diff --git a/charts/lagoon-docker-host/.gitignore b/charts/lagoon-docker-host/.gitignore new file mode 100644 index 00000000..413d4a36 --- /dev/null +++ b/charts/lagoon-docker-host/.gitignore @@ -0,0 +1 @@ +/charts diff --git a/charts/lagoon-docker-host/.helmignore b/charts/lagoon-docker-host/.helmignore new file mode 100644 index 00000000..50af0317 --- /dev/null +++ b/charts/lagoon-docker-host/.helmignore @@ -0,0 +1,22 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/lagoon-docker-host/Chart.yaml b/charts/lagoon-docker-host/Chart.yaml new file mode 100644 index 00000000..5310513d --- /dev/null +++ b/charts/lagoon-docker-host/Chart.yaml @@ -0,0 +1,30 @@ +apiVersion: v2 +name: lagoon-docker-host +description: A Helm chart to run a lagoon-docker-host +home: https://github.com/uselagoon/lagoon-charts +icon: https://raw.githubusercontent.com/uselagoon/lagoon-charts/main/icon.png +maintainers: +- name: shreddedbacon + email: ben.jackson@amazee.io + url: https://amazee.io +kubeVersion: ">= 1.21.0-0" + +# Application charts are a collection of templates that can be packaged into +# versioned archives to be deployed. +type: application + +# This is the chart version. This version number should be incremented each +# time you make changes to the chart and its templates, including the app +# version. +version: 0.1.0 + +appVersion: v3.3.0 + + +# This section is used to collect a changelog for artifacthub.io +# It should be started afresh for each release +# Valid supported kinds are added, changed, deprecated, removed, fixed and security +annotations: + artifacthub.io/changes: | + - kind: changed + description: update lagoon-docker-host to appversion v3.3.0 diff --git a/charts/lagoon-docker-host/README.md b/charts/lagoon-docker-host/README.md new file mode 100644 index 00000000..1f261af3 --- /dev/null +++ b/charts/lagoon-docker-host/README.md @@ -0,0 +1,4 @@ +# Lagoon Docker Host + +This chart installs a docker hpst service for [Lagoon](https://github.com/amazeeio/lagoon/). +Install this chart into the cluster you want to deploy workloads to. diff --git a/charts/lagoon-docker-host/ci/linter-values.yaml b/charts/lagoon-docker-host/ci/linter-values.yaml new file mode 100644 index 00000000..579baa2b --- /dev/null +++ b/charts/lagoon-docker-host/ci/linter-values.yaml @@ -0,0 +1,2 @@ +storage: + size: 50Gi diff --git a/charts/lagoon-docker-host/templates/NOTES.txt b/charts/lagoon-docker-host/templates/NOTES.txt new file mode 100644 index 00000000..0e853eec --- /dev/null +++ b/charts/lagoon-docker-host/templates/NOTES.txt @@ -0,0 +1,27 @@ + +            .;. +        .':ooo' .l;. +     .:odddooo' .lllc:'. + .;oxxxxdddddo' .lllcc:::,. +.kkkkxxxxxdddd' .lllcc:::::: +.kkkkkkxxxxxdd, .lllcccccc:: +.OOOkkkkkxxxxx, .llllllccccc +.OOOOOkkkkkxxx;  ':llllllccc +.0OOOOOOkkkkxxxo;.  .,cllllc. +.0000OOOOOkkkkxxxddc,. .':ll. +.K0000000OOOOkkkxxxxddo;.  . +.kKKKKKK0000OOOkkkkxxxdddoc. +  .;d0KKKKK000OOOOkkkxxdc' +      .ckKKKK000OOOOd;. +         .,o0KKKOl, +             .;.  + _ _ _ _ _ +| | | | | | | | | | +| | __ _ __ _ ___ ___ _ __ __| | ___ ___| | _____ _ __ | |__ ___ ___| |_ +| |/ _` |/ _` |/ _ \ / _ \| '_ \ / _` |/ _ \ / __| |/ / _ \ '__| | '_ \ / _ \/ __| __| +| | (_| | (_| | (_) | (_) | | | | | (_| | (_) | (__| < __/ | | | | | (_) \__ \ |_ +|_|\__,_|\__, |\___/ \___/|_| |_| \__,_|\___/ \___|_|\_\___|_| |_| |_|\___/|___/\__| + __/ | + |___/ + +Lagoon Docker Host configured. diff --git a/charts/lagoon-docker-host/templates/_helpers.tpl b/charts/lagoon-docker-host/templates/_helpers.tpl new file mode 100644 index 00000000..4ca2eff3 --- /dev/null +++ b/charts/lagoon-docker-host/templates/_helpers.tpl @@ -0,0 +1,81 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "lagoon-docker-host.name" -}} +{{- .Chart.Name | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "lagoon-docker-host.fullname" -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "lagoon-docker-host.