diff --git a/CHANGELOG.md b/CHANGELOG.md index 968c8cac3b..fd36cb6274 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -79,11 +79,11 @@ (PR[#3709](https://github.com/scality/metalk8s/pull/3709)) - Bump MetalLB chart version to - [2.6.2](https://artifacthub.io/packages/helm/bitnami/metallb/2.6.2) + [3.0.6](https://artifacthub.io/packages/helm/bitnami/metallb/3.0.6) The following images have also been bumped accordingly: - - metallb-controller to [0.11.0-debian-10-r73](https://github.com/bitnami/bitnami-docker-metallb-controller/releases/tag/0.11.0-debian-10-r73) - - metallb-speaker to [0.11.0-debian-10-r74](https://github.com/bitnami/bitnami-docker-metallb-speaker/releases/tag/0.11.0-debian-10-r74) - (PR[#3706](https://github.com/scality/metalk8s/pull/3706)) + - metallb-controller to [0.12.1-debian-10-r89](https://github.com/bitnami/bitnami-docker-metallb-controller/releases/tag/0.12.1-debian-10-r89) + - metallb-speaker to [0.12.1-debian-10-r90](https://github.com/bitnami/bitnami-docker-metallb-speaker/releases/tag/0.12.1-debian-10-r90) + (PR[#3777](https://github.com/scality/metalk8s/pull/3777)) - Bump nginx image to [1.21.6-alpine](https://github.com/nginx/nginx/releases/tag/release-1.21.6) (PR[#3710](https://github.com/scality/metalk8s/pull/3710)) diff --git a/buildchain/buildchain/versions.py b/buildchain/buildchain/versions.py index cdf7eed53f..7b6781fb0e 100644 --- a/buildchain/buildchain/versions.py +++ b/buildchain/buildchain/versions.py @@ -178,13 +178,13 @@ def _version_prefix(version: str, prefix: str = "v") -> str: ), Image( name="metallb-controller", - version="0.11.0-debian-10-r73", - digest="sha256:1232e5bc208d54e833713cac3c944279e46b467c3b67854de01edd07d5e6b888", + version="0.12.1-debian-10-r89", + digest="sha256:c3507509ac706896e89dd63b8db6565b90d7ac806801122d7a3df652c92b2ac9", ), Image( name="metallb-speaker", - version="0.11.0-debian-10-r74", - digest="sha256:3a582fc7f3851b4873a83109fd6b8fcf48b69e2d78b40c086a2ac7582ceda58c", + version="0.12.1-debian-10-r90", + digest="sha256:3c7f7c2e28fc7d7cc27f9f104c1e6450a1905d78df27cf380e81393c4a2ebd1e", ), Image( name="pause", diff --git a/charts/metallb/Chart.lock b/charts/metallb/Chart.lock index ff4f260a15..b0f84d23b2 100644 --- a/charts/metallb/Chart.lock +++ b/charts/metallb/Chart.lock @@ -1,6 +1,6 @@ dependencies: - name: common repository: https://charts.bitnami.com/bitnami - version: 1.10.3 -digest: sha256:710e8247ae70ea63a2fb2fde4320511ff28c7b5c7a738861427f104a7718bdf4 -generated: "2021-12-16T11:44:57.075524208Z" + version: 1.14.1 +digest: sha256:c69621f97b90b8c2e909293fbc475f0a3b0aaa4aa04de5df3e5d7a1974e5d735 +generated: "2022-05-21T17:32:08.376005281Z" diff --git a/charts/metallb/Chart.yaml b/charts/metallb/Chart.yaml index 512163cadb..fa1ea0f97e 100644 --- a/charts/metallb/Chart.yaml +++ b/charts/metallb/Chart.yaml @@ -1,14 +1,15 @@ annotations: category: Infrastructure apiVersion: v2 -appVersion: 0.11.0 +appVersion: 0.12.1 dependencies: - name: common repository: https://charts.bitnami.com/bitnami tags: - bitnami-common version: 1.x.x -description: The Metal LB for Kubernetes +description: MetalLB is a load-balancer implementation for bare metal Kubernetes clusters, + using standard routing protocols. home: https://github.com/bitnami/charts/tree/master/bitnami/metallb icon: https://bitnami.com/assets/stacks/metallb-speaker/img/metallb-speaker-stack-220x234.png keywords: @@ -29,4 +30,4 @@ sources: - https://github.com/metallb/metallb - https://github.com/bitnami/bitnami-docker-metallb - https://metallb.universe.tf -version: 2.6.2 +version: 3.0.6 diff --git a/charts/metallb/README.md b/charts/metallb/README.md index aadee610f9..640ababfea 100644 --- a/charts/metallb/README.md +++ b/charts/metallb/README.md @@ -1,9 +1,13 @@ -# MetalLB +# MetalLB packaged by Bitnami -[MetalLB](https://metallb.universe.tf/faq/) is an open source, rock solid LoadBalancer. It handles the `ServiceType: Loadbalancer`. +MetalLB is a load-balancer implementation for bare metal Kubernetes clusters, using standard routing protocols. +[Overview of MetalLB](https://metallb.universe.tf/) + +Trademarks: This software listing is packaged by Bitnami. The respective trademarks mentioned in the offering are owned by the respective companies, and use of them does not imply any affiliation or endorsement. + ## TL;DR ```console @@ -59,13 +63,17 @@ The command removes all the Kubernetes components associated with the chart and ### Common parameters -| Name | Description | Value | -| ------------------- | -------------------------------------------------------------------------------------- | ----- | -| `nameOverride` | String to partially override metallb.fullname include (will maintain the release name) | `""` | -| `fullnameOverride` | String to fully override metallb.fullname template | `""` | -| `commonLabels` | Add labels to all the deployed resources | `{}` | -| `commonAnnotations` | Add annotations to all the deployed resources | `{}` | -| `extraDeploy` | Array of extra objects to deploy with the release | `[]` | +| Name | Description | Value | +| ------------------------ | --------------------------------------------------------------------------------------- | -------------- | +| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` | +| `nameOverride` | String to partially override metallb.fullname include (will maintain the release name) | `""` | +| `fullnameOverride` | String to fully override metallb.fullname template | `""` | +| `commonLabels` | Add labels to all the deployed resources | `{}` | +| `commonAnnotations` | Add annotations to all the deployed resources | `{}` | +| `extraDeploy` | Array of extra objects to deploy with the release | `[]` | +| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | +| `diagnosticMode.command` | Command to override all containers in the the deployment(s)/statefulset(s) | `["sleep"]` | +| `diagnosticMode.args` | Args to override all containers in the the deployment(s)/statefulset(s) | `["infinity"]` | ### MetalLB parameters @@ -84,112 +92,192 @@ The command removes all the Kubernetes components associated with the chart and ### Controller parameters -| Name | Description | Value | -| -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -| `controller.image.registry` | MetalLB Controller image registry | `docker.io` | -| `controller.image.repository` | MetalLB Controller image repository | `bitnami/metallb-controller` | -| `controller.image.tag` | MetalLB Controller image tag (immutable tags are recommended) | `0.11.0-debian-10-r73` | -| `controller.image.pullPolicy` | MetalLB Controller image pull policy | `IfNotPresent` | -| `controller.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `controller.hostAliases` | Deployment pod host aliases | `[]` | -| `controller.rbac.create` | create specifies whether to install and use RBAC rules. | `true` | -| `controller.psp.create` | Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later | `true` | -| `controller.priorityClassName` | Set pod priorityClassName | `""` | -| `controller.resources.limits` | The resources limits for the container | `{}` | -| `controller.resources.requests` | The requested resources for the container | `{}` | -| `controller.nodeSelector` | Node labels for controller pod assignment | `{}` | -| `controller.tolerations` | Tolerations for controller pod assignment | `[]` | -| `controller.affinity` | Affinity for controller pod assignment | `{}` | -| `controller.podAnnotations` | Controller Pod annotations | `{}` | -| `controller.podLabels` | Controller Pod labels | `{}` | -| `controller.podAffinityPreset` | Controller Pod affinitypreset. Allowed values: soft, hard | `""` | -| `controller.podAntiAffinityPreset` | Controller Pod anti affinitypreset. Allowed values: soft, hard | `soft` | -| `controller.nodeAffinityPreset.type` | Controller Pod Node affinity preset. Allowed values: soft, hard | `""` | -| `controller.nodeAffinityPreset.key` | Controller Pod Node affinity label key to match | `""` | -| `controller.nodeAffinityPreset.values` | Controller Pod Node affinity label values to match | `[]` | -| `controller.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | -| `controller.serviceAccount.name` | The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template | `""` | -| `controller.securityContext.enabled` | Enable pods' security context | `true` | -| `controller.securityContext.runAsNonRoot` | MetalLB Controller must runs as nonRoot. | `true` | -| `controller.securityContext.runAsUser` | User ID for the pods. | `1001` | -| `controller.securityContext.fsGroup` | Group ID for the pods. | `1001` | -| `controller.securityContext.allowPrivilegeEscalation` | This defines if privilegeEscalation is allowed on that container | `false` | -| `controller.securityContext.readOnlyRootFilesystem` | This defines if the container can read the root fs on the host | `true` | -| `controller.securityContext.capabilities.drop` | Drop capabilities for the securityContext | `[]` | -| `controller.revisionHistoryLimit` | Configure the revisionHistoryLimit of the Controller deployment | `3` | -| `controller.terminationGracePeriodSeconds` | Configure the grace time period for sig term | `0` | -| `controller.containerPort.metrics` | Configures the ports the MetalLB Controller listens on for metrics | `7472` | -| `controller.livenessProbe.enabled` | Enable livenessProbe | `true` | -| `controller.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `10` | -| `controller.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | -| `controller.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` | -| `controller.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` | -| `controller.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `controller.readinessProbe.enabled` | Enable readinessProbe | `true` | -| `controller.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `10` | -| `controller.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | -| `controller.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | -| `controller.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | -| `controller.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | -| `controller.prometheus.serviceMonitor.enabled` | Specify if a servicemonitor will be deployed for prometheus-operator | `false` | -| `controller.prometheus.serviceMonitor.jobLabel` | Specify the jobLabel to use for the prometheus-operator | `app.kubernetes.io/name` | -| `controller.prometheus.serviceMonitor.interval` | Scrape interval. If not set, the Prometheus default scrape interval is used | `""` | -| `controller.prometheus.serviceMonitor.metricRelabelings` | Specify additional relabeling of metrics | `[]` | -| `controller.prometheus.serviceMonitor.relabelings` | Specify general relabeling | `[]` | +| Name | Description | Value | +| -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | +| `controller.image.registry` | MetalLB Controller image registry | `docker.io` | +| `controller.image.repository` | MetalLB Controller image repository | `bitnami/metallb-controller` | +| `controller.image.tag` | MetalLB Controller image tag (immutable tags are recommended) | `0.12.1-debian-10-r59` | +| `controller.image.pullPolicy` | MetalLB Controller image pull policy | `IfNotPresent` | +| `controller.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | +| `controller.updateStrategy.type` | Metallb controller deployment strategy type. | `RollingUpdate` | +| `controller.hostAliases` | Deployment pod host aliases | `[]` | +| `controller.rbac.create` | create specifies whether to install and use RBAC rules. | `true` | +| `controller.psp.create` | Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later | `true` | +| `controller.priorityClassName` | Metallb controller pods' priorityClassName | `""` | +| `controller.schedulerName` | Name of the k8s scheduler (other than default) | `""` | +| `controller.terminationGracePeriodSeconds` | In seconds, time the given to the Metallb controller pod needs to terminate gracefully | `0` | +| `controller.topologySpreadConstraints` | Topology Spread Constraints for pod assignment | `[]` | +| `controller.resources.limits` | The resources limits for the container | `{}` | +| `controller.resources.requests` | The requested resources for the container | `{}` | +| `controller.nodeSelector` | Node labels for controller pod assignment | `{}` | +| `controller.tolerations` | Tolerations for controller pod assignment | `[]` | +| `controller.affinity` | Affinity for controller pod assignment | `{}` | +| `controller.podAnnotations` | Controller Pod annotations | `{}` | +| `controller.podLabels` | Controller Pod labels | `{}` | +| `controller.podAffinityPreset` | Controller Pod affinitypreset. Allowed values: soft, hard | `""` | +| `controller.podAntiAffinityPreset` | Controller Pod anti affinitypreset. Allowed values: soft, hard | `soft` | +| `controller.nodeAffinityPreset.type` | Controller Pod Node affinity preset. Allowed values: soft, hard | `""` | +| `controller.nodeAffinityPreset.key` | Controller Pod Node affinity label key to match | `""` | +| `controller.nodeAffinityPreset.values` | Controller Pod Node affinity label values to match | `[]` | +| `controller.podSecurityContext.enabled` | Enabled Metallb Controller pods' Security Context | `true` | +| `controller.podSecurityContext.fsGroup` | Set Metallb Controller pod's Security Context fsGroup | `1001` | +| `controller.containerSecurityContext.enabled` | Enabled Metallb Controller containers' Security Context | `true` | +| `controller.containerSecurityContext.runAsUser` | Set Metallb Controller containers' Security Context runAsUser | `1001` | +| `controller.containerSecurityContext.runAsNonRoot` | Set Metallb Controller container's Security Context runAsNonRoot | `true` | +| `controller.containerSecurityContext.allowPrivilegeEscalation` | Enables privilege Escalation context for the pod. | `false` | +| `controller.containerSecurityContext.readOnlyRootFilesystem` | Allows the pod to mount the RootFS as ReadOnly | `true` | +| `controller.containerSecurityContext.capabilities.drop` | Drop capabilities for the securityContext | `[]` | +| `controller.command` | Override default container command (useful when using custom images) | `[]` | +| `controller.args` | Override default container args (useful when using custom images) | `[]` | +| `controller.lifecycleHooks` | for the Metallb Controller container(s) to automate configuration before or after startup | `{}` | +| `controller.extraEnvVars` | Extra environment variable to pass to the running container. | `[]` | +| `controller.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for Metallb controller nodes | `""` | +| `controller.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for Metallb controller nodes | `""` | +| `controller.extraVolumes` | Optionally specify extra list of additional volumes for the Metallb controller pod(s) | `[]` | +| `controller.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Metallb controller container(s) | `[]` | +| `controller.sidecars` | Add additional sidecar containers to the Metallb Controller pod(s) | `[]` | +| `controller.initContainers` | Add additional init containers to the Metallb Controller pod(s) | `[]` | +| `controller.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `controller.serviceAccount.name` | Name of the service account to use. If not set and create is true, a name is generated using the fullname template. | `""` | +| `controller.