From 510ceba8482cdf9ec1520fdac9dfca59359e7f58 Mon Sep 17 00:00:00 2001 From: Matt Date: Wed, 17 Jan 2024 19:05:12 +1100 Subject: [PATCH 1/2] [patch] Remove aws-calico helm chart --- stable/aws-calico/.helmignore | 22 -- stable/aws-calico/Chart.yaml | 8 - stable/aws-calico/README.md | 66 ------ stable/aws-calico/crds/crds.yaml | 214 ------------------ stable/aws-calico/crds/kustomization.yaml | 4 - stable/aws-calico/templates/_helpers.tpl | 55 ----- stable/aws-calico/templates/config-map.yaml | 10 - stable/aws-calico/templates/daemon-set.yaml | 158 ------------- stable/aws-calico/templates/deployment.yaml | 134 ----------- .../templates/pod-disruption-budget.yaml | 20 -- .../templates/podsecuritypolicy.yaml | 211 ----------------- stable/aws-calico/templates/rbac.yaml | 214 ------------------ .../templates/service-accounts.yaml | 18 -- stable/aws-calico/templates/service.yaml | 15 -- stable/aws-calico/values.yaml | 77 ------- 15 files changed, 1226 deletions(-) delete mode 100755 stable/aws-calico/.helmignore delete mode 100755 stable/aws-calico/Chart.yaml delete mode 100755 stable/aws-calico/README.md delete mode 100755 stable/aws-calico/crds/crds.yaml delete mode 100644 stable/aws-calico/crds/kustomization.yaml delete mode 100755 stable/aws-calico/templates/_helpers.tpl delete mode 100755 stable/aws-calico/templates/config-map.yaml delete mode 100755 stable/aws-calico/templates/daemon-set.yaml delete mode 100755 stable/aws-calico/templates/deployment.yaml delete mode 100644 stable/aws-calico/templates/pod-disruption-budget.yaml delete mode 100644 stable/aws-calico/templates/podsecuritypolicy.yaml delete mode 100755 stable/aws-calico/templates/rbac.yaml delete mode 100755 stable/aws-calico/templates/service-accounts.yaml delete mode 100755 stable/aws-calico/templates/service.yaml delete mode 100755 stable/aws-calico/values.yaml diff --git a/stable/aws-calico/.helmignore b/stable/aws-calico/.helmignore deleted file mode 100755 index 5ae7e8b..0000000 --- a/stable/aws-calico/.helmignore +++ /dev/null @@ -1,22 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -crds/kustomization.yaml diff --git a/stable/aws-calico/Chart.yaml b/stable/aws-calico/Chart.yaml deleted file mode 100755 index c18ae37..0000000 --- a/stable/aws-calico/Chart.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: v1 -description: A Helm chart for installing Calico on AWS -# Commenting `website` as it fails Yamale strict mode -# website: https://docs.aws.amazon.com/eks/latest/userguide/calico.html -name: aws-calico -version: 0.0.14 -appVersion: 3.19.3 -icon: https://www.projectcalico.org/wp-content/uploads/2019/09/Calico_Logo_Large_Calico.png diff --git a/stable/aws-calico/README.md b/stable/aws-calico/README.md deleted file mode 100755 index ecc7615..0000000 --- a/stable/aws-calico/README.md +++ /dev/null @@ -1,66 +0,0 @@ -# Calico on AWS - -This chart installs Calico on AWS: https://docs.aws.amazon.com/eks/latest/userguide/calico.html - -## Prerequisites - -- Kubernetes 1.11+ running on AWS - -## Installing the Chart - -First add the EKS repository to Helm: - -```shell -helm repo add eks https://aws.github.io/eks-charts -``` - -Install the Calico CRDs: - -```shell -kubectl apply -k github.com/aws/eks-charts/tree/master/stable/aws-calico/crds -``` - -To install the chart with the release name `aws-calico` and default configuration: - -```shell -helm install --name aws-calico --namespace kube-system eks/aws-calico -``` - -To install into an EKS cluster where the CNI is already installed, you can run: - -```shell -helm upgrade --install --recreate-pods --force aws-calico --namespace kube-system eks/aws-calico -``` - -If you receive an error similar to `Error: release aws-calico failed: "aws-calico" already exists`, simply rerun the above command. - -## Configuration - -The following table lists the configurable parameters for this chart and their default values. - -| Parameter | Description | Default | -|----------------------------------------|---------------------------------------------------------|---------------------------------| -| `calico.typha.image` | Calico Typha Image | `quay.io/calico/typha` | -| `calico.typha.resources` | Calico Typha Resources | `requests.memory: 64Mi, requests.cpu: 50m, limits.memory: 96Mi, limits.cpu: 100m` | -| `calico.typha.logseverity` | Calico Typha Log Severity | `Info` | -| `calico.typha.nodeSelector` | Calico Typha Node Selector | `{ beta.kubernetes.io/os: linux }` | -| `calico.node.extraEnv` | Calico Node extra ENV vars | `[]` | -| `calico.node.image` | Calico Node Image | `quay.io/calico/node` | -| `calico.node.resources` | Calico Node Resources | `requests.memory: 32Mi, requests.cpu: 20m, limits.memory: 64Mi, limits.cpu: 100m` | -| `calico.node.logseverity` | Calico Node Log Severity | `Info` | -| `calico.node.nodeSelector` | Calico Node Node Selector | `{ beta.kubernetes.io/os: linux }` | -| `calico.typha_autoscaler.resources` | Calico Typha Autoscaler Resources | `requests.memory: 16Mi, requests.cpu: 10m, limits.memory: 32Mi, limits.cpu: 10m` | -| `calico.typha_autoscaler.nodeSelector` | Calico Typha Autoscaler Node Selector | `{ beta.kubernetes.io/os: linux }` | -| `calico.tag` | Calico version | `v3.19.2` | -| `fullnameOverride` | Override the fullname of the chart | `calico` | -| `podSecurityPolicy.create` | Specifies whether podSecurityPolicy and related rbac objects should be created | `false` | -| `serviceAccount.name` | The name of the ServiceAccount to use | `nil` | -| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | -| `autoscaler.image` | Cluster Proportional Autoscaler Image | `k8s.gcr.io/cpa/cluster-proportional-autoscaler` | -| `autoscaler.tag` | Cluster Proportional Autoscaler version | `1.8.5` | - -Specify each parameter using the `--set key=value[,key=value]` argument to `helm install` or provide a YAML file containing the values for the above parameters: - -```shell -helm install --name aws-calico --namespace kube-system eks/aws-calico --values values.yaml -``` diff --git a/stable/aws-calico/crds/crds.yaml b/stable/aws-calico/crds/crds.yaml deleted file mode 100755 index 73fe142..0000000 --- a/stable/aws-calico/crds/crds.yaml +++ /dev/null @@ -1,214 +0,0 @@ -# Create all the CustomResourceDefinitions needed for -# Calico policy-only mode. - -apiVersion: apiextensions.k8s.io/v1beta1 -kind: CustomResourceDefinition -metadata: - name: felixconfigurations.crd.projectcalico.org -spec: - scope: Cluster - group: crd.projectcalico.org - versions: - - name: v1 - served: true - storage: true - names: - kind: FelixConfiguration - plural: felixconfigurations - singular: felixconfiguration - ---- - -apiVersion: apiextensions.k8s.io/v1beta1 -kind: CustomResourceDefinition -metadata: - name: ipamblocks.crd.projectcalico.org -spec: - scope: Cluster - group: crd.projectcalico.org - versions: - - name: v1 - served: true - storage: true - names: - kind: IPAMBlock - plural: ipamblocks - singular: ipamblock - ---- - -apiVersion: apiextensions.k8s.io/v1beta1 -kind: CustomResourceDefinition -metadata: - name: blockaffinities.crd.projectcalico.org -spec: - scope: Cluster - group: crd.projectcalico.org - versions: - - name: v1 - served: true - storage: true - names: - kind: BlockAffinity - plural: blockaffinities - singular: blockaffinity - ---- - -apiVersion: apiextensions.k8s.io/v1beta1 -kind: CustomResourceDefinition -metadata: - name: bgpconfigurations.crd.projectcalico.org -spec: - scope: Cluster - group: crd.projectcalico.org - versions: - - name: v1 - served: true - storage: true - names: - kind: BGPConfiguration - plural: bgpconfigurations - singular: bgpconfiguration - ---- -apiVersion: apiextensions.k8s.io/v1beta1 -kind: CustomResourceDefinition -metadata: - name: bgppeers.crd.projectcalico.org -spec: - scope: Cluster - group: crd.projectcalico.org - versions: - - name: v1 - served: true - storage: true - names: - kind: BGPPeer - plural: bgppeers - singular: bgppeer ---- - -apiVersion: apiextensions.k8s.io/v1beta1 -kind: CustomResourceDefinition -metadata: - name: ippools.crd.projectcalico.org -spec: - scope: Cluster - group: crd.projectcalico.org - versions: - - name: v1 - served: true - storage: true - names: - kind: IPPool - plural: ippools - singular: ippool - ---- - -apiVersion: apiextensions.k8s.io/v1beta1 -kind: CustomResourceDefinition -metadata: - name: hostendpoints.crd.projectcalico.org -spec: - scope: Cluster - group: crd.projectcalico.org - versions: - - name: v1 - served: true - storage: true - names: - kind: HostEndpoint - plural: hostendpoints - singular: hostendpoint - ---- - -apiVersion: apiextensions.k8s.io/v1beta1 -kind: CustomResourceDefinition -metadata: - name: clusterinformations.crd.projectcalico.org -spec: - scope: Cluster - group: crd.projectcalico.org - versions: - - name: v1 - served: true - storage: true - names: - kind: ClusterInformation - plural: clusterinformations - singular: clusterinformation - ---- - -apiVersion: apiextensions.k8s.io/v1beta1 -kind: CustomResourceDefinition -metadata: - name: globalnetworkpolicies.crd.projectcalico.org -spec: - scope: Cluster - group: crd.projectcalico.org - versions: - - name: v1 - served: true - storage: true - names: - kind: GlobalNetworkPolicy - plural: globalnetworkpolicies - singular: globalnetworkpolicy - ---- - -apiVersion: apiextensions.k8s.io/v1beta1 -kind: CustomResourceDefinition -metadata: - name: globalnetworksets.crd.projectcalico.org -spec: - scope: Cluster - group: crd.projectcalico.org - versions: - - name: v1 - served: true - storage: true - names: - kind: GlobalNetworkSet - plural: globalnetworksets - singular: globalnetworkset - ---- - -apiVersion: apiextensions.k8s.io/v1beta1 -kind: CustomResourceDefinition -metadata: - name: networkpolicies.crd.projectcalico.org -spec: - scope: Namespaced - group: crd.projectcalico.org - versions: - - name: v1 - served: true - storage: true - names: - kind: NetworkPolicy - plural: networkpolicies - singular: networkpolicy - ---- - -apiVersion: apiextensions.k8s.io/v1beta1 -kind: CustomResourceDefinition -metadata: - name: networksets.crd.projectcalico.org -spec: - scope: Namespaced - group: crd.projectcalico.org - versions: - - name: v1 - served: true - storage: true - names: - kind: NetworkSet - plural: networksets - singular: networkset \ No newline at end of file diff --git a/stable/aws-calico/crds/kustomization.yaml b/stable/aws-calico/crds/kustomization.yaml deleted file mode 100644 index f04014c..0000000 --- a/stable/aws-calico/crds/kustomization.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: -- crds.yaml \ No newline at end of file diff --git a/stable/aws-calico/templates/_helpers.tpl b/stable/aws-calico/templates/_helpers.tpl deleted file mode 100755 index 0a18027..0000000 --- a/stable/aws-calico/templates/_helpers.tpl +++ /dev/null @@ -1,55 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "aws-calico.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "aws-calico.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "aws-calico.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Common labels -*/}} -{{- define "aws-calico.labels" -}} -helm.sh/chart: {{ include "aws-calico.chart" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end -}} - -{{/* -Create the name of the service account to use -*/}} -{{- define "aws-calico.serviceAccountName" -}} -{{- if .Values.serviceAccount.create -}} - {{ default (include "aws-calico.fullname" .) .Values.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.serviceAccount.name }} -{{- end -}} -{{- end -}} \ No newline at end of file diff --git a/stable/aws-calico/templates/config-map.yaml b/stable/aws-calico/templates/config-map.yaml deleted file mode 100755 index 4bcafc5..0000000 --- a/stable/aws-calico/templates/config-map.yaml +++ /dev/null @@ -1,10 +0,0 @@ -kind: ConfigMap -apiVersion: v1 -metadata: - name: "{{ include "aws-calico.fullname" . }}-typha-horizontal-autoscaler" - labels: -{{ include "aws-calico.labels" . | indent 4 }} -{{- with .Values.autoscaler.configData }} -data: - {{- toYaml . | nindent 2 }} -{{- end }} diff --git a/stable/aws-calico/templates/daemon-set.yaml b/stable/aws-calico/templates/daemon-set.yaml deleted file mode 100755 index 96b076d..0000000 --- a/stable/aws-calico/templates/daemon-set.yaml +++ /dev/null @@ -1,158 +0,0 @@ -kind: DaemonSet -apiVersion: apps/v1 -metadata: - name: "{{ include "aws-calico.fullname" . }}-node" - labels: - app.kubernetes.io/name: "{{ include "aws-calico.fullname" . }}-node" -{{ include "aws-calico.labels" . | indent 4 }} -spec: - selector: - matchLabels: - app.kubernetes.io/name: "{{ include "aws-calico.fullname" . }}-node" - updateStrategy: - type: RollingUpdate - rollingUpdate: - maxUnavailable: 1 - template: - metadata: - labels: - app.kubernetes.io/name: "{{ include "aws-calico.fullname" . }}-node" - {{- with .Values.calico.node.podAnnotations }} - annotations: {{- toYaml . | nindent 8 }} - {{- end }} - spec: - priorityClassName: system-node-critical - affinity: - nodeAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - nodeSelectorTerms: - - matchExpressions: - - key: "eks.amazonaws.com/compute-type" - operator: NotIn - values: - - fargate - nodeSelector: - {{- toYaml .Values.calico.node.nodeSelector | nindent 8 }} - hostNetwork: true - serviceAccountName: "{{ include "aws-calico.serviceAccountName" . }}-node" - # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force - # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods. - terminationGracePeriodSeconds: 0 - containers: - # Runs calico/node container on each Kubernetes node. This - # container programs network policy and routes on each - # host. - - name: calico-node - image: "{{ .Values.calico.node.image }}:{{ .Values.calico.tag }}" - env: - # Use