Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(helm-chart): make charts Openshift compliant #3415

Merged
merged 9 commits into from
Apr 23, 2024
Merged

feat(helm-chart): make charts Openshift compliant #3415

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
1fb4e27
chore: Add test for Openshift.
smuda Apr 13, 2024
82d1565
chore keptn-cert-manager: Remove runAsUser and runAsGroup if running …
smuda Apr 13, 2024
8093aad
chore lifecycle-operator: Remove runAsUser and runAsGroup if running …
smuda Apr 13, 2024
106e7e3
chore metrics-operator: Remove runAsUser and runAsGroup if running on…
smuda Apr 13, 2024
e28a04b
chore: Add values and documentation for removing runAsUser and runAsG…
smuda Apr 13, 2024
e1c87c0
docs: Add documentation about running on Openshift.
smuda Apr 13, 2024
78ef5f6
Update docs/docs/installation/configuration/Openshift.md
smuda Apr 23, 2024
df63a1a
Update docs/docs/installation/configuration/Openshift.md
smuda Apr 23, 2024
87cae22
Update docs/docs/installation/configuration/Openshift.md
smuda Apr 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15,826 changes: 15,826 additions & 0 deletions .github/scripts/.helm-tests/Openshift/result.yaml
View file
Open in desktop

Large diffs are not rendered by default.

3 changes: 3 additions & 0 deletions .github/scripts/.helm-tests/Openshift/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
global:
openShift:
enabled: true
4 changes: 2 additions & 2 deletions .github/scripts/.helm-tests/default/result.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15399,8 +15399,8 @@ spec:
- ALL
privileged: false
runAsGroup: 65532
runAsNonRoot: true
runAsUser: 65532
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
volumeMounts:
Expand Down Expand Up @@ -15596,8 +15596,8 @@ spec:
- ALL
privileged: false
runAsGroup: 65532
runAsNonRoot: true
runAsUser: 65532
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
volumeMounts:
Expand Down
2 changes: 1 addition & 1 deletion .github/scripts/.helm-tests/lifecycle-only/result.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11965,8 +11965,8 @@ spec:
- ALL
privileged: false
runAsGroup: 65532
runAsNonRoot: true
runAsUser: 65532
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
volumeMounts:
Expand Down
2 changes: 1 addition & 1 deletion .github/scripts/.helm-tests/lifecycle-with-certs/result.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12266,8 +12266,8 @@ spec:
- ALL
privileged: false
runAsGroup: 65532
runAsNonRoot: true
runAsUser: 65532
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
volumeMounts:
Expand Down
4 changes: 2 additions & 2 deletions .github/scripts/.helm-tests/local-global-precedence/result.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15725,8 +15725,8 @@ spec:
- ALL
privileged: false
runAsGroup: 65532
runAsNonRoot: true
runAsUser: 65532
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
volumeMounts:
Expand Down Expand Up @@ -15937,8 +15937,8 @@ spec:
- ALL
privileged: false
runAsGroup: 65532
runAsNonRoot: true
runAsUser: 65532
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
volumeMounts:
Expand Down
2 changes: 1 addition & 1 deletion .github/scripts/.helm-tests/metrics-only-with-apiservice-disabled/result.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3200,8 +3200,8 @@ spec:
- ALL
privileged: false
runAsGroup: 65532
runAsNonRoot: true
runAsUser: 65532
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
volumeMounts:
Expand Down
2 changes: 1 addition & 1 deletion .github/scripts/.helm-tests/metrics-only/result.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3221,8 +3221,8 @@ spec:
- ALL
privileged: false
runAsGroup: 65532
runAsNonRoot: true
runAsUser: 65532
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
volumeMounts:
Expand Down
2 changes: 1 addition & 1 deletion .github/scripts/.helm-tests/metrics-with-certs/result.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3522,8 +3522,8 @@ spec:
- ALL
privileged: false
runAsGroup: 65532
runAsNonRoot: true
runAsUser: 65532
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
volumeMounts:
Expand Down
1 change: 1 addition & 0 deletions chart/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,3 +25,4 @@ metrics, observability, health checks, with pre- and post-deployment evaluations
| `global.commonLabels` | Common labels to add to all Keptn resources. Evaluated as a template | `{}` |
| `global.commonAnnotations` | Common annotations to add to all Keptn resources. Evaluated as a template | `{}` |
| `global.caInjectionAnnotations` | CA injection annotations for cert-manager.io configuration | `{}` |
| `global.openShift.enabled` | Enable this value to install on Openshift | `false` |
odubajDT marked this conversation as resolved.
Show resolved Hide resolved
3 changes: 3 additions & 0 deletions chart/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,3 +31,6 @@ global:
commonAnnotations: {}
## @param global.caInjectionAnnotations CA injection annotations for cert-manager.io configuration
caInjectionAnnotations: {}
openShift:
## @param global.openShift.enabled Enable this value to install on Openshift
odubajDT marked this conversation as resolved.
Show resolved Hide resolved
enabled: false
23 changes: 23 additions & 0 deletions docs/docs/installation/configuration/Openshift.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
---
comments: true
---

