Skip to content

Commit 4c107fc

Browse files
thallgrenthallgren
authored
Merge pull request #3805 from telepresenceio/thallgren/helm-schema
Add json-schema for the telepresence-oss Helm chart
2 parents 1b67352 + 90caca2 commit 4c107fc

27 files changed

+879
-339
lines changed

‎CHANGELOG.yml

+11
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,12 @@ items:
5454
5555
The deprecated `--replace` flag still works, but is hidden from the `telepresence intercept` command help, and
5656
will print a deprecation warning when used.
57+
- type: feature
58+
title: Add json-schema for the Telepresence Helm Chart
59+
body: |-
60+
Helm can validate a chart using a json-schema using the command `helm lint`, and this schema can be part of
61+
the actual Helm chart. The telepresence-oss Helm chart now includes such a schema, and a new
62+
`telepresence helm lint` command was added so that linting can be performed using the embedded chart.
5763
- type: feature
5864
title: No dormant container present during replace.
5965
body: |-
@@ -90,6 +96,11 @@ items:
9096
body: >-
9197
The output of the `telepresence list` command will now include the workload kind (deployment, replicaset,
9298
statefulset, or rollout) in all entries.
99+
- type: feature
100+
title: Add ability to override the default securityContext for the Telepresence init-container
101+
body: >-
102+
Users can now use the Helm value `agent.initSecurityContext` to override the default securityContext for the
103+
Telepresence init-container.
93104
- type: change
94105
title: Make the DNS recursion check configurable and turn it off by default.
95106
body: >-

‎build-aux/main.mk

+1-1
Original file line numberDiff line numberDiff line change
@@ -293,7 +293,7 @@ push-images: push-tel2-image push-client-image
293293
.PHONY: helm-chart
294294
helm-chart: $(BUILDDIR)/telepresence-oss-chart.tgz
295295

296-
$(BUILDDIR)/telepresence-oss-chart.tgz: $(wildcard charts/telepresence-oss/**/*)
296+
$(BUILDDIR)/telepresence-oss-chart.tgz: $(wildcard charts/**/*)
297297
mkdir -p $(BUILDDIR)
298298
go run packaging/helmpackage.go -o $@ -v $(TELEPRESENCE_SEMVER)
299299

‎charts/chart.go

+26-8
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77
"fmt"
88
"io"
99
"io/fs"
10+
"os"
1011
"sort"
1112
"strings"
1213

@@ -41,14 +42,19 @@ func filePriority(chartName, filename string) int {
4142
}
4243

4344
func addFile(tarWriter *tar.Writer, vfs fs.FS, filename string, content []byte) error {
45+
var header *tar.Header
4446
// Build the tar.Header.
4547
fi, err := fs.Stat(vfs, filename)
46-
if err != nil {
47-
return err
48-
}
49-
header, err := tar.FileInfoHeader(fi, "")
50-
if err != nil {
51-
return err
48+
if err == nil {
49+
header, err = tar.FileInfoHeader(fi, "")
50+
if err != nil {
51+
return err
52+
}
53+
} else {
54+
if !os.IsNotExist(err) {
55+
return err
56+
}
57+
header = &tar.Header{}
5258
}
5359
header.Name = filename
5460
header.Mode = 0o644
@@ -126,6 +132,18 @@ func WriteChart(helmChartDir DirType, out io.Writer, chartName, version string,
126132

127133
for _, filename := range filenames {
128134
switch filename {
135+
case fmt.Sprintf("%s/values.schema.yaml", chartName):
136+
content, err := fs.ReadFile(baseDir, filename)
137+
if err != nil {
138+
return err
139+
}
140+
content, err = yaml.YAMLToJSON(content)
141+
if err != nil {
142+
return err
143+
}
144+
if err = addFile(tarWriter, baseDir, fmt.Sprintf("%s/values.schema.json", chartName), content); err != nil {
145+
return err
146+
}
129147
case fmt.Sprintf("%s/Chart.yaml", chartName):
130148
content, err := fs.ReadFile(baseDir, filename)
131149
if err != nil {
@@ -141,15 +159,15 @@ func WriteChart(helmChartDir DirType, out io.Writer, chartName, version string,
141159
if err != nil {
142160
return err
143161
}
144-
if err := addFile(tarWriter, baseDir, filename, content); err != nil {
162+
if err = addFile(tarWriter, baseDir, filename, content); err != nil {
145163
return err
146164
}
147165
default:
148166
content, err := fs.ReadFile(baseDir, filename)
149167
if err != nil {
150168
return err
151169
}
152-
if err := addFile(tarWriter, baseDir, filename, content); err != nil {
170+
if err = addFile(tarWriter, baseDir, filename, content); err != nil {
153171
return err
154172
}
155173
}

‎charts/telepresence-oss/templates/_helpers.tpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -183,7 +183,7 @@ telepresence: manager
183183
Client RBAC name suffix
184184
*/}}
185185
{{- define "telepresence.clientRbacName" -}}
186-
{{ printf "%s-%s" (default (include "telepresence.name" $) .Values.rbac.nameOverride) (include "traffic-manager.namespace" $) }}
186+
{{ printf "%s-%s" (include "telepresence.name" $) (include "traffic-manager.namespace" $) }}
187187
{{- end -}}
188188

189189
{{- /*

‎charts/telepresence-oss/templates/agentInjectorWebhook.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if and (not .Values.rbac.only) .Values.agentInjector.enabled }}
1+
{{- if and (not (and .Values.rbac .Values.rbac.only)) .Values.agentInjector.enabled }}
22
{{- $namespaceSelector := mustFromJson (include "traffic-manager.namespaceSelector" $) }}
33
{{- /*
44
Perform a check that the new namespaceSelector doesn't select namespaces that are
@@ -64,11 +64,11 @@ already managed by some other traffic-manager.
6464
{{- end }}
6565
{{- end }}
6666
{{- end }}
67-
---
6867
{{- $altNames := list ( printf "agent-injector.%s" (include "traffic-manager.namespace" $)) ( printf "agent-injector.%s.svc" (include "traffic-manager.namespace" $)) -}}
6968
{{- $genCA := genCA "agent-injector-ca" 365 -}}
7069
{{- $genCert := genSignedCert "agent-injector" nil $altNames 365 $genCA -}}
7170
{{- $secretData := (lookup "v1" "Secret" (include "traffic-manager.namespace" $) .Values.agentInjector.secret.name).data -}}
71+
---
7272
apiVersion: admissionregistration.k8s.io/v1
7373
kind: MutatingWebhookConfiguration
7474
metadata:

‎charts/telepresence-oss/templates/clientRbac/connect.yaml

+4-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
{{- if .Values.clientRbac.create }}
1+
{{- with .Values.clientRbac }}
2+
{{- if .create }}
23
{{- /*
34
Client must have the following RBAC in the traffic-manager.namespace to establish
45
a port-forward to the traffic-manager pod.
@@ -32,10 +33,11 @@ metadata:
3233
labels:
3334
{{- include "telepresence.labels" $ | nindent 4 }}
3435
subjects:
35-
{{ toYaml .Values.clientRbac.subjects }}
36+
{{ toYaml .subjects }}
3637
roleRef:
3738
apiGroup: rbac.authorization.k8s.io
3839
name: traffic-manager-connect
3940
kind: Role
4041

4142
{{- end }}
43+
{{- end }}

‎charts/telepresence-oss/templates/deployment.yaml

+29-71
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{{- with .Values }}
2-
{{- if not .rbac.only }}
2+
{{- if not (and .rbac .rbac.only) }}
33
apiVersion: apps/v1
44
kind: Deployment
55
metadata:
@@ -114,87 +114,57 @@ spec:
114114
{{- /*
115115
Traffic agent configuration
116116
*/}}
117-
{{- if .agent.logLevel }}
117+
{{- with .agent }}
118+
{{- if .logLevel }}
118119
- name: AGENT_LOG_LEVEL
119-
value: {{ .agent.logLevel }}
120+
value: {{ .logLevel }}
120121
{{- end }}
121-
{{- if .agent.port }}
122+
{{- if .port }}
122123
- name: AGENT_PORT
123-
value: {{ .agent.port | quote }}
124+
value: {{ .port | quote }}
124125
{{- end }}
125-
{{- /* replaced by agent.appProtocolStrategy. Retained for backward compatibility */}}
126-
{{- if $.Values.agentInjector.appProtocolStrategy }}
127-
- name: AGENT_APP_PROTO_STRATEGY
128-
value: {{ $.Values.agentInjector.appProtocolStrategy }}
129-
{{- else }}
130-
{{- if .agent.appProtocolStrategy }}
126+
{{- if .appProtocolStrategy }}
131127
- name: AGENT_APP_PROTO_STRATEGY
132-
value: {{ .agent.appProtocolStrategy }}
128+
value: {{ .appProtocolStrategy }}
133129
{{- end }}
134-
{{- end }}
135-
{{- /* replaced by agent.resources. Retained for backward compatibility */}}
136-
{{- if $.Values.agentInjector.agentImage.resources }}
137-
- name: AGENT_RESOURCES
138-
value: '{{ toJson $.Values.agentInjector.agentImage.resources }}'
139-
{{- else }}
140-
{{- if .agent.resources }}
130+
{{- if .resources }}
141131
- name: AGENT_RESOURCES
142-
value: '{{ toJson .agent.resources }}'
143-
{{- end }}
132+
value: '{{ toJson .resources }}'
144133
{{- end }}
145-
{{- /* replaced by agent.initResoruces. Retained for backward compatibility */}}
146-
{{- if $.Values.agentInjector.agentImage.initResources }}
134+
{{- if .initResources }}
147135
- name: AGENT_INIT_RESOURCES
148-
value: '{{ toJson $.Values.agentInjector.agentImage.initResources }}'
149-
{{- else }}
150-
{{- if .agent.initResources }}
151-
- name: AGENT_INIT_RESOURCES
152-
value: '{{ toJson .agent.initResources }}'
136+
value: '{{ toJson .initResources }}'
153137
{{- end }}
154-
{{- end }}
155-
{{- /* replaced by agent.image.name Retained for backward compatibility */}}
156-
{{- if .agentInjector.agentImage.name }}
157-
- name: AGENT_IMAGE_NAME
158-
value: {{ .agentInjector.agentImage.name }}
159-
{{- else }}
160-
{{- if .agent.image.name }}
138+
{{- with .image }}
139+
{{- if .name }}
161140
- name: AGENT_IMAGE_NAME
162-
value: {{ .agent.image.name }}
141+
value: {{ .name }}
163142
{{- end }}
164-
{{- end }}
165-
{{- if .agentInjector.agentImage.tag }}
166-
- name: AGENT_IMAGE_TAG
167-
value: {{ .agentInjector.agentImage.tag }}
168-
{{- else }}
169-
{{- if .agent.image.tag }}
143+
{{- if .tag }}
170144
- name: AGENT_IMAGE_TAG
171-
value: {{ .agent.image.tag }}
172-
{{- end }}
145+
value: {{ .tag }}
173146
{{- end }}
174-
{{- /* replaced by agent.image.registry Retained for backward compatibility */}}
175-
{{- if .agentInjector.agentImage.registry }}
147+
{{- if .registry }}
176148
- name: AGENT_REGISTRY
177-
value: {{ .agentInjector.agentImage.registry }}
178-
{{- else }}
179-
{{- if .agent.image.registry }}
180-
- name: AGENT_REGISTRY
181-
value: {{ .agent.image.registry }}
182-
{{- end }}
149+
value: {{ .registry }}
183150
{{- end }}
184-
{{- with .agent.image.pullSecrets }}
151+
{{- with .pullSecrets }}
185152
- name: AGENT_IMAGE_PULL_SECRETS
186153
value: '{{ toJson . }}'
187154
{{- end }}
188155
- name: AGENT_IMAGE_PULL_POLICY
189-
value: {{ .agent.image.pullPolicy }}
190-
{{- /* to allow running with no security context, must check against nil - this allows specifying an empty dict for the value */}}
191-
{{- if not (eq .agent.securityContext nil) }}
156+
value: {{ .pullPolicy }}
157+
{{- end }}
158+
{{- /* must check against nil. An empty security context is a valid override */}}
159+
{{- if not (eq .securityContext nil) }}
192160
- name: AGENT_SECURITY_CONTEXT
193-
value: '{{ toJson .agent.securityContext }}'
161+
value: '{{ toJson .securityContext }}'
194162
{{- end }}
195-
{{- if .agent.initSecurityContext }}
163+
{{- /* must check against nil. An empty security context is a valid override */}}
164+
{{- if not (eq .initSecurityContext nil) }}
196165
- name: AGENT_INIT_SECURITY_CONTEXT
197-
value: '{{ toJson .agent.initSecurityContext }}'
166+
value: '{{ toJson .initSecurityContext }}'
167+
{{- end }}
198168
{{- end }}
199169
{{- with fromJsonArray (include "traffic-manager.namespaces" $) }}
200170
{{- /*
@@ -228,17 +198,6 @@ spec:
228198
{{- with .client }}
229199
- name: CLIENT_CONNECTION_TTL
230200
value: {{ .connectionTTL }}
231-
{{- /* replaced by client.routing. Retained for backward compatibility */}}
232-
{{- with $.Values.dnsConfig }}
233-
{{- if .alsoProxySubnets }}
234-
- name: CLIENT_ROUTING_ALSO_PROXY_SUBNETS
235-
value: "{{ join " " .alsoProxySubnets }}"
236-
{{- end }}
237-
{{- if .neverProxySubnets }}
238-
- name: CLIENT_ROUTING_NEVER_PROXY_SUBNETS
239-
value: "{{ join " " .neverProxySubnets }}"
240-
{{- end }}
241-
{{- else }}
242201
{{- with .routing }}
243202
{{- if .alsoProxySubnets }}
244203
- name: CLIENT_ROUTING_ALSO_PROXY_SUBNETS
@@ -253,7 +212,6 @@ spec:
253212
value: "{{ join " " .allowConflictingSubnets }}"
254213
{{- end }}
255214
{{- end }}
256-
{{- end }}
257215
{{- with .dns }}
258216
{{- with .excludeSuffixes }}
259217
- name: CLIENT_DNS_EXCLUDE_SUFFIXES

