maintenance-operator-controller-manager
|
||||
terminationGracePeriodSeconds: 10
|
||||
tolerations:
|
||||
- effect: NoSchedule
|
||||
key: node-role.kubernetes.io/master
|
||||
- effect: NoSchedule
|
||||
key: node-role.kubernetes.io/control-plane
|
||||
volumes:
|
||||
- name: cert
|
||||
secret:
|
||||
defaultMode: 420
|
||||
secretName: webhook-server-cert
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: node-maintenance-operator-leader-election-role
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
node-maintenance-operator: ""
|
||||
helm.sh/chart: node-maintenance-operator-0.0.0
|
||||
app.kubernetes.io/name: node-maintenance-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: node-maintenance-operator-leader-election-rolebinding
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
node-maintenance-operator: ""
|
||||
helm.sh/chart: node-maintenance-operator-0.0.0
|
||||
app.kubernetes.io/name: node-maintenance-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: 'node-maintenance-operator-leader-election-role'
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: 'node-maintenance-operator-controller-manager'
|
||||
namespace: 'testNamespace'
|
||||
|
|
@ -0,0 +1,131 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-maintenance-operator-manager-role
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
node-maintenance-operator: ""
|
||||
helm.sh/chart: node-maintenance-operator-0.0.0
|
||||
app.kubernetes.io/name: node-maintenance-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods/eviction
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- daemonsets
|
||||
- deployments
|
||||
- replicasets
|
||||
- statefulsets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- monitoring.coreos.com
|
||||
resources:
|
||||
- servicemonitors
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- apiGroups:
|
||||
- nodemaintenance.medik8s.io
|
||||
resources:
|
||||
- nodemaintenances
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- nodemaintenance.medik8s.io
|
||||
resources:
|
||||
- nodemaintenances/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- nodemaintenance.medik8s.io
|
||||
resources:
|
||||
- nodemaintenances/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- oauth.openshift.io
|
||||
resources:
|
||||
- '*'
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- policy
|
||||
resources:
|
||||
- poddisruptionbudgets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: node-maintenance-operator-manager-rolebinding
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
node-maintenance-operator: ""
|
||||
helm.sh/chart: node-maintenance-operator-0.0.0
|
||||
app.kubernetes.io/name: node-maintenance-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: 'node-maintenance-operator-manager-role'
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: 'node-maintenance-operator-controller-manager'
|
||||
namespace: 'testNamespace'
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-maintenance-operator-metrics-reader
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
node-maintenance-operator: ""
|
||||
helm.sh/chart: node-maintenance-operator-0.0.0
|
||||
app.kubernetes.io/name: node-maintenance-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
rules:
|
||||
- nonResourceURLs:
|
||||
- /metrics
|
||||
verbs:
|
||||
- get
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: node-maintenance-operator-controller-manager-metrics-service
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
node-maintenance-operator: ""
|
||||
helm.sh/chart: node-maintenance-operator-0.0.0
|
||||
app.kubernetes.io/name: node-maintenance-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
control-plane: controller-manager
|
||||
node-maintenance-operator: ""
|
||||
app.kubernetes.io/name: node-maintenance-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
ports:
|
||||
- name: https
|
||||
port: 8443
|
||||
protocol: TCP
|
||||
targetPort: https
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-maintenance-operator-proxy-role
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
node-maintenance-operator: ""
|
||||
helm.sh/chart: node-maintenance-operator-0.0.0
|
||||
app.kubernetes.io/name: node-maintenance-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
rules:
|
||||
- apiGroups:
|
||||
- authentication.k8s.io
|
||||
resources:
|
||||
- tokenreviews
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- authorization.k8s.io
|
||||
resources:
|
||||
- subjectaccessreviews
|
||||
verbs:
|
||||
- create
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: node-maintenance-operator-proxy-rolebinding
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
node-maintenance-operator: ""
|
||||
helm.sh/chart: node-maintenance-operator-0.0.0
|
||||
