kyverno 3.9.0 추가 — 자체 빌드 이미지 사용, 3.4.1 정리 (#57)
* kyverno 3.9.0(appVersion v1.19.0) 차트 추가 — 자체 빌드 이미지 사용 업스트림 이미지가 CVE 스캔 불가능한 베이스를 써서 자체 빌드로 대체한다(빌드 정의·근거는 hardened-containers). custom-values.yaml이 docker.io/paasup/* 7개 이미지를 가리키도록 고정했다. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * kyverno 3.4.1 삭제 3.9.0 추가 후 정리 --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
wbsong111
@@ -0,0 +1,31 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{- define "kyverno.test.labels" -}}
|
||||
{{- template "kyverno.labels.merge" (list
|
||||
(include "kyverno.labels.common" .)
|
||||
(include "kyverno.test.matchLabels" .)
|
||||
) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.test.matchLabels" -}}
|
||||
{{- template "kyverno.labels.merge" (list
|
||||
(include "kyverno.matchLabels.common" .)
|
||||
(include "kyverno.labels.component" "test")
|
||||
) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.test.annotations" -}}
|
||||
{{- $annotations := dict "helm.sh/hook" "test" -}}
|
||||
{{- with .Values.test.podAnnotations -}}
|
||||
{{- $annotations = merge $annotations . -}}
|
||||
{{- end -}}
|
||||
{{- toYaml $annotations -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.test.image" -}}
|
||||
{{- template "kyverno.image" (dict "image" .Values.test.image "defaultTag" "latest") -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.test.imagePullPolicy" -}}
|
||||
{{- default .Values.admissionController.container.image.pullPolicy .Values.test.image.pullPolicy -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,69 @@
|
||||
{{- if .Values.admissionController.enabled -}}
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: {{ template "kyverno.fullname" . }}-admission-controller-liveness
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.test.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- include "kyverno.test.annotations" . | nindent 4 }}
|
||||
spec:
|
||||
automountServiceAccountToken: {{ .Values.test.automountServiceAccountToken }}
|
||||
restartPolicy: Never
|
||||
{{- with .Values.test.imagePullSecrets | default .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: test
|
||||
image: {{ template "kyverno.test.image" . }}
|
||||
imagePullPolicy: {{ template "kyverno.test.imagePullPolicy" . }}
|
||||
{{- with .Values.test.resources }}
|
||||
resources:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.test.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
args:
|
||||
- check-http
|
||||
- --service-name={{ template "kyverno.admission-controller.serviceName" . }}
|
||||
- --namespace={{ template "kyverno.namespace" . }}
|
||||
- --port={{ .Values.admissionController.service.port }}
|
||||
- --path=health/liveness
|
||||
- --https
|
||||
{{- with .Values.test.nodeSelector | default .Values.global.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.test.tolerations | default .Values.global.tolerations}}
|
||||
tolerations:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if not .Values.test.automountServiceAccountToken }}
|
||||
volumes:
|
||||
- name: serviceaccount-token
|
||||
projected:
|
||||
defaultMode: 0444
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: {{ .Values.test.projectedServiceAccountToken.expirationSeconds | default 3600 }}
|
||||
path: token
|
||||
{{- with .Values.test.projectedServiceAccountToken.audience }}
|
||||
audience: {{ . }}
|
||||
{{- end }}
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: namespace
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,44 @@
|
||||
{{- if .Values.admissionController.metricsService.create -}}
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: {{ template "kyverno.fullname" . }}-admission-controller-metrics
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.test.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- include "kyverno.test.annotations" . | nindent 4 }}
|
||||
spec:
|
||||
automountServiceAccountToken: {{ .Values.test.automountServiceAccountToken }}
|
||||
restartPolicy: Never
|
||||
{{- with .Values.test.imagePullSecrets | default .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: test
|
||||
image: {{ template "kyverno.test.image" . }}
|
||||
imagePullPolicy: {{ template "kyverno.test.imagePullPolicy" . }}
|
||||
{{- with .Values.test.resources }}
|
||||
resources:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.test.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
args:
|
||||
- check-http
|
||||
- --service-name={{ template "kyverno.admission-controller.serviceName" . }}-metrics
|
||||
- --namespace={{ template "kyverno.namespace" . }}
|
||||
- --port={{ .Values.admissionController.metricsService.port }}
