diff --git a/awx-operator/.helmignore b/awx-operator/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/awx-operator/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/awx-operator/Chart.yaml b/awx-operator/Chart.yaml new file mode 100644 index 0000000..e7a588e --- /dev/null +++ b/awx-operator/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +appVersion: 2.16.1 +description: A Helm chart for the AWX Operator +name: awx-operator +type: application +version: 2.16.1 diff --git a/awx-operator/README.md b/awx-operator/README.md new file mode 100644 index 0000000..8fca8b4 --- /dev/null +++ b/awx-operator/README.md @@ -0,0 +1,366 @@ +# AWX Operator Helm Chart + +This chart installs the AWX Operator resources configured in [this](https://github.com/ansible/awx-operator) repository. + +## Getting Started +To configure your AWX resource using this chart, create your own `yaml` values file. The name is up to personal preference since it will explicitly be passed into the helm chart. Helm will merge whatever values you specify in your file with the default `values.yaml`, overriding any settings you've changed while allowing you to fall back on defaults. Because of this functionality, `values.yaml` should not be edited directly. + +In your values config, enable `AWX.enabled` and add `AWX.spec` values based on the awx operator's [documentation](https://github.com/ansible/awx-operator/blob/devel/README.md). Consult the docs below for additional functionality. + +### Installing + +The operator's [helm install](https://ansible.readthedocs.io/projects/awx-operator/en/latest/installation/helm-install-on-existing-cluster.html) guide provides key installation instructions. + +Example: + +```bash +helm install my-awx-operator awx-operator/awx-operator -n awx --create-namespace -f myvalues.yaml +``` + +Argument breakdown: +* `-f` passes in the file with your custom values +* `-n` sets the namespace to be installed in + * This value is accessed by `{{ $.Release.Namespace }}` in the templates + * Acts as the default namespace for all unspecified resources +* `--create-namespace` specifies that helm should create the namespace before installing + +To update an existing installation, use `helm upgrade` instead of `install`. The rest of the syntax remains the same. + +### Caveats on upgrading existing installation + +There is no support at this time for upgrading or deleting CRDs using Helm. See [helm documentation](https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#some-caveats-and-explanations) for additional detail. + +When upgrading to releases with CRD changes use the following command to update the CRDs + +```bash +kubectl apply --server-side -k github.com/ansible/awx-operator/config/crd?ref= +``` + +If running above command results in an error like below: + +```text +Apply failed with 1 conflict: conflict with "helm" using apiextensions.k8s.io/v1: .spec.versions +Please review the fields above--they currently have other managers. Here +are the ways you can resolve this warning: +* If you intend to manage all of these fields, please re-run the apply + command with the `--force-conflicts` flag. +* If you do not intend to manage all of the fields, please edit your + manifest to remove references to the fields that should keep their + current managers. +* You may co-own fields by updating your manifest to match the existing + value; in this case, you'll become the manager if the other manager(s) + stop managing the field (remove it from their configuration). +See https://kubernetes.io/docs/reference/using-api/server-side-apply/#conflicts +``` + +Use `--force-conflicts` flag to resolve the conflict. + +```bash +kubectl apply --server-side --force-conflicts -k github.com/ansible/awx-operator/config/crd?ref= +``` + +## Configuration +The goal of adding helm configurations is to abstract out and simplify the creation of multi-resource configs. The `AWX.spec` field maps directly to the spec configs of the `AWX` resource that the operator provides, which are detailed in the [main README](https://github.com/ansible/awx-operator/blob/devel/README.md). Other sub-config can be added with the goal of simplifying more involved setups that require additional resources to be specified. + +These sub-headers aim to be a more intuitive entrypoint into customizing your deployment, and are easier to manage in the long-term. By design, the helm templates will defer to the manually defined specs to avoid configuration conflicts. For example, if `AWX.spec.postgres_configuration_secret` is being used, the `AWX.postgres` settings will not be applied, even if enabled. + +### External Postgres +The `AWX.postgres` section simplifies the creation of the external postgres secret. If enabled, the configs provided will automatically be placed in a `postgres-config` secret and linked to the `AWX` resource. For proper secret management, the `AWX.postgres.password` value, and any other sensitive values, can be passed in at the command line rather than specified in code. Use the `--set` argument with `helm install`. Supplying the password this way is not recommended for production use, but may be helpful for initial PoC. + +### Additional Kubernetes Resources +The `AWX.extraDeploy` section allows the creation of additional Kubernetes resources. This simplifies setups requiring additional objects that are used by AWX, e.g. using `ExternalSecrets` to create Kubernetes secrets. + +Resources are passed as an array, either as YAML or strings (literal "|"). The resources are passed through `tpl`, so templating is possible. Example: + +```yaml +AWX: + # enable use of awx-deploy template + ... + + # configurations for external postgres instance + postgres: + enabled: false + ... + +extraDeploy: + - | + apiVersion: external-secrets.io/v1beta1 + kind: ExternalSecret + metadata: + name: {{ .Release.Name }}-postgres-secret-string-example + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Release.Name }} + spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + refreshInterval: "1h" + target: + name: postgres-configuration-secret-string-example + creationPolicy: "Owner" + deletionPolicy: "Delete" + dataFrom: + - extract: + key: awx/postgres-configuration-secret + + - apiVersion: external-secrets.io/v1beta1 + kind: ExternalSecret + metadata: + name: "{{ .Release.Name }}-postgres-secret-yaml-example" + namespace: "{{ .Release.Namespace }}" + labels: + app: "{{ .Release.Name }}" + spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + refreshInterval: "1h" + target: + name: postgres-configuration-secret-yaml-example + creationPolicy: "Owner" + deletionPolicy: "Delete" + dataFrom: + - extract: + key: awx/postgres-configuration-secret +``` + +### Custom secrets +The `customSecrets` section simplifies the creation of our custom secrets used during AWX deployment. Supplying the passwords this way is not recommended for production use, but may be helpful for initial PoC. + +If enabled, the configs provided will automatically used to create the respective secrets and linked at the CR spec level. For proper secret management, the sensitive values can be passed in at the command line rather than specified in code. Use the `--set` argument with `helm install`. + +Example: + +```yaml +AWX: + # enable use of awx-deploy template + ... + + # configurations for external postgres instance + postgres: + enabled: false + ... + + customSecrets: + enabled: true + admin: + enabled: true + password: mysuperlongpassword + secretName: my-admin-password + secretKey: + enabled: true + key: supersecuresecretkey + secretName: my-awx-secret-key + ingressTls: + enabled: true + selfSignedCert: true + key: unset + certificate: unset + routeTls: + enabled: false + key: + certificate: + ldapCacert: + enabled: false + crt: + ldap: + enabled: true + password: yourldapdnpassword + bundleCacert: + enabled: false + crt: + eePullCredentials: + enabled: false + url: unset + username: unset + password: unset + sslVerify: true + secretName: my-ee-pull-credentials + cpPullCredentials: + enabled: false + dockerconfig: + - registry: https://index.docker.io/v1/ + username: unset + password: unset + secretName: my-cp-pull-credentials +``` + +### Custom volumes +The `customVolumes` section simplifies the creation of Persistent Volumes used when you want to store your databases and projects files on the cluster's Node. Since their backends are `hostPath`, the size specified are just like a label and there is no actual capacity limitation. + +You have to prepare directories for these volumes. For example: + +```bash +sudo mkdir -p /data/postgres-13 +sudo mkdir -p /data/projects +sudo chmod 755 /data/postgres-13 +sudo chown 1000:0 /data/projects +``` + +Example: + +```yaml +AWX: + # enable use of awx-deploy template + ... + + # configurations for external postgres instance + postgres: + enabled: false + ... + + customVolumes: + postgres: + enabled: true + hostPath: /data/postgres-13 + projects: + enabled: true + hostPath: /data/projects + size: 1Gi +``` + +## Values Summary + +### AWX +| Value | Description | Default | +|---|---|---| +| `AWX.enabled` | Enable this AWX resource configuration | `false` | +| `AWX.name` | The name of the AWX resource and default prefix for other resources | `"awx"` | +| `AWX.spec` | specs to directly configure the AWX resource | `{}` | +| `AWX.postgres` | configurations for the external postgres secret | - | + +### extraDeploy +| Value | Description | Default | +|---|---|---| +| `extraDeploy` | array of additional resources to be deployed (supports YAML or literal "\|") | - | + +### customSecrets +| Value | Description | Default | +|---|---|---| +| `customSecrets.enabled` | Enable the secret resources configuration | `false` | +| `customSecrets.admin` | Configurations for the secret that contains the admin user password | - | +| `customSecrets.secretKey` | Configurations for the secret that contains the symmetric key for encryption | - | +| `customSecrets.ingressTls` | Configurations for the secret that contains the TLS information when `ingress_type=ingress` | - | +| `customSecrets.routeTls` | Configurations for the secret that contains the TLS information when `ingress_type=route` (`route_tls_secret`) | - | +| `customSecrets.ldapCacert` | Configurations for the secret that contains the LDAP Certificate Authority | - | +| `customSecrets.ldap` | Configurations for the secret that contains the LDAP BIND DN password | - | +| `customSecrets.bundleCacert` | Configurations for the secret that contains the Certificate Authority | - | +| `customSecrets.eePullCredentials` | Configurations for the secret that contains the pull credentials for registered ees can be found | - | +| `customSecrets.cpPullCredentials` | Configurations for the secret that contains the image pull credentials for app and database containers | - | + + +Below the addition variables to customize the secret configuration. + +#### Admin user password secret configuration +| Value | Description | Default | +|---|---|---| +| `customSecrets.admin.enabled` | If `true`, secret will be created | `false` | +| `customSecrets.admin.password` | Admin user password | - | +| `customSecrets.admin.secretName` | Name of secret for `admin_password_secret` | `-admin-password>` | + +#### Secret Key secret configuration +| Value | Description | Default | +|---|---|---| +| `customSecrets.secretKey.enabled` | If `true`, secret will be created | `false` | +| `customSecrets.secretKey.key` | Key is used to encrypt sensitive data in the database | - | +| `customSecrets.secretKey.secretName` | Name of secret for `secret_key_secret` | `-secret-key` | + +#### Ingress TLS secret configuration +| Value | Description | Default | +|---|---|---| +| `customSecrets.ingressTls.enabled` | If `true`, secret will be created | `false` | +| `customSecrets.ingressTls.selfSignedCert` | If `true`, an self-signed TLS certificate for `AWX.spec.hostname` will be create by helm | `false` | +| `customSecrets.ingressTls.key` | Private key to use for TLS/SSL | - | +| `customSecrets.ingressTls.certificate` | Certificate to use for TLS/SSL | - | +| `customSecrets.ingressTls.secretName` | Name of secret for `ingress_tls_secret` | `-ingress-tls` | +| `customSecrets.ingressTls.labels` | Array of labels for the secret | - | + +#### Route TLS secret configuration +| Value | Description | Default | +|---|---|---| +| `customSecrets.routeTls.enabled` | If `true`, secret will be created | `false` | +| `customSecrets.routeTls.key` | Private key to use for TLS/SSL | - | +| `customSecrets.routeTls.certificate` | Certificate to use for TLS/SSL | - | +| `customSecrets.routeTls.secretName` | Name of secret for `route_tls_secret` | `-route-tls` | + +#### LDAP Certificate Authority secret configuration +| Value | Description | Default | +|---|---|---| +| `customSecrets.ldapCacert.enabled` | If `true`, secret will be created | `false` | +| `customSecrets.ldapCacert.crt` | Bundle of CA Root Certificates | - | +| `customSecrets.ldapCacert.secretName` | Name of secret for `ldap_cacert_secret` | `-custom-certs` | + +#### LDAP BIND DN Password secret configuration +| Value | Description | Default | +|---|---|---| +| `customSecrets.ldap.enabled` | If `true`, secret will be created | `false` | +| `customSecrets.ldap.password` | LDAP BIND DN password | - | +| `customSecrets.ldap.secretName` | Name of secret for `ldap_password_secret` | `-ldap-password` | + +#### Certificate Authority secret configuration +| Value | Description | Default | +|---|---|---| +| `customSecrets.bundleCacert.enabled` | If `true`, secret will be created | `false` | +| `customSecrets.bundleCacert.crt` | Bundle of CA Root Certificates | - | +| `customSecrets.bundleCacert.secretName` | Name of secret for `bundle_cacert_secret` | `-custom-certs` | + +#### Default EE pull secrets configuration +| Value | Description | Default | +|---|---|---| +| `customSecrets.eePullCredentials.enabled` | If `true`, secret will be created | `false` | +| `customSecrets.eePullCredentials.url` | Registry url | - | +| `customSecrets.eePullCredentials.username` | Username to connect as | - | +| `customSecrets.eePullCredentials.password` | Password to connect with | - | +| `customSecrets.eePullCredentials.sslVerify` | Whether verify ssl connection or not. | `true` | +| `customSecrets.eePullCredentials.secretName` | Name of secret for `ee_pull_credentials_secret` | `-ee-pull-credentials` | + +#### Control Plane pull secrets configuration +| Value | Description | Default | +|---|---|---| +| `customSecrets.cpPullCredentials.enabled` | If `true`, secret will be created | `false` | +| `customSecrets.cpPullCredentials.dockerconfig` | Array of configurations for the Docker credentials that are used for accessing a registry | - | +| `customSecrets.cpPullCredentials.dockerconfig[].registry` | Server location for Docker registry | `https://index.docker.io/v1/` | +| `customSecrets.cpPullCredentials.dockerconfig[].username` | Username to connect as | - | +| `customSecrets.cpPullCredentials.dockerconfig[].password` | Password to connect with | - | +| `customSecrets.cpPullCredentials.secretName` | Name of secret for `image_pull_secrets`| `-cp-pull-credentials` | + +### customVolumes + +#### Persistent Volume for databases postgres +| Value | Description | Default | +|---|---|---| +| `customVolumes.postgres.enabled` | Enable the PV resource configuration for the postgres databases | `false` | +| `customVolumes.postgres.hostPath` | Directory location on host | - | +| `customVolumes.postgres.size` | Size of the volume | `8Gi` | +| `customVolumes.postgres.accessModes` | Volume access mode | `ReadWriteOnce` | +| `customVolumes.postgres.storageClassName` | PersistentVolume storage class name for `postgres_storage_class` | `-postgres-volume` | + +#### Persistent Volume for projects files +| Value | Description | Default | +|---|---|---| +| `customVolumes.projects.enabled` | Enable the PVC and PVC resources configuration for the projects files | `false` | +| `customVolumes.projects.hostPath` | Directory location on host | - | +| `customVolumes.projects.size` | Size of the volume | `8Gi` | +| `customVolumes.projects.accessModes` | Volume access mode | `ReadWriteOnce` | +| `customVolumes.postgres.storageClassName` | PersistentVolume storage class name | `-projects-volume` | + +# Contributing + +## Adding abstracted sections +Where possible, defer to `AWX.spec` configs before applying the abstracted configs to avoid collision. This can be facilitated by the `(hasKey .spec what_i_will_abstract)` check. + +## Building and Testing +This chart is built using the Makefile in the [awx-operator repo](https://github.com/ansible/awx-operator). Clone the repo and run `make helm-chart`. This will create the awx-operator chart in the `charts/awx-operator` directory. In this process, the contents of the `.helm/starter` directory will be added to the chart. + +## Future Goals +All values under the `AWX` header are focused on configurations that use the operator. Configurations that relate to the Operator itself could be placed under an `Operator` heading, but that may add a layer of complication over current development. + + +# Chart Publishing + +The chart is currently hosted on the gh-pages branch of the repo. During the release pipeline, the `index.yaml` stored in that branch is generated with helm chart entries from all valid tags. We are currently unable to use the `chart-releaser` pipeline due to the fact that the complete helm chart is not committed to the repo and is instead built during the release process. Therefore, the cr action is unable to compare against previous versions. + +Instead of CR, we use `helm repo index` to generate an index from all locally pulled chart versions. Since we build from scratch every time, the timestamps of all entries will be updated. This could be improved by using yq or something similar to detect which tags are already in the index.yaml file, and only merge in tags that are not present. + +Not using CR could be addressed in the future by keeping the chart built as a part of releases, as long as CR compares the chart to previous release packages rather than previous commits. If the latter is the case, then we would not have the necessary history for comparison. diff --git a/awx-operator/crds/customresourcedefinition-awxbackups.awx.ansible.com.yaml b/awx-operator/crds/customresourcedefinition-awxbackups.awx.ansible.com.yaml new file mode 100644 index 0000000..a77097f --- /dev/null +++ b/awx-operator/crds/customresourcedefinition-awxbackups.awx.ansible.com.yaml @@ -0,0 +1,142 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + helm.sh/chart: awx-operator + name: awxbackups.awx.ansible.com +spec: + group: awx.ansible.com + names: + kind: AWXBackup + listKind: AWXBackupList + plural: awxbackups + singular: awxbackup + scope: Namespaced + versions: + - name: v1beta1 + schema: + openAPIV3Schema: + description: Schema validation for the AWXBackup CRD + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + additional_labels: + description: Additional labels defined on the resource, which should be propagated to child resources + items: + type: string + type: array + backup_pvc: + description: Name of the backup PVC + type: string + backup_pvc_namespace: + description: (Deprecated) Namespace the PVC is in + type: string + backup_resource_requirements: + description: Resource requirements for the management pod used to create a backup + properties: + limits: + properties: + cpu: + type: string + memory: + type: string + type: object + requests: + properties: + cpu: + type: string + memory: + type: string + type: object + type: object + backup_storage_class: + description: Storage class to use when creating PVC for backup + type: string + backup_storage_requirements: + description: Storage requirements for backup PVC (may be similar to existing postgres PVC backing up from) + type: string + clean_backup_on_delete: + description: Flag to indicate if backup should be deleted on PVC if AWXBackup object is deleted + type: boolean + db_management_pod_node_selector: + description: nodeSelector for the Postgres pods to backup + type: string + deployment_name: + description: Name of the deployment to be backed up + type: string + image_pull_policy: + default: IfNotPresent + description: The image pull policy + enum: + - Always + - always + - Never + - never + - IfNotPresent + - ifnotpresent + type: string + no_log: + default: true + description: Configure no_log for no_log tasks + type: boolean + pg_dump_suffix: + description: Additional parameters for the pg_dump command + type: string + postgres_image: + description: Registry path to the PostgreSQL container to use + type: string + postgres_image_version: + description: PostgreSQL container image version to use + type: string + postgres_label_selector: + description: Label selector used to identify postgres pod for backing up data + type: string + precreate_partition_hours: + description: Number of hours worth of events table partitions to precreate before backup to avoid pg_dump locks. + format: int32 + type: integer + set_self_labels: + default: true + description: Maintain some of the recommended `app.kubernetes.io/*` labels on the resource (self) + type: boolean + required: + - deployment_name + type: object + x-kubernetes-preserve-unknown-fields: true + status: + properties: + backupClaim: + description: Backup persistent volume claim + type: string + backupDirectory: + description: Backup directory name on the specified pvc + type: string + conditions: + description: The resulting conditions when a Service Telemetry is instantiated + items: + properties: + lastTransitionTime: + type: string + reason: + type: string + status: + type: string + type: + type: string + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} diff --git a/awx-operator/crds/customresourcedefinition-awxmeshingresses.awx.ansible.com.yaml b/awx-operator/crds/customresourcedefinition-awxmeshingresses.awx.ansible.com.yaml new file mode 100644 index 0000000..e1d554d --- /dev/null +++ b/awx-operator/crds/customresourcedefinition-awxmeshingresses.awx.ansible.com.yaml @@ -0,0 +1,81 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + helm.sh/chart: awx-operator + name: awxmeshingresses.awx.ansible.com +spec: + group: awx.ansible.com + names: + kind: AWXMeshIngress + listKind: AWXMeshIngressList + plural: awxmeshingresses + singular: awxmeshingress + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: AWXMeshIngress is the Schema for the awxmeshingresses API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Spec defines the desired state of AWXMeshIngress + properties: + deployment_name: + description: Name of the AWX deployment to create the Mesh Ingress for. + type: string + external_hostname: + description: External hostname to use for the Mesh Ingress. + type: string + external_ipaddress: + description: External IP address to use for the Mesh Ingress. + type: string + image_pull_secrets: + description: Image pull secrets for Mesh Ingress containers. + items: + type: string + type: array + ingress_annotations: + description: Annotations to add to the Ingress Controller + type: string + ingress_api_version: + description: The Ingress API version to use + type: string + ingress_class_name: + description: The name of ingress class to use instead of the cluster default. + type: string + ingress_controller: + description: Special configuration for specific Ingress Controllers + type: string + ingress_type: + description: The ingress type to use to reach the deployed instance + enum: + - none + - Ingress + - ingress + - IngressRouteTCP + - ingressroutetcp + - Route + - route + type: string + required: + - deployment_name + type: object + x-kubernetes-preserve-unknown-fields: true + status: + description: Status defines the observed state of AWXMeshIngress + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} diff --git a/awx-operator/crds/customresourcedefinition-awxrestores.awx.ansible.com.yaml b/awx-operator/crds/customresourcedefinition-awxrestores.awx.ansible.com.yaml new file mode 100644 index 0000000..5131fda --- /dev/null +++ b/awx-operator/crds/customresourcedefinition-awxrestores.awx.ansible.com.yaml @@ -0,0 +1,142 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + helm.sh/chart: awx-operator + name: awxrestores.awx.ansible.com +spec: + group: awx.ansible.com + names: + kind: AWXRestore + listKind: AWXRestoreList + plural: awxrestores + singular: awxrestore + scope: Namespaced + versions: + - name: v1beta1 + schema: + openAPIV3Schema: + description: Schema validation for the AWXRestore CRD + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + additional_labels: + description: Additional labels defined on the resource, which should be propagated to child resources + items: + type: string + type: array + backup_dir: + description: Backup directory name, set as a status found on the awxbackup object (backupDirectory) + type: string + backup_name: + description: AWXBackup object name + type: string + backup_pvc: + description: Name of the PVC to be restored from, set as a status found on the awxbackup object (backupClaim) + type: string + backup_pvc_namespace: + description: (Deprecated) Namespace the PVC is in + type: string + backup_source: + description: Backup source + enum: + - Backup CR + - PVC + type: string + cluster_name: + description: Cluster name + type: string + db_management_pod_node_selector: + description: nodeSelector for the Postgres pods to backup + type: string + deployment_name: + description: Name of the restored deployment. This should be different from the original deployment name if the original deployment still exists. + type: string + force_drop_db: + default: false + description: Force drop the database before restoring. USE WITH CAUTION! + type: boolean + image_pull_policy: + default: IfNotPresent + description: The image pull policy + enum: + - Always + - always + - Never + - never + - IfNotPresent + - ifnotpresent + type: string + no_log: + default: true + description: Configure no_log for no_log tasks + type: boolean + postgres_image: + description: Registry path to the PostgreSQL container to use + type: string + postgres_image_version: + description: PostgreSQL container image version to use + type: string + postgres_label_selector: + description: Label selector used to identify postgres pod for backing up data + type: string + restore_resource_requirements: + description: Resource requirements for the management pod that restores AWX from a backup + properties: + limits: + properties: + cpu: + type: string + memory: + type: string + type: object + requests: + properties: + cpu: + type: string + memory: + type: string + type: object + type: object + set_self_labels: + default: true + description: Maintain some of the recommended `app.kubernetes.io/*` labels on the resource (self) + type: boolean + required: + - deployment_name + type: object + x-kubernetes-preserve-unknown-fields: true + status: + properties: + conditions: + description: The resulting conditions when a Service Telemetry is instantiated + items: + properties: + lastTransitionTime: + type: string + reason: + type: string + status: + type: string + type: + type: string + type: object + type: array + restoreComplete: + description: Restore process complete + type: boolean + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} diff --git a/awx-operator/crds/customresourcedefinition-awxs.awx.ansible.com.yaml b/awx-operator/crds/customresourcedefinition-awxs.awx.ansible.com.yaml new file mode 100644 index 0000000..23f1e58 --- /dev/null +++ b/awx-operator/crds/customresourcedefinition-awxs.awx.ansible.com.yaml @@ -0,0 +1,2016 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + helm.sh/chart: awx-operator + name: awxs.awx.ansible.com +spec: + group: awx.ansible.com + names: + kind: AWX + listKind: AWXList + plural: awxs + singular: awx + scope: Namespaced + versions: + - name: v1beta1 + schema: + openAPIV3Schema: + description: Schema validation for the AWX CRD + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + additional_labels: + description: Additional labels defined on the resource, which should be propagated to child resources + items: + type: string + type: array + admin_email: + description: The admin user email + type: string + admin_password_secret: + description: Secret where the admin password can be found + maxLength: 255 + pattern: ^[a-zA-Z0-9][-a-zA-Z0-9]{0,253}[a-zA-Z0-9]$ + type: string + admin_user: + default: admin + description: Username to use for the admin account + type: string + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + annotations: + description: Common annotations for both Web and Task deployments. + type: string + api_version: + description: apiVersion of the deployment type + type: string + auto_upgrade: + default: true + description: Should AWX instances be automatically upgraded when operator gets upgraded + type: boolean + broadcast_websocket_secret: + description: Secret where the broadcast websocket secret can be found + maxLength: 255 + pattern: ^[a-zA-Z0-9][-a-zA-Z0-9]{0,253}[a-zA-Z0-9]$ + type: string + bundle_cacert_secret: + description: Secret where can be found the trusted Certificate Authority Bundle + type: string + ca_trust_bundle: + description: Path where the trusted CA bundle is available + type: string + control_plane_ee_image: + description: Registry path to the Execution Environment container image to use on control plane pods + type: string + control_plane_priority_class: + description: Assign a preexisting priority class to the control plane pods + type: string + create_preload_data: + default: true + description: Whether or not to preload data upon instance creation + type: boolean + csrf_cookie_secure: + description: Set csrf cookie secure mode for web + type: string + deployment_type: + description: Name of the deployment type + type: string + development_mode: + description: If the deployment should be done in development mode + type: boolean + ee_extra_env: + type: string + ee_extra_volume_mounts: + description: Specify volume mounts to be added to Execution container + type: string + ee_images: + description: Registry path to the Execution Environment container to use + items: + properties: + image: + type: string + name: + type: string + type: object + type: array + ee_pull_credentials_secret: + description: Secret where pull credentials for registered ees can be found + type: string + ee_resource_requirements: + description: Resource requirements for the ee container + properties: + limits: + properties: + cpu: + type: string + ephemeral-storage: + type: string + memory: + type: string + storage: + type: string + type: object + requests: + properties: + cpu: + type: string + ephemeral-storage: + type: string + memory: + type: string + storage: + type: string + type: object + type: object + extra_settings: + description: Extra settings to specify for AWX + items: + properties: + setting: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + type: object + type: array + extra_volumes: + description: Specify extra volumes to add to the application pod + type: string + garbage_collect_secrets: + default: false + description: Whether or not to remove secrets upon instance removal + type: boolean + host_aliases: + description: HostAliases for app containers + items: + properties: + hostnames: + items: + type: string + type: array + ip: + type: string + type: object + type: array + hostname: + description: (Deprecated) The hostname of the instance + type: string + image: + description: Registry path to the application container to use + type: string + image_pull_policy: + default: IfNotPresent + description: The image pull policy + enum: + - Always + - always + - Never + - never + - IfNotPresent + - ifnotpresent + type: string + image_pull_secret: + description: (Deprecated) Image pull secret for app and database containers + type: string + image_pull_secrets: + description: Image pull secrets for app and