‎charts/telepresence-oss/templates/pre-delete-hook.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if and (not .Values.rbac.only) .Values.agentInjector.enabled }}
1+
{{- if and (not (and .Values.rbac .Values.rbac.only)) .Values.agentInjector.enabled }}
22
apiVersion: batch/v1
33
kind: Job
44
metadata:

‎charts/telepresence-oss/templates/service.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{{- with .Values }}
2-
{{- if not .rbac.only }}
2+
{{- if not (and .rbac .rbac.only) }}
33
apiVersion: v1
44
kind: Service
55
metadata:

‎charts/telepresence-oss/templates/tests/test-connection.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if not .Values.rbac.only }}
1+
{{- if not (and .Values.rbac .Values.rbac.only) }}
22
apiVersion: v1
33
kind: Pod
44
metadata:

‎charts/telepresence-oss/templates/trafficManager-configmap.yaml

+4-2
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,11 @@ data:
1010
client.yaml: |
1111
{{- toYaml .Values.client | nindent 4 }}
1212
{{- end }}
13-
{{- if .Values.intercept.environment }}
13+
{{- with .Values.intercept }}
14+
{{- if .environment }}
1415
agent-env.yaml: |
15-
{{- toYaml .Values.intercept.environment | nindent 4 }}
16+
{{- toYaml .environment | nindent 4 }}
17+
{{- end }}
1618
{{- end }}
1719
namespace-selector.yaml: |
1820
{{- toYaml (mustFromJson (include "traffic-manager.namespaceSelector" $)) | nindent 4 }}

0 commit comments

Comments
 (0)