Teleport Chart 업데이트
This commit is contained in:
ByeonJungHun
@@ -0,0 +1,66 @@
|
||||
adds operator permissions to ClusterRole:
|
||||
1: |
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: RELEASE-NAME
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- users
|
||||
- groups
|
||||
- serviceaccounts
|
||||
verbs:
|
||||
- impersonate
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- authorization.k8s.io
|
||||
resources:
|
||||
- selfsubjectaccessreviews
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- resources.teleport.dev
|
||||
resources:
|
||||
- teleportroles
|
||||
- teleportroles/status
|
||||
- teleportusers
|
||||
- teleportusers/status
|
||||
- teleportgithubconnectors
|
||||
- teleportgithubconnectors/status
|
||||
- teleportoidcconnectors
|
||||
- teleportoidcconnectors/status
|
||||
- teleportsamlconnectors
|
||||
- teleportsamlconnectors/status
|
||||
- teleportloginrules
|
||||
- teleportloginrules/status
|
||||
- teleportprovisiontokens
|
||||
- teleportprovisiontokens/status
|
||||
- teleportoktaimportrules
|
||||
- teleportoktaimportrules/status
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,518 @@
|
||||
should add an operator side-car when operator is enabled:
|
||||
1: |
|
||||
image: public.ecr.aws/gravitational/teleport-operator:13.3.9
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8081
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
name: operator
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 8081
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
volumeMounts:
|
||||
- mountPath: /etc/teleport
|
||||
name: config
|
||||
readOnly: true
|
||||
- mountPath: /var/lib/teleport
|
||||
name: data
|
||||
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
name: auth-serviceaccount-token
|
||||
readOnly: true
|
||||
? should not add named PersistentVolumeClaim as volume when in scratch mode, persistence.existingClaimName
|
||||
is set and persistence.enabled is false
|
||||
: 1: |
|
||||
affinity:
|
||||
podAntiAffinity: null
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
- args:
|
||||
- --diag-addr=0.0.0.0:3000
|
||||
- --apply-on-startup=/etc/teleport/apply-on-startup.yaml
|
||||
image: public.ecr.aws/gravitational/teleport-distroless:13.3.9
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- teleport
|
||||
- wait
|
||||
- duration
|
||||
- 30s
|
||||
livenessProbe:
|
||||
failureThreshold: 6
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: diag
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 1
|
||||
name: teleport
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: diag
|
||||
protocol: TCP
|
||||
- containerPort: 3025
|
||||
name: auth
|
||||
protocol: TCP
|
||||
- containerPort: 3026
|
||||
name: kube
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 12
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: diag
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 1
|
||||
volumeMounts:
|
||||
- mountPath: /etc/teleport
|
||||
name: config
|
||||
readOnly: true
|
||||
- mountPath: /var/lib/teleport
|
||||
name: data
|
||||
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
name: auth-serviceaccount-token
|
||||
readOnly: true
|
||||
serviceAccountName: RELEASE-NAME
|
||||
terminationGracePeriodSeconds: 60
|
||||
volumes:
|
||||
- name: auth-serviceaccount-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: token
|
||||
- configMap:
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
name: kube-root-ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
path: namespace
|
||||
- configMap:
|
||||
name: RELEASE-NAME-auth
|
||||
name: config
|
||||
- emptyDir: {}
|
||||
name: data
|
||||
should provision initContainer correctly when set in values:
|
||||
1: |
|
||||
- args:
|
||||
- echo test
|
||||
image: alpine
|
||||
name: teleport-init
|
||||
resources:
|
||||
limits:
|
||||
cpu: 2
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: 1
|
||||
memory: 2Gi
|
||||
volumeMounts:
|
||||
- mountPath: /etc/teleport
|
||||
name: config
|
||||
readOnly: true
|
||||
- mountPath: /var/lib/teleport
|
||||
name: data
|
||||
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
name: auth-serviceaccount-token
|
||||
readOnly: true
|
||||
- args:
|
||||
- echo test2
|
||||
image: alpine
|
||||
name: teleport-init2
|
||||
resources:
|
||||
limits:
|
||||
cpu: 2
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: 1
|
||||
memory: 2Gi
|
||||
volumeMounts:
|
||||
- mountPath: /etc/teleport
|
||||
name: config
|
||||
readOnly: true
|
||||
- mountPath: /var/lib/teleport
|
||||
name: data
|
||||
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
name: auth-serviceaccount-token
|
||||
readOnly: true
|
||||
should set affinity when set in values:
|
||||
1: |
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: gravitational.io/dedicated
|
||||
operator: In
|
||||
values:
|
||||
- teleport
|
||||
should set imagePullSecrets when set in values:
|
||||
1: |
|
||||
- name: myRegistryKeySecretName
|
||||
should set nodeSelector when set in values:
|
||||
1: |
|
||||
affinity:
|
||||
podAntiAffinity: null
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
- args:
|
||||
- --diag-addr=0.0.0.0:3000
|
||||
- --apply-on-startup=/etc/teleport/apply-on-startup.yaml
|
||||
image: public.ecr.aws/gravitational/teleport-distroless:13.3.9
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- teleport
|
||||
- wait
|
||||
- duration
|
||||
- 30s
|
||||
livenessProbe:
|
||||
failureThreshold: 6
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: diag
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 1
