dip/service-catalog
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Add chart flink kubernetes operator 1.13.0

Browse Source
This commit is contained in:
wbsong111
2026-01-20 09:25:29 +09:00
parent 0436749932
commit 5f22ec053f
43 changed files with 14148 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
manifests/helm/flink-kubernetes-operator/1.13.0/templates/_helpers.tpl
+79
View File
@@ -0,0 +1,79 @@
{{- /*
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/ -}}
{{/*
Expand the name of the chart.
*/}}
{{- define "flink-operator.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "flink-operator.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "flink-operator.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Common labels
*/}}
{{- define "flink-operator.labels" -}}
{{ include "flink-operator.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
helm.sh/chart: {{ include "flink-operator.chart" . }}
{{- end }}
{{/*
Selector labels
*/}}
{{- define "flink-operator.selectorLabels" -}}
app.kubernetes.io/name: {{ include "flink-operator.name" . }}
{{- end }}
{{/*
Create the path of the operator image to use
*/}}
{{- define "flink-operator.imagePath" -}}
{{- if .Values.image.digest }}
{{- .Values.image.repository }}@{{ .Values.image.digest }}
{{- else }}
{{- .Values.image.repository }}:{{ default .Chart.AppVersion .Values.image.tag }}
{{- end }}
{{- end }}
manifests/helm/flink-kubernetes-operator/1.13.0/templates/cert-manager/certificate.yaml
+46
View File
@@ -0,0 +1,46 @@
{{- /*
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/ -}}
{{- if eq (include "flink-operator.webhook-enabled" .) "true" }}
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: flink-operator-serving-cert
namespace: {{ .Release.Namespace }}
spec:
dnsNames:
- flink-operator-webhook-service.{{ .Release.Namespace }}.svc
- flink-operator-webhook-service.{{ .Release.Namespace }}.svc.cluster.local
keystores:
pkcs12:
create: true
passwordSecretRef:
{{- if .Values.webhook.keystore.useDefaultPassword }}
name: flink-operator-webhook-secret
key: password
{{- else }}
{{- with .Values.webhook.keystore.passwordSecretRef }}
{{- toYaml . | nindent 8 }}
{{- end }}
{{- end }}
issuerRef:
kind: Issuer
name: flink-operator-selfsigned-issuer
commonName: FlinkDeployment Validator
secretName: webhook-server-cert
{{- end }}
manifests/helm/flink-kubernetes-operator/1.13.0/templates/cert-manager/issuer.yaml
+27
View File
@@ -0,0 +1,27 @@
{{- /*
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/ -}}
{{- if eq (include "flink-operator.webhook-enabled" .) "true" }}
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: flink-operator-selfsigned-issuer
namespace: {{ .Release.Namespace }}
spec:
selfSigned: {}
{{- end }}
manifests/helm/flink-kubernetes-operator/1.13.0/templates/controller/configmap.yaml
+68
View File
@@ -0,0 +1,68 @@
{{- /*
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/ -}}
{{- if .Values.defaultConfiguration.create }}
apiVersion: v1
kind: ConfigMap
metadata:
name: flink-operator-config
namespace: {{ .Release.Namespace }}
labels:
{{- include "flink-operator.labels" . | nindent 4 }}
data:
config.yaml: |+
{{- if .Values.defaultConfiguration.append }}
{{- $.Files.Get "conf/flink-conf.yaml" | nindent 4 -}}
