Skip to content

Commit 7677273

Browse files
TechassiTechassi
committed
refactor: Adjust values.yaml file to be closer to listener-operator
1 parent ace085e commit 7677273

File tree

5 files changed

+122
-99
lines changed

5 files changed

+122
-99
lines changed

‎Tiltfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ helm_crds, helm_non_crds = filter_yaml(
3535
name=operator_name,
3636
namespace="stackable-operators",
3737
set=[
38-
'secretOperator.image.repository=' + registry + '/' + operator_name,
38+
'image.repository=' + registry + '/' + operator_name,
3939
],
4040
),
4141
api_version = "^apiextensions\\.k8s\\.io/.*$",

‎deploy/helm/secret-operator/templates/controller-deployment.yaml‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
apiVersion: apps/v1
33
kind: Deployment
44
metadata:
5-
name: {{ include "operator.fullname" . }}-controller
5+
name: {{ include "operator.fullname" . }}
66
labels:
77
{{- include "operator.labels" . | nindent 4 }}
88
spec:
@@ -12,29 +12,29 @@ spec:
1212
template:
1313
metadata:
1414
annotations:
15-
internal.stackable.tech/image: "{{ .Values.secretOperator.image.repository }}:{{ .Values.secretOperator.image.tag | default .Chart.AppVersion }}"
16-
{{- with .Values.podAnnotations }}
15+
internal.stackable.tech/image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
16+
{{- with .Values.controllerService.podAnnotations }}
1717
{{- toYaml . | nindent 8 }}
1818
{{- end }}
1919
labels:
2020
{{- include "operator.selectorLabels" . | nindent 8 }}
2121
spec:
22-
{{- with .Values.imagePullSecrets }}
22+
{{- with .Values.image.pullSecrets }}
2323
imagePullSecrets:
2424
{{- toYaml . | nindent 8 }}
2525
{{- end }}
2626
# NOTE (@Techassi): Does it maybe make sense to have two different service accounts?
2727
serviceAccountName: {{ include "operator.fullname" . }}-serviceaccount
2828
securityContext:
29-
{{- toYaml .Values.podSecurityContext | nindent 8 }}
29+
{{- toYaml .Values.controllerService.podSecurityContext | nindent 8 }}
3030
containers:
31-
- name: {{ include "operator.appname" . }}-controller
31+
- name: {{ include "operator.appname" . }}
3232
securityContext:
33-
{{- toYaml .Values.secretOperator.securityContext | nindent 12 }}
34-
image: "{{ .Values.secretOperator.image.repository }}:{{ .Values.secretOperator.image.tag | default .Chart.AppVersion }}"
35-
imagePullPolicy: {{ .Values.secretOperator.image.pullPolicy }}
33+
{{- toYaml .Values.controllerService.securityContext | nindent 12 }}
34+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
35+
imagePullPolicy: {{ .Values.image.pullPolicy }}
3636
resources:
37-
{{ .Values.secretOperator.resources | toYaml | nindent 12 }}
37+
{{ .Values.controllerService.resources | toYaml | nindent 12 }}
3838
# The arguments passed to the command being run in the container. The final command will
3939
# look like `secret-operator run controller [OPTIONS]`. The controller needs to only run
4040
# once in a Kubernetes cluster and as such is deployed as a Deployment with a single
@@ -80,18 +80,18 @@ spec:
8080
value: {{ .Values.kubernetesClusterDomain | quote }}
8181
{{- end }}
8282
{{- include "telemetry.envVars" . | nindent 12 }}
83-
{{- with .Values.nodeSelector }}
83+
{{- with .Values.controllerService.nodeSelector }}
8484
nodeSelector:
8585
{{- toYaml . | nindent 8 }}
8686
{{- end }}
87-
{{- with .Values.affinity }}
87+
{{- with .Values.controllerService.affinity }}
8888
affinity:
8989
{{- toYaml . | nindent 8 }}
9090
{{- end }}
91-
{{- with .Values.tolerations }}
91+
{{- with .Values.controllerService.tolerations }}
9292
tolerations:
9393
{{- toYaml . | nindent 8 }}
9494
{{- end }}
95-
{{- with .Values.priorityClassName }}
95+
{{- with .Values.controllerService.priorityClassName }}
9696
priorityClassName: {{ . }}
9797
{{- end }}

‎deploy/helm/secret-operator/templates/csi-server-daemonset.yaml‎ renamed to ‎deploy/helm/secret-operator/templates/csi-node-driver-daemonset.yaml‎

