Add cluster-registry-sync-manager chart

aalexandru · Aug 8, 2024 · 8a9b53e · 8a9b53e
1 parent b5c3060
commit 8a9b53e
Show file tree

Hide file tree

Showing 17 changed files with 540 additions and 3 deletions.
diff --git a/Makefile b/Makefile
@@ -73,13 +73,17 @@ build-apiserver:
 build-client:
 	$(GO_BUILD_RECIPE) -o cluster-registry-client cmd/client/client.go
 
+.PHONY: build-sync-manager
+build-sync-manager:
+	$(GO_BUILD_RECIPE) -o cluster-registry-sync-manager cmd/sync/manager/manager.go
+
 .PHONY: release
 release:
 	./hack/release.sh
 
 .PHONY: image
 image: GOOS := linux
-image: .hack-apiserver-image .hack-client-image
+image: .hack-apiserver-image .hack-client-image .hack-sync-manager-image
 
 .hack-apiserver-image: cmd/apiserver/Dockerfile build-apiserver
 	docker build -t $(IMAGE_APISERVER):$(TAG) -f cmd/apiserver/Dockerfile .
@@ -89,6 +93,10 @@ image: .hack-apiserver-image .hack-client-image
 	docker build -t $(IMAGE_CLIENT):$(TAG) -f cmd/client/Dockerfile .
 	touch $@
 
+.hack-sync-manager-image: cmd/sync/manager/Dockerfile build-sync-manager
+	docker build -t $(IMAGE_SYNC_MANAGER):$(TAG) -f cmd/sync/manager/Dockerfile .
+	touch $@
+
 .PHONY: update-go-deps
 update-go-deps:
 	for m in $$(go list -mod=readonly -m -f '{{ if and (not .Indirect) (not .Main)}}{{.Path}}{{end}}' all); do \

