Add RBAC support in Helm chart

helm-chart/externalipcontroller/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 description: Configure External IPs on k8s worker node(s) to provide IP connectivity.
 name: externalipcontroller
-version: 0.1.0
+version: 0.1.1
 keywords:
 - externalip
 - external-ip

helm-chart/externalipcontroller/templates/daemonset.yaml

@@ -1,16 +1,26 @@
 apiVersion: extensions/v1beta1
 kind: DaemonSet
 metadata:
-  name: {{ .Values.controller.name }}
+  labels:
+    app: {{ template "fullname" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    component: {{ .Values.controller.name }}
+  name: {{ template "fullname" . }}-{{ .Values.controller.name }}
 spec:
+  selector:
+    matchLabels:
+      app: {{ template "fullname" . }}
+      component: {{ .Values.controller.name }}
   template:
     metadata:
       labels:
-        app: {{ .Chart.Name }}
+        app: {{ template "fullname" . }}
+        chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+        component: {{ .Values.controller.name }}
     spec:
       hostNetwork: true
       containers:
-      - name: {{ .Chart.Name }}
+      - name: {{ .Values.controller.name }}
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         securityContext:
@@ -22,3 +32,10 @@ spec:
           - --logtostderr
           - --v=5
           - --hb=500ms
+        resources:
+{{ toYaml .Values.controller.resources | indent 12 }}
+      {{- with .Values.controller.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+      {{- end }}
+      serviceAccountName: {{ template "fullname" . }}

helm-chart/externalipcontroller/templates/deployment.yaml

@@ -1,26 +1,41 @@
 apiVersion: extensions/v1beta1
 kind: Deployment
 metadata:
-  name: {{ .Values.scheduler.name }}
+  name: {{ template "fullname" . }}-{{ .Values.scheduler.name }}
   labels:
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+    app: {{ template "fullname" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    component: {{ .Values.scheduler.name }}
 spec:
-  replicas: {{ .Values.replicaCount }}
+  replicas: {{ .Values.scheduler.replicaCount }}
+  selector:
+    matchLabels:
+      app: {{ template "fullname" . }}
+      component: {{ .Values.scheduler.name }}
   template:
     metadata:
       labels:
-        app: {{ .Values.scheduler.name }}
+        app: {{ template "fullname" . }}
+        chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+        component: {{ .Values.scheduler.name }}
     spec:
       containers:
-      - name: {{ .Chart.Name }}
+      - name: {{ .Values.scheduler.name }}
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         command:
-        - ipmanager
-        - scheduler
-        - --mask={{ .Values.scheduler.network_mask }}
-        - --logtostderr
-        - --v=5
-        - --leader-elect=true
-        - --monitor=4s
-        - --nodefilter=fair
+          - ipmanager
+          - scheduler
+          - --mask={{ .Values.scheduler.network_mask }}
+          - --logtostderr
+          - --v=5
+          - --leader-elect=true
+          - --monitor=4s
+          - --nodefilter=fair
+        resources:
+{{ toYaml .Values.scheduler.resources | indent 12 }}
+      {{- with .Values.scheduler.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+      {{- end }}
+      serviceAccountName: {{ template "fullname" . }}

helm-chart/externalipcontroller/templates/rbac.yaml

@@ -0,0 +1,61 @@
+{{- if .Values.rbac.create }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app: {{ template "fullname" . }}
+  name: {{ template "fullname" . }}
+rules:
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - '*'
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - endpoints
+  resourceNames:
+  - "ipclaim-scheduler"
+  verbs:
+  - '*'
+- apiGroups:
+  - ipcontroller.ext
+  resources:
+  - ipclaims
+  - ipnodes
+  verbs:
+  - '*'
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app: {{ template "fullname" . }}
+  name: {{ template "fullname" . }}
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app: {{ template "fullname" . }}
+  name: {{ template "fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "fullname" . }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "fullname" . }}
+{{- end }}

helm-chart/externalipcontroller/values.yaml

@@ -1,14 +1,20 @@
 # Default values for externalipcontroller.
 # This is a YAML-formatted file.
 # Declare variables to be passed into your templates.
-replicaCount: 2
 image:
   repository: mirantis/k8s-externalipcontroller
   tag: latest
   pullPolicy: IfNotPresent
 scheduler:
   name: claimscheduler
   network_mask: 24
+  nodeSelector: {}
+  replicaCount: 2
+  resources: {}
 controller:
-  name: claimcontroller
   interface: docker0
+  name: claimcontroller
+  nodeSelector: {}
+  resources: {}
+rbac:
+  create: false