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `controller.serviceAccount.annotations` | Annotations for service account. Evaluated as a template. Only used if `create` is `true`. | `{}` | +| `controller.revisionHistoryLimit` | Configure the revisionHistoryLimit of the Controller deployment | `3` | +| `controller.containerPorts.metrics` | Configures the ports the MetalLB Controller listens on for metrics | `7472` | +| `controller.livenessProbe.enabled` | Enable livenessProbe | `true` | +| `controller.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `10` | +| `controller.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `controller.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` | +| `controller.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` | +| `controller.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `controller.readinessProbe.enabled` | Enable readinessProbe | `true` | +| `controller.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `10` | +| `controller.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `controller.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `controller.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | +| `controller.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `controller.startupProbe.enabled` | Enable startupProbe | `false` | +| `controller.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `10` | +| `controller.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `controller.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `controller.startupProbe.failureThreshold` | Failure threshold for startupProbe | `3` | +| `controller.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `controller.customStartupProbe` | Custom liveness probe for the Web component | `{}` | +| `controller.customLivenessProbe` | Custom liveness probe for the Web component | `{}` | +| `controller.customReadinessProbe` | Custom readiness probe for the Web component | `{}` | + + +### Metallb controller Prometheus metrics export + +| Name | Description | Value | +| ----------------------------------------------------- | --------------------------------------------------------------------------- | ------------------------ | +| `controller.metrics.enabled` | Enable the export of Prometheus metrics | `false` | +| `controller.metrics.service.port` | Prometheus metrics service port | `7472` | +| `controller.metrics.service.annotations` | Annotations for the Prometheus Exporter service service | `{}` | +| `controller.metrics.serviceMonitor.enabled` | Specify if a servicemonitor will be deployed for prometheus-operator | `false` | +| `controller.metrics.serviceMonitor.namespace` | Namespace which Prometheus is running in | `""` | +| `controller.metrics.serviceMonitor.jobLabel` | Specify the jobLabel to use for the prometheus-operator | `app.kubernetes.io/name` | +| `controller.metrics.serviceMonitor.interval` | Scrape interval. If not set, the Prometheus default scrape interval is used | `""` | +| `controller.metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `""` | +| `controller.metrics.serviceMonitor.metricRelabelings` | Specify additional relabeling of metrics | `[]` | +| `controller.metrics.serviceMonitor.relabelings` | Specify general relabeling | `[]` | +| `controller.metrics.serviceMonitor.selector` | ServiceMonitor selector labels | `{}` | +| `controller.metrics.serviceMonitor.labels` | Extra labels for the ServiceMonitor | `{}` | +| `controller.metrics.serviceMonitor.honorLabels` | honorLabels chooses the metric's labels on collisions with target labels | `false` | ### Speaker parameters -| Name | Description | Value | -| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- | -| `speaker.image.registry` | MetalLB Speaker image registry | `docker.io` | -| `speaker.image.repository` | MetalLB Speaker image repository | `bitnami/metallb-speaker` | -| `speaker.image.tag` | MetalLB Speaker image tag (immutable tags are recommended) | `0.11.0-debian-10-r74` | -| `speaker.image.pullPolicy` | MetalLB Speaker image pull policy | `IfNotPresent` | -| `speaker.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `speaker.rbac.create` | create specifies whether to install and use RBAC rules. | `true` | -| `speaker.hostAliases` | Deployment pod host aliases | `[]` | -| `speaker.psp.create` | Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later | `true` | -| `speaker.priorityClassName` | Set pod priorityClassName. | `""` | -| `speaker.resources.limits` | The resources limits for the container | `{}` | -| `speaker.resources.requests` | The requested resources for the container | `{}` | -| `speaker.nodeSelector` | Node labels for speaker pod assignment | `{}` | -| `speaker.tolerations` | Tolerations for speaker pod assignment | `[]` | -| `speaker.affinity` | Affinity for speaker pod assignment | `{}` | -| `speaker.podAnnotations` | Speaker Pod annotations | `{}` | -| `speaker.podLabels` | Speaker Pod labels | `{}` | -| `speaker.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | -| `speaker.serviceAccount.name` | The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template | `""` | -| `speaker.daemonset.terminationGracePeriodSeconds` | Configure the grace time period for sig term | `2` | -| `speaker.daemonset.hostPorts.metrics` | HTTP Metrics Endpoint | `7472` | -| `speaker.secretName` | References a Secret name for the member secret outside of the helm chart | `""` | -| `speaker.secretKey` | References a Secret key the member secret outside of the helm chart | `""` | -| `speaker.secretValue` | Custom value for `speaker.secretKey` | `""` | -| `speaker.initContainers` | Extra initContainers to add to the daemonset | `[]` | -| `speaker.securityContext.enabled` | Enable pods' security context | `true` | -| `speaker.securityContext.runAsUser` | User ID for the pods. | `0` | -| `speaker.securityContext.allowPrivilegeEscalation` | Enables privilege Escalation context for the pod. | `false` | -| `speaker.securityContext.readOnlyRootFilesystem` | Allows the pod to mount the RootFS as ReadOnly | `true` | -| `speaker.securityContext.capabilities.drop` | Drop capabilities for the securityContext | `[]` | -| `speaker.securityContext.capabilities.add` | Add capabilities for the securityContext | `[]` | -| `speaker.extraEnvVars` | Extra environment variable to pass to the running container. | `[]` | -| `speaker.livenessProbe.enabled` | Enable livenessProbe | `true` | -| `speaker.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `10` | -| `speaker.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | -| `speaker.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` | -| `speaker.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` | -| `speaker.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `speaker.readinessProbe.enabled` | Enable readinessProbe | `true` | -| `speaker.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `10` | -| `speaker.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | -| `speaker.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | -| `speaker.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | -| `speaker.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | -| `speaker.prometheus.serviceMonitor.enabled` | Enable support for Prometheus Operator | `false` | -| `speaker.prometheus.serviceMonitor.jobLabel` | Job label for scrape target | `app.kubernetes.io/name` | -| `speaker.prometheus.serviceMonitor.interval` | Scrape interval. If not set, the Prometheus default scrape interval is used | `""` | -| `speaker.prometheus.serviceMonitor.metricRelabelings` | Specify additional relabeling of metrics | `[]` | -| `speaker.prometheus.serviceMonitor.relabelings` | Specify general relabeling | `[]` | +| Name | Description | Value | +| ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- | +| `speaker.image.registry` | MetalLB Speaker image registry | `docker.io` | +| `speaker.image.repository` | MetalLB Speaker image repository | `bitnami/metallb-speaker` | +| `speaker.image.tag` | MetalLB Speaker image tag (immutable tags are recommended) | `0.12.1-debian-10-r59` | +| `speaker.image.pullPolicy` | MetalLB Speaker image pull policy | `IfNotPresent` | +| `speaker.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | +| `speaker.updateStrategy.type` | Speaker daemonset strategy type | `RollingUpdate` | +| `speaker.rbac.create` | create specifies whether to install and use RBAC rules. | `true` | +| `speaker.hostAliases` | Deployment pod host aliases | `[]` | +| `speaker.psp.create` | Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later | `true` | +| `speaker.priorityClassName` | Speaker pods' priorityClassName | `""` | +| `speaker.terminationGracePeriodSeconds` | In seconds, time the given to the Speaker pod needs to terminate gracefully | `2` | +| `speaker.resources.limits` | The resources limits for the container | `{}` | +| `speaker.resources.requests` | The requested resources for the container | `{}` | +| `speaker.nodeSelector` | Node labels for speaker pod assignment | `{}` | +| `speaker.tolerations` | Tolerations for speaker pod assignment | `[]` | +| `speaker.affinity` | Affinity for speaker pod assignment | `{}` | +| `speaker.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `speaker.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `speaker.nodeAffinityPreset.key` | Node label key to match. Ignored if `speaker.affinity` is set | `""` | +| `speaker.nodeAffinityPreset.values` | Node label values to match. Ignored if `speaker.affinity` is set | `[]` | +| `speaker.podAffinityPreset` | Pod affinity preset. Ignored if `speaker.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `speaker.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `speaker.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `speaker.podAnnotations` | Speaker Pod annotations | `{}` | +| `speaker.podLabels` | Speaker Pod labels | `{}` | +| `speaker.podSecurityContext.enabled` | Enabled Speaker pods' Security Context | `true` | +| `speaker.podSecurityContext.fsGroup` | Set Speaker pod's Security Context fsGroup | `0` | +| `speaker.containerSecurityContext.enabled` | Enabled Speaker containers' Security Context | `true` | +| `speaker.containerSecurityContext.runAsUser` | Set Speaker containers' Security Context runAsUser | `0` | +| `speaker.containerSecurityContext.allowPrivilegeEscalation` | Enables privilege Escalation context for the pod. | `false` | +| `speaker.containerSecurityContext.readOnlyRootFilesystem` | Allows the pod to mount the RootFS as ReadOnly | `true` | +| `speaker.containerSecurityContext.capabilities.drop` | Drop capabilities for the securityContext | `[]` | +| `speaker.containerSecurityContext.capabilities.add` | Add capabilities for the securityContext | `[]` | +| `speaker.command` | Override default container command (useful when using custom images) | `[]` | +| `speaker.args` | Override default container args (useful when using custom images) | `[]` | +| `speaker.lifecycleHooks` | for the Speaker container(s) to automate configuration before or after startup | `{}` | +| `speaker.sidecars` | Add additional sidecar containers to the Speaker pod(s) | `[]` | +| `speaker.initContainers` | Add additional init containers to the Speaker pod(s) | `[]` | +| `speaker.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `speaker.serviceAccount.name` | Name of the service account to use. If not set and create is true, a name is generated using the fullname template. | `""` | +| `speaker.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `speaker.serviceAccount.annotations` | Annotations for service account. Evaluated as a template. Only used if `create` is `true`. | `{}` | +| `speaker.secretName` | References a Secret name for the member secret outside of the helm chart | `""` | +| `speaker.secretKey` | References a Secret key the member secret outside of the helm chart | `""` | +| `speaker.secretValue` | Custom value for `speaker.secretKey` | `""` | +| `speaker.extraEnvVars` | Extra environment variable to pass to the running container. | `[]` | +| `speaker.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for Speaker nodes | `""` | +| `speaker.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for Speaker nodes | `""` | +| `speaker.extraVolumes` | Optionally specify extra list of additional volumes for the Speaker pod(s) | `[]` | +| `speaker.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Speaker container(s) | `[]` | +| `speaker.containerPorts.metrics` | HTTP Metrics Endpoint | `7472` | +| `speaker.livenessProbe.enabled` | Enable livenessProbe | `true` | +| `speaker.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `10` | +| `speaker.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `speaker.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` | +| `speaker.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` | +| `speaker.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `speaker.readinessProbe.enabled` | Enable readinessProbe | `true` | +| `speaker.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `10` | +| `speaker.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `speaker.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `speaker.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | +| `speaker.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `speaker.startupProbe.enabled` | Enable startupProbe | `false` | +| `speaker.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `10` | +| `speaker.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `speaker.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `speaker.startupProbe.failureThreshold` | Failure threshold for startupProbe | `3` | +| `speaker.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `speaker.customStartupProbe` | Custom liveness probe for the Web component | `{}` | +| `speaker.customLivenessProbe` | Custom liveness probe for the Web component | `{}` | +| `speaker.customReadinessProbe` | Custom readiness probe for the Web component | `{}` | + + +### Speaker Prometheus metrics export + +| Name | Description | Value | +| -------------------------------------------------- | --------------------------------------------------------------------------- | ------------------------ | +| `speaker.metrics.enabled` | Enable the export of Prometheus metrics | `false` | +| `speaker.metrics.service.port` | Prometheus metrics service port | `7472` | +| `speaker.metrics.service.annotations` | Annotations for the Prometheus Exporter service service | `{}` | +| `speaker.metrics.serviceMonitor.enabled` | Enable support for Prometheus Operator | `false` | +| `speaker.metrics.serviceMonitor.namespace` | Namespace which Prometheus is running in | `""` | +| `speaker.metrics.serviceMonitor.jobLabel` | Job label for scrape target | `app.kubernetes.io/name` | +| `speaker.metrics.serviceMonitor.interval` | Scrape interval. If not set, the Prometheus default scrape interval is used | `""` | +| `speaker.metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `""` | +| `speaker.metrics.serviceMonitor.metricRelabelings` | Specify additional relabeling of metrics | `[]` | +| `speaker.metrics.serviceMonitor.relabelings` | Specify general relabeling | `[]` | +| `speaker.metrics.serviceMonitor.selector` | ServiceMonitor selector labels | `{}` | +| `speaker.metrics.serviceMonitor.labels` | Extra labels for the ServiceMonitor | `{}` | +| `speaker.metrics.serviceMonitor.honorLabels` | honorLabels chooses the metric's labels on collisions with target labels | `false` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, @@ -237,10 +325,24 @@ configInline: ## Troubleshooting -Find more information about how to deal with common errors related to Bitnami’s Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues). +Find more information about how to deal with common errors related to Bitnami's Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues). ## Upgrading +### To 3.0.0 + +This major release renames several values in this chart and adds missing features, in order to be aligned with the rest of the assets in the Bitnami charts repository. + +Affected values: + +- `.prometheus` has been renamed as `.metrics`. +- To enable the Prometheus serviceMonitors, it is necessary to enable both `.metrics.enabled` and `.metrics.serviceMonitor.enabled`. +- Added the values section `.metrics.service`. +- `.securityContext` has been split as `.podSecurityContext` and `.containerSecurityContext` +- `controller.containerPort` has been renamed as `controller.containerPorts`. +- `speaker.daemonset.hostPorts.metrics` renamed as `speaker.containerPorts.metrics` +- `speaker.daemonset.terminationGracePeriodSeconds` renamed as speaker.terminationGracePeriodSeconds + ### To 2.0.0 **What changes were introduced in this major version?