From de2c80328a1e05ddbbd4df1d417a4b91cfe18688 Mon Sep 17 00:00:00 2001 From: Jonny Ervine Date: Tue, 23 Jan 2024 23:39:07 +0800 Subject: [PATCH] Add postgres-operator --- cloudflared-6.0.4/.helmignore | 30 - cloudflared-6.0.4/CHANGELOG.md | 939 ---- cloudflared-6.0.4/Chart.lock | 6 - cloudflared-6.0.4/Chart.yaml | 28 - cloudflared-6.0.4/README.md | 27 - cloudflared-6.0.4/charts/common/Chart.yaml | 17 - cloudflared-6.0.4/charts/common/LICENSE | 106 - cloudflared-6.0.4/charts/common/README.md | 24 - .../charts/common/crds/cert-manager.crds.yaml | 4422 ----------------- .../common/crds/traefik.io_ingressroutes.yaml | 275 - .../crds/traefik.io_ingressroutetcps.yaml | 218 - .../crds/traefik.io_ingressrouteudps.yaml | 105 - .../common/crds/traefik.io_middlewares.yaml | 924 ---- .../crds/traefik.io_middlewaretcps.yaml | 72 - .../crds/traefik.io_serverstransports.yaml | 128 - .../common/crds/traefik.io_tlsoptions.yaml | 113 - .../common/crds/traefik.io_tlsstores.yaml | 99 - .../crds/traefik.io_traefikservices.yaml | 402 -- .../addons/code-server/_codeserver.tpl | 53 - .../addons/code-server/_container.tpl | 46 - .../templates/addons/netshoot/_container.tpl | 44 - .../templates/addons/netshoot/_netshoot.tpl | 15 - .../templates/addons/vpn/_configmap.tpl | 16 - .../addons/vpn/_gluetunContainer.tpl | 64 - .../addons/vpn/_openvpnContainer.tpl | 73 - .../common/templates/addons/vpn/_secret.tpl | 9 - .../addons/vpn/_tailscaleContainer.tpl | 87 - .../common/templates/addons/vpn/_volume.tpl | 112 - .../common/templates/addons/vpn/_vpn.tpl | 94 - .../addons/vpn/_wireguardContainer.tpl | 66 - .../common/templates/class/_certificate.tpl | 32 - .../common/templates/class/_cnpgCluster.tpl | 83 - .../common/templates/class/_cnpgPooler.tpl | 35 - .../common/templates/class/_configmap.tpl | 37 - .../common/templates/class/_cronjob.tpl | 52 - .../common/templates/class/_daemonset.tpl | 55 - .../common/templates/class/_deployment.tpl | 55 - .../common/templates/class/_endpoint.tpl | 33 - .../common/templates/class/_endpointSlice.tpl | 41 - .../class/_horizontalPodAutoscaler.tpl | 58 - .../common/templates/class/_ingress.tpl | 148 - .../charts/common/templates/class/_job.tpl | 52 - .../class/_mutatingWebhookConfiguration.tpl | 38 - .../class/_networkAttachmentDefinition.tpl | 35 - .../common/templates/class/_networkPolicy.tpl | 185 - .../templates/class/_podDisruptionBudget.tpl | 54 - .../common/templates/class/_podMonitor.tpl | 47 - .../templates/class/_prometheusRule.tpl | 55 - .../charts/common/templates/class/_pvc.tpl | 57 - .../charts/common/templates/class/_rbac.tpl | 64 - .../charts/common/templates/class/_route.tpl | 87 - .../charts/common/templates/class/_secret.tpl | 58 - .../common/templates/class/_service.tpl | 115 - .../templates/class/_serviceAccount.tpl | 34 - .../templates/class/_serviceMonitor.tpl | 47 - .../common/templates/class/_statefulset.tpl | 59 - .../class/_validatingWebhookConfiguration.tpl | 38 - .../templates/helpers/_envDupeCheck.tpl | 23 - .../templates/helpers/_getPortRange.tpl | 59 - .../templates/helpers/_getSelectedPod.tpl | 47 - .../templates/helpers/_getSelectedService.tpl | 47 - .../templates/helpers/_makeIntOrNoop.tpl | 21 - .../common/templates/lib/_tc_capabilities.tpl | 44 - .../common/templates/lib/chart/_names.tpl | 48 - .../common/templates/lib/chart/_notes.tpl | 21 - .../templates/lib/cnpg/_poolerMetrics.tpl | 9 - .../common/templates/lib/cnpg/_urlsSecret.tpl | 14 - .../common/templates/lib/cnpg/_userSecret.tpl | 9 - .../templates/lib/configmap/_validation.tpl | 21 - .../common/templates/lib/container/_args.tpl | 22 - .../templates/lib/container/_command.tpl | 18 - .../common/templates/lib/container/_env.tpl | 108 - .../templates/lib/container/_envFrom.tpl | 74 - .../templates/lib/container/_envList.tpl | 23 - .../templates/lib/container/_fixedEnv.tpl | 75 - .../lib/container/_imageSelector.tpl | 42 - .../templates/lib/container/_lifecycle.tpl | 37 - .../common/templates/lib/container/_ports.tpl | 87 - .../lib/container/_primaryValidation.tpl | 40 - .../templates/lib/container/_probes.tpl | 98 - .../templates/lib/container/_resources.tpl | 140 - .../lib/container/_securityContext.tpl | 181 - .../templates/lib/container/_termination.tpl | 33 - .../templates/lib/container/_volumeMounts.tpl | 147 - .../probe-lifecycle-actions/_exec.tpl | 18 - .../probe-lifecycle-actions/_grpc.tpl | 23 - .../probe-lifecycle-actions/_httpGet.tpl | 53 - .../probe-lifecycle-actions/_tcpSocket.tpl | 23 - .../lib/dependencies/_clickhouseInjector.tpl | 55 - .../templates/lib/dependencies/_dbWait.tpl | 387 -- .../lib/dependencies/_mariadbInjector.tpl | 66 - .../lib/dependencies/_mongodbInjector.tpl | 63 - .../lib/dependencies/_redisInjector.tpl | 51 - .../lib/dependencies/_solrInjector.tpl | 47 - .../templates/lib/endpoint/_addresses.tpl | 20 - .../common/templates/lib/endpoint/_ports.tpl | 40 - .../lib/endpointSlice/_endpoints.tpl | 21 - .../templates/lib/endpointSlice/_ports.tpl | 40 - .../lib/externalInterface/_validation.tpl | 53 - .../lib/imagePullSecret/_createData.tpl | 42 - .../lib/imagePullSecret/_validation.tpl | 27 - .../lib/metadata/_allAnnotations.tpl | 9 - .../templates/lib/metadata/_allLabels.tpl | 15 - .../_externalInterfaceAnnotations.tpl | 52 - .../lib/metadata/_globalAnnotations.tpl | 6 - .../templates/lib/metadata/_globalLabels.tpl | 6 - .../templates/lib/metadata/_namespace.tpl | 35 - .../lib/metadata/_podAnnotations.tpl | 7 - .../templates/lib/metadata/_podLabels.tpl | 6 - .../common/templates/lib/metadata/_render.tpl | 37 - .../lib/metadata/_selectorLabels.tpl | 16 - .../templates/lib/metadata/_validation.tpl | 22 - .../lib/pod/_autoMountServiceAccountToken.tpl | 24 - .../common/templates/lib/pod/_container.tpl | 62 - .../templates/lib/pod/_containerSpawner.tpl | 31 - .../charts/common/templates/lib/pod/_dns.tpl | 90 - .../templates/lib/pod/_enableServiceLinks.tpl | 24 - .../common/templates/lib/pod/_hostAliases.tpl | 37 - .../common/templates/lib/pod/_hostNetwork.tpl | 24 - .../common/templates/lib/pod/_hostPID.tpl | 24 - .../templates/lib/pod/_hostname.tpl.tpl | 22 - .../templates/lib/pod/_imagePullSecret.tpl | 38 - .../lib/pod/_initContainerSpawner.tpl | 91 - .../templates/lib/pod/_nodeSelector.tpl | 33 - .../templates/lib/pod/_podSecurityContext.tpl | 117 - .../templates/lib/pod/_priorityClassName.tpl | 24 - .../templates/lib/pod/_restartPolicy.tpl | 34 - .../templates/lib/pod/_runtimeClassName.tpl | 57 - .../templates/lib/pod/_schedulerName.tpl | 24 - .../templates/lib/pod/_serviceAccountName.tpl | 48 - .../lib/pod/_shareProcessNamespace.tpl | 24 - .../pod/_terminationGracePeriodSeconds.tpl | 29 - .../common/templates/lib/pod/_tolerations.tpl | 67 - .../common/templates/lib/pod/_volumes.tpl | 68 - .../templates/lib/pod/volumes/_configmap.tpl | 70 - .../templates/lib/pod/volumes/_device.tpl | 53 - .../templates/lib/pod/volumes/_emptyDir.tpl | 43 - .../templates/lib/pod/volumes/_hostPath.tpl | 35 - .../templates/lib/pod/volumes/_ixVolume.tpl | 56 - .../common/templates/lib/pod/volumes/_nfs.tpl | 27 - .../common/templates/lib/pod/volumes/_pvc.tpl | 18 - .../templates/lib/pod/volumes/_secret.tpl | 71 - .../lib/podDistruptionBudget/_validation.tpl | 48 - .../lib/rbac/_getServiceAccounts.tpl | 52 - .../common/templates/lib/rbac/_rules.tpl | 50 - .../common/templates/lib/rbac/_subjects.tpl | 17 - .../common/templates/lib/rbac/_validation.tpl | 38 - .../lib/scaleCertificate/_getData.tpl | 40 - .../lib/scaleCertificate/_validation.tpl | 18 - .../templates/lib/secret/_validation.tpl | 25 - .../lib/service/_additionalAnnotations.tpl | 40 - .../common/templates/lib/service/_ports.tpl | 63 - .../templates/lib/service/_validation.tpl | 133 - .../service/serviceTypeConfig/_cluster_ip.tpl | 16 - .../serviceTypeConfig/_externalIPs.tpl | 17 - .../_externalTrafficPolicy.tpl | 22 - .../service/serviceTypeConfig/_ipFamily.tpl | 38 - .../_publishNotReadyAddresses.tpl | 19 - .../serviceTypeConfig/_sessionAffinity.tpl | 42 - .../service/serviceTypeSpecs/_clusterIP.tpl | 21 - .../service/serviceTypeSpecs/_externalIP.tpl | 19 - .../serviceTypeSpecs/_externalName.tpl | 26 - .../serviceTypeSpecs/_loadBalancer.tpl | 33 - .../service/serviceTypeSpecs/_nodePort.tpl | 22 - .../lib/serviceAccount/_validation.tpl | 38 - .../templates/lib/storage/_accessModes.tpl | 32 - .../lib/storage/_storageClassName.tpl | 54 - .../templates/lib/storage/_validation.tpl | 39 - .../lib/storage/_volumeClaimTemplates.tpl | 66 - .../common/templates/lib/util/_autoperms.tpl | 144 - .../templates/lib/util/_chartcontext.tpl | 124 - .../templates/lib/util/_primary_cnpg.tpl | 23 - .../templates/lib/util/_primary_ingress.tpl | 23 - .../templates/lib/util/_primary_metrics.tpl | 30 - .../templates/lib/util/_primary_port.tpl | 41 - .../templates/lib/util/_primary_route.tpl | 23 - .../templates/lib/util/_primary_service.tpl | 39 - .../templates/lib/util/_primary_workload.tpl | 35 - .../templates/lib/util/_register_operator.tpl | 25 - .../templates/lib/util/_verify_operator.tpl | 123 - .../lib/webhook/_admissionReviewVersions.tpl | 8 - .../templates/lib/webhook/_clientConfig.tpl | 22 - .../common/templates/lib/webhook/_rules.tpl | 26 - .../templates/lib/webhook/_validation.tpl | 152 - .../common/templates/lib/webhook/_webhook.tpl | 31 - .../templates/lib/workload/_cronjobSpec.tpl | 31 - .../templates/lib/workload/_daemonsetSpec.tpl | 27 - .../lib/workload/_deploymentSpec.tpl | 36 - .../templates/lib/workload/_jobSpec.tpl | 31 - .../common/templates/lib/workload/_pod.tpl | 61 - .../lib/workload/_statefulsetSpec.tpl | 37 - .../validation/_cronjobValidation.tpl | 29 - .../validation/_daemonsetValidation.tpl | 30 - .../validation/_deploymentValidation.tpl | 30 - .../workload/validation/_jobValidation.tpl | 32 - .../validation/_statefusetValidation.tpl | 30 - .../validation/_workloadValidation.tpl | 43 - .../charts/common/templates/loader/_all.tpl | 8 - .../charts/common/templates/loader/_apply.tpl | 70 - .../charts/common/templates/loader/_init.tpl | 55 - .../charts/common/templates/loader/_lists.tpl | 9 - .../common/templates/spawner/_certificate.tpl | 23 - .../charts/common/templates/spawner/_cnpg.tpl | 102 - .../common/templates/spawner/_configmap.tpl | 60 - .../templates/spawner/_externalInterface.tpl | 32 - .../common/templates/spawner/_extraTpl.tpl | 13 - .../spawner/_horizontalPodAutoscaler.tpl | 19 - .../templates/spawner/_imagePullSecret.tpl | 41 - .../common/templates/spawner/_ingress.tpl | 62 - .../common/templates/spawner/_metrics.tpl | 28 - .../templates/spawner/_networkPolicy.tpl | 19 - .../spawner/_podDisruptionBudget.tpl | 59 - .../common/templates/spawner/_portal.tpl | 176 - .../charts/common/templates/spawner/_pvc.tpl | 41 - .../charts/common/templates/spawner/_rbac.tpl | 44 - .../common/templates/spawner/_route.tpl | 18 - .../templates/spawner/_scaleCertificate.tpl | 40 - .../common/templates/spawner/_secret.tpl | 59 - .../common/templates/spawner/_service.tpl | 58 - .../templates/spawner/_serviceAccount.tpl | 39 - .../common/templates/spawner/_webhook.tpl | 65 - .../common/templates/spawner/_workload.tpl | 57 - .../charts/common/templates/values/_init.tpl | 14 - .../common/templates/values/_validate.tpl | 18 - .../templates/values/lists/_deviceList.tpl | 21 - .../values/lists/_persistenceList.tpl | 21 - .../templates/values/lists/_portList.tpl | 34 - .../templates/values/lists/_serviceList.tpl | 36 - cloudflared-6.0.4/charts/common/values.yaml | 843 ---- cloudflared-6.0.4/ci/test-values.yaml | 9 - cloudflared-6.0.4/questions.yaml | 65 - cloudflared-6.0.4/templates/common.yaml | 1 - cloudflared-6.0.4/values.home.yaml | 34 - cloudflared-6.0.4/values.yaml | 34 - .../common => postgres-operator}/.helmignore | 2 - postgres-operator/Chart.yaml | 18 + .../crds/operatorconfigurations.yaml | 679 +++ postgres-operator/crds/postgresqls.yaml | 656 +++ postgres-operator/crds/postgresteams.yaml | 70 + postgres-operator/index.yaml | 158 + postgres-operator/templates/NOTES.txt | 3 + postgres-operator/templates/_helpers.tpl | 72 + .../templates/clusterrole-postgres-pod.yaml | 71 + postgres-operator/templates/clusterrole.yaml | 254 + .../templates/clusterrolebinding.yaml | 19 + postgres-operator/templates/configmap.yaml | 30 + postgres-operator/templates/deployment.yaml | 80 + .../templates/operatorconfiguration.yaml | 45 + .../postgres-pod-priority-class.yaml | 16 + postgres-operator/templates/service.yaml | 19 + .../templates/serviceaccount.yaml | 12 + .../templates/user-facing-clusterroles.yaml | 71 + postgres-operator/values.home.yaml | 9 + postgres-operator/values.yaml | 501 ++ 254 files changed, 2783 insertions(+), 19004 deletions(-) delete mode 100644 cloudflared-6.0.4/.helmignore delete mode 100644 cloudflared-6.0.4/CHANGELOG.md delete mode 100644 cloudflared-6.0.4/Chart.lock delete mode 100644 cloudflared-6.0.4/Chart.yaml delete mode 100644 cloudflared-6.0.4/README.md delete mode 100644 cloudflared-6.0.4/charts/common/Chart.yaml delete mode 100644 cloudflared-6.0.4/charts/common/LICENSE delete mode 100644 cloudflared-6.0.4/charts/common/README.md delete mode 100644 cloudflared-6.0.4/charts/common/crds/cert-manager.crds.yaml delete mode 100644 cloudflared-6.0.4/charts/common/crds/traefik.io_ingressroutes.yaml delete mode 100644 cloudflared-6.0.4/charts/common/crds/traefik.io_ingressroutetcps.yaml delete mode 100644 cloudflared-6.0.4/charts/common/crds/traefik.io_ingressrouteudps.yaml delete mode 100644 cloudflared-6.0.4/charts/common/crds/traefik.io_middlewares.yaml delete mode 100644 cloudflared-6.0.4/charts/common/crds/traefik.io_middlewaretcps.yaml delete mode 100644 cloudflared-6.0.4/charts/common/crds/traefik.io_serverstransports.yaml delete mode 100644 cloudflared-6.0.4/charts/common/crds/traefik.io_tlsoptions.yaml delete mode 100644 cloudflared-6.0.4/charts/common/crds/traefik.io_tlsstores.yaml delete mode 100644 cloudflared-6.0.4/charts/common/crds/traefik.io_traefikservices.yaml delete mode 100644 cloudflared-6.0.4/charts/common/templates/addons/code-server/_codeserver.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/addons/code-server/_container.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/addons/netshoot/_container.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/addons/netshoot/_netshoot.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/addons/vpn/_configmap.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/addons/vpn/_gluetunContainer.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/addons/vpn/_openvpnContainer.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/addons/vpn/_secret.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/addons/vpn/_tailscaleContainer.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/addons/vpn/_volume.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/addons/vpn/_vpn.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/addons/vpn/_wireguardContainer.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_certificate.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_cnpgCluster.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_cnpgPooler.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_configmap.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_cronjob.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_daemonset.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_deployment.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_endpoint.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_endpointSlice.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_horizontalPodAutoscaler.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_ingress.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_job.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_mutatingWebhookConfiguration.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_networkAttachmentDefinition.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_networkPolicy.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_podDisruptionBudget.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_podMonitor.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_prometheusRule.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_pvc.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_rbac.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_route.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_secret.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_service.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_serviceAccount.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_serviceMonitor.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_statefulset.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/class/_validatingWebhookConfiguration.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/helpers/_envDupeCheck.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/helpers/_getPortRange.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/helpers/_getSelectedPod.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/helpers/_getSelectedService.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/helpers/_makeIntOrNoop.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/_tc_capabilities.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/chart/_names.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/chart/_notes.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/cnpg/_poolerMetrics.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/cnpg/_urlsSecret.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/cnpg/_userSecret.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/configmap/_validation.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/container/_args.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/container/_command.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/container/_env.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/container/_envFrom.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/container/_envList.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/container/_fixedEnv.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/container/_imageSelector.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/container/_lifecycle.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/container/_ports.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/container/_primaryValidation.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/container/_probes.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/container/_resources.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/container/_securityContext.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/container/_termination.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/container/_volumeMounts.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/container/probe-lifecycle-actions/_exec.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/container/probe-lifecycle-actions/_grpc.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/container/probe-lifecycle-actions/_httpGet.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/container/probe-lifecycle-actions/_tcpSocket.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/dependencies/_clickhouseInjector.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/dependencies/_dbWait.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/dependencies/_mariadbInjector.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/dependencies/_mongodbInjector.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/dependencies/_redisInjector.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/dependencies/_solrInjector.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/endpoint/_addresses.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/endpoint/_ports.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/endpointSlice/_endpoints.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/endpointSlice/_ports.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/externalInterface/_validation.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/imagePullSecret/_createData.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/imagePullSecret/_validation.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/metadata/_allAnnotations.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/metadata/_allLabels.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/metadata/_externalInterfaceAnnotations.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/metadata/_globalAnnotations.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/metadata/_globalLabels.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/metadata/_namespace.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/metadata/_podAnnotations.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/metadata/_podLabels.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/metadata/_render.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/metadata/_selectorLabels.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/metadata/_validation.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/_autoMountServiceAccountToken.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/_container.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/_containerSpawner.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/_dns.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/_enableServiceLinks.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/_hostAliases.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/_hostNetwork.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/_hostPID.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/_hostname.tpl.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/_imagePullSecret.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/_initContainerSpawner.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/_nodeSelector.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/_podSecurityContext.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/_priorityClassName.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/_restartPolicy.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/_runtimeClassName.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/_schedulerName.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/_serviceAccountName.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/_shareProcessNamespace.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/_terminationGracePeriodSeconds.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/_tolerations.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/_volumes.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_configmap.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_device.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_emptyDir.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_hostPath.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_ixVolume.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_nfs.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_pvc.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_secret.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/podDistruptionBudget/_validation.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/rbac/_getServiceAccounts.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/rbac/_rules.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/rbac/_subjects.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/rbac/_validation.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/scaleCertificate/_getData.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/scaleCertificate/_validation.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/secret/_validation.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/service/_additionalAnnotations.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/service/_ports.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/service/_validation.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_cluster_ip.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_externalIPs.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_externalTrafficPolicy.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_ipFamily.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_publishNotReadyAddresses.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_sessionAffinity.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeSpecs/_clusterIP.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeSpecs/_externalIP.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeSpecs/_externalName.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeSpecs/_loadBalancer.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeSpecs/_nodePort.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/serviceAccount/_validation.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/storage/_accessModes.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/storage/_storageClassName.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/storage/_validation.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/storage/_volumeClaimTemplates.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/util/_autoperms.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/util/_chartcontext.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/util/_primary_cnpg.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/util/_primary_ingress.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/util/_primary_metrics.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/util/_primary_port.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/util/_primary_route.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/util/_primary_service.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/util/_primary_workload.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/util/_register_operator.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/util/_verify_operator.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/webhook/_admissionReviewVersions.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/webhook/_clientConfig.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/webhook/_rules.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/webhook/_validation.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/webhook/_webhook.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/workload/_cronjobSpec.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/workload/_daemonsetSpec.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/workload/_deploymentSpec.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/workload/_jobSpec.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/workload/_pod.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/workload/_statefulsetSpec.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_cronjobValidation.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_daemonsetValidation.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_deploymentValidation.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_jobValidation.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_statefusetValidation.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_workloadValidation.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/loader/_all.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/loader/_apply.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/loader/_init.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/loader/_lists.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/spawner/_certificate.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/spawner/_cnpg.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/spawner/_configmap.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/spawner/_externalInterface.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/spawner/_extraTpl.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/spawner/_horizontalPodAutoscaler.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/spawner/_imagePullSecret.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/spawner/_ingress.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/spawner/_metrics.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/spawner/_networkPolicy.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/spawner/_podDisruptionBudget.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/spawner/_portal.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/spawner/_pvc.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/spawner/_rbac.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/spawner/_route.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/spawner/_scaleCertificate.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/spawner/_secret.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/spawner/_service.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/spawner/_serviceAccount.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/spawner/_webhook.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/spawner/_workload.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/values/_init.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/values/_validate.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/values/lists/_deviceList.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/values/lists/_persistenceList.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/values/lists/_portList.tpl delete mode 100644 cloudflared-6.0.4/charts/common/templates/values/lists/_serviceList.tpl delete mode 100644 cloudflared-6.0.4/charts/common/values.yaml delete mode 100644 cloudflared-6.0.4/ci/test-values.yaml delete mode 100644 cloudflared-6.0.4/questions.yaml delete mode 100644 cloudflared-6.0.4/templates/common.yaml delete mode 100644 cloudflared-6.0.4/values.home.yaml delete mode 100644 cloudflared-6.0.4/values.yaml rename {cloudflared-6.0.4/charts/common => postgres-operator}/.helmignore (95%) create mode 100644 postgres-operator/Chart.yaml create mode 100644 postgres-operator/crds/operatorconfigurations.yaml create mode 100644 postgres-operator/crds/postgresqls.yaml create mode 100644 postgres-operator/crds/postgresteams.yaml create mode 100644 postgres-operator/index.yaml create mode 100644 postgres-operator/templates/NOTES.txt create mode 100644 postgres-operator/templates/_helpers.tpl create mode 100644 postgres-operator/templates/clusterrole-postgres-pod.yaml create mode 100644 postgres-operator/templates/clusterrole.yaml create mode 100644 postgres-operator/templates/clusterrolebinding.yaml create mode 100644 postgres-operator/templates/configmap.yaml create mode 100644 postgres-operator/templates/deployment.yaml create mode 100644 postgres-operator/templates/operatorconfiguration.yaml create mode 100644 postgres-operator/templates/postgres-pod-priority-class.yaml create mode 100644 postgres-operator/templates/service.yaml create mode 100644 postgres-operator/templates/serviceaccount.yaml create mode 100644 postgres-operator/templates/user-facing-clusterroles.yaml create mode 100644 postgres-operator/values.home.yaml create mode 100644 postgres-operator/values.yaml diff --git a/cloudflared-6.0.4/.helmignore b/cloudflared-6.0.4/.helmignore deleted file mode 100644 index 77ca556..0000000 --- a/cloudflared-6.0.4/.helmignore +++ /dev/null @@ -1,30 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ -# OWNERS file for Kubernetes -OWNERS -# helm-docs templates -*.gotmpl -# docs folder -/docs -# icon -icon.png diff --git a/cloudflared-6.0.4/CHANGELOG.md b/cloudflared-6.0.4/CHANGELOG.md deleted file mode 100644 index 34de3f6..0000000 --- a/cloudflared-6.0.4/CHANGELOG.md +++ /dev/null @@ -1,939 +0,0 @@ -# Changelog - - - -## [cloudflared-2.0.0](https://github.com/truecharts/charts/compare/cloudflared-1.0.28...cloudflared-2.0.0) (2022-11-10) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Major Change to GUI - - update helm general non-major ([#4329](https://github.com/truecharts/charts/issues/4329)) - - update helm general non-major ([#4349](https://github.com/truecharts/charts/issues/4349)) - - update helm general non-major ([#4342](https://github.com/truecharts/charts/issues/4342)) - - ### Fix - -- change container config label - - remove persistence on GUI aswell ([#4324](https://github.com/truecharts/charts/issues/4324)) - - - - -## [cloudflared-1.0.32](https://github.com/truecharts/charts/compare/cloudflared-1.0.28...cloudflared-1.0.32) (2022-11-08) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - update helm general non-major ([#4349](https://github.com/truecharts/charts/issues/4349)) - - update helm general non-major ([#4329](https://github.com/truecharts/charts/issues/4329)) - - update helm general non-major ([#4342](https://github.com/truecharts/charts/issues/4342)) - - ### Fix - -- remove persistence on GUI aswell ([#4324](https://github.com/truecharts/charts/issues/4324)) - - - - -## [cloudflared-1.0.31](https://github.com/truecharts/charts/compare/cloudflared-1.0.28...cloudflared-1.0.31) (2022-11-08) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - update helm general non-major ([#4329](https://github.com/truecharts/charts/issues/4329)) - - update helm general non-major ([#4342](https://github.com/truecharts/charts/issues/4342)) - - ### Fix - -- remove persistence on GUI aswell ([#4324](https://github.com/truecharts/charts/issues/4324)) - - - - -## [cloudflared-1.0.31](https://github.com/truecharts/charts/compare/cloudflared-1.0.28...cloudflared-1.0.31) (2022-11-08) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - update helm general non-major ([#4329](https://github.com/truecharts/charts/issues/4329)) - - update helm general non-major ([#4342](https://github.com/truecharts/charts/issues/4342)) - - ### Fix - -- remove persistence on GUI aswell ([#4324](https://github.com/truecharts/charts/issues/4324)) - - - - -## [cloudflared-1.0.31](https://github.com/truecharts/charts/compare/cloudflared-1.0.28...cloudflared-1.0.31) (2022-11-08) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - update helm general non-major ([#4329](https://github.com/truecharts/charts/issues/4329)) - - update helm general non-major ([#4342](https://github.com/truecharts/charts/issues/4342)) - - ### Fix - -- remove persistence on GUI aswell ([#4324](https://github.com/truecharts/charts/issues/4324)) - - - - -## [cloudflared-1.0.30](https://github.com/truecharts/charts/compare/cloudflared-1.0.28...cloudflared-1.0.30) (2022-11-07) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - update helm general non-major ([#4329](https://github.com/truecharts/charts/issues/4329)) - - ### Fix - -- remove persistence on GUI aswell ([#4324](https://github.com/truecharts/charts/issues/4324)) - - - - -## [cloudflared-1.0.30](https://github.com/truecharts/charts/compare/cloudflared-1.0.28...cloudflared-1.0.30) (2022-11-06) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - update helm general non-major ([#4329](https://github.com/truecharts/charts/issues/4329)) - - ### Fix - -- remove persistence on GUI aswell ([#4324](https://github.com/truecharts/charts/issues/4324)) - - - - -## [cloudflared-1.0.29](https://github.com/truecharts/charts/compare/cloudflared-1.0.28...cloudflared-1.0.29) (2022-11-06) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - ### Fix - -- remove persistence on GUI aswell ([#4324](https://github.com/truecharts/charts/issues/4324)) - - - - -## [cloudflared-1.0.29](https://github.com/truecharts/charts/compare/cloudflared-1.0.28...cloudflared-1.0.29) (2022-11-06) - -### Chore - -- Auto-update chart README [skip ci] - - ### Fix - -- remove persistence on GUI aswell ([#4324](https://github.com/truecharts/charts/issues/4324)) - - - - -## [cloudflared-1.0.28](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.33...cloudflared-1.0.28) (2022-11-06) - -### Chore - -- Auto-update chart README [skip ci] - - update helm general non-major ([#4317](https://github.com/truecharts/charts/issues/4317)) - - - - -## [cloudflared-1.0.27](https://github.com/truecharts/charts/compare/cloudflared-1.0.26...cloudflared-1.0.27) (2022-11-05) - -### Chore - -- Auto-update chart README [skip ci] - - update helm general non-major ([#4308](https://github.com/truecharts/charts/issues/4308)) - - - - -## [cloudflared-1.0.26](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.32...cloudflared-1.0.26) (2022-11-03) - -### Chore - -- Auto-update chart README [skip ci] - - - - -## [cloudflared-1.0.25](https://github.com/truecharts/charts/compare/cloudflared-1.0.24...cloudflared-1.0.25) (2022-11-02) - -### Chore - -- Auto-update chart README [skip ci] - - update helm general non-major ([#4261](https://github.com/truecharts/charts/issues/4261)) - - - - -## [cloudflared-1.0.24](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.31...cloudflared-1.0.24) (2022-10-27) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - update docker general non-major ([#4201](https://github.com/truecharts/charts/issues/4201)) - - - - -## [cloudflared-1.0.24](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.31...cloudflared-1.0.24) (2022-10-27) - -### Chore - -- Auto-update chart README [skip ci] - - update docker general non-major ([#4201](https://github.com/truecharts/charts/issues/4201)) - - - - -## [cloudflared-1.0.23](https://github.com/truecharts/charts/compare/cloudflared-1.0.22...cloudflared-1.0.23) (2022-10-25) - -### Chore - -- Auto-update chart README [skip ci] - - update helm general non-major ([#4182](https://github.com/truecharts/charts/issues/4182)) - - - - -## [cloudflared-1.0.22](https://github.com/truecharts/charts/compare/cloudflared-1.0.21...cloudflared-1.0.22) (2022-10-21) - -### Chore - -- Auto-update chart README [skip ci] - - update docker general non-major ([#4139](https://github.com/truecharts/charts/issues/4139)) - - - - -## [cloudflared-1.0.21](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.29...cloudflared-1.0.21) (2022-10-19) - -### Chore - -- Auto-update chart README [skip ci] - - update helm general non-major ([#4122](https://github.com/truecharts/charts/issues/4122)) - - - - -## [cloudflared-1.0.20](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.28...cloudflared-1.0.20) (2022-10-12) - -### Chore - -- Auto-update chart README [skip ci] - - update helm general non-major ([#4071](https://github.com/truecharts/charts/issues/4071)) - - - - -## [cloudflared-1.0.19](https://github.com/truecharts/charts/compare/cloudflared-1.0.18...cloudflared-1.0.19) (2022-10-07) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - update helm general non-major - - - - -## [cloudflared-1.0.19](https://github.com/truecharts/charts/compare/cloudflared-1.0.18...cloudflared-1.0.19) (2022-10-07) - -### Chore - -- Auto-update chart README [skip ci] - - update helm general non-major - - - - -## [cloudflared-1.0.18](https://github.com/truecharts/charts/compare/cloudflared-1.0.17...cloudflared-1.0.18) (2022-10-05) - -### Chore - -- Auto-update chart README [skip ci] - - split addons in smaller templates ([#3979](https://github.com/truecharts/charts/issues/3979)) - - update helm general non-major - - - - -## [cloudflared-1.0.17](https://github.com/truecharts/charts/compare/cloudflared-1.0.16...cloudflared-1.0.17) (2022-09-27) - -### Chore - -- Auto-update chart README [skip ci] - - update helm general non-major ([#3918](https://github.com/truecharts/charts/issues/3918)) - - - - -## [cloudflared-1.0.16](https://github.com/truecharts/charts/compare/cloudflared-1.0.15...cloudflared-1.0.16) (2022-09-25) - -### Chore - -- Auto-update chart README [skip ci] - - update helm general non-major ([#3898](https://github.com/truecharts/charts/issues/3898)) - - - - -## [cloudflared-1.0.15](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.20...cloudflared-1.0.15) (2022-09-22) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - refactor Services SCALE GUI - - update helm general non-major ([#3767](https://github.com/truecharts/charts/issues/3767)) - - split serviceSelector ([#3751](https://github.com/truecharts/charts/issues/3751)) - - - - -## [cloudflared-1.0.15](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.20...cloudflared-1.0.15) (2022-09-21) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - refactor Services SCALE GUI - - update helm general non-major ([#3767](https://github.com/truecharts/charts/issues/3767)) - - split serviceSelector ([#3751](https://github.com/truecharts/charts/issues/3751)) - - - - -## [cloudflared-1.0.15](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.20...cloudflared-1.0.15) (2022-09-21) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - refactor Services SCALE GUI - - update helm general non-major ([#3767](https://github.com/truecharts/charts/issues/3767)) - - split serviceSelector ([#3751](https://github.com/truecharts/charts/issues/3751)) - - - - -## [cloudflared-1.0.15](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.20...cloudflared-1.0.15) (2022-09-20) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - refactor Services SCALE GUI - - update helm general non-major ([#3767](https://github.com/truecharts/charts/issues/3767)) - - split serviceSelector ([#3751](https://github.com/truecharts/charts/issues/3751)) - - - - -## [cloudflared-1.0.15](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.20...cloudflared-1.0.15) (2022-09-20) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - refactor Services SCALE GUI - - update helm general non-major ([#3767](https://github.com/truecharts/charts/issues/3767)) - - split serviceSelector ([#3751](https://github.com/truecharts/charts/issues/3751)) - - - - -## [cloudflared-1.0.15](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.20...cloudflared-1.0.15) (2022-09-19) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - refactor Services SCALE GUI - - update helm general non-major ([#3767](https://github.com/truecharts/charts/issues/3767)) - - split serviceSelector ([#3751](https://github.com/truecharts/charts/issues/3751)) - - - - -## [cloudflared-1.0.15](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.20...cloudflared-1.0.15) (2022-09-19) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - refactor Services SCALE GUI - - update helm general non-major ([#3767](https://github.com/truecharts/charts/issues/3767)) - - split serviceSelector ([#3751](https://github.com/truecharts/charts/issues/3751)) - - - - -## [cloudflared-1.0.15](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.20...cloudflared-1.0.15) (2022-09-19) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - refactor Services SCALE GUI - - update helm general non-major ([#3767](https://github.com/truecharts/charts/issues/3767)) - - split serviceSelector ([#3751](https://github.com/truecharts/charts/issues/3751)) - - - - -## [cloudflared-1.0.15](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.20...cloudflared-1.0.15) (2022-09-17) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - refactor Services SCALE GUI - - update helm general non-major ([#3767](https://github.com/truecharts/charts/issues/3767)) - - split serviceSelector ([#3751](https://github.com/truecharts/charts/issues/3751)) - - - - -## [cloudflared-1.0.15](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.20...cloudflared-1.0.15) (2022-09-18) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - update helm general non-major ([#3767](https://github.com/truecharts/charts/issues/3767)) - - split serviceSelector ([#3751](https://github.com/truecharts/charts/issues/3751)) - - - - -## [cloudflared-1.0.15](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.20...cloudflared-1.0.15) (2022-09-16) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - update helm general non-major ([#3767](https://github.com/truecharts/charts/issues/3767)) - - split serviceSelector ([#3751](https://github.com/truecharts/charts/issues/3751)) - - - - -## [cloudflared-1.0.15](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.20...cloudflared-1.0.15) (2022-09-16) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - update helm general non-major ([#3767](https://github.com/truecharts/charts/issues/3767)) - - split serviceSelector ([#3751](https://github.com/truecharts/charts/issues/3751)) - - - - -## [cloudflared-1.0.15](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.20...cloudflared-1.0.15) (2022-09-15) - -### Chore - -- Auto-update chart README [skip ci] - - update helm general non-major ([#3767](https://github.com/truecharts/charts/issues/3767)) - - split serviceSelector ([#3751](https://github.com/truecharts/charts/issues/3751)) - - - - -## [cloudflared-1.0.15](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.20...cloudflared-1.0.15) (2022-09-15) - -### Chore - -- update helm general non-major ([#3767](https://github.com/truecharts/charts/issues/3767)) - - split serviceSelector ([#3751](https://github.com/truecharts/charts/issues/3751)) - - - - -## [cloudflared-1.0.14](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.19...cloudflared-1.0.14) (2022-09-12) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - update helm general non-major ([#3711](https://github.com/truecharts/charts/issues/3711)) - - - - -## [cloudflared-1.0.14](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.19...cloudflared-1.0.14) (2022-09-12) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - update helm general non-major ([#3711](https://github.com/truecharts/charts/issues/3711)) - - - - -## [cloudflared-1.0.14](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.19...cloudflared-1.0.14) (2022-09-11) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - update helm general non-major ([#3711](https://github.com/truecharts/charts/issues/3711)) - - - - -## [cloudflared-1.0.14](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.19...cloudflared-1.0.14) (2022-09-11) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - update helm general non-major ([#3711](https://github.com/truecharts/charts/issues/3711)) - - - - -## [cloudflared-1.0.14](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.19...cloudflared-1.0.14) (2022-09-11) - -### Chore - -- Auto-update chart README [skip ci] - - update helm general non-major ([#3711](https://github.com/truecharts/charts/issues/3711)) - - - - -## [cloudflared-1.0.14](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.19...cloudflared-1.0.14) (2022-09-11) - -### Chore - -- update helm general non-major ([#3711](https://github.com/truecharts/charts/issues/3711)) - - - - -## [cloudflared-1.0.13](https://github.com/truecharts/charts/compare/cloudflared-1.0.12...cloudflared-1.0.13) (2022-08-30) - -### Chore - -- update helm general non-major ([#3639](https://github.com/truecharts/charts/issues/3639)) - - - - -## [cloudflared-1.0.12](https://github.com/truecharts/charts/compare/cloudflared-1.0.11...cloudflared-1.0.12) (2022-08-30) - -### Chore - -- update helm chart common to v10.5.5 ([#3626](https://github.com/truecharts/charts/issues/3626)) - - - - -## [cloudflared-1.0.11](https://github.com/truecharts/charts/compare/cloudflared-1.0.10...cloudflared-1.0.11) (2022-08-29) - -### Chore - -- update helm general non-major ([#3619](https://github.com/truecharts/charts/issues/3619)) - - - - -## [cloudflared-1.0.10](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.15...cloudflared-1.0.10) (2022-08-28) - -### Fix - -- update the docs. ([#3602](https://github.com/truecharts/charts/issues/3602)) - - - - -## [cloudflared-1.0.9](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.14...cloudflared-1.0.9) (2022-08-23) - -### Chore - -- update helm general non-major helm releases ([#3545](https://github.com/truecharts/charts/issues/3545)) - - - - -## [cloudflared-1.0.8](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.13...cloudflared-1.0.8) (2022-08-14) - -### Chore - -- update docker general non-major docker tags ([#3465](https://github.com/truecharts/charts/issues/3465)) - - - - -## [cloudflared-1.0.7](https://github.com/truecharts/charts/compare/cloudflareddns-1.0.12...cloudflared-1.0.7) (2022-08-12) - -### Chore - -- update helm general non-major helm releases ([#3456](https://github.com/truecharts/charts/issues/3456)) - - - - -## [cloudflared-1.0.6](https://github.com/truecharts/charts/compare/cloudflared-1.0.5...cloudflared-1.0.6) (2022-08-08) - -### Chore - -- update helm general non-major helm releases ([#3376](https://github.com/truecharts/charts/issues/3376)) - - replace questions parts with templates ([#3402](https://github.com/truecharts/charts/issues/3402)) - - - - -## [cloudflared-1.0.5](https://github.com/truecharts/apps/compare/cloudflared-1.0.4...cloudflared-1.0.5) (2022-07-26) - -### Chore - -- update home links ([#3291](https://github.com/truecharts/apps/issues/3291)) - - update helm general non-major helm releases ([#3302](https://github.com/truecharts/apps/issues/3302)) - - - - -## [cloudflared-1.0.4](https://github.com/truecharts/apps/compare/cloudflareddns-1.0.7...cloudflared-1.0.4) (2022-07-25) - -### Chore - -- Auto-update chart README [skip ci] - - update docker general non-major ([#3295](https://github.com/truecharts/apps/issues/3295)) - - - - -## [cloudflared-1.0.4](https://github.com/truecharts/apps/compare/cloudflareddns-1.0.7...cloudflared-1.0.4) (2022-07-25) - -### Chore - -- update docker general non-major ([#3295](https://github.com/truecharts/apps/issues/3295)) - - - - -## [cloudflared-1.0.3](https://github.com/truecharts/apps/compare/cloudflareddns-1.0.6...cloudflared-1.0.3) (2022-07-23) - -### Chore - -- Auto-update chart README [skip ci] - - Auto-update chart README [skip ci] - - update helm general non-major helm releases ([#3280](https://github.com/truecharts/apps/issues/3280)) - - - - -## [cloudflared-1.0.3](https://github.com/truecharts/apps/compare/cloudflareddns-1.0.6...cloudflared-1.0.3) (2022-07-23) - -### Chore - -- Auto-update chart README [skip ci] - - update helm general non-major helm releases ([#3280](https://github.com/truecharts/apps/issues/3280)) - - - - -## [cloudflared-1.0.3](https://github.com/truecharts/apps/compare/cloudflareddns-1.0.6...cloudflared-1.0.3) (2022-07-23) - -### Chore - -- update helm general non-major helm releases ([#3280](https://github.com/truecharts/apps/issues/3280)) - - - - -## [cloudflared-1.0.2](https://github.com/truecharts/apps/compare/cloudflared-1.0.0...cloudflared-1.0.2) (2022-07-22) - -### Chore - -- Bump all charts to generate config and container references due to huge increase of repository - - update helm general non-major helm releases ([#3268](https://github.com/truecharts/apps/issues/3268)) - - - -## [cloudflared-1.0.0](https://github.com/truecharts/apps/compare/cloudflareddns-1.0.4...cloudflared-1.0.0) (2022-07-21) - -### Chore - -- Auto-update chart README [skip ci] -- Auto-update chart README [skip ci] - -### Fix - -- move to stable updated docs ([#3237](https://github.com/truecharts/apps/issues/3237)) - - - -## [cloudflared-1.0.0](https://github.com/truecharts/apps/compare/cloudflareddns-1.0.4...cloudflared-1.0.0) (2022-07-21) - -### Chore - -- Auto-update chart README [skip ci] - -### Fix - -- move to stable updated docs ([#3237](https://github.com/truecharts/apps/issues/3237)) - - - -## [cloudflared-1.0.0](https://github.com/truecharts/apps/compare/cloudflareddns-1.0.4...cloudflared-1.0.0) (2022-07-21) - -### Fix - -- move to stable updated docs ([#3237](https://github.com/truecharts/apps/issues/3237)) - - - -## [cloudflared-0.0.17](https://github.com/truecharts/apps/compare/cloudflareddns-1.0.2...cloudflared-0.0.17) (2022-07-19) - -### Chore - -- Update Readme and Description on SCALE - - - -## [cloudflared-0.0.16](https://github.com/truecharts/apps/compare/cloudflareddns-0.0.15...cloudflared-0.0.16) (2022-07-17) - -### Chore - -- extend linter and apply lint ([#3200](https://github.com/truecharts/apps/issues/3200)) - -### Feat - -- Add installation_notes for cloudflared ([#3196](https://github.com/truecharts/apps/issues/3196)) - - - -## [cloudflared-0.0.15](https://github.com/truecharts/apps/compare/cloudflareddns-0.0.14...cloudflared-0.0.15) (2022-07-14) - -### Fix - -- regenerate catalog and update template - - - -## [cloudflared-0.0.14](https://github.com/truecharts/apps/compare/cloudflareddns-0.0.12...cloudflared-0.0.14) (2022-07-14) - -### Fix - -- bump to ensure .helmignore is present on all Charts - - - -## [cloudflared-0.0.12](https://github.com/truecharts/apps/compare/cloudflareddns-0.0.10...cloudflared-0.0.12) (2022-07-12) - -### Chore - -- update icons ([#3156](https://github.com/truecharts/apps/issues/3156)) -- bump to cleanup old docs and use correct icon urls - - - -## [cloudflared-0.0.10](https://github.com/truecharts/apps/compare/cloudflareddns-0.0.9...cloudflared-0.0.10) (2022-07-12) - -### Chore - -- bump to regenerate documentation - - - - -### [cloudflared-0.0.9](https://github.com/truecharts/apps/compare/cloudflareddns-0.0.8...cloudflared-0.0.9) (2022-07-12) - -#### Chore - -* update helm general non-major helm releases ([#3147](https://github.com/truecharts/apps/issues/3147)) - - - - -### [cloudflared-0.0.8](https://github.com/truecharts/apps/compare/cloudflareddns-0.0.7...cloudflared-0.0.8) (2022-07-11) - -#### Chore - -* move icons into the apps folder ([#3139](https://github.com/truecharts/apps/issues/3139)) - - - - -### [cloudflared-0.0.7](https://github.com/truecharts/apps/compare/cloudflareddns-0.0.6...cloudflared-0.0.7) (2022-07-11) - -#### Chore - -* update image refs ([#3135](https://github.com/truecharts/apps/issues/3135)) - - - - -### [cloudflared-0.0.6](https://github.com/truecharts/apps/compare/cloudflared-0.0.5...cloudflared-0.0.6) (2022-07-09) - -#### Chore - -* update helm general non-major helm releases ([#3113](https://github.com/truecharts/apps/issues/3113)) - - - - -### [cloudflared-0.0.5](https://github.com/truecharts/apps/compare/cloudflared-0.0.4...cloudflared-0.0.5) (2022-07-09) - -#### Chore - -* combine some ports ([#3096](https://github.com/truecharts/apps/issues/3096)) - - - - -### [cloudflared-0.0.4](https://github.com/truecharts/apps/compare/cloudflared-0.0.3...cloudflared-0.0.4) (2022-07-07) - -#### Chore - -* update docker general non-major ([#3089](https://github.com/truecharts/apps/issues/3089)) - - - - -### [cloudflared-0.0.3](https://github.com/truecharts/apps/compare/cloudflareddns-0.0.4...cloudflared-0.0.3) (2022-07-06) - -#### Chore - -* update docker general non-major ([#3078](https://github.com/truecharts/apps/issues/3078)) - - - - -### [cloudflared-0.0.2](https://github.com/truecharts/apps/compare/cloudflareddns-0.0.3...cloudflared-0.0.2) (2022-07-04) - -#### Chore - -* update helm general non-major helm releases ([#3066](https://github.com/truecharts/apps/issues/3066)) - - - - -### [cloudflared-0.0.1](https://github.com/truecharts/apps/compare/cloudflareddns-0.0.1...cloudflared-0.0.1) (2022-07-02) - -#### Feat - -* add cloudflared ([#3029](https://github.com/truecharts/apps/issues/3029)) diff --git a/cloudflared-6.0.4/Chart.lock b/cloudflared-6.0.4/Chart.lock deleted file mode 100644 index a30db9d..0000000 --- a/cloudflared-6.0.4/Chart.lock +++ /dev/null @@ -1,6 +0,0 @@ -dependencies: -- name: common - repository: https://library-charts.truecharts.org - version: 14.0.6 -digest: sha256:df8345d83abf40d549397019a3910f2b06630fdcbdbd02a790a0e60bac8b7139 -generated: "2023-09-05T03:53:33.985985835Z" diff --git a/cloudflared-6.0.4/Chart.yaml b/cloudflared-6.0.4/Chart.yaml deleted file mode 100644 index c20eeaa..0000000 --- a/cloudflared-6.0.4/Chart.yaml +++ /dev/null @@ -1,28 +0,0 @@ -annotations: - truecharts.org/SCALE-support: "true" - truecharts.org/catagories: | - - network - truecharts.org/grade: U -apiVersion: v2 -appVersion: 2023.8.2 -dependencies: -- name: common - repository: https://library-charts.truecharts.org - version: 14.0.6 -description: Client for Cloudflare Tunnel, a daemon that exposes private services - through the Cloudflare edge. -home: https://truecharts.org/charts/stable/cloudflared -icon: https://truecharts.org/img/hotlink-ok/chart-icons/cloudflared.png -keywords: -- cloudflared -- networking -kubeVersion: '>=1.16.0-0' -maintainers: -- email: info@truecharts.org - name: TrueCharts - url: https://truecharts.org -name: cloudflared -sources: -- https://github.com/truecharts/charts/tree/master/charts/stable/cloudflared -type: application -version: 6.0.4 diff --git a/cloudflared-6.0.4/README.md b/cloudflared-6.0.4/README.md deleted file mode 100644 index e0a9b8f..0000000 --- a/cloudflared-6.0.4/README.md +++ /dev/null @@ -1,27 +0,0 @@ -# README - -## General Info - -TrueCharts can be installed as both *normal* Helm Charts or as Apps on TrueNAS SCALE. -However only installations using the TrueNAS SCALE Apps system are supported. - -For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/stable/) - -**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)** - - -## Support - -- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro). -- See the [Website](https://truecharts.org) -- Check our [Discord](https://discord.gg/tVsPTHWTtr) -- Open a [issue](https://github.com/truecharts/charts/issues/new/choose) - ---- - -## Sponsor TrueCharts - -TrueCharts can only exist due to the incredible effort of our staff. -Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can! - -*All Rights Reserved - The TrueCharts Project* diff --git a/cloudflared-6.0.4/charts/common/Chart.yaml b/cloudflared-6.0.4/charts/common/Chart.yaml deleted file mode 100644 index 31aa761..0000000 --- a/cloudflared-6.0.4/charts/common/Chart.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: v2 -appVersion: latest -description: Function library for TrueCharts -home: https://github.com/truecharts/apps/tree/master/charts/common -icon: https://avatars.githubusercontent.com/u/76400755 -keywords: -- truecharts -- library-chart -- common -kubeVersion: '>=1.16.0-0' -maintainers: -- email: info@truecharts.org - name: TrueCharts - url: https://truecharts.org -name: common -type: library -version: 14.0.6 diff --git a/cloudflared-6.0.4/charts/common/LICENSE b/cloudflared-6.0.4/charts/common/LICENSE deleted file mode 100644 index 4ce034b..0000000 --- a/cloudflared-6.0.4/charts/common/LICENSE +++ /dev/null @@ -1,106 +0,0 @@ -Business Source License 1.1 - -Parameters - -Licensor: The TrueCharts Project, it's owner and it's contributors -Licensed Work: The TrueCharts "Common" Helm Chart -Additional Use Grant: You may use the licensed work in production, as long - as it is directly sourced from a TrueCharts provided - official repository, catalog or source. You may also make private - modification to the directly sourced licenced work, - when used in production. - - The following cases are, due to their nature, also - defined as 'production use' and explicitly prohibited: - - Bundling, including or displaying the licensed work - with(in) another work intended for production use, - with the apparent intend of facilitating and/or - promoting production use by third parties in - violation of this license. - -Change Date: 2050-01-01 - -Change License: 3-clause BSD license - -For information about alternative licensing arrangements for the Software, -please contact: legal@truecharts.org - -Notice - -The Business Source License (this document, or the “License”) is not an Open -Source license. However, the Licensed Work will eventually be made available -under an Open Source License, as stated in this License. - -License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved. -“Business Source License” is a trademark of MariaDB Corporation Ab. - ------------------------------------------------------------------------------ - -Business Source License 1.1 - -Terms - -The Licensor hereby grants you the right to copy, modify, create derivative -works, redistribute, and make non-production use of the Licensed Work. The -Licensor may make an Additional Use Grant, above, permitting limited -production use. - -Effective on the Change Date, or the fourth anniversary of the first publicly -available distribution of a specific version of the Licensed Work under this -License, whichever comes first, the Licensor hereby grants you rights under -the terms of the Change License, and the rights granted in the paragraph -above terminate. - -If your use of the Licensed Work does not comply with the requirements -currently in effect as described in this License, you must purchase a -commercial license from the Licensor, its affiliated entities, or authorized -resellers, or you must refrain from using the Licensed Work. - -All copies of the original and modified Licensed Work, and derivative works -of the Licensed Work, are subject to this License. This License applies -separately for each version of the Licensed Work and the Change Date may vary -for each version of the Licensed Work released by Licensor. - -You must conspicuously display this License on each original or modified copy -of the Licensed Work. If you receive the Licensed Work in original or -modified form from a third party, the terms and conditions set forth in this -License apply to your use of that work. - -Any use of the Licensed Work in violation of this License will automatically -terminate your rights under this License for the current and all other -versions of the Licensed Work. - -This License does not grant you any right in any trademark or logo of -Licensor or its affiliates (provided that you may use a trademark or logo of -Licensor as expressly required by this License). - -TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON -AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS, -EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF -MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND -TITLE. - -MariaDB hereby grants you permission to use this License’s text to license -your works, and to refer to it using the trademark “Business Source License”, -as long as you comply with the Covenants of Licensor below. - -Covenants of Licensor - -In consideration of the right to use this License’s text and the “Business -Source License” name and trademark, Licensor covenants to MariaDB, and to all -other recipients of the licensed work to be provided by Licensor: - -1. To specify as the Change License the GPL Version 2.0 or any later version, - or a license that is compatible with GPL Version 2.0 or a later version, - where “compatible” means that software provided under the Change License can - be included in a program with software provided under GPL Version 2.0 or a - later version. Licensor may specify additional Change Licenses without - limitation. - -2. To either: (a) specify an additional grant of rights to use that does not - impose any additional restriction on the right granted in this License, as - the Additional Use Grant; or (b) insert the text “None”. - -3. To specify a Change Date. - -4. Not to modify this License in any other way. diff --git a/cloudflared-6.0.4/charts/common/README.md b/cloudflared-6.0.4/charts/common/README.md deleted file mode 100644 index f4615d7..0000000 --- a/cloudflared-6.0.4/charts/common/README.md +++ /dev/null @@ -1,24 +0,0 @@ -# Common Library - -## Naming Scheme - -- ServiceAccount: - - Primary: `$FullName` - - Others: `$FullName-$ServiceAccountName` -- RBAC: - - Primary: `$FullName` - - Others: `$FullName-$RBACName` -- Service: - - Primary: `$FullName` - - Others: `$FullName-$ServiceName` -- Pods: - - Primary: `$FullName` - - Others: `$FullName-$PodName` -- Containers: `$ContainerName` -- ConfigMap: `$FullName-$ConfigMapName` -- Secret: `$FullName-$SecretName` -- Scale Certificate: `$FullName-$CertName` -- Scale External Interface: `ix-$ReleaseName-$index` - -> Full name -> `$ReleaseName-$ChartName` -> Any name that exceeds 63 characters, will throw an error diff --git a/cloudflared-6.0.4/charts/common/crds/cert-manager.crds.yaml b/cloudflared-6.0.4/charts/common/crds/cert-manager.crds.yaml deleted file mode 100644 index 15af8a5..0000000 --- a/cloudflared-6.0.4/charts/common/crds/cert-manager.crds.yaml +++ /dev/null @@ -1,4422 +0,0 @@ -# Copyright 2022 The cert-manager Authors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Source: cert-manager/templates/crds.yaml -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: clusterissuers.cert-manager.io - labels: - app: 'cert-manager' - app.kubernetes.io/name: 'cert-manager' - app.kubernetes.io/instance: 'cert-manager' - # Generated labels - app.kubernetes.io/version: "v1.11.0" -spec: - group: cert-manager.io - names: - kind: ClusterIssuer - listKind: ClusterIssuerList - plural: clusterissuers - singular: clusterissuer - categories: - - cert-manager - scope: Cluster - versions: - - name: v1 - subresources: - status: {} - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message - name: Status - priority: 1 - type: string - - jsonPath: .metadata.creationTimestamp - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - name: Age - type: date - schema: - openAPIV3Schema: - description: A ClusterIssuer represents a certificate issuing authority which can be referenced as part of `issuerRef` fields. It is similar to an Issuer, however it is cluster-scoped and therefore can be referenced by resources that exist in *any* namespace, not just the same namespace as the referent. - type: object - required: - - spec - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: Desired state of the ClusterIssuer resource. - type: object - properties: - acme: - description: ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates. - type: object - required: - - privateKeySecretRef - - server - properties: - caBundle: - description: Base64-encoded bundle of PEM CAs which can be used to validate the certificate chain presented by the ACME server. Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various kinds of security vulnerabilities. If CABundle and SkipTLSVerify are unset, the system certificate bundle inside the container is used to validate the TLS connection. - type: string - format: byte - disableAccountKeyGeneration: - description: Enables or disables generating a new ACME account key. If true, the Issuer resource will *not* request a new account but will expect the account key to be supplied via an existing secret. If false, the cert-manager system will generate a new ACME account key for the Issuer. Defaults to false. - type: boolean - email: - description: Email is the email address to be associated with the ACME account. This field is optional, but it is strongly recommended to be set. It will be used to contact you in case of issues with your account or certificates, including expiry notification emails. This field may be updated after the account is initially registered. - type: string - enableDurationFeature: - description: Enables requesting a Not After date on certificates that matches the duration of the certificate. This is not supported by all ACME servers like Let's Encrypt. If set to true when the ACME server does not support it it will create an error on the Order. Defaults to false. - type: boolean - externalAccountBinding: - description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager will attempt to associate the given external account credentials with the registered ACME account. - type: object - required: - - keyID - - keySecretRef - properties: - keyAlgorithm: - description: 'Deprecated: keyAlgorithm field exists for historical compatibility reasons and should not be used. The algorithm is now hardcoded to HS256 in golang/x/crypto/acme.' - type: string - enum: - - HS256 - - HS384 - - HS512 - keyID: - description: keyID is the ID of the CA key that the External Account is bound to. - type: string - keySecretRef: - description: keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes Secret which holds the symmetric MAC key of the External Account Binding. The `key` is the index string that is paired with the key data in the Secret and should not be confused with the key data itself, or indeed with the External Account Binding keyID above. The secret key stored in the Secret **must** be un-padded, base64 URL encoded data. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - preferredChain: - description: 'PreferredChain is the chain to use if the ACME server outputs multiple. PreferredChain is no guarantee that this one gets delivered by the ACME endpoint. For example, for Let''s Encrypt''s DST crosssign you would use: "DST Root CA X3" or "ISRG Root X1" for the newer Let''s Encrypt root CA. This value picks the first certificate bundle in the ACME alternative chains that has a certificate with this value as its issuer''s CN' - type: string - maxLength: 64 - privateKeySecretRef: - description: PrivateKey is the name of a Kubernetes Secret resource that will be used to store the automatically generated ACME account private key. Optionally, a `key` may be specified to select a specific entry within the named Secret resource. If `key` is not specified, a default of `tls.key` will be used. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - server: - description: 'Server is the URL used to access the ACME server''s ''directory'' endpoint. For example, for Let''s Encrypt''s staging endpoint, you would use: "https://acme-staging-v02.api.letsencrypt.org/directory". Only ACME v2 endpoints (i.e. RFC 8555) are supported.' - type: string - skipTLSVerify: - description: 'INSECURE: Enables or disables validation of the ACME server TLS certificate. If true, requests to the ACME server will not have the TLS certificate chain validated. Mutually exclusive with CABundle; prefer using CABundle to prevent various kinds of security vulnerabilities. Only enable this option in development environments. If CABundle and SkipTLSVerify are unset, the system certificate bundle inside the container is used to validate the TLS connection. Defaults to false.' - type: boolean - solvers: - description: 'Solvers is a list of challenge solvers that will be used to solve ACME challenges for the matching domains. Solver configurations must be provided in order to obtain certificates from an ACME server. For more information, see: https://cert-manager.io/docs/configuration/acme/' - type: array - items: - description: An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of. A selector may be provided to use different solving strategies for different DNS names. Only one of HTTP01 or DNS01 must be provided. - type: object - properties: - dns01: - description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. - type: object - properties: - acmeDNS: - description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. - type: object - required: - - accountSecretRef - - host - properties: - accountSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - host: - type: string - akamai: - description: Use the Akamai DNS zone management API to manage DNS01 challenge records. - type: object - required: - - accessTokenSecretRef - - clientSecretSecretRef - - clientTokenSecretRef - - serviceConsumerDomain - properties: - accessTokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - clientSecretSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - clientTokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - serviceConsumerDomain: - type: string - azureDNS: - description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. - type: object - required: - - resourceGroupName - - subscriptionID - properties: - clientID: - description: if both this and ClientSecret are left unset MSI will be used - type: string - clientSecretSecretRef: - description: if both this and ClientID are left unset MSI will be used - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - environment: - description: name of the Azure environment (default AzurePublicCloud) - type: string - enum: - - AzurePublicCloud - - AzureChinaCloud - - AzureGermanCloud - - AzureUSGovernmentCloud - hostedZoneName: - description: name of the DNS zone that should be used - type: string - managedIdentity: - description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID - type: object - properties: - clientID: - description: client ID of the managed identity, can not be used at the same time as resourceID - type: string - resourceID: - description: resource ID of the managed identity, can not be used at the same time as clientID - type: string - resourceGroupName: - description: resource group the DNS zone is located in - type: string - subscriptionID: - description: ID of the Azure subscription - type: string - tenantID: - description: when specifying ClientID and ClientSecret then this field is also needed - type: string - cloudDNS: - description: Use the Google Cloud DNS API to manage DNS01 challenge records. - type: object - required: - - project - properties: - hostedZoneName: - description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone. - type: string - project: - type: string - serviceAccountSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - cloudflare: - description: Use the Cloudflare API to manage DNS01 challenge records. - type: object - properties: - apiKeySecretRef: - description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.' - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - apiTokenSecretRef: - description: API token used to authenticate with Cloudflare. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - email: - description: Email of the account, only required when using API key based authentication. - type: string - cnameStrategy: - description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. - type: string - enum: - - None - - Follow - digitalocean: - description: Use the DigitalOcean DNS API to manage DNS01 challenge records. - type: object - required: - - tokenSecretRef - properties: - tokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - rfc2136: - description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. - type: object - required: - - nameserver - properties: - nameserver: - description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. This field is required. - type: string - tsigAlgorithm: - description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.' - type: string - tsigKeyName: - description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required. - type: string - tsigSecretSecretRef: - description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - route53: - description: Use the AWS Route53 API to manage DNS01 challenge records. - type: object - required: - - region - properties: - accessKeyID: - description: 'The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' - type: string - accessKeyIDSecretRef: - description: 'The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - hostedZoneID: - description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call. - type: string - region: - description: Always set the region when using AccessKeyID and SecretAccessKey - type: string - role: - description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata - type: string - secretAccessKeySecretRef: - description: 'The SecretAccessKey is used for authentication. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - webhook: - description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. - type: object - required: - - groupName - - solverName - properties: - config: - description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. - x-kubernetes-preserve-unknown-fields: true - groupName: - description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation. - type: string - solverName: - description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'. - type: string - http01: - description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism. - type: object - properties: - gatewayHTTPRoute: - description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. - type: object - properties: - labels: - description: Custom labels that will be applied to HTTPRoutes created by cert-manager while solving HTTP-01 challenges. - type: object - additionalProperties: - type: string - parentRefs: - description: 'When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. cert-manager needs to know which parentRefs should be used when creating the HTTPRoute. Usually, the parentRef references a Gateway. See: https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways' - type: array - items: - description: "ParentReference identifies an API object (usually a Gateway) that can be considered a parent of this resource (usually a route). The only kind of parent resource with \"Core\" support is Gateway. This API may be extended in the future to support additional kinds of parent resources, such as HTTPRoute. \n The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid." - type: object - required: - - name - properties: - group: - description: "Group is the group of the referent. When unspecified, \"gateway.networking.k8s.io\" is inferred. To set the core API group (such as for a \"Service\" kind referent), Group must be explicitly set to \"\" (empty string). \n Support: Core" - type: string - default: gateway.networking.k8s.io - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - kind: - description: "Kind is kind of the referent. \n Support: Core (Gateway) \n Support: Implementation-specific (Other Resources)" - type: string - default: Gateway - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - name: - description: "Name is the name of the referent. \n Support: Core" - type: string - maxLength: 253 - minLength: 1 - namespace: - description: "Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. \n Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. \n Support: Core" - type: string - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - port: - description: "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n " - type: integer - format: int32 - maximum: 65535 - minimum: 1 - sectionName: - description: "SectionName is the name of a section within the target resource. In the following resources, SectionName is interpreted as the following: \n * Gateway: Listener Name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support attaching Routes to other resources. If that is the case, they MUST clearly document how SectionName is interpreted. \n When unspecified (empty string), this will reference the entire resource. For the purpose of status, an attachment is considered successful if at least one section in the parent resource accepts it. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Core" - type: string - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - serviceType: - description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. - type: string - ingress: - description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. - type: object - properties: - class: - description: The ingress class to use when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of 'class' or 'name' may be specified. - type: string - ingressTemplate: - description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges. - type: object - properties: - metadata: - description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. - type: object - properties: - annotations: - description: Annotations that should be added to the created ACME HTTP01 solver ingress. - type: object - additionalProperties: - type: string - labels: - description: Labels that should be added to the created ACME HTTP01 solver ingress. - type: object - additionalProperties: - type: string - name: - description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources. - type: string - podTemplate: - description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. - type: object - properties: - metadata: - description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. - type: object - properties: - annotations: - description: Annotations that should be added to the create ACME HTTP01 solver pods. - type: object - additionalProperties: - type: string - labels: - description: Labels that should be added to the created ACME HTTP01 solver pods. - type: object - additionalProperties: - type: string - spec: - description: PodSpec defines overrides for the HTTP01 challenge solver pod. Only the 'priorityClassName', 'nodeSelector', 'affinity', 'serviceAccountName' and 'tolerations' fields are supported currently. All other fields will be ignored. - type: object - properties: - affinity: - description: If specified, the pod's scheduling constraints - type: object - properties: - nodeAffinity: - description: Describes node affinity scheduling rules for the pod. - type: object - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. - type: array - items: - description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - type: object - required: - - preference - - weight - properties: - preference: - description: A node selector term, associated with the corresponding weight. - type: object - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchFields: - description: A list of node selector requirements by node's fields. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - x-kubernetes-map-type: atomic - weight: - description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - type: integer - format: int32 - requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. - type: object - required: - - nodeSelectorTerms - properties: - nodeSelectorTerms: - description: Required. A list of node selector terms. The terms are ORed. - type: array - items: - description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - type: object - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchFields: - description: A list of node selector requirements by node's fields. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - x-kubernetes-map-type: atomic - x-kubernetes-map-type: atomic - podAffinity: - description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). - type: object - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - weight: - description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer - format: int32 - requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array - items: - description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - podAntiAffinity: - description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). - type: object - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - weight: - description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer - format: int32 - requiredDuringSchedulingIgnoredDuringExecution: - description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array - items: - description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - nodeSelector: - description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' - type: object - additionalProperties: - type: string - priorityClassName: - description: If specified, the pod's priorityClassName. - type: string - serviceAccountName: - description: If specified, the pod's service account - type: string - tolerations: - description: If specified, the pod's tolerations. - type: array - items: - description: The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . - type: object - properties: - effect: - description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. - type: string - operator: - description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. - type: string - tolerationSeconds: - description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. - type: integer - format: int64 - value: - description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. - type: string - serviceType: - description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. - type: string - selector: - description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. - type: object - properties: - dnsNames: - description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. - type: array - items: - type: string - dnsZones: - description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. - type: array - items: - type: string - matchLabels: - description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to. - type: object - additionalProperties: - type: string - ca: - description: CA configures this issuer to sign certificates using a signing CA keypair stored in a Secret resource. This is used to build internal PKIs that are managed by cert-manager. - type: object - required: - - secretName - properties: - crlDistributionPoints: - description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set, certificates will be issued without distribution points set. - type: array - items: - type: string - ocspServers: - description: The OCSP server list is an X.509 v3 extension that defines a list of URLs of OCSP responders. The OCSP responders can be queried for the revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". - type: array - items: - type: string - secretName: - description: SecretName is the name of the secret used to sign Certificates issued by this Issuer. - type: string - selfSigned: - description: SelfSigned configures this issuer to 'self sign' certificates using the private key used to create the CertificateRequest object. - type: object - properties: - crlDistributionPoints: - description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set certificate will be issued without CDP. Values are strings. - type: array - items: - type: string - vault: - description: Vault configures this issuer to sign certificates using a HashiCorp Vault PKI backend. - type: object - required: - - auth - - path - - server - properties: - auth: - description: Auth configures how cert-manager authenticates with the Vault server. - type: object - properties: - appRole: - description: AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource. - type: object - required: - - path - - roleId - - secretRef - properties: - path: - description: 'Path where the App Role authentication backend is mounted in Vault, e.g: "approle"' - type: string - roleId: - description: RoleID configured in the App Role authentication backend when setting up the authentication backend in Vault. - type: string - secretRef: - description: Reference to a key in a Secret that contains the App Role secret used to authenticate with Vault. The `key` field must be specified and denotes which entry within the Secret resource is used as the app role secret. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - kubernetes: - description: Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server. - type: object - required: - - role - - secretRef - properties: - mountPath: - description: The Vault mountPath here is the mount path to use when authenticating with Vault. For example, setting a value to `/v1/auth/foo`, will use the path `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the default value "/v1/auth/kubernetes" will be used. - type: string - role: - description: A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies. - type: string - secretRef: - description: The required Secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. Use of 'ambient credentials' is not supported. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - tokenSecretRef: - description: TokenSecretRef authenticates with Vault by presenting a token. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - caBundle: - description: Base64-encoded bundle of PEM CAs which will be used to validate the certificate chain presented by Vault. Only used if using HTTPS to connect to Vault and ignored for HTTP connections. Mutually exclusive with CABundleSecretRef. If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. - type: string - format: byte - caBundleSecretRef: - description: Reference to a Secret containing a bundle of PEM-encoded CAs to use when verifying the certificate chain presented by Vault when using HTTPS. Mutually exclusive with CABundle. If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. If no key for the Secret is specified, cert-manager will default to 'ca.crt'. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - namespace: - description: 'Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces' - type: string - path: - description: 'Path is the mount path of the Vault PKI backend''s `sign` endpoint, e.g: "my_pki_mount/sign/my-role-name".' - type: string - server: - description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' - type: string - venafi: - description: Venafi configures this issuer to sign certificates using a Venafi TPP or Venafi Cloud policy zone. - type: object - required: - - zone - properties: - cloud: - description: Cloud specifies the Venafi cloud configuration settings. Only one of TPP or Cloud may be specified. - type: object - required: - - apiTokenSecretRef - properties: - apiTokenSecretRef: - description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - url: - description: URL is the base URL for Venafi Cloud. Defaults to "https://api.venafi.cloud/v1". - type: string - tpp: - description: TPP specifies Trust Protection Platform configuration settings. Only one of TPP or Cloud may be specified. - type: object - required: - - credentialsRef - - url - properties: - caBundle: - description: Base64-encoded bundle of PEM CAs which will be used to validate the certificate chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. If undefined, the certificate bundle in the cert-manager controller container is used to validate the chain. - type: string - format: byte - credentialsRef: - description: CredentialsRef is a reference to a Secret containing the username and password for the TPP server. The secret must contain two keys, 'username' and 'password'. - type: object - required: - - name - properties: - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - url: - description: 'URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, for example: "https://tpp.example.com/vedsdk".' - type: string - zone: - description: Zone is the Venafi Policy Zone to use for this issuer. All requests made to the Venafi platform will be restricted by the named zone policy. This field is required. - type: string - status: - description: Status of the ClusterIssuer. This is set and managed automatically. - type: object - properties: - acme: - description: ACME specific status options. This field should only be set if the Issuer is configured to use an ACME server to issue certificates. - type: object - properties: - lastRegisteredEmail: - description: LastRegisteredEmail is the email associated with the latest registered ACME account, in order to track changes made to registered account associated with the Issuer - type: string - uri: - description: URI is the unique account identifier, which can also be used to retrieve account details from the CA - type: string - conditions: - description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready`. - type: array - items: - description: IssuerCondition contains condition information for an Issuer. - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. - type: string - format: date-time - message: - description: Message is a human readable description of the details of the last transition, complementing reason. - type: string - observedGeneration: - description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Issuer. - type: integer - format: int64 - reason: - description: Reason is a brief machine readable explanation for the condition's last transition. - type: string - status: - description: Status of the condition, one of (`True`, `False`, `Unknown`). - type: string - enum: - - "True" - - "False" - - Unknown - type: - description: Type of the condition, known values are (`Ready`). - type: string - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - served: true - storage: true ---- -# Source: cert-manager/templates/crds.yaml -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: challenges.acme.cert-manager.io - labels: - app: 'cert-manager' - app.kubernetes.io/name: 'cert-manager' - app.kubernetes.io/instance: 'cert-manager' - # Generated labels - app.kubernetes.io/version: "v1.11.0" -spec: - group: acme.cert-manager.io - names: - kind: Challenge - listKind: ChallengeList - plural: challenges - singular: challenge - categories: - - cert-manager - - cert-manager-acme - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .status.state - name: State - type: string - - jsonPath: .spec.dnsName - name: Domain - type: string - - jsonPath: .status.reason - name: Reason - priority: 1 - type: string - - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - description: Challenge is a type to represent a Challenge request with an ACME server - type: object - required: - - metadata - - spec - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - type: object - required: - - authorizationURL - - dnsName - - issuerRef - - key - - solver - - token - - type - - url - properties: - authorizationURL: - description: The URL to the ACME Authorization resource that this challenge is a part of. - type: string - dnsName: - description: dnsName is the identifier that this challenge is for, e.g. example.com. If the requested DNSName is a 'wildcard', this field MUST be set to the non-wildcard domain, e.g. for `*.example.com`, it must be `example.com`. - type: string - issuerRef: - description: References a properly configured ACME-type Issuer which should be used to create this Challenge. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Challenge will be marked as failed. - type: object - required: - - name - properties: - group: - description: Group of the resource being referred to. - type: string - kind: - description: Kind of the resource being referred to. - type: string - name: - description: Name of the resource being referred to. - type: string - key: - description: 'The ACME challenge key for this challenge For HTTP01 challenges, this is the value that must be responded with to complete the HTTP01 challenge in the format: `.`. For DNS01 challenges, this is the base64 encoded SHA256 sum of the `.` text that must be set as the TXT record content.' - type: string - solver: - description: Contains the domain solving configuration that should be used to solve this challenge resource. - type: object - properties: - dns01: - description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. - type: object - properties: - acmeDNS: - description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. - type: object - required: - - accountSecretRef - - host - properties: - accountSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - host: - type: string - akamai: - description: Use the Akamai DNS zone management API to manage DNS01 challenge records. - type: object - required: - - accessTokenSecretRef - - clientSecretSecretRef - - clientTokenSecretRef - - serviceConsumerDomain - properties: - accessTokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - clientSecretSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - clientTokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - serviceConsumerDomain: - type: string - azureDNS: - description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. - type: object - required: - - resourceGroupName - - subscriptionID - properties: - clientID: - description: if both this and ClientSecret are left unset MSI will be used - type: string - clientSecretSecretRef: - description: if both this and ClientID are left unset MSI will be used - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - environment: - description: name of the Azure environment (default AzurePublicCloud) - type: string - enum: - - AzurePublicCloud - - AzureChinaCloud - - AzureGermanCloud - - AzureUSGovernmentCloud - hostedZoneName: - description: name of the DNS zone that should be used - type: string - managedIdentity: - description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID - type: object - properties: - clientID: - description: client ID of the managed identity, can not be used at the same time as resourceID - type: string - resourceID: - description: resource ID of the managed identity, can not be used at the same time as clientID - type: string - resourceGroupName: - description: resource group the DNS zone is located in - type: string - subscriptionID: - description: ID of the Azure subscription - type: string - tenantID: - description: when specifying ClientID and ClientSecret then this field is also needed - type: string - cloudDNS: - description: Use the Google Cloud DNS API to manage DNS01 challenge records. - type: object - required: - - project - properties: - hostedZoneName: - description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone. - type: string - project: - type: string - serviceAccountSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - cloudflare: - description: Use the Cloudflare API to manage DNS01 challenge records. - type: object - properties: - apiKeySecretRef: - description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.' - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - apiTokenSecretRef: - description: API token used to authenticate with Cloudflare. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - email: - description: Email of the account, only required when using API key based authentication. - type: string - cnameStrategy: - description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. - type: string - enum: - - None - - Follow - digitalocean: - description: Use the DigitalOcean DNS API to manage DNS01 challenge records. - type: object - required: - - tokenSecretRef - properties: - tokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - rfc2136: - description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. - type: object - required: - - nameserver - properties: - nameserver: - description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. This field is required. - type: string - tsigAlgorithm: - description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.' - type: string - tsigKeyName: - description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required. - type: string - tsigSecretSecretRef: - description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - route53: - description: Use the AWS Route53 API to manage DNS01 challenge records. - type: object - required: - - region - properties: - accessKeyID: - description: 'The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' - type: string - accessKeyIDSecretRef: - description: 'The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - hostedZoneID: - description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call. - type: string - region: - description: Always set the region when using AccessKeyID and SecretAccessKey - type: string - role: - description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata - type: string - secretAccessKeySecretRef: - description: 'The SecretAccessKey is used for authentication. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - webhook: - description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. - type: object - required: - - groupName - - solverName - properties: - config: - description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. - x-kubernetes-preserve-unknown-fields: true - groupName: - description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation. - type: string - solverName: - description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'. - type: string - http01: - description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism. - type: object - properties: - gatewayHTTPRoute: - description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. - type: object - properties: - labels: - description: Custom labels that will be applied to HTTPRoutes created by cert-manager while solving HTTP-01 challenges. - type: object - additionalProperties: - type: string - parentRefs: - description: 'When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. cert-manager needs to know which parentRefs should be used when creating the HTTPRoute. Usually, the parentRef references a Gateway. See: https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways' - type: array - items: - description: "ParentReference identifies an API object (usually a Gateway) that can be considered a parent of this resource (usually a route). The only kind of parent resource with \"Core\" support is Gateway. This API may be extended in the future to support additional kinds of parent resources, such as HTTPRoute. \n The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid." - type: object - required: - - name - properties: - group: - description: "Group is the group of the referent. When unspecified, \"gateway.networking.k8s.io\" is inferred. To set the core API group (such as for a \"Service\" kind referent), Group must be explicitly set to \"\" (empty string). \n Support: Core" - type: string - default: gateway.networking.k8s.io - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - kind: - description: "Kind is kind of the referent. \n Support: Core (Gateway) \n Support: Implementation-specific (Other Resources)" - type: string - default: Gateway - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - name: - description: "Name is the name of the referent. \n Support: Core" - type: string - maxLength: 253 - minLength: 1 - namespace: - description: "Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. \n Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. \n Support: Core" - type: string - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - port: - description: "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n " - type: integer - format: int32 - maximum: 65535 - minimum: 1 - sectionName: - description: "SectionName is the name of a section within the target resource. In the following resources, SectionName is interpreted as the following: \n * Gateway: Listener Name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support attaching Routes to other resources. If that is the case, they MUST clearly document how SectionName is interpreted. \n When unspecified (empty string), this will reference the entire resource. For the purpose of status, an attachment is considered successful if at least one section in the parent resource accepts it. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Core" - type: string - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - serviceType: - description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. - type: string - ingress: - description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. - type: object - properties: - class: - description: The ingress class to use when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of 'class' or 'name' may be specified. - type: string - ingressTemplate: - description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges. - type: object - properties: - metadata: - description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. - type: object - properties: - annotations: - description: Annotations that should be added to the created ACME HTTP01 solver ingress. - type: object - additionalProperties: - type: string - labels: - description: Labels that should be added to the created ACME HTTP01 solver ingress. - type: object - additionalProperties: - type: string - name: - description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources. - type: string - podTemplate: - description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. - type: object - properties: - metadata: - description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. - type: object - properties: - annotations: - description: Annotations that should be added to the create ACME HTTP01 solver pods. - type: object - additionalProperties: - type: string - labels: - description: Labels that should be added to the created ACME HTTP01 solver pods. - type: object - additionalProperties: - type: string - spec: - description: PodSpec defines overrides for the HTTP01 challenge solver pod. Only the 'priorityClassName', 'nodeSelector', 'affinity', 'serviceAccountName' and 'tolerations' fields are supported currently. All other fields will be ignored. - type: object - properties: - affinity: - description: If specified, the pod's scheduling constraints - type: object - properties: - nodeAffinity: - description: Describes node affinity scheduling rules for the pod. - type: object - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. - type: array - items: - description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - type: object - required: - - preference - - weight - properties: - preference: - description: A node selector term, associated with the corresponding weight. - type: object - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchFields: - description: A list of node selector requirements by node's fields. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - x-kubernetes-map-type: atomic - weight: - description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - type: integer - format: int32 - requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. - type: object - required: - - nodeSelectorTerms - properties: - nodeSelectorTerms: - description: Required. A list of node selector terms. The terms are ORed. - type: array - items: - description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - type: object - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchFields: - description: A list of node selector requirements by node's fields. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - x-kubernetes-map-type: atomic - x-kubernetes-map-type: atomic - podAffinity: - description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). - type: object - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - weight: - description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer - format: int32 - requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array - items: - description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - podAntiAffinity: - description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). - type: object - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - weight: - description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer - format: int32 - requiredDuringSchedulingIgnoredDuringExecution: - description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array - items: - description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - nodeSelector: - description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' - type: object - additionalProperties: - type: string - priorityClassName: - description: If specified, the pod's priorityClassName. - type: string - serviceAccountName: - description: If specified, the pod's service account - type: string - tolerations: - description: If specified, the pod's tolerations. - type: array - items: - description: The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . - type: object - properties: - effect: - description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. - type: string - operator: - description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. - type: string - tolerationSeconds: - description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. - type: integer - format: int64 - value: - description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. - type: string - serviceType: - description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. - type: string - selector: - description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. - type: object - properties: - dnsNames: - description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. - type: array - items: - type: string - dnsZones: - description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. - type: array - items: - type: string - matchLabels: - description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to. - type: object - additionalProperties: - type: string - token: - description: The ACME challenge token for this challenge. This is the raw value returned from the ACME server. - type: string - type: - description: The type of ACME challenge this resource represents. One of "HTTP-01" or "DNS-01". - type: string - enum: - - HTTP-01 - - DNS-01 - url: - description: The URL of the ACME Challenge resource for this challenge. This can be used to lookup details about the status of this challenge. - type: string - wildcard: - description: wildcard will be true if this challenge is for a wildcard identifier, for example '*.example.com'. - type: boolean - status: - type: object - properties: - presented: - description: presented will be set to true if the challenge values for this challenge are currently 'presented'. This *does not* imply the self check is passing. Only that the values have been 'submitted' for the appropriate challenge mechanism (i.e. the DNS01 TXT record has been presented, or the HTTP01 configuration has been configured). - type: boolean - processing: - description: Used to denote whether this challenge should be processed or not. This field will only be set to true by the 'scheduling' component. It will only be set to false by the 'challenges' controller, after the challenge has reached a final state or timed out. If this field is set to false, the challenge controller will not take any more action. - type: boolean - reason: - description: Contains human readable information on why the Challenge is in the current state. - type: string - state: - description: Contains the current 'state' of the challenge. If not set, the state of the challenge is unknown. - type: string - enum: - - valid - - ready - - pending - - processing - - invalid - - expired - - errored - served: true - storage: true - subresources: - status: {} ---- -# Source: cert-manager/templates/crds.yaml -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: certificaterequests.cert-manager.io - labels: - app: 'cert-manager' - app.kubernetes.io/name: 'cert-manager' - app.kubernetes.io/instance: 'cert-manager' - # Generated labels - app.kubernetes.io/version: "v1.11.0" -spec: - group: cert-manager.io - names: - kind: CertificateRequest - listKind: CertificateRequestList - plural: certificaterequests - shortNames: - - cr - - crs - singular: certificaterequest - categories: - - cert-manager - scope: Namespaced - versions: - - name: v1 - subresources: - status: {} - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type=="Approved")].status - name: Approved - type: string - - jsonPath: .status.conditions[?(@.type=="Denied")].status - name: Denied - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .spec.issuerRef.name - name: Issuer - type: string - - jsonPath: .spec.username - name: Requestor - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message - name: Status - priority: 1 - type: string - - jsonPath: .metadata.creationTimestamp - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - name: Age - type: date - schema: - openAPIV3Schema: - description: "A CertificateRequest is used to request a signed certificate from one of the configured issuers. \n All fields within the CertificateRequest's `spec` are immutable after creation. A CertificateRequest will either succeed or fail, as denoted by its `status.state` field. \n A CertificateRequest is a one-shot resource, meaning it represents a single point in time request for a certificate and cannot be re-used." - type: object - required: - - spec - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: Desired state of the CertificateRequest resource. - type: object - required: - - issuerRef - - request - properties: - duration: - description: The requested 'duration' (i.e. lifetime) of the Certificate. This option may be ignored/overridden by some issuer types. - type: string - extra: - description: Extra contains extra attributes of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. - type: object - additionalProperties: - type: array - items: - type: string - groups: - description: Groups contains group membership of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. - type: array - items: - type: string - x-kubernetes-list-type: atomic - isCA: - description: IsCA will request to mark the certificate as valid for certificate signing when submitting to the issuer. This will automatically add the `cert sign` usage to the list of `usages`. - type: boolean - issuerRef: - description: IssuerRef is a reference to the issuer for this CertificateRequest. If the `kind` field is not set, or set to `Issuer`, an Issuer resource with the given name in the same namespace as the CertificateRequest will be used. If the `kind` field is set to `ClusterIssuer`, a ClusterIssuer with the provided name will be used. The `name` field in this stanza is required at all times. The group field refers to the API group of the issuer which defaults to `cert-manager.io` if empty. - type: object - required: - - name - properties: - group: - description: Group of the resource being referred to. - type: string - kind: - description: Kind of the resource being referred to. - type: string - name: - description: Name of the resource being referred to. - type: string - request: - description: The PEM-encoded x509 certificate signing request to be submitted to the CA for signing. - type: string - format: byte - uid: - description: UID contains the uid of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. - type: string - usages: - description: Usages is the set of x509 usages that are requested for the certificate. If usages are set they SHOULD be encoded inside the CSR spec Defaults to `digital signature` and `key encipherment` if not specified. - type: array - items: - description: "KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12 \n Valid KeyUsage values are as follows: \"signing\", \"digital signature\", \"content commitment\", \"key encipherment\", \"key agreement\", \"data encipherment\", \"cert sign\", \"crl sign\", \"encipher only\", \"decipher only\", \"any\", \"server auth\", \"client auth\", \"code signing\", \"email protection\", \"s/mime\", \"ipsec end system\", \"ipsec tunnel\", \"ipsec user\", \"timestamping\", \"ocsp signing\", \"microsoft sgc\", \"netscape sgc\"" - type: string - enum: - - signing - - digital signature - - content commitment - - key encipherment - - key agreement - - data encipherment - - cert sign - - crl sign - - encipher only - - decipher only - - any - - server auth - - client auth - - code signing - - email protection - - s/mime - - ipsec end system - - ipsec tunnel - - ipsec user - - timestamping - - ocsp signing - - microsoft sgc - - netscape sgc - username: - description: Username contains the name of the user that created the CertificateRequest. Populated by the cert-manager webhook on creation and immutable. - type: string - status: - description: Status of the CertificateRequest. This is set and managed automatically. - type: object - properties: - ca: - description: The PEM encoded x509 certificate of the signer, also known as the CA (Certificate Authority). This is set on a best-effort basis by different issuers. If not set, the CA is assumed to be unknown/not available. - type: string - format: byte - certificate: - description: The PEM encoded x509 certificate resulting from the certificate signing request. If not set, the CertificateRequest has either not been completed or has failed. More information on failure can be found by checking the `conditions` field. - type: string - format: byte - conditions: - description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready` and `InvalidRequest`. - type: array - items: - description: CertificateRequestCondition contains condition information for a CertificateRequest. - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. - type: string - format: date-time - message: - description: Message is a human readable description of the details of the last transition, complementing reason. - type: string - reason: - description: Reason is a brief machine readable explanation for the condition's last transition. - type: string - status: - description: Status of the condition, one of (`True`, `False`, `Unknown`). - type: string - enum: - - "True" - - "False" - - Unknown - type: - description: Type of the condition, known values are (`Ready`, `InvalidRequest`, `Approved`, `Denied`). - type: string - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - failureTime: - description: FailureTime stores the time that this CertificateRequest failed. This is used to influence garbage collection and back-off. - type: string - format: date-time - served: true - storage: true ---- -# Source: cert-manager/templates/crds.yaml -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: issuers.cert-manager.io - labels: - app: 'cert-manager' - app.kubernetes.io/name: 'cert-manager' - app.kubernetes.io/instance: 'cert-manager' - # Generated labels - app.kubernetes.io/version: "v1.11.0" -spec: - group: cert-manager.io - names: - kind: Issuer - listKind: IssuerList - plural: issuers - singular: issuer - categories: - - cert-manager - scope: Namespaced - versions: - - name: v1 - subresources: - status: {} - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message - name: Status - priority: 1 - type: string - - jsonPath: .metadata.creationTimestamp - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - name: Age - type: date - schema: - openAPIV3Schema: - description: An Issuer represents a certificate issuing authority which can be referenced as part of `issuerRef` fields. It is scoped to a single namespace and can therefore only be referenced by resources within the same namespace. - type: object - required: - - spec - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: Desired state of the Issuer resource. - type: object - properties: - acme: - description: ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates. - type: object - required: - - privateKeySecretRef - - server - properties: - caBundle: - description: Base64-encoded bundle of PEM CAs which can be used to validate the certificate chain presented by the ACME server. Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various kinds of security vulnerabilities. If CABundle and SkipTLSVerify are unset, the system certificate bundle inside the container is used to validate the TLS connection. - type: string - format: byte - disableAccountKeyGeneration: - description: Enables or disables generating a new ACME account key. If true, the Issuer resource will *not* request a new account but will expect the account key to be supplied via an existing secret. If false, the cert-manager system will generate a new ACME account key for the Issuer. Defaults to false. - type: boolean - email: - description: Email is the email address to be associated with the ACME account. This field is optional, but it is strongly recommended to be set. It will be used to contact you in case of issues with your account or certificates, including expiry notification emails. This field may be updated after the account is initially registered. - type: string - enableDurationFeature: - description: Enables requesting a Not After date on certificates that matches the duration of the certificate. This is not supported by all ACME servers like Let's Encrypt. If set to true when the ACME server does not support it it will create an error on the Order. Defaults to false. - type: boolean - externalAccountBinding: - description: ExternalAccountBinding is a reference to a CA external account of the ACME server. If set, upon registration cert-manager will attempt to associate the given external account credentials with the registered ACME account. - type: object - required: - - keyID - - keySecretRef - properties: - keyAlgorithm: - description: 'Deprecated: keyAlgorithm field exists for historical compatibility reasons and should not be used. The algorithm is now hardcoded to HS256 in golang/x/crypto/acme.' - type: string - enum: - - HS256 - - HS384 - - HS512 - keyID: - description: keyID is the ID of the CA key that the External Account is bound to. - type: string - keySecretRef: - description: keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes Secret which holds the symmetric MAC key of the External Account Binding. The `key` is the index string that is paired with the key data in the Secret and should not be confused with the key data itself, or indeed with the External Account Binding keyID above. The secret key stored in the Secret **must** be un-padded, base64 URL encoded data. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - preferredChain: - description: 'PreferredChain is the chain to use if the ACME server outputs multiple. PreferredChain is no guarantee that this one gets delivered by the ACME endpoint. For example, for Let''s Encrypt''s DST crosssign you would use: "DST Root CA X3" or "ISRG Root X1" for the newer Let''s Encrypt root CA. This value picks the first certificate bundle in the ACME alternative chains that has a certificate with this value as its issuer''s CN' - type: string - maxLength: 64 - privateKeySecretRef: - description: PrivateKey is the name of a Kubernetes Secret resource that will be used to store the automatically generated ACME account private key. Optionally, a `key` may be specified to select a specific entry within the named Secret resource. If `key` is not specified, a default of `tls.key` will be used. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - server: - description: 'Server is the URL used to access the ACME server''s ''directory'' endpoint. For example, for Let''s Encrypt''s staging endpoint, you would use: "https://acme-staging-v02.api.letsencrypt.org/directory". Only ACME v2 endpoints (i.e. RFC 8555) are supported.' - type: string - skipTLSVerify: - description: 'INSECURE: Enables or disables validation of the ACME server TLS certificate. If true, requests to the ACME server will not have the TLS certificate chain validated. Mutually exclusive with CABundle; prefer using CABundle to prevent various kinds of security vulnerabilities. Only enable this option in development environments. If CABundle and SkipTLSVerify are unset, the system certificate bundle inside the container is used to validate the TLS connection. Defaults to false.' - type: boolean - solvers: - description: 'Solvers is a list of challenge solvers that will be used to solve ACME challenges for the matching domains. Solver configurations must be provided in order to obtain certificates from an ACME server. For more information, see: https://cert-manager.io/docs/configuration/acme/' - type: array - items: - description: An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of. A selector may be provided to use different solving strategies for different DNS names. Only one of HTTP01 or DNS01 must be provided. - type: object - properties: - dns01: - description: Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. - type: object - properties: - acmeDNS: - description: Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. - type: object - required: - - accountSecretRef - - host - properties: - accountSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - host: - type: string - akamai: - description: Use the Akamai DNS zone management API to manage DNS01 challenge records. - type: object - required: - - accessTokenSecretRef - - clientSecretSecretRef - - clientTokenSecretRef - - serviceConsumerDomain - properties: - accessTokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - clientSecretSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - clientTokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - serviceConsumerDomain: - type: string - azureDNS: - description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. - type: object - required: - - resourceGroupName - - subscriptionID - properties: - clientID: - description: if both this and ClientSecret are left unset MSI will be used - type: string - clientSecretSecretRef: - description: if both this and ClientID are left unset MSI will be used - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - environment: - description: name of the Azure environment (default AzurePublicCloud) - type: string - enum: - - AzurePublicCloud - - AzureChinaCloud - - AzureGermanCloud - - AzureUSGovernmentCloud - hostedZoneName: - description: name of the DNS zone that should be used - type: string - managedIdentity: - description: managed identity configuration, can not be used at the same time as clientID, clientSecretSecretRef or tenantID - type: object - properties: - clientID: - description: client ID of the managed identity, can not be used at the same time as resourceID - type: string - resourceID: - description: resource ID of the managed identity, can not be used at the same time as clientID - type: string - resourceGroupName: - description: resource group the DNS zone is located in - type: string - subscriptionID: - description: ID of the Azure subscription - type: string - tenantID: - description: when specifying ClientID and ClientSecret then this field is also needed - type: string - cloudDNS: - description: Use the Google Cloud DNS API to manage DNS01 challenge records. - type: object - required: - - project - properties: - hostedZoneName: - description: HostedZoneName is an optional field that tells cert-manager in which Cloud DNS zone the challenge record has to be created. If left empty cert-manager will automatically choose a zone. - type: string - project: - type: string - serviceAccountSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - cloudflare: - description: Use the Cloudflare API to manage DNS01 challenge records. - type: object - properties: - apiKeySecretRef: - description: 'API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions.' - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - apiTokenSecretRef: - description: API token used to authenticate with Cloudflare. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - email: - description: Email of the account, only required when using API key based authentication. - type: string - cnameStrategy: - description: CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. - type: string - enum: - - None - - Follow - digitalocean: - description: Use the DigitalOcean DNS API to manage DNS01 challenge records. - type: object - required: - - tokenSecretRef - properties: - tokenSecretRef: - description: A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - rfc2136: - description: Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. - type: object - required: - - nameserver - properties: - nameserver: - description: The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. This field is required. - type: string - tsigAlgorithm: - description: 'The TSIG Algorithm configured in the DNS supporting RFC2136. Used only when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. Supported values are (case-insensitive): ``HMACMD5`` (default), ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.' - type: string - tsigKeyName: - description: The TSIG Key name configured in the DNS. If ``tsigSecretSecretRef`` is defined, this field is required. - type: string - tsigSecretSecretRef: - description: The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - route53: - description: Use the AWS Route53 API to manage DNS01 challenge records. - type: object - required: - - region - properties: - accessKeyID: - description: 'The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' - type: string - accessKeyIDSecretRef: - description: 'The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - hostedZoneID: - description: If set, the provider will manage only this zone in Route53 and will not do an lookup using the route53:ListHostedZonesByName api call. - type: string - region: - description: Always set the region when using AccessKeyID and SecretAccessKey - type: string - role: - description: Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata - type: string - secretAccessKeySecretRef: - description: 'The SecretAccessKey is used for authentication. If neither the Access Key nor Key ID are set, we fall-back to using env vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - webhook: - description: Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. - type: object - required: - - groupName - - solverName - properties: - config: - description: Additional configuration that should be passed to the webhook apiserver when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. - x-kubernetes-preserve-unknown-fields: true - groupName: - description: The API group name that should be used when POSTing ChallengePayload resources to the webhook apiserver. This should be the same as the GroupName specified in the webhook provider implementation. - type: string - solverName: - description: The name of the solver to use, as defined in the webhook provider implementation. This will typically be the name of the provider, e.g. 'cloudflare'. - type: string - http01: - description: Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names (e.g. `*.example.com`) using the HTTP01 challenge mechanism. - type: object - properties: - gatewayHTTPRoute: - description: The Gateway API is a sig-network community API that models service networking in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. - type: object - properties: - labels: - description: Custom labels that will be applied to HTTPRoutes created by cert-manager while solving HTTP-01 challenges. - type: object - additionalProperties: - type: string - parentRefs: - description: 'When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. cert-manager needs to know which parentRefs should be used when creating the HTTPRoute. Usually, the parentRef references a Gateway. See: https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways' - type: array - items: - description: "ParentReference identifies an API object (usually a Gateway) that can be considered a parent of this resource (usually a route). The only kind of parent resource with \"Core\" support is Gateway. This API may be extended in the future to support additional kinds of parent resources, such as HTTPRoute. \n The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid." - type: object - required: - - name - properties: - group: - description: "Group is the group of the referent. When unspecified, \"gateway.networking.k8s.io\" is inferred. To set the core API group (such as for a \"Service\" kind referent), Group must be explicitly set to \"\" (empty string). \n Support: Core" - type: string - default: gateway.networking.k8s.io - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - kind: - description: "Kind is kind of the referent. \n Support: Core (Gateway) \n Support: Implementation-specific (Other Resources)" - type: string - default: Gateway - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - name: - description: "Name is the name of the referent. \n Support: Core" - type: string - maxLength: 253 - minLength: 1 - namespace: - description: "Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. \n Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. \n Support: Core" - type: string - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - port: - description: "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n " - type: integer - format: int32 - maximum: 65535 - minimum: 1 - sectionName: - description: "SectionName is the name of a section within the target resource. In the following resources, SectionName is interpreted as the following: \n * Gateway: Listener Name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support attaching Routes to other resources. If that is the case, they MUST clearly document how SectionName is interpreted. \n When unspecified (empty string), this will reference the entire resource. For the purpose of status, an attachment is considered successful if at least one section in the parent resource accepts it. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Core" - type: string - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - serviceType: - description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. - type: string - ingress: - description: The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. - type: object - properties: - class: - description: The ingress class to use when creating Ingress resources to solve ACME challenges that use this challenge solver. Only one of 'class' or 'name' may be specified. - type: string - ingressTemplate: - description: Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges. - type: object - properties: - metadata: - description: ObjectMeta overrides for the ingress used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. - type: object - properties: - annotations: - description: Annotations that should be added to the created ACME HTTP01 solver ingress. - type: object - additionalProperties: - type: string - labels: - description: Labels that should be added to the created ACME HTTP01 solver ingress. - type: object - additionalProperties: - type: string - name: - description: The name of the ingress resource that should have ACME challenge solving routes inserted into it in order to solve HTTP01 challenges. This is typically used in conjunction with ingress controllers like ingress-gce, which maintains a 1:1 mapping between external IPs and ingress resources. - type: string - podTemplate: - description: Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. - type: object - properties: - metadata: - description: ObjectMeta overrides for the pod used to solve HTTP01 challenges. Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. - type: object - properties: - annotations: - description: Annotations that should be added to the create ACME HTTP01 solver pods. - type: object - additionalProperties: - type: string - labels: - description: Labels that should be added to the created ACME HTTP01 solver pods. - type: object - additionalProperties: - type: string - spec: - description: PodSpec defines overrides for the HTTP01 challenge solver pod. Only the 'priorityClassName', 'nodeSelector', 'affinity', 'serviceAccountName' and 'tolerations' fields are supported currently. All other fields will be ignored. - type: object - properties: - affinity: - description: If specified, the pod's scheduling constraints - type: object - properties: - nodeAffinity: - description: Describes node affinity scheduling rules for the pod. - type: object - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. - type: array - items: - description: An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - type: object - required: - - preference - - weight - properties: - preference: - description: A node selector term, associated with the corresponding weight. - type: object - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchFields: - description: A list of node selector requirements by node's fields. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - x-kubernetes-map-type: atomic - weight: - description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - type: integer - format: int32 - requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. - type: object - required: - - nodeSelectorTerms - properties: - nodeSelectorTerms: - description: Required. A list of node selector terms. The terms are ORed. - type: array - items: - description: A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - type: object - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchFields: - description: A list of node selector requirements by node's fields. - type: array - items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array - items: - type: string - x-kubernetes-map-type: atomic - x-kubernetes-map-type: atomic - podAffinity: - description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). - type: object - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - weight: - description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer - format: int32 - requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array - items: - description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - podAntiAffinity: - description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). - type: object - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - weight: - description: weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer - format: int32 - requiredDuringSchedulingIgnoredDuringExecution: - description: If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array - items: - description: Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey - properties: - labelSelector: - description: A label query over a set of resources, in this case pods. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaceSelector: - description: A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array - items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array - items: - type: string - matchLabels: - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - namespaces: - description: namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array - items: - type: string - topologyKey: - description: This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. - type: string - nodeSelector: - description: 'NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node''s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' - type: object - additionalProperties: - type: string - priorityClassName: - description: If specified, the pod's priorityClassName. - type: string - serviceAccountName: - description: If specified, the pod's service account - type: string - tolerations: - description: If specified, the pod's tolerations. - type: array - items: - description: The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . - type: object - properties: - effect: - description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. - type: string - operator: - description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. - type: string - tolerationSeconds: - description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. - type: integer - format: int64 - value: - description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. - type: string - serviceType: - description: Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. - type: string - selector: - description: Selector selects a set of DNSNames on the Certificate resource that should be solved using this challenge solver. If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. - type: object - properties: - dnsNames: - description: List of DNSNames that this solver will be used to solve. If specified and a match is found, a dnsNames selector will take precedence over a dnsZones selector. If multiple solvers match with the same dnsNames value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. - type: array - items: - type: string - dnsZones: - description: List of DNSZones that this solver will be used to solve. The most specific DNS zone match specified here will take precedence over other DNS zone matches, so a solver specifying sys.example.com will be selected over one specifying example.com for the domain www.sys.example.com. If multiple solvers match with the same dnsZones value, the solver with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. - type: array - items: - type: string - matchLabels: - description: A label selector that is used to refine the set of certificate's that this challenge solver will apply to. - type: object - additionalProperties: - type: string - ca: - description: CA configures this issuer to sign certificates using a signing CA keypair stored in a Secret resource. This is used to build internal PKIs that are managed by cert-manager. - type: object - required: - - secretName - properties: - crlDistributionPoints: - description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set, certificates will be issued without distribution points set. - type: array - items: - type: string - ocspServers: - description: The OCSP server list is an X.509 v3 extension that defines a list of URLs of OCSP responders. The OCSP responders can be queried for the revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". - type: array - items: - type: string - secretName: - description: SecretName is the name of the secret used to sign Certificates issued by this Issuer. - type: string - selfSigned: - description: SelfSigned configures this issuer to 'self sign' certificates using the private key used to create the CertificateRequest object. - type: object - properties: - crlDistributionPoints: - description: The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set certificate will be issued without CDP. Values are strings. - type: array - items: - type: string - vault: - description: Vault configures this issuer to sign certificates using a HashiCorp Vault PKI backend. - type: object - required: - - auth - - path - - server - properties: - auth: - description: Auth configures how cert-manager authenticates with the Vault server. - type: object - properties: - appRole: - description: AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource. - type: object - required: - - path - - roleId - - secretRef - properties: - path: - description: 'Path where the App Role authentication backend is mounted in Vault, e.g: "approle"' - type: string - roleId: - description: RoleID configured in the App Role authentication backend when setting up the authentication backend in Vault. - type: string - secretRef: - description: Reference to a key in a Secret that contains the App Role secret used to authenticate with Vault. The `key` field must be specified and denotes which entry within the Secret resource is used as the app role secret. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - kubernetes: - description: Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server. - type: object - required: - - role - - secretRef - properties: - mountPath: - description: The Vault mountPath here is the mount path to use when authenticating with Vault. For example, setting a value to `/v1/auth/foo`, will use the path `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the default value "/v1/auth/kubernetes" will be used. - type: string - role: - description: A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies. - type: string - secretRef: - description: The required Secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. Use of 'ambient credentials' is not supported. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - tokenSecretRef: - description: TokenSecretRef authenticates with Vault by presenting a token. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - caBundle: - description: Base64-encoded bundle of PEM CAs which will be used to validate the certificate chain presented by Vault. Only used if using HTTPS to connect to Vault and ignored for HTTP connections. Mutually exclusive with CABundleSecretRef. If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. - type: string - format: byte - caBundleSecretRef: - description: Reference to a Secret containing a bundle of PEM-encoded CAs to use when verifying the certificate chain presented by Vault when using HTTPS. Mutually exclusive with CABundle. If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. If no key for the Secret is specified, cert-manager will default to 'ca.crt'. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - namespace: - description: 'Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces' - type: string - path: - description: 'Path is the mount path of the Vault PKI backend''s `sign` endpoint, e.g: "my_pki_mount/sign/my-role-name".' - type: string - server: - description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' - type: string - venafi: - description: Venafi configures this issuer to sign certificates using a Venafi TPP or Venafi Cloud policy zone. - type: object - required: - - zone - properties: - cloud: - description: Cloud specifies the Venafi cloud configuration settings. Only one of TPP or Cloud may be specified. - type: object - required: - - apiTokenSecretRef - properties: - apiTokenSecretRef: - description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - url: - description: URL is the base URL for Venafi Cloud. Defaults to "https://api.venafi.cloud/v1". - type: string - tpp: - description: TPP specifies Trust Protection Platform configuration settings. Only one of TPP or Cloud may be specified. - type: object - required: - - credentialsRef - - url - properties: - caBundle: - description: Base64-encoded bundle of PEM CAs which will be used to validate the certificate chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. If undefined, the certificate bundle in the cert-manager controller container is used to validate the chain. - type: string - format: byte - credentialsRef: - description: CredentialsRef is a reference to a Secret containing the username and password for the TPP server. The secret must contain two keys, 'username' and 'password'. - type: object - required: - - name - properties: - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - url: - description: 'URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, for example: "https://tpp.example.com/vedsdk".' - type: string - zone: - description: Zone is the Venafi Policy Zone to use for this issuer. All requests made to the Venafi platform will be restricted by the named zone policy. This field is required. - type: string - status: - description: Status of the Issuer. This is set and managed automatically. - type: object - properties: - acme: - description: ACME specific status options. This field should only be set if the Issuer is configured to use an ACME server to issue certificates. - type: object - properties: - lastRegisteredEmail: - description: LastRegisteredEmail is the email associated with the latest registered ACME account, in order to track changes made to registered account associated with the Issuer - type: string - uri: - description: URI is the unique account identifier, which can also be used to retrieve account details from the CA - type: string - conditions: - description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready`. - type: array - items: - description: IssuerCondition contains condition information for an Issuer. - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. - type: string - format: date-time - message: - description: Message is a human readable description of the details of the last transition, complementing reason. - type: string - observedGeneration: - description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Issuer. - type: integer - format: int64 - reason: - description: Reason is a brief machine readable explanation for the condition's last transition. - type: string - status: - description: Status of the condition, one of (`True`, `False`, `Unknown`). - type: string - enum: - - "True" - - "False" - - Unknown - type: - description: Type of the condition, known values are (`Ready`). - type: string - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - served: true - storage: true ---- -# Source: cert-manager/templates/crds.yaml -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: certificates.cert-manager.io - labels: - app: 'cert-manager' - app.kubernetes.io/name: 'cert-manager' - app.kubernetes.io/instance: 'cert-manager' - # Generated labels - app.kubernetes.io/version: "v1.11.0" -spec: - group: cert-manager.io - names: - kind: Certificate - listKind: CertificateList - plural: certificates - shortNames: - - cert - - certs - singular: certificate - categories: - - cert-manager - scope: Namespaced - versions: - - name: v1 - subresources: - status: {} - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .spec.secretName - name: Secret - type: string - - jsonPath: .spec.issuerRef.name - name: Issuer - priority: 1 - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message - name: Status - priority: 1 - type: string - - jsonPath: .metadata.creationTimestamp - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - name: Age - type: date - schema: - openAPIV3Schema: - description: "A Certificate resource should be created to ensure an up to date and signed x509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`. \n The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`)." - type: object - required: - - spec - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: Desired state of the Certificate resource. - type: object - required: - - issuerRef - - secretName - properties: - additionalOutputFormats: - description: AdditionalOutputFormats defines extra output formats of the private key and signed certificate chain to be written to this Certificate's target Secret. This is an Alpha Feature and is only enabled with the `--feature-gates=AdditionalCertificateOutputFormats=true` option on both the controller and webhook components. - type: array - items: - description: CertificateAdditionalOutputFormat defines an additional output format of a Certificate resource. These contain supplementary data formats of the signed certificate chain and paired private key. - type: object - required: - - type - properties: - type: - description: Type is the name of the format type that should be written to the Certificate's target Secret. - type: string - enum: - - DER - - CombinedPEM - commonName: - description: 'CommonName is a common name to be used on the Certificate. The CommonName should have a length of 64 characters or fewer to avoid generating invalid CSRs. This value is ignored by TLS clients when any subject alt name is set. This is x509 behaviour: https://tools.ietf.org/html/rfc6125#section-6.4.4' - type: string - dnsNames: - description: DNSNames is a list of DNS subjectAltNames to be set on the Certificate. - type: array - items: - type: string - duration: - description: The requested 'duration' (i.e. lifetime) of the Certificate. This option may be ignored/overridden by some issuer types. If unset this defaults to 90 days. Certificate will be renewed either 2/3 through its duration or `renewBefore` period before its expiry, whichever is later. Minimum accepted duration is 1 hour. Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration - type: string - emailAddresses: - description: EmailAddresses is a list of email subjectAltNames to be set on the Certificate. - type: array - items: - type: string - encodeUsagesInRequest: - description: EncodeUsagesInRequest controls whether key usages should be present in the CertificateRequest - type: boolean - ipAddresses: - description: IPAddresses is a list of IP address subjectAltNames to be set on the Certificate. - type: array - items: - type: string - isCA: - description: IsCA will mark this Certificate as valid for certificate signing. This will automatically add the `cert sign` usage to the list of `usages`. - type: boolean - issuerRef: - description: IssuerRef is a reference to the issuer for this certificate. If the `kind` field is not set, or set to `Issuer`, an Issuer resource with the given name in the same namespace as the Certificate will be used. If the `kind` field is set to `ClusterIssuer`, a ClusterIssuer with the provided name will be used. The `name` field in this stanza is required at all times. - type: object - required: - - name - properties: - group: - description: Group of the resource being referred to. - type: string - kind: - description: Kind of the resource being referred to. - type: string - name: - description: Name of the resource being referred to. - type: string - keystores: - description: Keystores configures additional keystore output formats stored in the `secretName` Secret resource. - type: object - properties: - jks: - description: JKS configures options for storing a JKS keystore in the `spec.secretName` Secret resource. - type: object - required: - - create - - passwordSecretRef - properties: - create: - description: Create enables JKS keystore creation for the Certificate. If true, a file named `keystore.jks` will be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef`. The keystore file will be updated immediately. A file named `truststore.jks` will also be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef` containing the issuing Certificate Authority - type: boolean - passwordSecretRef: - description: PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the JKS keystore. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - pkcs12: - description: PKCS12 configures options for storing a PKCS12 keystore in the `spec.secretName` Secret resource. - type: object - required: - - create - - passwordSecretRef - properties: - create: - description: Create enables PKCS12 keystore creation for the Certificate. If true, a file named `keystore.p12` will be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef`. The keystore file will be updated immediately. A file named `truststore.p12` will also be created in the target Secret resource, encrypted using the password stored in `passwordSecretRef` containing the issuing Certificate Authority - type: boolean - passwordSecretRef: - description: PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the PKCS12 keystore. - type: object - required: - - name - properties: - key: - description: The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be defaulted, in others it may be required. - type: string - name: - description: 'Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - literalSubject: - description: LiteralSubject is an LDAP formatted string that represents the [X.509 Subject field](https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6). Use this *instead* of the Subject field if you need to ensure the correct ordering of the RDN sequence, such as when issuing certs for LDAP authentication. See https://github.com/cert-manager/cert-manager/issues/3203, https://github.com/cert-manager/cert-manager/issues/4424. This field is alpha level and is only supported by cert-manager installations where LiteralCertificateSubject feature gate is enabled on both cert-manager controller and webhook. - type: string - privateKey: - description: Options to control private keys used for the Certificate. - type: object - properties: - algorithm: - description: Algorithm is the private key algorithm of the corresponding private key for this certificate. If provided, allowed values are either `RSA`,`Ed25519` or `ECDSA` If `algorithm` is specified and `size` is not provided, key size of 256 will be used for `ECDSA` key algorithm and key size of 2048 will be used for `RSA` key algorithm. key size is ignored when using the `Ed25519` key algorithm. - type: string - enum: - - RSA - - ECDSA - - Ed25519 - encoding: - description: The private key cryptography standards (PKCS) encoding for this certificate's private key to be encoded in. If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1 and PKCS#8, respectively. Defaults to `PKCS1` if not specified. - type: string - enum: - - PKCS1 - - PKCS8 - rotationPolicy: - description: RotationPolicy controls how private keys should be regenerated when a re-issuance is being processed. If set to Never, a private key will only be generated if one does not already exist in the target `spec.secretName`. If one does exists but it does not have the correct algorithm or size, a warning will be raised to await user intervention. If set to Always, a private key matching the specified requirements will be generated whenever a re-issuance occurs. Default is 'Never' for backward compatibility. - type: string - enum: - - Never - - Always - size: - description: Size is the key bit size of the corresponding private key for this certificate. If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`, and will default to `2048` if not specified. If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`, and will default to `256` if not specified. If `algorithm` is set to `Ed25519`, Size is ignored. No other values are allowed. - type: integer - renewBefore: - description: How long before the currently issued certificate's expiry cert-manager should renew the certificate. The default is 2/3 of the issued certificate's duration. Minimum accepted value is 5 minutes. Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration - type: string - revisionHistoryLimit: - description: revisionHistoryLimit is the maximum number of CertificateRequest revisions that are maintained in the Certificate's history. Each revision represents a single `CertificateRequest` created by this Certificate, either when it was created, renewed, or Spec was changed. Revisions will be removed by oldest first if the number of revisions exceeds this number. If set, revisionHistoryLimit must be a value of `1` or greater. If unset (`nil`), revisions will not be garbage collected. Default value is `nil`. - type: integer - format: int32 - secretName: - description: SecretName is the name of the secret resource that will be automatically created and managed by this Certificate resource. It will be populated with a private key and certificate, signed by the denoted issuer. - type: string - secretTemplate: - description: SecretTemplate defines annotations and labels to be copied to the Certificate's Secret. Labels and annotations on the Secret will be changed as they appear on the SecretTemplate when added or removed. SecretTemplate annotations are added in conjunction with, and cannot overwrite, the base set of annotations cert-manager sets on the Certificate's Secret. - type: object - properties: - annotations: - description: Annotations is a key value map to be copied to the target Kubernetes Secret. - type: object - additionalProperties: - type: string - labels: - description: Labels is a key value map to be copied to the target Kubernetes Secret. - type: object - additionalProperties: - type: string - subject: - description: Full X509 name specification (https://golang.org/pkg/crypto/x509/pkix/#Name). - type: object - properties: - countries: - description: Countries to be used on the Certificate. - type: array - items: - type: string - localities: - description: Cities to be used on the Certificate. - type: array - items: - type: string - organizationalUnits: - description: Organizational Units to be used on the Certificate. - type: array - items: - type: string - organizations: - description: Organizations to be used on the Certificate. - type: array - items: - type: string - postalCodes: - description: Postal codes to be used on the Certificate. - type: array - items: - type: string - provinces: - description: State/Provinces to be used on the Certificate. - type: array - items: - type: string - serialNumber: - description: Serial number to be used on the Certificate. - type: string - streetAddresses: - description: Street addresses to be used on the Certificate. - type: array - items: - type: string - uris: - description: URIs is a list of URI subjectAltNames to be set on the Certificate. - type: array - items: - type: string - usages: - description: Usages is the set of x509 usages that are requested for the certificate. Defaults to `digital signature` and `key encipherment` if not specified. - type: array - items: - description: "KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12 \n Valid KeyUsage values are as follows: \"signing\", \"digital signature\", \"content commitment\", \"key encipherment\", \"key agreement\", \"data encipherment\", \"cert sign\", \"crl sign\", \"encipher only\", \"decipher only\", \"any\", \"server auth\", \"client auth\", \"code signing\", \"email protection\", \"s/mime\", \"ipsec end system\", \"ipsec tunnel\", \"ipsec user\", \"timestamping\", \"ocsp signing\", \"microsoft sgc\", \"netscape sgc\"" - type: string - enum: - - signing - - digital signature - - content commitment - - key encipherment - - key agreement - - data encipherment - - cert sign - - crl sign - - encipher only - - decipher only - - any - - server auth - - client auth - - code signing - - email protection - - s/mime - - ipsec end system - - ipsec tunnel - - ipsec user - - timestamping - - ocsp signing - - microsoft sgc - - netscape sgc - status: - description: Status of the Certificate. This is set and managed automatically. - type: object - properties: - conditions: - description: List of status conditions to indicate the status of certificates. Known condition types are `Ready` and `Issuing`. - type: array - items: - description: CertificateCondition contains condition information for an Certificate. - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: LastTransitionTime is the timestamp corresponding to the last status change of this condition. - type: string - format: date-time - message: - description: Message is a human readable description of the details of the last transition, complementing reason. - type: string - observedGeneration: - description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Certificate. - type: integer - format: int64 - reason: - description: Reason is a brief machine readable explanation for the condition's last transition. - type: string - status: - description: Status of the condition, one of (`True`, `False`, `Unknown`). - type: string - enum: - - "True" - - "False" - - Unknown - type: - description: Type of the condition, known values are (`Ready`, `Issuing`). - type: string - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - failedIssuanceAttempts: - description: The number of continuous failed issuance attempts up till now. This field gets removed (if set) on a successful issuance and gets set to 1 if unset and an issuance has failed. If an issuance has failed, the delay till the next issuance will be calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts - 1). - type: integer - lastFailureTime: - description: LastFailureTime is the time as recorded by the Certificate controller of the most recent failure to complete a CertificateRequest for this Certificate resource. If set, cert-manager will not re-request another Certificate until 1 hour has elapsed from this time. - type: string - format: date-time - nextPrivateKeySecretName: - description: The name of the Secret resource containing the private key to be used for the next certificate iteration. The keymanager controller will automatically set this field if the `Issuing` condition is set to `True`. It will automatically unset this field when the Issuing condition is not set or False. - type: string - notAfter: - description: The expiration time of the certificate stored in the secret named by this resource in `spec.secretName`. - type: string - format: date-time - notBefore: - description: The time after which the certificate stored in the secret named by this resource in spec.secretName is valid. - type: string - format: date-time - renewalTime: - description: RenewalTime is the time at which the certificate will be next renewed. If not set, no upcoming renewal is scheduled. - type: string - format: date-time - revision: - description: "The current 'revision' of the certificate as issued. \n When a CertificateRequest resource is created, it will have the `cert-manager.io/certificate-revision` set to one greater than the current value of this field. \n Upon issuance, this field will be set to the value of the annotation on the CertificateRequest resource used to issue the certificate. \n Persisting the value on the CertificateRequest resource allows the certificates controller to know whether a request is part of an old issuance or if it is part of the ongoing revision's issuance by checking if the revision value in the annotation is greater than this field." - type: integer - served: true - storage: true ---- -# Source: cert-manager/templates/crds.yaml -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: orders.acme.cert-manager.io - labels: - app: 'cert-manager' - app.kubernetes.io/name: 'cert-manager' - app.kubernetes.io/instance: 'cert-manager' - # Generated labels - app.kubernetes.io/version: "v1.11.0" -spec: - group: acme.cert-manager.io - names: - kind: Order - listKind: OrderList - plural: orders - singular: order - categories: - - cert-manager - - cert-manager-acme - scope: Namespaced - versions: - - name: v1 - subresources: - status: {} - additionalPrinterColumns: - - jsonPath: .status.state - name: State - type: string - - jsonPath: .spec.issuerRef.name - name: Issuer - priority: 1 - type: string - - jsonPath: .status.reason - name: Reason - priority: 1 - type: string - - jsonPath: .metadata.creationTimestamp - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - name: Age - type: date - schema: - openAPIV3Schema: - description: Order is a type to represent an Order with an ACME server - type: object - required: - - metadata - - spec - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - type: object - required: - - issuerRef - - request - properties: - commonName: - description: CommonName is the common name as specified on the DER encoded CSR. If specified, this value must also be present in `dnsNames` or `ipAddresses`. This field must match the corresponding field on the DER encoded CSR. - type: string - dnsNames: - description: DNSNames is a list of DNS names that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR. - type: array - items: - type: string - duration: - description: Duration is the duration for the not after date for the requested certificate. this is set on order creation as pe the ACME spec. - type: string - ipAddresses: - description: IPAddresses is a list of IP addresses that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR. - type: array - items: - type: string - issuerRef: - description: IssuerRef references a properly configured ACME-type Issuer which should be used to create this Order. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Order will be marked as failed. - type: object - required: - - name - properties: - group: - description: Group of the resource being referred to. - type: string - kind: - description: Kind of the resource being referred to. - type: string - name: - description: Name of the resource being referred to. - type: string - request: - description: Certificate signing request bytes in DER encoding. This will be used when finalizing the order. This field must be set on the order. - type: string - format: byte - status: - type: object - properties: - authorizations: - description: Authorizations contains data returned from the ACME server on what authorizations must be completed in order to validate the DNS names specified on the Order. - type: array - items: - description: ACMEAuthorization contains data returned from the ACME server on an authorization that must be completed in order validate a DNS name on an ACME Order resource. - type: object - required: - - url - properties: - challenges: - description: Challenges specifies the challenge types offered by the ACME server. One of these challenge types will be selected when validating the DNS name and an appropriate Challenge resource will be created to perform the ACME challenge process. - type: array - items: - description: Challenge specifies a challenge offered by the ACME server for an Order. An appropriate Challenge resource can be created to perform the ACME challenge process. - type: object - required: - - token - - type - - url - properties: - token: - description: Token is the token that must be presented for this challenge. This is used to compute the 'key' that must also be presented. - type: string - type: - description: Type is the type of challenge being offered, e.g. 'http-01', 'dns-01', 'tls-sni-01', etc. This is the raw value retrieved from the ACME server. Only 'http-01' and 'dns-01' are supported by cert-manager, other values will be ignored. - type: string - url: - description: URL is the URL of this challenge. It can be used to retrieve additional metadata about the Challenge from the ACME server. - type: string - identifier: - description: Identifier is the DNS name to be validated as part of this authorization - type: string - initialState: - description: InitialState is the initial state of the ACME authorization when first fetched from the ACME server. If an Authorization is already 'valid', the Order controller will not create a Challenge resource for the authorization. This will occur when working with an ACME server that enables 'authz reuse' (such as Let's Encrypt's production endpoint). If not set and 'identifier' is set, the state is assumed to be pending and a Challenge will be created. - type: string - enum: - - valid - - ready - - pending - - processing - - invalid - - expired - - errored - url: - description: URL is the URL of the Authorization that must be completed - type: string - wildcard: - description: Wildcard will be true if this authorization is for a wildcard DNS name. If this is true, the identifier will be the *non-wildcard* version of the DNS name. For example, if '*.example.com' is the DNS name being validated, this field will be 'true' and the 'identifier' field will be 'example.com'. - type: boolean - certificate: - description: Certificate is a copy of the PEM encoded certificate for this Order. This field will be populated after the order has been successfully finalized with the ACME server, and the order has transitioned to the 'valid' state. - type: string - format: byte - failureTime: - description: FailureTime stores the time that this order failed. This is used to influence garbage collection and back-off. - type: string - format: date-time - finalizeURL: - description: FinalizeURL of the Order. This is used to obtain certificates for this order once it has been completed. - type: string - reason: - description: Reason optionally provides more information about a why the order is in the current state. - type: string - state: - description: State contains the current state of this Order resource. States 'success' and 'expired' are 'final' - type: string - enum: - - valid - - ready - - pending - - processing - - invalid - - expired - - errored - url: - description: URL of the Order. This will initially be empty when the resource is first created. The Order controller will populate this field when the Order is first processed. This field will be immutable after it is initially set. - type: string - served: true - storage: true diff --git a/cloudflared-6.0.4/charts/common/crds/traefik.io_ingressroutes.yaml b/cloudflared-6.0.4/charts/common/crds/traefik.io_ingressroutes.yaml deleted file mode 100644 index 89aaee7..0000000 --- a/cloudflared-6.0.4/charts/common/crds/traefik.io_ingressroutes.yaml +++ /dev/null @@ -1,275 +0,0 @@ - ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.6.2 - creationTimestamp: null - name: ingressroutes.traefik.io -spec: - group: traefik.io - names: - kind: IngressRoute - listKind: IngressRouteList - plural: ingressroutes - singular: ingressroute - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: IngressRoute is the CRD implementation of a Traefik HTTP Router. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: IngressRouteSpec defines the desired state of IngressRoute. - properties: - entryPoints: - description: 'EntryPoints defines the list of entry point names to - bind to. Entry points have to be configured in the static configuration. - More info: https://doc.traefik.io/traefik/v2.10/routing/entrypoints/ - Default: all.' - items: - type: string - type: array - routes: - description: Routes defines the list of routes. - items: - description: Route holds the HTTP route configuration. - properties: - kind: - description: Kind defines the kind of the route. Rule is the - only supported kind. - enum: - - Rule - type: string - match: - description: 'Match defines the router''s rule. More info: https://doc.traefik.io/traefik/v2.10/routing/routers/#rule' - type: string - middlewares: - description: 'Middlewares defines the list of references to - Middleware resources. More info: https://doc.traefik.io/traefik/v2.10/routing/providers/kubernetes-crd/#kind-middleware' - items: - description: MiddlewareRef is a reference to a Middleware - resource. - properties: - name: - description: Name defines the name of the referenced Middleware - resource. - type: string - namespace: - description: Namespace defines the namespace of the referenced - Middleware resource. - type: string - required: - - name - type: object - type: array - priority: - description: 'Priority defines the router''s priority. More - info: https://doc.traefik.io/traefik/v2.10/routing/routers/#priority' - type: integer - services: - description: Services defines the list of Service. It can contain - any combination of TraefikService and/or reference to a Kubernetes - Service. - items: - description: Service defines an upstream HTTP service to proxy - traffic to. - properties: - kind: - description: Kind defines the kind of the Service. - enum: - - Service - - TraefikService - type: string - name: - description: Name defines the name of the referenced Kubernetes - Service or TraefikService. The differentiation between - the two is specified in the Kind field. - type: string - namespace: - description: Namespace defines the namespace of the referenced - Kubernetes Service or TraefikService. - type: string - nativeLB: - description: NativeLB controls, when creating the load-balancer, - whether the LB's children are directly the pods IPs - or if the only child is the Kubernetes Service clusterIP. - The Kubernetes Service itself does load-balance to the - pods. By default, NativeLB is false. - type: boolean - passHostHeader: - description: PassHostHeader defines whether the client - Host header is forwarded to the upstream Kubernetes - Service. By default, passHostHeader is true. - type: boolean - port: - anyOf: - - type: integer - - type: string - description: Port defines the port of a Kubernetes Service. - This can be a reference to a named port. - x-kubernetes-int-or-string: true - responseForwarding: - description: ResponseForwarding defines how Traefik forwards - the response from the upstream Kubernetes Service to - the client. - properties: - flushInterval: - description: 'FlushInterval defines the interval, - in milliseconds, in between flushes to the client - while copying the response body. A negative value - means to flush immediately after each write to the - client. This configuration is ignored when ReverseProxy - recognizes a response as a streaming response; for - such responses, writes are flushed to the client - immediately. Default: 100ms' - type: string - type: object - scheme: - description: Scheme defines the scheme to use for the - request to the upstream Kubernetes Service. It defaults - to https when Kubernetes Service port is 443, http otherwise. - type: string - serversTransport: - description: ServersTransport defines the name of ServersTransport - resource to use. It allows to configure the transport - between Traefik and your servers. Can only be used on - a Kubernetes Service. - type: string - sticky: - description: 'Sticky defines the sticky sessions configuration. - More info: https://doc.traefik.io/traefik/v2.10/routing/services/#sticky-sessions' - properties: - cookie: - description: Cookie defines the sticky cookie configuration. - properties: - httpOnly: - description: HTTPOnly defines whether the cookie - can be accessed by client-side APIs, such as - JavaScript. - type: boolean - name: - description: Name defines the Cookie name. - type: string - sameSite: - description: 'SameSite defines the same site policy. - More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite' - type: string - secure: - description: Secure defines whether the cookie - can only be transmitted over an encrypted connection - (i.e. HTTPS). - type: boolean - type: object - type: object - strategy: - description: Strategy defines the load balancing strategy - between the servers. RoundRobin is the only supported - value at the moment. - type: string - weight: - description: Weight defines the weight and should only - be specified when Name references a TraefikService object - (and to be precise, one that embeds a Weighted Round - Robin). - type: integer - required: - - name - type: object - type: array - required: - - kind - - match - type: object - type: array - tls: - description: 'TLS defines the TLS configuration. More info: https://doc.traefik.io/traefik/v2.10/routing/routers/#tls' - properties: - certResolver: - description: 'CertResolver defines the name of the certificate - resolver to use. Cert resolvers have to be configured in the - static configuration. More info: https://doc.traefik.io/traefik/v2.10/https/acme/#certificate-resolvers' - type: string - domains: - description: 'Domains defines the list of domains that will be - used to issue certificates. More info: https://doc.traefik.io/traefik/v2.10/routing/routers/#domains' - items: - description: Domain holds a domain name with SANs. - properties: - main: - description: Main defines the main domain name. - type: string - sans: - description: SANs defines the subject alternative domain - names. - items: - type: string - type: array - type: object - type: array - options: - description: 'Options defines the reference to a TLSOption, that - specifies the parameters of the TLS connection. If not defined, - the `default` TLSOption is used. More info: https://doc.traefik.io/traefik/v2.10/https/tls/#tls-options' - properties: - name: - description: 'Name defines the name of the referenced TLSOption. - More info: https://doc.traefik.io/traefik/v2.10/routing/providers/kubernetes-crd/#kind-tlsoption' - type: string - namespace: - description: 'Namespace defines the namespace of the referenced - TLSOption. More info: https://doc.traefik.io/traefik/v2.10/routing/providers/kubernetes-crd/#kind-tlsoption' - type: string - required: - - name - type: object - secretName: - description: SecretName is the name of the referenced Kubernetes - Secret to specify the certificate details. - type: string - store: - description: Store defines the reference to the TLSStore, that - will be used to store certificates. Please note that only `default` - TLSStore can be used. - properties: - name: - description: 'Name defines the name of the referenced TLSStore. - More info: https://doc.traefik.io/traefik/v2.10/routing/providers/kubernetes-crd/#kind-tlsstore' - type: string - namespace: - description: 'Namespace defines the namespace of the referenced - TLSStore. More info: https://doc.traefik.io/traefik/v2.10/routing/providers/kubernetes-crd/#kind-tlsstore' - type: string - required: - - name - type: object - type: object - required: - - routes - type: object - required: - - metadata - - spec - type: object - served: true - storage: true -status: - acceptedNames: - kind: "" - plural: "" - conditions: [] - storedVersions: [] diff --git a/cloudflared-6.0.4/charts/common/crds/traefik.io_ingressroutetcps.yaml b/cloudflared-6.0.4/charts/common/crds/traefik.io_ingressroutetcps.yaml deleted file mode 100644 index 82f61ac..0000000 --- a/cloudflared-6.0.4/charts/common/crds/traefik.io_ingressroutetcps.yaml +++ /dev/null @@ -1,218 +0,0 @@ - ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.6.2 - creationTimestamp: null - name: ingressroutetcps.traefik.io -spec: - group: traefik.io - names: - kind: IngressRouteTCP - listKind: IngressRouteTCPList - plural: ingressroutetcps - singular: ingressroutetcp - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: IngressRouteTCP is the CRD implementation of a Traefik TCP Router. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: IngressRouteTCPSpec defines the desired state of IngressRouteTCP. - properties: - entryPoints: - description: 'EntryPoints defines the list of entry point names to - bind to. Entry points have to be configured in the static configuration. - More info: https://doc.traefik.io/traefik/v2.10/routing/entrypoints/ - Default: all.' - items: - type: string - type: array - routes: - description: Routes defines the list of routes. - items: - description: RouteTCP holds the TCP route configuration. - properties: - match: - description: 'Match defines the router''s rule. More info: https://doc.traefik.io/traefik/v2.10/routing/routers/#rule_1' - type: string - middlewares: - description: Middlewares defines the list of references to MiddlewareTCP - resources. - items: - description: ObjectReference is a generic reference to a Traefik - resource. - properties: - name: - description: Name defines the name of the referenced Traefik - resource. - type: string - namespace: - description: Namespace defines the namespace of the referenced - Traefik resource. - type: string - required: - - name - type: object - type: array - priority: - description: 'Priority defines the router''s priority. More - info: https://doc.traefik.io/traefik/v2.10/routing/routers/#priority_1' - type: integer - services: - description: Services defines the list of TCP services. - items: - description: ServiceTCP defines an upstream TCP service to - proxy traffic to. - properties: - name: - description: Name defines the name of the referenced Kubernetes - Service. - type: string - namespace: - description: Namespace defines the namespace of the referenced - Kubernetes Service. - type: string - nativeLB: - description: NativeLB controls, when creating the load-balancer, - whether the LB's children are directly the pods IPs - or if the only child is the Kubernetes Service clusterIP. - The Kubernetes Service itself does load-balance to the - pods. By default, NativeLB is false. - type: boolean - port: - anyOf: - - type: integer - - type: string - description: Port defines the port of a Kubernetes Service. - This can be a reference to a named port. - x-kubernetes-int-or-string: true - proxyProtocol: - description: 'ProxyProtocol defines the PROXY protocol - configuration. More info: https://doc.traefik.io/traefik/v2.10/routing/services/#proxy-protocol' - properties: - version: - description: Version defines the PROXY Protocol version - to use. - type: integer - type: object - terminationDelay: - description: TerminationDelay defines the deadline that - the proxy sets, after one of its connected peers indicates - it has closed the writing capability of its connection, - to close the reading capability as well, hence fully - terminating the connection. It is a duration in milliseconds, - defaulting to 100. A negative value means an infinite - deadline (i.e. the reading capability is never closed). - type: integer - weight: - description: Weight defines the weight used when balancing - requests between multiple Kubernetes Service. - type: integer - required: - - name - - port - type: object - type: array - required: - - match - type: object - type: array - tls: - description: 'TLS defines the TLS configuration on a layer 4 / TCP - Route. More info: https://doc.traefik.io/traefik/v2.10/routing/routers/#tls_1' - properties: - certResolver: - description: 'CertResolver defines the name of the certificate - resolver to use. Cert resolvers have to be configured in the - static configuration. More info: https://doc.traefik.io/traefik/v2.10/https/acme/#certificate-resolvers' - type: string - domains: - description: 'Domains defines the list of domains that will be - used to issue certificates. More info: https://doc.traefik.io/traefik/v2.10/routing/routers/#domains' - items: - description: Domain holds a domain name with SANs. - properties: - main: - description: Main defines the main domain name. - type: string - sans: - description: SANs defines the subject alternative domain - names. - items: - type: string - type: array - type: object - type: array - options: - description: 'Options defines the reference to a TLSOption, that - specifies the parameters of the TLS connection. If not defined, - the `default` TLSOption is used. More info: https://doc.traefik.io/traefik/v2.10/https/tls/#tls-options' - properties: - name: - description: Name defines the name of the referenced Traefik - resource. - type: string - namespace: - description: Namespace defines the namespace of the referenced - Traefik resource. - type: string - required: - - name - type: object - passthrough: - description: Passthrough defines whether a TLS router will terminate - the TLS connection. - type: boolean - secretName: - description: SecretName is the name of the referenced Kubernetes - Secret to specify the certificate details. - type: string - store: - description: Store defines the reference to the TLSStore, that - will be used to store certificates. Please note that only `default` - TLSStore can be used. - properties: - name: - description: Name defines the name of the referenced Traefik - resource. - type: string - namespace: - description: Namespace defines the namespace of the referenced - Traefik resource. - type: string - required: - - name - type: object - type: object - required: - - routes - type: object - required: - - metadata - - spec - type: object - served: true - storage: true -status: - acceptedNames: - kind: "" - plural: "" - conditions: [] - storedVersions: [] diff --git a/cloudflared-6.0.4/charts/common/crds/traefik.io_ingressrouteudps.yaml b/cloudflared-6.0.4/charts/common/crds/traefik.io_ingressrouteudps.yaml deleted file mode 100644 index 27c5018..0000000 --- a/cloudflared-6.0.4/charts/common/crds/traefik.io_ingressrouteudps.yaml +++ /dev/null @@ -1,105 +0,0 @@ - ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.6.2 - creationTimestamp: null - name: ingressrouteudps.traefik.io -spec: - group: traefik.io - names: - kind: IngressRouteUDP - listKind: IngressRouteUDPList - plural: ingressrouteudps - singular: ingressrouteudp - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: IngressRouteUDP is a CRD implementation of a Traefik UDP Router. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: IngressRouteUDPSpec defines the desired state of a IngressRouteUDP. - properties: - entryPoints: - description: 'EntryPoints defines the list of entry point names to - bind to. Entry points have to be configured in the static configuration. - More info: https://doc.traefik.io/traefik/v2.10/routing/entrypoints/ - Default: all.' - items: - type: string - type: array - routes: - description: Routes defines the list of routes. - items: - description: RouteUDP holds the UDP route configuration. - properties: - services: - description: Services defines the list of UDP services. - items: - description: ServiceUDP defines an upstream UDP service to - proxy traffic to. - properties: - name: - description: Name defines the name of the referenced Kubernetes - Service. - type: string - namespace: - description: Namespace defines the namespace of the referenced - Kubernetes Service. - type: string - nativeLB: - description: NativeLB controls, when creating the load-balancer, - whether the LB's children are directly the pods IPs - or if the only child is the Kubernetes Service clusterIP. - The Kubernetes Service itself does load-balance to the - pods. By default, NativeLB is false. - type: boolean - port: - anyOf: - - type: integer - - type: string - description: Port defines the port of a Kubernetes Service. - This can be a reference to a named port. - x-kubernetes-int-or-string: true - weight: - description: Weight defines the weight used when balancing - requests between multiple Kubernetes Service. - type: integer - required: - - name - - port - type: object - type: array - type: object - type: array - required: - - routes - type: object - required: - - metadata - - spec - type: object - served: true - storage: true -status: - acceptedNames: - kind: "" - plural: "" - conditions: [] - storedVersions: [] diff --git a/cloudflared-6.0.4/charts/common/crds/traefik.io_middlewares.yaml b/cloudflared-6.0.4/charts/common/crds/traefik.io_middlewares.yaml deleted file mode 100644 index 5a4dc36..0000000 --- a/cloudflared-6.0.4/charts/common/crds/traefik.io_middlewares.yaml +++ /dev/null @@ -1,924 +0,0 @@ - ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.6.2 - creationTimestamp: null - name: middlewares.traefik.io -spec: - group: traefik.io - names: - kind: Middleware - listKind: MiddlewareList - plural: middlewares - singular: middleware - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: 'Middleware is the CRD implementation of a Traefik Middleware. - More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/overview/' - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: MiddlewareSpec defines the desired state of a Middleware. - properties: - addPrefix: - description: 'AddPrefix holds the add prefix middleware configuration. - This middleware updates the path of a request before forwarding - it. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/addprefix/' - properties: - prefix: - description: Prefix is the string to add before the current path - in the requested URL. It should include a leading slash (/). - type: string - type: object - basicAuth: - description: 'BasicAuth holds the basic auth middleware configuration. - This middleware restricts access to your services to known users. - More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/basicauth/' - properties: - headerField: - description: 'HeaderField defines a header field to store the - authenticated user. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/basicauth/#headerfield' - type: string - realm: - description: 'Realm allows the protected resources on a server - to be partitioned into a set of protection spaces, each with - its own authentication scheme. Default: traefik.' - type: string - removeHeader: - description: 'RemoveHeader sets the removeHeader option to true - to remove the authorization header before forwarding the request - to your service. Default: false.' - type: boolean - secret: - description: Secret is the name of the referenced Kubernetes Secret - containing user credentials. - type: string - type: object - buffering: - description: 'Buffering holds the buffering middleware configuration. - This middleware retries or limits the size of requests that can - be forwarded to backends. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/buffering/#maxrequestbodybytes' - properties: - maxRequestBodyBytes: - description: 'MaxRequestBodyBytes defines the maximum allowed - body size for the request (in bytes). If the request exceeds - the allowed size, it is not forwarded to the service, and the - client gets a 413 (Request Entity Too Large) response. Default: - 0 (no maximum).' - format: int64 - type: integer - maxResponseBodyBytes: - description: 'MaxResponseBodyBytes defines the maximum allowed - response size from the service (in bytes). If the response exceeds - the allowed size, it is not forwarded to the client. The client - gets a 500 (Internal Server Error) response instead. Default: - 0 (no maximum).' - format: int64 - type: integer - memRequestBodyBytes: - description: 'MemRequestBodyBytes defines the threshold (in bytes) - from which the request will be buffered on disk instead of in - memory. Default: 1048576 (1Mi).' - format: int64 - type: integer - memResponseBodyBytes: - description: 'MemResponseBodyBytes defines the threshold (in bytes) - from which the response will be buffered on disk instead of - in memory. Default: 1048576 (1Mi).' - format: int64 - type: integer - retryExpression: - description: 'RetryExpression defines the retry conditions. It - is a logical combination of functions with operators AND (&&) - and OR (||). More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/buffering/#retryexpression' - type: string - type: object - chain: - description: 'Chain holds the configuration of the chain middleware. - This middleware enables to define reusable combinations of other - pieces of middleware. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/chain/' - properties: - middlewares: - description: Middlewares is the list of MiddlewareRef which composes - the chain. - items: - description: MiddlewareRef is a reference to a Middleware resource. - properties: - name: - description: Name defines the name of the referenced Middleware - resource. - type: string - namespace: - description: Namespace defines the namespace of the referenced - Middleware resource. - type: string - required: - - name - type: object - type: array - type: object - circuitBreaker: - description: CircuitBreaker holds the circuit breaker configuration. - properties: - checkPeriod: - anyOf: - - type: integer - - type: string - description: CheckPeriod is the interval between successive checks - of the circuit breaker condition (when in standby state). - x-kubernetes-int-or-string: true - expression: - description: Expression is the condition that triggers the tripped - state. - type: string - fallbackDuration: - anyOf: - - type: integer - - type: string - description: FallbackDuration is the duration for which the circuit - breaker will wait before trying to recover (from a tripped state). - x-kubernetes-int-or-string: true - recoveryDuration: - anyOf: - - type: integer - - type: string - description: RecoveryDuration is the duration for which the circuit - breaker will try to recover (as soon as it is in recovering - state). - x-kubernetes-int-or-string: true - type: object - compress: - description: 'Compress holds the compress middleware configuration. - This middleware compresses responses before sending them to the - client, using gzip compression. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/compress/' - properties: - excludedContentTypes: - description: ExcludedContentTypes defines the list of content - types to compare the Content-Type header of the incoming requests - and responses before compressing. - items: - type: string - type: array - minResponseBodyBytes: - description: 'MinResponseBodyBytes defines the minimum amount - of bytes a response body must have to be compressed. Default: - 1024.' - type: integer - type: object - contentType: - description: ContentType holds the content-type middleware configuration. - This middleware exists to enable the correct behavior until at least - the default one can be changed in a future version. - properties: - autoDetect: - description: AutoDetect specifies whether to let the `Content-Type` - header, if it has not been set by the backend, be automatically - set to a value derived from the contents of the response. As - a proxy, the default behavior should be to leave the header - alone, regardless of what the backend did with it. However, - the historic default was to always auto-detect and set the header - if it was nil, and it is going to be kept that way in order - to support users currently relying on it. - type: boolean - type: object - digestAuth: - description: 'DigestAuth holds the digest auth middleware configuration. - This middleware restricts access to your services to known users. - More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/digestauth/' - properties: - headerField: - description: 'HeaderField defines a header field to store the - authenticated user. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/basicauth/#headerfield' - type: string - realm: - description: 'Realm allows the protected resources on a server - to be partitioned into a set of protection spaces, each with - its own authentication scheme. Default: traefik.' - type: string - removeHeader: - description: RemoveHeader defines whether to remove the authorization - header before forwarding the request to the backend. - type: boolean - secret: - description: Secret is the name of the referenced Kubernetes Secret - containing user credentials. - type: string - type: object - errors: - description: 'ErrorPage holds the custom error middleware configuration. - This middleware returns a custom page in lieu of the default, according - to configured ranges of HTTP Status codes. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/errorpages/' - properties: - query: - description: Query defines the URL for the error page (hosted - by service). The {status} variable can be used in order to insert - the status code in the URL. - type: string - service: - description: 'Service defines the reference to a Kubernetes Service - that will serve the error page. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/errorpages/#service' - properties: - kind: - description: Kind defines the kind of the Service. - enum: - - Service - - TraefikService - type: string - name: - description: Name defines the name of the referenced Kubernetes - Service or TraefikService. The differentiation between the - two is specified in the Kind field. - type: string - namespace: - description: Namespace defines the namespace of the referenced - Kubernetes Service or TraefikService. - type: string - nativeLB: - description: NativeLB controls, when creating the load-balancer, - whether the LB's children are directly the pods IPs or if - the only child is the Kubernetes Service clusterIP. The - Kubernetes Service itself does load-balance to the pods. - By default, NativeLB is false. - type: boolean - passHostHeader: - description: PassHostHeader defines whether the client Host - header is forwarded to the upstream Kubernetes Service. - By default, passHostHeader is true. - type: boolean - port: - anyOf: - - type: integer - - type: string - description: Port defines the port of a Kubernetes Service. - This can be a reference to a named port. - x-kubernetes-int-or-string: true - responseForwarding: - description: ResponseForwarding defines how Traefik forwards - the response from the upstream Kubernetes Service to the - client. - properties: - flushInterval: - description: 'FlushInterval defines the interval, in milliseconds, - in between flushes to the client while copying the response - body. A negative value means to flush immediately after - each write to the client. This configuration is ignored - when ReverseProxy recognizes a response as a streaming - response; for such responses, writes are flushed to - the client immediately. Default: 100ms' - type: string - type: object - scheme: - description: Scheme defines the scheme to use for the request - to the upstream Kubernetes Service. It defaults to https - when Kubernetes Service port is 443, http otherwise. - type: string - serversTransport: - description: ServersTransport defines the name of ServersTransport - resource to use. It allows to configure the transport between - Traefik and your servers. Can only be used on a Kubernetes - Service. - type: string - sticky: - description: 'Sticky defines the sticky sessions configuration. - More info: https://doc.traefik.io/traefik/v2.10/routing/services/#sticky-sessions' - properties: - cookie: - description: Cookie defines the sticky cookie configuration. - properties: - httpOnly: - description: HTTPOnly defines whether the cookie can - be accessed by client-side APIs, such as JavaScript. - type: boolean - name: - description: Name defines the Cookie name. - type: string - sameSite: - description: 'SameSite defines the same site policy. - More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite' - type: string - secure: - description: Secure defines whether the cookie can - only be transmitted over an encrypted connection - (i.e. HTTPS). - type: boolean - type: object - type: object - strategy: - description: Strategy defines the load balancing strategy - between the servers. RoundRobin is the only supported value - at the moment. - type: string - weight: - description: Weight defines the weight and should only be - specified when Name references a TraefikService object (and - to be precise, one that embeds a Weighted Round Robin). - type: integer - required: - - name - type: object - status: - description: Status defines which status or range of statuses - should result in an error page. It can be either a status code - as a number (500), as multiple comma-separated numbers (500,502), - as ranges by separating two codes with a dash (500-599), or - a combination of the two (404,418,500-599). - items: - type: string - type: array - type: object - forwardAuth: - description: 'ForwardAuth holds the forward auth middleware configuration. - This middleware delegates the request authentication to a Service. - More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/forwardauth/' - properties: - address: - description: Address defines the authentication server address. - type: string - authRequestHeaders: - description: AuthRequestHeaders defines the list of the headers - to copy from the request to the authentication server. If not - set or empty then all request headers are passed. - items: - type: string - type: array - authResponseHeaders: - description: AuthResponseHeaders defines the list of headers to - copy from the authentication server response and set on forwarded - request, replacing any existing conflicting headers. - items: - type: string - type: array - authResponseHeadersRegex: - description: 'AuthResponseHeadersRegex defines the regex to match - headers to copy from the authentication server response and - set on forwarded request, after stripping all headers that match - the regex. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/forwardauth/#authresponseheadersregex' - type: string - tls: - description: TLS defines the configuration used to secure the - connection to the authentication server. - properties: - caOptional: - type: boolean - caSecret: - description: CASecret is the name of the referenced Kubernetes - Secret containing the CA to validate the server certificate. - The CA certificate is extracted from key `tls.ca` or `ca.crt`. - type: string - certSecret: - description: CertSecret is the name of the referenced Kubernetes - Secret containing the client certificate. The client certificate - is extracted from the keys `tls.crt` and `tls.key`. - type: string - insecureSkipVerify: - description: InsecureSkipVerify defines whether the server - certificates should be validated. - type: boolean - type: object - trustForwardHeader: - description: 'TrustForwardHeader defines whether to trust (ie: - forward) all X-Forwarded-* headers.' - type: boolean - type: object - headers: - description: 'Headers holds the headers middleware configuration. - This middleware manages the requests and responses headers. More - info: https://doc.traefik.io/traefik/v2.10/middlewares/http/headers/#customrequestheaders' - properties: - accessControlAllowCredentials: - description: AccessControlAllowCredentials defines whether the - request can include user credentials. - type: boolean - accessControlAllowHeaders: - description: AccessControlAllowHeaders defines the Access-Control-Request-Headers - values sent in preflight response. - items: - type: string - type: array - accessControlAllowMethods: - description: AccessControlAllowMethods defines the Access-Control-Request-Method - values sent in preflight response. - items: - type: string - type: array - accessControlAllowOriginList: - description: AccessControlAllowOriginList is a list of allowable - origins. Can also be a wildcard origin "*". - items: - type: string - type: array - accessControlAllowOriginListRegex: - description: AccessControlAllowOriginListRegex is a list of allowable - origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/). - items: - type: string - type: array - accessControlExposeHeaders: - description: AccessControlExposeHeaders defines the Access-Control-Expose-Headers - values sent in preflight response. - items: - type: string - type: array - accessControlMaxAge: - description: AccessControlMaxAge defines the time that a preflight - request may be cached. - format: int64 - type: integer - addVaryHeader: - description: AddVaryHeader defines whether the Vary header is - automatically added/updated when the AccessControlAllowOriginList - is set. - type: boolean - allowedHosts: - description: AllowedHosts defines the fully qualified list of - allowed domain names. - items: - type: string - type: array - browserXssFilter: - description: BrowserXSSFilter defines whether to add the X-XSS-Protection - header with the value 1; mode=block. - type: boolean - contentSecurityPolicy: - description: ContentSecurityPolicy defines the Content-Security-Policy - header value. - type: string - contentTypeNosniff: - description: ContentTypeNosniff defines whether to add the X-Content-Type-Options - header with the nosniff value. - type: boolean - customBrowserXSSValue: - description: CustomBrowserXSSValue defines the X-XSS-Protection - header value. This overrides the BrowserXssFilter option. - type: string - customFrameOptionsValue: - description: CustomFrameOptionsValue defines the X-Frame-Options - header value. This overrides the FrameDeny option. - type: string - customRequestHeaders: - additionalProperties: - type: string - description: CustomRequestHeaders defines the header names and - values to apply to the request. - type: object - customResponseHeaders: - additionalProperties: - type: string - description: CustomResponseHeaders defines the header names and - values to apply to the response. - type: object - featurePolicy: - description: 'Deprecated: use PermissionsPolicy instead.' - type: string - forceSTSHeader: - description: ForceSTSHeader defines whether to add the STS header - even when the connection is HTTP. - type: boolean - frameDeny: - description: FrameDeny defines whether to add the X-Frame-Options - header with the DENY value. - type: boolean - hostsProxyHeaders: - description: HostsProxyHeaders defines the header keys that may - hold a proxied hostname value for the request. - items: - type: string - type: array - isDevelopment: - description: IsDevelopment defines whether to mitigate the unwanted - effects of the AllowedHosts, SSL, and STS options when developing. - Usually testing takes place using HTTP, not HTTPS, and on localhost, - not your production domain. If you would like your development - environment to mimic production with complete Host blocking, - SSL redirects, and STS headers, leave this as false. - type: boolean - permissionsPolicy: - description: PermissionsPolicy defines the Permissions-Policy - header value. This allows sites to control browser features. - type: string - publicKey: - description: PublicKey is the public key that implements HPKP - to prevent MITM attacks with forged certificates. - type: string - referrerPolicy: - description: ReferrerPolicy defines the Referrer-Policy header - value. This allows sites to control whether browsers forward - the Referer header to other sites. - type: string - sslForceHost: - description: 'Deprecated: use RedirectRegex instead.' - type: boolean - sslHost: - description: 'Deprecated: use RedirectRegex instead.' - type: string - sslProxyHeaders: - additionalProperties: - type: string - description: 'SSLProxyHeaders defines the header keys with associated - values that would indicate a valid HTTPS request. It can be - useful when using other proxies (example: "X-Forwarded-Proto": - "https").' - type: object - sslRedirect: - description: 'Deprecated: use EntryPoint redirection or RedirectScheme - instead.' - type: boolean - sslTemporaryRedirect: - description: 'Deprecated: use EntryPoint redirection or RedirectScheme - instead.' - type: boolean - stsIncludeSubdomains: - description: STSIncludeSubdomains defines whether the includeSubDomains - directive is appended to the Strict-Transport-Security header. - type: boolean - stsPreload: - description: STSPreload defines whether the preload flag is appended - to the Strict-Transport-Security header. - type: boolean - stsSeconds: - description: STSSeconds defines the max-age of the Strict-Transport-Security - header. If set to 0, the header is not set. - format: int64 - type: integer - type: object - inFlightReq: - description: 'InFlightReq holds the in-flight request middleware configuration. - This middleware limits the number of requests being processed and - served concurrently. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/inflightreq/' - properties: - amount: - description: Amount defines the maximum amount of allowed simultaneous - in-flight request. The middleware responds with HTTP 429 Too - Many Requests if there are already amount requests in progress - (based on the same sourceCriterion strategy). - format: int64 - type: integer - sourceCriterion: - description: 'SourceCriterion defines what criterion is used to - group requests as originating from a common source. If several - strategies are defined at the same time, an error will be raised. - If none are set, the default is to use the requestHost. More - info: https://doc.traefik.io/traefik/v2.10/middlewares/http/inflightreq/#sourcecriterion' - properties: - ipStrategy: - description: 'IPStrategy holds the IP strategy configuration - used by Traefik to determine the client IP. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/ipwhitelist/#ipstrategy' - properties: - depth: - description: Depth tells Traefik to use the X-Forwarded-For - header and take the IP located at the depth position - (starting from the right). - type: integer - excludedIPs: - description: ExcludedIPs configures Traefik to scan the - X-Forwarded-For header and select the first IP not in - the list. - items: - type: string - type: array - type: object - requestHeaderName: - description: RequestHeaderName defines the name of the header - used to group incoming requests. - type: string - requestHost: - description: RequestHost defines whether to consider the request - Host as the source. - type: boolean - type: object - type: object - ipWhiteList: - description: 'IPWhiteList holds the IP whitelist middleware configuration. - This middleware accepts / refuses requests based on the client IP. - More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/ipwhitelist/' - properties: - ipStrategy: - description: 'IPStrategy holds the IP strategy configuration used - by Traefik to determine the client IP. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/ipwhitelist/#ipstrategy' - properties: - depth: - description: Depth tells Traefik to use the X-Forwarded-For - header and take the IP located at the depth position (starting - from the right). - type: integer - excludedIPs: - description: ExcludedIPs configures Traefik to scan the X-Forwarded-For - header and select the first IP not in the list. - items: - type: string - type: array - type: object - sourceRange: - description: SourceRange defines the set of allowed IPs (or ranges - of allowed IPs by using CIDR notation). - items: - type: string - type: array - type: object - passTLSClientCert: - description: 'PassTLSClientCert holds the pass TLS client cert middleware - configuration. This middleware adds the selected data from the passed - client TLS certificate to a header. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/passtlsclientcert/' - properties: - info: - description: Info selects the specific client certificate details - you want to add to the X-Forwarded-Tls-Client-Cert-Info header. - properties: - issuer: - description: Issuer defines the client certificate issuer - details to add to the X-Forwarded-Tls-Client-Cert-Info header. - properties: - commonName: - description: CommonName defines whether to add the organizationalUnit - information into the issuer. - type: boolean - country: - description: Country defines whether to add the country - information into the issuer. - type: boolean - domainComponent: - description: DomainComponent defines whether to add the - domainComponent information into the issuer. - type: boolean - locality: - description: Locality defines whether to add the locality - information into the issuer. - type: boolean - organization: - description: Organization defines whether to add the organization - information into the issuer. - type: boolean - province: - description: Province defines whether to add the province - information into the issuer. - type: boolean - serialNumber: - description: SerialNumber defines whether to add the serialNumber - information into the issuer. - type: boolean - type: object - notAfter: - description: NotAfter defines whether to add the Not After - information from the Validity part. - type: boolean - notBefore: - description: NotBefore defines whether to add the Not Before - information from the Validity part. - type: boolean - sans: - description: Sans defines whether to add the Subject Alternative - Name information from the Subject Alternative Name part. - type: boolean - serialNumber: - description: SerialNumber defines whether to add the client - serialNumber information. - type: boolean - subject: - description: Subject defines the client certificate subject - details to add to the X-Forwarded-Tls-Client-Cert-Info header. - properties: - commonName: - description: CommonName defines whether to add the organizationalUnit - information into the subject. - type: boolean - country: - description: Country defines whether to add the country - information into the subject. - type: boolean - domainComponent: - description: DomainComponent defines whether to add the - domainComponent information into the subject. - type: boolean - locality: - description: Locality defines whether to add the locality - information into the subject. - type: boolean - organization: - description: Organization defines whether to add the organization - information into the subject. - type: boolean - organizationalUnit: - description: OrganizationalUnit defines whether to add - the organizationalUnit information into the subject. - type: boolean - province: - description: Province defines whether to add the province - information into the subject. - type: boolean - serialNumber: - description: SerialNumber defines whether to add the serialNumber - information into the subject. - type: boolean - type: object - type: object - pem: - description: PEM sets the X-Forwarded-Tls-Client-Cert header with - the certificate. - type: boolean - type: object - plugin: - additionalProperties: - x-kubernetes-preserve-unknown-fields: true - description: 'Plugin defines the middleware plugin configuration. - More info: https://doc.traefik.io/traefik/plugins/' - type: object - rateLimit: - description: 'RateLimit holds the rate limit configuration. This middleware - ensures that services will receive a fair amount of requests, and - allows one to define what fair is. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/ratelimit/' - properties: - average: - description: Average is the maximum rate, by default in requests/s, - allowed for the given source. It defaults to 0, which means - no rate limiting. The rate is actually defined by dividing Average - by Period. So for a rate below 1req/s, one needs to define a - Period larger than a second. - format: int64 - type: integer - burst: - description: Burst is the maximum number of requests allowed to - arrive in the same arbitrarily small period of time. It defaults - to 1. - format: int64 - type: integer - period: - anyOf: - - type: integer - - type: string - description: 'Period, in combination with Average, defines the - actual maximum rate, such as: r = Average / Period. It defaults - to a second.' - x-kubernetes-int-or-string: true - sourceCriterion: - description: SourceCriterion defines what criterion is used to - group requests as originating from a common source. If several - strategies are defined at the same time, an error will be raised. - If none are set, the default is to use the request's remote - address field (as an ipStrategy). - properties: - ipStrategy: - description: 'IPStrategy holds the IP strategy configuration - used by Traefik to determine the client IP. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/ipwhitelist/#ipstrategy' - properties: - depth: - description: Depth tells Traefik to use the X-Forwarded-For - header and take the IP located at the depth position - (starting from the right). - type: integer - excludedIPs: - description: ExcludedIPs configures Traefik to scan the - X-Forwarded-For header and select the first IP not in - the list. - items: - type: string - type: array - type: object - requestHeaderName: - description: RequestHeaderName defines the name of the header - used to group incoming requests. - type: string - requestHost: - description: RequestHost defines whether to consider the request - Host as the source. - type: boolean - type: object - type: object - redirectRegex: - description: 'RedirectRegex holds the redirect regex middleware configuration. - This middleware redirects a request using regex matching and replacement. - More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/redirectregex/#regex' - properties: - permanent: - description: Permanent defines whether the redirection is permanent - (301). - type: boolean - regex: - description: Regex defines the regex used to match and capture - elements from the request URL. - type: string - replacement: - description: Replacement defines how to modify the URL to have - the new target URL. - type: string - type: object - redirectScheme: - description: 'RedirectScheme holds the redirect scheme middleware - configuration. This middleware redirects requests from a scheme/port - to another. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/redirectscheme/' - properties: - permanent: - description: Permanent defines whether the redirection is permanent - (301). - type: boolean - port: - description: Port defines the port of the new URL. - type: string - scheme: - description: Scheme defines the scheme of the new URL. - type: string - type: object - replacePath: - description: 'ReplacePath holds the replace path middleware configuration. - This middleware replaces the path of the request URL and store the - original path in an X-Replaced-Path header. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/replacepath/' - properties: - path: - description: Path defines the path to use as replacement in the - request URL. - type: string - type: object - replacePathRegex: - description: 'ReplacePathRegex holds the replace path regex middleware - configuration. This middleware replaces the path of a URL using - regex matching and replacement. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/replacepathregex/' - properties: - regex: - description: Regex defines the regular expression used to match - and capture the path from the request URL. - type: string - replacement: - description: Replacement defines the replacement path format, - which can include captured variables. - type: string - type: object - retry: - description: 'Retry holds the retry middleware configuration. This - middleware reissues requests a given number of times to a backend - server if that server does not reply. As soon as the server answers, - the middleware stops retrying, regardless of the response status. - More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/retry/' - properties: - attempts: - description: Attempts defines how many times the request should - be retried. - type: integer - initialInterval: - anyOf: - - type: integer - - type: string - description: InitialInterval defines the first wait time in the - exponential backoff series. The maximum interval is calculated - as twice the initialInterval. If unspecified, requests will - be retried immediately. The value of initialInterval should - be provided in seconds or as a valid duration format, see https://pkg.go.dev/time#ParseDuration. - x-kubernetes-int-or-string: true - type: object - stripPrefix: - description: 'StripPrefix holds the strip prefix middleware configuration. - This middleware removes the specified prefixes from the URL path. - More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/stripprefix/' - properties: - forceSlash: - description: 'ForceSlash ensures that the resulting stripped path - is not the empty string, by replacing it with / when necessary. - Default: true.' - type: boolean - prefixes: - description: Prefixes defines the prefixes to strip from the request - URL. - items: - type: string - type: array - type: object - stripPrefixRegex: - description: 'StripPrefixRegex holds the strip prefix regex middleware - configuration. This middleware removes the matching prefixes from - the URL path. More info: https://doc.traefik.io/traefik/v2.10/middlewares/http/stripprefixregex/' - properties: - regex: - description: Regex defines the regular expression to match the - path prefix from the request URL. - items: - type: string - type: array - type: object - type: object - required: - - metadata - - spec - type: object - served: true - storage: true -status: - acceptedNames: - kind: "" - plural: "" - conditions: [] - storedVersions: [] diff --git a/cloudflared-6.0.4/charts/common/crds/traefik.io_middlewaretcps.yaml b/cloudflared-6.0.4/charts/common/crds/traefik.io_middlewaretcps.yaml deleted file mode 100644 index 8623568..0000000 --- a/cloudflared-6.0.4/charts/common/crds/traefik.io_middlewaretcps.yaml +++ /dev/null @@ -1,72 +0,0 @@ - ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.6.2 - creationTimestamp: null - name: middlewaretcps.traefik.io -spec: - group: traefik.io - names: - kind: MiddlewareTCP - listKind: MiddlewareTCPList - plural: middlewaretcps - singular: middlewaretcp - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: 'MiddlewareTCP is the CRD implementation of a Traefik TCP middleware. - More info: https://doc.traefik.io/traefik/v2.10/middlewares/overview/' - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: MiddlewareTCPSpec defines the desired state of a MiddlewareTCP. - properties: - inFlightConn: - description: InFlightConn defines the InFlightConn middleware configuration. - properties: - amount: - description: Amount defines the maximum amount of allowed simultaneous - connections. The middleware closes the connection if there are - already amount connections opened. - format: int64 - type: integer - type: object - ipWhiteList: - description: IPWhiteList defines the IPWhiteList middleware configuration. - properties: - sourceRange: - description: SourceRange defines the allowed IPs (or ranges of - allowed IPs by using CIDR notation). - items: - type: string - type: array - type: object - type: object - required: - - metadata - - spec - type: object - served: true - storage: true -status: - acceptedNames: - kind: "" - plural: "" - conditions: [] - storedVersions: [] diff --git a/cloudflared-6.0.4/charts/common/crds/traefik.io_serverstransports.yaml b/cloudflared-6.0.4/charts/common/crds/traefik.io_serverstransports.yaml deleted file mode 100644 index 803b563..0000000 --- a/cloudflared-6.0.4/charts/common/crds/traefik.io_serverstransports.yaml +++ /dev/null @@ -1,128 +0,0 @@ - ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.6.2 - creationTimestamp: null - name: serverstransports.traefik.io -spec: - group: traefik.io - names: - kind: ServersTransport - listKind: ServersTransportList - plural: serverstransports - singular: serverstransport - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: 'ServersTransport is the CRD implementation of a ServersTransport. - If no serversTransport is specified, the default@internal will be used. - The default@internal serversTransport is created from the static configuration. - More info: https://doc.traefik.io/traefik/v2.10/routing/services/#serverstransport_1' - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: ServersTransportSpec defines the desired state of a ServersTransport. - properties: - certificatesSecrets: - description: CertificatesSecrets defines a list of secret storing - client certificates for mTLS. - items: - type: string - type: array - disableHTTP2: - description: DisableHTTP2 disables HTTP/2 for connections with backend - servers. - type: boolean - forwardingTimeouts: - description: ForwardingTimeouts defines the timeouts for requests - forwarded to the backend servers. - properties: - dialTimeout: - anyOf: - - type: integer - - type: string - description: DialTimeout is the amount of time to wait until a - connection to a backend server can be established. - x-kubernetes-int-or-string: true - idleConnTimeout: - anyOf: - - type: integer - - type: string - description: IdleConnTimeout is the maximum period for which an - idle HTTP keep-alive connection will remain open before closing - itself. - x-kubernetes-int-or-string: true - pingTimeout: - anyOf: - - type: integer - - type: string - description: PingTimeout is the timeout after which the HTTP/2 - connection will be closed if a response to ping is not received. - x-kubernetes-int-or-string: true - readIdleTimeout: - anyOf: - - type: integer - - type: string - description: ReadIdleTimeout is the timeout after which a health - check using ping frame will be carried out if no frame is received - on the HTTP/2 connection. - x-kubernetes-int-or-string: true - responseHeaderTimeout: - anyOf: - - type: integer - - type: string - description: ResponseHeaderTimeout is the amount of time to wait - for a server's response headers after fully writing the request - (including its body, if any). - x-kubernetes-int-or-string: true - type: object - insecureSkipVerify: - description: InsecureSkipVerify disables SSL certificate verification. - type: boolean - maxIdleConnsPerHost: - description: MaxIdleConnsPerHost controls the maximum idle (keep-alive) - to keep per-host. - type: integer - peerCertURI: - description: PeerCertURI defines the peer cert URI used to match against - SAN URI during the peer certificate verification. - type: string - rootCAsSecrets: - description: RootCAsSecrets defines a list of CA secret used to validate - self-signed certificate. - items: - type: string - type: array - serverName: - description: ServerName defines the server name used to contact the - server. - type: string - type: object - required: - - metadata - - spec - type: object - served: true - storage: true -status: - acceptedNames: - kind: "" - plural: "" - conditions: [] - storedVersions: [] diff --git a/cloudflared-6.0.4/charts/common/crds/traefik.io_tlsoptions.yaml b/cloudflared-6.0.4/charts/common/crds/traefik.io_tlsoptions.yaml deleted file mode 100644 index b86fefe..0000000 --- a/cloudflared-6.0.4/charts/common/crds/traefik.io_tlsoptions.yaml +++ /dev/null @@ -1,113 +0,0 @@ - ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.6.2 - creationTimestamp: null - name: tlsoptions.traefik.io -spec: - group: traefik.io - names: - kind: TLSOption - listKind: TLSOptionList - plural: tlsoptions - singular: tlsoption - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: 'TLSOption is the CRD implementation of a Traefik TLS Option, - allowing to configure some parameters of the TLS connection. More info: - https://doc.traefik.io/traefik/v2.10/https/tls/#tls-options' - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: TLSOptionSpec defines the desired state of a TLSOption. - properties: - alpnProtocols: - description: 'ALPNProtocols defines the list of supported application - level protocols for the TLS handshake, in order of preference. More - info: https://doc.traefik.io/traefik/v2.10/https/tls/#alpn-protocols' - items: - type: string - type: array - cipherSuites: - description: 'CipherSuites defines the list of supported cipher suites - for TLS versions up to TLS 1.2. More info: https://doc.traefik.io/traefik/v2.10/https/tls/#cipher-suites' - items: - type: string - type: array - clientAuth: - description: ClientAuth defines the server's policy for TLS Client - Authentication. - properties: - clientAuthType: - description: ClientAuthType defines the client authentication - type to apply. - enum: - - NoClientCert - - RequestClientCert - - RequireAnyClientCert - - VerifyClientCertIfGiven - - RequireAndVerifyClientCert - type: string - secretNames: - description: SecretNames defines the names of the referenced Kubernetes - Secret storing certificate details. - items: - type: string - type: array - type: object - curvePreferences: - description: 'CurvePreferences defines the preferred elliptic curves - in a specific order. More info: https://doc.traefik.io/traefik/v2.10/https/tls/#curve-preferences' - items: - type: string - type: array - maxVersion: - description: 'MaxVersion defines the maximum TLS version that Traefik - will accept. Possible values: VersionTLS10, VersionTLS11, VersionTLS12, - VersionTLS13. Default: None.' - type: string - minVersion: - description: 'MinVersion defines the minimum TLS version that Traefik - will accept. Possible values: VersionTLS10, VersionTLS11, VersionTLS12, - VersionTLS13. Default: VersionTLS10.' - type: string - preferServerCipherSuites: - description: 'PreferServerCipherSuites defines whether the server - chooses a cipher suite among his own instead of among the client''s. - It is enabled automatically when minVersion or maxVersion is set. - Deprecated: https://github.com/golang/go/issues/45430' - type: boolean - sniStrict: - description: SniStrict defines whether Traefik allows connections - from clients connections that do not specify a server_name extension. - type: boolean - type: object - required: - - metadata - - spec - type: object - served: true - storage: true -status: - acceptedNames: - kind: "" - plural: "" - conditions: [] - storedVersions: [] diff --git a/cloudflared-6.0.4/charts/common/crds/traefik.io_tlsstores.yaml b/cloudflared-6.0.4/charts/common/crds/traefik.io_tlsstores.yaml deleted file mode 100644 index 47b4685..0000000 --- a/cloudflared-6.0.4/charts/common/crds/traefik.io_tlsstores.yaml +++ /dev/null @@ -1,99 +0,0 @@ - ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.6.2 - creationTimestamp: null - name: tlsstores.traefik.io -spec: - group: traefik.io - names: - kind: TLSStore - listKind: TLSStoreList - plural: tlsstores - singular: tlsstore - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: 'TLSStore is the CRD implementation of a Traefik TLS Store. For - the time being, only the TLSStore named default is supported. This means - that you cannot have two stores that are named default in different Kubernetes - namespaces. More info: https://doc.traefik.io/traefik/v2.10/https/tls/#certificates-stores' - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: TLSStoreSpec defines the desired state of a TLSStore. - properties: - certificates: - description: Certificates is a list of secret names, each secret holding - a key/certificate pair to add to the store. - items: - description: Certificate holds a secret name for the TLSStore resource. - properties: - secretName: - description: SecretName is the name of the referenced Kubernetes - Secret to specify the certificate details. - type: string - required: - - secretName - type: object - type: array - defaultCertificate: - description: DefaultCertificate defines the default certificate configuration. - properties: - secretName: - description: SecretName is the name of the referenced Kubernetes - Secret to specify the certificate details. - type: string - required: - - secretName - type: object - defaultGeneratedCert: - description: DefaultGeneratedCert defines the default generated certificate - configuration. - properties: - domain: - description: Domain is the domain definition for the DefaultCertificate. - properties: - main: - description: Main defines the main domain name. - type: string - sans: - description: SANs defines the subject alternative domain names. - items: - type: string - type: array - type: object - resolver: - description: Resolver is the name of the resolver that will be - used to issue the DefaultCertificate. - type: string - type: object - type: object - required: - - metadata - - spec - type: object - served: true - storage: true -status: - acceptedNames: - kind: "" - plural: "" - conditions: [] - storedVersions: [] diff --git a/cloudflared-6.0.4/charts/common/crds/traefik.io_traefikservices.yaml b/cloudflared-6.0.4/charts/common/crds/traefik.io_traefikservices.yaml deleted file mode 100644 index 0f3475b..0000000 --- a/cloudflared-6.0.4/charts/common/crds/traefik.io_traefikservices.yaml +++ /dev/null @@ -1,402 +0,0 @@ - ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.6.2 - creationTimestamp: null - name: traefikservices.traefik.io -spec: - group: traefik.io - names: - kind: TraefikService - listKind: TraefikServiceList - plural: traefikservices - singular: traefikservice - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: 'TraefikService is the CRD implementation of a Traefik Service. - TraefikService object allows to: - Apply weight to Services on load-balancing - - Mirror traffic on services More info: https://doc.traefik.io/traefik/v2.10/routing/providers/kubernetes-crd/#kind-traefikservice' - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: TraefikServiceSpec defines the desired state of a TraefikService. - properties: - mirroring: - description: Mirroring defines the Mirroring service configuration. - properties: - kind: - description: Kind defines the kind of the Service. - enum: - - Service - - TraefikService - type: string - maxBodySize: - description: MaxBodySize defines the maximum size allowed for - the body of the request. If the body is larger, the request - is not mirrored. Default value is -1, which means unlimited - size. - format: int64 - type: integer - mirrors: - description: Mirrors defines the list of mirrors where Traefik - will duplicate the traffic. - items: - description: MirrorService holds the mirror configuration. - properties: - kind: - description: Kind defines the kind of the Service. - enum: - - Service - - TraefikService - type: string - name: - description: Name defines the name of the referenced Kubernetes - Service or TraefikService. The differentiation between - the two is specified in the Kind field. - type: string - namespace: - description: Namespace defines the namespace of the referenced - Kubernetes Service or TraefikService. - type: string - nativeLB: - description: NativeLB controls, when creating the load-balancer, - whether the LB's children are directly the pods IPs or - if the only child is the Kubernetes Service clusterIP. - The Kubernetes Service itself does load-balance to the - pods. By default, NativeLB is false. - type: boolean - passHostHeader: - description: PassHostHeader defines whether the client Host - header is forwarded to the upstream Kubernetes Service. - By default, passHostHeader is true. - type: boolean - percent: - description: 'Percent defines the part of the traffic to - mirror. Supported values: 0 to 100.' - type: integer - port: - anyOf: - - type: integer - - type: string - description: Port defines the port of a Kubernetes Service. - This can be a reference to a named port. - x-kubernetes-int-or-string: true - responseForwarding: - description: ResponseForwarding defines how Traefik forwards - the response from the upstream Kubernetes Service to the - client. - properties: - flushInterval: - description: 'FlushInterval defines the interval, in - milliseconds, in between flushes to the client while - copying the response body. A negative value means - to flush immediately after each write to the client. - This configuration is ignored when ReverseProxy recognizes - a response as a streaming response; for such responses, - writes are flushed to the client immediately. Default: - 100ms' - type: string - type: object - scheme: - description: Scheme defines the scheme to use for the request - to the upstream Kubernetes Service. It defaults to https - when Kubernetes Service port is 443, http otherwise. - type: string - serversTransport: - description: ServersTransport defines the name of ServersTransport - resource to use. It allows to configure the transport - between Traefik and your servers. Can only be used on - a Kubernetes Service. - type: string - sticky: - description: 'Sticky defines the sticky sessions configuration. - More info: https://doc.traefik.io/traefik/v2.10/routing/services/#sticky-sessions' - properties: - cookie: - description: Cookie defines the sticky cookie configuration. - properties: - httpOnly: - description: HTTPOnly defines whether the cookie - can be accessed by client-side APIs, such as JavaScript. - type: boolean - name: - description: Name defines the Cookie name. - type: string - sameSite: - description: 'SameSite defines the same site policy. - More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite' - type: string - secure: - description: Secure defines whether the cookie can - only be transmitted over an encrypted connection - (i.e. HTTPS). - type: boolean - type: object - type: object - strategy: - description: Strategy defines the load balancing strategy - between the servers. RoundRobin is the only supported - value at the moment. - type: string - weight: - description: Weight defines the weight and should only be - specified when Name references a TraefikService object - (and to be precise, one that embeds a Weighted Round Robin). - type: integer - required: - - name - type: object - type: array - name: - description: Name defines the name of the referenced Kubernetes - Service or TraefikService. The differentiation between the two - is specified in the Kind field. - type: string - namespace: - description: Namespace defines the namespace of the referenced - Kubernetes Service or TraefikService. - type: string - nativeLB: - description: NativeLB controls, when creating the load-balancer, - whether the LB's children are directly the pods IPs or if the - only child is the Kubernetes Service clusterIP. The Kubernetes - Service itself does load-balance to the pods. By default, NativeLB - is false. - type: boolean - passHostHeader: - description: PassHostHeader defines whether the client Host header - is forwarded to the upstream Kubernetes Service. By default, - passHostHeader is true. - type: boolean - port: - anyOf: - - type: integer - - type: string - description: Port defines the port of a Kubernetes Service. This - can be a reference to a named port. - x-kubernetes-int-or-string: true - responseForwarding: - description: ResponseForwarding defines how Traefik forwards the - response from the upstream Kubernetes Service to the client. - properties: - flushInterval: - description: 'FlushInterval defines the interval, in milliseconds, - in between flushes to the client while copying the response - body. A negative value means to flush immediately after - each write to the client. This configuration is ignored - when ReverseProxy recognizes a response as a streaming response; - for such responses, writes are flushed to the client immediately. - Default: 100ms' - type: string - type: object - scheme: - description: Scheme defines the scheme to use for the request - to the upstream Kubernetes Service. It defaults to https when - Kubernetes Service port is 443, http otherwise. - type: string - serversTransport: - description: ServersTransport defines the name of ServersTransport - resource to use. It allows to configure the transport between - Traefik and your servers. Can only be used on a Kubernetes Service. - type: string - sticky: - description: 'Sticky defines the sticky sessions configuration. - More info: https://doc.traefik.io/traefik/v2.10/routing/services/#sticky-sessions' - properties: - cookie: - description: Cookie defines the sticky cookie configuration. - properties: - httpOnly: - description: HTTPOnly defines whether the cookie can be - accessed by client-side APIs, such as JavaScript. - type: boolean - name: - description: Name defines the Cookie name. - type: string - sameSite: - description: 'SameSite defines the same site policy. More - info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite' - type: string - secure: - description: Secure defines whether the cookie can only - be transmitted over an encrypted connection (i.e. HTTPS). - type: boolean - type: object - type: object - strategy: - description: Strategy defines the load balancing strategy between - the servers. RoundRobin is the only supported value at the moment. - type: string - weight: - description: Weight defines the weight and should only be specified - when Name references a TraefikService object (and to be precise, - one that embeds a Weighted Round Robin). - type: integer - required: - - name - type: object - weighted: - description: Weighted defines the Weighted Round Robin configuration. - properties: - services: - description: Services defines the list of Kubernetes Service and/or - TraefikService to load-balance, with weight. - items: - description: Service defines an upstream HTTP service to proxy - traffic to. - properties: - kind: - description: Kind defines the kind of the Service. - enum: - - Service - - TraefikService - type: string - name: - description: Name defines the name of the referenced Kubernetes - Service or TraefikService. The differentiation between - the two is specified in the Kind field. - type: string - namespace: - description: Namespace defines the namespace of the referenced - Kubernetes Service or TraefikService. - type: string - nativeLB: - description: NativeLB controls, when creating the load-balancer, - whether the LB's children are directly the pods IPs or - if the only child is the Kubernetes Service clusterIP. - The Kubernetes Service itself does load-balance to the - pods. By default, NativeLB is false. - type: boolean - passHostHeader: - description: PassHostHeader defines whether the client Host - header is forwarded to the upstream Kubernetes Service. - By default, passHostHeader is true. - type: boolean - port: - anyOf: - - type: integer - - type: string - description: Port defines the port of a Kubernetes Service. - This can be a reference to a named port. - x-kubernetes-int-or-string: true - responseForwarding: - description: ResponseForwarding defines how Traefik forwards - the response from the upstream Kubernetes Service to the - client. - properties: - flushInterval: - description: 'FlushInterval defines the interval, in - milliseconds, in between flushes to the client while - copying the response body. A negative value means - to flush immediately after each write to the client. - This configuration is ignored when ReverseProxy recognizes - a response as a streaming response; for such responses, - writes are flushed to the client immediately. Default: - 100ms' - type: string - type: object - scheme: - description: Scheme defines the scheme to use for the request - to the upstream Kubernetes Service. It defaults to https - when Kubernetes Service port is 443, http otherwise. - type: string - serversTransport: - description: ServersTransport defines the name of ServersTransport - resource to use. It allows to configure the transport - between Traefik and your servers. Can only be used on - a Kubernetes Service. - type: string - sticky: - description: 'Sticky defines the sticky sessions configuration. - More info: https://doc.traefik.io/traefik/v2.10/routing/services/#sticky-sessions' - properties: - cookie: - description: Cookie defines the sticky cookie configuration. - properties: - httpOnly: - description: HTTPOnly defines whether the cookie - can be accessed by client-side APIs, such as JavaScript. - type: boolean - name: - description: Name defines the Cookie name. - type: string - sameSite: - description: 'SameSite defines the same site policy. - More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite' - type: string - secure: - description: Secure defines whether the cookie can - only be transmitted over an encrypted connection - (i.e. HTTPS). - type: boolean - type: object - type: object - strategy: - description: Strategy defines the load balancing strategy - between the servers. RoundRobin is the only supported - value at the moment. - type: string - weight: - description: Weight defines the weight and should only be - specified when Name references a TraefikService object - (and to be precise, one that embeds a Weighted Round Robin). - type: integer - required: - - name - type: object - type: array - sticky: - description: 'Sticky defines whether sticky sessions are enabled. - More info: https://doc.traefik.io/traefik/v2.10/routing/providers/kubernetes-crd/#stickiness-and-load-balancing' - properties: - cookie: - description: Cookie defines the sticky cookie configuration. - properties: - httpOnly: - description: HTTPOnly defines whether the cookie can be - accessed by client-side APIs, such as JavaScript. - type: boolean - name: - description: Name defines the Cookie name. - type: string - sameSite: - description: 'SameSite defines the same site policy. More - info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite' - type: string - secure: - description: Secure defines whether the cookie can only - be transmitted over an encrypted connection (i.e. HTTPS). - type: boolean - type: object - type: object - type: object - type: object - required: - - metadata - - spec - type: object - served: true - storage: true -status: - acceptedNames: - kind: "" - plural: "" - conditions: [] - storedVersions: [] diff --git a/cloudflared-6.0.4/charts/common/templates/addons/code-server/_codeserver.tpl b/cloudflared-6.0.4/charts/common/templates/addons/code-server/_codeserver.tpl deleted file mode 100644 index 599e862..0000000 --- a/cloudflared-6.0.4/charts/common/templates/addons/code-server/_codeserver.tpl +++ /dev/null @@ -1,53 +0,0 @@ -{{/* -Template to render code-server addon -It will include / inject the required templates based on the given values. -*/}} -{{- define "tc.v1.common.addon.codeserver" -}} -{{- $targetSelector := "main" -}} -{{- if $.Values.addons.codeserver.targetSelector -}} - {{- $targetSelector = $.Values.addons.codeserver.targetSelector -}} -{{- end -}} -{{- if .Values.addons.codeserver.enabled -}} - {{/* Append the code-server container to the workloads */}} - {{- $container := include "tc.v1.common.addon.codeserver.container" . | fromYaml -}} - {{- if $container -}} - {{- $workload := get $.Values.workload $targetSelector -}} - {{- $_ := set $workload.podSpec.containers "codeserver" $container -}} - {{- end -}} - - {{- $hasPrimaryService := false -}} - {{- range $svcName, $svcValues := .Values.service -}} - {{- if $svcValues.enabled -}} - {{- if $svcValues.primary -}} - {{- $hasPrimaryService = true -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{/* Add the code-server service */}} - {{- if .Values.addons.codeserver.service.enabled -}} - {{- $serviceValues := .Values.addons.codeserver.service -}} - {{- $_ := set $serviceValues "targetSelector" $targetSelector -}} - {{- if not $hasPrimaryService -}} - {{- $_ := set $serviceValues "primary" true -}} - {{- end -}} - {{- $_ := set .Values.service "codeserver" $serviceValues -}} - {{- end -}} - - {{/* Add the code-server ingress */}} - {{- if .Values.addons.codeserver.ingress.enabled -}} - {{- $ingressValues := .Values.addons.codeserver.ingress -}} - {{- $_ := set $ingressValues "nameOverride" "codeserver" -}} - - {{/* Determine the target service name & port */}} - {{- $svcName := printf "%v-codeserver" (include "tc.v1.common.names.fullname" .) -}} - {{- $svcPort := .Values.addons.codeserver.service.ports.codeserver.port -}} - {{- range $_, $host := $ingressValues.hosts -}} - {{- $_ := set (index $host.paths 0) "service" (dict "name" $svcName "port" $svcPort) -}} - {{- end -}} - {{- $_ := set $ "ObjectValues" (dict "ingress" $ingressValues) -}} - {{- include "tc.v1.common.class.ingress" $ -}} - {{- $_ := unset $ "ObjectValues" -}} - {{- end -}} -{{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/addons/code-server/_container.tpl b/cloudflared-6.0.4/charts/common/templates/addons/code-server/_container.tpl deleted file mode 100644 index a66572d..0000000 --- a/cloudflared-6.0.4/charts/common/templates/addons/code-server/_container.tpl +++ /dev/null @@ -1,46 +0,0 @@ -{{/* -The code-server sidecar container to be inserted. -*/}} -{{- define "tc.v1.common.addon.codeserver.container" -}} -enabled: true -probes: - liveness: - enabled: true - port: {{ .Values.addons.codeserver.service.ports.codeserver.port }} - path: "/" - readiness: - enabled: true - port: {{ .Values.addons.codeserver.service.ports.codeserver.port }} - path: "/" - startup: - enabled: true - port: {{ .Values.addons.codeserver.service.ports.codeserver.port }} - path: "/" -imageSelector: "codeserverImage" -imagePullPolicy: {{ .Values.codeserverImage.pullPolicy }} -securityContext: - runAsUser: 0 - runAsGroup: 0 - runAsNonRoot: false - readOnlyRootFilesystem: false -env: -{{- range $envList := .Values.addons.codeserver.envList -}} - {{- if and $envList.name $envList.value }} - {{ $envList.name }}: {{ $envList.value | quote }} - {{- else }} - {{- fail "Please specify name/value for codeserver environment variable" -}} - {{- end -}} -{{- end -}} -{{- with .Values.addons.codeserver.env -}} -{{- range $k, $v := . }} - {{ $k }}: {{ $v | quote }} -{{- end -}} -{{- end }} -args: -{{- range .Values.addons.codeserver.args }} -- {{ . | quote }} -{{- end }} -- "--port" -- "{{ .Values.addons.codeserver.service.ports.codeserver.port }}" -- {{ .Values.addons.codeserver.workingDir | default "/" }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/addons/netshoot/_container.tpl b/cloudflared-6.0.4/charts/common/templates/addons/netshoot/_container.tpl deleted file mode 100644 index bfc954f..0000000 --- a/cloudflared-6.0.4/charts/common/templates/addons/netshoot/_container.tpl +++ /dev/null @@ -1,44 +0,0 @@ -{{/* -The code-server sidecar container to be inserted. -*/}} -{{- define "tc.v1.common.addon.netshoot.container" -}} -enabled: true -command: - - /bin/sh - - -c - - sleep infinity -probes: - liveness: - enabled: false - readiness: - enabled: false - startup: - enabled: false -imageSelector: "netshootImage" -securityContext: - runAsUser: 0 - runAsGroup: 0 - runAsNonRoot: false - readOnlyRootFilesystem: false - capabilities: - add: - - NET_ADMIN - - NET_RAW -env: -{{- range $envList := $.Values.addons.netshoot.envList -}} - {{- if and $envList.name $envList.value }} - {{ $envList.name }}: {{ $envList.value | quote }} - {{- else }} - {{- fail "Please specify name/value for netshoot environment variable" -}} - {{- end -}} -{{- end -}} -{{- with $.Values.addons.netshoot.env -}} -{{- range $k, $v := . }} - {{ $k }}: {{ $v | quote }} -{{- end -}} -{{- end }} -args: -{{- range $.Values.addons.netshoot.args }} -- {{ . | quote }} -{{- end }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/addons/netshoot/_netshoot.tpl b/cloudflared-6.0.4/charts/common/templates/addons/netshoot/_netshoot.tpl deleted file mode 100644 index fe75c80..0000000 --- a/cloudflared-6.0.4/charts/common/templates/addons/netshoot/_netshoot.tpl +++ /dev/null @@ -1,15 +0,0 @@ -{{/* -Template to render code-server addon -It will include / inject the required templates based on the given values. -*/}} -{{- define "tc.v1.common.addon.netshoot" -}} -{{- $targetSelector := "main" -}} -{{- if .Values.addons.netshoot.enabled -}} - {{/* Append the code-server container to the workloads */}} - {{- $container := include "tc.v1.common.addon.netshoot.container" . | fromYaml -}} - {{- if $container -}} - {{- $workload := get $.Values.workload $targetSelector -}} - {{- $_ := set $workload.podSpec.containers "netshoot" $container -}} - {{- end -}} -{{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/addons/vpn/_configmap.tpl b/cloudflared-6.0.4/charts/common/templates/addons/vpn/_configmap.tpl deleted file mode 100644 index 4b417a6..0000000 --- a/cloudflared-6.0.4/charts/common/templates/addons/vpn/_configmap.tpl +++ /dev/null @@ -1,16 +0,0 @@ -{{/* -The VPN config and scripts to be included. -*/}} -{{- define "tc.v1.common.addon.vpn.configmap" -}} -enabled: true -data: -{{- with .Values.addons.vpn.scripts.up }} - up.sh: |- - {{- . | nindent 4 }} -{{- end -}} - -{{- with .Values.addons.vpn.scripts.down }} - down.sh: |- - {{- . | nindent 4 }} -{{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/addons/vpn/_gluetunContainer.tpl b/cloudflared-6.0.4/charts/common/templates/addons/vpn/_gluetunContainer.tpl deleted file mode 100644 index 59e3a4f..0000000 --- a/cloudflared-6.0.4/charts/common/templates/addons/vpn/_gluetunContainer.tpl +++ /dev/null @@ -1,64 +0,0 @@ -{{/* -The gluetun sidecar container to be inserted. -*/}} -{{- define "tc.v1.common.addon.vpn.gluetun.container" -}} -enabled: true -imageSelector: gluetunImage -probes: -{{- if $.Values.addons.vpn.livenessProbe }} - liveness: - {{- toYaml . | nindent 2 }} -{{- else }} - liveness: - enabled: false -{{- end }} - readiness: - enabled: false - startup: - enabled: false -securityContext: - runAsUser: 0 - runAsNonRoot: false - readOnlyRootFilesystem: false - runAsGroup: 568 - capabilities: - add: - - NET_ADMIN - - NET_RAW - - MKNOD - - SYS_MODULE - -env: - DNS_KEEP_NAMESERVER: "on" - DOT: "off" -{{- if $.Values.addons.vpn.killSwitch }} -{{- $excludednetworks := ( printf "%v,%v" $.Values.chartContext.podCIDR $.Values.chartContext.svcCIDR ) -}} -{{- range $.Values.addons.vpn.excludedNetworks_IPv4 -}} - {{- $excludednetworks = ( printf "%v,%v" $excludednetworks . ) -}} -{{- end }} -{{- range $.Values.addons.vpn.excludedNetworks_IPv6 -}} - {{- $excludednetworksv6 = ( printf "%v,%v" $excludednetworks . ) -}} -{{- end }} - FIREWALL: "on" - FIREWALL_OUTBOUND_SUBNETS: {{ $excludednetworks | quote }} -{{- else }} - FIREWALL: "off" -{{- end }} - -{{- with $.Values.addons.vpn.env }} - {{- . | toYaml | nindent 2 }} -{{- end -}} - -{{- range $envList := $.Values.addons.vpn.envList -}} - {{- if and $envList.name $envList.value }} - {{ $envList.name }}: {{ $envList.value | quote }} - {{- else -}} - {{- fail "Please specify name/value for VPN environment variable" -}} - {{- end -}} -{{- end -}} - -{{- with $.Values.addons.vpn.args }} -args: - {{- . | toYaml | nindent 2 }} -{{- end }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/addons/vpn/_openvpnContainer.tpl b/cloudflared-6.0.4/charts/common/templates/addons/vpn/_openvpnContainer.tpl deleted file mode 100644 index 26c881a..0000000 --- a/cloudflared-6.0.4/charts/common/templates/addons/vpn/_openvpnContainer.tpl +++ /dev/null @@ -1,73 +0,0 @@ -{{/* -The gluetun sidecar container to be inserted. -*/}} -{{- define "tc.v1.common.addon.vpn.openvpn.container" -}} -enabled: true -imageSelector: openvpnImage -probes: -{{- if $.Values.addons.vpn.livenessProbe }} - liveness: - {{- toYaml . | nindent 2 }} -{{- else }} - liveness: - enabled: false -{{- end }} - readiness: - enabled: false - startup: - enabled: false -securityContext: - runAsUser: 0 - runAsGroup: 0 - capabilities: - add: - - NET_ADMIN - - NET_RAW - - MKNOD - - SYS_MODULE - -env: -{{- with $.Values.addons.vpn.env }} - {{- . | toYaml | nindent 2 }} -{{- end }} - {{- if and $.Values.addons.vpn.openvpn.username $.Values.addons.vpn.openvpn.password }} - VPN_AUTH: {{ (printf "%v;%v" $.Values.addons.vpn.openvpn.username $.Values.addons.vpn.openvpn.password) }} - {{- end -}} -{{- if $.Values.addons.vpn.killSwitch }} -{{- $ipv4list := $.Values.addons.vpn.excludedNetworks_IPv4 }} - -{{- if $.Values.chartContext.podCIDR }} -{{- $ipv4list = append $ipv4list $.Values.chartContext.podCIDR }} -{{- end }} -{{- if $.Values.chartContext.svcCIDR }} -{{- $ipv4list = append $ipv4list $.Values.chartContext.svcCIDR }} -{{- end }} - - FIREWALL: "ON" - {{- range $index, $value := $ipv4list }} - ROUTE_{{ add $index 1 }}: {{ $value | quote }} - {{- end }} -{{- if $.Values.addons.vpn.excludedNetworks_IPv6 }} - {{- $excludednetworksv6 := "" -}} - {{- range $.Values.addons.vpn.excludedNetworks_IPv4 -}} - {{- $excludednetworksv6 = ( printf "%v;%v" $excludednetworksv6 . ) -}} - {{- end }} - {{- range $index, $value := $.Values.addons.vpn.excludedNetworks_IPv6 }} - ROUTE6_{{ add $index 1 }}: {{ $value | quote }} - {{- end }} -{{- end }} -{{- end -}} - -{{- range $envList := $.Values.addons.vpn.envList -}} - {{- if and $envList.name $envList.value }} - {{ $envList.name }}: {{ $envList.value | quote }} - {{- else -}} - {{- fail "Please specify name/value for VPN environment variable" -}} - {{- end -}} -{{- end -}} - -{{- with $.Values.addons.vpn.args }} -args: - {{- . | toYaml | nindent 2 }} -{{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/addons/vpn/_secret.tpl b/cloudflared-6.0.4/charts/common/templates/addons/vpn/_secret.tpl deleted file mode 100644 index b46a5d3..0000000 --- a/cloudflared-6.0.4/charts/common/templates/addons/vpn/_secret.tpl +++ /dev/null @@ -1,9 +0,0 @@ -{{/* -The OpenVPN config secret to be included. -*/}} -{{- define "tc.v1.common.addon.vpn.secret" -}} -enabled: true -data: - vpn.conf: |- - {{- .Values.addons.vpn.config | nindent 4 }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/addons/vpn/_tailscaleContainer.tpl b/cloudflared-6.0.4/charts/common/templates/addons/vpn/_tailscaleContainer.tpl deleted file mode 100644 index 50998d0..0000000 --- a/cloudflared-6.0.4/charts/common/templates/addons/vpn/_tailscaleContainer.tpl +++ /dev/null @@ -1,87 +0,0 @@ -{{/* -The Tailscale sidecar container to be inserted. -*/}} -{{- define "tc.v1.common.addon.vpn.tailscale.container" -}} -enabled: true -imageSelector: "tailscaleImage" -probes: -{{- if $.Values.addons.vpn.livenessProbe }} - liveness: - {{- toYaml . | nindent 2 }} -{{- else }} - liveness: - enabled: false -{{- end }} - readiness: - enabled: false - startup: - enabled: false -command: - - /usr/local/bin/containerboot -securityContext: - {{- if $.Values.addons.vpn.tailscale.userspace }} - runAsUser: 1000 - runAsGroup: 1000 - runAsNonRoot: false - readOnlyRootFilesystem: true - {{- else }} - runAsUser: 0 - runAsGroup: 0 - runAsNonRoot: true - readOnlyRootFilesystem: false - {{- end }} - capabilities: - add: - - NET_ADMIN - - NET_RAW - -{{/* -Set KUBE_SECRET to empty string to force tailscale -to use the filesystem for state tracking. -With secret for state tracking you can't always -know if the app that uses this sidecard will -use a custom ServiceAccount and will lead to falure. -*/}} -env: - TS_KUBE_SECRET: "" - TS_SOCKET: /var/run/tailscale/tailscaled.sock - TS_STATE_DIR: /var/lib/tailscale/state - TS_AUTH_ONCE: {{ $.Values.addons.vpn.tailscale.auth_once | quote }} - TS_USERSPACE: {{ $.Values.addons.vpn.tailscale.userspace | quote }} - TS_ACCEPT_DNS: {{ $.Values.addons.vpn.tailscale.accept_dns | quote }} - {{- with $.Values.addons.vpn.tailscale.outbound_http_proxy_listen }} - TS_OUTBOUND_HTTP_PROXY_LISTEN: {{ . }} - {{- end -}} - {{- with $.Values.addons.vpn.tailscale.routes }} - TS_ROUTES: {{ . }} - {{- end -}} - {{- with $.Values.addons.vpn.tailscale.dest_ip }} - TS_DEST_IP: {{ . }} - {{- end -}} - {{- with $.Values.addons.vpn.tailscale.sock5_server }} - TS_SOCKS5_SERVER: {{ . }} - {{- end -}} - {{- with $.Values.addons.vpn.tailscale.extra_args }} - TS_EXTRA_ARGS: {{ . | quote }} - {{- end -}} - {{- with $.Values.addons.vpn.tailscale.daemon_extra_args }} - TS_TAILSCALED_EXTRA_ARGS: {{ . | quote }} - {{- end -}} - {{- with $.Values.addons.vpn.tailscale.authkey }} - TS_AUTH_KEY: {{ . }} - {{- end }} - -{{- range $envList := $.Values.addons.vpn.envList -}} - {{- if and $envList.name $envList.value }} - {{ $envList.name }}: {{ $envList.value | quote }} - {{- else -}} - {{- fail "Please specify name/value for VPN environment variable" -}} - {{- end -}} -{{- end -}} - -{{- with $.Values.addons.vpn.env -}} - {{- range $k, $v := . }} - {{ $k }}: {{ $v | quote }} - {{- end -}} -{{- end }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/addons/vpn/_volume.tpl b/cloudflared-6.0.4/charts/common/templates/addons/vpn/_volume.tpl deleted file mode 100644 index b6a8f1a..0000000 --- a/cloudflared-6.0.4/charts/common/templates/addons/vpn/_volume.tpl +++ /dev/null @@ -1,112 +0,0 @@ -{{/* -The volume (referencing VPN scripts) to be inserted into persistence. -*/}} -{{- define "tc.v1.common.addon.vpn.volume.scripts" -}} -{{- $basePath := (include "tc.v1.common.addon.vpn.volume.basePath" .) }} -enabled: true -type: configmap -objectName: vpnscripts -expandObjectName: false -defaultMode: "0777" -items: -{{- if .Values.addons.vpn.scripts.up }} -- key: up.sh - path: up.sh -{{- end -}} -{{- if .Values.addons.vpn.scripts.down }} -- key: down.sh - path: down.sh -{{- end }} -targetSelector: - {{- range .Values.addons.vpn.targetSelector }} - {{ . }}: - vpn: - mountPath: {{ $basePath }} - {{- end -}} -{{- end -}} - -{{/* -The volume (referencing VPN config) to be inserted into persistence. -*/}} -{{- define "tc.v1.common.addon.vpn.volume.config" -}} -{{- $basePath := (include "tc.v1.common.addon.vpn.volume.basePath" .) }} -{{- $mountPath := $basePath }} - -enabled: true -{{- if or .Values.addons.vpn.config .Values.addons.vpn.existingSecret }} -type: secret -defaultMode: "0777" -items: - - key: vpn.conf - path: vpn.conf -{{- if .Values.addons.vpn.existingSecret }} -objectName: {{ .Values.addons.vpn.existingSecret }} -expandObjectName: false -{{- else }} -objectName: vpnconfig -expandObjectName: true -{{- end -}} -{{- else }} -{{- $mountPath = (printf "%s/vpn.conf" $basePath) }} -type: hostPath -hostPath: {{ .Values.addons.vpn.configFile | default "/vpn" }} -hostPathType: "File" -autoPermissions: - enabled: true - chown: true - user: 568 - group: 568 -{{- end }} -targetSelector: - {{- range .Values.addons.vpn.targetSelector }} - {{ . }}: - vpn: - mountPath: {{ $mountPath }} - {{- end -}} -{{- end -}} - -{{/* -The volume (referencing VPN config folder) to be inserted into persistence. -*/}} -{{- define "tc.v1.common.addon.vpn.volume.folder" -}} -{{- $basePath := (include "tc.v1.common.addon.vpn.volume.basePath" .) }} -enabled: true -type: hostPath -hostPath: {{ .Values.addons.vpn.configFolder | quote }} -autoPermissions: - enabled: true - chown: true - user: 568 - group: 568 -targetSelector: - {{- range .Values.addons.vpn.targetSelector }} - {{ . }}: - vpn: - mountPath: {{ $basePath }} - {{- end -}} -{{- end -}} - - -{{/* -The empty tailscale folder -*/}} -{{- define "tc.v1.common.addon.vpn.volume.tailscale" -}} -enabled: true -type: emptyDir -targetSelector: - {{- range .Values.addons.vpn.targetSelector }} - {{ . }}: - tailscale: - mountPath: /var/lib/tailscale - {{- end -}} -{{- end -}} - -{{- define "tc.v1.common.addon.vpn.volume.basePath" -}} - {{- $basePath := "/vpn" -}} {{/* Base Path for OVPN */}} - {{- if eq .Values.addons.vpn.type "wireguard" -}} - {{- $basePath = "/etc/wireguard" -}} {{/* Base Path for Wireguard */}} - {{- else if eq .Values.addons.vpn.type "gluetun" -}} - {{- $basePath = "/gluetun" -}} {{/* Base Path for Gluetun */}} - {{- end -}} - {{- $basePath -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/addons/vpn/_vpn.tpl b/cloudflared-6.0.4/charts/common/templates/addons/vpn/_vpn.tpl deleted file mode 100644 index 62aad34..0000000 --- a/cloudflared-6.0.4/charts/common/templates/addons/vpn/_vpn.tpl +++ /dev/null @@ -1,94 +0,0 @@ -{{/* -Template to render VPN addon -It will include / inject the required templates based on the given values. -*/}} -{{- define "tc.v1.common.addon.vpn" -}} -{{- if ne "disabled" .Values.addons.vpn.type -}} - - {{- if .Values.addons.vpn.config -}} - {{/* Append the vpn config secret to the secrets */}} - {{- $secret := include "tc.v1.common.addon.vpn.secret" . | fromYaml -}} - {{- if $secret -}} - {{- $_ := set .Values.secret "vpnconfig" $secret -}} - {{- end -}} - {{- end }} - - {{- if or .Values.addons.vpn.scripts.up .Values.addons.vpn.scripts.down -}} - {{/* Append the vpn up/down scripts to the configmaps */}} - {{- $configmap := include "tc.v1.common.addon.vpn.configmap" . | fromYaml -}} - {{- if $configmap -}} - {{- $_ := set .Values.configmap "vpnscripts" $configmap -}} - {{- end -}} - {{- end }} - - {{- if or .Values.addons.vpn.configFile .Values.addons.vpn.config .Values.addons.vpn.existingSecret -}} - {{/* Append the vpn config to the persistence */}} - {{- $configper := include "tc.v1.common.addon.vpn.volume.config" . | fromYaml -}} - {{- if $configper -}} - {{- $_ := set .Values.persistence "vpnconfig" $configper -}} - {{- end -}} - {{- end -}} - - {{- if or .Values.addons.vpn.scripts.up .Values.addons.vpn.scripts.down -}} - {{/* Append the vpn scripts to the persistence */}} - {{- $scriptsper := include "tc.v1.common.addon.vpn.volume.scripts" . | fromYaml -}} - {{- if $scriptsper -}} - {{- $_ := set .Values.persistence "vpnscripts" $scriptsper -}} - {{- end -}} - {{- end -}} - - {{- if .Values.addons.vpn.configFolder -}} - {{/* Append the vpn folder to the persistence */}} - {{- $folderper := include "tc.v1.common.addon.vpn.volume.folder" . | fromYaml -}} - {{- if $folderper -}} - {{- $_ := set .Values.persistence "vpnfolder" $folderper -}} - {{- end -}} - {{- end -}} - - {{/* Ensure target Selector defaults to main pod even if unset */}} - {{- $targetSelector := list "main" -}} - {{- if $.Values.addons.codeserver.targetSelector -}} - {{- $targetSelector = $.Values.addons.codeserver.targetSelector -}} - {{- end -}} - - {{/* Append the vpn container to the containers */}} - {{- range $targetSelector -}} - {{- if eq "gluetun" $.Values.addons.vpn.type -}} - {{- $container := include "tc.v1.common.addon.vpn.gluetun.container" $ | fromYaml -}} - {{- if $container -}} - {{- $workload := get $.Values.workload . -}} - {{- $_ := set $workload.podSpec.containers "vpn" $container -}} - {{- end -}} - {{- else if eq "tailscale" $.Values.addons.vpn.type -}} - {{/* FIXME: https://github.com/tailscale/tailscale/issues/8188 */}} - {{- $_ := set $.Values.podOptions "automountServiceAccountToken" true -}} - {{- $container := include "tc.v1.common.addon.vpn.tailscale.container" $ | fromYaml -}} - {{- if $container -}} - {{- $workload := get $.Values.workload . -}} - {{- $_ := set $workload.podSpec.containers "tailscale" $container -}} - {{- end -}} - {{- else if eq "openvpn" $.Values.addons.vpn.type -}} - {{- $container := include "tc.v1.common.addon.vpn.openvpn.container" $ | fromYaml -}} - {{- if $container -}} - {{- $workload := get $.Values.workload . -}} - {{- $_ := set $workload.podSpec.containers "vpn" $container -}} - {{- end -}} - {{- else if eq "wireguard" $.Values.addons.vpn.type -}} - {{- $container := include "tc.v1.common.addon.vpn.wireguard.container" $ | fromYaml -}} - {{- if $container -}} - {{- $workload := get $.Values.workload . -}} - {{- $_ := set $workload.podSpec.containers "vpn" $container -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if eq "tailscale" $.Values.addons.vpn.type -}} - {{/* Append the empty tailscale folder to the persistence */}} - {{- $tailscaledir := include "tc.v1.common.addon.vpn.volume.tailscale" . | fromYaml -}} - {{- if $tailscaledir -}} - {{- $_ := set .Values.persistence "tailscalestate" $tailscaledir -}} - {{- end -}} - {{- end -}} - -{{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/addons/vpn/_wireguardContainer.tpl b/cloudflared-6.0.4/charts/common/templates/addons/vpn/_wireguardContainer.tpl deleted file mode 100644 index 3fd7eb7..0000000 --- a/cloudflared-6.0.4/charts/common/templates/addons/vpn/_wireguardContainer.tpl +++ /dev/null @@ -1,66 +0,0 @@ -{{/* -The gluetun sidecar container to be inserted. -*/}} -{{- define "tc.v1.common.addon.vpn.wireguard.container" -}} -enabled: true -imageSelector: wireguardImage -probes: -{{- if $.Values.addons.vpn.livenessProbe }} - liveness: - {{- toYaml . | nindent 2 }} -{{- else }} - liveness: - enabled: false -{{- end }} - readiness: - enabled: false - startup: - enabled: false -securityContext: - runAsUser: 568 - runAsGroup: 568 - readOnlyRootFilesystem: false - allowPrivilegeEscalation: true - capabilities: - add: - - AUDIT_WRITE - - NET_ADMIN - - SETUID - - SETGID - - SYS_MODULE - -env: -{{- with $.Values.addons.vpn.env }} - {{- . | toYaml | nindent 2 }} -{{- end }} - SEPARATOR: ";" - IPTABLES_BACKEND: "nft" -{{- if $.Values.addons.vpn.killSwitch }} - KILLSWITCH: "true" - {{- $excludednetworksv4 := ( printf "%v;%v" $.Values.chartContext.podCIDR $.Values.chartContext.svcCIDR ) -}} - {{- range $.Values.addons.vpn.excludedNetworks_IPv4 -}} - {{- $excludednetworksv4 = ( printf "%v;%v" $excludednetworksv4 . ) -}} - {{- end }} - KILLSWITCH_EXCLUDEDNETWORKS_IPV4: {{ $excludednetworksv4 | quote }} -{{- if $.Values.addons.vpn.excludedNetworks_IPv6 -}} - {{- $excludednetworksv6 := "" -}} - {{- range $.Values.addons.vpn.excludedNetworks_IPv4 -}} - {{- $excludednetworksv6 = ( printf "%v;%v" $excludednetworksv6 . ) -}} - {{- end }} - KILLSWITCH_EXCLUDEDNETWORKS_IPV6: {{ $.Values.addons.vpn.excludedNetworks_IPv6 | quote }} -{{- end -}} -{{- end -}} - -{{- range $envList := $.Values.addons.vpn.envList -}} - {{- if and $envList.name $envList.value }} - {{ $envList.name }}: {{ $envList.value | quote }} - {{- else -}} - {{- fail "Please specify name/value for VPN environment variable" -}} - {{- end -}} -{{- end -}} - -{{- with $.Values.addons.vpn.args }} -args: - {{- . | toYaml | nindent 2 }} -{{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_certificate.tpl b/cloudflared-6.0.4/charts/common/templates/class/_certificate.tpl deleted file mode 100644 index e2ec1c5..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_certificate.tpl +++ /dev/null @@ -1,32 +0,0 @@ -{{/* -This template serves as a blueprint for all Cert-Manager Certificate objects that are created -within the common library. -*/}} -{{- define "tc.v1.common.class.certificate" -}} -{{- $root := .root -}} -{{- $name := .name -}} -{{- $hosts := .hosts -}} -{{- $certificateIssuer := .certificateIssuer }} ---- -apiVersion: {{ include "tc.v1.common.capabilities.cert-manager.certificate.apiVersion" $ }} -kind: Certificate -metadata: - name: {{ $name }} - namespace: {{ $root.Values.namespace | default $root.Values.global.namespace | default $root.Release.Namespace }} -spec: - secretName: {{ $name }} - dnsNames: - {{- range $hosts }} - - {{ tpl . $root | quote }} - {{- end }} - privateKey: - algorithm: ECDSA - size: 256 - rotationPolicy: Always - issuerRef: - name: {{ tpl $certificateIssuer $root | quote }} - kind: ClusterIssuer - group: cert-manager.io - - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_cnpgCluster.tpl b/cloudflared-6.0.4/charts/common/templates/class/_cnpgCluster.tpl deleted file mode 100644 index fc42e58..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_cnpgCluster.tpl +++ /dev/null @@ -1,83 +0,0 @@ -{{- define "tc.v1.common.class.cnpg.cluster" -}} - {{- $values := .Values.cnpg -}} - - {{- if hasKey . "ObjectValues" -}} - {{- with .ObjectValues.cnpg -}} - {{- $values = . -}} - {{- end -}} - {{- end -}} - {{- $cnpgClusterName := $values.name -}} - {{- $cnpgClusterLabels := $values.labels -}} - {{- $cnpgClusterAnnotations := $values.annotations -}} - {{- $hibernation := "off" -}} - {{- if or $values.hibernate $.Values.global.stopAll -}} - {{- $hibernation = "on" -}} - {{- end }} ---- -apiVersion: {{ include "tc.v1.common.capabilities.cnpg.cluster.apiVersion" $ }} -kind: Cluster -metadata: - name: {{ $cnpgClusterName }} - namespace: {{ $.Values.namespace | default $.Values.global.namespace | default $.Release.Namespace }} - {{- $labels := (mustMerge ($cnpgClusterLabels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $ | fromYaml)) }} - labels: - cnpg.io/reload: "on" - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "labels" $labels) | trim) }} - {{- . | nindent 4 }} - {{- end }} - {{- $annotations := (mustMerge ($cnpgClusterAnnotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $ | fromYaml)) }} - annotations: - cnpg.io/hibernation: {{ $hibernation | quote }} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "annotations" $annotations) | trim) }} - {{- . | nindent 4 }} - {{- end }} -spec: - instances: {{ $values.instances | default 2 }} - - bootstrap: - initdb: - database: {{ $values.database | default "app" }} - owner: {{ $values.user | default "app" }} - secret: - name: {{ $cnpgClusterName }}-user - - primaryUpdateStrategy: {{ $values.primaryUpdateStrategy | default "unsupervised" }} - - storage: - pvcTemplate: - {{- with (include "tc.v1.common.lib.storage.storageClassName" ( dict "rootCtx" $ "objectData" $values.storage )) | trim }} - storageClassName: {{ . }} - {{- end }} - accessModes: - - ReadWriteOnce - resources: - requests: - storage: {{ tpl ($values.storage.walsize | default $.Values.fallbackDefaults.vctSize) $ | quote }} - - walStorage: - pvcTemplate: - {{- with (include "tc.v1.common.lib.storage.storageClassName" ( dict "rootCtx" $ "objectData" $values.storage )) | trim }} - storageClassName: {{ . }} - {{- end }} - accessModes: - - ReadWriteOnce - resources: - requests: - storage: {{ tpl ($values.storage.walsize | default $.Values.fallbackDefaults.vctSize) $ | quote }} - - monitoring: - enablePodMonitor: {{ $values.monitoring.enablePodMonitor | default true }} - - nodeMaintenanceWindow: - inProgress: false - reusePVC: true - - {{- with (include "tc.v1.common.lib.container.resources" (dict "rootCtx" $ "objectData" $values) | trim) }} - resources: - {{- . | nindent 4 }} - {{- end }} - - postgresql: - {{- tpl ( $values.postgresql | toYaml ) $ | nindent 4 }} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_cnpgPooler.tpl b/cloudflared-6.0.4/charts/common/templates/class/_cnpgPooler.tpl deleted file mode 100644 index 6a2dee2..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_cnpgPooler.tpl +++ /dev/null @@ -1,35 +0,0 @@ -{{- define "tc.v1.common.class.cnpg.pooler" -}} - {{- $values := .Values.cnpg -}} - - {{- if hasKey . "ObjectValues" -}} - {{- with .ObjectValues.cnpg -}} - {{- $values = . -}} - {{- end -}} - {{- end -}} - {{- $cnpgClusterName := $values.name -}} - {{- $cnpgName := $values.cnpgName -}} - {{- $cnpgPoolerName := $values.poolerName -}} - {{- $cnpgClusterLabels := $values.labels -}} - {{- $cnpgClusterAnnotations := $values.annotations -}} - {{- $instances := $values.pooler.instances | default 2 -}} - {{- if or $values.hibernate $.Values.global.stopAll -}} - {{- $instances = 0 -}} - {{- end }} ---- -apiVersion: {{ include "tc.v1.common.capabilities.cnpg.pooler.apiVersion" $ }} -kind: Pooler -metadata: - name: {{ printf "%v-%v" $cnpgClusterName $values.pooler.type }} - namespace: {{ $.Values.namespace | default $.Values.global.namespace | default $.Release.Namespace }} -spec: - cluster: - name: {{ $cnpgClusterName }} - instances: {{ $instances }} - type: {{ $values.pooler.type }} - pgbouncer: - poolMode: session - parameters: - max_client_conn: "1000" - default_pool_size: "10" - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_configmap.tpl b/cloudflared-6.0.4/charts/common/templates/class/_configmap.tpl deleted file mode 100644 index 0d40e1d..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_configmap.tpl +++ /dev/null @@ -1,37 +0,0 @@ -{{/* Configmap Class */}} -{{/* Call this template: -{{ include "tc.v1.common.class.configmap" (dict "rootCtx" $ "objectData" $objectData) }} - -rootCtx: The root context of the chart. -objectData: - name: The name of the configmap. - labels: The labels of the configmap. - annotations: The annotations of the configmap. - data: The data of the configmap. - namespace: The namespace of the configmap. (Optional) -*/}} - -{{- define "tc.v1.common.class.configmap" -}} - - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData }} ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ $objectData.name }} - namespace: {{ include "tc.v1.common.lib.metadata.namespace" (dict "rootCtx" $rootCtx "objectData" $objectData "caller" "Configmap") }} - {{- $labels := (mustMerge ($objectData.labels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end -}} - {{- $annotations := (mustMerge ($objectData.annotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 4 }} - {{- end }} -data: - {{- tpl (toYaml $objectData.data) $rootCtx | nindent 2 }} - {{/* This comment is here to add a new line */}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_cronjob.tpl b/cloudflared-6.0.4/charts/common/templates/class/_cronjob.tpl deleted file mode 100644 index 3efcc58..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_cronjob.tpl +++ /dev/null @@ -1,52 +0,0 @@ -{{/* CronJob Class */}} -{{/* Call this template: -{{ include "tc.v1.common.class.cronjob" (dict "rootCtx" $ "objectData" $objectData) }} - -rootCtx: The root context of the chart. -objectData: The object data to be used to render the CronJob. -*/}} - -{{- define "tc.v1.common.class.cronjob" -}} - - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - {{- include "tc.v1.common.lib.workload.cronjobValidation" (dict "objectData" $objectData) }} ---- -apiVersion: batch/v1 -kind: CronJob -metadata: - name: {{ $objectData.name }} - namespace: {{ include "tc.v1.common.lib.metadata.namespace" (dict "rootCtx" $rootCtx "objectData" $objectData "caller" "CronJob") }} - {{- $labels := (mustMerge ($objectData.labels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end -}} - {{- $annotations := (mustMerge ($objectData.annotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 4 }} - {{- end }} -spec: - {{- include "tc.v1.common.lib.workload.cronjobSpec" (dict "rootCtx" $rootCtx "objectData" $objectData) | indent 2 }} - template: - metadata: - {{- $labels := (mustMerge ($objectData.podSpec.labels | default dict) - (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml) - (include "tc.v1.common.lib.metadata.podLabels" $rootCtx | fromYaml) - (include "tc.v1.common.lib.metadata.selectorLabels" (dict "rootCtx" $rootCtx "objectType" "pod" "objectName" $objectData.shortName) | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 12 }} - {{- end -}} - {{- $annotations := (mustMerge ($objectData.podSpec.annotations | default dict) - (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml) - (include "tc.v1.common.lib.metadata.externalInterfacePodAnnotations" (dict "rootCtx" $rootCtx "objectData" $objectData) | fromYaml) - (include "tc.v1.common.lib.metadata.podAnnotations" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 12 }} - {{- end }} - spec: - {{- include "tc.v1.common.lib.workload.pod" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 10 }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_daemonset.tpl b/cloudflared-6.0.4/charts/common/templates/class/_daemonset.tpl deleted file mode 100644 index 4bfd2af..