Skip to content

Commit b9f33df

Browse files
shaynafinocchiaroshaynafinocchiaro
committed
[charts/csm-authorization-v2.0] Move Authorization V2 to a new chart (#464)
* move authorization v2 to separate helm chart * update v2 version in chart.yaml * add new line * remove storage secret
1 parent 6c6705f commit b9f33df

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+1723
-393
lines changed

‎charts/csm-authorization-v2.0/.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Chart.lock
2+
charts/*tgz

‎charts/csm-authorization-v2.0/.helmignore

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/
24+
installer/

‎charts/csm-authorization-v2.0/Chart.yaml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
apiVersion: v2
2+
name: csm-authorization
3+
version: v2.0.0-alpha
4+
appVersion: v2.0.0-alpha
5+
type: application
6+
description: |
7+
CSM for Authorization is part of the [Container Storage Modules](https://github.com/dell/csm) open source suite of Kubernetes
8+
storage enablers for Dell EMC storage products. CSM for Authorization provides storage and Kubernetes administrators the ability
9+
to apply RBAC for Dell CSI Drivers.
10+
dependencies:
11+
- name: cert-manager
12+
version: 1.10.0
13+
repository: https://charts.jetstack.io
14+
condition: cert-manager.enabled
15+
- name: ingress-nginx
16+
version: 4.0.19
17+
repository: https://kubernetes.github.io/ingress-nginx
18+
condition: nginx.enabled

‎charts/csm-authorization-v2.0/README.md

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
<!--
2+
Copyright (c) 2022 Dell Inc., or its subsidiaries. All Rights Reserved.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
-->
10+
11+
# Container Storage Modules (CSM) for Authorization Dell Community Helm Chart
12+
13+
CSM for Authorization V2 can be deployed using Helm.
14+
15+
For complete deployment instructions, refer to the [Container Storage Modules documentation](https://dell.github.io/csm-docs/docs/authorization/deployment/helm).
16+
17+
## Helm Chart Versioning
18+
19+
For an explanation and examples on versioning/releasing the CSM for Authorization Helm chart, please see the [contributing guide](../../docs/CONTRIBUTING.md#helm-chart-release-strategy).

‎charts/csm-authorization-v2.0/charts/redis/.helmignore

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎charts/csm-authorization-v2.0/charts/redis/Chart.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: v2
2+
name: redis-csm
3+
description: Helm Chart for Redis with Sentinels
4+
type: application
5+
version: 0.1.0
6+
appVersion: 0.1.0

‎charts/csm-authorization/charts/redis/templates/_helpers.tpl renamed to ‎charts/csm-authorization-v2.0/charts/redis/templates/_helpers.tpl

File renamed without changes.

‎charts/csm-authorization/charts/redis/templates/redis-cm.yaml renamed to ‎charts/csm-authorization-v2.0/charts/redis/templates/redis-cm.yaml

File renamed without changes.

‎charts/csm-authorization/charts/redis/templates/redis-secret.yaml renamed to ‎charts/csm-authorization-v2.0/charts/redis/templates/redis-secret.yaml

File renamed without changes.