** @@ -300,4 +402,4 @@ Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and -limitations under the License. +limitations under the License. \ No newline at end of file diff --git a/charts/metallb/charts/common/Chart.yaml b/charts/metallb/charts/common/Chart.yaml index cf934aad97..c8cf26e4cc 100644 --- a/charts/metallb/charts/common/Chart.yaml +++ b/charts/metallb/charts/common/Chart.yaml @@ -1,7 +1,7 @@ annotations: category: Infrastructure apiVersion: v2 -appVersion: 1.10.0 +appVersion: 1.13.1 description: A Library Helm Chart for grouping common logic between bitnami charts. This chart is not deployable by itself. home: https://github.com/bitnami/charts/tree/master/bitnami/common @@ -20,4 +20,4 @@ sources: - https://github.com/bitnami/charts - https://www.bitnami.com/ type: library -version: 1.10.3 +version: 1.14.1 diff --git a/charts/metallb/charts/common/README.md b/charts/metallb/charts/common/README.md index cbbc31d96b..a98aab377b 100644 --- a/charts/metallb/charts/common/README.md +++ b/charts/metallb/charts/common/README.md @@ -7,7 +7,7 @@ A [Helm Library Chart](https://helm.sh/docs/topics/library_charts/#helm) for gro ```yaml dependencies: - name: common - version: 0.x.x + version: 1.x.x repository: https://charts.bitnami.com/bitnami ``` @@ -32,8 +32,8 @@ Bitnami charts can be used with [Kubeapps](https://kubeapps.com/) for deployment ## Prerequisites -- Kubernetes 1.12+ -- Helm 3.1.0 +- Kubernetes 1.19+ +- Helm 3.2.0+ ## Parameters @@ -43,10 +43,10 @@ The following table lists the helpers available in the library which are scoped | Helper identifier | Description | Expected Input | |-------------------------------|------------------------------------------------------|------------------------------------------------| -| `common.affinities.node.soft` | Return a soft nodeAffinity definition | `dict "key" "FOO" "values" (list "BAR" "BAZ")` | -| `common.affinities.node.hard` | Return a hard nodeAffinity definition | `dict "key" "FOO" "values" (list "BAR" "BAZ")` | -| `common.affinities.pod.soft` | Return a soft podAffinity/podAntiAffinity definition | `dict "component" "FOO" "context" $` | -| `common.affinities.pod.hard` | Return a hard podAffinity/podAntiAffinity definition | `dict "component" "FOO" "context" $` | +| `common.affinities.nodes.soft` | Return a soft nodeAffinity definition | `dict "key" "FOO" "values" (list "BAR" "BAZ")` | +| `common.affinities.nodes.hard` | Return a hard nodeAffinity definition | `dict "key" "FOO" "values" (list "BAR" "BAZ")` | +| `common.affinities.pods.soft` | Return a soft podAffinity/podAntiAffinity definition | `dict "component" "FOO" "context" $` | +| `common.affinities.pods.hard` | Return a hard podAffinity/podAntiAffinity definition | `dict "component" "FOO" "context" $` | ### Capabilities @@ -61,6 +61,8 @@ The following table lists the helpers available in the library which are scoped | `common.capabilities.crd.apiVersion` | Return the appropriate apiVersion for CRDs. | `.` Chart context | | `common.capabilities.policy.apiVersion` | Return the appropriate apiVersion for podsecuritypolicy. | `.` Chart context | | `common.capabilities.networkPolicy.apiVersion` | Return the appropriate apiVersion for networkpolicy. | `.` Chart context | +| `common.capabilities.apiService.apiVersion` | Return the appropriate apiVersion for APIService. | `.` Chart context | +| `common.capabilities.hpa.apiVersion` | Return the appropriate apiVersion for Horizontal Pod Autoscaler | `.` Chart context | | `common.capabilities.supportsHelmVersion` | Returns true if the used Helm version is 3.3+ | `.` Chart context | ### Errors @@ -79,26 +81,28 @@ The following table lists the helpers available in the library which are scoped ### Ingress -| Helper identifier | Description | Expected Input | -|-------------------------------------------|----------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `common.ingress.backend` | Generate a proper Ingress backend entry depending on the API version | `dict "serviceName" "foo" "servicePort" "bar"`, see the [Ingress deprecation notice](https://kubernetes.io/blog/2019/07/18/api-deprecations-in-1-16/) for the syntax differences | -| `common.ingress.supportsPathType` | Prints "true" if the pathType field is supported | `.` Chart context | -| `common.ingress.supportsIngressClassname` | Prints "true" if the ingressClassname field is supported | `.` Chart context | +| Helper identifier | Description | Expected Input | +|-------------------------------------------|-------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `common.ingress.backend` | Generate a proper Ingress backend entry depending on the API version | `dict "serviceName" "foo" "servicePort" "bar"`, see the [Ingress deprecation notice](https://kubernetes.io/blog/2019/07/18/api-deprecations-in-1-16/) for the syntax differences | +| `common.ingress.supportsPathType` | Prints "true" if the pathType field is supported | `.` Chart context | +| `common.ingress.supportsIngressClassname` | Prints "true" if the ingressClassname field is supported | `.` Chart context | +| `common.ingress.certManagerRequest` | Prints "true" if required cert-manager annotations for TLS signed certificates are set in the Ingress annotations | `dict "annotations" .Values.path.to.the.ingress.annotations` | ### Labels -| Helper identifier | Description | Expected Input | -|-----------------------------|------------------------------------------------------|-------------------| -| `common.labels.standard` | Return Kubernetes standard labels | `.` Chart context | -| `common.labels.matchLabels` | Return the proper Docker Image Registry Secret Names | `.` Chart context | +| Helper identifier | Description | Expected Input | +|-----------------------------|-----------------------------------------------------------------------------|-------------------| +| `common.labels.standard` | Return Kubernetes standard labels | `.` Chart context | +| `common.labels.matchLabels` | Labels to use on `deploy.spec.selector.matchLabels` and `svc.spec.selector` | `.` Chart context | ### Names -| Helper identifier | Description | Expected Input | -|-------------------------|------------------------------------------------------------|-------------------| -| `common.names.name` | Expand the name of the chart or use `.Values.nameOverride` | `.` Chart context | -| `common.names.fullname` | Create a default fully qualified app name. | `.` Chart context | -| `common.names.chart` | Chart name plus version | `.` Chart context | +| Helper identifier | Description | Expected Input | +|--------------------------|------------------------------------------------------------|-------------------| +| `common.names.name` | Expand the name of the chart or use `.Values.nameOverride` | `.` Chart context | +| `common.names.fullname` | Create a default fully qualified app name. | `.` Chart context | +| `common.names.namespace` | Allow the release namespace to be overridden | `.` Chart context | +| `common.names.chart` | Chart name plus version | `.` Chart context | ### Secrets @@ -326,3 +330,19 @@ $ helm install test mychart --set path.to.value00="",path.to.value01="" - https://docs.bitnami.com/tutorials/resolve-helm2-helm3-post-migration-issues/ - https://helm.sh/docs/topics/v2_v3_migration/ - https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/ + +## License + +Copyright © 2022 Bitnami + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/charts/metallb/charts/common/templates/_capabilities.tpl b/charts/metallb/charts/common/templates/_capabilities.tpl index b94212bbe7..9d9b760044 100644 --- a/charts/metallb/charts/common/templates/_capabilities.tpl +++ b/charts/metallb/charts/common/templates/_capabilities.tpl @@ -115,6 +115,32 @@ Return the appropriate apiVersion for CRDs. {{- end -}} {{- end -}} +{{/* +Return the appropriate apiVersion for APIService. +*/}} +{{- define "common.capabilities.apiService.apiVersion" -}} +{{- if semverCompare "<1.10-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "apiregistration.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "apiregistration.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for Horizontal Pod Autoscaler. +*/}} +{{- define "common.capabilities.hpa.apiVersion" -}} +{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .context) -}} +{{- if .beta2 -}} +{{- print "autoscaling/v2beta2" -}} +{{- else -}} +{{- print "autoscaling/v2beta1" -}} +{{- end -}} +{{- else -}} +{{- print "autoscaling/v2" -}} +{{- end -}} +{{- end -}} + {{/* Returns true if the used Helm version is 3.3+. A way to check the used Helm version was not introduced until version 3.3.0 with .Capabilities.HelmVersion, which contains an additional "{}}" structure. diff --git a/charts/metallb/charts/common/templates/_ingress.tpl b/charts/metallb/charts/common/templates/_ingress.tpl index f905f20059..8caf73a610 100644 --- a/charts/metallb/charts/common/templates/_ingress.tpl +++ b/charts/metallb/charts/common/templates/_ingress.tpl @@ -53,3 +53,16 @@ Usage: {{- print "true" -}} {{- end -}} {{- end -}} + +{{/* +Return true if cert-manager required annotations for TLS signed +certificates are set in the Ingress annotations +Ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations +Usage: +{{ include "common.ingress.certManagerRequest" ( dict "annotations" .Values.path.to.the.ingress.annotations ) }} +*/}} +{{- define "common.ingress.certManagerRequest" -}} +{{ if or (hasKey .annotations "cert-manager.io/cluster-issuer") (hasKey .annotations "cert-manager.io/issuer") }} + {{- true -}} +{{- end -}} +{{- end -}} diff --git a/charts/metallb/charts/common/templates/_names.tpl b/charts/metallb/charts/common/templates/_names.tpl index cf0323171f..c8574d1751 100644 --- a/charts/metallb/charts/common/templates/_names.tpl +++ b/charts/metallb/charts/common/templates/_names.tpl @@ -50,3 +50,14 @@ Usage: {{- end -}} {{- end -}} {{- end -}} + +{{/* +Allow the release namespace to be overridden for multi-namespace deployments in combined charts. +*/}} +{{- define "common.names.namespace" -}} +{{- if .Values.namespaceOverride -}} +{{- .Values.namespaceOverride -}} +{{- else -}} +{{- .Release.Namespace -}} +{{- end -}} +{{- end -}} \ No newline at end of file diff --git a/charts/metallb/charts/common/templates/_secrets.tpl b/charts/metallb/charts/common/templates/_secrets.tpl index 60b84a7019..a53fb44f74 100644 --- a/charts/metallb/charts/common/templates/_secrets.tpl +++ b/charts/metallb/charts/common/templates/_secrets.tpl @@ -72,6 +72,15 @@ Params: - strong - Boolean - Optional - Whether to add symbols to the generated random password. - chartName - String - Optional - Name of the chart used when said chart is deployed as a subchart. - context - Context - Required - Parent context. + +The order in which this function returns a secret password: + 1. Already existing 'Secret' resource + (If a 'Secret' resource is found under the name provided to the 'secret' parameter to this function and that 'Secret' resource contains a key with the name passed as the 'key' parameter to this function then the value of this existing secret password will be returned) + 2. Password provided via the values.yaml + (If one of the keys passed to the 'providedValues' parameter to this function is a valid path to a key in the values.yaml and has a value, the value of the first key with a value will be returned) + 3. Randomly generated secret password + (A new random secret password with the length specified in the 'length' parameter will be generated and returned) + */}} {{- define "common.secrets.passwords.manage" -}} @@ -81,10 +90,12 @@ Params: {{- $passwordLength := default 10 .length }} {{- $providedPasswordKey := include "common.utils.getKeyFromList" (dict "keys" .providedValues "context" $.context) }} {{- $providedPasswordValue := include "common.utils.getValueFromKey" (dict "key" $providedPasswordKey "context" $.context) }} -{{- $secret := (lookup "v1" "Secret" $.context.Release.Namespace .secret) }} -{{- if $secret }} - {{- if index $secret.data .key }} - {{- $password = index $secret.data .key }} +{{- $secretData := (lookup "v1" "Secret" $.context.Release.Namespace .secret).data }} +{{- if $secretData }} + {{- if hasKey $secretData .key }} + {{- $password = index $secretData .key }} + {{- else }} + {{- printf "\nPASSWORDS ERROR: The secret \"%s\" does not contain the key \"%s\"\n" .secret .key | fail -}} {{- end -}} {{- else if $providedPasswordValue }} {{- $password = $providedPasswordValue | toString | b64enc | quote }} @@ -98,7 +109,7 @@ Params: {{- $requiredPasswordError := include "common.validations.values.single.empty" $requiredPassword -}} {{- $passwordValidationErrors := list $requiredPasswordError -}} {{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" $passwordValidationErrors "context" $.context) -}} - + {{- if .strong }} {{- $subStr := list (lower (randAlpha 1)) (randNumeric 1) (upper (randAlpha 1)) | join "_" }} {{- $password = randAscii $passwordLength }} diff --git a/charts/metallb/templates/NOTES.txt b/charts/metallb/templates/NOTES.txt index fda8be7a40..ccafb57ac6 100644 --- a/charts/metallb/templates/NOTES.txt +++ b/charts/metallb/templates/NOTES.txt @@ -4,6 +4,27 @@ APP VERSION: {{ .Chart.AppVersion }} ** Please be patient while the chart is being deployed ** +{{- if .Values.diagnosticMode.enabled }} +The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with: + + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 4 }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 4 }} + +Get the list of pods by executing: + + kubectl get pods --namespace {{ include "common.names.namespace" . }} -l app.kubernetes.io/instance={{ .Release.Name }} + +Access the pod you want to debug by executing + + kubectl exec --namespace {{ include "common.names.namespace" . }} -ti -- bash + +In order to replicate the container startup scripts execute these commands in their respective pods: + + speaker --port={{ .Values.speaker.containerPorts.metrics }} --config={{ include "metallb.configMapName" . }} + controller --port={{ .Values.controller.containerPorts.metrics }} --config={{ include "metallb.configMapName" . }} + +{{- else }} + MetalLB is now running in the cluster LoadBalancer Services in