Skip to content

Commit a073e2f

Browse files
andrii-codefreshandrii-codefresh
authored
feat: limits enforcement in runtime installation (#495)
1 parent 425a2d9 commit a073e2f

File tree

7 files changed

+170
-15
lines changed

7 files changed

+170
-15
lines changed

‎charts/gitops-runtime/templates/hooks/pre-install/helm-values-cm.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{- if not (and .Values.installer.skipValidation .Values.installer.skipUsageValidation) }}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: helm-values-config
6+
annotations:
7+
helm.sh/hook: pre-install,pre-upgrade
8+
helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation,hook-failed
9+
helm.sh/hook-weight: "-10"
10+
data:
11+
values.yaml: |
12+
{{ .Values | toYaml | indent 4 }}
13+
{{- end }}

‎charts/gitops-runtime/templates/hooks/pre-install/rbac.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,3 +41,48 @@ metadata:
4141
helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation,hook-failed
4242
helm.sh/hook-weight: "-10"
4343
{{- end }}
44+
45+
{{- if not .Values.installer.skipUsageValidation }}
46+
---
47+
apiVersion: rbac.authorization.k8s.io/v1
48+
kind: ClusterRole
49+
metadata:
50+
name: validate-usage-cr
51+
annotations:
52+
helm.sh/hook: pre-install
53+
helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation,hook-failed
54+
helm.sh/hook-weight: "5"
55+
rules:
56+
- apiGroups:
57+
- ""
58+
resources:
59+
- secrets
60+
verbs:
61+
- get
62+
---
63+
apiVersion: rbac.authorization.k8s.io/v1
64+
kind: ClusterRoleBinding
65+
metadata:
66+
name: validate-usage-crb
67+
annotations:
68+
helm.sh/hook: pre-install
69+
helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation,hook-failed
70+
helm.sh/hook-weight: "5"
71+
roleRef:
72+
apiGroup: rbac.authorization.k8s.io
73+
kind: ClusterRole
74+
name: validate-usage-cr
75+
subjects:
76+
- kind: ServiceAccount
77+
name: validate-usage-sa
78+
namespace: {{ .Release.Namespace }}
79+
---
80+
apiVersion: v1
81+
kind: ServiceAccount
82+
metadata:
83+
name: validate-usage-sa
84+
annotations:
85+
helm.sh/hook: pre-install
86+
helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation,hook-failed
87+
helm.sh/hook-weight: "5"
88+
{{- end }}

‎charts/gitops-runtime/templates/hooks/pre-install/validate-usage.yaml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
{{- if not .Values.installer.skipUsageValidation }}
2+
apiVersion: batch/v1
3+
kind: Job
4+
metadata:
5+
name: validate-usage
6+
annotations:
7+
helm.sh/hook: pre-install
8+
helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation
9+
helm.sh/hook-weight: "10"
10+
spec:
11+
backoffLimit: 0
12+
ttlSecondsAfterFinished: 300
13+
template:
14+
spec:
15+
serviceAccountName: validate-usage-sa
16+
restartPolicy: Never
17+
containers:
18+
- name: validate-usage
19+
image: "{{ .Values.installer.image.repository }}:{{ .Values.installer.image.tag | default .Chart.Version }}"
20+
imagePullPolicy: {{ .Values.installer.image.pullPolicy }}
21+
env:
22+
- name: NAMESPACE
23+
valueFrom:
24+
fieldRef:
25+
fieldPath: metadata.namespace
26+
command: ["sh", "-c"]
27+
args:
28+
- |
29+
cf account validate-usage --fail-condition=reached --subject=clusters --values /job_tmp/values.yaml --namespace ${NAMESPACE} --hook --log-level debug
30+
volumeMounts:
31+
- name: validate-usage-volume
32+
mountPath: "/job_tmp"
33+
volumes:
34+
- name: validate-usage-volume
35+
configMap:
36+
name: helm-values-config
37+
{{- with .Values.installer.nodeSelector | default .Values.global.nodeSelector }}
38+
nodeSelector: {{ toYaml . | nindent 8 }}
39+
{{- end }}
40+
{{- with .Values.installer.tolerations | default .Values.global.tolerations}}
41+
tolerations: {{ toYaml . | nindent 6 }}
42+
{{- end }}
43+
{{- with .Values.installer.affinity }}
44+
affinity: {{ toYaml . | nindent 8 }}
45+
{{- end }}
46+
{{- end }}