database containers + items: + type: string + type: array + image_version: + description: Application container image version to use + type: string + ingress_annotations: + description: Annotations to add to the Ingress Controller + type: string + ingress_api_version: + description: The Ingress API version to use + type: string + ingress_class_name: + description: The name of ingress class to use instead of the cluster default. + type: string + ingress_controller: + description: Special configuration for specific Ingress Controllers + type: string + ingress_hosts: + description: Ingress hostnames of the instance + items: + properties: + hostname: + description: Hostname of the instance + type: string + tls_secret: + description: Secret where the Ingress TLS secret can be found + type: string + type: object + type: array + ingress_path: + description: The ingress path used to reach the deployed service + type: string + ingress_path_type: + description: The ingress path type for the deployed service + type: string + ingress_tls_secret: + description: (Deprecated) Secret where the Ingress TLS secret can be found + type: string + ingress_type: + description: The ingress type to use to reach the deployed instance + enum: + - none + - Ingress + - ingress + - Route + - route + type: string + init_container_extra_commands: + description: Extra commands for the init container + type: string + init_container_extra_volume_mounts: + description: Specify volume mounts to be added to the init container + type: string + init_container_image: + description: Registry path to the init container to use + type: string + init_container_image_version: + description: Init container image version to use + type: string + init_container_resource_requirements: + description: Resource requirements for the init container + properties: + limits: + properties: + cpu: + type: string + ephemeral-storage: + type: string + memory: + type: string + storage: + type: string + type: object + requests: + properties: + cpu: + type: string + ephemeral-storage: + type: string + memory: + type: string + storage: + type: string + type: object + type: object + init_projects_container_image: + description: Registry path to the init projects container to use + type: string + ipv6_disabled: + default: false + description: Disable web container's nginx ipv6 listener + type: boolean + kind: + description: Kind of the deployment type + type: string + ldap_cacert_secret: + description: Secret where can be found the LDAP trusted Certificate Authority Bundle + type: string + ldap_password_secret: + description: Secret where can be found the LDAP bind password + type: string + loadbalancer_class: + default: "" + description: Class of LoadBalancer to use + type: string + loadbalancer_ip: + default: "" + description: Assign LoadBalancer IP address + type: string + loadbalancer_port: + default: 80 + description: Port to use for the loadbalancer + type: integer + loadbalancer_protocol: + default: http + description: Protocol to use for the loadbalancer + enum: + - http + - https + type: string + metrics_utility_configmap: + description: Metrics-Utility ConfigMap + type: string + metrics_utility_console_enabled: + default: false + description: Enable metrics utility shipping to Red Hat Hybrid Cloud Console + type: boolean + metrics_utility_cronjob_gather_schedule: + default: '@hourly' + description: Metrics-Utility Gather Data CronJob Schedule + type: string + metrics_utility_cronjob_report_schedule: + default: '@monthly' + description: Metrics-Utility Report CronJob Schedule + type: string + metrics_utility_enabled: + default: false + description: Enable metrics utility + type: boolean + metrics_utility_image: + description: Metrics-Utility Image + type: string + metrics_utility_image_pull_policy: + description: Metrics-Utility Image PullPolicy + type: string + metrics_utility_image_version: + description: Metrics-Utility Image Version + type: string + metrics_utility_pvc_claim: + description: Metrics-Utility PVC Claim + type: string + metrics_utility_pvc_claim_size: + default: 5Gi + description: Metrics-Utility PVC Claim Size + type: string + metrics_utility_pvc_claim_storage_class: + description: Metrics-Utility PVC Claim Storage Class + type: string + metrics_utility_secret: + description: Metrics-Utility Secret + type: string + metrics_utility_ship_target: + description: Metrics-Utility Ship Target + type: string + nginx_listen_queue_size: + description: Set the socket listen queue size for nginx (defaults to same as uwsgi) + type: integer + nginx_worker_connections: + description: Set the number of connections per worker for nginx + type: integer + nginx_worker_cpu_affinity: + description: Set the CPU affinity for nginx workers + type: string + nginx_worker_processes: + description: Set the number of workers for nginx + type: integer + no_log: + default: true + description: Configure no_log for no_log tasks + type: boolean + node_selector: + description: nodeSelector for the pods + type: string + nodeport_port: + description: Port to use for the nodeport + type: integer + old_postgres_configuration_secret: + description: Secret where the old database configuration can be found for data migration + maxLength: 255 + pattern: ^[a-zA-Z0-9][-a-zA-Z0-9]{0,253}[a-zA-Z0-9]$ + type: string + postgres_configuration_secret: + description: Secret where the database configuration can be found + type: string + postgres_data_volume_init: + description: Sets permissions on the /var/lib/pgdata/data for postgres container using an init container (not Openshift) + type: boolean + postgres_extra_args: + items: + type: string + type: array + postgres_extra_volume_mounts: + description: Specify volume mounts to be added to Postgres container + type: string + postgres_extra_volumes: + description: Specify extra volumes to add to the application pod + type: string + postgres_image: + description: Registry path to the PostgreSQL container to use + type: string + postgres_image_version: + description: PostgreSQL container image version to use + type: string + postgres_init_container_commands: + description: Customize the postgres init container commands (Non Openshift) + type: string + postgres_init_container_resource_requirements: + description: (Deprecated, use postgres_resource_requirements parameter) Resource requirements for the postgres init container + properties: + limits: + properties: + cpu: + type: string + memory: + type: string + storage: + type: string + type: object + requests: + properties: + cpu: + type: string + memory: + type: string + storage: + type: string + type: object + type: object + postgres_keep_pvc_after_upgrade: + description: Specify whether or not to keep the old PVC after PostgreSQL upgrades + type: boolean + postgres_keepalives: + default: true + description: Controls whether client-side TCP keepalives are used for Postgres connections. + type: boolean + postgres_keepalives_count: + default: 5 + description: Controls the number of TCP keepalives that can be lost before the client's connection to the server is considered dead. + format: int32 + type: integer + postgres_keepalives_idle: + default: 5 + description: Controls the number of seconds of inactivity after which TCP should send a keepalive message to the server. + format: int32 + type: integer + postgres_keepalives_interval: + default: 5 + description: Controls the number of seconds after which a TCP keepalive message that is not acknowledged by the server should be retransmitted. + format: int32 + type: integer + postgres_label_selector: + description: Label selector used to identify postgres pod for data migration + type: string + postgres_priority_class: + description: Assign a preexisting priority class to the postgres pod + type: string + postgres_resource_requirements: + description: Resource requirements for the PostgreSQL container + properties: + limits: + properties: + cpu: + type: string + memory: + type: string + type: object + requests: + properties: + cpu: + type: string + memory: + type: string + type: object + type: object + postgres_security_context_settings: + description: Key/values that will be set under the pod-level securityContext field + type: object + x-kubernetes-preserve-unknown-fields: true + postgres_selector: + description: nodeSelector for the Postgres pods + type: string + postgres_storage_class: + description: Storage class to use for the PostgreSQL PVC + type: string + postgres_storage_requirements: + description: Storage requirements for the PostgreSQL container + properties: + limits: + properties: + storage: + type: string + type: object + requests: + properties: + storage: + type: string + type: object + type: object + postgres_tolerations: + description: node tolerations for the Postgres pods + type: string + projects_existing_claim: + description: PersistentVolumeClaim to mount /var/lib/projects directory + type: string + projects_persistence: + default: false + description: Whether or not the /var/lib/projects directory will be persistent + type: boolean + projects_storage_access_mode: + default: ReadWriteMany + description: AccessMode for the /var/lib/projects PersistentVolumeClaim + type: string + projects_storage_class: + description: Storage class for the /var/lib/projects PersistentVolumeClaim + type: string + projects_storage_size: + default: 8Gi + description: Size for the /var/lib/projects PersistentVolumeClaim + type: string + projects_use_existing_claim: + description: Using existing PersistentVolumeClaim + enum: + - _Yes_ + - _No_ + type: string + receptor_log_level: + description: Set log level of receptor service + type: string + redis_capabilities: + description: Redis container capabilities + items: + type: string + type: array + redis_image: + description: Registry path to the redis container to use + type: string + redis_image_version: + description: Redis container image version to use + type: string + redis_resource_requirements: + description: Resource requirements for the redis container + properties: + limits: + properties: + cpu: + type: string + ephemeral-storage: + type: string + memory: + type: string + storage: + type: string + type: object + requests: + properties: + cpu: + type: string + ephemeral-storage: + type: string + memory: + type: string + storage: + type: string + type: object + type: object + replicas: + default: 1 + description: Number of instance replicas + format: int32 + type: integer + route_api_version: + description: The route API version to use + type: string + route_host: + description: The DNS to use to points to the instance + type: string + route_tls_secret: + description: Secret where the