your cluster are now available on the IPs you @@ -15,7 +36,7 @@ should be executed. To see the currently configured configuration for metallb run - kubectl get configmaps --namespace {{ .Release.Namespace }} {{ include "metallb.configMapName" . }} -o yaml + kubectl get configmaps --namespace {{ include "common.names.namespace" . }} {{ include "metallb.configMapName" . }} -o yaml in your preferred shell. @@ -26,20 +47,21 @@ ConfigMap to your cluster yourself. Ensure you put the configmap in place - kubectl get configmaps --namespace {{ .Release.Namespace }} | grep --color=never -E "{{ include "metallb.configMapName" . }}|NAME" + kubectl get configmaps --namespace {{ include "common.names.namespace" . }} | grep --color=never -E "{{ include "metallb.configMapName" . }}|NAME" If it is missing create it with: - kubectl create configmap {{ include "metallb.configMapName" . }} --namespace {{ .Release.Namespace }} --from-file=config + kubectl create configmap {{ include "metallb.configMapName" . }} --namespace {{ include "common.names.namespace" . }} --from-file=config {{- end }} {{- if .Values.speaker.secretName }} WARNING: you specified a secretName that isn't managed by Helm. The MetalLB speakers will not join without the secret in place. - kubectl get secrets --namespace {{ .Release.Namespace }} | grep --color=never -E "{{ include "metallb.speaker.secretName" . }}|NAME" + kubectl get secrets --namespace {{ include "common.names.namespace" . }} | grep --color=never -E "{{ include "metallb.speaker.secretName" . }}|NAME" If it is missing create it with: kubectl create secret {{ include "metallb.speaker.secretName" . }} --from-file={{ include "metallb.speaker.secretKey" . }} {{- end }} +{{- end }} diff --git a/charts/metallb/templates/_helpers.tpl b/charts/metallb/templates/_helpers.tpl index be56730f78..19b42059b0 100644 --- a/charts/metallb/templates/_helpers.tpl +++ b/charts/metallb/templates/_helpers.tpl @@ -3,14 +3,14 @@ {{/* Create the name of the controller service account to use */}} -{{- define "metallb.controllerServiceAccountName" -}} +{{- define "metallb.controller.serviceAccountName" -}} {{ include "common.secrets.name" (dict "existingSecret" .Values.controller.serviceAccount.name "defaultNameSuffix" "controller" "context" $) }} {{- end -}} {{/* Create the name of the speaker service account to use */}} -{{- define "metallb.speakerServiceAccountName" -}} +{{- define "metallb.speaker.serviceAccountName" -}} {{ include "common.secrets.name" (dict "existingSecret" .Values.speaker.serviceAccount.name "defaultNameSuffix" "speaker" "context" $) }} {{- end -}} diff --git a/charts/metallb/templates/controller/configmap.yaml b/charts/metallb/templates/controller/configmap.yaml index 3f64eb0dc7..7bafe90fdc 100644 --- a/charts/metallb/templates/controller/configmap.yaml +++ b/charts/metallb/templates/controller/configmap.yaml @@ -3,6 +3,7 @@ apiVersion: v1 kind: ConfigMap metadata: name: {{ include "metallb.configMapName" . }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} diff --git a/charts/metallb/templates/controller/deployment.yaml b/charts/metallb/templates/controller/deployment.yaml index 0115c7b6ce..714d4ee622 100644 --- a/charts/metallb/templates/controller/deployment.yaml +++ b/charts/metallb/templates/controller/deployment.yaml @@ -1,7 +1,8 @@ apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} kind: Deployment metadata: - name: {{ include "common.names.fullname" . }}-controller + name: {{ printf "%s-controller" (include "common.names.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} app.kubernetes.io/component: controller {{- if .Values.commonLabels }} @@ -11,6 +12,10 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: + replicas: 1 + {{- if .Values.controller.updateStrategy }} + strategy: {{- toYaml .Values.controller.updateStrategy | nindent 4 }} + {{- end }} revisionHistoryLimit: {{ .Values.controller.revisionHistoryLimit }} selector: matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} @@ -19,7 +24,7 @@ spec: metadata: labels: {{- include "common.labels.standard" . | nindent 8 }} app.kubernetes.io/component: controller - {{- if .Values.podLabels }} + {{- if .Values.controller.podLabels }} {{- include "common.tplvalues.render" (dict "value" .Values.controller.podLabels "context" $) | nindent 8 }} {{- end }} {{- if .Values.controller.podAnnotations }} @@ -27,17 +32,16 @@ spec: {{- end }} spec: {{- include "common.images.pullSecrets" (dict "images" (list .Values.speaker.image .Values.controller.image) "global" .Values.global) | nindent 6 }} - {{- if .Values.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hostAliases "context" $) | nindent 8 }} + {{- if .Values.controller.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.controller.hostAliases "context" $) | nindent 8 }} {{- end }} - serviceAccountName: {{ include "metallb.controllerServiceAccountName" . }} - terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }} + serviceAccountName: {{ include "metallb.controller.serviceAccountName" . }} nodeSelector: - {{- if .Values.controller.nodeSelector }} - {{- include "common.tplvalues.render" (dict "value" .Values.controller.nodeSelector "context" $) | nindent 8 }} - {{- end }} "kubernetes.io/os": linux - {{- if .Values.affinity }} + {{- if .Values.controller.nodeSelector }} + {{- include "common.tplvalues.render" (dict "value" .Values.controller.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.controller.affinity }} affinity: {{- include "common.tplvalues.render" (dict "value" .Values.controller.affinity "context" $) | nindent 8 }} {{- else }} affinity: @@ -51,51 +55,95 @@ spec: {{- if .Values.controller.priorityClassName }} priorityClassName: {{ .Values.controller.priorityClassName | quote }} {{- end }} + {{- if .Values.controller.schedulerName }} + schedulerName: {{ .Values.controller.schedulerName | quote }} + {{- end }} + {{- if .Values.controller.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.controller.topologySpreadConstraints "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.controller.podSecurityContext.enabled }} + securityContext: {{- omit .Values.controller.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + {{- if .Values.controller.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }} + {{- end }} + {{- if .Values.controller.initContainers }} + initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.controller.initContainers "context" $) | nindent 8 }} + {{- end }} containers: - name: metallb-controller image: {{ include "common.images.image" (dict "imageRoot" .Values.controller.image "global" .Values.global) }} imagePullPolicy: {{ .Values.controller.image.pullPolicy }} + {{- if .Values.controller.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.controller.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.controller.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.controller.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.controller.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.controller.args "context" $) | nindent 12 }} + {{- else }} args: - - --port={{ .Values.controller.containerPort.metrics }} + - --port={{ .Values.controller.containerPorts.metrics }} - --config={{ include "metallb.configMapName" . }} + {{- end }} + {{- if .Values.controller.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.controller.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + env: + {{- if .Values.controller.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.controller.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + envFrom: + {{- if .Values.controller.extraEnvVarsCM }} + - configMapRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.controller.extraEnvVarsCM "context" $) }} + {{- end }} + {{- if .Values.controller.extraEnvVarsSecret }} + - secretRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.controller.extraEnvVarsSecret "context" $) }} + {{- end }} ports: - name: metrics - containerPort: {{ .Values.controller.containerPort.metrics }} + containerPort: {{ .Values.controller.containerPorts.metrics }} + {{- if .Values.controller.extraVolumeMounts }} + volumeMounts: {{- include "common.tplvalues.render" (dict "value" .Values.controller.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if not .Values.diagnosticMode.enabled }} {{- if .Values.controller.livenessProbe.enabled }} - livenessProbe: + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.controller.livenessProbe "enabled") "context" $) | nindent 12 }} httpGet: path: /metrics port: metrics - initialDelaySeconds: {{ .Values.controller.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.controller.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.controller.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.controller.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.controller.livenessProbe.failureThreshold }} + {{- else if .Values.controller.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.controller.customLivenessProbe "context" $) | nindent 12 }} {{- end }} {{- if .Values.controller.readinessProbe.enabled }} - readinessProbe: + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.controller.readinessProbe "enabled") "context" $) | nindent 12 }} httpGet: path: /metrics port: metrics - initialDelaySeconds: {{ .Values.controller.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.controller.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.controller.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.controller.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.controller.readinessProbe.failureThreshold }} + {{- else if .Values.controller.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.controller.customReadinessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.controller.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.controller.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: metrics + {{- else if .Values.controller.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.controller.customStartupProbe "context" $) | nindent 12 }} {{- end }} - {{- if .Values.controller.securityContext.enabled }} - securityContext: - allowPrivilegeEscalation: {{ .Values.controller.securityContext.allowPrivilegeEscalation }} - readOnlyRootFilesystem: {{ .Values.controller.securityContext.readOnlyRootFilesystem }} - capabilities: - drop: {{- toYaml .Values.controller.securityContext.capabilities.drop | nindent 16 }} {{- end }} {{- if .Values.controller.resources }} resources: {{- toYaml .Values.controller.resources | nindent 12 }} {{- end }} - {{- if .Values.controller.securityContext.enabled }} - securityContext: - runAsUser: {{ .Values.controller.securityContext.runAsUser }} - fsGroup: {{ .Values.controller.securityContext.fsGroup }} - runAsNonRoot: {{ .Values.controller.securityContext.runAsNonRoot }} + {{- if .Values.controller.sidecars }} + {{- include "common.tplvalues.render" ( dict "value" .Values.controller.sidecars "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.controller.extraVolumes }} + volumes: {{- include "common.tplvalues.render" (dict "value" .Values.controller.extraVolumes "context" $) | nindent 8 }} {{- end }} diff --git a/charts/metallb/templates/controller/psp.yaml b/charts/metallb/templates/controller/psp.yaml index b3320a9ecf..7ae423802a 100644 --- a/charts/metallb/templates/controller/psp.yaml +++ b/charts/metallb/templates/controller/psp.yaml @@ -3,7 +3,8 @@ apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: - name: {{ include "common.names.fullname" . }}-controller + name: {{ printf "%s-controller" (include "common.names.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} app.kubernetes.io/component: controller {{- if .Values.commonLabels }} @@ -13,36 +14,36 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: - allowPrivilegeEscalation: {{ .Values.controller.securityContext.allowPrivilegeEscalation }} + allowPrivilegeEscalation: {{ .Values.controller.containerSecurityContext.allowPrivilegeEscalation }} allowedCapabilities: [] allowedHostPaths: [] defaultAddCapabilities: [] - defaultAllowPrivilegeEscalation: {{ .Values.controller.securityContext.allowPrivilegeEscalation }} + defaultAllowPrivilegeEscalation: {{ .Values.controller.containerSecurityContext.allowPrivilegeEscalation }} fsGroup: ranges: - - max: {{ .Values.controller.securityContext.fsGroup }} - min: {{ .Values.controller.securityContext.fsGroup }} + - max: {{ .Values.controller.podSecurityContext.fsGroup }} + min: {{ .Values.controller.podSecurityContext.fsGroup }} rule: MustRunAs hostIPC: false hostNetwork: false hostPID: false privileged: false - readOnlyRootFilesystem: {{ .Values.controller.securityContext.readOnlyRootFilesystem }} - requiredDropCapabilities: {{- toYaml .Values.controller.securityContext.capabilities.drop | nindent 2 }} + readOnlyRootFilesystem: {{ .Values.controller.containerSecurityContext.readOnlyRootFilesystem }} + requiredDropCapabilities: {{- toYaml .Values.controller.containerSecurityContext.capabilities.drop | nindent 2 }} runAsUser: ranges: - - max: {{ .Values.controller.securityContext.runAsUser }} - min: {{ .Values.controller.securityContext.runAsUser }} + - max: {{ .Values.controller.containerSecurityContext.runAsUser }} + min: {{ .Values.controller.containerSecurityContext.runAsUser }} rule: MustRunAs seLinux: rule: RunAsAny supplementalGroups: ranges: - - max: {{ .Values.controller.securityContext.runAsUser }} - min: {{ .Values.controller.securityContext.runAsUser }} + - max: {{ .Values.controller.containerSecurityContext.runAsUser }} + min: {{ .Values.controller.containerSecurityContext.runAsUser }} rule: MustRunAs volumes: - - configMap - - secret - - emptyDir + - configMap + - secret + - emptyDir {{- end -}} diff --git a/charts/metallb/templates/controller/rbac.yaml b/charts/metallb/templates/controller/rbac.yaml index 9a376eaf70..53cdfd70d3 100644 --- a/charts/metallb/templates/controller/rbac.yaml +++ b/charts/metallb/templates/controller/rbac.yaml @@ -1,9 +1,9 @@ {{- if and .Values.rbac.create .Values.controller.rbac.create -}} ---- apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} kind: ClusterRole metadata: - name: {{ include "common.names.fullname" . }}-controller + name: {{ printf "%s-controller" (include "common.names.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} app.kubernetes.io/component: controller {{- if .Values.commonLabels }} @@ -38,7 +38,7 @@ rules: - apiGroups: - policy resourceNames: - - {{ include "common.names.fullname" . }}-controller + - {{ printf "%s-controller" (include "common.names.fullname" .) }} resources: - podsecuritypolicies verbs: @@ -48,7 +48,8 @@ rules: apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} kind: ClusterRoleBinding metadata: - name: {{ include "common.names.fullname" . }}-controller + name: {{ printf "%s-controller" (include "common.names.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} app.kubernetes.io/component: controller {{- if .Values.commonLabels }} @@ -59,10 +60,10 @@ metadata: {{- end }} subjects: - kind: ServiceAccount - name: {{ include "metallb.controllerServiceAccountName" . }} - namespace: {{ .Release.Namespace }} + name: {{ include "metallb.controller.serviceAccountName" . }} + namespace: {{ include "common.names.namespace" . }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: {{ include "common.names.fullname" . }}-controller + name: {{ printf "%s-controller" (include "common.names.fullname" .) }} {{- end -}} diff --git a/charts/metallb/templates/controller/service.yaml b/charts/metallb/templates/controller/service.yaml index c589c26f21..6df24bf524 100644 --- a/charts/metallb/templates/controller/service.yaml +++ b/charts/metallb/templates/controller/service.yaml @@ -1,24 +1,29 @@ -{{- if .Values.controller.prometheus.serviceMonitor.enabled }} +{{- if .Values.controller.metrics.enabled }} apiVersion: v1 kind: Service metadata: - name: {{ include "common.names.fullname" . }}-controller-metrics + name: {{ printf "%s-controller-metrics" (include "common.names.