Lines changed: 29 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
apiVersion: apps/v1
33
kind: DaemonSet
44
metadata:
5-
name: {{ include "operator.fullname" . }}-csi-server
5+
name: {{ include "operator.fullname" . }}-csi-node-driver
66
labels:
77
{{- include "operator.labels" . | nindent 4 }}
88
spec:
@@ -12,8 +12,8 @@ spec:
1212
template:
1313
metadata:
1414
annotations:
15-
internal.stackable.tech/image: "{{ .Values.secretOperator.image.repository }}:{{ .Values.secretOperator.image.tag | default .Chart.AppVersion }}"
16-
{{- with .Values.podAnnotations }}
15+
internal.stackable.tech/image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
16+
{{- with .Values.csiNodeDriver.podAnnotations }}
1717
{{- toYaml . | nindent 8 }}
1818
{{- end }}
1919
labels:
@@ -26,21 +26,21 @@ spec:
2626
# NOTE (@Techassi): Does it maybe make sense to have two different service accounts?
2727
serviceAccountName: {{ include "operator.fullname" . }}-serviceaccount
2828
securityContext:
29-
{{- toYaml .Values.podSecurityContext | nindent 8 }}
29+
{{- toYaml .Values.csiNodeDriver.podSecurityContext | nindent 8 }}
3030
containers:
31-
- name: {{ include "operator.appname" . }}-csi-server
31+
- name: csi-node-service
3232
securityContext:
33-
{{- toYaml .Values.secretOperator.securityContext | nindent 12 }}
34-
image: "{{ .Values.secretOperator.image.repository }}:{{ .Values.secretOperator.image.tag | default .Chart.AppVersion }}"
35-
imagePullPolicy: {{ .Values.secretOperator.image.pullPolicy }}
33+
{{- toYaml .Values.csiNodeDriver.nodeService.securityContext | nindent 12 }}
34+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
35+
imagePullPolicy: {{ .Values.image.pullPolicy }}
3636
resources:
37-
{{ .Values.secretOperator.resources | toYaml | nindent 12 }}
37+
{{ .Values.csiNodeDriver.nodeService.resources | toYaml | nindent 12 }}
3838
# The arguments passed to the command being run in the container. The final command will
3939
# look like `secret-operator run csi-server [OPTIONS]`. The CSI server needs to run on
4040
# every Kubernetes cluster node and as such is deployed as a DaemonSet.
4141
args:
4242
- run
43-
- csi-server
43+
- csi-node-service
4444
env:
4545
# The following env vars are passed as clap (think CLI) arguments to the operator.
4646
# They are picked up by clap using the structs defied in the operator.
@@ -50,7 +50,7 @@ spec:
5050
- name: CSI_ENDPOINT
5151
value: /csi/csi.sock
5252
- name: PRIVILEGED
53-
value: {{ .Values.secretOperator.securityContext.privileged | quote }}
53+
value: {{ .Values.csiNodeDriver.nodeService.securityContext.privileged | quote }}
5454