# Installing on Openshift
odubajDT marked this conversation as resolved.
Show resolved Hide resolved

To install on Openshift, set the value `global.isOpenshift` in the `values.yaml` file to true.
smuda marked this conversation as resolved.
Show resolved Hide resolved
In practice this means that `runAsUser` and `runAsGroup` are removed, since
Openshift sets those automatically.

You can set the `global.isOpenshift` parameter when running the `helm install` command:
smuda marked this conversation as resolved.
Show resolved Hide resolved

```shell
helm install keptn keptn --set global.openShift.enabled=true
smuda marked this conversation as resolved.
Show resolved Hide resolved
```

or you can define it in your `values.yaml` file:

```yaml
global:
openShift:
enabled: true
```
1 change: 1 addition & 0 deletions keptn-cert-manager/chart/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ resource.
| `global.commonLabels` | Common labels to add to all Keptn resources. Evaluated as a template | `{}` |
| `global.commonAnnotations` | Common annotations to add to all Keptn resources. Evaluated as a template | `{}` |
| `global.caInjectionAnnotations` | CA injection annotations for cert-manager.io configuration | `{}` |
| `global.openShift.enabled` | Enable this value to install on Openshift | `false` |
odubajDT marked this conversation as resolved.
Show resolved Hide resolved

### Keptn Certificate Operator common

Expand Down
2 changes: 2 additions & 0 deletions keptn-cert-manager/chart/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,10 +56,12 @@ spec:
capabilities: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext.capabilities "context" $) | nindent 14 }}
readOnlyRootFilesystem: {{ .Values.containerSecurityContext.readOnlyRootFilesystem
}}
{{- if not .Values.global.openShift.enabled }}
runAsGroup: {{ .Values.containerSecurityContext.runAsGroup
}}
runAsUser: {{ .Values.containerSecurityContext.runAsUser
}}
{{- end }}
seccompProfile: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext.seccompProfile
"context" $) | nindent 14 }}
{{- if .Values.livenessProbe }}
Expand Down
3 changes: 3 additions & 0 deletions keptn-cert-manager/chart/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,9 @@ global:
commonAnnotations: {}
## @param global.caInjectionAnnotations CA injection annotations for cert-manager.io configuration
caInjectionAnnotations: { }
openShift:
## @param global.openShift.enabled Enable this value to install on Openshift
odubajDT marked this conversation as resolved.
Show resolved Hide resolved
enabled: false


