Skip to content

Commit 41e8d05

Browse files
vsukhinvsukhin
authored
feat: [TKC-3299] add namespaces rbac (#997)
* feat: add namespaces rbac Signed-off-by: Vladislav Sukhin <[email protected]> * fix: disable cron jobs flag Signed-off-by: Vladislav Sukhin <[email protected]> * fix: typo Signed-off-by: Vladislav Sukhin <[email protected]> * fix: change default flag Signed-off-by: Vladislav Sukhin <[email protected]> * fix: add env var Signed-off-by: Vladislav Sukhin <[email protected]> * fix: role typo Signed-off-by: Vladislav Sukhin <[email protected]> * fix: watch role Signed-off-by: Vladislav Sukhin <[email protected]> * fix: change default values Signed-off-by: Vladislav Sukhin <[email protected]> * fix: change default value Signed-off-by: Vladislav Sukhin <[email protected]> * fix: config name Signed-off-by: Vladislav Sukhin <[email protected]> * fix: rename helm var Signed-off-by: Vladislav Sukhin <[email protected]> * fix: rename helm var Signed-off-by: Vladislav Sukhin <[email protected]> * fix: rename helm var Signed-off-by: Vladislav Sukhin <[email protected]> * fix: disable con jobs Signed-off-by: Vladislav Sukhin <[email protected]> --------- Signed-off-by: Vladislav Sukhin <[email protected]>
1 parent 596ea3f commit 41e8d05

File tree

10 files changed

+76
-0
lines changed

10 files changed

+76
-0
lines changed

‎charts/testkube-api/templates/configmap.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ metadata:
1010
annotations: {{- include "global.tplvalues.render" ( dict "value" .Values.global.annotations "context" $ ) | nindent 4 }}
1111
{{- end }}
1212
data:
13+
{{- if .Values.next.enabled }}
14+
enable-cron-jobs: "{{ .Values.next.cronJobs.enabled }}"
15+
{{- end }}
1316
executors.json: |-
1417
{{ include "testkube-api.executors" . | indent 4 }}
1518
job-container-template.yml: |-

‎charts/testkube-api/templates/deployment.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -250,6 +250,8 @@ spec:
250250
value: "{{ .Values.next.gitops.namePatterns.kubernetes }}"
251251
- name: DISABLE_DEFAULT_AGENT
252252
value: "{{ not .Values.next.legacyAgent.enabled }}"
253+
- name: ENABLE_CRON_JOBS
254+
value: "{{ .Values.next.cronJobs.enabled }}"
253255
{{- end }}
254256
image: {{ include "testkube-api.image" . }}
255257
imagePullPolicy: {{ .Values.image.pullPolicy }}

‎charts/testkube-api/values.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,13 @@ next:
194194
## Should it enable controller API
195195
enabled: true
196196

197+
198+
## Configure cron jobs in this installation.
199+
# - tkcagnt_*** - Super Agent
200+
cronJobs:
201+
## Should it manage cron jobs
202+
enabled: false
203+
197204
## Testkube API Deployment parameters
198205
## Running Testkube in Agent mode
199206
cloud:

‎charts/testkube-operator/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ A Helm chart for the testkube-operator (installs needed CRDs only for now)
1717
| affinity | object | `{}` | |
1818
| apiFullname | string | `"testkube-api-server"` | |
1919
| apiPort | int | `8088` | |
20+
| agentCronJobs | bool | `true` | |
2021
| useArgoCDSync| bool | `false` | |
2122
| extraEnvVars | list | `[]` | |
2223
| fullnameOverride | string | `""` | |

‎charts/testkube-operator/templates/deployment.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,10 @@ spec:
8282
- name: APISERVER_PURGE_EXECUTIONS
8383
value: "true"
8484
{{- end }}
85+
{{- if .Values.agentCronJobs }}
86+
- name: APISERVER_CONFIG
87+
value: {{ .Values.apiFullname }}
88+
{{- end }}
8589
ports:
8690
- containerPort: {{ .Values.webhookServerPort }}
8791
name: webhook-server

‎charts/testkube-operator/templates/role.yaml

+24
Original file line numberDiff line numberDiff line change
@@ -541,4 +541,28 @@ rules:
541541
- update
542542
{{- end }}
543543

