Tornjak UBI support (#123)
* Tornjak UBI support The Tornjak containers now have two different flavors. Vanilla and UBI. Automatically select the UBI image when deploying on OpenShift. Signed-off-by: Kevin Fox <[email protected]> Co-authored-by: Mariusz Sabath <[email protected]>
This commit is contained in:
kfox1111
co-authored by
Mariusz Sabath
Mariusz Sabath
parent
89c07e2d04
commit
7726351955
@@ -277,7 +277,8 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` |
|
||||
| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tornjak.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `tornjak.image.tag` | Overrides the image tag whose default is the chart appVersion | `v1.4.0` |
|
||||
| `tornjak.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `""` |
|
||||
| `tornjak.image.defaultTag` | Sets the default image to use when image.tag is not set. It will automatically be updated with a ubi- prefix if on OpenShift. | `v1.4.1` |
|
||||
| `tornjak.service.type` | Type of service resource | `ClusterIP` |
|
||||
| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` |
|
||||
| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` |
|
||||
|
||||
@@ -231,7 +231,7 @@ spec:
|
||||
- name: tornjak
|
||||
securityContext:
|
||||
{{- toYaml .Values.controllerManager.securityContext | nindent 12 }}
|
||||
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tornjak.image "global" .Values.global) }}
|
||||
image: {{ template "spire-lib.image" (dict "appVersion" .Values.tornjak.image.defaultTag "image" .Values.tornjak.image "global" .Values.global "ubi" true) }}
|
||||
imagePullPolicy: {{ .Values.tornjak.image.pullPolicy }}
|
||||
{{- if eq (include "spire-tornjak.connectionType" .) "http" }}
|
||||
startupProbe:
|
||||
|
||||
@@ -608,14 +608,16 @@ tornjak:
|
||||
## @param tornjak.image.repository The repository within the registry
|
||||
## @param tornjak.image.pullPolicy The image pull policy
|
||||
## @param tornjak.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
||||
## @param tornjak.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
## @param tornjak.image.tag Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications
|
||||
## @param tornjak.image.defaultTag Sets the default image to use when image.tag is not set. It will automatically be updated with a ubi- prefix if on OpenShift.
|
||||
##
|
||||
image:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/tornjak-backend
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: "v1.4.0"
|
||||
tag: ""
|
||||
defaultTag: "v1.4.1"
|
||||
|
||||
service:
|
||||
## @param tornjak.service.type Type of service resource
|
||||
|
||||
@@ -3,7 +3,7 @@ name: tornjak-frontend
|
||||
description: A Helm chart to deploy Tornjak frontend
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "v1.4.0"
|
||||
appVersion: "v1.4.1"
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
- https://github.com/spiffe/tornjak
|
||||
|
||||
@@ -24,7 +24,7 @@ spec:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
containers:
|
||||
- name: {{ include "tornjak-frontend.fullname" . }}
|
||||
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
|
||||
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global "ubi" true) }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
|
||||
@@ -55,7 +55,11 @@
|
||||
{{- if eq (substr 0 7 $tag) "sha256:" }}
|
||||
{{- printf "%s/%s@%s" $registry $repo $tag }}
|
||||
{{- else if .appVersion }}
|
||||
{{- printf "%s%s:%s" $registry $repo (default .appVersion $tag) }}
|
||||
{{- $appVersion := .appVersion }}
|
||||
{{- if and (hasKey . "ubi") (dig "openshift" false .global) }}
|
||||
{{- $appVersion = printf "ubi-%s" $appVersion }}
|
||||
{{- end }}
|
||||
{{- printf "%s%s:%s" $registry $repo (default $appVersion $tag) }}
|
||||
{{- else if $tag }}
|
||||
{{- printf "%s%s:%s" $registry $repo $tag }}
|
||||
{{- else }}
|
||||
|
||||
@@ -19,11 +19,6 @@ global:
|
||||
pod-security.kubernetes.io/audit: privileged
|
||||
|
||||
spire-server:
|
||||
tornjak:
|
||||
image:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/tornjak-backend
|
||||
tag: ubi-v1.4.1
|
||||
nodeAttestor:
|
||||
k8sPsat:
|
||||
serviceAccountAllowList: ["spire-system:spire-agent"]
|
||||
@@ -56,10 +51,6 @@ spiffe-oidc-discovery-provider:
|
||||
|
||||
tornjak-frontend:
|
||||
workingDir: /opt/app-root/src
|
||||
image:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/tornjak-frontend
|
||||
tag: ubi-v1.4.1
|
||||
podSecurityContext:
|
||||
runAsUser: null
|
||||
runAsGroup: null
|
||||
|
||||
Reference in New Issue
Block a user