Change chart directory structure
This commit is contained in:
wbsong111
@@ -0,0 +1,166 @@
|
||||
{{/*
|
||||
Copyright 2024 The Kubeflow authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
https://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/}}
|
||||
|
||||
{{/*
|
||||
Create the name of webhook component
|
||||
*/}}
|
||||
{{- define "spark-operator.webhook.name" -}}
|
||||
{{- include "spark-operator.fullname" . }}-webhook
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Common labels for the webhook
|
||||
*/}}
|
||||
{{- define "spark-operator.webhook.labels" -}}
|
||||
{{ include "spark-operator.labels" . }}
|
||||
app.kubernetes.io/component: webhook
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Selector labels for the webhook
|
||||
*/}}
|
||||
{{- define "spark-operator.webhook.selectorLabels" -}}
|
||||
{{ include "spark-operator.selectorLabels" . }}
|
||||
app.kubernetes.io/component: webhook
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of service account to be used by webhook
|
||||
*/}}
|
||||
{{- define "spark-operator.webhook.serviceAccountName" -}}
|
||||
{{- if .Values.webhook.serviceAccount.create -}}
|
||||
{{ .Values.webhook.serviceAccount.name | default (include "spark-operator.webhook.name" .) }}
|
||||
{{- else -}}
|
||||
{{ .Values.webhook.serviceAccount.name | default "default" }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the cluster role to be used by the webhook
|
||||
*/}}
|
||||
{{- define "spark-operator.webhook.clusterRoleName" -}}
|
||||
{{ include "spark-operator.webhook.name" . }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the cluster role binding to be used by the webhook
|
||||
*/}}
|
||||
{{- define "spark-operator.webhook.clusterRoleBindingName" -}}
|
||||
{{ include "spark-operator.webhook.clusterRoleName" . }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the role to be used by the webhook
|
||||
*/}}
|
||||
{{- define "spark-operator.webhook.roleName" -}}
|
||||
{{ include "spark-operator.webhook.name" . }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the role binding to be used by the webhook
|
||||
*/}}
|
||||
{{- define "spark-operator.webhook.roleBindingName" -}}
|
||||
{{ include "spark-operator.webhook.roleName" . }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the secret to be used by webhook
|
||||
*/}}
|
||||
{{- define "spark-operator.webhook.secretName" -}}
|
||||
{{ include "spark-operator.webhook.name" . }}-certs
|
||||
{{- end -}}
|
||||
|
||||
|
||||
{{/*
|
||||
Create the name of the service to be used by webhook
|
||||
*/}}
|
||||
{{- define "spark-operator.webhook.serviceName" -}}
|
||||
{{ include "spark-operator.webhook.name" . }}-svc
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of mutating webhook configuration
|
||||
*/}}
|
||||
{{- define "spark-operator.mutatingWebhookConfigurationName" -}}
|
||||
webhook.sparkoperator.k8s.io
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of mutating webhook configuration
|
||||
*/}}
|
||||
{{- define "spark-operator.validatingWebhookConfigurationName" -}}
|
||||
quotaenforcer.sparkoperator.k8s.io
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the deployment to be used by webhook
|
||||
*/}}
|
||||
{{- define "spark-operator.webhook.deploymentName" -}}
|
||||
{{ include "spark-operator.webhook.name" . }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the lease resource to be used by leader election
|
||||
*/}}
|
||||
{{- define "spark-operator.webhook.leaderElectionName" -}}
|
||||
{{ include "spark-operator.webhook.name" . }}-lock
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the pod disruption budget to be used by webhook
|
||||
*/}}
|
||||
{{- define "spark-operator.webhook.podDisruptionBudgetName" -}}
|
||||
{{ include "spark-operator.webhook.name" . }}-pdb
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the role policy rules for the webhook in every Spark job namespace
|
||||
*/}}
|
||||
{{- define "spark-operator.webhook.policyRules" -}}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- resourcequotas
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- sparkoperator.k8s.io
|
||||
resources:
|
||||
- sparkapplications
|
||||
- sparkapplications/status
|
||||
- sparkapplications/finalizers
|
||||
- scheduledsparkapplications
|
||||
- scheduledsparkapplications/status
|
||||
- scheduledsparkapplications/finalizers
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,159 @@
|
||||
{{/*
|
||||
Copyright 2024 The Kubeflow authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
https://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/}}
|
||||
|
||||
{{- if .Values.webhook.enable }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "spark-operator.webhook.deploymentName" . }}
|
||||
labels:
|
||||
{{- include "spark-operator.webhook.labels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.webhook.replicas }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "spark-operator.webhook.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "spark-operator.webhook.selectorLabels" . | nindent 8 }}
|
||||
{{- with .Values.webhook.labels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
containers:
|
||||
- name: spark-operator-webhook
|
||||
image: {{ include "spark-operator.image" . }}
|
||||
{{- with .Values.image.pullPolicy }}
|
||||
imagePullPolicy: {{ . }}
|
||||
{{- end }}
|
||||
args:
|
||||
- webhook
|
||||
- start
|
||||
{{- with .Values.webhook.logLevel }}
|
||||
- --zap-log-level={{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.spark.jobNamespaces }}
|
||||
{{- if has "" . }}
|
||||
- --namespaces=""
|
||||
{{- else }}
|
||||
- --namespaces={{ . | join "," }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- --webhook-secret-name={{ include "spark-operator.webhook.secretName" . }}
|
||||
- --webhook-secret-namespace={{ .Release.Namespace }}
|
||||
- --webhook-svc-name={{ include "spark-operator.webhook.serviceName" . }}
|
||||
- --webhook-svc-namespace={{ .Release.Namespace }}
|
||||
- --webhook-port={{ .Values.webhook.port }}
|
||||
- --mutating-webhook-name={{ include "spark-operator.webhook.name" . }}
|
||||
- --validating-webhook-name={{ include "spark-operator.webhook.name" . }}
|
||||
{{- with .Values.webhook.resourceQuotaEnforcement.enable }}
|
||||
- --enable-resource-quota-enforcement=true
|
||||
{{- end }}
|
||||
{{- if .Values.prometheus.metrics.enable }}
|
||||
- --enable-metrics=true
|
||||
- --metrics-bind-address=:{{ .Values.prometheus.metrics.port }}
|
||||
- --metrics-endpoint={{ .Values.prometheus.metrics.endpoint }}
|
||||
- --metrics-prefix={{ .Values.prometheus.metrics.prefix }}
|
||||
- --metrics-labels=app_type
|
||||
{{- end }}
|
||||
- --leader-election=true
|
||||
- --leader-election-lock-name={{ include "spark-operator.webhook.leaderElectionName" . }}
|
||||
- --leader-election-lock-namespace={{ .Release.Namespace }}
|
||||
ports:
|
||||
- name: {{ .Values.webhook.portName | quote }}
|
||||
containerPort: {{ .Values.webhook.port }}
|
||||
{{- if .Values.prometheus.metrics.enable }}
|
||||
- name: {{ .Values.prometheus.metrics.portName | quote }}
|
||||
containerPort: {{ .Values.prometheus.metrics.port }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.env }}
|
||||
env:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.envFrom }}
|
||||
envFrom:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.volumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
port: 8081
|
||||
scheme: HTTP
|
||||
path: /healthz
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
port: 8081
|
||||
scheme: HTTP
|
||||
path: /readyz
|
||||
{{- with .Values.webhook.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.sidecars }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with .Values.image.pullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.volumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.priorityClassName }}
|
||||
priorityClassName: {{ . }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "spark-operator.webhook.serviceAccountName" . }}
|
||||
{{- with .Values.webhook.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.webhook.topologySpreadConstraints }}
|
||||
{{- if le (int .Values.webhook.replicas) 1 }}
|
||||
{{- fail "webhook.replicas must be greater than 1 to enable topology spread constraints for webhook pods"}}
|
