dip/service-catalog
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Add kyverno chart 3.4.1

Browse Source
This commit is contained in:
wbsong111
2025-05-13 11:54:58 +09:00
parent 459425ba58
commit af45031108
114 changed files with 65061 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/kyverno/templates/hooks/_helpers.tpl
+15
View File
@@ -0,0 +1,15 @@
{{/* vim: set filetype=mustache: */}}
{{- define "kyverno.hooks.labels" -}}
{{- template "kyverno.labels.merge" (list
(include "kyverno.labels.common" .)
(include "kyverno.hooks.matchLabels" .)
) -}}
{{- end -}}
{{- define "kyverno.hooks.matchLabels" -}}
{{- template "kyverno.labels.merge" (list
(include "kyverno.matchLabels.common" .)
(include "kyverno.labels.component" "hooks")
) -}}
{{- end -}}
charts/kyverno/templates/hooks/post-delete-configmap.yaml
+132
View File
@@ -0,0 +1,132 @@
{{- if .Values.config.preserve -}}
{{- if not .Values.templating.enabled -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ template "kyverno.fullname" . }}:remove-configmap
namespace: {{ template "kyverno.namespace" . }}
labels:
{{- include "kyverno.hooks.labels" . | nindent 4 }}
annotations:
helm.sh/hook: post-delete
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
helm.sh/hook-weight: "0"
rules:
- apiGroups:
- ""
resources:
- configmaps
verbs:
- list
- get
- delete
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ template "kyverno.fullname" . }}:remove-configmap
namespace: {{ template "kyverno.namespace" . }}
labels:
{{- include "kyverno.hooks.labels" . | nindent 4 }}
annotations:
helm.sh/hook: post-delete
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
helm.sh/hook-weight: "0"
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ template "kyverno.fullname" . }}:remove-configmap
subjects:
- kind: ServiceAccount
name: {{ template "kyverno.fullname" . }}-remove-configmap
namespace: {{ template "kyverno.namespace" . }}
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ template "kyverno.fullname" . }}-remove-configmap
namespace: {{ template "kyverno.namespace" . }}
labels:
{{- include "kyverno.hooks.labels" . | nindent 4 }}
annotations:
helm.sh/hook: post-delete
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
helm.sh/hook-weight: "0"
---
apiVersion: batch/v1
kind: Job
metadata:
name: {{ template "kyverno.fullname" . }}-remove-configmap
namespace: {{ template "kyverno.namespace" . }}
labels:
{{- include "kyverno.hooks.labels" . | nindent 4 }}
annotations:
helm.sh/hook: post-delete
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
helm.sh/hook-weight: "10"
spec:
backoffLimit: 2
template:
metadata:
{{- with .Values.webhooksCleanup.podAnnotations }}
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.webhooksCleanup.podLabels }}
labels:
{{- toYaml . | nindent 8 }}
{{- end }}
spec:
serviceAccountName: {{ template "kyverno.fullname" . }}-remove-configmap
{{- with .Values.webhooksCleanup.podSecurityContext }}
securityContext:
{{- tpl (toYaml .) $ | nindent 8 }}
{{- end }}
restartPolicy: Never
{{- with .Values.webhooksCleanup.imagePullSecrets | default .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- tpl (toYaml .) $ | nindent 8 }}
{{- end }}
containers:
- name: kubectl
image: {{ (include "kyverno.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.webhooksCleanup.image "defaultTag" (default .Chart.AppVersion .Values.webhooksCleanup.image.tag))) | quote }}
imagePullPolicy: {{ .Values.webhooksCleanup.image.pullPolicy }}
command:
- /bin/bash
- '-c'
- |-
set -euo pipefail
kubectl delete cm --ignore-not-found -n {{ template "kyverno.namespace" . }} {{ template "kyverno.config.configMapName" . }}
{{- with .Values.webhooksCleanup.securityContext }}
securityContext:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.webhooksCleanup.resources }}
resources:
{{- tpl (toYaml .) $ | nindent 12 }}
{{- end }}
{{- with .Values.webhooksCleanup.tolerations | default .Values.global.tolerations }}
tolerations:
{{- tpl (toYaml .) $ | nindent 8 }}
{{- end }}
{{- with .Values.webhooksCleanup.nodeSelector | default .Values.global.nodeSelector }}
nodeSelector:
{{- tpl (toYaml .) $ | nindent 8 }}
{{- end }}
{{- if or .Values.webhooksCleanup.podAntiAffinity .Values.webhooksCleanup.podAffinity .Values.webhooksCleanup.nodeAffinity }}
affinity:
{{- with .Values.webhooksCleanup.podAntiAffinity }}
podAntiAffinity:
{{- tpl (toYaml .) $ | nindent 10 }}
{{- end }}
{{- with .Values.webhooksCleanup.podAffinity }}
podAffinity:
{{- tpl (toYaml .) $ | nindent 10 }}
{{- end }}
{{- with .Values.webhooksCleanup.nodeAffinity }}
nodeAffinity:
{{- tpl (toYaml .) $ | nindent 10 }}
{{- end }}
{{- end }}
{{- end -}}
{{- end -}}
charts/kyverno/templates/hooks/post-upgrade-clean-reports.yaml
+99
View File
@@ -0,0 +1,99 @@
{{- if .Values.policyReportsCleanup.enabled -}}
{{- if not .Values.templating.enabled -}}
apiVersion: batch/v1
kind: Job
metadata:
name: {{ template "kyverno.fullname" . }}-clean-reports
namespace: {{ template "kyverno.namespace" . }}
labels:
{{- include "kyverno.hooks.labels" . | nindent 4 }}
annotations:
helm.sh/hook: post-upgrade
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
spec:
backoffLimit: 2
template:
metadata:
{{- with .Values.policyReportsCleanup.podAnnotations }}
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.policyReportsCleanup.podLabels }}
labels:
{{- toYaml . | nindent 8 }}
{{- end }}
spec:
serviceAccountName: {{ template "kyverno.admission-controller.serviceAccountName" . }}
{{- with .Values.policyReportsCleanup.podSecurityContext }}
securityContext:
{{- tpl (toYaml .) $ | nindent 8 }}
{{- end }}
restartPolicy: Never
containers:
- name: kubectl
image: {{ (include "kyverno.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.policyReportsCleanup.image "defaultTag" (default .Chart.AppVersion .Values.policyReportsCleanup.image.tag))) | quote }}
imagePullPolicy: {{ .Values.policyReportsCleanup.image.pullPolicy }}
command:
- /bin/bash
- -c
- |
set -euo pipefail
NAMESPACES=$(kubectl get namespaces --no-headers=true | awk '{print $1}')
for ns in ${NAMESPACES[@]};
do
COUNT=$(kubectl get policyreports.wgpolicyk8s.io -n $ns --no-headers=true | awk '/pol/{print $1}' | wc -l)
if [ $COUNT -gt 0 ]; then
echo "deleting $COUNT policyreports in namespace $ns"
kubectl get policyreports.wgpolicyk8s.io -n $ns --no-headers=true | awk '/pol/{print $1}' | xargs kubectl delete -n $ns policyreports.wgpolicyk8s.io
else
echo "no policyreports in namespace $ns"
fi
done
COUNT=$(kubectl get clusterpolicyreports.wgpolicyk8s.io --no-headers=true | awk '/pol/{print $1}' | wc -l)
if [ $COUNT -gt 0 ]; then
echo "deleting $COUNT clusterpolicyreports"
kubectl get clusterpolicyreports.wgpolicyk8s.io --no-headers=true | awk '/pol/{print $1}' | xargs kubectl delete clusterpolicyreports.wgpolicyk8s.io
else
echo "no clusterpolicyreports"
fi
{{- with .Values.policyReportsCleanup.resources }}
resources:
{{- tpl (toYaml .) $ | nindent 12 }}
{{- end }}
{{- with .Values.policyReportsCleanup.securityContext }}
securityContext:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.policyReportsCleanup.imagePullSecrets | default .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- tpl (toYaml .) $ | nindent 8 }}
{{- end }}
{{- with .Values.policyReportsCleanup.tolerations | default .Values.global.tolerations}}
tolerations:
{{- tpl (toYaml .) $ | nindent 8 }}
{{- end }}
{{- with .Values.policyReportsCleanup.nodeSelector | default .Values.global.nodeSelector }}
nodeSelector:
{{- tpl (toYaml .) $ | nindent 8 }}
{{- end }}
{{- if or .Values.policyReportsCleanup.podAntiAffinity .Values.policyReportsCleanup.podAffinity .Values.policyReportsCleanup.nodeAffinity }}
affinity:
{{- with .Values.policyReportsCleanup.podAntiAffinity }}
podAntiAffinity:
{{- tpl (toYaml .) $ | nindent 10 }}
{{- end }}
{{- with .Values.policyReportsCleanup.podAffinity }}
podAffinity:
{{- tpl (toYaml .) $ | nindent 10 }}
{{- end }}
{{- with .Values.policyReportsCleanup.nodeAffinity }}
nodeAffinity:
{{- tpl (toYaml .) $ | nindent 10 }}
{{- end }}
{{- end }}
{{- end -}}
{{- end -}}
charts/kyverno/templates/hooks/post-upgrade-migrate-resources.yaml
+142
View File
@@ -0,0 +1,142 @@
{{- if .Values.crds.migration.enabled -}}
{{- if not .Values.templating.enabled -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ template "kyverno.fullname" . }}:migrate-resources
labels:
{{- include "kyverno.hooks.labels" . | nindent 4 }}
annotations:
helm.sh/hook: post-upgrade
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
helm.sh/hook-weight: "100"
rules:
- apiGroups:
- kyverno.io
resources:
- '*'
verbs:
- get
- list
- update
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions/status
verbs:
- update
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ template "kyverno.fullname" . }}:migrate-resources
labels:
{{- include "kyverno.hooks.labels" . | nindent 4 }}
annotations:
helm.sh/hook: post-upgrade
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
helm.sh/hook-weight: "100"
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{ template "kyverno.fullname" . }}:migrate-resources
subjects:
- kind: ServiceAccount
name: {{ template "kyverno.fullname" . }}-migrate-resources
namespace: {{ template "kyverno.namespace" . }}
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ template "kyverno.fullname" . }}-migrate-resources
namespace: {{ template "kyverno.namespace" . }}
labels:
{{- include "kyverno.hooks.labels" . | nindent 4 }}
annotations:
helm.sh/hook: post-upgrade
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
helm.sh/hook-weight: "100"
---
apiVersion: batch/v1
kind: Job
metadata:
name: {{ template "kyverno.fullname" . }}-migrate-resources
namespace: {{ template "kyverno.namespace" . }}
labels:
{{- include "kyverno.hooks.labels" . | nindent 4 }}
annotations:
helm.sh/hook: post-upgrade
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
helm.sh/hook-weight: "200"
spec:
backoffLimit: 2
template:
metadata:
{{- with .Values.crds.migration.podAnnotations }}
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.crds.migration.podLabels }}
labels:
{{- toYaml . | nindent 8 }}
{{- end }}
spec:
serviceAccountName: {{ template "kyverno.fullname" . }}-migrate-resources
{{- with .Values.crds.migration.podSecurityContext }}
securityContext:
{{- tpl (toYaml .) $ | nindent 8 }}
{{- end }}
restartPolicy: Never
containers:
- name: kubectl
image: {{ (include "kyverno.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.crds.migration.image "defaultTag" (default .Chart.AppVersion .Values.crds.migration.image.tag))) | quote }}
imagePullPolicy: {{ .Values.crds.migration.image.pullPolicy }}
args:
- migrate
{{- range .Values.crds.migration.resources }}
- --resource
- {{ . }}
{{- end }}
{{- with .Values.crds.migration.podResources }}
resources:
{{- tpl (toYaml .) $ | nindent 12 }}
{{- end }}
{{- with .Values.crds.migration.securityContext }}
securityContext:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.crds.migration.imagePullSecrets | default .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- tpl (toYaml .) $ | nindent 8 }}
