Skip to content

Commit 0b4e49d

Browse files
arjunrnarjunrn
committed
[stable/field-exporter] add validating webhook configuration
1 parent ee9c471 commit 0b4e49d

16 files changed

+394
-26
lines changed

‎stable/field-exporter/Chart.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@ description: |
44
A chart to install [field-exporter](https://github.com/deliveryhero/field-exporter). This controller is used to fill the gap in [k8s-config-connector](https://github.com/GoogleCloudPlatform/k8s-config-connector) for exporting value from Config Connector managed resources into Secrets and ConfigMaps.
55
66
type: application
7-
version: 1.1.0
8-
appVersion: "v1.1.0"
7+
version: 1.3.0
8+
appVersion: "v1.3.0"
99
home: https://github.com/deliveryhero/field-exporter
1010
sources:
1111
- https://github.com/deliveryhero/field-exporter

‎stable/field-exporter/README.md

+7-6
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# field-exporter
22

3-
![Version: 1.1.0](https://img.shields.io/badge/Version-1.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.1.0](https://img.shields.io/badge/AppVersion-v1.1.0-informational?style=flat-square)
3+
![Version: 1.3.0](https://img.shields.io/badge/Version-1.3.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.3.0](https://img.shields.io/badge/AppVersion-v1.3.0-informational?style=flat-square)
44

55
A chart to install [field-exporter](https://github.com/deliveryhero/field-exporter). This controller is used to fill the gap in [k8s-config-connector](https://github.com/GoogleCloudPlatform/k8s-config-connector) for exporting value from Config Connector managed resources into Secrets and ConfigMaps.
66

@@ -46,18 +46,15 @@ helm install my-release deliveryhero/field-exporter -f values.yaml
4646

4747
| Key | Type | Default | Description |
4848
|-----|------|---------|-------------|
49-
| controllerManager.manager.args[0] | string | `"--health-probe-bind-address=:8081"` | |
50-
| controllerManager.manager.args[1] | string | `"--metrics-bind-address=127.0.0.1:8080"` | |
51-
| controllerManager.manager.args[2] | string | `"--leader-elect"` | |
49+
| controllerManager.manager.args[0] | string | `"--leader-elect"` | |
5250
| controllerManager.manager.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | |
5351
| controllerManager.manager.containerSecurityContext.capabilities.drop[0] | string | `"ALL"` | |
5452
| controllerManager.manager.image.repository | string | `"europe-docker.pkg.dev/dp-common-infra-5780/developer-platform-public/deliveryhero/field-exporter"` | |
55-
| controllerManager.manager.image.tag | string | `"v1.1.0"` | |
53+
| controllerManager.manager.image.tag | string | `"v1.3.0"` | |
5654
| controllerManager.manager.resources.limits.cpu | string | `"500m"` | |
5755
| controllerManager.manager.resources.limits.memory | string | `"128Mi"` | |
5856
| controllerManager.manager.resources.requests.cpu | string | `"10m"` | |
5957
| controllerManager.manager.resources.requests.memory | string | `"128Mi"` | |
60-
| controllerManager.podLabels | object | `{}` | |
6158
| controllerManager.replicas | int | `1` | |
6259
| controllerManager.serviceAccount.annotations | object | `{}` | |
6360
| kubernetesClusterDomain | string | `"cluster.local"` | |
@@ -66,6 +63,10 @@ helm install my-release deliveryhero/field-exporter -f values.yaml
6663
| metricsService.ports[0].protocol | string | `"TCP"` | |
6764
| metricsService.ports[0].targetPort | string | `"https"` | |
6865
| metricsService.type | string | `"ClusterIP"` | |
66+
| webhookService.ports[0].port | int | `443` | |
67+
| webhookService.ports[0].protocol | string | `"TCP"` | |
68+
| webhookService.ports[0].targetPort | int | `9443` | |
69+
| webhookService.type | string | `"ClusterIP"` | |
6970