|
||||
name: teleport
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: diag
|
||||
protocol: TCP
|
||||
- containerPort: 3025
|
||||
name: auth
|
||||
protocol: TCP
|
||||
- containerPort: 3026
|
||||
name: kube
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 12
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: diag
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 1
|
||||
volumeMounts:
|
||||
- mountPath: /etc/teleport
|
||||
name: config
|
||||
readOnly: true
|
||||
- mountPath: /var/lib/teleport
|
||||
name: data
|
||||
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
name: auth-serviceaccount-token
|
||||
readOnly: true
|
||||
nodeSelector:
|
||||
environment: security
|
||||
role: bastion
|
||||
serviceAccountName: RELEASE-NAME
|
||||
terminationGracePeriodSeconds: 60
|
||||
volumes:
|
||||
- name: auth-serviceaccount-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: token
|
||||
- configMap:
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
name: kube-root-ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
path: namespace
|
||||
- configMap:
|
||||
name: RELEASE-NAME-auth
|
||||
name: config
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: RELEASE-NAME
|
||||
should set required affinity when highAvailability.requireAntiAffinity is set:
|
||||
1: |
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/instance
|
||||
operator: In
|
||||
values:
|
||||
- RELEASE-NAME
|
||||
- key: app.kubernetes.io/component
|
||||
operator: In
|
||||
values:
|
||||
- auth
|
||||
topologyKey: kubernetes.io/hostname
|
||||
should set resources when set in values:
|
||||
1: |
|
||||
affinity:
|
||||
podAntiAffinity: null
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
- args:
|
||||
- --diag-addr=0.0.0.0:3000
|
||||
- --apply-on-startup=/etc/teleport/apply-on-startup.yaml
|
||||
image: public.ecr.aws/gravitational/teleport-distroless:13.3.9
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- teleport
|
||||
- wait
|
||||
- duration
|
||||
- 30s
|
||||
livenessProbe:
|
||||
failureThreshold: 6
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: diag
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 1
|
||||
name: teleport
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: diag
|
||||
protocol: TCP
|
||||
- containerPort: 3025
|
||||
name: auth
|
||||
protocol: TCP
|
||||
- containerPort: 3026
|
||||
name: kube
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 12
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: diag
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 1
|
||||
resources:
|
||||
limits:
|
||||
cpu: 2
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: 1
|
||||
memory: 2Gi
|
||||
volumeMounts:
|
||||
- mountPath: /etc/teleport
|
||||
name: config
|
||||
readOnly: true
|
||||
- mountPath: /var/lib/teleport
|
||||
name: data
|
||||
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
name: auth-serviceaccount-token
|
||||
readOnly: true
|
||||
serviceAccountName: RELEASE-NAME
|
||||
terminationGracePeriodSeconds: 60
|
||||
volumes:
|
||||
- name: auth-serviceaccount-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: token
|
||||
- configMap:
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
name: kube-root-ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
path: namespace
|
||||
- configMap:
|
||||
name: RELEASE-NAME-auth
|
||||
name: config
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: RELEASE-NAME
|
||||
should set securityContext when set in values:
|
||||
1: |
|
||||
affinity:
|
||||
podAntiAffinity: null
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
- args:
|
||||
- --diag-addr=0.0.0.0:3000
|
||||
- --apply-on-startup=/etc/teleport/apply-on-startup.yaml
|
||||
image: public.ecr.aws/gravitational/teleport-distroless:13.3.9
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- teleport
|
||||
- wait
|
||||
- duration
|
||||
- 30s
|
||||
livenessProbe:
|
||||
failureThreshold: 6
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: diag
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 1
|
||||
name: teleport
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: diag
|
||||
protocol: TCP
|
||||
- containerPort: 3025
|
||||
name: auth
|
||||
protocol: TCP
|
||||
- containerPort: 3026
|
||||
name: kube
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 12
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: diag
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 1
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: false
|
||||
runAsGroup: 99
|
||||
runAsNonRoot: true
|
||||
runAsUser: 99
|
||||
volumeMounts:
|
||||
- mountPath: /etc/teleport
|
||||
name: config
|
||||
readOnly: true
|
||||
- mountPath: /var/lib/teleport
|
||||
name: data
|
||||
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
name: auth-serviceaccount-token
|
||||
readOnly: true
|
||||
serviceAccountName: RELEASE-NAME
|
||||
terminationGracePeriodSeconds: 60
|
||||
volumes:
|
||||
- name: auth-serviceaccount-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: token
|
||||
- configMap:
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
name: kube-root-ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
path: namespace
|
||||
- configMap:
|
||||
name: RELEASE-NAME-auth
|
||||
name: config
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: RELEASE-NAME
|
||||
should set tolerations when set in values:
|
||||
1: |
|
||||
- effect: NoExecute
|
||||
key: dedicated
|
||||
operator: Equal
|
||||
value: teleport
|
||||
- effect: NoSchedule
|
||||
key: dedicated
|
||||
operator: Equal
|
||||
value: teleport
|
||||
should use OSS image and not mount license when enterprise is not set in values:
|
||||
1: |
|
||||
affinity:
|
||||
podAntiAffinity: null
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
- args:
|
||||
- --diag-addr=0.0.0.0:3000
|
||||
- --apply-on-startup=/etc/teleport/apply-on-startup.yaml
|
||||
image: public.ecr.aws/gravitational/teleport-distroless:12.2.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- teleport
|
||||
- wait
|
||||
- duration
|
||||
- 30s
|
||||
livenessProbe:
|
||||
failureThreshold: 6
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: diag
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 1
|
||||
name: teleport
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: diag
|
||||
protocol: TCP
|
||||
- containerPort: 3025
|
||||
name: auth
|
||||
protocol: TCP
|
||||
- containerPort: 3026
|
||||
name: kube
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 12
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: diag
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 1
|
||||
volumeMounts:
|
||||
- mountPath: /etc/teleport
|
||||
name: config
|
||||
readOnly: true
|
||||
- mountPath: /var/lib/teleport
|
||||
name: data
|
||||
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
name: auth-serviceaccount-token
|
||||
readOnly: true
|
||||
serviceAccountName: RELEASE-NAME
|
||||
terminationGracePeriodSeconds: 60
|
||||
volumes:
|
||||
- name: auth-serviceaccount-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: token
|
||||
- configMap:
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
name: kube-root-ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
path: namespace
|
||||
- configMap:
|
||||
name: RELEASE-NAME-auth
|
||||
name: config
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: RELEASE-NAME
|
||||
@@ -0,0 +1,55 @@
|
||||
does not add additional wildcard publicAddrs when Ingress is enabled and a publicAddr already contains a wildcard:
|
||||
1: |
|
||||
- hosts:
|
||||
- helm-lint.example.com
|
||||
- '*.helm-lint.example.com'
|
||||
- helm-lint-second-domain.example.com
|
||||
- '*.helm-lint-second-domain.example.com'
|
||||
does not set a wildcard of clusterName as a hostname when Ingress is enabled and ingress.suppressAutomaticWildcards is true:
|
||||
1: |
|
||||
- hosts:
|
||||
- teleport.example.com
|
||||
? does not set a wildcard of publicAddr as a hostname when Ingress is enabled, publicAddr
|
||||
is set and ingress.suppressAutomaticWildcards is true
|
||||
: 1: |
|
||||
- hosts:
|
||||
- helm-lint.example.com
|
||||
does not set tls.secretName by default:
|
||||
1: |
|
||||
- hosts:
|
||||
- teleport.example.com
|
||||
- '*.teleport.example.com'
|
||||
exposes all publicAddrs and wildcard publicAddrs as hostnames when Ingress is enabled and multiple publicAddrs are set:
|
||||
1: |
|
||||
- hosts:
|
||||
- helm-lint.example.com
|
||||
- helm-lint-second-domain.example.com
|
||||
- '*.helm-lint.example.com'
|
||||
- '*.helm-lint-second-domain.example.com'
|
||||
sets the clusterName and wildcard of clusterName as hostnames when Ingress is enabled:
|
||||
1: |
|
||||
- hosts:
|
||||
- teleport.example.com
|
||||
- '*.teleport.example.com'
|
||||
sets the publicAddr and wildcard of publicAddr as hostnames when Ingress is enabled and publicAddr is set:
|
||||
1: |
|
||||
- hosts:
|
||||
- helm-lint.example.com
|
||||
- '*.helm-lint.example.com'
|
||||
sets tls.secretName the value of tls.existingSecretName when set:
|
||||
1: |
|
||||
- hosts:
|
||||
- teleport.example.com
|
||||
- '*.teleport.example.com'
|
||||
secretName: helm-lint-tls-secret
|
||||
sets tls.secretName when cert-manager is enabled:
|
||||
1: |
|
||||
- hosts:
|
||||
- teleport.example.com
|
||||
- '*.teleport.example.com'
|
||||
secretName: teleport-tls
|
||||
trims ports from publicAddr and uses it as the hostname when Ingress is enabled and publicAddr is set:
|
||||
1: |
|
||||
- hosts:
|
||||
- helm-lint.example.com
|
||||
- '*.helm-lint.example.com'
|
||||
@@ -0,0 +1,6 @@
|
||||
should set imagePullSecrets on auth predeploy job when set in values:
|
||||
1: |
|
||||
- name: myRegistryKeySecretName
|
||||
should set imagePullSecrets on proxy predeploy job when set in values:
|
||||
1: |
|
||||
- name: myRegistryKeySecretName
|
||||
@@ -0,0 +1,16 @@
|
||||
should request a certificate for cluster name when cert-manager is enabled (cert-manager.yaml):
|
||||
1: |
|
||||
- test-cluster
|
||||
- '*.test-cluster'
|
||||
2: |
|
||||
group: custom.cert-manager.io
|
||||
kind: CustomClusterIssuer
|
||||
name: custom
|
||||
should request a certificate for cluster name when cert-manager is enabled (cert-secret.yaml):
|
||||
1: |
|
||||
- test-cluster
|
||||
- '*.test-cluster'
|
||||
2: |
|
||||
group: cert-manager.io
|
||||
kind: Issuer
|
||||
name: letsencrypt
|
||||
@@ -0,0 +1,530 @@
|
||||
generates a config WITHOUT proxy_service.trust_x_forwarded_for=true when version < 13.2.0 and ingress.enabled is not set:
|
||||
1: |
|
||||
|-
|
||||
auth_service:
|
||||
enabled: false
|
||||
proxy_service:
|
||||
enabled: true
|
||||
kube_listen_addr: 0.0.0.0:3026
|
||||
listen_addr: 0.0.0.0:3023
|
||||
mysql_listen_addr: 0.0.0.0:3036
|
||||
public_addr: helm-test.example.com:443
|
||||
tunnel_listen_addr: 0.0.0.0:3024
|
||||
ssh_service:
|
||||
enabled: false
|
||||
teleport:
|
||||
auth_server: RELEASE-NAME-auth.NAMESPACE.svc.cluster.local:3025
|
||||
join_params:
|
||||
method: kubernetes
|
||||
token_name: RELEASE-NAME-proxy
|
||||
log:
|
||||
format:
|
||||
extra_fields:
|
||||
- timestamp
|
||||
- level
|
||||
- component
|
||||
- caller
|
||||
output: text
|
||||
output: stderr
|
||||
severity: INFO
|
||||
version: v3
|
||||
generates a config WITHOUT proxy_service.trust_x_forwarded_for=true when version < 13.2.0 and ingress.enabled=true:
|
||||
1: |
|
||||
|-
|
||||
auth_service:
|
||||
enabled: false
|
||||
proxy_service:
|
||||
enabled: true
|
||||
public_addr: helm-test.example.com:443
|
||||
ssh_service:
|
||||
enabled: false
|
||||
teleport:
|
||||
auth_server: RELEASE-NAME-auth.NAMESPACE.svc.cluster.local:3025
|
||||
join_params:
|
||||
method: kubernetes
|
||||
token_name: RELEASE-NAME-proxy
|
||||
log:
|
||||
format:
|
||||
extra_fields:
|
||||
- timestamp
|
||||
- level
|
||||
- component
|
||||
- caller
|
||||
output: text
|
||||
output: stderr
|
||||
severity: INFO
|
||||
version: v3
|
||||
generates a config WITHOUT proxy_service.trust_x_forwarded_for=true when version >=13.2.0 and ingress.enabled is not set:
|
||||
1: |
|
||||
|-
|
||||
auth_service:
|
||||
enabled: false
|
||||
proxy_service:
|
||||
enabled: true
|
||||
kube_listen_addr: 0.0.0.0:3026
|
||||
listen_addr: 0.0.0.0:3023
|
||||
mysql_listen_addr: 0.0.0.0:3036
|
||||
public_addr: helm-test.example.com:443
|
||||
tunnel_listen_addr: 0.0.0.0:3024
|
||||
ssh_service:
|
||||
enabled: false
|
||||
teleport:
|
||||
auth_server: RELEASE-NAME-auth.NAMESPACE.svc.cluster.local:3025
|
||||
join_params:
|
||||
method: kubernetes
|
||||
token_name: RELEASE-NAME-proxy
|
||||
log:
|
||||
format:
|
||||
extra_fields:
|
||||
- timestamp
|
||||
- level
|
||||
- component
|
||||
- caller
|
||||
output: text
|
||||
output: stderr
|
||||
severity: INFO
|
||||
version: v3
|
||||
generates a config with a clusterName containing a regular string:
|
||||
1: |
|
||||
|-
|
||||
auth_service:
|
||||
enabled: false
|
||||
proxy_service:
|
||||
enabled: true
|
||||
kube_listen_addr: 0.0.0.0:3026
|
||||
listen_addr: 0.0.0.0:3023
|
||||
mysql_listen_addr: 0.0.0.0:3036
|
||||
public_addr: helm-test.example.com:443
|
||||
tunnel_listen_addr: 0.0.0.0:3024
|
||||
ssh_service:
|
||||
enabled: false
|
||||
teleport:
|
||||
auth_server: RELEASE-NAME-auth.NAMESPACE.svc.cluster.local:3025
|
||||
join_params:
|
||||
method: kubernetes
|
||||
token_name: RELEASE-NAME-proxy
|
||||
log:
|
||||
format:
|
||||
extra_fields:
|
||||
- timestamp
|
||||
- level
|
||||
- component
|
||||
- caller
|
||||
output: text
|
||||
output: stderr
|
||||
severity: INFO
|
||||
version: v3
|
||||
generates a config with proxy_service.trust_x_forwarded_for=true when version = 14.0.0-rc.1 and ingress.enabled=true:
|
||||
1: |
|
||||
|-
|
||||
auth_service:
|
||||
enabled: false
|
||||
proxy_service:
|
||||
enabled: true
|
||||
public_addr: helm-test.example.com:443
|
||||
trust_x_forwarded_for: true
|
||||
ssh_service:
|
||||
enabled: false
|
||||
teleport:
|
||||
auth_server: RELEASE-NAME-auth.NAMESPACE.svc.cluster.local:3025
|
||||
join_params:
|
||||
method: kubernetes
|
||||
token_name: RELEASE-NAME-proxy
|
||||
log:
|
||||
format:
|
||||
extra_fields:
|
||||
- timestamp
|
||||
- level
|
||||
- component
|
||||
- caller
|
||||
output: text
|
||||
output: stderr
|
||||
severity: INFO
|
||||
version: v3
|
||||
generates a config with proxy_service.trust_x_forwarded_for=true when version >=13.2.0 and ingress.enabled=true:
|
||||
1: |
|
||||
|-
|
||||
auth_service:
|
||||
enabled: false
|
||||
proxy_service:
|
||||
enabled: true
|
||||
public_addr: helm-test.example.com:443
|
||||
trust_x_forwarded_for: true
|
||||
ssh_service:
|
||||
enabled: false
|
||||
teleport:
|
||||
auth_server: RELEASE-NAME-auth.NAMESPACE.svc.cluster.local:3025
|
||||
join_params:
|
||||
method: kubernetes
|
||||
token_name: RELEASE-NAME-proxy
|
||||
log:
|
||||
format:
|
||||
extra_fields:
|
||||
- timestamp
|
||||
- level
|
||||
- component
|
||||
- caller
|
||||
output: text
|
||||
output: stderr
|
||||
severity: INFO
|
||||
version: v3
|
||||
matches snapshot for acme-on.yaml:
|
||||
1: |
|
||||
|-
|
||||
auth_service:
|
||||
enabled: false
|
||||
proxy_service:
|
||||
acme:
|
||||
email: test@email.com
|
||||
enabled: true
|
||||
enabled: true
|
||||
kube_listen_addr: 0.0.0.0:3026
|
||||
listen_addr: 0.0.0.0:3023
|
||||
mysql_listen_addr: 0.0.0.0:3036
|
||||
public_addr: test-acme-cluster:443
|
||||
tunnel_listen_addr: 0.0.0.0:3024
|
||||
ssh_service:
|
||||
enabled: false
|
||||
teleport:
|
||||
auth_server: RELEASE-NAME-auth.NAMESPACE.svc.cluster.local:3025
|
||||
join_params:
|
||||
method: kubernetes
|
||||
token_name: RELEASE-NAME-proxy
|
||||
log:
|
||||
format:
|
||||
extra_fields:
|
||||
- timestamp
|
||||
- level
|
||||
- component
|
||||
- caller
|
||||
output: text
|
||||
output: stderr
|
||||
severity: INFO
|
||||
version: v3
|
||||
matches snapshot for acme-uri-staging.yaml:
|
||||
1: |
|
||||
|-
|
||||
auth_service:
|
||||
enabled: false
|
||||
proxy_service:
|
||||
acme:
|
||||
email: test@email.com
|
||||
enabled: true
|
||||
uri: https://acme-staging-v02.api.letsencrypt.org/directory
|
||||
enabled: true
|
||||
kube_listen_addr: 0.0.0.0:3026
|
||||
listen_addr: 0.0.0.0:3023
|
||||
mysql_listen_addr: 0.0.0.0:3036
|
||||
public_addr: test-acme-cluster:443
|
||||
tunnel_listen_addr: 0.0.0.0:3024
|
||||
ssh_service:
|
||||
enabled: false
|
||||
teleport:
|
||||
auth_server: RELEASE-NAME-auth.NAMESPACE.svc.cluster.local:3025
|
||||
join_params:
|
||||
method: kubernetes
|
||||
token_name: RELEASE-NAME-proxy
|
||||
log:
|
||||
format:
|
||||
extra_fields:
|
||||
- timestamp
|
||||
- level
|
||||
- component
|
||||
- caller
|
||||
output: text
|
||||
output: stderr
|
||||
severity: INFO
|
||||
version: v3
|
||||
matches snapshot for aws-ha-acme.yaml:
|
||||
1: |
|
||||
|-
|
||||
auth_service:
|
||||
enabled: false
|
||||
proxy_service:
|
||||
enabled: true
|
||||
https_keypairs:
|
||||
- cert_file: /etc/teleport-tls/tls.crt
|
||||
key_file: /etc/teleport-tls/tls.key
|
||||
https_keypairs_reload_interval: 12h
|
||||
kube_listen_addr: 0.0.0.0:3026
|
||||
listen_addr: 0.0.0.0:3023
|
||||
mysql_listen_addr: 0.0.0.0:3036
|
||||
public_addr: test-aws-cluster:443
|
||||
tunnel_listen_addr: 0.0.0.0:3024
|
||||
ssh_service:
|
||||
enabled: false
|
||||
teleport:
|
||||
auth_server: RELEASE-NAME-auth.NAMESPACE.svc.cluster.local:3025
|
||||
join_params:
|
||||
method: kubernetes
|
||||
token_name: RELEASE-NAME-proxy
|
||||
log:
|
||||
format:
|
||||
extra_fields:
|
||||
- timestamp
|
||||
- level
|
||||
- component
|
||||
- caller
|
||||
output: text
|
||||
output: stderr
|
||||
severity: INFO
|
||||
version: v3
|
||||
matches snapshot for existing-tls-secret.yaml:
|
||||
1: |
|
||||
|-
|
||||
auth_service:
|
||||
enabled: false
|
||||
proxy_service:
|
||||
enabled: true
|
||||
https_keypairs:
|
||||
- cert_file: /etc/teleport-tls/tls.crt
|
||||
key_file: /etc/teleport-tls/tls.key
|
||||
https_keypairs_reload_interval: 12h
|
||||
kube_listen_addr: 0.0.0.0:3026
|
||||
listen_addr: 0.0.0.0:3023
|
||||
mysql_listen_addr: 0.0.0.0:3036
|
||||
public_addr: test-cluster-name:443
|
||||
tunnel_listen_addr: 0.0.0.0:3024
|
||||
ssh_service:
|
||||
enabled: false
|
||||
teleport:
|
||||
auth_server: RELEASE-NAME-auth.NAMESPACE.svc.cluster.local:3025
|
||||
join_params:
|
||||
method: kubernetes
|
||||
token_name: RELEASE-NAME-proxy
|
||||
log:
|
||||
format:
|
||||
extra_fields:
|
||||
- timestamp
|
||||
- level
|
||||
- component
|
||||
- caller
|
||||
output: text
|
||||
output: stderr
|
||||
severity: INFO
|
||||
version: v3
|
||||
matches snapshot for log-basic.yaml:
|
||||
1: |
|
||||
|-
|
||||
auth_service:
|
||||
enabled: false
|
||||
proxy_service:
|
||||
enabled: true
|
||||
kube_listen_addr: 0.0.0.0:3026
|
||||
listen_addr: 0.0.0.0:3023
|
||||
mysql_listen_addr: 0.0.0.0:3036
|
||||
public_addr: test-log-cluster:443
|
||||
tunnel_listen_addr: 0.0.0.0:3024
|
||||
ssh_service:
|
||||
enabled: false
|
||||
teleport:
|
||||
auth_server: RELEASE-NAME-auth.NAMESPACE.svc.cluster.local:3025
|
||||
join_params:
|
||||
method: kubernetes
|
||||
token_name: RELEASE-NAME-proxy
|
||||
log:
|
||||
format:
|
||||
extra_fields:
|
||||
- timestamp
|
||||
- level
|
||||
- component
|
||||
- caller
|
||||
output: json
|
||||
output: stderr
|
||||
severity: INFO
|
||||
version: v3
|
||||
matches snapshot for log-extra.yaml:
|
||||
1: |
|
||||
|-
|
||||
auth_service:
|
||||
enabled: false
|
||||
proxy_service:
|
||||
enabled: true
|
||||
kube_listen_addr: 0.0.0.0:3026
|
||||
listen_addr: 0.0.0.0:3023
|
||||
mysql_listen_addr: 0.0.0.0:3036
|
||||
public_addr: test-log-cluster:443
|
||||
tunnel_listen_addr: 0.0.0.0:3024
|
||||
ssh_service:
|
||||
enabled: false
|
||||
teleport:
|
||||
auth_server: RELEASE-NAME-auth.NAMESPACE.svc.cluster.local:3025
|
||||
join_params:
|
||||
method: kubernetes
|
||||
token_name: RELEASE-NAME-proxy
|
||||
log:
|
||||
format:
|
||||
extra_fields:
|
||||
- level
|
||||
- timestamp
|
||||
- component
|
||||
- caller
|
||||
output: json
|
||||
output: /var/lib/teleport/test.log
|
||||
severity: DEBUG
|
||||
version: v3
|
||||
matches snapshot for proxy-listener-mode-multiplex.yaml:
|
||||
1: |
|
||||
|-
|
||||
auth_service:
|
||||
enabled: false
|
||||
proxy_service:
|
||||
enabled: true
|
||||
public_addr: test-proxy-listener-mode:443
|
||||
ssh_service:
|
||||
enabled: false
|
||||
teleport:
|
||||
auth_server: RELEASE-NAME-auth.NAMESPACE.svc.cluster.local:3025
|
||||
join_params:
|
||||
method: kubernetes
|
||||
token_name: RELEASE-NAME-proxy
|
||||
log:
|
||||
format:
|
||||
extra_fields:
|
||||
- timestamp
|
||||
- level
|
||||
- component
|
||||
- caller
|
||||
output: text
|
||||
output: stderr
|
||||
severity: INFO
|
||||
version: v3
|
||||
matches snapshot for proxy-listener-mode-separate.yaml:
|
||||
1: |
|
||||
|-
|
||||
auth_service:
|
||||
enabled: false
|
||||
proxy_service:
|
||||
enabled: true
|
||||
kube_listen_addr: 0.0.0.0:3026
|
||||
listen_addr: 0.0.0.0:3023
|
||||
mysql_listen_addr: 0.0.0.0:3036
|
||||
public_addr: test-proxy-listener-mode:443
|
||||
tunnel_listen_addr: 0.0.0.0:3024
|
||||
ssh_service:
|
||||
enabled: false
|
||||
teleport:
|
||||
auth_server: RELEASE-NAME-auth.NAMESPACE.svc.cluster.local:3025
|
||||
join_params:
|
||||
method: kubernetes
|
||||
token_name: RELEASE-NAME-proxy
|
||||
log:
|
||||
format:
|
||||
extra_fields:
|
||||
- timestamp
|
||||
- level
|
||||
- component
|
||||
- caller
|
||||
output: text
|
||||
output: stderr
|
||||
severity: INFO
|
||||
version: v3
|
||||
matches snapshot for public-addresses.yaml:
|
||||
1: |
|
||||
|-
|
||||
auth_service:
|
||||
enabled: false
|
||||
proxy_service:
|
||||
enabled: true
|
||||
kube_listen_addr: 0.0.0.0:3026
|
||||
kube_public_addr:
|
||||
- loadbalancer.example.com:3026
|
||||
listen_addr: 0.0.0.0:3023
|
||||
mongo_listen_addr: 0.0.0.0:27017
|
||||
mongo_public_addr:
|
||||
- loadbalancer.example.com:27017
|
||||
mysql_listen_addr: 0.0.0.0:3036
|
||||
mysql_public_addr:
|
||||
- loadbalancer.example.com:3036
|
||||
postgres_listen_addr: 0.0.0.0:5432
|
||||
postgres_public_addr:
|
||||
- loadbalancer.example.com:5432
|
||||
public_addr:
|
||||
- loadbalancer.example.com:443
|
||||
ssh_public_addr:
|
||||
- loadbalancer.example.com:3023
|
||||
tunnel_listen_addr: 0.0.0.0:3024
|
||||
tunnel_public_addr:
|
||||
- loadbalancer.example.com:3024
|
||||
ssh_service:
|
||||
enabled: false
|
||||
teleport:
|
||||
auth_server: RELEASE-NAME-auth.NAMESPACE.svc.cluster.local:3025
|
||||
join_params:
|
||||
method: kubernetes
|
||||
token_name: RELEASE-NAME-proxy
|
||||
log:
|
||||
format:
|
||||
extra_fields:
|
||||
- timestamp
|
||||
- level
|
||||
- component
|
||||
- caller
|
||||
output: text
|
||||
output: stderr
|
||||
severity: INFO
|
||||
version: v3
|
||||
matches snapshot for separate-mongo-listener.yaml:
|
||||
1: |
|
||||
|-
|
||||
auth_service:
|
||||
enabled: false
|
||||
proxy_service:
|
||||
enabled: true
|
||||
kube_listen_addr: 0.0.0.0:3026
|
||||
listen_addr: 0.0.0.0:3023
|
||||
mongo_listen_addr: 0.0.0.0:27017
|
||||
mongo_public_addr: helm-lint:27017
|
||||
mysql_listen_addr: 0.0.0.0:3036
|
||||
public_addr: helm-lint:443
|
||||
tunnel_listen_addr: 0.0.0.0:3024
|
||||
ssh_service:
|
||||
enabled: false
|
||||
teleport:
|
||||
auth_server: RELEASE-NAME-auth.NAMESPACE.svc.cluster.local:3025
|
||||
join_params:
|
||||
method: kubernetes
|
||||
token_name: RELEASE-NAME-proxy
|
||||
log:
|
||||
format:
|
||||
extra_fields:
|
||||
- timestamp
|
||||
- level
|
||||
- component
|
||||
- caller
|
||||
output: text
|
||||
output: stderr
|
||||
severity: INFO
|
||||
version: v3
|
||||
matches snapshot for separate-postgres-listener.yaml:
|
||||
1: |
|
||||
|-
|
||||
auth_service:
|
||||
enabled: false
|
||||
proxy_service:
|
||||
enabled: true
|
||||
kube_listen_addr: 0.0.0.0:3026
|
||||
listen_addr: 0.0.0.0:3023
|
||||
mysql_listen_addr: 0.0.0.0:3036
|
||||
postgres_listen_addr: 0.0.0.0:5432
|
||||
postgres_public_addr: helm-lint:5432
|
||||
public_addr: helm-lint:443
|
||||
tunnel_listen_addr: 0.0.0.0:3024
|
||||
ssh_service:
|
||||
enabled: false
|
||||
teleport:
|
||||
auth_server: RELEASE-NAME-auth.NAMESPACE.svc.cluster.local:3025
|
||||
join_params:
|
||||
method: kubernetes
|
||||
token_name: RELEASE-NAME-proxy
|
||||
log:
|
||||
format:
|
||||
extra_fields:
|
||||
- timestamp
|
||||
- level
|
||||
- component
|
||||
- caller
|
||||
output: text
|
||||
output: stderr
|
||||
severity: INFO
|
||||
version: v3
|
||||
@@ -0,0 +1,495 @@
|
||||
should provision initContainer correctly when set in values:
|
||||
1: |
|
||||
- command:
|
||||
- teleport
|
||||
- wait
|
||||
- no-resolve
|
||||
- RELEASE-NAME-auth-v12.NAMESPACE.svc.cluster.local
|
||||
image: public.ecr.aws/gravitational/teleport-distroless:13.3.9
|
||||
name: wait-auth-update
|
||||
- args:
|
||||
- echo test
|
||||
image: alpine
|
||||
name: teleport-init
|
||||
resources:
|
||||
limits:
|
||||
cpu: 2
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: 1
|
||||
memory: 2Gi
|
||||
volumeMounts:
|
||||
- mountPath: /etc/teleport
|
||||
name: config
|
||||
readOnly: true
|
||||
- mountPath: /var/lib/teleport
|
||||
name: data
|
||||
- args:
|
||||
- echo test2
|
||||
image: alpine
|
||||
name: teleport-init2
|
||||
resources:
|
||||
limits:
|
||||
cpu: 2
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: 1
|
||||
memory: 2Gi
|
||||
volumeMounts:
|
||||
- mountPath: /etc/teleport
|
||||
name: config
|
||||
readOnly: true
|
||||
- mountPath: /var/lib/teleport
|
||||
name: data
|
||||
should set affinity when set in values:
|
||||
1: |
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: gravitational.io/dedicated
|
||||
operator: In
|
||||
values:
|
||||
- teleport
|
||||
should set imagePullSecrets when set in values:
|
||||
1: |
|
||||
- name: myRegistryKeySecretName
|
||||
should set nodeSelector when set in values:
|
||||
1: |
|
||||
affinity:
|
||||
podAntiAffinity: null
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
- args:
|
||||
- --diag-addr=0.0.0.0:3000
|
||||
image: public.ecr.aws/gravitational/teleport-distroless:13.3.9
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- teleport
|
||||
- wait
|
||||
- duration
|
||||
- 30s
|
||||
livenessProbe:
|
||||
failureThreshold: 6
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: diag
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 1
|
||||
name: teleport
|
||||
ports:
|
||||
- containerPort: 3080
|
||||
name: tls
|
||||
protocol: TCP
|
||||
- containerPort: 3023
|
||||
name: sshproxy
|
||||
protocol: TCP
|
||||
- containerPort: 3024
|
||||
name: sshtun
|
||||
protocol: TCP
|
||||
- containerPort: 3026
|
||||
name: kube
|
||||
protocol: TCP
|
||||
- containerPort: 3036
|
||||
name: mysql
|
||||
protocol: TCP
|
||||
- containerPort: 3000
|
||||
name: diag
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 12
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: diag
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 1
|
||||
volumeMounts:
|
||||
- mountPath: /etc/teleport
|
||||
name: config
|
||||
readOnly: true
|
||||
- mountPath: /var/lib/teleport
|
||||
name: data
|
||||
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
name: proxy-serviceaccount-token
|
||||
readOnly: true
|
||||
initContainers:
|
||||
- command:
|
||||
- teleport
|
||||
- wait
|
||||
- no-resolve
|
||||
- RELEASE-NAME-auth-v12.NAMESPACE.svc.cluster.local
|
||||
image: public.ecr.aws/gravitational/teleport-distroless:13.3.9
|
||||
name: wait-auth-update
|
||||
nodeSelector:
|
||||
environment: security
|
||||
role: bastion
|
||||
serviceAccountName: RELEASE-NAME-proxy
|
||||
terminationGracePeriodSeconds: 60
|
||||
volumes:
|
||||
- name: proxy-serviceaccount-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: token
|
||||
- configMap:
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
name: kube-root-ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
path: namespace
|
||||
- configMap:
|
||||
name: RELEASE-NAME-proxy
|
||||
name: config
|
||||
- emptyDir: {}
|
||||
name: data
|
||||
should set required affinity when highAvailability.requireAntiAffinity is set:
|
||||
1: |
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/instance
|
||||
operator: In
|
||||
values:
|
||||
- RELEASE-NAME
|
||||
- key: app.kubernetes.io/component
|
||||
operator: In
|
||||
values:
|
||||
- proxy
|
||||
topologyKey: kubernetes.io/hostname
|
||||
should set resources when set in values:
|
||||
1: |
|
||||
affinity:
|
||||
podAntiAffinity: null
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
- args:
|
||||
- --diag-addr=0.0.0.0:3000
|
||||
image: public.ecr.aws/gravitational/teleport-distroless:13.3.9
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- teleport
|
||||
- wait
|
||||
- duration
|
||||
- 30s
|
||||
livenessProbe:
|
||||
failureThreshold: 6
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: diag
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 1
|
||||
name: teleport
|
||||
ports:
|
||||
- containerPort: 3080
|
||||
name: tls
|
||||
protocol: TCP
|
||||
- containerPort: 3023
|
||||
name: sshproxy
|
||||
protocol: TCP
|
||||
- containerPort: 3024
|
||||
name: sshtun
|
||||
protocol: TCP
|
||||
- containerPort: 3026
|
||||
name: kube
|
||||
protocol: TCP
|
||||
- containerPort: 3036
|
||||
name: mysql
|
||||
protocol: TCP
|
||||
- containerPort: 3000
|
||||
name: diag
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 12
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: diag
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 1
|
||||
resources:
|
||||
limits:
|
||||
cpu: 2
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: 1
|
||||
memory: 2Gi
|
||||
volumeMounts:
|
||||
- mountPath: /etc/teleport
|
||||
name: config
|
||||
readOnly: true
|
||||
- mountPath: /var/lib/teleport
|
||||
name: data
|
||||
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
name: proxy-serviceaccount-token
|
||||
readOnly: true
|
||||
initContainers:
|
||||
- command:
|
||||
- teleport
|
||||
- wait
|
||||
- no-resolve
|
||||
- RELEASE-NAME-auth-v12.NAMESPACE.svc.cluster.local
|
||||
image: public.ecr.aws/gravitational/teleport-distroless:13.3.9
|
||||
name: wait-auth-update
|
||||
serviceAccountName: RELEASE-NAME-proxy
|
||||
terminationGracePeriodSeconds: 60
|
||||
volumes:
|
||||
- name: proxy-serviceaccount-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: token
|
||||
- configMap:
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
name: kube-root-ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
path: namespace
|
||||
- configMap:
|
||||
name: RELEASE-NAME-proxy
|
||||
name: config
|
||||
- emptyDir: {}
|
||||
name: data
|
||||
should set securityContext for initContainers when set in values:
|
||||
1: |
|
||||
affinity:
|
||||
podAntiAffinity: null
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
- args:
|
||||
- --diag-addr=0.0.0.0:3000
|
||||
image: public.ecr.aws/gravitational/teleport-distroless:13.3.9
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- teleport
|
||||
- wait
|
||||
- duration
|
||||
- 30s
|
||||
livenessProbe:
|
||||
failureThreshold: 6
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: diag
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 1
|
||||
name: teleport
|
||||
ports:
|
||||
- containerPort: 3080
|
||||
name: tls
|
||||
protocol: TCP
|
||||
- containerPort: 3023
|
||||
name: sshproxy
|
||||
protocol: TCP
|
||||
- containerPort: 3024
|
||||
name: sshtun
|
||||
protocol: TCP
|
||||
- containerPort: 3026
|
||||
name: kube
|
||||
protocol: TCP
|
||||
- containerPort: 3036
|
||||
name: mysql
|
||||
protocol: TCP
|
||||
- containerPort: 3000
|
||||
name: diag
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 12
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: diag
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 1
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: false
|
||||
runAsGroup: 99
|
||||
runAsNonRoot: true
|
||||
runAsUser: 99
|
||||
volumeMounts:
|
||||
- mountPath: /etc/teleport
|
||||
name: config
|
||||
readOnly: true
|
||||
- mountPath: /var/lib/teleport
|
||||
name: data
|
||||
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
name: proxy-serviceaccount-token
|
||||
readOnly: true
|
||||
initContainers:
|
||||
- command:
|
||||
- teleport
|
||||
- wait
|
||||
- no-resolve
|
||||
- RELEASE-NAME-auth-v12.NAMESPACE.svc.cluster.local
|
||||
image: public.ecr.aws/gravitational/teleport-distroless:13.3.9
|
||||
name: wait-auth-update
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: false
|
||||
runAsGroup: 99
|
||||
runAsNonRoot: true
|
||||
runAsUser: 99
|
||||
serviceAccountName: RELEASE-NAME-proxy
|
||||
terminationGracePeriodSeconds: 60
|
||||
volumes:
|
||||
- name: proxy-serviceaccount-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: token
|
||||
- configMap:
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
name: kube-root-ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
path: namespace
|
||||
- configMap:
|
||||
name: RELEASE-NAME-proxy
|
||||
name: config
|
||||
- emptyDir: {}
|
||||
name: data
|
||||
should set securityContext when set in values:
|
||||
1: |
|
||||
affinity:
|
||||
podAntiAffinity: null
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
- args:
|
||||
- --diag-addr=0.0.0.0:3000
|
||||
image: public.ecr.aws/gravitational/teleport-distroless:13.3.9
