Merge pull request #19 from 7knot/support/update-panope

support(panope): update panope chart.
growilabs · Mar 9, 2022 · 6e71874 · 6e71874
2 parents 5912bf0 + 8852f5e
commit 6e71874
Show file tree

Hide file tree

Showing 7 changed files with 66 additions and 5 deletions.
diff --git a/charts/panope/Chart.yaml b/charts/panope/Chart.yaml
@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.3.2
+version: 0.3.3
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

diff --git a/charts/panope/templates/agent/cluterrole.yaml b/charts/panope/templates/agent/cluterrole.yaml
@@ -21,7 +21,7 @@ rules:
   - get
   - list
   - watch
-  - patch
+  - update
   - delete
 - apiGroups:
   - ""

diff --git a/charts/panope/templates/observer/clusterrole.yaml b/charts/panope/templates/observer/clusterrole.yaml
@@ -20,7 +20,7 @@ rules:
   - get
   - list
   - watch
-  - patch
+  - update
 - apiGroups:
   - ""
   resources:

diff --git a/charts/panope/templates/observer/configmap.yaml b/charts/panope/templates/observer/configmap.yaml
@@ -14,3 +14,7 @@ metadata:
 data:
   HEALTH_CHECK_PORT: {{ .Values.observer.configMap.healthCheckPort | quote }}
   METRICS_PORT: {{ .Values.observer.configMap.metricsPort | quote }}
+  OBSERVER_SUBJECT: {{ required "Invalid value. Values.observer.configMap.observerSubject is required!" .Values.observer.configMap.observerSubject | quote }}
+  CONTROLLER_SUBJECT: {{ required "Invalid value. Values.observer.configMap.controllerSubject is required!" .Values.observer.configMap.controllerSubject | quote }}
+  NATS_URI: {{ required "Invalid value. Values.observer.configMap.natsUri is required!" .Values.observer.configMap.natsUri | quote }}
+
diff --git a/charts/panope/templates/observer/daemonset.yaml b/charts/panope/templates/observer/daemonset.yaml
@@ -27,6 +27,13 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
     spec:
+      volumes:
+      - secret:
+          secretName: {{ include "panope.observer.fullname" . }}
+        name: {{ include "panope.observer.fullname" . }}-creds
+      # necessary to hit the node's metadata server when using Workload Identity
+      hostNetwork: true
+      terminationGracePeriodSeconds: 30 # for graceful shutdown
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
@@ -71,6 +78,15 @@ spec:
         envFrom:
         - configMapRef:
             name: {{ include "panope.observer.fullname" . }}-env
+        volumeMounts:
+        - mountPath: /observer/nats.creds
+          name: {{ include "panope.observer.fullname" . }}-creds
+          subPath: nats.creds
+        # necessary to get the node's preempted status before handle the SIGTERM signal
+        lifecycle:
+          preStop:
+            exec:
+              command: ["sh", "-c", "sleep 5"]
       {{- with .Values.observer.tolerations }}
       tolerations:
         {{- toYaml . | nindent 8 }}

diff --git a/charts/panope/templates/observer/secret.yaml b/charts/panope/templates/observer/secret.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "panope.observer.fullname" . }}
+  labels:
+    {{- include "panope.observer.labels" . | nindent 4 }}
+  {{- with .Values.observer.secret.labels }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.observer.secret.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+type: Opaque
+data:
+  nats.creds: {{ required "Invalid value. Values.observer.secret.nats.credentials is required!" .Values.observer.secret.nats.credentials | b64enc }}
diff --git a/charts/panope/values.yaml b/charts/panope/values.yaml
@@ -117,8 +117,8 @@ agent:
     annotations: {}
 
     natsUri: "wss://nats.panope.net:443"
-    agentSubject:
-    controllerSubject:
+    agentSubject: ""
+    controllerSubject: ""
     healthCheckPort: "4444"
     metricsPort: "2112"
     # configure the maximum number of nodes in the cluster as a percentage
@@ -203,12 +203,37 @@ observer:
     # Annotations to add to the deployment
     annotations: {}
 
+  secret:
+    # labels to add to the secret
+    labels: {}
+    # annotations to add to the secret
+    annotations: {}
+
+    nats:
+      credentials:
+      # credentials: |
+      #   -----BEGIN NATS USER JWT-----
+      #   ------END NATS USER JWT------
+
+      #   ************************* IMPORTANT *************************
+      #   NKEY Seed printed below can be used to sign and prove identity.
+      #   NKEYs are sensitive and should be treated as secrets.
+
+      #   -----BEGIN USER NKEY SEED-----
+      #   ------END USER NKEY SEED------
+
+      #   *************************************************************
+
+
   configMap:
     # labels to add to the config map
     labels: {}
     # annotations to add to the config map
     annotations: {}
 
+    observerSubject: ""
+    controllerSubject: ""
+    natsUri: "wss://nats.panope.net:443"
     healthCheckPort: "4444"
     metricsPort: "2112"