Skip to content

Commit 1254f73

Browse files
joshuatcaseyjoshuatcasey
committed
Revert the Concierge configmap data to inline rendering
1 parent 69281a4 commit 1254f73

File tree

3 files changed

+63
-74
lines changed

3 files changed

+63
-74
lines changed

‎deploy/concierge/deployment.yaml‎

Lines changed: 51 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,16 @@
22
#! SPDX-License-Identifier: Apache-2.0
33

44
#@ load("@ytt:data", "data")
5-
#@ load("@ytt:yaml", "yaml")
5+
#@ load("@ytt:json", "json")
66
#@ load("helpers.lib.yaml",
77
#@ "defaultLabel",
88
#@ "labels",
99
#@ "deploymentPodLabel",
1010
#@ "namespace",
1111
#@ "defaultResourceName",
1212
#@ "defaultResourceNameWithSuffix",
13+
#@ "getAndValidateLogLevel",
1314
#@ "pinnipedDevAPIGroupWithPrefix",
14-
#@ "getPinnipedConfigMapData",
1515
#@ )
1616
#@ load("@ytt:template", "template")
1717

@@ -66,10 +66,56 @@ metadata:
6666
labels: #@ labels()
6767
data:
6868
#! If names.apiService is changed in this ConfigMap, must also change name of the ClusterIP Service resource below.
69-
#! aggregatedAPIServerPort may be set here, although other YAML references to the default port (10250) may also need to be updated.
70-
#! impersonationProxyServerPort may be set here, although other YAML references to the default port (8444) may also need to be updated.
7169
#@yaml/text-templated-strings
72-
pinniped.yaml: #@ yaml.encode(getPinnipedConfigMapData())
70+
pinniped.yaml: |
71+
discovery:
72+
url: (@= data.values.discovery_url or "null" @)
73+
api:
74+
servingCertificate:
75+
durationSeconds: (@= str(data.values.api_serving_certificate_duration_seconds) @)
76+
renewBeforeSeconds: (@= str(data.values.api_serving_certificate_renew_before_seconds) @)
77+
apiGroupSuffix: (@= data.values.api_group_suffix @)
78+
# aggregatedAPIServerPort may be set here, although other YAML references to the default port (10250) may also need to be updated
79+
# impersonationProxyServerPort may be set here, although other YAML references to the default port (8444) may also need to be updated
80+
aggregatedAPIServerDisableAdmissionPlugins: []
81+
names:
82+
servingCertificateSecret: (@= defaultResourceNameWithSuffix("api-tls-serving-certificate") @)
83+
credentialIssuer: (@= defaultResourceNameWithSuffix("config") @)
84+
apiService: (@= defaultResourceNameWithSuffix("api") @)
85+
impersonationLoadBalancerService: (@= defaultResourceNameWithSuffix("impersonation-proxy-load-balancer") @)
86+
impersonationClusterIPService: (@= defaultResourceNameWithSuffix("impersonation-proxy-cluster-ip") @)
87+
impersonationTLSCertificateSecret: (@= defaultResourceNameWithSuffix("impersonation-proxy-tls-serving-certificate") @)
88+
impersonationCACertificateSecret: (@= defaultResourceNameWithSuffix("impersonation-proxy-ca-certificate") @)
89+
impersonationSignerSecret: (@= defaultResourceNameWithSuffix("impersonation-proxy-signer-ca-certificate") @)
90+
agentServiceAccount: (@= defaultResourceNameWithSuffix("kube-cert-agent") @)
91+
impersonationProxyServiceAccount: (@= defaultResourceNameWithSuffix("impersonation-proxy") @)
92+
impersonationProxyLegacySecret: (@= defaultResourceNameWithSuffix("impersonation-proxy") @)
93+
labels: (@= json.encode(labels()).rstrip() @)
94+
kubeCertAgent:
95+
namePrefix: (@= defaultResourceNameWithSuffix("kube-cert-agent-") @)
96+
priorityClassName: (@= data.values.kube_cert_agent_priority_class_name @)
97+
(@ if data.values.kube_cert_agent_image: @)
98+
image: (@= data.values.kube_cert_agent_image @)
99+
(@ else: @)
100+
(@ if data.values.image_digest: @)
101+
image: (@= data.values.image_repo + "@" + data.values.image_digest @)
102+
(@ else: @)
103+
image: (@= data.values.image_repo + ":" + data.values.image_tag @)
104+
(@ end @)
105+
(@ end @)
106+
(@ if data.values.image_pull_dockerconfigjson: @)
107+
imagePullSecrets:
108+
- image-pull-secret
109+
(@ end @)
110+
(@ if data.values.log_level: @)
111+
log:
112+
level: (@= getAndValidateLogLevel() @)
113+
(@ end @)
114+
tls:
115+
onedottwo:
116+
allowedCiphers: (@= str(data.values.allowed_ciphers_for_tls_onedottwo) @)
117+
audit:
118+
logUsernamesAndGroups: (@= data.values.audit.log_usernames_and_groups @)
73119
---
74120
#@ if data.values.image_pull_dockerconfigjson and data.values.image_pull_dockerconfigjson != "":
75121
apiVersion: v1