|
||||
- --path=metrics
|
||||
{{- with .Values.test.nodeSelector | default .Values.global.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.test.tolerations | default .Values.global.tolerations}}
|
||||
tolerations:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,69 @@
|
||||
{{- if .Values.admissionController.enabled -}}
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: {{ template "kyverno.fullname" . }}-admission-controller-readiness
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.test.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- include "kyverno.test.annotations" . | nindent 4 }}
|
||||
spec:
|
||||
automountServiceAccountToken: {{ .Values.test.automountServiceAccountToken }}
|
||||
restartPolicy: Never
|
||||
{{- with .Values.test.imagePullSecrets | default .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: test
|
||||
image: {{ template "kyverno.test.image" . }}
|
||||
imagePullPolicy: {{ template "kyverno.test.imagePullPolicy" . }}
|
||||
{{- with .Values.test.resources }}
|
||||
resources:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.test.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
args:
|
||||
- check-http
|
||||
- --service-name={{ template "kyverno.admission-controller.serviceName" . }}
|
||||
- --namespace={{ template "kyverno.namespace" . }}
|
||||
- --port={{ .Values.admissionController.service.port }}
|
||||
- --path=health/readiness
|
||||
- --https
|
||||
{{- with .Values.test.nodeSelector | default .Values.global.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.test.tolerations | default .Values.global.tolerations}}
|
||||
tolerations:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if not .Values.test.automountServiceAccountToken }}
|
||||
volumes:
|
||||
- name: serviceaccount-token
|
||||
projected:
|
||||
defaultMode: 0444
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: {{ .Values.test.projectedServiceAccountToken.expirationSeconds | default 3600 }}
|
||||
path: token
|
||||
{{- with .Values.test.projectedServiceAccountToken.audience }}
|
||||
audience: {{ . }}
|
||||
{{- end }}
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: namespace
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,45 @@
|
||||
{{- if .Values.cleanupController.enabled -}}
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: {{ template "kyverno.fullname" . }}-cleanup-controller-liveness
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.test.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- include "kyverno.test.annotations" . | nindent 4 }}
|
||||
spec:
|
||||
automountServiceAccountToken: {{ .Values.test.automountServiceAccountToken }}
|
||||
restartPolicy: Never
|
||||
{{- with .Values.test.imagePullSecrets | default .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: test
|
||||
image: {{ template "kyverno.test.image" . }}
|
||||
imagePullPolicy: {{ template "kyverno.test.imagePullPolicy" . }}
|
||||
{{- with .Values.test.resources }}
|
||||
resources:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.test.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
args:
|
||||
- check-http
|
||||
- --service-name={{ template "kyverno.cleanup-controller.name" . }}
|
||||
- --namespace={{ template "kyverno.namespace" . }}
|
||||
- --port={{ .Values.cleanupController.service.port }}
|
||||
- --path=health/liveness
|
||||
- --https
|
||||
{{- with .Values.test.nodeSelector | default .Values.global.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.test.tolerations | default .Values.global.tolerations}}
|
||||
tolerations:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,44 @@
|
||||
{{- if and .Values.cleanupController.enabled .Values.cleanupController.metricsService.create -}}
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: {{ template "kyverno.fullname" . }}-cleanup-controller-metrics
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.test.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- include "kyverno.test.annotations" . | nindent 4 }}
|
||||
spec:
|
||||
automountServiceAccountToken: {{ .Values.test.automountServiceAccountToken }}
|
||||
restartPolicy: Never
|
||||
{{- with .Values.test.imagePullSecrets | default .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: test
|
||||
image: {{ template "kyverno.test.image" . }}
|
||||
imagePullPolicy: {{ template "kyverno.test.imagePullPolicy" . }}
|
||||
{{- with .Values.test.resources }}
|
||||
resources:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.test.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
args:
|
||||
- check-http
|
||||
- --service-name={{ template "kyverno.cleanup-controller.name" . }}-metrics
