Skip to content

Commit ce3d65c

Browse files
kmadelkmadel
committed
updated to 0.23.0
1 parent c278226 commit ce3d65c

File tree

9 files changed

+429
-26
lines changed

9 files changed

+429
-26
lines changed

‎charts/vcluster/Chart.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,4 @@ sources:
2323
- https://github.com/loft-demos/vcluster-charts/charts/vcluster
2424
type: application
2525

26-
version: 0.22.3 # version is auto-generated by release pipeline
26+
version: 0.23.0 # version is auto-generated by release pipeline

‎charts/vcluster/templates/_init-containers.tpl

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@
88
{{- end -}}
99
{{- end -}}
1010

11-
1211
{{- define "vcluster.k8s.capabilities.version" -}}
1312
{{/* We need to workaround here for unit tests because Capabilities.KubeVersion.Version is not supported, so we use .Chart.Version */}}
1413
{{- if hasPrefix "test-" .Chart.Version -}}
@@ -20,7 +19,7 @@
2019

2120
{{/* Bump $defaultTag value whenever k8s version is bumped */}}
2221
{{- define "vcluster.k8s.controllerManager.image.tag" -}}
23-
{{- $defaultTag := "v1.31.1" -}}
22+
{{- $defaultTag := "v1.32.1" -}}
2423
{{- if and (not (empty .Values.controlPlane.distro.k8s.version)) (eq .Values.controlPlane.distro.k8s.controllerManager.image.tag $defaultTag) -}}
2524
{{ .Values.controlPlane.distro.k8s.version }}
2625
{{- else -}}
@@ -36,7 +35,7 @@
3635

3736
{{/* Bump $defaultTag value whenever k8s version is bumped */}}
3837
{{- define "vcluster.k8s.apiServer.image.tag" -}}
39-
{{- $defaultTag := "v1.31.1" -}}
38+
{{- $defaultTag := "v1.32.1" -}}
4039
{{- if and (not (empty .Values.controlPlane.distro.k8s.version)) (eq .Values.controlPlane.distro.k8s.apiServer.image.tag $defaultTag) -}}
4140
{{ .Values.controlPlane.distro.k8s.version}}
4241
{{- else -}}
@@ -53,7 +52,7 @@
5352

5453
{{/* Bump $defaultTag value whenever k8s version is bumped */}}
5554
{{- define "vcluster.k8s.scheduler.image.tag" -}}
56-
{{- $defaultTag := "v1.31.1" -}}
55+
{{- $defaultTag := "v1.32.1" -}}
5756
{{- if and (not (empty .Values.controlPlane.distro.k8s.version)) (eq .Values.controlPlane.distro.k8s.scheduler.image.tag $defaultTag) -}}
5857
{{ .Values.controlPlane.distro.k8s.version}}
5958
{{- else -}}

