Skip to content

Commit b209058

Browse files
butler54butler54
committed
feat: add custom init chart
Signed-off-by: Chris Butler <chris.butler@redhat.com>
1 parent cbe71db commit b209058

10 files changed

Lines changed: 197 additions & 4 deletions

File tree

‎charts/coco-supported/custom-init/Chart.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: v2
2+
description: A Helm chart which uses ACM to deploy a pod with custom init data including inferring the certificate.
3+
keywords:
4+
- pattern
5+
- upstream
6+
- sandbox
7+
name: custom-init
8+
version: 0.0.1

‎charts/coco-supported/custom-init/initdata.toml.tpl‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
algorithm = "sha384"
2+
version = "0.1.0"
3+
4+
[data]
5+
"aa.toml" = '''
6+
[token_configs]
7+
[token_configs.coco_as]
8+
url = 'https://kbs-trustee-operator-system.{{ .Values.global.hubClusterDomain }}'
9+
10+
11+
[token_configs.kbs]
12+
url = 'https://kbs-trustee-operator-system.{{ .Values.global.hubClusterDomain }}'
13+
cert = """
14+
acmmagickey_trustee_cert
15+
"""
16+
'''
17+
18+
"cdh.toml" = '''
19+
socket = 'unix:///run/confidential-containers/cdh.sock'
20+
credentials = []
21+
22+
[kbc]
23+
name = 'cc_kbc'
24+
url = 'https://kbs-trustee-operator-system.{{ .Values.global.hubClusterDomain }}'
25+
kbs_cert = """
26+
acmmagickey_trustee_cert
27+
"""
28+
'''
29+
30+
"policy.rego" = '''
31+
package agent_policy
32+
33+
default AddARPNeighborsRequest := true
34+
default AddSwapRequest := true
35+
default CloseStdinRequest := true
36+
default CopyFileRequest := true
37+
default CreateContainerRequest := true
38+
default CreateSandboxRequest := true
39+
default DestroySandboxRequest := true
40+
default ExecProcessRequest := true
41+
default GetMetricsRequest := true
42+
default GetOOMEventRequest := true
43+
default GuestDetailsRequest := true
44+
default ListInterfacesRequest := true
45+
default ListRoutesRequest := true
46+
default MemHotplugByProbeRequest := true
47+
default OnlineCPUMemRequest := true
48+
default PauseContainerRequest := true
49+
default PullImageRequest := true
50+
default ReadStreamRequest := true
51+
default RemoveContainerRequest := true
52+
default RemoveStaleVirtiofsShareMountsRequest := true
53+
default ReseedRandomDevRequest := true
54+
default ResumeContainerRequest := true
55+
default SetGuestDateTimeRequest := true
56+
default SetPolicyRequest := true
57+
default SignalProcessRequest := true
58+
default StartContainerRequest := true
59+
default StartTracingRequest := true
60+
default StatsContainerRequest := true
61+
default StopTracingRequest := true
62+
default TtyWinResizeRequest := true
63+
default UpdateContainerRequest := true
64+
default UpdateEphemeralMountsRequest := true
65+
default UpdateInterfaceRequest := true
66+
default UpdateRoutesRequest := true
67+
default WaitProcessRequest := true
68+
default WriteStreamRequest := true
69+
'''

‎charts/coco-supported/custom-init/templates/custom-initdata-injection.yaml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
---
2+
apiVersion: policy.open-cluster-management.io/v1
3+
kind: Policy
4+
metadata:
5+
name: custominit-pod-policy
6+
spec:
7+
remediationAction: enforce
8+
disabled: false
9+
policy-templates:
10+
- objectDefinition:
11+
apiVersion: policy.open-cluster-management.io/v1
12+
kind: ConfigurationPolicy
13+
metadata:
14+
name: custominit-pod-cp
15+
spec:
16+
remediationAction: enforce
17+
severity: medium
18+
object-templates:
19+
20+
- complianceType: mustonlyhave
21+
objectDefinition:
22+
apiVersion: v1
23+
kind: Pod
24+
metadata:
25+
name: custom
26+
namespace: custom-init
27+
annotations:
28+
io.katacontainers.config.runtime.cc_init_data: '{{ `{{if (lookup "operator.openshift.io/v1" "IngressController" "openshift-ingress-operator" "default").spec.defaultCertificate.name }}{{ fromConfigMap "openshift-sandboxed-containers-operator" "initdata-placeholder" "initdata" | base64dec | replace "acmmagickey_trustee_cert" (fromSecret "openshift-ingress" (lookup "operator.openshift.io/v1" "IngressController" "openshift-ingress-operator" "default").spec.defaultCertificate.name "tls.crt" | base64dec) | base64enc }}{{ else }}{{ fromConfigMap "openshift-sandboxed-containers-operator" "initdata-placeholder" "initdata" | base64dec | replace "acmmagickey_trustee_cert" (fromSecret "openshift-ingress" "router-certs-default" "tls.crt" | base64dec) | base64enc }}{{ end }}` }}'
29+
peerpods: "true"
30+
spec:
31+
runtimeClassName: kata-remote
32+
containers:
33+
- name: hello-openshift
34+
image: quay.io/openshift/origin-hello-openshift
35+
ports:
36+
- containerPort: 8888
37+
securityContext:
38+
privileged: false
39+
allowPrivilegeEscalation: false
40+
runAsNonRoot: true
41+
runAsUser: 1001
42+
capabilities:
43+
drop:
44+
- ALL
45+
seccompProfile:
46+
type: RuntimeDefault
47+
48+
49+
---
50+
apiVersion: policy.open-cluster-management.io/v1
51+
kind: PlacementBinding
52+
metadata:
53+
name: custominit-placement-binding
54+
annotations:
55+
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
56+
placementRef:
57+
name: custominit-placement-rule
58+
kind: PlacementRule
59+
apiGroup: apps.open-cluster-management.io
60+
subjects:
61+
- name: custominit-pod-policy
62+
kind: Policy
63+
apiGroup: policy.open-cluster-management.io
64+
---
65+
apiVersion: apps.open-cluster-management.io/v1
66+
kind: PlacementRule
67+
metadata:
68+
name: custominit-placement-rule
69+
spec:
70+
clusterConditions:
71+
- status: 'True'
72+
type: ManagedClusterConditionAvailable
73+
clusterSelector:
74+
matchLabels:
75+
cloud: Azure
76+
---
77+
{{- end }}