TLS related credentials are stored + type: string + route_tls_termination_mechanism: + default: Edge + description: The secure TLS termination mechanism to use + enum: + - Edge + - edge + - Passthrough + - passthrough + type: string + rsyslog_args: + items: + type: string + type: array + rsyslog_command: + items: + type: string + type: array + rsyslog_extra_env: + type: string + rsyslog_extra_volume_mounts: + description: Specify volume mounts to be added to the Rsyslog container + type: string + rsyslog_resource_requirements: + description: Resource requirements for the rsyslog container + properties: + limits: + properties: + cpu: + type: string + ephemeral-storage: + type: string + memory: + type: string + storage: + type: string + type: object + requests: + properties: + cpu: + type: string + ephemeral-storage: + type: string + memory: + type: string + storage: + type: string + type: object + type: object + secret_key_secret: + description: Secret where the secret key can be found + maxLength: 255 + pattern: ^[a-zA-Z0-9][-a-zA-Z0-9]{0,253}[a-zA-Z0-9]$ + type: string + security_context_settings: + description: Key/values that will be set under the pod-level securityContext field + type: object + x-kubernetes-preserve-unknown-fields: true + service_account_annotations: + description: ServiceAccount annotations + type: string + service_annotations: + description: Annotations to add to the service + type: string + service_labels: + description: Additional labels to apply to the service + type: string + service_type: + description: The service type to be used on the deployed instance + enum: + - LoadBalancer + - loadbalancer + - ClusterIP + - clusterip + - NodePort + - nodeport + type: string + session_cookie_secure: + description: Set session cookie secure mode for web + type: string + set_self_labels: + default: true + description: Maintain some of the recommended `app.kubernetes.io/*` labels on the resource (self) + type: boolean + task_affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + task_annotations: + description: Task deployment annotations. This will override the general annotations parameter for the Task deployment. + type: string + task_args: + items: + type: string + type: array + task_command: + items: + type: string + type: array + task_extra_env: + type: string + task_extra_volume_mounts: + description: Specify volume mounts to be added to Task container + type: string + task_liveness_failure_threshold: + default: 3 + description: Number of consecutive failure events to identify failure of task pod + format: int32 + type: integer + task_liveness_initial_delay: + default: 5 + description: Initial delay before starting liveness checks on task pod + format: int32 + type: integer + task_liveness_period: + default: 0 + description: Time period in seconds between each liveness check for the task pod + format: int32 + type: integer + task_liveness_timeout: + default: 1 + description: Number of seconds to wait for a probe response from task pod + format: int32 + type: integer + task_node_selector: + description: nodeSelector for the task pods + type: string + task_privileged: + default: false + description: If a privileged security context should be enabled + type: boolean + task_readiness_failure_threshold: + default: 3 + description: Number of consecutive failure events to identify failure of task pod + format: int32 + type: integer + task_readiness_initial_delay: + default: 20 + description: Initial delay before starting readiness checks on task pod + format: int32 + type: integer + task_readiness_period: + default: 0 + description: Time period in seconds between each readiness check for the task pod + format: int32 + type: integer + task_readiness_timeout: + default: 1 + description: Number of seconds to wait for a probe response from task pod + format: int32 + type: integer + task_replicas: + description: Number of task instance replicas + format: int32 + type: integer + task_resource_requirements: + description: Resource requirements for the task container + properties: + limits: + properties: + cpu: + type: string + ephemeral-storage: + type: string + memory: + type: string + storage: + type: string + type: object + requests: + properties: + cpu: + type: string + ephemeral-storage: + type: string + memory: + type: string + storage: + type: string + type: object + type: object + task_tolerations: + description: node tolerations for the task pods + type: string + task_topology_spread_constraints: + description: topology rule(s) for the task pods + type: string + termination_grace_period_seconds: + description: Optional duration in seconds pods needs to terminate gracefully + format: int32 + type: integer + tolerations: + description: node tolerations for the pods + type: string + topology_spread_constraints: + description: topology rule(s) for the pods + type: string + uwsgi_listen_queue_size: + description: Set the socket listen queue size for uwsgi + type: integer + uwsgi_processes: + description: Set the number of uwsgi processes to run in a web container + type: integer + web_affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + preference: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + properties: + nodeSelectorTerms: + items: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + properties: + preferredDuringSchedulingIgnoredDuringExecution: + items: + properties: + podAffinityTerm: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + weight: + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + items: + properties: + labelSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + properties: + matchExpressions: + items: + properties: + key: + type: string + operator: + type: string + values: + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + items: + type: string + type: array + topologyKey: + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + web_annotations: + description: Web deployment annotations. This will override the general annotations parameter for the Web deployment. + type: string + web_args: + items: + type: string + type: array + web_command: + items: + type: string + type: array + web_extra_env: + type: string + web_extra_volume_mounts: + description: Specify volume mounts to be added to the Web container + type: string + web_liveness_failure_threshold: + default: 3 + description: Number of consecutive failure events to identify failure of web pod + format: int32 + type: integer + web_liveness_initial_delay: + default: 5 + description: Initial delay before starting liveness checks on web pod + format: int32 + type: integer + web_liveness_period: + default: 0 + description: Time period in seconds between each liveness check for the web pod + format: int32 + type: integer + web_liveness_timeout: + default: 1 + description: Number of seconds to wait for a probe response from web pod + format: int32 + type: integer + web_node_selector: + description: nodeSelector for the web pods + type: string + web_readiness_failure_threshold: + default: 3 + description: Number of consecutive failure events to identify failure of web pod + format: int32 + type: integer + web_readiness_initial_delay: + default: 20 + description: Initial delay before starting readiness checks on web pod + format: int32 + type: integer + web_readiness_period: + default: 0 + description: Time period in seconds between each readiness check for the web pod + format: int32 + type: integer + web_readiness_timeout: + default: 1 + description: Number of seconds to wait for a probe response from web pod + format: int32 + type: integer + web_replicas: + description: Number of web instance replicas + format: int32 + type: integer + web_resource_requirements: + description: Resource requirements for the web container + properties: + limits: + properties: + cpu: + type: string + ephemeral-storage: + type: string + memory: + type: string + storage: + type: string + type: object + requests: + properties: + cpu: + type: string + ephemeral-storage: + type: string + memory: + type: string + storage: + type: string + type: object + type: object + web_tolerations: + description: node tolerations for the web pods + type: string + web_topology_spread_constraints: + description: topology rule(s) for the web pods + type: string + type: object + status: + properties: + URL: + description: URL to access the deployed instance + type: string + adminPasswordSecret: + description: Admin password secret name of the deployed instance + type: string + adminUser: + description: Admin user of the deployed instance + type: string + broadcastWebsocketSecret: + description: Broadcast websocket secret name of the deployed instance + type: string + conditions: + description: The resulting conditions when a Service Telemetry is instantiated + items: + properties: + lastTransitionTime: + type: string + reason: + type: string + status: + type: string + type: + type: string + type: object + type: array + image: + description: URL of the image used for the deployed instance + type: string + migratedFromSecret: + description: The secret used for migrating an old instance + type: string + postgresConfigurationSecret: + description: Postgres Configuration secret name of the deployed instance + type: string + secretKeySecret: + description: Secret key secret name of the deployed instance + type: string + upgradedPostgresVersion: + description: Status to indicate that the database has been upgraded to the version in the status + type: string + version: + description: Version of the deployed instance + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/awx-operator/templates/NOTES.txt b/awx-operator/templates/NOTES.txt new file mode 100644 index 0000000..b24f325 --- /dev/null +++ b/awx-operator/templates/NOTES.txt @@ -0,0 +1 @@ +AWX Operator installed with Helm Chart version 2.16.1 diff --git a/awx-operator/templates/_helpers.tpl b/awx-operator/templates/_helpers.tpl new file mode 100644 index 0000000..5deab29 --- /dev/null +++ b/awx-operator/templates/_helpers.tpl @@ -0,0 +1,6 @@ +{{/* +Generate the name of the postgres secret, expects AWX context passed in +*/}} +{{- define "postgres.secretName" -}} +{{ default (printf "%s-postgres-configuration" .Values.AWX.name) .Values.AWX.postgres.secretName }} +{{- end }} diff --git a/awx-operator/templates/awx-deploy.yaml b/awx-operator/templates/awx-deploy.yaml new file mode 100644 index 0000000..742ef36 --- /dev/null +++ b/awx-operator/templates/awx-deploy.yaml @@ -0,0 +1,28 @@ +{{- if $.Values.AWX.enabled }} +{{- with .Values.AWX }} +apiVersion: awx.ansible.com/v1beta1 +kind: AWX +metadata: + name: {{ .name }} + namespace: {{ $.Release.Namespace }} +spec: +{{- /* Provide