‎charts/vcluster/templates/_rbac.tpl

Lines changed: 48 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,9 @@
4141
.Values.integrations.externalSecrets.enabled
4242
(and .Values.integrations.certManager.enabled .Values.integrations.certManager.sync.fromHost.clusterIssuers.enabled)
4343
(and .Values.integrations.metricsServer.enabled .Values.integrations.metricsServer.nodes)
44-
.Values.experimental.multiNamespaceMode.enabled -}}
44+
.Values.experimental.multiNamespaceMode.enabled
45+
.Values.sync.fromHost.configMaps.enabled
46+
.Values.sync.fromHost.secrets.enabled -}}
4547
{{- true -}}
4648
{{- end -}}
4749
{{- end -}}
@@ -213,3 +215,48 @@
213215
{{- define "vcluster.rbac.platformRoleBindingName" -}}
214216
{{- printf "vc-%s-v-%s-platform-role-binding" .Release.Name .Release.Namespace | trunc 63 | trimSuffix "-" -}}
215217
{{- end -}}
218+
219+
{{/*
220+
Cluster role rules needed for fromHost sync (containing namespaces + configmaps/secret/other core resources)
221+
*/}}
222+
{{- define "vcluster.rbac.rulesForFromHostSyncerForGivenCoreResource" -}}
223+
{{- $root := index . 0 -}}
224+
{{- $mappings := index . 1 -}}
225+
{{- $kind := index . 2 -}}
226+
{{- $enabled := index . 3 -}}
227+
{{- if and $enabled $mappings -}}
228+
{{- $namespaces := list -}}
229+
{{- $objNames := list -}}
230+
{{- $addResourceNames := true -}}
231+
{{- range $key, $val := $mappings -}}
232+
{{- $sourceNs := splitList "/" $key | first -}}
233+
{{- $sourceObjName := splitList "/" $key | last }}
234+
{{- if eq $sourceNs "" -}}
235+
{{- $namespaces = append $namespaces (quote $root.Release.Namespace) -}}
236+
{{- else -}}
237+
{{- $namespaces = append $namespaces (quote $sourceNs) -}}
238+
{{- end -}}
239+
{{- if eq $sourceObjName "*" -}}
240+
{{- $addResourceNames = false -}}
241+
{{- else -}}
242+
{{- $objNames = append $objNames (quote $sourceObjName) -}}
243+
{{- end -}}
244+
{{- end -}}
245+
{{- $objList := $objNames | uniq | sortAlpha -}}
246+
{{- $nsList := $namespaces | uniq | sortAlpha -}}
247+
- apiGroups: [""]
248+
resources: [ "namespaces" ]
249+
resourceNames: [ {{ join "," $nsList }} ]
250+
verbs: ["get", "list", "watch"]
251+
- apiGroups: [""]
252+
resources: [ {{ $kind | quote }} ]
253+
verbs: ["list", "watch"]
254+
- apiGroups: [""]
255+
resources: [ {{ $kind | quote }} ]
256+
verbs: ["get"]
257+
{{- if $addResourceNames }}
258+
resourceNames: [ {{ join "," $objList }} ]
259+
{{- end }}
260+
{{- end }}
261+
{{- end }}
262+

‎charts/vcluster/templates/clusterrole.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,8 @@ rules:
134134
resources: ["clusterissuers"]
135135
verbs: ["get", "list", "watch"]
136136
{{- end }}
137+
{{- include "vcluster.rbac.rulesForFromHostSyncerForGivenCoreResource" (list $ .Values.sync.fromHost.configMaps.mappings.byName "configmaps" .Values.sync.fromHost.configMaps.enabled ) | nindent 2 }}
138+
{{- include "vcluster.rbac.rulesForFromHostSyncerForGivenCoreResource" (list $ .Values.sync.fromHost.secrets.mappings.byName "secrets" .Values.sync.fromHost.secrets.enabled ) | nindent 2 }}
137139
{{- include "vcluster.customResources.clusterRoleExtraRules" . | indent 2 }}
138140
{{- include "vcluster.plugin.clusterRoleExtraRules" . | indent 2 }}
139141
{{- include "vcluster.generic.clusterRoleExtraRules" . | indent 2 }}

‎charts/vcluster/templates/statefulset.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,6 +159,7 @@ spec:
159159
scheme: HTTPS
160160
failureThreshold: 60
161161
initialDelaySeconds: 60
162+
timeoutSeconds: 3
162163
periodSeconds: 2
163164
{{- end }}
164165
{{- if .Values.controlPlane.statefulSet.probes.readinessProbe.enabled }}
@@ -168,6 +169,7 @@ spec:
168169
port: 8443
169170
scheme: HTTPS
170171
failureThreshold: 60
172+
timeoutSeconds: 3
171173
periodSeconds: 2
172174
{{- end }}
173175
{{- if .Values.controlPlane.statefulSet.probes.startupProbe.enabled }}
@@ -177,6 +179,7 @@ spec:
177179
port: 8443
178180
scheme: HTTPS
179181
failureThreshold: 300
182+
timeoutSeconds: 3
180183
periodSeconds: 6
181184
{{- end }}
182185
{{- if .Values.controlPlane.statefulSet.security.containerSecurityContext }}