‎charts/coco-supported/custom-init/templates/custom-route.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: route.openshift.io/v1
2+
kind: Route
3+
metadata:
4+
name: custom
5+
namespace: custom-init
6+
spec:
7+
port:
8+
targetPort: 8888
9+
to:
10+
kind: Service
11+
name: custom
12+
weight: 100
13+
wildcardPolicy: None

‎charts/coco-supported/custom-init/templates/custom-svc.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: custom
5+
namespace: custom-init
6+
spec:
7+
ports:
8+
- name: 8888-tcp
9+
port: 8888
10+
protocol: TCP
11+
targetPort: 8888
12+
selector:
13+
app: custom
14+
sessionAffinity: None
15+
type: ClusterIP

‎charts/coco-supported/custom-init/values.yaml‎

Whitespace-only changes.

‎charts/coco-supported/hello-openshift/templates/secure-route.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,4 @@ spec:
99
kind: Service
1010
name: secure
1111
weight: 100
12-
wildcardPolicy: None
12+
wildcardPolicy: None

‎charts/coco-supported/sandbox/templates/peer-pods-cm.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,12 @@ spec:
2828
data:
2929
CLOUD_PROVIDER: "azure"
3030
VXLAN_PORT: "9000"
31+
# IF
32+
{{- if .Values.sandbox.peerPodImage }}
33+
AZURE_IMAGE_ID: {{ .Values.sandbox.peerPodImage }}
34+
{{- else }}
3135
AZURE_IMAGE_ID: '{{ `{{if (lookup "v1" "ConfigMap" "openshift-sandboxed-containers-operator" "peer-pods-cm").metadata.name }}{{ fromConfigMap "openshift-sandboxed-containers-operator" "peer-pods-cm" "AZURE_IMAGE_ID" }}{{ else }}{{ end }}` }}'
36+
{{- end }}
3237
AZURE_INSTANCE_SIZE: "{{ .Values.global.coco.azure.defaultVMFlavour }}"
3338
AZURE_INSTANCE_SIZES: "Standard_DC2as_v5,Standard_DC4as_v5,Standard_DC8as_v5,Standard_DC16as_v5"
3439
AZURE_RESOURCE_GROUP: '{{ `{{ (fromJson (fromConfigMap "openshift-cloud-controller-manager" "cloud-conf" "cloud.conf" | toLiteral)).vnetResourceGroup }}` }}'

‎charts/coco-supported/sandbox/values.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,13 @@ secretStore:
1111
name: vault-backend
1212
kind: ClusterSecretStore
1313

14-
15-
1614
sandbox:
1715
deploy: true
1816
sshKey: secret/data/global/sshKey
1917
azure: true
20-
peerpodsCreds: secret/data/global/azure
18+
# Peer pod image defined, if required to avoid rebuilds.
19+
#peerPodImage: ""
20+
peerPodImage: '/CommunityGalleries/cococommunity-42d8482d-92cd-415b-b332-7648bd978eff/Images/peerpod-podvm-fedora-debug/Versions/0.12.0'
2121
# These variables today limit to one cluster
2222
# revise using imperative framework to infer from cluster vars
2323
# Strongly advised to override in values-global.yaml or values-{cluster-group}.yaml

‎values-simple.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ clusterGroup:
1414
- cert-manager
1515
- kbs-access
1616
- encrypted-storage
17+
- custom-init
1718
subscriptions:
1819
# ACM is kept anticipating
1920
acm:
@@ -94,6 +95,11 @@ clusterGroup:
9495
namespace: kbs-access
9596
project: workloads
9697
path: charts/coco-supported/kbs-access
98+
custom-init:
99+
name: custom-init
100+
namespace: custom-init
101+
project: workloads
102+
path: charts/coco-supported/custom-init
97103

98104
imperative:
99105
# NOTE: We *must* use lists and not hashes. As hashes lose ordering once parsed by helm

0 commit comments

Comments
 (0)