5555
# Sometimes products need to know the operator image, e.g. the opa-bundle-builder OPA
5656
# sidecar uses the operator image.
@@ -88,32 +88,34 @@ spec:
8888
- name: csi
8989
mountPath: /csi
9090
- name: mountpoint
91-
mountPath: {{ .Values.kubeletDir }}/pods
92-
{{- if .Values.secretOperator.securityContext.privileged }}
91+
mountPath: {{ .Values.csiNodeDriver.kubeletDir }}/pods
92+
{{- if .Values.csiNodeDriver.nodeService.securityContext.privileged }}
9393
mountPropagation: Bidirectional
9494
{{- end }}
9595
- name: tmp
9696
mountPath: /tmp
97+
9798
- name: external-provisioner
98-
image: "{{ .Values.externalProvisioner.image.repository }}:{{ .Values.externalProvisioner.image.tag }}"
99-
imagePullPolicy: {{ .Values.externalProvisioner.image.pullPolicy }}
99+
image: "{{ .Values.csiNodeDriver.externalProvisioner.image.repository }}:{{ .Values.csiNodeDriver.externalProvisioner.image.tag }}"
100+
imagePullPolicy: {{ .Values.csiNodeDriver.externalProvisioner.image.pullPolicy }}
100101
resources:
101-
{{ .Values.externalProvisioner.resources | toYaml | nindent 12 }}
102+
{{ .Values.csiNodeDriver.externalProvisioner.resources | toYaml | nindent 12 }}
102103
args:
103104
- --csi-address=/csi/csi.sock
104105
- --feature-gates=Topology=true
105106
- --extra-create-metadata
106107
volumeMounts:
107108
- name: csi
108109
mountPath: /csi
110+
109111
- name: node-driver-registrar
110-
image: "{{ .Values.nodeDriverRegistrar.image.repository }}:{{ .Values.nodeDriverRegistrar.image.tag }}"
111-
imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }}
112+
image: "{{ .Values.csiNodeDriver.nodeDriverRegistrar.image.repository }}:{{ .Values.csiNodeDriver.nodeDriverRegistrar.image.tag }}"
113+
imagePullPolicy: {{ .Values.csiNodeDriver.nodeDriverRegistrar.image.pullPolicy }}
112114
resources:
113-
{{ .Values.nodeDriverRegistrar.resources | toYaml | nindent 12 }}
115+
{{ .Values.csiNodeDriver.nodeDriverRegistrar.resources | toYaml | nindent 12 }}
114116
args:
115117
- --csi-address=/csi/csi.sock
116-
- --kubelet-registration-path={{ .Values.kubeletDir }}/plugins/secrets.stackable.tech/csi.sock
118+
- --kubelet-registration-path={{ .Values.csiNodeDriver.kubeletDir }}/plugins/secrets.stackable.tech/csi.sock
117119
volumeMounts:
118120
- name: registration-sock
119121
mountPath: /registration
@@ -124,27 +126,27 @@ spec:
124126
hostPath:
125127
# node-driver-registrar appends a driver-unique filename to this path to avoid conflicts
126128
# see https://github.com/stackabletech/secret-operator/issues/229 for why this path should not be too long
127-
path: {{ .Values.kubeletDir }}/plugins_registry
129+
path: {{ .Values.csiNodeDriver.kubeletDir }}/plugins_registry
128130
- name: csi
129131
hostPath:
130-
path: {{ .Values.kubeletDir }}/plugins/secrets.stackable.tech/
132+
path: {{ .Values.csiNodeDriver.kubeletDir }}/plugins/secrets.stackable.tech/
131133
- name: mountpoint
132134
hostPath:
133-
path: {{ .Values.kubeletDir }}/pods/
135+
path: {{ .Values.csiNodeDriver.kubeletDir }}/pods/
134136
- name: tmp
135137
emptyDir: {}
136-
{{- with .Values.nodeSelector }}
138+
{{- with .Values.csiNodeDriver.nodeSelector }}
137139
nodeSelector:
138140
{{- toYaml . | nindent 8 }}
139141
{{- end }}
140-
{{- with .Values.affinity }}
142+
{{- with .Values.csiNodeDriver.affinity }}
141143
affinity:
142144
{{- toYaml . | nindent 8 }}
143145
{{- end }}
144-
{{- with .Values.tolerations }}
146+
{{- with .Values.csiNodeDriver.tolerations }}
145147
tolerations:
146148
{{- toYaml . | nindent 8 }}
147149
{{- end }}
148-
{{- with .Values.priorityClassName }}
150+
{{- with .Values.csiNodeDriver.priorityClassName }}
149151
priorityClassName: {{ . }}
150152
{{- end }}

‎deploy/helm/secret-operator/values.yaml‎

Lines changed: 75 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,20 @@
11
# Default values for secret-operator.
22
---
3+
# Used by both the Controller Service and Node Service containers
34
image:
5+
repository: oci.stackable.tech/sdp/listener-operator
6+
# tag: 0.0.0-dev
7+
pullPolicy: IfNotPresent
48
pullSecrets: []
59

6-
externalProvisioner:
7-
image:
8-
repository: oci.stackable.tech/sdp/sig-storage/csi-provisioner
9-
tag: v5.3.0
10-
pullPolicy: IfNotPresent
11-
resources:
12-
requests:
13-
cpu: 100m
14-
memory: 128Mi
15-
limits:
16-
cpu: 100m
17-
memory: 128Mi
18-
nodeDriverRegistrar:
19-
image:
20-
repository: oci.stackable.tech/sdp/sig-storage/csi-node-driver-registrar
21-
tag: v2.15.0
22-
pullPolicy: IfNotPresent
23-
resources:
24-
requests:
25-
cpu: 100m
26-
memory: 128Mi
27-
limits:
28-
cpu: 100m
29-
memory: 128Mi
10+
controllerService:
11+
podAnnotations: {}
12+
podSecurityContext: {}
13+
# fsGroup: 2000
14+
nodeSelector: {}
15+
tolerations: []
16+
affinity: {}
3017

