디렉토리 구조 및 각 서비스 추가
This commit is contained in:
dsk-minchulahn
23
helm/awx-operator/.helmignore
Normal file
23
helm/awx-operator/.helmignore
Normal file
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
6
helm/awx-operator/Chart.yaml
Normal file
6
helm/awx-operator/Chart.yaml
Normal file
@@ -0,0 +1,6 @@
|
||||
apiVersion: v2
|
||||
appVersion: 2.3.0
|
||||
description: A Helm chart for the AWX Operator
|
||||
name: awx-operator
|
||||
type: application
|
||||
version: 2.3.0
|
||||
67
helm/awx-operator/README.md
Normal file
67
helm/awx-operator/README.md
Normal file
@@ -0,0 +1,67 @@
|
||||
# AWX Operator Helm Chart
|
||||
|
||||
This chart installs the AWX Operator resources configured in [this](https://github.com/ansible/awx-operator) repository.
|
||||
|
||||
## Getting Started
|
||||
To configure your AWX resource using this chart, create your own `yaml` values file. The name is up to personal preference since it will explicitly be passed into the helm chart. Helm will merge whatever values you specify in your file with the default `values.yaml`, overriding any settings you've changed while allowing you to fall back on defaults. Because of this functionality, `values.yaml` should not be edited directly.
|
||||
|
||||
In your values config, enable `AWX.enabled` and add `AWX.spec` values based on the awx operator's [documentation](https://github.com/ansible/awx-operator/blob/devel/README.md). Consult the docs below for additional functionality.
|
||||
|
||||
### Installing
|
||||
The operator's [helm install](https://github.com/ansible/awx-operator/blob/devel/README.md#helm-install-on-existing-cluster) guide provides key installation instructions.
|
||||
|
||||
Example:
|
||||
```
|
||||
helm install my-awx-operator awx-operator/awx-operator -n awx --create-namespace -f myvalues.yaml
|
||||
```
|
||||
|
||||
Argument breakdown:
|
||||
* `-f` passes in the file with your custom values
|
||||
* `-n` sets the namespace to be installed in
|
||||
* This value is accessed by `{{ $.Release.Namespace }}` in the templates
|
||||
* Acts as the default namespace for all unspecified resources
|
||||
* `--create-namespace` specifies that helm should create the namespace before installing
|
||||
|
||||
To update an existing installation, use `helm upgrade` instead of `install`. The rest of the syntax remains the same.
|
||||
|
||||
## Configuration
|
||||
The goal of adding helm configurations is to abstract out and simplify the creation of multi-resource configs. The `AWX.spec` field maps directly to the spec configs of the `AWX` resource that the operator provides, which are detailed in the [main README](https://github.com/ansible/awx-operator/blob/devel/README.md). Other sub-config can be added with the goal of simplifying more involved setups that require additional resources to be specified.
|
||||
|
||||
These sub-headers aim to be a more intuitive entrypoint into customizing your deployment, and are easier to manage in the long-term. By design, the helm templates will defer to the manually defined specs to avoid configuration conflicts. For example, if `AWX.spec.postgres_configuration_secret` is being used, the `AWX.postgres` settings will not be applied, even if enabled.
|
||||
|
||||
### External Postgres
|
||||
The `AWX.postgres` section simplifies the creation of the external postgres secret. If enabled, the configs provided will automatically be placed in a `postgres-config` secret and linked to the `AWX` resource. For proper secret management, the `AWX.postgres.password` value, and any other sensitive values, can be passed in at the command line rather than specified in code. Use the `--set` argument with `helm install`. Supplying the password this way is not recommended for production use, but may be helpful for initial PoC.
|
||||
|
||||
|
||||
## Values Summary
|
||||
|
||||
### AWX
|
||||
| Value | Description | Default |
|
||||
|---|---|---|
|
||||
| `AWX.enabled` | Enable this AWX resource configuration | `false` |
|
||||
| `AWX.name` | The name of the AWX resource and default prefix for other resources | `"awx"` |
|
||||
| `AWX.spec` | specs to directly configure the AWX resource | `{}` |
|
||||
| `AWX.postgres` | configurations for the external postgres secret | - |
|
||||
|
||||
|
||||
# Contributing
|
||||
|
||||
## Adding abstracted sections
|
||||
Where possible, defer to `AWX.spec` configs before applying the abstracted configs to avoid collision. This can be facilitated by the `(hasKey .spec what_i_will_abstract)` check.
|
||||
|
||||
## Building and Testing
|
||||
This chart is built using the Makefile in the [awx-operator repo](https://github.com/ansible/awx-operator). Clone the repo and run `make helm-chart`. This will create the awx-operator chart in the `charts/awx-operator` directory. In this process, the contents of the `.helm/starter` directory will be added to the chart.
|
||||
|
||||
## Future Goals
|
||||
All values under the `AWX` header are focused on configurations that use the operator. Configurations that relate to the Operator itself could be placed under an `Operator` heading, but that may add a layer of complication over current development.
|
||||
|
||||
|
||||
# Chart Publishing
|
||||
|
||||
The chart is currently hosted on the gh-pages branch of the repo. During the release pipeline, the `index.yaml` stored in that branch is generated with helm chart entries from all valid tags. We are currently unable to use the `chart-releaser` pipeline due to the fact that the complete helm chart is not committed to the repo and is instead built during the release process. Therefore, the cr action is unable to compare against previous versions.
|
||||
|
||||
Instead of CR, we use `helm repo index` to generate an index from all locally pulled chart versions. Since we build from scratch every time, the timestamps of all entries will be updated. This could be improved by using yq or something similar to detect which tags are already in the index.yaml file, and only merge in tags that are not present.
|
||||
|
||||
Not using CR could be addressed in the future by keeping the chart built as a part of releases, as long as CR compares the chart to previous release packages rather than previous commits. If the latter is the case, then we would not have the necessary history for comparison.
|
||||
|
||||
|
||||
@@ -0,0 +1,127 @@
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
labels:
|
||||
helm.sh/chart: awx-operator
|
||||
name: awxbackups.awx.ansible.com
|
||||
spec:
|
||||
group: awx.ansible.com
|
||||
names:
|
||||
kind: AWXBackup
|
||||
listKind: AWXBackupList
|
||||
plural: awxbackups
|
||||
singular: awxbackup
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: Schema validation for the AWXBackup CRD
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
additional_labels:
|
||||
description: Additional labels defined on the resource, which should be propagated to child resources
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
backup_pvc:
|
||||
description: Name of the backup PVC
|
||||
type: string
|
||||
backup_pvc_namespace:
|
||||
description: (Deprecated) Namespace the PVC is in
|
||||
type: string
|
||||
backup_resource_requirements:
|
||||
description: Resource requirements for the management pod used to create a backup
|
||||
properties:
|
||||
limits:
|
||||
properties:
|
||||
cpu:
|
||||
type: string
|
||||
memory:
|
||||
type: string
|
||||
type: object
|
||||
requests:
|
||||
properties:
|
||||
cpu:
|
||||
type: string
|
||||
memory:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
backup_storage_class:
|
||||
description: Storage class to use when creating PVC for backup
|
||||
type: string
|
||||
backup_storage_requirements:
|
||||
description: Storage requirements for backup PVC (may be similar to existing postgres PVC backing up from)
|
||||
type: string
|
||||
clean_backup_on_delete:
|
||||
description: Flag to indicate if backup should be deleted on PVC if AWXBackup object is deleted
|
||||
type: boolean
|
||||
db_management_pod_node_selector:
|
||||
description: nodeSelector for the Postgres pods to backup
|
||||
type: string
|
||||
deployment_name:
|
||||
description: Name of the deployment to be backed up
|
||||
type: string
|
||||
no_log:
|
||||
default: true
|
||||
description: Configure no_log for no_log tasks
|
||||
type: boolean
|
||||
pg_dump_suffix:
|
||||
description: Additional parameters for the pg_dump command
|
||||
type: string
|
||||
postgres_image:
|
||||
description: Registry path to the PostgreSQL container to use
|
||||
type: string
|
||||
postgres_image_version:
|
||||
description: PostgreSQL container image version to use
|
||||
type: string
|
||||
postgres_label_selector:
|
||||
description: Label selector used to identify postgres pod for backing up data
|
||||
type: string
|
||||
set_self_labels:
|
||||
default: true
|
||||
description: Maintain some of the recommended `app.kubernetes.io/*` labels on the resource (self)
|
||||
type: boolean
|
||||
required:
|
||||
- deployment_name
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
status:
|
||||
properties:
|
||||
backupClaim:
|
||||
description: Backup persistent volume claim
|
||||
type: string
|
||||
backupDirectory:
|
||||
