디렉토리 구조 및 각 서비스 추가
This commit is contained in:
dsk-minchulahn
@@ -0,0 +1,19 @@
|
||||
{{- range $cm_name, $cm_val := .Values.artifactRepositoryRef }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ $cm_name }}
|
||||
namespace: {{ $.Release.Namespace | quote }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" $ "component" $.Values.controller.name "name" $cm_name) | nindent 4 }}
|
||||
{{- with $cm_val.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
{{- range $data_key, $data_val := (omit $cm_val "annotations") }}
|
||||
{{- $data_key | nindent 2 }}: |
|
||||
{{- toYaml $data_val | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,91 @@
|
||||
{{- if .Values.createAggregateRoles }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.fullname" . }}-view
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 4 }}
|
||||
rbac.authorization.k8s.io/aggregate-to-view: "true"
|
||||
rules:
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflows
|
||||
- workflows/finalizers
|
||||
- workfloweventbindings
|
||||
- workfloweventbindings/finalizers
|
||||
- workflowtemplates
|
||||
- workflowtemplates/finalizers
|
||||
- cronworkflows
|
||||
- cronworkflows/finalizers
|
||||
- clusterworkflowtemplates
|
||||
- clusterworkflowtemplates/finalizers
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.fullname" . }}-edit
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.server.name "name" .Values.server.name) | nindent 4 }}
|
||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||
rules:
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflows
|
||||
- workflows/finalizers
|
||||
- workfloweventbindings
|
||||
- workfloweventbindings/finalizers
|
||||
- workflowtemplates
|
||||
- workflowtemplates/finalizers
|
||||
- cronworkflows
|
||||
- cronworkflows/finalizers
|
||||
- clusterworkflowtemplates
|
||||
- clusterworkflowtemplates/finalizers
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.fullname" . }}-admin
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.server.name "name" .Values.server.name) | nindent 4 }}
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||
rules:
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflows
|
||||
- workflows/finalizers
|
||||
- workfloweventbindings
|
||||
- workfloweventbindings/finalizers
|
||||
- workflowtasksets
|
||||
- workflowtasksets/finalizers
|
||||
- workflowtemplates
|
||||
- workflowtemplates/finalizers
|
||||
- cronworkflows
|
||||
- cronworkflows/finalizers
|
||||
- clusterworkflowtemplates
|
||||
- clusterworkflowtemplates/finalizers
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
{{- end }}
|
||||
@@ -0,0 +1,220 @@
|
||||
{{- if .Values.controller.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
{{- if .Values.singleNamespace }}
|
||||
kind: Role
|
||||
{{- else }}
|
||||
kind: ClusterRole
|
||||
{{- end }}
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.controller.fullname" . }}
|
||||
{{- if .Values.singleNamespace }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods/exec
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- list
|
||||
{{- if .Values.controller.rbac.writeConfigMaps }}
|
||||
- create
|
||||
- update
|
||||
{{- end}}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- persistentvolumeclaims
|
||||
- persistentvolumeclaims/finalizers
|
||||
verbs:
|
||||
- create
|
||||
- update
|
||||
- delete
|
||||
- get
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflows
|
||||
- workflows/finalizers
|
||||
- workflowtasksets
|
||||
- workflowtasksets/finalizers
|
||||
- workflowartifactgctasks
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- create
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflowtemplates
|
||||
- workflowtemplates/finalizers
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflowtaskresults
|
||||
- workflowtaskresults/finalizers
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- cronworkflows
|
||||
- cronworkflows/finalizers
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- serviceaccounts
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- apiGroups:
|
||||
- "policy"
|
||||
resources:
|
||||
- poddisruptionbudgets
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- delete
|
||||
{{- if .Values.controller.persistence }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
resourceNames:
|
||||
