Tornjak UBI support (#123)
* Tornjak UBI support The Tornjak containers now have two different flavors. Vanilla and UBI. Automatically select the UBI image when deploying on OpenShift. Signed-off-by: Kevin Fox <[email protected]> Co-authored-by: Mariusz Sabath <[email protected]>
This commit is contained in:
kfox1111
co-authored by
Mariusz Sabath
Mariusz Sabath
parent
89c07e2d04
commit
7726351955
@@ -277,7 +277,8 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` |
|
| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` |
|
||||||
| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `tornjak.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
| `tornjak.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
| `tornjak.image.tag` | Overrides the image tag whose default is the chart appVersion | `v1.4.0` |
|
| `tornjak.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `""` |
|
||||||
|
| `tornjak.image.defaultTag` | Sets the default image to use when image.tag is not set. It will automatically be updated with a ubi- prefix if on OpenShift. | `v1.4.1` |
|
||||||
| `tornjak.service.type` | Type of service resource | `ClusterIP` |
|
| `tornjak.service.type` | Type of service resource | `ClusterIP` |
|
||||||
| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` |
|
| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` |
|
||||||
| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` |
|
| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` |
|
||||||
|
|||||||
@@ -231,7 +231,7 @@ spec:
|
|||||||
- name: tornjak
|
- name: tornjak
|
||||||
securityContext:
|
securityContext:
|
||||||
{{- toYaml .Values.controllerManager.securityContext | nindent 12 }}
|
{{- toYaml .Values.controllerManager.securityContext | nindent 12 }}
|
||||||
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tornjak.image "global" .Values.global) }}
|
image: {{ template "spire-lib.image" (dict "appVersion" .Values.tornjak.image.defaultTag "image" .Values.tornjak.image "global" .Values.global "ubi" true) }}
|
||||||
imagePullPolicy: {{ .Values.tornjak.image.pullPolicy }}
|
imagePullPolicy: {{ .Values.tornjak.image.pullPolicy }}
|
||||||
{{- if eq (include "spire-tornjak.connectionType" .) "http" }}
|
{{- if eq (include "spire-tornjak.connectionType" .) "http" }}
|
||||||
startupProbe:
|
startupProbe:
|
||||||
|
|||||||
@@ -608,14 +608,16 @@ tornjak:
|
|||||||
## @param tornjak.image.repository The repository within the registry
|
## @param tornjak.image.repository The repository within the registry
|
||||||
## @param tornjak.image.pullPolicy The image pull policy
|
## @param tornjak.image.pullPolicy The image pull policy
|
||||||
## @param tornjak.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
## @param tornjak.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
||||||
## @param tornjak.image.tag Overrides the image tag whose default is the chart appVersion
|
## @param tornjak.image.tag Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications
|
||||||
|
## @param tornjak.image.defaultTag Sets the default image to use when image.tag is not set. It will automatically be updated with a ubi- prefix if on OpenShift.
|
||||||
##
|
##
|
||||||
image:
|
image:
|
||||||
registry: ghcr.io
|
registry: ghcr.io
|
||||||
repository: spiffe/tornjak-backend
|
repository: spiffe/tornjak-backend
|
||||||
pullPolicy: IfNotPresent
|
pullPolicy: IfNotPresent
|
||||||
version: ""
|
version: ""
|
||||||
tag: "v1.4.0"
|
tag: ""
|
||||||
|
defaultTag: "v1.4.1"
|
||||||
|
|
||||||
service:
|
service:
|
||||||
## @param tornjak.service.type Type of service resource
|
## @param tornjak.service.type Type of service resource
|
||||||
|
|||||||
@@ -3,7 +3,7 @@ name: tornjak-frontend
|
|||||||
description: A Helm chart to deploy Tornjak frontend
|
description: A Helm chart to deploy Tornjak frontend
|
||||||
type: application
|
type: application
|
||||||
version: 0.1.0
|
version: 0.1.0
|
||||||
appVersion: "v1.4.0"
|
appVersion: "v1.4.1"
|
||||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||||
sources:
|
sources:
|
||||||
- https://github.com/spiffe/tornjak
|
- https://github.com/spiffe/tornjak
|
||||||
|
|||||||
@@ -24,7 +24,7 @@ spec:
|
|||||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||||
containers:
|
containers:
|
||||||
- name: {{ include "tornjak-frontend.fullname" . }}
|
- name: {{ include "tornjak-frontend.fullname" . }}
|
||||||
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
|
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global "ubi" true) }}
|
||||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||||
securityContext:
|
securityContext:
|
||||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||||
|
|||||||
@@ -55,7 +55,11 @@
|
|||||||
{{- if eq (substr 0 7 $tag) "sha256:" }}
|
{{- if eq (substr 0 7 $tag) "sha256:" }}
|
||||||
{{- printf "%s/%s@%s" $registry $repo $tag }}
|
{{- printf "%s/%s@%s" $registry $repo $tag }}
|
||||||
{{- else if .appVersion }}
|
{{- else if .appVersion }}
|
||||||
{{- printf "%s%s:%s" $registry $repo (default .appVersion $tag) }}
|
{{- $appVersion := .appVersion }}
|
||||||
|
{{- if and (hasKey . "ubi") (dig "openshift" false .global) }}
|
||||||
|
{{- $appVersion = printf "ubi-%s" $appVersion }}
|
||||||
|
{{- end }}
|
||||||
|
{{- printf "%s%s:%s" $registry $repo (default $appVersion $tag) }}
|
||||||
{{- else if $tag }}
|
{{- else if $tag }}
|
||||||
{{- printf "%s%s:%s" $registry $repo $tag }}
|
{{- printf "%s%s:%s" $registry $repo $tag }}
|
||||||
{{- else }}
|
{{- else }}
|
||||||
|
|||||||
@@ -19,11 +19,6 @@ global:
|
|||||||
pod-security.kubernetes.io/audit: privileged
|
pod-security.kubernetes.io/audit: privileged
|
||||||
|
|
||||||
spire-server:
|
spire-server:
|
||||||
tornjak:
|
|
||||||
image:
|
|
||||||
registry: ghcr.io
|
|
||||||
repository: spiffe/tornjak-backend
|
|
||||||
tag: ubi-v1.4.1
|
|
||||||
nodeAttestor:
|
nodeAttestor:
|
||||||
k8sPsat:
|
k8sPsat:
|
||||||
serviceAccountAllowList: ["spire-system:spire-agent"]
|
serviceAccountAllowList: ["spire-system:spire-agent"]
|
||||||
@@ -56,10 +51,6 @@ spiffe-oidc-discovery-provider:
|
|||||||
|
|
||||||
tornjak-frontend:
|
tornjak-frontend:
|
||||||
workingDir: /opt/app-root/src
|
workingDir: /opt/app-root/src
|
||||||
image:
|
|
||||||
registry: ghcr.io
|
|
||||||
repository: spiffe/tornjak-frontend
|
|
||||||
tag: ubi-v1.4.1
|
|
||||||
podSecurityContext:
|
podSecurityContext:
|
||||||
runAsUser: null
|
runAsUser: null
|
||||||
runAsGroup: null
|
runAsGroup: null
|
||||||
|
|||||||
Reference in New Issue
Block a user