Created flame controller manifests

eigr-labs · Dec 15, 2023 · 2b63b0a · 2b63b0a
1 parent cae917d
commit 2b63b0a
Show file tree

Hide file tree

Showing 16 changed files with 691 additions and 287 deletions.
diff --git a/.k8s/install/manifests/clusterrole.yaml b/.k8s/install/manifests/clusterrole.yaml
@@ -0,0 +1,143 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    k8s-app: flame-controller
+  name: flame-controller
+rules:
+  - apiGroups:
+      - admissionregistration.k8s.io
+    resources:
+      - validatingwebhookconfigurations
+      - mutatingwebhookconfigurations
+    verbs:
+      - get
+      - list
+      - update
+      - patch
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+      - update
+      - patch
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - '*'
+  - apiGroups:
+      - ""
+    resources:
+      - node
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - ""
+    resources:
+      - nodes
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - '*'
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - '*'
+  - apiGroups:
+      - ""
+    resources:
+      - serviceaccount
+    verbs:
+      - '*'
+  - apiGroups:
+      - ""
+    resources:
+      - serviceaccounts
+    verbs:
+      - '*'
+  - apiGroups:
+      - ""
+    resources:
+      - services
+    verbs:
+      - '*'
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - '*'
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+    verbs:
+      - '*'
+  - apiGroups:
+      - coordination.k8s.io
+    resources:
+      - leases
+    verbs:
+      - '*'
+  - apiGroups:
+      - events.k8s.io
+    resources:
+      - events
+    verbs:
+      - '*'
+  - apiGroups:
+      - flame.org
+    resources:
+      - flamepools
+    verbs:
+      - '*'
+  - apiGroups:
+      - flame.org
+    resources:
+      - flamepools/status
+    verbs:
+      - '*'
+  - apiGroups:
+      - flame.org
+    resources:
+      - flamerunners
+    verbs:
+      - '*'
+  - apiGroups:
+      - flame.org
+    resources:
+      - flamerunners/status
+    verbs:
+      - '*'
+  - apiGroups:
+      - rbac.authorization.k8s.io
+    resources:
+      - role
+    verbs:
+      - '*'
+  - apiGroups:
+      - rbac.authorization.k8s.io
+    resources:
+      - rolebindings
+    verbs:
+      - '*'
+  - apiGroups:
+      - rbac.authorization.k8s.io
+    resources:
+      - roles
+    verbs:
+      - '*'
diff --git a/.k8s/install/manifests/clusterrolebinding.yaml b/.k8s/install/manifests/clusterrolebinding.yaml
@@ -0,0 +1,15 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    k8s-app: flame-controller
+  name: flame-controller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: flame-controller
+subjects:
+  - kind: ServiceAccount
+    name: flame-controller
+    namespace: flame
diff --git a/.k8s/install/manifests/deployment.yaml b/.k8s/install/manifests/deployment.yaml
@@ -0,0 +1,72 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    k8s-app: flame-controller
+  name: flame-controller
+  namespace: flame
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      k8s-app: flame-controller
+  template:
+    metadata:
+      labels:
+        k8s-app: flame-controller
+    spec:
+      containers:
+        - env:
+            - name: MIX_ENV
+              value: prod
+            - name: BONNY_OPERATOR_NAME
+              value: flame-controller
+            - name: BONNY_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: BONNY_POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: BONNY_POD_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+            - name: BONNY_POD_SERVICE_ACCOUNT
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.serviceAccountName
+          image: eigr/flame-k8s-controller:0.1.0
+          name: flame-controller
+          ports:
+            - containerPort: 9001
+              name: webhooks
+          resources:
+            limits:
+              cpu: 200m
+              memory: 200Mi
+            requests:
+              cpu: 200m
+              memory: 200Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 1001
+          volumeMounts:
+            - mountPath: /mnt/cert
+              name: certs
+      initContainers:
+        - args:
+            - eval
+            - FlameK8sController.Webhooks.bootstrap_tls(:prod, "tls-certs")
+          image: eigr/flame-k8s-controller:0.1.0
+          name: init-certificates
+      serviceAccountName: flame-controller
+      volumes:
+        - name: certs
+          secret:
+            optional: true
+            secretName: tls-certs
diff --git a/.k8s/install/manifests/flamepool.crd.yaml b/.k8s/install/manifests/flamepool.crd.yaml
@@ -0,0 +1,36 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  labels:
+    k8s-app: flame-controller
+  name: flamepools.flame.org
+spec:
+  group: flame.org
+  names:
+    kind: FlamePool
+    plural: flamepools
+    shortNames:
+      - framepool
+      - framepools
+      - pool
+      - pools
+    singular: flamepool
+  scope: Namespaced
+  versions:
+    - deprecationWarning:
+      name: v1
+      schema:
+        openAPIV3Schema:
+          properties:
+            status:
+              properties:
+                observedGeneration:
+                  type: integer
+              type: object
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+      served: true
+      storage: true
+      subresources:
+        status: {}
diff --git a/.k8s/install/manifests/flamepool.yaml b/.k8s/install/manifests/flamepool.yaml
@@ -0,0 +1,31 @@
+---
+apiVersion: flame.org/v1
+kind: FlamePool
+metadata:
+  name: default-pool
+  namespace: flame
+spec:
+  podTemplate:
+    spec:
+      containers:
+        - env:
+            - name: PHX_SERVER
+              value: 'false'
+            - name: MIX_ENV
+              value: prod
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: POD_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
diff --git a/.k8s/install/manifests/flamerunner.crd.yaml b/.k8s/install/manifests/flamerunner.crd.yaml
@@ -0,0 +1,37 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  labels:
+    k8s-app: flame-controller
+  name: flamerunners.flame.org
+spec:
+  group: flame.org
+  names:
+    kind: FlameRunner
+    plural: flamerunners
+    shortNames:
+      - fr
+      - flamerunner
+      - flamerunners
+      - runner
+      - runners
+    singular: flamerunner
+  scope: Namespaced
+  versions:
+    - deprecationWarning:
+      name: v1
+      schema:
+        openAPIV3Schema:
+          properties:
+            status:
+              properties:
+                observedGeneration:
+                  type: integer
+              type: object
+          type: object
+          x-kubernetes-preserve-unknown-fields: true
+      served: true
+      storage: true
+      subresources:
+        status: {}
diff --git a/.k8s/install/manifests/mutatingwebhookconfiguration.yaml b/.k8s/install/manifests/mutatingwebhookconfiguration.yaml
@@ -0,0 +1,28 @@
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: flame-k8s
+webhooks:
+  - admissionReviewVersions:
+      - v1
+    clientConfig:
+      service:
+        name: flame-k8s
+        namespace: flame
+        path: /admission-review/mutating
+        port: 443
+    failurePolicy: Ignore
+    matchPolicy: Equivalent
+    name: flame-k8s.flame.org
+    rules:
+      - apiGroups:
+          - apps
+        apiVersions:
+          - v1
+        operations:
+          - CREATE
+          - UPDATE
+        resources:
+          - deployments
+          - statefulsets
diff --git a/.k8s/install/manifests/namespace.yaml b/.k8s/install/manifests/namespace.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: flame
diff --git a/.k8s/install/manifests/service.yaml b/.k8s/install/manifests/service.yaml
@@ -0,0 +1,16 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    k8s-app: flame-controller
+  name: flame-controller
+  namespace: flame
+spec:
+  ports:
+    - name: webhooks
+      port: 443
+      protocol: TCP
+      targetPort: webhooks
+  selector:
+    k8s-app: flame-controller