{{- if .Values.controller.persistence.postgresql }}
|
||||
- {{ .Values.controller.persistence.postgresql.userNameSecret.name }}
|
||||
- {{ .Values.controller.persistence.postgresql.passwordSecret.name }}
|
||||
{{- end}}
|
||||
{{- if .Values.controller.persistence.mysql }}
|
||||
- {{ .Values.controller.persistence.mysql.userNameSecret.name }}
|
||||
- {{ .Values.controller.persistence.mysql.passwordSecret.name }}
|
||||
{{- end}}
|
||||
verbs:
|
||||
- get
|
||||
{{- end}}
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
resourceNames:
|
||||
{{- if .Values.controller.instanceID.enabled }}
|
||||
{{- if .Values.controller.instanceID.useReleaseName }}
|
||||
- workflow-controller-{{ .Release.Name }}
|
||||
- workflow-controller-lease-{{ .Release.Name }}
|
||||
{{- else }}
|
||||
- workflow-controller-{{ .Values.controller.instanceID.explicitID }}
|
||||
- workflow-controller-lease-{{ .Values.controller.instanceID.explicitID }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
- workflow-controller
|
||||
- workflow-controller-lease
|
||||
{{- end }}
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
resourceNames:
|
||||
{{/* for HTTP templates */}}
|
||||
- argo-workflows-agent-ca-certificates
|
||||
{{- with .Values.controller.rbac.secretWhitelist }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
resourceNames: {{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if and (not .Values.controller.rbac.secretWhitelist) (.Values.controller.rbac.accessAllSecrets) }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.controller.clusterWorkflowTemplates.enabled }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.controller.fullname" . }}-cluster-template
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- clusterworkflowtemplates
|
||||
- clusterworkflowtemplates/finalizers
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,193 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.controller.fullname" . }}-configmap
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" "cm") | nindent 4 }}
|
||||
data:
|
||||
config: |
|
||||
{{- if .Values.controller.instanceID.enabled }}
|
||||
{{- if .Values.controller.instanceID.useReleaseName }}
|
||||
instanceID: {{ .Release.Name }}
|
||||
{{- else }}
|
||||
instanceID: {{ .Values.controller.instanceID.explicitID }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.parallelism }}
|
||||
parallelism: {{ .Values.controller.parallelism }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.resourceRateLimit }}
|
||||
resourceRateLimit: {{ toYaml .Values.controller.resourceRateLimit | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.namespaceParallelism }}
|
||||
namespaceParallelism: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.initialDelay }}
|
||||
initialDelay: {{ . }}
|
||||
{{- end }}
|
||||
{{- if or .Values.mainContainer.resources .Values.mainContainer.env .Values.mainContainer.envFrom .Values.mainContainer.securityContext}}
|
||||
mainContainer:
|
||||
imagePullPolicy: {{ default (.Values.images.pullPolicy) .Values.mainContainer.imagePullPolicy }}
|
||||
{{- with .Values.mainContainer.resources }}
|
||||
resources: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.mainContainer.env }}
|
||||
env: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.mainContainer.envFrom }}
|
||||
envFrom: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.mainContainer.securityContext }}
|
||||
securityContext: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or .Values.executor.resources .Values.executor.env .Values.executor.args .Values.executor.securityContext}}
|
||||
executor:
|
||||
imagePullPolicy: {{ default (.Values.images.pullPolicy) .Values.executor.image.pullPolicy }}
|
||||
{{- with .Values.executor.resources }}
|
||||
resources: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.executor.args }}
|
||||
args: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.executor.env }}
|
||||
env: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.executor.securityContext }}
|
||||
securityContext: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or .Values.artifactRepository.s3 .Values.artifactRepository.gcs .Values.artifactRepository.azure .Values.customArtifactRepository }}
|
||||
artifactRepository:
|
||||
{{- if .Values.artifactRepository.archiveLogs }}
|
||||
archiveLogs: {{ .Values.artifactRepository.archiveLogs }}
