make chart mittwald-repo compatible

.travis.yml

@@ -14,9 +14,18 @@ env:
     - GO111MODULE=on
     - CGO_ENABLED=0
     - GO_VERSION=1.12
+    - HELM_VERSION=v3.1.2
     - secure: "VNMhL0rwbAaiTV3YrERYSN57/EsMbtp6QET0cN0O4LSWlt0SRDBIeKXnL+Ex3Q7BMY+++DPovW4jZcIVnKyKvH5oGCgJ9Ilj6/Vk9GRKuyu5X+XQi4CuY9f70fz5gCb5ESpeLP9LD12Q6tsNrfRVO+zJiqyvjkZJYZAeTOZmL8szoJIDK83foRmVvwGdTQEK6Pq5fnaNXePcDqgywApDu9QMrab6HcoxZ/TZ99sJP7OEZTQIitdjfTQkol8bx34KT9NUvtd1nvMdcXAWaKyraFr4hJJEYIyB9b3rTtHemKQUhaQm3lrvuy0ns8wqNVyGV9u9qSPdtrL0rqdllw3xm3s5Azg7F+cnVBLyUebG/t5QpAipPeknkRKaicbAyjEZJUIrSLyVma1KQo82btmX/CeFlfS2tyNq9OtOfHouYxdrry8FtMH2DlUkFjHpry5E+FYBldUYDh6HGLYpXuk5JJkx5Td3DL2cqJHpYi6OjcENNESsFkg2ONGW6X3fu7khIkpBrnLMeWwGKlnwn2SVuvcfB/mBKK93Rknm2RdJGEYuOazidRjxRvl9y1oEwerx0SaQH5/uI/QwPN0ksVEiXVXD/C/Djp6nBptxnJdXPBl5gqZsSQ2Qd9JVN2B1oXb1wgHBcIO8ikmuKG8/32IJpFeOCSnkYVEjKSVqQ1MtQhs="
+
+install:
+  - wget https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz -O /tmp/helm.tar.gz
+  - tar xzf /tmp/helm.tar.gz -C /tmp --strip-components=1
+  - chmod +x /tmp/helm
+
 script:
   - curl -sL https://git.io/goreleaser | bash -s -- --snapshot --skip-publish --rm-dist
+  - /tmp/helm template ./deploy/helm-chart/kubernetes-replicator/.
+  - /tmp/helm lint ./deploy/helm-chart/kubernetes-replicator/
 
 before_deploy:
   - if [[ -n "${DOCKER_LOGIN_USERNAME}" ]] && [[ -n "${DOCKER_LOGIN_PASSWORD}" ]] && [[ -n "${DOCKER_LOGIN_URL}" ]]; then docker login -u "${DOCKER_LOGIN_USERNAME}" -p "${DOCKER_LOGIN_PASSWORD}" "${DOCKER_LOGIN_URL}"; fi

deploy/helm-chart/kubernetes-replicator/Chart.yaml

@@ -1,6 +1,23 @@
+# apiVersion will be set to v2 as soon as Github Workflows supports Helmv2 Charts
+# https://github.com/mittwald/helm-charts/blob/master/README.md#limitations
 apiVersion: v1
-appVersion: "1.0.0-alpha1"
-description: Controller for replicating secrets+configmaps across namespaces
 name: kubernetes-replicator
-version: 0.1.0
-url: https://github.com/mittwald/kubernetes-replicator
+description: Controller for replicating secrets+configmaps across namespaces
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+#type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+version: 0.2.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application.
+appVersion: v2.2.2

deploy/helm-chart/kubernetes-replicator/templates/_helpers.tpl

@@ -30,3 +30,34 @@ Create chart name and version as used by the chart label.
 {{- define "kubernetes-replicator.chart" -}}
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
+
+{{/*
+Common labels
+*/}}
+{{- define "kubernetes-replicator.labels" -}}
+helm.sh/chart: {{ include "kubernetes-replicator.chart" . }}
+{{ include "kubernetes-replicator.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{/*
+Selector labels
+*/}}
+{{- define "kubernetes-replicator.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "kubernetes-replicator.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "kubernetes-replicator.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "kubernetes-replicator.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}