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} app.kubernetes.io/component: controller {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.controller.metrics.service.annotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.controller.metrics.service.annotations "context" $ ) | nindent 4 }} + {{- end }} spec: type: ClusterIP clusterIP: "None" selector: {{- include "common.labels.matchLabels" . | nindent 4 }} app.kubernetes.io/component: controller ports: - - name: metrics - port: {{ .Values.controller.containerPort.metrics }} - protocol: TCP - targetPort: {{ .Values.controller.containerPort.metrics }} + - name: metrics + port: {{ .Values.controller.metrics.service.port }} + protocol: TCP + targetPort: {{ .Values.controller.containerPorts.metrics }} {{- end }} diff --git a/charts/metallb/templates/controller/serviceaccount.yaml b/charts/metallb/templates/controller/serviceaccount.yaml index 6aaaee62ce..70b3464755 100644 --- a/charts/metallb/templates/controller/serviceaccount.yaml +++ b/charts/metallb/templates/controller/serviceaccount.yaml @@ -2,13 +2,21 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ include "metallb.controllerServiceAccountName" . }} + name: {{ include "metallb.controller.serviceAccountName" . }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} app.kubernetes.io/component: controller {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- if or .Values.controller.serviceAccount.annotations .Values.commonAnnotations }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.controller.serviceAccount.annotations }} + {{- include "common.tplvalues.render" (dict "value" .Values.controller.serviceAccount.annotations "context" $) | nindent 4 }} + {{- end }} {{- end }} +automountServiceAccountToken: {{ .Values.controller.serviceAccount.automountServiceAccountToken }} {{- end -}} diff --git a/charts/metallb/templates/controller/servicemonitor.yaml b/charts/metallb/templates/controller/servicemonitor.yaml index 71c8171ef7..2ad796abce 100644 --- a/charts/metallb/templates/controller/servicemonitor.yaml +++ b/charts/metallb/templates/controller/servicemonitor.yaml @@ -1,33 +1,51 @@ -{{- if .Values.controller.prometheus.serviceMonitor.enabled }} +{{- if and .Values.controller.metrics.enabled .Values.controller.metrics.serviceMonitor.enabled }} apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: - name: {{ include "common.names.fullname" . }}-controller + name: {{ printf "%s-controller" (include "common.names.fullname" .) }} + {{- if .Values.controller.metrics.serviceMonitor.namespace }} + namespace: {{ .Values.controller.metrics.serviceMonitor.namespace | quote }} + {{- else }} + namespace: {{ include "common.names.namespace" . | quote }} + {{- end }} labels: {{- include "common.labels.standard" . | nindent 4 }} app.kubernetes.io/component: controller {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} + {{- if .Values.controller.metrics.serviceMonitor.labels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.controller.metrics.serviceMonitor.labels "context" $ ) | nindent 4 }} + {{- end }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} spec: - jobLabel: {{ .Values.controller.prometheus.serviceMonitor.jobLabel | quote }} + jobLabel: {{ .Values.controller.metrics.serviceMonitor.jobLabel | quote }} selector: matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} app.kubernetes.io/component: controller + {{- if .Values.controller.metrics.serviceMonitor.selector }} + {{- include "common.tplvalues.render" (dict "value" .Values.controller.metrics.serviceMonitor.selector "context" $) | nindent 6 }} + {{- end }} namespaceSelector: matchNames: - - {{ .Release.Namespace }} + - {{ include "common.names.namespace" .| quote }} endpoints: - - port: metrics - {{- if .Values.controller.prometheus.serviceMonitor.interval }} - interval: {{ .Values.controller.prometheus.serviceMonitor.interval }} - {{- end }} - {{- if .Values.controller.prometheus.serviceMonitor.metricRelabelings }} - metricRelabelings: {{ toYaml .Values.controller.prometheus.serviceMonitor.metricRelabelings | nindent 4 }} - {{- end }} - {{- if .Values.controller.prometheus.serviceMonitor.relabelings }} - relabelings: {{ toYaml .Values.controller.prometheus.serviceMonitor.relabelings | nindent 4 }} - {{- end }} + - port: metrics + {{- if .Values.controller.metrics.serviceMonitor.interval }} + interval: {{ .Values.controller.metrics.serviceMonitor.interval }} + {{- end }} + {{- if .Values.controller.metrics.serviceMonitor.scrapeTimeout }} + scrapeTimeout: {{ .Values.controller.metrics.serviceMonitor.scrapeTimeout }} + {{- end }} + {{- if .Values.controller.metrics.serviceMonitor.honorLabels }} + honorLabels: {{ .Values.controller.metrics.serviceMonitor.honorLabels }} + {{- end }} + {{- if .Values.controller.metrics.serviceMonitor.metricRelabelings }} + metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.controller.metrics.serviceMonitor.metricRelabelings "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.controller.metrics.serviceMonitor.relabelings }} + relabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.controller.metrics.serviceMonitor.relabelings "context" $) | nindent 8 }} + {{- end }} {{- end -}} diff --git a/charts/metallb/templates/networkpolicy.yaml b/charts/metallb/templates/networkpolicy.yaml index 4e741f4114..2563f840db 100644 --- a/charts/metallb/templates/networkpolicy.yaml +++ b/charts/metallb/templates/networkpolicy.yaml @@ -2,9 +2,16 @@ kind: NetworkPolicy apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} metadata: - name: {{ include "common.names.fullname" . }}-controller - labels: + name: {{ printf "%s-controller" (include "common.names.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} app.kubernetes.io/component: controller + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} spec: podSelector: matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} @@ -14,7 +21,7 @@ spec: ingress: # Allow prometheus scrapes for metrics - ports: - - port: {{ .Values.controller.containerPort.metrics }} + - port: {{ .Values.controller.containerPorts.metrics }} protocol: TCP {{- if .Values.networkPolicy.ingressNSMatchLabels }} from: diff --git a/charts/metallb/templates/prometheus/metallb.alerts.yaml b/charts/metallb/templates/prometheus/metallb.alerts.yaml index 433850138f..eb1468949e 100644 --- a/charts/metallb/templates/prometheus/metallb.alerts.yaml +++ b/charts/metallb/templates/prometheus/metallb.alerts.yaml @@ -1,8 +1,9 @@ -{{- if and .Values.prometheusRule.enabled .Values.speaker.prometheus.serviceMonitor.enabled .Values.controller.prometheus.serviceMonitor.enabled }} +{{- if and .Values.prometheusRule.enabled .Values.speaker.metrics.serviceMonitor.enabled .Values.controller.metrics.serviceMonitor.enabled }} apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: {{ include "common.names.fullname" . }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -12,22 +13,22 @@ metadata: {{- end }} spec: groups: - - name: {{ include "common.names.fullname" . }}.alerts - rules: - - alert: MetalLBStaleConfig - annotations: - message: {{`'{{ $labels.job }} - MetalLB {{ $labels.container_name }} on {{ $labels.instance - }} has a stale config for > 1 minute'`}} - expr: metallb_k8s_client_config_stale_bool{job="{{ include "common.names.name" . }}"} == 1 - for: 1m - labels: - severity: warning - - alert: MetalLBConfigNotLoaded - annotations: - message: {{`'{{ $labels.job }} - MetalLB {{ $labels.container_name }} on {{ $labels.instance - }} has not loaded for > 1 minute'`}} - expr: metallb_k8s_client_config_loaded_bool{job="{{ include "common.names.name" . }}"} == 0 - for: 1m - labels: - severity: warning + - name: {{ include "common.names.fullname" . }}.alerts + rules: + - alert: MetalLBStaleConfig + annotations: + message: {{`'{{ $labels.job }} - MetalLB {{ $labels.container_name }} on {{ $labels.instance + }} has a stale config for > 1 minute'`}} + expr: metallb_k8s_client_config_stale_bool{job="{{ include "common.names.name" . }}"} == 1 + for: 1m + labels: + severity: warning + - alert: MetalLBConfigNotLoaded + annotations: + message: {{`'{{ $labels.job }} - MetalLB {{ $labels.container_name }} on {{ $labels.instance + }} has not loaded for > 1 minute'`}} + expr: metallb_k8s_client_config_loaded_bool{job="{{ include "common.names.name" . }}"} == 0 + for: 1m + labels: + severity: warning {{- end }} diff --git a/charts/metallb/templates/rbac.yaml b/charts/metallb/templates/rbac.yaml index daacd9b88c..7f1cc1060b 100644 --- a/charts/metallb/templates/rbac.yaml +++ b/charts/metallb/templates/rbac.yaml @@ -1,9 +1,9 @@ {{- if and .Values.rbac.create (or .Values.controller.rbac.create .Values.speaker.rbac.create ) -}} ---- apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} kind: Role metadata: - name: {{ include "common.names.fullname" . }}-config-watcher + name: {{ printf "%s-config-watcher" (include "common.names.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -24,7 +24,8 @@ rules: apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} kind: RoleBinding metadata: - name: {{ include "common.names.fullname" . }}-config-watcher + name: {{ printf "%s-config-watcher" (include "common.names.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} @@ -35,14 +36,14 @@ metadata: subjects: {{- if .Values.controller.rbac.create }} - kind: ServiceAccount - name: {{ include "metallb.controllerServiceAccountName" . }} + name: {{ include "metallb.controller.serviceAccountName" . }} {{- end }} {{- if .Values.speaker.rbac.create }} - kind: ServiceAccount - name: {{ include "metallb.speakerServiceAccountName" . }} + name: {{ include "metallb.speaker.serviceAccountName" . }} {{- end }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role - name: {{ include "common.names.fullname" . }}-config-watcher + name: {{ printf "%s-config-watcher" (include "common.names.fullname" .) }} {{- end -}} diff --git a/charts/metallb/templates/speaker/daemonset.yaml b/charts/metallb/templates/speaker/daemonset.yaml index 407e90d8b7..3c069af28a 100644 --- a/charts/metallb/templates/speaker/daemonset.yaml +++ b/charts/metallb/templates/speaker/daemonset.yaml @@ -1,7 +1,8 @@ apiVersion: apps/v1 kind: DaemonSet metadata: - name: {{ include "common.names.fullname" . }}-speaker + name: {{ printf "%s-speaker" (include "common.names.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} app.kubernetes.io/component: speaker {{- if .Values.commonLabels }} @@ -11,6 +12,9 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: + {{- if .Values.speaker.updateStrategy }} + updateStrategy: {{- toYaml .Values.speaker.updateStrategy | nindent 4 }} + {{- end }} selector: matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} app.kubernetes.io/component: speaker @@ -18,7 +22,7 @@ spec: metadata: labels: {{- include "common.labels.standard" . | nindent 8 }} app.kubernetes.io/component: speaker - {{- if .Values.podLabels }} + {{- if .Values.speaker.podLabels }} {{- include "common.tplvalues.render" (dict "value" .Values.speaker.podLabels "context" $) | nindent 8 }} {{- end }} {{- if .Values.speaker.podAnnotations }} @@ -26,26 +30,63 @@ spec: {{- end }} spec: {{- include "common.images.pullSecrets" (dict "images" (list .Values.speaker.image .Values.controller.image) "global" .Values.global) | nindent 6 }} - {{- if .Values.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hostAliases "context" $) | nindent 8 }} + {{- if .Values.speaker.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.speaker.hostAliases "context" $) | nindent 8 }} {{- end }} - serviceAccountName: {{ include "metallb.speakerServiceAccountName" . }} - terminationGracePeriodSeconds: {{ .Values.speaker.daemonset.terminationGracePeriodSeconds }} - hostNetwork: true - {{- if .Values.speaker.initContainers }} - initContainers: - {{- include "common.tplvalues.render" (dict "value" .Values.speaker.initContainers "context" $) | nindent 8 }} + serviceAccountName: {{ include "metallb.speaker.serviceAccountName" . }} + {{- if .Values.speaker.affinity }} + affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.speaker.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.speaker.podAffinityPreset "component" "speaker" "context" $) | nindent 10 }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.speaker.podAntiAffinityPreset "component" "speaker" "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.speaker.nodeAffinityPreset.type "key" .Values.speaker.nodeAffinityPreset.key "values" .Values.speaker.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + nodeSelector: + {{- if .Values.speaker.nodeSelector }} + {{- include "common.tplvalues.render" (dict "value" .Values.speaker.nodeSelector "context" $) | nindent 8 }} + {{- end }} + "kubernetes.io/os": linux + {{- if .Values.speaker.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.speaker.tolerations "context" $) | nindent 8 }} {{- end }} + hostNetwork: true {{- if .Values.speaker.priorityClassName }} priorityClassName: {{ .Values.speaker.priorityClassName | quote }} {{- end }} + {{- if .Values.speaker.podSecurityContext.enabled }} + securityContext: {{- omit .Values.speaker.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + {{- if .Values.speaker.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ .Values.speaker.terminationGracePeriodSeconds }} + {{- end }} + {{- if .Values.speaker.initContainers }} + initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.speaker.initContainers "context" $) | nindent 8 }} + {{- end }} containers: - name: metallb-speaker image: {{ include "common.images.image" (dict "imageRoot" .Values.speaker.image "global" .Values.global) }} imagePullPolicy: {{ .Values.speaker.image.pullPolicy }} + {{- if .Values.speaker.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.speaker.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.speaker.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.speaker.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.speaker.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.speaker.args "context" $) | nindent 12 }} + {{- else }} args: - - --port={{ .Values.speaker.daemonset.hostPorts.metrics }} + - --port={{ .Values.speaker.containerPorts.metrics }} - --config={{ include "metallb.configMapName" . }} + {{- end }} + {{- if .Values.speaker.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.speaker.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} env: - name: METALLB_NODE_NAME valueFrom: @@ -73,56 +114,52 @@ spec: {{- if .Values.speaker.extraEnvVars }} {{- include "common.tplvalues.render" ( dict "value" .Values.speaker.extraEnvVars "context" $ ) | nindent 12 }} {{- end }} - {{- if .Values.extraEnvVarsSecret }} - envFrom: - - secretRef: - name: {{ include "common.tplvalues.render" ( dict "value" .Values.speaker.extraEnvVarsSecret "context" $ ) }} + envFrom: + {{- if .Values.speaker.extraEnvVarsCM }} + - configMapRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.speaker.extraEnvVarsCM "context" $) }} + {{- end }} + {{- if .Values.speaker.extraEnvVarsSecret }} + - secretRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.speaker.extraEnvVarsSecret "context" $) }} {{- end }} ports: - name: metrics - containerPort: {{ .Values.speaker.daemonset.hostPorts.metrics }} + containerPort: {{ .Values.speaker.containerPorts.metrics }} + {{- if not .Values.diagnosticMode.enabled }} {{- if .Values.speaker.livenessProbe.enabled }} - livenessProbe: + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.speaker.livenessProbe "enabled") "context" $) | nindent 12 }} httpGet: path: /metrics port: metrics - initialDelaySeconds: {{ .Values.speaker.