|
||||
{{- end }}
|
||||
{{- with .Values.artifactRepository.gcs }}
|
||||
gcs: {{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.artifactRepository.azure }}
|
||||
azure: {{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.artifactRepository.s3 }}
|
||||
s3:
|
||||
{{- if .Values.useStaticCredentials }}
|
||||
accessKeySecret:
|
||||
key: {{ tpl .Values.artifactRepository.s3.accessKeySecret.key . }}
|
||||
name: {{ tpl .Values.artifactRepository.s3.accessKeySecret.name . }}
|
||||
secretKeySecret:
|
||||
key: {{ tpl .Values.artifactRepository.s3.secretKeySecret.key . }}
|
||||
name: {{ tpl .Values.artifactRepository.s3.secretKeySecret.name . }}
|
||||
{{- end }}
|
||||
bucket: {{ tpl (.Values.artifactRepository.s3.bucket | default "") . }}
|
||||
endpoint: {{ tpl (.Values.artifactRepository.s3.endpoint | default "") . }}
|
||||
insecure: {{ .Values.artifactRepository.s3.insecure }}
|
||||
{{- if .Values.artifactRepository.s3.keyFormat }}
|
||||
keyFormat: {{ .Values.artifactRepository.s3.keyFormat | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.artifactRepository.s3.region }}
|
||||
region: {{ tpl .Values.artifactRepository.s3.region $ }}
|
||||
{{- end }}
|
||||
{{- if .Values.artifactRepository.s3.roleARN }}
|
||||
roleARN: {{ .Values.artifactRepository.s3.roleARN }}
|
||||
{{- end }}
|
||||
{{- if .Values.artifactRepository.s3.useSDKCreds }}
|
||||
useSDKCreds: {{ .Values.artifactRepository.s3.useSDKCreds }}
|
||||
{{- end }}
|
||||
{{- with .Values.artifactRepository.s3.encryptionOptions }}
|
||||
encryptionOptions:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.customArtifactRepository }}
|
||||
{{- toYaml .Values.customArtifactRepository | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.metricsConfig.enabled }}
|
||||
metricsConfig:
|
||||
enabled: {{ .Values.controller.metricsConfig.enabled }}
|
||||
path: {{ .Values.controller.metricsConfig.path }}
|
||||
port: {{ .Values.controller.metricsConfig.port }}
|
||||
{{- if .Values.controller.metricsConfig.metricsTTL }}
|
||||
metricsTTL: {{ .Values.controller.metricsConfig.metricsTTL }}
|
||||
{{- end }}
|
||||
ignoreErrors: {{ .Values.controller.metricsConfig.ignoreErrors }}
|
||||
secure: {{ .Values.controller.metricsConfig.secure }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.telemetryConfig.enabled }}
|
||||
telemetryConfig:
|
||||
enabled: {{ .Values.controller.telemetryConfig.enabled }}
|
||||
path: {{ .Values.controller.telemetryConfig.path }}
|
||||
port: {{ .Values.controller.telemetryConfig.port }}
|
||||
{{- if .Values.controller.telemetryConfig.metricsTTL }}
|
||||
metricsTTL: {{ .Values.controller.telemetryConfig.metricsTTL }}
|
||||
{{- end }}
|
||||
ignoreErrors: {{ .Values.controller.telemetryConfig.ignoreErrors }}
|
||||
secure: {{ .Values.controller.telemetryConfig.secure }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.persistence }}
|
||||
persistence:
|
||||
{{ toYaml .Values.controller.persistence | indent 6 }}{{- end }}
|
||||
{{- if .Values.controller.workflowDefaults }}
|
||||
workflowDefaults:
|
||||
{{ toYaml .Values.controller.workflowDefaults | indent 6 }}{{- end }}
|
||||
{{- if .Values.server.sso.enabled }}
|
||||
sso:
|
||||
issuer: {{ .Values.server.sso.issuer }}
|
||||
clientId:
|
||||
name: {{ .Values.server.sso.clientId.name }}
|
||||
key: {{ .Values.server.sso.clientId.key }}
|
||||
clientSecret:
|
||||
name: {{ .Values.server.sso.clientSecret.name }}
|
||||
key: {{ .Values.server.sso.clientSecret.key }}
|
||||
redirectUrl: {{ .Values.server.sso.redirectUrl }}
|
||||
rbac:
|
||||
enabled: {{ .Values.server.sso.rbac.enabled }}
|
||||
{{- with .Values.server.sso.scopes }}
|
||||
scopes: {{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.sso.issuerAlias }}
|
||||
issuerAlias: {{ toYaml . }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.sso.sessionExpiry }}
|
||||
sessionExpiry: {{ toYaml . }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.sso.customGroupClaimName }}
|
||||
customGroupClaimName: {{ toYaml . }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.sso.userInfoPath }}
|
||||
userInfoPath: {{ toYaml . }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.sso.insecureSkipVerify }}
|
||||
insecureSkipVerify: {{ toYaml . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.workflowRestrictions }}
|
||||