app.kubernetes.io/name: node-maintenance-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: 'node-maintenance-operator-proxy-role'
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: 'node-maintenance-operator-controller-manager'
|
||||
namespace: 'testNamespace'
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: node-maintenance-operator-selfsigned-issuer
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
helm.sh/chart: node-maintenance-operator-0.0.0
|
||||
app.kubernetes.io/name: node-maintenance-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
selfSigned: {}
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: node-maintenance-operator-serving-cert
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
helm.sh/chart: node-maintenance-operator-0.0.0
|
||||
app.kubernetes.io/name: node-maintenance-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
dnsNames:
|
||||
- 'node-maintenance-operator-webhook-service.testNamespace.svc'
|
||||
- 'node-maintenance-operator-webhook-service.testNamespace.svc.cluster.local'
|
||||
issuerRef:
|
||||
kind: Issuer
|
||||
name: node-maintenance-operator-selfsigned-issuer
|
||||
secretName: webhook-server-cert
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: node-maintenance-operator-validating-webhook-configuration
|
||||
namespace: testNamespace
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: testNamespace/node-maintenance-operator-serving-cert
|
||||
labels:
|
||||
helm.sh/chart: node-maintenance-operator-0.0.0
|
||||
app.kubernetes.io/name: node-maintenance-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
service:
|
||||
name: node-maintenance-operator-webhook-service
|
||||
namespace: testNamespace
|
||||
path: /validate-nodemaintenance-medik8s-io-v1beta1-nodemaintenance
|
||||
failurePolicy: Fail
|
||||
name: vnodemaintenance.kb.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- nodemaintenance.medik8s.io
|
||||
apiVersions:
|
||||
- v1beta1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- nodemaintenances
|
||||
sideEffects: None
|
||||
timeoutSeconds: 15
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: node-maintenance-operator-webhook-service
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
node-maintenance-operator: ""
|
||||
helm.sh/chart: node-maintenance-operator-0.0.0
|
||||
app.kubernetes.io/name: node-maintenance-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
control-plane: controller-manager
|
||||
node-maintenance-operator: ""
|
||||
app.kubernetes.io/name: node-maintenance-operator
|
||||
app.kubernetes.io/instance: testRelease
|
||||
ports:
|
||||
- port: 443
|
||||
protocol: TCP
|
||||
targetPort: 9443
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: join-service
|
||||
name: join-service
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- create
|
||||
- update
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- roles
|
||||
- rolebindings
|
||||
verbs:
|
||||
- create
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
- apiGroups:
|
||||
- "update.edgeless.systems"
|
||||
resources:
|
||||
- joiningnodes
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- "update.edgeless.systems"
|
||||
resources:
|
||||
- nodeversions
|
||||
verbs:
|
||||
- get
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: join-service
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: join-service
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: join-service
|
||||
namespace: testNamespace
|
||||
67
internal/helm/testdata/QEMU/constellation-services/charts/join-service/templates/daemonset.yaml
vendored
Normal file
67
internal/helm/testdata/QEMU/constellation-services/charts/join-service/templates/daemonset.yaml
vendored
Normal file
|
|
@ -0,0 +1,67 @@
|
|||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: join-service
|
||||
namespace: testNamespace
|
||||
labels:
|
||||
component: join-service
|
||||
k8s-app: join-service
|
||||
kubernetes.io/cluster-service: "true"
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
k8s-app: join-service
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: join-service
|
||||
spec:
|
||||
priorityClassName: system-cluster-critical
|
||||
serviceAccountName: join-service
|
||||
tolerations:
|
||||
- key: CriticalAddonsOnly
|
||||
operator: Exists
|
||||
- effect: NoSchedule
|
||||
key: node-role.kubernetes.io/master
|
||||
operator: Exists
|
||||
- effect: NoSchedule
|
||||
key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
- effect: NoExecute
|
||||
operator: Exists
|
||||
- effect: NoSchedule
|
||||
operator: Exists
|
||||
nodeSelector:
|
||||
node-role.kubernetes.io/control-plane: ""
|
||||
containers:
|
||||
- name: join-service
|
||||
image: joinServiceImage
|
||||
args:
|
||||
- --cloud-provider=QEMU
|
||||
- --key-service-endpoint=key-service.testNamespace:9000
|
||||
- --attestation-variant=qemu-vtpm
|
||||
volumeMounts:
|
||||
- mountPath: /var/config
|
||||
name: config
|
||||
readOnly: true
|
||||
- mountPath: /etc/kubernetes
|
||||
name: kubeadm
|
||||
readOnly: true
|
||||
ports:
|
||||
- containerPort: 9090
|
||||
name: tcp
|
||||
resources: {}
|
||||
securityContext:
|
||||
privileged: true
|
||||
volumes:
|
||||
- name: config
|
||||
projected:
|
||||
sources:
|
||||
- configMap:
|
||||
name: join-config
|
||||
- configMap:
|
||||
name: internal-config
|
||||
- name: kubeadm
|
||||
hostPath:
|
||||
path: /etc/kubernetes
|
||||
updateStrategy: {}
|
||||
17
internal/helm/testdata/QEMU/constellation-services/charts/join-service/templates/service.yaml
vendored
Normal file
17
internal/helm/testdata/QEMU/constellation-services/charts/join-service/templates/service.yaml
vendored
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: join-service
|
||||
namespace: testNamespace
|
||||
spec:
|
||||
type: NodePort
|
||||
selector:
|
||||
k8s-app: join-service
|
||||
ports:
|
||||
- name: grpc
|
||||
protocol: TCP
|
||||
port: 9090
|
||||
targetPort: 9090
|
||||
nodePort: 30090
|
||||
status:
|
||||
loadBalancer: {}
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: join-service
|
||||
namespace: testNamespace
|
||||
13
internal/helm/testdata/QEMU/constellation-services/charts/key-service/templates/clusterrole.yaml
vendored
Normal file
13
internal/helm/testdata/QEMU/constellation-services/charts/key-service/templates/clusterrole.yaml
vendored
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: key-service
|
||||
name: key-service
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: key-service
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: key-service
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: key-service
|
||||
namespace: testNamespace
|
||||
57
internal/helm/testdata/QEMU/constellation-services/charts/key-service/templates/daemonset.yaml
vendored
Normal file
57
internal/helm/testdata/QEMU/constellation-services/charts/key-service/templates/daemonset.yaml
vendored
Normal file
|
|
@ -0,0 +1,57 @@
|
|||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
labels:
|
||||
component: key-service
|
||||
k8s-app: key-service
|
||||
kubernetes.io/cluster-service: "true"
|
||||
name: key-service
|
||||
namespace: testNamespace
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
k8s-app: key-service
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: key-service
|
||||
spec:
|
||||
containers:
|
||||
- name: key-service
|
||||
image: keyServiceImage
|
||||
args:
|
||||
- --port=9000
|
||||
volumeMounts:
|
||||
- mountPath: /var/config
|
||||
name: config
|
||||
readOnly: true
|
||||
resources: {}
|
||||
nodeSelector:
|
||||
node-role.kubernetes.io/control-plane: ""
|
||||
priorityClassName: system-cluster-critical
|
||||
serviceAccountName: key-service
|
||||
tolerations:
|
||||
- key: CriticalAddonsOnly
|
||||
operator: Exists
|
||||
- effect: NoSchedule
|
||||
key: node-role.kubernetes.io/master
|
||||
operator: Exists
|
||||
- effect: NoSchedule
|
||||
key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
- effect: NoExecute
|
||||
operator: Exists
|
||||
- effect: NoSchedule
|
||||
operator: Exists
|
||||
volumes:
|
||||
- name: config
|
||||
projected:
|
||||
sources:
|
||||
- secret:
|
||||
items:
|
||||
- key: mastersecret
|
||||
path: mastersecret
|
||||
- key: salt
|
||||
path: salt
|
||||
name: constellation-mastersecret
|
||||
updateStrategy: {}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
apiVersion: v1
|
||||
kind: Secret
|
||||
type: Opaque
|
||||
immutable: true
|
||||
metadata:
|
||||
name: constellation-mastersecret
|
||||
namespace: testNamespace
|
||||
data:
|
||||
mastersecret: YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWE=
|
||||
salt: YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWE=
|
||||
16
internal/helm/testdata/QEMU/constellation-services/charts/key-service/templates/service.yaml
vendored
Normal file
16
internal/helm/testdata/QEMU/constellation-services/charts/key-service/templates/service.yaml
vendored
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: key-service
|
||||
namespace: testNamespace
|
||||
spec:
|
||||
ports:
|
||||
- name: grpc
|
||||
port: 9000
|
||||
protocol: TCP
|
||||
targetPort: 9000
|
||||
selector:
|
||||
k8s-app: key-service
|
||||
type: ClusterIP
|
||||
status:
|
||||
loadBalancer: {}
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: key-service
|
||||
namespace: testNamespace
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
addonmanager.kubernetes.io/mode: Reconcile
|
||||
kubernetes.io/cluster-service: "true"
|
||||
name: system:konnectivity-server
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: system:auth-delegator
|
||||
subjects:
|
||||
- apiGroup: rbac.authorization.k8s.io
|
||||
kind: User
|
||||
name: system:konnectivity-server
|
||||