||||
{{- end }}
|
||||
{{- $selectorLabels := include "spark-operator.webhook.selectorLabels" . | fromYaml }}
|
||||
{{- $labelSelectorDict := dict "labelSelector" ( dict "matchLabels" $selectorLabels ) }}
|
||||
topologySpreadConstraints:
|
||||
{{- range .Values.webhook.topologySpreadConstraints }}
|
||||
- {{ mergeOverwrite . $labelSelectorDict | toYaml | nindent 8 | trim }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
+124
@@ -0,0 +1,124 @@
|
||||
{{/*
|
||||
Copyright 2024 The Kubeflow authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
https://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/}}
|
||||
|
||||
{{- if .Values.webhook.enable }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
name: {{ include "spark-operator.webhook.name" . }}
|
||||
labels:
|
||||
{{- include "spark-operator.webhook.labels" . | nindent 4 }}
|
||||
webhooks:
|
||||
- name: mutate--v1-pod.sparkoperator.k8s.io
|
||||
admissionReviewVersions: ["v1"]
|
||||
clientConfig:
|
||||
service:
|
||||
name: {{ include "spark-operator.webhook.serviceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
port: {{ .Values.webhook.port }}
|
||||
path: /mutate--v1-pod
|
||||
sideEffects: NoneOnDryRun
|
||||
{{- with .Values.webhook.failurePolicy }}
|
||||
failurePolicy: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.spark.jobNamespaces }}
|
||||
{{- if not (has "" .) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/metadata.name
|
||||
operator: In
|
||||
values:
|
||||
{{- range $jobNamespace := . }}
|
||||
- {{ $jobNamespace }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
objectSelector:
|
||||
matchLabels:
|
||||
sparkoperator.k8s.io/launched-by-spark-operator: "true"
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
apiVersions: ["v1"]
|
||||
resources: ["pods"]
|
||||
operations: ["CREATE"]
|
||||
{{- with .Values.webhook.timeoutSeconds }}
|
||||
timeoutSeconds: {{ . }}
|
||||
{{- end }}
|
||||
- name: mutate-sparkoperator-k8s-io-v1beta2-sparkapplication.sparkoperator.k8s.io
|
||||
admissionReviewVersions: ["v1"]
|
||||
clientConfig:
|
||||
service:
|
||||
name: {{ include "spark-operator.webhook.serviceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
port: {{ .Values.webhook.port }}
|
||||
path: /mutate-sparkoperator-k8s-io-v1beta2-sparkapplication
|
||||
sideEffects: NoneOnDryRun
|
||||
{{- with .Values.webhook.failurePolicy }}
|
||||
failurePolicy: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.spark.jobNamespaces }}
|
||||
{{- if not (has "" .) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/metadata.name
|
||||
operator: In
|
||||
values:
|
||||
{{- range $jobNamespace := . }}
|
||||
- {{ $jobNamespace }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups: ["sparkoperator.k8s.io"]
|
||||
apiVersions: ["v1beta2"]
|
||||
resources: ["sparkapplications"]
|
||||
operations: ["CREATE", "UPDATE"]
|
||||
{{- with .Values.webhook.timeoutSeconds }}
|
||||
timeoutSeconds: {{ . }}
|
||||
{{- end }}
|
||||
- name: mutate-sparkoperator-k8s-io-v1beta2-scheduledsparkapplication.sparkoperator.k8s.io
|
||||
admissionReviewVersions: ["v1"]
|
||||
clientConfig:
|
||||
service:
|
||||
name: {{ include "spark-operator.webhook.serviceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
port: {{ .Values.webhook.port }}
|
||||
path: /mutate-sparkoperator-k8s-io-v1beta2-scheduledsparkapplication
|
||||
sideEffects: NoneOnDryRun
|
||||
{{- with .Values.webhook.failurePolicy }}
|
||||
failurePolicy: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.spark.jobNamespaces }}
|
||||
{{- if not (has "" .) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/metadata.name
|
||||
operator: In
|
||||
values:
|
||||
{{- range $jobNamespace := . }}
|
||||
- {{ $jobNamespace }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups: ["sparkoperator.k8s.io"]
|
||||
apiVersions: ["v1beta2"]
|
||||
resources: ["scheduledsparkapplications"]
|
||||
operations: ["CREATE", "UPDATE"]
|
||||
{{- with .Values.webhook.timeoutSeconds }}
|
||||
timeoutSeconds: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,36 @@
|
||||
{{/*
|
||||
Copyright 2024 The Kubeflow authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
https://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/}}
|
||||
|
||||
{{- if .Values.webhook.enable }}
|
||||
{{- if .Values.webhook.podDisruptionBudget.enable }}
|
||||
{{- if le (int .Values.webhook.replicas) 1 }}
|
||||
{{- fail "webhook.replicas must be greater than 1 to enable pod disruption budget for webhook" }}
|
||||
{{- end -}}
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "spark-operator.webhook.podDisruptionBudgetName" . }}
|
||||
labels:
|
||||
{{- include "spark-operator.webhook.labels" . | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "spark-operator.webhook.selectorLabels" . | nindent 6 }}
|
||||
{{- with .Values.webhook.podDisruptionBudget.minAvailable }}
|
||||
minAvailable: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,193 @@
|
||||
{{/*
|
||||
Copyright 2024 The Kubeflow authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
https://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/}}
|
||||
|
||||
{{- if .Values.webhook.enable }}
|
||||
{{- if .Values.webhook.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "spark-operator.webhook.clusterRoleName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "spark-operator.webhook.labels" . | nindent 4 }}
|
||||
{{- with .Values.webhook.rbac.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- admissionregistration.k8s.io
|
||||
resources:
|
||||
- mutatingwebhookconfigurations
|
||||
- validatingwebhookconfigurations
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- admissionregistration.k8s.io
|
||||
resources:
|
||||
- mutatingwebhookconfigurations
|
||||
- validatingwebhookconfigurations
|
||||
resourceNames:
|
||||
- {{ include "spark-operator.webhook.name" . }}
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
{{- if not .Values.spark.jobNamespaces | or (has "" .Values.spark.jobNamespaces) }}
|
||||
{{ include "spark-operator.webhook.policyRules" . }}
|
||||
{{- end }}
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "spark-operator.webhook.clusterRoleBindingName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "spark-operator.webhook.labels" . | nindent 4 }}
|
||||
{{- with .Values.webhook.rbac.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spark-operator.webhook.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "spark-operator.webhook.clusterRoleName" . }}
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "spark-operator.webhook.roleName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "spark-operator.webhook.labels" . | nindent 4 }}
|
||||
{{- with .Values.webhook.rbac.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
resourceNames:
|
||||
- {{ include "spark-operator.webhook.secretName" . }}
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
resourceNames:
|
||||
- {{ include "spark-operator.webhook.leaderElectionName" . }}
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
{{- if has .Release.Namespace .Values.spark.jobNamespaces }}
|
||||
{{ include "spark-operator.webhook.policyRules" . }}
|
||||
{{- end }}
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "spark-operator.webhook.roleBindingName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "spark-operator.webhook.labels" . | nindent 4 }}
|
||||
{{- with .Values.webhook.rbac.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spark-operator.webhook.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ include "spark-operator.webhook.roleName" . }}
|
||||
|
||||
{{- if and .Values.spark.jobNamespaces (not (has "" .Values.spark.jobNamespaces)) }}
|
||||
{{- range $jobNamespace := .Values.spark.jobNamespaces }}
|
||||
{{- if ne $jobNamespace $.Release.Namespace }}
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "spark-operator.webhook.roleName" $ }}
|
||||
namespace: {{ $jobNamespace }}
|
||||
labels:
|
||||
{{- include "spark-operator.webhook.labels" $ | nindent 4 }}
|
||||
{{- with $.Values.webhook.rbac.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{ include "spark-operator.webhook.policyRules" $ }}
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "spark-operator.webhook.roleBindingName" $ }}
|
||||
namespace: {{ $jobNamespace }}
|
||||
labels:
|
||||
{{- include "spark-operator.webhook.labels" $ | nindent 4 }}
|
||||
{{- with $.Values.webhook.rbac.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spark-operator.webhook.serviceAccountName" $ }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ include "spark-operator.webhook.roleName" $ }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,31 @@
|
||||
{{/*
|
||||
Copyright 2024 The Kubeflow authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
https://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/}}
|
||||
|
||||
{{- if .Values.webhook.enable }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "spark-operator.webhook.serviceName" . }}
|
||||
labels:
|
||||
{{- include "spark-operator.webhook.labels" . | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
{{- include "spark-operator.webhook.selectorLabels" . | nindent 4 }}
|
||||
ports:
|
||||
- port: {{ .Values.webhook.port }}
|
||||
targetPort: {{ .Values.webhook.portName | quote }}
|
||||
name: {{ .Values.webhook.portName }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,31 @@
|
||||
{{/*
|
||||
Copyright 2024 The Kubeflow authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
https://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/}}
|
||||
|
||||
{{- if .Values.webhook.enable }}
|
||||
{{- if .Values.webhook.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "spark-operator.webhook.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "spark-operator.webhook.labels" . | nindent 4 }}
|
||||
{{- with .Values.webhook.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
+89
@@ -0,0 +1,89 @@
|
||||
{{/*
|
||||
Copyright 2024 The Kubeflow authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
https://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/}}
|
||||
|
||||
{{- if .Values.webhook.enable }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: {{ include "spark-operator.webhook.name" . }}
|
||||
labels:
|
||||
{{- include "spark-operator.webhook.labels" . | nindent 4 }}
|
||||
webhooks:
|
||||
- name: validate-sparkoperator-k8s-io-v1beta2-sparkapplication.sparkoperator.k8s.io
|
||||
admissionReviewVersions: ["v1"]
|
||||
clientConfig:
|
||||
service:
|
||||
name: {{ include "spark-operator.webhook.serviceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
port: {{ .Values.webhook.port }}
|
||||
path: /validate-sparkoperator-k8s-io-v1beta2-sparkapplication
|
||||
sideEffects: NoneOnDryRun
|
||||
{{- with .Values.webhook.failurePolicy }}
|
||||
failurePolicy: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.spark.jobNamespaces }}
|
||||
{{- if not (has "" .) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/metadata.name
|
||||
operator: In
|
||||
values:
|
||||
{{- range $jobNamespace := . }}
|
||||
- {{ $jobNamespace }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups: ["sparkoperator.k8s.io"]
|
||||
apiVersions: ["v1beta2"]
|
||||
resources: ["sparkapplications"]
|
||||
operations: ["CREATE", "UPDATE"]
|
||||
{{- with .Values.webhook.timeoutSeconds }}
|
||||
timeoutSeconds: {{ . }}
|
||||
{{- end }}
|
||||
- name: validate-sparkoperator-k8s-io-v1beta2-scheduledsparkapplication.sparkoperator.k8s.io
|
||||
admissionReviewVersions: ["v1"]
|
||||
clientConfig:
|
||||
service:
|
||||
name: {{ include "spark-operator.webhook.serviceName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
port: {{ .Values.webhook.port }}
|
||||
path: /validate-sparkoperator-k8s-io-v1beta2-scheduledsparkapplication
|
||||
sideEffects: NoneOnDryRun
|
||||
{{- with .Values.webhook.failurePolicy }}
|
||||
failurePolicy: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.spark.jobNamespaces }}
|
||||
{{- if not (has "" .) }}
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/metadata.name
|
||||
operator: In
|
||||
values:
|
||||
{{- range $jobNamespace := . }}
|
||||
- {{ $jobNamespace }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups: ["sparkoperator.k8s.io"]
|
||||
apiVersions: ["v1beta2"]
|
||||
resources: ["scheduledsparkapplications"]
|
||||
operations: ["CREATE", "UPDATE"]
|
||||
{{- with .Values.webhook.timeoutSeconds }}
|
||||
timeoutSeconds: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user