7071
## Maintainers
7172

‎stable/field-exporter/templates/_helpers.tpl

+39
Original file line numberDiff line numberDiff line change
@@ -60,3 +60,42 @@ Create the name of the service account to use
6060
{{- default "default" .Values.serviceAccount.name }}
6161
{{- end }}
6262
{{- end }}
63+
64+
{{/*
65+
Create the name of the webhook service
66+
*/}}
67+
{{- define "field-exporter.webhookService" -}}
68+
{{- printf "%s-webhook-service" (include "field-exporter.name" .) -}}
69+
{{- end -}}
70+
71+
{{/*
72+
Create the name of the webhook cert secret
73+
*/}}
74+
{{- define "field-exporter.webhookCertSecret" -}}
75+
{{- printf "%s-tls" (include "field-exporter.name" .) -}}
76+
{{- end -}}
77+
78+
{{/*
79+
Generate certificates for webhook
80+
*/}}
81+
{{- define "field-exporter.webhookCerts" -}}
82+
{{- $serviceName := (include "field-exporter.webhookService" .) -}}
83+
{{- $secretName := (include "field-exporter.webhookCertSecret" .) -}}
84+
{{- $secret := lookup "v1" "Secret" .Release.Namespace $secretName -}}
85+
{{- if (and .Values.webhookTLS.caCert .Values.webhookTLS.cert .Values.webhookTLS.key) -}}
86+
caCert: {{ .Values.webhookTLS.caCert | b64enc }}
87+
clientCert: {{ .Values.webhookTLS.cert | b64enc }}
88+
clientKey: {{ .Values.webhookTLS.key | b64enc }}
89+
{{- else if and .Values.keepTLSSecret $secret -}}
90+
caCert: {{ index $secret.data "ca.crt" }}
91+
clientCert: {{ index $secret.data "tls.crt" }}
92+
clientKey: {{ index $secret.data "tls.key" }}
93+
{{- else -}}
94+
{{- $altNames := list (printf "%s.%s" $serviceName .Release.Namespace) (printf "%s.%s.svc" $serviceName .Release.Namespace) (printf "%s.%s.svc.%s" $serviceName .Release.Namespace .Values.cluster.dnsDomain) -}}
95+
{{- $ca := genCA "field-exporter-ca" 3650 -}}
96+
{{- $cert := genSignedCert (include "field-exporter.fullname" .) nil $altNames 3650 $ca -}}
97+
caCert: {{ $ca.Cert | b64enc }}
98+
clientCert: {{ $cert.Cert | b64enc }}
99+
clientKey: {{ $cert.Key | b64enc }}
100+
{{- end -}}
101+
{{- end -}}

‎stable/field-exporter/templates/deployment.yaml

+17-4
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,6 @@ spec:
1515
labels:
1616
control-plane: controller-manager
1717
{{- include "field-exporter.selectorLabels" . | nindent 8 }}
18-
{{- if .Values.controllerManager.podLabels }}
19-
{{ toYaml .Values.controllerManager.podLabels | indent 8 }}
20-
{{- end }}
2118
annotations:
2219
kubectl.kubernetes.io/default-container: manager
2320
spec:
@@ -28,14 +25,21 @@ spec:
2825
env:
2926
- name: KUBERNETES_CLUSTER_DOMAIN
3027
value: {{ quote .Values.kubernetesClusterDomain }}
31-
image: {{ .Values.controllerManager.manager.image.repository }}:{{ .Values.controllerManager.manager.image.tag | default .Chart.AppVersion }}
28+
- name: ENABLE_WEBHOOKS
29+
value: "true"
30+
image: {{ .Values.controllerManager.manager.image.repository }}:{{ .Values.controllerManager.manager.image.tag
31+
| default .Chart.AppVersion }}
3232
livenessProbe:
3333
httpGet:
3434
path: /healthz
3535
port: 8081
3636
initialDelaySeconds: 15
3737
periodSeconds: 20
3838
name: manager
39+
ports:
40+
- containerPort: 9443
41+
name: webhook-server
42+
protocol: TCP
3943
readinessProbe:
4044
httpGet:
4145
path: /readyz
@@ -46,7 +50,16 @@ spec:
4650
}}
4751
securityContext: {{- toYaml .Values.controllerManager.manager.containerSecurityContext
4852
| nindent 10 }}
53+
volumeMounts:
54+
- mountPath: /tmp/k8s-webhook-server/serving-certs
55+
name: cert
56+
readOnly: true
4957
securityContext:
5058
runAsNonRoot: true
5159
serviceAccountName: {{ include "field-exporter.fullname" . }}-controller-manager
5260
terminationGracePeriodSeconds: 10
61+
volumes:
62+
- name: cert
63+
secret:
64+
defaultMode: 420
65+
secretName: webhook-server-cert