{{- end }}
{{- if hasKey (.Values.defaultConfiguration) "config.yaml" }}
{{- index (.Values.defaultConfiguration) "config.yaml" | nindent 4 -}}
{{- end }}
{{- if .Values.watchNamespaces }}
kubernetes.operator.watched.namespaces: {{ join "," .Values.watchNamespaces }}
{{- end }}
{{- if index .Values "operatorHealth" }}
kubernetes.operator.health.probe.enabled: true
kubernetes.operator.health.probe.port: {{ .Values.operatorHealth.port }}
{{- end }}
flink-conf.yaml: |+
{{- if .Values.defaultConfiguration.append }}
{{- $.Files.Get "conf/flink-conf.yaml" | nindent 4 -}}
{{- end }}
{{- if hasKey (.Values.defaultConfiguration) "flink-conf.yaml" }}
{{- index (.Values.defaultConfiguration) "flink-conf.yaml" | nindent 4 -}}
{{- end }}
{{- if .Values.watchNamespaces }}
kubernetes.operator.watched.namespaces: {{ join "," .Values.watchNamespaces }}
{{- end }}
{{- if index .Values "operatorHealth" }}
kubernetes.operator.health.probe.enabled: true
kubernetes.operator.health.probe.port: {{ .Values.operatorHealth.port }}
{{- end }}
log4j-operator.properties: |+
{{- if .Values.defaultConfiguration.append }}
{{- $.Files.Get "conf/log4j-operator.properties" | nindent 4 -}}
{{- end }}
{{- if index (.Values.defaultConfiguration) "log4j-operator.properties" }}
{{- index (.Values.defaultConfiguration) "log4j-operator.properties" | nindent 4 -}}
{{- end }}
log4j-console.properties: |+
{{- if .Values.defaultConfiguration.append }}
{{- $.Files.Get "conf/log4j-console.properties" | nindent 4 -}}
{{- end }}
{{- if index (.Values.defaultConfiguration) "log4j-console.properties" }}
{{- index (.Values.defaultConfiguration) "log4j-console.properties" | nindent 4 -}}
{{- end }}
{{- end }}
manifests/helm/flink-kubernetes-operator/1.13.0/templates/controller/deployment.yaml
+273
View File
@@ -0,0 +1,273 @@
{{- /*
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/ -}}
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "flink-operator.name" . }}
namespace: {{ .Release.Namespace }}
labels:
{{- include "flink-operator.labels" . | nindent 4 }}
{{- if index (.Values.operatorPod) "labels" }}
{{- with .Values.operatorPod.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}
spec:
replicas: {{ .Values.replicas }}
strategy:
{{- toYaml .Values.strategy | nindent 4 }}
selector:
matchLabels:
{{- include "flink-operator.selectorLabels" . | nindent 6 }}
template:
metadata:
labels:
{{- include "flink-operator.selectorLabels" . | nindent 8 }}
{{- if index (.Values.operatorPod) "labels" }}
{{- with .Values.operatorPod.labels }}
{{- toYaml . | nindent 8 }}
{{- end }}
{{- end }}
annotations:
kubectl.kubernetes.io/default-container: {{ .Chart.Name }}
{{- if index (.Values.operatorPod) "annotations" }}
{{- with .Values.operatorPod.annotations }}
{{- toYaml . | nindent 8 }}
{{- end }}
{{- end }}
spec:
{{- with .Values.operatorPod.priorityClassName }}
priorityClassName: {{ . }}
{{- end }}
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
{{- if .Values.operatorPod.nodeSelector }}
nodeSelector: {{ toYaml .Values.operatorPod.nodeSelector | nindent 8 }}
{{- end }}
{{- if .Values.operatorPod.affinity }}
affinity: {{ toYaml .Values.operatorPod.affinity | nindent 8 }}
{{- end }}
{{- with .Values.operatorPod.tolerations }}