workflowRestrictions: {{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.links }}
|
||||
links: {{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.columns }}
|
||||
columns: {{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.navColor }}
|
||||
navColor: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.retentionPolicy }}
|
||||
retentionPolicy: {{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with .Values.emissary.images }}
|
||||
images: {{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
nodeEvents:
|
||||
enabled: {{ .Values.controller.nodeEvents.enabled }}
|
||||
{{- with .Values.controller.kubeConfig }}
|
||||
kubeConfig: {{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.podGCGracePeriodSeconds }}
|
||||
podGCGracePeriodSeconds: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.podGCDeleteDelayDuration }}
|
||||
podGCDeleteDelayDuration: {{ . }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,45 @@
|
||||
{{- if .Values.controller.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
{{- if .Values.singleNamespace }}
|
||||
kind: RoleBinding
|
||||
{{ else }}
|
||||
kind: ClusterRoleBinding
|
||||
{{- end }}
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.controller.fullname" . }}
|
||||
{{- if .Values.singleNamespace }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
{{- if .Values.singleNamespace }}
|
||||
kind: Role
|
||||
{{ else }}
|
||||
kind: ClusterRole
|
||||
{{- end }}
|
||||
name: {{ template "argo-workflows.controller.fullname" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "argo-workflows.controllerServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
|
||||
{{- if .Values.controller.clusterWorkflowTemplates.enabled }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.controller.fullname" . }}-cluster-template
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "argo-workflows.controller.fullname" . }}-cluster-template
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "argo-workflows.controllerServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,20 @@
|
||||
{{- if .Values.controller.pdb.enabled }}
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.controller.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 4 }}
|
||||
spec:
|
||||
{{- if .Values.controller.pdb.minAvailable }}
|
||||
minAvailable: {{ .Values.controller.pdb.minAvailable }}
|
||||
{{- else if .Values.controller.pdb.maxUnavailable }}
|
||||
maxUnavailable: {{ .Values.controller.pdb.maxUnavailable }}
|
||||
{{- else }}
|
||||
minAvailable: 0
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "argo-workflows.selectorLabels" (dict "context" . "name" .Values.controller.name) | nindent 6 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,129 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.controller.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 4 }}
|
||||
app.kubernetes.io/version: {{ include "argo-workflows.controller_chart_version_label" . }}
|
||||
{{- with .Values.controller.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.controller.replicas }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "argo-workflows.selectorLabels" (dict "context" . "name" .Values.controller.name) | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 8 }}
|
||||
app.kubernetes.io/version: {{ include "argo-workflows.controller_chart_version_label" . }}
|
||||
{{- with.Values.controller.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
serviceAccountName: {{ template "argo-workflows.controllerServiceAccountName" . }}
|
||||
{{- with .Values.controller.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.extraInitContainers }}
|
||||
initContainers:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: controller
|
||||
image: "{{- include "argo-workflows.image" (dict "context" . "image" .Values.controller.image) }}:{{ default (include "argo-workflows.defaultTag" .) .Values.controller.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.images.pullPolicy }}
|
||||
command: [ "workflow-controller" ]
|
||||
args:
|
||||
- "--configmap"
|
||||
- "{{ template "argo-workflows.controller.fullname" . }}-configmap"
|
||||
- "--executor-image"
|
||||
- "{{- include "argo-workflows.image" (dict "context" . "image" .Values.executor.image) }}:{{ default (include "argo-workflows.defaultTag" .) .Values.executor.image.tag }}"
|
||||
- "--loglevel"
|
||||