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_daemonset.tpl +++ /dev/null @@ -1,55 +0,0 @@ -{{/* DaemonSet Class */}} -{{/* Call this template: -{{ include "tc.v1.common.class.deployment" (dict "rootCtx" $ "objectData" $objectData) }} - -rootCtx: The root context of the chart. -objectData: The object data to be used to render the DaemonSet. -*/}} - -{{- define "tc.v1.common.class.daemonset" -}} - - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - {{- include "tc.v1.common.lib.workload.daemonsetValidation" (dict "objectData" $objectData) }} ---- -apiVersion: apps/v1 -kind: DaemonSet -metadata: - name: {{ $objectData.name }} - namespace: {{ include "tc.v1.common.lib.metadata.namespace" (dict "rootCtx" $rootCtx "objectData" $objectData "caller" "DaemonSet") }} - {{- $labels := (mustMerge ($objectData.labels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end -}} - {{- $annotations := (mustMerge ($objectData.annotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 4 }} - {{- end }} -spec: - {{- include "tc.v1.common.lib.workload.daemonsetSpec" (dict "rootCtx" $rootCtx "objectData" $objectData) | indent 2 }} - selector: - matchLabels: - {{- include "tc.v1.common.lib.metadata.selectorLabels" (dict "rootCtx" $rootCtx "objectType" "pod" "objectName" $objectData.shortName) | trim | nindent 6 }} - template: - metadata: - {{- $labels := (mustMerge ($objectData.podSpec.labels | default dict) - (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml) - (include "tc.v1.common.lib.metadata.podLabels" $rootCtx | fromYaml) - (include "tc.v1.common.lib.metadata.selectorLabels" (dict "rootCtx" $rootCtx "objectType" "pod" "objectName" $objectData.shortName) | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 8 }} - {{- end -}} - {{- $annotations := (mustMerge ($objectData.podSpec.annotations | default dict) - (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml) - (include "tc.v1.common.lib.metadata.externalInterfacePodAnnotations" (dict "rootCtx" $rootCtx "objectData" $objectData) | fromYaml) - (include "tc.v1.common.lib.metadata.podAnnotations" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 8 }} - {{- end }} - spec: - {{- include "tc.v1.common.lib.workload.pod" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 6 }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_deployment.tpl b/cloudflared-6.0.4/charts/common/templates/class/_deployment.tpl deleted file mode 100644 index 3238a5c..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_deployment.tpl +++ /dev/null @@ -1,55 +0,0 @@ -{{/* Deployment Class */}} -{{/* Call this template: -{{ include "tc.v1.common.class.deployment" (dict "rootCtx" $ "objectData" $objectData) }} - -rootCtx: The root context of the chart. -objectData: The object data to be used to render the Deployment. -*/}} - -{{- define "tc.v1.common.class.deployment" -}} - - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - {{- include "tc.v1.common.lib.workload.deploymentValidation" (dict "objectData" $objectData) }} ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ $objectData.name }} - namespace: {{ include "tc.v1.common.lib.metadata.namespace" (dict "rootCtx" $rootCtx "objectData" $objectData "caller" "Deployment") }} - {{- $labels := (mustMerge ($objectData.labels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end -}} - {{- $annotations := (mustMerge ($objectData.annotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 4 }} - {{- end }} -spec: - {{- include "tc.v1.common.lib.workload.deploymentSpec" (dict "rootCtx" $rootCtx "objectData" $objectData) | indent 2 }} - selector: - matchLabels: - {{- include "tc.v1.common.lib.metadata.selectorLabels" (dict "rootCtx" $rootCtx "objectType" "pod" "objectName" $objectData.shortName) | trim | nindent 6 }} - template: - metadata: - {{- $labels := (mustMerge ($objectData.podSpec.labels | default dict) - (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml) - (include "tc.v1.common.lib.metadata.podLabels" $rootCtx | fromYaml) - (include "tc.v1.common.lib.metadata.selectorLabels" (dict "rootCtx" $rootCtx "objectType" "pod" "objectName" $objectData.shortName) | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 8 }} - {{- end -}} - {{- $annotations := (mustMerge ($objectData.podSpec.annotations | default dict) - (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml) - (include "tc.v1.common.lib.metadata.externalInterfacePodAnnotations" (dict "rootCtx" $rootCtx "objectData" $objectData) | fromYaml) - (include "tc.v1.common.lib.metadata.podAnnotations" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 8 }} - {{- end }} - spec: - {{- include "tc.v1.common.lib.workload.pod" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 6 }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_endpoint.tpl b/cloudflared-6.0.4/charts/common/templates/class/_endpoint.tpl deleted file mode 100644 index 29862e9..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_endpoint.tpl +++ /dev/null @@ -1,33 +0,0 @@ -{{/* Endpoint Class */}} -{{/* Call this template: -{{ include "tc.v1.common.class.endpoint" (dict "rootCtx" $ "objectData" $objectData) }} - -rootCtx: The root context of the chart. -objectData: The service data, that will be used to render the Service object. -*/}} - -{{- define "tc.v1.common.class.endpoint" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData }} ---- -apiVersion: v1 -kind: Endpoints -metadata: - name: {{ $objectData.name }} - namespace: {{ include "tc.v1.common.lib.metadata.namespace" (dict "rootCtx" $rootCtx "objectData" $objectData "caller" "Endpoint") }} - {{- $labels := (mustMerge ($objectData.labels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end -}} - {{- $annotations := (mustMerge ($objectData.annotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 4 }} - {{- end }} -subsets: - - addresses: - {{- include "tc.v1.common.lib.endpoint.addresses" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 6 }} - ports: - {{- include "tc.v1.common.lib.endpoint.ports" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 6 }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_endpointSlice.tpl b/cloudflared-6.0.4/charts/common/templates/class/_endpointSlice.tpl deleted file mode 100644 index 0a29dce..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_endpointSlice.tpl +++ /dev/null @@ -1,41 +0,0 @@ -{{/* EndpointSlice Class */}} -{{/* Call this template: -{{ include "tc.v1.common.class.endpointSlice" (dict "rootCtx" $ "objectData" $objectData) }} - -rootCtx: The root context of the chart. -objectData: The service data, that will be used to render the Service object. -*/}} - -{{- define "tc.v1.common.class.endpointSlice" -}} - - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $addressType := $objectData.addressType | default "IPv4" -}} - {{- if $objectData.addressType -}} - {{- $addressType = tpl $addressType $rootCtx -}} - {{- end }} - ---- -apiVersion: discovery.k8s.io/v1 -kind: EndpointSlice -metadata: - name: {{ $objectData.name }} - namespace: {{ include "tc.v1.common.lib.metadata.namespace" (dict "rootCtx" $rootCtx "objectData" $objectData "caller" "Endpoint Slice") }} - {{- $labels := (mustMerge ($objectData.labels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml)) -}} - {{- $_ := set $labels "kubernetes.io/service-name" $objectData.name -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end -}} - {{- $annotations := (mustMerge ($objectData.annotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 4 }} - {{- end }} -addressType: {{ $addressType }} -ports: -{{- include "tc.v1.common.lib.endpointslice.ports" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 2 }} -endpoints: -{{- include "tc.v1.common.lib.endpointslice.endpoints" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 2 }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_horizontalPodAutoscaler.tpl b/cloudflared-6.0.4/charts/common/templates/class/_horizontalPodAutoscaler.tpl deleted file mode 100644 index 92abf3f..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_horizontalPodAutoscaler.tpl +++ /dev/null @@ -1,58 +0,0 @@ -{{/* -This template serves as a blueprint for horizontal pod autoscaler objects that are created -using the common library. -*/}} -{{- define "tc.v1.common.class.hpa" -}} - {{- $targetName := include "tc.v1.common.lib.chart.names.fullname" . -}} - {{- $fullName := include "tc.v1.common.lib.chart.names.fullname" . -}} - {{- $hpaName := $fullName -}} - {{- $values := .Values.hpa -}} - - {{- if hasKey . "ObjectValues" -}} - {{- with .ObjectValues.hpa -}} - {{- $values = . -}} - {{- end -}} - {{- end -}} - {{- $hpaLabels := $values.labels -}} - {{- $hpaAnnotations := $values.annotations -}} - - {{- if and (hasKey $values "nameOverride") $values.nameOverride -}} - {{- $hpaName = printf "%v-%v" $hpaName $values.nameOverride -}} - {{- end }} ---- -apiVersion: {{ include "tc.v1.common.capabilities.hpa.apiVersion" $ }} -kind: HorizontalPodAutoscaler -metadata: - name: {{ $hpaName }} - namespace: {{ $.Values.namespace | default $.Values.global.namespace | default $.Release.Namespace }} - {{- $labels := (mustMerge ($hpaLabels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $ | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end -}} - {{- $annotations := (mustMerge ($hpaAnnotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $ | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 4 }} - {{- end -}} -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: {{ $values.targetKind | default ( include "tc.v1.common.names.controllerType" . ) }} - name: {{ $values.target | default $targetName }} - minReplicas: {{ $values.minReplicas | default 1 }} - maxReplicas: {{ $values.maxReplicas | default 3 }} - metrics: - {{- if $values.targetCPUUtilizationPercentage }} - - type: Resource - resource: - name: cpu - targetAverageUtilization: {{ $values.targetCPUUtilizationPercentage }} - {{- end -}} - {{- if $values.targetMemoryUtilizationPercentage }} - - type: Resource - resource: - name: memory - targetAverageUtilization: {{ $values.targetMemoryUtilizationPercentage }} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_ingress.tpl b/cloudflared-6.0.4/charts/common/templates/class/_ingress.tpl deleted file mode 100644 index 502111b..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_ingress.tpl +++ /dev/null @@ -1,148 +0,0 @@ -{{/* -This template serves as a blueprint for all Ingress objects that are created -within the common library. -*/}} -{{- define "tc.v1.common.class.ingress" -}} - {{- $fullName := include "tc.v1.common.lib.chart.names.fullname" . -}} - {{- $ingressName := $fullName -}} - {{- $values := .Values.ingress -}} - - {{- if hasKey . "ObjectValues" -}} - {{- with .ObjectValues.ingress -}} - {{- $values = . -}} - {{- end -}} - {{- end -}} - {{- $ingressLabels := $values.labels -}} - {{- $ingressAnnotations := $values.annotations -}} - - {{- $ingressName = $values.name -}} - - {{/* Get the name of the primary service, if any */}} - {{- $primaryServiceName := (include "tc.v1.common.lib.util.service.primary" (dict "services" .Values.service "root" .)) -}} - {{/* Get service values of the primary service, if any */}} - {{- $primaryService := get .Values.service $primaryServiceName -}} - {{- $defaultServiceName := $fullName -}} - - {{- if and (hasKey $primaryService "nameOverride") $primaryService.nameOverride -}} - {{- $defaultServiceName = printf "%v-%v" $defaultServiceName $primaryService.nameOverride -}} - {{- end -}} - {{- $defaultServicePort := get $primaryService.ports (include "tc.v1.common.lib.util.service.ports.primary" (dict "svcValues" $primaryService "svcName" $primaryServiceName )) -}} - - {{- $mddwrNamespace := "tc-system" -}} - {{- if $.Values.operator.traefik -}} - {{- if $.Values.operator.traefik.namespace -}} - {{- $mddwrNamespace = $.Values.operator.traefik.namespace -}} - {{- end -}} - {{- end -}} - - {{- if $values.ingressClassName -}} - - {{- if $.Values.global.ixChartContext -}} - {{- $mddwrNamespace = (printf "ix-%s" $values.ingressClassName) -}} - {{- else -}} - {{- $mddwrNamespace = $values.ingressClassName -}} - {{- end -}} - {{- end -}} - - {{- $fixedMiddlewares := "" -}} - {{- if $values.enableFixedMiddlewares -}} - {{- range $index, $fixedMiddleware := $values.fixedMiddlewares -}} - {{- if $index -}} - {{- $fixedMiddlewares = ( printf "%v, %v-%v@%v" $fixedMiddlewares $mddwrNamespace $fixedMiddleware "kubernetescrd" ) -}} - {{- else -}} - {{- $fixedMiddlewares = ( printf "%v-%v@%v" $mddwrNamespace $fixedMiddleware "kubernetescrd" ) -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- $middlewares := "" -}} - {{- range $index, $middleware := $values.middlewares -}} - {{- if $index -}} - {{- $middlewares = ( printf "%v, %v-%v@%v" $middlewares $mddwrNamespace $middleware "kubernetescrd" ) -}} - {{- else -}} - {{- $middlewares = ( printf "%v-%v@%v" $mddwrNamespace $middleware "kubernetescrd" ) -}} - {{- end -}} - {{ end }} - - {{- if and ( $fixedMiddlewares ) ( $middlewares ) -}} - {{- $middlewares = ( printf "%v, %v" $fixedMiddlewares $middlewares ) -}} - {{- else if $fixedMiddlewares -}} - {{- $middlewares = ( printf "%s" $fixedMiddlewares ) -}} - {{- end }} ---- -apiVersion: {{ include "tc.v1.common.capabilities.ingress.apiVersion" $ }} -kind: Ingress -metadata: - name: {{ $ingressName }} - namespace: {{ $.Values.namespace | default $.Values.global.namespace | default $.Release.Namespace }} - {{- $labels := (mustMerge ($ingressLabels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $ | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end -}} - {{- $annotations := (mustMerge ($ingressAnnotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $ | fromYaml)) }} - annotations: - {{- with $values.certificateIssuer }} - cert-manager.io/cluster-issuer: {{ tpl ( toYaml . ) $ }} - cert-manager.io/private-key-rotation-policy: Always - {{- end }} - "traefik.ingress.kubernetes.io/router.entrypoints": {{ $values.entrypoint | default "websecure" }} - "traefik.ingress.kubernetes.io/router.middlewares": {{ $middlewares | quote }} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "annotations" $annotations) | trim) }} - {{- . | nindent 4 }} - {{- end }} -spec: - {{- if $values.ingressClassName }} - ingressClassName: {{ $values.ingressClassName }} - {{- end -}} - {{- if $values.certificateIssuer }} - tls: - {{- range $index, $hostsValues := $values.hosts }} - - hosts: - - {{ tpl $hostsValues.host $ | quote }} - secretName: {{ ( printf "%v-%v-%v" $ingressName "tls" $index ) }} - {{- end -}} - {{- else if $values.tls }} - tls: - {{- range $index, $tlsValues := $values.tls }} - {{- $tlsName := ( printf "%v-%v" "tls" $index ) }} - - hosts: - {{- range $tlsValues.hosts }} - - {{ tpl . $ | quote }} - {{- end -}} - {{- if $tlsValues.certificateIssuer }} - secretName: {{ printf "%v-%v" $ingressName $tlsName }} - {{- else if and ($tlsValues.scaleCert) ($.Values.global.ixChartContext) -}} - {{- $cert := dict }} - {{- $_ := set $cert "id" $tlsValues.scaleCert }} - {{- $_ := set $cert "nameOverride" $tlsName }} - secretName: {{ printf "%s-tls-%v" (include "tc.v1.common.lib.chart.names.fullname" $) $index }} - {{- else if .secretName }} - secretName: {{ tpl .secretName $ | quote }} - {{- end -}} - {{- end -}} - {{- end }} - rules: - {{- range $values.hosts }} - - host: {{ tpl .host $ | quote }} - http: - paths: - {{- range .paths -}} - {{- $service := $defaultServiceName -}} - {{- $port := $defaultServicePort.port -}} - {{- if .service -}} - {{- $service = default $service .service.name -}} - {{- $port = default $port .service.port -}} - {{- end }} - - path: {{ tpl .path $ | quote }} - pathType: {{ default "Prefix" .pathType }} - backend: - service: - name: {{ $service }} - port: - number: {{ $port }} - {{- end -}} - {{- end -}} - - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_job.tpl b/cloudflared-6.0.4/charts/common/templates/class/_job.tpl deleted file mode 100644 index e6630cf..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_job.tpl +++ /dev/null @@ -1,52 +0,0 @@ -{{/* Job Class */}} -{{/* Call this template: -{{ include "tc.v1.common.class.job" (dict "rootCtx" $ "objectData" $objectData) }} - -rootCtx: The root context of the chart. -objectData: The object data to be used to render the Job. -*/}} - -{{- define "tc.v1.common.class.job" -}} - - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - {{- include "tc.v1.common.lib.workload.jobValidation" (dict "objectData" $objectData) }} ---- -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ $objectData.name }} - namespace: {{ include "tc.v1.common.lib.metadata.namespace" (dict "rootCtx" $rootCtx "objectData" $objectData "caller" "Job") }} - {{- $labels := (mustMerge ($objectData.labels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end -}} - {{- $annotations := (mustMerge ($objectData.annotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 4 }} - {{- end }} -spec: - {{- include "tc.v1.common.lib.workload.jobSpec" (dict "rootCtx" $rootCtx "objectData" $objectData) | indent 2 }} - template: - metadata: - {{- $labels := (mustMerge ($objectData.podSpec.labels | default dict) - (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml) - (include "tc.v1.common.lib.metadata.podLabels" $rootCtx | fromYaml) - (include "tc.v1.common.lib.metadata.selectorLabels" (dict "rootCtx" $rootCtx "objectType" "pod" "objectName" $objectData.shortName) | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 8 }} - {{- end -}} - {{- $annotations := (mustMerge ($objectData.podSpec.annotations | default dict) - (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml) - (include "tc.v1.common.lib.metadata.externalInterfacePodAnnotations" (dict "rootCtx" $rootCtx "objectData" $objectData) | fromYaml) - (include "tc.v1.common.lib.metadata.podAnnotations" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 8 }} - {{- end }} - spec: - {{- include "tc.v1.common.lib.workload.pod" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 6 }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_mutatingWebhookConfiguration.tpl b/cloudflared-6.0.4/charts/common/templates/class/_mutatingWebhookConfiguration.tpl deleted file mode 100644 index 2bcd6b9..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_mutatingWebhookConfiguration.tpl +++ /dev/null @@ -1,38 +0,0 @@ -{{/* MutatingWebhookConfiguration Class */}} -{{/* Call this template: -{{ include "tc.v1.common.class.mutatingWebhookConfiguration" (dict "rootCtx" $ "objectData" $objectData) }} - -rootCtx: The root context of the chart. -objectData: - name: The name of the MutatingWebhookConfiguration. - labels: The labels of the MutatingWebhookConfiguration. - annotations: The annotations of the MutatingWebhookConfiguration. - data: The data of the MutatingWebhookConfiguration. - namespace: The namespace of the MutatingWebhookConfiguration. (Optional) -*/}} - -{{- define "tc.v1.common.class.mutatingWebhookConfiguration" -}} - - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData }} ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: MutatingWebhookConfiguration -metadata: - name: {{ $objectData.name }} - namespace: {{ include "tc.v1.common.lib.metadata.namespace" (dict "rootCtx" $rootCtx "objectData" $objectData "caller" "Webhook") }} - {{- $labels := (mustMerge ($objectData.labels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end -}} - {{- $annotations := (mustMerge ($objectData.annotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 4 }} - {{- end }} -webhooks: - {{- range $webhook := $objectData.webhooks -}} - {{- include "tc.v1.common.lib.webhook" (dict "webhook" $webhook "rootCtx" $rootCtx) | trim | nindent 4 }} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_networkAttachmentDefinition.tpl b/cloudflared-6.0.4/charts/common/templates/class/_networkAttachmentDefinition.tpl deleted file mode 100644 index 1c0364d..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_networkAttachmentDefinition.tpl +++ /dev/null @@ -1,35 +0,0 @@ -{{/* Network Attachment Definition Class */}} -{{/* Call this template: -{{ include "tc.v1.common.class.networkAttachmentDefinition" (dict "rootCtx" $ "objectData" $objectData) }} - -rootCtx: The root context of the chart. -objectData: - name: The name of the Network Attachment Definition. - labels: The labels of the Network Attachment Definition. - annotations: The annotations of the Network Attachment Definition. - config: The config of the interface -*/}} - -{{- define "tc.v1.common.class.networkAttachmentDefinition" -}} - - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData }} ---- -apiVersion: k8s.cni.cncf.io/v1 -kind: NetworkAttachmentDefinition -metadata: - name: {{ $objectData.name }} - namespace: {{ include "tc.v1.common.lib.metadata.namespace" (dict "rootCtx" $rootCtx "objectData" $objectData "caller" "Network Attachment Definition") }} - {{- $labels := (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml) | default dict -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end -}} - {{- $annotations := (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml) | default dict -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 4 }} - {{- end }} -spec: - config: {{ $objectData.config | squote }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_networkPolicy.tpl b/cloudflared-6.0.4/charts/common/templates/class/_networkPolicy.tpl deleted file mode 100644 index 735ea2b..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_networkPolicy.tpl +++ /dev/null @@ -1,185 +0,0 @@ -{{/* -Blueprint for the NetworkPolicy object -*/}} -{{- define "tc.v1.common.class.networkpolicy" -}} - {{- $fullName := include "tc.v1.common.lib.chart.names.fullname" . -}} - {{- $networkPolicyName := $fullName -}} - {{- $values := .Values.networkPolicy -}} - - {{- if hasKey . "ObjectValues" -}} - {{- with .ObjectValues.networkPolicy -}} - {{- $values = . -}} - {{- end -}} - {{- end -}} - {{- $networkpolicyLabels := $values.labels -}} - {{- $networkpolicyAnnotations := $values.annotations -}} - - {{- if and (hasKey $values "nameOverride") $values.nameOverride -}} - {{- $networkPolicyName = printf "%v-%v" $networkPolicyName $values.nameOverride -}} - {{- end }} ---- -kind: NetworkPolicy -apiVersion: {{ include "tc.v1.common.capabilities.networkpolicy.apiVersion" $ }} -metadata: - name: {{ $networkPolicyName }} - namespace: {{ $.Values.namespace | default $.Values.global.namespace | default $.Release.Namespace }} - {{- $labels := (mustMerge ($networkpolicyLabels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $ | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end -}} - {{- $annotations := (mustMerge ($networkpolicyAnnotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $ | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 4 }} - {{- end }} -spec: - podSelector: - {{- if $values.podSelector }} - {{- tpl (toYaml $values.podSelector) $ | nindent 4 }} - {{- else if $values.targetSelector }} - {{- $objectData := dict "targetSelector" $values.targetSelector }} - {{- $selectedPod := fromYaml ( include "tc.v1.common.lib.helpers.getSelectedPodValues" (dict "rootCtx" $ "objectData" $objectData)) }} - {{- $selectedPodName := $selectedPod.shortName }} - matchLabels: - {{- include "tc.v1.common.lib.metadata.selectorLabels" (dict "rootCtx" $ "objectType" "pod" "objectName" $selectedPodName) | indent 8 }} - {{- else }} - matchLabels: - {{- include "tc.v1.common.lib.metadata.selectorLabels" (dict "rootCtx" $ "objectType" "" "objectName" "") | indent 8 }} - {{- end }} - - {{- if $values.policyType }} - {{- if eq $values.policyType "ingress" }} - policyTypes: ["Ingress"] - {{- else if eq $values.policyType "egress" }} - policyTypes: ["Egress"] - - {{- else if eq $values.policyType "ingress-egress" }} - policyTypes: ["Ingress", "Egress"] - {{- end -}} - {{- end -}} - - {{- if $values.egress }} - egress: - {{- range $values.egress }} - - to: - {{- range .to -}} - {{- $nss := false -}} - {{- $ipb := false -}} - {{- if .ipBlock -}} - {{- if .ipBlock.cidr -}} - {{- $ipb = true }} - - ipBlock: - cidr: {{ .ipBlock.cidr }} - {{- if .ipBlock.except }} - except: - {{- range .ipBlock.except }} - - {{ . }} - {{- end -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if and ( .namespaceSelector ) ( not $ipb ) -}} - {{- if or ( .namespaceSelector.matchLabels ) ( .namespaceSelector.matchExpressions ) -}} - {{- $nss = true }} - - namespaceSelector: - {{- if .namespaceSelector.matchLabels }} - matchLabels: - {{- .namespaceSelector.matchLabels | toYaml | nindent 12 }} - {{- end -}} - {{- if .namespaceSelector.matchExpressions }} - matchExpressions: - {{- .namespaceSelector.matchExpressions | toYaml | nindent 12 }} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if and ( .podSelector ) ( not $ipb ) -}} - {{- if or ( .podSelector.matchLabels ) ( .podSelector.matchExpressions ) -}} - {{- if $nss }} - podSelector: - {{- else }} - - podSelector: - {{- end -}} - {{- if .podSelector.matchLabels }} - matchLabels: - {{- .podSelector.matchLabels | toYaml | nindent 12 }} - {{- end -}} - {{- if .podSelector.matchExpressions }} - matchExpressions: - {{- .podSelector.matchExpressions | toYaml | nindent 12 }} - {{- end -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- with .ports }} - ports: - {{- . | toYaml | nindent 6 }} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if $values.ingress }} - ingress: - {{- range $values.ingress }} - - from: - {{- range .from -}} - {{- $nss := false -}} - {{- $ipb := false -}} - {{- if .ipBlock -}} - {{- if .ipBlock.cidr -}} - {{- $ipb = true }} - - ipBlock: - cidr: {{ .ipBlock.cidr }} - {{- if .ipBlock.except }} - except: - {{- range .ipBlock.except }} - - {{ . }} - {{- end -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if and ( .namespaceSelector ) ( not $ipb ) -}} - {{- if or ( .namespaceSelector.matchLabels ) ( .namespaceSelector.matchExpressions ) -}} - {{- $nss = true }} - - namespaceSelector: - {{- if .namespaceSelector.matchLabels }} - matchLabels: - {{- .namespaceSelector.matchLabels | toYaml | nindent 12 }} - {{- end -}} - {{- if .namespaceSelector.matchExpressions }} - matchExpressions: - {{- .namespaceSelector.matchExpressions | toYaml | nindent 12 }} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if and ( .podSelector ) ( not $ipb ) -}} - {{- if or ( .podSelector.matchLabels ) ( .podSelector.matchExpressions ) -}} - {{- if $nss }} - podSelector: - {{- else }} - - podSelector: - {{- end }} - {{- if .podSelector.matchLabels }} - matchLabels: - {{- .podSelector.matchLabels | toYaml | nindent 12 }} - {{- end -}} - {{- if .podSelector.matchExpressions }} - matchExpressions: - {{- .podSelector.matchExpressions | toYaml | nindent 12 }} - {{- end -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- with .ports }} - ports: - {{- . | toYaml | nindent 6 }} - {{- end -}} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_podDisruptionBudget.tpl b/cloudflared-6.0.4/charts/common/templates/class/_podDisruptionBudget.tpl deleted file mode 100644 index ae48bc5..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_podDisruptionBudget.tpl +++ /dev/null @@ -1,54 +0,0 @@ -{{/* poddisruptionbudget Class */}} -{{/* Call this template: -{{ include "tc.v1.common.class.podDisruptionBudget" (dict "rootCtx" $ "objectData" $objectData) }} - -rootCtx: The root context of the chart. -objectData: - name: The name of the podDisruptionBudget. - labels: The labels of the podDisruptionBudget. - annotations: The annotations of the podDisruptionBudget. - data: The data of the podDisruptionBudget. - namespace: The namespace of the podDisruptionBudget. (Optional) -*/}} - -{{- define "tc.v1.common.class.podDisruptionBudget" -}} - - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData }} ---- -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: {{ $objectData.name }} - namespace: {{ include "tc.v1.common.lib.metadata.namespace" (dict "rootCtx" $rootCtx "objectData" $objectData "caller" "Pod Disruption Budget") }} - {{- $labels := (mustMerge ($objectData.labels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end -}} - {{- $annotations := (mustMerge ($objectData.annotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 4 }} - {{- end }} -data: - selector: - matchLabels: - {{- if $objectData.customLabels -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $objectData.customLabels) | trim) }} - {{- . | nindent 6 }} - {{- end -}} - {{- else -}} - {{- $selectedPod := fromJson (include "tc.v1.common.lib.helpers.getSelectedPodValues" (dict "rootCtx" $rootCtx "objectData" $objectData "caller" "Pod Disruption Budget")) }} - {{- include "tc.v1.common.lib.metadata.selectorLabels" (dict "rootCtx" $rootCtx "objectType" "pod" "objectName" $selectedPod.shortName) | nindent 6 }} - {{- end -}} - {{- if hasKey $objectData "minAvailable" }} - minAvailable: {{ tpl (toString $objectData.minAvailable) $rootCtx }} - {{- end -}} - {{- if hasKey $objectData "maxUnavailable" }} - maxUnavailable: {{ tpl (toString $objectData.maxUnavailable) $rootCtx }} - {{- end -}} - {{- with $objectData.unhealthyPodEvictionPolicy }} - unhealthyPodEvictionPolicy: {{ tpl . $rootCtx }} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_podMonitor.tpl b/cloudflared-6.0.4/charts/common/templates/class/_podMonitor.tpl deleted file mode 100644 index 907bb3b..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_podMonitor.tpl +++ /dev/null @@ -1,47 +0,0 @@ -{{- define "tc.v1.common.class.podmonitor" -}} - {{- $fullName := include "tc.v1.common.lib.chart.names.fullname" . -}} - {{- $podmonitorName := $fullName -}} - {{- $values := .Values.podmonitor -}} - - {{- if hasKey . "ObjectValues" -}} - {{- with .ObjectValues.metrics -}} - {{- $values = . -}} - {{- end -}} - {{- end -}} - {{- $podmonitorLabels := $values.labels -}} - {{- $podmonitorAnnotations := $values.annotations -}} - - {{- if and (hasKey $values "nameOverride") $values.nameOverride -}} - {{- $podmonitorName = printf "%v-%v" $podmonitorName $values.nameOverride -}} - {{- end }} ---- -apiVersion: {{ include "tc.v1.common.capabilities.podmonitor.apiVersion" $ }} -kind: PodMonitor -metadata: - name: {{ $podmonitorName }} - namespace: {{ $.Values.namespace | default $.Values.global.namespace | default $.Release.Namespace }} - {{- $labels := (mustMerge ($podmonitorLabels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $ | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end }} - {{- $annotations := (mustMerge ($podmonitorAnnotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $ | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 4 }} - {{- end }} -spec: - jobLabel: app.kubernetes.io/name - selector: - {{- if $values.selector }} - {{- tpl (toYaml $values.selector) $ | nindent 4 }} - {{- else }} - {{- $objectData := dict "targetSelector" $values.targetSelector }} - {{- $selectedPod := fromYaml ( include "tc.v1.common.lib.helpers.getSelectedPodValues" (dict "rootCtx" $ "objectData" $objectData)) }} - {{- $selectedPodName := $selectedPod.shortName }} - matchLabels: - {{- include "tc.v1.common.lib.metadata.selectorLabels" (dict "rootCtx" $ "objectType" "pod" "objectName" $selectedPodName) | indent 6 }} - {{- end }} - podMetricsEndpoints: - {{- tpl (toYaml $values.endpoints) $ | nindent 4 }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_prometheusRule.tpl b/cloudflared-6.0.4/charts/common/templates/class/_prometheusRule.tpl deleted file mode 100644 index 34b0b47..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_prometheusRule.tpl +++ /dev/null @@ -1,55 +0,0 @@ -{{- define "tc.v1.common.class.prometheusrule" -}} - {{- $fullName := include "tc.v1.common.lib.chart.names.fullname" . -}} - {{- $prometheusruleName := $fullName -}} - {{- $values := .Values.prometheusrule -}} - - {{- if hasKey . "ObjectValues" -}} - {{- with .ObjectValues.metrics -}} - {{- $values = . -}} - {{- end -}} - {{- end -}} - {{- $prometheusruleLabels := $values.labels -}} - {{- $prometheusruleAnnotations := $values.annotations -}} - - {{- if and (hasKey $values "nameOverride") $values.nameOverride -}} - {{- $prometheusruleName = printf "%v-%v" $prometheusruleName $values.nameOverride -}} - {{- end }} ---- -apiVersion: {{ include "tc.v1.common.capabilities.prometheusrule.apiVersion" $ }} -kind: PrometheusRule -metadata: - name: {{ $prometheusruleName }} - namespace: {{ $.Values.namespace | default $.Values.global.namespace | default $.Release.Namespace }} - {{- $labels := (mustMerge ($prometheusruleLabels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $ | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end }} - {{- $annotations := (mustMerge ($prometheusruleAnnotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $ | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 4 }} - {{- end }} -spec: - groups: - {{- range $name, $groupValues := .groups }} - - name: {{ $prometheusruleName }}-{{ $name }} - rules: - {{- with $groupValues.rules }} - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with $groupValues.additionalrules }} - {{- toYaml . | nindent 8 }} - {{- end }} - {{- end }} - {{- range $id, $groupValues := .additionalgroups }} - - name: {{ $prometheusruleName }}-{{ if $groupValues.name }}{{ $groupValues.name }}{{ else }}{{ $id }}{{ end }} - rules: - {{- with $groupValues.rules }} - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with $groupValues.additionalrules }} - {{- toYaml . | nindent 8 }} - {{- end }} - {{- end }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_pvc.tpl b/cloudflared-6.0.4/charts/common/templates/class/_pvc.tpl deleted file mode 100644 index b145101..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_pvc.tpl +++ /dev/null @@ -1,57 +0,0 @@ -{{/* PVC Class */}} -{{/* Call this template: -{{ include "tc.v1.common.class.pvc" (dict "rootCtx" $ "objectData" $objectData) }} - -rootCtx: The root context of the chart. -objectData: - name: The name of the PVC. - labels: The labels of the PVC. - annotations: The annotations of the PVC. -*/}} - -{{- define "tc.v1.common.class.pvc" -}} - - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $pvcRetain := $rootCtx.Values.fallbackDefaults.pvcRetain -}} - {{- if (kindIs "bool" $objectData.retain) -}} - {{- $pvcRetain = $objectData.retain -}} - {{- end -}} - - {{- $pvcSize := $rootCtx.Values.fallbackDefaults.pvcSize -}} - {{- with $objectData.size -}} - {{- $pvcSize = tpl . $rootCtx -}} - {{- end }} ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: {{ $objectData.name }} - namespace: {{ include "tc.v1.common.lib.metadata.namespace" (dict "rootCtx" $rootCtx "objectData" $objectData "caller" "Persistent Volume Claim") }} - {{- $labels := (mustMerge ($objectData.labels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end -}} - {{- $annotations := (mustMerge ($objectData.annotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml)) -}} - {{- if $pvcRetain -}} - {{- $_ := set $annotations "\"helm.sh/resource-policy\"" "keep" -}} - {{- end -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 4 }} - {{- end }} -spec: - accessModes: - {{- include "tc.v1.common.lib.pvc.accessModes" (dict "rootCtx" $rootCtx "objectData" $objectData "caller" "PVC") | trim | nindent 4 }} - resources: - requests: - storage: {{ $pvcSize }} - {{- with $objectData.volumeName }} - volumeName: {{ tpl . $rootCtx }} - {{- end -}} - {{- with (include "tc.v1.common.lib.storage.storageClassName" (dict "rootCtx" $rootCtx "objectData" $objectData "caller" "PVC") | trim) }} - storageClassName: {{ . }} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_rbac.tpl b/cloudflared-6.0.4/charts/common/templates/class/_rbac.tpl deleted file mode 100644 index d5f94a7..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_rbac.tpl +++ /dev/null @@ -1,64 +0,0 @@ -{{/* RBAC Class */}} -{{/* Call this template: -{{ include "tc.v1.common.class.rbac" (dict "rootCtx" $ "objectData" $objectData) }} - -rootCtx: The root context of the chart. -objectData: - name: The name of the rbac. - labels: The labels of the rbac. - annotations: The annotations of the rbac. - clusterWide: Whether the rbac is cluster wide or not. - rules: The rules of the rbac. - subjects: The subjects of the rbac. -*/}} - -{{- define "tc.v1.common.class.rbac" -}} - - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: {{ ternary "ClusterRole" "Role" $objectData.clusterWide }} -metadata: - name: {{ $objectData.name }} - {{- if not $objectData.clusterWide }} - namespace: {{ include "tc.v1.common.lib.metadata.namespace" (dict "rootCtx" $rootCtx "objectData" $objectData "caller" "RBAC") }} - {{- end }} - {{- $labels := (mustMerge ($objectData.labels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end -}} - {{- $annotations := (mustMerge ($objectData.annotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 4 }} - {{- end }} -rules: - {{- include "tc.v1.common.lib.rbac.rules" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 2 }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: {{ ternary "ClusterRoleBinding" "RoleBinding" $objectData.clusterWide }} -metadata: - name: {{ $objectData.name }} - {{- if not $objectData.clusterWide }} - namespace: {{ $rootCtx.Release.Namespace }} - {{- end }} - {{- $labels := (mustMerge ($objectData.labels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end -}} - {{- $annotations := (mustMerge ($objectData.annotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 4 }} - {{- end }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: {{ ternary "ClusterRole" "Role" $objectData.clusterWide }} - name: {{ $objectData.name }} -subjects: - {{- include "tc.v1.common.lib.rbac.serviceAccount" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 2 }} - {{- include "tc.v1.common.lib.rbac.subjects" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 2 }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_route.tpl b/cloudflared-6.0.4/charts/common/templates/class/_route.tpl deleted file mode 100644 index e9ef7e0..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_route.tpl +++ /dev/null @@ -1,87 +0,0 @@ -{{/* -This template serves as a blueprint for all Route objects that are created -within the common library. -*/}} -{{- define "tc.v1.common.class.route" -}} -{{- $values := .Values.route -}} -{{- if hasKey . "ObjectValues" -}} - {{- with .ObjectValues.route -}} - {{- $values = . -}} - {{- end -}} -{{- end -}} - - {{- $routeLabels := $values.labels -}} - {{- $routeAnnotations := $values.annotations -}} - -{{- $fullName := include "tc.v1.common.lib.chart.names.fullname" . -}} -{{- if and (hasKey $values "nameOverride") $values.nameOverride -}} - {{- $fullName = printf "%v-%v" $fullName $values.nameOverride -}} -{{- end -}} -{{- $routeKind := $values.kind | default "HTTPRoute" -}} - -{{/* Get the name of the primary service, if any */}} -{{- $primaryServiceName := (include "tc.v1.common.lib.util.service.primary" (dict "services" .Values.service "root" .)) -}} -{{/* Get service values of the primary service, if any */}} -{{- $primaryService := get .Values.service $primaryServiceName -}} -{{- $defaultServiceName := $fullName -}} - -{{- if and (hasKey $primaryService "nameOverride") $primaryService.nameOverride -}} - {{- $defaultServiceName = printf "%v-%v" $defaultServiceName $primaryService.nameOverride -}} -{{- end -}} -{{- $defaultServicePort := get $primaryService.ports (include "tc.v1.common.lib.util.service.ports.primary" (dict "svcValues" $primaryService "svcName" $primaryServiceName )) }} - ---- -apiVersion: gateway.networking.k8s.io/v1alpha2 -{{- if and (ne $routeKind "GRPCRoute") (ne $routeKind "HTTPRoute") (ne $routeKind "TCPRoute") (ne $routeKind "TLSRoute") (ne $routeKind "UDPRoute") -}} - {{- fail (printf "Not a valid route kind (%s)" $routeKind) -}} -{{- end }} -kind: {{ $routeKind }} -metadata: - name: {{ $fullName }} - namespace: {{ $.Values.namespace | default $.Values.global.namespace | default $.Release.Namespace }} - {{- $labels := (mustMerge ($routeLabels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $ | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end -}} - {{- $annotations := (mustMerge ($routeAnnotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $ | fromYaml)) }} - annotations: - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "annotations" $annotations) | trim) }} - {{- . | nindent 4 }} - {{- end }} -spec: - parentRefs: - {{- range $values.parentRefs }} - - group: {{ default "gateway.networking.k8s.io" .group }} - kind: {{ default "Gateway" .kind }} - name: {{ required (printf "parentRef name is required for %v %v" $routeKind $fullName) .name }} - namespace: {{ required (printf "parentRef namespace is required for %v %v" $routeKind $fullName) .namespace }} - {{- if .sectionName }} - sectionName: {{ .sectionName | quote }} - {{- end }} - {{- end }} - {{- if and (ne $routeKind "TCPRoute") (ne $routeKind "UDPRoute") $values.hostnames }} - hostnames: - {{- with $values.hostnames }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} - rules: - {{- range $values.rules }} - - backendRefs: - {{- range .backendRefs }} - - group: {{ default "" .group | quote}} - kind: {{ default "Service" .kind }} - name: {{ default $defaultServiceName .name }} - namespace: {{ default $.Release.Namespace .namespace }} - port: {{ default $defaultServicePort.port .port }} - weight: {{ default 1 .weight }} - {{- end }} - {{- if (eq $routeKind "HTTPRoute") }} - {{- with .matches }} - matches: - {{- toYaml . | nindent 6 }} - {{- end }} - {{- end }} - {{- end }} -{{- end }} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_secret.tpl b/cloudflared-6.0.4/charts/common/templates/class/_secret.tpl deleted file mode 100644 index 14b2f2a..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_secret.tpl +++ /dev/null @@ -1,58 +0,0 @@ -{{/* Secret Class */}} -{{/* Call this template: -{{ include "tc.v1.common.class.secret" (dict "rootCtx" $ "objectData" $objectData) }} - -rootCtx: The root context of the chart. -objectData: - name: The name of the secret. - labels: The labels of the secret. - annotations: The annotations of the secret. - type: The type of the secret. - data: The data of the secret. - namespace: The namespace of the secret. (Optional) -*/}} - -{{- define "tc.v1.common.class.secret" -}} - - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - {{- $secretType := "Opaque" -}} - - {{- if eq $objectData.type "certificate" -}} - {{- $secretType = "kubernetes.io/tls" -}} - {{- else if eq $objectData.type "imagePullSecret" -}} - {{- $secretType = "kubernetes.io/dockerconfigjson" -}} - {{- else if $objectData.type -}} - {{- $secretType = $objectData.type -}} - {{- end }} ---- -apiVersion: v1 -kind: Secret -type: {{ $secretType }} -metadata: - name: {{ $objectData.name }} - namespace: {{ include "tc.v1.common.lib.metadata.namespace" (dict "rootCtx" $rootCtx "objectData" $objectData "caller" "Secret") }} - {{- $labels := (mustMerge ($objectData.labels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end -}} - {{- $annotations := (mustMerge ($objectData.annotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 4 }} - {{- end -}} - {{- if (mustHas $objectData.type (list "certificate" "imagePullSecret")) }} -data: - {{- if eq $objectData.type "certificate" }} - tls.crt: {{ $objectData.data.certificate | trim | b64enc }} - tls.key: {{ $objectData.data.privatekey | trim | b64enc }} - {{- else if eq $objectData.type "imagePullSecret" }} - .dockerconfigjson: {{ $objectData.data | trim | b64enc }} - {{- end -}} - {{- else }} -stringData: - {{- tpl (toYaml $objectData.data) $rootCtx | nindent 2 }} - {{/* This comment is here to add a new line */}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_service.tpl b/cloudflared-6.0.4/charts/common/templates/class/_service.tpl deleted file mode 100644 index e1fd3d4..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_service.tpl +++ /dev/null @@ -1,115 +0,0 @@ -{{/* Service Class */}} -{{/* Call this template: -{{ include "tc.v1.common.class.service" (dict "rootCtx" $ "objectData" $objectData) }} - -rootCtx: The root context of the chart. -objectData: The service data, that will be used to render the Service object. -*/}} - -{{- define "tc.v1.common.class.service" -}} - - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $svcType := $objectData.type | default $rootCtx.Values.fallbackDefaults.serviceType -}} - - {{/* Init variables */}} - {{- $hasHTTPSPort := false -}} - {{- $hasHostPort := false -}} - {{- $hostNetwork := false -}} - {{- $podValues := dict -}} - - {{- range $portName, $port := $objectData.ports -}} - {{- if $port.enabled -}} - {{- if eq (tpl ($port.protocol | default "") $rootCtx) "https" -}} - {{- $hasHTTPSPort = true -}} - {{- end -}} - - {{- if and (hasKey $port "hostPort") $port.hostPort -}} - {{- $hasHostPort = true -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- $specialTypes := (list "ExternalName" "ExternalIP") -}} - {{/* External Name / External IP does not rely on any pod values */}} - {{- if not (mustHas $svcType $specialTypes) -}} - {{/* Get Pod Values based on the selector (or the absence of it) */}} - {{- $podValues = fromJson (include "tc.v1.common.lib.helpers.getSelectedPodValues" (dict "rootCtx" $rootCtx "objectData" $objectData "caller" "Service")) -}} - - {{- if $podValues -}} - {{/* Get Pod hostNetwork configuration */}} - {{- $hostNetwork = include "tc.v1.common.lib.pod.hostNetwork" (dict "rootCtx" $rootCtx "objectData" $podValues) -}} - {{/* When hostNetwork is set on the pod, force ClusterIP, so services wont try to bind the same ports on the host */}} - {{- if or (and (kindIs "bool" $hostNetwork) $hostNetwork) (and (kindIs "string" $hostNetwork) (eq $hostNetwork "true")) -}} - {{- $svcType = "ClusterIP" -}} - {{- end -}} - {{- end -}} - - {{/* When hostPort is defined, force ClusterIP aswell */}} - {{- if $hasHostPort -}} - {{- $svcType = "ClusterIP" -}} - {{- end -}} - {{- end -}} - {{- $_ := set $objectData "type" $svcType }} - ---- -apiVersion: v1 -kind: Service -metadata: - name: {{ $objectData.name }} - namespace: {{ include "tc.v1.common.lib.metadata.namespace" (dict "rootCtx" $rootCtx "objectData" $objectData "caller" "Service") }} - {{- $labels := (mustMerge ($objectData.labels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml) - (include "tc.v1.common.lib.metadata.selectorLabels" (dict "rootCtx" $rootCtx "objectType" "service" "objectName" $objectData.shortName) | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end -}} - {{- $annotations := (mustMerge ($objectData.annotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml)) -}} - {{- if eq $objectData.type "LoadBalancer" -}} - {{- include "tc.v1.common.lib.service.metalLBAnnotations" (dict "rootCtx" $rootCtx "objectData" $objectData "annotations" $annotations) -}} - {{- end -}} - {{- if $hasHTTPSPort -}} - {{- include "tc.v1.common.lib.service.traefikAnnotations" (dict "rootCtx" $rootCtx "annotations" $annotations) -}} - {{- end -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 4 }} - {{- end }} -spec: - {{- if eq $objectData.type "ClusterIP" -}} - {{- include "tc.v1.common.lib.service.spec.clusterIP" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 2 -}} - {{- else if eq $objectData.type "LoadBalancer" -}} - {{- include "tc.v1.common.lib.service.spec.loadBalancer" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 2 -}} - {{- else if eq $objectData.type "NodePort" -}} - {{- include "tc.v1.common.lib.service.spec.nodePort" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 2 -}} - {{- else if eq $objectData.type "ExternalName" -}} - {{- include "tc.v1.common.lib.service.spec.externalName" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 2 -}} - {{- else if eq $objectData.type "ExternalIP" -}} - {{- include "tc.v1.common.lib.service.spec.externalIP" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 2 -}} - {{- end -}} - {{- with (include "tc.v1.common.lib.service.ports" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim) }} - ports: - {{- . | nindent 4 }} - {{- end -}} - {{- if not (mustHas $objectData.type $specialTypes) }} - selector: - {{- if $objectData.selectorLabels }} - {{- tpl ( toYaml $objectData.selectorLabels) $rootCtx | nindent 4 }} - {{- else }} - {{- include "tc.v1.common.lib.metadata.selectorLabels" (dict "rootCtx" $rootCtx "objectType" "pod" "objectName" $podValues.shortName) | trim | nindent 4 -}} - {{- end }} - {{- end -}} - {{- if eq $objectData.type "ExternalIP" -}} - {{- $useSlice := true -}} - {{- if kindIs "bool" $objectData.useSlice -}} - {{- $useSlice = $objectData.useSlice -}} - {{- end -}} - - {{- if $useSlice -}} - {{- include "tc.v1.common.class.endpointSlice" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 0 }} - {{- else -}} - {{- include "tc.v1.common.class.endpoint" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 0 }} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_serviceAccount.tpl b/cloudflared-6.0.4/charts/common/templates/class/_serviceAccount.tpl deleted file mode 100644 index 209bf0b..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_serviceAccount.tpl +++ /dev/null @@ -1,34 +0,0 @@ -{{/* Service Account Class */}} -{{/* Call this template: -{{ include "tc.v1.common.class.serviceAccount" (dict "rootCtx" $ "objectData" $objectData) }} - -rootCtx: The root context of the chart. -objectData: - name: The name of the serviceAccount. - labels: The labels of the serviceAccount. - annotations: The annotations of the serviceAccount. - autoMountToken: Whether to mount the ServiceAccount token or not. -*/}} - -{{- define "tc.v1.common.class.serviceAccount" -}} - - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData }} ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ $objectData.name }} - namespace: {{ include "tc.v1.common.lib.metadata.namespace" (dict "rootCtx" $rootCtx "objectData" $objectData "caller" "Service Account") }} - {{- $labels := (mustMerge ($objectData.labels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end -}} - {{- $annotations := (mustMerge ($objectData.annotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 4 }} - {{- end }} -automountServiceAccountToken: {{ $objectData.automountServiceAccountToken | default false }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_serviceMonitor.tpl b/cloudflared-6.0.4/charts/common/templates/class/_serviceMonitor.tpl deleted file mode 100644 index 17c2020..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_serviceMonitor.tpl +++ /dev/null @@ -1,47 +0,0 @@ -{{- define "tc.v1.common.class.servicemonitor" -}} - {{- $fullName := include "tc.v1.common.lib.chart.names.fullname" . -}} - {{- $servicemonitorName := $fullName -}} - {{- $values := .Values.servicemonitor -}} - - {{- if hasKey . "ObjectValues" -}} - {{- with .ObjectValues.metrics -}} - {{- $values = . -}} - {{- end -}} - {{- end -}} - {{- $servicemonitorLabels := $values.labels -}} - {{- $servicemonitorAnnotations := $values.annotations -}} - - {{- if and (hasKey $values "nameOverride") $values.nameOverride -}} - {{- $servicemonitorName = printf "%v-%v" $servicemonitorName $values.nameOverride -}} - {{- end }} ---- -apiVersion: {{ include "tc.v1.common.capabilities.servicemonitor.apiVersion" $ }} -kind: ServiceMonitor -metadata: - name: {{ $servicemonitorName }} - namespace: {{ $.Values.namespace | default $.Values.global.namespace | default $.Release.Namespace }} - {{- $labels := (mustMerge ($servicemonitorLabels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $ | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end }} - {{- $annotations := (mustMerge ($servicemonitorAnnotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $ | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 4 }} - {{- end }} -spec: - jobLabel: app.kubernetes.io/name - selector: - {{- if $values.selector }} - {{- tpl (toYaml $values.selector) $ | nindent 4 }} - {{- else }} - {{- $objectData := dict "targetSelector" $values.targetSelector }} - {{- $selectedService := fromYaml ( include "tc.v1.common.lib.helpers.getSelectedServiceValues" (dict "rootCtx" $ "objectData" $objectData)) }} - {{- $selectedServiceName := $selectedService.shortName }} - matchLabels: - {{- include "tc.v1.common.lib.metadata.selectorLabels" (dict "rootCtx" $ "objectType" "service" "objectName" $selectedServiceName) | indent 6 }} - {{- end }} - endpoints: - {{- tpl (toYaml $values.endpoints) $ | nindent 4 }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_statefulset.tpl b/cloudflared-6.0.4/charts/common/templates/class/_statefulset.tpl deleted file mode 100644 index 289ba82..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_statefulset.tpl +++ /dev/null @@ -1,59 +0,0 @@ -{{/* StatefulSet Class */}} -{{/* Call this template: -{{ include "tc.v1.common.class.deployment" (dict "rootCtx" $ "objectData" $objectData) }} - -rootCtx: The root context of the chart. -objectData: The object data to be used to render the StatefulSet. -*/}} - -{{- define "tc.v1.common.class.statefulset" -}} - - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - {{- include "tc.v1.common.lib.workload.statefulsetValidation" (dict "objectData" $objectData) }} ---- -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: {{ $objectData.name }} - namespace: {{ include "tc.v1.common.lib.metadata.namespace" (dict "rootCtx" $rootCtx "objectData" $objectData "caller" "StatefulSet") }} - {{- $labels := (mustMerge ($objectData.labels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end -}} - {{- $annotations := (mustMerge ($objectData.annotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 4 }} - {{- end }} -spec: - {{- include "tc.v1.common.lib.workload.statefulsetSpec" (dict "rootCtx" $rootCtx "objectData" $objectData) | indent 2 }} - selector: - matchLabels: - {{- include "tc.v1.common.lib.metadata.selectorLabels" (dict "rootCtx" $rootCtx "objectType" "pod" "objectName" $objectData.shortName) | trim | nindent 6 }} - template: - metadata: - {{- $labels := (mustMerge ($objectData.podSpec.labels | default dict) - (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml) - (include "tc.v1.common.lib.metadata.podLabels" $rootCtx | fromYaml) - (include "tc.v1.common.lib.metadata.selectorLabels" (dict "rootCtx" $rootCtx "objectType" "pod" "objectName" $objectData.shortName) | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 8 }} - {{- end -}} - {{- $annotations := (mustMerge ($objectData.podSpec.annotations | default dict) - (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml) - (include "tc.v1.common.lib.metadata.externalInterfacePodAnnotations" (dict "rootCtx" $rootCtx "objectData" $objectData) | fromYaml) - (include "tc.v1.common.lib.metadata.podAnnotations" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 8 }} - {{- end }} - spec: - {{- include "tc.v1.common.lib.workload.pod" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 6 }} - {{- with (include "tc.v1.common.lib.storage.volumeClaimTemplates" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim) }} - volumeClaimTemplates: - {{- . | nindent 4 }} - {{- end }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/class/_validatingWebhookConfiguration.tpl b/cloudflared-6.0.4/charts/common/templates/class/_validatingWebhookConfiguration.tpl deleted file mode 100644 index f9f05d4..0000000 --- a/cloudflared-6.0.4/charts/common/templates/class/_validatingWebhookConfiguration.tpl +++ /dev/null @@ -1,38 +0,0 @@ -{{/* ValidatingWebhookconfiguration Class */}} -{{/* Call this template: -{{ include "tc.v1.common.class.validatingWebhookconfiguration" (dict "rootCtx" $ "objectData" $objectData) }} - -rootCtx: The root context of the chart. -objectData: - name: The name of the validatingWebhookconfiguration. - labels: The labels of the validatingWebhookconfiguration. - annotations: The annotations of the validatingWebhookconfiguration. - data: The data of the validatingWebhookconfiguration. - namespace: The namespace of the validatingWebhookconfiguration. (Optional) -*/}} - -{{- define "tc.v1.common.class.validatingWebhookconfiguration" -}} - - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData }} ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingWebhookConfiguration -metadata: - name: {{ $objectData.name }} - namespace: {{ include "tc.v1.common.lib.metadata.namespace" (dict "rootCtx" $rootCtx "objectData" $objectData "caller" "Webhook") }} - {{- $labels := (mustMerge ($objectData.labels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 4 }} - {{- end -}} - {{- $annotations := (mustMerge ($objectData.annotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $rootCtx | fromYaml)) -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 4 }} - {{- end }} -webhooks: - {{- range $webhook := $objectData.webhooks -}} - {{- include "tc.v1.common.lib.webhook" (dict "webhook" $webhook "rootCtx" $rootCtx) | trim | nindent 4 }} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/helpers/_envDupeCheck.tpl b/cloudflared-6.0.4/charts/common/templates/helpers/_envDupeCheck.tpl deleted file mode 100644 index da27c96..0000000 --- a/cloudflared-6.0.4/charts/common/templates/helpers/_envDupeCheck.tpl +++ /dev/null @@ -1,23 +0,0 @@ -{{/* Check Env for Duplicates */}} -{{/* Call this template: -{{ include "tc.v1.common.helper.container.envDupeCheck" (dict "rootCtx" $ "objectData" $objectData "source" $source "key" $key) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the container. -*/}} -{{- define "tc.v1.common.helper.container.envDupeCheck" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $source := .source -}} - {{- $type := .type -}} - {{- $key := .key -}} - - {{- $dupeEnv := (get $objectData.envDupe $key) -}} - - {{- if $dupeEnv -}} - {{- fail (printf "Container - Environment Variable [%s] in [%s] tried to override the Environment Variable that is already defined in [%s]" $key $source $dupeEnv.source) -}} - {{- end -}} - - {{- $_ := set $objectData.envDupe $key (dict "source" $source) -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/helpers/_getPortRange.tpl b/cloudflared-6.0.4/charts/common/templates/helpers/_getPortRange.tpl deleted file mode 100644 index 8127fc5..0000000 --- a/cloudflared-6.0.4/charts/common/templates/helpers/_getPortRange.tpl +++ /dev/null @@ -1,59 +0,0 @@ -{{/* Returns Lowest and Highest ports assigned to the any container in the pod */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.helpers.securityContext.getPortRange" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the Pod. -*/}} -{{- define "tc.v1.common.lib.helpers.securityContext.getPortRange" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{ $portRange := (dict "high" 0 "low" 0) }} - - {{- range $name, $service := $rootCtx.Values.service -}} - {{- $selected := false -}} - {{/* If service is enabled... */}} - {{- if $service.enabled -}} - - {{/* If there is a selector */}} - {{- if $service.targetSelector -}} - - {{/* And pod is selected */}} - {{- if eq $service.targetSelector $objectData.shortName -}} - {{- $selected = true -}} - {{- end -}} - - {{- else -}} - {{/* If no selector is defined but pod is primary */}} - {{- if $objectData.primary -}} - {{- $selected = true -}} - {{- end -}} - - {{- end -}} - {{- end -}} - - {{- if $selected -}} - {{- range $name, $portValues := $service.ports -}} - {{- if $portValues.enabled -}} - - {{- $portToCheck := ($portValues.targetPort | default $portValues.port) -}} - {{- if kindIs "string" $portToCheck -}} - {{- $portToCheck = (tpl $portToCheck $rootCtx) | int -}} - {{- end -}} - - {{- if or (not $portRange.low) (lt ($portToCheck | int) ($portRange.low | int)) -}} - {{- $_ := set $portRange "low" $portToCheck -}} - {{- end -}} - - {{- if or (not $portRange.high) (gt ($portToCheck | int) ($portRange.high | int)) -}} - {{- $_ := set $portRange "high" $portToCheck -}} - {{- end -}} - - {{- end -}} - {{- end -}} - {{- end -}} - - {{- end -}} - - {{- $portRange | toJson -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/helpers/_getSelectedPod.tpl b/cloudflared-6.0.4/charts/common/templates/helpers/_getSelectedPod.tpl deleted file mode 100644 index c2d7cf9..0000000 --- a/cloudflared-6.0.4/charts/common/templates/helpers/_getSelectedPod.tpl +++ /dev/null @@ -1,47 +0,0 @@ -{{/* Service - Get Selected Pod */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.helpers.getSelectedPodValues" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -objectData: The object data of the service -rootCtx: The root context of the chart. -*/}} - -{{- define "tc.v1.common.lib.helpers.getSelectedPodValues" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - {{- $caller := .caller -}} - - {{- $podValues := dict -}} - {{- with $objectData.targetSelector -}} - {{- $podValues = mustDeepCopy (get $rootCtx.Values.workload .) -}} - - {{- if not $podValues -}} - {{- fail (printf "%s - Selected pod [%s] is not defined" $caller .) -}} - {{- end -}} - - {{- if not $podValues.enabled -}} - {{- fail (printf "%s - Selected pod [%s] is not enabled" $caller .) -}} - {{- end -}} - - {{/* While we know the shortName from targetSelector, let's set it explicitly - So service can reference this directly, to match the behaviour of a service - without targetSelector defined (assumes "use primary") */}} - {{- $_ := set $podValues "shortName" . -}} - {{- else -}} - - {{/* If no targetSelector is defined, we assume the service is using the primary pod */}} - {{/* Also no need to check for multiple primaries here, it's already done on the workload validation */}} - {{- range $podName, $pod := $rootCtx.Values.workload -}} - {{- if $pod.enabled -}} - {{- if $pod.primary -}} - {{- $podValues = mustDeepCopy $pod -}} - {{/* Set the shortName so service can use this on selector */}} - {{- $_ := set $podValues "shortName" $podName -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- end -}} - - {{/* Return values in Json, to preserve types */}} - {{ $podValues | toJson }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/helpers/_getSelectedService.tpl b/cloudflared-6.0.4/charts/common/templates/helpers/_getSelectedService.tpl deleted file mode 100644 index d874222..0000000 --- a/cloudflared-6.0.4/charts/common/templates/helpers/_getSelectedService.tpl +++ /dev/null @@ -1,47 +0,0 @@ -{{/* Service - Get Selected Service */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.helpers.getSelectedServiceValues" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -objectData: The object data of the service -rootCtx: The root context of the chart. -*/}} - -{{- define "tc.v1.common.lib.helpers.getSelectedServiceValues" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - {{- $caller := .caller -}} - - {{- $serviceValues := dict -}} - {{- with $objectData.targetSelector -}} - {{- $serviceValues = mustDeepCopy (get $rootCtx.Values.service .) -}} - - {{- if not $serviceValues -}} - {{- fail (printf "%s - Selected service [%s] is not defined" $caller .) -}} - {{- end -}} - - {{- if not $serviceValues.enabled -}} - {{- fail (printf "%s - Selected service [%s] is not enabled" $caller .) -}} - {{- end -}} - - {{/* While we know the shortName from targetSelector, let's set it explicitly - So service can reference this directly, to match the behaviour of a service - without targetSelector defined (assumes "use primary") */}} - {{- $_ := set $serviceValues "shortName" . -}} - {{- else -}} - - {{/* If no targetSelector is defined, we assume the service is using the primary service */}} - {{/* Also no need to check for multiple primaries here, it's already done on the service validation */}} - {{- range $serviceName, $service := $rootCtx.Values.service -}} - {{- if $service.enabled -}} - {{- if $service.primary -}} - {{- $serviceValues = mustDeepCopy $service -}} - {{/* Set the shortName so service can use this on selector */}} - {{- $_ := set $serviceValues "shortName" $serviceName -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- end -}} - - {{/* Return values in Json, to preserve types */}} - {{ $serviceValues | toJson }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/helpers/_makeIntOrNoop.tpl b/cloudflared-6.0.4/charts/common/templates/helpers/_makeIntOrNoop.tpl deleted file mode 100644 index aec1ddf..0000000 --- a/cloudflared-6.0.4/charts/common/templates/helpers/_makeIntOrNoop.tpl +++ /dev/null @@ -1,21 +0,0 @@ -{{- define "tc.v1.common.helper.makeIntOrNoop" -}} - {{- $value := . -}} - - {{/* - - Ints in Helm can be either int, int64 or float64. - - Values that start with zero should not be converted - to int again as this will strip leading zeros. - - Numbers converted to E notation by Helm will - always contain the "e" character. So we only - convert those. - */}} - {{- if and - (mustHas (kindOf $value) (list "int" "int64" "float64")) - (not (hasPrefix "0" ($value | toString))) - (contains "e" ($value | toString | lower)) - -}} - {{- $value | int -}} - {{- else -}} - {{- $value -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/_tc_capabilities.tpl b/cloudflared-6.0.4/charts/common/templates/lib/_tc_capabilities.tpl deleted file mode 100644 index 62602c5..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/_tc_capabilities.tpl +++ /dev/null @@ -1,44 +0,0 @@ -{{/* Return the appropriate apiVersion for PodMonitor */}} -{{- define "tc.v1.common.capabilities.podmonitor.apiVersion" -}} - {{- print "monitoring.coreos.com/v1" -}} -{{- end -}} - -{{/* Return the appropriate apiVersion for ServiceMonitor */}} -{{- define "tc.v1.common.capabilities.servicemonitor.apiVersion" -}} - {{- print "monitoring.coreos.com/v1" -}} -{{- end -}} - -{{/* Return the appropriate apiVersion for PrometheusRule */}} -{{- define "tc.v1.common.capabilities.prometheusrule.apiVersion" -}} - {{- print "monitoring.coreos.com/v1" -}} -{{- end -}} - -{{/* Return the appropriate apiVersion for Ingress */}} -{{- define "tc.v1.common.capabilities.ingress.apiVersion" -}} - {{- print "networking.k8s.io/v1" -}} -{{- end -}} - -{{/* Return the appropriate apiVersion for NetworkPolicy*/}} -{{- define "tc.v1.common.capabilities.networkpolicy.apiVersion" -}} - {{- print "networking.k8s.io/v1" -}} -{{- end -}} - -{{/* Return the appropriate apiVersion for HorizontalPodAutoscaler aka HPA*/}} -{{- define "tc.v1.common.capabilities.hpa.apiVersion" -}} - {{- print "autoscaling/v2" -}} -{{- end -}} - -{{/* Return the appropriate apiVersion for Cert-Manager certificates */}} -{{- define "tc.v1.common.capabilities.cert-manager.certificate.apiVersion" -}} - {{- print "cert-manager.io/v1" -}} -{{- end -}} - -{{/* Return the appropriate apiVersion for Cert-Manager certificates */}} -{{- define "tc.v1.common.capabilities.cnpg.cluster.apiVersion" -}} - {{- print "postgresql.cnpg.io/v1" -}} -{{- end -}} - -{{/* Return the appropriate apiVersion for Cert-Manager certificates */}} -{{- define "tc.v1.common.capabilities.cnpg.pooler.apiVersion" -}} - {{- print "postgresql.cnpg.io/v1" -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/chart/_names.tpl b/cloudflared-6.0.4/charts/common/templates/lib/chart/_names.tpl deleted file mode 100644 index 9241b0c..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/chart/_names.tpl +++ /dev/null @@ -1,48 +0,0 @@ -{{/* Contains functions for generating names */}} - -{{/* Returns the name of the Chart */}} -{{- define "tc.v1.common.lib.chart.names.name" -}} - - {{- .Chart.Name | lower | trunc 63 | trimSuffix "-" -}} - -{{- end -}} - -{{/* Returns the fullname of the Chart */}} -{{- define "tc.v1.common.lib.chart.names.fullname" -}} - - {{- $name := include "tc.v1.common.lib.chart.names.name" . -}} - - {{- if contains $name .Release.Name -}} - {{- $name = .Release.Name -}} - {{- else -}} - {{- $name = printf "%s-%s" .Release.Name $name -}} - {{- end -}} - - {{- $name | lower | trunc 63 | trimSuffix "-" -}} - -{{- end -}} - -{{/* Returns the fqdn of the Chart */}} -{{- define "tc.v1.common.lib.chart.names.fqdn" -}} - - {{- printf "%s.%s" (include "tc.v1.common.lib.chart.names.name" .) .Release.Namespace | replace "+" "_" | trunc 63 | trimSuffix "-" -}} - -{{- end -}} - -{{/* Validates names */}} -{{- define "tc.v1.common.lib.chart.names.validation" -}} - - {{- $name := .name -}} - - {{- if not (and (mustRegexMatch "^[a-z0-9](-?[a-z0-9]-?)+[a-z0-9]$" $name) (le (len $name) 63)) -}} - {{- fail (printf "Name [%s] is not valid. Must start and end with an alphanumeric lowercase character. It can contain '-'. And must be at most 63 characters." $name) -}} - {{- end -}} - -{{- end -}} - -{{/* Create chart name and version as used by the chart label */}} -{{- define "tc.v1.common.lib.chart.names.chart" -}} - - {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/chart/_notes.tpl b/cloudflared-6.0.4/charts/common/templates/lib/chart/_notes.tpl deleted file mode 100644 index b6924de..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/chart/_notes.tpl +++ /dev/null @@ -1,21 +0,0 @@ -{{- define "tc.v1.common.lib.chart.notes" -}} - - {{- include "tc.v1.common.lib.chart.header" . -}} - - {{- include "tc.v1.common.lib.chart.custom" . -}} - - {{- include "tc.v1.common.lib.chart.footer" . -}} - -{{- end -}} - -{{- define "tc.v1.common.lib.chart.header" -}} - {{- tpl $.Values.notes.header $ | nindent 0 }} -{{- end -}} - -{{- define "tc.v1.common.lib.chart.custom" -}} - {{- tpl $.Values.notes.custom $ | nindent 0 }} -{{- end -}} - -{{- define "tc.v1.common.lib.chart.footer" -}} - {{- tpl $.Values.notes.footer $ | nindent 0 }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/cnpg/_poolerMetrics.tpl b/cloudflared-6.0.4/charts/common/templates/lib/cnpg/_poolerMetrics.tpl deleted file mode 100644 index f1b7152..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/cnpg/_poolerMetrics.tpl +++ /dev/null @@ -1,9 +0,0 @@ -{{- define "tc.v1.common.lib.cnpg.metrics.pooler" -}} -enabled: true -type: "podmonitor" -selector: - matchLabels: - cnpg.io/poolerName: {{ .poolerName }} -endpoints: -- port: metrics -{{- end }} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/cnpg/_urlsSecret.tpl b/cloudflared-6.0.4/charts/common/templates/lib/cnpg/_urlsSecret.tpl deleted file mode 100644 index 2b83fe0..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/cnpg/_urlsSecret.tpl +++ /dev/null @@ -1,14 +0,0 @@ -{{- define "tc.v1.common.lib.cnpg.secret.urls" -}} -{{- $std := .std }} -{{- $nossl := .nossl }} -{{- $porthost := .porthost }} -{{- $host := .host }} -{{- $jdbc := .jdbc }} -enabled: true -data: - std: {{ $std }} - nossl: {{ $nossl }} - porthost: {{ $porthost }} - host: {{ $host }} - jdbc: {{ $jdbc }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/cnpg/_userSecret.tpl b/cloudflared-6.0.4/charts/common/templates/lib/cnpg/_userSecret.tpl deleted file mode 100644 index b4bb53c..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/cnpg/_userSecret.tpl +++ /dev/null @@ -1,9 +0,0 @@ -{{- define "tc.v1.common.lib.cnpg.secret.user" -}} -{{- $dbPass := .dbPass }} -{{- $values := .values -}} -enabled: true -type: kubernetes.io/basic-auth -data: - username: {{ $values.user }} - password: {{ $dbPass }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/configmap/_validation.tpl b/cloudflared-6.0.4/charts/common/templates/lib/configmap/_validation.tpl deleted file mode 100644 index 6f2a252..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/configmap/_validation.tpl +++ /dev/null @@ -1,21 +0,0 @@ -{{/* Configmap Validation */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.configmap.validation" (dict "objectData" $objectData) -}} -objectData: - labels: The labels of the configmap. - annotations: The annotations of the configmap. - data: The data of the configmap. -*/}} - -{{- define "tc.v1.common.lib.configmap.validation" -}} - {{- $objectData := .objectData -}} - - {{- if not $objectData.data -}} - {{- fail "ConfigMap - Expected non-empty " -}} - {{- end -}} - - {{- if not (kindIs "map" $objectData.data) -}} - {{- fail (printf "ConfigMap - Expected to be a dictionary, but got [%v]" (kindOf $objectData.data)) -}} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/container/_args.tpl b/cloudflared-6.0.4/charts/common/templates/lib/container/_args.tpl deleted file mode 100644 index afe3825..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/container/_args.tpl +++ /dev/null @@ -1,22 +0,0 @@ -{{/* Returns args list */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.container.args" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the container. -*/}} -{{- define "tc.v1.common.lib.container.args" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- range $key := (list "args" "extraArgs") -}} - {{- with (get $objectData $key) -}} - {{- if kindIs "string" . }} -- {{ tpl . $rootCtx | quote }} - {{- else if kindIs "slice" . -}} - {{- range $arg := . }} -- {{ tpl $arg $rootCtx | quote }} - {{- end -}} - {{- end -}} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/container/_command.tpl b/cloudflared-6.0.4/charts/common/templates/lib/container/_command.tpl deleted file mode 100644 index 1a83eb8..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/container/_command.tpl +++ /dev/null @@ -1,18 +0,0 @@ -{{/* Returns command list */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.container.command" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the container. -*/}} -{{- define "tc.v1.common.lib.container.command" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- if kindIs "string" $objectData.command }} -- {{ tpl $objectData.command $rootCtx | quote }} - {{- else if kindIs "slice" $objectData.command -}} - {{- range $objectData.command }} -- {{ tpl . $rootCtx | quote }} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/container/_env.tpl b/cloudflared-6.0.4/charts/common/templates/lib/container/_env.tpl deleted file mode 100644 index 08b779f..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/container/_env.tpl +++ /dev/null @@ -1,108 +0,0 @@ -{{/* Returns Env */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.container.env" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the container. -*/}} -{{- define "tc.v1.common.lib.container.env" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- range $k, $v := $objectData.env -}} - {{- include "tc.v1.common.helper.container.envDupeCheck" (dict "rootCtx" $rootCtx "objectData" $objectData "source" "env" "key" $k) }} -- name: {{ $k | quote }} - {{- if not (kindIs "map" $v) -}} - {{- $value := "" -}} - {{- if not (kindIs "invalid" $v) -}} {{/* Only tpl non-empty values */}} - {{- $value = $v -}} - {{- if kindIs "string" $v -}} - {{- $value = tpl $v $rootCtx -}} - {{- end -}} - {{- end }} - value: {{ include "tc.v1.common.helper.makeIntOrNoop" $value | quote }} - {{- else if kindIs "map" $v }} - valueFrom: - {{- $refs := (list "configMapKeyRef" "secretKeyRef" "fieldRef") -}} - {{- if or (ne (len ($v | keys)) 1) (not (mustHas ($v | keys | first) $refs)) -}} - {{- fail (printf "Container - Expected with a ref to have one of [%s], but got [%s]" (join ", " $refs) (join ", " ($v | keys | sortAlpha))) -}} - {{- end -}} - - {{- $name := "" -}} - - - {{- range $key := (list "configMapKeyRef" "secretKeyRef") -}} - {{- if hasKey $v $key }} - {{ $key }}: - {{- $obj := get $v $key -}} - {{- if not $obj.name -}} - {{- fail (printf "Container - Expected non-empty " $key) -}} - {{- end -}} - - {{- if not $obj.key -}} - {{- fail (printf "Container - Expected non-empty " $key) -}} - {{- end }} - key: {{ $obj.key | quote }} - - {{- $name = tpl $obj.name $rootCtx -}} - - {{- $expandName := true -}} - {{- if (hasKey $obj "expandObjectName") -}} - {{- if not (kindIs "invalid" $obj.expandObjectName) -}} - {{- $expandName = $obj.expandObjectName -}} - {{- else -}} - {{- fail (printf "Container - Expected the defined key [expandObjectName] in to not be empty" $k) -}} - {{- end -}} - {{- end -}} - - {{- if kindIs "string" $expandName -}} - {{- $expandName = tpl $expandName $rootCtx -}} - - {{/* After tpl it becomes a string, not a bool */}} - {{- if eq $expandName "true" -}} - {{- $expandName = true -}} - {{- else if eq $expandName "false" -}} - {{- $expandName = false -}} - {{- end -}} - {{- end -}} - - {{- if $expandName -}} - {{- $item := ($key | trimSuffix "KeyRef" | lower) -}} - - {{- $data := (get $rootCtx.Values $item) -}} - {{- $data = (get $data $name) -}} - - {{- if not $data -}} - {{- fail (printf "Container - Expected in the referenced %s [%s] to be defined" (camelcase $item) $name) -}} - {{- end -}} - - {{- $found := false -}} - {{- range $k, $v := $data.data -}} - {{- if eq $k $obj.key -}} - {{- $found = true -}} - {{- end -}} - {{- end -}} - - {{- if not $found -}} - {{- fail (printf "Container - Expected in the referenced key [%s] in %s [%s] to be defined" $obj.key (camelcase $item) $name) -}} - {{- end -}} - - {{- $name = (printf "%s-%s" (include "tc.v1.common.lib.chart.names.fullname" $rootCtx) $name) -}} - {{- end }} - name: {{ $name | quote }} - {{- end -}} - {{- end -}} - - {{- if hasKey $v "fieldRef" }} - fieldRef: - {{- if not $v.fieldRef.fieldPath -}} - {{- fail "Container - Expected non-empty " -}} - {{- end }} - fieldPath: {{ $v.fieldRef.fieldPath | quote }} - {{- if $v.fieldRef.apiVersion }} - apiVersion: {{ $v.fieldRef.apiVersion | quote }} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/container/_envFrom.tpl b/cloudflared-6.0.4/charts/common/templates/lib/container/_envFrom.tpl deleted file mode 100644 index d8876fc..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/container/_envFrom.tpl +++ /dev/null @@ -1,74 +0,0 @@ -{{/* Returns Env From */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.container.envFrom" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the container. -*/}} -{{- define "tc.v1.common.lib.container.envFrom" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $refs := (list "configMapRef" "secretRef") -}} - {{- range $envFrom := $objectData.envFrom -}} - {{- if and (not $envFrom.secretRef) (not $envFrom.configMapRef) -}} - {{- fail (printf "Container - Expected entry to have one of [%s]" (join ", " $refs)) -}} - {{- end -}} - - {{- if and $envFrom.secretRef $envFrom.configMapRef -}} - {{- fail (printf "Container - Expected entry to have only one of [%s], but got both" (join ", " $refs)) -}} - {{- end -}} - - {{- range $ref := $refs -}} - {{- with (get $envFrom $ref) -}} - {{- if not .name -}} - {{- fail (printf "Container - Expected non-empty " $ref) -}} - {{- end -}} - - {{- $objectName := tpl .name $rootCtx -}} - - {{- $expandName := true -}} - {{- if (hasKey . "expandObjectName") -}} - {{- if not (kindIs "invalid" .expandObjectName) -}} - {{- $expandName = .expandObjectName -}} - {{- else -}} - {{- fail (printf "Container - Expected the defined key [expandObjectName] in to not be empty" $ref) -}} - {{- end -}} - {{- end -}} - - {{- if kindIs "string" $expandName -}} - {{- $expandName = tpl $expandName $rootCtx -}} - - {{/* After tpl it becomes a string, not a bool */}} - {{- if eq $expandName "true" -}} - {{- $expandName = true -}} - {{- else if eq $expandName "false" -}} - {{- $expandName = false -}} - {{- end -}} - {{- end -}} - - {{- if $expandName -}} - {{- $object := dict -}} - {{- $source := "" -}} - {{- if eq $ref "configMapRef" -}} - {{- $object = (get $rootCtx.Values.configmap $objectName) -}} - {{- $source = "ConfigMap" -}} - {{- else if eq $ref "secretRef" -}} - {{- $object = (get $rootCtx.Values.secret $objectName) -}} - {{- $source = "Secret" -}} - {{- end -}} - - {{- if not $object -}} - {{- fail (printf "Container - Expected %s [%s] defined in to exist" $source $objectName) -}} - {{- end -}} - {{- range $k, $v := $object.data -}} - {{- include "tc.v1.common.helper.container.envDupeCheck" (dict "rootCtx" $rootCtx "objectData" $objectData "source" (printf "%s - %s" $source $objectName) "key" $k) -}} - {{- end -}} - - {{- $objectName = (printf "%s-%s" (include "tc.v1.common.lib.chart.names.fullname" $rootCtx) $objectName) -}} - {{- end }} -- {{ $ref }}: - name: {{ $objectName | quote }} - {{- end -}} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/container/_envList.tpl b/cloudflared-6.0.4/charts/common/templates/lib/container/_envList.tpl deleted file mode 100644 index a257e67..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/container/_envList.tpl +++ /dev/null @@ -1,23 +0,0 @@ -{{/* Returns Env List */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.container.envList" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the container. -*/}} -{{- define "tc.v1.common.lib.container.envList" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- range $env := $objectData.envList -}} - {{- if not $env.name -}} - {{- fail "Container - Expected non-empty " -}} - {{- end -}} {{/* Empty value is valid */}} - {{- include "tc.v1.common.helper.container.envDupeCheck" (dict "rootCtx" $rootCtx "objectData" $objectData "source" "envList" "key" $env.name) -}} - {{- $value := $env.value -}} - {{- if kindIs "string" $env.value -}} - {{- $value = tpl $env.value $rootCtx -}} - {{- end }} -- name: {{ $env.name | quote }} - value: {{ include "tc.v1.common.helper.makeIntOrNoop" $value | quote }} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/container/_fixedEnv.tpl b/cloudflared-6.0.4/charts/common/templates/lib/container/_fixedEnv.tpl deleted file mode 100644 index aac6941..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/container/_fixedEnv.tpl +++ /dev/null @@ -1,75 +0,0 @@ -{{/* Returns Fixed Env */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.container.fixedEnv" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the container. -*/}} -{{- define "tc.v1.common.lib.container.fixedEnv" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{/* Avoid nil pointers */}} - {{- if not (hasKey $objectData "fixedEnv") -}} - {{- $_ := set $objectData "fixedEnv" dict -}} - {{- end -}} - - {{- $nvidiaCaps := $rootCtx.Values.containerOptions.NVIDIA_CAPS -}} - - {{- if $objectData.fixedEnv.NVIDIA_CAPS -}} - {{- $nvidiaCaps = $objectData.fixedEnv.NVIDIA_CAPS -}} - {{- end -}} - - {{- if not (deepEqual $nvidiaCaps (mustUniq $nvidiaCaps)) -}} - {{- fail (printf "Container - Expected to have only unique values, but got [%s]" (join ", " $nvidiaCaps)) -}} - {{- end -}} - - {{- $caps := (list "all" "compute" "utility" "graphics" "video") -}} - {{- range $cap := $nvidiaCaps -}} - {{- if not (mustHas $cap $caps) -}} - {{- fail (printf "Container - Expected entry to be one of [%s], but got [%s]" (join ", " $caps) $cap) -}} - {{- end -}} - {{- end -}} - - {{- $secContext := fromJson (include "tc.v1.common.lib.container.securityContext.calculate" (dict "rootCtx" $rootCtx "objectData" $objectData)) -}} - - {{- $fixed := list -}} - {{- $TZ := $objectData.fixedEnv.TZ | default $rootCtx.Values.TZ -}} - {{- $UMASK := $objectData.fixedEnv.UMASK | default $rootCtx.Values.securityContext.container.UMASK -}} - {{- $PUID := $objectData.fixedEnv.PUID | default $rootCtx.Values.securityContext.container.PUID -}} - {{- if and (not (kindIs "invalid" $objectData.fixedEnv.PUID)) (eq (int $objectData.fixedEnv.PUID) 0) -}} - {{- $PUID = $objectData.fixedEnv.PUID -}} - {{- end -}} - {{/* calculatedFSGroup is passed from the pod */}} - {{- $PGID := $objectData.calculatedFSGroup -}} - - {{- $fixed = mustAppend $fixed (dict "k" "TZ" "v" $TZ) -}} - {{- $fixed = mustAppend $fixed (dict "k" "UMASK" "v" $UMASK) -}} - {{- $fixed = mustAppend $fixed (dict "k" "UMASK_SET" "v" $UMASK) -}} - {{/* TODO: Offer gpu section in resources for native helm and adjust this include, then we can remove the "if inside ixChartContext" */}} - {{- if eq (include "tc.v1.common.lib.container.resources.gpu" (dict "rootCtx" $rootCtx "objectData" $objectData "returnBool" true)) "true" -}} - {{- $fixed = mustAppend $fixed (dict "k" "NVIDIA_DRIVER_CAPABILITIES" "v" (join "," $nvidiaCaps)) -}} - {{- else -}} {{/* Only when in SCALE */}} - {{- if hasKey $rootCtx.Values.global "ixChartContext" -}} - {{- $fixed = mustAppend $fixed (dict "k" "NVIDIA_VISIBLE_DEVICES" "v" "void") -}} - {{- end -}} - {{- end -}} - {{/* If running as root and PUID is set (0 or greater), set related envs */}} - {{- if and (or (eq (int $secContext.runAsUser) 0) (eq (int $secContext.runAsGroup) 0)) (ge (int $PUID) 0) -}} - {{- $fixed = mustAppend $fixed (dict "k" "PUID" "v" $PUID) -}} - {{- $fixed = mustAppend $fixed (dict "k" "USER_ID" "v" $PUID) -}} - {{- $fixed = mustAppend $fixed (dict "k" "UID" "v" $PUID) -}} - {{- $fixed = mustAppend $fixed (dict "k" "PGID" "v" $PGID) -}} - {{- $fixed = mustAppend $fixed (dict "k" "GROUP_ID" "v" $PGID) -}} - {{- $fixed = mustAppend $fixed (dict "k" "GID" "v" $PGID) -}} - {{- end -}} - {{/* If rootFS is readOnly OR does not as root, let s6 containers to know that fs is readonly */}} - {{- if or $secContext.readOnlyRootFilesystem $secContext.runAsNonRoot -}} - {{- $fixed = mustAppend $fixed (dict "k" "S6_READ_ONLY_ROOT" "v" "1") -}} - {{- end -}} - - {{- range $env := $fixed -}} - {{- include "tc.v1.common.helper.container.envDupeCheck" (dict "rootCtx" $rootCtx "objectData" $objectData "source" "fixedEnv" "key" $env.k) }} -- name: {{ $env.k | quote }} - value: {{ (include "tc.v1.common.helper.makeIntOrNoop" $env.v) | quote }} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/container/_imageSelector.tpl b/cloudflared-6.0.4/charts/common/templates/lib/container/_imageSelector.tpl deleted file mode 100644 index ea7b548..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/container/_imageSelector.tpl +++ /dev/null @@ -1,42 +0,0 @@ -{{/* Returns the image dictionary */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.container.imageSelector" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the container. -*/}} -{{- define "tc.v1.common.lib.container.imageSelector" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $imageObj := dict -}} - - {{- $selector := "image" -}} - {{- with $objectData.imageSelector -}} - {{- $selector = tpl . $rootCtx -}} - {{- end -}} - - {{- if hasKey $rootCtx.Values $selector -}} - {{- $imageObj = get $rootCtx.Values $selector -}} - {{- else -}} - {{- fail (printf "Container - Expected <.Values.%s> to exist" $selector) -}} - {{- end -}} - - {{- if not $imageObj.repository -}} - {{- fail (printf "Container - Expected non-empty <.Values.%s.repository>" $selector) -}} - {{- end -}} - - {{- if not $imageObj.tag -}} - {{- fail (printf "Container - Expected non-empty <.Values.%s.tag>" $selector) -}} - {{- end -}} - - {{- if not $imageObj.pullPolicy -}} - {{- $_ := set $imageObj "pullPolicy" "IfNotPresent" -}} - {{- end -}} - - {{- $policies := (list "IfNotPresent" "Always" "Never") -}} - {{- if not (mustHas $imageObj.pullPolicy $policies) -}} - {{- fail (printf "Container - Expected <.Values.%s.pullPolicy> to be one of [%s], but got [%s]" $selector (join ", " $policies) $imageObj.pullPolicy) -}} - {{- end -}} - - {{- $imageObj | toJson -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/container/_lifecycle.tpl b/cloudflared-6.0.4/charts/common/templates/lib/container/_lifecycle.tpl deleted file mode 100644 index bc4743d..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/container/_lifecycle.tpl +++ /dev/null @@ -1,37 +0,0 @@ -{{/* Returns lifecycle */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.container.lifecycle" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the container. -*/}} -{{- define "tc.v1.common.lib.container.lifecycle" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $hooks := (list "preStop" "postStart") -}} - {{- $types := (list "exec" "http" "https") -}} - {{- with $objectData.lifecycle -}} - {{- range $hook, $hookValues := . -}} - {{- if not (mustHas $hook $hooks) -}} - {{- fail (printf "Container - Expected to be one of [%s], but got [%s]" (join ", " $hooks) $hook) -}} - {{- end -}} - - {{- if not $hookValues.type -}} - {{- fail "Container - Expected non-empty " -}} - {{- end -}} - - {{- if not (mustHas $hookValues.type $types) -}} - {{- fail (printf "Container - Expected to be one of [%s], but got [%s]" (join ", " $types) $hookValues.type) -}} - {{- end }} -{{ $hook }}: - {{- if eq $hookValues.type "exec" -}} - {{- include "tc.v1.common.lib.container.actions.exec" (dict "rootCtx" $rootCtx "objectData" $hookValues "caller" "lifecycle") | trim | nindent 2 -}} - {{- else if mustHas $hookValues.type (list "http" "https") -}} - {{- include "tc.v1.common.lib.container.actions.httpGet" (dict "rootCtx" $rootCtx "objectData" $hookValues "caller" "lifecycle") | trim | nindent 2 -}} - {{- end -}} - - {{- end -}} - {{- end -}} - - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/container/_ports.tpl b/cloudflared-6.0.4/charts/common/templates/lib/container/_ports.tpl deleted file mode 100644 index e243d8f..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/container/_ports.tpl +++ /dev/null @@ -1,87 +0,0 @@ -{{/* Returns ports list */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.container.ports" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the container. -*/}} -{{- define "tc.v1.common.lib.container.ports" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- range $serviceName, $serviceValues := $rootCtx.Values.service -}} - {{- $podSelected := false -}} - {{/* If service is enabled... */}} - {{- if $serviceValues.enabled -}} - - {{/* If there is a selector */}} - {{- if $serviceValues.targetSelector -}} - - {{/* And pod is selected */}} - {{- if eq $serviceValues.targetSelector $objectData.podShortName -}} - {{- $podSelected = true -}} - {{- end -}} - - {{- else -}} - {{/* If no selector is defined but pod is primary */}} - {{- if $objectData.podPrimary -}} - {{- $podSelected = true -}} - {{- end -}} - - {{- end -}} - {{- end -}} - - {{- if $podSelected -}} - {{- range $portName, $portValues := $serviceValues.ports -}} - {{- $containerSelected := false -}} - - {{/* If service is enabled... */}} - {{- if $portValues.enabled -}} - {{/* If there is a selector */}} - {{- if $portValues.targetSelector -}} - - {{/* And container is selected */}} - {{- if eq $portValues.targetSelector $objectData.shortName -}} - {{- $containerSelected = true -}} - {{- end -}} - - {{- else -}} - {{/* If no selector is defined but container is primary */}} - {{- if $objectData.primary -}} - {{- $containerSelected = true -}} - {{- end -}} - - {{- end -}} - {{- end -}} - - {{/* If the container is selected render port */}} - {{- if $containerSelected -}} - {{- $containerPort := $portValues.targetPort | default $portValues.port -}} - {{- if kindIs "string" $containerPort -}} - {{- $containerPort = (tpl $containerPort $rootCtx) -}} - {{- end -}} - - {{- $tcpProtocols := (list "tcp" "http" "https") -}} - {{- $protocol := tpl ($portValues.protocol | default $rootCtx.Values.fallbackDefaults.serviceProtocol) $rootCtx -}} - {{- if mustHas $protocol $tcpProtocols -}} - {{- $protocol = "tcp" -}} - {{- end }} -- name: {{ $portName }} - containerPort: {{ $containerPort }} - protocol: {{ $protocol | upper }} - {{- with $portValues.hostPort }} - hostPort: {{ . }} - {{- else }} - hostPort: null - {{- end -}} - {{- end -}} - - {{- end -}} - {{- end -}} - {{- end -}} - -{{- end -}} -{{/* Turning hostNetwork on, it creates hostPort automatically and turning it back off does not remove them. Setting hostPort explicitly to null will remove them. - There are still cases that hostPort is not removed, for example, if you have a TCP and UDP port with the same number. Only the TCPs hostPort will be removed. - Also note that setting hostPort to null always, it will NOT affect hostNetwork, as it will still create the hostPorts. - It only helps to remove them when hostNetwork is turned off. -*/}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/container/_primaryValidation.tpl b/cloudflared-6.0.4/charts/common/templates/lib/container/_primaryValidation.tpl deleted file mode 100644 index 6928a78..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/container/_primaryValidation.tpl +++ /dev/null @@ -1,40 +0,0 @@ -{{/* Containers Basic Validation */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.container.primaryValidation" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -*/}} -{{- define "tc.v1.common.lib.container.primaryValidation" -}} - {{- $objectData := .objectData -}} - {{- $rootCtx := .rootCtx -}} - - {{/* Initialize values */}} - {{- $hasPrimary := false -}} - {{- $hasEnabled := false -}} - - {{/* Go over the contaienrs */}} - {{- range $name, $container := $objectData.podSpec.containers -}} - - {{/* If container is enabled */}} - {{- if $container.enabled -}} - {{- $hasEnabled = true -}} - - {{/* And container is primary */}} - {{- if and (hasKey $container "primary") ($container.primary) -}} - - {{/* Fail if there is already a primary container */}} - {{- if $hasPrimary -}} - {{- fail "Container - Only one container can be primary per workload" -}} - {{- end -}} - - {{- $hasPrimary = true -}} - - {{- end -}} - {{- end -}} - - {{- end -}} - - {{/* Require at least one primary container, if any enabled */}} - {{- if and $hasEnabled (not $hasPrimary) -}} - {{- fail "Container - At least one enabled container must be primary per workload" -}} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/container/_probes.tpl b/cloudflared-6.0.4/charts/common/templates/lib/container/_probes.tpl deleted file mode 100644 index a7d56e5..