diff --git a/deploy/helm/charts/nfspv-provisioner/Chart.yaml b/deploy/helm/charts/nfspv-provisioner/Chart.yaml new file mode 100644 index 0000000..585aee3 --- /dev/null +++ b/deploy/helm/charts/nfspv-provisioner/Chart.yaml @@ -0,0 +1,28 @@ +apiVersion: v2 +name: nfspv-provisioner +description: Helm chart for OpenEBS Dynamic NFS PV. For instructions to install OpenEBS Dynamic NFS PV using helm chart, refer to https://openebs.github.io/dynamic-nfs-provisioner. +type: application +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +version: 0.2.0 +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. +appVersion: 0.2.0 +icon: https://raw.githubusercontent.com/cncf/artwork/master/projects/openebs/icon/color/openebs-icon-color.png +home: http://www.openebs.io/ +keywords: + - storage + - nfs + - dynamic-nfspv +sources: + - https://github.com/openebs/dynamic-nfs-provisioner + +maintainers: + - name: akhilerm + email: akhil.mohan@mayadata.io + - name: kiranmova + email: kiran.mova@mayadata.io + - name: prateekpandey14 + email: prateek.pandey@mayadata.io + - name: rahulkrishnanra + email: rahulkrishnanfs@gmail.com diff --git a/deploy/helm/charts/nfspv-provisioner/README.md b/deploy/helm/charts/nfspv-provisioner/README.md new file mode 100644 index 0000000..ed9717d --- /dev/null +++ b/deploy/helm/charts/nfspv-provisioner/README.md @@ -0,0 +1,93 @@ +# OpenEBS NFSPV Provisioner + +[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) + +A Helm chart for openebs dynamic nfspv provisioner. This chart bootstraps OpenEBS Dynamic NFSPV provisioner deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + + +**Homepage:** + +## Maintainers + +| Name | Email | Url | +| ---- | ------ | --- | +| akhilerm | akhil.mohan@mayadata.io | | +| kiranmova | kiran.mova@mayadata.io | | +| prateekpandey14 | prateek.pandey@mayadata.io | | +| rahulkrishnanra | rahulkrishnanfs@gmail.com | | + + +## Get Repo Info + +```console +helm repo add openebs-nfspv https://openebs.github.io/dynamic-nfspv-provisioner +helm repo update +``` + +_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._ + +## Install Chart + +Please visit the [link](https://openebs.github.io/dynamic-nfspv-provisioner/) for install instructions via helm3. + +```console +# Helm +$ helm install [RELEASE_NAME] openebs-nfspv/nfspv-provisioner +``` + +_See [configuration](#configuration) below._ + +_See [helm install](https://helm.sh/docs/helm/helm_install/) for command documentation._ + + +## Uninstall Chart + +```console +# Helm +$ helm uninstall [RELEASE_NAME] +``` + +This removes all the Kubernetes components associated with the chart and deletes the release. + +_See [helm uninstall](https://helm.sh/docs/helm/helm_uninstall/) for command documentation._ + +## Upgrading Chart + +```console +# Helm +$ helm upgrade [RELEASE_NAME] [CHART] --install +``` + + +## Configuration + +The following table lists the configurable parameters of the OpenEBS NFSPV Provisioner chart and their default values. + +| Parameter | Description | Default | +| ------------------------------------------- | --------------------------------------------- | ----------------------------------------- | +| `analytics.enabled` | Enable sending stats to Google Analytics | `true` | +| `imagePullSecrets` | Provides image pull secret | `""` | +| `nfspv.enabled` | Enable NFSPV Provisioner | `true` | +| `nfspv.image.registry` | Registry for NFSPV Provisioner image | `""` | +| `nfspv.image.repository` | Image repository for NFSPV Provisioner | `openebs/provisioner-nfs-amd64` | +| `nfspv.image.tag` | Image