- "{{ .Values.controller.logging.level }}"
|
||||
- "--gloglevel"
|
||||
- "{{ .Values.controller.logging.globallevel }}"
|
||||
- "--log-format"
|
||||
- "{{ .Values.controller.logging.format }}"
|
||||
{{- if .Values.singleNamespace }}
|
||||
- "--namespaced"
|
||||
{{- end }}
|
||||
{{- with .Values.controller.workflowWorkers }}
|
||||
- "--workflow-workers"
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.extraArgs }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.controller.securityContext | nindent 12 }}
|
||||
env:
|
||||
- name: ARGO_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: LEADER_ELECTION_IDENTITY
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
{{- with .Values.controller.extraEnv }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.controller.resources | nindent 12 }}
|
||||
{{- with .Values.controller.volumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: {{ .Values.controller.metricsConfig.portName }}
|
||||
containerPort: {{ .Values.controller.metricsConfig.port }}
|
||||
- containerPort: 6060
|
||||
livenessProbe: {{ .Values.controller.livenessProbe | toYaml | nindent 12 }}
|
||||
{{- with .Values.controller.extraContainers }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.images.pullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.volumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- range $constraint := . }}
|
||||
- {{ toYaml $constraint | nindent 8 | trim }}
|
||||
{{- if not $constraint.labelSelector }}
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
{{- include "argo-workflows.selectorLabels" (dict "context" $ "name" $.Values.controller.name) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.priorityClassName }}
|
||||
priorityClassName: {{ . }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,16 @@
|
||||
{{- if .Values.controller.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.controllerServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 4 }}
|
||||
{{- with .Values.controller.serviceAccount.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{ with .Values.controller.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml .| nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,39 @@
|
||||
{{- if or .Values.controller.metricsConfig.enabled .Values.controller.telemetryConfig.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.controller.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 4 }}
|
||||
app.kubernetes.io/version: {{ default (include "argo-workflows.defaultTag" .) .Values.controller.image.tag | trunc 63 | quote }}
|
||||
{{- with .Values.controller.serviceLabels }}
|
||||
{{ toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.serviceAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4}}
|
||||
{{- end }}
|
||||
spec:
|
||||
ports:
|
||||
{{- if .Values.controller.metricsConfig.enabled }}
|
||||
- name: {{ .Values.controller.metricsConfig.servicePortName }}
|
||||
port: {{ .Values.controller.metricsConfig.servicePort }}
|
||||
protocol: TCP
|
||||
targetPort: {{ .Values.controller.metricsConfig.port }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.telemetryConfig.enabled }}
|
||||
- name: {{ .Values.controller.telemetryConfig.servicePortName }}
|
||||
port: {{ .Values.controller.telemetryConfig.servicePort }}
|
||||
protocol: TCP
|
||||
targetPort: {{ .Values.controller.telemetryConfig.port }}
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "argo-workflows.selectorLabels" (dict "context" . "name" .Values.controller.name) | nindent 4 }}
|
||||
sessionAffinity: None
|
||||
type: {{ .Values.controller.serviceType }}
|
||||
{{- if and (eq .Values.controller.serviceType "LoadBalancer") .Values.controller.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges:
|
||||
{{- toYaml .Values.controller.loadBalancerSourceRanges | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,50 @@
|
||||
{{- if and (or .Values.controller.metricsConfig.enabled .Values.controller.telemetryConfig.enabled) .Values.controller.serviceMonitor.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.controller.fullname" . }}
|
||||
namespace: {{ default .Release.Namespace .Values.controller.serviceMonitor.namespace | quote }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 4 }}
|
||||
{{- with .Values.controller.serviceMonitor.additionalLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