description: Backup directory name on the specified pvc
|
||||
type: string
|
||||
conditions:
|
||||
description: The resulting conditions when a Service Telemetry is instantiated
|
||||
items:
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
type: string
|
||||
reason:
|
||||
type: string
|
||||
status:
|
||||
type: string
|
||||
type:
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,127 @@
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
labels:
|
||||
helm.sh/chart: awx-operator
|
||||
name: awxrestores.awx.ansible.com
|
||||
spec:
|
||||
group: awx.ansible.com
|
||||
names:
|
||||
kind: AWXRestore
|
||||
listKind: AWXRestoreList
|
||||
plural: awxrestores
|
||||
singular: awxrestore
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: Schema validation for the AWXRestore CRD
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
additional_labels:
|
||||
description: Additional labels defined on the resource, which should be propagated to child resources
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
backup_dir:
|
||||
description: Backup directory name, set as a status found on the awxbackup object (backupDirectory)
|
||||
type: string
|
||||
backup_name:
|
||||
description: AWXBackup object name
|
||||
type: string
|
||||
backup_pvc:
|
||||
description: Name of the PVC to be restored from, set as a status found on the awxbackup object (backupClaim)
|
||||
type: string
|
||||
backup_pvc_namespace:
|
||||
description: (Deprecated) Namespace the PVC is in
|
||||
type: string
|
||||
backup_source:
|
||||
description: Backup source
|
||||
enum:
|
||||
- Backup CR
|
||||
- PVC
|
||||
type: string
|
||||
cluster_name:
|
||||
description: Cluster name
|
||||
type: string
|
||||
db_management_pod_node_selector:
|
||||
description: nodeSelector for the Postgres pods to backup
|
||||
type: string
|
||||
deployment_name:
|
||||
description: Name of the restored deployment. This should be different from the original deployment name if the original deployment still exists.
|
||||
type: string
|
||||
no_log:
|
||||
default: true
|
||||
description: Configure no_log for no_log tasks
|
||||
type: boolean
|
||||
postgres_image:
|
||||
description: Registry path to the PostgreSQL container to use
|
||||
type: string
|
||||
postgres_image_version:
|
||||
description: PostgreSQL container image version to use
|
||||
type: string
|
||||
postgres_label_selector:
|
||||
description: Label selector used to identify postgres pod for backing up data
|
||||
type: string
|
||||
restore_resource_requirements:
|
||||
description: Resource requirements for the management pod that restores AWX from a backup
|
||||
properties:
|
||||
limits:
|
||||
properties:
|
||||
cpu:
|
||||
type: string
|
||||
memory:
|
||||
type: string
|
||||
type: object
|
||||
requests:
|
||||
properties:
|
||||
cpu:
|
||||
type: string
|
||||
memory:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
set_self_labels:
|
||||
default: true
|
||||
description: Maintain some of the recommended `app.kubernetes.io/*` labels on the resource (self)
|
||||
type: boolean
|
||||
required:
|
||||
- deployment_name
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
status:
|
||||
properties:
|
||||
conditions:
|
||||
description: The resulting conditions when a Service Telemetry is instantiated
|
||||
items:
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
type: string
|
||||
reason:
|
||||
type: string
|
||||
status:
|
||||
type: string
|
||||
type:
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
restoreComplete:
|
||||
description: Restore process complete
|
||||
type: boolean
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
File diff suppressed because it is too large
Load Diff
1
helm/awx-operator/templates/NOTES.txt
Normal file
1
helm/awx-operator/templates/NOTES.txt
Normal file
@@ -0,0 +1 @@
|
||||
AWX Operator installed with Helm Chart version 2.3.0
|
||||
6
helm/awx-operator/templates/_helpers.tpl
Normal file
6
helm/awx-operator/templates/_helpers.tpl
Normal file
@@ -0,0 +1,6 @@
|
||||
{{/*
|
||||
Generate the name of the postgres secret, expects AWX context passed in
|
||||
*/}}
|
||||
{{- define "postgres.secretName" -}}
|
||||
{{ default (printf "%s-postgres-configuration" .Values.AWX.name) .Values.AWX.postgres.secretName }}
|
||||
{{- end }}
|
||||
24
helm/awx-operator/templates/awx-deploy.yaml
Normal file
24
helm/awx-operator/templates/awx-deploy.yaml
Normal file
@@ -0,0 +1,24 @@
|
||||
{{- if $.Values.AWX.enabled }}
|
||||
{{- with .Values.AWX }}
|
||||
apiVersion: awx.ansible.com/v1beta1
|
||||
kind: AWX
|
||||
metadata:
|
||||
name: {{ .name }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
spec:
|
||||
{{- /* Include raw map from the values file spec */}}