# yamllint disable rule:line-length
Expand Down
1 change: 1 addition & 0 deletions lifecycle-operator/chart/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ and application health checks
| `global.commonLabels` | Common labels to add to all Keptn resources. Evaluated as a template | `{}` |
| `global.commonAnnotations` | Common annotations to add to all Keptn resources. Evaluated as a template | `{}` |
| `global.caInjectionAnnotations` | CA injection annotations for cert-manager.io configuration | `{}` |
| `global.openShift.enabled` | Enable this value to install on Openshift | `false` |
odubajDT marked this conversation as resolved.
Show resolved Hide resolved
| `lifecycleOperatorConfig.health.healthProbeBindAddress` | setup on what address to start the default health handler | `:8081` |
| `lifecycleOperatorConfig.leaderElection.leaderElect` | enable leader election for multiple replicas of the lifecycle operator | `true` |
| `lifecycleOperatorConfig.leaderElection.resourceName` | define LeaderElectionID | `6b866dd9.keptn.sh` |
Expand Down
8 changes: 6 additions & 2 deletions lifecycle-operator/chart/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,12 +127,14 @@ spec:
"context" $) | nindent 12 }}
privileged: {{ .Values.lifecycleOperator.containerSecurityContext.privileged
}}
{{- if not .Values.global.openShift.enabled }}
runAsGroup: {{ .Values.lifecycleOperator.containerSecurityContext.runAsGroup
}}
runAsNonRoot: {{ .Values.lifecycleOperator.containerSecurityContext.runAsNonRoot
}}
runAsUser: {{ .Values.lifecycleOperator.containerSecurityContext.runAsUser
}}
{{- end }}
runAsNonRoot: {{ .Values.lifecycleOperator.containerSecurityContext.runAsNonRoot
}}
seccompProfile: {{- include "common.tplvalues.render" (dict "value" .Values.lifecycleOperator.containerSecurityContext.seccompProfile
"context" $) | nindent 12 }}
volumeMounts:
Expand Down Expand Up @@ -224,7 +226,9 @@ spec:
}}
runAsNonRoot: {{ .Values.scheduler.containerSecurityContext.runAsNonRoot
}}
{{- if not .Values.global.openShift.enabled }}
runAsUser: {{ .Values.scheduler.containerSecurityContext.runAsUser }}
{{- end }}
seccompProfile: {{- include "common.tplvalues.render" (dict "value" .Values.scheduler.containerSecurityContext.seccompProfile
"context" $) | nindent 12 }}
volumeMounts:
Expand Down
3 changes: 3 additions & 0 deletions lifecycle-operator/chart/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,9 @@ global:
## @param global.caInjectionAnnotations CA injection annotations for cert-manager.io configuration
##
caInjectionAnnotations: { }
openShift:
## @param global.openShift.enabled Enable this value to install on Openshift
odubajDT marked this conversation as resolved.
Show resolved Hide resolved
enabled: false

lifecycleOperatorConfig:
health:
Expand Down
1 change: 1 addition & 0 deletions metrics-operator/chart/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ Prometheus, Dynatrace, DataDog and K8s metric server...
| `global.commonLabels` | Common labels to add to all Keptn resources. Evaluated as a template | `{}` |
| `global.commonAnnotations` | Common annotations to add to all Keptn resources. Evaluated as a template | `{}` |
| `global.caInjectionAnnotations` | CA injection annotations for cert-manager.io configuration | `{}` |
| `global.openShift.enabled` | Enable this value to install on Openshift | `false` |
odubajDT marked this conversation as resolved.
Show resolved Hide resolved

### Keptn Metrics Operator common

Expand Down
6 changes: 4 additions & 2 deletions metrics-operator/chart/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,12 +83,14 @@ spec:
"context" $) | nindent 12 }}
privileged: {{ .Values.containerSecurityContext.privileged
}}
{{- if not .Values.global.openShift.enabled }}
runAsGroup: {{ .Values.containerSecurityContext.runAsGroup
}}
runAsNonRoot: {{ .Values.containerSecurityContext.runAsNonRoot
}}
runAsUser: {{ .Values.containerSecurityContext.runAsUser
}}
{{- end }}
runAsNonRoot: {{ .Values.containerSecurityContext.runAsNonRoot
}}
seccompProfile: {{- include "common.tplvalues.render" (dict "value" .Values.containerSecurityContext.seccompProfile
"context" $) | nindent 12 }}
volumeMounts:
Expand Down
3 changes: 3 additions & 0 deletions metrics-operator/chart/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,9 @@ global:
## @param global.caInjectionAnnotations CA injection annotations for cert-manager.io configuration
##
caInjectionAnnotations: { }
openShift:
## @param global.openShift.enabled Enable this value to install on Openshift
odubajDT marked this conversation as resolved.
Show resolved Hide resolved
enabled: false

## @section Keptn Metrics Operator common
## @extra operatorService.ports[0] webhook port (must correspond to Mutating Webhook Configurations)
Expand Down
1 change: 1 addition & 0 deletions mkdocs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,6 +125,7 @@ nav:
- vCluster installation: docs/installation/configuration/vcluster.md
- Keptn + cert-manager.io: docs/installation/configuration/cert-manager.md
- Deploy Keptn via ArgoCD: docs/installation/configuration/argocd.md
- Deploy Keptn on OpenShift: docs/installation/configuration/Openshift.md
- Installation Tips and Tricks: docs/installation/tips-tricks.md
- Troubleshooting Guide: docs/installation/troubleshooting.md
- Kubernetes cluster: docs/installation/k8s.md
Expand Down
Loading