76
internal/helm/testdata/QEMU/constellation-services/charts/konnectivity/templates/daemonset.yaml
vendored
Normal file
76
internal/helm/testdata/QEMU/constellation-services/charts/konnectivity/templates/daemonset.yaml
vendored
Normal file
|
|
@ -0,0 +1,76 @@
|
|||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
labels:
|
||||
addonmanager.kubernetes.io/mode: Reconcile
|
||||
k8s-app: konnectivity-agent
|
||||
name: konnectivity-agent
|
||||
namespace: testNamespace
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
k8s-app: konnectivity-agent
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: konnectivity-agent
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- --logtostderr=true
|
||||
- --proxy-server-host=127.0.0.1
|
||||
- --ca-cert=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||
- --proxy-server-port=8132
|
||||
- --admin-server-port=8133
|
||||
- --health-server-port=8134
|
||||
- --service-account-token-path=/var/run/secrets/tokens/konnectivity-agent-token
|
||||
- --agent-identifiers=host=$(HOST_IP)
|
||||
- --sync-forever=true
|
||||
- --keepalive-time=60m
|
||||
- --sync-interval=5s
|
||||
- --sync-interval-cap=30s
|
||||
- --probe-interval=5s
|
||||
- --v=3
|
||||
command:
|
||||
- /proxy-agent
|
||||
env:
|
||||
- name: HOST_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: status.hostIP
|
||||
image: konnectivityImage
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8134
|
||||
initialDelaySeconds: 15
|
||||
timeoutSeconds: 15
|
||||
name: konnectivity-agent
|
||||
resources: {}
|
||||
volumeMounts:
|
||||
- mountPath: /var/run/secrets/tokens
|
||||
name: konnectivity-agent-token
|
||||
readOnly: true
|
||||
priorityClassName: system-cluster-critical
|
||||
serviceAccountName: konnectivity-agent
|
||||
tolerations:
|
||||
- effect: NoSchedule
|
||||
key: node-role.kubernetes.io/master
|
||||
operator: Exists
|
||||
- effect: NoSchedule
|
||||
key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
- key: CriticalAddonsOnly
|
||||
operator: Exists
|
||||
- effect: NoExecute
|
||||
key: node.kubernetes.io/not-ready
|
||||
operator: Exists
|
||||
volumes:
|
||||
- name: konnectivity-agent-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
audience: system:konnectivity-server
|
||||
path: konnectivity-agent-token
|
||||
updateStrategy: {}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
addonmanager.kubernetes.io/mode: Reconcile
|
||||
kubernetes.io/cluster-service: "true"
|
||||
name: konnectivity-agent
|
||||
namespace: testNamespace
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
labels:
|
||||
component: verification-service
|
||||
k8s-app: verification-service
|
||||
name: verification-service
|
||||
namespace: testNamespace
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
k8s-app: verification-service
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: verification-service
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- --attestation-variant=qemu-vtpm
|
||||
image: verificationImage
|
||||
name: verification-service
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
- containerPort: 9090
|
||||
name: grpc
|
||||
resources: {}
|
||||
securityContext:
|
||||
privileged: true
|
||||
volumeMounts:
|
||||
- mountPath: /sys/kernel/security/
|
||||
name: event-log
|
||||
readOnly: true
|
||||
tolerations:
|
||||
- effect: NoSchedule
|
||||
key: node-role.kubernetes.io/master
|
||||
operator: Equal
|
||||
value: "true"
|
||||
- effect: NoSchedule
|
||||
key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
- effect: NoExecute
|
||||
operator: Exists
|
||||
- effect: NoSchedule
|
||||
operator: Exists
|
||||
volumes:
|
||||
- hostPath:
|
||||
path: /sys/kernel/security/
|
||||
name: event-log
|
||||
updateStrategy: {}
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: verify
|
||||
namespace: testNamespace
|
||||
spec:
|
||||
allocateLoadBalancerNodePorts: false
|
||||
externalIPs:
|
||||
- 127.0.0.1
|
||||
loadBalancerClass: constellation
|
||||
ports:
|
||||
- name: grpc
|
||||
port: 30081
|
||||
protocol: TCP
|
||||
targetPort: 9090
|
||||
selector:
|
||||
k8s-app: verification-service
|
||||
type: LoadBalancer
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: verification-service
|
||||
namespace: testNamespace
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
nodePort: 30080
|
||||
port: 8080
|
||||
protocol: TCP
|
||||
targetPort: 8080
|
||||
- name: grpc
|
||||
nodePort: 30081
|
||||
port: 9090
|
||||
protocol: TCP
|
||||
targetPort: 9090
|
||||
selector:
|
||||
k8s-app: verification-service
|
||||
type: NodePort
|
||||
0
internal/helm/testdata/QEMU/constellation-services/templates/.gitkeep
vendored
Normal file
0
internal/helm/testdata/QEMU/constellation-services/templates/.gitkeep
vendored
Normal file
Loading…
Add table
Add a link
Reference in a new issue