tag for NFSPV Provisioner | `0.2.0` | +| `nfspv.image.pullPolicy` | Image pull policy for NFSPV Provisioner | `IfNotPresent` | +| `nfspv.annotations` | Annotations for NFSPV Provisioner metadata | `""` | +| `nfspv.nodeSelector` | Nodeselector for NFSPV Provisioner pods | `""` | +| `nfspv.tolerations` | NFSPV Provisioner pod toleration values | `""` | +| `nfspv.securityContext` | Seurity context for container | `""` | +| `nfspv.healthCheck.initialDelaySeconds` | Delay before liveness probe is initiated | `30` | +| `nfspv.healthCheck.periodSeconds` | How often to perform the liveness probe | `60` | +| `nfspv.enableLeaderElection` | Enable leader election | `true` | +| `rbac.create` | Enable RBAC Resources | `true` | +| `rbac.pspEnabled` | Create pod security policy resources | `false` | +| `nfspv.affinity` | NFSPV Provisioner pod affinity | `{}` | +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. + +Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example, + +```bash +helm install -f values.yaml ----namespace openebs nfspv-provisioner +``` + +> **Tip**: You can use the default [values.yaml](values.yaml) diff --git a/deploy/helm/charts/nfspv-provisioner/templates/NOTES.txt b/deploy/helm/charts/nfspv-provisioner/templates/NOTES.txt new file mode 100644 index 0000000..93b5984 --- /dev/null +++ b/deploy/helm/charts/nfspv-provisioner/templates/NOTES.txt @@ -0,0 +1,9 @@ +Thank you for installing {{ .Chart.Name }} 😀 + +Your release is named {{ .Release.Name }} and it's installed to namespace: {{ .Release.Namespace }}. + +The OpenEBS NFSPV Provisioner has been installed check its status by running: +$ kubectl get pods -n {{ .Release.Namespace }} + +For more information, visit our Slack at https://openebs.io/community or view +the documentation online at https://github.com/openebs/dynamic-nfs-provisioner/. diff --git a/deploy/helm/charts/nfspv-provisioner/templates/_helpers.tpl b/deploy/helm/charts/nfspv-provisioner/templates/_helpers.tpl new file mode 100644 index 0000000..dc3113c --- /dev/null +++ b/deploy/helm/charts/nfspv-provisioner/templates/_helpers.tpl @@ -0,0 +1,77 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "nfspv.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "nfspv.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "nfspv.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "nfspv.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "nfspv.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Meta labels +*/}} +{{- define "nfspv.common.metaLabels" -}} +chart: {{ include "nfspv.chart" . }} +heritage: {{ .Release.Service }} +openebs.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} + +{{/* +Selector Labels +*/}} +{{- define "nfspv.selectorLabels" -}} +app: {{ include "nfspv.name" . }} +release: {{ .Release.Name }} +component: {{ .Values.nfspv.name }} +{{- end }} + +{{/* +Component labels +*/}} +{{- define "nfspv.componentLabels" -}} +openebs.io/component-name: openebs-{{ .Values.nfspv.name }} +{{- end -}} + +{{/* +Common labels +*/}} +{{- define "nfspv.labels" -}} +{{ include "nfspv.common.metaLabels" . }} +{{ include "nfspv.selectorLabels" . }} +{{ include "nfspv.componentLabels" . }} +{{- end -}} diff --git a/deploy/helm/charts/nfspv-provisioner/templates/clusterrole.yaml b/deploy/helm/charts/nfspv-provisioner/templates/clusterrole.yaml new file mode 100644 index 0000000..2f4f5c0 --- /dev/null +++ b/deploy/helm/charts/nfspv-provisioner/templates/clusterrole.yaml @@ -0,0 +1,58 @@ +# Define Role that allows operations on K8s pods/deployments +{{- if .Values.rbac.create }} +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "nfspv.fullname" . }} + {{- with .Values.nfspv.annotations }} + annotations: {{ toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "nfspv.labels" . | nindent 4 }} +rules: + - apiGroups: ["*"] + resources: ["nodes", "nodes/proxy"] + verbs: ["*"] + - apiGroups: ["*"] + resources: ["namespaces", "services", "pods", "pods/exec", "deployments", "deployments/finalizers", "replicationcontrollers", "replicasets", "events", "endpoints", "configmaps", "secrets", "jobs", "cronjobs"] + verbs: ["*"] + - apiGroups: ["*"] + resources: ["statefulsets", "daemonsets"] + verbs: ["*"] + - apiGroups: ["*"] + resources: ["resourcequotas", "limitranges"] + verbs: ["list", "watch"] + - apiGroups: ["*"] + resources: ["ingresses", "horizontalpodautoscalers", "verticalpodautoscalers", "poddisruptionbudgets", "certificatesigningrequests"] + verbs: ["list", "watch"] + - apiGroups: ["*"] + resources: ["storageclasses", "persistentvolumeclaims", "persistentvolumes"] + verbs: ["*"] + - apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"] + verbs: [ "get", "list", "create", "update", "delete", "patch"] + - apiGroups: ["openebs.io"] + resources: [ "*"] + verbs: ["*"] + - nonResourceURLs: ["/metrics"] + verbs: ["get"] + +{{- if .Values.rbac.pspEnabled}}} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "nfspv.fullname" . }}-psp + {{- with .Values.nfspv.annotations }} + annotations: {{ toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "nfspv.labels" . | nindent 4 }} +rules: + - apiGroups: ['policy'] + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: + - {{ include "nfspv.fullname" . }}-psp +{{- end }} +{{- end }} diff --git a/deploy/helm/charts/nfspv-provisioner/templates/clusterrolebinding.yaml b/deploy/helm/charts/nfspv-provisioner/templates/clusterrolebinding.yaml new file mode 100644 index 0000000..efe00a9 --- /dev/null +++ b/deploy/helm/charts/nfspv-provisioner/templates/clusterrolebinding.yaml @@ -0,0 +1,42 @@ +# Bind the Service Account with the Role Privileges. +{{- if .Values.rbac.create }} +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "nfspv.fullname" . }} + {{- with .Values.nfspv.annotations }} + annotations: {{ toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "nfspv.labels" . | nindent 4 }} +roleRef: + kind: ClusterRole + name: {{ include "nfspv.fullname" . }} + apiGroup: rbac.authorization.k8s.io +subjects: + - kind: ServiceAccount + name: {{ include "nfspv.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} + +{{- if .Values.rbac.pspEnabled }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "nfspv.fullname" . }}-psp + {{- with .Values.nfspv.annotations }} + annotations: {{ toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "nfspv.labels" . | nindent 4 }} +roleRef: + kind: ClusterRole + name: {{ include "nfspv.fullname" . }}-psp + apiGroup: rbac.authorization.k8s.io +subjects: + # Authorize specific service accounts: + - kind: ServiceAccount + name: {{ include "nfspv.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end }} +{{- end }} diff --git a/deploy/helm/charts/nfspv-provisioner/templates/deployment.yaml b/deploy/helm/charts/nfspv-provisioner/templates/deployment.yaml new file mode 100644 index 0000000..2372ff5 --- /dev/null +++ b/deploy/helm/charts/nfspv-provisioner/templates/deployment.yaml @@ -0,0 +1,108 @@ +{{- if .Values.nfspv.enabled }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "nfspv.fullname" . }} + namespace: {{ .Release.Namespace }} + {{- if .Values.nfspv.annotations }} + annotations: {{- with .Values.nfspv.annotations }} + {{ toYaml . | nindent 4 }} + {{- end }} + {{- end }} + labels: + {{- include "nfspv.labels" . | nindent 4 }} +spec: + selector: + matchLabels: + {{- include "nfspv.selectorLabels" . | nindent 8 }} + replicas: 1 + strategy: + type: Recreate + rollingUpdate: null + template: + metadata: + labels: + {{- include "nfspv.labels" . | nindent 8 }} + {{- with .Values.nfspv.podLabels -}} + {{ toYaml . | nindent 8 }} + {{- end }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "nfspv.serviceAccountName" . }} + {{- if .Values.podSecurityContext }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + {{- end }} + containers: + - name: {{ include "nfspv.fullname" . }} + imagePullPolicy: {{ .Values.nfspv.image.pullPolicy }} + image: "{{ .Values.nfspv.image.registry }}{{ .Values.nfspv.image.repository }}:{{ default .Chart.AppVersion .Values.nfspv.image.tag }}" + {{- if .Values.nfspv.resources }} + resources: + {{- toYaml .Values.nfspv.resources | nindent 12 }} + {{ end }} + env: + # OPENEBS_IO_K8S_MASTER enables openebs provisioner to connect to K8s + # based on this address. This is ignored if empty. + # This is supported for openebs provisioner version 0.5.2 onwards + #- name: OPENEBS_IO_K8S_MASTER + # value: "http://10.128.0.12:8080" + # OPENEBS_IO_KUBE_CONFIG enables openebs provisioner to connect to K8s + # based on this config. This is ignored if empty. + # This is supported for openebs provisioner version 0.5.2 onwards + #- name: OPENEBS_IO_KUBE_CONFIG + # value: "/home/ubuntu/.kube/config" + - name: NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: OPENEBS_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + # OPENEBS_SERVICE_ACCOUNT provides the service account of this pod as + # environment variable + - name: OPENEBS_SERVICE_ACCOUNT + valueFrom: + fieldRef: + fieldPath: spec.serviceAccountName + - name: OPENEBS_IO_ENABLE_ANALYTICS + value: "{{ .Values.analytics.enabled }}" + - name: OPENEBS_IO_NFS_SERVER_USE_CLUSTERIP + value: "{{ .Values.nfsServer.useClusterIP }}" + - name: OPENEBS_IO_INSTALLER_TYPE + value: "charts-helm" + # LEADER_ELECTION_ENABLED is used to enable/disable leader election. By default + # leader election is enabled. + - name: LEADER_ELECTION_ENABLED + value: "{{ .Values.nfspv.enableLeaderElection }}" + # Process name used for matching is limited to the 15 characters + # present in the pgrep output. + # So fullname can't be used here with pgrep (>15 chars).A regular expression + # that matches the entire command name has to specified. + # Anchor `^` : matches any string that starts with `provisioner-nfs` + # `.*`: matches any string that has `provisioner-loc` followed by zero or more char + livenessProbe: + exec: + command: + - sh + - -c + - test `pgrep -c "^provisioner-nfs.*"` = 1 + initialDelaySeconds: {{ .Values.nfspv.healthCheck.initialDelaySeconds }} + periodSeconds: {{ .Values.nfspv.healthCheck.periodSeconds }} +{{- if .Values.nfspv.nodeSelector }} + nodeSelector: +{{ toYaml .Values.nfspv.nodeSelector | indent 8 }} +{{- end }} +{{- if .Values.nfspv.tolerations }} + tolerations: +{{ toYaml .Values.nfspv.tolerations | indent 8 }} +{{- end }} +{{- if .Values.nfspv.affinity }} + affinity: +{{ toYaml .Values.nfspv.affinity | indent 8 }} +{{- end }} +{{- end }} diff --git a/deploy/helm/charts/nfspv-provisioner/templates/kernel-nfs-storageclass.yaml b/deploy/helm/charts/nfspv-provisioner/templates/kernel-nfs-storageclass.yaml new file mode 100644 index 0000000..73ecd88 --- /dev/null +++ b/deploy/helm/charts/nfspv-provisioner/templates/kernel-nfs-storageclass.yaml @@ -0,0 +1,16 @@ +#Storage classes for OpenEBS NFS Dynamic PV +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + name: {{ .Values.nfsStorageClass.name }} + annotations: + openebs.io/cas-type: nfsrwx + cas.openebs.io/config: | + - name: NFSServerType + value: {{ .Values.nfsStorageClass.nfsServerType }} +{{- if .Values.nfsStorageClass.backendStorageClass }} + - name: BackendStorageClass + value: {{ .Values.nfsStorageClass.backendStorageClass }} +{{- end }} +provisioner: openebs.io/nfsrwx +reclaimPolicy: {{ .Values.nfsStorageClass.reclaimPolicy }} diff --git a/deploy/helm/charts/nfspv-provisioner/templates/psp.yaml b/deploy/helm/charts/nfspv-provisioner/templates/psp.yaml new file mode 100644 index 0000000..94661e9 --- /dev/null +++ b/deploy/helm/charts/nfspv-provisioner/templates/psp.yaml @@ -0,0 +1,31 @@ +{{- if .Values.rbac.pspEnabled }} +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ template "nfspv.fullname" . }}-psp + {{- with .Values.nfspv.annotations }} + annotations: {{ toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "nfspv.labels" . | nindent 4 }} +spec: + privileged: {{ .Values.nfspv.privileged }} + allowPrivilegeEscalation: true + allowedCapabilities: ['*'] + volumes: ['*'] + hostNetwork: true + hostPorts: + - min: 0 + max: 65535 + hostIPC: true + hostPID: true + runAsUser: + rule: 'RunAsAny' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'RunAsAny' + fsGroup: + rule: 'RunAsAny' + {{- end }} + diff --git a/deploy/helm/charts/nfspv-provisioner/templates/serviceaccount.yaml b/deploy/helm/charts/nfspv-provisioner/templates/serviceaccount.yaml new file mode 100644 index 0000000..a11c77f --- /dev/null +++ b/deploy/helm/charts/nfspv-provisioner/templates/serviceaccount.yaml @@ -0,0 +1,10 @@ +# Create Service Account for nfspv-provisioner. +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "nfspv.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "nfspv.labels" . | nindent 4 }} +{{- end }} diff --git a/deploy/helm/charts/nfspv-provisioner/values.yaml b/deploy/helm/charts/nfspv-provisioner/values.yaml new file mode 100644 index 0000000..c2cc253 --- /dev/null +++ b/deploy/helm/charts/nfspv-provisioner/values.yaml @@ -0,0 +1,73 @@ +# Default values for nfspv-provisioner. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: + +rbac: + # rbac.create: `true` if rbac resources should be created + create: true + # rbac.pspEnabled: `true` if PodSecurityPolicy resources should be created + pspEnabled: false + +podSecurityContext: {} +# fsGroup: 2000 + +imagePullSecrets: + #- name: image-pull-secret + +fullnameOverride: "" +nameOverride: "" + +nfspv: + name: nfspv-provisioner + enabled: true + annotations: {} + podLabels: + name: openebs-nfspv-provisioner + image: + # Make sure that registry name end with a '/'. + # For example : quay.io/ is a correct value here and quay.io is incorrect + registry: + repository: openebs/provisioner-nfs + tag: + pullPolicy: IfNotPresent + enableLeaderElection: "true" + resources: + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 100m + # memory: 128Mi + # limits: + # cpu: 100m + # memory: 128Mi + # If set to false, containers created by the nfspv provisioner will run without extra privileges. + privileged: true + nodeSelector: { } + tolerations: [ ] + affinity: { } + healthCheck: + initialDelaySeconds: 30 + periodSeconds: 60 + +nfsStorageClass: + name: openebs-kernel-nfs + reclaimPolicy: Delete + nfsServerType: kernel + backendStorageClass: "" + +nfsServer: + useClusterIP: "true" + +analytics: + enabled: "true"