544+
---
545+
546+
apiVersion: {{ include "global.capabilities.rbac.apiVersion" . }}
547+
kind: ClusterRole
548+
metadata:
549+
name: {{ .Release.Name }}-namespaces-role
550+
labels:
551+
{{- if .Values.global.labels }}
552+
{{- include "global.tplvalues.render" ( dict "value" .Values.global.labels "context" $ ) | nindent 4 }}
553+
{{- end }}
554+
{{- if .Values.global.annotations }}
555+
annotations: {{- include "global.tplvalues.render" ( dict "value" .Values.global.annotations "context" $ ) | nindent 4 }}
556+
{{- end }}
557+
namespace: {{ include "testkube-operator.namespace" . }}
558+
rules:
559+
- apiGroups:
560+
- ""
561+
resources:
562+
- namespaces
563+
verbs:
564+
- get
565+
- list
566+
- watch
567+
544568
{{- end -}}

‎charts/testkube-operator/templates/rolebinding.yaml

+24
Original file line numberDiff line numberDiff line change
@@ -143,4 +143,28 @@ subjects:
143143
name: {{ include "testkube-operator.webhook.serviceAccountName" . }}
144144
namespace: {{ include "testkube-operator.namespace" . }}
145145
{{- end }}
146+
147+
---
148+
149+
apiVersion: {{ include "global.capabilities.rbac.apiVersion" . }}
150+
kind: ClusterRoleBinding
151+
metadata:
152+
name: {{ .Release.Name }}-namespaces-rolebinding
153+
labels:
154+
{{- if .Values.global.labels }}
155+
{{- include "global.tplvalues.render" ( dict "value" .Values.global.labels "context" $ ) | nindent 4 }}
156+
{{- end }}
157+
{{- if .Values.global.annotations }}
158+
annotations: {{- include "global.tplvalues.render" ( dict "value" .Values.global.annotations "context" $ ) | nindent 4 }}
159+
{{- end }}
160+
namespace: {{ include "testkube-operator.namespace" . }}
161+
roleRef:
162+
apiGroup: rbac.authorization.k8s.io
163+
kind: ClusterRole
164+
name: {{ .Release.Name }}-namespaces-role
165+
subjects:
166+
- kind: ServiceAccount
167+
name: {{ include "testkube-operator.serviceAccountName" . }}
168+
namespace: {{ include "testkube-operator.namespace" . }}
169+
146170
{{- end -}}

‎charts/testkube-operator/values.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,8 @@ healthcheckPort: 8081
104104
useArgoCDSync: false
105105
# purge executions on CRD deletion
106106
purgeExecutions: false
107+
# agent cron jobs for scheduling test, suites, workflows
108+
agentCronJobs: false
107109

108110
## Service Account parameters
109111
serviceAccount:

‎charts/testkube/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -436,6 +436,7 @@ kubectl label --overwrite crds scripts.tests.testkube.io app.kubernetes.io/manag
436436
| testkube-operator.apiFullname | string | `"testkube-api-server"` | Testkube API full name |
437437
| testkube-operator.apiPort | int | `8088` | Testkube API port |
438438
| testkube-operator.cronJobTemplate | string | `""` | |
439+
| testkube-operator.agentCronJobs | bool | `true` | Agent cron jobs for scheduling test, suites, workflows |
439440
| testkube-operator.enabled | bool | `true` | |
440441
| testkube-operator.extraEnvVars | list | `[]` | Extra environment variables to be set on deployment |
441442
| testkube-operator.fullnameOverride | string | `"testkube-operator"` | Testkube Operator fullname override |

‎charts/testkube/values.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -567,6 +567,12 @@ testkube-api:
567567
## Should it be enabled
568568
enabled: true
569569

570+
## Configure cron jobs in this installation.
571+
# - tkcagnt_*** - Super Agent
572+
cronJobs:
573+
## Should it manage cron jobs
574+
enabled: false
575+
570576
# ref: https://cloud.google.com/kubernetes-engine/docs/how-to/prepare-arm-workloads-for-deployment#node-affinity-multi-arch-arm
571577
# -- Tolerations to schedule a workload to nodes with any architecture type. Required for deployment to GKE cluster.
572578
tolerations: []
@@ -1042,6 +1048,8 @@ testkube-operator:
10421048
useArgoCDSync: false
10431049
# -- Purge executions on CRD deletion
10441050
purgeExecutions: false
1051+
# -- Agent cron jobs for scheduling test, suites, workflows
1052+
agentCronJobs: false
10451053

10461054
# Service Account parameters
10471055
serviceAccount:

0 commit comments

Comments
 (0)