‎stable/field-exporter/templates/leader-election-rbac.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -53,4 +53,4 @@ roleRef:
5353
subjects:
5454
- kind: ServiceAccount
5555
name: '{{ include "field-exporter.fullname" . }}-controller-manager'
56-
namespace: '{{ .Release.Namespace }}'
56+
namespace: '{{ .Release.Namespace }}'

‎stable/field-exporter/templates/manager-rbac.yaml

+8-8
Original file line numberDiff line numberDiff line change
@@ -6,23 +6,23 @@ metadata:
66
{{- include "field-exporter.labels" . | nindent 4 }}
77
rules:
88
- apiGroups:
9-
- ""
9+
- alloydb.cnrm.cloud.google.com
1010
resources:
11-
- configmaps
12-
- secrets
11+
- '*'
1312
verbs:
1413
- get
1514
- list
16-
- patch
17-
- update
1815
- watch
1916
- apiGroups:
20-
- alloydb.cnrm.cloud.google.com
17+
- ""
2118
resources:
22-
- '*'
19+
- configmaps
20+
- secrets
2321
verbs:
2422
- get
2523
- list
24+
- patch
25+
- update
2626
- watch
2727
- apiGroups:
2828
- gdp.deliveryhero.io
@@ -99,4 +99,4 @@ roleRef:
9999
subjects:
100100
- kind: ServiceAccount
101101
name: '{{ include "field-exporter.fullname" . }}-controller-manager'
102-
namespace: '{{ .Release.Namespace }}'
102+
namespace: '{{ .Release.Namespace }}'

‎stable/field-exporter/templates/metrics-reader-rbac.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: {{ include "field-exporter.fullname" . }}-metrics-reader
5+
labels:
6+
app.kubernetes.io/component: kube-rbac-proxy
7+
app.kubernetes.io/created-by: field-exporter
8+
app.kubernetes.io/part-of: field-exporter
9+
{{- include "field-exporter.labels" . | nindent 4 }}
10+
rules:
11+
- nonResourceURLs:
12+
- /metrics
13+
verbs:
14+
- get

‎stable/field-exporter/templates/metrics-service.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: {{ include "field-exporter.fullname" . }}-controller-manager-metrics-service
5+
labels:
6+
app.kubernetes.io/component: kube-rbac-proxy
7+
app.kubernetes.io/created-by: field-exporter
8+
app.kubernetes.io/part-of: field-exporter
9+
control-plane: controller-manager
10+
{{- include "field-exporter.labels" . | nindent 4 }}
11+
spec:
12+
type: {{ .Values.metricsService.type }}
13+
selector:
14+
control-plane: controller-manager
15+
{{- include "field-exporter.selectorLabels" . | nindent 4 }}
16+
ports:
17+
{{- .Values.metricsService.ports | toYaml | nindent 2 -}}

‎stable/field-exporter/templates/proxy-rbac.yaml

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: {{ include "field-exporter.fullname" . }}-proxy-role
5+
labels:
6+
app.kubernetes.io/component: kube-rbac-proxy
7+
app.kubernetes.io/created-by: field-exporter
8+
app.kubernetes.io/part-of: field-exporter
9+
{{- include "field-exporter.labels" . | nindent 4 }}
10+
rules:
11+
- apiGroups:
12+
- authentication.k8s.io
13+
resources:
14+
- tokenreviews
15+
verbs:
16+
- create
17+
- apiGroups:
18+
- authorization.k8s.io
19+
resources:
20+
- subjectaccessreviews
21+
verbs:
22+
- create
23+
---
24+
apiVersion: rbac.authorization.k8s.io/v1
25+
kind: ClusterRoleBinding
26+
metadata:
27+
name: {{ include "field-exporter.fullname" . }}-proxy-rolebinding
28+
labels:
29+
app.kubernetes.io/component: kube-rbac-proxy
30+
app.kubernetes.io/created-by: field-exporter
31+
app.kubernetes.io/part-of: field-exporter
32+
{{- include "field-exporter.labels" . | nindent 4 }}
33+
roleRef:
34+
apiGroup: rbac.authorization.k8s.io
35+
kind: ClusterRole
36+
name: '{{ include "field-exporter.fullname" . }}-proxy-role'
37+
subjects:
38+
- kind: ServiceAccount
39+
name: '{{ include "field-exporter.fullname" . }}-controller-manager'
40+
namespace: '{{ .Release.Namespace }}'

0 commit comments

Comments
 (0)