-
Notifications
You must be signed in to change notification settings - Fork 12
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
supported overlays: - no-webhook - deploy without webhook - certmanager - deploy with webhook to k8s cluster where certmanager is available - openshift - deploy with webhook to the Openshift cluster Signed-off-by: Yury Kulazhenkov <ykulazhenkov@nvidia.com>
- Loading branch information
1 parent
bf17352
commit 3a0c4ce
Showing
33 changed files
with
712 additions
and
325 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,2 @@ | ||
| resources: | ||
| - nv-ipam.nvidia.com_ippools.yaml | ||
| - nv-ipam.nvidia.com_ippools.yaml |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| # The following manifests contain a self-signed issuer CR and a certificate CR. | ||
| # More document can be found at https://docs.cert-manager.io | ||
| # WARNING: Targets CertManager v1.0. Check https://cert-manager.io/docs/installation/upgrading/ for breaking changes. | ||
| apiVersion: cert-manager.io/v1 | ||
| kind: Issuer | ||
| metadata: | ||
| name: selfsigned-issuer | ||
| namespace: system | ||
| spec: | ||
| selfSigned: {} | ||
| --- | ||
| apiVersion: cert-manager.io/v1 | ||
| kind: Certificate | ||
| metadata: | ||
| name: serving-cert # this name should match the one appeared in kustomizeconfig.yaml | ||
| namespace: system | ||
| spec: | ||
| # $(SERVICE_NAME) and $(SERVICE_NAMESPACE) will be substituted by kustomize | ||
| dnsNames: | ||
| - $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc | ||
| - $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc.cluster.local | ||
| issuerRef: | ||
| kind: Issuer | ||
| name: selfsigned-issuer | ||
| secretName: nv-ipam-webhook-server-cert # this secret will not be prefixed, since it's not managed by kustomize |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| resources: | ||
| - certificate.yaml | ||
|
|
||
| configurations: | ||
| - kustomizeconfig.yaml |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| # This configuration is for teaching kustomize how to update name ref and var substitution | ||
| nameReference: | ||
| - kind: Issuer | ||
| group: cert-manager.io | ||
| fieldSpecs: | ||
| - kind: Certificate | ||
| group: cert-manager.io | ||
| path: spec/issuerRef/name | ||
|
|
||
| varReference: | ||
| - kind: Certificate | ||
| group: cert-manager.io | ||
| path: spec/commonName | ||
| - kind: Certificate | ||
| group: cert-manager.io | ||
| path: spec/dnsNames |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,99 @@ | ||
| kind: Deployment | ||
| apiVersion: apps/v1 | ||
| metadata: | ||
| name: controller | ||
| namespace: system | ||
| annotations: | ||
| kubernetes.io/description: | | ||
| This deployment launches the nv-ipam controller for nv-ipam. | ||
| spec: | ||
| strategy: | ||
| type: RollingUpdate | ||
| replicas: 1 | ||
| selector: | ||
| matchLabels: | ||
| name: controller | ||
| template: | ||
| metadata: | ||
| labels: | ||
| name: controller | ||
| spec: | ||
| priorityClassName: system-cluster-critical | ||
| serviceAccountName: controller | ||
| affinity: | ||
| podAntiAffinity: | ||
| preferredDuringSchedulingIgnoredDuringExecution: | ||
| - weight: 100 | ||
| podAffinityTerm: | ||
| labelSelector: | ||
| matchExpressions: | ||
| - key: name | ||
| operator: In | ||
| values: | ||
| - controller | ||
| topologyKey: "kubernetes.io/hostname" | ||
| nodeAffinity: | ||