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "lagoon-docker-host.labels" -}} +helm.sh/chart: {{ include "lagoon-docker-host.chart" . }} +{{ include "lagoon-docker-host.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "lagoon-docker-host.selectorLabels" -}} +app.kubernetes.io/name: {{ include "lagoon-docker-host.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + + + +{{/* +Create the name of the service account to use for dockerHost. +*/}} +{{- define "lagoon-docker-host.dockerHost.serviceAccountName" -}} +{{- default (include "lagoon-docker-host.dockerHost.fullname" .) .Values.serviceAccount.name }} +{{- end }} + +{{/* +Create a default fully qualified app name for dockerHost. +*/}} +{{- define "lagoon-docker-host.dockerHost.fullname" -}} +{{- include "lagoon-docker-host.fullname" . }}-docker-host +{{- end }} + +{{/* +Common labels dockerHost. +*/}} +{{- define "lagoon-docker-host.dockerHost.labels" -}} +helm.sh/chart: {{ include "lagoon-docker-host.chart" . }} +{{ include "lagoon-docker-host.dockerHost.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels dockerHost. +*/}} +{{- define "lagoon-docker-host.dockerHost.selectorLabels" -}} +app.kubernetes.io/name: {{ include "lagoon-docker-host.name" . }} +app.kubernetes.io/component: {{ include "lagoon-docker-host.dockerHost.fullname" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + diff --git a/charts/lagoon-docker-host/templates/docker-host.clusterrole.yaml b/charts/lagoon-docker-host/templates/docker-host.clusterrole.yaml new file mode 100644 index 00000000..cb4e6583 --- /dev/null +++ b/charts/lagoon-docker-host/templates/docker-host.clusterrole.yaml @@ -0,0 +1,17 @@ +{{- if and .Values.serviceAccount.create .Values.global.openshift -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "lagoon-docker-host.dockerHost.fullname" . }} + labels: + {{- include "lagoon-docker-host.dockerHost.labels" . | nindent 4 }} +rules: +- apiGroups: + - security.openshift.io + resourceNames: + - privileged + resources: + - securitycontextconstraints + verbs: + - use +{{- end }} diff --git a/charts/lagoon-docker-host/templates/docker-host.deployment.yaml b/charts/lagoon-docker-host/templates/docker-host.deployment.yaml new file mode 100644 index 00000000..5f3b0041 --- /dev/null +++ b/charts/lagoon-docker-host/templates/docker-host.deployment.yaml @@ -0,0 +1,113 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "lagoon-docker-host.dockerHost.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + {{- include "lagoon-docker-host.dockerHost.labels" . | nindent 4 }} +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + {{- include "lagoon-docker-host.dockerHost.selectorLabels" . | nindent 6 }} + strategy: + type: Recreate + template: + metadata: + labels: + {{- include "lagoon-docker-host.dockerHost.selectorLabels" . | nindent 8 }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.serviceAccount.create }} + serviceAccountName: {{ include "lagoon-docker-host.dockerHost.serviceAccountName" . }} + {{- end }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: docker-host + securityContext: + {{- toYaml .Values.securityContext | nindent 10 }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + env: + {{- range $name, $value := .Values.extraEnvs }} + - name: {{ .name }} + value: {{ .value | quote }} + {{- end }} + {{- with .Values.httpProxy }} + - name: HTTP_PROXY + value: {{ . | quote }} + - name: http_proxy + value: {{ . | quote }} + {{- end }} + {{- with .Values.httpsProxy }} + - name: HTTPS_PROXY + value: {{ . | quote }} + - name: https_proxy + value: {{ . | quote }} + {{- end }} + {{- with .Values.noProxy }} + - name: NO_PROXY + value: {{ . | quote }} + - name: no_proxy + value: {{ . | quote }} + {{- end }} + - name: DOCKER_HOST + value: localhost + - name: REGISTRY + value: {{ .Values.registry | quote }} + - name: REPOSITORY_TO_UPDATE + value: {{ .Values.repositoryToUpdate | quote }} + - name: PRUNE_IMAGES_UNTIL + value: {{ .Values.pruneImagesUntil | quote }} + - name: CRONJOBS + value: | + 22 1 * * * /lagoon/cronjob.sh "/prune-images.sh" + 22 */4 * * * /lagoon/cronjob.sh "/remove-exited.sh" + */15 * * * * /lagoon/cronjob.sh "/update-images.sh" + ports: + - containerPort: 2375 + protocol: TCP + name: docker-daemon + livenessProbe: + failureThreshold: 3 + periodSeconds: 10 + successThreshold: 1 + tcpSocket: + port: 2375 + timeoutSeconds: 1 + readinessProbe: + failureThreshold: 3 + periodSeconds: 10 + successThreshold: 1 + tcpSocket: + port: 2375 + timeoutSeconds: 1 + resources: + {{- toYaml .Values.resources | nindent 10 }} + volumeMounts: + - mountPath: /var/lib/docker + name: docker-lib + volumes: + - name: docker-lib + {{- if .Values.storage.create }} + persistentVolumeClaim: + claimName: {{ include "lagoon-docker-host.dockerHost.fullname" . }} + {{- else }} + emptyDir: {} + {{- end -}} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 6 }} + {{- end }} diff --git a/charts/lagoon-docker-host/templates/docker-host.networkpolicy.yaml b/charts/lagoon-docker-host/templates/docker-host.networkpolicy.yaml new file mode 100644 index 00000000..1548ea17 --- /dev/null +++ b/charts/lagoon-docker-host/templates/docker-host.networkpolicy.yaml @@ -0,0 +1,17 @@ +{{- if .Values.networkPolicy.enabled -}} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "lagoon-docker-host.dockerHost.fullname" . }} + labels: + {{- include "lagoon-docker-host.dockerHost.labels" . | nindent 4 }} +spec: + ingress: + - from: + {{- toYaml .Values.networkPolicy.policy | nindent 4 }} + podSelector: + matchLabels: + {{- include "lagoon-docker-host.dockerHost.selectorLabels" . | nindent 6 }} + policyTypes: + - Ingress +{{- end }} diff --git a/charts/lagoon-docker-host/templates/docker-host.pvc.yaml b/charts/lagoon-docker-host/templates/docker-host.pvc.yaml new file mode 100644 index 00000000..a72c3c6c --- /dev/null +++ b/charts/lagoon-docker-host/templates/docker-host.pvc.yaml @@ -0,0 +1,17 @@ +{{- if .Values.storage.create -}} +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: {{ include "lagoon-docker-host.dockerHost.fullname" . }} + labels: + {{- include "lagoon-docker-host.dockerHost.labels" . | nindent 4 }} +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: {{ .Values.storage.size | quote }} + {{- with .Values.storage.className }} + storageClassName: {{ . | quote }} + {{- end }} +{{- end }} diff --git a/charts/lagoon-docker-host/templates/docker-host.rolebinding.yaml b/charts/lagoon-docker-host/templates/docker-host.rolebinding.yaml new file mode 100644 index 00000000..89978731 --- /dev/null +++ b/charts/lagoon-docker-host/templates/docker-host.rolebinding.yaml @@ -0,0 +1,17 @@ +{{- if and .Values.serviceAccount.create .Values.global.openshift -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "lagoon-docker-host.dockerHost.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + {{- include "lagoon-docker-host.dockerHost.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "lagoon-docker-host.dockerHost.fullname" . }} +subjects: +- kind: ServiceAccount + name: {{ include "lagoon-docker-host.dockerHost.serviceAccountName" . }} + namespace: {{ .Release.Namespace | quote }} +{{- end }} diff --git a/charts/lagoon-docker-host/templates/docker-host.service.yaml b/charts/lagoon-docker-host/templates/docker-host.service.yaml new file mode 100644 index 00000000..c1b28ee7 --- /dev/null +++ b/charts/lagoon-docker-host/templates/docker-host.service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: docker-host + labels: + {{- include "lagoon-docker-host.dockerHost.labels" . | nindent 4 }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: docker-daemon + protocol: TCP + name: docker-daemon + selector: + {{- include "lagoon-docker-host.dockerHost.selectorLabels" . | nindent 4 }} diff --git a/charts/lagoon-docker-host/templates/docker-host.serviceaccount.yaml b/charts/lagoon-docker-host/templates/docker-host.serviceaccount.yaml new file mode 100644 index 00000000..5e5e81c3 --- /dev/null +++ b/charts/lagoon-docker-host/templates/docker-host.serviceaccount.yaml @@ -0,0 +1,8 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "lagoon-docker-host.dockerHost.serviceAccountName" . }} + labels: + {{- include "lagoon-docker-host.dockerHost.labels" . | nindent 4 }} +{{- end }} diff --git a/charts/lagoon-docker-host/templates/tests/test-connection.yaml b/charts/lagoon-docker-host/templates/tests/test-connection.yaml new file mode 100644 index 00000000..fcf59492 --- /dev/null +++ b/charts/lagoon-docker-host/templates/tests/test-connection.yaml @@ -0,0 +1,18 @@ +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "lagoon-docker-host.dockerHost.fullname" . }}-test-connection" + labels: + {{- include "lagoon-docker-host.dockerHost.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": test-success +spec: + containers: + - name: nc + image: busybox + command: ['nc'] + args: + - "-zvw5" + - "docker-host" + - "{{ .Values.service.port }}" + restartPolicy: Never diff --git a/charts/lagoon-docker-host/values.yaml b/charts/lagoon-docker-host/values.yaml new file mode 100644 index 00000000..877dc32e --- /dev/null +++ b/charts/lagoon-docker-host/values.yaml @@ -0,0 +1,95 @@ +global: + # set to true to enable openshift support + openshift: false + +image: + repository: uselagoon/docker-host + pullPolicy: Always + +name: docker-host + +pruneImagesUntil: 168h + +# TODO: change this up once new docker-host is released +registry: registry.lagoon.svc:5000 +repositoryToUpdate: amazeeio|lagoon + +replicaCount: 1 + +## proxy configuration +# httpProxy: "" +# httpsProxy: "" +# noProxy: "" + +# add extra environment variables if required +extraEnvs: + +storage: + create: true + size: 750Gi + # className sets the storageClassName for the docker-host PVC. This is + # useful if the docker-host requires a specific storage class for features + # such as increased IOPS. + # + # WARNING: On platforms such as AKS not all storage volume classes can be + # bound to all node types. So if you configure a storage class that can't + # be bound to any nodes in the cluster it will cause the docker-host pod to + # fail to schedule. For example AKS requires Premium Storage suport on the + # node for the managed-premium storage class. + # + # If className is not defined the chart will not set any specify storage + # class on the PVC, effectively falling back to the cluster default. + # + # className: managed-premium + +networkPolicy: + # Specifies whether the docker-host network policy should be enabled + enabled: true + # Specify the policy to apply, useful to change who can access the docker-host + # This default policy just replicates the existing docker-host + policy: + - namespaceSelector: + matchExpressions: + - key: lagoon.sh/environment + operator: Exists + podSelector: + matchExpressions: + - key: lagoon.sh/buildName + operator: Exists + +serviceAccount: + # Specifies whether a service account should be created + create: true + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname + # template + name: + +podSecurityContext: {} + +securityContext: + privileged: true + seLinuxOptions: + # Ensures selinux relabeling is disabled, this would case the container never to start + # as there can be so many files in the persistent storage + type: spc_t + +resources: {} + +service: + type: ClusterIP + port: 2375 + +tolerations: +- key: lagoon/build + effect: NoSchedule + operator: Exists +- key: lagoon/build + effect: PreferNoSchedule + operator: Exists +- key: lagoon.sh/build + effect: NoSchedule + operator: Exists +- key: lagoon.sh/build + effect: PreferNoSchedule + operator: Exists