custom persistent volumes configs if enabled */}} +{{- include "spec.storageClassNames" $ }} +{{- /* Provide custom secrets configs if enabled */}} +{{- include "spec.secrets" $ }} +{{- /* Include raw map from the values file spec */}} +{{ .spec | toYaml | indent 2 }} +{{- /* Provide security context defaults */}} + {{- if not (hasKey .spec "security_context_settings") }} + security_context_settings: + runAsGroup: 0 + runAsUser: 0 + fsGroup: 0 + fsGroupChangePolicy: OnRootMismatch + {{- end }} +{{- /* Postgres configs if enabled and not already present */}} + {{- if and .postgres.enabled (not (hasKey .spec "postgres_configuration_secret")) }} + postgres_configuration_secret: {{ include "postgres.secretName" $ }} + {{- end }} +{{- end }} +{{- end }} diff --git a/awx-operator/templates/clusterrole-awx-operator-metrics-reader.yaml b/awx-operator/templates/clusterrole-awx-operator-metrics-reader.yaml new file mode 100644 index 0000000..9754f04 --- /dev/null +++ b/awx-operator/templates/clusterrole-awx-operator-metrics-reader.yaml @@ -0,0 +1,11 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + helm.sh/chart: awx-operator + name: awx-operator-metrics-reader-{{ .Release.Name }} +rules: + - nonResourceURLs: + - /metrics + verbs: + - get diff --git a/awx-operator/templates/clusterrole-awx-operator-proxy-role.yaml b/awx-operator/templates/clusterrole-awx-operator-proxy-role.yaml new file mode 100644 index 0000000..b82f1e2 --- /dev/null +++ b/awx-operator/templates/clusterrole-awx-operator-proxy-role.yaml @@ -0,0 +1,19 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + helm.sh/chart: awx-operator + name: awx-operator-proxy-role-{{ .Release.Name }} +rules: + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create diff --git a/awx-operator/templates/clusterrolebinding-awx-operator-proxy-rolebinding.yaml b/awx-operator/templates/clusterrolebinding-awx-operator-proxy-rolebinding.yaml new file mode 100644 index 0000000..ebabaa4 --- /dev/null +++ b/awx-operator/templates/clusterrolebinding-awx-operator-proxy-rolebinding.yaml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + helm.sh/chart: awx-operator + name: awx-operator-proxy-rolebinding-{{ .Release.Name }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: awx-operator-proxy-role-{{ .Release.Name }} +subjects: + - kind: ServiceAccount + name: awx-operator-controller-manager + namespace: '{{ .Release.Namespace }}' diff --git a/awx-operator/templates/configmap-awx-operator-awx-manager-config.yaml b/awx-operator/templates/configmap-awx-operator-awx-manager-config.yaml new file mode 100644 index 0000000..a262c4a --- /dev/null +++ b/awx-operator/templates/configmap-awx-operator-awx-manager-config.yaml @@ -0,0 +1,28 @@ +apiVersion: v1 +data: + controller_manager_config.yaml: | + apiVersion: controller-runtime.sigs.k8s.io/v1alpha1 + kind: ControllerManagerConfig + health: + healthProbeBindAddress: :6789 + metrics: + bindAddress: 127.0.0.1:8080 + + leaderElection: + leaderElect: true + resourceName: 811c9dc5.ansible.com + # leaderElectionReleaseOnCancel defines if the leader should step down volume + # when the Manager ends. This requires the binary to immediately end when the + # Manager is stopped, otherwise, this setting is unsafe. Setting this significantly + # speeds up voluntary leader transitions as the new leader don't have to wait + # LeaseDuration time first. + # In the default scaffold provided, the program ends immediately after + # the manager stops, so would be fine to enable this option. However, + # if you are doing or is intended to do any operation such as perform cleanups + # after the manager stops then its usage might be unsafe. + # leaderElectionReleaseOnCancel: true +kind: ConfigMap +metadata: + labels: + helm.sh/chart: awx-operator + name: awx-operator-awx-manager-config diff --git a/awx-operator/templates/deployment-awx-operator-controller-manager.yaml b/awx-operator/templates/deployment-awx-operator-controller-manager.yaml new file mode 100644 index 0000000..99f28c6 --- /dev/null +++ b/awx-operator/templates/deployment-awx-operator-controller-manager.yaml @@ -0,0 +1,92 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + control-plane: controller-manager + helm.sh/chart: awx-operator + name: awx-operator-controller-manager +spec: + replicas: 1 + selector: + matchLabels: + control-plane: controller-manager + helm.sh/chart: awx-operator + template: + metadata: + annotations: + kubectl.kubernetes.io/default-container: awx-manager + labels: + control-plane: controller-manager + helm.sh/chart: awx-operator + spec: + containers: + - args: + - --secure-listen-address=0.0.0.0:8443 + - --upstream=http://127.0.0.1:8080/ + - --logtostderr=true + - --v=0 + image: gcr.io/kubebuilder/kube-rbac-proxy:v0.15.0 + name: kube-rbac-proxy + ports: + - containerPort: 8443 + name: https + protocol: TCP + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 5m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + - args: + - --health-probe-bind-address=:6789 + - --metrics-bind-address=127.0.0.1:8080 + - --leader-elect + - --leader-election-id=awx-operator + env: + - name: ANSIBLE_GATHERING + value: explicit + - name: ANSIBLE_DEBUG_LOGS + value: "false" + - name: WATCH_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: quay.io/ansible/awx-operator:2.16.1 + imagePullPolicy: IfNotPresent + livenessProbe: + httpGet: + path: /healthz + port: 6789 + initialDelaySeconds: 15 + periodSeconds: 20 + name: awx-manager + readinessProbe: + httpGet: + path: /readyz + port: 6789 + initialDelaySeconds: 5 + periodSeconds: 10 + resources: + limits: + cpu: 1500m + memory: 960Mi + requests: + cpu: 50m + memory: 32Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + imagePullSecrets: + - name: redhat-operators-pull-secret + securityContext: + runAsNonRoot: true + serviceAccountName: awx-operator-controller-manager + terminationGracePeriodSeconds: 10 diff --git a/awx-operator/templates/extra-list.yaml b/awx-operator/templates/extra-list.yaml new file mode 100644 index 0000000..5237334 --- /dev/null +++ b/awx-operator/templates/extra-list.yaml @@ -0,0 +1,8 @@ +{{- range .Values.extraDeploy }} +--- + {{- if typeIs "string" . }} + {{- tpl . $ }} + {{- else }} + {{- tpl (. | toYaml | nindent 0) $ }} + {{- end }} +{{- end }} diff --git a/awx-operator/templates/postgres-config.yaml b/awx-operator/templates/postgres-config.yaml new file mode 100644 index 0000000..4a1d9ec --- /dev/null +++ b/awx-operator/templates/postgres-config.yaml @@ -0,0 +1,18 @@ +{{- if and $.Values.AWX.enabled $.Values.AWX.postgres.enabled }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "postgres.secretName" . }} + namespace: {{ $.Release.Namespace }} +{{- with $.Values.AWX.postgres }} +stringData: + host: {{ .host }} + port: {{ .port | quote }} + database: {{ .dbName }} + username: {{ .username }} + password: {{ .password }} + sslmode: {{ .sslmode }} + type: {{ .type }} +type: Opaque +{{- end }} +{{- end }} diff --git a/awx-operator/templates/role-awx-operator-awx-manager-role.yaml b/awx-operator/templates/role-awx-operator-awx-manager-role.yaml new file mode 100644 index 0000000..9e8a281 --- /dev/null +++ b/awx-operator/templates/role-awx-operator-awx-manager-role.yaml @@ -0,0 +1,152 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + creationTimestamp: null + labels: + helm.sh/chart: awx-operator + name: awx-operator-awx-manager-role +rules: + - apiGroups: + - route.openshift.io + resources: + - routes + - routes/custom-host + verbs: + - get + - list + - create + - delete + - patch + - update + - watch + - apiGroups: + - "" + resources: + - pods + - services + - services/finalizers + - serviceaccounts + - endpoints + - persistentvolumeclaims + - events + - configmaps + - secrets + verbs: + - get + - list + - create + - delete + - patch + - update + - watch + - apiGroups: + - rbac.authorization.k8s.io + resources: + - roles + - rolebindings + verbs: + - get + - list + - create + - delete + - patch + - update + - watch + - apiGroups: + - apps + resources: + - deployments + - daemonsets + - replicasets + - statefulsets + verbs: + - get + - list + - create + - delete + - patch + - update + - watch + - apiGroups: + - networking.k8s.io + resources: + - ingresses + verbs: + - get + - list + - create + - delete + - patch + - update + - watch + - apiGroups: + - batch + resources: + - cronjobs + - jobs + verbs: + - get + - list + - create + - patch + - update + - watch + - apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - get + - create + - apiGroups: + - apps + resourceNames: + - awx-operator + resources: + - deployments/finalizers + verbs: + - update + - apiGroups: + - apps + resources: + - deployments/scale + - statefulsets/scale + verbs: + - patch + - apiGroups: + - "" + resources: + - pods/exec + - pods/attach + - pods/log + verbs: + - create + - get + - apiGroups: + - apps + resources: + - replicasets + verbs: + - get + - create + - apiGroups: + - awx.ansible.com + resources: + - '*' + - awxbackups + - awxrestores + verbs: + - '*' + - apiGroups: + - traefik.containo.us + - traefik.io + resources: + - ingressroutetcps + verbs: + - get + - list + - create + - delete + - patch + - update + - watch diff --git a/awx-operator/templates/role-awx-operator-leader-election-role.yaml b/awx-operator/templates/role-awx-operator-leader-election-role.yaml new file mode 100644 index 0000000..f52a177 --- /dev/null +++ b/awx-operator/templates/role-awx-operator-leader-election-role.yaml @@ -0,0 +1,38 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + helm.sh/chart: awx-operator + name: awx-operator-leader-election-role +rules: + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch diff --git a/awx-operator/templates/rolebinding-awx-operator-awx-manager-rolebinding.yaml b/awx-operator/templates/rolebinding-awx-operator-awx-manager-rolebinding.yaml new file mode 100644 index 0000000..400bcac --- /dev/null +++ b/awx-operator/templates/rolebinding-awx-operator-awx-manager-rolebinding.yaml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + helm.sh/chart: awx-operator + name: awx-operator-awx-manager-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: awx-operator-awx-manager-role +subjects: + - kind: ServiceAccount + name: awx-operator-controller-manager + namespace: '{{ .Release.Namespace }}' diff --git a/awx-operator/templates/rolebinding-awx-operator-leader-election-rolebinding.yaml b/awx-operator/templates/rolebinding-awx-operator-leader-election-rolebinding.yaml new file mode 100644 index 0000000..200ba58 --- /dev/null +++ b/awx-operator/templates/rolebinding-awx-operator-leader-election-rolebinding.yaml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + helm.sh/chart: awx-operator + name: awx-operator-leader-election-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: awx-operator-leader-election-role +subjects: + - kind: ServiceAccount + name: awx-operator-controller-manager + namespace: '{{ .Release.Namespace }}' diff --git a/awx-operator/templates/secrets/_helpers.tpl b/awx-operator/templates/secrets/_helpers.tpl new file mode 100644 index 0000000..c6a0089 --- /dev/null +++ b/awx-operator/templates/secrets/_helpers.tpl @@ -0,0 +1,170 @@ +{{/* +Generate certificates for ingress +*/}} +{{- define "ingress.gen-certs" -}} +{{- $ca := genCA "ingress-ca" 365 -}} +{{- $cert := genSignedCert ( $.Values.AWX.spec.hostname | required "AWX.spec.hostname is required!" ) nil nil 365 $ca -}} +tls.crt: {{ $cert.Cert | b64enc }} +tls.key: {{ $cert.Key | b64enc }} +{{- end -}} + +{{/* +Generate the name of the secret that contains the admin user password +*/}} +{{- define "admin.secretName" -}} +{{ default (printf "%s-admin-password" $.Values.AWX.name) (default $.Values.customSecrets.admin.secretName $.Values.AWX.spec.admin_password_secret) }} +{{- end }} + +{{/* +Generate the name of the secret that contains the TLS information when ingress_type=route +*/}} +{{- define "routeTls.secretName" -}} +{{ default (printf "%s-route-tls" $.Values.AWX.name) (default $.Values.customSecrets.routeTls.secretName $.Values.AWX.spec.route_tls_secret) }} +{{- end }} + +{{/* +Generate the name of the secret that contains the TLS information when ingress_type=ingress +*/}} +{{- define "ingressTls.secretName" -}} +{{ default (printf "%s-ingress-tls" $.Values.AWX.name) (default $.Values.customSecrets.ingressTls.secretName $.Values.AWX.spec.ingress_tls_secret) }} +{{- end }} + +{{/* +Generate the name of the secret that contains the LDAP Certificate Authority +*/}} +{{- define "ldapCacert.secretName" -}} +{{ default (printf "%s-custom-certs" $.Values.AWX.name) (default ($.Values.customSecrets.ldapCacert).secretName $.Values.AWX.spec.ldap_cacert_secret) }} +{{- end }} + +{{/* +Generate the name of the secret that contains the custom Certificate Authority +*/}} +{{- define "bundleCacert.secretName" -}} +{{ default (printf "%s-custom-certs" $.Values.AWX.name) (default ($.Values.customSecrets.bundleCacert).secretName $.Values.AWX.spec.bundle_cacert_secret) }} +{{- end }} + +{{/* +Generate the name of the secret that contains the LDAP BIND DN password +*/}} +{{- define "ldap.secretName" -}} +{{ default (printf "%s-ldap-password" $.Values.AWX.name) (default $.Values.customSecrets.ldap.secretName $.Values.AWX.spec.ldap_password_secret) }} +{{- end }} + +{{/* +Generate the name of the secret that contains the symmetric key for encryption +*/}} +{{- define "secretKey.secretName" -}} +{{ default (printf "%s-secret-key" $.Values.AWX.name) (default $.Values.customSecrets.secretKey.secretName $.Values.AWX.spec.secret_key_secret) }} +{{- end }} + +{{/* +Generate the name of the secret that contains the default execution environment pull credentials +*/}} +{{- define "eePullCredentials.secretName" -}} +{{ default (printf "%s-ee-pull-credentials" $.Values.AWX.name) (default $.Values.customSecrets.eePullCredentials.secretName $.Values.AWX.spec.ee_pull_credentials_secret) }} +{{- end }} + +{{/* +Generate the name of the secret that contains the default control plane pull credentials +*/}} +{{- define "cpPullCredentials.secretName" -}} +{{ default (printf "%s-cp-pull-credentials" $.Values.AWX.name) (default $.Values.customSecrets.cpPullCredentials.secretName $.Values.AWX.spec.image_pull_secrets) }} +{{- end }} + +{{/* +Generate the .dockerconfigjson file unencoded. +*/}} +{{- define "dockerconfigjson.b64dec" }} + {{- print "{\"auths\":{" }} + {{- range $index, $item := . }} + {{- if $index }} + {{- print "," }} + {{- end }} + {{- printf "\"%s\":{\"username\":\"%s\",\"password\":\"%s\",\"email\":\"%s\",\"auth\":\"%s\"}" (default "https://index.docker.io/v1/" $item.registry) $item.username $item.password (default "" $item.email) (printf "%s:%s" $item.username $item.password | b64enc) }} + {{- end }} + {{- print "}}" }} +{{- end }} + +{{/* +Generate the base64-encoded .dockerconfigjson. +*/}} +{{- define "dockerconfigjson.b64enc" }} + {{- $list := ternary (list .) . (kindIs "map" .) }} + {{- include "dockerconfigjson.required" $list }} + {{- include "dockerconfigjson.b64dec" $list | b64enc }} +{{- end }} + +{{/* +Required values for .dockerconfigjson +*/}} +{{- define "dockerconfigjson.required" -}} + {{- range . -}} + {{- $_ := required "cpPullCredentials.dockerconfigjson[].username is required!" .username -}} + {{- $_ := required "cpPullCredentials.dockerconfigjson[].password is required!" .password -}} + {{- end -}} + {{/* Check for registry uniqueness */}} + {{- $registries := list -}} + {{- range . -}} + {{- $registries = append $registries (default "https://index.docker.io/v1/" .registry) -}} + {{- end -}} + {{- $_ := required "All cpPullCredentials.dockerconfigjson[].registry's must be unique!" (or (eq (len $registries) (len ($registries | uniq))) nil) -}} +{{- end -}} + +{{/* +Generate the name of the secrets +*/}} +{{- define "spec.secrets" -}} +{{- /* secret configs if enabled */}} +{{- if hasKey $.Values "customSecrets" }} +{{- with $.Values.customSecrets }} +{{- if .enabled }} + {{- if hasKey . "admin" }} + {{- if and (not (hasKey $.Values.AWX.spec "admin_password_secret")) .admin.enabled }} + admin_password_secret: {{ include "admin.secretName" $ }} + {{- end }} + {{- end }} + {{- if hasKey . "secretKey" }} + {{- if and (not (hasKey $.Values.AWX.spec "secret_key_secret")) .secretKey.enabled }} + secret_key_secret: {{ include "secretKey.secretName" $ }} + {{- end }} + {{- end }} + {{- if hasKey . "routeTls" }} + {{- if and (not (hasKey $.Values.AWX.spec "route_tls_secret")) .routeTls.enabled }} + route_tls_secret: {{ include "routeTls.secretName" $ }} + {{- end }} + {{- end }} + {{- if hasKey . "ingressTls" }} + {{- if and (not (hasKey $.Values.AWX.spec "ingress_tls_secret")) .ingressTls.enabled }} + ingress_tls_secret: {{ include "ingressTls.secretName" $ }} + {{- end }} + {{- end }} + {{- if hasKey . "ldapCacert" }} + {{- if and (not (hasKey $.Values.AWX.spec "ldap_cacert_secret")) .ldapCacert.enabled }} + ldap_cacert_secret: {{ include "ldapCacert.secretName" $ }} + {{- end }} + {{- end }} + {{- if hasKey . "bundleCacert" }} + {{- if and (not (hasKey $.Values.AWX.spec "bundle_cacert_secret")) .bundleCacert.enabled }} + bundle_cacert_secret: {{ include "bundleCacert.secretName" $ }} + {{- end }} + {{- end }} + {{- if hasKey . "ldap" }} + {{- if and (not (hasKey $.Values.AWX.spec "ldap_password_secret")) .ldap.enabled }} + ldap_password_secret: {{ include "ldap.secretName" $ }} + {{- end }} + {{- end }} + {{- if hasKey . "eePullCredentials" }} + {{- if and (not (hasKey $.Values.AWX.spec "ee_pull_credentials_secret")) .eePullCredentials.enabled }} + ee_pull_credentials_secret: {{ include "eePullCredentials.secretName" $ }} + {{- end }} + {{- end }} + {{- if hasKey . "cpPullCredentials" }} + {{- if and (not (hasKey $.Values.AWX.spec "image_pull_secrets")) .cpPullCredentials.enabled }} + image_pull_secrets: + - {{ include "cpPullCredentials.secretName" $ }} + {{- end }} + {{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/awx-operator/templates/secrets/admin-password-secret.yaml b/awx-operator/templates/secrets/admin-password-secret.yaml new file mode 100644 index 0000000..d864c9f --- /dev/null +++ b/awx-operator/templates/secrets/admin-password-secret.yaml @@ -0,0 +1,16 @@ +{{- if ($.Values.customSecrets).enabled }} +{{- if hasKey .Values.customSecrets "admin" }} +{{- with $.Values.customSecrets.admin }} +{{- if .enabled }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "admin.secretName" $ }} + namespace: {{ $.Release.Namespace }} +type: Opaque +data: + password: {{ .password | required "customSecrets.admin.password is required!" | b64enc }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/awx-operator/templates/secrets/cp-pull-credentials-secret.yaml b/awx-operator/templates/secrets/cp-pull-credentials-secret.yaml new file mode 100644 index 0000000..df31c36 --- /dev/null +++ b/awx-operator/templates/secrets/cp-pull-credentials-secret.yaml @@ -0,0 +1,16 @@ +{{- if ($.Values.customSecrets).enabled }} +{{- if hasKey .Values.customSecrets "cpPullCredentials" }} +{{- with $.Values.customSecrets.cpPullCredentials }} +{{- if .enabled }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "cpPullCredentials.secretName" $ }} + namespace: {{ $.Release.Namespace }} +type: kubernetes.io/dockerconfigjson +data: + .dockerconfigjson: {{ template "dockerconfigjson.b64enc" .dockerconfig | required "customSecrets.cpPullCredentials.dockerconfig is required!" }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/awx-operator/templates/secrets/custom-certs-secret.yaml b/awx-operator/templates/secrets/custom-certs-secret.yaml new file mode 100644 index 0000000..c93f59f --- /dev/null +++ b/awx-operator/templates/secrets/custom-certs-secret.yaml @@ -0,0 +1,49 @@ +{{- if ($.Values.customSecrets).enabled }} +{{- with .Values.customSecrets }} +{{- $hasLdapCrt := (hasKey $.Values.customSecrets "ldapCacert") -}} +{{- $hasBundleCrt := (hasKey . "bundleCacert") -}} +{{- if or $hasLdapCrt $hasBundleCrt }} +{{- $ldapCrtEnabled := ternary (.ldapCacert).enabled false $hasLdapCrt -}} +{{- $bundleCrtEnabled := ternary (.bundleCacert).enabled false $hasBundleCrt -}} +{{- $ldapSecretName := (include "ldapCacert.secretName" $) -}} +{{- $bundleSecretName := (include "bundleCacert.secretName" $) -}} +{{- if and (or $bundleCrtEnabled $ldapCrtEnabled) (eq $ldapSecretName $bundleSecretName) }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ $ldapSecretName }} + namespace: {{ $.Release.Namespace }} +type: Opaque +data: +{{- if $ldapCrtEnabled }} + ldap-ca.crt: {{ .ldapCacert.crt | required "customSecrets.ldapCacert.crt is required!" | b64enc }} +{{- end }} +{{- if $bundleCrtEnabled }} + bundle-ca.crt: {{ .bundleCacert.crt | required "customSecrets.bundleCacert.crt is required!" | b64enc }} +{{- end }} +{{- else }} +{{- if $ldapCrtEnabled }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ $ldapSecretName }} + namespace: {{ $.Release.Namespace }} +type: Opaque +data: + ldap-ca.crt: {{ .ldapCacert.crt | required "customSecrets.ldapCacert.crt is required!" | b64enc }} +{{- end }} +{{- if $bundleCrtEnabled }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ $bundleSecretName }} + namespace: {{ $.Release.Namespace }} +type: Opaque +data: + bundle-ca.crt: {{ .bundleCacert.crt | required "customSecrets.bundleCacert.crt is required!" | b64enc }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/awx-operator/templates/secrets/ee-pull-credentials-secret.yaml