Merge pull request #320 from rothgar/main

Add EKS distro templates

.github/workflows/release.yaml

@@ -100,6 +100,7 @@ jobs:
           helm cm-push --force --version="$RELEASE_VERSION" charts/k3s/ chartmuseum
           helm cm-push --force --version="$RELEASE_VERSION" charts/k0s/ chartmuseum
           helm cm-push --force --version="$RELEASE_VERSION" charts/k8s/ chartmuseum
+          helm cm-push --force --version="$RELEASE_VERSION" charts/eks/ chartmuseum
         env:
           CHART_MUSEUM_URL: "https://charts.loft.sh/"
           CHART_MUSEUM_USER: ${{ secrets.CHART_MUSEUM_USER }}

charts/eks/.helmignore

@@ -0,0 +1,21 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj

charts/eks/Chart.yaml

@@ -0,0 +1,15 @@
+apiVersion: v2
+name: vcluster-eks
+description: vcluster - Virtual Kubernetes Clusters (k8s)
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+version: 0.0.1 # version is auto-generated by release pipeline

charts/eks/templates/NOTES.txt

@@ -0,0 +1,8 @@
+Thank you for installing {{ .Chart.Name }}.
+
+Your release is named {{ .Release.Name }}.
+
+To learn more about the release, try:
+
+  $ helm status {{ .Release.Name }}
+  $ helm get all {{ .Release.Name }}

charts/eks/templates/_helpers.tpl

@@ -0,0 +1,59 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "vcluster.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "vcluster.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "vcluster.clusterRoleName" -}}
+{{- printf "vc-%s-v-%s" .Release.Name .Release.Namespace | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "vcluster.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Common labels
+*/}}
+{{- define "vcluster.labels" -}}
+app.kubernetes.io/name: {{ include "vcluster.name" . }}
+helm.sh/chart: {{ include "vcluster.chart" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- else }}
+app.kubernetes.io/version: {{ .Chart.Version | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{/*
+Get
+*/}}
+{{- $}}
+{{- define "vcluster.admin.accessKey" -}}
+{{- now | unixEpoch | toString | trunc 8 | sha256sum -}}
+{{- end -}}

