Skip to content

Fix #17: Make RBAC resources unique and optional #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Fix #17: Make RBAC resources unique and optional #18

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3468c34
Fix #17: Make RBAC resources unique and optional
Sep 11, 2018
0d562c8
Fix name of ServiceAccount
Sep 12, 2018
8dfae0c
Remove namespace from resources.
Sep 12, 2018
03cc231
Set version to 0.0.5
Nov 12, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion src/incubator/f5-bigip-ctlr/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
apiVersion: v1
description: Deploy the F5 Networks BIG-IP Controller for Kubernetes and OpenShift (k8s-bigip-ctlr).
name: f5-bigip-ctlr
version: 0.0.4
version: 0.1.0
home: https://github.com/F5Networks/charts
keywords:
- f5-bigip
sources:
- https://clouddocs.f5.com/containers/v2/kubernetes/kctlr-k8s-ingress-ctlr.html
27 changes: 27 additions & 0 deletions src/incubator/f5-bigip-ctlr/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,35 @@ Expand the name of the chart.
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "f5-bigip-ctlr.fullname" -}}
{{- if .Values.fullnameOverride -}}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "f5-bigip-ctlr.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create the name of the service account to use
*/}}
{{- define "f5-bigip-ctlr.serviceAccountName" -}}
{{- if .Values.serviceAccount.create -}}
{{ default (include "f5-bigip-ctlr.fullname" .) .Values.serviceAccount.name }}
{{- else -}}
{{ default "default" .Values.serviceAccount.name }}
{{- end -}}
{{- end -}}
6 changes: 4 additions & 2 deletions src/incubator/f5-bigip-ctlr/templates/f5-bigip-ctlr-clusterrole.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,11 @@
{{- if .Values.rbac.create -}}
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: f5-bigip-ctlr-clusterrole
name: {{ template "f5-bigip-ctlr.fullname" . }}
labels:
app: {{ template "f5-bigip-ctlr.name" . }}
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
chart: {{ template "f5-bigip-ctlr.chart" . }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Charts in helm are expected to be tied to a version. This naming convention is deliberate and should be retained. Operators may be expected to use multiple versions of a chart during rolling deployments, testing etc., and having the name explicitly reference the version should make tracking, debugging, and human error elimination easier.

@f5tsomanchi The names of resources should be validated in a test environment

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@recursivelycurious - as said in the above comments,

The RBAC aspects look fine, however, this MR had not been merged yet due to difficulty around a testing environment to run the system tests. They may need to be modified to run the newer charts.

  • Can you please elaborate the modifications needed to run newer charts ?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://helm.sh/docs/developing_charts/#charts-and-versioning

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you look in the helpers template "f5-bigip-ctlr.chart" . is functionally equivalent to .Chart.Name }}-{{ .Chart.Version | replace "+" "_"

release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
rules:
Expand Down Expand Up @@ -37,3 +38,4 @@ rules:
- update
- create
- patch
{{- end -}}
13 changes: 7 additions & 6 deletions src/incubator/f5-bigip-ctlr/templates/f5-bigip-ctlr-clusterrolebinding.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,19 @@
{{- if .Values.rbac.create -}}
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: f5-bigip-ctlr-clusterrolebinding
namespace: kube-system
name: {{ template "f5-bigip-ctlr.fullname" . }}
labels:
app: {{ template "f5-bigip-ctlr.name" . }}
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
chart: {{ template "f5-bigip-ctlr.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: f5-bigip-ctlr-clusterrole
name: {{ template "f5-bigip-ctlr.fullname" . }}
subjects:
- kind: ServiceAccount
name: f5-bigip-ctlr-serviceaccount
namespace: kube-system
name: {{ template "f5-bigip-ctlr.serviceAccountName" . }}
namespace: {{ .Release.Namespace | quote }}
{{- end -}}
5 changes: 2 additions & 3 deletions src/incubator/f5-bigip-ctlr/templates/f5-bigip-ctlr-deploy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 +9,9 @@ apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: {{ template "f5-bigip-ctlr.fullname" . }}
namespace: {{ .Values.namespace }}
labels:
app: {{ template "f5-bigip-ctlr.name" . }}
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "-" }}
chart: {{ template "f5-bigip-ctlr.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
spec:
Expand All @@ -23,7 +22,7 @@ spec:
app: {{ template "f5-bigip-ctlr.name" . }}
release: {{ .Release.Name }}
spec:
serviceAccountName: {{ .Values.serviceaccount }}
serviceAccountName: {{ template "f5-bigip-ctlr.serviceAccountName" . }}
{{- if .Values.image.pullSecrets }}
imagePullSecrets:
{{- range $pullSecret := .Values.image.pullSecrets }}
Expand Down
11 changes: 7 additions & 4 deletions src/incubator/f5-bigip-ctlr/templates/f5-bigip-ctlr-serviceaccount.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,13 @@
{{- if .Values.rbac.create -}}
{{- if .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
name: f5-bigip-ctlr-serviceaccount
namespace: kube-system
name: {{ template "f5-bigip-ctlr.fullname" . }}
labels:
app: {{ template "f5-bigip-ctlr.name" . }}
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
chart: {{ template "f5-bigip-ctlr.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
heritage: {{ .Release.Service }}
{{- end -}}
{{- end -}}
15 changes: 12 additions & 3 deletions src/incubator/f5-bigip-ctlr/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,18 @@
# To create a secret using kubectl see
# http://clouddocs.f5.com/containers/latest/kubernetes/kctlr-secrets.html#secret-bigip-login
bigip_login_secret: f5-bigip-ctlr-login
serviceaccount: f5-bigip-ctlr-serviceaccount
# This namespace is where the Controller lives;
namespace: kube-system

rbac:
# Specifies whether RBAC resources should be created
create: true

serviceAccount:
# Specifies whether a service account should be created
create: true
# The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name:

args:
# See http://clouddocs.f5.com/products/connectors/k8s-bigip-ctlr/latest/#controller-configuration-parameters
# NOTE: helm has difficulty with values using `-`; `_` are used for naming
Expand Down