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.speaker.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.speaker.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.speaker.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.speaker.livenessProbe.failureThreshold }} + {{- else if .Values.speaker.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.speaker.customLivenessProbe "context" $) | nindent 12 }} {{- end }} {{- if .Values.speaker.readinessProbe.enabled }} - readinessProbe: + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.speaker.readinessProbe "enabled") "context" $) | nindent 12 }} httpGet: path: /metrics port: metrics - initialDelaySeconds: {{ .Values.speaker.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.speaker.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.speaker.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.speaker.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.speaker.readinessProbe.failureThreshold }} + {{- else if .Values.speaker.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.speaker.customReadinessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.speaker.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.speaker.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: metrics + {{- else if .Values.speaker.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.speaker.customStartupProbe "context" $) | nindent 12 }} + {{- end }} {{- end }} {{- if .Values.speaker.resources }} resources: {{- toYaml .Values.speaker.resources | nindent 12 }} {{- end }} - {{- if .Values.speaker.securityContext.enabled }} - securityContext: - runAsUser: {{ .Values.speaker.securityContext.runAsUser }} - allowPrivilegeEscalation: {{ .Values.speaker.securityContext.allowPrivilegeEscalation }} - readOnlyRootFilesystem: {{ .Values.speaker.securityContext.readOnlyRootFilesystem }} - capabilities: - drop: {{- toYaml .Values.speaker.securityContext.capabilities.drop | nindent 16 }} - add: {{- toYaml .Values.speaker.securityContext.capabilities.add | nindent 16 }} + {{- if .Values.speaker.extraVolumeMounts }} + volumeMounts: {{- include "common.tplvalues.render" (dict "value" .Values.speaker.extraVolumeMounts "context" $) | nindent 12 }} {{- end }} - nodeSelector: - {{- if .Values.speaker.nodeSelector }} - {{- include "common.tplvalues.render" (dict "value" .Values.speaker.nodeSelector "context" $) | nindent 8 }} - {{- end }} - "kubernetes.io/os": linux - {{- if .Values.speaker.affinity }} - affinity: {{- include "common.tplvalues.render" (dict "value" .Values.speaker.affinity "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.speaker.tolerations }} - tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.speaker.tolerations "context" $) | nindent 8 }} + {{- if .Values.speaker.sidecars }} + {{- include "common.tplvalues.render" ( dict "value" .Values.speaker.sidecars "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.speaker.extraVolumes }} + volumes: {{- include "common.tplvalues.render" (dict "value" .Values.speaker.extraVolumes "context" $) | nindent 8 }} {{- end }} diff --git a/charts/metallb/templates/speaker/psp.yaml b/charts/metallb/templates/speaker/psp.yaml index 8d837ec0d5..dc588bde4a 100644 --- a/charts/metallb/templates/speaker/psp.yaml +++ b/charts/metallb/templates/speaker/psp.yaml @@ -3,7 +3,8 @@ apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: - name: {{ include "common.names.fullname" . }}-speaker + name: {{ printf "%s-speaker" (include "common.names.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} app.kubernetes.io/component: speaker {{- if .Values.commonLabels }} @@ -13,22 +14,22 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} spec: - allowPrivilegeEscalation: {{ .Values.speaker.securityContext.allowPrivilegeEscalation }} - allowedCapabilities: {{- toYaml .Values.speaker.securityContext.capabilities.add | nindent 2 }} + allowPrivilegeEscalation: {{ .Values.speaker.containerSecurityContext.allowPrivilegeEscalation }} + allowedCapabilities: {{- toYaml .Values.speaker.containerSecurityContext.capabilities.add | nindent 2 }} allowedHostPaths: [] - defaultAddCapabilities: {{- toYaml .Values.speaker.securityContext.capabilities.add | nindent 2 }} - defaultAllowPrivilegeEscalation: {{ .Values.speaker.securityContext.allowPrivilegeEscalation }} + defaultAddCapabilities: {{- toYaml .Values.speaker.containerSecurityContext.capabilities.add | nindent 2 }} + defaultAllowPrivilegeEscalation: {{ .Values.speaker.containerSecurityContext.allowPrivilegeEscalation }} fsGroup: rule: RunAsAny hostIPC: false hostNetwork: true hostPID: false hostPorts: - - max: {{ .Values.speaker.daemonset.hostPorts.metrics }} - min: {{ .Values.speaker.daemonset.hostPorts.metrics }} + - max: {{ .Values.speaker.containerPorts.metrics }} + min: {{ .Values.speaker.containerPorts.metrics }} privileged: true - readOnlyRootFilesystem: {{ .Values.speaker.securityContext.readOnlyRootFilesystem }} - requiredDropCapabilities: {{- toYaml .Values.speaker.securityContext.capabilities.drop | nindent 2 }} + readOnlyRootFilesystem: {{ .Values.speaker.containerSecurityContext.readOnlyRootFilesystem }} + requiredDropCapabilities: {{- toYaml .Values.speaker.containerSecurityContext.capabilities.drop | nindent 2 }} runAsUser: rule: RunAsAny seLinux: diff --git a/charts/metallb/templates/speaker/rbac.yaml b/charts/metallb/templates/speaker/rbac.yaml index 0492daa130..ba05e755ea 100644 --- a/charts/metallb/templates/speaker/rbac.yaml +++ b/charts/metallb/templates/speaker/rbac.yaml @@ -1,9 +1,9 @@ {{- if and .Values.rbac.create .Values.speaker.rbac.create -}} ---- apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} kind: ClusterRole metadata: - name: {{ include "common.names.fullname" . }}-speaker + name: {{ printf "%s-speaker" (include "common.names.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} app.kubernetes.io/component: speaker {{- if .Values.commonLabels }} @@ -33,7 +33,7 @@ rules: - apiGroups: - policy resourceNames: - - {{ include "common.names.fullname" . }}-speaker + - {{ printf "%s-speaker" (include "common.names.fullname" .) }} resources: - podsecuritypolicies verbs: @@ -42,7 +42,8 @@ rules: apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} kind: Role metadata: - name: {{ include "common.names.fullname" . }}-pod-lister + name: {{ printf "%s-pod-lister" (include "common.names.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} app.kubernetes.io/component: speaker {{- if .Values.commonLabels }} @@ -62,7 +63,8 @@ rules: apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} kind: ClusterRoleBinding metadata: - name: {{ include "common.names.fullname" . }}-speaker + name: {{ printf "%s-speaker" (include "common.names.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} app.kubernetes.io/component: speaker {{- if .Values.commonLabels }} @@ -73,17 +75,18 @@ metadata: {{- end }} subjects: - kind: ServiceAccount - name: {{ include "metallb.speakerServiceAccountName" . }} - namespace: {{ .Release.Namespace }} + name: {{ include "metallb.speaker.serviceAccountName" . }} + namespace: {{ include "common.names.namespace" . | quote }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: {{ include "common.names.fullname" . }}-speaker + name: {{ printf "%s-speaker" (include "common.names.fullname" .) }} --- apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} kind: RoleBinding metadata: - name: {{ include "common.names.fullname" . }}-pod-lister + name: {{ printf "%s-pod-lister" (include "common.names.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} app.kubernetes.io/component: speaker {{- if .Values.commonLabels }} @@ -95,8 +98,8 @@ metadata: roleRef: apiGroup: rbac.authorization.k8s.io kind: Role - name: {{ include "common.names.fullname" . }}-pod-lister + name: {{ printf "%s-pod-lister" (include "common.names.fullname" .) }} subjects: - kind: ServiceAccount - name: {{ include "metallb.speakerServiceAccountName" . }} + name: {{ include "metallb.speaker.serviceAccountName" . }} {{- end -}} diff --git a/charts/metallb/templates/speaker/secret.yaml b/charts/metallb/templates/speaker/secret.yaml index 7bce190f62..3844334faf 100644 --- a/charts/metallb/templates/speaker/secret.yaml +++ b/charts/metallb/templates/speaker/secret.yaml @@ -1,10 +1,9 @@ {{- if not .Values.speaker.secretName }} apiVersion: v1 -data: - {{ include "metallb.speaker.secretKey" . }}: {{ include "common.secrets.passwords.manage" (dict "secret" ( include "metallb.speaker.secretName" .) "key" ( include "metallb.speaker.secretKey" .) "providedValues" (list "speaker.secretValue") "length" 256 "context" $) }} kind: Secret metadata: name: {{ include "metallb.speaker.secretName" . }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} app.kubernetes.io/component: speaker {{- if .Values.commonLabels }} @@ -16,4 +15,6 @@ metadata: {{- if .Values.commonAnnotations }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} +data: + {{ include "metallb.speaker.secretKey" . }}: {{ include "common.secrets.passwords.manage" (dict "secret" ( include "metallb.speaker.secretName" .) "key" ( include "metallb.speaker.secretKey" .) "providedValues" (list "speaker.secretValue") "length" 256 "context" $) }} {{- end }} diff --git a/charts/metallb/templates/speaker/service.yaml b/charts/metallb/templates/speaker/service.yaml index a6d9bf0732..31c7e8384a 100644 --- a/charts/metallb/templates/speaker/service.yaml +++ b/charts/metallb/templates/speaker/service.yaml @@ -1,24 +1,29 @@ -{{- if .Values.speaker.prometheus.serviceMonitor.enabled }} +{{- if .Values.speaker.metrics.enabled }} apiVersion: v1 kind: Service metadata: - name: {{ include "common.names.fullname" . }}-speaker-metrics + name: {{ printf "%s-speaker-metrics" (include "common.names.fullname" .) }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} app.kubernetes.io/component: speaker {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.speaker.metrics.service.annotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.speaker.metrics.service.annotations "context" $ ) | nindent 4 }} + {{- end }} spec: type: ClusterIP clusterIP: "None" selector: {{- include "common.labels.matchLabels" . | nindent 4 }} app.kubernetes.io/component: speaker ports: - - name: metrics - port: {{ .Values.speaker.daemonset.hostPorts.metrics }} - protocol: TCP - targetPort: {{ .Values.speaker.daemonset.hostPorts.metrics }} + - name: metrics + port: {{ .Values.speaker.metrics.service.port }} + protocol: TCP + targetPort: {{ .Values.speaker.containerPorts.metrics }} {{- end }} diff --git a/charts/metallb/templates/speaker/serviceaccount.yaml b/charts/metallb/templates/speaker/serviceaccount.yaml index 9e461355b5..abc4b314c8 100644 --- a/charts/metallb/templates/speaker/serviceaccount.yaml +++ b/charts/metallb/templates/speaker/serviceaccount.yaml @@ -2,13 +2,21 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ include "metallb.speakerServiceAccountName" . }} + name: {{ include "metallb.speaker.serviceAccountName" . }} + namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} app.kubernetes.io/component: speaker {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- if or .Values.speaker.serviceAccount.annotations .Values.commonAnnotations }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.speaker.serviceAccount.annotations }} + {{- include "common.tplvalues.render" (dict "value" .Values.speaker.serviceAccount.annotations "context" $) | nindent 4 }} + {{- end }} {{- end }} +automountServiceAccountToken: {{ .Values.speaker.serviceAccount.automountServiceAccountToken }} {{- end -}} diff --git a/charts/metallb/templates/speaker/servicemonitor.yaml b/charts/metallb/templates/speaker/servicemonitor.yaml index 3bb4dabed1..5d2cde7fb0 100644 --- a/charts/metallb/templates/speaker/servicemonitor.yaml +++ b/charts/metallb/templates/speaker/servicemonitor.yaml @@ -1,33 +1,51 @@ -{{- if .Values.speaker.prometheus.serviceMonitor.enabled }} +{{- if and .Values.speaker.metrics.enabled .Values.speaker.metrics.serviceMonitor.enabled }} apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: - name: {{ include "common.names.fullname" . }}-speaker + name: {{ printf "%s-speaker" (include "common.names.fullname" .) }} + {{- if .Values.speaker.metrics.serviceMonitor.namespace }} + namespace: {{ .Values.speaker.metrics.serviceMonitor.namespace | quote }} + {{- else }} + namespace: {{ include "common.names.namespace" . | quote }} + {{- end }} labels: {{- include "common.labels.standard" . | nindent 4 }} app.kubernetes.io/component: speaker {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} + {{- if .Values.speaker.metrics.serviceMonitor.labels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.speaker.metrics.serviceMonitor.labels "context" $ ) | nindent 4 }} + {{- end }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} spec: - jobLabel: {{ .Values.speaker.prometheus.serviceMonitor.jobLabel | quote }} + jobLabel: {{ .Values.speaker.metrics.serviceMonitor.jobLabel | quote }} selector: matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} app.kubernetes.io/component: speaker + {{- if .Values.speaker.metrics.serviceMonitor.selector }} + {{- include "common.tplvalues.render" (dict "value" .Values.speaker.metrics.serviceMonitor.selector "context" $) | nindent 6 }} + {{- end }} namespaceSelector: matchNames: - - {{ .Release.Namespace }} + - {{ include "common.names.namespace" .