tolerations:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
serviceAccountName: {{ include "flink-operator.serviceAccountName" . }}
{{- if .Values.operatorPod.topologySpreadConstraints }}
topologySpreadConstraints: {{ toYaml .Values.operatorPod.topologySpreadConstraints | nindent 8 }}
{{- end }}
{{- if .Values.operatorPod.initContainers }}
initContainers:
{{- toYaml .Values.operatorPod.initContainers | nindent 8 }}
{{- end }}
containers:
- name: {{ .Chart.Name }}
image: {{ include "flink-operator.imagePath" . }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
command: ["/docker-entrypoint.sh", "operator"]
ports:
{{- if .Values.metrics.port }}
- containerPort: {{ .Values.metrics.port }}
name: metrics
protocol: TCP
{{- end }}
{{- if index .Values "operatorHealth" }}
- containerPort: {{ .Values.operatorHealth.port }}
name: health-port
protocol: TCP
{{- end }}
env:
- name: OPERATOR_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: HOST_IP
valueFrom:
fieldRef:
fieldPath: status.hostIP
- name: POD_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: OPERATOR_NAME
value: {{ include "flink-operator.name" . }}
- name: FLINK_CONF_DIR
value: /opt/flink/conf
- name: FLINK_PLUGINS_DIR
value: /opt/flink/plugins
- name: LOG_CONFIG
value: {{ .Values.jvmArgs.logConfig }}
- name: JVM_ARGS
value: {{ .Values.jvmArgs.operator }}
{{- if .Values.tls.create }}
- name: OPERATOR_KEYSTORE_PATH
value: /opt/flink/tls-cert/keystore.jks
- name: OPERATOR_TRUSTSTORE_PATH
value: /opt/flink/tls-cert/truststore.jks
- name: OPERATOR_KEYSTORE_PASSWORD
valueFrom:
secretKeyRef:
{{- toYaml .Values.tls.secretKeyRef | nindent 18 }}
optional: true
{{- end }}
{{- with .Values.operatorPod.env }}
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.operatorPod.envFrom }}
envFrom:
{{- toYaml . | nindent 12 }}
{{- end }}
resources:
{{- toYaml .Values.operatorPod.resources | nindent 12 }}
securityContext:
{{- toYaml .Values.operatorSecurityContext | nindent 12 }}
volumeMounts:
- name: flink-operator-config-volume
mountPath: /opt/flink/conf
{{- if .Values.operatorVolumeMounts.create }}
{{- toYaml .Values.operatorVolumeMounts.data | nindent 12 }}
{{- else }}
- name: flink-artifacts-volume
mountPath: /opt/flink/artifacts
{{- end }}
{{- if .Values.tls.create }}
- name: flink-operator-cert-secret
mountPath: /opt/flink/tls-cert
{{- end }}
{{- if and (index .Values "operatorHealth") (index .Values.operatorHealth "livenessProbe") }}
livenessProbe:
{{- toYaml .Values.operatorHealth.livenessProbe | nindent 12 }}
httpGet:
path: /
port: health-port
{{- end }}
{{- if and (index .Values "operatorHealth") (index .Values.operatorHealth "startupProbe") }}
startupProbe:
{{- toYaml .Values.operatorHealth.startupProbe | nindent 12 }}
httpGet:
path: /
port: health-port
{{- end }}
{{- if .Values.postStart }}
lifecycle:
postStart:
{{- toYaml .Values.postStart | nindent 14 }}
{{- end }}
{{- if eq (include "flink-operator.webhook-enabled" .) "true" }}
- name: flink-webhook
image: {{ include "flink-operator.imagePath" . }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
command: ["/docker-entrypoint.sh", "webhook"]
env:
- name: WEBHOOK_KEYSTORE_PASSWORD
valueFrom:
secretKeyRef:
{{- if .Values.webhook.keystore.useDefaultPassword }}