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/container/_probes.tpl +++ /dev/null @@ -1,98 +0,0 @@ -{{/* Returns Probes */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.container.probes" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the container. -*/}} -{{- define "tc.v1.common.lib.container.probes" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $probeNames := (list "liveness" "readiness" "startup") -}} - {{- $probeTypes := (list "http" "https" "tcp" "grpc" "exec") -}} - - {{- if not $objectData.probes -}} - {{- fail "Container - Expected non-empty " -}} - {{- end -}} - - {{- range $key := $probeNames -}} - {{- if not (get $objectData.probes $key) -}} - {{- fail (printf "Container - Expected to be defined" $key) -}} - {{- end -}} - {{- end -}} - - {{- range $probeName, $probe := $objectData.probes -}} - - {{- if not (mustHas $probeName $probeNames) -}} - {{- fail (printf "Container - Expected probe to be one of [%s], but got [%s]" (join ", " $probeNames) $probeName) -}} - {{- end -}} - - {{- $isEnabled := true -}} - {{- if kindIs "bool" $probe.enabled -}} - {{- $isEnabled = $probe.enabled -}} - {{- end -}} - - {{- if $isEnabled -}} - - {{- $probeType := $rootCtx.Values.fallbackDefaults.probeType -}} - - {{- with $probe.type -}} - {{- $probeType = tpl . $rootCtx -}} - {{- end -}} - - {{- if not (mustHas $probeType $probeTypes) -}} - {{- fail (printf "Container - Expected probe type to be one of [%s], but got [%s]" (join ", " $probeTypes) $probeType) -}} - {{- end }} -{{ $probeName }}Probe: - {{- if (mustHas $probeType (list "http" "https")) -}} - {{- include "tc.v1.common.lib.container.actions.httpGet" (dict "rootCtx" $rootCtx "objectData" $probe "caller" "probes") | trim | nindent 2 -}} - {{- else if eq $probeType "tcp" -}} - {{- include "tc.v1.common.lib.container.actions.tcpSocket" (dict "rootCtx" $rootCtx "objectData" $probe "caller" "probes") | trim | nindent 2 -}} - {{- else if eq $probeType "grpc" -}} - {{- include "tc.v1.common.lib.container.actions.grpc" (dict "rootCtx" $rootCtx "objectData" $probe "caller" "probes") | trim | nindent 2 -}} - {{- else if eq $probeType "exec" -}} - {{- include "tc.v1.common.lib.container.actions.exec" (dict "rootCtx" $rootCtx "objectData" $probe "caller" "probes") | trim | nindent 2 -}} - {{- end -}} - - {{- include "tc.v1.common.lib.container.probeTimeouts" (dict "rootCtx" $rootCtx "objectData" $probe "probeName" $probeName) | trim | nindent 2 -}} - - {{- end -}} - {{- end -}} -{{- end -}} - -{{/* Returns Probe Timeouts */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.container.probeTimeouts" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the container. -*/}} -{{- define "tc.v1.common.lib.container.probeTimeouts" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - {{- $probeName := .probeName -}} - - {{- $timeouts := mustDeepCopy (get $rootCtx.Values.fallbackDefaults.probeTimeouts $probeName) -}} - - {{- if $objectData.spec -}} {{/* Overwrite with defined timeouts */}} - {{- $timeouts = mustMergeOverwrite $timeouts $objectData.spec -}} - {{- end -}} - - {{- $keys := (list "initialDelaySeconds" "failureThreshold" "successThreshold" "timeoutSeconds" "periodSeconds") -}} - {{- range $key := $keys -}} - {{- $number := get $timeouts $key -}} - {{- if not (mustHas (kindOf $number) (list "float64" "int" "int64")) -}} - {{- fail (printf "Container - Expected <%s> to be a number, but got [%v]" $key $number) -}} - {{- end -}} - {{- end -}} - - {{- if mustHas $probeName (list "liveness" "startup") -}} - {{- if ne (int $timeouts.successThreshold) 1 -}} - {{- fail (printf "Container - Expected to be 1 on [%s] probe" $probeName) -}} - {{- end -}} - {{- end }} -initialDelaySeconds: {{ $timeouts.initialDelaySeconds }} -failureThreshold: {{ $timeouts.failureThreshold }} -successThreshold: {{ $timeouts.successThreshold }} -timeoutSeconds: {{ $timeouts.timeoutSeconds }} -periodSeconds: {{ $timeouts.periodSeconds }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/container/_resources.tpl b/cloudflared-6.0.4/charts/common/templates/lib/container/_resources.tpl deleted file mode 100644 index 7e3c0f7..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/container/_resources.tpl +++ /dev/null @@ -1,140 +0,0 @@ -{{/* Returns Resources */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.container.resources" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the container. -*/}} -{{- define "tc.v1.common.lib.container.resources" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $resources := mustDeepCopy $rootCtx.Values.resources -}} - - {{- if $objectData.resources -}} - {{- $resources = mustMergeOverwrite $resources $objectData.resources -}} - {{- end -}} - - {{- include "tc.v1.common.lib.container.resources.validation" (dict "resources" $resources) -}} - -requests: - cpu: {{ $resources.requests.cpu }} - memory: {{ $resources.requests.memory }} - {{- if $resources.limits }} -limits: - {{- with $resources.limits.cpu }} {{/* Passing 0, will not render it, meaning unlimited */}} - cpu: {{ . }} - {{- end -}} - {{- with $resources.limits.memory }} {{/* Passing 0, will not render it, meaning unlimited */}} - memory: {{ . }} - {{- end -}} - {{- include "tc.v1.common.lib.container.resources.gpu" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 2 -}} - {{- end -}} -{{- end -}} - -{{/* Returns GPU resource */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.container.resources.gpu" (dict "rootCtx" $rootCtx "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the container. -*/}} -{{- define "tc.v1.common.lib.container.resources.gpu" -}} - {{- $objectData := .objectData -}} - {{- $rootCtx := .rootCtx -}} - {{- $returnBool := .returnBool -}} - - {{- $gpuResource := list -}} - - {{- range $GPUValues := $rootCtx.Values.scaleGPU -}} - {{- if not $GPUValues.gpu -}} - {{- fail "Container - Expected non-empty " -}} - {{- end -}} - - {{- $selected := false -}} - - {{/* Parse selector if defined */}} - {{- if $GPUValues.targetSelector -}} - {{- range $podName, $containers := $GPUValues.targetSelector -}} - {{- if not $containers -}} - {{- fail "Container - Expected non-empty list under pod in " -}} - {{- end -}} - - {{- if and (eq $podName $objectData.podShortName) (mustHas $objectData.shortName $containers) -}} - {{- $selected = true -}} - {{- end -}} - {{- end -}} - {{/* If no selector, select primary pod/container */}} - {{- else if and $objectData.podPrimary $objectData.primary -}} - {{- $selected = true -}} - {{- end -}} - - {{- if $selected -}} - {{- $gpuResource = mustAppend $gpuResource $GPUValues.gpu -}} - {{- end -}} - {{- end -}} - - {{- if not $returnBool -}} - {{- range $gpu := $gpuResource -}} - {{- range $k, $v := $gpu -}} - {{- if or (kindIs "invalid" $v) (eq (toString $v) "") -}} - {{- fail "Container - Expected non-empty " -}} - {{- end -}} {{/* Don't try to schedule 0 GPUs */}} - {{- if gt (int $v) 0 }} -{{ $k }}: {{ $v | quote }} - {{- end -}} - {{- end -}} - {{- end -}} - {{- else -}} - {{- if $gpuResource -}} - {{- "true" -}} - {{- end -}} - {{- end -}} - -{{- end -}} - -{{/* Validates resources to match a pattern */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.container.resources.validation" (dict "resources" $resources) }} -rootCtx: The root context of the chart. -resources: The resources object -*/}} -{{- define "tc.v1.common.lib.container.resources.validation" -}} - {{- $resources := .resources -}} - {{/* CPU: https://regex101.com/r/D4HouI/1 */}} - {{/* MEM: https://regex101.com/r/NNPV2D/1 */}} - {{- $regex := (dict - "cpu" "^(0\\.[1-9]|[1-9][0-9]*)(\\.[0-9]|m?)$" - "memory" "^[1-9][0-9]*([EPTGMK]i?|e[0-9]+)?$") -}} - {{- $errorMsg := (dict - "cpu" "(Plain Integer - eg. 1), (Float - eg. 0.5), (Milicpu - eg. 500m)" - "memory" "(Suffixed with E/P/T/G/M/K - eg. 1G), (Suffixed with Ei/Pi/Ti/Gi/Mi/Ki - eg. 1Gi), (Plain Integer in bytes - eg. 1024), (Exponent - eg. 134e6)") -}} - - {{- $resourceTypes := (list "cpu" "memory") -}} - - {{- range $category := (list "requests") -}} {{/* We can also add "limits" here if we want to require them */}} - {{- if not (get $resources $category) -}} - {{- fail (printf "Container - Expected non-empty " $category) -}} - {{- end -}} - - {{- range $type := $resourceTypes -}} - {{- if not (get (get $resources $category) $type) -}} - {{- fail (printf "Container - Expected non-empty " $category $type) -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- range $key := (list "requests" "limits") -}} - {{- $resourceCategory := (get $resources $key) -}} - {{- if $resourceCategory -}} - - {{- range $type := $resourceTypes -}} - {{- $resourceValue := (get $resourceCategory $type) -}} - {{- if $resourceValue -}} {{/* Only try to match defined values */}} - {{- if not (mustRegexMatch (get $regex $type) (toString $resourceValue)) -}} - {{- fail (printf "Container - Expected to have one of the following formats [%s], but got [%s]" $key $type (get $errorMsg $type) $resourceValue) -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/container/_securityContext.tpl b/cloudflared-6.0.4/charts/common/templates/lib/container/_securityContext.tpl deleted file mode 100644 index f72d401..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/container/_securityContext.tpl +++ /dev/null @@ -1,181 +0,0 @@ -{{/* Returns Container Security Context */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.container.securityContext" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the container. -*/}} -{{- define "tc.v1.common.lib.container.securityContext" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{/* Initialize from the "global" options */}} - {{- $secContext := fromJson (include "tc.v1.common.lib.container.securityContext.calculate" (dict "rootCtx" $rootCtx "objectData" $objectData)) }} -runAsNonRoot: {{ $secContext.runAsNonRoot }} -runAsUser: {{ $secContext.runAsUser }} -runAsGroup: {{ $secContext.runAsGroup }} -readOnlyRootFilesystem: {{ $secContext.readOnlyRootFilesystem }} -allowPrivilegeEscalation: {{ $secContext.allowPrivilegeEscalation }} -privileged: {{ $secContext.privileged }} -seccompProfile: - type: {{ $secContext.seccompProfile.type }} - {{- if eq $secContext.seccompProfile.type "Localhost" }} - localhostProfile: {{ $secContext.seccompProfile.profile }} - {{- end }} -capabilities: - {{- if $secContext.capabilities.add }} - add: - {{- range $secContext.capabilities.add }} - - {{ . }} - {{- end -}} - {{- else }} - add: [] - {{- end -}} - {{- if $secContext.capabilities.drop }} - drop: - {{- range $secContext.capabilities.drop }} - - {{ . }} - {{- end -}} - {{- else }} - drop: [] - {{- end -}} -{{- end -}} - -{{/* Calculates Container Security Context */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.container.securityContext.calculate" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the container. -*/}} -{{- define "tc.v1.common.lib.container.securityContext.calculate" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $mustPrivileged := false -}} - {{- range $persistenceName, $persistenceValues := $rootCtx.Values.persistence -}} - {{- if $persistenceValues.enabled -}} - {{- if eq $persistenceValues.type "device" -}} - {{- $volume := (fromJson (include "tc.v1.common.lib.container.volumeMount.isSelected" (dict "persistenceName" $persistenceName "persistenceValues" $persistenceValues "objectData" $objectData "key" "persistence"))) -}} - {{- if $volume -}} {{/* If a volume is returned, it means that the container has an assigned device */}} - {{- $mustPrivileged = true -}} - {{- end -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if not $rootCtx.Values.securityContext.container -}} - {{- fail "Container - Expected non-empty <.Values.securityContext.container>" -}} - {{- end -}} - - {{/* Initialize from the "global" options */}} - {{- $secContext := mustDeepCopy $rootCtx.Values.securityContext.container -}} - - {{/* Override with containers options */}} - {{- with $objectData.securityContext -}} - {{- $secContext = mustMergeOverwrite $secContext . -}} - {{- end -}} - - {{/* Validations, as we might endup with null values after merge */}} - {{- range $key := (list "runAsUser" "runAsGroup") -}} - {{- $value := (get $secContext $key) -}} - {{- if not (mustHas (kindOf $value) (list "float64" "int" "int64")) -}} - {{- fail (printf "Container - Expected to be [int], but got [%v] of type [%s]" $key $value (kindOf $value)) -}} - {{- end -}} - {{- end -}} - - {{- if or (eq (int $secContext.runAsUser) 0) (eq (int $secContext.runAsGroup) 0) -}} - {{- $_ := set $secContext "runAsNonRoot" false -}} - {{- else -}} - {{- $_ := set $secContext "runAsNonRoot" true -}} - {{- end -}} - - {{- if $secContext.privileged -}} {{/* When privileged is true, allowPrivilegeEscalation is required */}} - {{- $_ := set $secContext "allowPrivilegeEscalation" true -}} - {{- end -}} - - {{- if $mustPrivileged -}} - {{- $_ := set $secContext "privileged" true -}} - {{- $_ := set $secContext "allowPrivilegeEscalation" true -}} - {{- $_ := set $secContext "runAsNonRoot" false -}} - {{- $_ := set $secContext "runAsUser" 0 -}} - {{- $_ := set $secContext "runAsGroup" 0 -}} - {{- end -}} - - {{- range $key := (list "privileged" "allowPrivilegeEscalation" "runAsNonRoot" "readOnlyRootFilesystem") -}} - {{- $value := (get $secContext $key) -}} - {{- if not (kindIs "bool" $value) -}} - {{- fail (printf "Container - Expected to be [bool], but got [%s] of type [%s]" $key $value (kindOf $value)) -}} - {{- end -}} - {{- end -}} - - {{- if not $secContext.seccompProfile -}} - {{- fail "Container - Expected to be defined" -}} - {{- end -}} - - {{- $profiles := (list "RuntimeDefault" "Localhost" "Unconfined") -}} - {{- if not (mustHas $secContext.seccompProfile.type $profiles) -}} - {{- fail (printf "Container - Expected to be one of [%s], but got [%s]" (join ", " $profiles) $secContext.seccompProfile.type) -}} - {{- end -}} - - {{- if eq $secContext.seccompProfile.type "Localhost" -}} - {{- if not $secContext.seccompProfile.profile -}} - {{- fail "Container - Expected to be defined on type [Localhost]" -}} - {{- end -}} - {{- end -}} - - {{- if not $secContext.capabilities -}} - {{- fail "Container - Expected to be defined" -}} - {{- end -}} - - {{- $tempObjectData := (dict "shortName" $objectData.podShortName "primary" $objectData.podPrimary) -}} - {{- $portRange := fromJson (include "tc.v1.common.lib.helpers.securityContext.getPortRange" (dict "rootCtx" $rootCtx "objectData" $tempObjectData)) -}} - {{- if and $portRange.low (le (int $portRange.low) 1024) -}} {{/* If a container wants to bind a port <= 1024 add NET_BIND_SERVICE */}} - {{- $addCap := $secContext.capabilities.add -}} - {{- if not (mustHas "NET_BIND_SERIVCE" $addCap) -}} - {{- $addCap = mustAppend $addCap "NET_BIND_SERVICE" -}} - {{- end -}} - {{- $_ := set $secContext.capabilities "add" $addCap -}} - {{- end -}} - - {{/* - Most containers that run as root, is because it has to chown - files before switching to another user. - Lets add automatically the CHOWN cap. - */}} - {{- if eq (int $secContext.runAsUser) 0 -}} - - {{- if not (kindIs "bool" $secContext.capabilities.disableS6Caps) -}} - {{- fail (printf "Container - Expected to be [bool], but got [%s] of type [%s]" $secContext.capabilities.disableS6Caps (kindOf $secContext.capabilities.disableS6Caps)) -}} - {{- end -}} - - {{- $addCap := $secContext.capabilities.add -}} - - {{- if not $secContext.capabilities.disableS6Caps -}} - {{- $addCap = mustAppend $addCap "CHOWN" -}} - {{- $addCap = mustAppend $addCap "SETUID" -}} - {{- $addCap = mustAppend $addCap "SETGID" -}} - {{- $addCap = mustAppend $addCap "FOWNER" -}} - {{- $addCap = mustAppend $addCap "DAC_OVERRIDE" -}} - {{- end -}} - - {{- $_ := set $secContext.capabilities "add" $addCap -}} - {{- end -}} - - {{- range $key := (list "add" "drop") -}} - {{- $item := (get $secContext.capabilities $key) -}} - {{- if not (kindIs "slice" $item) -}} - {{- fail (printf "Container - Expected to be [list], but got [%s]" $key (kindOf $item)) -}} - {{- end -}} - - {{- range $item -}} - {{- if not (kindIs "string" .) -}} - {{- fail (printf "Container - Expected items of to be [string], but got [%s]" $key (kindOf .)) -}} - {{- end -}} - {{- end -}} - - {{- if not (deepEqual (uniq $item) $item) -}} - {{- fail (printf "Container - Expected items of to be unique, but got [%s]" $key (join ", " $item)) -}} - {{- end -}} - {{- end -}} - - {{- $secContext | toJson -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/container/_termination.tpl b/cloudflared-6.0.4/charts/common/templates/lib/container/_termination.tpl deleted file mode 100644 index 5d04a8f..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/container/_termination.tpl +++ /dev/null @@ -1,33 +0,0 @@ -{{/* Returns termination */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.container.termination" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the container. -*/}} -{{- define "tc.v1.common.lib.container.termination" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $termination := (dict "messagePath" "" "messagePolicy" "") -}} - - {{- with $objectData.termination -}} - {{- with .messagePath -}} - {{- $_ := set $termination "messagePath" (tpl . $rootCtx) -}} - {{- end -}} - - {{- with .messagePolicy -}} - - {{- $policy := (tpl . $rootCtx) -}} - - {{- $policies := (list "File" "FallbackToLogsOnError") -}} - {{- if not (mustHas $policy $policies) -}} - {{- fail (printf "Container - Expected to be one of [%s], but got [%s]" (join ", " $policies) $policy) -}} - {{- end -}} - - {{- $_ := set $termination "messagePolicy" $policy -}} - {{- end -}} - - {{- end -}} - - {{- $termination | toJson -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/container/_volumeMounts.tpl b/cloudflared-6.0.4/charts/common/templates/lib/container/_volumeMounts.tpl deleted file mode 100644 index 027cdc4..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/container/_volumeMounts.tpl +++ /dev/null @@ -1,147 +0,0 @@ -{{/* Returns volumeMount list */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.container.volumeMount" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the container. -*/}} -{{- define "tc.v1.common.lib.container.volumeMount" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $volMounts := list -}} - - {{- $codeServerIgnoredTypes := (list "configmap" "secret") -}} - {{- $keys := (list "persistence") -}} - {{- if eq $objectData.podType "StatefulSet" -}} - {{- $keys = mustAppend $keys "volumeClaimTemplates" -}} - {{- end -}} - - {{- range $key := $keys -}} - {{- range $persistenceName, $persistenceValues := (get $rootCtx.Values $key) -}} - {{- if $persistenceValues.enabled -}} - {{/* Dont try to mount configmap/sercet to codeserver */}} - {{- if not (and (eq $objectData.shortName "codeserver") (mustHas $persistenceValues.type $codeServerIgnoredTypes)) -}} - {{- $volMount := (fromJson (include "tc.v1.common.lib.container.volumeMount.isSelected" (dict "persistenceName" $persistenceName "persistenceValues" $persistenceValues "objectData" $objectData "key" $key))) -}} - {{- if $volMount -}} - {{- $volMounts = mustAppend $volMounts $volMount -}} - {{- end -}} - {{- end -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- range $volMount := $volMounts -}} - {{/* Expand values */}} - {{- $_ := set $volMount "mountPath" (tpl $volMount.mountPath $rootCtx) -}} - {{- $_ := set $volMount "subPath" (tpl $volMount.subPath $rootCtx) -}} - {{- $_ := set $volMount "mountPropagation" (tpl $volMount.mountPropagation $rootCtx) -}} - - {{- if not $volMount.mountPath -}} - {{- fail (printf "%s - Expected non-empty " (camelcase $volMount.key)) -}} - {{- end -}} - - {{- if not (hasPrefix "/" $volMount.mountPath) -}} - {{- fail (printf "%s - Expected to start with a forward slash [/]" (camelcase $volMount.key)) -}} - {{- end -}} - - {{- $propagationTypes := (list "None" "HostToContainer" "Bidirectional") -}} - {{- if and $volMount.mountPropagation (not (mustHas $volMount.mountPropagation $propagationTypes)) -}} - {{- fail (printf "%s - Expected to be one of [%s], but got [%s]" (camelcase $volMount.key) (join ", " $propagationTypes) $volMount.mountPropagation) -}} - {{- end -}} - - {{- if not (kindIs "bool" $volMount.readOnly) -}} - {{- fail (printf "%s - Expected to be [boolean], but got [%s]" (camelcase $volMount.key) (kindOf $volMount.readOnly)) -}} - {{- end }} -- name: {{ $volMount.name }} - mountPath: {{ $volMount.mountPath }} - readOnly: {{ $volMount.readOnly }} - {{- with $volMount.subPath }} - subPath: {{ . }} - {{- end -}} - {{- with $volMount.mountPropagation }} - mountPropagation: {{ . }} - {{- end -}} - {{- end -}} - -{{- end -}} - -{{- define "tc.v1.common.lib.container.volumeMount.isSelected" -}} - {{- $persistenceName := .persistenceName -}} - {{- $persistenceValues := .persistenceValues -}} - {{- $objectData := .objectData -}} - {{- $key := .key -}} - - {{/* Initialize from the default values */}} - {{- $volMount := dict -}} - {{- $_ := set $volMount "name" $persistenceName -}} - {{- $_ := set $volMount "key" $key -}} - {{- if eq $persistenceValues.type "device" -}} {{/* On devices use the hostPath as default if mountpath is not defined */}} - {{- $_ := set $volMount "mountPath" ($persistenceValues.mountPath | default $persistenceValues.hostPath | default "") -}} - {{- else -}} - {{- $_ := set $volMount "mountPath" ($persistenceValues.mountPath | default "") -}} - {{- end -}} - {{- $_ := set $volMount "subPath" ($persistenceValues.subPath | default "") -}} - {{- $_ := set $volMount "readOnly" ($persistenceValues.readOnly | default false) -}} - {{- $_ := set $volMount "mountPropagation" ($persistenceValues.mountPropagation | default "") -}} - - {{- $return := false -}} - {{/* If targetSelectAll is set, means all pods/containers */}} {{/* targetSelectAll does not make sense for vct */}} - {{- if and $persistenceValues.targetSelectAll (ne $key "volumeClaimTemplates") -}} - {{- $return = true -}} - {{/* Set custom path on autopermissions container */}} - {{- if and (eq $objectData.shortName "autopermissions") $persistenceValues.autoPermissions -}} - {{- if $persistenceValues.autoPermissions.enabled -}} - {{- $return = true -}} - {{- $_ := set $volMount "mountPath" (printf "/mounts/%v" $persistenceName) -}} - {{- end -}} - {{- end -}} - - {{/* If the container is the autopermission */}} - {{- else if (eq $objectData.shortName "autopermissions") -}} - {{- if $persistenceValues.autoPermissions -}} - {{- if $persistenceValues.autoPermissions.enabled -}} - {{- $return = true -}} - {{- $_ := set $volMount "mountPath" (printf "/mounts/%v" $persistenceName) -}} - {{- end -}} - {{- end -}} - - {{/* Else if selector is defined */}} - {{- else if $persistenceValues.targetSelector -}} - {{/* If pod is selected */}} - {{- if mustHas $objectData.podShortName ($persistenceValues.targetSelector | keys) -}} - {{- $selectorValues := (get $persistenceValues.targetSelector $objectData.podShortName) -}} - {{- if not (kindIs "map" $selectorValues) -}} - {{- fail (printf "%s - Expected to be a [dict], but got [%s]" (camelcase $key) $objectData.podShortName (kindOf $selectorValues)) -}} - {{- end -}} - - {{- if not $selectorValues -}} - {{- fail (printf "%s - Expected non-empty " (camelcase $key) $objectData.podShortName) -}} - {{- end -}} - - {{/* If container is selected */}} - {{- if or (mustHas $objectData.shortName ($selectorValues | keys)) (eq $objectData.shortName "codeserver") -}} - {{/* Merge with values that might be set for the specific container */}} - {{- $fetchedSelectorValues := (get $selectorValues $objectData.shortName) -}} - {{- if and (eq $objectData.shortName "codeserver") (not $fetchedSelectorValues) -}} - {{- $fetchedSelectorValues = (get $selectorValues ($selectorValues | keys | first)) -}} - {{- end -}} - {{- $volMount = mustMergeOverwrite $volMount $fetchedSelectorValues -}} - {{- $return = true -}} - {{- end -}} - {{- end -}} - - {{/* if its the codeserver */}} - {{- else if (eq $objectData.shortName "codeserver") -}} - {{- $return = true -}} - - {{/* Else if not selector, but pod and container is primary */}} - {{- else if and $objectData.podPrimary $objectData.primary -}} - {{- $return = true -}} - {{- end -}} - - {{- if $return -}} {{/* If it's selected, return the volumeMount */}} - {{- $volMount | toJson -}} - {{- else -}} {{/* Else return an empty dict */}} - {{- dict | toJson -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/container/probe-lifecycle-actions/_exec.tpl b/cloudflared-6.0.4/charts/common/templates/lib/container/probe-lifecycle-actions/_exec.tpl deleted file mode 100644 index 505a90b..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/container/probe-lifecycle-actions/_exec.tpl +++ /dev/null @@ -1,18 +0,0 @@ -{{/* Returns exec action */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.container.actions.exec" (dict "rootCtx" $ "objectData" $objectData "caller" $caller) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the container. -*/}} -{{- define "tc.v1.common.lib.container.actions.exec" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - {{- $caller := .caller -}} - - {{- if not $objectData.command -}} - {{- fail (printf "Container - Expected non-empty <%s> on [exec] type" $caller) -}} - {{- end }} -exec: - command: - {{- include "tc.v1.common.lib.container.command" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 4}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/container/probe-lifecycle-actions/_grpc.tpl b/cloudflared-6.0.4/charts/common/templates/lib/container/probe-lifecycle-actions/_grpc.tpl deleted file mode 100644 index 29660ad..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/container/probe-lifecycle-actions/_grpc.tpl +++ /dev/null @@ -1,23 +0,0 @@ -{{/* Returns grpc action */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.container.actions.tcpSocket" (dict "rootCtx" $ "objectData" $objectData "caller" $caller) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the container. -*/}} -{{- define "tc.v1.common.lib.container.actions.grpc" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - {{- $caller := .caller -}} - - {{- if not $objectData.port -}} - {{- fail (printf "Container - Expected non-empty <%s> on [grpc] type" $caller) -}} - {{- end -}} - - {{- $port := $objectData.port -}} - - {{- if kindIs "string" $port -}} - {{- $port = tpl $port $rootCtx -}} - {{- end }} -grpc: - port: {{ $port }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/container/probe-lifecycle-actions/_httpGet.tpl b/cloudflared-6.0.4/charts/common/templates/lib/container/probe-lifecycle-actions/_httpGet.tpl deleted file mode 100644 index 029ab50..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/container/probe-lifecycle-actions/_httpGet.tpl +++ /dev/null @@ -1,53 +0,0 @@ -{{/* Returns httpGet action */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.container.actions.httpGet" (dict "rootCtx" $ "objectData" $objectData "caller" $caller) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the container. -*/}} -{{- define "tc.v1.common.lib.container.actions.httpGet" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - {{- $caller := .caller -}} - - {{- if not $objectData.port -}} - {{- fail (printf "Container - Expected non-empty <%s> on [http] type" $caller) -}} - {{- end -}} - - {{- $port := $objectData.port -}} - {{- $path := "/" -}} - {{- $scheme := "http" -}} - - {{- if kindIs "string" $port -}} - {{- $port = tpl $port $rootCtx -}} - {{- end -}} - - {{- with $objectData.path -}} - {{- $path = tpl . $rootCtx -}} - {{- end -}} - - {{- if not (hasPrefix "/" $path) -}} - {{- fail (printf "Container - Expected <%s> to start with a forward slash [/] on type" $caller) -}} - {{- end -}} - - {{- with $objectData.type -}} - {{- $scheme = tpl . $rootCtx -}} - {{- end }} -httpGet: - {{- with $objectData.host }} - host: {{ tpl . $rootCtx }} - {{- end }} - port: {{ $port }} - path: {{ $path }} - scheme: {{ $scheme | upper }} - {{- with $objectData.httpHeaders }} - httpHeaders: - {{- range $name, $value := . }} - {{- if not $value -}} - {{- fail "Container - Expected non-empty on " -}} - {{- end }} - - name: {{ $name }} - value: {{ tpl (toString $value) $rootCtx | quote }} - {{- end -}} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/container/probe-lifecycle-actions/_tcpSocket.tpl b/cloudflared-6.0.4/charts/common/templates/lib/container/probe-lifecycle-actions/_tcpSocket.tpl deleted file mode 100644 index 2425fd3..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/container/probe-lifecycle-actions/_tcpSocket.tpl +++ /dev/null @@ -1,23 +0,0 @@ -{{/* Returns tcpSocket action */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.container.actions.tcpSocket" (dict "rootCtx" $ "objectData" $objectData "caller" $caller) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the container. -*/}} -{{- define "tc.v1.common.lib.container.actions.tcpSocket" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - {{- $caller := .caller -}} - - {{- if not $objectData.port -}} - {{- fail (printf "Container - Expected non-empty <%s> on [tcp] type" $caller) -}} - {{- end -}} - - {{- $port := $objectData.port -}} - - {{- if kindIs "string" $port -}} - {{- $port = tpl $port $rootCtx -}} - {{- end }} -tcpSocket: - port: {{ $port }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/dependencies/_clickhouseInjector.tpl b/cloudflared-6.0.4/charts/common/templates/lib/dependencies/_clickhouseInjector.tpl deleted file mode 100644 index 6a4c0b0..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/dependencies/_clickhouseInjector.tpl +++ /dev/null @@ -1,55 +0,0 @@ -{{/* - This template generates a random password and ensures it persists across updates/edits to the chart -*/}} -{{- define "tc.v1.common.dependencies.clickhouse.secret" -}} - -{{- if .Values.clickhouse.enabled -}} - {{/* Initialize variables */}} - {{- $fetchname := printf "%s-clickhousecreds" .Release.Name -}} - {{- $dbprevious := lookup "v1" "Secret" .Release.Namespace $fetchname -}} - {{- $dbpreviousold := lookup "v1" "Secret" .Release.Namespace "clickhousecreds" -}} - {{- $dbPass := randAlphaNum 50 -}} - - {{/* If there are previous secrets, fetch values and decrypt them */}} - {{- if $dbprevious -}} - {{- $dbPass = (index $dbprevious.data "clickhouse-password") | b64dec -}} - {{- else if $dbpreviousold -}} - {{- $dbPass = (index $dbpreviousold.data "clickhouse-password") | b64dec -}} - {{- end -}} - - {{/* Prepare data */}} - {{- $dbHost := printf "%v-%v" .Release.Name "clickhouse" -}} - {{- $portHost := printf "%v:8123" $dbHost -}} - {{- $ping := printf "http://%v/ping" $portHost -}} - {{- $url := printf "http://%v:%v@%v/%v" .Values.clickhouse.clickhouseUsername $dbPass $portHost .Values.clickhouse.clickhouseDatabase -}} - {{- $jdbc := printf "jdbc:ch://%v/%v" $portHost -}} - - {{/* Append some values to clickhouse.creds, so apps using the dep, can use them */}} - {{- $_ := set .Values.clickhouse.creds "plain" ($dbHost | quote) -}} - {{- $_ := set .Values.clickhouse.creds "plainhost" ($dbHost | quote) -}} - {{- $_ := set .Values.clickhouse.creds "clickhousePassword" ($dbPass | quote) -}} - {{- $_ := set .Values.clickhouse.creds "plainport" ($portHost | quote) -}} - {{- $_ := set .Values.clickhouse.creds "plainporthost" ($portHost | quote) -}} - {{- $_ := set .Values.clickhouse.creds "ping" ($ping | quote) -}} - {{- $_ := set .Values.clickhouse.creds "complete" ($url | quote) -}} - {{- $_ := set .Values.clickhouse.creds "jdbc" ($jdbc | quote) -}} - -{{/* Create the secret (Comment also plays a role on correct formatting) */}} -enabled: true -expandObjectName: false -data: - clickhouse-password: {{ $dbPass }} - plainhost: {{ $dbHost }} - plainporthost: {{ $portHost }} - ping: {{ $ping }} - url: {{ $url }} - jdbc: {{ $jdbc }} - {{- end -}} -{{- end -}} - -{{- define "tc.v1.common.dependencies.clickhouse.injector" -}} - {{- $secret := include "tc.v1.common.dependencies.clickhouse.secret" . | fromYaml -}} - {{- if $secret -}} - {{- $_ := set .Values.secret ( printf "%s-%s" .Release.Name "clickhousecreds" ) $secret -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/dependencies/_dbWait.tpl b/cloudflared-6.0.4/charts/common/templates/lib/dependencies/_dbWait.tpl deleted file mode 100644 index 0dcd4e9..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/dependencies/_dbWait.tpl +++ /dev/null @@ -1,387 +0,0 @@ -{{- define "tc.v1.common.lib.deps.wait" -}} - {{- if .Values.redis.enabled -}} - {{- $container := include "tc.v1.common.lib.deps.wait.redis" $ | fromYaml -}} - {{- if $container -}} - {{- range .Values.workload -}} - {{- if not (hasKey .podSpec "initContainers") -}} - {{- $_ := set .podSpec "initContainers" dict -}} - {{- end -}} - {{- $_ := set .podSpec.initContainers "redis-wait" $container -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if .Values.mariadb.enabled -}} - {{- $container := include "tc.v1.common.lib.deps.wait.mariadb" $ | fromYaml -}} - {{- if $container -}} - {{- range .Values.workload -}} - {{- if not (hasKey .podSpec "initContainers") -}} - {{- $_ := set .podSpec "initContainers" dict -}} - {{- end -}} - {{- $_ := set .podSpec.initContainers "mariadb-wait" $container -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if .Values.mongodb.enabled -}} - {{- $container := include "tc.v1.common.lib.deps.wait.mongodb" $ | fromYaml -}} - {{- if $container -}} - {{- range .Values.workload -}} - {{- if not (hasKey .podSpec "initContainers") -}} - {{- $_ := set .podSpec "initContainers" dict -}} - {{- end -}} - {{- $_ := set .podSpec.initContainers "mongodb-wait" $container -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if .Values.clickhouse.enabled -}} - {{- $container := include "tc.v1.common.lib.deps.wait.clickhouse" $ | fromYaml -}} - {{- if $container -}} - {{- range .Values.workload -}} - {{- if not (hasKey .podSpec "initContainers") -}} - {{- $_ := set .podSpec "initContainers" dict -}} - {{- end -}} - {{- $_ := set .podSpec.initContainers "clickhouse-wait" $container -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if .Values.solr.enabled -}} - {{- $container := include "tc.v1.common.lib.deps.wait.solr" $ | fromYaml -}} - {{- if $container -}} - {{- range .Values.workload -}} - {{- if not (hasKey .podSpec "initContainers") -}} - {{- $_ := set .podSpec "initContainers" dict -}} - {{- end -}} - {{- $_ := set .podSpec.initContainers "solr-wait" $container -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- $result := false -}} - {{- range .Values.cnpg -}} - {{- if .enabled -}} - {{- $result = true -}} - {{- end -}} - {{- end -}} - - {{- if $result -}} - {{- $container := include "tc.v1.common.lib.deps.wait.cnpg" $ | fromYaml -}} - {{- if $container -}} - {{- range $.Values.workload -}} - {{- if not (hasKey .podSpec "initContainers") -}} - {{- $_ := set .podSpec "initContainers" dict -}} - {{- end -}} - {{- $_ := set .podSpec.initContainers "cnpg-wait" $container -}} - {{- end -}} - {{- end -}} - {{- end -}} -{{- end -}} - -{{- define "tc.v1.common.lib.deps.wait.redis" -}} -enabled: true -type: system -imageSelector: redisClientImage -securityContext: - runAsUser: 568 - runAsGroup: 568 - readOnlyRootFilesystem: true - runAsNonRoot: true - allowPrivilegeEscalation: false - privileged: false - seccompProfile: - type: RuntimeDefault - capabilities: - add: [] - drop: - - ALL -env: - REDIS_HOST: - secretKeyRef: - expandObjectName: false - name: '{{ printf "%s-%s" .Release.Name "rediscreds" }}' - key: plainhost - REDIS_PASSWORD: - secretKeyRef: - expandObjectName: false - name: '{{ printf "%s-%s" .Release.Name "rediscreds" }}' - key: redis-password - REDIS_PORT: "6379" -command: - - "/bin/sh" - - "-c" - - | - /bin/bash <<'EOF' - echo "Executing DB waits..." - [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD"; - export LIVE=false; - until "$LIVE"; - do - response=$( - timeout -s 3 2 \ - redis-cli \ - -h "$REDIS_HOST" \ - -p "$REDIS_PORT" \ - ping - ) - if [ "$response" == "PONG" ] || [ "$response" == "LOADING Redis is loading the dataset in memory" ]; then - LIVE=true - echo "$response" - echo "Redis Responded, ending initcontainer and starting main container(s)..." - else - echo "$response" - echo "Redis not responding... Sleeping for 10 sec..." - sleep 10 - fi; - done - EOF -{{- end -}} - -{{- define "tc.v1.common.lib.deps.wait.mariadb" -}} -enabled: true -type: system -imageSelector: mariadbClientImage -securityContext: - runAsUser: 568 - runAsGroup: 568 - readOnlyRootFilesystem: true - runAsNonRoot: true - allowPrivilegeEscalation: false - privileged: false - seccompProfile: - type: RuntimeDefault - capabilities: - add: [] - drop: - - ALL -resources: - requests: - cpu: 10m - memory: 50Mi - limits: - cpu: 4000m - memory: 8Gi -env: - MARIADB_HOST: - secretKeyRef: - expandObjectName: false - name: '{{ printf "%s-%s" .Release.Name "mariadbcreds" }}' - key: plainhost - MARIADB_ROOT_PASSWORD: - secretKeyRef: - expandObjectName: false - name: '{{ printf "%s-%s" .Release.Name "mariadbcreds" }}' - key: mariadb-root-password -command: - - "/bin/sh" - - "-c" - - | - /bin/bash <<'EOF' - echo "Executing DB waits..." - until - mysqladmin -uroot -h"${MARIADB_HOST}" -p"${MARIADB_ROOT_PASSWORD}" ping \ - && mysqladmin -uroot -h"${MARIADB_HOST}" -p"${MARIADB_ROOT_PASSWORD}" status; - do sleep 2; - done - EOF -{{- end -}} - -{{- define "tc.v1.common.lib.deps.wait.mongodb" -}} -enabled: true -type: system -imageSelector: mongodbClientImage -securityContext: - runAsUser: 568 - runAsGroup: 568 - readOnlyRootFilesystem: true - runAsNonRoot: true - allowPrivilegeEscalation: false - privileged: false - seccompProfile: - type: RuntimeDefault - capabilities: - add: [] - drop: - - ALL -resources: - requests: - cpu: 10m - memory: 50Mi - limits: - cpu: 4000m - memory: 8Gi -env: - MONGODB_HOST: - secretKeyRef: - expandObjectName: false - name: '{{ printf "%s-%s" .Release.Name "mongodbcreds" }}' - key: plainhost - MONGODB_DATABASE: "{{ .Values.mongodb.mongodbDatabase }}" -command: - - "/bin/sh" - - "-c" - - | - /bin/bash <<'EOF' - echo "Executing DB waits..." - until - HOME=/config && echo "db.runCommand(\"ping\")" | mongosh --host ${MONGODB_HOST} --port 27017 ${MONGODB_DATABASE} --quiet; - do sleep 2; - done - EOF -{{- end -}} - -{{- define "tc.v1.common.lib.deps.wait.clickhouse" -}} -enabled: true -type: system -imageSelector: wgetImage -securityContext: - runAsUser: 568 - runAsGroup: 568 - readOnlyRootFilesystem: true - runAsNonRoot: true - allowPrivilegeEscalation: false - privileged: false - seccompProfile: - type: RuntimeDefault - capabilities: - add: [] - drop: - - ALL -resources: - requests: - cpu: 10m - memory: 50Mi - limits: - cpu: 4000m - memory: 8Gi -env: - CLICKHOUSE_PING: - secretKeyRef: - expandObjectName: false - name: '{{ printf "%s-%s" .Release.Name "clickhousecreds" }}' - key: ping -command: - - "/bin/sh" -args: - - "-c" - - | - echo "Executing DB waits..." - until wget --quiet --tries=1 --spider "${CLICKHOUSE_PING}"; do - echo "ClickHouse - no response. Sleeping 2 seconds..." - sleep 2 - done - echo "ClickHouse - accepting connections" -{{- end -}} - -{{- define "tc.v1.common.lib.deps.wait.solr" -}} -enabled: true -type: system -imageSelector: wgetImage -securityContext: - runAsUser: 568 - runAsGroup: 568 - readOnlyRootFilesystem: true - runAsNonRoot: true - allowPrivilegeEscalation: false - privileged: false - seccompProfile: - type: RuntimeDefault - capabilities: - add: [] - drop: - - ALL -resources: - requests: - cpu: 10m - memory: 50Mi - limits: - cpu: 4000m - memory: 8Gi -env: - SOLR_HOST: - secretKeyRef: - expandObjectName: false - name: '{{ printf "%s-%s" .Release.Name "solrcreds" }}' - key: plainhost - SOLR_CORES: "{{ .Values.solr.solrCores }}" - SOLR_ENABLE_AUTHENTICATION: "{{ .Values.solr.solrEnableAuthentication }}" - SOLR_ADMIN_USERNAME: "{{ .Values.solr.solrUsername }}" - SOLR_ADMIN_PASSWORD: - secretKeyRef: - expandObjectName: false - name: '{{ printf "%s-%s" .Release.Name "solrcreds" }}' - key: solr-password - -command: - - "/bin/sh" -args: - - "-c" - - | - echo "Executing DB waits..." - if [ "$SOLR_ENABLE_AUTHENTICATION" == "yes" ]; then - until curl --fail --user "${SOLR_ADMIN_USERNAME}":"${SOLR_ADMIN_PASSWORD}" "${SOLR_HOST}":8983/solr/"${SOLR_CORES}"/admin/ping; do - echo "Solr is not responding... Sleeping 2 seconds..." - sleep 2 - done - else - until curl --fail "${SOLR_HOST}":8983/solr/"${SOLR_CORES}"/admin/ping; do - echo "Solr is not responding... Sleeping 2 seconds..." - sleep 2 - done - fi -{{- end -}} - -{{- define "tc.v1.common.lib.deps.wait.cnpg" -}} -enabled: true -type: system -imageSelector: postgresClientImage -securityContext: - runAsUser: 568 - runAsGroup: 568 - readOnlyRootFilesystem: true - runAsNonRoot: true - allowPrivilegeEscalation: false - privileged: false - seccompProfile: - type: RuntimeDefault - capabilities: - add: [] - drop: - - ALL -resources: - requests: - cpu: 10m - memory: 50Mi - limits: - cpu: 4000m - memory: 8Gi -command: - - "/bin/sh" - - "-c" - - | - /bin/sh <<'EOF' - {{ range $name, $cnpg := .Values.cnpg }} - {{ if $cnpg.enabled }} - echo "Executing DB waits..." - {{ $cnpgName := include "tc.v1.common.lib.chart.names.fullname" $ }} - {{ $cnpgName = printf "%v-cnpg-%v" $cnpgName $name }} - echo "Detected RW pooler, testing RW pooler availability..." - until - echo "Testing database on url: {{ $cnpgName }}-rw" - pg_isready -U {{ .user }} -d {{ .database }} -h {{ $cnpgName }}-rw - do sleep 5 - done - {{ if $cnpg.acceptRO }} - echo "Detected RO pooler, testing RO pooler availability..." - until - echo "Testing database on url: {{ $cnpgName }}-ro" - pg_isready -U {{ .user }} -d {{ .database }} -h {{ $cnpgName }}-ro - do sleep 5 - done - {{ end }} - {{ end }} - {{ end }} - sleep 5 - EOF -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/dependencies/_mariadbInjector.tpl b/cloudflared-6.0.4/charts/common/templates/lib/dependencies/_mariadbInjector.tpl deleted file mode 100644 index 59565f7..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/dependencies/_mariadbInjector.tpl +++ /dev/null @@ -1,66 +0,0 @@ -{{/* -This template generates a random password and ensures it persists across updates/edits to the chart -*/}} -{{- define "tc.v1.common.dependencies.mariadb.secret" -}} - -{{- if .Values.mariadb.enabled -}} - {{/* Initialize variables */}} - {{- $fetchname := printf "%s-mariadbcreds" .Release.Name -}} - {{- $dbprevious := lookup "v1" "Secret" .Release.Namespace $fetchname -}} - {{- $dbpreviousold := lookup "v1" "Secret" .Release.Namespace "mariadbcreds" -}} - {{- $dbPass := randAlphaNum 50 -}} - {{- $rootPass := randAlphaNum 50 -}} - - {{/* If there are previous secrets, fetch values and decrypt them */}} - {{- if $dbprevious -}} - {{- $dbPass = (index $dbprevious.data "mariadb-password") | b64dec -}} - {{- $rootPass = (index $dbprevious.data "mariadb-root-password") | b64dec -}} - {{- else if $dbpreviousold -}} - {{- $dbPass = (index $dbpreviousold.data "mariadb-password") | b64dec -}} - {{- $rootPass = (index $dbpreviousold.data "mariadb-root-password") | b64dec -}} - {{- end -}} - - {{/* Prepare data */}} - {{- $dbhost := printf "%v-%v" .Release.Name "mariadb" -}} - {{- $portHost := printf "%v:3306" $dbhost -}} - {{- $complete := printf "sql://%v:%v@%v/%v" .Values.mariadb.mariadbUsername $dbPass $portHost .Values.mariadb.mariadbDatabase -}} - {{- $urlnossl := printf "sql://%v:%v@%v/%v?sslmode=disable" .Values.mariadb.mariadbUsername $dbPass $portHost .Values.mariadb.mariadbDatabase -}} - {{- $jdbc := printf "jdbc:sqlserver://%v/%v" $portHost .Values.mariadb.mariadbDatabase -}} - {{- $jdbcMySQL := printf "jdbc:mysql://%v/%v" $portHost .Values.mariadb.mariadbDatabase -}} - {{- $jdbcMariaDB := printf "jdbc:mariadb://%v/%v" $portHost .Values.mariadb.mariadbDatabase -}} - - {{/* Append some values to mariadb.creds, so apps using the dep, can use them */}} - {{- $_ := set .Values.mariadb.creds "mariadbPassword" ($dbPass | quote) -}} - {{- $_ := set .Values.mariadb.creds "mariadbRootPassword" ($rootPass | quote) -}} - {{- $_ := set .Values.mariadb.creds "plain" ($dbhost | quote) -}} - {{- $_ := set .Values.mariadb.creds "plainhost" ($dbhost | quote) -}} - {{- $_ := set .Values.mariadb.creds "plainport" ($portHost | quote) -}} - {{- $_ := set .Values.mariadb.creds "plainporthost" ($portHost | quote) -}} - {{- $_ := set .Values.mariadb.creds "complete" ($complete | quote) -}} - {{- $_ := set .Values.mariadb.creds "urlnossl" ($urlnossl | quote) -}} - {{- $_ := set .Values.mariadb.creds "jdbc" ($jdbc | quote) -}} - {{- $_ := set .Values.mariadb.creds "jdbcmysql" ($jdbcMySQL | quote) -}} - {{- $_ := set .Values.mariadb.creds "jdbcmariadb" ($jdbcMariaDB | quote) -}} - -{{/* Create the secret (Comment also plays a role on correct formatting) */}} -enabled: true -expandObjectName: false -data: - mariadb-password: {{ $dbPass }} - mariadb-root-password: {{ $rootPass }} - url: {{ $complete }} - urlnossl: {{ $urlnossl }} - plainporthost: {{ $portHost }} - plainhost: {{ $dbhost }} - jdbc: {{ $jdbc }} - jdbc-mysql: {{ $jdbcMySQL }} - jdbc-mariadb: {{ $jdbcMariaDB }} - {{- end -}} -{{- end -}} - -{{- define "tc.v1.common.dependencies.mariadb.injector" -}} - {{- $secret := include "tc.v1.common.dependencies.mariadb.secret" . | fromYaml -}} - {{- if $secret -}} - {{- $_ := set .Values.secret (printf "%s-%s" .Release.Name "mariadbcreds") $secret -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/dependencies/_mongodbInjector.tpl b/cloudflared-6.0.4/charts/common/templates/lib/dependencies/_mongodbInjector.tpl deleted file mode 100644 index 12f0ff6..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/dependencies/_mongodbInjector.tpl +++ /dev/null @@ -1,63 +0,0 @@ -{{/* -This template generates a random password and ensures it persists across updates/edits to the chart -*/}} -{{- define "tc.v1.common.dependencies.mongodb.secret" -}} - -{{- if .Values.mongodb.enabled -}} - {{/* Initialize variables */}} - {{- $fetchname := printf "%s-mongodbcreds" .Release.Name -}} - {{- $dbprevious := lookup "v1" "Secret" .Release.Namespace $fetchname -}} - {{- $dbpreviousold := lookup "v1" "Secret" .Release.Namespace "mongodbcreds" -}} - {{- $dbPass := randAlphaNum 50 -}} - {{- $rootPass := randAlphaNum 50 -}} - - {{/* If there are previous secrets, fetch values and decrypt them */}} - {{- if $dbprevious -}} - {{- $dbPass = (index $dbprevious.data "mongodb-password") | b64dec -}} - {{- $rootPass = (index $dbprevious.data "mongodb-root-password") | b64dec -}} - {{- else if $dbpreviousold -}} - {{- $dbPass = (index $dbpreviousold.data "mongodb-password") | b64dec -}} - {{- $rootPass = (index $dbpreviousold.data "mongodb-root-password") | b64dec -}} - {{- end -}} - - {{/* Prepare data */}} - {{- $dbhost := printf "%v-%v" .Release.Name "mongodb" -}} - {{- $portHost := printf "%v:27017" $dbhost -}} - {{- $jdbc := printf "jdbc:mongodb://%v/%v" $portHost .Values.mongodb.mongodbDatabase -}} - {{- $url := printf "mongodb://%v:%v@%v/%v" .Values.mongodb.mongodbUsername $dbPass $portHost .Values.mongodb.mongodbDatabase -}} - {{- $urlssl := printf "%v?ssl=true" $url -}} - {{- $urltls := printf "%v?tls=true" $url -}} - - {{/* Append some values to mongodb.creds, so apps using the dep, can use them */}} - {{- $_ := set .Values.mongodb.creds "mongodbPassword" ($dbPass | quote) -}} - {{- $_ := set .Values.mongodb.creds "mongodbRootPassword" ($rootPass | quote) -}} - {{- $_ := set .Values.mongodb.creds "plain" ($dbhost | quote) -}} - {{- $_ := set .Values.mongodb.creds "plainhost" ($dbhost | quote) -}} - {{- $_ := set .Values.mongodb.creds "plainport" ($portHost | quote) -}} - {{- $_ := set .Values.mongodb.creds "plainporthost" ($portHost | quote) -}} - {{- $_ := set .Values.mongodb.creds "complete" ($url | quote) -}} - {{- $_ := set .Values.mongodb.creds "urlssl" ($urlssl | quote) -}} - {{- $_ := set .Values.mongodb.creds "urltls" ($urltls | quote) -}} - {{- $_ := set .Values.mongodb.creds "jdbc" ($jdbc | quote) -}} - -{{/* Create the secret (Comment also plays a role on correct formatting) */}} -enabled: true -expandObjectName: false -data: - mongodb-password: {{ $dbPass }} - mongodb-root-password: {{ $rootPass }} - url: {{ $url }} - urlssl: {{ $urlssl }} - urltls: {{ $urltls }} - jdbc: {{ $jdbc }} - plainhost: {{ $dbhost }} - plainporthost: {{ $portHost }} - {{- end -}} -{{- end -}} - -{{- define "tc.v1.common.dependencies.mongodb.injector" -}} - {{- $secret := include "tc.v1.common.dependencies.mongodb.secret" . | fromYaml -}} - {{- if $secret -}} - {{- $_ := set .Values.secret (printf "%s-%s" .Release.Name "mongodbcreds") $secret -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/dependencies/_redisInjector.tpl b/cloudflared-6.0.4/charts/common/templates/lib/dependencies/_redisInjector.tpl deleted file mode 100644 index 6860164..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/dependencies/_redisInjector.tpl +++ /dev/null @@ -1,51 +0,0 @@ -{{/* -This template generates a random password and ensures it persists across updates/edits to the chart -*/}} -{{- define "tc.v1.common.dependencies.redis.secret" -}} - -{{- if .Values.redis.enabled -}} - {{/* Initialize variables */}} - {{- $fetchname := printf "%s-rediscreds" .Release.Name -}} - {{- $dbprevious := lookup "v1" "Secret" .Release.Namespace $fetchname -}} - {{- $dbPass := randAlphaNum 50 -}} - {{- $dbIndex := .Values.redis.redisDatabase | default "0" -}} - - {{/* If there are previous secrets, fetch values and decrypt them */}} - {{- if $dbprevious -}} - {{- $dbPass = (index $dbprevious.data "redis-password") | b64dec -}} - {{- end -}} - - {{/* Prepare data */}} - {{- $dbHost := printf "%v-%v" .Release.Name "redis" -}} - {{- $portHost := printf "%v:6379" $dbHost -}} - {{- $url := printf "redis://%v:%v@%v/%v" .Values.redis.redisUsername $dbPass $portHost $dbIndex -}} - {{- $hostPass := printf "%v:%v@%v" .Values.redis.redisUsername $dbPass $dbHost -}} - - {{/* Append some values to redis.creds, so apps using the dep, can use them */}} - {{- $_ := set .Values.redis.creds "redisPassword" ($dbPass | quote) -}} - {{- $_ := set .Values.redis.creds "plain" ($dbHost | quote) -}} - {{- $_ := set .Values.redis.creds "plainhost" ($dbHost | quote) -}} - {{- $_ := set .Values.redis.creds "plainport" ($portHost | quote) -}} - {{- $_ := set .Values.redis.creds "plainporthost" ($portHost | quote) -}} - {{- $_ := set .Values.redis.creds "plainhostpass" ($hostPass | quote) -}} - {{- $_ := set .Values.redis.creds "url" ($url | quote) -}} - -{{/* Create the secret (Comment also plays a role on correct formatting) */}} -enabled: true -expandObjectName: false -data: - redis-password: {{ $dbPass }} - plain: {{ $dbHost }} - url: {{ $url }} - plainhostpass: {{ $hostPass }} - plainporthost: {{ $portHost }} - plainhost: {{ $dbHost }} - {{- end -}} -{{- end -}} - -{{- define "tc.v1.common.dependencies.redis.injector" -}} - {{- $secret := include "tc.v1.common.dependencies.redis.secret" . | fromYaml -}} - {{- if $secret -}} - {{- $_ := set .Values.secret (printf "%s-%s" .Release.Name "rediscreds") $secret -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/dependencies/_solrInjector.tpl b/cloudflared-6.0.4/charts/common/templates/lib/dependencies/_solrInjector.tpl deleted file mode 100644 index 32d33f2..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/dependencies/_solrInjector.tpl +++ /dev/null @@ -1,47 +0,0 @@ -{{/* -This template generates a random password and ensures it persists across updates/edits to the chart -*/}} -{{- define "tc.v1.common.dependencies.solr.secret" -}} - -{{- if .Values.solr.enabled -}} - {{/* Initialize variables */}} - {{- $fetchname := printf "%s-solrcreds" .Release.Name -}} - {{- $solrprevious := lookup "v1" "Secret" .Release.Namespace $fetchname -}} - {{- $solrpreviousold := lookup "v1" "Secret" .Release.Namespace "solrcreds" -}} - {{- $solrPass := randAlphaNum 50 -}} - - {{/* If there are previous secrets, fetch values and decrypt them */}} - {{- if $solrprevious -}} - {{- $solrPass = (index $solrprevious.data "solr-password") | b64dec -}} - {{- else if $solrpreviousold -}} - {{- $solrPass = (index $solrpreviousold.data "solr-password") | b64dec -}} - {{- end -}} - - {{/* Prepare data */}} - {{- $dbHost := printf "%v-%v" .Release.Name "solr" -}} - {{- $portHost := printf "%v:8983" $dbHost -}} - {{- $url := printf "http://%v:%v@%v/url/%v" .Values.solr.solrUsername $solrPass $portHost .Values.solr.solrCores -}} - - {{/* Append some values to solr.creds, so apps using the dep, can use them */}} - {{- $_ := set .Values.solr.creds "solrPassword" ($solrPass | quote) -}} - {{- $_ := set .Values.solr.creds "plain" ($dbHost | quote) -}} - {{- $_ := set .Values.solr.creds "plainhost" ($dbHost | quote) -}} - {{- $_ := set .Values.solr.creds "portHost" ($portHost | quote) -}} - {{- $_ := set .Values.solr.creds "url" ($url | quote) -}} - -{{/* Create the secret (Comment also plays a role on correct formatting) */}} -enabled: true -expandObjectName: false -data: - solr-password: {{ $solrPass }} - url: {{ $url }} - plainhost: {{ $dbHost }} - {{- end -}} -{{- end -}} - -{{- define "tc.v1.common.dependencies.solr.injector" -}} - {{- $secret := include "tc.v1.common.dependencies.solr.secret" . | fromYaml -}} - {{- if $secret -}} - {{- $_ := set .Values.secret (printf "%s-%s" .Release.Name "solrcreds") $secret -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/endpoint/_addresses.tpl b/cloudflared-6.0.4/charts/common/templates/lib/endpoint/_addresses.tpl deleted file mode 100644 index 381bb1f..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/endpoint/_addresses.tpl +++ /dev/null @@ -1,20 +0,0 @@ -{{/* Endpoint - addresses */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.endpoint.addresses" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: The object data of the service -*/}} - -{{- define "tc.v1.common.lib.endpoint.addresses" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- if not $objectData.externalIP -}} - {{- fail "EndpointSlice - Expected non-empty " -}} - {{- end -}} - - {{- if not (kindIs "string" $objectData.externalIP) -}} {{/* Only single IP is supported currently on this lib */}} - {{- fail (printf "EndpointSlice - Expected to be a [string], but got [%s]" (kindOf $objectData.externalIP)) -}} - {{- end }} - - ip: {{ tpl $objectData.externalIP $rootCtx }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/endpoint/_ports.tpl b/cloudflared-6.0.4/charts/common/templates/lib/endpoint/_ports.tpl deleted file mode 100644 index f0f9b93..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/endpoint/_ports.tpl +++ /dev/null @@ -1,40 +0,0 @@ -{{/* Endpoint - Ports */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.endpoint.ports" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: The object data of the service -*/}} - -{{- define "tc.v1.common.lib.endpoint.ports" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $tcpProtocols := (list "tcp" "http" "https") -}} - {{- range $name, $portValues := $objectData.ports -}} - {{- if $portValues.enabled -}} - {{- $protocol := $rootCtx.Values.fallbackDefaults.serviceProtocol -}} {{/* Default to fallback protocol, if no protocol is defined */}} - {{- $port := $portValues.targetPort | default $portValues.port -}} - - {{/* Expand targetPort */}} - {{- if (kindIs "string" $port) -}} - {{- $port = (tpl $port $rootCtx) -}} - {{- end -}} - {{- $port = int $port -}} - - {{- with $portValues.protocol -}} - {{- $protocol = tpl . $rootCtx -}} - - {{- if mustHas $protocol $tcpProtocols -}} - {{- $protocol = "tcp" -}} - {{- end -}} - {{- end }} -- name: {{ $name }} - port: {{ $port }} - protocol: {{ $protocol | upper }} - {{- with $portValues.appProtocol }} - appProtocol: {{ tpl . $rootCtx | lower }} - {{- end -}} - {{- end -}} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/endpointSlice/_endpoints.tpl b/cloudflared-6.0.4/charts/common/templates/lib/endpointSlice/_endpoints.tpl deleted file mode 100644 index a030fe5..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/endpointSlice/_endpoints.tpl +++ /dev/null @@ -1,21 +0,0 @@ -{{/* EndpointSlice - endpoints */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.endpointslice.endpoints" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: The object data of the service -*/}} - -{{- define "tc.v1.common.lib.endpointslice.endpoints" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- if not $objectData.externalIP -}} - {{- fail "EndpointSlice - Expected non-empty " -}} - {{- end -}} - - {{- if not (kindIs "string" $objectData.externalIP) -}} {{/* Only single IP is supported currently on this lib */}} - {{- fail (printf "EndpointSlice - Expected to be a [string], but got [%s]" (kindOf $objectData.externalIP)) -}} - {{- end }} -- addresses: - - {{ tpl $objectData.externalIP $rootCtx }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/endpointSlice/_ports.tpl b/cloudflared-6.0.4/charts/common/templates/lib/endpointSlice/_ports.tpl deleted file mode 100644 index a323fb8..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/endpointSlice/_ports.tpl +++ /dev/null @@ -1,40 +0,0 @@ -{{/* EndpointSlice - Ports */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.endpointslice.ports" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: The object data of the service -*/}} - -{{- define "tc.v1.common.lib.endpointslice.ports" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $tcpProtocols := (list "tcp" "http" "https") -}} - {{- range $name, $portValues := $objectData.ports -}} - {{- if $portValues.enabled -}} - {{- $protocol := $rootCtx.Values.fallbackDefaults.serviceProtocol -}} {{/* Default to fallback protocol, if no protocol is defined */}} - {{- $port := $portValues.targetPort | default $portValues.port -}} - - {{/* Expand targetPort */}} - {{- if (kindIs "string" $port) -}} - {{- $port = (tpl $port $rootCtx) -}} - {{- end -}} - {{- $port = int $port -}} - - {{- with $portValues.protocol -}} - {{- $protocol = tpl . $rootCtx -}} - - {{- if mustHas $protocol $tcpProtocols -}} - {{- $protocol = "tcp" -}} - {{- end -}} - {{- end }} -- name: {{ $name }} - port: {{ $port }} - protocol: {{ $protocol | upper }} - {{- with $portValues.appProtocol }} - appProtocol: {{ tpl . $rootCtx | lower }} - {{- end -}} - {{- end -}} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/externalInterface/_validation.tpl b/cloudflared-6.0.4/charts/common/templates/lib/externalInterface/_validation.tpl deleted file mode 100644 index c1eb478..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/externalInterface/_validation.tpl +++ /dev/null @@ -1,53 +0,0 @@ -{{/* External Interface Validation */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.externalInterface.validation" (dict "objectData" $objectData) -}} -objectData: The object data to validate that contains the external interface configuratioon. -*/}} - -{{- define "tc.v1.common.lib.externalInterface.validation" -}} - {{- $objectData := .objectData -}} - - {{- if and $objectData.targetSelector (not (kindIs "slice" $objectData.targetSelector)) -}} - {{- fail (printf "External Interface - Expected to be a [list], but got [%s]" (kindOf $objectData.targetSelector)) -}} - {{- end -}} - - {{- if not $objectData.hostInterface -}} - {{- fail "External Interface - Expected non-empty " -}} - {{- end -}} - - {{- if not $objectData.ipam -}} - {{- fail "External Interface - Expected non-empty " -}} - {{- end -}} - - {{- if not $objectData.ipam.type -}} - {{- fail "External Interface - Expected non-empty " -}} - {{- end -}} - - {{- $types := (list "dhcp" "static") -}} - {{- if not (mustHas $objectData.ipam.type $types) -}} - {{- fail (printf "External Interface - Expected to be one of [%s], but got [%s]" (join ", " $types) $objectData.ipam.type) -}} - {{- end -}} - - {{- if and (or $objectData.ipam.staticIPConfigurations $objectData.ipam.staticRoutes) (ne $objectData.ipam.type "static") -}} - {{- fail "External Interface - Expected empty and when is not [static]" -}} - {{- end -}} - - {{- if eq $objectData.ipam.type "static" -}} - {{- if not $objectData.ipam.staticIPConfigurations -}} - {{- fail "External Interface - Expected non-empty when is [static]" -}} - {{- end -}} - - {{- with $objectData.ipam.staticRoutes -}} - {{- range . -}} - {{- if not .destination -}} - {{- fail "External Interface - Expected non-empty in " -}} - {{- end -}} - - {{- if not .gateway -}} - {{- fail "External Interface - Expected non-empty in " -}} - {{- end -}} - {{- end -}} - {{- end -}} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/imagePullSecret/_createData.tpl b/cloudflared-6.0.4/charts/common/templates/lib/imagePullSecret/_createData.tpl deleted file mode 100644 index 3c355b1..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/imagePullSecret/_createData.tpl +++ /dev/null @@ -1,42 +0,0 @@ -{{/* Configmap Validation */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.imagePullSecret.createData" (dict "objectData" $objectData "root" $rootCtx) -}} -rootCtx: The root context of the chart. -objectData: - data: The data of the imagePullSecret. -*/}} - -{{- define "tc.v1.common.lib.imagePullSecret.createData" -}} - {{- $objectData := .objectData -}} - {{- $rootCtx := .rootCtx -}} - - {{- $registrySecret := dict -}} - - {{/* Auth is b64encoded and then the whole secret is b64encoded */}} - {{- $auth := printf "%s:%s" (tpl $objectData.data.username $rootCtx) (tpl $objectData.data.password $rootCtx) | b64enc -}} - - {{- $registry := dict -}} - {{- with $objectData.data -}} - {{- $registry = (dict "username" (tpl .username $rootCtx) "password" (tpl .password $rootCtx) - "email" (tpl .email $rootCtx) "auth" $auth) -}} - {{- end -}} - - {{- $_ := set $registrySecret "auths" (dict "registry" $registry) -}} - - {{/* - This should result in something like this: - { - "auths": { - "$registry": { - "username": "$username", - "password": "$password", - "email": "$email", - "auth": "($username:$password) base64" - } - } -} -*/}} - - {{/* Return the registrySecret as Json */}} - {{- $registrySecret | toJson -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/imagePullSecret/_validation.tpl b/cloudflared-6.0.4/charts/common/templates/lib/imagePullSecret/_validation.tpl deleted file mode 100644 index 7d0f9fa..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/imagePullSecret/_validation.tpl +++ /dev/null @@ -1,27 +0,0 @@ -{{/* Configmap Validation */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.imagePullSecret.validation" (dict "objectData" $objectData) -}} -objectData: - labels: The labels of the imagePullSecret. - annotations: The annotations of the imagePullSecret. - data: The data of the imagePullSecret. -*/}} - -{{- define "tc.v1.common.lib.imagePullSecret.validation" -}} - {{- $objectData := .objectData -}} - - {{- if not $objectData.data -}} - {{- fail "Image Pull Secret - Expected non-empty " -}} - {{- end -}} - - {{- if not (kindIs "map" $objectData.data) -}} - {{- fail (printf "Image Pull Secret - Expected to be a dictionary, but got [%v]" (kindOf $objectData.data)) -}} - {{- end -}} - - {{- range $key := (list "username" "password" "registry" "email") -}} - {{- if not (get $objectData.data $key) -}} - {{- fail (printf "Image Pull Secret - Expected non-empty <%s>" $key) -}} - {{- end -}} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/metadata/_allAnnotations.tpl b/cloudflared-6.0.4/charts/common/templates/lib/metadata/_allAnnotations.tpl deleted file mode 100644 index a00703f..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/metadata/_allAnnotations.tpl +++ /dev/null @@ -1,9 +0,0 @@ -{{/* Annotations that are added to all objects */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.metadata.allAnnotations" $ }} -*/}} -{{- define "tc.v1.common.lib.metadata.allAnnotations" -}} - {{/* Currently empty but can add later, if needed */}} -{{- include "tc.v1.common.lib.metadata.globalAnnotations" . }} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/metadata/_allLabels.tpl b/cloudflared-6.0.4/charts/common/templates/lib/metadata/_allLabels.tpl deleted file mode 100644 index 3346f79..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/metadata/_allLabels.tpl +++ /dev/null @@ -1,15 +0,0 @@ -{{/* Labels that are added to all objects */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.metadata.allLabels" $ }} -*/}} -{{- define "tc.v1.common.lib.metadata.allLabels" -}} -helm.sh/chart: {{ include "tc.v1.common.lib.chart.names.chart" . }} -helm-revision: {{ .Release.Revision | quote }} -app.kubernetes.io/name: {{ include "tc.v1.common.lib.chart.names.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -app: {{ include "tc.v1.common.lib.chart.names.chart" . }} -release: {{ .Release.Name }} -{{- include "tc.v1.common.lib.metadata.globalLabels" . }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/metadata/_externalInterfaceAnnotations.tpl b/cloudflared-6.0.4/charts/common/templates/lib/metadata/_externalInterfaceAnnotations.tpl deleted file mode 100644 index 01bbcff..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/metadata/_externalInterfaceAnnotations.tpl +++ /dev/null @@ -1,52 +0,0 @@ - - -{{/* External Interface Annotations that are added to podSpec */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.metadata.externalInterfacePodAnnotations" (dict "rootCtx" $ "podShortName" $podShortName) }} -rootCtx is the root context of the chart -objectData is object containing the data of the pod -*/}} -{{- define "tc.v1.common.lib.metadata.externalInterfacePodAnnotations" -}} - {{- $objectData := .objectData -}} - {{- $rootCtx := .rootCtx -}} - - {{- $ifaceIndexes := list -}} - - {{- range $index, $iface := $rootCtx.Values.scaleExternalInterface -}} - {{/* If targetSelectAll is set append the index */}} - {{- if .targetSelectAll -}} - {{- $ifaceIndexes = mustAppend $ifaceIndexes $index -}} - {{/* Else If targetSelector is set and pod is selected append the index */}} - {{- else if and .targetSelector (mustHas $objectData.shortName .targetSelector) -}} - {{- $ifaceIndexes = mustAppend $ifaceIndexes $index -}} - {{/* Else If none of the above, but pod is primary append the index */}} - {{- else if $objectData.primary -}} - {{- $ifaceIndexes = mustAppend $ifaceIndexes $index -}} - {{- end -}} - {{- end -}} - - {{- $ifaceNames := list -}} - {{- if $rootCtx.Values.ixExternalInterfacesConfiguration -}} - {{- with $rootCtx.Values.ixExternalInterfacesConfigurationNames -}} - {{- range $ifaceName := . -}} - {{/* Get the index by splitting the iFaceName (ix-release-name-0) */}} - {{- $index := splitList "-" $ifaceName -}} - {{/* And pick the last item on the list */}} - {{- $index = mustLast $index -}} - - {{/* If the index is in the list of indexes to be added, append the name */}} - {{- if mustHas (int $index) $ifaceIndexes -}} - {{- $ifaceNames = mustAppend $ifaceNames $ifaceName -}} - {{- end -}} - - {{- end -}} - {{- else -}} - {{- fail "External Interface - Expected non empty " -}} - {{- end -}} - {{- end -}} - - {{/* If we have ifaceNames, then add the annotations to the pod calling this template */}} - {{- if $ifaceNames }} -k8s.v1.cni.cncf.io/networks: {{ join ", " $ifaceNames }} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/metadata/_globalAnnotations.tpl b/cloudflared-6.0.4/charts/common/templates/lib/metadata/_globalAnnotations.tpl deleted file mode 100644 index 1133783..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/metadata/_globalAnnotations.tpl +++ /dev/null @@ -1,6 +0,0 @@ -{{/* Returns the global annotations */}} -{{- define "tc.v1.common.lib.metadata.globalAnnotations" -}} - - {{- include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "annotations" .Values.global.annotations) -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/metadata/_globalLabels.tpl b/cloudflared-6.0.4/charts/common/templates/lib/metadata/_globalLabels.tpl deleted file mode 100644 index 672f522..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/metadata/_globalLabels.tpl +++ /dev/null @@ -1,6 +0,0 @@ -{{/* Returns the global labels */}} -{{- define "tc.v1.common.lib.metadata.globalLabels" -}} - - {{- include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "labels" .Values.global.labels) -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/metadata/_namespace.tpl b/cloudflared-6.0.4/charts/common/templates/lib/metadata/_namespace.tpl deleted file mode 100644 index 10b048d..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/metadata/_namespace.tpl +++ /dev/null @@ -1,35 +0,0 @@ -{{- define "tc.v1.common.lib.metadata.namespace" -}} - {{- $caller := .caller -}} - {{- $objectData := .objectData -}} - {{- $rootCtx := .rootCtx -}} - - {{- $namespace := $rootCtx.Release.Namespace -}} - - {{- with $rootCtx.Values.global.namespace -}} - {{- $namespace = tpl . $rootCtx -}} - {{- end -}} - - {{- with $rootCtx.Values.namespace -}} - {{- $namespace = tpl . $rootCtx -}} - {{- end -}} - - {{- with $objectData.namespace -}} - {{- $namespace = tpl . $rootCtx -}} - {{- end -}} - - {{- if not (and (mustRegexMatch "^[a-z0-9](-?[a-z0-9]-?)+[a-z0-9]$" $namespace) (le (len $namespace) 63)) -}} - {{- fail (printf "%s - Namespace [%s] is not valid. Must start and end with an alphanumeric lowercase character. It can contain '-'. And must be at most 63 characters." $caller $namespace) -}} - {{- end -}} - - {{- if $rootCtx.Values.global.ixChartContext -}} - {{- if not (hasPrefix "ix-" $namespace) -}} - {{/* This is only to be used on CI that do not run in SCALE so we can skip the failure */}} - {{- if not $rootCtx.Values.global.ixChartContext.ci -}} - {{- fail (printf "%s - Namespace [%v] expected to have [ix-] prefix when installed in TrueNAS SCALE" $caller $namespace) -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- $namespace -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/metadata/_podAnnotations.tpl b/cloudflared-6.0.4/charts/common/templates/lib/metadata/_podAnnotations.tpl deleted file mode 100644 index db9d92e..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/metadata/_podAnnotations.tpl +++ /dev/null @@ -1,7 +0,0 @@ -{{/* Annotations that are added to podSpec */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.metadata.podAnnotations" $ }} -*/}} -{{- define "tc.v1.common.lib.metadata.podAnnotations" -}} -rollme: {{ randAlphaNum 5 | quote }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/metadata/_podLabels.tpl b/cloudflared-6.0.4/charts/common/templates/lib/metadata/_podLabels.tpl deleted file mode 100644 index a227d36..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/metadata/_podLabels.tpl +++ /dev/null @@ -1,6 +0,0 @@ -{{/* Labels that are added to podSpec */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.metadata.podLabels" $ }} -*/}} -{{- define "tc.v1.common.lib.metadata.podLabels" -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/metadata/_render.tpl b/cloudflared-6.0.4/charts/common/templates/lib/metadata/_render.tpl deleted file mode 100644 index 9e5f3d9..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/metadata/_render.tpl +++ /dev/null @@ -1,37 +0,0 @@ -{{/* Renders a dict of labels */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "labels" $labels) }} -{{ include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "annotations" $annotations) }} -*/}} - -{{- define "tc.v1.common.lib.metadata.render" -}} - {{- $labels := .labels -}} - {{- $annotations := .annotations -}} - {{- $rootCtx := .rootCtx -}} - - {{- $seenLabels := list -}} - {{- $seenAnnotations := list -}} - - {{- with $labels -}} - {{- range $k, $v := . -}} - {{- if and $k $v -}} - {{- if not (mustHas $k $seenLabels) }} -{{ $k }}: {{ tpl $v $rootCtx | quote }} - {{- $seenLabels = mustAppend $seenLabels $k -}} - {{- end -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- with $annotations -}} - {{- range $k, $v := . -}} - {{- if and $k $v -}} - {{- if not (mustHas $k $seenAnnotations) }} -{{ $k }}: {{ tpl $v $rootCtx | quote }} - {{- $seenAnnotations = mustAppend $seenAnnotations $k -}} - {{- end -}} - {{- end -}} - {{- end -}} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/metadata/_selectorLabels.tpl b/cloudflared-6.0.4/charts/common/templates/lib/metadata/_selectorLabels.tpl deleted file mode 100644 index aaf09be..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/metadata/_selectorLabels.tpl +++ /dev/null @@ -1,16 +0,0 @@ -{{/* Labels that are used on selectors */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.metadata.selectorLabels" (dict "rootCtx" $rootCtx "objectType" $objectType "objectName" $objectName) }} -podName is the "shortName" of the pod. The one you define in the .Values.workload -*/}} -{{- define "tc.v1.common.lib.metadata.selectorLabels" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectType := .objectType -}} - {{- $objectName := .objectName }} - -{{- if and $objectType $objectName }} -{{ printf "%s.name" $objectType }}: {{ $objectName }} -{{- end }} -app.kubernetes.io/name: {{ include "tc.v1.common.lib.chart.names.name" $rootCtx }} -app.kubernetes.io/instance: {{ $rootCtx.Release.Name }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/metadata/_validation.tpl b/cloudflared-6.0.4/charts/common/templates/lib/metadata/_validation.tpl deleted file mode 100644 index 61b4c55..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/metadata/_validation.tpl +++ /dev/null @@ -1,22 +0,0 @@ -{{/* Metadata Validation */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.metadata.validation" (dict "objectData" $objectData "caller" $caller) -}} -objectData: - labels: The labels of the configmap. - annotations: The annotations of the configmap. - data: The data of the configmap. -*/}} - -{{- define "tc.v1.common.lib.metadata.validation" -}} - {{- $objectData := .objectData -}} - {{- $caller := .caller -}} - - {{- if and $objectData.labels (not (kindIs "map" $objectData.labels)) -}} - {{- fail (printf "%s - Expected to be a dictionary, but got [%v]" $caller (kindOf $objectData.labels)) -}} - {{- end -}} - - {{- if and $objectData.annotations (not (kindIs "map" $objectData.annotations)) -}} - {{- fail (printf "%s - Expected to be a dictionary, but got [%v]" $caller (kindOf $objectData.annotations)) -}} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/_autoMountServiceAccountToken.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/_autoMountServiceAccountToken.tpl deleted file mode 100644 index f6cc5ff..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/_autoMountServiceAccountToken.tpl +++ /dev/null @@ -1,24 +0,0 @@ -{{/* Returns automountServiceAccountToken */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.automountServiceAccountToken" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the Pod. -*/}} -{{- define "tc.v1.common.lib.pod.automountServiceAccountToken" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $automount := false -}} - - {{/* Initialize from the "global" option */}} - {{- if (kindIs "bool" $rootCtx.Values.podOptions.automountServiceAccountToken) -}} - {{- $automount = $rootCtx.Values.podOptions.automountServiceAccountToken -}} - {{- end -}} - - {{/* Override with pod's option */}} - {{- if (kindIs "bool" $objectData.podSpec.automountServiceAccountToken) -}} - {{- $automount = $objectData.podSpec.automountServiceAccountToken -}} - {{- end -}} - - {{- $automount -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/_container.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/_container.tpl deleted file mode 100644 index 90f51fa..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/_container.tpl +++ /dev/null @@ -1,62 +0,0 @@ -{{/* Returns Container */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.container" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the Pod. -*/}} -{{- define "tc.v1.common.lib.pod.container" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $imageObj := fromJson (include "tc.v1.common.lib.container.imageSelector" (dict "rootCtx" $rootCtx "objectData" $objectData)) -}} - {{- $termination := fromJson (include "tc.v1.common.lib.container.termination" (dict "rootCtx" $rootCtx "objectData" $objectData)) }} -- name: {{ $objectData.name }} - image: {{ printf "%s:%s" $imageObj.repository $imageObj.tag }} - imagePullPolicy: {{ $imageObj.pullPolicy }} - tty: {{ $objectData.tty | default false }} - stdin: {{ $objectData.stdin | default false }} - {{- with (include "tc.v1.common.lib.container.command" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim) }} - command: - {{- . | nindent 4 }} - {{- end -}} - {{- with (include "tc.v1.common.lib.container.args" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim) }} - args: - {{- . | nindent 4 }} - {{- end -}} - {{- with $termination.messagePath }} - terminationMessagePath: {{ . }} - {{- end -}} - {{- with $termination.messagePolicy }} - terminationMessagePolicy: {{ . }} - {{- end -}} - {{- with (include "tc.v1.common.lib.container.lifecycle" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim) }} - lifecycle: - {{- . | nindent 4 }} - {{- end -}} - {{- with (include "tc.v1.common.lib.container.ports" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim) }} - ports: - {{- . | nindent 4 }} - {{- end -}} - {{- with (include "tc.v1.common.lib.container.volumeMount" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim) }} - volumeMounts: - {{- . | nindent 4 }} - {{- end -}} - {{- include "tc.v1.common.lib.container.probes" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 2 -}} - {{- with (include "tc.v1.common.lib.container.resources" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim) }} - resources: - {{- . | nindent 4 }} - {{- end }} - securityContext: - {{- include "tc.v1.common.lib.container.securityContext" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 4 }} - {{- /* Create a dict for storing env's so it can be checked for dupes */ -}} - {{- $_ := set $objectData "envDupe" dict -}} - {{- with (include "tc.v1.common.lib.container.envFrom" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim) }} - envFrom: - {{- . | nindent 4 }} - {{- end }} - env: - {{- include "tc.v1.common.lib.container.fixedEnv" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 4 -}} - {{- include "tc.v1.common.lib.container.env" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 4 -}} - {{- include "tc.v1.common.lib.container.envList" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 4 -}} - {{- $_ := unset $objectData "envDupe" -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/_containerSpawner.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/_containerSpawner.tpl deleted file mode 100644 index 66e3bb4..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/_containerSpawner.tpl +++ /dev/null @@ -1,31 +0,0 @@ -{{/* Containers */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.containerSpawner" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the Pod. -*/}} -{{- define "tc.v1.common.lib.pod.containerSpawner" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- include "tc.v1.common.lib.container.primaryValidation" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} - - {{- range $containerName, $containerValues := $objectData.podSpec.containers -}} - {{- if $containerValues.enabled -}} - {{- $container := (mustDeepCopy $containerValues) -}} - {{- $name := include "tc.v1.common.lib.chart.names.fullname" $rootCtx -}} - {{- if not $container.primary -}} - {{- $name = printf "%s-%s" $name $containerName -}} - {{- end -}} - - {{- $_ := set $container "name" $name -}} - {{- $_ := set $container "shortName" $containerName -}} - {{- $_ := set $container "podShortName" $objectData.shortName -}} - {{- $_ := set $container "podPrimary" $objectData.primary -}} - {{- $_ := set $container "podType" $objectData.type -}} - {{/* Created from the pod.securityContext, used by fixedEnv */}} - {{- $_ := set $container "calculatedFSGroup" $objectData.podSpec.calculatedFSGroup -}} - {{- include "tc.v1.common.lib.pod.container" (dict "rootCtx" $rootCtx "objectData" $container) | trim | nindent 0 -}} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/_dns.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/_dns.tpl deleted file mode 100644 index 48181fd..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/_dns.tpl +++ /dev/null @@ -1,90 +0,0 @@ -{{/* Returns DNS Policy and Config */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.dns" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the Pod. -*/}} -{{- define "tc.v1.common.lib.pod.dns" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $policy := "ClusterFirst" -}} - {{- $config := dict -}} - - {{/* Initialize from the "global" option */}} - {{- with $rootCtx.Values.podOptions.dnsPolicy -}} - {{- $policy = . -}} - {{- end -}} - - {{- with $rootCtx.Values.podOptions.dnsConfig -}} - {{- $config = . -}} - {{- end -}} - - {{/* Override with pod's option */}} - {{- with $objectData.podSpec.dnsPolicy -}} - {{- $policy = . -}} - {{- end -}} - - {{- with $objectData.podSpec.dnsConfig -}} - {{- $config = . -}} - {{- end -}} - - {{/* Expand policy */}} - {{- $policy = (tpl $policy $rootCtx) -}} - - {{/* If hostNetwork is enabled, then use ClusterFirstWithHostNet */}} - {{- $hostNet := include "tc.v1.common.lib.pod.hostNetwork" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} - {{- if or (and (kindIs "string" $hostNet) (eq $hostNet "true")) (and (kindIs "bool" $hostNet) $hostNet) -}} - {{- $policy = "ClusterFirstWithHostNet" -}} - {{- end -}} - - {{- $policies := (list "ClusterFirst" "ClusterFirstWithHostNet" "Default" "None") -}} - {{- if not (mustHas $policy $policies) -}} - {{- fail (printf "Expected to be one of [%s], but got [%s]" (join ", " $policies) $policy) -}} - {{- end -}} - - {{/* When policy is set to None all keys are required */}} - {{- if eq $policy "None" -}} - - {{- range $key := (list "nameservers" "searches" "options") -}} - {{- if not (get $config $key) -}} - {{- fail (printf "Expected non-empty with set to [None]." $key) -}} - {{- end -}} - {{- end -}} - - {{- end }} -dnsPolicy: {{ $policy }} - {{- if or $config.nameservers $config.options $config.searches }} -dnsConfig: - {{- with $config.nameservers -}} - {{- if gt (len .) 3 -}} - {{- fail (printf "Expected no more than [3] , but got [%v]" (len .)) -}} - {{- end }} - nameservers: - {{- range . }} - - {{ tpl . $rootCtx }} - {{- end -}} - {{- end -}} - - {{- with $config.searches -}} - {{- if gt (len .) 6 -}} - {{- fail (printf "Expected no more than [6] , but got [%v]" (len .)) -}} - {{- end }} - searches: - {{- range . }} - - {{ tpl . $rootCtx }} - {{- end -}} - {{- end -}} - - {{- with $config.options }} - options: - {{- range . }} - - name: {{ tpl .name $rootCtx }} - {{- with .value }} - value: {{ tpl . $rootCtx | quote }} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/_enableServiceLinks.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/_enableServiceLinks.tpl deleted file mode 100644 index 4d4864e..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/_enableServiceLinks.tpl +++ /dev/null @@ -1,24 +0,0 @@ -{{/* Returns enableServiceLinks */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.enableServiceLinks" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the Pod. -*/}} -{{- define "tc.v1.common.lib.pod.enableServiceLinks" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $enableServiceLinks := false -}} - - {{/* Initialize from the "global" option */}} - {{- if (kindIs "bool" $rootCtx.Values.podOptions.enableServiceLinks) -}} - {{- $enableServiceLinks = $rootCtx.Values.podOptions.enableServiceLinks -}} - {{- end -}} - - {{/* Override with pod's option */}} - {{- if (kindIs "bool" $objectData.podSpec.enableServiceLinks) -}} - {{- $enableServiceLinks = $objectData.podSpec.enableServiceLinks -}} - {{- end -}} - - {{- $enableServiceLinks -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/_hostAliases.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/_hostAliases.tpl deleted file mode 100644 index 60fb5a2..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/_hostAliases.tpl +++ /dev/null @@ -1,37 +0,0 @@ -{{/* Returns Host Aliases */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.hostAliases" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the Pod. -*/}} -{{- define "tc.v1.common.lib.pod.hostAliases" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $aliases := list -}} - - {{/* Initialize from the "global" option */}} - {{- with $rootCtx.Values.podOptions.hostAliases -}} - {{- $aliases = . -}} - {{- end -}} - - {{/* Override with pod's option */}} - {{- with $objectData.podSpec.hostAliases -}} - {{- $aliases = . -}} - {{- end -}} - - {{- range $aliases -}} - {{- if not .ip -}} - {{- fail (printf "Expected non-empty value on .") -}} - {{- end -}} - - {{- if not .hostnames -}} - {{- fail (printf "Expected non-empty list on .") -}} - {{- end }} -- ip: {{ tpl .ip $rootCtx }} - hostnames: - {{- range .hostnames }} - - {{ tpl . $rootCtx }} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/_hostNetwork.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/_hostNetwork.tpl deleted file mode 100644 index 1159c64..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/_hostNetwork.tpl +++ /dev/null @@ -1,24 +0,0 @@ -{{/* Returns Host Network */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.hostNetwork" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the Pod. -*/}} -{{- define "tc.v1.common.lib.pod.hostNetwork" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $hostNet := false -}} - - {{/* Initialize from the "global" option */}} - {{- if (kindIs "bool" $rootCtx.Values.podOptions.hostNetwork) -}} - {{- $hostNet = $rootCtx.Values.podOptions.hostNetwork -}} - {{- end -}} - - {{/* Override with pod's option */}} - {{- if (kindIs "bool" $objectData.podSpec.hostNetwork) -}} - {{- $hostNet = $objectData.podSpec.hostNetwork -}} - {{- end -}} - - {{- $hostNet -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/_hostPID.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/_hostPID.tpl deleted file mode 100644 index 5859ec2..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/_hostPID.tpl +++ /dev/null @@ -1,24 +0,0 @@ -{{/* Returns Host PID */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.hostPID" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the Pod. -*/}} -{{- define "tc.v1.common.lib.pod.hostPID" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $hostPID := false -}} - - {{/* Initialize from the "global" option */}} - {{- if (kindIs "bool" $rootCtx.Values.podOptions.hostPID) -}} - {{- $hostPID = $rootCtx.Values.podOptions.hostPID -}} - {{- end -}} - - {{/* Override with pods option */}} - {{- if (kindIs "bool" $objectData.podSpec.hostPID) -}} - {{- $hostPID = $objectData.podSpec.hostPID -}} - {{- end -}} - - {{- $hostPID -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/_hostname.tpl.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/_hostname.tpl.tpl deleted file mode 100644 index f68769d..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/_hostname.tpl.tpl +++ /dev/null @@ -1,22 +0,0 @@ -{{/* Returns Host Name */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.hostname" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the Pod. -*/}} -{{- define "tc.v1.common.lib.pod.hostname" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $hostname := "" -}} - - {{- with $objectData.podSpec.hostname -}} - {{- $hostname = tpl . $rootCtx -}} - {{- end -}} - - {{- if $hostname -}} - {{- include "tc.v1.common.lib.chart.names.validation" (dict "name" $hostname) -}} - {{- end -}} - - {{- $hostname -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/_imagePullSecret.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/_imagePullSecret.tpl deleted file mode 100644 index de0f23e..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/_imagePullSecret.tpl +++ /dev/null @@ -1,38 +0,0 @@ -{{/* Returns Image Pull Secret List */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.imagePullSecret" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the Pod. -*/}} -{{- define "tc.v1.common.lib.pod.imagePullSecret" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $imgPullSecrets := list -}} - - {{- range $name, $imgPull := $rootCtx.Values.imagePullSecret -}} - {{- $pullName := (printf "%s-%s" (include "tc.v1.common.lib.chart.names.fullname" $rootCtx) $name) -}} - - {{- if $imgPull.enabled -}} - {{/* If targetSelectAll is true */}} - {{- if $imgPull.targetSelectAll -}} - {{- $imgPullSecrets = mustAppend $imgPullSecrets $pullName -}} - - {{/* Else if targetSelector is a list */}} - {{- else if (kindIs "slice" $imgPull.targetSelector) -}} - {{- if (mustHas $objectData.shortName $imgPull.targetSelector) -}} - {{- $imgPullSecrets = mustAppend $imgPullSecrets $pullName -}} - {{- end -}} - - {{/* If not targetSelectAll or targetSelector, but is the primary pod */}} - {{- else if $objectData.primary -}} - {{- $imgPullSecrets = mustAppend $imgPullSecrets $pullName -}} - {{- end -}} - - {{- end -}} - {{- end -}} - - {{- range $imgPullSecrets }} -- name: {{ . }} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/_initContainerSpawner.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/_initContainerSpawner.tpl deleted file mode 100644 index d0a8f63..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/_initContainerSpawner.tpl +++ /dev/null @@ -1,91 +0,0 @@ -{{/* Init Containers */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.initContainerSpawner" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the Pod. -*/}} -{{- define "tc.v1.common.lib.pod.initContainerSpawner" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $initContainers := (dict "system" list - "init" list - "install" list - "upgrade" list) -}} - - {{- $types := (list "system" "init" "install" "upgrade") -}} - - {{- $mergedContainers := $objectData.podSpec.initContainers -}} - - {{- range $containerName, $containerValues := $mergedContainers -}} - - {{- $enabled := $containerValues.enabled -}} - {{- if kindIs "string" $enabled -}} - {{- $enabled = tpl $enabled $rootCtx -}} - - {{/* After tpl it becomes a string, not a bool */}} - {{- if eq $enabled "true" -}} - {{- $enabled = true -}} - {{- else if eq $enabled "false" -}} - {{- $enabled = false -}} - {{- end -}} - {{- end -}} - - {{- if $enabled -}} - - {{- if not ($containerValues.type) -}} - {{- fail "InitContainer - Expected non-empty " -}} - {{- end -}} - - {{- $containerType := tpl $containerValues.type $rootCtx -}} - {{- if not (mustHas $containerType $types) -}} - {{- fail (printf "InitContainer - Expected to be one of [%s], but got [%s]" (join ", " $types) $containerType) -}} - {{- end -}} - - {{- $container := (mustDeepCopy $containerValues) -}} - {{- $name := printf "%s-%s-%s" (include "tc.v1.common.lib.chart.names.fullname" $rootCtx) $containerType $containerName -}} - - {{- $_ := set $container "name" $name -}} - {{- $_ := set $container "shortName" $containerName -}} - {{- $_ := set $container "podShortName" $objectData.shortName -}} - {{- $_ := set $container "podPrimary" $objectData.primary -}} - {{- $_ := set $container "podType" $objectData.type -}} - - {{/* Remove keys that do not apply on init containers */}} - {{- $_ := set $container "lifecycle" dict -}} - {{- $_ := set $container "probes" dict -}} - {{/* Template expects probes dict defined even if enabled */}} - {{- $_ := set $container.probes "liveness" (dict "enabled" false) -}} - {{- $_ := set $container.probes "readiness" (dict "enabled" false) -}} - {{- $_ := set $container.probes "startup" (dict "enabled" false) -}} - - {{/* Created from the pod.securityContext, used by fixedEnv */}} - {{- $_ := set $container "calculatedFSGroup" $objectData.podSpec.calculatedFSGroup -}} - - {{/* Append to list of containers based on type */}} - {{- $tempContainers := (get $initContainers $containerType) -}} - {{- $_ := set $initContainers $containerType (mustAppend $tempContainers $container) -}} - {{- end -}} - {{- end -}} - - {{- if $rootCtx.Release.IsInstall -}} - {{- range $container := (get $initContainers "install") -}} - {{- include "tc.v1.common.lib.pod.container" (dict "rootCtx" $rootCtx "objectData" $container) -}} - {{- end -}} - {{- end -}} - - {{- if $rootCtx.Release.IsUpgrade -}} - {{- range $container := (get $initContainers "upgrade") -}} - {{- include "tc.v1.common.lib.pod.container" (dict "rootCtx" $rootCtx "objectData" $container) -}} - {{- end -}} - {{- end -}} - - {{- range $container := (get $initContainers "system") -}} - {{- include "tc.v1.common.lib.pod.container" (dict "rootCtx" $rootCtx "objectData" $container) -}} - {{- end -}} - - {{- range $container := (get $initContainers "init") -}} - {{- include "tc.v1.common.lib.pod.container" (dict "rootCtx" $rootCtx "objectData" $container) -}} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/_nodeSelector.