Skip to content

Commit b6bae1a

Browse files
zhiweiyin318zhiweiyin318
committed
add helm charts
Signed-off-by: Zhiwei Yin <[email protected]>
1 parent 8b8c7ad commit b6bae1a

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+2917
-35
lines changed

‎Makefile

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@ OPERATOR_SDK?=$(PERMANENT_TMP_GOPATH)/bin/operator-sdk
2121
OPERATOR_SDK_VERSION?=v1.32.0
2222
operatorsdk_gen_dir:=$(dir $(OPERATOR_SDK))
2323

24+
HELM?=$(PERMANENT_TMP_GOPATH)/bin/helm
25+
HELM_VERSION?=v3.14.0
26+
helm_gen_dir:=$(dir $(HELM))
27+
2428
# RELEASED_CSV_VERSION is used to generate a released CSV manifests
2529
RELEASED_CSV_VERSION?=0.14.0
2630
export RELEASED_CSV_VERSION
@@ -30,12 +34,15 @@ CSV_VERSION?=9.9.9
3034
export CSV_VERSION
3135

3236
OPERATOR_SDK_ARCHOS:=linux_amd64
37+
HELM_ARCHOS:=linux-amd64
3338
ifeq ($(GOHOSTOS),darwin)
3439
ifeq ($(GOHOSTARCH),amd64)
3540
OPERATOR_SDK_ARCHOS:=darwin_amd64
41+
HELM_ARCHOS:=darwin-amd64
3642
endif
3743
ifeq ($(GOHOSTARCH),arm64)
3844
OPERATOR_SDK_ARCHOS:=darwin_arm64
45+
HELM_ARCHOS:=darwin-arm64
3946
endif
4047
endif
4148

@@ -69,7 +76,9 @@ update: copy-crd update-csv
6976

7077
test-unit: ensure-kubebuilder-tools
7178

72-
update-csv: ensure-operator-sdk
79+
update-csv: ensure-operator-sdk ensure-operator-helm
80+
bash -x hack/update-csv.sh
81+
7382
# update the replaces to released version in csv
7483
$(SED_CMD) -i 's/cluster-manager\.v[0-9]\+\.[0-9]\+\.[0-9]\+/cluster-manager\.v$(RELEASED_CSV_VERSION)/g' deploy/cluster-manager/config/manifests/bases/cluster-manager.clusterserviceversion.yaml
7584
$(SED_CMD) -i 's/klusterlet\.v[0-9]\+\.[0-9]\+\.[0-9]\+/klusterlet\.v$(RELEASED_CSV_VERSION)/g' deploy/klusterlet/config/manifests/bases/klusterlet.clusterserviceversion.yaml
@@ -116,3 +125,16 @@ ifeq "" "$(wildcard $(OPERATOR_SDK))"
116125
else
117126
$(info Using existing operator-sdk from "$(OPERATOR_SDK)")
118127
endif
128+
129+
ensure-operator-helm:
130+
ifeq "" "$(wildcard $(HELM))"
131+
$(info Installing helm into '$(HELM)')
132+
mkdir -p '$(helm_gen_dir)'
133+
curl -s -f -L https://get.helm.sh/helm-$(HELM_VERSION)-$(HELM_ARCHOS).tar.gz -o '$(helm_gen_dir)$(HELM_VERSION)-$(HELM_ARCHOS).tar.gz'
134+
tar -zvxf '$(helm_gen_dir)/$(HELM_VERSION)-$(HELM_ARCHOS).tar.gz' -C $(helm_gen_dir)
135+
mv $(helm_gen_dir)/$(HELM_ARCHOS)/helm $(HELM)
136+
rm -rf $(helm_gen_dir)/$(HELM_ARCHOS)
137+
chmod +x '$(HELM)';
138+
else
139+
$(info Using existing helm from "$(HELM)")
140+
endif

‎deploy/cluster-manager/chart/cluster-manager/Chart.yaml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: v2
2+
name: cluster-manager
3+
version: 1.0.0
4+
5+
# appVersion will be replaced with the release version after released, and is the default image tag, for example v0.14.0.
6+
appVersion: latest
7+
8+
description: |-
9+
The Cluster Manager provides the multi-cluster hub, which can manage Kubernetes-based clusters across data centers,
10+
public clouds, and private clouds. This Helm Chart supports the installation and upgrade of ClusterManager.
11+
type: application
12+
home: https://open-cluster-management.io/
13+
sources:
14+
- https://github.com/open-cluster-management-io/ocm
15+
keywords:
16+
- open-cluster-management
17+
- clusterManager

‎deploy/cluster-manager/chart/cluster-manager/README.md

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# cluster-manager
2+
3+
The cluster-manager provides the multicluster hub, which can manage Kubernetes-based clusters across data centers,
4+
public clouds, and private clouds. This operator supports the installation and upgrade of ClusterManager.
5+
6+
# Get Repo Info
7+
8+
```bash
9+
helm repo add ocm https://open-cluster-management.io/helm-charts
10+
helm repo update
11+
helm search repo ocm
12+
```
13+
14+
# Install the Chart
15+
16+
For example, install the chart into `open-cluster-management` namespace.
17+
18+
```bash
19+
$ helm install cluster-manager --version <version> ocm/cluster-manager --namespace=open-cluster-management --create-namespace
20+
```
21+
22+
# Uninstall the Chart
23+
24+
## Delete all managedClusters before uninstall the Chart.
25+
26+
```bash
27+
kubectl get managedcluster | awk '{print $1}' | xargs kubectl delete managedcluster
28+
```
29+
30+
## And then delete the clusterManager CR.
31+
32+
``` bash
33+
kubectl delete clustermanagers cluster-manager
34+
```
35+
36+
## Uninstall the Chart
37+
38+
```bash
39+
helm uninstall cluster-manager
40+
```
41+

‎deploy/cluster-manager/chart/cluster-manager/crds/0000_01_operator.open-cluster-management.io_clustermanagers.crd.yaml

Lines changed: 550 additions & 0 deletions
Large diffs are not rendered by default.

‎deploy/cluster-manager/chart/cluster-manager/templates/_helpers.tpl

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
{{/* Create secret to access docker registry */}}
2+
{{- define "imagePullSecret" }}
3+
{{- with .Values.images }}
4+
{{- if and .imageCredentials.userName .imageCredentials.password }}
5+
{{- printf "{\"auths\": {\"%s\": {\"auth\": \"%s\"}}}" .registry (printf "%s:%s" .imageCredentials.userName .imageCredentials.password | b64enc) | b64enc }}
6+
{{- else }}
7+
{{- printf "{}" | b64enc }}
8+
{{- end }}
9+
{{- end }}
10+
{{- end }}
11+
12+
13+
{{/* Create random bootstrap token secret. */}}
14+
{{- define "tokenID" }}
15+
{{- printf "ocmhub" }}
16+
{{- end }}
17+
{{- define "tokenSecret" }}
18+
{{- printf "%s" (randAlphaNum 6) }}
19+
{{- end }}
20+
21+
{{/* Define the image tag. */}}
22+
{{- define "imageTag" }}
23+
{{- if .Values.images.version }}
24+
{{- printf "%s" .Values.images.version }}
25+
{{- else }}
26+
{{- printf "%s" .Chart.AppVersion }}
27+
{{- end }}
28+
{{- end }}

‎deploy/cluster-manager/chart/cluster-manager/templates/bootstrap_cluster_role.yaml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{{- if .Values.createBootstrapToken }}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: system:open-cluster-management:bootstrap
6+
rules:
7+
- apiGroups:
8+
- ""
9+
resources:
10+
- configmaps
11+
verbs:
12+
- get
13+
- apiGroups:
14+
- certificates.k8s.io
15+
resources:
16+
- certificatesigningrequests
17+
verbs:
18+
- create
19+
- get
20+
- list
21+
- watch
22+
- apiGroups:
23+
- cluster.open-cluster-management.io
24+
resources:
25+
- managedclusters
26+
verbs:
27+
- get
28+
- create
29+
- list
30+
- watch
31+
- apiGroups:
32+
- "cluster.open-cluster-management.io"
33+
resources:
34+
- "managedclustersets/join"
35+
verbs:
36+
- "create"
37+
{{- end }}

‎deploy/cluster-manager/chart/cluster-manager/templates/bootstrap_cluster_role_binding.yaml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{{- if .Values.createBootstrapToken }}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRoleBinding
4+
metadata:
5+
name: cluster-bootstrap
6+
roleRef:
7+
apiGroup: rbac.authorization.k8s.io
8+
kind: ClusterRole
9+
name: system:open-cluster-management:bootstrap
10+
subjects:
11+
- kind: Group
12+
apiGroup: rbac.authorization.k8s.io
13+
name: system:bootstrappers:managedcluster
14+
{{- end }}

‎deploy/cluster-manager/chart/cluster-manager/templates/bootstrap_token_secret.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
{{- if .Values.createBootstrapToken }}
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
# Name MUST be of form "bootstrap-token-<token id>"
6+
name: bootstrap-token-{{ template "tokenID" .}}
7+
namespace: kube-system
8+
labels:
9+
app: cluster-manager
10+
type: bootstrap.kubernetes.io/token
11+
stringData:
12+
# Token ID and secret. Required.
13+
token-id: "{{ template "tokenID" .}}"
14+
token-secret: "{{ template "tokenSecret" .}}"
15+
# Allowed usages.
16+
usage-bootstrap-authentication: "true"
17+
18+
# Extra groups to authenticate the token as. Must start with "system:bootstrappers:"
19+
auth-extra-groups: "system:bootstrappers:managedcluster"
20+
{{- end }}

‎deploy/cluster-manager/chart/cluster-manager/templates/cluster_manager.yaml

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
apiVersion: operator.open-cluster-management.io/v1
2+
kind: ClusterManager
3+
metadata:
4+
name: cluster-manager
5+
spec:
6+
registrationImagePullSpec: {{ .Values.images.registry }}/registration:{{ template "imageTag" . }}
7+
workImagePullSpec: {{ .Values.images.registry }}/work:{{ template "imageTag" . }}
8+
placementImagePullSpec: {{ .Values.images.registry }}/placement:{{ template "imageTag" . }}
9+
addOnManagerImagePullSpec: {{ .Values.images.registry }}/addon-manager:{{ template "imageTag" . }}
10+
deployOption:
11+
mode: {{ .Values.clusterManager.mode }}
12+
{{- with .Values.clusterManager.resourceRequirement }}
13+
resourceRequirement:
14+
{{- toYaml . | nindent 4 }}
15+
{{- end }}
16+
registrationConfiguration:
17+
{{- if .Values.createBootstrapToken }}
18+
autoApproveUsers:
19+
- system:bootstrap:bootstrap-token-{{ template "tokenID" .}}
20+
- system:serviceaccount:open-cluster-management:cluster-bootstrap
21+
{{- end }}
22+
{{- with .Values.clusterManager.registrationConfiguration.featureGates }}
23+
featureGates:
24+
{{- toYaml . | nindent 6 }}
25+
{{- end }}
26+
{{- with .Values.clusterManager.workConfiguration }}
27+
workConfiguration:
28+
{{- toYaml . | nindent 4 }}
29+
{{- end }}
30+
{{if .Values.clusterManager.addOnManagerConfiguration }}
31+
addOnManagerConfiguration:
32+
{{- toYaml . | nindent 4 }}
33+
{{- end }}

‎deploy/cluster-manager/chart/cluster-manager/templates/cluster_role.yaml

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: cluster-manager
5+
rules:
6+
# Allow the registration-operator to create workload
7+
- apiGroups: [""]
8+
resources: ["configmaps", "namespaces", "serviceaccounts", "services"]
9+
verbs: ["create", "get", "list", "update", "watch", "patch", "delete", "deletecollection"]
10+
- apiGroups: [""]
11+
resources: ["pods"]
12+
verbs: ["get"]
13+
- apiGroups: [""]
14+
resources: ["secrets"]
15+
verbs: ["get", "list", "watch", "update", "patch", "delete"]
16+
resourceNames:
17+
- "signer-secret"
18+
- "registration-webhook-serving-cert"
19+
- "work-webhook-serving-cert"
20+
- "registration-controller-sa-kubeconfig"
21+
- "registration-webhook-sa-kubeconfig"
22+
- "work-webhook-sa-kubeconfig"
23+
- "placement-controller-sa-kubeconfig"
24+
- "work-controller-sa-kubeconfig"
25+
- "addon-manager-controller-sa-kubeconfig"
26+
- "external-hub-kubeconfig"
27+
- "work-driver-config"
28+
- "open-cluster-management-image-pull-credentials"
29+
- apiGroups: [""]
30+
resources: ["secrets"]
31+
verbs: ["create"]
32+
- apiGroups: ["coordination.k8s.io"]
33+
resources: ["leases"]
34+
verbs: ["create", "get", "list", "update", "watch", "patch", "delete"]
35+
- apiGroups: [""]
36+
resources: ["nodes"]
37+
verbs: ["get", "list", "watch"]
38+
- apiGroups: ["authorization.k8s.io"]
39+
resources: ["subjectaccessreviews"]
40+
verbs: ["create", "get"]
41+
- apiGroups: ["", "events.k8s.io"]
42+
resources: ["events"]
43+
verbs: ["get", "list", "watch", "create", "patch", "update", "delete", "deletecollection"]
44+
- apiGroups: ["apps"]
45+
resources: ["deployments"]
46+
verbs: ["create", "get", "list", "update", "watch", "patch", "delete"]
47+
- apiGroups: ["apps"]
48+
resources: ["replicasets"]
49+
verbs: ["get"]
50+
- apiGroups: ["rbac.authorization.k8s.io"]
51+
resources: ["clusterrolebindings", "rolebindings"]
52+
verbs: ["create", "get", "list", "update", "watch", "patch", "delete"]
53+
- apiGroups: ["rbac.authorization.k8s.io"]
54+
resources: ["clusterroles", "roles"]
55+
verbs: ["create", "get", "list", "update", "watch", "patch", "delete"]
56+
# Allow the registration-operator to create crds
57+
- apiGroups: ["apiextensions.k8s.io"]
58+
resources: ["customresourcedefinitions"]
59+
verbs: ["create", "get", "list", "update", "watch", "patch", "delete"]
60+
# Allow the registration-operator to update crds status
61+
- apiGroups: ["apiextensions.k8s.io"]
62+
resources: ["customresourcedefinitions/status"]
63+
verbs: ["update", "patch"]
64+
# Allow the registration-operator to create apiservice
65+
- apiGroups: ["apiregistration.k8s.io"]
66+
resources: ["apiservices"]
67+
verbs: ["create", "get", "list", "update", "watch", "patch", "delete"]
68+
# Allow the registration-operator to create validatingwebhookconfigurration
69+
- apiGroups: ["admissionregistration.k8s.io"]
70+
resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"]
71+
verbs: ["create", "get", "list", "update", "watch", "patch", "delete"]
72+
# Allow the nuclues to manage clustermanager apis.
73+
- apiGroups: ["operator.open-cluster-management.io"]
74+
resources: ["clustermanagers"]
75+
verbs: ["get", "list", "watch", "update", "delete", "patch"]
76+
- apiGroups: ["operator.open-cluster-management.io"]
77+
resources: ["clustermanagers/status"]
78+
verbs: ["update", "patch"]
79+
# Allow the registration-operator to create storageversionmigration
80+
- apiGroups: ["migration.k8s.io"]
81+
resources: ["storageversionmigrations"]
82+
verbs: ["create", "get", "list", "update", "watch", "patch", "delete"]
83+
# Some rbac needed in cluster-manager
84+
- apiGroups: ["addon.open-cluster-management.io"]
85+
resources: ["managedclusteraddons", "clustermanagementaddons"]
86+
verbs: ["create", "update", "patch", "get", "list", "watch", "delete"]
87+
- apiGroups: ["addon.open-cluster-management.io"]
88+
resources: ["managedclusteraddons/status", "clustermanagementaddons/status"]
89+
verbs: ["patch", "update"]
90+
- apiGroups: ["addon.open-cluster-management.io"]
91+
resources: [managedclusteraddons/finalizers, "clustermanagementaddons/finalizers"]
92+
verbs: ["update"]
93+
- apiGroups: ["addon.open-cluster-management.io"]
94+
resources: [addondeploymentconfigs, "addontemplates"]
95+
verbs: ["get", "list", "watch"]
96+
- apiGroups: ["authentication.k8s.io"]
97+
resources: ["tokenreviews"]
98+
verbs: ["create"]
99+
- apiGroups: ["certificates.k8s.io"]
100+
resources: ["certificatesigningrequests"]
101+
verbs: ["create", "get", "list", "watch"]
102+
- apiGroups: ["certificates.k8s.io"]
103+
resources: ["certificatesigningrequests/approval", "certificatesigningrequests/status"]
104+
verbs: ["update"]
105+
- apiGroups: ["certificates.k8s.io"]
106+
resources: ["signers"]
107+
verbs: ["approve", "sign"]
108+
- apiGroups: ["cluster.open-cluster-management.io"]
109+
resources: ["managedclusters"]
110+
verbs: ["get", "list", "watch", "update", "patch"]
111+
- apiGroups: ["cluster.open-cluster-management.io"]
112+
resources: ["managedclustersetbindings", "placements", "addonplacementscores"]
113+
verbs: ["get", "list", "watch"]
114+
- apiGroups: ["cluster.open-cluster-management.io"]
115+
resources: ["managedclustersets","placementdecisions"]
116+
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
117+
- apiGroups: ["cluster.open-cluster-management.io"]
118+
resources: ["managedclusters/status","managedclustersetbindings/status", "managedclustersets/status", "placements/status", "placementdecisions/status"]
119+
verbs: ["update", "patch"]
120+
- apiGroups: ["cluster.open-cluster-management.io"]
121+
resources: ["placements/finalizers"]
122+
verbs: ["update"]
123+
- apiGroups: ["register.open-cluster-management.io"]
124+
resources: ["managedclusters/clientcertificates"]
125+
verbs: ["renew"]
126+
- apiGroups: ["register.open-cluster-management.io"]
127+
resources: ["managedclusters/accept"]
128+
verbs: ["update"]
129+
- apiGroups: ["work.open-cluster-management.io"]
130+
resources: ["manifestworkreplicasets"]
131+
verbs: ["get", "list", "watch", "create", "update", "delete", "deletecollection", "patch"]
132+
- apiGroups: ["work.open-cluster-management.io"]
133+
resources: ["manifestworkreplicasets/finalizers"]
134+
verbs: ["update"]
135+
- apiGroups: ["work.open-cluster-management.io"]
136+
resources: ["manifestworks"]
137+
verbs: ["get", "list", "watch", "create", "update", "delete", "deletecollection", "patch", "execute-as"]
138+
- apiGroups: ["work.open-cluster-management.io"]
139+
resources: ["manifestworks/status", "manifestworkreplicasets/status"]
140+
verbs: ["update", "patch"]
141+
- apiGroups: ["flowcontrol.apiserver.k8s.io"]
142+
resources: ["flowschemas", "prioritylevelconfigurations"]
143+
verbs: ["get", "list", "watch"]
144+
- apiGroups: ["config.openshift.io"]
145+
resources: ["infrastructures"]
146+
verbs: ["get"]

0 commit comments

Comments
 (0)