deploy/helm-chart/kubernetes-replicator/templates/deployment.yaml

@@ -3,40 +3,44 @@ kind: Deployment
 metadata:
   name: {{ include "kubernetes-replicator.fullname" . }}
   labels:
-    app.kubernetes.io/name: {{ include "kubernetes-replicator.name" . }}
-    helm.sh/chart: {{ include "kubernetes-replicator.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "kubernetes-replicator.labels" . | nindent 4 }}
 spec:
-  replicas: 1
+  replicas: {{ .Values.replicaCount }}
   selector:
     matchLabels:
-      app.kubernetes.io/name: {{ include "kubernetes-replicator.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
+      {{- include "kubernetes-replicator.selectorLabels" . | nindent 6 }}
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: {{ include "kubernetes-replicator.name" . }}
-        app.kubernetes.io/instance: {{ .Release.Name }}
+        {{- include "kubernetes-replicator.selectorLabels" . | nindent 8 }}
     spec:
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+      serviceAccountName: {{ include "kubernetes-replicator.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
       containers:
         - name: {{ .Chart.Name }}
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           ports:
             - name: health
               containerPort: 9102
-          readinessProbe:
+              protocol: TCP
+          livenessProbe:
             httpGet:
               path: /healthz
               port: health
-          livenessProbe:
+          readinessProbe:
             httpGet:
               path: /healthz
               port: health
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
-      serviceAccountName: {{ include "kubernetes-replicator.fullname" . }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

deploy/helm-chart/kubernetes-replicator/templates/rbac.yaml

@@ -1,44 +1,41 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "kubernetes-replicator.serviceAccountName" . }}
+  labels:
+    {{- include "kubernetes-replicator.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+---
 kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1beta1
+apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "kubernetes-replicator.fullname" . }}
   labels:
-    app.kubernetes.io/name: {{ include "kubernetes-replicator.name" . }}
-    helm.sh/chart: {{ include "kubernetes-replicator.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "kubernetes-replicator.labels" . | nindent 4 }}
 rules:
-- apiGroups: [""] # "" indicates the core API group
-  resources: ["secrets", "configmaps"]
-  verbs: ["get", "watch", "list", "update", "patch"]
-- apiGroups: ["rbac.authorization.k8s.io"]
-  resources: ["roles", "rolebindings"]
-  verbs: ["get", "watch", "list", "update", "patch"]
+  - apiGroups: [""] # "" indicates the core API group
+    resources: ["secrets", "configmaps"]
+    verbs: ["get", "watch", "list", "update", "patch"]
+  - apiGroups: ["rbac.authorization.k8s.io"]
+    resources: ["roles", "rolebindings"]
+    verbs: ["get", "watch", "list", "update", "patch"]
 ---
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1beta1
+apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "kubernetes-replicator.fullname" . }}
   labels:
-    app.kubernetes.io/name: {{ include "kubernetes-replicator.name" . }}
-    helm.sh/chart: {{ include "kubernetes-replicator.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "kubernetes-replicator.labels" . | nindent 4 }}
 roleRef:
   kind: ClusterRole
   name: {{ include "kubernetes-replicator.fullname" . }}
   apiGroup: rbac.authorization.k8s.io
 subjects:
   - kind: ServiceAccount
     name: {{ include "kubernetes-replicator.fullname" . }}
-    namespace: {{ .Release.Namespace }}
----
-kind: ServiceAccount
-apiVersion: v1
-metadata:
-  name: {{ include "kubernetes-replicator.fullname" . }}
-  labels:
-    app.kubernetes.io/name: {{ include "kubernetes-replicator.name" . }}
-    helm.sh/chart: {{ include "kubernetes-replicator.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    namespace: {{ .Release.Namespace | quote }}
+{{- end -}}

deploy/helm-chart/kubernetes-replicator/values.yaml

@@ -2,25 +2,48 @@
 # This is a YAML-formatted file.
 # Declare variables to be passed into your templates.
 
+replicaCount: 1
+
 image:
   repository: quay.io/mittwald/kubernetes-replicator
-  tag: stable
-  pullPolicy: IfNotPresent
+  #tag: stable # if no tag is given, the chart's appVersion is used
+  pullPolicy: Always
 
+imagePullSecrets: []
 nameOverride: ""
 fullnameOverride: ""
 
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name:
+
+podSecurityContext: {}
+  # fsGroup: 2000
+
+securityContext: {}
+  # capabilities:
+  #   drop:
+  #   - ALL
+  # readOnlyRootFilesystem: true
+  # runAsNonRoot: true
+  # runAsUser: 1000
+
 resources: {}
   # We usually recommend not to specify default resources and to leave this as a conscious
   # choice for the user. This also increases chances charts run on environments with little
   # resources, such as Minikube. If you do want to specify resources, uncomment the following
   # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
   # limits:
-  #  cpu: 100m
-  #  memory: 128Mi
+  #   cpu: 100m
+  #   memory: 128Mi
   # requests:
-  #  cpu: 100m
-  #  memory: 128Mi
+  #   cpu: 100m
+  #   memory: 128Mi
 
 nodeSelector: {}