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/_nodeSelector.tpl deleted file mode 100644 index de43add..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/_nodeSelector.tpl +++ /dev/null @@ -1,33 +0,0 @@ -{{/* Returns Node Selector */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.nodeSelector" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the Pod. -*/}} -{{- define "tc.v1.common.lib.pod.nodeSelector" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $selectors := dict -}} - - {{/* Initialize from the "global" option */}} - {{- with $rootCtx.Values.podOptions.nodeSelector -}} - {{- $selectors = . -}} - {{- end -}} - - {{/* Override with pods option */}} - {{- with $objectData.podSpec.nodeSelector -}} - {{- $selectors = . -}} - {{- end -}} - - {{- if and $rootCtx.Values.global.stopAll (eq $objectData.type "DaemonSet") }} -"non-existing": "true" - {{ else }} - {{- range $k, $v := $selectors -}} - {{- if not $v -}} - {{- fail (printf "Expected non-empty value on [%s] key." $k) -}} - {{- end }} -{{ $k }}: {{ tpl $v $rootCtx }} - {{- end -}} - {{ end }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/_podSecurityContext.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/_podSecurityContext.tpl deleted file mode 100644 index 6bf2d6e..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/_podSecurityContext.tpl +++ /dev/null @@ -1,117 +0,0 @@ -{{/* Returns Pod Security Context */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.securityContext" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the Pod. -*/}} -{{- define "tc.v1.common.lib.pod.securityContext" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- if not $rootCtx.Values.securityContext.pod -}} - {{- fail "Pod - Expected non-empty <.Values.securityContext.pod>" -}} - {{- end -}} - - {{/* Initialize from the "global" option */}} - {{- $secContext := mustDeepCopy $rootCtx.Values.securityContext.pod -}} - - {{/* Override with pods option */}} - {{- with $objectData.podSpec.securityContext -}} - {{- $secContext = mustMergeOverwrite $secContext . -}} - {{- end -}} - - {{- $gpuAdded := false -}} - {{- range $GPUValues := $rootCtx.Values.scaleGPU -}} - {{/* If there is a selector and pod is selected */}} - {{- if $GPUValues.targetSelector -}} - {{- if mustHas $objectData.shortName ($GPUValues.targetSelector | keys) -}} - {{- $gpuAdded = true -}} - {{- end -}} - {{/* If there is not a selector, but pod is primary */}} - {{- else if $objectData.primary -}} - {{- $gpuAdded = true -}} - {{- end -}} - {{- end -}} - - {{- $deviceGroups := (list 5 10 20 24) -}} - {{- $deviceAdded := false -}} - {{- range $persistenceName, $persistenceValues := $rootCtx.Values.persistence -}} - {{- if $persistenceValues.enabled -}} - {{- if eq $persistenceValues.type "device" -}} - {{- if $persistenceValues.targetSelectAll -}} - {{- $deviceAdded = true -}} - {{- else if $persistenceValues.targetSelector -}} - {{- if mustHas $objectData.shortName ($persistenceValues.targetSelector | keys) -}} - {{- $deviceAdded = true -}} - {{- end -}} - {{- else if $objectData.podPrimary -}} - {{- $deviceAdded = true -}} - {{- end -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if $gpuAdded -}} - {{- $_ := set $secContext "supplementalGroups" (concat $secContext.supplementalGroups (list 44 107)) -}} - {{- end -}} - - {{- if $deviceAdded -}} - {{- $_ := set $secContext "supplementalGroups" (concat $secContext.supplementalGroups $deviceGroups) -}} - {{- end -}} - - {{- $_ := set $secContext "supplementalGroups" (concat $secContext.supplementalGroups (list 568)) -}} - - {{- if not (deepEqual $secContext.supplementalGroups (mustUniq $secContext.supplementalGroups)) -}} - {{- fail (printf "Pod - Expected to have only unique values, but got [%s]" (join ", " $secContext.supplementalGroups)) -}} - {{- end -}} - - {{- $portRange := fromJson (include "tc.v1.common.lib.helpers.securityContext.getPortRange" (dict "rootCtx" $rootCtx "objectData" $objectData)) -}} - {{/* If a container wants to bind a port <= 1024 change the unprivileged_port_start */}} - {{- if and $portRange.low (le (int $portRange.low) 1024) -}} - {{/* That sysctl is not supported when hostNet is enabled */}} - {{- if ne (include "tc.v1.common.lib.pod.hostNetwork" (dict "rootCtx" $rootCtx "objectData" $objectData)) "true" -}} - {{- $_ := set $secContext "sysctls" (mustAppend $secContext.sysctls (dict "name" "net.ipv4.ip_unprivileged_port_start" "value" (printf "%v" $portRange.low))) -}} - {{- end -}} - {{- end -}} - - {{- if or (kindIs "invalid" $secContext.fsGroup) (eq (toString $secContext.fsGroup) "") -}} - {{- fail "Pod - Expected non-empty " -}} - {{- end -}} - - {{/* Used by the fixedEnv template */}} - {{- $_ := set $objectData.podSpec "calculatedFSGroup" $secContext.fsGroup -}} - - {{- if not $secContext.fsGroupChangePolicy -}} - {{- fail "Pod - Expected non-empty " -}} - {{- end -}} - - {{- $policies := (list "Always" "OnRootMismatch") -}} - {{- if not (mustHas $secContext.fsGroupChangePolicy $policies) -}} - {{- fail (printf "Pod - Expected to be one of [%s], but got [%s]" (join ", " $policies) $secContext.fsGroupChangePolicy) -}} - {{- end }} -fsGroup: {{ include "tc.v1.common.helper.makeIntOrNoop" $secContext.fsGroup }} -fsGroupChangePolicy: {{ $secContext.fsGroupChangePolicy }} - {{- with $secContext.supplementalGroups }} -supplementalGroups: - {{- range . }} - - {{ include "tc.v1.common.helper.makeIntOrNoop" . }} - {{- end -}} - {{- else }} -supplementalGroups: [] - {{- end -}} - {{- with $secContext.sysctls }} -sysctls: - {{- range . }} - {{- if not .name -}} - {{- fail "Pod - Expected non-empty in " -}} - {{- end -}} - {{- if not .value -}} - {{- fail "Pod - Expected non-empty in " -}} - {{- end }} - - name: {{ tpl .name $rootCtx | quote }} - value: {{ tpl .value $rootCtx | quote }} - {{- end -}} - {{- else }} -sysctls: [] - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/_priorityClassName.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/_priorityClassName.tpl deleted file mode 100644 index aaf15ac..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/_priorityClassName.tpl +++ /dev/null @@ -1,24 +0,0 @@ -{{/* Returns Priority Class Name */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.priorityClassName" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the Pod. -*/}} -{{- define "tc.v1.common.lib.pod.priorityClassName" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $className := "" -}} - - {{/* Initialize from the "global" option */}} - {{- with $rootCtx.Values.podOptions.priorityClassName -}} - {{- $className = tpl . $rootCtx -}} - {{- end -}} - - {{/* Override with pod's option */}} - {{- with $objectData.podSpec.priorityClassName -}} - {{- $className = tpl . $rootCtx -}} - {{- end -}} - - {{- $className -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/_restartPolicy.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/_restartPolicy.tpl deleted file mode 100644 index d14c8c9..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/_restartPolicy.tpl +++ /dev/null @@ -1,34 +0,0 @@ -{{/* Returns Restart Policy */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.restartPolicy" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the Pod. -*/}} -{{- define "tc.v1.common.lib.pod.restartPolicy" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $policy := "Always" -}} - - {{/* Initialize from the "defaults" */}} - {{- with $rootCtx.Values.podOptions.restartPolicy -}} - {{- $policy = tpl . $rootCtx -}} - {{- end -}} - - {{/* Override from the pod values, if defined */}} - {{- with $objectData.podSpec.restartPolicy -}} - {{- $policy = tpl . $rootCtx -}} - {{- end -}} - - {{- $policies := (list "Never" "Always" "OnFailure") -}} - {{- if not (mustHas $policy $policies) -}} - {{- fail (printf "Expected to be one of [%s] but got [%s]" (join ", " $operators) $operator) -}} - {{- end -}} - - {{- if and (eq $operator "Equal") (or (not $key) (not $value)) -}} - {{- fail "Expected non-empty and with set to [Equal]" -}} - {{- end -}} - - {{- if and (eq $operator "Exists") $value -}} - {{- fail (printf "Expected empty with set to [Exists], but got [%s]" $value) -}} - {{- end -}} - - {{- $effects := (list "NoExecute" "NoSchedule" "PreferNoSchedule") -}} - {{- if and $effect (not (mustHas $effect $effects)) -}} - {{- fail (printf "Expected to be one of [%s], but got [%s]" (join ", " $effects) $effect) -}} - {{- end -}} - - {{- if and (not (kindIs "invalid" $tolSeconds)) (not (mustHas (kindOf $tolSeconds) (list "int" "int64" "float64"))) -}} - {{- fail (printf "Expected to be a number, but got [%v]" $tolSeconds) -}} - {{- end }} -- operator: {{ $operator }} - {{- with $key }} - key: {{ $key }} - {{- end -}} - {{- with $effect }} - effect: {{ $effect }} - {{- end -}} - {{- with $value }} - value: {{ . }} - {{- end -}} - {{- if (mustHas (kindOf $tolSeconds) (list "int" "int64" "float64")) }} - tolerationSeconds: {{ $tolSeconds }} - {{- end -}} - - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/_volumes.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/_volumes.tpl deleted file mode 100644 index d054c2d..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/_volumes.tpl +++ /dev/null @@ -1,68 +0,0 @@ -{{/* Returns Volumes */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.volumes" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the Pod. -*/}} -{{- define "tc.v1.common.lib.pod.volumes" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- range $name, $persistenceValues := $rootCtx.Values.persistence -}} - {{- if $persistenceValues.enabled -}} - {{- $persistence := (mustDeepCopy $persistenceValues) -}} - {{- $_ := set $persistence "shortName" $name -}} - - {{- $selected := false -}} - - {{/* If set to true, define volume */}} - {{- if $persistence.targetSelectAll -}} - {{- $selected = true -}} - - {{/* If the pod is the autopermission */}} - {{- else if eq $objectData.shortName "autopermissions" -}} - {{- if $persistence.autoPermissions -}} - {{- if $persistence.autoPermissions.enabled -}} - {{- $selected = true -}} - {{- end -}} - {{- end -}} - - {{/* If targetSelector is set, check if pod is selected */}} - {{- else if $persistence.targetSelector -}} - {{- if (mustHas $objectData.shortName (keys $persistence.targetSelector)) -}} - {{- $selected = true -}} - {{- end -}} - - {{/* If no targetSelector is set or targetSelectAll, check if pod is primary */}} - {{- else if $objectData.primary -}} - {{- $selected = true -}} - {{- end -}} - - {{/* If pod selected */}} - {{- if $selected -}} - {{/* Define the volume based on type */}} - {{- $type := ($persistence.type | default $rootCtx.Values.fallbackDefaults.persistenceType) -}} - - {{- if eq "pvc" $type -}} - {{- include "tc.v1.common.lib.pod.volume.pvc" (dict "rootCtx" $rootCtx "objectData" $persistence) | trim | nindent 0 -}} - {{- else if eq "ixVolume" $type -}} - {{- include "tc.v1.common.lib.pod.volume.ixVolume" (dict "rootCtx" $rootCtx "objectData" $persistence) | trim | nindent 0 -}} - {{- else if eq "hostPath" $type -}} - {{- include "tc.v1.common.lib.pod.volume.hostPath" (dict "rootCtx" $rootCtx "objectData" $persistence) | trim | nindent 0 -}} - {{- else if eq "secret" $type -}} - {{- include "tc.v1.common.lib.pod.volume.secret" (dict "rootCtx" $rootCtx "objectData" $persistence) | trim | nindent 0 -}} - {{- else if eq "configmap" $type -}} - {{- include "tc.v1.common.lib.pod.volume.configmap" (dict "rootCtx" $rootCtx "objectData" $persistence) | trim | nindent 0 -}} - {{- else if eq "emptyDir" $type -}} - {{- include "tc.v1.common.lib.pod.volume.emptyDir" (dict "rootCtx" $rootCtx "objectData" $persistence) | trim | nindent 0 -}} - {{- else if eq "nfs" $type -}} - {{- include "tc.v1.common.lib.pod.volume.nfs" (dict "rootCtx" $rootCtx "objectData" $persistence) | trim | nindent 0 -}} - {{- else if eq "device" $type -}} - {{- include "tc.v1.common.lib.pod.volume.device" (dict "rootCtx" $rootCtx "objectData" $persistence) | trim | nindent 0 -}} - {{- end -}} - - {{- end -}} - - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_configmap.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_configmap.tpl deleted file mode 100644 index f8b7b9e..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_configmap.tpl +++ /dev/null @@ -1,70 +0,0 @@ -{{/* Returns ConfigMap Volume */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.volume.configmap" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the volume. -*/}} -{{- define "tc.v1.common.lib.pod.volume.configmap" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- if not $objectData.objectName -}} - {{- fail "Persistence - Expected non-empty on type" -}} - {{- end -}} - - {{- $objectName := tpl $objectData.objectName $rootCtx -}} - {{- $expandName := true -}} - {{- if kindIs "bool" $objectData.expandObjectName -}} - {{- $expandName = $objectData.expandObjectName -}} - {{- end -}} - - {{- if $expandName -}} - {{- $object := (get $rootCtx.Values.configmap $objectName) -}} - {{- if and (not $object) (not $objectData.optional) -}} - {{- fail (printf "Persistence - Expected configmap [%s] defined in to exist" $objectName) -}} - {{- end -}} - - {{- $objectName = (printf "%s-%s" (include "tc.v1.common.lib.chart.names.fullname" $rootCtx) $objectName) -}} - {{- end -}} - - {{- $optional := false -}} - {{- if hasKey $objectData "optional" -}} - {{- if not (kindIs "bool" $objectData.optional) -}} - {{- fail (printf "Persistence - Expected to be [bool], but got [%s]" (kindOf $objectData.optional)) -}} - {{- end -}} - {{- $optional = $objectData.optional -}} - {{- end -}} - - {{- $defMode := "" -}} - {{- if (and $objectData.defaultMode (not (kindIs "string" $objectData.defaultMode))) -}} - {{- fail (printf "Persistence - Expected to be [string], but got [%s]" (kindOf $objectData.defaultMode)) -}} - {{- end -}} - - {{- with $objectData.defaultMode -}} - {{- $defMode = tpl $objectData.defaultMode $rootCtx -}} - {{- end -}} - - {{- if and $defMode (not (mustRegexMatch "^[0-9]{4}$" $defMode)) -}} - {{- fail (printf "Persistence - Expected to have be in format of [\"0777\"], but got [%q]" $defMode) -}} - {{- end }} -- name: {{ $objectData.shortName }} - configMap: - name: {{ $objectName }} - {{- with $defMode }} - defaultMode: {{ . }} - {{- end }} - optional: {{ $optional }} - {{- with $objectData.items }} - items: - {{- range . -}} - {{- if not .key -}} - {{- fail "Persistence - Expected non-empty " -}} - {{- end -}} - {{- if not .path -}} - {{- fail "Persistence - Expected non-empty " -}} - {{- end }} - - key: {{ tpl .key $rootCtx }} - path: {{ tpl .path $rootCtx }} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_device.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_device.tpl deleted file mode 100644 index c1af694..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_device.tpl +++ /dev/null @@ -1,53 +0,0 @@ -{{/* Returns device (hostPath) Volume */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.volume.device" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the volume. -*/}} -{{- define "tc.v1.common.lib.pod.volume.device" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $hostPathType := "" -}} - {{- if $objectData.hostPathType -}} - {{- $hostPathType = tpl $objectData.hostPathType $rootCtx -}} - {{- end -}} - - {{- if not $objectData.hostPath -}} - {{- fail "Persistence - Expected non-empty on type" -}} - {{- end -}} - {{- $hostPath := tpl $objectData.hostPath $rootCtx -}} - - {{- if not (hasPrefix "/" $hostPath) -}} - {{- fail "Persistence - Expected to start with a forward slash [/] on type" -}} - {{- end -}} - - {{- $charDevices := (list "tty") -}} - {{- if not $hostPathType -}} - {{- range $char := $charDevices -}} - {{- if hasPrefix (printf "/dev/%v" $char) $hostPath -}} - {{- $hostPathType = "CharDevice" -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- $blockDevices := (list "sd" "hd" "nvme") -}} - {{- if not $hostPathType -}} - {{- range $block := $blockDevices -}} - {{- if hasPrefix (printf "/dev/%v" $block) $hostPath -}} - {{- $hostPathType = "BlockDevice" -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- $types := (list "DirectoryOrCreate" "Directory" "FileOrCreate" "File" "Socket" "CharDevice" "BlockDevice") -}} - {{- if and $hostPathType (not (mustHas $hostPathType $types)) -}} - {{- fail (printf "Persistence - Expected to be one of [%s], but got [%s]" (join ", " $types) $hostPathType) -}} - {{- end }} -- name: {{ $objectData.shortName }} - hostPath: - path: {{ $hostPath }} - {{- with $hostPathType }} - type: {{ $hostPathType }} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_emptyDir.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_emptyDir.tpl deleted file mode 100644 index 30d8431..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_emptyDir.tpl +++ /dev/null @@ -1,43 +0,0 @@ -{{/* Returns emptyDir Volume */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.volume.emptyDir" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the volume. -*/}} -{{- define "tc.v1.common.lib.pod.volume.emptyDir" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $medium := "" -}} - {{- $size := "" -}} - {{- with $objectData.medium -}} - {{- $medium = tpl . $rootCtx -}} - {{- end -}} - {{- with $objectData.size -}} - {{- $size = tpl . $rootCtx -}} - {{- end -}} - - {{- if $size -}} - {{/* Size: https://regex101.com/r/NNPV2D/1 */}} - {{- if not (mustRegexMatch "^[1-9][0-9]*([EPTGMK]i?|e[0-9]+)?$" (toString $size)) -}} - {{- $formats := "(Suffixed with E/P/T/G/M/K - eg. 1G), (Suffixed with Ei/Pi/Ti/Gi/Mi/Ki - eg. 1Gi), (Plain Integer in bytes - eg. 1024), (Exponent - eg. 134e6)" -}} - {{- fail (printf "Persistence Expected to have one of the following formats [%s], but got [%s]" $formats $size) -}} - {{- end -}} - {{- end -}} - - {{- if and $medium (ne $medium "Memory") -}} - {{- fail (printf "Persistence - Expected [medium] to be one of [\"\", Memory], but got [%s] on type" $medium) -}} - {{- end }} -- name: {{ $objectData.shortName }} - {{- if or $medium $size }} - emptyDir: - {{- if $medium }} - medium: {{ $medium }} - {{- end -}} - {{- if $size }} - sizeLimit: {{ $size }} - {{- end -}} - {{- else }} - emptyDir: {} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_hostPath.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_hostPath.tpl deleted file mode 100644 index 5d66b97..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_hostPath.tpl +++ /dev/null @@ -1,35 +0,0 @@ -{{/* Returns hostPath Volume */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.volume.hostPath" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the volume. -*/}} -{{- define "tc.v1.common.lib.pod.volume.hostPath" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $hostPathType := "" -}} - {{- if $objectData.hostPathType -}} - {{- $hostPathType = tpl $objectData.hostPathType $rootCtx -}} - {{- end -}} - - {{- if not $objectData.hostPath -}} - {{- fail "Persistence - Expected non-empty on type" -}} - {{- end -}} - {{- $hostPath := tpl $objectData.hostPath $rootCtx -}} - - {{- if not (hasPrefix "/" $hostPath) -}} - {{- fail "Persistence - Expected to start with a forward slash [/] on type" -}} - {{- end -}} - - {{- $types := (list "DirectoryOrCreate" "Directory" "FileOrCreate" "File" "Socket" "CharDevice" "BlockDevice") -}} - {{- if and $hostPathType (not (mustHas $hostPathType $types)) -}} - {{- fail (printf "Persistence - Expected to be one of [%s], but got [%s]" (join ", " $types) $hostPathType) -}} - {{- end }} -- name: {{ $objectData.shortName }} - hostPath: - path: {{ $hostPath }} - {{- with $hostPathType }} - type: {{ $hostPathType }} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_ixVolume.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_ixVolume.tpl deleted file mode 100644 index 225281c..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_ixVolume.tpl +++ /dev/null @@ -1,56 +0,0 @@ -{{/* Returns ixVolume Volume */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.volume.ixVolume" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the volume. -*/}} -{{- define "tc.v1.common.lib.pod.volume.ixVolume" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $hostPathType := "" -}} - {{- if $objectData.hostPathType -}} - {{- $hostPathType = tpl $objectData.hostPathType $rootCtx -}} - {{- end -}} - - {{- if not $objectData.datasetName -}} - {{- fail "Persistence - Expected non-empty on type" -}} - {{- end -}} - {{- $datasetName := tpl $objectData.datasetName $rootCtx -}} - - {{- if not $rootCtx.Values.ixVolumes -}} - {{- fail "Persistence - Expected non-empty in values on type" -}} - {{- end -}} - - {{- $hostPath := "" -}} - {{- $found := false -}} - {{- range $idx, $normalizedHostPath := $rootCtx.Values.ixVolumes -}} - {{- if eq $datasetName (base $normalizedHostPath.hostPath) -}} - {{- $found = true -}} - {{- $hostPath = $normalizedHostPath.hostPath -}} - {{- end -}} - {{- end -}} - - {{- if not $found -}} {{/* If we go over the ixVolumes and we dont find a match, fail */}} - {{- $datasets := list -}} - {{- range $rootCtx.Values.ixVolumes -}} - {{- $datasets = mustAppend $datasets (base .hostPath) -}} - {{- end -}} - {{- fail (printf "Persistence - Expected [%s] to exist on list, but list contained [%s] on type" $datasetName (join ", " $datasets)) -}} - {{- end -}} - - {{- if not (hasPrefix "/" $hostPath) -}} - {{- fail "Persistence - Expected normalized path from to start with a forward slash [/] on type" -}} - {{- end -}} - - {{- $types := (list "DirectoryOrCreate" "Directory" "FileOrCreate" "File" "Socket" "CharDevice" "BlockDevice") -}} - {{- if and $hostPathType (not (mustHas $hostPathType $types)) -}} - {{- fail (printf "Persistence - Expected to be one of [%s], but got [%s]" (join ", " $types) $hostPathType) -}} - {{- end }} -- name: {{ $objectData.shortName }} - hostPath: - path: {{ $hostPath }} - {{- with $hostPathType }} - type: {{ $hostPathType }} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_nfs.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_nfs.tpl deleted file mode 100644 index 3e91208..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_nfs.tpl +++ /dev/null @@ -1,27 +0,0 @@ -{{/* Returns NFS Volume */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.volume.nfs" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the volume. -*/}} -{{- define "tc.v1.common.lib.pod.volume.nfs" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- if not $objectData.path -}} - {{- fail "Persistence - Expected non-empty on type" -}} - {{- end -}} - - {{- $path := tpl $objectData.path $rootCtx -}} - {{- if not (hasPrefix "/" $path) -}} - {{- fail "Persistence - Expected to start with a forward slash [/] on type" -}} - {{- end -}} - - {{- if not $objectData.server -}} - {{- fail "Persistence - Expected non-empty on type" -}} - {{- end }} -- name: {{ $objectData.shortName }} - nfs: - path: {{ $path }} - server: {{ tpl $objectData.server $rootCtx }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_pvc.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_pvc.tpl deleted file mode 100644 index b0a2fe2..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_pvc.tpl +++ /dev/null @@ -1,18 +0,0 @@ -{{/* Returns PVC Volume */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.volume.pvc" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the volume. -*/}} -{{- define "tc.v1.common.lib.pod.volume.pvc" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $pvcName := (printf "%s-%s" (include "tc.v1.common.lib.chart.names.fullname" $rootCtx) $objectData.shortName) -}} - {{- with $objectData.existingClaim -}} - {{- $pvcName = tpl . $rootCtx -}} - {{- end }} -- name: {{ $objectData.shortName }} - persistentVolumeClaim: - claimName: {{ $pvcName }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_secret.tpl b/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_secret.tpl deleted file mode 100644 index 223b376..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/pod/volumes/_secret.tpl +++ /dev/null @@ -1,71 +0,0 @@ -{{/* Returns Secret Volume */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pod.volume.secret" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the volume. -*/}} -{{- define "tc.v1.common.lib.pod.volume.secret" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- if not $objectData.objectName -}} - {{- fail "Persistence - Expected non-empty on type" -}} - {{- end -}} - - {{- $objectName := tpl $objectData.objectName $rootCtx -}} - {{- $expandName := true -}} - {{- if kindIs "bool" $objectData.expandObjectName -}} - {{- $expandName = $objectData.expandObjectName -}} - {{- end -}} - - {{- if $expandName -}} - {{- $object := (get $rootCtx.Values.secret $objectName) -}} - {{- $certObject := (get $rootCtx.Values.scaleCertificate $objectName) -}} - {{- if and (not $object) (not $certObject) (not $objectData.optional) -}} - {{- fail (printf "Persistence - Expected secret [%s] defined in to exist" $objectName) -}} - {{- end -}} - - {{- $objectName = (printf "%s-%s" (include "tc.v1.common.lib.chart.names.fullname" $rootCtx) $objectName) -}} - {{- end -}} - - {{- $optional := false -}} - {{- if hasKey $objectData "optional" -}} - {{- if not (kindIs "bool" $objectData.optional) -}} - {{- fail (printf "Persistence - Expected to be [bool], but got [%s]" (kindOf $objectData.optional)) -}} - {{- end -}} - {{- $optional = $objectData.optional -}} - {{- end -}} - - {{- $defMode := "" -}} - {{- if (and $objectData.defaultMode (not (kindIs "string" $objectData.defaultMode))) -}} - {{- fail (printf "Persistence - Expected to be [string], but got [%s]" (kindOf $objectData.defaultMode)) -}} - {{- end -}} - - {{- with $objectData.defaultMode -}} - {{- $defMode = tpl $objectData.defaultMode $rootCtx -}} - {{- end -}} - - {{- if and $defMode (not (mustRegexMatch "^[0-9]{4}$" $defMode)) -}} - {{- fail (printf "Persistence - Expected to have be in format of [\"0777\"], but got [%q]" $defMode) -}} - {{- end }} -- name: {{ $objectData.shortName }} - secret: - secretName: {{ $objectName }} - {{- with $defMode }} - defaultMode: {{ . }} - {{- end }} - optional: {{ $optional }} - {{- with $objectData.items }} - items: - {{- range . -}} - {{- if not .key -}} - {{- fail "Persistence - Expected non-empty " -}} - {{- end -}} - {{- if not .path -}} - {{- fail "Persistence - Expected non-empty " -}} - {{- end }} - - key: {{ tpl .key $rootCtx }} - path: {{ tpl .path $rootCtx }} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/podDistruptionBudget/_validation.tpl b/cloudflared-6.0.4/charts/common/templates/lib/podDistruptionBudget/_validation.tpl deleted file mode 100644 index d0eb993..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/podDistruptionBudget/_validation.tpl +++ /dev/null @@ -1,48 +0,0 @@ -{{/* Metadata Validation */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.podDisruptionBudget.validation" (dict "objectData" $objectData "caller" $caller) -}} -objectData: - labels: The labels of the configmap. - annotations: The annotations of the configmap. - data: The data of the configmap. -*/}} - -{{- define "tc.v1.common.lib.podDisruptionBudget.validation" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- if and $objectData.targetSelector (not (kindIs "string" $objectData.targetSelector)) -}} - {{- fail (printf "Pod Disruption Budget - Expected to be [string], but got [%s]" (kindOf $objectData.targetSelector)) -}} - {{- end -}} - - {{- if and (not $objectData.targetSelector) (not $objectData.customLabels) -}} - {{- fail (printf "Pod Disruption Budget - Expected one of [targetSelector, customLabels] to be defined in " $objectData.shortName) -}} - {{- end -}} - - {{- if and $objectData.targetSelector $objectData.customLabels -}} - {{- fail (printf "Pod Disruption Budget - Expected only one of [targetSelector, customLabels] to be defined in " $objectData.shortName) -}} - {{- end -}} - - {{- with $objectData.unhealthyPodEvictionPolicy -}} - {{- $policies := (list "IfHealthyBudget" "AlwaysAllow") -}} - {{- if not (mustHas (tpl . $rootCtx) $policies) -}} - {{- fail (printf "Pod Disruption Budget - Expected to be one of [%s], but got [%s]" (join ", " $policies) .) -}} - {{- end -}} - {{- end -}} - - {{- $hasKey := false -}} - {{- $keys := (list "minAvailable" "maxUnavailable") -}} - {{- range $key := $keys -}} - {{- if hasKey $objectData $key -}} - {{- $hasKey = true -}} - {{- if kindIs "invalid" (get $objectData $key) -}} - {{- fail (printf "Pod Disruption Budget - Expected the defined key [%v] in to not be empty" $key $objectData.shortName) -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if not $hasKey -}} - {{- fail (printf "Pod Disruption Budget - Expected at least one of [%s] to be defined in " (join ", " $keys) $objectData.shortName) -}} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/rbac/_getServiceAccounts.tpl b/cloudflared-6.0.4/charts/common/templates/lib/rbac/_getServiceAccounts.tpl deleted file mode 100644 index 61a2305..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/rbac/_getServiceAccounts.tpl +++ /dev/null @@ -1,52 +0,0 @@ -{{/* Returns Service Account List for rbac */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.rbac.serviceAccount" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the RBAC. -*/}} -{{/* Parses service accounts, and checks if RBAC have selected any of them */}} -{{- define "tc.v1.common.lib.rbac.serviceAccount" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $serviceAccounts := list -}} - - {{- range $name, $serviceAccount := $rootCtx.Values.serviceAccount -}} - {{- $saName := include "tc.v1.common.lib.chart.names.fullname" $rootCtx -}} - - {{- if $serviceAccount.enabled -}} - - {{- if not $serviceAccount.primary -}} - {{- $saName = (printf "%s-%s" (include "tc.v1.common.lib.chart.names.fullname" $rootCtx) $name) -}} - {{- end -}} - - {{/* If allServiceAccounts is true */}} - {{- if $objectData.allServiceAccounts -}} - {{- $serviceAccounts = mustAppend $serviceAccounts $saName -}} - - {{/* Else if serviceAccounts is a list */}} - {{- else if (kindIs "slice" $objectData.serviceAccounts) -}} - {{- if (mustHas $name $objectData.serviceAccounts) -}} - {{- $serviceAccounts = mustAppend $serviceAccounts $saName -}} - {{- end -}} - - {{/* If not "allServiceAccounts" or "serviceAccounts", assign the primary service account to rbac */}} - {{- else if $serviceAccount.primary -}} - {{- if $objectData.primary -}} - {{- $serviceAccounts = mustAppend $serviceAccounts $saName -}} - {{- end -}} - {{- end -}} - - {{- end -}} - {{- end -}} - - {{- if not $serviceAccounts -}} - {{- fail "RBAC - Expected at least one serviceAccount to be assigned. Assign one using [allServiceAccounts (boolean), serviceAccounts (list)]" -}} - {{- end -}} - - {{- range $serviceAccounts }} -- kind: ServiceAccount - name: {{ . }} - namespace: {{ $rootCtx.Release.Namespace }} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/rbac/_rules.tpl b/cloudflared-6.0.4/charts/common/templates/lib/rbac/_rules.tpl deleted file mode 100644 index 6f46e51..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/rbac/_rules.tpl +++ /dev/null @@ -1,50 +0,0 @@ -{{/* Returns Rules for rbac */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.rbac.rules" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the RBAC. -*/}} -{{/* Parses service accounts, and checks if RBAC have selected any of them */}} -{{- define "tc.v1.common.lib.rbac.rules" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- if not $objectData.rules -}} - {{- fail "RBAC - Expected non-empty " -}} - {{- end -}} - - {{- range $objectData.rules -}} - {{- if not .apiGroups -}} - {{- fail "RBAC - Expected non-empty " -}} - {{- end -}} - {{- if not .resources -}} - {{- fail "RBAC - Expected non-empty " -}} - {{- end -}} - {{- if not .verbs -}} - {{- fail "RBAC - Expected non-empty " -}} - {{- end -}} - - {{- /* apiGroups */}} -- apiGroups: - {{- range .apiGroups }} - - {{ tpl . $rootCtx | quote }} - {{- end -}} - {{- /* resources */}} - resources: - {{- range .resources -}} - {{- if not . -}} - {{- fail "RBAC - Expected non-empty entry in " -}} - {{- end }} - - {{ tpl . $rootCtx | quote }} - {{- end -}} - {{- /* verbs */}} - verbs: - {{- range .verbs -}} - {{- if not . -}} - {{- fail "RBAC - Expected non-empty entry in " -}} - {{- end }} - - {{ tpl . $rootCtx | quote }} - {{- end -}} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/rbac/_subjects.tpl b/cloudflared-6.0.4/charts/common/templates/lib/rbac/_subjects.tpl deleted file mode 100644 index 58f8c63..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/rbac/_subjects.tpl +++ /dev/null @@ -1,17 +0,0 @@ -{{/* Returns Subjects for rbac */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.rbac.subjects" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the RBAC. -*/}} -{{/* Parses service accounts, and checks if RBAC have selected any of them */}} -{{- define "tc.v1.common.lib.rbac.subjects" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- range $objectData.subjects }} -- kind: {{ tpl (required "RBAC - Expected non-empty " .kind) $rootCtx | quote }} - name: {{ tpl (required "RBAC - Expected non-empty " .name) $rootCtx | quote }} - apiGroup: {{ tpl (required "RBAC - Expected non-empty " .apiGroup) $rootCtx | quote }} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/rbac/_validation.tpl b/cloudflared-6.0.4/charts/common/templates/lib/rbac/_validation.tpl deleted file mode 100644 index 81f7ca8..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/rbac/_validation.tpl +++ /dev/null @@ -1,38 +0,0 @@ -{{/* RBAC Primary Validation */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.rbac.primaryValidation" $ -}} -*/}} - -{{- define "tc.v1.common.lib.rbac.primaryValidation" -}} - - {{/* Initialize values */}} - {{- $hasPrimary := false -}} - {{- $hasEnabled := false -}} - - {{- range $name, $rbac := .Values.rbac -}} - - {{/* If rbac is enabled */}} - {{- if $rbac.enabled -}} - {{- $hasEnabled = true -}} - - {{/* And rbac is primary */}} - {{- if and (hasKey $rbac "primary") ($rbac.primary) -}} - - {{/* Fail if there is already a primary rbac */}} - {{- if $hasPrimary -}} - {{- fail "RBAC - Only one rbac can be primary" -}} - {{- end -}} - - {{- $hasPrimary = true -}} - - {{- end -}} - - {{- end -}} - {{- end -}} - - {{/* Require at least one primary rbac, if any enabled */}} - {{- if and $hasEnabled (not $hasPrimary) -}} - {{- fail "RBAC - At least one enabled rbac must be primary" -}} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/scaleCertificate/_getData.tpl b/cloudflared-6.0.4/charts/common/templates/lib/scaleCertificate/_getData.tpl deleted file mode 100644 index 3f8214f..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/scaleCertificate/_getData.tpl +++ /dev/null @@ -1,40 +0,0 @@ -{{/* Get Certificate Data */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.scaleCertificate.getData" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: The object data of the certificate -*/}} -{{- define "tc.v1.common.lib.scaleCertificate.getData" -}} - {{- $objectData := .objectData -}} - {{- $rootCtx := .rootCtx -}} - - {{- $certID := (toString $objectData.id) -}} - - {{/* Make sure certificate exists */}} - {{- if hasKey $rootCtx.Values "ixCertificates" -}} - {{- if not $rootCtx.Values.ixCertificates -}} - {{- fail "Certificate - Expected non-empty " -}} - {{- end -}} - - {{- if not (hasKey $rootCtx.Values.ixCertificates $certID) -}} - {{- fail (printf "Certificate - Expected certificate with [%q] to exist in " $certID) -}} - {{- end -}} - {{- end -}} - - {{- $data := get $rootCtx.Values.ixCertificates $certID -}} - - {{- range $flag := (list "revoked" "expired") -}} - {{- if (get $data $flag) -}} - {{- fail (printf "Certificate - Expected non-%s certificate with [%q]" $flag $certID) -}} - {{- end -}} - {{- end -}} - - {{- range $key := (list "certificate" "privatekey") -}} - {{- if not (get $data $key) -}} - {{- fail (printf "Certificate - Expected non-empty [%s] in certificate with [%q] in " $key $certID) -}} - {{- end -}} - {{- end -}} - - - {{- $data | toJson -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/scaleCertificate/_validation.tpl b/cloudflared-6.0.4/charts/common/templates/lib/scaleCertificate/_validation.tpl deleted file mode 100644 index bd4f951..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/scaleCertificate/_validation.tpl +++ /dev/null @@ -1,18 +0,0 @@ -{{/* Certificate Validation */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.scaleCertificate.validation" (dict "objectData" $objectData) -}} -objectData: The object data of the certificate. -*/}} - -{{- define "tc.v1.common.lib.scaleCertificate.validation" -}} - {{- $objectData := .objectData -}} - - {{- if not $objectData.id -}} - {{- fail "Certificate - Expected non-empty " -}} - {{- end -}} - - {{- if and $objectData.targetSelector (not (kindIs "map" $objectData.targetSelector)) -}} - {{- fail (printf "Certificate - Expected to be a [map], but got [%s]" (kindOf $objectData.targetSelector)) -}} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/secret/_validation.tpl b/cloudflared-6.0.4/charts/common/templates/lib/secret/_validation.tpl deleted file mode 100644 index 5f930c5..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/secret/_validation.tpl +++ /dev/null @@ -1,25 +0,0 @@ -{{/* Secret Validation */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.secret.validation" (dict "objectData" $objectData) -}} -objectData: - labels: The labels of the secret. - annotations: The annotations of the secret. - data: The data of the secret. -*/}} - -{{- define "tc.v1.common.lib.secret.validation" -}} - {{- $objectData := .objectData -}} - - {{- if and ( not $objectData.data ) ( not $objectData.stringData ) -}} - {{- fail "Secret - Expected non-empty or " -}} - {{- end -}} - - {{- if and $objectData.data (not (kindIs "map" $objectData.data)) -}} - {{- fail (printf "Secret - Expected to be a dictionary, but got [%v]" (kindOf $objectData.data)) -}} - {{- end -}} - - {{- if and (hasKey $objectData "type") (not $objectData.type) -}} - {{- fail (printf "Secret - Found key, but it's empty") -}} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/service/_additionalAnnotations.tpl b/cloudflared-6.0.4/charts/common/templates/lib/service/_additionalAnnotations.tpl deleted file mode 100644 index ab4e8dc..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/service/_additionalAnnotations.tpl +++ /dev/null @@ -1,40 +0,0 @@ -{{/* Service - MetalLB Annotations */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.service.metalLBAnnotations" (dict "rootCtx" $rootCtx "objectData" $objectData "annotations" $annotations) -}} -rootCtx: The root context of the chart. -objectData: The object data of the service -annotations: The annotations variable reference, to append the MetalLB annotations -*/}} - -{{- define "tc.v1.common.lib.service.metalLBAnnotations" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - {{- $annotations := .annotations -}} - - {{- $sharedKey := include "tc.v1.common.lib.chart.names.fullname" $rootCtx -}} - - {{/* A custom shared key can be defined per service even between multiple charts */}} - {{- with $objectData.sharedKey -}} - {{- $sharedKey = tpl . $rootCtx -}} - {{- end -}} - - {{- if $rootCtx.Values.global.addMetalLBAnnotations -}} - {{- $_ := set $annotations "metallb.universe.tf/allow-shared-ip" $sharedKey -}} - {{- end -}} -{{- end -}} - -{{/* Service - Traefik Annotations */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.service.traefikAnnotations" (dict "rootCtx" $rootCtx "annotations" $annotations) -}} -rootCtx: The root context of the chart. -annotations: The annotations variable reference, to append the Traefik annotations -*/}} - -{{- define "tc.v1.common.lib.service.traefikAnnotations" -}} - {{- $rootCtx := .rootCtx -}} - {{- $annotations := .annotations -}} - - {{- if $rootCtx.Values.global.addTraefikAnnotations -}} - {{- $_ := set $annotations "traefik.ingress.kubernetes.io/service.serversscheme" "https" -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/service/_ports.tpl b/cloudflared-6.0.4/charts/common/templates/lib/service/_ports.tpl deleted file mode 100644 index 55585e9..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/service/_ports.tpl +++ /dev/null @@ -1,63 +0,0 @@ -{{/* Service - Ports */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.service.ports" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: The object data of the service -*/}} - -{{- define "tc.v1.common.lib.service.ports" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $tcpProtocols := (list "tcp" "http" "https") -}} - {{- range $name, $portValues := $objectData.ports -}} - {{- if $portValues.enabled -}} - {{- $protocol := $rootCtx.Values.fallbackDefaults.serviceProtocol -}} {{/* Default to fallback protocol, if no protocol is defined */}} - {{- $port := $portValues.port -}} - {{- $targetPort := $portValues.targetPort -}} - {{- $nodePort := $portValues.nodePort -}} - - {{/* Expand port */}} - {{- if (kindIs "string" $port) -}} - {{- $port = (tpl $port $rootCtx) -}} - {{- end -}} - {{- $port = int $port -}} - - {{/* Expand targetPort */}} - {{- if (kindIs "string" $targetPort) -}} - {{- $targetPort = tpl $targetPort $rootCtx -}} - {{- end -}} - {{- $targetPort = int $targetPort -}} - - {{/* Expand nodePort */}} - {{- if (kindIs "string" $nodePort) -}} - {{- $nodePort = tpl $nodePort $rootCtx -}} - {{- end -}} - {{- $nodePort = int $nodePort -}} - - {{- with $portValues.protocol -}} - {{- $protocol = tpl . $rootCtx -}} - - {{- if mustHas $protocol $tcpProtocols -}} - {{- $protocol = "tcp" -}} - {{- end -}} - {{- end }} -- name: {{ $name }} - port: {{ $port }} - protocol: {{ $protocol | upper }} - targetPort: {{ $targetPort | default $port }} {{/* If no targetPort, default to port */}} - {{- if (eq $objectData.type "NodePort") -}} - {{- if not $nodePort -}} - {{- fail "Service - Expected non-empty on NodePort service type" -}} - {{- end -}} - - {{- $minNodePort := int $rootCtx.Values.global.minNodePort -}} - {{- if (lt $nodePort $minNodePort) -}} - {{- fail (printf "Service - Expected to be higher than [%v], but got [%v]" $minNodePort $nodePort) -}} - {{- end }} - nodePort: {{ $nodePort }} - {{- end -}} - {{- end -}} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/service/_validation.tpl b/cloudflared-6.0.4/charts/common/templates/lib/service/_validation.tpl deleted file mode 100644 index 9c5c193..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/service/_validation.tpl +++ /dev/null @@ -1,133 +0,0 @@ -{{/* Service Validation */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.service.validation" (dict "objectData" $objectData) -}} -objectData: - rootCtx: The root context of the chart. - objectData: The service object. -*/}} - -{{- define "tc.v1.common.lib.service.validation" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- if and $objectData.targetSelector (not (kindIs "string" $objectData.targetSelector)) -}} - {{- fail (printf "Service - Expected to be [string], but got [%s]" (kindOf $objectData.targetSelector)) -}} - {{- end -}} - - {{- $svcTypes := (list "ClusterIP" "LoadBalancer" "NodePort" "ExternalName" "ExternalIP") -}} - {{- if and $objectData.type (not (mustHas $objectData.type $svcTypes)) -}} - {{- fail (printf "Service - Expected to be one of [%s] but got [%s]" (join ", " $svcTypes) $objectData.type) -}} - {{- end -}} - - {{- $hasEnabledPort := false -}} - {{- if ne $objectData.type "ExternalName" -}} - {{- range $name, $port := $objectData.ports -}} - {{- if $port.enabled -}} - {{- $hasEnabledPort = true -}} - - {{- if and $port.targetSelector (not (kindIs "string" $port.targetSelector)) -}} - {{- fail (printf "Service - Expected to be [string], but got [%s]" (kindOf $port.targetSelector)) -}} - {{- end -}} - - {{- if not $port.port -}} - {{- fail (printf "Service - Expected non-empty ") -}} - {{- end -}} - - {{- $protocolTypes := (list "tcp" "udp" "http" "https") -}} - {{- if $port.protocol -}} - {{- if not (mustHas (tpl $port.protocol $rootCtx) $protocolTypes) -}} - {{- fail (printf "Service - Expected to be one of [%s] but got [%s]" (join ", " $protocolTypes) $port.protocol) -}} - {{- end -}} - {{- end -}} - - {{- end -}} - {{- end -}} - - {{- if not $hasEnabledPort -}} - {{- fail "Service - Expected enabled service to have at least one port" -}} - {{- end -}} - {{- end -}} - -{{- end -}} - -{{/* Service Primary Validation */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.service.primaryValidation" $ -}} -*/}} - -{{- define "tc.v1.common.lib.service.primaryValidation" -}} - - {{/* Initialize values */}} - {{- $hasPrimary := false -}} - {{- $hasEnabled := false -}} - - {{- range $name, $service := .Values.service -}} - - {{/* If service is enabled */}} - {{- if $service.enabled -}} - {{- $hasEnabled = true -}} - - {{/* And service is primary */}} - {{- if and (hasKey $service "primary") ($service.primary) -}} - {{/* Fail if there is already a primary service */}} - {{- if $hasPrimary -}} - {{- fail "Service - Only one service can be primary" -}} - {{- end -}} - - {{- $hasPrimary = true -}} - - {{- include "tc.v1.common.lib.servicePort.primaryValidation" (dict "objectData" $service.ports) -}} - - {{- end -}} - - {{- end -}} - {{- end -}} - - {{/* Require at least one primary service, if any enabled */}} - {{- if and $hasEnabled (not $hasPrimary) -}} - {{- fail "Service - At least one enabled service must be primary" -}} - {{- end -}} - -{{- end -}} - -{{/* Service Port Primary Validation */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.service.primaryValidation" (dict "objectData" $objectData -}} -objectData: - The ports of the service. -*/}} - -{{- define "tc.v1.common.lib.servicePort.primaryValidation" -}} - {{- $objectData := .objectData -}} - - {{/* Initialize values */}} - {{- $hasPrimary := false -}} - {{- $hasEnabled := false -}} - - {{- range $name, $port := $objectData -}} - - {{/* If service is enabled */}} - {{- if $port.enabled -}} - {{- $hasEnabled = true -}} - - {{/* And service is primary */}} - {{- if and (hasKey $port "primary") ($port.primary) -}} - - {{/* Fail if there is already a primary port */}} - {{- if $hasPrimary -}} - {{- fail "Service - Only one port per service can be primary" -}} - {{- end -}} - - {{- $hasPrimary = true -}} - - {{- end -}} - - {{- end -}} - {{- end -}} - - {{/* Require at least one primary service, if any enabled */}} - {{- if and $hasEnabled (not $hasPrimary) -}} - {{- fail "Service - At least one enabled port in service must be primary" -}} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_cluster_ip.tpl b/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_cluster_ip.tpl deleted file mode 100644 index 97c8a37..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_cluster_ip.tpl +++ /dev/null @@ -1,16 +0,0 @@ -{{/* Service - clusterIP */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.service.clusterIP" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: The service object data -*/}} - -{{- define "tc.v1.common.lib.service.clusterIP" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData }} - - {{- with $objectData.clusterIP }} -clusterIP: {{ tpl . $rootCtx }} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_externalIPs.tpl b/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_externalIPs.tpl deleted file mode 100644 index fd53714..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_externalIPs.tpl +++ /dev/null @@ -1,17 +0,0 @@ -{{/* Service - externalIPs */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.service.externalIPs" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: The service object data -*/}} - -{{- define "tc.v1.common.lib.service.externalIPs" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- with $objectData.externalIPs -}} - {{- range . }} -- {{ tpl . $rootCtx }} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_externalTrafficPolicy.tpl b/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_externalTrafficPolicy.tpl deleted file mode 100644 index 55642a4..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_externalTrafficPolicy.tpl +++ /dev/null @@ -1,22 +0,0 @@ -{{/* Service - externalTrafficPolicy */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.service.externalTrafficPolicy" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: The service object data -*/}} - -{{- define "tc.v1.common.lib.service.externalTrafficPolicy" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData }} - - {{- with $objectData.externalTrafficPolicy }} - {{- $policy := tpl . $rootCtx -}} - {{- $policies := (list "Cluster" "Local") -}} - - {{- if not (mustHas $policy $policies) -}} - {{- fail (printf "Service - Expected to be one of [%s], but got [%s]" (join ", " $policies) $policy) -}} - {{- end }} -externalTrafficPolicy: {{ $policy }} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_ipFamily.tpl b/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_ipFamily.tpl deleted file mode 100644 index eebdd47..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_ipFamily.tpl +++ /dev/null @@ -1,38 +0,0 @@ -{{/* Service - ipFamily */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.service.ipFamily" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: The service object data -*/}} - -{{- define "tc.v1.common.lib.service.ipFamily" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- with $objectData.ipFamilyPolicy -}} - {{- $famPolicy := tpl . $rootCtx -}} - - {{- $stacks := (list "SingleStack" "PreferDualStack" "RequireDualStack") -}} - {{- if not (mustHas $famPolicy $stacks) -}} - {{- fail (printf "Service - Expected to be one of [%s], but got [%s]" (join ", " $stacks) $famPolicy) -}} - {{- end }} -ipFamilyPolicy: {{ $famPolicy }} - {{- end -}} - - {{- if and $objectData.ipFamilies (not (kindIs "slice" $objectData.ipFamilies)) -}} - {{- fail (printf "Service - Expected to be a list, but got a [%s]" (kindOf $objectData.ipFamilies)) -}} - {{- end -}} - - {{- with $objectData.ipFamilies }} -ipFamilies: - {{- range . }} - {{- $ipFam := tpl . $rootCtx -}} - - {{- $stacks := (list "IPv4" "IPv6") -}} - {{- if not (mustHas $ipFam $stacks) -}} - {{- fail (printf "Service - Expected to be one of [%s], but got [%s]" (join ", " $stacks) $ipFam) -}} - {{- end }} - - {{ $ipFam }} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_publishNotReadyAddresses.tpl b/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_publishNotReadyAddresses.tpl deleted file mode 100644 index 6f9626e..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_publishNotReadyAddresses.tpl +++ /dev/null @@ -1,19 +0,0 @@ -{{/* Service - publishNotReadyAddresses */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.service.publishNotReadyAddresses" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: The service object data -*/}} - -{{- define "tc.v1.common.lib.service.publishNotReadyAddresses" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData }} - - {{- $publishAddr := false -}} - - {{- if (kindIs "bool" $objectData.publishNotReadyAddresses) -}} - {{- $publishAddr = $objectData.publishNotReadyAddresses -}} - {{- end -}} - - {{- $publishAddr -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_sessionAffinity.tpl b/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_sessionAffinity.tpl deleted file mode 100644 index a06d2b6..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeConfig/_sessionAffinity.tpl +++ /dev/null @@ -1,42 +0,0 @@ -{{/* Service - Session Affinity */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.service.sessionAffinity" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: The service object data -*/}} - -{{- define "tc.v1.common.lib.service.sessionAffinity" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- with $objectData.sessionAffinity -}} - {{- $affinity := tpl . $rootCtx -}} - {{- $affinities := (list "ClientIP" "None") -}} - {{- if not (mustHas $affinity $affinities) -}} - {{- fail (printf "Service - Expected to be one of [%s], but got [%s]" (join ", " $affinities) $affinity) -}} - {{- end }} -sessionAffinity: {{ $affinity }} - {{- if eq $affinity "ClientIP" -}} - {{- with $objectData.sessionAffinityConfig -}} - {{- with .clientIP -}} - - {{- $timeout := .timeoutSeconds -}} - {{- if kindIs "string" $timeout -}} - {{- $timeout = tpl $timeout $rootCtx -}} - {{- end -}} - - {{- $timeout = int $timeout -}} - {{- if and $timeout (mustHas (kindOf $timeout) (list "float64" "int64" "int")) -}} - {{- if or (lt $timeout 0) (gt $timeout 86400) -}} - {{- fail (printf "Service - Expected to be between [0 - 86400], but got [%v]" $timeout) -}} - {{- end }} -sessionAffinityConfig: - clientIP: - timeoutSeconds: {{ $timeout }} - {{- end -}} - {{- end -}} - {{- end -}} - {{- end -}} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeSpecs/_clusterIP.tpl b/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeSpecs/_clusterIP.tpl deleted file mode 100644 index 9b45d4f..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeSpecs/_clusterIP.tpl +++ /dev/null @@ -1,21 +0,0 @@ -{{/* Service - ClusterIP Spec */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.service.spec.clusterIP" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: The service object data -*/}} - -{{- define "tc.v1.common.lib.service.spec.clusterIP" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData }} - -type: ClusterIP -publishNotReadyAddresses: {{ include "tc.v1.common.lib.service.publishNotReadyAddresses" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim }} - {{- with (include "tc.v1.common.lib.service.externalIPs" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim) }} -externalIPs: - {{- . | nindent 2 }} - {{- end -}} - {{- include "tc.v1.common.lib.service.sessionAffinity" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 0 }} - {{- include "tc.v1.common.lib.service.clusterIP" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 0 }} - {{- include "tc.v1.common.lib.service.ipFamily" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 0 }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeSpecs/_externalIP.tpl b/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeSpecs/_externalIP.tpl deleted file mode 100644 index e43e446..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeSpecs/_externalIP.tpl +++ /dev/null @@ -1,19 +0,0 @@ -{{/* Service - ExternalIP Spec */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.service.spec.externalIP" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: The service object data -*/}} - -{{- define "tc.v1.common.lib.service.spec.externalIP" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData }} - -publishNotReadyAddresses: {{ include "tc.v1.common.lib.service.publishNotReadyAddresses" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim }} - {{- with (include "tc.v1.common.lib.service.externalIPs" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim) }} -externalIPs: - {{- . | nindent 2 }} - {{- end -}} - {{- include "tc.v1.common.lib.service.sessionAffinity" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 0 }} - {{- include "tc.v1.common.lib.service.externalTrafficPolicy" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 0 }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeSpecs/_externalName.tpl b/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeSpecs/_externalName.tpl deleted file mode 100644 index 2f51214..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeSpecs/_externalName.tpl +++ /dev/null @@ -1,26 +0,0 @@ -{{/* Service - ExternalName Spec */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.service.spec.externalName" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: The service object data -*/}} - -{{- define "tc.v1.common.lib.service.spec.externalName" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData }} - - {{- if not $objectData.externalName -}} - {{- fail "Service - Expected non-empty on ExternalName service type." -}} - {{- end }} - -type: ExternalName -externalName: {{ tpl $objectData.externalName $rootCtx }} -publishNotReadyAddresses: {{ include "tc.v1.common.lib.service.publishNotReadyAddresses" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim }} - {{- with (include "tc.v1.common.lib.service.externalIPs" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim) }} -externalIPs: - {{- . | nindent 2 }} - {{- end }} - {{- include "tc.v1.common.lib.service.sessionAffinity" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 0 }} - {{- include "tc.v1.common.lib.service.clusterIP" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 0 }} - {{- include "tc.v1.common.lib.service.externalTrafficPolicy" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 0 }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeSpecs/_loadBalancer.tpl b/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeSpecs/_loadBalancer.tpl deleted file mode 100644 index 261c188..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeSpecs/_loadBalancer.tpl +++ /dev/null @@ -1,33 +0,0 @@ -{{/* Service - LoadBalancer Spec */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.service.spec.loadBalancer" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: The service object data -*/}} - -{{- define "tc.v1.common.lib.service.spec.loadBalancer" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData }} - -type: LoadBalancer -allocateLoadBalancerNodePorts: {{ $objectData.allocateLoadBalancerNodePorts | default false }} -publishNotReadyAddresses: {{ include "tc.v1.common.lib.service.publishNotReadyAddresses" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim }} - {{- with (include "tc.v1.common.lib.service.externalIPs" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim) }} -externalIPs: - {{- . | nindent 2 }} - {{- end -}} - {{- with $objectData.loadBalancerIP }} -loadBalancerIP: {{ tpl . $rootCtx }} - {{- end -}} - - {{- with $objectData.loadBalancerSourceRanges }} -loadBalancerSourceRanges: - {{- range . }} - - {{ tpl . $rootCtx }} - {{- end -}} - {{- end -}} - {{- include "tc.v1.common.lib.service.clusterIP" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 0 }} - {{- include "tc.v1.common.lib.service.ipFamily" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 0 }} - {{- include "tc.v1.common.lib.service.externalTrafficPolicy" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 0 }} - {{- include "tc.v1.common.lib.service.sessionAffinity" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 0 }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeSpecs/_nodePort.tpl b/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeSpecs/_nodePort.tpl deleted file mode 100644 index a6bb34f..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/service/serviceTypeSpecs/_nodePort.tpl +++ /dev/null @@ -1,22 +0,0 @@ -{{/* Service - NodePort Spec */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.service.spec.nodePort" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: The service object data -*/}} - -{{- define "tc.v1.common.lib.service.spec.nodePort" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData }} - -type: NodePort -publishNotReadyAddresses: {{ include "tc.v1.common.lib.service.publishNotReadyAddresses" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim }} - {{- with (include "tc.v1.common.lib.service.externalIPs" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim) }} -externalIPs: - {{- . | nindent 2 }} - {{- end -}} - {{- include "tc.v1.common.lib.service.sessionAffinity" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 0 }} - {{- include "tc.v1.common.lib.service.clusterIP" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 0 }} - {{- include "tc.v1.common.lib.service.ipFamily" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 0 }} - {{- include "tc.v1.common.lib.service.externalTrafficPolicy" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 0 }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/serviceAccount/_validation.tpl b/cloudflared-6.0.4/charts/common/templates/lib/serviceAccount/_validation.tpl deleted file mode 100644 index 6c82b2c..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/serviceAccount/_validation.tpl +++ /dev/null @@ -1,38 +0,0 @@ -{{/* Service Account Primary Validation */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.serviceAccount.primaryValidation" $ -}} -*/}} - -{{- define "tc.v1.common.lib.serviceAccount.primaryValidation" -}} - - {{/* Initialize values */}} - {{- $hasPrimary := false -}} - {{- $hasEnabled := false -}} - - {{- range $name, $serviceAccount := .Values.serviceAccount -}} - - {{/* If service account is enabled */}} - {{- if $serviceAccount.enabled -}} - {{- $hasEnabled = true -}} - - {{/* And service account is primary */}} - {{- if and (hasKey $serviceAccount "primary") ($serviceAccount.primary) -}} - - {{/* Fail if there is already a primary service account */}} - {{- if $hasPrimary -}} - {{- fail "Service Account - Only one service account can be primary" -}} - {{- end -}} - - {{- $hasPrimary = true -}} - - {{- end -}} - - {{- end -}} - {{- end -}} - - {{/* Require at least one primary service account, if any enabled */}} - {{- if and $hasEnabled (not $hasPrimary) -}} - {{- fail "Service Account - At least one enabled service account must be primary" -}} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/storage/_accessModes.tpl b/cloudflared-6.0.4/charts/common/templates/lib/storage/_accessModes.tpl deleted file mode 100644 index 7e45f68..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/storage/_accessModes.tpl +++ /dev/null @@ -1,32 +0,0 @@ -{{/* PVC - Access Modes */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.pvc.accessModes" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: The object data of the pvc -*/}} - -{{- define "tc.v1.common.lib.pvc.accessModes" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - {{- $caller := .caller -}} - - {{- $accessModes := $objectData.accessModes -}} - - {{- if kindIs "string" $accessModes -}} - {{- $accessModes = (list $accessModes) -}} - {{- end -}} - - {{- if not $accessModes -}} - {{- $accessModes = $rootCtx.Values.fallbackDefaults.accessModes -}} - {{- end -}} - - {{- $validAccessModes := (list "ReadWriteOnce" "ReadOnlyMany" "ReadWriteMany" "ReadWriteOncePod") -}} - - {{- range $accessModes -}} - {{- $mode := tpl . $rootCtx -}} - {{- if not (mustHas $mode $validAccessModes) -}} - {{- fail (printf "%s - Expected entry to be one of [%s], but got [%s]" $caller (join ", " $validAccessModes) $mode) -}} - {{- end }} -- {{ $mode }} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/storage/_storageClassName.tpl b/cloudflared-6.0.4/charts/common/templates/lib/storage/_storageClassName.tpl deleted file mode 100644 index a4f4f6d..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/storage/_storageClassName.tpl +++ /dev/null @@ -1,54 +0,0 @@ -{{/* PVC - Storage Class Name */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.storage.storageClassName" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: The object data of the pvc -*/}} -{{- define "tc.v1.common.lib.storage.storageClassName" -}} - {{- $objectData := .objectData -}} - {{- $rootCtx := .rootCtx -}} - {{- $caller := .caller -}} - - {{/* - If storageClass is defined on the objectData: - * "-" returns "", which means requesting a PV without class - * "SCALE-ZFS" returns the value set on Values.global.ixChartContext.storageClassName - (*) "SCALE-SMB" returns the value set on Values.global.ixChartContext.smbStorageClassName (Example for the future) - * Else return the original defined storageClass - - Else if we are in an ixChartContext, always return the storageClassName defined on the ixChartContext - - Else if there is a storageClass defined in Values.fallbackDefaults.storageClass, return this - - In any other case, return nothing - */}} - - {{- $className := "" -}} - {{- if $objectData.storageClass -}} - {{- $storageClass := (tpl $objectData.storageClass $rootCtx) -}} - - {{- if eq "-" $storageClass -}} - {{- $className = "\"\"" -}} - {{- else if eq "SCALE-ZFS" $storageClass -}} - {{- if not $rootCtx.Values.global.ixChartContext.storageClassName -}} - {{- fail (printf "%s - Expected non-empty on [SCALE-ZFS] storageClass" $caller) -}} - {{- end -}} - {{- $className = tpl $rootCtx.Values.global.ixChartContext.storageClassName $rootCtx -}} - {{- else -}} - {{- $className = tpl $storageClass $rootCtx -}} - {{- end -}} - - {{- else if $rootCtx.Values.global.ixChartContext -}} - {{- if not $rootCtx.Values.global.ixChartContext.storageClassName -}} - {{- fail (printf "%s - Expected non-empty " $caller) -}} - {{- end -}} - {{- $className = tpl $rootCtx.Values.global.ixChartContext.storageClassName $rootCtx -}} - - {{- else if $rootCtx.Values.fallbackDefaults.storageClass -}} - - {{- $className = tpl $rootCtx.Values.fallbackDefaults.storageClass $rootCtx -}} - - {{- end -}} - - {{- $className -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/storage/_validation.tpl b/cloudflared-6.0.4/charts/common/templates/lib/storage/_validation.tpl deleted file mode 100644 index 3c71a7b..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/storage/_validation.tpl +++ /dev/null @@ -1,39 +0,0 @@ -{{/* PVC Validation */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.persistence.validation" (dict "objectData" $objectData) -}} -objectData: - rootCtx: The root context of the chart. - objectData: The pvc object. -*/}} - -{{- define "tc.v1.common.lib.persistence.validation" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- $types := (list "pvc" "emptyDir" "nfs" "hostPath" "ixVolume" "secret" "configmap" "device") -}} - {{- if not (mustHas $objectData.type $types) -}} - {{- fail (printf "Persistence - Expected to be one of [%s], but got [%s]" (join ", " $types) $objectData.type) -}} - {{- end -}} - - {{- if and $objectData.targetSelector (not (kindIs "map" $objectData.targetSelector)) -}} - {{- fail (printf "Persistence - Expected to be [dict], but got [%s]" (kindOf $objectData.targetSelector)) -}} - {{- end -}} - -{{- end -}} - -{{/* VCT Validation */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.vct.validation" (dict "objectData" $objectData) -}} -objectData: - rootCtx: The root context of the chart. - objectData: The vct object. -*/}} - -{{- define "tc.v1.common.lib.vct.validation" -}} - {{- $objectData := .objectData -}} - - {{- if and $objectData.targetSelector (not (kindIs "map" $objectData.targetSelector)) -}} - {{- fail (printf "Volume Claim Templates - Expected to be [dict], but got [%s]" (kindOf $objectData.targetSelector)) -}} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/storage/_volumeClaimTemplates.tpl b/cloudflared-6.0.4/charts/common/templates/lib/storage/_volumeClaimTemplates.tpl deleted file mode 100644 index 37e55e0..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/storage/_volumeClaimTemplates.tpl +++ /dev/null @@ -1,66 +0,0 @@ -{{/* Returns Volume Claim Templates */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.storage.volumeClaimTemplates" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the Pod. -*/}} -{{- define "tc.v1.common.lib.storage.volumeClaimTemplates" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData -}} - - {{- range $name, $vctValues := $rootCtx.Values.volumeClaimTemplates -}} - - {{- if $vctValues.enabled -}} - {{- $vct := (mustDeepCopy $vctValues) -}} - - {{- $selected := false -}} - {{- $_ := set $vct "shortName" $name -}} - - {{- include "tc.v1.common.lib.vct.validation" (dict "objectData" $vct) -}} - {{- include "tc.v1.common.lib.chart.names.validation" (dict "name" $vct.shortName) -}} - {{- include "tc.v1.common.lib.metadata.validation" (dict "objectData" $vct "caller" "Volume Claim Templates") -}} - - {{/* If targetSelector is set, check if pod is selected */}} - {{- if $vct.targetSelector -}} - {{- if (mustHas $objectData.shortName (keys $vct.targetSelector)) -}} - {{- $selected = true -}} - {{- end -}} - - {{/* If no targetSelector is set or targetSelectAll, check if pod is primary */}} - {{- else -}} - {{- if $objectData.primary -}} - {{- $selected = true -}} - {{- end -}} - {{- end -}} - - {{/* If pod selected */}} - {{- if $selected -}} - {{- $vctSize := $rootCtx.Values.fallbackDefaults.vctSize -}} - {{- with $vct.size -}} - {{- $vctSize = tpl . $rootCtx -}} - {{- end }} -- metadata: - name: {{ $vct.shortName }} - {{- $labels := $vct.labels | default dict -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "labels" $labels) | trim) }} - labels: - {{- . | nindent 6 }} - {{- end -}} - {{- $annotations := $vct.annotations | default dict -}} - {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $rootCtx "annotations" $annotations) | trim) }} - annotations: - {{- . | nindent 6 }} - {{- end }} - spec: - {{- with (include "tc.v1.common.lib.storage.storageClassName" (dict "rootCtx" $rootCtx "objectData" $vct "caller" "Volume Claim Templates") | trim) }} - storageClassName: {{ . }} - {{- end }} - accessModes: - {{- include "tc.v1.common.lib.pvc.accessModes" (dict "rootCtx" $rootCtx "objectData" $vct "caller" "Volume Claim Templates") | trim | nindent 6 }} - resources: - requests: - storage: {{ $vctSize }} - {{- end -}} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/util/_autoperms.tpl b/cloudflared-6.0.4/charts/common/templates/lib/util/_autoperms.tpl deleted file mode 100644 index 773b45c..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/util/_autoperms.tpl +++ /dev/null @@ -1,144 +0,0 @@ -{{/* Contains the auto-permissions job */}} -{{- define "tc.v1.common.lib.util.autoperms" -}} - -{{- $permAllowedTypes := (list "hostPath" "emptyDir" "nfs" "ixVolume") -}} -{{/* If you change this path, you must change it under _volumeMounts.tpl too*/}} -{{- $basePath := "/mounts" -}} - -{{/* Init an empty dict to hold data */}} -{{- $mounts := dict -}} - -{{/* Go over persistence and gather needed data */}} -{{- range $name, $mount := .Values.persistence -}} - {{- if and $mount.enabled $mount.autoPermissions -}} - {{/* If autoPermissions is enabled...*/}} - {{- if $mount.autoPermissions.enabled -}} - {{- if or $mount.autoPermissions.chown $mount.autoPermissions.chmod -}} - {{- $type := $.Values.fallbackDefaults.persistenceType -}} - {{- if $mount.type -}} - {{- $type = $mount.type -}} - {{- end -}} - - {{- if not (mustHas $type $permAllowedTypes) -}} - {{- fail (printf "Auto Permissions - Allowed persistent types for auto permissions are [%v], but got [%v] on [%v]" (join ", " $permAllowedTypes) $type $name) -}} - {{- end -}} - - {{- if $mount.readOnly -}} - {{- fail (printf "Auto Permissions - You cannot change permissions/ownership automatically on [%v] with readOnly enabled" $name) -}} - {{- end -}} - - {{/* Add some data regarding what actions to perform */}} - {{- $_ := set $mounts $name $mount.autoPermissions -}} - {{- end -}} - {{- end -}} - {{- end -}} -{{- end -}} - -{{- if $mounts }} -enabled: true -type: Job -annotations: - "helm.sh/hook": pre-install, pre-upgrade - "helm.sh/hook-weight": "3" - "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation,hook-failed -podSpec: - restartPolicy: Never - containers: - # If you change this name, you must change it under _volumeMounts.tpl - autopermissions: - enabled: true - primary: true - imageSelector: alpineImage - securityContext: - runAsNonRoot: false - runAsUser: 0 - capabilities: - disableS6Caps: true - add: - - CHOWN - - DAC_OVERRIDE - - FOWNER - resources: - limits: - cpu: 2000m - memory: 2Gi - probes: - liveness: - type: exec - command: - - cat - - /tmp/healthy - readiness: - type: exec - command: - - cat - - /tmp/healthy - startup: - type: exec - command: - - cat - - /tmp/healthy - command: - - /bin/sh - - -c - args: - - | - echo "Starting auto permissions job..." - touch /tmp/healthy - - echo "Automatically correcting ownership and permissions..." - - {{- range $name, $vol := $mounts }} - {{- $mountPath := (printf "%v/%v" $basePath $name) -}} - - {{- $user := "" -}} - {{- if $vol.user -}} - {{- $user = $vol.user -}} - {{- end -}} - - {{- $group := $.Values.securityContext.pod.fsGroup -}} - {{- if $vol.group -}} - {{- $group = $vol.group -}} - {{- end -}} - - {{- $r := "" -}} - {{- if $vol.recursive -}} - {{- $r = "-$" -}} - {{- end -}} - - {{/* Permissions */}} - {{- if $vol.chmod }} - echo "Automatically correcting permissions for {{ $mountPath }}..." - before=$(stat -c "%a" {{ $mountPath }}) - chmod {{ $r }} {{ $vol.chmod }} {{ $mountPath }} || echo "Failed setting permissions using chmod..." - echo "Permissions after: [$before]" - echo "Permissions after: [$(stat -c "%a" {{ $mountPath }})]" - echo "" - {{- end -}} - - {{/* Ownership */}} - {{- if $vol.chown }} - echo "Automatically correcting ownership for {{ $mountPath }}..." - before=$(stat -c "%u:%g" {{ $mountPath }}) - {{- if $.Values.global.ixChartContext }}{{/* TODO: Add user here too? */}} - /usr/sbin/nfs4xdr_winacl -a chown -G {{ $group }} {{ $r | lower }} -c "{{ $mountPath }}" -p "{{ $mountPath }}" || echo "Failed setting ownership using winacl..." - {{- else }} - chown {{ $r }} -f {{ $user }}:{{ $group }} {{ $mountPath }} || echo "Failed setting ownership using chown..." - {{- end }} - - echo "Ownership before: [$before]" - echo "Ownership after: [$(stat -c "%u:%g" {{ $mountPath }})]" - echo "" - {{- end -}} - {{- end }} - echo "Finished auto permissions job..." -{{- end -}} -{{- end -}} - -{{- define "tc.v1.common.lib.util.autoperms.job" -}} - {{- $job := (include "tc.v1.common.lib.util.autoperms" $) | fromYaml -}} - {{- if $job -}} - # If you change this name, you must change it under _volumes.tpl - {{- $_ := set $.Values.workload "autopermissions" $job -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/util/_chartcontext.tpl b/cloudflared-6.0.4/charts/common/templates/lib/util/_chartcontext.tpl deleted file mode 100644 index 2d18d28..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/util/_chartcontext.tpl +++ /dev/null @@ -1,124 +0,0 @@ -{{/* Returns the primary Workload object */}} -{{- define "tc.v1.common.lib.util.chartcontext" -}} - {{/* Create defaults */}} - {{- $protocol := "https" -}} - {{- $host := "127.0.0.1" -}} - {{- $port := "443" -}} - {{- $url := "" -}} - {{- $podCIDR := "172.16.0.0/16" -}} - {{- $svcCIDR := "172.17.0.0/16" -}} - - {{/* set temporary storage for ingress name and port */}} - {{- $targetIngress := "" -}} - {{- $selectedIngress := "" -}} - - {{/* Get service, default to primary */}} - {{- $selectedService := fromYaml (include "tc.v1.common.lib.helpers.getSelectedServiceValues" (dict "rootCtx" $ )) -}} - - {{/* read loadbalancer IPs for metallb */}} - {{- if eq $selectedService.type "LoadBalancer" -}} - {{- with $selectedService.loadBalancerIP -}} - {{- $host = toString . -}} - {{- end -}} - - {{/* set temporary storage for port name and port */}} - {{- $targetPort := "" -}} - {{- $selectedPort := "" -}} - {{/* Fetch port values */}} - {{- $targetPort = include "tc.v1.common.lib.util.service.ports.primary" (dict "svcName" $selectedService.shortName "svcValues" $selectedService) -}} - {{- $selectedPort = get $selectedService.ports $targetPort -}} - {{/* store port number */}} - {{- $port = $selectedPort.port -}} - {{- end -}} - - {{/* Fetch ingress values */}} - {{- $targetIngress = include "tc.v1.common.lib.util.ingress.primary" $ -}} - {{- $selectedIngress = get $.Values.ingress $targetIngress -}} - - {{/* store host from ingress number */}} - {{- if $selectedIngress -}} - {{- if $selectedIngress.enabled -}} - {{- with (index $selectedIngress.hosts 0) -}} - {{- $host = .host -}} - {{- end -}} - {{/* Get the port for the ingress entrypoint */}} - - {{- $namespace := "tc-system" -}} - {{- if $.Values.operator.traefik -}} - {{- if $.Values.operator.traefik.namespace -}} - {{- $namespace = $.Values.operator.traefik.namespace -}} - {{- end -}} - {{- end -}} - - {{- if $selectedIngress.ingressClassName -}} - {{- if $.Values.global.ixChartContext -}} - {{- $namespace = (printf "ix-%s" $selectedIngress.ingressClassName) -}} - {{- else -}} - {{- $namespace = $selectedIngress.ingressClassName -}} - {{- end -}} - - {{- end -}} - - {{- $traefikportalhook := lookup "v1" "ConfigMap" $namespace "portalhook" -}} - {{- $entrypoint := "websecure" -}} - {{- if $selectedIngress.entrypoint -}} - {{- $entrypoint = $selectedIngress.entrypoint -}} - {{- end -}} - {{- if $traefikportalhook -}} - {{- if (index $traefikportalhook.data $entrypoint) -}} - {{- $port = (index $traefikportalhook.data $entrypoint) -}} - {{- end -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- $port = toString $port -}} - - {{/* sanitise */}} - {{- if eq $port "443" -}} - {{- $protocol = "https" -}} - {{- end -}} - - {{- if eq $port "80" -}} - {{- $protocol = "http" -}} - {{- end -}} - - {{- if or (and (eq $protocol "https") (eq $port "443")) (and (eq $protocol "http") (eq $port "80")) -}} - {{- $port = "" -}} - {{- end -}} - - {{/* Construct URL*/}} - {{- if $port -}} - {{- $url = printf "%s://%s:%s" $protocol $host $port -}} - {{- else -}} - {{- $url = printf "%s://%s" $protocol $host -}} - {{- end -}} - - {{/* TrueNAS SCALE specific code */}} - {{- if $.Values.global.ixChartContext -}} - {{- if $.Values.global.ixChartContext.kubernetes_config -}} - {{- $podCIDR = $.Values.global.ixChartContext.kubernetes_config.cluster_cidr -}} - {{- $svcCIDR = $.Values.global.ixChartContext.kubernetes_config.service_cidr -}} - {{- end -}} - {{- else -}} - {{/* TODO: Find ways to implement CIDR detection */}} - {{- end -}} - - {{- if $.Values.chartContext -}} - {{- if $.Values.chartContext.APPURL -}} - {{- $url = $.Values.chartContext.APPURL -}} - {{- end -}} - - {{- if $.Values.chartContext.podCIDR -}} - {{- $podCIDR = $.Values.chartContext.podCIDR -}} - {{- end -}} - - {{- if $.Values.chartContext.svcCIDR -}} - {{- $svcCIDR = $.Values.chartContext.svcCIDR -}} - {{- end -}} - {{- end -}} - - {{- $_ := set $.Values.chartContext "APPURL" $url -}} - {{- $_ := set $.Values.chartContext "podCIDR" $podCIDR -}} - {{- $_ := set $.Values.chartContext "svcCIDR" $svcCIDR -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/util/_primary_cnpg.tpl b/cloudflared-6.0.4/charts/common/templates/lib/util/_primary_cnpg.tpl deleted file mode 100644 index 07ea0c0..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/util/_primary_cnpg.tpl +++ /dev/null @@ -1,23 +0,0 @@ -{{/* Return the name of the primary cnpg object */}} -{{- define "tc.v1.common.lib.util.cnpg.primary" -}} - {{- $cnpgs := .Values.cnpg -}} - - {{- $enabledcnpges := dict -}} - {{- range $name, $cnpg := $cnpgs -}} - {{- if $cnpg.enabled -}} - {{- $_ := set $enabledcnpges $name . -}} - {{- end -}} - {{- end -}} - - {{- $result := "" -}} - {{- range $name, $cnpg := $enabledcnpges -}} - {{- if and (hasKey $cnpg "primary") $cnpg.primary -}} - {{- $result = $name -}} - {{- end -}} - {{- end -}} - - {{- if not $result -}} - {{- $result = keys $enabledcnpges | first -}} - {{- end -}} - {{- $result -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/util/_primary_ingress.tpl b/cloudflared-6.0.4/charts/common/templates/lib/util/_primary_ingress.tpl deleted file mode 100644 index e1e50b6..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/util/_primary_ingress.tpl +++ /dev/null @@ -1,23 +0,0 @@ -{{/* Return the name of the primary ingress object */}} -{{- define "tc.v1.common.lib.util.ingress.primary" -}} - {{- $ingresses := $.Values.ingress -}} - - {{- $enabledIngresses := dict -}} - {{- range $name, $ingress := $ingresses -}} - {{- if $ingress.enabled -}} - {{- $_ := set $enabledIngresses $name . -}} - {{- end -}} - {{- end -}} - - {{- $result := "" -}} - {{- range $name, $ingress := $enabledIngresses -}} - {{- if and (hasKey $ingress "primary") $ingress.primary -}} - {{- $result = $name -}} - {{- end -}} - {{- end -}} - - {{- if not $result -}} - {{- $result = keys $enabledIngresses | first -}} - {{- end -}} - {{- $result -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/util/_primary_metrics.tpl b/cloudflared-6.0.4/charts/common/templates/lib/util/_primary_metrics.tpl deleted file mode 100644 index f085399..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/util/_primary_metrics.tpl +++ /dev/null @@ -1,30 +0,0 @@ -{{/* Return the name of the primary metrics object */}} -{{- define "tc.v1.common.lib.util.metrics.primary" -}} - {{- $metrics := .Values.metrics -}} - - {{- $enabledMetrics := dict -}} - {{- range $name, $metrics := $metrics -}} - {{- if $metrics.enabled -}} - {{- $_ := set $enabledMetrics $name $metrics -}} - {{- end -}} - {{- end -}} - - {{- $result := "" -}} - {{- range $name, $metrics := $enabledMetrics -}} - {{- if (hasKey $metrics "primary") -}} - {{- if $metrics.primary -}} - {{- if $result -}} - {{- fail "More than one metrics are set as primary. This is not supported." -}} - {{- end -}} - {{- $result = $name -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if not $result -}} - {{- if eq (len $enabledMetrics) 1 -}} - {{- $result = keys $enabledMetrics | mustFirst -}} - {{- end -}} - {{- end -}} - {{- $result -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/util/_primary_port.tpl b/cloudflared-6.0.4/charts/common/templates/lib/util/_primary_port.tpl deleted file mode 100644 index f3e21a8..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/util/_primary_port.tpl +++ /dev/null @@ -1,41 +0,0 @@ -{{/* A dict containing .values and .serviceName is passed when this function is called */}} -{{/* Return the primary port for a given Service object. */}} -{{- define "tc.v1.common.lib.util.service.ports.primary" -}} - {{- $svcName := .svcName -}} - {{- $svcValues := .svcValues -}} - - {{- $enabledPorts := dict -}} - - {{- range $name, $port := $svcValues.ports -}} - {{- if $port.enabled -}} - {{- $_ := set $enabledPorts $name $port -}} - {{- end -}} - {{- end -}} - - {{- if not $enabledPorts -}} - {{- fail (printf "No ports are enabled for the service: (%s)" $svcName) -}} - {{- end -}} - - {{- $result := "" -}} - {{- range $name, $port := $enabledPorts -}} - {{- if (hasKey $port "primary") -}} - {{- if $port.primary -}} - {{- if $result -}} - {{- fail (printf "More than one ports are set as primary in the (%s) service. This is not supported." $svcName ) -}} - {{- end -}} - {{- $result = $name -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if not $result -}} - {{- if eq (len $enabledPorts) 1 -}} - {{- $result = keys $enabledPorts | mustFirst -}} - {{- else -}} - {{- if $enabledPorts -}} - {{- fail (printf "At least one port must be set as primary in service (%s)" $svcName) -}} - {{- end -}} - {{- end -}} - {{- end -}} - {{- $result -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/util/_primary_route.tpl b/cloudflared-6.0.4/charts/common/templates/lib/util/_primary_route.tpl deleted file mode 100644 index 04da801..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/util/_primary_route.tpl +++ /dev/null @@ -1,23 +0,0 @@ -{{/* Return the name of the primary route object */}} -{{- define "tc.v1.common.lib.util.route.primary" -}} - {{- $routees := $.Values.route -}} - - {{- $enabledroutees := dict -}} - {{- range $name, $route := $routees -}} - {{- if $route.enabled -}} - {{- $_ := set $enabledroutees $name . -}} - {{- end -}} - {{- end -}} - - {{- $result := "" -}} - {{- range $name, $route := $enabledroutees -}} - {{- if and (hasKey $route "primary") $route.primary -}} - {{- $result = $name -}} - {{- end -}} - {{- end -}} - - {{- if not $result -}} - {{- $result = keys $enabledroutees | first -}} - {{- end -}} - {{- $result -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/util/_primary_service.tpl b/cloudflared-6.0.4/charts/common/templates/lib/util/_primary_service.tpl deleted file mode 100644 index b661a25..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/util/_primary_service.tpl +++ /dev/null @@ -1,39 +0,0 @@ -{{/* Returns the primary service object */}} -{{- define "tc.v1.common.lib.util.service.primary" -}} - {{- $services := .services -}} - - {{- $enabledServices := dict -}} - {{- range $name, $service := $services -}} - {{- if $service.enabled -}} - {{- $_ := set $enabledServices $name $service -}} - {{- end -}} - {{- end -}} - - {{- $result := "" -}} - {{- range $name, $service := $enabledServices -}} - {{- if (hasKey $service "primary") -}} - {{- if $service.primary -}} - {{- if $result -}} - {{- fail "More than one services are set as primary. This is not supported." -}} - {{- end -}} - {{- $result = $name -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if not $result -}} - {{- if eq (len $enabledServices) 1 -}} - {{- $result = keys $enabledServices | mustFirst -}} - {{- else -}} - {{- if $enabledServices -}} - {{- fail "At least one Service must be set as primary" -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if $result -}} - {{- $result -}} - {{- else -}} - {{- fail "No primary and enabled service found" -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/util/_primary_workload.tpl b/cloudflared-6.0.4/charts/common/templates/lib/util/_primary_workload.tpl deleted file mode 100644 index b24836b..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/util/_primary_workload.tpl +++ /dev/null @@ -1,35 +0,0 @@ -{{/* Returns the primary Workload object */}} -{{- define "tc.v1.common.lib.util.workload.primary" -}} - {{- $Workloads := .workload -}} - - {{- $enabledWorkloads := dict -}} - {{- range $name, $Workload := $Workloads -}} - {{- if $Workload.enabled -}} - {{- $_ := set $enabledWorkloads $name $Workload -}} - {{- end -}} - {{- end -}} - - {{- $result := "" -}} - {{- range $name, $Workload := $enabledWorkloads -}} - {{- if (hasKey $Workload "primary") -}} - {{- if $Workload.primary -}} - {{- if $result -}} - {{- fail "More than one Workloads are set as primary. This is not supported." -}} - {{- end -}} - {{- $result = $name -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if not $result -}} - {{- if eq (len $enabledWorkloads) 1 -}} - {{- $result = keys $enabledWorkloads | mustFirst -}} - {{- else -}} - {{- if $enabledWorkloads -}} - {{- fail "At least one Workload must be set as primary" -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- $result -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/util/_register_operator.tpl b/cloudflared-6.0.4/charts/common/templates/lib/util/_register_operator.tpl deleted file mode 100644 index 682ec42..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/util/_register_operator.tpl +++ /dev/null @@ -1,25 +0,0 @@ -{{- define "tc.v1.common.lib.util.operator.register" -}} - {{- if .Values.operator.register -}} - - {{/* If it is an install operator check the operator does not exist */}} - {{/* We do not want to fail on upgrades, as the operator will always be present */}} - {{- if $.Release.IsInstall -}} - {{- $opExists := include "tc.v1.common.lib.util.operator.verify" (dict "rootCtx" $ "opName" $.Chart.Name) -}} - {{/* If the operator exists, fail to continue */}} - {{- if eq $opExists "true" -}} - {{- fail (printf "Operator [%v] is already installed. Can only be installed once" $.Chart.Name) -}} - {{- end -}} - {{- end -}} - - {{/* Create/Update the ConfigMap */}} - {{- $objectData := (dict "enabled" true - "data" (dict "tc-operator-name" $.Chart.Name - "tc-operator-version" $.Chart.Version)) -}} - {{/* data.tc-operator-name - The name the operator */}} - {{/* data.tc-operator-version - The version of the installed operator */}} - - {{/* Create a configmap with the above data */}} - {{/* Name will be expanded to "release-name-chart-name-tc-data" */}} - {{- $_ := set $.Values.configmap "tc-data" $objectData -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/util/_verify_operator.tpl b/cloudflared-6.0.4/charts/common/templates/lib/util/_verify_operator.tpl deleted file mode 100644 index 825f40b..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/util/_verify_operator.tpl +++ /dev/null @@ -1,123 +0,0 @@ -{{- define "tc.v1.common.lib.util.operator.verifyAll" -}} - {{- if .Values.operator.verify.enabled -}} - {{/* Go over all operators that need to be verified */}} - {{- $operatorList := .Values.operator.verify.additionalOperators -}} - - {{- $cnpg := false -}} - {{- range $opName := $.Values.cnpg -}} - {{- if .enabled -}} - {{- $cnpg = true -}} - {{- end -}} - {{- end -}} - {{- if $cnpg -}} - {{- $operatorList = mustAppend $operatorList "cloudnative-pg" -}} - {{- end -}} - - {{- $ingress := false -}} - {{- range $opName := $.Values.ingress -}} - {{- if .enabled -}} - {{- $ingress = true -}} - {{- end -}} - {{- end -}} - {{- if $ingress -}} - {{- $operatorList = mustAppend $operatorList "traefik" -}} - {{- end -}} - - {{- $metrics := false -}} - {{- range $opName := $.Values.metrics -}} - {{- if .enabled -}} - {{- $metrics = true -}} - {{- end -}} - {{- end -}} - {{- if $metrics -}} - {{- $operatorList = mustAppend $operatorList "prometheus-operator" -}} - {{- end -}} - - {{- range $opName := $operatorList -}} - {{- $fetchedOpData := include "tc.v1.common.lib.util.operator.verify" (dict "rootCtx" $ "opName" $opName) -}} - - {{/* If the operator was not found */}} - {{- if eq $fetchedOpData "false" -}} - {{/* Fail only if explicitly asked */}} - {{- if $.Values.operator.verify.failOnError -}} - {{- fail (printf "Operator [%s] has to be installed first" $opName) -}} - {{- end -}} - {{/* If $fetchedOpData is not false, we should have JSON data */}} - {{- else -}} - {{- $opData := ($fetchedOpData | fromJson) -}} - {{- $_ := set $.Values.operator $opName $opData -}} - - {{/* Prepare the data for the cache ConfigMap */}} - {{- $cacheDataWrite := (dict "enabled" true "data" $opData) -}} - {{/* Create/Update the Configmap - ConfigMap name will be expanded to "$fullname-operator-$opName" */}} - {{- $_ := set $.Values.configmap (printf "operator-%s" $opName) $cacheDataWrite -}} - {{- end -}} - {{- end -}} - {{- end -}} -{{- end -}} - -{{- define "tc.v1.common.lib.util.operator.verify" -}} - {{- $rootCtx := .rootCtx -}} - {{- $opName := .opName -}} - - {{- $opExists := false -}} - {{- $opData := dict -}} - {{- $fullname := (include "tc.v1.common.lib.chart.names.fullname" $rootCtx) -}} - {{- $cache := (lookup "v1" "ConfigMap" $rootCtx.Release.Namespace (printf "%v-operator-%v" $fullname $opName)) | default dict -}} - - {{- if $cache.data -}} - {{/* Fetch data that the operator itself stored in the tc-data configmap */}} - {{- $viaCache := (lookup "v1" "ConfigMap" $cache.data.namespace (printf "%v-tc-data" $fullname)) | default dict -}} - {{- if $viaCache -}} - {{- if not $viaCache.data -}} - {{- fail (printf "Operator - Expected [tc-data] ConfigMap to have non-empty [data] for operator [%v]" $opName) -}} - {{- end -}} - - {{- $name := (get $viaCache.data "tc-operator-name") -}} - {{- $version := (get $viaCache.data "tc-operator-version") -}} - - {{/* If fetched name does not matches the "$opName"... */}} - {{- if ne $name $opName -}} - {{- fail (printf "Operator - ConfigMap [tc-data] does not contain the operator [%v] name. Something went wrong." $opName) -}} - {{- end -}} - - {{/* If matches continue and mark operator as found */}} - {{- $opExists = true -}} - {{/* Prepare the data */}} - {{- $opData = (dict "name" $name - "namespace" $viaCache.metadata.namespace - "version" $version) -}} - {{- end -}} - {{- end -}} - - {{/* Go over all configmaps */}} - {{- if not $opExists -}} - {{- range $index, $cm := (lookup "v1" "ConfigMap" "" "").items -}} - {{- if $cm.data -}} - {{/* If "tc-operator-name" does not exist will return "" */}} - {{- $name := (get $cm.data "tc-operator-name") -}} - {{- $version := (get $cm.data "tc-operator-version") -}} - - {{/* If fetched name matches the "$opName"... */}} - {{- if eq $name $opName -}} - {{- if $opExists -}} - {{- fail (printf "Found duplicate configmaps for operator [%s]" $opName) -}} - {{- end -}} - - {{/* Mark operator as found*/}} - {{- $opExists = true -}} - {{- $opData = (dict "name" $name - "namespace" $cm.metadata.namespace - "version" $version) -}} - - {{- end -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if $opExists -}} {{/* If operator was found, return its data as JSON */}} - {{- $opData | toJson -}} - {{- else -}} {{/* If operator was not found, return stringified false */}} - {{- $opExists | toString -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/webhook/_admissionReviewVersions.tpl b/cloudflared-6.0.4/charts/common/templates/lib/webhook/_admissionReviewVersions.tpl deleted file mode 100644 index ff4a81d..