name: flink-operator-webhook-secret
key: password
{{- else }}
{{- with .Values.webhook.keystore.passwordSecretRef }}
{{- toYaml . | nindent 18 }}
{{- end }}
{{- end }}
- name: WEBHOOK_KEYSTORE_FILE
value: "/certs/keystore.p12"
- name: WEBHOOK_KEYSTORE_TYPE
value: "pkcs12"
- name: WEBHOOK_SERVER_PORT
value: "9443"
- name: LOG_CONFIG
value: {{ .Values.jvmArgs.logConfig }}
- name: JVM_ARGS
value: {{ .Values.jvmArgs.webhook }}
- name: FLINK_CONF_DIR
value: /opt/flink/conf
- name: FLINK_PLUGINS_DIR
value: /opt/flink/plugins
- name: OPERATOR_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
{{- with .Values.operatorPod.webhook.container.env }}
{{- toYaml . | nindent 12 }}
{{- end }}
resources:
{{- toYaml .Values.operatorPod.webhook.resources | nindent 12 }}
securityContext:
{{- toYaml .Values.webhookSecurityContext | nindent 12 }}
volumeMounts:
- name: keystore
mountPath: "/certs"
readOnly: true
- name: flink-operator-config-volume
mountPath: /opt/flink/conf
{{- end }}
{{- if .Values.operatorPod.sidecarContainers }}
{{- toYaml .Values.operatorPod.sidecarContainers | nindent 8 }}
{{- end }}
{{- if index (.Values.operatorPod) "dnsPolicy" }}
dnsPolicy: {{ .Values.operatorPod.dnsPolicy | quote }}
{{- end }}
{{- if index (.Values.operatorPod) "dnsConfig" }}
dnsConfig:
{{- with .Values.operatorPod.dnsConfig }}
{{- toYaml . | nindent 8 }}
{{- end }}
{{- end }}
volumes:
- name: flink-operator-config-volume
configMap:
name: flink-operator-config
items:
{{- if hasKey .Values.defaultConfiguration "flink-conf.yaml" }}
- key: flink-conf.yaml
path: flink-conf.yaml
{{- else }}
- key: config.yaml
path: config.yaml
{{- end }}
- key: log4j-operator.properties
path: log4j-operator.properties
- key: log4j-console.properties
path: log4j-console.properties
{{- if .Values.operatorVolumes.create }}
{{- toYaml .Values.operatorVolumes.data | nindent 8 }}
{{- else }}
- name: flink-artifacts-volume
emptyDir: {}
{{- end }}
{{- if eq (include "flink-operator.webhook-enabled" .) "true" }}
- name: keystore
secret:
secretName: webhook-server-cert
items:
- key: keystore.p12
path: keystore.p12
{{- end }}
{{- if .Values.tls.create }}
- name: flink-operator-cert-secret
secret:
secretName: {{ .Values.tls.secretName }}
optional: true
{{- end }}
manifests/helm/flink-kubernetes-operator/1.13.0/templates/flink/_helpers.tpl
+50
View File
@@ -0,0 +1,50 @@
{{- /*
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/ -}}
{{/*
Create the name of the job service account to use
*/}}
{{- define "flink-operator.jobServiceAccountName" -}}
{{- if .Values.jobServiceAccount.create }}
{{- default (include "flink-operator.fullname" .) .Values.jobServiceAccount.name }}
{{- else }}
{{- default "default" .Values.jobServiceAccount.name }}
{{- end }}
{{- end }}
{{/*
Create the name of the job role to use
*/}}
{{- define "flink-operator.jobRoleName" -}}
{{- if .Values.rbac.jobRoleBinding.create }}
{{- default (include "flink-operator.fullname" .) .Values.rbac.jobRole.name }}
{{- else }}
{{- default "default" .Values.rbac.jobRole.name }}
{{- end }}
{{- end }}
{{/*
Create the name of the job role to use
*/}}
{{- define "flink-operator.jobRoleBindingName" -}}
{{- if .Values.rbac.jobRole.create }}