Kubernetes API as the backing datastore. - - name: DATASTORE_TYPE - value: "kubernetes" - # Use eni not cali for interface prefix - - name: FELIX_INTERFACEPREFIX - value: "eni" - # Enable felix info logging. - - name: FELIX_LOGSEVERITYSCREEN - value: "{{ .Values.calico.node.logseverity }}" - # Don't enable BGP. - - name: CALICO_NETWORKING_BACKEND - value: "none" - # Cluster type to identify the deployment type - - name: CLUSTER_TYPE - value: "k8s,ecs" - # Disable file logging so `kubectl logs` works. - - name: CALICO_DISABLE_FILE_LOGGING - value: "true" - - name: FELIX_TYPHAK8SSERVICENAME - value: "calico-typha" - # Set Felix endpoint to host default action to ACCEPT. - - name: FELIX_DEFAULTENDPOINTTOHOSTACTION - value: "ACCEPT" - # This will make Felix honor AWS VPC CNI's mangle table - # rules. - - name: FELIX_IPTABLESMANGLEALLOWACTION - value: Return - # Disable IPV6 on Kubernetes. - - name: FELIX_IPV6SUPPORT - value: "false" - # Wait for the datastore. - - name: WAIT_FOR_DATASTORE - value: "true" - - name: FELIX_LOGSEVERITYSYS - value: "none" - - name: FELIX_PROMETHEUSMETRICSENABLED - value: "true" - - name: FELIX_ROUTESOURCE - value: "WorkloadIPs" - - name: NO_DEFAULT_POOLS - value: "true" - # Set based on the k8s node name. - - name: NODENAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName - # No IP address needed. - - name: IP - value: "" - - name: FELIX_HEALTHENABLED - value: "true" - {{- if .Values.calico.node.extraEnv }} - {{- toYaml .Values.calico.node.extraEnv | nindent 12 }} - {{- end }} - securityContext: - privileged: true - livenessProbe: - exec: - command: - - /bin/calico-node - - -felix-live - periodSeconds: 10 - initialDelaySeconds: 10 - failureThreshold: 6 - timeoutSeconds: 5 - readinessProbe: - exec: - command: - - /bin/calico-node - - -felix-ready - periodSeconds: 10 - timeoutSeconds: 5 - resources: - {{- toYaml .Values.calico.node.resources | nindent 12 }} - volumeMounts: - - mountPath: /lib/modules - name: lib-modules - readOnly: true - - mountPath: /run/xtables.lock - name: xtables-lock - readOnly: false - - mountPath: /var/run/calico - name: var-run-calico - readOnly: false - - mountPath: /var/lib/calico - name: var-lib-calico - readOnly: false - volumes: - # Used to ensure proper kmods are installed. - - name: lib-modules - hostPath: - path: /lib/modules - - name: var-run-calico - hostPath: - path: /var/run/calico - - name: var-lib-calico - hostPath: - path: /var/lib/calico - - name: xtables-lock - hostPath: - path: /run/xtables.lock - type: FileOrCreate - tolerations: - # Make sure calico/node gets scheduled on all nodes. - - effect: NoSchedule - operator: Exists - # Mark the pod as a critical add-on for rescheduling. - - key: CriticalAddonsOnly - operator: Exists - - effect: NoExecute - operator: Exists diff --git a/stable/aws-calico/templates/deployment.yaml b/stable/aws-calico/templates/deployment.yaml deleted file mode 100755 index 3f990af..0000000 --- a/stable/aws-calico/templates/deployment.yaml +++ /dev/null @@ -1,134 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: "{{ include "aws-calico.fullname" . }}-typha" - labels: - app.kubernetes.io/name: "{{ include "aws-calico.fullname" . }}-typha" -{{ include "aws-calico.labels" . | indent 4 }} -spec: - revisionHistoryLimit: 2 - selector: - matchLabels: - app.kubernetes.io/name: "{{ include "aws-calico.fullname" . }}-typha" - template: - metadata: - labels: - app.kubernetes.io/name: "{{ include "aws-calico.fullname" . }}-typha" - annotations: - cluster-autoscaler.kubernetes.io/safe-to-evict: 'true' - {{- with .Values.calico.typha.podAnnotations }} - annotations: {{- toYaml . | nindent 10 }} - {{- end }} - spec: - priorityClassName: system-cluster-critical - nodeSelector: - {{- toYaml .Values.calico.typha.nodeSelector | nindent 8 }} - tolerations: - # Mark the pod as a critical add-on for rescheduling - - key: CriticalAddonsOnly - operator: Exists - {{- if .Values.calico.typha.tolerations }} - {{- toYaml .Values.calico.typha.tolerations | nindent 8 }} - {{- end }} - hostNetwork: true - serviceAccountName: "{{ include "aws-calico.serviceAccountName" . }}-node" - # fsGroup allows using projected serviceaccount tokens as described here kubernetes/kubernetes#82573 - securityContext: - fsGroup: 65534 - containers: - - image: "{{ .Values.calico.typha.image }}:{{ .Values.calico.tag }}" - name: calico-typha - ports: - - containerPort: 5473 - name: calico-typha - protocol: TCP - env: - # Use eni not cali for interface prefix - - name: FELIX_INTERFACEPREFIX - value: "eni" - - name: TYPHA_LOGFILEPATH - value: "none" - - name: TYPHA_LOGSEVERITYSYS - value: "none" - - name: TYPHA_LOGSEVERITYSCREEN - value: "{{ .Values.calico.typha.logseverity }}" - - name: TYPHA_PROMETHEUSMETRICSENABLED - value: "true" - - name: TYPHA_CONNECTIONREBALANCINGMODE - value: "kubernetes" - - name: TYPHA_PROMETHEUSMETRICSPORT - value: "9093" - - name: TYPHA_DATASTORETYPE - value: "kubernetes" - - name: TYPHA_MAXCONNECTIONSLOWERLIMIT - value: "1" - - name: TYPHA_HEALTHENABLED - value: "true" - # This will make Felix honor AWS VPC CNI's mangle table - # rules. - - name: FELIX_IPTABLESMANGLEALLOWACTION - value: Return - livenessProbe: - httpGet: - path: /liveness - port: 9098 - host: localhost - periodSeconds: 30 - initialDelaySeconds: 30 - securityContext: - runAsNonRoot: true - allowPrivilegeEscalation: false - readinessProbe: - httpGet: - path: /readiness - port: 9098 - host: localhost - periodSeconds: 10 - resources: - {{- toYaml .Values.calico.typha.resources | nindent 12 }} - ---- - -apiVersion: apps/v1 -kind: Deployment -metadata: - name: "{{ include "aws-calico.fullname" . }}-typha-horizontal-autoscaler" - labels: - app.kubernetes.io/name: "{{ include "aws-calico.fullname" . }}-typha-autoscaler" -{{ include "aws-calico.labels" . | indent 4 }} -spec: - selector: - matchLabels: - app.kubernetes.io/name: "{{ include "aws-calico.fullname" . }}-typha-autoscaler" - replicas: 1 - template: - metadata: - labels: - app.kubernetes.io/name: "{{ include "aws-calico.fullname" . }}-typha-autoscaler" - {{- with .Values.calico.typha_autoscaler.podAnnotations }} - annotations: {{- toYaml . | nindent 10 }} - {{- end }} - spec: - priorityClassName: system-cluster-critical - nodeSelector: - {{- toYaml .Values.calico.typha_autoscaler.nodeSelector | nindent 8 }} - tolerations: - # Mark the pod as a critical add-on for rescheduling. - - key: CriticalAddonsOnly - operator: Exists - {{- if .Values.calico.typha_autoscaler.tolerations }} - {{- toYaml .Values.calico.typha_autoscaler.tolerations | nindent 8 }} - {{- end }} - containers: - - image: "{{ .Values.autoscaler.image }}:{{ .Values.autoscaler.tag }}" - name: autoscaler - command: - - /cluster-proportional-autoscaler - - --namespace={{ .Release.Namespace }} - - --configmap={{ include "aws-calico.fullname" . }}-typha-horizontal-autoscaler - - --target=deployment/{{ include "aws-calico.fullname" . }}-typha - - --logtostderr=true - - --v=2 - resources: - {{- toYaml .Values.calico.typha_autoscaler.resources | nindent 12 }} - serviceAccountName: "{{ include "aws-calico.serviceAccountName" . }}-typha-cpha" diff --git a/stable/aws-calico/templates/pod-disruption-budget.yaml b/stable/aws-calico/templates/pod-disruption-budget.yaml deleted file mode 100644 index 701afa5..0000000 --- a/stable/aws-calico/templates/pod-disruption-budget.yaml +++ /dev/null @@ -1,20 +0,0 @@ -# This manifest creates a Pod Disruption Budget for Typha to allow K8s Cluster Autoscaler to evict -{{- if .Values.calico.typha.podDisruptionBudget.enabled }} -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: "{{ include "aws-calico.fullname" . }}-typha" - labels: - app.kubernetes.io/name: "{{ include "aws-calico.fullname" . }}-typha" -{{ include "aws-calico.labels" . | indent 4 }} -spec: -{{- if .Values.calico.typha.podDisruptionBudget.minAvailable }} - minAvailable: {{ .Values.calico.typha.podDisruptionBudget.minAvailable }} -{{- end }} -{{- if .Values.calico.typha.podDisruptionBudget.maxUnavailable }} - maxUnavailable: {{ .Values.calico.typha.podDisruptionBudget.maxUnavailable }} -{{- end }} - selector: - matchLabels: - app.kubernetes.io/name: "{{ include "aws-calico.fullname" . }}-typha" -{{- end }} diff --git a/stable/aws-calico/templates/podsecuritypolicy.yaml b/stable/aws-calico/templates/podsecuritypolicy.yaml deleted file mode 100644 index c946ee7..0000000 --- a/stable/aws-calico/templates/podsecuritypolicy.yaml +++ /dev/null @@ -1,211 +0,0 @@ -{{- if .Values.podSecurityPolicy.create -}} -apiVersion: policy/v1beta1 -kind: PodSecurityPolicy -metadata: - name: {{ include "aws-calico.fullname" . }}-node - labels: - app.kubernetes.io/name: {{ include "aws-calico.fullname" . }}-node -{{ include "aws-calico.labels" . | indent 4 }} -spec: - privileged: true - allowPrivilegeEscalation: true - requiredDropCapabilities: - - ALL - hostNetwork: true - hostIPC: false - hostPID: false - volumes: - - 'configMap' - - 'emptyDir' - - 'projected' - - 'secret' - - 'downwardAPI' - - 'persistentVolumeClaim' - - 'hostPath' - allowedHostPaths: - - pathPrefix: "/lib/modules" - readOnly: false - - pathPrefix: "/var/run/calico" - readOnly: false - - pathPrefix: "/var/lib/calico" - readOnly: false - - pathPrefix: "/run/xtables.lock" - readOnly: false - runAsUser: - rule: 'RunAsAny' - runAsGroup: - rule: 'RunAsAny' - seLinux: - rule: 'RunAsAny' - supplementalGroups: - rule: 'RunAsAny' - fsGroup: - rule: 'MustRunAs' - ranges: - - min: 1 - max: 65535 - readOnlyRootFilesystem: false ---- -apiVersion: policy/v1beta1 -kind: PodSecurityPolicy -metadata: - name: {{ include "aws-calico.fullname" . }}-typha - labels: - app.kubernetes.io/name: {{ include "aws-calico.fullname" . }}-typha -{{ include "aws-calico.labels" . | indent 4 }} -spec: - privileged: false - allowPrivilegeEscalation: false - requiredDropCapabilities: - - ALL - hostNetwork: true - hostPorts: - - max: 5473 - min: 5473 - hostIPC: false - hostPID: false - volumes: - - 'configMap' - - 'emptyDir' - - 'projected' - - 'secret' - - 'downwardAPI' - - 'persistentVolumeClaim' - runAsUser: - rule: 'RunAsAny' - seLinux: - rule: 'RunAsAny' - supplementalGroups: - rule: 'RunAsAny' - fsGroup: - rule: 'MustRunAs' - ranges: - - min: 1 - max: 65535 - readOnlyRootFilesystem: false ---- -apiVersion: policy/v1beta1 -kind: PodSecurityPolicy -metadata: - name: {{ include "aws-calico.fullname" . }}-typha-horizontal-autoscaler - labels: - app.kubernetes.io/name: {{ include "aws-calico.fullname" . }}-typha-autoscaler -{{ include "aws-calico.labels" . | indent 4 }} -spec: - privileged: false - allowPrivilegeEscalation: false - requiredDropCapabilities: - - ALL - hostNetwork: false - hostIPC: false - hostPID: false - volumes: - - 'configMap' - - 'emptyDir' - - 'projected' - - 'secret' - - 'downwardAPI' - - 'persistentVolumeClaim' - runAsUser: - rule: 'RunAsAny' - seLinux: - rule: 'RunAsAny' - supplementalGroups: - rule: 'RunAsAny' - fsGroup: - rule: 'MustRunAs' - ranges: - - min: 1 - max: 65535 - readOnlyRootFilesystem: false ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ include "aws-calico.fullname" . }}-node-psp - labels: - app.kubernetes.io/name: {{ include "aws-calico.fullname" . }}-node -{{ include "aws-calico.labels" . | indent 4 }} -rules: -- apiGroups: ['policy'] - resources: ['podsecuritypolicies'] - verbs: ['use'] - resourceNames: - - {{ include "aws-calico.fullname" . }}-node ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ include "aws-calico.fullname" . }}-typha-psp - labels: - app.kubernetes.io/name: {{ include "aws-calico.fullname" . }}-typha -{{ include "aws-calico.labels" . | indent 4 }} -rules: -- apiGroups: ['policy'] - resources: ['podsecuritypolicies'] - verbs: ['use'] - resourceNames: - - {{ include "aws-calico.fullname" . }}-typha ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ include "aws-calico.fullname" . }}-typha-horizontal-autoscaler-psp - labels: - app.kubernetes.io/name: {{ include "aws-calico.fullname" . }}-typha-autoscaler -{{ include "aws-calico.labels" . | indent 4 }} -rules: -- apiGroups: ['policy'] - resources: ['podsecuritypolicies'] - verbs: ['use'] - resourceNames: - - {{ include "aws-calico.fullname" . }}-typha-horizontal-autoscaler ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ include "aws-calico.fullname" . }}-node-psp - labels: - app.kubernetes.io/name: {{ include "aws-calico.fullname" . }}-node -{{ include "aws-calico.labels" . | indent 4 }} -roleRef: - kind: Role - name: {{ include "aws-calico.fullname" . }}-node-psp - apiGroup: rbac.authorization.k8s.io -subjects: -- kind: ServiceAccount - name: {{ include "aws-calico.serviceAccountName" . }}-node - namespace: {{ .Release.Namespace }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ include "aws-calico.fullname" . }}-typha-psp - labels: - app.kubernetes.io/name: {{ include "aws-calico.fullname" . }}-typha -{{ include "aws-calico.labels" . | indent 4 }} -roleRef: - kind: Role - name: {{ include "aws-calico.fullname" . }}-typha-psp - apiGroup: rbac.authorization.k8s.io -subjects: -- kind: ServiceAccount - name: {{ include "aws-calico.serviceAccountName" . }}-node - namespace: {{ .Release.Namespace }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ include "aws-calico.fullname" . }}-typha-horizontal-autoscaler-psp - labels: - app.kubernetes.io/name: {{ include "aws-calico.fullname" . }}-typha-autoscaler -{{ include "aws-calico.labels" . | indent 4 }} -roleRef: - kind: Role - name: {{ include "aws-calico.fullname" . }}-typha-horizontal-autoscaler-psp - apiGroup: rbac.authorization.k8s.io -subjects: -- kind: ServiceAccount - name: {{ include "aws-calico.serviceAccountName" . }}-typha-cpha - namespace: {{ .Release.Namespace }} -{{- end }} \ No newline at end of file diff --git