‎charts/csm-authorization-v2.0/charts/redis/templates/redis.yaml

Lines changed: 188 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,188 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: {{ .Values.redis.name }}
5+
namespace: {{ include "custom.namespace" . }}
6+
spec:
7+
type:
8+
clusterIP: None
9+
selector:
10+
app: {{ .Values.redis.name }}
11+
ports:
12+
- protocol: TCP
13+
port: 6379
14+
targetPort: 6379
15+
name: {{ .Values.redis.name }}
16+
---
17+
apiVersion: apps/v1
18+
kind: StatefulSet
19+
metadata:
20+
name: {{ .Values.redis.name }}
21+
namespace: {{ include "custom.namespace" . }}
22+
spec:
23+
serviceName: {{ .Values.redis.name }}
24+
replicas: {{ .Values.redis.replicas }}
25+
selector:
26+
matchLabels:
27+
app: {{ .Values.redis.name }}
28+
template:
29+
metadata:
30+
labels:
31+
app: {{ .Values.redis.name }}
32+
annotations:
33+
checksum/secret: {{ include (print $.Template.BasePath "/redis-secret.yaml") . | sha256sum }}
34+
spec:
35+
initContainers:
36+
- name: config
37+
image: {{ .Values.redis.images.redis }}
38+
env:
39+
- name: REDIS_PASSWORD
40+
valueFrom:
41+
secretKeyRef:
42+
name: redis-csm-secret
43+
key: password
44+
45+
command: [ "sh", "-c" ]
46+
args:
47+
- |
48+
cp /csm-auth-redis-cm/redis.conf /etc/redis/redis.conf
49+
echo "masterauth $REDIS_PASSWORD" >> /etc/redis/redis.conf
50+
echo "requirepass $REDIS_PASSWORD" >> /etc/redis/redis.conf
51+
52+
echo "Finding master..."
53+
MASTER_FDQN=`hostname -f | sed -e 's/{{ .Values.redis.name }}-[0-9]\./{{ .Values.redis.name }}-0./'`
54+
echo "Master at " $MASTER_FQDN
55+
if [ "$(redis-cli -h sentinel -p 5000 ping)" != "PONG" ]; then
56+
echo "No sentinel found..."
57+
if [ "$(hostname)" = "{{ .Values.redis.name }}-0" ]; then
58+
echo "This is Redis master, not updating redis.conf..."
59+
else
60+
echo "This is Redis replica, updating redis.conf..."
61+
echo "replicaof $MASTER_FDQN 6379" >> /etc/redis/redis.conf
62+
fi
63+
else
64+
echo "Sentinel found, finding master..."
65+
MASTER="$(redis-cli -h sentinel -p 5000 sentinel get-master-addr-by-name mymaster | grep -E '(^redis-csm-\d{1,})|([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})')"
66+
echo "replicaof $MASTER_FDQN 6379" >> /etc/redis/redis.conf
67+
fi
68+
volumeMounts:
69+
- name: redis-primary-volume
70+
mountPath: /data
71+
- name: configmap
72+
mountPath: /csm-auth-redis-cm/
73+
- name: config
74+
mountPath: /etc/redis/
75+
containers:
76+
- name: {{ .Values.redis.name }}
77+
image: {{ .Values.redis.images.redis }}
78+
command: ["redis-server"]
79+
args: ["/etc/redis/redis.conf"]
80+
ports:
81+
- containerPort: 6379
82+
name: {{ .Values.redis.name }}
83+
volumeMounts:
84+
- name: redis-primary-volume
85+
mountPath: /data
86+
- name: configmap
87+
mountPath: /csm-auth-redis-cm/
88+
- name: config
89+
mountPath: /etc/redis/
90+
volumes:
91+
- name: redis-primary-volume
92+
emptyDir: {}
93+
- name: config
94+
emptyDir: {}
95+
- name: configmap
96+
configMap:
97+
name: redis-csm-cm
98+
---
99+
apiVersion: apps/v1
100+
kind: Deployment
101+
metadata:
102+
name: {{ .Values.redis.rediscommander }}
103+
namespace: {{ include "custom.namespace" . }}
104+
spec:
105+
replicas: 1
106+
selector:
107+
matchLabels:
108+
app: {{ .Values.redis.rediscommander }}
109+
template:
110+
metadata:
111+
labels:
112+
app: {{ .Values.redis.rediscommander }}
113+
tier: backend
114+
annotations:
115+
checksum/secret: {{ include (print $.Template.BasePath "/redis-secret.yaml") . | sha256sum }}
116+
spec:
117+
containers:
118+
- name: {{ .Values.redis.rediscommander }}
119+
image: {{ .Values.redis.images.commander }}
120+
imagePullPolicy: IfNotPresent
121+
env:
122+
{{- $str := "" -}}
123+
{{- $ns := include "custom.namespace" . -}}
124+
{{- $replicas := .Values.redis.replicas | int }}
125+
{{- $sentinel := .Values.redis.sentinel }}
126+
{{- range $i, $e := until $replicas }}
127+
{{- if $i }}
128+
{{- $str = print $str "," -}}
129+
{{- end }}
130+
{{- $str = printf "%s%s-%d.%s.%s.svc.cluster.local:5000" $str $sentinel $i $sentinel $ns -}}
131+
{{- end }}
132+
- name: SENTINELS
133+
value: {{ $str | quote }}
134+
- name: K8S_SIGTERM
135+
value: "1"
136+
- name: REDIS_PASSWORD
137+
valueFrom:
138+
secretKeyRef:
139+
name: redis-csm-secret
140+
key: password
141+
- name: SENTINEL_PASSWORD
142+
valueFrom:
143+
secretKeyRef:
144+
name: redis-csm-secret
145+
key: password
146+
- name: HTTP_PASSWORD
147+
valueFrom:
148+
secretKeyRef:
149+
name: redis-csm-secret
150+
key: password
151+
- name: HTTP_USER
152+
valueFrom:
153+
secretKeyRef:
154+
name: redis-csm-secret
155+
key: commander_user
156+
ports:
157+
- name: {{ .Values.redis.rediscommander }}
158+
containerPort: 8081
159+
livenessProbe:
160+
httpGet:
161+
path: /favicon.png
162+
port: 8081
163+
initialDelaySeconds: 10
164+
timeoutSeconds: 5
165+
resources:
166+
limits:
167+
cpu: "500m"
168+
memory: "512M"
169+
securityContext:
170+
runAsNonRoot: true
171+
readOnlyRootFilesystem: false
172+
allowPrivilegeEscalation: false
173+
capabilities:
174+
drop:
175+
- ALL
176+
---
177+
apiVersion: v1
178+
kind: Service
179+
metadata:
180+
name: {{ .Values.redis.rediscommander }}
181+
namespace: {{ include "custom.namespace" . }}
182+
spec:
183+
selector:
184+
app: {{ .Values.redis.rediscommander }}
185+
ports:
186+
- protocol: TCP
187+
port: 8081
188+
targetPort: 8081

‎charts/csm-authorization/charts/redis/templates/sentinel.yaml renamed to ‎charts/csm-authorization-v2.0/charts/redis/templates/sentinel.yaml

File renamed without changes.

‎charts/csm-authorization-v2.0/charts/redis/values.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
redis:
2+
name: redis-csm
3+
sentinel: sentinel
4+
rediscommander: rediscommander
5+
replicas: 5
6+
images:
7+
redis: amaas-eos-mw1.cec.lab.emc.com:5046/redis:7.2.4-alpine
8+
commander: rediscommander/redis-commander:latest

‎charts/csm-authorization/crds/csm-authorization.storage.dell.com_csmroles.yaml renamed to ‎charts/csm-authorization-v2.0/crds/csm-authorization.storage.dell.com_csmroles.yaml

File renamed without changes.

‎charts/csm-authorization/crds/csm-authorization.storage.dell.com_csmtenants.yaml renamed to ‎charts/csm-authorization-v2.0/crds/csm-authorization.storage.dell.com_csmtenants.yaml

File renamed without changes.

‎charts/csm-authorization/crds/csm-authorization.storage.dell.com_storages.yaml renamed to ‎charts/csm-authorization-v2.0/crds/csm-authorization.storage.dell.com_storages.yaml

File renamed without changes.

‎charts/csm-authorization-v2.0/policies/common.rego

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
package karavi.common
2+
default roles = {}
3+
roles = {}
4+

‎charts/csm-authorization-v2.0/policies/sdc-approve.rego

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# Copyright © 2023 Dell Inc., or its subsidiaries. All Rights Reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http:#www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
package karavi.sdc.approve
16+
17+
import data.karavi.common
18+
19+
# Allow requests by default.
20+
default allow = true
21+
22+
default response = {
23+
"allowed": true
24+
}
25+
response = {
26+
"allowed": false,
27+
"status": {
28+
"reason": reason,
29+
},
30+
} {
31+
reason = concat(", ", deny)
32+
reason != ""
33+
}
34+
35+
default claims = {}
36+
claims = input.claims
37+
deny[msg] {
38+
claims == {}
39+
msg := sprintf("missing claims", [])
40+
}

‎charts/csm-authorization/policies/snapshot-create-test.rego renamed to ‎charts/csm-authorization-v2.0/policies/snapshot-create-test.rego

File renamed without changes.

‎charts/csm-authorization/policies/snapshot-create.rego renamed to ‎charts/csm-authorization-v2.0/policies/snapshot-create.rego

File renamed without changes.

0 commit comments

Comments
 (0)