|
||||
{{ .spec | toYaml | indent 2 }}
|
||||
{{- /* Provide security context defaults */}}
|
||||
{{- if not (hasKey .spec "security_context_settings") }}
|
||||
security_context_settings:
|
||||
runAsGroup: 0
|
||||
runAsUser: 0
|
||||
fsGroup: 0
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
{{- end }}
|
||||
{{- /* Postgres configs if enabled and not already present */}}
|
||||
{{- if and .postgres.enabled (not (hasKey .spec "postgres_configuration_secret")) }}
|
||||
postgres_configuration_secret: {{ include "postgres.secretName" $ }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
helm.sh/chart: awx-operator
|
||||
name: awx-operator-metrics-reader
|
||||
rules:
|
||||
- nonResourceURLs:
|
||||
- /metrics
|
||||
verbs:
|
||||
- get
|
||||
@@ -0,0 +1,19 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
helm.sh/chart: awx-operator
|
||||
name: awx-operator-proxy-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- authentication.k8s.io
|
||||
resources:
|
||||
- tokenreviews
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- authorization.k8s.io
|
||||
resources:
|
||||
- subjectaccessreviews
|
||||
verbs:
|
||||
- create
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
helm.sh/chart: awx-operator
|
||||
name: awx-operator-proxy-rolebinding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: awx-operator-proxy-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: awx-operator-controller-manager
|
||||
namespace: '{{ .Release.Namespace }}'
|
||||
@@ -0,0 +1,28 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
controller_manager_config.yaml: |
|
||||
apiVersion: controller-runtime.sigs.k8s.io/v1alpha1
|
||||
kind: ControllerManagerConfig
|
||||
health:
|
||||
healthProbeBindAddress: :6789
|
||||
metrics:
|
||||
bindAddress: 127.0.0.1:8080
|
||||
|
||||
leaderElection:
|
||||
leaderElect: true
|
||||
resourceName: 811c9dc5.ansible.com
|
||||
# leaderElectionReleaseOnCancel defines if the leader should step down volume
|
||||
# when the Manager ends. This requires the binary to immediately end when the
|
||||
# Manager is stopped, otherwise, this setting is unsafe. Setting this significantly
|
||||
# speeds up voluntary leader transitions as the new leader don't have to wait
|
||||
# LeaseDuration time first.
|
||||
# In the default scaffold provided, the program ends immediately after
|
||||
# the manager stops, so would be fine to enable this option. However,
|
||||
# if you are doing or is intended to do any operation such as perform cleanups
|
||||
# after the manager stops then its usage might be unsafe.
|
||||
# leaderElectionReleaseOnCancel: true
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
helm.sh/chart: awx-operator
|
||||
name: awx-operator-awx-manager-config
|
||||
@@ -0,0 +1,91 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
helm.sh/chart: awx-operator
|
||||
name: awx-operator-controller-manager
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
control-plane: controller-manager
|
||||
helm.sh/chart: awx-operator
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
kubectl.kubernetes.io/default-container: awx-manager
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
helm.sh/chart: awx-operator
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- --secure-listen-address=0.0.0.0:8443
|
||||
- --upstream=http://127.0.0.1:8080/
|
||||
- --logtostderr=true
|
||||
- --v=0
|
||||
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
|
||||
name: kube-rbac-proxy
|
||||
ports:
|
||||
- containerPort: 8443
|
||||
name: https
|
||||
protocol: TCP
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 5m
|
||||
memory: 64Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
- args:
|
||||
- --health-probe-bind-address=:6789
|
||||
- --metrics-bind-address=127.0.0.1:8080
|
||||
- --leader-elect
|
||||
- --leader-election-id=awx-operator
|
||||
env:
|
||||
- name: ANSIBLE_GATHERING
|
||||
value: explicit
|
||||
- name: ANSIBLE_DEBUG_LOGS
|
||||
value: "false"
|
||||
- name: WATCH_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
image: quay.io/ansible/awx-operator:latest
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 6789
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
name: awx-manager
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 6789
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
resources:
|
||||
limits:
|
||||
cpu: 2000m
|
||||
memory: 4096Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
imagePullSecrets:
|
||||
- name: redhat-operators-pull-secret
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
serviceAccountName: awx-operator-controller-manager
|
||||
terminationGracePeriodSeconds: 10
|
||||
18
helm/awx-operator/templates/postgres-config.yaml
