Skip to content
This repository was archived by the owner on Mar 14, 2024. It is now read-only.

Commit ba2c2d9

Browse files
cygnuslyracygnuslyra
committed
Helm release - 1.4
1 parent 8e27220 commit ba2c2d9

20 files changed

+527
-226
lines changed

‎helm-chart/Chart.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: v2
22
name: nginx-service-mesh
33
description: NGINX Service Mesh
4-
version: 0.3.1
5-
appVersion: 1.3.1
4+
version: 0.4.0
5+
appVersion: 1.4.0
66
kubeVersion: ">= 1.18-0"
77
icon: https://raw.githubusercontent.com/nginxinc/nginx-service-mesh/master/helm-chart/chart-icon.png

‎helm-chart/configs/grafana-top-dashboard.json

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -310,7 +310,7 @@
310310
"alertThreshold": true
311311
},
312312
"percentage": false,
313-
"pluginVersion": "8.1.7",
313+
"pluginVersion": "8.3.4",
314314
"pointradius": 5,
315315
"points": false,
316316
"renderer": "flot",
@@ -405,7 +405,7 @@
405405
"alertThreshold": true
406406
},
407407
"percentage": false,
408-
"pluginVersion": "8.1.7",
408+
"pluginVersion": "8.3.4",
409409
"pointradius": 5,
410410
"points": false,
411411
"renderer": "flot",
@@ -502,7 +502,7 @@
502502
"alertThreshold": true
503503
},
504504
"percentage": false,
505-
"pluginVersion": "8.1.7",
505+
"pluginVersion": "8.3.4",
506506
"pointradius": 2,
507507
"points": false,
508508
"renderer": "flot",
@@ -596,7 +596,7 @@
596596
"alertThreshold": true
597597
},
598598
"percentage": false,
599-
"pluginVersion": "8.1.7",
599+
"pluginVersion": "8.3.4",
600600
"pointradius": 2,
601601
"points": false,
602602
"renderer": "flot",

‎helm-chart/configs/k8s-workload-registrar.conf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,6 @@ pod_controller = true
66
add_svc_dns_name = true
77
mode = "crd"
88
webhook_enabled = true
9+
webhook_cert_dir = "/tmp/k8s-webhook-server/serving-certs"
910
identity_template_label = "spiffe.io/spiffeid"
11+
dns_name_templates = ["{{`{{ .Pod.Name}}`}}", "{{`{{ .Pod.ServiceAccount }}`}}.{{`{{ .Pod.Namespace }}`}}.svc"]

‎helm-chart/configs/mesh-config.conf

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
{
22
"accessControlMode": {{ quote .Values.accessControlMode }},
33
"api": {
4-
"address": {{ printf "nginx-mesh-api.%s" .Release.Namespace }},
4+
"address": {{ printf "nginx-mesh-api.%s" .Release.Namespace | quote }},
55
"containerPort": 8443,
66
"port": 443
77
},
88
"autoInjectorPort": 9443,
99
"environment": {{ quote .Values.environment }},
10+
"isUDPEnabled": {{ .Values.enableUDP }},
1011
"injection": {
1112
"disabledNamespaces": [{{ range $idx, $elem := .Values.autoInjection.disabledNamespaces }}{{if $idx}},{{end}}{{quote .}}{{end}}],
1213
"enabledNamespaces": [{{ range $idx, $elem := .Values.autoInjection.enabledNamespaces }}{{if $idx}},{{end}}{{quote .}}{{end}}],
@@ -35,6 +36,8 @@
3536
"incomingTcp": 8904,
3637
"incomingTcpDeny": 8905,
3738
"incomingTcpPermissive": 8907,
39+
"outgoingUdp": 8908,
40+
"incomingUdp": 8909,
3841
"metrics": 8887,
3942
"outgoing": 8889,
4043
"outgoingDefaultEgress": 8894,
@@ -50,18 +53,27 @@
5053
},
5154
"registryKeyName": {{ if (include "docker-config-json" .) }}{{ include "registry-key-name" . | quote }}{{ else }}""{{ end }},
5255
"sidecarImage": {
53-
"image": {{ printf "%s/nginx-mesh-sidecar:%s" .Values.registry.server .Values.registry.imageTag }},
56+
"image": {{ printf "%s/nginx-mesh-sidecar:%s" .Values.registry.server .Values.registry.imageTag | quote }},
5457
"name": "nginx-mesh-sidecar"
5558
},
5659
"sidecarInitImage": {
57-
"image": {{ printf "%s/nginx-mesh-init:%s" .Values.registry.server .Values.registry.imageTag }},
60+
"image": {{ printf "%s/nginx-mesh-init:%s" .Values.registry.server .Values.registry.imageTag | quote }},
5861
"name": "nginx-mesh-init"
5962
},
60-
"tracing": {
63+
"tracing": {{if .Values.tracing }}{
6164
"backend": {{ quote .Values.tracing.backend }},
6265
"backendAddress": {{ include "tracing.address" . | quote }},
6366
"isEnabled": {{ not .Values.tracing.disable }},
6467
"sampleRate": {{ .Values.tracing.sampleRate }}
65-
},
68+
},{{ else }}{},{{ end }}
69+
"telemetry": {{ if .Values.telemetry }}{
70+
"exporters": {
71+
"otlp": {
72+
"host": {{ quote .Values.telemetry.exporters.otlp.host }},
73+
"port": {{ .Values.telemetry.exporters.otlp.port }}
74+
}
75+
},
76+
"samplerRatio": {{ .Values.telemetry.samplerRatio }}
77+
},{{ else }}{},{{ end }}
6678
"trustDomain": {{ quote .Values.mtls.trustDomain }}
6779
}