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/webhook/_admissionReviewVersions.tpl +++ /dev/null @@ -1,8 +0,0 @@ -{{- define "tc.v1.common.lib.webhook.admissionReviewVersions" -}} - {{- $admissionReviewVersions := .admissionReviewVersions -}} - {{- $rootCtx := .rootCtx }} -admissionReviewVersions: - {{- range $admissionReviewVersions }} - - {{ tpl . $rootCtx }} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/webhook/_clientConfig.tpl b/cloudflared-6.0.4/charts/common/templates/lib/webhook/_clientConfig.tpl deleted file mode 100644 index 14b2444..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/webhook/_clientConfig.tpl +++ /dev/null @@ -1,22 +0,0 @@ -{{- define "tc.v1.common.lib.webhook.clientConfig" -}} - {{- $clientConfig := .clientConfig -}} - {{- $rootCtx := .rootCtx }} -clientConfig: - {{- if $clientConfig.caBundle }} - caBundle: {{ tpl $clientConfig.caBundle $rootCtx | quote }} - {{- end -}} - {{- if $clientConfig.url }} - url: {{ tpl $clientConfig.url $rootCtx | quote }} - {{- end -}} - {{- if $clientConfig.service }} - service: - name: {{ tpl $clientConfig.service.name $rootCtx }} - namespace: {{ tpl $clientConfig.service.namespace $rootCtx }} - {{- with $clientConfig.service.path }} - path: {{ tpl . $rootCtx | quote }} - {{- end -}} - {{- with $clientConfig.service.port }} - port: {{ tpl . $rootCtx }} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/webhook/_rules.tpl b/cloudflared-6.0.4/charts/common/templates/lib/webhook/_rules.tpl deleted file mode 100644 index dfa1952..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/webhook/_rules.tpl +++ /dev/null @@ -1,26 +0,0 @@ -{{- define "tc.v1.common.lib.webhook.rules" -}} - {{- $rules := .rules -}} - {{- $rootCtx := .rootCtx }} -rules: - {{- range $rule := $rules }} - - apiVersions: - {{- range $rule.apiVersions }} - - {{ tpl . $rootCtx | quote }} - {{- end }} - apiGroups: - {{- range $rule.apiGroups }} - - {{ tpl . $rootCtx | quote }} - {{- end }} - operations: - {{- range $rule.operations }} - - {{ tpl . $rootCtx | quote }} - {{- end }} - resources: - {{- range $rule.resources }} - - {{ tpl . $rootCtx | quote }} - {{- end -}} - {{- with $rule.scope }} - scope: {{ tpl . $rootCtx | quote }} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/webhook/_validation.tpl b/cloudflared-6.0.4/charts/common/templates/lib/webhook/_validation.tpl deleted file mode 100644 index 6ab05d4..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/webhook/_validation.tpl +++ /dev/null @@ -1,152 +0,0 @@ -{{- define "tc.v1.common.lib.webhook.validation" -}} - {{- $objectData := .objectData -}} - {{- $rootCtx := .rootCtx -}} - - {{- if not $objectData.type -}} - {{- fail (printf "Webhook - Expected in to not be empty" $objectData.shortName) -}} - {{- end -}} - - {{- $type := tpl $objectData.type $rootCtx -}} - {{- $types := (list "validating" "mutating") -}} - {{- if not (mustHas $type $types) -}} - {{- fail (printf "Webhook - Expected in to be one of [%s], but got [%v]" $objectData.shortName (join ", " $types) $type) -}} - {{- end -}} - - {{- if not $objectData.webhooks -}} - {{- fail (printf "Webhook - Expected in to not be empty" $objectData.shortName) -}} - {{- end -}} - - {{- if not (kindIs "slice" $objectData.webhooks) -}} - {{- fail (printf "Webhook - Expected in to be a list, but got [%v]" $objectData.shortName (kindOf $objectData.webhooks)) -}} - {{- end -}} - - {{- range $webhook := $objectData.webhooks -}} - {{- if not $webhook.name -}} - {{- fail (printf "Webhook - Expected in to not be empty" $objectData.shortName) -}} - {{- end -}} - - {{- $webhookName := tpl $webhook.name $rootCtx -}} - - {{- if not $webhook.admissionReviewVersions -}} - {{- fail (printf "Webhook - Expected in to not be empty" $objectData.shortName $webhookName) -}} - {{- end -}} - - {{- range $adm := $webhook.admissionReviewVersions -}} - {{- if not (kindIs "string" $adm) -}} - {{- fail (printf "Webhook - Expected in to be a string" $objectData.shortName $webhookName) -}} - {{- end -}} - {{- end -}} - - {{- if not $webhook.clientConfig -}} - {{- fail (printf "Webhook - Expected in to not be empty" $objectData.shortName $webhookName) -}} - {{- end -}} - - {{- with $webhook.clientConfig -}} - {{- if and .url .service -}} - {{- fail (printf "Webhook - Expected either or in to be defined, but got both" $objectData.shortName $webhookName) -}} - {{- end -}} - - {{- $service := .service -}} - - {{- if $service -}} - {{- if not $service.name -}} - {{- fail (printf "Webhook - Expected in to not be empty" $objectData.shortName $webhookName) -}} - {{- end -}} - - {{- if not $service.namespace -}} - {{- fail (printf "Webhook - Expected in to not be empty" $objectData.shortName $webhookName) -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- if not $webhook.rules -}} - {{- fail (printf "Webhook - Expected in to not be empty" $objectData.shortName $webhookName) -}} - {{- end -}} - - {{- if not (kindIs "slice" $webhook.rules) -}} - {{- fail (printf "Webhook - Expected in to be a list, but got [%v]" $objectData.shortName $webhookName (kindOf $webhook.rules)) -}} - {{- end -}} - - {{- range $rule := $webhook.rules -}} - {{- if not $rule.apiGroups -}} - {{- fail (printf "Webhook - Expected in to not be empty" $objectData.shortName $webhookName) -}} - {{- end -}} - - {{- if not $rule.apiVersions -}} - {{- fail (printf "Webhook - Expected in to not be empty" $objectData.shortName $webhookName) -}} - {{- end -}} - - {{- if not $rule.operations -}} - {{- fail (printf "Webhook - Expected in to not be empty" $objectData.shortName $webhookName) -}} - {{- end -}} - - {{- if not $rule.resources -}} - {{- fail (printf "Webhook - Expected in to not be empty" $objectData.shortName $webhookName) -}} - {{- end -}} - - {{- $scopes := (list "Cluster" "Namespaced" "*") -}} - {{- with $rule.scope -}} - {{- $scope := tpl . $rootCtx -}} - {{- if not (mustHas $scope $scopes) -}} - {{- fail (printf "Webhook - Expected in to be one of [%s], but got [%v]" $objectData.shortName $webhookName (join ", " $scopes) $scope) -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- with $webhook.failurePolicy -}} - {{- $policy := tpl . $rootCtx -}} - {{- $failPolicies := (list "Ignore" "Fail") -}} - {{- if not (mustHas $policy $failPolicies) -}} - {{- fail (printf "Webhook - Expected in to be one of [%s], but got [%v]" $objectData.shortName $webhookName (join ", " $failPolicies) $policy) -}} - {{- end -}} - {{- end -}} - - {{- with $webhook.matchPolicy -}} - {{- $policy := tpl . $rootCtx -}} - {{- $matchPolicies := (list "Exact" "Equivalent") -}} - {{- if not (mustHas $policy $matchPolicies) -}} - {{- fail (printf "Webhook - Expected in to be one of [%s], but got [%v]" $objectData.shortName $webhookName (join ", " $matchPolicies) $policy) -}} - {{- end -}} - {{- end -}} - - {{- if and (eq $type "validating") $webhook.reinvocationPolicy -}} - {{- fail (printf "Webhook - Expected [mutating] type in when is defined" $objectData.shortName $webhookName) -}} - {{- end -}} - - {{- if and (eq $type "mutating") $webhook.reinvocationPolicy -}} - {{- $policy := tpl $webhook.reinvocationPolicy $rootCtx -}} - {{- $reinvPolicies := (list "Never" "IfNeeded") -}} - {{- if not (mustHas $policy $reinvPolicies) -}} - {{- fail (printf "Webhook - Expected in to be one of [%s], but got [%v]" $objectData.shortName $webhookName (join ", " $reinvPolicies) $policy) -}} - {{- end -}} - {{- end -}} - - {{- with $webhook.sideEffects -}} - {{- $effect := tpl . $rootCtx -}} - {{- $sideEffects := (list "None" "NoneOnDryRun") -}} - {{- if not (mustHas $effect $sideEffects) -}} - {{- fail (printf "Webhook - Expected in to be one of [%s], but got [%v]" $objectData.shortName $webhookName (join ", " $sideEffects) $effect) -}} - {{- end -}} - {{- end -}} - - {{- if (hasKey $webhook "timeoutSeconds") -}} - {{- if (kindIs "invalid" $webhook.timeoutSeconds) -}} - {{- fail (printf "Webhook - Expected the defined key in to not be empty" $objectData.shortName $webhookName) -}} - {{- end -}} - - {{- if not (mustHas (kindOf $webhook.timeoutSeconds) (list "int" "int64" "float64")) -}} - {{- fail (printf "Webhook - Expected in to be an integer, but got [%v]" $objectData.shortName $webhookName (kindOf $webhook.timeoutSeconds)) -}} - {{- end -}} - - {{- if (lt (int $webhook.timeoutSeconds) 1) -}} - {{- fail (printf "Webhook - Expected in to be greater than 0, but got [%v]" $objectData.shortName $webhookName $webhook.timeoutSeconds) -}} - {{- end -}} - - {{- if (gt (int $webhook.timeoutSeconds) 30) -}} - {{- fail (printf "Webhook - Expected in to be less than 30, but got [%v]" $objectData.shortName $webhookName $webhook.timeoutSeconds) -}} - {{- end -}} - {{- end -}} - - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/webhook/_webhook.tpl b/cloudflared-6.0.4/charts/common/templates/lib/webhook/_webhook.tpl deleted file mode 100644 index f49ea21..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/webhook/_webhook.tpl +++ /dev/null @@ -1,31 +0,0 @@ -{{- define "tc.v1.common.lib.webhook" -}} - {{- $webhook := .webhook -}} - {{- $rootCtx := .rootCtx }} -- name: {{ tpl $webhook.name $rootCtx }} - {{- with $webhook.failurePolicy }} - failurePolicy: {{ tpl . $rootCtx }} - {{- end -}} - {{- with $webhook.matchPolicy }} - matchPolicy: {{ tpl . $rootCtx }} - {{- end -}} - {{- with $webhook.reinvocationPolicy }} - reinvocationPolicy: {{ tpl . $rootCtx }} - {{- end -}} - {{- with $webhook.sideEffects }} - sideEffects: {{ tpl . $rootCtx }} - {{- end -}} - {{- with $webhook.timeoutSeconds }} - timeoutSeconds: {{ . }} - {{- end -}} - {{- include "tc.v1.common.lib.webhook.admissionReviewVersions" (dict "rootCtx" $rootCtx "admissionReviewVersions" $webhook.admissionReviewVersions) | trim | nindent 2 -}} - {{- include "tc.v1.common.lib.webhook.clientConfig" (dict "rootCtx" $rootCtx "clientConfig" $webhook.clientConfig) | trim | nindent 2 -}} - {{- include "tc.v1.common.lib.webhook.rules" (dict "rootCtx" $rootCtx "rules" $webhook.rules) | trim | nindent 2 -}} - {{- with $webhook.namespaceSelector }} - namespaceSelector: - {{- tpl (toYaml $webhook.namespaceSelector) $rootCtx | nindent 2 -}} - {{- end -}} - {{- with $webhook.objectSelector }} - objectSelector: - {{- tpl (toYaml $webhook.objectSelector) $rootCtx | nindent 2 -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/workload/_cronjobSpec.tpl b/cloudflared-6.0.4/charts/common/templates/lib/workload/_cronjobSpec.tpl deleted file mode 100644 index f890d27..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/workload/_cronjobSpec.tpl +++ /dev/null @@ -1,31 +0,0 @@ -{{/* CronJob Spec */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.workload.cronjobSpec" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: - schedule: The schedule in Cron format, see https://en.wikipedia.org/wiki/Cron. - concurrencyPolicy: Allow, Forbid, or Replace. Defaults to Allow. - failedJobsHistoryLimit: The number of failed finished jobs to retain. Defaults to 1. - successfulJobsHistoryLimit: The number of successful finished jobs to retain. Defaults to 3. - startingDeadlineSeconds: Optional deadline in seconds for starting the job if it misses scheduled time for any reason. Defaults to nil. - timezone: The timezone name. Defaults to .Values.TZ - +jobSpec data -*/}} -{{- define "tc.v1.common.lib.workload.cronjobSpec" -}} - {{- $objectData := .objectData -}} - {{- $rootCtx := .rootCtx -}} - {{- $suspend := $objectData.suspend | default false -}} - {{- if $rootCtx.Values.global.stopAll -}} - {{- $suspend = true -}} - {{- end }} -timeZone: {{ (tpl ($objectData.timezone | default $rootCtx.Values.TZ) $rootCtx) | quote }} -schedule: {{ (tpl $objectData.schedule $rootCtx) | quote }} -concurrencyPolicy: {{ $objectData.concurrencyPolicy | default "Forbid" }} -failedJobsHistoryLimit: {{ $objectData.failedJobsHistoryLimit | default 1 }} -successfulJobsHistoryLimit: {{ $objectData.successfulJobsHistoryLimit | default 3 }} -startingDeadlineSeconds: {{ $objectData.startingDeadlineSeconds | default 600 }} -suspend: {{ $suspend }} -jobTemplate: - spec: - {{- include "tc.v1.common.lib.workload.jobSpec" (dict "rootCtx" $rootCtx "objectData" $objectData) | indent 4 }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/workload/_daemonsetSpec.tpl b/cloudflared-6.0.4/charts/common/templates/lib/workload/_daemonsetSpec.tpl deleted file mode 100644 index 82e5aba..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/workload/_daemonsetSpec.tpl +++ /dev/null @@ -1,27 +0,0 @@ -{{/* DaemonSet Spec */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.workload.daemonsetSpec" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: - revisionHistoryLimit: The number of old ReplicaSets to retain to allow rollback. - strategy: The daemonset strategy to use to replace existing pods with new ones. -*/}} -{{- define "tc.v1.common.lib.workload.daemonsetSpec" -}} - {{- $objectData := .objectData -}} - {{- $rootCtx := .rootCtx -}} - {{- $strategy := $objectData.strategy | default "RollingUpdate" }} -revisionHistoryLimit: {{ $objectData.revisionHistoryLimit | default 3 }} -updateStrategy: - type: {{ $strategy }} - {{- if and (eq $objectData.strategy "RollingUpdate") $objectData.rollingUpdate -}} - {{ if (or (hasKey $objectData.rollingUpdate "maxUnavailable") (hasKey $objectData.rollingUpdate "maxSurge")) }} - rollingUpdate: - {{- if hasKey $objectData.rollingUpdate "maxUnavailable" }} - maxUnavailable: {{ $objectData.rollingUpdate.maxUnavailable }} - {{- end -}} - {{- if hasKey $objectData.rollingUpdate "maxSurge" }} - maxSurge: {{ $objectData.rollingUpdate.maxSurge }} - {{- end -}} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/workload/_deploymentSpec.tpl b/cloudflared-6.0.4/charts/common/templates/lib/workload/_deploymentSpec.tpl deleted file mode 100644 index b5f1d34..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/workload/_deploymentSpec.tpl +++ /dev/null @@ -1,36 +0,0 @@ -{{/* Deployment Spec */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.workload.deploymentSpec" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: - replicas: The number of replicas. - revisionHistoryLimit: The number of old ReplicaSets to retain to allow rollback. - strategy: The deployment strategy to use to replace existing pods with new ones. -*/}} -{{- define "tc.v1.common.lib.workload.deploymentSpec" -}} - {{- $objectData := .objectData -}} - {{- $rootCtx := .rootCtx -}} - {{- $strategy := $objectData.strategy | default "Recreate" -}} - {{- $replicas := 1 -}} - {{- if hasKey $objectData "replicas" -}} - {{- $replicas = $objectData.replicas -}} - {{- end -}} - {{- if $rootCtx.Values.global.stopAll -}} - {{- $replicas = 0 -}} - {{- end }} -replicas: {{ $replicas }} -revisionHistoryLimit: {{ $objectData.revisionHistoryLimit | default 3 }} -strategy: - type: {{ $strategy }} - {{- if and (eq $objectData.strategy "RollingUpdate") $objectData.rollingUpdate -}} - {{ if (or (hasKey $objectData.rollingUpdate "maxUnavailable") (hasKey $objectData.rollingUpdate "maxSurge")) }} - rollingUpdate: - {{- if hasKey $objectData.rollingUpdate "maxUnavailable" }} - maxUnavailable: {{ $objectData.rollingUpdate.maxUnavailable }} - {{- end -}} - {{- if hasKey $objectData.rollingUpdate "maxSurge" }} - maxSurge: {{ $objectData.rollingUpdate.maxSurge }} - {{- end -}} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/workload/_jobSpec.tpl b/cloudflared-6.0.4/charts/common/templates/lib/workload/_jobSpec.tpl deleted file mode 100644 index 4d7b9be..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/workload/_jobSpec.tpl +++ /dev/null @@ -1,31 +0,0 @@ -{{/* Job Spec */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.workload.jobSpec" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: - backoffLimit: The number of retries before marking this job failed. Defaults to 6. - completions: The desired number of successfully finished pods the job should be run with. Defaults to 1. - parallelism: The maximum desired number of pods the job should run at any given time. Defaults to 1. - activeDeadlineSeconds: Specifies the duration in seconds relative to the startTime that the job may be active before the system tries to terminate it; value must be positive integer. If set to nil, the job is never terminated due to timeout. - ttlSecondsAfterFinished: TTLSecondsAfterFinished limits the lifetime of a Job that has finished execution (either Complete or Failed). If this field is set, ttlSecondsAfterFinished after the Job finishes, it is eligible to be automatically deleted. When the Job is being deleted, its lifecycle guarantees (e.g. finalizers) will be honored. If this field is unset, the Job won't be automatically deleted. If this field is set to zero, the Job becomes eligible to be deleted immediately after it finishes. This field is alpha-level and is only honored by servers that enable the TTLAfterFinished feature. - completionMode: CompletionMode specifies how Pod completions are tracked. It can be `NonIndexed` (default) or `Indexed`. -*/}} -{{- define "tc.v1.common.lib.workload.jobSpec" -}} - {{- $objectData := .objectData -}} - {{- $rootCtx := .rootCtx -}} - {{- $parallelism := 1 -}} - {{- if hasKey $objectData "parallelism" -}} - {{- $parallelism = $objectData.parallelism -}} - {{- end -}} - {{- if $rootCtx.Values.global.stopAll -}} - {{- $parallelism = 0 -}} - {{- end }} -backoffLimit: {{ $objectData.backoffLimit | default 5 }} -completionMode: {{ $objectData.completionMode | default "NonIndexed" }} -completions: {{ $objectData.completions | default nil }} -parallelism: {{ $parallelism }} -ttlSecondsAfterFinished: {{ $objectData.ttlSecondsAfterFinished | default 120 }} - {{- with $objectData.activeDeadlineSeconds }} -activeDeadlineSeconds: {{ . }} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/workload/_pod.tpl b/cloudflared-6.0.4/charts/common/templates/lib/workload/_pod.tpl deleted file mode 100644 index b21f9f0..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/workload/_pod.tpl +++ /dev/null @@ -1,61 +0,0 @@ -{{/* Pod Spec */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.workload.pod" (dict "rootCtx" $ "objectData" $objectData) }} -rootCtx: The root context of the chart. -objectData: The object data to be used to render the Pod. -*/}} -{{- define "tc.v1.common.lib.workload.pod" -}} - {{- $rootCtx := .rootCtx -}} - {{- $objectData := .objectData }} -serviceAccountName: {{ include "tc.v1.common.lib.pod.serviceAccountName" (dict "rootCtx" $rootCtx "objectData" $objectData) }} -automountServiceAccountToken: {{ include "tc.v1.common.lib.pod.automountServiceAccountToken" (dict "rootCtx" $rootCtx "objectData" $objectData) }} -runtimeClassName: {{ include "tc.v1.common.lib.pod.runtimeClassName" (dict "rootCtx" $rootCtx "objectData" $objectData) }} - {{- with (include "tc.v1.common.lib.pod.imagePullSecret" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim) }} -imagePullSecrets: - {{- . | nindent 2 }} - {{- end }} -hostNetwork: {{ include "tc.v1.common.lib.pod.hostNetwork" (dict "rootCtx" $rootCtx "objectData" $objectData) }} -hostPID: {{ include "tc.v1.common.lib.pod.hostPID" (dict "rootCtx" $rootCtx "objectData" $objectData) }} -shareProcessNamespace: {{ include "tc.v1.common.lib.pod.shareProcessNamespace" (dict "rootCtx" $rootCtx "objectData" $objectData) }} -enableServiceLinks: {{ include "tc.v1.common.lib.pod.enableServiceLinks" (dict "rootCtx" $rootCtx "objectData" $objectData) }} -restartPolicy: {{ include "tc.v1.common.lib.pod.restartPolicy" (dict "rootCtx" $rootCtx "objectData" $objectData) }} - {{- with (include "tc.v1.common.lib.pod.schedulerName" (dict "rootCtx" $rootCtx "objectData" $objectData)) }} -schedulerName: {{ . }} - {{- end -}} - {{- with (include "tc.v1.common.lib.pod.priorityClassName" (dict "rootCtx" $rootCtx "objectData" $objectData)) }} -priorityClassName: {{ . }} - {{- end -}} - {{- with (include "tc.v1.common.lib.pod.nodeSelector" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim) }} -nodeSelector: - {{- . | nindent 2 }} - {{- end -}} - {{- with (include "tc.v1.common.lib.pod.hostAliases" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim) }} -hostAliases: - {{- . | nindent 2 }} - {{- end -}} - {{- with (include "tc.v1.common.lib.pod.hostname" (dict "rootCtx" $rootCtx "objectData" $objectData)) }} -hostname: {{ . }} - {{- end -}} - {{- include "tc.v1.common.lib.pod.dns" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} - {{- with (include "tc.v1.common.lib.pod.terminationGracePeriodSeconds" (dict "rootCtx" $rootCtx "objectData" $objectData)) }} -terminationGracePeriodSeconds: {{ . }} - {{- end -}} - {{- with (include "tc.v1.common.lib.pod.tolerations" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim) }} -tolerations: - {{- . | nindent 2 }} - {{- end }} -securityContext: - {{- include "tc.v1.common.lib.pod.securityContext" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 2 }} - {{- if $objectData.podSpec.containers }} -containers: - {{- include "tc.v1.common.lib.pod.containerSpawner" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 2 -}} - {{- end -}} - {{- if $objectData.podSpec.initContainers }} -initContainers: - {{- include "tc.v1.common.lib.pod.initContainerSpawner" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 2 -}} - {{- end -}} - {{- with (include "tc.v1.common.lib.pod.volumes" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim) }} -volumes: - {{- . | nindent 2 }} -{{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/workload/_statefulsetSpec.tpl b/cloudflared-6.0.4/charts/common/templates/lib/workload/_statefulsetSpec.tpl deleted file mode 100644 index 54969a6..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/workload/_statefulsetSpec.tpl +++ /dev/null @@ -1,37 +0,0 @@ -{{/* StatefulSet Spec */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.workload.statefulsetSpec" (dict "rootCtx" $rootCtx "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: - replicas: The number of replicas. - revisionHistoryLimit: The number of old ReplicaSets to retain to allow rollback. - strategy: The statefulset strategy to use to replace existing pods with new ones. -*/}} -{{- define "tc.v1.common.lib.workload.statefulsetSpec" -}} - {{- $objectData := .objectData -}} - {{- $rootCtx := .rootCtx -}} - {{- $strategy := $objectData.strategy | default "RollingUpdate" -}} - {{- $replicas := 1 -}} - {{- if hasKey $objectData "replicas" -}} - {{- $replicas = $objectData.replicas -}} - {{- end -}} - {{- if $rootCtx.Values.global.stopAll -}} - {{- $replicas = 0 -}} - {{- end }} -replicas: {{ $replicas }} -revisionHistoryLimit: {{ $objectData.revisionHistoryLimit | default 3 }} -serviceName: {{ $objectData.name }} -updateStrategy: - type: {{ $strategy }} - {{- if and (eq $objectData.strategy "RollingUpdate") $objectData.rollingUpdate -}} - {{- if (or (hasKey $objectData.rollingUpdate "maxUnavailable") (hasKey $objectData.rollingUpdate "partition")) }} - rollingUpdate: - {{- if hasKey $objectData.rollingUpdate "maxUnavailable" }} - maxUnavailable: {{ $objectData.rollingUpdate.maxUnavailable }} - {{- end -}} - {{- if hasKey $objectData.rollingUpdate "partition" }} - partition: {{ $objectData.rollingUpdate.partition }} - {{- end -}} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_cronjobValidation.tpl b/cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_cronjobValidation.tpl deleted file mode 100644 index 3d251bb..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_cronjobValidation.tpl +++ /dev/null @@ -1,29 +0,0 @@ -{{/* CronJob Validation */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.workload.cronjobValidation" (dict "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: - completionMode: The completionMode of the object. - completions: The completions of the object. - parallelism: The parallelism of the object. -*/}} -{{- define "tc.v1.common.lib.workload.cronjobValidation" -}} - {{- $objectData := .objectData -}} - - {{- if $objectData.concurrencyPolicy -}} - {{- $concurrencyPolicy := $objectData.concurrencyPolicy -}} - - {{- $policies := (list "Allow" "Forbid" "Replace") -}} - {{- if not (mustHas $concurrencyPolicy $policies) -}} - {{- fail (printf "CronJob - Expected to be one of [%s], but got [%v]" (join ", " $policies) $concurrencyPolicy) -}} - {{- end -}} - - {{- end -}} - - {{- if not $objectData.schedule -}} - {{- fail "CronJob - Expected non-empty " -}} - {{- end -}} - - {{/* CronJob contains a job inside, so we validate job values too */}} - {{- include "tc.v1.common.lib.workload.jobValidation" (dict "objectData" $objectData) -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_daemonsetValidation.tpl b/cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_daemonsetValidation.tpl deleted file mode 100644 index 58fa18e..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_daemonsetValidation.tpl +++ /dev/null @@ -1,30 +0,0 @@ -{{/* DaemonSet Validation */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.workload.daemonsetValidation" (dict "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: - strategy: The strategy of the object. - rollingUpdate: The rollingUpdate of the object. -*/}} -{{- define "tc.v1.common.lib.workload.daemonsetValidation" -}} - {{- $objectData := .objectData -}} - - {{- if $objectData.strategy -}} - {{- $strategy := $objectData.strategy -}} - - {{- $strategies := (list "OnDelete" "RollingUpdate") -}} - {{- if not (mustHas $strategy $strategies) -}} - {{- fail (printf "DaemonSet - Expected to be one of [%s], but got [%v]" (join ", " $strategies) $strategy) -}} - {{- end -}} - - {{- end -}} - - {{- if $objectData.rollingUpdate -}} - {{- $rollUp := $objectData.rollingUpdate -}} - - {{- if and $rollUp (not (kindIs "map" $rollUp)) -}} - {{- fail (printf "DaemonSet - Expected to be a dictionary, but got [%v]" (kindOf $rollUp)) -}} - {{- end -}} - - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_deploymentValidation.tpl b/cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_deploymentValidation.tpl deleted file mode 100644 index 40a6dcd..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_deploymentValidation.tpl +++ /dev/null @@ -1,30 +0,0 @@ -{{/* Deployment Validation */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.workload.deploymentValidation" (dict "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: - strategy: The strategy of the object. - rollingUpdate: The rollingUpdate of the object. -*/}} -{{- define "tc.v1.common.lib.workload.deploymentValidation" -}} - {{- $objectData := .objectData -}} - - {{- if $objectData.strategy -}} - {{- $strategy := $objectData.strategy -}} - - {{- $strategies := (list "Recreate" "RollingUpdate") -}} - {{- if not (mustHas $strategy $strategies) -}} - {{- fail (printf "Deployment - Expected to be one of [%s], but got [%v]" (join ", " $strategies) $strategy) -}} - {{- end -}} - - {{- end -}} - - {{- if $objectData.rollingUpdate -}} - {{- $rollUp := $objectData.rollingUpdate -}} - - {{- if and $rollUp (not (kindIs "map" $rollUp)) -}} - {{- fail (printf "Deployment - Expected to be a dictionary, but got [%v]" (kindOf $rollUp)) -}} - {{- end -}} - - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_jobValidation.tpl b/cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_jobValidation.tpl deleted file mode 100644 index bd93ea3..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_jobValidation.tpl +++ /dev/null @@ -1,32 +0,0 @@ -{{/* Job Validation */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.workload.jobValidation" (dict "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: - completionMode: The completionMode of the object. - completions: The completions of the object. - parallelism: The parallelism of the object. -*/}} -{{- define "tc.v1.common.lib.workload.jobValidation" -}} - {{- $objectData := .objectData -}} - - {{- if $objectData.completionMode -}} - {{- $completionMode := $objectData.completionMode -}} - - {{- if not (mustHas $completionMode (list "Indexed" "NonIndexed")) -}} - {{- fail (printf "Job - Expected to be one of [Indexed, NonIndexed], but got [%v]" $completionMode) -}} - {{- end -}} - - {{- if eq $completionMode "Indexed" -}} - {{- if not $objectData.completions -}} - {{- fail "Job - Expected to be set when is set to [Indexed]" -}} - {{- end -}} - - {{- if not $objectData.parallelism -}} - {{- fail "Job - Expected to be set when is set to [Indexed]" -}} - {{- end -}} - {{- end -}} - - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_statefusetValidation.tpl b/cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_statefusetValidation.tpl deleted file mode 100644 index 6e75b08..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_statefusetValidation.tpl +++ /dev/null @@ -1,30 +0,0 @@ -{{/* StatefulSet Validation */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.workload.statefulsetValidation" (dict "objectData" $objectData) -}} -rootCtx: The root context of the chart. -objectData: - strategy: The strategy of the object. - rollingUpdate: The rollingUpdate of the object. -*/}} -{{- define "tc.v1.common.lib.workload.statefulsetValidation" -}} - {{- $objectData := .objectData -}} - - {{- if $objectData.strategy -}} - {{- $strategy := $objectData.strategy -}} - - {{- $strategies := (list "OnDelete" "RollingUpdate") -}} - {{- if not (mustHas $strategy $strategies) -}} - {{- fail (printf "StatefulSet - Expected to be one of [%s], but got [%v]" (join ", " $strategies) $strategy) -}} - {{- end -}} - - {{- end -}} - - {{- if $objectData.rollingUpdate -}} - {{- $rollUp := $objectData.rollingUpdate -}} - - {{- if and $rollUp (not (kindIs "map" $rollUp)) -}} - {{- fail (printf "StatefulSet - Expected to be a dictionary, but got [%v]" (kindOf $rollUp)) -}} - {{- end -}} - - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_workloadValidation.tpl b/cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_workloadValidation.tpl deleted file mode 100644 index 4a8818f..0000000 --- a/cloudflared-6.0.4/charts/common/templates/lib/workload/validation/_workloadValidation.tpl +++ /dev/null @@ -1,43 +0,0 @@ -{{/* Workload Basic Validation */}} -{{/* Call this template: -{{ include "tc.v1.common.lib.workload.primaryValidation" $ -}} -*/}} -{{- define "tc.v1.common.lib.workload.primaryValidation" -}} - - {{/* Initialize values */}} - {{- $hasPrimary := false -}} - {{- $hasEnabled := false -}} - - {{/* Go over workload */}} - {{- range $name, $workload := .Values.workload -}} - - {{/* If workload is enabled */}} - {{- if $workload.enabled -}} - - {{- $types := (list "Deployment" "StatefulSet" "DaemonSet" "Job" "CronJob") -}} - {{- if not (mustHas $workload.type $types) -}} - {{- fail (printf "Workload - Expected to be one of [%s], but got [%s]" (join ", " $types) $workload.type) -}} - {{- end -}} - - {{- $hasEnabled = true -}} - - {{/* And workload is primary */}} - {{- if $workload.primary -}} - {{/* Fail if there is already a primary workload */}} - {{- if $hasPrimary -}} - {{- fail "Workload - Only one workload can be primary" -}} - {{- end -}} - - {{- $hasPrimary = true -}} - - {{- end -}} - {{- end -}} - - {{- end -}} - - {{/* Require at one primary workload, if any enabled */}} - {{- if and $hasEnabled (not $hasPrimary) -}} - {{- fail "Workload - One enabled workload must be primary" -}} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/loader/_all.tpl b/cloudflared-6.0.4/charts/common/templates/loader/_all.tpl deleted file mode 100644 index 2983499..0000000 --- a/cloudflared-6.0.4/charts/common/templates/loader/_all.tpl +++ /dev/null @@ -1,8 +0,0 @@ -{{/* Main entrypoint for the library */}} -{{- define "tc.v1.common.loader.all" -}} - - {{- include "tc.v1.common.loader.init" . -}} - - {{- include "tc.v1.common.loader.apply" . -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/loader/_apply.tpl b/cloudflared-6.0.4/charts/common/templates/loader/_apply.tpl deleted file mode 100644 index 3094272..0000000 --- a/cloudflared-6.0.4/charts/common/templates/loader/_apply.tpl +++ /dev/null @@ -1,70 +0,0 @@ -{{/* Loads all spawners */}} -{{- define "tc.v1.common.loader.apply" -}} - - {{/* Inject custom tpl files, as defined in values.yaml */}} - {{- include "tc.v1.common.spawner.extraTpl" . | nindent 0 -}} - - {{/* Ensure automatic permissions containers are injected */}} - {{- include "tc.v1.common.lib.util.autoperms.job" $ -}} - - {{/* Make sure there are not any YAML errors */}} - {{- include "tc.v1.common.values.validate" .Values -}} - - {{/* Render ConfigMap(s) */}} - {{- include "tc.v1.common.spawner.configmap" . | nindent 0 -}} - - {{/* Render Certificate(s) */}} - {{- include "tc.v1.common.spawner.scaleCertificate" . | nindent 0 -}} - - {{/* Render Secret(s) */}} - {{- include "tc.v1.common.spawner.secret" . | nindent 0 -}} - - {{/* Render Image Pull Secrets(s) */}} - {{- include "tc.v1.common.spawner.imagePullSecret" . | nindent 0 -}} - - {{/* Render Service Accounts(s) */}} - {{- include "tc.v1.common.spawner.serviceAccount" . | nindent 0 -}} - - {{/* Render RBAC(s) */}} - {{- include "tc.v1.common.spawner.rbac" . | nindent 0 -}} - - {{/* Render External Interface(s) */}} - {{- include "tc.v1.common.spawner.externalInterface" . | nindent 0 -}} - - {{/* Render Workload(s) */}} - {{- include "tc.v1.common.spawner.workload" . | nindent 0 -}} - - {{/* Render Services(s) */}} - {{- include "tc.v1.common.spawner.service" . | nindent 0 -}} - - {{/* Render PVC(s) */}} - {{- include "tc.v1.common.spawner.pvc" . | nindent 0 -}} - - {{/* Render ingress(s) */}} - {{- include "tc.v1.common.spawner.ingress" . | nindent 0 -}} - - {{/* Render Gateway API Route(s) */}} - {{- include "tc.v1.common.spawner.routes" . | nindent 0 -}} - - {{/* Render Horizontal Pod Autoscalers(s) */}} - {{- include "tc.v1.common.spawner.hpa" . | nindent 0 -}} - - {{/* Render Networkpolicy(s) */}} - {{- include "tc.v1.common.spawner.networkpolicy" . | nindent 0 -}} - - {{/* Render podDisruptionBudget(s) */}} - {{- include "tc.v1.common.spawner.podDisruptionBudget" . | nindent 0 -}} - - {{/* Render webhook(s) */}} - {{- include "tc.v1.common.spawner.webhook" . | nindent 0 -}} - - {{/* Render Prometheus Metrics(s) */}} - {{- include "tc.v1.common.spawner.metrics" . | nindent 0 -}} - - {{/* Render Cert-Manager Certificates(s) */}} - {{- include "tc.v1.common.spawner.certificate" . | nindent 0 -}} - - {{/* Render/Set portal configmap, .Values.iXPortals and APPURL */}} - {{- include "tc.v1.common.spawner.portal" . | nindent 0 -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/loader/_init.tpl b/cloudflared-6.0.4/charts/common/templates/loader/_init.tpl deleted file mode 100644 index aff423a..0000000 --- a/cloudflared-6.0.4/charts/common/templates/loader/_init.tpl +++ /dev/null @@ -1,55 +0,0 @@ -{{/* Initialiaze values of the chart */}} -{{- define "tc.v1.common.loader.init" -}} - - {{/* Merge chart values and the common chart defaults */}} - {{- include "tc.v1.common.values.init" . -}} - - {{/* Parse lists and append to values */}} - {{- include "tc.v1.common.loader.lists" . -}} - - {{/* Ensure TrueCharts chart context information is available */}} - {{- include "tc.v1.common.lib.util.chartcontext" . -}} - - {{/* Autogenerate postgresql passwords if needed */}} - {{- include "tc.v1.common.spawner.cnpg" . }} - - {{/* Autogenerate redis passwords if needed */}} - {{- include "tc.v1.common.dependencies.redis.injector" . }} - - {{/* Autogenerate mariadb passwords if needed */}} - {{- include "tc.v1.common.dependencies.mariadb.injector" . }} - - {{/* Autogenerate mongodb passwords if needed */}} - {{- include "tc.v1.common.dependencies.mongodb.injector" . }} - - {{/* Autogenerate clickhouse passwords if needed */}} - {{- include "tc.v1.common.dependencies.clickhouse.injector" . }} - - {{/* Autogenerate solr passwords if needed */}} - {{- include "tc.v1.common.dependencies.solr.injector" . }} - - {{/* Register Operator if needed */}} - {{- include "tc.v1.common.lib.util.operator.register" . }} - - {{/* Verify if required operators are present */}} - {{- include "tc.v1.common.lib.util.operator.verifyAll" . }} - - {{/* Enable code-server add-on if required */}} - {{- if .Values.addons.codeserver.enabled }} - {{- include "tc.v1.common.addon.codeserver" . }} - {{- end -}} - - {{/* Enable VPN add-on if required */}} - {{- if ne "disabled" .Values.addons.vpn.type -}} - {{- include "tc.v1.common.addon.vpn" . }} - {{- end -}} - - {{/* Enable netshoot add-on if required */}} - {{- if .Values.addons.netshoot.enabled }} - {{- include "tc.v1.common.addon.netshoot" . }} - {{- end -}} - - {{/* Append database wait containers to pods */}} - {{- include "tc.v1.common.lib.deps.wait" $ }} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/loader/_lists.tpl b/cloudflared-6.0.4/charts/common/templates/loader/_lists.tpl deleted file mode 100644 index f1ea7ee..0000000 --- a/cloudflared-6.0.4/charts/common/templates/loader/_lists.tpl +++ /dev/null @@ -1,9 +0,0 @@ -{{- define "tc.v1.common.loader.lists" -}} - - {{- include "tc.v1.common.values.persistenceList" . -}} - - {{- include "tc.v1.common.values.deviceList" . -}} - - {{- include "tc.v1.common.values.serviceList" . -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/spawner/_certificate.tpl b/cloudflared-6.0.4/charts/common/templates/spawner/_certificate.tpl deleted file mode 100644 index a8000b4..0000000 --- a/cloudflared-6.0.4/charts/common/templates/spawner/_certificate.tpl +++ /dev/null @@ -1,23 +0,0 @@ -{{/* Renders the certificate objects required by the chart */}} -{{- define "tc.v1.common.spawner.certificate" -}} - {{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $ -}} - - {{/* Generate named certs as required */}} - {{- range $name, $cert := .Values.cert -}} - {{- if $cert.enabled -}} - {{- $certValues := $cert -}} - {{- $certName := $fullname -}} - - {{/* set defaults */}} - {{- if and (not $certValues.nameOverride) (ne $name (include "tc.v1.common.lib.util.cert.primary" $)) -}} - {{- $_ := set $certValues "nameOverride" $name -}} - {{- end -}} - - {{- if $certValues.nameOverride -}} - {{- $certName = printf "%v-%v" $certName $certValues.nameOverride -}} - {{- end -}} - - {{- include "tc.v1.common.class.certificate" (dict "root" $ "name" $certName "certificateIssuer" $cert.certificateIssuer "hosts" $cert.hosts ) -}} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/spawner/_cnpg.tpl b/cloudflared-6.0.4/charts/common/templates/spawner/_cnpg.tpl deleted file mode 100644 index 440d761..0000000 --- a/cloudflared-6.0.4/charts/common/templates/spawner/_cnpg.tpl +++ /dev/null @@ -1,102 +0,0 @@ -{{/* Renders the cnpg objects required by the chart */}} -{{- define "tc.v1.common.spawner.cnpg" -}} - {{/* Generate named cnpges as required */}} - {{- range $name, $cnpg := $.Values.cnpg }} - - {{- $enabled := false -}} - {{- if hasKey $cnpg "enabled" -}} - {{- if not (kindIs "invalid" $cnpg.enabled) -}} - {{- $enabled = $cnpg.enabled -}} - {{- else -}} - {{- fail (printf "cnpg - Expected the defined key [enabled] in to not be empty" $name) -}} - {{- end -}} - {{- end -}} - - {{- if kindIs "string" $enabled -}} - {{- $enabled = tpl $enabled $ -}} - - {{/* After tpl it becomes a string, not a bool */}} - {{- if eq $enabled "true" -}} - {{- $enabled = true -}} - {{- else if eq $enabled "false" -}} - {{- $enabled = false -}} - {{- end -}} - {{- end -}} - - - {{- $cnpgValues := $cnpg }} - {{- $cnpgName := include "tc.v1.common.lib.chart.names.fullname" $ }} - {{- $_ := set $cnpgValues "shortName" $name }} - - {{/* set defaults */}} - {{- $_ := set $cnpgValues "nameOverride" ( printf "cnpg-%v" $name ) }} - - {{- $cnpgName := printf "%v-%v" $cnpgName $cnpgValues.nameOverride }} - - {{- $_ := set $cnpgValues "name" $cnpgName }} - - {{- if $enabled -}} - {{- $_ := set $ "ObjectValues" (dict "cnpg" $cnpgValues) }} - {{- include "tc.v1.common.class.cnpg.cluster" $ }} - - {{- $_ := set $cnpgValues.pooler "type" "rw" }} - {{- if not $cnpgValues.acceptRO }} - {{- include "tc.v1.common.class.cnpg.pooler" $ }} - {{- else }} - {{- include "tc.v1.common.class.cnpg.pooler" $ }} - {{- $_ := set $cnpgValues.pooler "type" "ro" }} - {{- include "tc.v1.common.class.cnpg.pooler" $ }} - {{- end }} - - {{- end }} - - - {{- $dbPass := "" }} - {{- $dbprevious := lookup "v1" "Secret" $.Release.Namespace ( printf "%s-user" $cnpgValues.name ) }} - {{- if or $enabled $dbprevious -}} - {{/* Inject the required secrets */}} - - {{- if $dbprevious }} - {{- $dbPass = ( index $dbprevious.data "password" ) | b64dec }} - {{- else }} - {{- $dbPass = $cnpgValues.password | default ( randAlphaNum 62 ) }} - {{- end }} - - {{- $std := ( ( printf "postgresql://%v:%v@%v-rw:5432/%v" $cnpgValues.user $dbPass $cnpgValues.name $cnpgValues.database ) | quote ) }} - {{- $nossl := ( ( printf "postgresql://%v:%v@%v-rw:5432/%v?sslmode=disable" $cnpgValues.user $dbPass $cnpgValues.name $cnpgValues.database ) | quote ) }} - {{- $porthost := ( ( printf "%s-rw:5432" $cnpgValues.name ) | quote ) }} - {{- $host := ( ( printf "%s-rw" $cnpgValues.name ) | quote ) }} - {{- $jdbc := ( ( printf "jdbc:postgresql://%v-rw:5432/%v" $cnpgValues.name $cnpgValues.database ) | quote ) }} - - {{- $userSecret := include "tc.v1.common.lib.cnpg.secret.user" (dict "values" $cnpgValues "dbPass" $dbPass ) | fromYaml }} - {{- if $userSecret }} - {{- $_ := set $.Values.secret ( printf "cnpg-%s-user" $cnpgValues.shortName ) $userSecret }} - {{- end }} - - {{- $urlSecret := include "tc.v1.common.lib.cnpg.secret.urls" (dict "std" $std "nossl" $nossl "porthost" $porthost "host" $host "jdbc" $jdbc) | fromYaml }} - {{- if $urlSecret }} - {{- $_ := set $.Values.secret ( printf "cnpg-%s-urls" $cnpgValues.shortName ) $urlSecret }} - {{- end }} - - {{- $_ := set $cnpgValues.creds "password" ( $dbPass | quote ) }} - {{- $_ := set $cnpgValues.creds "std" $std }} - {{- $_ := set $cnpgValues.creds "nossl" $nossl }} - {{- $_ := set $cnpgValues.creds "porthost" $porthost }} - {{- $_ := set $cnpgValues.creds "host" $host }} - {{- $_ := set $cnpgValues.creds "jdbc" $jdbc }} - - {{- if $cnpgValues.monitoring }} - {{- if $cnpgValues.monitoring.enablePodMonitor }} - {{- $poolermetrics := include "tc.v1.common.lib.cnpg.metrics.pooler" (dict "poolerName" ( printf "%s-rw" $cnpgValues.name) ) | fromYaml }} - - {{- $_ := set $.Values.metrics ( printf "cnpg-%s-rw" $cnpgValues.shortName ) $poolermetrics }} - {{- if $cnpgValues.acceptRO }} - {{- $poolermetricsRO := include "tc.v1.common.lib.cnpg.metrics.pooler" (dict "poolerName" ( printf "%s-ro" $cnpgValues.name) ) | fromYaml }} - {{- $_ := set $.Values.metrics ( printf "cnpg-%s-ro" $cnpgValues.shortName ) $poolermetricsRO }} - {{- end }} - {{- end }} - {{- end }} - - {{- end }} - {{- end }} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/spawner/_configmap.tpl b/cloudflared-6.0.4/charts/common/templates/spawner/_configmap.tpl deleted file mode 100644 index b55ac15..0000000 --- a/cloudflared-6.0.4/charts/common/templates/spawner/_configmap.tpl +++ /dev/null @@ -1,60 +0,0 @@ -{{/* Configmap Spawwner */}} -{{/* Call this template: -{{ include "tc.v1.common.spawner.configmap" $ -}} -*/}} - -{{- define "tc.v1.common.spawner.configmap" -}} - {{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $ -}} - - {{- range $name, $configmap := .Values.configmap -}} - - {{- $enabled := false -}} - {{- if hasKey $configmap "enabled" -}} - {{- if not (kindIs "invalid" $configmap.enabled) -}} - {{- $enabled = $configmap.enabled -}} - {{- else -}} - {{- fail (printf "ConfigMap - Expected the defined key [enabled] in to not be empty" $name) -}} - {{- end -}} - {{- end -}} - - - {{- if kindIs "string" $enabled -}} - {{- $enabled = tpl $enabled $ -}} - - {{/* After tpl it becomes a string, not a bool */}} - {{- if eq $enabled "true" -}} - {{- $enabled = true -}} - {{- else if eq $enabled "false" -}} - {{- $enabled = false -}} - {{- end -}} - {{- end -}} - - {{- if $enabled -}} - - {{/* Create a copy of the configmap */}} - {{- $objectData := (mustDeepCopy $configmap) -}} - - {{- $objectName := (printf "%s-%s" $fullname $name) -}} - {{- if hasKey $objectData "expandObjectName" -}} - {{- if not $objectData.expandObjectName -}} - {{- $objectName = $name -}} - {{- end -}} - {{- end -}} - - {{/* Perform validations */}} - {{- include "tc.v1.common.lib.chart.names.validation" (dict "name" $objectName) -}} - {{- include "tc.v1.common.lib.configmap.validation" (dict "objectData" $objectData) -}} - {{- include "tc.v1.common.lib.metadata.validation" (dict "objectData" $objectData "caller" "ConfigMap") -}} - - {{/* Set the name of the configmap */}} - {{- $_ := set $objectData "name" $objectName -}} - {{- $_ := set $objectData "shortName" $name -}} - - {{/* Call class to create the object */}} - {{- include "tc.v1.common.class.configmap" (dict "rootCtx" $ "objectData" $objectData) -}} - - {{- end -}} - - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/spawner/_externalInterface.tpl b/cloudflared-6.0.4/charts/common/templates/spawner/_externalInterface.tpl deleted file mode 100644 index 6fffa24..0000000 --- a/cloudflared-6.0.4/charts/common/templates/spawner/_externalInterface.tpl +++ /dev/null @@ -1,32 +0,0 @@ -{{/* External Interface Spawwner */}} -{{/* Call this template: -{{ include "tc.v1.common.spawner.externalInterface" $ -}} -*/}} - -{{- define "tc.v1.common.spawner.externalInterface" -}} - - {{- range $iface := .Values.scaleExternalInterface -}} - {{- include "tc.v1.common.lib.externalInterface.validation" (dict "objectData" $iface) -}} - {{- end -}} - - {{/* Now we have validated interfaces, render the objects */}} - - {{- range $index, $interface := .Values.ixExternalInterfacesConfiguration -}} - - {{- $objectData := dict -}} - {{/* Create a copy of the interface and put it in objectData.config */}} - {{- $_ := set $objectData "config" (mustDeepCopy $interface) -}} - - {{- $objectName := (printf "ix-%s-%v" $.Release.Name $index) -}} - {{/* Perform validations */}} - {{- include "tc.v1.common.lib.chart.names.validation" (dict "name" $objectName) -}} - - {{/* Set the name of the object to objectData.name */}} - {{- $_ := set $objectData "name" $objectName -}} - - {{/* Call class to create the object */}} - {{- include "tc.v1.common.class.networkAttachmentDefinition" (dict "rootCtx" $ "objectData" $objectData) -}} - - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/spawner/_extraTpl.tpl b/cloudflared-6.0.4/charts/common/templates/spawner/_extraTpl.tpl deleted file mode 100644 index 30b5460..0000000 --- a/cloudflared-6.0.4/charts/common/templates/spawner/_extraTpl.tpl +++ /dev/null @@ -1,13 +0,0 @@ -{{- define "tc.v1.common.spawner.extraTpl" -}} - {{- range $item := .Values.extraTpl }} - {{- if not $item -}} - {{- fail "Extra tpl - Expected non-empty item" -}} - {{- end }} ---- - {{- if kindIs "string" $item }} - {{- tpl $item $ | nindent 0 }} - {{- else }} - {{- tpl ($item | toYaml) $ | nindent 0 }} - {{- end }} - {{- end }} -{{- end }} diff --git a/cloudflared-6.0.4/charts/common/templates/spawner/_horizontalPodAutoscaler.tpl b/cloudflared-6.0.4/charts/common/templates/spawner/_horizontalPodAutoscaler.tpl deleted file mode 100644 index 1a14dbc..0000000 --- a/cloudflared-6.0.4/charts/common/templates/spawner/_horizontalPodAutoscaler.tpl +++ /dev/null @@ -1,19 +0,0 @@ -{{/* -Renders the configMap objects required by the chart. -*/}} -{{- define "tc.v1.common.spawner.hpa" -}} - {{/* Generate named configMaps as required */}} - {{- range $name, $hpa := .Values.horizontalPodAutoscaler -}} - {{- if $hpa.enabled -}} - {{- $hpaValues := $hpa -}} - - {{/* set the default nameOverride to the hpa name */}} - {{- if not $hpaValues.nameOverride -}} - {{- $_ := set $hpaValues "nameOverride" $name -}} - {{- end -}} - - {{- $_ := set $ "ObjectValues" (dict "hpa" $hpaValues) -}} - {{- include "tc.v1.common.class.hpa" $ -}} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/spawner/_imagePullSecret.tpl b/cloudflared-6.0.4/charts/common/templates/spawner/_imagePullSecret.tpl deleted file mode 100644 index 0cce5a7..0000000 --- a/cloudflared-6.0.4/charts/common/templates/spawner/_imagePullSecret.tpl +++ /dev/null @@ -1,41 +0,0 @@ -{{/* Image Pull Secrets Spawner */}} -{{/* Call this template: -{{ include "tc.v1.common.spawner.imagePullSecret" $ -}} -*/}} - -{{- define "tc.v1.common.spawner.imagePullSecret" -}} - {{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $ -}} - - {{- range $name, $imgPullSecret := .Values.imagePullSecret -}} - - {{- if $imgPullSecret.enabled -}} - - {{/* Create a copy of the configmap */}} - {{- $objectData := (mustDeepCopy $imgPullSecret) -}} - - {{- $objectName := (printf "%s-%s" $fullname $name) -}} - - {{/* Perform validations */}} - {{- include "tc.v1.common.lib.chart.names.validation" (dict "name" $objectName) -}} - {{- include "tc.v1.common.lib.imagePullSecret.validation" (dict "objectData" $objectData) -}} - {{- include "tc.v1.common.lib.metadata.validation" (dict "objectData" $objectData "caller" "Image Pull Secret") -}} - {{- $data := include "tc.v1.common.lib.imagePullSecret.createData" (dict "rootCtx" $ "objectData" $objectData) -}} - - {{/* Update the data */}} - {{- $_ := set $objectData "data" $data -}} - - {{/* Set the type to Image Pull Secret */}} - {{- $_ := set $objectData "type" "imagePullSecret" -}} - - {{/* Set the name of the image pull secret */}} - {{- $_ := set $objectData "name" $objectName -}} - {{- $_ := set $objectData "shortName" $name -}} - - {{/* Call class to create the object */}} - {{- include "tc.v1.common.class.secret" (dict "rootCtx" $ "objectData" $objectData) -}} - - {{- end -}} - - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/spawner/_ingress.tpl b/cloudflared-6.0.4/charts/common/templates/spawner/_ingress.tpl deleted file mode 100644 index 2daaa67..0000000 --- a/cloudflared-6.0.4/charts/common/templates/spawner/_ingress.tpl +++ /dev/null @@ -1,62 +0,0 @@ -{{/* Renders the Ingress objects required by the chart */}} -{{- define "tc.v1.common.spawner.ingress" -}} - {{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $ -}} - - {{/* Generate named ingresses as required */}} - {{- range $name, $ingress := .Values.ingress -}} - {{- if $ingress.enabled -}} - {{- $ingressValues := $ingress -}} - {{- $ingressName := $fullname -}} - - {{/* set defaults */}} - {{- if and (not $ingressValues.nameOverride) (ne $name (include "tc.v1.common.lib.util.ingress.primary" $)) -}} - {{- $_ := set $ingressValues "nameOverride" $name -}} - {{- end -}} - - {{- if $ingressValues.nameOverride -}} - {{- $ingressName = printf "%v-%v" $ingressName $ingressValues.nameOverride -}} - {{- end -}} - - {{- $_ := set $ingressValues "name" $ingressName -}} - - {{- $_ := set $ "ObjectValues" (dict "ingress" $ingressValues) -}} - {{- include "tc.v1.common.class.ingress" $ -}} - {{- if and ( $ingressValues.tls ) ( not $ingressValues.clusterIssuer ) -}} - {{- range $index, $tlsValues := $ingressValues.tls -}} - {{- $tlsName := ( printf "%v-%v" "tls" $index ) -}} - {{- if $tlsValues.certificateIssuer -}} - {{- include "tc.v1.common.class.certificate" (dict "root" $ "name" ( printf "%v-%v" $ingressName $tlsName ) "certificateIssuer" $tlsValues.certificateIssuer "hosts" $tlsValues.hosts ) -}} - {{- else if and ( $tlsValues.scaleCert ) ( $.Values.global.ixChartContext ) -}} - - {{/* Create certificate object and use it to construct a secret */}} - {{- $objectData := dict -}} - {{- $_ := set $objectData "id" .scaleCert -}} - - {{- $objectName := (printf "%s-%s" $fullname $tlsName) -}} - {{/* Perform validations */}} - {{- include "tc.v1.common.lib.chart.names.validation" (dict "name" $objectName) -}} - {{- include "tc.v1.common.lib.scaleCertificate.validation" (dict "objectData" $objectData) -}} - {{- include "tc.v1.common.lib.metadata.validation" (dict "objectData" $objectData "caller" "Certificate") -}} - - {{/* Prepare data */}} - {{- $data := fromJson (include "tc.v1.common.lib.scaleCertificate.getData" (dict "rootCtx" $ "objectData" $objectData)) -}} - {{- $_ := set $objectData "data" $data -}} - - {{/* Set the type to certificate */}} - {{- $_ := set $objectData "type" "certificate" -}} - - {{/* Set the name of the certificate */}} - {{- $_ := set $objectData "name" $objectName -}} - {{- $_ := set $objectData "shortName" $name -}} - - {{/* Call class to create the object */}} - {{- include "tc.v1.common.class.secret" (dict "rootCtx" $ "objectData" $objectData) -}} - - {{- end -}} - {{- end -}} - {{- end -}} - {{- else if $ingress.required -}} - {{- fail (printf "Ingress - is set to be [required] and cannot be disabled" $name) -}} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/spawner/_metrics.tpl b/cloudflared-6.0.4/charts/common/templates/spawner/_metrics.tpl deleted file mode 100644 index 7d72777..0000000 --- a/cloudflared-6.0.4/charts/common/templates/spawner/_metrics.tpl +++ /dev/null @@ -1,28 +0,0 @@ -{{/* Renders the Ingress objects required by the chart */}} -{{- define "tc.v1.common.spawner.metrics" -}} - {{/* Generate named metricses as required */}} - {{- range $name, $metrics := .Values.metrics -}} - {{- if $metrics.enabled -}} - {{- $metricsValues := $metrics -}} - - {{/* set defaults */}} - {{- if and (not $metricsValues.nameOverride) (ne $name (include "tc.v1.common.lib.util.metrics.primary" $)) -}} - {{- $_ := set $metricsValues "nameOverride" $name -}} - {{- end -}} - - {{- $_ := set $ "ObjectValues" (dict "metrics" $metricsValues) -}} - {{- if eq $metricsValues.type "podmonitor" -}} - {{- include "tc.v1.common.class.podmonitor" $ -}} - {{- else if eq $metricsValues.type "servicemonitor" -}} - {{- include "tc.v1.common.class.servicemonitor" $ -}} - {{- else -}} - {{/* TODO: Add Fail case */}} - {{- end -}} - - {{- if $metricsValues.PrometheusRule -}} - {{- include "tc.v1.common.class.prometheusrule" $ -}} - {{- end -}} - - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/spawner/_networkPolicy.tpl b/cloudflared-6.0.4/charts/common/templates/spawner/_networkPolicy.tpl deleted file mode 100644 index 46e4ea2..0000000 --- a/cloudflared-6.0.4/charts/common/templates/spawner/_networkPolicy.tpl +++ /dev/null @@ -1,19 +0,0 @@ -{{/* -Renders the networkPolicy objects required by the chart. -*/}} -{{- define "tc.v1.common.spawner.networkpolicy" -}} - {{/* Generate named networkpolicy as required */}} - {{- range $name, $networkPolicy := .Values.networkPolicy -}} - {{- if $networkPolicy.enabled -}} - {{- $networkPolicyValues := $networkPolicy -}} - - {{/* set the default nameOverride to the networkpolicy name */}} - {{- if not $networkPolicyValues.nameOverride -}} - {{- $_ := set $networkPolicyValues "nameOverride" $name -}} - {{- end -}} - - {{- $_ := set $ "ObjectValues" (dict "networkPolicy" $networkPolicyValues) -}} - {{- include "tc.v1.common.class.networkpolicy" $ -}} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/spawner/_podDisruptionBudget.tpl b/cloudflared-6.0.4/charts/common/templates/spawner/_podDisruptionBudget.tpl deleted file mode 100644 index 3aa8340..0000000 --- a/cloudflared-6.0.4/charts/common/templates/spawner/_podDisruptionBudget.tpl +++ /dev/null @@ -1,59 +0,0 @@ -{{/* poddisruptionbudget Spawwner */}} -{{/* Call this template: -{{ include "tc.v1.common.spawner.podDisruptionBudget" $ -}} -*/}} - -{{- define "tc.v1.common.spawner.podDisruptionBudget" -}} - {{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $ -}} - - {{- range $name, $pdb := .Values.podDisruptionBudget -}} - {{- $enabled := false -}} - {{- if hasKey $pdb "enabled" -}} - {{- if not (kindIs "invalid" $pdb.enabled) -}} - {{- $enabled = $pdb.enabled -}} - {{- else -}} - {{- fail (printf "Pod Disruption Budget - Expected the defined key [enabled] in to not be empty" $name) -}} - {{- end -}} - {{- end -}} - - {{- if kindIs "string" $enabled -}} - {{- $enabled = tpl $enabled $ -}} - - {{/* After tpl it becomes a string, not a bool */}} - {{- if eq $enabled "true" -}} - {{- $enabled = true -}} - {{- else if eq $enabled "false" -}} - {{- $enabled = false -}} - {{- end -}} - {{- end -}} - - {{- if $enabled -}} - - {{/* Create a copy of the poddisruptionbudget */}} - {{- $objectData := (mustDeepCopy $pdb) -}} - - {{- $objectName := (printf "%s-%s" $fullname $name) -}} - {{- if hasKey $objectData "expandObjectName" -}} - {{- if not $objectData.expandObjectName -}} - {{- $objectName = $name -}} - {{- end -}} - {{- end -}} - - {{/* Perform validations */}} - {{- include "tc.v1.common.lib.chart.names.validation" (dict "name" $objectName) -}} - {{- include "tc.v1.common.lib.metadata.validation" (dict "objectData" $objectData "caller" "Pod Disruption Budget") -}} - - {{/* Set the name of the poddisruptionbudget */}} - {{- $_ := set $objectData "name" $objectName -}} - {{- $_ := set $objectData "shortName" $name -}} - - {{- include "tc.v1.common.lib.podDisruptionBudget.validation" (dict "objectData" $objectData "rootCtx" $) -}} - - {{/* Call class to create the object */}} - {{- include "tc.v1.common.class.podDisruptionBudget" (dict "rootCtx" $ "objectData" $objectData) -}} - - {{- end -}} - - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/spawner/_portal.tpl b/cloudflared-6.0.4/charts/common/templates/spawner/_portal.tpl deleted file mode 100644 index fd141b7..0000000 --- a/cloudflared-6.0.4/charts/common/templates/spawner/_portal.tpl +++ /dev/null @@ -1,176 +0,0 @@ -{{/* Portal Spawwner */}} -{{/* Call this template: -{{ include "tc.v1.common.spawner.portal" $ -}} -*/}} - -{{- define "tc.v1.common.spawner.portal" -}} - {{- range $name, $portal := .Values.portal -}} - {{- if $portal.enabled -}} - - {{/* Create a copy of the portal */}} - {{- $objectData := (mustDeepCopy $portal) -}} - {{- $override := $objectData.override -}} - {{- $targetSelector := $objectData.targetSelector -}} - - {{/* Create defaults */}} - {{- $protocol := "http" -}} - {{- $host := "$node_ip" -}} - {{- $port := "443" -}} - {{- $path := $objectData.path | default "/" -}} - {{- $url := "" -}} - - - {{/* Get service, default to primary */}} - {{- $serviceData := dict "targetSelector" $targetSelector.service -}} - {{- $selectedService := fromYaml ( include "tc.v1.common.lib.helpers.getSelectedServiceValues" (dict "rootCtx" $ "objectData" $serviceData)) }} - - {{/* read loadbalancer IPs for metallb */}} - {{- if eq $selectedService.type "LoadBalancer" -}} - {{- with $selectedService.loadBalancerIP -}} - {{- $host = toString . -}} - {{- end -}} - - {{/* set temporary storage for port name and port */}} - {{- $targetPort := "" -}} - {{- $selectedPort := "" -}} - - {{/* Fetch port values */}} - {{- if $targetSelector.port -}} - {{- $targetPort = $targetSelector.port -}} - {{- else -}} - {{- $targetPort = include "tc.v1.common.lib.util.service.ports.primary" (dict "svcName" $selectedService.shortName "svcValues" $selectedService ) -}} - {{- end -}} - - - {{- $selectedPort = get $selectedService.ports $targetPort -}} - - {{/* store port number */}} - {{- $port = $selectedPort.port -}} - {{- end -}} - - - {{/* set temporary storage for ingress name and port */}} - {{- $targetIngress := "" -}} - {{- $selectedIngress := "" -}} - - {{/* Fetch ingress values */}} - {{- if $targetSelector.ingress -}} - {{- $targetIngress = $targetSelector.ingress -}} - {{- else -}} - {{- $targetIngress = ( include "tc.v1.common.lib.util.ingress.primary" $ ) -}} - {{- end -}} - - {{- $selectedIngress = get $.Values.ingress $targetIngress -}} - - {{/* store host from ingress number */}} - {{- if $selectedIngress -}} - {{- if $selectedIngress.enabled -}} - {{- with (index $selectedIngress.hosts 0) }} - {{- $host = .host -}} - {{- end }} - - {{/* Get the port for the ingress entrypoint */}} - - - {{- $traefikNamespace := "tc-system" -}} - {{- if $.Values.operator.traefik -}} - {{- if $.Values.operator.traefik.namespace -}} - {{- $traefikNamespace := $.Values.operator.traefik.namespace -}} - {{- end -}} - {{- end -}} - {{- if $selectedIngress.ingressClassName }} - {{- if $.Values.global.ixChartContext -}} - {{- $traefikNamespace = (printf "ix-%s" $selectedIngress.ingressClassName) -}} - {{- else -}} - {{- $traefikNamespace = $selectedIngress.ingressClassName -}} - {{- end -}} - {{- end -}} - - {{- $traefikportalhook := lookup "v1" "ConfigMap" $traefikNamespace "portalhook" }} - - {{- $entrypoint := "websecure" }} - {{- $protocol = "https" -}} - {{- if $selectedIngress.entrypoint }} - {{- $entrypoint = $selectedIngress.entrypoint }} - {{- end }} - - {{- if $traefikportalhook }} - {{- if ( index $traefikportalhook.data $entrypoint ) }} - {{- $port = ( index $traefikportalhook.data $entrypoint ) }} - {{- end }} - {{- end }} - - {{- end }} - {{- end }} - - - {{- $port = ( toString $port ) -}} - - {{/* Apply overrides */}} - {{- if $override.protocol -}} - {{- $protocol = $override.protocol -}} - {{- end -}} - - {{- if $override.host -}} - {{- $host = $override.host -}} - {{- end -}} - - {{- if $override.port -}} - {{- $port = $override.port -}} - {{- end -}} - - {{/* sanitise */}} - {{- if eq $port "443" -}} - {{- $protocol = "https" -}} - {{- end -}} - - {{- if eq $port "80" -}} - {{- $protocol = "http" -}} - {{- end -}} - - {{/* TODO: Reenable when iX fixes bugs crashing GUI on empty port */}} - {{/* - {{- if or ( and ( eq $protocol "https" ) ( eq $port "443" ) ) ( and ( eq $protocol "http" ) ( eq $port "80" ) ) -}} - {{- $port = "" -}} - {{- end -}} - */}} - - {{- $port = toString $port -}} - - {{/* Construct URL*/}} - {{- if $port -}} - {{- $url = printf "%s://%s:%s%s" $protocol $host $port $path -}} - {{- else -}} - {{- $url = printf "%s://%s%s" $protocol $host $path -}} - {{- end -}} - - {{/* create configmap entry*/}} - {{- $portalData := dict "protocol" $protocol "host" $host "port" $port "path" $path "url" $url -}} - - {{/* construct configmap */}} - {{- $objectName := ( printf "tcportal-%s" $name ) -}} - {{- $configMap := dict "enabled" true "name" $objectName "shortName" $objectName "data" $portalData -}} - - {{/* Perform validations */}} - {{- include "tc.v1.common.lib.chart.names.validation" (dict "name" $objectName) -}} - {{- include "tc.v1.common.lib.configmap.validation" (dict "objectData" $configMap) -}} - {{- include "tc.v1.common.lib.metadata.validation" (dict "objectData" $configMap "caller" "ConfigMap") -}} - - {{- if $.Values.global.ixChartContext -}} - {{/* Call class to create the object */}} - {{- include "tc.v1.common.class.configmap" (dict "rootCtx" $ "objectData" $configMap) -}} - - {{/* iXportals */}} - {{- $useNodeIP := false -}} - {{- if eq $host "$node_ip" -}} - {{- $useNodeIP = true -}} - {{- end -}} - - {{- $iXPortalData := dict "portalName" $name "useNodeIP" $useNodeIP "protocol" $protocol "host" $host "port" $port "path" $path "url" $url -}} - {{- $iXPortals := append $.Values.iXPortals $iXPortalData -}} - {{- $_ := set $.Values "iXPortals" $iXPortals -}} - - {{- end -}} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/spawner/_pvc.tpl b/cloudflared-6.0.4/charts/common/templates/spawner/_pvc.tpl deleted file mode 100644 index 14b1197..0000000 --- a/cloudflared-6.0.4/charts/common/templates/spawner/_pvc.tpl +++ /dev/null @@ -1,41 +0,0 @@ -{{/* PVC Spawwner */}} -{{/* Call this template: -{{ include "tc.v1.common.spawner.pvc" $ -}} -*/}} - -{{- define "tc.v1.common.spawner.pvc" -}} - {{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $ -}} - - {{- range $name, $persistence := .Values.persistence -}} - - {{- if $persistence.enabled -}} - - {{/* Create a copy of the persistence */}} - {{- $objectData := (mustDeepCopy $persistence) -}} - - {{- $_ := set $objectData "type" ($objectData.type | default $.Values.fallbackDefaults.persistenceType) -}} - - {{/* Perform general validations */}} - {{- include "tc.v1.common.lib.persistence.validation" (dict "rootCtx" $ "objectData" $objectData) -}} - {{- include "tc.v1.common.lib.metadata.validation" (dict "objectData" $objectData "caller" "Persistence") -}} - - {{/* Only spawn PVC if its enabled and type of "pvc" */}} - {{- if and (eq "pvc" $objectData.type) (not $objectData.existingClaim) -}} - - {{- $objectName := (printf "%s-%s" $fullname $name) -}} - {{/* Perform validations */}} - {{- include "tc.v1.common.lib.chart.names.validation" (dict "name" $objectName) -}} - - {{/* Set the name of the secret */}} - {{- $_ := set $objectData "name" $objectName -}} - {{- $_ := set $objectData "shortName" $name -}} - - {{/* Call class to create the object */}} - {{- include "tc.v1.common.class.pvc" (dict "rootCtx" $ "objectData" $objectData) -}} - - {{- end -}} - {{- end -}} - - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/spawner/_rbac.tpl b/cloudflared-6.0.4/charts/common/templates/spawner/_rbac.tpl deleted file mode 100644 index 255f11c..0000000 --- a/cloudflared-6.0.4/charts/common/templates/spawner/_rbac.tpl +++ /dev/null @@ -1,44 +0,0 @@ -{{/* RBAC Spawner */}} -{{/* Call this template: -{{ include "tc.v1.common.spawner.rbac" $ -}} -*/}} - -{{- define "tc.v1.common.spawner.rbac" -}} - {{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $ -}} - - {{/* Primary validation for enabled rbacs. */}} - {{- include "tc.v1.common.lib.rbac.primaryValidation" $ -}} - - {{- range $name, $rbac := .Values.rbac -}} - - {{- if $rbac.enabled -}} - - {{/* Create a copy of the configmap */}} - {{- $objectData := (mustDeepCopy $rbac) -}} - - {{- $objectName := $fullname -}} - {{- if not $objectData.primary -}} - {{- $objectName = (printf "%s-%s" $fullname $name) -}} - {{- end -}} - - {{/* Perform validations */}} - {{- include "tc.v1.common.lib.chart.names.validation" (dict "name" $objectName) -}} - {{- include "tc.v1.common.lib.metadata.validation" (dict "objectData" $objectData "caller" "RBAC") -}} - - {{/* Set the name of the rbac */}} - {{- $_ := set $objectData "name" $objectName -}} - {{- $_ := set $objectData "shortName" $name -}} - - {{/* If clusteWide key does not exist, assume false */}} - {{- if not (hasKey $objectData "clusterWide") -}} - {{- $_ := set $objectData "clusterWide" false -}} - {{- end -}} - - {{/* Call class to create the object */}} - {{- include "tc.v1.common.class.rbac" (dict "rootCtx" $ "objectData" $objectData) -}} - - {{- end -}} - - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/spawner/_route.tpl b/cloudflared-6.0.4/charts/common/templates/spawner/_route.tpl deleted file mode 100644 index 5ecf210..0000000 --- a/cloudflared-6.0.4/charts/common/templates/spawner/_route.tpl +++ /dev/null @@ -1,18 +0,0 @@ -{{/* Renders the Route objects required by the chart */}} -{{- define "tc.v1.common.spawner.routes" -}} - {{- /* Generate named routes as required */ -}} - {{- range $name, $route := .Values.route }} - {{- if $route.enabled -}} - {{- $routeValues := $route -}} - - {{/* set defaults */}} - {{- if and (not $routeValues.nameOverride) (ne $name (include "tc.v1.common.lib.util.route.primary" $)) -}} - {{- $_ := set $routeValues "nameOverride" $name -}} - {{- end -}} - - {{- $_ := set $ "ObjectValues" (dict "route" $routeValues) -}} - {{- include "tc.v1.common.class.route" $ | nindent 0 -}} - {{- $_ := unset $.ObjectValues "route" -}} - {{- end }} - {{- end }} -{{- end }} diff --git a/cloudflared-6.0.4/charts/common/templates/spawner/_scaleCertificate.tpl b/cloudflared-6.0.4/charts/common/templates/spawner/_scaleCertificate.tpl deleted file mode 100644 index d69c703..0000000 --- a/cloudflared-6.0.4/charts/common/templates/spawner/_scaleCertificate.tpl +++ /dev/null @@ -1,40 +0,0 @@ -{{/* Certificate Spawwner */}} -{{/* Call this template: -{{ include "tc.v1.common.spawner.scaleCertificate" $ -}} -*/}} - -{{- define "tc.v1.common.spawner.scaleCertificate" -}} - {{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $ -}} - - {{- range $name, $certificate := .Values.scaleCertificate -}} - - {{- if $certificate.enabled -}} - - {{/* Create a copy of the certificate */}} - {{- $objectData := (mustDeepCopy $certificate) -}} - - {{- $objectName := (printf "%s-%s" $fullname $name) -}} - {{/* Perform validations */}} - {{- include "tc.v1.common.lib.chart.names.validation" (dict "name" $objectName) -}} - {{- include "tc.v1.common.lib.scaleCertificate.validation" (dict "objectData" $objectData) -}} - {{- include "tc.v1.common.lib.metadata.validation" (dict "objectData" $objectData "caller" "Certificate") -}} - - {{/* Prepare data */}} - {{- $data := fromJson (include "tc.v1.common.lib.scaleCertificate.getData" (dict "rootCtx" $ "objectData" $objectData)) -}} - {{- $_ := set $objectData "data" $data -}} - - {{/* Set the type to certificate */}} - {{- $_ := set $objectData "type" "certificate" -}} - - {{/* Set the name of the certificate */}} - {{- $_ := set $objectData "name" $objectName -}} - {{- $_ := set $objectData "shortName" $name -}} - - {{/* Call class to create the object */}} - {{- include "tc.v1.common.class.secret" (dict "rootCtx" $ "objectData" $objectData) -}} - - {{- end -}} - - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/spawner/_secret.tpl b/cloudflared-6.0.4/charts/common/templates/spawner/_secret.tpl deleted file mode 100644 index 5b62d0c..0000000 --- a/cloudflared-6.0.4/charts/common/templates/spawner/_secret.tpl +++ /dev/null @@ -1,59 +0,0 @@ -{{/* Secret Spawwner */}} -{{/* Call this template: -{{ include "tc.v1.common.spawner.secret" $ -}} -*/}} - -{{- define "tc.v1.common.spawner.secret" -}} - {{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $ -}} - - {{- range $name, $secret := .Values.secret -}} - - {{- $enabled := false -}} - {{- if hasKey $secret "enabled" -}} - {{- if not (kindIs "invalid" $secret.enabled) -}} - {{- $enabled = $secret.enabled -}} - {{- else -}} - {{- fail (printf "Secret - Expected the defined key [enabled] in to not be empty" $name) -}} - {{- end -}} - {{- end -}} - - {{- if kindIs "string" $enabled -}} - {{- $enabled = tpl $enabled $ -}} - - {{/* After tpl it becomes a string, not a bool */}} - {{- if eq $enabled "true" -}} - {{- $enabled = true -}} - {{- else if eq $enabled "false" -}} - {{- $enabled = false -}} - {{- end -}} - {{- end -}} - - {{- if $enabled -}} - - {{/* Create a copy of the secret */}} - {{- $objectData := (mustDeepCopy $secret) -}} - - {{- $objectName := (printf "%s-%s" $fullname $name) -}} - {{- if hasKey $objectData "expandObjectName" -}} - {{- if not $objectData.expandObjectName -}} - {{- $objectName = $name -}} - {{- end -}} - {{- end -}} - - {{/* Perform validations */}} - {{- include "tc.v1.common.lib.chart.names.validation" (dict "name" $objectName) -}} - {{- include "tc.v1.common.lib.secret.validation" (dict "objectData" $objectData) -}} - {{- include "tc.v1.common.lib.metadata.validation" (dict "objectData" $objectData "caller" "Secret") -}} - - {{/* Set the name of the secret */}} - {{- $_ := set $objectData "name" $objectName -}} - {{- $_ := set $objectData "shortName" $name -}} - - {{/* Call class to create the object */}} - {{- include "tc.v1.common.class.secret" (dict "rootCtx" $ "objectData" $objectData) -}} - - {{- end -}} - - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/spawner/_service.tpl b/cloudflared-6.0.4/charts/common/templates/spawner/_service.tpl deleted file mode 100644 index 34ed847..0000000 --- a/cloudflared-6.0.4/charts/common/templates/spawner/_service.tpl +++ /dev/null @@ -1,58 +0,0 @@ -{{/* Service Spawner */}} -{{/* Call this template: -{{ include "tc.v1.common.spawner.service" $ -}} -*/}} - -{{- define "tc.v1.common.spawner.service" -}} - {{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $ -}} - - {{/* Primary validation for enabled service. */}} - {{- include "tc.v1.common.lib.service.primaryValidation" $ -}} - - {{- range $name, $service := .Values.service -}} - - {{- if $service.enabled -}} - - {{/* Create a copy of the configmap */}} - {{- $objectData := (mustDeepCopy $service) -}} - - {{/* Init object name */}} - {{- $objectName := $name -}} - - {{/* Default expandName to true */}} - {{- $expandName := true -}} - {{- if (hasKey $objectData "expandObjectName") -}} - {{- if not (kindIs "invalid" $objectData.expandObjectName) -}} - {{- $expandName = $objectData.expandName -}} - {{- else -}} - {{- fail (printf "Service - Expected the defined key [expandObjectName] in to not be empty" $name) -}} - {{- end -}} - {{- end -}} - - {{- if $expandName -}} - {{/* Expand the name of the service if expandName resolves to true */}} - {{- $objectName = $fullname -}} - {{- end -}} - - {{- if and $expandName (not $objectData.primary) -}} - {{/* If the service is not primary append its name to fullname */}} - {{- $objectName = (printf "%s-%s" $fullname $name) -}} - {{- end -}} - - {{/* Perform validations */}} - {{- include "tc.v1.common.lib.chart.names.validation" (dict "name" $objectName) -}} - {{- include "tc.v1.common.lib.metadata.validation" (dict "objectData" $objectData "caller" "Service") -}} - {{- include "tc.v1.common.lib.service.validation" (dict "rootCtx" $ "objectData" $objectData) -}} - - {{/* Set the name of the service account */}} - {{- $_ := set $objectData "name" $objectName -}} - {{- $_ := set $objectData "shortName" $name -}} - - {{/* Call class to create the object */}} - {{- include "tc.v1.common.class.service" (dict "rootCtx" $ "objectData" $objectData) -}} - - {{- end -}} - - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/spawner/_serviceAccount.tpl b/cloudflared-6.0.4/charts/common/templates/spawner/_serviceAccount.tpl deleted file mode 100644 index c15aff4..0000000 --- a/cloudflared-6.0.4/charts/common/templates/spawner/_serviceAccount.tpl +++ /dev/null @@ -1,39 +0,0 @@ -{{/* Service Account Spawner */}} -{{/* Call this template: -{{ include "tc.v1.common.spawner.serviceAccount" $ -}} -*/}} - -{{- define "tc.v1.common.spawner.serviceAccount" -}} - {{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $ -}} - - {{/* Primary validation for enabled service accounts. */}} - {{- include "tc.v1.common.lib.serviceAccount.primaryValidation" $ -}} - - {{- range $name, $serviceAccount := .Values.serviceAccount -}} - - {{- if $serviceAccount.enabled -}} - - {{/* Create a copy of the configmap */}} - {{- $objectData := (mustDeepCopy $serviceAccount) -}} - - {{- $objectName := $fullname -}} - {{- if not $objectData.primary -}} - {{- $objectName = (printf "%s-%s" $fullname $name) -}} - {{- end -}} - - {{/* Perform validations */}} - {{- include "tc.v1.common.lib.chart.names.validation" (dict "name" $objectName) -}} - {{- include "tc.v1.common.lib.metadata.validation" (dict "objectData" $objectData "caller" "Service Account") -}} - - {{/* Set the name of the service account */}} - {{- $_ := set $objectData "name" $objectName -}} - {{- $_ := set $objectData "shortName" $name -}} - - {{/* Call class to create the object */}} - {{- include "tc.v1.common.class.serviceAccount" (dict "rootCtx" $ "objectData" $objectData) -}} - - {{- end -}} - - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/spawner/_webhook.tpl b/cloudflared-6.0.4/charts/common/templates/spawner/_webhook.tpl deleted file mode 100644 index 302e83f..0000000 --- a/cloudflared-6.0.4/charts/common/templates/spawner/_webhook.tpl +++ /dev/null @@ -1,65 +0,0 @@ -{{/* MutatingWebhookConfiguration Spawwner */}} -{{/* Call this template: -{{ include "tc.v1.common.spawner.webhook" $ -}} -*/}} - -{{- define "tc.v1.common.spawner.webhook" -}} - {{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $ -}} - - {{- range $name, $mutatingWebhookConfiguration := .Values.webhook -}} - - {{- $enabled := false -}} - {{- if hasKey $mutatingWebhookConfiguration "enabled" -}} - {{- if not (kindIs "invalid" $mutatingWebhookConfiguration.enabled) -}} - {{- $enabled = $mutatingWebhookConfiguration.enabled -}} - {{- else -}} - {{- fail (printf "Webhook - Expected the defined key [enabled] in to not be empty" $name) -}} - {{- end -}} - {{- end -}} - - {{- if kindIs "string" $enabled -}} - {{- $enabled = tpl $enabled $ -}} - - {{/* After tpl it becomes a string, not a bool */}} - {{- if eq $enabled "true" -}} - {{- $enabled = true -}} - {{- else if eq $enabled "false" -}} - {{- $enabled = false -}} - {{- end -}} - {{- end -}} - - {{- if $enabled -}} - - {{/* Create a copy of the mutatingWebhookConfiguration */}} - {{- $objectData := (mustDeepCopy $mutatingWebhookConfiguration) -}} - - {{- $objectName := (printf "%s-%s" $fullname $name) -}} - {{- if hasKey $objectData "expandObjectName" -}} - {{- if not $objectData.expandObjectName -}} - {{- $objectName = $name -}} - {{- end -}} - {{- end -}} - - {{/* Perform validations */}} - {{- include "tc.v1.common.lib.chart.names.validation" (dict "name" $objectName) -}} - {{- include "tc.v1.common.lib.metadata.validation" (dict "objectData" $objectData "caller" "Webhook") -}} - - {{/* Set the name of the MutatingWebhookConfiguration */}} - {{- $_ := set $objectData "name" $objectName -}} - {{- $_ := set $objectData "shortName" $name -}} - - {{- include "tc.v1.common.lib.webhook.validation" (dict "rootCtx" $ "objectData" $objectData) -}} - - {{- $type := tpl $objectData.type $ -}} - {{/* Call class to create the object */}} - {{- if eq $type "validating" -}} - {{- include "tc.v1.common.class.validatingWebhookconfiguration" (dict "rootCtx" $ "objectData" $objectData) -}} - {{- else if eq $type "mutating" -}} - {{- include "tc.v1.common.class.mutatingWebhookConfiguration" (dict "rootCtx" $ "objectData" $objectData) -}} - {{- end -}} - - {{- end -}} - - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/spawner/_workload.tpl b/cloudflared-6.0.4/charts/common/templates/spawner/_workload.tpl deleted file mode 100644 index 92c87bc..0000000 --- a/cloudflared-6.0.4/charts/common/templates/spawner/_workload.tpl +++ /dev/null @@ -1,57 +0,0 @@ -{{/* Workload Spawner */}} -{{/* Call this template: -{{ include "tc.v1.common.spawner.workload" $ -}} -*/}} - -{{- define "tc.v1.common.spawner.workload" -}} - {{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $ -}} - - {{/* Primary validation for enabled workload. */}} - {{- include "tc.v1.common.lib.workload.primaryValidation" $ -}} - - {{- range $name, $workload := .Values.workload -}} - - {{- if $workload.enabled -}} - - {{/* Create a copy of the workload */}} - {{- $objectData := (mustDeepCopy $workload) -}} - - {{/* Generate the name of the workload */}} - {{- $objectName := $fullname -}} - {{- if not $objectData.primary -}} - {{- $objectName = printf "%s-%s" $fullname $name -}} - {{- end -}} - - {{/* Perform validations */}} - {{- include "tc.v1.common.lib.chart.names.validation" (dict "name" $objectName) -}} - {{- include "tc.v1.common.lib.metadata.validation" (dict "objectData" $objectData "caller" "Workload") -}} - - {{/* Set the name of the workload */}} - {{- $_ := set $objectData "name" $objectName -}} - - {{/* Short name is the one that defined on the chart, used on selectors */}} - {{- $_ := set $objectData "shortName" $name -}} - - {{/* Set the podSpec so it doesn't fail on nil pointer */}} - {{- if not (hasKey $objectData "podSpec") -}} - {{- fail "Workload - Expected key to exist" -}} - {{- end -}} - - {{/* Call class to create the object */}} - {{- if eq $objectData.type "Deployment" -}} - {{- include "tc.v1.common.class.deployment" (dict "rootCtx" $ "objectData" $objectData) -}} - {{- else if eq $objectData.type "StatefulSet" -}} - {{- include "tc.v1.common.class.statefulset" (dict "rootCtx" $ "objectData" $objectData) -}} - {{- else if eq $objectData.type "DaemonSet" -}} - {{- include "tc.v1.common.class.daemonset" (dict "rootCtx" $ "objectData" $objectData) -}} - {{- else if eq $objectData.type "Job" -}} - {{- include "tc.v1.common.class.job" (dict "rootCtx" $ "objectData" $objectData) -}} - {{- else if eq $objectData.type "CronJob" -}} - {{- include "tc.v1.common.class.cronjob" (dict "rootCtx" $ "objectData" $objectData) -}} - {{- end -}} - - {{- end -}} - - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/values/_init.tpl b/cloudflared-6.0.4/charts/common/templates/values/_init.tpl deleted file mode 100644 index 154742d..0000000 --- a/cloudflared-6.0.4/charts/common/templates/values/_init.tpl +++ /dev/null @@ -1,14 +0,0 @@ -{{/* Merge chart values and the common chart defaults */}} -{{/* The ".common" is the name of the library */}} -{{/* Call this template: -{{ include "tc.v1.common.values.init" $ }} -*/}} - -{{- define "tc.v1.common.values.init" -}} - {{- if .Values.common -}} - {{- $commonValues := mustDeepCopy .Values.common -}} - {{- $chartValues := mustDeepCopy (omit .Values "common") -}} - {{- $mergedValues := mustMergeOverwrite $commonValues $chartValues -}} - {{- $_ := set . "Values" (mustDeepCopy $mergedValues) -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/values/_validate.tpl b/cloudflared-6.0.4/charts/common/templates/values/_validate.tpl deleted file mode 100644 index a6edc07..0000000 --- a/cloudflared-6.0.4/charts/common/templates/values/_validate.tpl +++ /dev/null @@ -1,18 +0,0 @@ -{{/* Validates any object that it does not contain helm errors */}} -{{/* This usually can happen after merging values from an include that did not render correcly */}} -{{/* Any object will be passed to "toYaml" */}} -{{/* Call this template: -{{ include "tc.v1.common.values.validate" . }} -*/}} -{{- define "tc.v1.common.values.validate" -}} - {{- $allValues := (toYaml .) -}} - - {{- if contains "error converting YAML to JSON" $allValues -}} - {{/* Print values to show values with the error included. */}} - {{/* Ideally we would want to extract the error only, but because it usually contains ":", - It gets parsed as dict and it cant regex matched it afterwards */}} - - {{- fail (printf "Chart - Values contain an error that may be a result of merging. Values containing the error: \n\n %v \n\n See error above values." $allValues) -}} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/values/lists/_deviceList.tpl b/cloudflared-6.0.4/charts/common/templates/values/lists/_deviceList.tpl deleted file mode 100644 index e48330d..0000000 --- a/cloudflared-6.0.4/charts/common/templates/values/lists/_deviceList.tpl +++ /dev/null @@ -1,21 +0,0 @@ -{{- define "tc.v1.common.values.deviceList" -}} - {{- $rootCtx := . -}} - - {{- range $idx, $deviceValues := $rootCtx.Values.deviceList -}} - {{- if eq $deviceValues.type "device" -}} - {{- $name := (printf "device-%s" (toString $idx)) -}} - - {{- with $deviceValues.name -}} - {{- $name = . -}} - {{- end -}} - - {{- if not (hasKey $rootCtx.Values "persistence") -}} - {{- $_ := set $rootCtx.Values "persistence" dict -}} - {{- end -}} - - {{- $_ := set $rootCtx.Values.persistence $name $deviceValues -}} - {{- else -}} - {{- fail (printf "Device List - Only [device] type can be defined in deviceList, but got [%s]" $deviceValues.type) -}} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/values/lists/_persistenceList.tpl b/cloudflared-6.0.4/charts/common/templates/values/lists/_persistenceList.tpl deleted file mode 100644 index 7f30716..0000000 --- a/cloudflared-6.0.4/charts/common/templates/values/lists/_persistenceList.tpl +++ /dev/null @@ -1,21 +0,0 @@ -{{- define "tc.v1.common.values.persistenceList" -}} - {{- $rootCtx := . -}} - - {{- range $idx, $persistenceValues := $rootCtx.Values.persistenceList -}} - {{- if ne $persistenceValues.type "device" -}} - {{- $name := (printf "persist-list-%s" (toString $idx)) -}} - - {{- with $persistenceValues.name -}} - {{- $name = . -}} - {{- end -}} - - {{- if not (hasKey $rootCtx.Values "persistence") -}} - {{- $_ := set $rootCtx.Values "persistence" dict -}} - {{- end -}} - - {{- $_ := set $rootCtx.Values.persistence $name $persistenceValues -}} - {{- else -}} - {{- fail "Persistence List - type [device] should be defined in deviceList only" -}} - {{- end -}} - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/values/lists/_portList.tpl b/cloudflared-6.0.4/charts/common/templates/values/lists/_portList.tpl deleted file mode 100644 index 4cfd4d4..0000000 --- a/cloudflared-6.0.4/charts/common/templates/values/lists/_portList.tpl +++ /dev/null @@ -1,34 +0,0 @@ -{{- define "tc.v1.common.values.portList" -}} - {{- $rootCtx := . -}} - {{- $svcValues := .svcValues -}} - - {{- $hasPrimaryPort := false -}} - {{- range $portName, $portValues := $svcValues.ports -}} - {{- if $portValues.enabled -}} - {{- if $portValues.primary -}} - {{- $hasPrimaryPort = true -}} - {{- end -}} - {{- end -}} - {{- end -}} - - {{- range $portIdx, $portValues := $svcValues.portsList -}} - {{- $portName := (printf "port-list-%s" (toString $portIdx)) -}} - - {{- if eq $portIdx 0 -}} - {{- if not $hasPrimaryPort -}} - {{- $_ := set $portValues "primary" true -}} - {{- end -}} - {{- end -}} - - {{- with $portValues.name -}} - {{- $portName = . -}} - {{- end -}} - - {{- if not (hasKey $svcValues "ports") -}} - {{- $_ := set $svcValues "ports" dict -}} - {{- end -}} - - {{- $_ := set $svcValues.ports $portName $portValues -}} - {{- end -}} - -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/templates/values/lists/_serviceList.tpl b/cloudflared-6.0.4/charts/common/templates/values/lists/_serviceList.tpl deleted file mode 100644 index 448a9f1..0000000 --- a/cloudflared-6.0.4/charts/common/templates/values/lists/_serviceList.tpl +++ /dev/null @@ -1,36 +0,0 @@ -{{- define "tc.v1.common.values.serviceList" -}} - {{- $rootCtx := . -}} - - {{- $hasPrimary := false -}} - {{- range $svcName, $svcValues := $rootCtx.Values.service -}} - {{- if $svcValues.enabled -}} - {{- if $svcValues.primary -}} - {{- $hasPrimary = true -}} - {{- end -}} {{/* Check if "service" has a portList. */}} - {{- include "tc.v1.common.values.portList" (dict "rootCtx" $rootCtx "svcValues" $svcValues) -}} - {{- end -}} - {{- end -}} - - {{- range $svcIdx, $svcValues := $rootCtx.Values.serviceList -}} - {{- $svcName := (printf "svc-list-%s" (toString $svcIdx)) -}} - - {{- if eq $svcIdx 0 -}} - {{- if not $hasPrimary -}} - {{- $_ := set $svcValues "primary" true -}} - {{- end -}} - {{- end -}} - - {{- with $svcValues.name -}} - {{- $svcName = . -}} - {{- end -}} - - {{- if not (hasKey $rootCtx.Values "service") -}} - {{- $_ := set $rootCtx.Values "service" dict -}} - {{- end -}} - - {{- include "tc.v1.common.values.portList" (dict "rootCtx" $rootCtx "svcValues" $svcValues) -}} - - {{- $_ := set $rootCtx.Values.service $svcName $svcValues -}} - - {{- end -}} -{{- end -}} diff --git a/cloudflared-6.0.4/charts/common/values.yaml b/cloudflared-6.0.4/charts/common/values.yaml deleted file mode 100644 index e29a0d1..0000000 --- a/cloudflared-6.0.4/charts/common/values.yaml +++ /dev/null @@ -1,843 +0,0 @@ -# -- Global values -global: - # -- Set additional global labels - labels: {} - # -- Set additional global annotations - annotations: {} - # -- Set a global namespace - # TODO: Currently some objects do not support this - namespace: "" - # -- Adds metalLB annotations to services - addMetalLBAnnotations: true - # -- Adds traefik annotations to services - addTraefikAnnotations: true - # -- Minimum nodePort value - minNodePort: 9000 - # -- Enable to stop most pods and containers including cnpg - # does not include stand-alone pods - stopAll: false - -fallbackDefaults: - # -- Define a storageClassName that will be used for all PVCs - # Can be overruled per PVC - storageClass: - # -- Default probe type - probeType: http - # -- Default Service Protocol - serviceProtocol: tcp - # -- Default Service Type - serviceType: ClusterIP - # -- Default persistence type - persistenceType: pvc - # -- Default Retain PVC - pvcRetain: false - # -- Default PVC Size - pvcSize: 100Gi - # -- Default VCT Size - vctSize: 100Gi - # -- Default PVC/VCT Access Modes - accessModes: - - ReadWriteOnce - # -- Default probe timeouts - probeTimeouts: - liveness: - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 5 - successThreshold: 1 - readiness: - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 5 - successThreshold: 2 - startup: - initialDelaySeconds: 10 - periodSeconds: 5 - timeoutSeconds: 2 - failureThreshold: 60 - successThreshold: 1 - -# -- Explicitly set a namespace for this chart only -namespace: "" - -# -- Image values -image: - # -- Image repository - repository: tccr.io/truecharts/whoami - # -- Image tag - tag: v1.10.1@sha256:36d22e4b8a154919b819bd7283531783eca9076972e8fc631649bb7eade770d9 - # -- Image pull policy - pullPolicy: IfNotPresent - -chartContext: - APPURL: "" - podCIDR: "" - svcCIDR: "" - -# -- Security Context -securityContext: - # -- Container security context for all containers - # Can be overruled per container - container: - runAsUser: 568 - runAsGroup: 568 - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - privileged: false - seccompProfile: - type: RuntimeDefault - capabilities: - add: [] - drop: - - ALL - # When set to false, it will automatically - # add CHOWN, SETUID, SETGID, FOWNER, DAC_OVERRIDE - # capabilities ONLY when container runs as ROOT - disableS6Caps: false - # -- PUID for all containers - # Can be overruled per container - PUID: 568 - # -- UMASK for all containers - # Can be overruled per container - UMASK: "0022" - # -- Pod security context for all pods - # Can be overruled per pod - pod: - fsGroup: 568 - fsGroupChangePolicy: OnRootMismatch - supplementalGroups: [] - sysctls: [] - -# -- Resources -# Can be overruled per container -resources: - limits: - cpu: 4000m - memory: 8Gi - requests: - cpu: 10m - memory: 50Mi - -containerOptions: - NVIDIA_CAPS: - - all - -# -- Options for all pods -# Can be overruled per pod -podOptions: - enableServiceLinks: false - hostNetwork: false - hostPID: false - shareProcessNamespace: false - restartPolicy: Always - dnsPolicy: ClusterFirst - dnsConfig: - options: - - name: ndots - value: "1" - hostAliases: [] - nodeSelector: {} - tolerations: [] - schedulerName: "" - priorityClassName: "" - runtimeClassName: "" - automountServiceAccountToken: false - terminationGracePeriodSeconds: 60 - -# -- (docs/workload/README.md) -workload: - main: - enabled: true - primary: true - type: Deployment - dbWait: true - podSpec: - containers: - main: - enabled: true - primary: true - imageSelector: image - probes: - liveness: - enabled: true - type: "{{ .Values.service.main.ports.main.protocol }}" - port: "{{ $.Values.service.main.ports.main.targetPort | default .Values.service.main.ports.main.port }}" - readiness: - enabled: true - type: "{{ .Values.service.main.ports.main.protocol }}" - port: "{{ $.Values.service.main.ports.main.targetPort | default .Values.service.main.ports.main.port }}" - startup: - enabled: true - type: "tcp" - port: "{{ $.Values.service.main.ports.main.targetPort | default .Values.service.main.ports.main.port }}" - -# -- Timezone used everywhere applicable -TZ: UTC - -# -- (docs/service/README.md) -service: - main: - enabled: true - primary: true - ports: - main: - enabled: true - primary: true - protocol: http - -serviceList: [] - -# -- (docs/persistence/README.md) -persistence: - shared: - enabled: true - type: emptyDir - mountPath: /shared - targetSelectAll: true - varlogs: - enabled: true - type: emptyDir - mountPath: /var/logs - targetSelectAll: true - varrun: - enabled: true - type: emptyDir - mountPath: /var/run - medium: Memory - targetSelectAll: true - tmp: - enabled: true - type: emptyDir - mountPath: /tmp - targetSelectAll: true - devshm: - enabled: true - type: emptyDir - mountPath: /dev/shm - medium: Memory - targetSelectAll: true - -persistenceList: [] - -deviceList: [] - -# -- Injected from SCALE middleware -# Only for reference here -ixExternalInterfacesConfiguration: [] -# -- Injected from SCALE middleware -# Only for reference here -ixExternalInterfacesConfigurationNames: [] -# -- Injected from SCALE middleware -# Only for reference here -ixCertificates: [] -# -- Injected from SCALE middleware -# Only for reference here -ixVolumes: [] - -# -- (docs/imagePullSecrets.md) -imagePullSecret: [] - -# -- (docs/configmap.md) -configmap: {} - -# -- (docs/secret.md) -secret: {} - -# -- (docs/serviceAccount.md) -serviceAccount: {} - -# -- (docs/rbac.md) -rbac: {} - -# -- (docs/volumeClaimTemplates) (StatefulSet only) -volumeClaimTemplates: {} - -# -- (docs/scaleExternalInterface.md) -scaleExternalInterface: [] - -# -- (docs/scaleCertificate.md) -scaleCertificate: {} - -# -- (docs/scaleGPU.md) -scaleGPU: [] - -# NOTES.txt -notes: - header: | - # Welcome to using <{{ .Chart.Name }}>. - Thank you for installing thank you for choosing TrueCharts - # custom: "{{ toYaml $.Values }}" - custom: | - ## Using <{{ .Chart.Name }}> - {{- if .Values.iXPortals -}} - ## Connecting externally - You can use this Chart by opening one of the following links in your browser: - {{- range .Values.iXPortals -}} - - {{ . }} - {{- end -}} - {{- end -}} - footer: | - ## Documentation - Please check out the TrueCharts documentation on: - https://truecharts.com - - OpenSource can only exist with your help, please consider supporting TrueCharts: - https://truecharts.org/sponsor - - -# -- iXsystems prototype values.yaml based portals -iXPortals: [] - -#### -## -## TrueCharts Specific Root Objects -## -#### - -# -- Defines the portals for which config needs to be generated -portal: - open: - enabled: false - override: - protocol: - host: - port: - path: "" - targetSelector: - ingress: "" - service: "" - port: "" - -# -- Set by "open" portal, used for some applications internally. -APPURL: "" - -gluetunImage: - repository: tccr.io/truecharts/gluetun - tag: v3.35.0@sha256:d86c128a3b480b6de94c81928e1007390fc0722eb4be8cd087c5c292fbec7a5b - pullPolicy: IfNotPresent - -netshootImage: - repository: tccr.io/truecharts/netshoot - tag: v0.11.0@sha256:e6a26284531b240865a0b31d1c8835e8ee1862799c816014e4c59c1401abe1c5 - pullPolicy: IfNotPresent - -tailscaleImage: - repository: tccr.io/truecharts/tailscale - tag: v1.48.1@sha256:53e5c5f8fca62664ad4404ebfb0fb6280404ad3a12c75d28afdbcdc5393b42a5 - pullPolicy: IfNotPresent - -codeserverImage: - repository: tccr.io/truecharts/code-server - tag: v4.16.1@sha256:fc3a0b190c3f6eac23ba65fc678fef2c2b37d40a0b6182183de642ca25668816 - pullPolicy: IfNotPresent - -alpineImage: - repository: tccr.io/truecharts/alpine - tag: v3.18.3@sha256:5391a9572fcfda2ec5a9df99e08d4772f13635041eccfa61e57d49935486d9db - pullPolicy: IfNotPresent - -scratchImage: - repository: tccr.io/truecharts/scratch - tag: latest@sha256:f4d99ffcd318372f92ecf9433a42348c1150f190c77253f5b73d835389b3da60 - pullPolicy: IfNotPresent - -kubectlImage: - repository: tccr.io/truecharts/kubectl - tag: v1.26.0@sha256:323ab7aa3e7ce84c024df79d0f364282c1135499298f54be2ade46508a116c4b - pullPolicy: IfNotPresent - -wgetImage: - repository: tccr.io/truecharts/wget - tag: 1.0.0@sha256:1764b1bb79b5d33edeb65b0bd5452b0a9622f8602f53a77e6a516261cfe7aa3d - pullPolicy: IfNotPresent - -postgresClientImage: - repository: tccr.io/truecharts/db-wait-postgres - tag: 1.1.0@sha256:a163c7836d7bb436a428f5d55bbba0eb73bcdb9bc202047e2523bbb539c113e6 - pullPolicy: IfNotPresent - -mariadbClientImage: - repository: tccr.io/truecharts/db-wait-mariadb - tag: 1.1.0@sha256:492a9659511d3288ba9b6536fb17d1cb037fb3876f402dffa5dbcb040acbb85a - pullPolicy: IfNotPresent - -redisClientImage: - repository: tccr.io/truecharts/db-wait-redis - tag: 1.1.0@sha256:8affa086d097b948f62b0433d70f4219a22ec29843ebd5479391869341bdb638 - pullPolicy: IfNotPresent - -mongodbClientImage: - repository: tccr.io/truecharts/db-wait-mongodb - tag: 1.1.0@sha256:502f70a653a905ad23576e208d0e5241e9cc8aeed63bb923e6da8563bdc3c1e7 - pullPolicy: IfNotPresent - -# -- OpenVPN specific configuration -# @default -- See below -openvpnImage: - # -- Specify the openvpn client image - repository: tccr.io/truecharts/openvpn-client - # -- Specify the openvpn client image tag - tag: latest@sha256:1f83decdf614cbf48e2429921b6f0efa0e825f447f5c510b65bc90f660227688 - # -- Specify the openvpn client image pull policy - pullPolicy: IfNotPresent - -# -- WireGuard specific configuration -# @default -- See below -wireguardImage: - # -- Specify the WireGuard image - repository: tccr.io/truecharts/wireguard - # -- Specify the WireGuard image tag - tag: v1.0.20210914@sha256:9f56e5660e8df8d4d38521ed73a4cc29fa24bf578007bfbe633e00184e2ebfbc - # -- Specify the WireGuard image pull policy - pullPolicy: IfNotPresent - - -# -- Configure the ingresses for the chart here. -# Additional ingresses can be added by adding a dictionary key similar to the 'main' ingress. -# @default -- See below -ingress: - main: - # -- Enables or disables the ingress - enabled: false - - # -- Make this the primary ingress (used in probes, notes, etc...). - # If there is more than 1 ingress, make sure that only 1 ingress is marked as primary. - primary: true - - # -- Ensure this ingress is always enabled. - required: false - - # -- Override the name suffix that is used for this ingress. - nameOverride: - - # -- Autolink the ingress to a service and port, both with the same name as the ingress. - autoLink: false - - # -- disable to ignore any default middlwares - enableFixedMiddlewares: true - - # -- set the Cert-Manager clusterissuer for this ingress - clusterIssuer: "" - - # -- List of middlewares in the traefikmiddlewares k8s namespace to add automatically - # Creates an annotation with the middlewares and appends k8s and traefik namespaces to the middleware names - # Primarily used for TrueNAS SCALE to add additional (seperate) middlewares without exposing them to the end-user - fixedMiddlewares: - - chain-basic - - # -- Additional List of middlewares in the traefikmiddlewares k8s namespace to add automatically - # Creates an annotation with the middlewares and appends k8s and traefik namespaces to the middleware names - middlewares: [] - annotationsList: [] - # - name: somename - # value: somevalue - # -- Provide additional annotations which may be required. - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - - labelsList: [] - # - name: somename - # value: somevalue - # -- Set labels on the deployment/statefulset/daemonset - # -- Provide additional labels which may be required. - # -- Provide additional labels which may be required. - labels: {} - - # -- Set the ingressClass that is used for this ingress. - # Requires Kubernetes >=1.19 - ingressClassName: # "nginx" - - ## Configure the hosts for the ingress - hosts: - - # -- Host address. Helm template can be passed. - host: chart-example.local - ## Configure the paths for the host - paths: - - # -- Path. Helm template can be passed. - path: / - # -- Ignored if not kubeVersion >= 1.14-0 - pathType: Prefix - service: - # -- Overrides the service name reference for this path - name: - # -- Overrides the service port reference for this path - port: - - # -- Configure TLS for the ingress. Both secretName and hosts can process a Helm template. - # Gets ignored when clusterIssuer is filled - tls: [] - # - secretName: chart-example-tls - # # Cannot be combined with scaleCert - # clusterIssuer: "" - # # Cannot be combined with clusterIssuer - # scaleCert: "" - # hosts: - # - chart-example.local - -# -- BETA: Configure the gateway routes for the chart here. -# Additional routes can be added by adding a dictionary key similar to the 'main' route. -# Please be aware that this is an early beta of this feature, TrueCharts does not guarantee this actually works. -# Being BETA this can/will change in the future without notice, please do not use unless you want to take that risk -# [[ref]](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io%2fv1alpha2) -# @default -- See below -route: - main: - # -- Enables or disables the route - enabled: false - # -- Set the route kind - # Valid options are GRPCRoute, HTTPRoute, TCPRoute, TLSRoute, UDPRoute - kind: HTTPRoute - # -- Provide additional annotations which may be required. - annotations: {} - # -- Provide additional labels which may be required. - labels: {} - # -- Configure the resource the route attaches to. - parentRefs: - - # Group of the referent resource. - group: gateway.networking.k8s.io - # Kind of the referent resource. - kind: Gateway - # Name of the referent resource - name: - # Namespace of the referent resource - namespace: - # Name of the section within the target resource. - sectionName: - # -- Host addresses - hostnames: [] - # -- Configure rules for routing. Defaults to the primary service. - rules: - - # -- Configure backends where matching requests should be sent. - backendRefs: - - group: "" - kind: Service - name: - namespace: - port: - weight: 1 - ## Configure conditions used for matching incoming requests. Only for HTTPRoutes - matches: - - path: - type: PathPrefix - value: / - -podDisruptionBudget: - main: - enabled: false - # -- Custom Selector Labels - # customLabels: - # customKey: customValue - targetSelector: main - minAvailable: 1 - maxUnavailable: 1 - -webhook: - validating: - enabled: false - type: validating - webhooks: [] - mutating: - enabled: false - type: mutating - webhooks: [] - -metrics: - main: - enabled: false - primary: true - # options: servicemonitor, podmonitor - type: "servicemonitor" - # defaults to selectorLabels - selector: {} - endpoints: - - port: main - interval: 5s - scrapeTimeout: 5s - path: / - honorLabels: false - prometheusRule: - enabled: false - groups: {} - # somegroup: - # # list of rules - # rules: [] - # # list to support adding rules via the SCALE GUI without overwrithing the rules - # additionalrules: [] - # List to support adding groups using the SCALE GUI - additionalgroups: - #- name: "somegroup" - # # list of rules - # rules: [] - # # list to support adding rules via the SCALE GUI without overwrithing the rules - # additionalrules: [] - -# -- Contains specific settings for helm charts containing or using operators -operator: - # -- Adds a configmap to the operator to register this chart as an operator - register: false - # -- Verified wether required operators for this chart are actually installed and registered - verify: - enabled: true - # -- Makes non-found operators hard-failing - failOnError: true - # -- a list of extra operators to check for - additionalOperators: [] - ## -- used as a datastore when a metallb operator is found. - # metallb: {} - ## -- used as a datastore when a traefik operator is found. - # traefik: {} - ## -- used as a datastore when a prometheus operator is found. - # prometheus: {} - ## -- used as a datastore when a cloudnative-pg operator is found. - # cloudnative-pg: {} - ## -- used as a datastore when a cert-manager operator is found. - # cert-manager: {} - -# -- The common chart supports several add-ons. These can be configured under this key. -# @default -- See below -addons: - # -- The common chart supports adding a VPN add-on. It can be configured under this key. - # @default -- See values.yaml - vpn: - # -- Specify the VPN type. Valid options are disabled, gluetun, openvpn, wireguard or tailscale - # OpenVPN and Wireguard are considered deprecated - type: disabled - - # -- Tailscale specific configuration - # @default -- See below - # See more info for the configuration - # https://github.com/tailscale/tailscale/blob/main/docs/k8s/run.sh - tailscale: - # -- Auth key to connect to the VPN Service - authkey: "" - # As a sidecar, it should only need to run in userspace - userspace: true - auth_once: true - accept_dns: false - routes: "" - dest_ip: "" - sock5_server: "" - extra_args: "" - daemon_extra_args: "" - outbound_http_proxy_listen: "" - # -- Annotations for tailscale sidecar - annotations: {} - - # -- OpenVPN specific configuration - # @default -- See below - openvpn: - # -- Credentials to connect to the VPN Service (used with -a) - # Only using password is enough - username: "" - password: "" - - # -- All variables specified here will be added to the vpn sidecar container - # See the documentation of the VPN image for all config values - env: {} - # TZ: UTC - - # -- All variables specified here will be added to the vpn sidecar container - # See the documentation of the VPN image for all config values - envList: [] - # - name: someenv - # value: somevalue - - - # -- you can directly specify the config file here - config: "" - - scripts: - # -- you can directly specify the upscript here - up: "" - # some script - - # -- you can directly specify the downscript here - down: "" - # some script - - # -- Provide a customized vpn configuration file location to be used by the VPN. - configFile: "" - - # -- Provide a customized vpn configuration folder location to be added to the VPN container - # The config file needs to be mounted seperately - # the upscript and downscript need to be named: upscript.sh and downscript.sh respectively - configFolder: "" - - # -- Provide an existing secret for vpn config storage - existingSecret: "" - - # -- select pods to bind vpn addon to - # Add "codeserver" to also add the codeserver pod to VPN - targetSelector: - - main - - ## Only for Wireguard and OpenVPN - killSwitch: true - excludedNetworks_IPv4: [] - excludedNetworks_IPv6: [] - - - # -- The common library supports adding a code-server add-on to access files. It can be configured under this key. - # @default -- See values.yaml - codeserver: - # -- Enable running a code-server container in the pod - enabled: false - - # -- Set any environment variables for code-server here - env: {} - - # -- All variables specified here will be added to the codeserver sidecar container - # See the documentation of the codeserver image for all config values - envList: [] - # - name: someenv - # value: somevalue - # -- Set codeserver command line arguments. - # Consider setting --user-data-dir to a persistent location to preserve code-server setting changes - args: - - --auth - - none - # - --user-data-dir - # - "/config/.vscode" - - # -- Specify the working dir that will be opened when code-server starts - # If not given, the app will default to the mountpah of the first specified volumeMount - workingDir: "/" - - service: - # -- Enable a service for the code-server add-on. - enabled: true - type: ClusterIP - # Specify the default port information - ports: - codeserver: - enabled: true - primary: true - protocol: http - port: 12321 - - ingress: - # -- Enable an ingress for the code-server add-on. - enabled: false - annotations: {} - # kubernetes.io/ingress.class: nginx - labels: {} - hosts: - - host: code.chart-example.local - paths: - - path: / - # Ignored if not kubeVersion >= 1.14-0 - pathType: Prefix - tls: [] - - # -- Select a container to add the addon to - targetSelector: "" - - - netshoot: - # -- Enable running a netshoot container in the pod - enabled: false - - # -- Set any environment variables for netshoot here - env: {} - - -## -# This section contains some-preconfig for frequently used dependencies -## - -cnpg: - main: - enabled: false - primary: true - # -- Puts the cnpg cluster in hibernation mode - hibernate: false - # -- number of instances for both postgres and pgbouncer - instances: 2 - database: "app" - user: "app" - # password: - # superUserPassword: - # -- change to supervised to disable unsupervised updates - # Example of rolling update strategy: - # - unsupervised: automated update of the primary once all - # replicas have been upgraded (default) - # - supervised: requires manual supervision to perform - # the switchover of the primary - primaryUpdateStrategy: unsupervised - # -- enable to create extra pgbouncer for readonly access - acceptRO: false - # -- storage size for the two pvc's per instance - storage: - size: "256Gi" - walsize: "256Gi" - # -- Gets scaled to 0 if hibernation is true - pooler: - instances: 2 - # -- set to enable prometheus metrics - monitoring: - enablePodMonitor: true - # -- contains credentials and urls output by generator - creds: {} - # -- contains postgresql settings - # ref: https://cloudnative-pg.io/documentation/1.19/postgresql_conf/#the-postgresql-section - postgresql: {} - -# -- Redis dependency configuration -# @default -- See below -redis: - enabled: false - # -- can be used to make an easy accessable note which URLS to use to access the DB. - creds: {} - manifestManager: - enabled: false - secret: - credentials: - enabled: false - -# -- mariadb dependency configuration -# @default -- See below -mariadb: - enabled: false - existingSecret: "mariadbcreds" - # -- can be used to make an easy accessable note which URLS to use to access the DB. - creds: {} - manifestManager: - enabled: false - -# -- mongodb dependency configuration -# @default -- See below -mongodb: - enabled: false - existingSecret: "mongodbcreds" - # -- can be used to make an easy accessable note which URLS to use to access the DB. - creds: {} - manifestManager: - enabled: false - -# -- clickhouse dependency configuration -# @default -- See below -clickhouse: - enabled: false - existingSecret: "clickhousecreds" - # -- can be used to make an easy accessable note which URLS to use to access the DB. - creds: {} - manifestManager: - enabled: false - -# -- solr dependency configuration -# @default -- See below -solr: - enabled: false - solrCores: 1 - solrEnableAuthentication: "no" - existingSecret: "solrcreds" - # -- can be used to make an easy accessable note which URLS to use to access the DB. - creds: {} - manifestManager: - enabled: false - -# -- List of extra objects to deploy with the release -extraTpl: [] diff --git a/cloudflared-6.0.4/ci/test-values.yaml b/cloudflared-6.0.4/ci/test-values.yaml deleted file mode 100644 index bc009c8..0000000 --- a/cloudflared-6.0.4/ci/test-values.yaml +++ /dev/null @@ -1,9 +0,0 @@ -workload: - main: - podSpec: - containers: - main: - args: - - tunnel - - --no-autoupdate - - --hello-world diff --git a/cloudflared-6.0.4/questions.yaml b/cloudflared-6.0.4/questions.yaml deleted file mode 100644 index 9e9cfb9..0000000 --- a/cloudflared-6.0.4/questions.yaml +++ /dev/null @@ -1,65 +0,0 @@ -# Include{groups} -portals: {} -questions: -# Include{global} -# Include{workload} -# Include{workloadDeployment} - -# Include{replicas1} -# Include{podSpec} -# Include{containerMain} - - variable: env - group: "App Configuration" - label: "Image Environment" - schema: - additional_attrs: true - type: dict - attrs: - - variable: TUNNEL_TOKEN - label: "Tunnel Token" - description: "Token for tunnel (Tunnel managed by Cloudflare not locally)" - schema: - type: string - required: true - default: "" - -# Include{containerBasic} -# Include{containerAdvanced} - -# Include{containerConfig} -# Include{podOptions} -# Include{serviceExpertRoot} -# Include{serviceExpert} -# Include{serviceList} -# Include{persistenceList} -# Include{securityContextRoot} - - - variable: runAsUser - label: "runAsUser" - description: "The UserID of the user running the application" - schema: - type: int - default: 0 - - variable: runAsGroup - label: "runAsGroup" - description: "The groupID of the user running the application" - schema: - type: int - default: 0 -# Include{securityContextContainer} -# Include{securityContextAdvanced} -# Include{securityContextPod} - - variable: fsGroup - label: "fsGroup" - description: "The group that should own ALL storage." - schema: - type: int - default: 568 - -# Include{resources} -# Include{advanced} -# Include{addons} -# Include{codeserver} -# Include{netshoot} -# Include{vpn} -# Include{documentation} diff --git a/cloudflared-6.0.4/templates/common.yaml b/cloudflared-6.0.4/templates/common.yaml deleted file mode 100644 index b51394e..0000000 --- a/cloudflared-6.0.4/templates/common.yaml +++ /dev/null @@ -1 +0,0 @@ -{{ include "tc.v1.common.loader.all" . }} diff --git a/cloudflared-6.0.4/values.home.yaml b/cloudflared-6.0.4/values.home.yaml deleted file mode 100644 index 6e3ace0..0000000 --- a/cloudflared-6.0.4/values.home.yaml +++ /dev/null @@ -1,34 +0,0 @@ -image: - repository: quay.io/truecharts/cloudflared - pullPolicy: IfNotPresent - tag: v2023.10.0 - -workload: - main: - podSpec: - containers: - main: - probes: - liveness: - enabled: false - readiness: - enabled: false - startup: - enabled: false - args: - - tunnel - - --no-autoupdate - - run - env: - TUNNEL_TOKEN: 'eyJhIjoiNmRlYmQ1NmE5N2VhMmFkOTM4ZjA3NDI4ZWU1NGYxMmEiLCJ0IjoiMGQ3ZjhkYWMtOTUzMC00NzU2LWI0ZTgtMTc0YTllOGNlZTkxIiwicyI6IllqUXdNVE15TVdVdE1tUXlOUzAwTXpVM0xUa3dOMk10TW1SbU16RmlNemxsTTJZNCJ9' - -service: - main: - enabled: false - ports: - main: - enabled: false - -portal: - open: - enabled: false diff --git a/cloudflared-6.0.4/values.yaml b/cloudflared-6.0.4/values.yaml deleted file mode 100644 index 4054c93..0000000 --- a/cloudflared-6.0.4/values.yaml +++ /dev/null @@ -1,34 +0,0 @@ -image: - repository: tccr.io/truecharts/cloudflared - pullPolicy: IfNotPresent - tag: v2023.8.2@sha256:fda01764ea6d58703cf1dbe74617cffd000d3bc8df9e49fb84ba53785b4e9cf4 - -workload: - main: - podSpec: - containers: - main: - probes: - liveness: - enabled: false - readiness: - enabled: false - startup: - enabled: false - args: - - tunnel - - --no-autoupdate - - run - env: - TUNNEL_TOKEN: "" - -service: - main: - enabled: false - ports: - main: - enabled: false - -portal: - open: - enabled: false diff --git a/cloudflared-6.0.4/charts/common/.helmignore b/postgres-operator/.helmignore similarity index 95% rename from cloudflared-6.0.4/charts/common/.helmignore rename to postgres-operator/.helmignore index 0e8a0eb..f0c1319 100644 --- a/cloudflared-6.0.4/charts/common/.helmignore +++ b/postgres-operator/.helmignore @@ -14,10 +14,8 @@ *.swp *.bak *.tmp -*.orig *~ # Various IDEs .project .idea/ *.tmproj -.vscode/ diff --git a/postgres-operator/Chart.yaml b/postgres-operator/Chart.yaml new file mode 100644 index 0000000..91dd703 --- /dev/null +++ b/postgres-operator/Chart.yaml @@ -0,0 +1,18 @@ +apiVersion: v2 +appVersion: 1.10.1 +description: Postgres Operator creates and manages PostgreSQL clusters running in + Kubernetes +home: https://github.com/zalando/postgres-operator +keywords: +- postgres +- operator +- cloud-native +- patroni +- spilo +maintainers: +- email: opensource@zalando.de + name: Zalando +name: postgres-operator +sources: +- https://github.com/zalando/postgres-operator +version: 1.10.1 diff --git a/postgres-operator/crds/operatorconfigurations.yaml b/postgres-operator/crds/operatorconfigurations.yaml new file mode 100644 index 0000000..c6d2635 --- /dev/null +++ b/postgres-operator/crds/operatorconfigurations.yaml @@ -0,0 +1,679 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: operatorconfigurations.acid.zalan.do + labels: + app.kubernetes.io/name: postgres-operator +spec: + group: acid.zalan.do + names: + kind: OperatorConfiguration + listKind: OperatorConfigurationList + plural: operatorconfigurations + singular: operatorconfiguration + shortNames: + - opconfig + categories: + - all + scope: Namespaced + versions: + - name: v1 + served: true + storage: true + subresources: + status: {} + additionalPrinterColumns: + - name: Image + type: string + description: Spilo image to be used for Pods + jsonPath: .configuration.docker_image + - name: Cluster-Label + type: string + description: Label for K8s resources created by operator + jsonPath: .configuration.kubernetes.cluster_name_label + - name: Service-Account + type: string + description: Name of service account to be used + jsonPath: .configuration.kubernetes.pod_service_account_name + - name: Min-Instances + type: integer + description: Minimum number of instances per Postgres cluster + jsonPath: .configuration.min_instances + - name: Age + type: date + jsonPath: .metadata.creationTimestamp + schema: + openAPIV3Schema: + type: object + required: + - kind + - apiVersion + - configuration + properties: + kind: + type: string + enum: + - OperatorConfiguration + apiVersion: + type: string + enum: + - acid.zalan.do/v1 + configuration: + type: object + properties: + crd_categories: + type: array + nullable: true + items: + type: string + docker_image: + type: string + default: "ghcr.io/zalando/spilo-15:3.0-p1" + enable_crd_registration: + type: boolean + default: true + enable_crd_validation: + type: boolean + description: deprecated + default: true + enable_lazy_spilo_upgrade: + type: boolean + default: false + enable_pgversion_env_var: + type: boolean + default: true + enable_shm_volume: + type: boolean + default: true + enable_spilo_wal_path_compat: + type: boolean + default: false + enable_team_id_clustername_prefix: + type: boolean + default: false + etcd_host: + type: string + default: "" + ignore_instance_limits_annotation_key: + type: string + kubernetes_use_configmaps: + type: boolean + default: false + max_instances: + type: integer + description: "-1 = disabled" + minimum: -1 + default: -1 + min_instances: + type: integer + description: "-1 = disabled" + minimum: -1 + default: -1 + resync_period: + type: string + default: "30m" + repair_period: + type: string + default: "5m" + set_memory_request_to_limit: + type: boolean + default: false + sidecar_docker_images: + type: object + additionalProperties: + type: string + sidecars: + type: array + nullable: true + items: + type: object + x-kubernetes-preserve-unknown-fields: true + workers: + type: integer + minimum: 1 + default: 8 + users: + type: object + properties: + additional_owner_roles: + type: array + nullable: true + items: + type: string + enable_password_rotation: + type: boolean + default: false + password_rotation_interval: + type: integer + default: 90 + password_rotation_user_retention: + type: integer + default: 180 + replication_username: + type: string + default: standby + super_username: + type: string + default: postgres + major_version_upgrade: + type: object + properties: + major_version_upgrade_mode: + type: string + default: "off" + major_version_upgrade_team_allow_list: + type: array + items: + type: string + minimal_major_version: + type: string + default: "11" + target_major_version: + type: string + default: "15" + kubernetes: + type: object + properties: + additional_pod_capabilities: + type: array + items: + type: string + cluster_domain: + type: string + default: "cluster.local" + cluster_labels: + type: object + additionalProperties: + type: string + default: + application: spilo + cluster_name_label: + type: string + default: "cluster-name" + custom_pod_annotations: + type: object + additionalProperties: + type: string + delete_annotation_date_key: + type: string + delete_annotation_name_key: + type: string + downscaler_annotations: + type: array + items: + type: string + enable_cross_namespace_secret: + type: boolean + default: false + enable_init_containers: + type: boolean + default: true + enable_pod_antiaffinity: + type: boolean + default: false + enable_pod_disruption_budget: + type: boolean + default: true + enable_readiness_probe: + type: boolean + default: false + enable_sidecars: + type: boolean + default: true + ignored_annotations: + type: array + items: + type: string + infrastructure_roles_secret_name: + type: string + infrastructure_roles_secrets: + type: array + nullable: true + items: + type: object + required: + - secretname + - userkey + - passwordkey + properties: + secretname: + type: string + userkey: + type: string + passwordkey: + type: string + rolekey: + type: string + defaultuservalue: + type: string + defaultrolevalue: + type: string + details: + type: string + template: + type: boolean + inherited_annotations: + type: array + items: + type: string + inherited_labels: + type: array + items: + type: string + master_pod_move_timeout: + type: string + default: "20m" + node_readiness_label: + type: object + additionalProperties: + type: string + node_readiness_label_merge: + type: string + enum: + - "AND" + - "OR" + oauth_token_secret_name: + type: string + default: "postgresql-operator" + pdb_name_format: + type: string + default: "postgres-{cluster}-pdb" + pod_antiaffinity_preferred_during_scheduling: + type: boolean + default: false + pod_antiaffinity_topology_key: + type: string + default: "kubernetes.io/hostname" + pod_environment_configmap: + type: string + pod_environment_secret: + type: string + pod_management_policy: + type: string + enum: + - "ordered_ready" + - "parallel" + default: "ordered_ready" + pod_priority_class_name: + type: string + pod_role_label: + type: string + default: "spilo-role" + pod_service_account_definition: + type: string + default: "" + pod_service_account_name: + type: string + default: "postgres-pod" + pod_service_account_role_binding_definition: + type: string + default: "" + pod_terminate_grace_period: + type: string + default: "5m" + secret_name_template: + type: string + default: "{username}.{cluster}.credentials.{tprkind}.{tprgroup}" + share_pgsocket_with_sidecars: + type: boolean + default: false + spilo_allow_privilege_escalation: + type: boolean + default: true + spilo_runasuser: + type: integer + spilo_runasgroup: + type: integer + spilo_fsgroup: + type: integer + spilo_privileged: + type: boolean + default: false + storage_resize_mode: + type: string + enum: + - "ebs" + - "mixed" + - "pvc" + - "off" + default: "pvc" + toleration: + type: object + additionalProperties: + type: string + watched_namespace: + type: string + postgres_pod_resources: + type: object + properties: + default_cpu_limit: + type: string + pattern: '^(\d+m|\d+(\.\d{1,3})?)$' + default: "1" + default_cpu_request: + type: string + pattern: '^(\d+m|\d+(\.\d{1,3})?)$' + default: "100m" + default_memory_limit: + type: string + pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$' + default: "500Mi" + default_memory_request: + type: string + pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$' + default: "100Mi" + max_cpu_request: + type: string + pattern: '^(\d+m|\d+(\.\d{1,3})?)$' + max_memory_request: + type: string + pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$' + min_cpu_limit: + type: string + pattern: '^(\d+m|\d+(\.\d{1,3})?)$' + default: "250m" + min_memory_limit: + type: string + pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$' + default: "250Mi" + timeouts: + type: object + properties: + patroni_api_check_interval: + type: string + default: "1s" + patroni_api_check_timeout: + type: string + default: "5s" + pod_label_wait_timeout: + type: string + default: "10m" + pod_deletion_wait_timeout: + type: string + default: "10m" + ready_wait_interval: + type: string + default: "4s" + ready_wait_timeout: + type: string + default: "30s" + resource_check_interval: + type: string + default: "3s" + resource_check_timeout: + type: string + default: "10m" + load_balancer: + type: object + properties: + custom_service_annotations: + type: object + additionalProperties: + type: string + db_hosted_zone: + type: string + default: "db.example.com" + enable_master_load_balancer: + type: boolean + default: true + enable_master_pooler_load_balancer: + type: boolean + default: false + enable_replica_load_balancer: + type: boolean + default: false + enable_replica_pooler_load_balancer: + type: boolean + default: false + external_traffic_policy: + type: string + enum: + - "Cluster" + - "Local" + default: "Cluster" + master_dns_name_format: + type: string + default: "{cluster}.{namespace}.{hostedzone}" + master_legacy_dns_name_format: + type: string + default: "{cluster}.{team}.{hostedzone}" + replica_dns_name_format: + type: string + default: "{cluster}-repl.{namespace}.{hostedzone}" + replica_legacy_dns_name_format: + type: string + default: "{cluster}-repl.{team}.{hostedzone}" + aws_or_gcp: + type: object + properties: + additional_secret_mount: + type: string + additional_secret_mount_path: + type: string + default: "/meta/credentials" + aws_region: + type: string + default: "eu-central-1" + enable_ebs_gp3_migration: + type: boolean + default: false + enable_ebs_gp3_migration_max_size: + type: integer + default: 1000 + gcp_credentials: + type: string + kube_iam_role: + type: string + log_s3_bucket: + type: string + wal_az_storage_account: + type: string + wal_gs_bucket: + type: string + wal_s3_bucket: + type: string + logical_backup: + type: object + properties: + logical_backup_azure_storage_account_name: + type: string + logical_backup_azure_storage_container: + type: string + logical_backup_azure_storage_account_key: + type: string + logical_backup_cpu_limit: + type: string + pattern: '^(\d+m|\d+(\.\d{1,3})?)$' + logical_backup_cpu_request: + type: string + pattern: '^(\d+m|\d+(\.\d{1,3})?)$' + logical_backup_docker_image: + type: string + default: "registry.opensource.zalan.do/acid/logical-backup:v1.10.1" + logical_backup_google_application_credentials: + type: string + logical_backup_job_prefix: + type: string + default: "logical-backup-" + logical_backup_memory_limit: + type: string + pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$' + logical_backup_memory_request: + type: string + pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$' + logical_backup_provider: + type: string + enum: + - "az" + - "gcs" + - "s3" + default: "s3" + logical_backup_s3_access_key_id: + type: string + logical_backup_s3_bucket: + type: string + logical_backup_s3_endpoint: + type: string + logical_backup_s3_region: + type: string + logical_backup_s3_secret_access_key: + type: string + logical_backup_s3_sse: + type: string + logical_backup_s3_retention_time: + type: string + logical_backup_schedule: + type: string + pattern: '^(\d+|\*)(/\d+)?(\s+(\d+|\*)(/\d+)?){4}$' + default: "30 00 * * *" + debug: + type: object + properties: + debug_logging: + type: boolean + default: true + enable_database_access: + type: boolean + default: true + teams_api: + type: object + properties: + enable_admin_role_for_users: + type: boolean + default: true + enable_postgres_team_crd: + type: boolean + default: true + enable_postgres_team_crd_superusers: + type: boolean + default: false + enable_team_member_deprecation: + type: boolean + default: false + enable_team_superuser: + type: boolean + default: false + enable_teams_api: + type: boolean + default: true + pam_configuration: + type: string + default: "https://info.example.com/oauth2/tokeninfo?access_token= uid realm=/employees" + pam_role_name: + type: string + default: "zalandos" + postgres_superuser_teams: + type: array + items: + type: string + protected_role_names: + type: array + items: + type: string + default: + - admin + - cron_admin + role_deletion_suffix: + type: string + default: "_deleted" + team_admin_role: + type: string + default: "admin" + team_api_role_configuration: + type: object + additionalProperties: + type: string + default: + log_statement: all + teams_api_url: + type: string + default: "https://teams.example.com/api/" + logging_rest_api: + type: object + properties: + api_port: + type: integer + default: 8080 + cluster_history_entries: + type: integer + default: 1000 + ring_log_lines: + type: integer + default: 100 + scalyr: # deprecated + type: object + properties: + scalyr_api_key: + type: string + scalyr_cpu_limit: + type: string + pattern: '^(\d+m|\d+(\.\d{1,3})?)$' + default: "1" + scalyr_cpu_request: + type: string + pattern: '^(\d+m|\d+(\.\d{1,3})?)$' + default: "100m" + scalyr_image: + type: string + scalyr_memory_limit: + type: string + pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$' + default: "500Mi" + scalyr_memory_request: + type: string + pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$' + default: "50Mi" + scalyr_server_url: + type: string + default: "https://upload.eu.scalyr.com" + connection_pooler: + type: object + properties: + connection_pooler_schema: + type: string + default: "pooler" + connection_pooler_user: + type: string + default: "pooler" + connection_pooler_image: + type: string + default: "registry.opensource.zalan.do/acid/pgbouncer:master-27" + connection_pooler_max_db_connections: + type: integer + default: 60 + connection_pooler_mode: + type: string + enum: + - "session" + - "transaction" + default: "transaction" + connection_pooler_number_of_instances: + type: integer + minimum: 1 + default: 2 + connection_pooler_default_cpu_limit: + type: string + pattern: '^(\d+m|\d+(\.\d{1,3})?)$' + default: "1" + connection_pooler_default_cpu_request: + type: string + pattern: '^(\d+m|\d+(\.\d{1,3})?)$' + default: "500m" + connection_pooler_default_memory_limit: + type: string + pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$' + default: "100Mi" + connection_pooler_default_memory_request: + type: string + pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$' + default: "100Mi" + patroni: + type: object + properties: + enable_patroni_failsafe_mode: + type: boolean + default: false + status: + type: object + additionalProperties: + type: string diff --git a/postgres-operator/crds/postgresqls.yaml b/postgres-operator/crds/postgresqls.yaml new file mode 100644 index 0000000..6f938cf --- /dev/null +++ b/postgres-operator/crds/postgresqls.yaml @@ -0,0 +1,656 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: postgresqls.acid.zalan.do + labels: + app.kubernetes.io/name: postgres-operator +spec: + group: acid.zalan.do + names: + kind: postgresql + listKind: postgresqlList + plural: postgresqls + singular: postgresql + shortNames: + - pg + categories: + - all + scope: Namespaced + versions: + - name: v1 + served: true + storage: true + subresources: + status: {} + additionalPrinterColumns: + - name: Team + type: string + description: Team responsible for Postgres cluster + jsonPath: .spec.teamId + - name: Version + type: string + description: PostgreSQL version + jsonPath: .spec.postgresql.version + - name: Pods + type: integer + description: Number of Pods per Postgres cluster + jsonPath: .spec.numberOfInstances + - name: Volume + type: string + description: Size of the bound volume + jsonPath: .spec.volume.size + - name: CPU-Request + type: string + description: Requested CPU for Postgres containers + jsonPath: .spec.resources.requests.cpu + - name: Memory-Request + type: string + description: Requested memory for Postgres containers + jsonPath: .spec.resources.requests.memory + - name: Age + type: date + jsonPath: .metadata.creationTimestamp + - name: Status + type: string + description: Current sync status of postgresql resource + jsonPath: .status.PostgresClusterStatus + schema: + openAPIV3Schema: + type: object + required: + - kind + - apiVersion + - spec + properties: + kind: + type: string + enum: + - postgresql + apiVersion: + type: string + enum: + - acid.zalan.do/v1 + spec: + type: object + required: + - numberOfInstances + - teamId + - postgresql + - volume + properties: + additionalVolumes: + type: array + items: + type: object + required: + - name + - mountPath + - volumeSource + properties: + name: + type: string + mountPath: + type: string + targetContainers: + type: array + nullable: true + items: + type: string + volumeSource: + type: object + x-kubernetes-preserve-unknown-fields: true + subPath: + type: string + allowedSourceRanges: + type: array + nullable: true + items: + type: string + pattern: '^(\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\.(\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\.(\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\.(\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\/(\d|[1-2]\d|3[0-2])$' + clone: + type: object + required: + - cluster + properties: + cluster: + type: string + s3_endpoint: + type: string + s3_access_key_id: + type: string + s3_secret_access_key: + type: string + s3_force_path_style: + type: boolean + s3_wal_path: + type: string + timestamp: + type: string + pattern: '^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\.[0-9]+)?(([+-]([01][0-9]|2[0-3]):[0-5][0-9]))$' + # The regexp matches the date-time format (RFC 3339 Section 5.6) that specifies a timezone as an offset relative to UTC + # Example: 1996-12-19T16:39:57-08:00 + # Note: this field requires a timezone + uid: + format: uuid + type: string + connectionPooler: + type: object + properties: + dockerImage: + type: string + maxDBConnections: + type: integer + mode: + type: string + enum: + - "session" + - "transaction" + numberOfInstances: + type: integer + minimum: 1 + resources: + type: object + properties: + limits: + type: object + properties: + cpu: + type: string + pattern: '^(\d+m|\d+(\.\d{1,3})?)$' + memory: + type: string + pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$' + requests: + type: object + properties: + cpu: + type: string + pattern: '^(\d+m|\d+(\.\d{1,3})?)$' + memory: + type: string + pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$' + schema: + type: string + user: + type: string + databases: + type: object + additionalProperties: + type: string + # Note: usernames specified here as database owners must be declared in the users key of the spec key. + dockerImage: + type: string + enableConnectionPooler: + type: boolean + enableReplicaConnectionPooler: + type: boolean + enableLogicalBackup: + type: boolean + enableMasterLoadBalancer: + type: boolean + enableMasterPoolerLoadBalancer: + type: boolean + enableReplicaLoadBalancer: + type: boolean + enableReplicaPoolerLoadBalancer: + type: boolean + enableShmVolume: + type: boolean + env: + type: array + nullable: true + items: + type: object + x-kubernetes-preserve-unknown-fields: true + init_containers: + type: array + description: deprecated + nullable: true + items: + type: object + x-kubernetes-preserve-unknown-fields: true + initContainers: + type: array + nullable: true + items: + type: object + x-kubernetes-preserve-unknown-fields: true + logicalBackupSchedule: + type: string + pattern: '^(\d+|\*)(/\d+)?(\s+(\d+|\*)(/\d+)?){4}$' + maintenanceWindows: + type: array + items: + type: string + pattern: '^\ *((Mon|Tue|Wed|Thu|Fri|Sat|Sun):(2[0-3]|[01]?\d):([0-5]?\d)|(2[0-3]|[01]?\d):([0-5]?\d))-((Mon|Tue|Wed|Thu|Fri|Sat|Sun):(2[0-3]|[01]?\d):([0-5]?\d)|(2[0-3]|[01]?\d):([0-5]?\d))\ *$' + masterServiceAnnotations: + type: object + additionalProperties: + type: string + nodeAffinity: + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + type: array + items: + type: object + required: + - preference + - weight + properties: + preference: + type: object + properties: + matchExpressions: + type: array + items: + type: object + required: + - key + - operator + properties: + key: + type: string + operator: + type: string + values: + type: array + items: + type: string + matchFields: + type: array + items: + type: object + required: + - key + - operator + properties: + key: + type: string + operator: + type: string + values: + type: array + items: + type: string + weight: + format: int32 + type: integer + requiredDuringSchedulingIgnoredDuringExecution: + type: object + required: + - nodeSelectorTerms + properties: + nodeSelectorTerms: + type: array + items: + type: object + properties: + matchExpressions: + type: array + items: + type: object + required: + - key + - operator + properties: + key: + type: string + operator: + type: string + values: + type: array + items: + type: string + matchFields: + type: array + items: + type: object + required: + - key + - operator + properties: + key: + type: string + operator: + type: string + values: + type: array + items: + type: string + numberOfInstances: + type: integer + minimum: 0 + patroni: + type: object + properties: + failsafe_mode: + type: boolean + initdb: + type: object + additionalProperties: + type: string + loop_wait: + type: integer + maximum_lag_on_failover: + type: integer + pg_hba: + type: array + items: + type: string + retry_timeout: + type: integer + slots: + type: object + additionalProperties: + type: object + additionalProperties: + type: string + synchronous_mode: + type: boolean + synchronous_mode_strict: + type: boolean + synchronous_node_count: + type: integer + ttl: + type: integer + podAnnotations: + type: object + additionalProperties: + type: string + pod_priority_class_name: + type: string + description: deprecated + podPriorityClassName: + type: string + postgresql: + type: object + required: + - version + properties: + version: + type: string + enum: + - "10" + - "11" + - "12" + - "13" + - "14" + - "15" + parameters: + type: object + additionalProperties: + type: string + preparedDatabases: + type: object + additionalProperties: + type: object + properties: + defaultUsers: + type: boolean + extensions: + type: object + additionalProperties: + type: string + schemas: + type: object + additionalProperties: + type: object + properties: + defaultUsers: + type: boolean + defaultRoles: + type: boolean + secretNamespace: + type: string + replicaLoadBalancer: + type: boolean + description: deprecated + replicaServiceAnnotations: + type: object + additionalProperties: + type: string + resources: + type: object + properties: + limits: + type: object + properties: + cpu: + type: string + # Decimal natural followed by m, or decimal natural followed by + # dot followed by up to three decimal digits. + # + # This is because the Kubernetes CPU resource has millis as the + # maximum precision. The actual values are checked in code + # because the regular expression would be huge and horrible and + # not very helpful in validation error messages; this one checks + # only the format of the given number. + # + # https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu + pattern: '^(\d+m|\d+(\.\d{1,3})?)$' + # Note: the value specified here must not be zero or be lower + # than the corresponding request. + memory: + type: string + # You can express memory as a plain integer or as a fixed-point + # integer using one of these suffixes: E, P, T, G, M, k. You can + # also use the power-of-two equivalents: Ei, Pi, Ti, Gi, Mi, Ki + # + # https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-memory + pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$' + # Note: the value specified here must not be zero or be higher + # than the corresponding limit. + requests: + type: object + properties: + cpu: + type: string + pattern: '^(\d+m|\d+(\.\d{1,3})?)$' + memory: + type: string + pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$' + schedulerName: + type: string + serviceAnnotations: + type: object + additionalProperties: + type: string + sidecars: + type: array + nullable: true + items: + type: object + x-kubernetes-preserve-unknown-fields: true + spiloRunAsUser: + type: integer + spiloRunAsGroup: + type: integer + spiloFSGroup: + type: integer + standby: + type: object + properties: + s3_wal_path: + type: string + gs_wal_path: + type: string + standby_host: + type: string + standby_port: + type: string + oneOf: + - required: + - s3_wal_path + - required: + - gs_wal_path + - required: + - standby_host + streams: + type: array + items: + type: object + required: + - applicationId + - database + - tables + properties: + applicationId: + type: string + batchSize: + type: integer + database: + type: string + filter: + type: object + additionalProperties: + type: string + tables: + type: object + additionalProperties: + type: object + required: + - eventType + properties: + eventType: + type: string + idColumn: + type: string + payloadColumn: + type: string + teamId: + type: string + tls: + type: object + required: + - secretName + properties: + secretName: + type: string + certificateFile: + type: string + privateKeyFile: + type: string + caFile: + type: string + caSecretName: + type: string + tolerations: + type: array + items: + type: object + properties: + key: + type: string + operator: + type: string + enum: + - Equal + - Exists + value: + type: string + effect: + type: string + enum: + - NoExecute + - NoSchedule + - PreferNoSchedule + tolerationSeconds: + type: integer + useLoadBalancer: + type: boolean + description: deprecated + users: + type: object + additionalProperties: + type: array + nullable: true + items: + type: string + enum: + - bypassrls + - BYPASSRLS + - nobypassrls + - NOBYPASSRLS + - createdb + - CREATEDB + - nocreatedb + - NOCREATEDB + - createrole + - CREATEROLE + - nocreaterole + - NOCREATEROLE + - inherit + - INHERIT + - noinherit + - NOINHERIT + - login + - LOGIN + - nologin + - NOLOGIN + - replication + - REPLICATION + - noreplication + - NOREPLICATION + - superuser + - SUPERUSER + - nosuperuser + - NOSUPERUSER + usersWithInPlaceSecretRotation: + type: array + nullable: true + items: + type: string + usersWithSecretRotation: + type: array + nullable: true + items: + type: string + volume: + type: object + required: + - size + properties: + iops: + type: integer + selector: + type: object + properties: + matchExpressions: + type: array + items: + type: object + required: + - key + - operator + properties: + key: + type: string + operator: + type: string + enum: + - DoesNotExist + - Exists + - In + - NotIn + values: + type: array + items: + type: string + matchLabels: + type: object + x-kubernetes-preserve-unknown-fields: true + size: + type: string + pattern: '^(\d+(e\d+)?|\d+(\.\d+)?(e\d+)?[EPTGMK]i?)$' + # Note: the value specified here must not be zero. + storageClass: + type: string + subPath: + type: string + throughput: + type: integer + status: + type: object + additionalProperties: + type: string diff --git a/postgres-operator/crds/postgresteams.yaml b/postgres-operator/crds/postgresteams.yaml new file mode 100644 index 0000000..b7a3684 --- /dev/null +++ b/postgres-operator/crds/postgresteams.yaml @@ -0,0 +1,70 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: postgresteams.acid.zalan.do + labels: + app.kubernetes.io/name: postgres-operator +spec: + group: acid.zalan.do + names: + kind: PostgresTeam + listKind: PostgresTeamList + plural: postgresteams + singular: postgresteam + shortNames: + - pgteam + categories: + - all + scope: Namespaced + versions: + - name: v1 + served: true + storage: true + subresources: + status: {} + schema: + openAPIV3Schema: + type: object + required: + - kind + - apiVersion + - spec + properties: + kind: + type: string + enum: + - PostgresTeam + apiVersion: + type: string + enum: + - acid.zalan.do/v1 + spec: + type: object + properties: + additionalSuperuserTeams: + type: object + description: "Map for teamId and associated additional superuser teams" + additionalProperties: + type: array + nullable: true + description: "List of teams to become Postgres superusers" + items: + type: string + additionalTeams: + type: object + description: "Map for teamId and associated additional teams" + additionalProperties: + type: array + nullable: true + description: "List of teams whose members will also be added to the Postgres cluster" + items: + type: string + additionalMembers: + type: object + description: "Map for teamId and associated additional users" + additionalProperties: + type: array + nullable: true + description: "List of users who will also be added to the Postgres cluster" + items: + type: string diff --git a/postgres-operator/index.yaml b/postgres-operator/index.yaml new file mode 100644 index 0000000..ccb9e00 --- /dev/null +++ b/postgres-operator/index.yaml @@ -0,0 +1,158 @@ +apiVersion: v1 +entries: + postgres-operator: + - apiVersion: v2 + appVersion: 1.10.0 + created: "2023-04-20T15:17:33.816556775+02:00" + description: Postgres Operator creates and manages PostgreSQL clusters running + in Kubernetes + digest: 60fc5c8059dfed175d14e1034b40997d9c59d33ec8ea158c0597f7228ab04b51 + home: https://github.com/zalando/postgres-operator + keywords: + - postgres + - operator + - cloud-native + - patroni + - spilo + maintainers: + - email: opensource@zalando.de + name: Zalando + name: postgres-operator + sources: + - https://github.com/zalando/postgres-operator + urls: + - postgres-operator-1.10.0.tgz + version: 1.10.0 + - apiVersion: v2 + appVersion: 1.9.0 + created: "2023-04-20T15:17:33.826385642+02:00" + description: Postgres Operator creates and manages PostgreSQL clusters running + in Kubernetes + digest: 64df90c898ca591eb3a330328173ffaadfbf9ddd474d8c42ed143edc9e3f4276 + home: https://github.com/zalando/postgres-operator + keywords: + - postgres + - operator + - cloud-native + - patroni + - spilo + maintainers: + - email: opensource@zalando.de + name: Zalando + name: postgres-operator + sources: + - https://github.com/zalando/postgres-operator + urls: + - postgres-operator-1.9.0.tgz + version: 1.9.0 + - apiVersion: v2 + appVersion: 1.8.2 + created: "2023-04-20T15:17:33.824908306+02:00" + description: Postgres Operator creates and manages PostgreSQL clusters running + in Kubernetes + digest: f77ffad2e98b72a621e5527015cf607935d3ed688f10ba4b626435acb9631b5b + home: https://github.com/zalando/postgres-operator + keywords: + - postgres + - operator + - cloud-native + - patroni + - spilo + maintainers: + - email: opensource@zalando.de + name: Zalando + name: postgres-operator + sources: + - https://github.com/zalando/postgres-operator + urls: + - postgres-operator-1.8.2.tgz + version: 1.8.2 + - apiVersion: v2 + appVersion: 1.8.1 + created: "2023-04-20T15:17:33.823470311+02:00" + description: Postgres Operator creates and manages PostgreSQL clusters running + in Kubernetes + digest: ee0c3bb6ba72fa4289ba3b1c6060e5b312dd023faba2a61b4cb7d9e5e2cc57a5 + home: https://github.com/zalando/postgres-operator + keywords: + - postgres + - operator + - cloud-native + - patroni + - spilo + maintainers: + - email: opensource@zalando.de + name: Zalando + name: postgres-operator + sources: + - https://github.com/zalando/postgres-operator + urls: + - postgres-operator-1.8.1.tgz + version: 1.8.1 + - apiVersion: v1 + appVersion: 1.8.0 + created: "2023-04-20T15:17:33.822014945+02:00" + description: Postgres Operator creates and manages PostgreSQL clusters running + in Kubernetes + digest: 3ae232cf009e09aa2ad11c171484cd2f1b72e63c59735e58fbe2b6eb842f4c86 + home: https://github.com/zalando/postgres-operator + keywords: + - postgres + - operator + - cloud-native + - patroni + - spilo + maintainers: + - email: opensource@zalando.de + name: Zalando + name: postgres-operator + sources: + - https://github.com/zalando/postgres-operator + urls: + - postgres-operator-1.8.0.tgz + version: 1.8.0 + - apiVersion: v1 + appVersion: 1.7.1 + created: "2023-04-20T15:17:33.819324505+02:00" + description: Postgres Operator creates and manages PostgreSQL clusters running + in Kubernetes + digest: 7262563bec0b058e669ae6bcff0226e33fa9ece9c41ac46a53274046afe7700c + home: https://github.com/zalando/postgres-operator + keywords: + - postgres + - operator + - cloud-native + - patroni + - spilo + maintainers: + - email: opensource@zalando.de + name: Zalando + name: postgres-operator + sources: + - https://github.com/zalando/postgres-operator + urls: + - postgres-operator-1.7.1.tgz + version: 1.7.1 + - apiVersion: v1 + appVersion: 1.7.0 + created: "2023-04-20T15:17:33.817929939+02:00" + description: Postgres Operator creates and manages PostgreSQL clusters running + in Kubernetes + digest: c3e99fb94305f81484b8b1af18eefb78681f3b5d057d5ad10565e4afb7c65ffe + home: https://github.com/zalando/postgres-operator + keywords: + - postgres + - operator + - cloud-native + - patroni + - spilo + maintainers: + - email: opensource@zalando.de + name: Zalando + name: postgres-operator + sources: + - https://github.com/zalando/postgres-operator + urls: + - postgres-operator-1.7.0.tgz + version: 1.7.0 +generated: "2023-04-20T15:17:33.814720127+02:00" diff --git a/postgres-operator/templates/NOTES.txt b/postgres-operator/templates/NOTES.txt new file mode 100644 index 0000000..f1fe050 --- /dev/null +++ b/postgres-operator/templates/NOTES.txt @@ -0,0 +1,3 @@ +To verify that postgres-operator has started, run: + + kubectl --namespace={{ .Release.Namespace }} get pods -l "app.kubernetes.io/name={{ template "postgres-operator.name" . }}" diff --git a/postgres-operator/templates/_helpers.tpl b/postgres-operator/templates/_helpers.tpl new file mode 100644 index 0000000..ee3a8dd --- /dev/null +++ b/postgres-operator/templates/_helpers.tpl @@ -0,0 +1,72 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "postgres-operator.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "postgres-operator.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create a service account name. +*/}} +{{- define "postgres-operator.serviceAccountName" -}} +{{ default (include "postgres-operator.fullname" .) .Values.serviceAccount.name }} +{{- end -}} + +{{/* +Create a pod service account name. +*/}} +{{- define "postgres-pod.serviceAccountName" -}} +{{ default (printf "%s-%v" (include "postgres-operator.fullname" .) "pod") .Values.podServiceAccount.name }} +{{- end -}} + +{{/* +Create a controller ID. +*/}} +{{- define "postgres-operator.controllerID" -}} +{{ default (include "postgres-operator.fullname" .) .Values.controllerID.name }} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "postgres-operator.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Flatten nested config options when ConfigMap is used as ConfigTarget +*/}} +{{- define "flattenValuesForConfigMap" }} +{{- range $key, $value := . }} + {{- if kindIs "slice" $value }} +{{ $key }}: {{ join "," $value | quote }} + {{- else if kindIs "map" $value }} + {{- $list := list }} + {{- range $subKey, $subValue := $value }} + {{- $list = append $list (printf "%s:%s" $subKey $subValue) }} +{{ $key }}: {{ join "," $list | quote }} + {{- end }} + {{- else }} +{{ $key }}: {{ $value | quote }} + {{- end }} +{{- end }} +{{- end }} diff --git a/postgres-operator/templates/clusterrole-postgres-pod.yaml b/postgres-operator/templates/clusterrole-postgres-pod.yaml new file mode 100644 index 0000000..fdccf16 --- /dev/null +++ b/postgres-operator/templates/clusterrole-postgres-pod.yaml @@ -0,0 +1,71 @@ +{{ if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "postgres-pod.serviceAccountName" . }} + labels: + app.kubernetes.io/name: {{ template "postgres-operator.name" . }} + helm.sh/chart: {{ template "postgres-operator.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} +rules: +# Patroni needs to watch and manage config maps or endpoints +{{- if toString .Values.configGeneral.kubernetes_use_configmaps | eq "true" }} +- apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch +{{- else }} +- apiGroups: + - "" + resources: + - endpoints + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch +{{- end }} +# Patroni needs to watch pods +- apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - patch + - update + - watch +# to let Patroni create a headless service +- apiGroups: + - "" + resources: + - services + verbs: + - create +{{- if toString .Values.configKubernetes.spilo_privileged | eq "true" }} +# to run privileged pods +- apiGroups: + - extensions + resources: + - podsecuritypolicies + resourceNames: + - privileged + verbs: + - use +{{- end }} +{{ end }} diff --git a/postgres-operator/templates/clusterrole.yaml b/postgres-operator/templates/clusterrole.yaml new file mode 100644 index 0000000..199086a --- /dev/null +++ b/postgres-operator/templates/clusterrole.yaml @@ -0,0 +1,254 @@ +{{ if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "postgres-operator.serviceAccountName" . }} + labels: + app.kubernetes.io/name: {{ template "postgres-operator.name" . }} + helm.sh/chart: {{ template "postgres-operator.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} +rules: +# all verbs allowed for custom operator resources +- apiGroups: + - acid.zalan.do + resources: + - postgresqls + - postgresqls/status + - operatorconfigurations + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch +# operator only reads PostgresTeams +- apiGroups: + - acid.zalan.do + resources: + - postgresteams + verbs: + - get + - list + - watch +# all verbs allowed for event streams +{{- if .Values.enableStreams }} +- apiGroups: + - zalando.org + resources: + - fabriceventstreams + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch +{{- end }} +# to create or get/update CRDs when starting up +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get +{{- if toString .Values.configGeneral.enable_crd_registration | eq "true" }} + - create + - patch + - update +{{- end }} +# to send events to the CRs +- apiGroups: + - "" + resources: + - events + verbs: + - create + - get + - list + - patch + - update + - watch +# to manage endpoints/configmaps which are also used by Patroni +{{- if toString .Values.configGeneral.kubernetes_use_configmaps | eq "true" }} +- apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch +{{- else }} +# to read configuration from ConfigMaps +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get +- apiGroups: + - "" + resources: + - endpoints + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch +{{- end }} +# to CRUD secrets for database access +- apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - get + - update +# to check nodes for node readiness label +- apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch +# to read or delete existing PVCs. Creation via StatefulSet +- apiGroups: + - "" + resources: + - persistentvolumeclaims + verbs: + - delete + - get + - list +{{- if toString .Values.configKubernetes.storage_resize_mode | eq "pvc" }} + - patch + - update +{{- end }} + # to read existing PVs. Creation should be done via dynamic provisioning +- apiGroups: + - "" + resources: + - persistentvolumes + verbs: + - get + - list +{{- if toString .Values.configKubernetes.storage_resize_mode | eq "ebs" }} + - update # only for resizing AWS volumes +{{- end }} +# to watch Spilo pods and do rolling updates. Creation via StatefulSet +- apiGroups: + - "" + resources: + - pods + verbs: + - delete + - get + - list + - patch + - update + - watch +# to resize the filesystem in Spilo pods when increasing volume size +- apiGroups: + - "" + resources: + - pods/exec + verbs: + - create +# to CRUD services to point to Postgres cluster instances +- apiGroups: + - "" + resources: + - services + verbs: + - create + - delete + - get + - patch + - update +# to CRUD the StatefulSet which controls the Postgres cluster instances +- apiGroups: + - apps + resources: + - statefulsets + - deployments + verbs: + - create + - delete + - get + - list + - patch +# to CRUD cron jobs for logical backups +- apiGroups: + - batch + resources: + - cronjobs + verbs: + - create + - delete + - get + - list + - patch + - update +# to get namespaces operator resources can run in +- apiGroups: + - "" + resources: + - namespaces + verbs: + - get +# to define PDBs. Update happens via delete/create +- apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - create + - delete + - get +# to create ServiceAccounts in each namespace the operator watches +- apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - get + - create +# to create role bindings to the postgres-pod service account +- apiGroups: + - rbac.authorization.k8s.io + resources: + - rolebindings + verbs: + - get + - create +{{- if toString .Values.configKubernetes.spilo_privileged | eq "true" }} +# to run privileged pods +- apiGroups: + - extensions + resources: + - podsecuritypolicies + resourceNames: + - privileged + verbs: + - use +{{- end }} +{{ end }} diff --git a/postgres-operator/templates/clusterrolebinding.yaml b/postgres-operator/templates/clusterrolebinding.yaml new file mode 100644 index 0000000..dbf65d0 --- /dev/null +++ b/postgres-operator/templates/clusterrolebinding.yaml @@ -0,0 +1,19 @@ +{{ if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "postgres-operator.serviceAccountName" . }} + labels: + app.kubernetes.io/name: {{ template "postgres-operator.name" . }} + helm.sh/chart: {{ template "postgres-operator.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "postgres-operator.serviceAccountName" . }} +subjects: +- kind: ServiceAccount + name: {{ include "postgres-operator.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{ end }} diff --git a/postgres-operator/templates/configmap.yaml b/postgres-operator/templates/configmap.yaml new file mode 100644 index 0000000..471f1ae --- /dev/null +++ b/postgres-operator/templates/configmap.yaml @@ -0,0 +1,30 @@ +{{- if eq .Values.configTarget "ConfigMap" }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "postgres-operator.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: {{ template "postgres-operator.name" . }} + helm.sh/chart: {{ template "postgres-operator.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} +data: + {{- if .Values.podPriorityClassName }} + pod_priority_class_name: {{ .Values.podPriorityClassName }} + {{- end }} + pod_service_account_name: {{ include "postgres-pod.serviceAccountName" . }} +{{- include "flattenValuesForConfigMap" .Values.configGeneral | indent 2 }} +{{- include "flattenValuesForConfigMap" .Values.configUsers | indent 2 }} +{{- include "flattenValuesForConfigMap" .Values.configMajorVersionUpgrade | indent 2 }} +{{- include "flattenValuesForConfigMap" .Values.configKubernetes | indent 2 }} +{{- include "flattenValuesForConfigMap" .Values.configTimeouts | indent 2 }} +{{- include "flattenValuesForConfigMap" .Values.configLoadBalancer | indent 2 }} +{{- include "flattenValuesForConfigMap" .Values.configAwsOrGcp | indent 2 }} +{{- include "flattenValuesForConfigMap" .Values.configLogicalBackup | indent 2 }} +{{- include "flattenValuesForConfigMap" .Values.configDebug | indent 2 }} +{{- include "flattenValuesForConfigMap" .Values.configLoggingRestApi | indent 2 }} +{{- include "flattenValuesForConfigMap" .Values.configTeamsApi | indent 2 }} +{{- include "flattenValuesForConfigMap" .Values.configConnectionPooler | indent 2 }} +{{- include "flattenValuesForConfigMap" .Values.configPatroni | indent 2 }} +{{- end }} diff --git a/postgres-operator/templates/deployment.yaml b/postgres-operator/templates/deployment.yaml new file mode 100644 index 0000000..1752cb3 --- /dev/null +++ b/postgres-operator/templates/deployment.yaml @@ -0,0 +1,80 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/name: {{ template "postgres-operator.name" . }} + helm.sh/chart: {{ template "postgres-operator.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} + name: {{ template "postgres-operator.fullname" . }} + namespace: {{ .Release.Namespace }} +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: {{ template "postgres-operator.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + template: + metadata: + annotations: + {{- if eq .Values.configTarget "ConfigMap" }} + checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + {{- else }} + checksum/config: {{ include (print $.Template.BasePath "/operatorconfiguration.yaml") . | sha256sum }} + {{- end }} + {{- if .Values.podAnnotations }} +{{ toYaml .Values.podAnnotations | indent 8 }} + {{- end }} + labels: + app.kubernetes.io/name: {{ template "postgres-operator.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + {{- if .Values.podLabels }} +{{ toYaml .Values.podLabels | indent 8 }} + {{- end }} + spec: + serviceAccountName: {{ include "postgres-operator.serviceAccountName" . }} + containers: + - name: {{ .Chart.Name }} + image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + env: + {{- if .Values.enableJsonLogging }} + - name: ENABLE_JSON_LOGGING + value: "true" + {{- end }} + {{- if eq .Values.configTarget "ConfigMap" }} + - name: CONFIG_MAP_NAME + value: {{ template "postgres-operator.fullname" . }} + {{- else }} + - name: POSTGRES_OPERATOR_CONFIGURATION_OBJECT + value: {{ template "postgres-operator.fullname" . }} + {{- end }} + {{- if .Values.controllerID.create }} + - name: CONTROLLER_ID + value: {{ template "postgres-operator.controllerID" . }} + {{- end }} + resources: +{{ toYaml .Values.resources | indent 10 }} + securityContext: +{{ toYaml .Values.securityContext | indent 10 }} + {{- if .Values.readinessProbe }} + readinessProbe: + httpGet: + path: /readyz + port: {{ .Values.configLoggingRestApi.api_port }} + initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.readinessProbe.periodSeconds }} + {{- end }} + {{- if .Values.imagePullSecrets }} + imagePullSecrets: +{{ toYaml .Values.imagePullSecrets | indent 8 }} + {{- end }} + affinity: +{{ toYaml .Values.affinity | indent 8 }} + nodeSelector: +{{ toYaml .Values.nodeSelector | indent 8 }} + tolerations: +{{ toYaml .Values.tolerations | indent 8 }} + {{- if .Values.priorityClassName }} + priorityClassName: {{ .Values.priorityClassName }} + {{- end }} diff --git a/postgres-operator/templates/operatorconfiguration.yaml b/postgres-operator/templates/operatorconfiguration.yaml new file mode 100644 index 0000000..6d3b0eb --- /dev/null +++ b/postgres-operator/templates/operatorconfiguration.yaml @@ -0,0 +1,45 @@ +{{- if eq .Values.configTarget "OperatorConfigurationCRD" }} +apiVersion: "acid.zalan.do/v1" +kind: OperatorConfiguration +metadata: + name: {{ template "postgres-operator.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: {{ template "postgres-operator.name" . }} + helm.sh/chart: {{ template "postgres-operator.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} +configuration: +{{ tpl (toYaml .Values.configGeneral) . | indent 2 }} + users: +{{ tpl (toYaml .Values.configUsers) . | indent 4 }} + major_version_upgrade: +{{ toYaml .Values.configMajorVersionUpgrade | indent 4 }} + kubernetes: + {{- if .Values.podPriorityClassName }} + pod_priority_class_name: {{ .Values.podPriorityClassName }} + {{- end }} + pod_service_account_name: {{ include "postgres-pod.serviceAccountName" . }} + oauth_token_secret_name: {{ template "postgres-operator.fullname" . }} +{{ tpl (toYaml .Values.configKubernetes) . | indent 4 }} + postgres_pod_resources: +{{ toYaml .Values.configPostgresPodResources | indent 4 }} + timeouts: +{{ toYaml .Values.configTimeouts | indent 4 }} + load_balancer: +{{ toYaml .Values.configLoadBalancer | indent 4 }} + aws_or_gcp: +{{ toYaml .Values.configAwsOrGcp | indent 4 }} + logical_backup: +{{ toYaml .Values.configLogicalBackup | indent 4 }} + debug: +{{ toYaml .Values.configDebug | indent 4 }} + teams_api: +{{ tpl (toYaml .Values.configTeamsApi) . | indent 4 }} + logging_rest_api: +{{ toYaml .Values.configLoggingRestApi | indent 4 }} + connection_pooler: +{{ toYaml .Values.configConnectionPooler | indent 4 }} + patroni: +{{ toYaml .Values.configPatroni | indent 4 }} +{{- end }} diff --git a/postgres-operator/templates/postgres-pod-priority-class.yaml b/postgres-operator/templates/postgres-pod-priority-class.yaml new file mode 100644 index 0000000..583639e --- /dev/null +++ b/postgres-operator/templates/postgres-pod-priority-class.yaml @@ -0,0 +1,16 @@ +{{- if .Values.podPriorityClassName }} +apiVersion: scheduling.k8s.io/v1 +description: 'Use only for databases controlled by Postgres operator' +kind: PriorityClass +metadata: + labels: + app.kubernetes.io/name: {{ template "postgres-operator.name" . }} + helm.sh/chart: {{ template "postgres-operator.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} + name: {{ .Values.podPriorityClassName }} + namespace: {{ .Release.Namespace }} +preemptionPolicy: PreemptLowerPriority +globalDefault: false +value: 1000000 +{{- end }} diff --git a/postgres-operator/templates/service.yaml b/postgres-operator/templates/service.yaml new file mode 100644 index 0000000..c1b5274 --- /dev/null +++ b/postgres-operator/templates/service.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/name: {{ template "postgres-operator.name" . }} + helm.sh/chart: {{ template "postgres-operator.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} + name: {{ template "postgres-operator.fullname" . }} + namespace: {{ .Release.Namespace }} +spec: + type: ClusterIP + ports: + - port: 8080 + protocol: TCP + targetPort: 8080 + selector: + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/name: {{ template "postgres-operator.name" . }} diff --git a/postgres-operator/templates/serviceaccount.yaml b/postgres-operator/templates/serviceaccount.yaml new file mode 100644 index 0000000..4f42559 --- /dev/null +++ b/postgres-operator/templates/serviceaccount.yaml @@ -0,0 +1,12 @@ +{{ if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "postgres-operator.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: {{ template "postgres-operator.name" . }} + helm.sh/chart: {{ template "postgres-operator.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} +{{ end }} diff --git a/postgres-operator/templates/user-facing-clusterroles.yaml b/postgres-operator/templates/user-facing-clusterroles.yaml new file mode 100644 index 0000000..d7db347 --- /dev/null +++ b/postgres-operator/templates/user-facing-clusterroles.yaml @@ -0,0 +1,71 @@ +{{ if .Values.rbac.createAggregateClusterRoles }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + rbac.authorization.k8s.io/aggregate-to-admin: "true" + app.kubernetes.io/name: {{ template "postgres-operator.name" . }} + helm.sh/chart: {{ template "postgres-operator.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} + name: {{ template "postgres-operator.fullname" . }}:users:admin +rules: +- apiGroups: + - acid.zalan.do + resources: + - postgresqls + - postgresqls/status + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch + +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + rbac.authorization.k8s.io/aggregate-to-edit: "true" + app.kubernetes.io/name: {{ template "postgres-operator.name" . }} + helm.sh/chart: {{ template "postgres-operator.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} + name: {{ template "postgres-operator.fullname" . }}:users:edit +rules: +- apiGroups: + - acid.zalan.do + resources: + - postgresqls + verbs: + - create + - update + - patch + - delete + +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + rbac.authorization.k8s.io/aggregate-to-view: "true" + app.kubernetes.io/name: {{ template "postgres-operator.name" . }} + helm.sh/chart: {{ template "postgres-operator.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/instance: {{ .Release.Name }} + name: {{ template "postgres-operator.fullname" . }}:users:view +rules: +- apiGroups: + - acid.zalan.do + resources: + - postgresqls + - postgresqls/status + verbs: + - get + - list + - watch +{{ end }} diff --git a/postgres-operator/values.home.yaml b/postgres-operator/values.home.yaml new file mode 100644 index 0000000..4845c4e --- /dev/null +++ b/postgres-operator/values.home.yaml @@ -0,0 +1,9 @@ +configKubernetes: + enable_readiness_probe: true +enableJsonLogging: true +resources: + limits: + memory: 500Mi + requests: + cpu: 100m + memory: 250Mi diff --git a/postgres-operator/values.yaml b/postgres-operator/values.yaml new file mode 100644 index 0000000..4f1d3fa --- /dev/null +++ b/postgres-operator/values.yaml @@ -0,0 +1,501 @@ +image: + registry: registry.opensource.zalan.do + repository: acid/postgres-operator + tag: v1.10.1 + pullPolicy: "IfNotPresent" + +# Optionally specify an array of imagePullSecrets. +# Secrets must be manually created in the namespace. +# ref: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod +# imagePullSecrets: +# - name: myRegistryKeySecretName + +podAnnotations: {} +podLabels: {} + +configTarget: "OperatorConfigurationCRD" + +# JSON logging format +enableJsonLogging: false + +# general configuration parameters +configGeneral: + # the deployment should create/update the CRDs + enable_crd_registration: true + # specify categories under which crds should be listed + crd_categories: + - "all" + # update only the statefulsets without immediately doing the rolling update + enable_lazy_spilo_upgrade: false + # set the PGVERSION env var instead of providing the version via postgresql.bin_dir in SPILO_CONFIGURATION + enable_pgversion_env_var: true + # start any new database pod without limitations on shm memory + enable_shm_volume: true + # enables backwards compatible path between Spilo 12 and Spilo 13+ images + enable_spilo_wal_path_compat: false + # operator will sync only clusters where name starts with teamId prefix + enable_team_id_clustername_prefix: false + # etcd connection string for Patroni. Empty uses K8s-native DCS. + etcd_host: "" + # Spilo docker image + docker_image: ghcr.io/zalando/spilo-15:3.0-p1 + + # key name for annotation to ignore globally configured instance limits + # ignore_instance_limits_annotation_key: "" + + # Select if setup uses endpoints (default), or configmaps to manage leader (DCS=k8s) + # kubernetes_use_configmaps: false + + # min number of instances in Postgres cluster. -1 = no limit + min_instances: -1 + # max number of instances in Postgres cluster. -1 = no limit + max_instances: -1 + # period between consecutive repair requests + repair_period: 5m + # period between consecutive sync requests + resync_period: 30m + # can prevent certain cases of memory overcommitment + # set_memory_request_to_limit: false + + # map of sidecar names to docker images + # sidecar_docker_images: + # example: "exampleimage:exampletag" + + # number of routines the operator spawns to process requests concurrently + workers: 8 + +# parameters describing Postgres users +configUsers: + # roles to be granted to database owners + # additional_owner_roles: + # - cron_admin + + # enable password rotation for app users that are not database owners + enable_password_rotation: false + # rotation interval for updating credentials in K8s secrets of app users + password_rotation_interval: 90 + # retention interval to keep rotation users + password_rotation_user_retention: 180 + # postgres username used for replication between instances + replication_username: standby + # postgres superuser name to be created by initdb + super_username: postgres + +configMajorVersionUpgrade: + # "off": no upgrade, "manual": manifest triggers action, "full": minimal version violation triggers too + major_version_upgrade_mode: "off" + # upgrades will only be carried out for clusters of listed teams when mode is "off" + # major_version_upgrade_team_allow_list: + # - acid + + # minimal Postgres major version that will not automatically be upgraded + minimal_major_version: "11" + # target Postgres major version when upgrading clusters automatically + target_major_version: "15" + +configKubernetes: + # list of additional capabilities for postgres container + # additional_pod_capabilities: + # - "SYS_NICE" + + # default DNS domain of K8s cluster where operator is running + cluster_domain: cluster.local + # additional labels assigned to the cluster objects + cluster_labels: + application: spilo + # label assigned to Kubernetes objects created by the operator + cluster_name_label: cluster-name + # additional annotations to add to every database pod + # custom_pod_annotations: + # keya: valuea + # keyb: valueb + + # key name for annotation that compares manifest value with current date + # delete_annotation_date_key: "delete-date" + + # key name for annotation that compares manifest value with cluster name + # delete_annotation_name_key: "delete-clustername" + + # list of annotations propagated from cluster manifest to statefulset and deployment + # downscaler_annotations: + # - deployment-time + # - downscaler/* + + # allow user secrets in other namespaces than the Postgres cluster + enable_cross_namespace_secret: false + # enables initContainers to run actions before Spilo is started + enable_init_containers: true + # toggles pod anti affinity on the Postgres pods + enable_pod_antiaffinity: false + # toggles PDB to set to MinAvailabe 0 or 1 + enable_pod_disruption_budget: true + # toogles readiness probe for database pods + enable_readiness_probe: false + # enables sidecar containers to run alongside Spilo in the same pod + enable_sidecars: true + + # annotations to be ignored when comparing statefulsets, services etc. + # ignored_annotations: + # - k8s.v1.cni.cncf.io/network-status + + # namespaced name of the secret containing infrastructure roles names and passwords + # infrastructure_roles_secret_name: postgresql-infrastructure-roles + + # list of annotation keys that can be inherited from the cluster manifest + # inherited_annotations: + # - owned-by + + # list of label keys that can be inherited from the cluster manifest + # inherited_labels: + # - application + # - environment + + # timeout for successful migration of master pods from unschedulable node + # master_pod_move_timeout: 20m + + # set of labels that a running and active node should possess to be considered ready + # node_readiness_label: + # status: ready + + # defines how nodeAffinity from manifest should be merged with node_readiness_label + # node_readiness_label_merge: "OR" + + # namespaced name of the secret containing the OAuth2 token to pass to the teams API + # oauth_token_secret_name: postgresql-operator + + # defines the template for PDB (Pod Disruption Budget) names + pdb_name_format: "postgres-{cluster}-pdb" + # switches pod anti affinity type to `preferredDuringSchedulingIgnoredDuringExecution` + pod_antiaffinity_preferred_during_scheduling: false + # override topology key for pod anti affinity + pod_antiaffinity_topology_key: "kubernetes.io/hostname" + # namespaced name of the ConfigMap with environment variables to populate on every pod + # pod_environment_configmap: "default/my-custom-config" + # name of the Secret (in cluster namespace) with environment variables to populate on every pod + # pod_environment_secret: "my-custom-secret" + + # specify the pod management policy of stateful sets of Postgres clusters + pod_management_policy: "ordered_ready" + # label assigned to the Postgres pods (and services/endpoints) + pod_role_label: spilo-role + # service account definition as JSON/YAML string to be used by postgres cluster pods + # pod_service_account_definition: "" + + # role binding definition as JSON/YAML string to be used by pod service account + # pod_service_account_role_binding_definition: "" + + # Postgres pods are terminated forcefully after this timeout + pod_terminate_grace_period: 5m + # template for database user secrets generated by the operator, + # here username contains the namespace in the format namespace.username + # if the user is in different namespace than cluster and cross namespace secrets + # are enabled via `enable_cross_namespace_secret` flag in the configuration. + secret_name_template: "{username}.{cluster}.credentials.{tprkind}.{tprgroup}" + # sharing unix socket of PostgreSQL (`pg_socket`) with the sidecars + share_pgsocket_with_sidecars: false + # set user and group for the spilo container (required to run Spilo as non-root process) + # spilo_runasuser: 101 + # spilo_runasgroup: 103 + + # group ID with write-access to volumes (required to run Spilo as non-root process) + # spilo_fsgroup: 103 + + # whether the Spilo container should run in privileged mode + spilo_privileged: false + # whether the Spilo container should run with additional permissions other than parent. + # required by cron which needs setuid + spilo_allow_privilege_escalation: true + # storage resize strategy, available options are: ebs, pvc, off or mixed + storage_resize_mode: pvc + # pod toleration assigned to instances of every Postgres cluster + # toleration: + # key: db-only + # operator: Exists + # effect: NoSchedule + + # operator watches for postgres objects in the given namespace + watched_namespace: "*" # listen to all namespaces + +# configure resource requests for the Postgres pods +configPostgresPodResources: + # CPU limits for the postgres containers + default_cpu_limit: "1" + # CPU request value for the postgres containers + default_cpu_request: 100m + # memory limits for the postgres containers + default_memory_limit: 500Mi + # memory request value for the postgres containers + default_memory_request: 100Mi + # optional upper boundary for CPU request + # max_cpu_request: "1" + + # optional upper boundary for memory request + # max_memory_request: 4Gi + + # hard CPU minimum required to properly run a Postgres cluster + min_cpu_limit: 250m + # hard memory minimum required to properly run a Postgres cluster + min_memory_limit: 250Mi + +# timeouts related to some operator actions +configTimeouts: + # interval between consecutive attempts of operator calling the Patroni API + patroni_api_check_interval: 1s + # timeout when waiting for successful response from Patroni API + patroni_api_check_timeout: 5s + # timeout when waiting for the Postgres pods to be deleted + pod_deletion_wait_timeout: 10m + # timeout when waiting for pod role and cluster labels + pod_label_wait_timeout: 10m + # interval between consecutive attempts waiting for postgresql CRD to be created + ready_wait_interval: 3s + # timeout for the complete postgres CRD creation + ready_wait_timeout: 30s + # interval to wait between consecutive attempts to check for some K8s resources + resource_check_interval: 3s + # timeout when waiting for the presence of a certain K8s resource (e.g. Sts, PDB) + resource_check_timeout: 10m + +# configure behavior of load balancers +configLoadBalancer: + # DNS zone for cluster DNS name when load balancer is configured for cluster + db_hosted_zone: db.example.com + # annotations to apply to service when load balancing is enabled + # custom_service_annotations: + # keyx: valuez + # keya: valuea + + # toggles service type load balancer pointing to the master pod of the cluster + enable_master_load_balancer: false + # toggles service type load balancer pointing to the master pooler pod of the cluster + enable_master_pooler_load_balancer: false + # toggles service type load balancer pointing to the replica pod of the cluster + enable_replica_load_balancer: false + # toggles service type load balancer pointing to the replica pooler pod of the cluster + enable_replica_pooler_load_balancer: false + # define external traffic policy for the load balancer + external_traffic_policy: "Cluster" + # defines the DNS name string template for the master load balancer cluster + master_dns_name_format: "{cluster}.{namespace}.{hostedzone}" + # deprecated DNS template for master load balancer using team name + master_legacy_dns_name_format: "{cluster}.{team}.{hostedzone}" + # defines the DNS name string template for the replica load balancer cluster + replica_dns_name_format: "{cluster}-repl.{namespace}.{hostedzone}" + # deprecated DNS template for replica load balancer using team name + replica_legacy_dns_name_format: "{cluster}-repl.{team}.{hostedzone}" + +# options to aid debugging of the operator itself +configDebug: + # toggles verbose debug logs from the operator + debug_logging: true + # toggles operator functionality that require access to the postgres database + enable_database_access: true + +# parameters affecting logging and REST API listener +configLoggingRestApi: + # REST API listener listens to this port + api_port: 8080 + # number of entries in the cluster history ring buffer + cluster_history_entries: 1000 + # number of lines in the ring buffer used to store cluster logs + ring_log_lines: 100 + +# configure interaction with non-Kubernetes objects from AWS or GCP +configAwsOrGcp: + # Additional Secret (aws or gcp credentials) to mount in the pod + # additional_secret_mount: "some-secret-name" + + # Path to mount the above Secret in the filesystem of the container(s) + # additional_secret_mount_path: "/some/dir" + + # AWS region used to store EBS volumes + aws_region: eu-central-1 + + # enable automatic migration on AWS from gp2 to gp3 volumes + enable_ebs_gp3_migration: false + # defines maximum volume size in GB until which auto migration happens + # enable_ebs_gp3_migration_max_size: 1000 + + # GCP credentials that will be used by the operator / pods + # gcp_credentials: "" + + # AWS IAM role to supply in the iam.amazonaws.com/role annotation of Postgres pods + # kube_iam_role: "" + + # S3 bucket to use for shipping postgres daily logs + # log_s3_bucket: "" + + # S3 bucket to use for shipping WAL segments with WAL-E + # wal_s3_bucket: "" + + # GCS bucket to use for shipping WAL segments with WAL-E + # wal_gs_bucket: "" + + # Azure Storage Account to use for shipping WAL segments with WAL-G + # wal_az_storage_account: "" + +# configure K8s cron job managed by the operator +configLogicalBackup: + # Azure Storage Account specs to store backup results + # logical_backup_azure_storage_account_name: "" + # logical_backup_azure_storage_container: "" + # logical_backup_azure_storage_account_key: "" + + # resources for logical backup pod, if empty configPostgresPodResources will be used + # logical_backup_cpu_limit: "" + # logical_backup_cpu_request: "" + # logical_backup_memory_limit: "" + # logical_backup_memory_request: "" + + # image for pods of the logical backup job (example runs pg_dumpall) + logical_backup_docker_image: "registry.opensource.zalan.do/acid/logical-backup:v1.10.1" + # path of google cloud service account json file + # logical_backup_google_application_credentials: "" + + # prefix for the backup job name + logical_backup_job_prefix: "logical-backup-" + # storage provider - either "s3", "gcs" or "az" + logical_backup_provider: "s3" + # S3 Access Key ID + logical_backup_s3_access_key_id: "" + # S3 bucket to store backup results + logical_backup_s3_bucket: "my-bucket-url" + # S3 region of bucket + logical_backup_s3_region: "" + # S3 endpoint url when not using AWS + logical_backup_s3_endpoint: "" + # S3 Secret Access Key + logical_backup_s3_secret_access_key: "" + # S3 server side encryption + logical_backup_s3_sse: "AES256" + # S3 retention time for stored backups for example "2 week" or "7 days" + logical_backup_s3_retention_time: "" + # backup schedule in the cron format + logical_backup_schedule: "30 00 * * *" + +# automate creation of human users with teams API service +configTeamsApi: + # team_admin_role will have the rights to grant roles coming from PG manifests + enable_admin_role_for_users: true + # operator watches for PostgresTeam CRs to assign additional teams and members to clusters + enable_postgres_team_crd: false + # toogle to create additional superuser teams from PostgresTeam CRs + enable_postgres_team_crd_superusers: false + # toggle to automatically rename roles of former team members and deny LOGIN + enable_team_member_deprecation: false + # toggle to grant superuser to team members created from the Teams API + enable_team_superuser: false + # toggles usage of the Teams API by the operator + enable_teams_api: false + # should contain a URL to use for authentication (username and token) + # pam_configuration: https://info.example.com/oauth2/tokeninfo?access_token= uid realm=/employees + + # operator will add all team member roles to this group and add a pg_hba line + pam_role_name: zalandos + # List of teams which members need the superuser role in each Postgres cluster + postgres_superuser_teams: + - postgres_superusers + # List of roles that cannot be overwritten by an application, team or infrastructure role + protected_role_names: + - admin + - cron_admin + # Suffix to add if members are removed from TeamsAPI or PostgresTeam CRD + role_deletion_suffix: "_deleted" + # role name to grant to team members created from the Teams API + team_admin_role: admin + # postgres config parameters to apply to each team member role + team_api_role_configuration: + log_statement: all + # URL of the Teams API service + # teams_api_url: http://fake-teams-api.default.svc.cluster.local + +# configure connection pooler deployment created by the operator +configConnectionPooler: + # db schema to install lookup function into + connection_pooler_schema: "pooler" + # db user for pooler to use + connection_pooler_user: "pooler" + # docker image + connection_pooler_image: "registry.opensource.zalan.do/acid/pgbouncer:master-27" + # max db connections the pooler should hold + connection_pooler_max_db_connections: 60 + # default pooling mode + connection_pooler_mode: "transaction" + # number of pooler instances + connection_pooler_number_of_instances: 2 + # default resources + connection_pooler_default_cpu_request: 500m + connection_pooler_default_memory_request: 100Mi + connection_pooler_default_cpu_limit: "1" + connection_pooler_default_memory_limit: 100Mi + +configPatroni: + # enable Patroni DCS failsafe_mode feature + enable_patroni_failsafe_mode: false + +# Zalando's internal CDC stream feature +enableStreams: false + +rbac: + # Specifies whether RBAC resources should be created + create: true + # Specifies whether ClusterRoles that are aggregated into the K8s default roles should be created. (https://kubernetes.io/docs/reference/access-authn-authz/rbac/#default-roles-and-role-bindings) + createAggregateClusterRoles: false + +serviceAccount: + # Specifies whether a ServiceAccount should be created + create: true + # The name of the ServiceAccount to use. + # If not set and create is true, a name is generated using the fullname template + name: + +podServiceAccount: + # The name of the ServiceAccount to be used by postgres cluster pods + # If not set a name is generated using the fullname template and "-pod" suffix + name: "postgres-pod" + +# priority class for operator pod +priorityClassName: "" + +# priority class for database pods +podPriorityClassName: "" + +resources: + limits: + cpu: 500m + memory: 500Mi + requests: + cpu: 100m + memory: 250Mi + +securityContext: + runAsUser: 1000 + runAsNonRoot: true + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + +# Allow to setup operator Deployment readiness probe +readinessProbe: + initialDelaySeconds: 5 + periodSeconds: 10 + +# Affinity for pod assignment +# Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity +affinity: {} + +# Node labels for pod assignment +# Ref: https://kubernetes.io/docs/user-guide/node-selection/ +nodeSelector: {} + +# Tolerations for pod assignment +# Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ +tolerations: [] + +controllerID: + # Specifies whether a controller ID should be defined for the operator + # Note, all postgres manifest must then contain the following annotation to be found by this operator + # "acid.zalan.do/controller": + create: false + # The name of the controller ID to use. + # If not set and create is true, a name is generated using the fullname template + name: