디렉토리 구조 및 각 서비스 추가
This commit is contained in:
dsk-minchulahn
44
helm/airflow/templates/rbac/pod-cleanup-role.yaml
Normal file
44
helm/airflow/templates/rbac/pod-cleanup-role.yaml
Normal file
@@ -0,0 +1,44 @@
|
||||
{{/*
|
||||
Licensed to the Apache Software Foundation (ASF) under one
|
||||
or more contributor license agreements. See the NOTICE file
|
||||
distributed with this work for additional information
|
||||
regarding copyright ownership. The ASF licenses this file
|
||||
to you under the Apache License, Version 2.0 (the
|
||||
"License"); you may not use this file except in compliance
|
||||
with the License. You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing,
|
||||
software distributed under the License is distributed on an
|
||||
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
KIND, either express or implied. See the License for the
|
||||
specific language governing permissions and limitations
|
||||
under the License.
|
||||
*/}}
|
||||
|
||||
################################
|
||||
## Airflow Cleanup Role
|
||||
#################################
|
||||
{{- if and .Values.rbac.create .Values.cleanup.enabled }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "airflow.fullname" . }}-cleanup-role
|
||||
labels:
|
||||
tier: airflow
|
||||
release: {{ .Release.Name }}
|
||||
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- with .Values.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "pods"
|
||||
verbs:
|
||||
- "list"
|
||||
- "delete"
|
||||
{{- end }}
|
||||
44
helm/airflow/templates/rbac/pod-cleanup-rolebinding.yaml
Normal file
44
helm/airflow/templates/rbac/pod-cleanup-rolebinding.yaml
Normal file
@@ -0,0 +1,44 @@
|
||||
{{/*
|
||||
Licensed to the Apache Software Foundation (ASF) under one
|
||||
or more contributor license agreements. See the NOTICE file
|
||||
distributed with this work for additional information
|
||||
regarding copyright ownership. The ASF licenses this file
|
||||
to you under the Apache License, Version 2.0 (the
|
||||
"License"); you may not use this file except in compliance
|
||||
with the License. You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing,
|
||||
software distributed under the License is distributed on an
|
||||
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
KIND, either express or implied. See the License for the
|
||||
specific language governing permissions and limitations
|
||||
under the License.
|
||||
*/}}
|
||||
|
||||
################################
|
||||
## Airflow Cleanup Role Binding
|
||||
#################################
|
||||
{{- if and .Values.rbac.create .Values.cleanup.enabled }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "airflow.fullname" . }}-cleanup-rolebinding
|
||||
labels:
|
||||
tier: airflow
|
||||
release: {{ .Release.Name }}
|
||||
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- with .Values.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ include "airflow.fullname" . }}-cleanup-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "cleanup.serviceAccountName" . }}
|
||||
namespace: "{{ .Release.Namespace }}"
|
||||
{{- end }}
|
||||
74
helm/airflow/templates/rbac/pod-launcher-role.yaml
Normal file
74
helm/airflow/templates/rbac/pod-launcher-role.yaml
Normal file
@@ -0,0 +1,74 @@
|
||||
{{/*
|
||||
Licensed to the Apache Software Foundation (ASF) under one
|
||||
or more contributor license agreements. See the NOTICE file
|
||||
distributed with this work for additional information
|
||||
regarding copyright ownership. The ASF licenses this file
|
||||
to you under the Apache License, Version 2.0 (the
|
||||
"License"); you may not use this file except in compliance
|
||||
with the License. You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing,
|
||||
software distributed under the License is distributed on an
|
||||
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
KIND, either express or implied. See the License for the
|
||||
specific language governing permissions and limitations
|
||||
under the License.
|
||||
*/}}
|
||||
|
||||
################################
|
||||
## Airflow Pod Launcher Role
|
||||
#################################
|
||||
{{- if and .Values.rbac.create .Values.allowPodLaunching }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
{{- if .Values.multiNamespaceMode }}
|
||||
kind: ClusterRole
|
||||
{{- else }}
|
||||
kind: Role
|
||||
{{- end }}
|
||||
metadata:
|
||||
name: {{ include "airflow.fullname" . }}-pod-launcher-role
|
||||
{{- if not .Values.multiNamespaceMode }}
|
||||
namespace: "{{ .Release.Namespace }}"
|
||||
{{- end }}
|
||||
labels:
|
||||
tier: airflow
|
||||
release: {{ .Release.Name }}
|
||||
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- with .Values.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "pods"
|
||||
verbs:
|
||||
- "create"
|
||||
- "list"
|
||||
- "get"
|
||||
- "patch"
|
||||
- "watch"
|
||||
- "delete"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "pods/log"
|
||||
verbs:
|
||||
- "get"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "pods/exec"
|
||||
verbs:
|
||||
- "create"
|
||||
- "get"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "events"
|
||||
verbs:
|
||||
- "list"
|
||||
{{- end }}
|
||||
64
helm/airflow/templates/rbac/pod-launcher-rolebinding.yaml
Normal file
64
helm/airflow/templates/rbac/pod-launcher-rolebinding.yaml
Normal file
@@ -0,0 +1,64 @@
|
||||
{{/*
|
||||
Licensed to the Apache Software Foundation (ASF) under one
|
||||
or more contributor license agreements. See the NOTICE file
|
||||
distributed with this work for additional information
|
||||
regarding copyright ownership. The ASF licenses this file
|
||||
to you under the Apache License, Version 2.0 (the
|
||||
"License"); you may not use this file except in compliance
|
||||
with the License. You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing,
|
||||
software distributed under the License is distributed on an
|
||||
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
KIND, either express or implied. See the License for the
|
||||
specific language governing permissions and limitations
|
||||
under the License.
|
||||
*/}}
|
||||
|
||||
################################
|
||||
## Airflow Pod Launcher Role Binding
|
||||
#################################
|
||||
{{- if and .Values.rbac.create .Values.allowPodLaunching }}
|
||||
{{- $schedulerLaunchExecutors := list "LocalExecutor" "LocalKubernetesExecutor" "KubernetesExecutor" "CeleryKubernetesExecutor" }}
|
||||
{{- $workerLaunchExecutors := list "CeleryExecutor" "LocalKubernetesExecutor" "KubernetesExecutor" "CeleryKubernetesExecutor" }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
{{- if .Values.multiNamespaceMode }}
|
||||
kind: ClusterRoleBinding
|
||||
{{- else }}
|
||||
kind: RoleBinding
|
||||
{{- end }}
|
||||
metadata:
|
||||
{{- if not .Values.multiNamespaceMode }}
|
||||
namespace: "{{ .Release.Namespace }}"
|
||||
{{- end }}
|
||||
name: {{ include "airflow.fullname" . }}-pod-launcher-rolebinding
|
||||
labels:
|
||||
tier: airflow
|
||||
release: {{ .Release.Name }}
|
||||
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- with .Values.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
{{- if .Values.multiNamespaceMode }}
|
||||
kind: ClusterRole
|
||||
{{- else }}
|
||||
kind: Role
|
||||
{{- end }}
|
||||
name: {{ include "airflow.fullname" . }}-pod-launcher-role
|
||||
subjects:
|
||||
{{- if has .Values.executor $schedulerLaunchExecutors }}
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "scheduler.serviceAccountName" . }}
|
||||
namespace: "{{ .Release.Namespace }}"
|
||||
{{- end }}
|
||||
{{- if has .Values.executor $workerLaunchExecutors }}
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "worker.serviceAccountName" . }}
|
||||
namespace: "{{ .Release.Namespace }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
59
helm/airflow/templates/rbac/pod-log-reader-role.yaml
Normal file
59
helm/airflow/templates/rbac/pod-log-reader-role.yaml
Normal file
@@ -0,0 +1,59 @@
|
||||
{{/*
|
||||
Licensed to the Apache Software Foundation (ASF) under one
|
||||
or more contributor license agreements. See the NOTICE file
|
||||
distributed with this work for additional information
|
||||
regarding copyright ownership. The ASF licenses this file
|
||||
to you under the Apache License, Version 2.0 (the
|
||||
"License"); you may not use this file except in compliance
|
||||
with the License. You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing,
|
||||
software distributed under the License is distributed on an
|
||||
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
KIND, either express or implied. See the License for the
|
||||
specific language governing permissions and limitations
|
||||
under the License.
|
||||
*/}}
|
||||
|
||||
################################
|
||||
## Airflow Pod Reader Role
|
||||
#################################
|
||||
{{- if and .Values.rbac.create (or .Values.webserver.allowPodLogReading .Values.triggerer.enabled) }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
{{- if .Values.multiNamespaceMode }}
|
||||
kind: ClusterRole
|
||||
{{- else }}
|
||||
kind: Role
|
||||
{{- end }}
|
||||
metadata:
|
||||
name: {{ include "airflow.fullname" . }}-pod-log-reader-role
|
||||
{{- if not .Values.multiNamespaceMode }}
|
||||
namespace: "{{ .Release.Namespace }}"
|
||||
{{- end }}
|
||||
labels:
|
||||
tier: airflow
|
||||
release: {{ .Release.Name }}
|
||||
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- with .Values.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "pods"
|
||||
verbs:
|
||||
- "list"
|
||||
- "get"
|
||||
- "watch"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "pods/log"
|
||||
verbs:
|
||||
- "get"
|
||||
- "list"
|
||||
{{- end }}
|
||||
62
helm/airflow/templates/rbac/pod-log-reader-rolebinding.yaml
Normal file
62
helm/airflow/templates/rbac/pod-log-reader-rolebinding.yaml
Normal file
@@ -0,0 +1,62 @@
|
||||
{{/*
|
||||
Licensed to the Apache Software Foundation (ASF) under one
|
||||
or more contributor license agreements. See the NOTICE file
|
||||
distributed with this work for additional information
|
||||
regarding copyright ownership. The ASF licenses this file
|
||||
to you under the Apache License, Version 2.0 (the
|
||||
"License"); you may not use this file except in compliance
|
||||
with the License. You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing,
|
||||
software distributed under the License is distributed on an
|
||||
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
KIND, either express or implied. See the License for the
|
||||
specific language governing permissions and limitations
|
||||
under the License.
|
||||
*/}}
|
||||
|
||||
################################
|
||||
## Airflow Pod Reader Role Binding
|
||||
#################################
|
||||
{{- if and .Values.rbac.create (or .Values.webserver.allowPodLogReading .Values.triggerer.enabled) }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
{{- if .Values.multiNamespaceMode }}
|
||||
kind: ClusterRoleBinding
|
||||
{{- else }}
|
||||
kind: RoleBinding
|
||||
{{- end }}
|
||||
metadata:
|
||||
{{- if not .Values.multiNamespaceMode }}
|
||||
namespace: "{{ .Release.Namespace }}"
|
||||
{{- end }}
|
||||
name: {{ include "airflow.fullname" . }}-pod-log-reader-rolebinding
|
||||
labels:
|
||||
tier: airflow
|
||||
release: {{ .Release.Name }}
|
||||
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- with .Values.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
{{- if .Values.multiNamespaceMode }}
|
||||
kind: ClusterRole
|
||||
{{- else }}
|
||||
kind: Role
|
||||
{{- end }}
|
||||
name: {{ include "airflow.fullname" . }}-pod-log-reader-role
|
||||
subjects:
|
||||
{{- if .Values.webserver.allowPodLogReading }}
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "webserver.serviceAccountName" . }}
|
||||
namespace: "{{ .Release.Namespace }}"
|
||||
{{- end }}
|
||||
{{- if .Values.triggerer.enabled }}
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "triggerer.serviceAccountName" . }}
|
||||
namespace: "{{ .Release.Namespace }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,88 @@
|
||||
{{/*
|
||||
Licensed to the Apache Software Foundation (ASF) under one
|
||||
or more contributor license agreements. See the NOTICE file
|
||||
distributed with this work for additional information
|
||||
regarding copyright ownership. The ASF licenses this file
|
||||
to you under the Apache License, Version 2.0 (the
|
||||
"License"); you may not use this file except in compliance
|
||||
with the License. You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing,
|
||||
software distributed under the License is distributed on an
|
||||
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
KIND, either express or implied. See the License for the
|
||||
specific language governing permissions and limitations
|
||||
under the License.
|
||||
*/}}
|
||||
|
||||
################################
|
||||
## Airflow SCC Role Binding
|
||||
#################################
|
||||
{{- if and .Values.rbac.create .Values.rbac.createSCCRoleBinding }}
|
||||
{{- $hasWorkers := has .Values.executor (list "CeleryExecutor" "LocalKubernetesExecutor" "KubernetesExecutor" "CeleryKubernetesExecutor") }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
{{- if .Values.multiNamespaceMode }}
|
||||
kind: ClusterRoleBinding
|
||||
{{- else }}
|
||||
kind: RoleBinding
|
||||
{{- end }}
|
||||
metadata:
|
||||
{{- if not .Values.multiNamespaceMode }}
|
||||
namespace: "{{ .Release.Namespace }}"
|
||||
{{- end }}
|
||||
name: {{ include "airflow.fullname" . }}-scc-rolebinding
|
||||
labels:
|
||||
tier: airflow
|
||||
release: {{ .Release.Name }}
|
||||
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- with .Values.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: system:openshift:scc:anyuid
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "webserver.serviceAccountName" . }}
|
||||
namespace: "{{ .Release.Namespace }}"
|
||||
{{- if $hasWorkers }}
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "worker.serviceAccountName" . }}
|
||||
namespace: "{{ .Release.Namespace }}"
|
||||
{{- end }}
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "scheduler.serviceAccountName" . }}
|
||||
namespace: "{{ .Release.Namespace }}"
|
||||
{{- if and .Values.statsd.enabled }}
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "statsd.serviceAccountName" . }}
|
||||
namespace: "{{ .Release.Namespace }}"
|
||||
{{- end }}
|
||||
{{- if and .Values.flower.enabled (or (eq .Values.executor "CeleryExecutor") (eq .Values.executor "CeleryKubernetesExecutor")) }}
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "flower.serviceAccountName" . }}
|
||||
namespace: "{{ .Release.Namespace }}"
|
||||
{{- end }}
|
||||
{{- if and (semverCompare ">=2.2.0" .Values.airflowVersion) }}
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "triggerer.serviceAccountName" . }}
|
||||
namespace: "{{ .Release.Namespace }}"
|
||||
{{- end }}
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "migrateDatabaseJob.serviceAccountName" . }}
|
||||
namespace: "{{ .Release.Namespace }}"
|
||||
{{- if .Values.webserver.defaultUser.enabled }}
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "createUserJob.serviceAccountName" . }}
|
||||
namespace: "{{ .Release.Namespace }}"
|
||||
{{- end }}
|
||||
{{- if and .Values.cleanup.enabled }}
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "cleanup.serviceAccountName" . }}
|
||||
namespace: "{{ .Release.Namespace }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user