| quote }} endpoints: - - port: metrics - {{- if .Values.speaker.prometheus.serviceMonitor.interval }} - interval: {{ .Values.speaker.prometheus.serviceMonitor.interval }} - {{- end }} - {{- if .Values.speaker.prometheus.serviceMonitor.metricRelabelings }} - metricRelabelings: {{ toYaml .Values.speaker.prometheus.serviceMonitor.metricRelabelings | nindent 4 }} - {{- end }} - {{- if .Values.speaker.prometheus.serviceMonitor.relabelings }} - relabelings: {{ toYaml .Values.speaker.prometheus.serviceMonitor.relabelings | nindent 4 }} - {{- end }} -{{- end }} + - port: metrics + {{- if .Values.speaker.metrics.serviceMonitor.interval }} + interval: {{ .Values.speaker.metrics.serviceMonitor.interval }} + {{- end }} + {{- if .Values.speaker.metrics.serviceMonitor.scrapeTimeout }} + scrapeTimeout: {{ .Values.speaker.metrics.serviceMonitor.scrapeTimeout }} + {{- end }} + {{- if .Values.speaker.metrics.serviceMonitor.honorLabels }} + honorLabels: {{ .Values.speaker.metrics.serviceMonitor.honorLabels }} + {{- end }} + {{- if .Values.speaker.metrics.serviceMonitor.metricRelabelings }} + metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.speaker.metrics.serviceMonitor.metricRelabelings "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.speaker.metrics.serviceMonitor.relabelings }} + relabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.speaker.metrics.serviceMonitor.relabelings "context" $) | nindent 8 }} + {{- end }} +{{- end -}} diff --git a/charts/metallb/values.yaml b/charts/metallb/values.yaml index 169d1ecc8d..452905e2ef 100644 --- a/charts/metallb/values.yaml +++ b/charts/metallb/values.yaml @@ -16,6 +16,9 @@ global: ## @section Common parameters +## @param kubeVersion Force target Kubernetes version (using Helm capabilities if not set) +## +kubeVersion: "" ## @param nameOverride String to partially override metallb.fullname include (will maintain the release name) ## nameOverride: "" @@ -32,6 +35,20 @@ commonAnnotations: {} ## extraDeploy: [] +## Enable diagnostic mode in the deployment(s)/statefulset(s) +## +diagnosticMode: + ## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden) + ## + enabled: false + ## @param diagnosticMode.command Command to override all containers in the the deployment(s)/statefulset(s) + ## + command: + - sleep + ## @param diagnosticMode.args Args to override all containers in the the deployment(s)/statefulset(s) + ## + args: + - infinity ## @section MetalLB parameters ## To configure MetalLB, you must specify ONE of the following two @@ -96,7 +113,7 @@ controller: image: registry: docker.io repository: bitnami/metallb-controller - tag: 0.11.0-debian-10-r73 + tag: 0.12.1-debian-10-r89 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -110,6 +127,17 @@ controller: ## - myRegistryKeySecretName ## pullSecrets: [] + ## @param controller.updateStrategy.type Metallb controller deployment strategy type. + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy + ## e.g: + ## updateStrategy: + ## type: RollingUpdate + ## rollingUpdate: + ## maxSurge: 25% + ## maxUnavailable: 25% + ## + updateStrategy: + type: RollingUpdate ## @param controller.hostAliases Deployment pod host aliases ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ ## @@ -130,9 +158,22 @@ controller: ## @param controller.psp.create Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later ## create: true - ## @param controller.priorityClassName Set pod priorityClassName + ## @param controller.priorityClassName Metallb controller pods' priorityClassName ## priorityClassName: "" + ## @param controller.schedulerName Name of the k8s scheduler (other than default) + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param controller.terminationGracePeriodSeconds In seconds, time the given to the Metallb controller pod needs to terminate gracefully + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods + ## + terminationGracePeriodSeconds: 0 + ## @param controller.topologySpreadConstraints Topology Spread Constraints for pod assignment + ## https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + ## The value is evaluated as a template + ## + topologySpreadConstraints: [] ## Controller container resource requests and limits ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ ## We usually recommend not to specify default resources and to leave this as a conscious @@ -201,44 +242,100 @@ controller: ## - e2e-az2 ## values: [] - serviceAccount: - ## @param controller.serviceAccount.create Specifies whether a ServiceAccount should be created - ## - create: true - ## @param controller.serviceAccount.name The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template - ## - name: "" - ## Pod securityContext - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - ## @param controller.securityContext.enabled Enable pods' security context - ## @param controller.securityContext.runAsNonRoot MetalLB Controller must runs as nonRoot. - ## @param controller.securityContext.runAsUser User ID for the pods. - ## @param controller.securityContext.fsGroup Group ID for the pods. - ## @param controller.securityContext.allowPrivilegeEscalation This defines if privilegeEscalation is allowed on that container - ## @param controller.securityContext.readOnlyRootFilesystem This defines if the container can read the root fs on the host - ## @param controller.securityContext.capabilities.drop [array] Drop capabilities for the securityContext - ## - securityContext: + ## Configure Pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param controller.podSecurityContext.enabled Enabled Metallb Controller pods' Security Context + ## @param controller.podSecurityContext.fsGroup Set Metallb Controller pod's Security Context fsGroup + ## + podSecurityContext: enabled: true - runAsNonRoot: true - runAsUser: 1001 fsGroup: 1001 + ## Configure Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param controller.containerSecurityContext.enabled Enabled Metallb Controller containers' Security Context + ## @param controller.containerSecurityContext.runAsUser Set Metallb Controller containers' Security Context runAsUser + ## @param controller.containerSecurityContext.runAsNonRoot Set Metallb Controller container's Security Context runAsNonRoot + ## @param controller.containerSecurityContext.allowPrivilegeEscalation Enables privilege Escalation context for the pod. + ## @param controller.containerSecurityContext.readOnlyRootFilesystem Allows the pod to mount the RootFS as ReadOnly + ## @param controller.containerSecurityContext.capabilities.drop [array] Drop capabilities for the securityContext + ## + containerSecurityContext: + enabled: true + runAsUser: 1001 + runAsNonRoot: true allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL + ## @param controller.command Override default container command (useful when using custom images) + ## + command: [] + ## @param controller.args Override default container args (useful when using custom images) + ## + args: [] + ## @param controller.lifecycleHooks for the Metallb Controller container(s) to automate configuration before or after startup + ## + lifecycleHooks: {} + ## @param controller.extraEnvVars Extra environment variable to pass to the running container. + ## For example: + ## extraEnvVars: + ## - name: MY_ENV_VAR + ## value: env_var_value + ## + extraEnvVars: [] + ## @param controller.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for Metallb controller nodes + ## + extraEnvVarsCM: "" + ## @param controller.extraEnvVarsSecret Name of existing Secret containing extra env vars for Metallb controller nodes + ## + extraEnvVarsSecret: "" + ## @param controller.extraVolumes Optionally specify extra list of additional volumes for the Metallb controller pod(s) + ## + extraVolumes: [] + ## @param controller.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Metallb controller container(s) + ## + extraVolumeMounts: [] + ## @param controller.sidecars Add additional sidecar containers to the Metallb Controller pod(s) + ## e.g: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param controller.initContainers Add additional init containers to the Metallb Controller pod(s) + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + ## e.g: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## command: ['sh', '-c', 'echo "hello world"'] + ## + initContainers: [] + ## Pods Service Account + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ + ## @param controller.serviceAccount.create Specifies whether a ServiceAccount should be created + ## @param controller.serviceAccount.name Name of the service account to use. If not set and create is true, a name is generated using the fullname template. + ## @param controller.serviceAccount.automountServiceAccountToken Automount service account token for the server service account + ## @param controller.serviceAccount.annotations Annotations for service account. Evaluated as a template. Only used if `create` is `true`. + ## + serviceAccount: + create: true + name: "" + automountServiceAccountToken: true + annotations: {} ## @param controller.revisionHistoryLimit Configure the revisionHistoryLimit of the Controller deployment ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#revision-history-limit ## revisionHistoryLimit: 3 - ## @param controller.terminationGracePeriodSeconds Configure the grace time period for sig term - ## ref: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#hook-handler-execution + ## @param controller.containerPorts.metrics Configures the ports the MetalLB Controller listens on for metrics ## - terminationGracePeriodSeconds: 0 - ## @param controller.containerPort.metrics Configures the ports the MetalLB Controller listens on for metrics - ## - containerPort: + containerPorts: metrics: 7472 ## Liveness probe values ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes @@ -272,25 +369,89 @@ controller: periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 - prometheus: - ## Prometheus Operator service monitors + ## Startup probe values + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + ## @param controller.startupProbe.enabled Enable startupProbe + ## @param controller.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param controller.startupProbe.periodSeconds Period seconds for startupProbe + ## @param controller.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param controller.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param controller.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + failureThreshold: 3 + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + ## @param controller.customStartupProbe Custom liveness probe for the Web component + ## + customStartupProbe: {} + ## @param controller.customLivenessProbe Custom liveness probe for the Web component + ## + customLivenessProbe: {} + ## @param controller.customReadinessProbe Custom readiness probe for the Web component + ## + customReadinessProbe: {} + + ## @section Metallb controller Prometheus metrics export + ## + metrics: + ## @param controller.metrics.enabled Enable the export of Prometheus metrics + ## + enabled: false + ## Prometheus Exporter service parameters + ## + service: + ## @param controller.metrics.service.port Prometheus metrics service port + ## + port: 7472 + ## @param controller.metrics.service.annotations [object] Annotations for the Prometheus Exporter service service + ## + annotations: + prometheus.io/scrape: "true" + prometheus.io/port: "7472" + prometheus.io/path: "/metrics" ## Prometheus Operator service monitors ## serviceMonitor: - ## @param controller.prometheus.serviceMonitor.enabled Specify if a servicemonitor will be deployed for prometheus-operator + ## @param controller.metrics.serviceMonitor.enabled Specify if a servicemonitor will be deployed for prometheus-operator ## enabled: false - ## @param controller.prometheus.serviceMonitor.jobLabel Specify the jobLabel to use for the prometheus-operator + ## @param controller.metrics.serviceMonitor.namespace Namespace which Prometheus is running in + ## e.g: + ## namespace: monitoring + ## + namespace: "" + ## @param controller.metrics.serviceMonitor.jobLabel Specify the jobLabel to use for the prometheus-operator ## jobLabel: "app.kubernetes.io/name" - ## @param controller.prometheus.serviceMonitor.interval Scrape interval. If not set, the Prometheus default scrape interval is used + ## @param controller.metrics.serviceMonitor.interval Scrape interval. If not set, the Prometheus default scrape interval is used ## interval: "" - ## @param controller.prometheus.serviceMonitor.metricRelabelings Specify additional relabeling of metrics + ## @param controller.metrics.serviceMonitor.scrapeTimeout Timeout after which the scrape is ended + ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint + ## + scrapeTimeout: "" + ## @param controller.metrics.serviceMonitor.metricRelabelings Specify additional relabeling of metrics ## metricRelabelings: [] - ## @param controller.prometheus.serviceMonitor.relabelings Specify general relabeling + ## @param controller.metrics.serviceMonitor.relabelings Specify general relabeling ## relabelings: [] + ## @param controller.metrics.serviceMonitor.selector ServiceMonitor selector labels + ## ref: https://github.com/bitnami/charts/tree/master/bitnami/prometheus-operator#prometheus-configuration + ## + ## selector: + ## prometheus: my-prometheus + ## + selector: {} + ## @param controller.metrics.serviceMonitor.labels Extra labels for the ServiceMonitor + ## + labels: {} + ## @param controller.metrics.serviceMonitor.honorLabels honorLabels chooses the metric's labels on collisions with target labels + ## + honorLabels: false ## @section Speaker parameters @@ -307,7 +468,7 @@ speaker: image: registry: docker.io repository: bitnami/metallb-speaker - tag: 0.11.0-debian-10-r74 + tag: 0.12.1-debian-10-r90 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -321,6 +482,14 @@ speaker: ## - myRegistryKeySecretName ## pullSecrets: [] + ## @param speaker.updateStrategy.type Speaker daemonset strategy type + ## ref: https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/ + ## + updateStrategy: + ## StrategyType + ## Can be set to RollingUpdate or OnDelete + ## + type: RollingUpdate ## If global .Values.rbac.create is disabled no rbac is created. ## This value is then meaningless ## Defines if the speaker rbac should be created. @@ -341,9 +510,13 @@ speaker: ## @param speaker.psp.create Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later ## create: true - ## @param speaker.priorityClassName Set pod priorityClassName. + ## @param speaker.priorityClassName Speaker pods' priorityClassName ## priorityClassName: "" + ## @param speaker.terminationGracePeriodSeconds In seconds, time the given to the Speaker pod needs to terminate gracefully + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods + ## + terminationGracePeriodSeconds: 2 ## Speaker container resource requests and limits ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ ## We usually recommend not to specify default resources and to leave this as a conscious @@ -376,6 +549,31 @@ speaker: ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity ## affinity: {} + ## Node speaker.affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param speaker.nodeAffinityPreset.type Node affinity preset type. Ignored if `speaker.affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param speaker.nodeAffinityPreset.key Node label key to match. Ignored if `speaker.affinity` is set + ## + key: "" + ## @param speaker.nodeAffinityPreset.values Node label values to match. Ignored if `speaker.affinity` is set + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param speaker.podAffinityPreset Pod affinity preset. Ignored if `speaker.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param speaker.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `speaker.