{{- default (include "flink-operator.fullname" .) .Values.rbac.jobRoleBinding.name }}
{{- else }}
{{- default "default" .Values.rbac.jobRoleBinding.name }}
{{- end }}
{{- end }}
manifests/helm/flink-kubernetes-operator/1.13.0/templates/flink/role.yaml
+46
View File
@@ -0,0 +1,46 @@
{{- /*
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/ -}}
{{- if and .Values.rbac.create .Values.rbac.jobRole.create }}
{{- if .Values.watchNamespaces }}
{{- range .Values.watchNamespaces }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ include "flink-operator.jobRoleName" $ }}
namespace: {{ . }}
labels:
{{- include "flink-operator.labels" $ | nindent 4 }}
annotations:
"helm.sh/resource-policy": keep
{{- template "flink-operator.jobRbacRules" $ }}
{{- end }}
{{- else }}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ include "flink-operator.jobRoleName" $ }}
namespace: {{ .Release.Namespace }}
labels:
{{- include "flink-operator.labels" . | nindent 4 }}
annotations:
"helm.sh/resource-policy": keep
{{- template "flink-operator.jobRbacRules" $ }}
{{- end }}
{{- end }}
manifests/helm/flink-kubernetes-operator/1.13.0/templates/flink/role_binding.yaml
+60
View File
@@ -0,0 +1,60 @@
{{- /*
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/ -}}
{{- if and .Values.rbac.create .Values.rbac.jobRoleBinding.create }}
{{- if .Values.watchNamespaces }}
{{- range .Values.watchNamespaces }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ include "flink-operator.jobRoleBindingName" $ }}
namespace: {{ . }}
labels:
{{- include "flink-operator.labels" $ | nindent 4 }}
annotations:
"helm.sh/resource-policy": keep
roleRef:
kind: {{ $role := include "flink-operator.jobRoleName" $ }}{{ include "flink-operator.roleScope" (dict "role" $role)}}
name: {{ include "flink-operator.jobRoleName" $ }}
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
name: {{ include "flink-operator.jobServiceAccountName" $ }}
namespace: {{ . }}
{{- end }}
{{- else }}
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ include "flink-operator.jobRoleBindingName" $ }}
namespace: {{ .Release.Namespace }}
labels:
{{- include "flink-operator.labels" . | nindent 4 }}
annotations:
"helm.sh/resource-policy": keep
roleRef:
kind: Role
name: {{ include "flink-operator.jobRoleName" $ }}
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
name: {{ include "flink-operator.jobServiceAccountName" . }}
namespace: {{ .Release.Namespace }}
{{- end }}
{{- end }}
manifests/helm/flink-kubernetes-operator/1.13.0/templates/flink/service_account.yaml
+53
View File
@@ -0,0 +1,53 @@
{{- /*
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/ -}}
{{- if .Values.jobServiceAccount.create -}}
{{- /* Create job service accounts for all watched namespaces. */ -}}
{{- if .Values.watchNamespaces }}
{{- range .Values.watchNamespaces }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "flink-operator.jobServiceAccountName" $ }}
namespace: {{ . }}
labels:
{{- include "flink-operator.labels" $ | nindent 4 }}
{{- with $.Values.jobServiceAccount.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
---
{{- end }}
{{- /*
Create the job service account for the operator namespace, it is to be added for other namespaces manually
(or via specifying them in watchNamespaces).