‎charts/vcluster/tests/clusterrole_test.yaml

Lines changed: 238 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -445,3 +445,241 @@ tests:
445445
apiGroups: [ "external-secrets.io" ]
446446
resources: [ "clustersecretstores" ]
447447
verbs: ["get", "list", "watch"]
448+
449+
- it: fromHost sync configmaps disabled
450+
set:
451+
sync:
452+
fromHost:
453+
configMaps:
454+
enabled: false
455+
asserts:
456+
- hasDocuments:
457+
count: 0
458+
459+
- it: fromHost sync configmaps enabled with wildcard namespace
460+
set:
461+
sync:
462+
fromHost:
463+
configMaps:
464+
enabled: true
465+
mappings:
466+
byName:
467+
"": "my-ns/*"
468+
my-ns/*: "my-ns-2/*"
469+
asserts:
470+
- hasDocuments:
471+
count: 1
472+
- lengthEqual:
473+
path: rules
474+
count: 3
475+
- contains:
476+
path: rules
477+
content:
478+
apiGroups: [ "" ]
479+
resourceNames: ["NAMESPACE", "my-ns"]
480+
resources: [ "namespaces" ]
481+
verbs: [ "get", "list", "watch" ]
482+
- contains:
483+
path: rules
484+
content:
485+
apiGroups: [ "" ]
486+
resources: [ "configmaps" ]
487+
verbs: [ "list", "watch" ]
488+
- contains:
489+
path: rules
490+
content:
491+
apiGroups: [ "" ]
492+
resources: [ "configmaps" ]
493+
verbs: [ "get" ]
494+
495+
- it: fromHost sync configmaps enabled with wildcard name
496+
set:
497+
sync:
498+
fromHost:
499+
configMaps:
500+
enabled: true
501+
mappings:
502+
byName:
503+
"my-ns/*": "my-ns-4/*"
504+
my-ns-2/*: "my-ns-3/*"
505+
asserts:
506+
- hasDocuments:
507+
count: 1
508+
- lengthEqual:
509+
path: rules
510+
count: 3
511+
- contains:
512+
path: rules
513+
content:
514+
apiGroups: [ "" ]
515+
resourceNames: ["my-ns", "my-ns-2"]
516+
resources: [ "namespaces" ]
517+
verbs: [ "get", "list", "watch" ]
518+
- contains:
519+
path: rules
520+
content:
521+
apiGroups: [ "" ]
522+
resources: [ "configmaps" ]
523+
verbs: [ "list", "watch" ]
524+
- contains:
525+
path: rules
526+
content:
527+
apiGroups: [ "" ]
528+
resources: [ "configmaps" ]
529+
verbs: [ "get" ]
530+
531+
- it: fromHost sync configmaps enabled without wildcards
532+
set:
533+
sync:
534+
fromHost:
535+
configMaps:
536+
enabled: true
537+
mappings:
538+
byName:
539+
"my-ns/my-cm": "my-ns-2/my-cm-2"
540+
my-ns-3/my-cm-2: "my-ns-4/my-cm4"
541+
asserts:
542+
- hasDocuments:
543+
count: 1
544+
- lengthEqual:
545+
path: rules
546+
count: 3
547+
- contains:
548+
path: rules
549+
content:
550+
apiGroups: [ "" ]
551+
resourceNames: [ "my-ns", "my-ns-3" ]
552+
resources: [ "namespaces" ]
553+
verbs: [ "get", "list", "watch" ]
554+
- contains:
555+
path: rules
556+
content:
557+
apiGroups: [ "" ]
558+
resources: [ "configmaps" ]
559+
verbs: [ "list", "watch" ]
560+
- contains:
561+
path: rules
562+