Normal file
18
helm/awx-operator/templates/postgres-config.yaml
Normal file
@@ -0,0 +1,18 @@
|
||||
{{- if and $.Values.AWX.enabled $.Values.AWX.postgres.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "postgres.secretName" . }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
{{- with $.Values.AWX.postgres }}
|
||||
stringData:
|
||||
host: {{ .host }}
|
||||
port: {{ .port | quote }}
|
||||
database: {{ .dbName }}
|
||||
username: {{ .username }}
|
||||
password: {{ .password }}
|
||||
sslmode: {{ .sslmode }}
|
||||
type: {{ .type }}
|
||||
type: Opaque
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,127 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
labels:
|
||||
helm.sh/chart: awx-operator
|
||||
name: awx-operator-awx-manager-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- route.openshift.io
|
||||
resources:
|
||||
- routes
|
||||
- routes/custom-host
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- create
|
||||
- delete
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
- services/finalizers
|
||||
- serviceaccounts
|
||||
- endpoints
|
||||
- persistentvolumeclaims
|
||||
- events
|
||||
- configmaps
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- create
|
||||
- delete
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- roles
|
||||
- rolebindings
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- create
|
||||
- delete
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
- daemonsets
|
||||
- replicasets
|
||||
- statefulsets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- create
|
||||
- delete
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- create
|
||||
- delete
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- monitoring.coreos.com
|
||||
resources:
|
||||
- servicemonitors
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
- apiGroups:
|
||||
- apps
|
||||
resourceNames:
|
||||
- awx-operator
|
||||
resources:
|
||||
- deployments/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments/scale
|
||||
- statefulsets/scale
|
||||
verbs:
|
||||
- patch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods/exec
|
||||
- pods/attach
|
||||
- pods/log
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- replicasets
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
- apiGroups:
|
||||
- awx.ansible.com
|
||||
resources:
|
||||
- '*'
|
||||
- awxbackups
|
||||
- awxrestores
|
||||
verbs:
|
||||
- '*'
|
||||
@@ -0,0 +1,38 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
helm.sh/chart: awx-operator
|
||||
name: awx-operator-leader-election-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
helm.sh/chart: awx-operator
|
||||
name: awx-operator-awx-manager-rolebinding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: awx-operator-awx-manager-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: awx-operator-controller-manager
|
||||
namespace: '{{ .Release.Namespace }}'
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
helm.sh/chart: awx-operator
|
||||
name: awx-operator-leader-election-rolebinding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: awx-operator-leader-election-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: awx-operator-controller-manager
|
||||
namespace: '{{ .Release.Namespace }}'
|
||||
@@ -0,0 +1,16 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
helm.sh/chart: awx-operator
|
||||
name: awx-operator-controller-manager-metrics-service
|
||||
spec:
|
||||
ports:
|
||||
- name: https
|
||||
port: 8443
|
||||
protocol: TCP
|
||||
targetPort: https
|
||||
selector:
|
||||
control-plane: controller-manager
|
||||
helm.sh/chart: awx-operator
|
||||
@@ -0,0 +1,6 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
helm.sh/chart: awx-operator
|
||||
name: awx-operator-controller-manager
|
||||
26
helm/awx-operator/values.yaml
Normal file
26
helm/awx-operator/values.yaml
Normal file
@@ -0,0 +1,26 @@
|
||||
AWX:
|
||||
# enable use of awx-deploy template
|
||||
enabled: True
|
||||
name: awx
|
||||
csrf_cookie_secure: False
|
||||
spec:
|
||||
admin_user: admin
|
||||
service_type: nodeport
|
||||
nodeport_port: 30801
|
||||
#service_type: LoadBalancer
|
||||
#loadbalancer_ip: '10.10.43.98'
|
||||
loadbalancer_protocol: https
|
||||
#loadbalancer_port: 80
|
||||
|
||||
# configurations for external postgres instance
|
||||
postgres:
|
||||
enabled: True
|
||||
host: awx-postgres-13
|
||||
port: 5432
|
||||
dbName: infra
|
||||
username: infra
|
||||
# for secret management, pass in the password independently of this file
|
||||
# at the command line, use --set AWX.postgres.password
|
||||
password: infraadmin1234
|
||||
sslmode: prefer
|
||||
type: managed
|
||||
Reference in New Issue
Block a user