*/ -}}
{{- else }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "flink-operator.jobServiceAccountName" $ }}
namespace: {{ .Release.Namespace }}
labels:
{{- include "flink-operator.labels" $ | nindent 4 }}
{{- with .Values.jobServiceAccount.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}
{{- end }}
manifests/helm/flink-kubernetes-operator/1.13.0/templates/rbac/_helpers.tpl
+212
View File
@@ -0,0 +1,212 @@
{{- /*
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/ -}}
{{/*
Create the name of the operator service account to use
*/}}
{{- define "flink-operator.serviceAccountName" -}}
{{- if .Values.operatorServiceAccount.create }}
{{- default (include "flink-operator.fullname" .) .Values.operatorServiceAccount.name }}
{{- else }}
{{- default "default" .Values.operatorServiceAccount.name }}
{{- end }}
{{- end }}
{{/*
Determine role scope based on name
*/}}
{{- define "flink-operator.roleScope" -}}
{{- if contains ":" .role }}
{{- printf "ClusterRole" }}
{{- else }}
{{- printf "Role" }}
{{- end }}
{{- end }}
{{/*
Create the name of the operator role to use
*/}}
{{- define "flink-operator.roleName" -}}
{{- if .Values.rbac.operatorRole.create }}
{{- default (include "flink-operator.fullname" .) .Values.rbac.operatorRole.name }}
{{- else }}
{{- default "default" .Values.rbac.operatorRole.name }}
{{- end }}
{{- end }}
{{/*
Create the name of the operator role binding to use
*/}}
{{- define "flink-operator.roleBindingName" -}}
{{- if .Values.rbac.operatorRoleBinding.create }}
{{- default (include "flink-operator.fullname" .) .Values.rbac.operatorRoleBinding.name }}
{{- else }}
{{- default "default" .Values.rbac.operatorRoleBinding.name }}
{{- end }}
{{- end }}
{{/*
RBAC rules used to create the operator (cluster)role based on the scope
*/}}
{{- define "flink-operator.rbacRules" }}
rules:
- apiGroups:
- ""
resources:
- pods
- services
- events
- configmaps
- secrets
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- deletecollection
{{- if .Values.rbac.nodesRule.create }}
- apiGroups:
- ""
resources:
- nodes
verbs:
- list
{{- end }}
- apiGroups:
- apps
resources:
- deployments
- deployments/finalizers
- replicasets
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- apps
resources:
- deployments/scale
verbs:
- get
- update
- patch
- apiGroups:
- extensions
resources:
- deployments
- ingresses
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- flink.apache.org
resources:
- flinkdeployments
- flinkdeployments/finalizers
- flinksessionjobs
- flinksessionjobs/finalizers
- flinkstatesnapshots
- flinkstatesnapshots/finalizers
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- flink.apache.org
resources:
- flinkdeployments/status
- flinksessionjobs/status
- flinkstatesnapshots/status
verbs:
- get
- update
- patch
- apiGroups:
- networking.k8s.io
resources:
- ingresses
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
{{- end }}
{{/*
RBAC rules used to create the job (cluster)role based on the scope
*/}}
{{- define "flink-operator.jobRbacRules" }}
rules:
- apiGroups:
- ""
resources:
- pods
- configmaps
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- apps
resources:
- deployments
- deployments/finalizers
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
{{- end }}
manifests/helm/flink-kubernetes-operator/1.13.0/templates/rbac/cluster_role.yaml
+30
View File
@@ -0,0 +1,30 @@
{{- /*
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/ -}}
{{- if and .Values.rbac.create .Values.rbac.operatorRole.create }}
{{- if not .Values.watchNamespaces }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ include "flink-operator.roleName" $ }}
namespace: {{ .Release.Namespace }}
labels:
{{- include "flink-operator.labels" . | nindent 4 }}
{{- template "flink-operator.rbacRules" $ }}
{{- end }}
{{- end }}
manifests/helm/flink-kubernetes-operator/1.13.0/templates/rbac/cluster_role_binding.yaml
+37
View File
@@ -0,0 +1,37 @@
{{- /*
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/ -}}
{{- if and .Values.rbac.create .Values.rbac.operatorRoleBinding.create }}