31-
secretOperator:
32-
image:
33-
repository: oci.stackable.tech/sdp/secret-operator
34-
# tag: 0.0.0-dev
35-
pullPolicy: IfNotPresent
36-
# Resources of the secret-operator container itself
3718
resources:
3819
limits:
3920
cpu: 100m
@@ -45,17 +26,76 @@ secretOperator:
4526
securityContext:
4627
# secret-operator requires root permissions
4728
runAsUser: 0
48-
# It is strongly recommended to run secret-operator as a privileged container, since
49-
# it enables additional protections for the secret contents.
50-
# Unprivileged mode is EXPERIMENTAL and requires manual migration for an existing cluster.
51-
privileged: true
5229
# capabilities:
5330
# drop:
5431
# - ALL
5532
# readOnlyRootFilesystem: true
5633
# runAsNonRoot: true
5734
# runAsUser: 1000
5835

36+
csiNodeDriver:
37+
# Kubelet dir may vary in environments such as microk8s.
38+
# See https://github.com/stackabletech/secret-operator/issues/229
39+
kubeletDir: /var/lib/kubelet
40+
41+
podAnnotations: {}
42+
podSecurityContext: {}
43+
# fsGroup: 2000
44+
nodeSelector: {}
45+
tolerations: []
46+
affinity: {}
47+
48+
nodeService:
49+
resources:
50+
limits:
51+
cpu: 100m
52+
memory: 128Mi
53+
requests:
54+
cpu: 100m
55+
memory: 128Mi
56+
57+
securityContext:
58+
# secret-operator requires root permissions
59+
runAsUser: 0
60+
# It is strongly recommended to run secret-operator as a privileged container, since
61+
# it enables additional protections for the secret contents.
62+
# Unprivileged mode is EXPERIMENTAL and requires manual migration for an existing cluster.
63+
privileged: true
64+
# capabilities:
65+
# drop:
66+
# - ALL
67+
# readOnlyRootFilesystem: true
68+
# runAsNonRoot: true
69+
# runAsUser: 1000
70+
71+
externalProvisioner:
72+
image:
73+
repository: oci.stackable.tech/sdp/sig-storage/csi-provisioner
74+
tag: v5.3.0
75+
pullPolicy: IfNotPresent
76+
# NOTE (@Techassi): Support setting pullSecrets
77+
resources:
78+
requests:
79+
cpu: 100m
80+
memory: 128Mi
81+
limits:
82+
cpu: 100m
83+
memory: 128Mi
84+
85+
nodeDriverRegistrar:
86+
image:
87+
repository: oci.stackable.tech/sdp/sig-storage/csi-node-driver-registrar
88+
tag: v2.15.0
89+
pullPolicy: IfNotPresent
90+
# NOTE (@Techassi): Support setting pullSecrets
91+
resources:
92+
requests:
93+
cpu: 100m
94+
memory: 128Mi
95+
limits:
96+
cpu: 100m
97+
memory: 128Mi
98+
5999
nameOverride: ""
60100
fullnameOverride: ""
61101

@@ -68,30 +108,11 @@ serviceAccount:
68108
# If not set and create is true, a name is generated using the fullname template
69109
name: ""
70110

71-
podAnnotations: {}
72-
73111
# Provide additional labels which get attached to all deployed resources
74112
labels:
75113
stackable.tech/vendor: Stackable
76114

77-
podSecurityContext: {}
78-
# fsGroup: 2000
79-
80-
nodeSelector: {}
81-
82-
tolerations: []
83-
84-
affinity: {}
85-
86-
# priorityClassName: ...
87-
88-
# When running on a non-default Kubernetes cluster domain, the cluster domain can be configured here.
89-
# See the https://docs.stackable.tech/home/stable/guides/kubernetes-cluster-domain guide for details.
90-
# kubernetesClusterDomain: my-cluster.local
91-
92-
# Kubelet dir may vary in environments such as microk8s, see https://github.com/stackabletech/secret-operator/issues/229
93-
kubeletDir: /var/lib/kubelet
94-
115+
# Customize default custom resources deployed by the operator
95116
secretClasses:
96117
tls:
97118
# The namespace that the TLS Certificate Authority is installed into.

0 commit comments

Comments
 (0)