charts/eks/templates/api-deployment.yaml

@@ -0,0 +1,137 @@
+{{- if not .Values.api.disabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-api
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: vcluster-api
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+{{- if .Values.api.labels }}
+{{ toYaml .Values.api.labels | indent 4 }}
+{{- end }}
+  {{- if .Values.api.annotations }}
+  annotations:
+{{ toYaml .Values.api.annotations | indent 4 }}
+  {{- end }}
+spec:
+  replicas: {{ .Values.api.replicas }}
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      {{- if (eq (int .Values.api.replicas) 1) }}
+      maxUnavailable: 0
+      {{- else }}
+      maxUnavailable: 1
+      {{- end }}
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app: vcluster-api
+      release: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: vcluster-api
+        release: {{ .Release.Name }}
+    spec:
+      terminationGracePeriodSeconds: 10
+      {{- if .Values.api.affinity }}
+      affinity: 
+{{ toYaml .Values.api.affinity | indent 8 }}
+      {{- end }}
+      {{- if .Values.api.topologySpreadConstraints }}
+      topologySpreadConstraints: 
+{{ toYaml .Values.api.topologySpreadConstraints | indent 8 }}
+      {{- end }}
+      nodeSelector:
+{{ toYaml .Values.api.nodeSelector | indent 8 }}
+      affinity:
+{{ toYaml .Values.api.affinity | indent 8 }}
+      tolerations:
+{{ toYaml .Values.api.tolerations | indent 8 }}
+      automountServiceAccountToken: false
+      volumes:
+        - name: certs
+          secret:
+            secretName: {{ .Release.Name }}-certs
+      {{- if .Values.api.volumes }}
+{{ toYaml .Values.api.volumes | indent 8 }}
+      {{- end }}
+      containers:
+      - name: kube-apiserver
+        image: "{{ .Values.defaultImageRegistry }}{{ .Values.api.image }}"
+        command:
+          - kube-apiserver
+          - '--advertise-address=0.0.0.0'
+          - '--allow-privileged=true'
+          - '--audit-log-maxage=30'
+          - '--audit-log-maxbackup=10'
+          - '--audit-log-maxsize=512'
+          - '--cloud-provider=external'
+          - '--authorization-mode=Node,RBAC'
+          - '--client-ca-file=/run/config/pki/ca.crt'
+          - '--enable-admission-plugins=NodeRestriction'
+          - '--enable-bootstrap-token-auth=true'
+          - '--etcd-cafile=/run/config/pki/etcd-ca.crt'
+          - '--etcd-certfile=/run/config/pki/apiserver-etcd-client.crt'
+          - '--etcd-keyfile=/run/config/pki/apiserver-etcd-client.key'
+          - '--etcd-servers=https://{{ .Release.Name }}-etcd:2379'
+          - '--insecure-port=0'
+          - '--kubelet-client-certificate=/run/config/pki/apiserver-kubelet-client.crt'
+          - '--kubelet-client-key=/run/config/pki/apiserver-kubelet-client.key'
+          - '--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname'
+          - '--profiling=false'
+          - '--proxy-client-cert-file=/run/config/pki/front-proxy-client.crt'
+          - '--proxy-client-key-file=/run/config/pki/front-proxy-client.key'
+          - '--requestheader-allowed-names=front-proxy-client'
+          - '--requestheader-client-ca-file=/run/config/pki/front-proxy-ca.crt'
+          - '--requestheader-extra-headers-prefix=X-Remote-Extra-'
+          - '--requestheader-group-headers=X-Remote-Group'
+          - '--requestheader-username-headers=X-Remote-User'
+          - '--secure-port=6443'
+          - '--service-account-issuer=https://kubernetes.default.svc.cluster.local'
+          - '--service-account-key-file=/run/config/pki/sa.pub'
+          - '--service-account-signing-key-file=/run/config/pki/sa.key'
+          - '--service-cluster-ip-range={{ .Values.serviceCIDR }}'
+          - '--tls-cert-file=/run/config/pki/apiserver.crt'
+          - '--tls-private-key-file=/run/config/pki/apiserver.key'
+          - '--watch-cache=false'
+          {{- range $f := .Values.api.extraArgs }}
+          - {{ $f | quote }}
+          {{- end }}
+        livenessProbe:
+          httpGet:
+            path: /livez
+            port: 6443
+            scheme: HTTPS
+          initialDelaySeconds: 10
+          timeoutSeconds: 15
+          periodSeconds: 10
+          successThreshold: 1
+          failureThreshold: 8
+        readinessProbe:
+          httpGet:
+            path: /readyz
+            port: 6443
+            scheme: HTTPS
+          timeoutSeconds: 15
+          periodSeconds: 1
+          successThreshold: 1
+          failureThreshold: 3
+        securityContext:
+{{ toYaml .Values.api.securityContext | indent 10 }}
+        env:
+{{ toYaml .Values.api.env | indent 10 }}
+        volumeMounts:
+          - mountPath: /run/config/pki
+            name: certs
+            readOnly: true
+        {{- if .Values.api.volumeMounts }}
+{{ toYaml .Values.api.volumeMounts | indent 10 }}
+        {{- end }}
+        resources:
+{{ toYaml .Values.api.resources | indent 10 }}
+{{- end }}

charts/eks/templates/api-service.yaml

@@ -0,0 +1,22 @@
+{{- if not .Values.api.disabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-api
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: vcluster-api
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+spec:
+  type: ClusterIP
+  ports:
+    - name: https
+      port: 443
+      targetPort: 6443
+      protocol: TCP
+  selector:
+    app: vcluster-api
+    release: {{ .Release.Name }}
+{{- end }}