{{- if not .Values.watchNamespaces }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: {{ include "flink-operator.roleBindingName" $ }}
namespace: {{ .Release.Namespace }}
labels:
{{- include "flink-operator.labels" . | nindent 4 }}
roleRef:
kind: ClusterRole
name: {{ include "flink-operator.roleName" $ }}
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
name: {{ include "flink-operator.serviceAccountName" . }}
namespace: {{ .Release.Namespace }}
{{- end }}
{{- end }}
manifests/helm/flink-kubernetes-operator/1.13.0/templates/rbac/role.yaml
+58
View File
@@ -0,0 +1,58 @@
{{- /*
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/ -}}
{{- if and .Values.rbac.create .Values.rbac.operatorRole.create }}
{{- /* Namespaced scoped RBAC. */ -}}
{{- if .Values.watchNamespaces }}
{{- range .Values.watchNamespaces }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ include "flink-operator.roleName" $ }}
namespace: {{ . }}
labels:
{{- include "flink-operator.labels" $ | nindent 4 }}
{{- template "flink-operator.rbacRules" $ }}
{{- end }}
{{- /* Give operator the ability to operate on leases in the release namespace */ -}}
{{- if not (has .Release.Namespace .Values.watchNamespaces) }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ include "flink-operator.roleName" $ }}
namespace: {{ .Release.Namespace }}
labels:
{{- include "flink-operator.labels" . | nindent 4 }}
rules:
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
{{- end }}
{{- end }}
{{- end }}
manifests/helm/flink-kubernetes-operator/1.13.0/templates/rbac/role_binding.yaml
+60
View File
@@ -0,0 +1,60 @@
{{- /*
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/ -}}
{{- if and .Values.rbac.create .Values.rbac.operatorRoleBinding.create }}
{{- /* Namespaced scoped RBAC. */ -}}
{{- if .Values.watchNamespaces }}
{{- range .Values.watchNamespaces }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ include "flink-operator.roleBindingName" $ }}
namespace: {{ . }}
labels:
{{- include "flink-operator.labels" $ | nindent 4 }}
roleRef:
kind: {{ $role := include "flink-operator.roleName" $ }}{{ include "flink-operator.roleScope" (dict "role" $role)}}
name: {{ include "flink-operator.roleName" $ }}
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
name: {{ include "flink-operator.serviceAccountName" $ }}
namespace: {{ $.Release.Namespace }}
{{- end }}
{{- /* Give operator the ability to operate on leases in the release namespace */ -}}
{{- if not (has .Release.Namespace .Values.watchNamespaces) }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ include "flink-operator.roleBindingName" $ }}
namespace: {{ .Release.Namespace }}
labels:
{{- include "flink-operator.labels" $ | nindent 4 }}
roleRef:
kind: Role
name: {{ include "flink-operator.roleName" $ }}
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
name: {{ include "flink-operator.serviceAccountName" . }}
namespace: {{ .Release.Namespace }}
{{- end }}
{{- end }}
{{- end }}
manifests/helm/flink-kubernetes-operator/1.13.0/templates/rbac/service_account.yaml
+29
View File
@@ -0,0 +1,29 @@
{{- /*
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/ -}}
{{- if .Values.operatorServiceAccount.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "flink-operator.serviceAccountName" . }}
namespace: {{ .Release.Namespace }}
labels:
{{- include "flink-operator.labels" . | nindent 4 }}
{{- with .Values.operatorServiceAccount.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}
manifests/helm/flink-kubernetes-operator/1.13.0/templates/webhook/_helpers.tpl
+57
View File
@@ -0,0 +1,57 @@
{{- /*
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/ -}}
{{- define "flink-operator.webhook-enabled" -}}
{{- if or (eq (include "flink-operator.validating-webhook-enabled" .) "true") (eq (include "flink-operator.mutating-webhook-enabled" .) "true") }}
{{- printf "true" }}
{{- else }}
{{- printf "false" }}
{{- end }}
{{- end }}
{{- define "flink-operator.validating-webhook-enabled" -}}
{{- if hasKey .Values.webhook "validator" }}
{{- if .Values.webhook.validator.create }}
