Various fixes to installer

chart/searchlight/templates/_helpers.tpl

@@ -29,3 +29,10 @@ Create the name of the service account to use
     {{ default "default" .Values.serviceAccount.name }}
 {{- end -}}
 {{- end -}}
+
+{{- define "searchlight.labels" -}}
+chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+app: "{{ template "searchlight.name" . }}"
+release: {{ .Release.Name | quote}}
+heritage: "{{ .Release.Service }}"
+{{- end -}}

chart/searchlight/templates/apiregistration.yaml

@@ -8,10 +8,7 @@ kind: APIService
 metadata:
   name: v1alpha1.admission.monitoring.appscode.com
   labels:
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    app: "{{ template "searchlight.name" . }}"
-    heritage: "{{ .Release.Service }}"
-    release: "{{ .Release.Name }}"
+    {{- include "searchlight.labels" . | nindent 4 }}
 spec:
   group: admission.monitoring.appscode.com
   version: v1alpha1
@@ -27,10 +24,7 @@ kind: APIService
 metadata:
   name: v1alpha1.incidents.monitoring.appscode.com
   labels:
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    app: "{{ template "searchlight.name" . }}"
-    heritage: "{{ .Release.Service }}"
-    release: "{{ .Release.Name }}"
+    {{- include "searchlight.labels" . | nindent 4 }}
 spec:
   group: incidents.monitoring.appscode.com
   version: v1alpha1
@@ -47,10 +41,7 @@ metadata:
   name: {{ template "searchlight.fullname" . }}-apiserver-cert
   namespace: {{ .Release.Namespace }}
   labels:
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    app: "{{ template "searchlight.name" . }}"
-    heritage: "{{ .Release.Service }}"
-    release: "{{ .Release.Name }}"
+    {{- include "searchlight.labels" . | nindent 4 }}
 type: Opaque
 data:
   tls.crt: {{ b64enc $cert.Cert }}
@@ -61,13 +52,10 @@ data:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: {{ template "searchlight.fullname" . }}-apiserver-extension-server-authentication-reader
+  name: {{ template "searchlight.fullname" . }}-extension-server-authentication-reader
   namespace: kube-system
   labels:
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    app: "{{ template "searchlight.name" . }}"
-    heritage: "{{ .Release.Service }}"
-    release: "{{ .Release.Name }}"
+    {{- include "searchlight.labels" . | nindent 4 }}
 roleRef:
   kind: Role
   apiGroup: rbac.authorization.k8s.io
@@ -81,12 +69,9 @@ subjects:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ template "searchlight.fullname" . }}-apiserver-auth-delegator
+  name: {{ template "searchlight.fullname" . }}-auth-delegator
   labels:
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    app: "{{ template "searchlight.name" . }}"
-    heritage: "{{ .Release.Service }}"
-    release: "{{ .Release.Name }}"
+    {{- include "searchlight.labels" . | nindent 4 }}
 roleRef:
   kind: ClusterRole
   apiGroup: rbac.authorization.k8s.io

chart/searchlight/templates/cleaner.yaml

@@ -3,10 +3,7 @@ kind: Job
 metadata:
   name: {{ .Release.Name }}-cleaner
   labels:
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    app: "{{ template "searchlight.name" . }}"
-    heritage: "{{ .Release.Service }}"
-    release: "{{ .Release.Name }}"
+    {{- include "searchlight.labels" . | nindent 4 }}
   annotations:
     "helm.sh/hook": pre-delete
     "helm.sh/hook-delete-policy": hook-succeeded,hook-failed
@@ -22,10 +19,10 @@ spec:
       {{- end }}
       containers:
       - name: busybox
-        image: appscode/kubectl:v1.11
+        image: {{ .Values.cleaner.registry }}/{{ .Values.cleaner.repository }}:{{ .Values.cleaner.tag }}
         command:
           - sh
           - -c
           - "sleep 2; kubectl delete validatingwebhookconfigurations admission.monitoring.appscode.com || true"
-        imagePullPolicy: IfNotPresent
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
       restartPolicy: Never

chart/searchlight/templates/cluster-role-binding.yaml

@@ -4,10 +4,7 @@ kind: ClusterRoleBinding
 metadata:
   name: {{ template "searchlight.fullname" . }}
   labels:
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    app: "{{ template "searchlight.name" . }}"
-    heritage: "{{ .Release.Service }}"
-    release: "{{ .Release.Name }}"
+    {{- include "searchlight.labels" . | nindent 4 }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole

chart/searchlight/templates/cluster-role.yaml

@@ -4,16 +4,18 @@ kind: ClusterRole
 metadata:
   name: {{ template "searchlight.fullname" . }}
   labels:
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    app: "{{ template "searchlight.name" . }}"
-    heritage: "{{ .Release.Service }}"
-    release: "{{ .Release.Name }}"
+    {{- include "searchlight.labels" . | nindent 4 }}
 rules:
 - apiGroups:
   - apiextensions.k8s.io
   resources:
   - customresourcedefinitions
   verbs: ["*"]
+- apiGroups:
+  - apiregistration.k8s.io
+  resources:
+  - apiservices
+  verbs: ["get", "patch"]
 - apiGroups:
   - admissionregistration.k8s.io
   resources:
@@ -54,4 +56,9 @@ rules:
   resources:
   - events
   verbs: ["create", "list"]
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs: ["get"]
 {{ end }}

chart/searchlight/templates/deployment.yaml

@@ -7,10 +7,7 @@ metadata:
   name: {{ template "searchlight.fullname" . }}
   namespace: {{ .Release.Namespace }}
   labels:
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    app: "{{ template "searchlight.name" . }}"
-    heritage: "{{ .Release.Service }}"
-    release: "{{ .Release.Name }}"
+    {{- include "searchlight.labels" . | nindent 4 }}
 {{- if .Values.annotations }}
   annotations:
 {{ toYaml .Values.annotations | indent 4 }}
@@ -24,11 +21,15 @@ spec:
   template:
     metadata:
       labels:
-        app: "{{ template "searchlight.name" . }}"
-        release: "{{ .Release.Name }}"
-{{- if and .Values.criticalAddon (eq .Release.Namespace "kube-system") }}
+        {{- include "searchlight.labels" . | nindent 8 }}
+{{- if or .Values.annotations (and .Values.criticalAddon (eq .Release.Namespace "kube-system")) }}
       annotations:
+{{- if and .Values.criticalAddon (eq .Release.Namespace "kube-system") }}
         scheduler.alpha.kubernetes.io/critical-pod: ''
+{{- end }}
+{{- if .Values.annotations }}
+{{ toYaml .Values.annotations | indent 8 }}
+{{- end }}
 {{- end }}
     spec:
       serviceAccountName: {{ template "searchlight.serviceAccountName" . }}

chart/searchlight/templates/service-account.yaml

@@ -5,8 +5,5 @@ metadata:
   name: {{ template "searchlight.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
   labels:
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    app: "{{ template "searchlight.name" . }}"
-    heritage: "{{ .Release.Service }}"
-    release: "{{ .Release.Name }}"
+    {{- include "searchlight.labels" . | nindent 4 }}
 {{ end }}

chart/searchlight/values.yaml

@@ -17,6 +17,11 @@ icinga:
   repository: icinga
   tag: 7.0.0-k8s
 
+cleaner:
+  registry: appscode
+  repository: kubectl
+  tag: v1.12
+
 ## Optionally specify an array of imagePullSecrets.
 ## Secrets must be manually created in the namespace.
 ## ref: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod

hack/deploy/operator.yaml

@@ -100,7 +100,7 @@ spec:
       tolerations:
       - key: CriticalAddonsOnly
         operator: Exists
-      priorityClassName: system-cluster-critical
+      priorityClassName: ${SEARCHLIGHT_PRIORITY_CLASS}
 ---
 # kube lacks the service serving cert signer, so provide a manual secret for it
 apiVersion: v1

hack/deploy/searchlight.sh

@@ -121,6 +121,7 @@ export SEARCHLIGHT_ENABLE_ANALYTICS=true
 export SEARCHLIGHT_UNINSTALL=0
 export SEARCHLIGHT_PURGE=0
 export SEARCHLIGHT_ENABLE_STATUS_SUBRESOURCE=false
+export SEARCHLIGHT_PRIORITY_CLASS=system-cluster-critical
 
 export SCRIPT_LOCATION="curl -fsSL https://raw.githubusercontent.com/appscode/searchlight/7.0.0/"
 if [[ "$APPSCODE_ENV" == "dev" ]]; then
@@ -238,6 +239,10 @@ while test $# -gt 0; do
   esac
 done
 
+if [ "$SEARCHLIGHT_NAMESPACE" != "kube-system" ]; then
+    export SEARCHLIGHT_PRIORITY_CLASS=""
+fi
+
 if [ "$SEARCHLIGHT_UNINSTALL" -eq 1 ]; then
   # delete webhooks and apiservices
   kubectl delete validatingwebhookconfiguration -l app=searchlight || true