‎charts/gitops-runtime/templates/hooks/pre-install/validate-values.yaml‎

Lines changed: 1 addition & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,4 @@
11
{{- if not .Values.installer.skipValidation }}
2-
apiVersion: v1
3-
kind: ConfigMap
4-
metadata:
5-
name: validate-values-config
6-
annotations:
7-
helm.sh/hook: pre-install,pre-upgrade
8-
helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation,hook-failed
9-
helm.sh/hook-weight: "-10"
10-
data:
11-
values.yaml: |
12-
{{ .Values | toYaml | indent 4 }}
13-
14-
---
152
apiVersion: batch/v1
163
kind: Job
174
metadata:
@@ -174,7 +161,7 @@ spec:
174161
volumes:
175162
- name: customized-values
176163
configMap:
177-
name: validate-values-config
164+
name: helm-values-config
178165
{{- with .Values.installer.nodeSelector | default .Values.global.nodeSelector }}
179166
nodeSelector: {{ toYaml . | nindent 8 }}
180167
{{- end }}

‎charts/gitops-runtime/tests/global_constraints_test.yaml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -436,6 +436,68 @@ tests:
436436
value: another-value
437437
effect: NoSchedule
438438

439+
- it: validate-usage job should have nodeSelector from .Values.global
440+
values:
441+
- ./values/global-constraints-values.yaml
442+
template: hooks/pre-install/validate-usage.yaml
443+
documentSelector:
444+
path: kind
445+
value: Job
446+
asserts:
447+
- equal:
448+
path: spec.template.spec.nodeSelector
449+
value:
450+
some-key: some-value
451+
extra-key: extra-value
452+
453+
- it: validate-usage job should have nodeSelector from .Values.installer and NOT from .Values.global
454+
values:
455+
- ./values/global-constraints-values.yaml
456+
- ./values/subcharts-constraints-values.yaml
457+
template: hooks/pre-install/validate-usage.yaml
458+
documentSelector:
459+
path: kind
460+
value: Job
461+
asserts:
462+
- equal:
463+
path: spec.template.spec.nodeSelector
464+
value:
465+
some-key: another-value
466+
foo: bar
467+
468+
- it: validate-usage job should have tolerations from .Values.global
469+
values:
470+
- ./values/global-constraints-values.yaml
471+
template: hooks/pre-install/validate-usage.yaml
472+
documentSelector:
473+
path: kind
474+
value: Job
475+
asserts:
476+
- equal:
477+
path: spec.template.spec.tolerations
478+
value:
479+
- key: some-key
480+
operator: Equal
481+
value: some-value
482+
effect: NoSchedule
483+
484+
- it: validate-usage job should have tolerations from .Values.installer and NOT from .Values.global
485+
values:
486+
- ./values/global-constraints-values.yaml
487+
- ./values/subcharts-constraints-values.yaml
488+
template: hooks/pre-install/validate-usage.yaml
489+
documentSelector:
490+
path: kind
491+
value: Job
492+
asserts:
493+
- equal:
494+
path: spec.template.spec.tolerations
495+
value:
496+
- key: another-key
497+
operator: Equal
498+
value: another-value
499+
effect: NoSchedule
500+
439501

440502
- it: cleanup-resources job should have nodeSelector from .Values.global
441503
values:

‎charts/gitops-runtime/values.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,8 @@ global:
186186
installer:
187187
# -- if set to true, pre-install hook will *not* run
188188
skipValidation: false
189+
# -- if set to true, pre-install hook will *not* run
190+
skipUsageValidation: false
189191
image:
190192
repository: quay.io/codefresh/gitops-runtime-installer
191193
tag: ""

‎installer-image/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ FROM debian:12.10-slim
88

99
RUN echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections
1010

11-
ARG CF_CLI_VERSION=v0.2.6
11+
ARG CF_CLI_VERSION=v0.2.8
1212
ARG TARGETARCH
1313

1414
RUN apt-get update && apt-get install curl jq -y

0 commit comments

Comments
 (0)