{{- printf "true" }}
{{- else }}
{{- printf "false" }}
{{- end }}
{{- else }}
{{- if or (.Values.webhook.create) }}
{{- printf "true" }}
{{- else }}
{{- printf "false" }}
{{- end }}
{{- end }}
{{- end }}
{{- define "flink-operator.mutating-webhook-enabled" -}}
{{- if hasKey .Values.webhook "mutator" }}
{{- if .Values.webhook.mutator.create }}
{{- printf "true" }}
{{- else }}
{{- printf "false" }}
{{- end }}
{{- else }}
{{- if or (.Values.webhook.create) }}
{{- printf "true" }}
{{- else }}
{{- printf "false" }}
{{- end }}
{{- end }}
{{- end }}
manifests/helm/flink-kubernetes-operator/1.13.0/templates/webhook/mutating_webhook_configuration.yaml
+55
View File
@@ -0,0 +1,55 @@
{{- /*
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/ -}}
{{- if eq (include "flink-operator.webhook-enabled" .) "true" }}
{{- if eq (include "flink-operator.mutating-webhook-enabled" .) "true" }}
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
annotations:
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/flink-operator-serving-cert
name: flink-operator-{{ .Release.Namespace }}-webhook-configuration
webhooks:
- name: mutationwebhook.flink.apache.org
admissionReviewVersions: ["v1"]
clientConfig:
service:
name: flink-operator-webhook-service
namespace: {{ .Release.Namespace }}
path: /mutate
failurePolicy: Fail
rules:
- apiGroups: ["flink.apache.org"]
apiVersions: ["*"]
scope: "Namespaced"
operations:
- CREATE
- UPDATE
resources:
- flinksessionjobs
- flinkdeployments
sideEffects: None
{{- if .Values.watchNamespaces }}
namespaceSelector:
matchExpressions:
- key: kubernetes.io/metadata.name
operator: In
values: [{{- range .Values.watchNamespaces }}{{ . | quote }},{{- end}}]
{{- end }}
{{- end }}
{{- end }}
manifests/helm/flink-kubernetes-operator/1.13.0/templates/webhook/secret.yaml
+30
View File
@@ -0,0 +1,30 @@
{{- /*
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/ -}}
{{- if eq (include "flink-operator.webhook-enabled" .) "true" }}
{{- if .Values.webhook.keystore.useDefaultPassword }}
apiVersion: v1
kind: Secret
metadata:
name: flink-operator-webhook-secret
namespace: {{ .Release.Namespace }}
type: Opaque
data:
password: cGFzc3dvcmQxMjM0
{{- end }}
{{- end }}
manifests/helm/flink-kubernetes-operator/1.13.0/templates/webhook/service.yaml
+37
View File
@@ -0,0 +1,37 @@
{{- /*
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/ -}}
{{- if eq (include "flink-operator.webhook-enabled" .) "true" }}
apiVersion: v1
kind: Service
metadata:
name: flink-operator-webhook-service
namespace: {{ .Release.Namespace }}
{{- if .Values.webhook.serviceLabels }}
labels:
{{- range $key, $value := .Values.webhook.serviceLabels }}
{{ $key }}: {{ $value }}
{{- end }}
{{- end }}
spec:
ports:
- port: 443
targetPort: 9443
selector:
app.kubernetes.io/name: {{ include "flink-operator.name" . }}
{{- end }}
manifests/helm/flink-kubernetes-operator/1.13.0/templates/webhook/validating_webhook_configuration.yaml
+56
View File
@@ -0,0 +1,56 @@
{{- /*
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/ -}}
{{- if eq (include "flink-operator.webhook-enabled" .) "true" }}
{{- if eq (include "flink-operator.validating-webhook-enabled" .) "true" }}
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
annotations:
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/flink-operator-serving-cert
name: flink-operator-{{ .Release.Namespace }}-webhook-configuration
webhooks:
- name: validationwebhook.flink.apache.org
admissionReviewVersions: ["v1"]
clientConfig:
service:
name: flink-operator-webhook-service
namespace: {{ .Release.Namespace }}
path: /validate
failurePolicy: Fail
rules:
- apiGroups: ["flink.apache.org"]
apiVersions: ["*"]
scope: "Namespaced"
operations:
- CREATE
- UPDATE
resources:
- flinkdeployments
- flinksessionjobs
- flinkstatesnapshots
sideEffects: None
{{- if .Values.watchNamespaces }}
namespaceSelector:
matchExpressions:
- key: kubernetes.io/metadata.name
operator: In
values: [{{- range .Values.watchNamespaces }}{{ . | quote }},{{- end}}]
{{- end }}
{{- end }}
{{- end }}