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft ## @param speaker.podAnnotations Speaker Pod annotations ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ ## @@ -384,24 +582,78 @@ speaker: ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ ## podLabels: {} + ## Configure Pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param speaker.podSecurityContext.enabled Enabled Speaker pods' Security Context + ## @param speaker.podSecurityContext.fsGroup Set Speaker pod's Security Context fsGroup + ## + podSecurityContext: + enabled: true + fsGroup: 0 + ## Configure Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param speaker.containerSecurityContext.enabled Enabled Speaker containers' Security Context + ## @param speaker.containerSecurityContext.runAsUser Set Speaker containers' Security Context runAsUser + ## @param speaker.containerSecurityContext.allowPrivilegeEscalation Enables privilege Escalation context for the pod. + ## @param speaker.containerSecurityContext.readOnlyRootFilesystem Allows the pod to mount the RootFS as ReadOnly + ## @param speaker.containerSecurityContext.capabilities.drop [array] Drop capabilities for the securityContext + ## @param speaker.containerSecurityContext.capabilities.add [array] Add capabilities for the securityContext + ## + + containerSecurityContext: + enabled: true + runAsUser: 0 + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + add: + - NET_ADMIN + - NET_RAW + - SYS_ADMIN + ## @param speaker.command Override default container command (useful when using custom images) + ## + command: [] + ## @param speaker.args Override default container args (useful when using custom images) + ## + args: [] + ## @param speaker.lifecycleHooks for the Speaker container(s) to automate configuration before or after startup + ## + lifecycleHooks: {} + ## @param speaker.sidecars Add additional sidecar containers to the Speaker pod(s) + ## e.g: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param speaker.initContainers Add additional init containers to the Speaker pod(s) + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + ## e.g: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## command: ['sh', '-c', 'echo "hello world"'] + ## + initContainers: [] + ## Pods Service Account + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ + ## @param speaker.serviceAccount.create Specifies whether a ServiceAccount should be created + ## @param speaker.serviceAccount.name Name of the service account to use. If not set and create is true, a name is generated using the fullname template. + ## @param speaker.serviceAccount.automountServiceAccountToken Automount service account token for the server service account + ## @param speaker.serviceAccount.annotations Annotations for service account. Evaluated as a template. Only used if `create` is `true`. + ## serviceAccount: - ## @param speaker.serviceAccount.create Specifies whether a ServiceAccount should be created - ## create: true - ## @param speaker.serviceAccount.name The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template - ## name: "" - ## Daemonset configuration - ## - daemonset: - ## @param speaker.daemonset.terminationGracePeriodSeconds Configure the grace time period for sig term - ## ref: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#hook-handler-execution - ## - terminationGracePeriodSeconds: 2 - ## @param speaker.daemonset.hostPorts.metrics HTTP Metrics Endpoint - ## - hostPorts: - metrics: 7472 + automountServiceAccountToken: true + annotations: {} ## Defines a secret to use outside of the auto generate ## @param speaker.secretName References a Secret name for the member secret outside of the helm chart ## @param speaker.secretKey References a Secret key the member secret outside of the helm chart @@ -415,30 +667,6 @@ speaker: secretName: "" secretKey: "" secretValue: "" - ## @param speaker.initContainers Extra initContainers to add to the daemonset - ## - initContainers: [] - ## Pod securityContext - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - ## @param speaker.securityContext.enabled Enable pods' security context - ## @param speaker.securityContext.runAsUser User ID for the pods. - ## @param speaker.securityContext.allowPrivilegeEscalation Enables privilege Escalation context for the pod. - ## @param speaker.securityContext.readOnlyRootFilesystem Allows the pod to mount the RootFS as ReadOnly - ## @param speaker.securityContext.capabilities.drop [array] Drop capabilities for the securityContext - ## @param speaker.securityContext.capabilities.add [array] Add capabilities for the securityContext - ## - securityContext: - enabled: true - runAsUser: 0 - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: - drop: - - ALL - add: - - NET_ADMIN - - NET_RAW - - SYS_ADMIN ## @param speaker.extraEnvVars Extra environment variable to pass to the running container. ## For example: ## extraEnvVars: @@ -446,6 +674,22 @@ speaker: ## value: env_var_value ## extraEnvVars: [] + ## @param speaker.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for Speaker nodes + ## + extraEnvVarsCM: "" + ## @param speaker.extraEnvVarsSecret Name of existing Secret containing extra env vars for Speaker nodes + ## + extraEnvVarsSecret: "" + ## @param speaker.extraVolumes Optionally specify extra list of additional volumes for the Speaker pod(s) + ## + extraVolumes: [] + ## @param speaker.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Speaker container(s) + ## + extraVolumeMounts: [] + ## @param speaker.containerPorts.metrics HTTP Metrics Endpoint + ## + containerPorts: + metrics: 7472 ## Liveness probe values ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes ## @param speaker.livenessProbe.enabled Enable livenessProbe @@ -478,22 +722,86 @@ speaker: periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 - prometheus: + ## Startup probe values + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + ## @param speaker.startupProbe.enabled Enable startupProbe + ## @param speaker.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param speaker.startupProbe.periodSeconds Period seconds for startupProbe + ## @param speaker.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param speaker.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param speaker.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + failureThreshold: 3 + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + ## @param speaker.customStartupProbe Custom liveness probe for the Web component + ## + customStartupProbe: {} + ## @param speaker.customLivenessProbe Custom liveness probe for the Web component + ## + customLivenessProbe: {} + ## @param speaker.customReadinessProbe Custom readiness probe for the Web component + ## + customReadinessProbe: {} + + ## @section Speaker Prometheus metrics export + metrics: + ## @param speaker.metrics.enabled Enable the export of Prometheus metrics + ## + enabled: false + ## Prometheus Exporter service parameters + ## + service: + ## @param speaker.metrics.service.port Prometheus metrics service port + ## + port: 7472 + ## @param speaker.metrics.service.annotations [object] Annotations for the Prometheus Exporter service service + ## + annotations: + prometheus.io/scrape: "true" + prometheus.io/port: "7472" + prometheus.io/path: "/metrics" ## Prometheus Operator service monitors ## serviceMonitor: - ## @param speaker.prometheus.serviceMonitor.enabled Enable support for Prometheus Operator + ## @param speaker.metrics.serviceMonitor.enabled Enable support for Prometheus Operator ## enabled: false - ## @param speaker.prometheus.serviceMonitor.jobLabel Job label for scrape target + ## @param speaker.metrics.serviceMonitor.namespace Namespace which Prometheus is running in + ## e.g: + ## namespace: monitoring + ## + namespace: "" + ## @param speaker.metrics.serviceMonitor.jobLabel Job label for scrape target ## jobLabel: "app.kubernetes.io/name" - ## @param speaker.prometheus.serviceMonitor.interval Scrape interval. If not set, the Prometheus default scrape interval is used + ## @param speaker.metrics.serviceMonitor.interval Scrape interval. If not set, the Prometheus default scrape interval is used ## interval: "" - ## @param speaker.prometheus.serviceMonitor.metricRelabelings Specify additional relabeling of metrics + ## @param speaker.metrics.serviceMonitor.scrapeTimeout Timeout after which the scrape is ended + ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint + ## + scrapeTimeout: "" + ## @param speaker.metrics.serviceMonitor.metricRelabelings Specify additional relabeling of metrics ## metricRelabelings: [] - ## @param speaker.prometheus.serviceMonitor.relabelings Specify general relabeling + ## @param speaker.metrics.serviceMonitor.relabelings Specify general relabeling ## relabelings: [] + ## @param speaker.metrics.serviceMonitor.selector ServiceMonitor selector labels + ## ref: https://github.com/bitnami/charts/tree/master/bitnami/prometheus-operator#prometheus-configuration + ## + ## selector: + ## prometheus: my-prometheus + ## + selector: {} + ## @param speaker.metrics.serviceMonitor.labels Extra labels for the ServiceMonitor + ## + labels: {} + ## @param speaker.metrics.serviceMonitor.honorLabels honorLabels chooses the metric's labels on collisions with target labels + ## + honorLabels: false diff --git a/salt/metalk8s/addons/metallb/deployed/chart.sls b/salt/metalk8s/addons/metallb/deployed/chart.sls index 59297d7dda..c9a9fb1c93 100644 --- a/salt/metalk8s/addons/metallb/deployed/chart.sls +++ b/salt/metalk8s/addons/metallb/deployed/chart.sls @@ -7,6 +7,7 @@ {% raw %} apiVersion: v1 +automountServiceAccountToken: true kind: ServiceAccount metadata: labels: @@ -15,12 +16,13 @@ metadata: app.kubernetes.io/managed-by: salt app.kubernetes.io/name: metallb app.kubernetes.io/part-of: metalk8s - helm.sh/chart: metallb-2.6.2 + helm.sh/chart: metallb-3.0.6 heritage: metalk8s name: metallb-controller namespace: metalk8s-loadbalancing --- apiVersion: v1 +automountServiceAccountToken: true kind: ServiceAccount metadata: labels: @@ -29,7 +31,7 @@ metadata: app.kubernetes.io/managed-by: salt app.kubernetes.io/name: metallb app.kubernetes.io/part-of: metalk8s - helm.sh/chart: metallb-2.6.2 + helm.sh/chart: metallb-3.0.6 heritage: metalk8s name: metallb-speaker namespace: metalk8s-loadbalancing @@ -43,7 +45,7 @@ metadata: app.kubernetes.io/managed-by: salt app.kubernetes.io/name: metallb app.kubernetes.io/part-of: metalk8s - helm.sh/chart: metallb-2.6.2 + helm.sh/chart: metallb-3.0.6 heritage: metalk8s name: metallb-controller namespace: metalk8s-loadbalancing @@ -88,7 +90,7 @@ metadata: app.kubernetes.io/managed-by: salt app.kubernetes.io/name: metallb app.kubernetes.io/part-of: metalk8s - helm.sh/chart: metallb-2.6.2 + helm.sh/chart: metallb-3.0.6 heritage: metalk8s name: metallb-speaker namespace: metalk8s-loadbalancing @@ -128,7 +130,7 @@ metadata: app.kubernetes.io/managed-by: salt app.kubernetes.io/name: metallb app.kubernetes.io/part-of: metalk8s - helm.sh/chart: metallb-2.6.2 + helm.sh/chart: metallb-3.0.6 heritage: metalk8s name: metallb-controller namespace: metalk8s-loadbalancing @@ -150,7 +152,7 @@ metadata: app.kubernetes.io/managed-by: salt app.kubernetes.io/name: metallb app.kubernetes.io/part-of: metalk8s - helm.sh/chart: metallb-2.6.2 + helm.sh/chart: metallb-3.0.6 heritage: metalk8s name: metallb-speaker namespace: metalk8s-loadbalancing @@ -171,7 +173,7 @@ metadata: app.kubernetes.io/managed-by: salt app.kubernetes.io/name: metallb app.kubernetes.io/part-of: metalk8s - helm.sh/chart: metallb-2.6.2 + helm.sh/chart: metallb-3.0.6 heritage: metalk8s name: metallb-config-watcher namespace: metalk8s-loadbalancing @@ -194,7 +196,7 @@ metadata: app.kubernetes.io/managed-by: salt app.kubernetes.io/name: metallb app.kubernetes.io/part-of: metalk8s - helm.sh/chart: metallb-2.6.2 + helm.sh/chart: metallb-3.0.6 heritage: metalk8s name: metallb-pod-lister namespace: metalk8s-loadbalancing @@ -214,7 +216,7 @@ metadata: app.kubernetes.io/managed-by: salt app.kubernetes.io/name: metallb app.kubernetes.io/part-of: metalk8s - helm.sh/chart: metallb-2.6.2 + helm.sh/chart: metallb-3.0.6 heritage: metalk8s name: metallb-config-watcher namespace: metalk8s-loadbalancing @@ -237,7 +239,7 @@ metadata: app.kubernetes.io/managed-by: salt app.kubernetes.io/name: metallb app.kubernetes.io/part-of: metalk8s - helm.sh/chart: metallb-2.6.2 + helm.sh/chart: metallb-3.0.6 heritage: metalk8s name: metallb-pod-lister namespace: metalk8s-loadbalancing @@ -258,7 +260,7 @@ metadata: app.kubernetes.io/managed-by: salt app.kubernetes.io/name: metallb app.kubernetes.io/part-of: metalk8s - helm.sh/chart: metallb-2.6.2 + helm.sh/chart: metallb-3.0.6 heritage: metalk8s name: metallb-speaker namespace: metalk8s-loadbalancing @@ -276,9 +278,24 @@ spec: app.kubernetes.io/managed-by: salt app.kubernetes.io/name: metallb app.kubernetes.io/part-of: metalk8s - helm.sh/chart: metallb-2.6.2 + helm.sh/chart: metallb-3.0.6 heritage: metalk8s spec: + affinity: + nodeAffinity: null + podAffinity: null + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app.kubernetes.io/component: speaker + app.kubernetes.io/instance: metallb + app.kubernetes.io/name: metallb + namespaces: + - metalk8s-loadbalancing + topologyKey: kubernetes.io/hostname + weight: 1 containers: - args: - --port=7472 @@ -307,7 +324,8 @@ spec: secretKeyRef: key: secretkey name: metallb-memberlist - image: {% endraw -%}{{ build_image_name("metallb-speaker", False) }}{%- raw %}:0.11.0-debian-10-r74 + envFrom: null + image: {% endraw -%}{{ build_image_name("metallb-speaker", False) }}{%- raw %}:0.12.1-debian-10-r90 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 @@ -349,6 +367,8 @@ spec: nodeSelector: kubernetes.io/os: linux node-role.kubernetes.io/master: '' + securityContext: + fsGroup: 0 serviceAccountName: metallb-speaker terminationGracePeriodSeconds: 2 tolerations: @@ -361,6 +381,8 @@ spec: - effect: NoSchedule key: node-role.kubernetes.io/infra operator: Exists + updateStrategy: + type: RollingUpdate --- apiVersion: apps/v1 kind: Deployment @@ -371,17 +393,20 @@ metadata: app.kubernetes.io/managed-by: salt app.kubernetes.io/name: metallb app.kubernetes.io/part-of: metalk8s - helm.sh/chart: metallb-2.6.2 + helm.sh/chart: metallb-3.0.6 heritage: metalk8s name: metallb-controller namespace: metalk8s-loadbalancing spec: + replicas: 1 revisionHistoryLimit: 3 selector: matchLabels: app.kubernetes.io/component: controller app.kubernetes.io/instance: metallb app.kubernetes.io/name: metallb + strategy: + type: RollingUpdate template: metadata: annotations: @@ -394,7 +419,7 @@ spec: app.kubernetes.io/managed-by: salt app.kubernetes.io/name: metallb app.kubernetes.io/part-of: metalk8s - helm.sh/chart: metallb-2.6.2 + helm.sh/chart: metallb-3.0.6 heritage: metalk8s spec: affinity: @@ -416,7 +441,9 @@ spec: - args: - --port=7472 - --config=metallb-config - image: {% endraw -%}{{ build_image_name("metallb-controller", False) }}{%- raw %}:0.11.0-debian-10-r73 + env: null + envFrom: null + image: {% endraw -%}{{ build_image_name("metallb-controller", False) }}{%- raw %}:0.12.1-debian-10-r89 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 @@ -449,15 +476,14 @@ spec: drop: - ALL readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1001 nodeSelector: kubernetes.io/os: linux node-role.kubernetes.io/master: '' securityContext: fsGroup: 1001 - runAsNonRoot: true - runAsUser: 1001 serviceAccountName: metallb-controller - terminationGracePeriodSeconds: 0 tolerations: - effect: NoSchedule key: node-role.kubernetes.io/bootstrap @@ -471,7 +497,7 @@ spec: --- apiVersion: v1 data: - secretkey: NzRieDFTaW92U1h5cWhXYXVuakZyTThlMGx6MU44T0lYTlJQOHZHejlpUkFQZEZiSUdLeFA1WlFXajRCRm1qSmRPc0xRQ00xVTZsNVM0Y0NVYklnVU55RHpJejdyTkFVeWZlSkpqU2UxU0pTU1c1ZzJPUUYzYW5rOExyQnNzNHpVZmoyRFJ5SGZaakJKM2RCVGZpUHpxc200cHpQbWtQTWlPazVpMUdDTnAwclRzSmU2ZjJhSDJkZ2ZIeW8xQkkwU3dmMXY1UzhHUlBzT3JQT1VReW8xRWx1aGJxbGdFZmRuUGJQVDFub1VKODhaQzdodWRSREpmazE2MzBmNFBzVQ== + secretkey: V3NINmJucWdkSDFaelRHWHlvZEh1RHNjOHFtbzd0Z0dGam5DbXpKa1MxU1lkNktRcmthVDBrcjlJeU9lOEgyZHI4QndxZm5hOGFlWndsRWhubnY0QmpFcmpOZnJPSWh0TlhpcmowRUVvYmd6VWtqMDBncEcxelZTSGFZRTg1Mk9NcEh4c200Z3RLMkh0bzZsTFpGNUNSdDhTaWFNTzFpTXBYQUVGT0FSZVdqZExKdU52R0RtOVhZMVBNWWtYQlNMOEZaamM1cFpqOUdTR0dPQ3FiSUpsOWozMk1wcml2VGV2OERnN2NnYmhweUVtY1h2alBOczFxcTZOV3BQTWgydw== kind: Secret metadata: annotations: @@ -483,7 +509,7 @@ metadata: app.kubernetes.io/managed-by: salt app.kubernetes.io/name: metallb app.kubernetes.io/part-of: metalk8s - helm.sh/chart: metallb-2.6.2 + helm.sh/chart: metallb-3.0.6 heritage: metalk8s name: metallb-memberlist namespace: metalk8s-loadbalancing