‎helm-chart/configs/spire-server.conf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,13 +57,16 @@ plugins {
5757
{{ tpl (.Files.Get "configs/upstreamAuthority/disk-ua.conf") . }}
5858
{{ else if .Values.mtls.upstreamAuthority.vault }}
5959
{{ tpl (.Files.Get "configs/upstreamAuthority/vault-ua.conf") . }}
60+
{{ else if .Values.mtls.upstreamAuthority.certManager }}
61+
{{ tpl (.Files.Get "configs/upstreamAuthority/cert-manager-ua.conf") . }}
6062
{{ end }}
6163

6264
}
6365

6466
health_checks {
6567
listener_enabled = true
6668
bind_address = "0.0.0.0"
69+
bind_port = "8082"
6770
live_path = "/live"
6871
ready_path = "/ready"
6972
}

‎helm-chart/configs/upstreamAuthority/cert-manager-ua.conf

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
UpstreamAuthority "cert-manager" {
2+
plugin_data {
3+
namespace = {{ quote .Values.mtls.upstreamAuthority.certManager.namespace }}
4+
issuer_name = {{ quote .Values.mtls.upstreamAuthority.certManager.issuerName }}
5+
{{- if .Values.mtls.upstreamAuthority.certManager.issuerKind }}
6+
issuer_kind = {{ quote .Values.mtls.upstreamAuthority.certManager.issuerKind }}{{ end }}
7+
{{- if .Values.mtls.upstreamAuthority.certManager.issuerGroup }}
8+
issuer_group = {{ quote .Values.mtls.upstreamAuthority.certManager.issuerGroup }}{{ end }}
9+
{{- if .Values.mtls.upstreamAuthority.certManager.kubeConfig }}
10+
kube_config_file = "/run/spire/secrets/cert-manager-kubeconfig"{{ end }}
11+
}
12+
}

‎helm-chart/templates/_helpers.tpl

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,8 @@ credentials {{- end }}
8989
upstreamCA.key
9090
{{- else if .Values.mtls.upstreamAuthority.vault }}{{ if .Values.mtls.upstreamAuthority.vault.certAuth -}}
9191
upstreamClient.key{{ end }}
92+
{{- else if .Values.mtls.upstreamAuthority.certManager }}{{ if .Values.mtls.upstreamAuthority.certManager.kubeConfig -}}
93+
cert-manager-kubeconfig{{ end }}
9294
{{- end }}
9395
{{- end }}
9496

@@ -102,6 +104,8 @@ Define the name of the mount path where the Upstream Authority secret data is st
102104
/run/spire/secrets
103105
{{- else if .Values.mtls.upstreamAuthority.vault }}{{ if .Values.mtls.upstreamAuthority.vault.certAuth -}}
104106
/run/spire/secrets{{ end }}
107+
{{- else if .Values.mtls.upstreamAuthority.certManager }}{{ if .Values.mtls.upstreamAuthority.certManager.kubeConfig -}}
108+
/run/spire/secrets{{ end }}
105109
{{- end }}
106110
{{- end }}
107111

@@ -128,15 +132,17 @@ upstreamBundle.crt: {{ quote .Values.mtls.upstreamAuthority.awsPCA.supplementalB
128132
{{- end }}
129133

130134
{{/*
131-
Define the Upstream Authority key to be stored in the Secret.
135+
Define the Upstream Authority value to be stored in the Secret.
132136
*/}}
133-
{{- define "ua-upstream-key" -}}
137+
{{- define "ua-secret-value" -}}
134138
{{- if .Values.mtls.upstreamAuthority.awsPCA -}}
135139
{{ tpl (.Files.Get "configs/upstreamAuthority/aws-credentials.conf") . | b64enc }}
136140
{{- else if .Values.mtls.upstreamAuthority.disk -}}
137141
{{ .Values.mtls.upstreamAuthority.disk.key | b64enc }}
138142
{{- else if .Values.mtls.upstreamAuthority.vault }}{{ if .Values.mtls.upstreamAuthority.vault.certAuth -}}
139143
{{ .Values.mtls.upstreamAuthority.vault.certAuth.clientKey | b64enc }}{{ end }}
144+
{{- else if .Values.mtls.upstreamAuthority.certManager }}{{ if .Values.mtls.upstreamAuthority.certManager.kubeConfig -}}
145+
{{ .Values.mtls.upstreamAuthority.certManager.kubeConfig | b64enc }}{{ end }}
140146
{{- end }}
141147
{{- end }}
142148