|
||||
- --namespace={{ template "kyverno.namespace" . }}
|
||||
- --port={{ .Values.cleanupController.metricsService.port }}
|
||||
- --path=metrics
|
||||
{{- with .Values.test.nodeSelector | default .Values.global.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.test.tolerations | default .Values.global.tolerations}}
|
||||
tolerations:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,45 @@
|
||||
{{- if .Values.cleanupController.enabled -}}
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: {{ template "kyverno.fullname" . }}-cleanup-controller-readiness
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.test.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- include "kyverno.test.annotations" . | nindent 4 }}
|
||||
spec:
|
||||
automountServiceAccountToken: {{ .Values.test.automountServiceAccountToken }}
|
||||
restartPolicy: Never
|
||||
{{- with .Values.test.imagePullSecrets | default .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: test
|
||||
image: {{ template "kyverno.test.image" . }}
|
||||
imagePullPolicy: {{ template "kyverno.test.imagePullPolicy" . }}
|
||||
{{- with .Values.test.resources }}
|
||||
resources:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.test.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
args:
|
||||
- check-http
|
||||
- --service-name={{ template "kyverno.cleanup-controller.name" . }}
|
||||
- --namespace={{ template "kyverno.namespace" . }}
|
||||
- --port={{ .Values.cleanupController.service.port }}
|
||||
- --path=health/readiness
|
||||
- --https
|
||||
{{- with .Values.test.nodeSelector | default .Values.global.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.test.tolerations | default .Values.global.tolerations}}
|
||||
tolerations:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,25 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{- /* Test file for the sortedImagePullSecrets helper function */ -}}
|
||||
|
||||
{{- if .Values.unittest -}}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "kyverno.fullname" . }}-helper-functions-test
|
||||
labels:
|
||||
{{- include "kyverno.labels.common" . | nindent 4 }}
|
||||
app.kubernetes.io/component: test
|
||||
annotations:
|
||||
helm.sh/hook: test
|
||||
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
|
||||
data:
|
||||
empty: {{ include "kyverno.sortedImagePullSecrets" (list) }}
|
||||
single: |
|
||||
{{ include "kyverno.sortedImagePullSecrets" (list (dict "name" "registry-secret-a")) | indent 4 }}
|
||||
sorted: |
|
||||
{{ include "kyverno.sortedImagePullSecrets" (list (dict "name" "registry-secret-a") (dict "name" "registry-secret-b") (dict "name" "registry-secret-c")) | indent 4 }}
|
||||
reversed: |
|
||||
{{ include "kyverno.sortedImagePullSecrets" (list (dict "name" "registry-secret-c") (dict "name" "registry-secret-b") (dict "name" "registry-secret-a")) | indent 4 }}
|
||||
random: |
|
||||
{{ include "kyverno.sortedImagePullSecrets" (list (dict "name" "registry-secret-c") (dict "name" "registry-secret-a") (dict "name" "registry-secret-d") (dict "name" "registry-secret-b")) | indent 4 }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,44 @@
|
||||
{{- if and .Values.reportsController.enabled .Values.reportsController.metricsService.create -}}
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: {{ template "kyverno.fullname" . }}-reports-controller-metrics
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.test.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- include "kyverno.test.annotations" . | nindent 4 }}
|
||||
spec:
|
||||
automountServiceAccountToken: {{ .Values.test.automountServiceAccountToken }}
|
||||
restartPolicy: Never
|
||||
{{- with .Values.test.imagePullSecrets | default .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: test
|
||||
image: {{ template "kyverno.test.image" . }}
|
||||
imagePullPolicy: {{ template "kyverno.test.imagePullPolicy" . }}
|
||||
{{- with .Values.test.resources }}
|
||||
resources:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.test.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
args:
|
||||
- check-http
|
||||
- --service-name={{ template "kyverno.reports-controller.name" . }}-metrics
|
||||
- --namespace={{ template "kyverno.namespace" . }}
|
||||
- --port={{ .Values.reportsController.metricsService.port }}
|
||||
- --path=metrics
|
||||
{{- with .Values.test.nodeSelector | default .Values.global.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.test.tolerations | default .Values.global.tolerations}}
|
||||
tolerations:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
Reference in New Issue
Block a user