a/stable/aws-calico/templates/rbac.yaml b/stable/aws-calico/templates/rbac.yaml deleted file mode 100755 index 7caa7fa..0000000 --- a/stable/aws-calico/templates/rbac.yaml +++ /dev/null @@ -1,214 +0,0 @@ -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: "{{ include "aws-calico.fullname" . }}-node" - labels: - app.kubernetes.io/name: "{{ include "aws-calico.fullname" . }}-node" -{{ include "aws-calico.labels" . | indent 4 }} -rules: - # The CNI plugin needs to get pods, nodes, namespaces, and configmaps. - - apiGroups: [""] - resources: - - pods - - nodes - - namespaces - - configmaps - verbs: - - get - - apiGroups: [""] - resources: - - endpoints - - services - verbs: - # Used to discover service IPs for advertisement. - - watch - - list - # Used to discover Typhas. - - get - - apiGroups: [""] - resources: - - nodes/status - verbs: - # Needed for clearing NodeNetworkUnavailable flag. - - patch - # Calico stores some configuration information in node annotations. - - update - # Watch for changes to Kubernetes NetworkPolicies. - - apiGroups: ["networking.k8s.io"] - resources: - - networkpolicies - verbs: - - watch - - list - # Used by Calico for policy information. - - apiGroups: [""] - resources: - - pods - - namespaces - - serviceaccounts - verbs: - - list - - watch - # The CNI plugin patches pods/status. - - apiGroups: [""] - resources: - - pods/status - verbs: - - patch - # Calico monitors various CRDs for config. - - apiGroups: ["crd.projectcalico.org"] - resources: - - globalfelixconfigs - - felixconfigurations - - bgppeers - - globalbgpconfigs - - bgpconfigurations - - ippools - - ipamblocks - - globalnetworkpolicies - - globalnetworksets - - networkpolicies - - networksets - - clusterinformations - - hostendpoints - - blockaffinities - verbs: - - get - - list - - watch - # Calico must create and update some CRDs on startup. - - apiGroups: ["crd.projectcalico.org"] - resources: - - ippools - - felixconfigurations - - clusterinformations - verbs: - - create - - update - # Calico stores some configuration information on the node. - - apiGroups: [""] - resources: - - nodes - verbs: - - get - - list - - watch - # These permissions are only requried for upgrade from v2.6, and can - # be removed after upgrade or on fresh installations. - - apiGroups: ["crd.projectcalico.org"] - resources: - - bgpconfigurations - - bgppeers - verbs: - - create - - update - # These permissions are required for Calico CNI to perform IPAM allocations. - - apiGroups: ["crd.projectcalico.org"] - resources: - - blockaffinities - - ipamblocks - - ipamhandles - verbs: - - get - - list - - create - - update - - delete - - apiGroups: ["crd.projectcalico.org"] - resources: - - ipamconfigs - verbs: - - get - # Block affinities must also be watchable by confd for route aggregation. - - apiGroups: ["crd.projectcalico.org"] - resources: - - blockaffinities - verbs: - - watch - # The Calico IPAM migration needs to get daemonsets. These permissions can be - # removed if not upgrading from an installation using host-local IPAM. - - apiGroups: ["apps"] - resources: - - daemonsets - verbs: - - get - ---- - -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: "{{ include "aws-calico.fullname" . }}-node" - labels: -{{ include "aws-calico.labels" . | indent 4 }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: "{{ include "aws-calico.fullname" . }}-node" -subjects: - - kind: ServiceAccount - name: "{{ include "aws-calico.serviceAccountName" . }}-node" - namespace: {{ .Release.Namespace }} - ---- - -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: "{{ include "aws-calico.fullname" . }}-typha-cpha" - labels: -{{ include "aws-calico.labels" . | indent 4 }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: "{{ include "aws-calico.fullname" . }}-typha-cpha" -subjects: - - kind: ServiceAccount - name: "{{ include "aws-calico.serviceAccountName" . }}-typha-cpha" - namespace: {{ .Release.Namespace }} - ---- - -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: "{{ include "aws-calico.fullname" . }}-typha-cpha" - labels: -{{ include "aws-calico.labels" . | indent 4 }} -rules: - - apiGroups: [""] - resources: ["nodes"] - verbs: ["watch", "list"] - ---- - -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: "{{ include "aws-calico.fullname" . }}-typha-cpha" - labels: -{{ include "aws-calico.labels" . | indent 4 }} -rules: - - apiGroups: [""] - resources: ["configmaps"] - verbs: ["get"] - - apiGroups: ["extensions", "apps"] - resources: ["deployments/scale"] - verbs: ["get", "update"] - ---- - -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: "{{ include "aws-calico.fullname" . }}-typha-cpha" - labels: -{{ include "aws-calico.labels" . | indent 4 }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "{{ include "aws-calico.fullname" . }}-typha-cpha" -subjects: - - kind: ServiceAccount - name: "{{ include "aws-calico.serviceAccountName" . }}-typha-cpha" - namespace: "{{ .Release.Namespace }}" diff --git a/stable/aws-calico/templates/service-accounts.yaml b/stable/aws-calico/templates/service-accounts.yaml deleted file mode 100755 index 2140939..0000000 --- a/stable/aws-calico/templates/service-accounts.yaml +++ /dev/null @@ -1,18 +0,0 @@ -# Create the ServiceAccount and roles necessary for Calico. -apiVersion: v1 -kind: ServiceAccount -metadata: - name: "{{ include "aws-calico.serviceAccountName" . }}-node" - labels: - app.kubernetes.io/name: "{{ include "aws-calico.fullname" . }}-node" -{{ include "aws-calico.labels" . | indent 4 }} - ---- - -apiVersion: v1 -kind: ServiceAccount -metadata: - name: "{{ include "aws-calico.serviceAccountName" . }}-typha-cpha" - labels: - app.kubernetes.io/name: "{{ include "aws-calico.fullname" . }}-typha-cpha" -{{ include "aws-calico.labels" . | indent 4 }} \ No newline at end of file diff --git a/stable/aws-calico/templates/service.yaml b/stable/aws-calico/templates/service.yaml deleted file mode 100755 index 4edb632..0000000 --- a/stable/aws-calico/templates/service.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: "{{ include "aws-calico.fullname" . }}-typha" - labels: - app.kubernetes.io/name: "{{ include "aws-calico.fullname" . }}-typha" -{{ include "aws-calico.labels" . | indent 4 }} -spec: - ports: - - port: 5473 - protocol: TCP - targetPort: calico-typha - name: "{{ include "aws-calico.fullname" . }}-typha" - selector: - app.kubernetes.io/name: "{{ include "aws-calico.fullname" . }}-typha" diff --git a/stable/aws-calico/values.yaml b/stable/aws-calico/values.yaml deleted file mode 100755 index 3ab726a..0000000 --- a/stable/aws-calico/values.yaml +++ /dev/null @@ -1,77 +0,0 @@ -fullnameOverride: calico - -serviceAccount: - create: true - -podSecurityPolicy: - create: false - -calico: - tag: v3.19.2 - - typha: - logseverity: Info # Debug, Info, Warning, Error, Fatal - image: calico/typha - # Controls a PodDisruptionBudget for the Typha pod. Suggested use if having one always running - podDisruptionBudget: - enabled: true - # minAvailable: 1 - maxUnavailable: 1 - resources: - requests: - memory: "64Mi" - cpu: "50m" - limits: - memory: "96Mi" - cpu: "100m" - tolerations: [] - nodeSelector: - beta.kubernetes.io/os: linux - podAnnotations: {} - node: - logseverity: Info # Debug, Info, Warning, Error, Fatal - image: calico/node - resources: - requests: - memory: "32Mi" - cpu: "20m" - limits: - memory: "64Mi" - cpu: "100m" - extraEnv: [] - # - name: SOME_VAR - # value: 'some value' - nodeSelector: - beta.kubernetes.io/os: linux - podAnnotations: {} - typha_autoscaler: - resources: - requests: - memory: "16Mi" - cpu: "10m" - limits: - memory: "32Mi" - cpu: "10m" - tolerations: [] - nodeSelector: - beta.kubernetes.io/os: linux - podAnnotations: {} - -autoscaler: - tag: "1.8.5" - image: k8s.gcr.io/cpa/cluster-proportional-autoscaler - configData: - ladder: |- - { - "coresToReplicas": [], - "nodesToReplicas": [ - [1, 1], - [10, 2], - [100, 3], - [250, 4], - [500, 5], - [1000, 6], - [1500, 7], - [2000, 8] - ] - } From 1157fec8b5581da6d0d30654e4b79e906e8afd38 Mon Sep 17 00:00:00 2001 From: Matt Date: Wed, 17 Jan 2024 19:10:05 +1100 Subject: [PATCH 2/2] Testing release 0.2.5 of ssm-secrets-webhook --- stable/ssm-secrets-webhook/Chart.yaml | 2 +- stable/ssm-secrets-webhook/values.yaml | 2 -- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/stable/ssm-secrets-webhook/Chart.yaml b/stable/ssm-secrets-webhook/Chart.yaml index 5a1eb67..56fe5f1 100644 --- a/stable/ssm-secrets-webhook/Chart.yaml +++ b/stable/ssm-secrets-webhook/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 appVersion: 1.3.2 -version: 0.2.4 +version: 0.2.5 description: A Helm chart that deploys a mutating admission webhook that configures applications to request env vars from AWS SSM name: ssm-secrets-webhook maintainers: diff --git a/stable/ssm-secrets-webhook/values.yaml b/stable/ssm-secrets-webhook/values.yaml index 50f5c74..db4b3f6 100644 --- a/stable/ssm-secrets-webhook/values.yaml +++ b/stable/ssm-secrets-webhook/values.yaml @@ -63,8 +63,6 @@ priorityClassName: "" rbac: enabled: true - psp: - enabled: false # A list of Kubernetes resource types to mutate as well: # Example: ["ingresses", "servicemonitors"]