content:
563+
apiGroups: [ "" ]
564+
resourceNames: [ "my-cm", "my-cm-2" ]
565+
resources: [ "configmaps" ]
566+
verbs: [ "get"]
567+
568+
- it: fromHost sync secrets disabled
569+
set:
570+
sync:
571+
fromHost:
572+
secrets:
573+
enabled: false
574+
asserts:
575+
- hasDocuments:
576+
count: 0
577+
578+
- it: fromHost sync secrets enabled with wildcard namespace
579+
set:
580+
sync:
581+
fromHost:
582+
secrets:
583+
enabled: true
584+
mappings:
585+
byName:
586+
"": "my-ns/*"
587+
my-ns/*: "my-ns-2/*"
588+
asserts:
589+
- hasDocuments:
590+
count: 1
591+
- lengthEqual:
592+
path: rules
593+
count: 3
594+
- contains:
595+
path: rules
596+
content:
597+
apiGroups: [ "" ]
598+
resourceNames: ["NAMESPACE", "my-ns"]
599+
resources: [ "namespaces" ]
600+
verbs: [ "get", "list", "watch" ]
601+
- contains:
602+
path: rules
603+
content:
604+
apiGroups: [ "" ]
605+
resources: [ "secrets" ]
606+
verbs: [ "list", "watch" ]
607+
- contains:
608+
path: rules
609+
content:
610+
apiGroups: [ "" ]
611+
resources: [ "secrets" ]
612+
verbs: [ "get"]
613+
614+
- it: fromHost sync secrets enabled with wildcard name
615+
set:
616+
sync:
617+
fromHost:
618+
secrets:
619+
enabled: true
620+
mappings:
621+
byName:
622+
"my-ns/*": "my-ns-4/*"
623+
my-ns-2/*: "my-ns-3/*"
624+
asserts:
625+
- hasDocuments:
626+
count: 1
627+
- lengthEqual:
628+
path: rules
629+
count: 3
630+
- contains:
631+
path: rules
632+
content:
633+
apiGroups: [ "" ]
634+
resourceNames: ["my-ns", "my-ns-2"]
635+
resources: [ "namespaces" ]
636+
verbs: [ "get", "list", "watch" ]
637+
- contains:
638+
path: rules
639+
content:
640+
apiGroups: [ "" ]
641+
resources: [ "secrets" ]
642+
verbs: [ "list", "watch" ]
643+
- contains:
644+
path: rules
645+
content:
646+
apiGroups: [ "" ]
647+
resources: [ "secrets" ]
648+
verbs: [ "get" ]
649+
650+
- it: fromHost sync secrets enabled without wildcards
651+
set:
652+
sync:
653+
fromHost:
654+
secrets:
655+
enabled: true
656+
mappings:
657+
byName:
658+
"my-ns/my-secret": "my-ns-2/my-secret-2"
659+
my-ns-3/my-secret-2: "my-ns-4/my-secret-4"
660+
asserts:
661+
- hasDocuments:
662+
count: 1
663+
- lengthEqual:
664+
path: rules
665+
count: 3
666+
- contains:
667+
path: rules
668+
content:
669+
apiGroups: [ "" ]
670+
resourceNames: [ "my-ns", "my-ns-3" ]
671+
resources: [ "namespaces" ]
672+
verbs: [ "get", "list", "watch" ]
673+
- contains:
674+
path: rules
675+
content:
676+
apiGroups: [ "" ]
677+
resources: [ "secrets" ]
678+
verbs: [ "list", "watch" ]
679+
- contains:
680+
path: rules
681+
content:
682+
apiGroups: [ "" ]
683+
resourceNames: [ "my-secret", "my-secret-2" ]
684+
resources: [ "secrets" ]
685+
verbs: [ "get" ]

0 commit comments

Comments
 (0)