diff --git a/charts/cluster-registry-sync-manager/.helmignore b/charts/cluster-registry-sync-manager/.helmignore
@@ -0,0 +1,22 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/charts/cluster-registry-sync-manager/Chart.yaml b/charts/cluster-registry-sync-manager/Chart.yaml
@@ -0,0 +1,19 @@
+apiVersion: v2
+name: cluster-registry-sync-manager
+
+description: Cluster Registry is a Rest API representing the source of record for
+  all Kubernetes clusters in the infrastructure fleet. All clusters are automatically
+  registered, and the information is accurately reflected in the Cluster Registry
+  using a client-server architecture.
+
+type: application
+home: https://github.com/adobe/cluster-registry
+
+maintainers:
+  - name: aalexandru
+    email: [email protected]
+  - name: radu-catalina
+    email: [email protected]
+
+version: 0.1.0
+appVersion: v1.6.0
diff --git a/charts/cluster-registry-sync-manager/README.md b/charts/cluster-registry-sync-manager/README.md
@@ -0,0 +1,60 @@
+# cluster-registry-sync-manager
+
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.6.0](https://img.shields.io/badge/AppVersion-v1.6.0-informational?style=flat-square)
+
+Cluster Registry is a Rest API representing the source of record for all Kubernetes clusters in the infrastructure fleet. All clusters are automatically registered, and the information is accurately reflected in the Cluster Registry using a client-server architecture.
+
+**Homepage:** <https://github.com/adobe/cluster-registry>
+
+## Maintainers
+
+| Name | Email | Url |
+| ---- | ------ | --- |
+| aalexandru | <[email protected]> |  |
+| radu-catalina | <[email protected]> |  |
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| clusterRegistryClient.alertmanagerWebhook.alertMap | list | `[]` |  |
+| clusterRegistryClient.alertmanagerWebhook.bindAddress | string | `"0.0.0.0:9092"` |  |
+| clusterRegistryClient.health.healthProbeBindAddress | string | `":9091"` |  |
+| clusterRegistryClient.leaderElection.leaderElect | bool | `true` |  |
+| clusterRegistryClient.leaderElection.resourceName | string | `"0c4967d2.registry.ethos.adobe.com"` |  |
+| clusterRegistryClient.leaderElection.resourceNamespace | string | `"cluster-registry"` |  |
+| clusterRegistryClient.metrics.bindAddress | string | `"0.0.0.0:9090"` |  |
+| clusterRegistryClient.webhook.port | int | `9443` |  |
+| fullnameOverride | string | `"cluster-registry-client"` |  |
+| image.pullPolicy | string | `"IfNotPresent"` |  |
+| image.registry | string | `"ghcr.io/adobe/cluster-registry-client"` |  |
+| imagePullSecrets | list | `[]` |  |
+| livenessProbe.httpGet.path | string | `"/healthz"` |  |
+| livenessProbe.httpGet.port | int | `9091` |  |
+| livenessProbe.initialDelaySeconds | int | `15` |  |
+| livenessProbe.periodSeconds | int | `20` |  |
+| nameOverride | string | `"cluster-registry-client"` |  |
+| podDisruptionBudget.enabled | bool | `true` |  |
+| podDisruptionBudget.minAvailable | string | `"50%"` |  |
+| podMonitor.enabled | bool | `false` |  |
+| podMonitor.extraLabels | object | `{}` |  |
+| ports[0].containerPort | int | `9090` |  |
+| ports[0].name | string | `"metrics"` |  |
+| ports[1].containerPort | int | `9092` |  |
+| ports[1].name | string | `"amwebhook"` |  |
+| rbac.create | bool | `true` |  |
+| readinessProbe.httpGet.path | string | `"/readyz"` |  |
+| readinessProbe.httpGet.port | int | `9091` |  |
+| readinessProbe.initialDelaySeconds | int | `5` |  |
+| readinessProbe.periodSeconds | int | `10` |  |
+| replicaCount | int | `2` |  |
+| resources.limits.cpu | string | `"200m"` |  |
+| resources.limits.memory | string | `"400Mi"` |  |
+| resources.requests.cpu | string | `"100m"` |  |
+| resources.requests.memory | string | `"200Mi"` |  |
+| serviceAccount.create | bool | `true` |  |
+| serviceAccount.name | string | `"cluster-registry-client"` |  |
+| terminationGracePeriodSeconds | int | `10` |  |
+
+----------------------------------------------
+Autogenerated from chart metadata using [helm-docs v1.12.0](https://github.com/norwoodj/helm-docs/releases/v1.12.0)
diff --git a/charts/cluster-registry-sync-manager/templates/_helpers.tpl b/charts/cluster-registry-sync-manager/templates/_helpers.tpl
@@ -0,0 +1,63 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "cluster-registry-sync-manager.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "cluster-registry-sync-manager.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "cluster-registry-sync-manager.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "cluster-registry-sync-manager.labels" -}}
+helm.sh/chart: {{ include "cluster-registry-sync-manager.chart" . }}
+{{ include "cluster-registry-sync-manager.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+component: cluster-registry
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "cluster-registry-sync-manager.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "cluster-registry-sync-manager.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "cluster-registry-sync-manager.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "cluster-registry-sync-manager.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
diff --git a/charts/cluster-registry-sync-manager/templates/clusterrole.yaml b/charts/cluster-registry-sync-manager/templates/clusterrole.yaml
@@ -0,0 +1,36 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cluster-registry-sync-manager
+  labels:
+    {{- include "cluster-registry-sync-manager.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - registry.ethos.adobe.com
+    resources:
+      - clustersyncs
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - registry.ethos.adobe.com
+    resources:
+      - clustersyncs/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - registry.ethos.adobe.com
+    resources:
+      - clustersyncs/status
+    verbs:
+      - get
+      - patch
+      - update
+  {{- with .Values.extraRBAC }}
+    {{- toYaml . | nindent 2 }}
+  {{- end }}
diff --git a/charts/cluster-registry-sync-manager/templates/clusterrolebinding.yaml b/charts/cluster-registry-sync-manager/templates/clusterrolebinding.yaml
@@ -0,0 +1,14 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cluster-registry-sync-manager
+  labels:
+    {{- include "cluster-registry-sync-manager.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-registry-sync-manager
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "cluster-registry-sync-manager.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
diff --git a/charts/cluster-registry-sync-manager/templates/configmap.yaml b/charts/cluster-registry-sync-manager/templates/configmap.yaml
@@ -0,0 +1,30 @@
+{{- if .Values.clusterRegistrySyncManager }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: sync-manager-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "cluster-registry-sync-manager.labels" . | nindent 4 }}
+data:
+  config.yaml: |-
+    apiVersion: config.registry.ethos.adobe.com/v1
+    kind: SyncConfig
+    health:
+      healthProbeBindAddress: {{ .Values.clusterRegistrySyncManager.health.healthProbeBindAddress }}
+    metrics:
+      bindAddress: {{ .Values.clusterRegistrySyncManager.metrics.bindAddress }}
+    webhook:
+      port: {{ .Values.clusterRegistrySyncManager.webhook.port }}
+    leaderElection:
+      leaderElect: {{ .Values.clusterRegistrySyncManager.leaderElection.leaderElect }}
+      resourceNamespace: {{ .Release.Namespace }}
+      resourceName:  {{ .Values.clusterRegistrySyncManager.leaderElection.resourceName }}
+    namespace: {{ .Release.Namespace }}
+    watchedGVKs:
+    {{- range $_, $gvk := .Values.clusterRegistrySyncManager.watchedGVKs }}
+      - group: {{ $gvk.group }}
+        version: {{ $gvk.version }}
+        kind: {{ $gvk.kind }}
+    {{- end }}
+{{- end }}
diff --git a/charts/cluster-registry-sync-manager/templates/deployment.yaml b/charts/cluster-registry-sync-manager/templates/deployment.yaml
@@ -0,0 +1,88 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:   {{- include "cluster-registry-sync-manager.labels" . | nindent 4 }}
+  name: {{ include "cluster-registry-sync-manager.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  replicas: {{ .Values.replicaCount | required ".Values.replicaCount is required" }}
+  selector:
+    matchLabels:
+      {{- include "cluster-registry-sync-manager.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+      {{- include "cluster-registry-sync-manager.selectorLabels" . | nindent 8 }}
+      annotations:
+        kubectl.kubernetes.io/default-container: manager
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+      {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - args:
+            - --leader-elect
+            - --config=config.yaml
+          command:
+            - /bin/sync-manager
+          image: "{{ .Values.image.registry }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          volumeMounts:
+            - name: sync-manager-config
+              mountPath: /config.yaml
+              subPath: config.yaml
+          ports:
+            {{- toYaml .Values.ports | nindent 12 }}
+          env:
+            - name: AWS_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  key: AWS_ACCESS_KEY_ID
+                  name: cluster-registry-aws
+            - name: AWS_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  key: AWS_SECRET_ACCESS_KEY
+                  name: cluster-registry-aws
+            - name: SQS_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  key: SQS_ENDPOINT
+                  name: cluster-registry-aws
+            - name: SQS_QUEUE_NAME
+              valueFrom:
+                secretKeyRef:
+                  key: SQS_QUEUE_NAME
+                  name: cluster-registry-aws
+            - name: AWS_REGION
+              valueFrom:
+                secretKeyRef:
+                  key: SQS_AWS_REGION
+                  name: cluster-registry-aws
+            - name: SQS_AWS_REGION
+              valueFrom:
+                secretKeyRef:
+                  key: SQS_AWS_REGION
+                  name: cluster-registry-aws
+          {{- if .Values.livenessProbe }}
+          livenessProbe:
+            {{- toYaml .Values.livenessProbe | nindent 12 }}
+          {{- end }}
+          {{- if .Values.readinessProbe }}
+          readinessProbe:
+            {{- toYaml .Values.readinessProbe | nindent 12 }}
+          {{- end }}
+          {{- if .Values.resources }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          {{- end }}
+          name: manager
+          securityContext:
+            allowPrivilegeEscalation: false
+      volumes:
+        - name: sync-manager-config
+          configMap:
+            name: sync-manager-config
+      serviceAccountName: {{ include "cluster-registry-sync-manager.serviceAccountName" . }}
+      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds | required ".Values.terminationGracePeriodSeconds is required"  }}
diff --git a/charts/cluster-registry-sync-manager/templates/poddisruptionbudget.yaml b/charts/cluster-registry-sync-manager/templates/poddisruptionbudget.yaml
@@ -0,0 +1,19 @@
+{{- if .Values.podDisruptionBudget.enabled }}
+{{- $isPercentage := regexMatch "^[0-9]+%$" (.Values.podDisruptionBudget.minAvailable | quote) }}
+{{- if and (not $isPercentage) (le (.Values.replicaCount | int) (.Values.podDisruptionBudget.minAvailable | int)) }}
+{{- fail ".Values.replicaCount should be greater than .Values.podDisruptionBudget.minAvailable" }}
+{{- else }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  labels:
+    {{- include "cluster-registry-sync-manager.labels" . | nindent 4 }}
+  name: {{ template "cluster-registry-sync-manager.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "cluster-registry-sync-manager.selectorLabels" . | nindent 6 }}
+  minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
+{{- end }}
+{{- end }}