{{- end }}
{{- with .Values.crds.migration.tolerations | default .Values.global.tolerations}}
tolerations:
{{- tpl (toYaml .) $ | nindent 8 }}
{{- end }}
{{- with .Values.crds.migration.nodeSelector | default .Values.global.nodeSelector }}
nodeSelector:
{{- tpl (toYaml .) $ | nindent 8 }}
{{- end }}
{{- if or .Values.crds.migration.podAntiAffinity .Values.crds.migration.podAffinity .Values.crds.migration.nodeAffinity }}
affinity:
{{- with .Values.crds.migration.podAntiAffinity }}
podAntiAffinity:
{{- tpl (toYaml .) $ | nindent 10 }}
{{- end }}
{{- with .Values.crds.migration.podAffinity }}
podAffinity:
{{- tpl (toYaml .) $ | nindent 10 }}
{{- end }}
{{- with .Values.crds.migration.nodeAffinity }}
nodeAffinity:
{{- tpl (toYaml .) $ | nindent 10 }}
{{- end }}
{{- end }}
{{- end -}}
{{- end -}}
charts/kyverno/templates/hooks/pre-delete-scale-to-zero.yaml
+82
View File
@@ -0,0 +1,82 @@
{{- if .Values.webhooksCleanup.enabled -}}
{{- if not .Values.templating.enabled -}}
apiVersion: batch/v1
kind: Job
metadata:
name: {{ template "kyverno.fullname" . }}-scale-to-zero
namespace: {{ template "kyverno.namespace" . }}
labels:
{{- include "kyverno.hooks.labels" . | nindent 4 }}
annotations:
helm.sh/hook: pre-delete
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
helm.sh/hook-weight: "100"
spec:
backoffLimit: 2
template:
metadata:
{{- with .Values.webhooksCleanup.podAnnotations }}
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.webhooksCleanup.podLabels }}
labels:
{{- toYaml . | nindent 8 }}
{{- end }}
spec:
serviceAccountName: {{ template "kyverno.admission-controller.serviceAccountName" . }}
{{- with .Values.webhooksCleanup.podSecurityContext }}
securityContext:
{{- tpl (toYaml .) $ | nindent 8 }}
{{- end }}
restartPolicy: Never
{{- with .Values.webhooksCleanup.imagePullSecrets | default .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- tpl (toYaml .) $ | nindent 8 }}
{{- end }}
containers:
- name: kubectl
image: {{ (include "kyverno.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.webhooksCleanup.image "defaultTag" (default .Chart.AppVersion .Values.webhooksCleanup.image.tag))) | quote }}
imagePullPolicy: {{ .Values.webhooksCleanup.image.pullPolicy }}
command:
- /bin/bash
- '-c'
- |-
set -euo pipefail
kubectl scale -n {{ template "kyverno.namespace" . }} deployment -l app.kubernetes.io/part-of={{ template "kyverno.fullname" . }} --replicas=0
sleep 30
kubectl delete validatingwebhookconfiguration -l webhook.kyverno.io/managed-by=kyverno
kubectl delete mutatingwebhookconfiguration -l webhook.kyverno.io/managed-by=kyverno
{{- with .Values.webhooksCleanup.resources }}
resources:
{{- tpl (toYaml .) $ | nindent 12 }}
{{- end }}
{{- with .Values.webhooksCleanup.securityContext }}
securityContext:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.webhooksCleanup.tolerations | default .Values.global.tolerations}}
tolerations:
{{- tpl (toYaml .) $ | nindent 8 }}
{{- end }}
{{- with .Values.webhooksCleanup.nodeSelector | default .Values.global.nodeSelector }}
nodeSelector:
{{- tpl (toYaml .) $ | nindent 8 }}
{{- end }}
{{- if or .Values.webhooksCleanup.podAntiAffinity .Values.webhooksCleanup.podAffinity .Values.webhooksCleanup.nodeAffinity }}
affinity:
{{- with .Values.webhooksCleanup.podAntiAffinity }}
podAntiAffinity:
{{- tpl (toYaml .) $ | nindent 10 }}
{{- end }}
{{- with .Values.webhooksCleanup.podAffinity }}
podAffinity:
{{- tpl (toYaml .) $ | nindent 10 }}
{{- end }}
{{- with .Values.webhooksCleanup.nodeAffinity }}
nodeAffinity:
{{- tpl (toYaml .) $ | nindent 10 }}
{{- end }}
{{- end }}
{{- end -}}
{{- end -}}