endpoints:
|
||||
{{- if .Values.controller.metricsConfig.enabled }}
|
||||
- port: {{ .Values.controller.metricsConfig.servicePortName }}
|
||||
path: {{ .Values.controller.metricsConfig.path }}
|
||||
interval: 30s
|
||||
{{- with .Values.controller.metricsConfig.relabelings }}
|
||||
relabelings:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.metricsConfig.metricRelabelings }}
|
||||
metricRelabelings:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.telemetryConfig.enabled }}
|
||||
- port: telemetry
|
||||
path: {{ .Values.controller.telemetryConfig.path }}
|
||||
interval: 30s
|
||||
{{- with .Values.controller.metricsConfig.relabelings }}
|
||||
relabelings:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.metricsConfig.metricRelabelings }}
|
||||
metricRelabelings:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.metricsConfig.targetLabels }}
|
||||
targetLabels:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ .Release.Namespace | quote }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "argo-workflows.selectorLabels" (dict "context" . "name" .Values.controller.name) | nindent 6 }}
|
||||
{{- end }}
|
||||
24
helm/argo-workflows/templates/controller/workflow-rb.yaml
Normal file
24
helm/argo-workflows/templates/controller/workflow-rb.yaml
Normal file
@@ -0,0 +1,24 @@
|
||||
{{- if .Values.workflow.rbac.create -}}
|
||||
{{- range $namespace := or .Values.singleNamespace false | ternary (list "") (append .Values.controller.workflowNamespaces (coalesce .Values.workflow.namespace .Release.Namespace) | uniq) }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.fullname" $ }}-workflow
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" $ "component" $.Values.controller.name "name" $.Values.controller.name) | nindent 4 }}
|
||||
{{- with $namespace }}
|
||||
namespace: {{ . }}
|
||||
{{- end }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "argo-workflows.fullname" $ }}-workflow
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ $.Values.workflow.serviceAccount.name }}
|
||||
{{- with $namespace }}
|
||||
namespace: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
58
helm/argo-workflows/templates/controller/workflow-role.yaml
Normal file
58
helm/argo-workflows/templates/controller/workflow-role.yaml
Normal file
@@ -0,0 +1,58 @@
|
||||
{{- if .Values.workflow.rbac.create -}}
|
||||
{{- range $namespace := or .Values.singleNamespace false | ternary (list "") (append .Values.controller.workflowNamespaces (coalesce .Values.workflow.namespace .Release.Namespace) | uniq) }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.fullname" $ }}-workflow
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" $ "component" $.Values.controller.name "name" $.Values.controller.name) | nindent 4 }}
|
||||
{{- with $namespace }}
|
||||
namespace: {{ . }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- patch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods/log
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods/exec
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflowtaskresults
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflowtasksets
|
||||
- workflowartifactgctasks
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflowtasksets/status
|
||||
- workflowartifactgctasks/status
|
||||
verbs:
|
||||
- patch
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
25
helm/argo-workflows/templates/controller/workflow-sa.yaml
Normal file
25
helm/argo-workflows/templates/controller/workflow-sa.yaml
Normal file
@@ -0,0 +1,25 @@
|
||||
{{- if .Values.workflow.serviceAccount.create -}}
|
||||
{{- range $namespace := or .Values.singleNamespace false | ternary (list "") (append .Values.controller.workflowNamespaces (coalesce .Values.workflow.namespace .Release.Namespace) | uniq) }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ $.Values.workflow.serviceAccount.name }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" $ "component" $.Values.controller.name "name" $.Values.controller.name) | nindent 4 }}
|
||||
{{- with $.Values.workflow.serviceAccount.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $namespace }}
|
||||
namespace: {{ . }}
|
||||
{{- end }}
|
||||
{{- with $.Values.workflow.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $.Values.workflow.serviceAccount.pullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user