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- teleport
|
||||
- wait
|
||||
- duration
|
||||
- 30s
|
||||
livenessProbe:
|
||||
failureThreshold: 6
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: diag
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 1
|
||||
name: teleport
|
||||
ports:
|
||||
- containerPort: 3080
|
||||
name: tls
|
||||
protocol: TCP
|
||||
- containerPort: 3023
|
||||
name: sshproxy
|
||||
protocol: TCP
|
||||
- containerPort: 3024
|
||||
name: sshtun
|
||||
protocol: TCP
|
||||
- containerPort: 3026
|
||||
name: kube
|
||||
protocol: TCP
|
||||
- containerPort: 3036
|
||||
name: mysql
|
||||
protocol: TCP
|
||||
- containerPort: 3000
|
||||
name: diag
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 12
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: diag
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 1
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: false
|
||||
runAsGroup: 99
|
||||
runAsNonRoot: true
|
||||
runAsUser: 99
|
||||
volumeMounts:
|
||||
- mountPath: /etc/teleport
|
||||
name: config
|
||||
readOnly: true
|
||||
- mountPath: /var/lib/teleport
|
||||
name: data
|
||||
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
name: proxy-serviceaccount-token
|
||||
readOnly: true
|
||||
initContainers:
|
||||
- command:
|
||||
- teleport
|
||||
- wait
|
||||
- no-resolve
|
||||
- RELEASE-NAME-auth-v12.NAMESPACE.svc.cluster.local
|
||||
image: public.ecr.aws/gravitational/teleport-distroless:13.3.9
|
||||
name: wait-auth-update
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: false
|
||||
runAsGroup: 99
|
||||
runAsNonRoot: true
|
||||
runAsUser: 99
|
||||
serviceAccountName: RELEASE-NAME-proxy
|
||||
terminationGracePeriodSeconds: 60
|
||||
volumes:
|
||||
- name: proxy-serviceaccount-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: token
|
||||
- configMap:
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
name: kube-root-ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
path: namespace
|
||||
- configMap:
|
||||
name: RELEASE-NAME-proxy
|
||||
name: config
|
||||
- emptyDir: {}
|
||||
name: data
|
||||
should set tolerations when set in values:
|
||||
1: |
|
||||
- effect: NoExecute
|
||||
key: dedicated
|
||||
operator: Equal
|
||||
value: teleport
|
||||
- effect: NoSchedule
|
||||
key: dedicated
|
||||
operator: Equal
|
||||
value: teleport
|
||||
@@ -0,0 +1,68 @@
|
||||
does not expose separate listener ports by default when ingress.enabled=true:
|
||||
1: |
|
||||
- name: tls
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: 3080
|
||||
does not expose separate listener ports when running in separate mode and ingress.enabled=true:
|
||||
1: |
|
||||
- name: tls
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: 3080
|
||||
exposes a single port when running in multiplex mode:
|
||||
1: |
|
||||
- name: tls
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: 3080
|
||||
exposes a single port when running in multiplex mode and ingress.enabled=true:
|
||||
1: |
|
||||
- name: tls
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: 3080
|
||||
exposes separate listener ports by default:
|
||||
1: |
|
||||
- name: tls
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: 3080
|
||||
- name: sshproxy
|
||||
port: 3023
|
||||
protocol: TCP
|
||||
targetPort: 3023
|
||||
- name: k8s
|
||||
port: 3026
|
||||
protocol: TCP
|
||||
targetPort: 3026
|
||||
- name: sshtun
|
||||
port: 3024
|
||||
protocol: TCP
|
||||
targetPort: 3024
|
||||
- name: mysql
|
||||
port: 3036
|
||||
protocol: TCP
|
||||
targetPort: 3036
|
||||
exposes separate listener ports when running in separate mode:
|
||||
1: |
|
||||
- name: tls
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: 3080
|
||||
- name: sshproxy
|
||||
port: 3023
|
||||
protocol: TCP
|
||||
targetPort: 3023
|
||||
- name: k8s
|
||||
port: 3026
|
||||
protocol: TCP
|
||||
targetPort: 3026
|
||||
- name: sshtun
|
||||
port: 3024
|
||||
protocol: TCP
|
||||
targetPort: 3024
|
||||
- name: mysql
|
||||
port: 3036
|
||||
protocol: TCP
|
||||
targetPort: 3036
|
||||
@@ -0,0 +1,62 @@
|
||||
creates a PodSecurityPolicy when enabled in values and supported:
|
||||
1: |
|
||||
apiVersion: policy/v1beta1
|
||||
kind: PodSecurityPolicy
|
||||
metadata:
|
||||
annotations:
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default,runtime/default
|
||||
seccomp.security.alpha.kubernetes.io/defaultProfileName: runtime/default
|
||||
name: RELEASE-NAME
|
||||
spec:
|
||||
allowPrivilegeEscalation: false
|
||||
fsGroup:
|
||||
ranges:
|
||||
- max: 65535
|
||||
min: 1
|
||||
rule: MustRunAs
|
||||
hostIPC: false
|
||||
hostNetwork: false
|
||||
hostPID: false
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
requiredDropCapabilities:
|
||||
- ALL
|
||||
runAsUser:
|
||||
rule: MustRunAsNonRoot
|
||||
seLinux:
|
||||
rule: RunAsAny
|
||||
supplementalGroups:
|
||||
ranges:
|
||||
- max: 65535
|
||||
min: 1
|
||||
rule: MustRunAs
|
||||
volumes:
|
||||
- '*'
|
||||
2: |
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: RELEASE-NAME-psp
|
||||
namespace: NAMESPACE
|
||||
rules:
|
||||
- apiGroups:
|
||||
- policy
|
||||
resourceNames:
|
||||
- RELEASE-NAME
|
||||
resources:
|
||||
- podsecuritypolicies
|
||||
verbs:
|
||||
- use
|
||||
3: |
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: RELEASE-NAME-psp
|
||||
namespace: NAMESPACE
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: RELEASE-NAME-psp
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: RELEASE-NAME
|
||||
Reference in New Issue
Block a user