‎helm-chart/templates/grafana.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,7 @@ spec:
100100
serviceAccountName: grafana
101101
containers:
102102
- name: grafana
103-
image: {{ include "grafana.image-server" . }}/grafana:8.1.7
103+
image: {{ include "grafana.image-server" . }}/grafana:8.3.4
104104
imagePullPolicy: {{ .Values.registry.imagePullPolicy }}
105105
ports:
106106
- containerPort: 3000

‎helm-chart/templates/jaeger.yaml

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if (and (not .Values.tracing.disable) (eq .Values.tracing.backend "jaeger") (eq .Values.tracing.address "")) }}
1+
{{- if .Values.tracing }} {{ if (and (not .Values.tracing.disable) (eq .Values.tracing.backend "jaeger") (eq .Values.tracing.address "")) }}
22
---
33
apiVersion: v1
44
kind: Service
@@ -20,6 +20,10 @@ spec:
2020
port: 6831
2121
targetPort: 6831
2222
protocol: UDP
23+
- name: collector-http
24+
port: 14268
25+
protocol: TCP
26+
targetPort: 14268
2327
---
2428
apiVersion: apps/v1
2529
kind: Deployment
@@ -47,10 +51,10 @@ spec:
4751
- name: {{ include "registry-key-name" . }}
4852
containers:
4953
- name: jaeger
50-
image: {{ include "jaeger.image-server" . }}/all-in-one:1.26.0
54+
image: {{ include "jaeger.image-server" . }}/all-in-one:1.31.0
5155
imagePullPolicy: {{ .Values.registry.imagePullPolicy }}
5256
ports:
5357
- containerPort: 16686
5458
- containerPort: 6831
5559
protocol: UDP
56-
{{- end }}
60+
{{- end }}{{- end }}

‎helm-chart/templates/nats.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ spec:
103103
- name: spire-agent-socket
104104
mountPath: "/run/spire/sockets"
105105
- name: nats-server
106-
image: {{ include "nats.image-server" . }}nats:2.4.0-alpine3.14
106+
image: {{ include "nats.image-server" . }}nats:2.7.2-alpine3.15
107107
imagePullPolicy: {{ .Values.registry.imagePullPolicy }}
108108
ports:
109109
- containerPort: 4222

‎helm-chart/templates/nginx-mesh-api.yaml

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,36 @@ subjects:
164164
name: nginx-mesh-api
165165
namespace: {{ .Release.Namespace }}
166166
---
167+
apiVersion: rbac.authorization.k8s.io/v1
168+
kind: ClusterRoleBinding
169+
metadata:
170+
name: nginx-mesh-api-svc.internal.builtin.nsm.nginx
171+
labels:
172+
app.kubernetes.io/part-of: nginx-service-mesh
173+
roleRef:
174+
apiGroup: rbac.authorization.k8s.io
175+
kind: ClusterRole
176+
name: system:auth-delegator
177+
subjects:
178+
- kind: ServiceAccount
179+
name: nginx-mesh-api
180+
namespace: {{ .Release.Namespace }}
181+
---
182+
apiVersion: rbac.authorization.k8s.io/v1
183+
kind: RoleBinding
184+
metadata:
185+
name: nginx-mesh-api-svc.internal.builtin.nsm.nginx
186+
labels:
187+
app.kubernetes.io/part-of: nginx-service-mesh
188+
roleRef:
189+
apiGroup: rbac.authorization.k8s.io
190+
kind: Role
191+
name: extension-apiserver-authentication-reader
192+
subjects:
193+
- kind: ServiceAccount
194+
name: nginx-mesh-api
195+
namespace: {{ .Release.Namespace }}
196+
---
167197
apiVersion: v1
168198
kind: ConfigMap
169199
metadata:
@@ -374,6 +404,23 @@ spec:
374404
path: "/run/spire/sockets"
375405
type: DirectoryOrCreate
376406
{{- end }}
407+
---
408+
apiVersion: apiregistration.k8s.io/v1
409+
kind: APIService
410+
metadata:
411+
labels:
412+
app.kubernetes.io/part-of: nginx-service-mesh
413+
spiffe.io/apiservice: "true"
414+
name: v1alpha1.nsm.nginx.com
415+
spec:
416+
group: nsm.nginx.com
417+
groupPriorityMinimum: 100
418+
service:
419+
name: nginx-mesh-api
420+
namespace: {{ .Release.Namespace}}
421+
port: 443
422+
version: v1alpha1
423+
versionPriority: 100
377424
{{- if eq .Values.environment "openshift" }}
378425
---
379426
apiVersion: rbac.authorization.k8s.io/v1
@@ -476,6 +523,8 @@ allowPrivilegedContainer: false
476523
allowedCapabilities:
477524
- NET_ADMIN
478525
- NET_RAW
526+
- SYS_RESOURCE
527+
- SYS_ADMIN
479528
seLinuxContext:
480529
type: RunAsAny
481530
runAsUser:

0 commit comments

Comments
 (0)