‎deploy/concierge/helpers.lib.yaml‎

Lines changed: 0 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -45,69 +45,3 @@ _: #@ template.replace(data.values.custom_labels)
4545
#@ end
4646
#@ return log_level
4747
#@ end
48-
49-
#@ def getDiscoveryURL():
50-
#@ if data.values.discovery_url == "" or data.values.discovery_url == "null":
51-
#@ return None
52-
#@ end
53-
#@ return data.values.discovery_url
54-
#@ end
55-
56-
#@ def getPinnipedConfigMapData():
57-
#@ config = {
58-
#@ "discovery": {
59-
#@ "url": getDiscoveryURL(),
60-
#@ },
61-
#@ "api": {
62-
#@ "servingCertificate": {
63-
#@ "durationSeconds": int(data.values.api_serving_certificate_duration_seconds),
64-
#@ "renewBeforeSeconds": int(data.values.api_serving_certificate_renew_before_seconds),
65-
#@ },
66-
#@ },
67-
#@ "apiGroupSuffix": data.values.api_group_suffix,
68-
#@ "names": {
69-
#@ "servingCertificateSecret": defaultResourceNameWithSuffix("api-tls-serving-certificate"),
70-
#@ "credentialIssuer": defaultResourceNameWithSuffix("config"),
71-
#@ "apiService": defaultResourceNameWithSuffix("api"),
72-
#@ "impersonationLoadBalancerService": defaultResourceNameWithSuffix("impersonation-proxy-load-balancer"),
73-
#@ "impersonationClusterIPService": defaultResourceNameWithSuffix("impersonation-proxy-cluster-ip"),
74-
#@ "impersonationTLSCertificateSecret": defaultResourceNameWithSuffix("impersonation-proxy-tls-serving-certificate"),
75-
#@ "impersonationCACertificateSecret": defaultResourceNameWithSuffix("impersonation-proxy-ca-certificate"),
76-
#@ "impersonationSignerSecret": defaultResourceNameWithSuffix("impersonation-proxy-signer-ca-certificate"),
77-
#@ "agentServiceAccount": defaultResourceNameWithSuffix("kube-cert-agent"),
78-
#@ "impersonationProxyServiceAccount": defaultResourceNameWithSuffix("impersonation-proxy"),
79-
#@ "impersonationProxyLegacySecret": defaultResourceNameWithSuffix("impersonation-proxy"),
80-
#@ },
81-
#@ "labels": labels(),
82-
#@ "kubeCertAgent": {
83-
#@ "namePrefix": defaultResourceNameWithSuffix("kube-cert-agent-"),
84-
#@ "priorityClassName": "",
85-
#@ },
86-
#@ "tls": {
87-
#@ "onedottwo": {
88-
#@ "allowedCiphers": data.values.allowed_ciphers_for_tls_onedottwo
89-
#@ }
90-
#@ },
91-
#@ "audit": {
92-
#@ "logUsernamesAndGroups": data.values.audit.log_usernames_and_groups,
93-
#@ },
94-
#@ "aggregatedAPIServerDisableAdmissionPlugins": []
95-
#@ }
96-
#@ if data.values.kube_cert_agent_image:
97-
#@ config["kubeCertAgent"]["image"] = data.values.kube_cert_agent_image
98-
#@ else:
99-
#@ if data.values.image_digest:
100-
#@ config["kubeCertAgent"]["image"] = data.values.image_repo + "@" + data.values.image_digest
101-
#@ else:
102-
#@ config["kubeCertAgent"]["image"] = data.values.image_repo + ":" + data.values.image_tag
103-
#@ end
104-
#@ end
105-
#@ if data.values.image_pull_dockerconfigjson:
106-
#@ config["kubeCertAgent"]["imagePullSecrets"] = ["image-pull-secret"]
107-
#@ end
108-
#@ if data.values.log_level:
109-
#@ config["log"] = {}
110-
#@ config["log"]["level"] = getAndValidateLogLevel()
111-
#@ end
112-
#@ return config
113-
#@ end

‎deploy/concierge/values.yaml‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
#! Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
1+
#! Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
22
#! SPDX-License-Identifier: Apache-2.0
33

44
#@ def validate_strings_map(obj):
@@ -68,15 +68,24 @@ image_digest: ""
6868
image_tag: latest
6969

7070
#@schema/title "Kube Cert Agent image"
71-
#@ kube_cert_agent_image = "Optionally specify a different image for the 'kube-cert-agent' pod which is scheduled \
71+
#@ kube_cert_agent_image_desc = "Optionally specify a different image for the 'kube-cert-agent' pod which is scheduled \
7272
#@ on the control plane. This image needs only to include `sleep` and `cat` binaries. \
7373
#@ By default, the same image specified for image_repo/image_digest/image_tag will be re-used."
74-
#@schema/desc kube_cert_agent_image
74+
#@schema/desc kube_cert_agent_image_desc
7575
#@schema/examples ("Image including tag or digest", "ghcr.io/vmware-tanzu/pinniped/pinniped-server:latest")
7676
#@schema/nullable
7777
#@schema/validation min_len=1
7878
kube_cert_agent_image: ""
7979

80+
#@schema/title "Kube Cert Agent Priority Class Name"
81+
#@ kube_cert_agent_priority_class_name_desc = "Optionally specify a PriorityClassName for the 'kube-cert-agent' pod. \
82+
#@ See https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/ for more details. \
83+
#@ By default, this is the empty string."
84+
#@schema/desc kube_cert_agent_priority_class_name_desc
85+
#@schema/examples ("name of a PriorityClass object", "high-priority")
86+
#@schema/validation min_len=0
87+
kube_cert_agent_priority_class_name: ""
88+
8089
#@schema/title "Image pull dockerconfigjson"
8190
#@ image_pull_dockerconfigjson_desc = "A base64 encoded secret to be used when pulling the `image_repo` container image. \
8291
#@ Can be used when the image_repo is a private registry. Typically, the value would be the output of: \

0 commit comments

Comments
 (0)