| preferredDuringSchedulingIgnoredDuringExecution: | ||
| - weight: 1 | ||
| preference: | ||
| matchExpressions: | ||
| - key: node-role.kubernetes.io/master | ||
| operator: In | ||
| values: | ||
| - "" | ||
| - weight: 1 | ||
| preference: | ||
| matchExpressions: | ||
| - key: node-role.kubernetes.io/control-plane | ||
| operator: In | ||
| values: | ||
| - "" | ||
| tolerations: | ||
| - key: node-role.kubernetes.io/master | ||
| operator: Exists | ||
| effect: NoSchedule | ||
| - key: node-role.kubernetes.io/control-plane | ||
| operator: Exists | ||
| effect: NoSchedule | ||
| - key: nvidia.com/gpu | ||
| operator: Exists | ||
| effect: NoSchedule | ||
| containers: | ||
| - name: controller | ||
| image: ghcr.io/mellanox/nvidia-k8s-ipam:latest | ||
| imagePullPolicy: IfNotPresent | ||
| command: [ "/ipam-controller" ] | ||
| args: | ||
| - --leader-elect=true | ||
| - --leader-elect-namespace=$(POD_NAMESPACE) | ||
| - --ippools-namespace=$(POD_NAMESPACE) | ||
| env: | ||
| - name: POD_NAMESPACE | ||
| valueFrom: | ||
| fieldRef: | ||
| fieldPath: metadata.namespace | ||
| securityContext: | ||
| allowPrivilegeEscalation: false | ||
| capabilities: | ||
| drop: | ||
| - "ALL" | ||
| livenessProbe: | ||
| httpGet: | ||
| path: /healthz | ||
| port: 8081 | ||
| initialDelaySeconds: 15 | ||
| periodSeconds: 20 | ||
| readinessProbe: | ||
| httpGet: | ||
| path: /readyz | ||
| port: 8081 | ||
| initialDelaySeconds: 5 | ||
| periodSeconds: 10 | ||
| resources: | ||
| requests: | ||
| cpu: 100m | ||
| memory: 300Mi | ||
| ports: | ||
| - containerPort: 9443 | ||
| name: webhook-server | ||
| protocol: TCP |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| resources: | ||
| - deployment.yaml | ||
| - role.yaml | ||
| - role_binding.yaml | ||
| - service_account.yaml |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| kind: ClusterRole | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| metadata: | ||
| name: controller | ||
| rules: | ||
| - apiGroups: | ||
| - "" | ||
| resources: | ||
| - nodes | ||
| verbs: | ||
| - get | ||
| - list | ||
| - patch | ||
| - update | ||
| - watch | ||
| - apiGroups: | ||
| - "" | ||
| resources: | ||
| - configmaps | ||
| verbs: | ||
| - get | ||
| - list | ||
| - watch | ||
| - delete | ||
| - apiGroups: | ||
| - nv-ipam.nvidia.com | ||
| resources: | ||
| - ippools | ||
| verbs: | ||
| - get | ||
| - list | ||
| - watch | ||
| - create | ||
| - apiGroups: | ||
| - nv-ipam.nvidia.com | ||
| resources: | ||
| - ippools/status | ||
| verbs: | ||
| - get | ||
| - update | ||
| - patch | ||
| - apiGroups: | ||
| - coordination.k8s.io | ||
| resources: | ||
| - leases | ||
| verbs: | ||
| - get | ||
| - list | ||
| - watch | ||
| - create | ||
| - update | ||
| - patch | ||
| - delete | ||
| - apiGroups: | ||
| - "" | ||
| resources: | ||
| - events | ||
| verbs: | ||
| - create | ||
| - patch |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| kind: ClusterRoleBinding | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| metadata: | ||
| name: controller | ||
| roleRef: | ||
| apiGroup: rbac.authorization.k8s.io | ||
| kind: ClusterRole | ||
| name: controller | ||
| subjects: | ||
| - kind: ServiceAccount | ||
| name: controller | ||
| namespace: system |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| apiVersion: v1 | ||
| kind: ServiceAccount | ||
| metadata: | ||
| name: controller | ||
| namespace: system |
Oops, something went wrong.