feat(ytt): added more templates

templates/ca.yaml

@@ -0,0 +1,9 @@
+#@ load("@ytt:data", "data")
+#@ load("config.lib.yml", "name", "fullName", "chart", "labels", "selectorLabels")
+
+apiVersion: v1
+kind: Secret
+metadata:
+  labels: #@ labels()
+  name: #@ secretCaName()
+data:

templates/certs.yaml

@@ -0,0 +1,9 @@
+#@ load("@ytt:data", "data")
+#@ load("config.lib.yml", "name", "fullName", "chart", "labels", "selectorLabels")
+
+apiVersion: v1
+kind: Secret
+metadata:
+  labels: #@ labels()
+  name: #@ secretTlsName()
+data:

templates/metrics-rbac.yaml

@@ -0,0 +1,43 @@
+#@ load("@ytt:data", "data")
+#@ load("config.lib.yml", "name", "fullName", "chart", "labels", "selectorLabels")
+
+#@ if data.values.serviceMonitor.enabled:
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels: #@ labels()
+  #@ if data.values.serviceMonitor.labels:
+  #@  return data.values.serviceMonitor.labels
+  #@ end
+  name: #@ fullName() + "-metrics-role"
+  namespace: #@ data.values.serviceMonitor.namespace if data.values.serviceMonitor.namespace else data.values.release.namespace
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - services
+  - endpoints
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels: #@ labels()
+  #@ if data.values.serviceMonitor.labels:
+  #@  return data.values.serviceMonitor.labels
+  #@ end
+  name: #@ fullName() + "-metrics-rolebinding"
+  namespace: #@ data.values.serviceMonitor.namespace if data.values.serviceMonitor.namespace else data.values.release.namespace
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: #@ fullName() + "-metrics-role"
+subjects:
+- kind: ServiceAccount
+  name: #@ data.values.serviceMonitor.serviceAccount.name
+  namespace: #@ data.values.serviceMonitor.serviceAccount.namespace if data.values.serviceMonitor.serviceAccount.namespace else data.values.release.namespace
+#@ end

templates/metrics-service.yaml

@@ -0,0 +1,17 @@
+#@ load("@ytt:data", "data")
+#@ load("config.lib.yml", "name", "fullName", "chart", "labels", "selectorLabels")
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: #@ fullName() + "-controller-manager-metrics-service"
+  labels: #@ labels()
+spec:
+  ports:
+  - port: 8080
+    name: metrics
+    protocol: TCP
+    targetPort: 8080
+  selector: #@ selectorLabels()
+  sessionAffinity: None
+  type: ClusterIP

templates/mutatingwebhookconfiguration.yaml

@@ -0,0 +1,37 @@
+#@ load("@ytt:data", "data")
+#@ load("config.lib.yml", "name", "fullName", "chart", "labels", "selectorLabels")
+
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: #@ fullName() + "-mutating-webhook-configuration"
+  labels: #@ labels()
+webhooks:
+- admissionReviewVersions:
+    - v1
+    - v1beta1
+  clientConfig:
+    caBundle: Cg==
+    service:
+      name: #@ fullName() + "-webhook-service"
+      namespace: #@ data.values.release.namespace
+      path: /namespace-owner-reference
+      port: 443
+  failurePolicy: Fail
+  matchPolicy: Equivalent
+  name: owner.namespace.capsule.clastix.io
+  namespaceSelector: {}
+  objectSelector: {}
+  reinvocationPolicy: Never
+  rules:
+    - apiGroups:
+      - ""
+      apiVersions:
+      - v1
+      operations:
+      - CREATE
+      resources:
+      - namespaces
+      scope: '*'
+  sideEffects: NoneOnDryRun
+  timeoutSeconds: #@ data.values.validatingWebhooksTimeoutSeconds

templates/podsecuritypolicy.yaml

@@ -0,0 +1,54 @@
+#@ load("@ytt:data", "data")
+#@ load("config.lib.yml", "name", "fullName", "chart", "labels", "selectorLabels")
+
+#@ if data.values.podSecurityPolicy.enabled:
+kind: PodSecurityPolicy
+apiVersion: policy/v1beta1
+metadata:
+  name: #@ fullName()
+  labels: #@ labels()
+spec:
+  fsGroup:
+    rule: RunAsAny
+  hostPorts:
+  - max: 0
+    min: 0
+  runAsUser:
+    rule: RunAsAny
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    rule: RunAsAny
+  volumes:
+  - secret
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: #@ fullName() + "-use-psp"
+  labels: #@ labels()
+rules:
+- apiGroups:
+  - extensions
+  resources:
+  - podsecuritypolicies
+  resourceNames:
+  - #@ fullName()
+  verbs:
+  - use
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: #@ fullName() + "-use-psp"
+  labels: #@ labels()
+  namespace: #@ data.values.release.namespace
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: #@ fullName() + "-use-psp"
+subjects:
+- apiGroup: ""
+  kind: ServiceAccount
+  name: #@ serviceAccountName()
+#@ end