b/awx-operator/templates/secrets/ee-pull-credentials-secret.yaml new file mode 100644 index 0000000..b610802 --- /dev/null +++ b/awx-operator/templates/secrets/ee-pull-credentials-secret.yaml @@ -0,0 +1,19 @@ +{{- if ($.Values.customSecrets).enabled }} +{{- if hasKey .Values.customSecrets "eePullCredentials" }} +{{- with $.Values.customSecrets.eePullCredentials }} +{{- if .enabled }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "eePullCredentials.secretName" $ }} + namespace: {{ $.Release.Namespace }} +type: Opaque +stringData: + url: {{ (required "customSecrets.eePullCredentials.url is required!" .url) | quote }} + username: {{ (required "customSecrets.eePullCredentials.username is required!" .username) | quote }} + password: {{ (required "customSecrets.eePullCredentials.password is required!" .password) | quote }} + ssl_verify: {{ or .sslVerify (eq (.sslVerify | toString) "") | quote }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/awx-operator/templates/secrets/ingress-tls-secret.yaml b/awx-operator/templates/secrets/ingress-tls-secret.yaml new file mode 100644 index 0000000..b094e29 --- /dev/null +++ b/awx-operator/templates/secrets/ingress-tls-secret.yaml @@ -0,0 +1,25 @@ +{{- if ($.Values.customSecrets).enabled }} +{{- if hasKey .Values.customSecrets "ingressTls" }} +{{- with $.Values.customSecrets.ingressTls }} +{{- if .enabled }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "ingressTls.secretName" $ }} + namespace: {{ $.Release.Namespace }} +{{- if .labels }} + labels: +{{ toYaml .labels | indent 4 }} +{{- end }} +type: kubernetes.io/tls +data: +{{- if .selfSignedCert }} +{{ ( include "ingress.gen-certs" $ ) | indent 2 }} +{{ else }} + tls.key: {{ (.key | required "customSecrets.ingressTls.key is required!") | b64enc }} + tls.crt: {{ (.certificate | required "customSecrets.ingressTls.certificate is required!") | b64enc }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/awx-operator/templates/secrets/ldap-password-secret.yaml b/awx-operator/templates/secrets/ldap-password-secret.yaml new file mode 100644 index 0000000..6d28cc6 --- /dev/null +++ b/awx-operator/templates/secrets/ldap-password-secret.yaml @@ -0,0 +1,16 @@ +{{- if ($.Values.customSecrets).enabled }} +{{- if hasKey .Values.customSecrets "ldap" }} +{{- with $.Values.customSecrets.ldap }} +{{- if .enabled }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "ldap.secretName" $ }} + namespace: {{ $.Release.Namespace }} +type: Opaque +data: + ldap-password: {{ .password | required "customSecrets.ldap.password is required!" | b64enc }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/awx-operator/templates/secrets/route-tls-secret.yaml b/awx-operator/templates/secrets/route-tls-secret.yaml new file mode 100644 index 0000000..2e024af --- /dev/null +++ b/awx-operator/templates/secrets/route-tls-secret.yaml @@ -0,0 +1,17 @@ +{{- if ($.Values.customSecrets).enabled }} +{{- if hasKey .Values.customSecrets "routeTls" }} +{{- with $.Values.customSecrets.routeTls }} +{{- if .enabled }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "routeTls.secretName" $ }} + namespace: {{ $.Release.Namespace }} +type: kubernetes.io/tls +data: + tls.key: {{ (.key | required "customSecrets.routeTls.key is required!") | b64enc }} + tls.crt: {{ (.certificate | required "customSecrets.routeTls.certificate is required!") | b64enc }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/awx-operator/templates/secrets/secret-key-secret.yaml b/awx-operator/templates/secrets/secret-key-secret.yaml new file mode 100644 index 0000000..ef9a277 --- /dev/null +++ b/awx-operator/templates/secrets/secret-key-secret.yaml @@ -0,0 +1,16 @@ +{{- if ($.Values.customSecrets).enabled }} +{{- if hasKey .Values.customSecrets "secretKey" }} +{{- with $.Values.customSecrets.secretKey }} +{{- if .enabled }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "secretKey.secretName" $ }} + namespace: {{ $.Release.Namespace }} +type: Opaque +stringData: + secret_key: {{ .key | required "customSecrets.secretKey.key is required!" | quote }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/awx-operator/templates/service-awx-operator-controller-manager-metrics-service.yaml b/awx-operator/templates/service-awx-operator-controller-manager-metrics-service.yaml new file mode 100644 index 0000000..a53356d --- /dev/null +++ b/awx-operator/templates/service-awx-operator-controller-manager-metrics-service.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + control-plane: controller-manager + helm.sh/chart: awx-operator + name: awx-operator-controller-manager-metrics-service +spec: + ports: + - name: https + port: 8443 + protocol: TCP + targetPort: https + selector: + control-plane: controller-manager + helm.sh/chart: awx-operator diff --git a/awx-operator/templates/serviceaccount-awx-operator-controller-manager.yaml b/awx-operator/templates/serviceaccount-awx-operator-controller-manager.yaml new file mode 100644 index 0000000..128bcb1 --- /dev/null +++ b/awx-operator/templates/serviceaccount-awx-operator-controller-manager.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + helm.sh/chart: awx-operator + name: awx-operator-controller-manager diff --git a/awx-operator/templates/storage/_helpers.tpl b/awx-operator/templates/storage/_helpers.tpl new file mode 100644 index 0000000..d31bb43 --- /dev/null +++ b/awx-operator/templates/storage/_helpers.tpl @@ -0,0 +1,57 @@ +{{/* +Generate the name of the persistent volume for postgres folders +*/}} +{{- define "postgres.persistentVolumeName" -}} +{{ printf "%s-postgres-volume" $.Values.AWX.name }} +{{- end }} + +{{/* +Generate the name of the persistent volume for projects folder +*/}} +{{- define "projects.persistentVolumeName" -}} +{{ printf "%s-projects-volume" $.Values.AWX.name }} +{{- end }} + +{{/* +Generate the name of the persistent volume claim for the projects volume +*/}} +{{- define "projects.persistentVolumeClaim" -}} +{{ printf "%s-projects-claim" $.Values.AWX.name }} +{{- end }} + +{{/* +Generate the name of the storage class to use for the postgres volume +*/}} +{{- define "postgres.storageClassName" -}} +{{ default (printf "%s-postgres-volume" $.Values.AWX.name) (default $.Values.AWX.spec.postgres_storage_class (($.Values.customVolumes).postgres).storageClassName) }} +{{- end }} + +{{/* +Generate the name of the storage class to use for the projects volume +*/}} +{{- define "projects.storageClassName" -}} +{{ default (printf "%s-projects-volume" $.Values.AWX.name) (default $.Values.AWX.spec.projects_storage_class (($.Values.customVolumes).projects).storageClassName) }} +{{- end }} + +{{/* +Generate the name of the storage class names, expects AWX context passed in +*/}} +{{- define "spec.storageClassNames" -}} +{{- if and (not $.Values.AWX.postgres.enabled) (eq (($.Values.AWX.spec).postgres_configuration_secret | default "") "") -}} +{{- if (($.Values.customVolumes).postgres).enabled -}} + {{- if not (hasKey $.Values.AWX.spec "postgres_storage_class") }} + postgres_storage_class: {{ include "postgres.storageClassName" $ }} + {{- end }} + {{- if not (hasKey $.Values.AWX.spec "postgres_storage_requirements") }} + postgres_storage_requirements: + requests: + storage: {{ default "8Gi" $.Values.customVolumes.postgres.size | quote }} + {{- end }} +{{- end }} +{{- end }} +{{- if and ($.Values.AWX.spec.projects_persistence) (eq (($.Values.AWX.spec).projects_existing_claim | default "") "") -}} +{{- if (($.Values.customVolumes).projects).enabled }} + projects_existing_claim: {{ include "projects.persistentVolumeClaim" $ }} +{{- end }} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/awx-operator/templates/storage/postgres-pv.yaml b/awx-operator/templates/storage/postgres-pv.yaml new file mode 100644 index 0000000..544feab --- /dev/null +++ b/awx-operator/templates/storage/postgres-pv.yaml @@ -0,0 +1,19 @@ +{{- if and (not $.Values.AWX.postgres.enabled) (eq (($.Values.AWX.spec).postgres_configuration_secret | default "") "") -}} +{{- if (($.Values.customVolumes).postgres).enabled -}} +apiVersion: v1 +kind: PersistentVolume +metadata: + name: {{ include "postgres.persistentVolumeName" $ }} +{{- with $.Values.customVolumes.postgres }} +spec: + accessModes: + - {{ default "ReadWriteOnce" .accessModes }} + persistentVolumeReclaimPolicy: {{ default "Retain" .reclaimPolicy | quote }} + capacity: + storage: {{ default "8Gi" .size | quote }} + storageClassName: {{ include "postgres.storageClassName" $ }} + hostPath: + path: /var/lib/pgsql/data/userdata +{{- end }} +{{- end }} +{{- end }} diff --git a/awx-operator/templates/storage/projects-pv.yaml b/awx-operator/templates/storage/projects-pv.yaml new file mode 100644 index 0000000..f9a82c6 --- /dev/null +++ b/awx-operator/templates/storage/projects-pv.yaml @@ -0,0 +1,32 @@ +{{- if and ($.Values.AWX.spec.projects_persistence) (eq (($.Values.AWX.spec).projects_existing_claim | default "") "") -}} +{{- if (($.Values.customVolumes).projects).enabled -}} +apiVersion: v1 +kind: PersistentVolume +metadata: + name: {{ include "projects.persistentVolumeName" $ }} +{{- with $.Values.customVolumes.projects }} +spec: + accessModes: + - {{ default "ReadWriteOnce" (default $.Values.AWX.spec.projects_storage_access_mode .accessModes) }} + persistentVolumeReclaimPolicy: {{ default "Retain" .reclaimPolicy | quote }} + capacity: + storage: {{ default "8Gi" (default $.Values.AWX.spec.projects_storage_size .size) | quote }} + storageClassName: {{ include "projects.storageClassName" $ }} + hostPath: + path: {{ required "customVolumes.projects.hostPath is required!" .hostPath | quote }} +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: {{ include "projects.persistentVolumeClaim" $ }} +spec: + accessModes: + - {{ default "ReadWriteOnce" (default $.Values.AWX.spec.projects_storage_access_mode .accessModes) }} + volumeMode: Filesystem + resources: + requests: + storage: {{ default "8Gi" (default $.Values.AWX.spec.projects_storage_size .size) | quote }} + storageClassName: {{ include "projects.storageClassName" $ }} +{{- end }} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/awx-operator/values.yaml b/awx-operator/values.yaml new file mode 100644 index 0000000..f6c6db5 --- /dev/null +++ b/awx-operator/values.yaml @@ -0,0 +1,19 @@ +AWX: + # enable use of awx-deploy template + enabled: false + name: awx + spec: + admin_user: admin + + # configurations for external postgres instance + postgres: + enabled: false + host: Unset + port: 5678 + dbName: Unset + username: admin + # for secret management, pass in the password independently of this file + # at the command line, use --set AWX.postgres.password + password: Unset + sslmode: prefer + type: unmanaged