From 6ca0c8b4af3aeefa57b24ef465cb4978368d243a Mon Sep 17 00:00:00 2001 From: Venkata Krishna Rohit Sakala Date: Fri, 4 Aug 2023 13:03:35 -0700 Subject: [PATCH 1/3] make prepare/make patch --- .../patch/templates/deployment.yaml.patch | 11 +++++++++++ packages/ui-plugin-operator/package.yaml | 2 +- 2 files changed, 12 insertions(+), 1 deletion(-) create mode 100644 packages/ui-plugin-operator/generated-changes/patch/templates/deployment.yaml.patch diff --git a/packages/ui-plugin-operator/generated-changes/patch/templates/deployment.yaml.patch b/packages/ui-plugin-operator/generated-changes/patch/templates/deployment.yaml.patch new file mode 100644 index 0000000000..a68c5606a2 --- /dev/null +++ b/packages/ui-plugin-operator/generated-changes/patch/templates/deployment.yaml.patch @@ -0,0 +1,11 @@ +--- charts-original/templates/deployment.yaml ++++ charts/templates/deployment.yaml +@@ -37,7 +37,7 @@ + - name: {{ .Chart.Name }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} +- image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" ++ image: "{{ template "system_default_registry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: http diff --git a/packages/ui-plugin-operator/package.yaml b/packages/ui-plugin-operator/package.yaml index 7faa901dde..523843c116 100644 --- a/packages/ui-plugin-operator/package.yaml +++ b/packages/ui-plugin-operator/package.yaml @@ -1,7 +1,7 @@ url: https://github.com/rancher/ui-plugin-operator.git subdirectory: charts/ui-plugin-operator commit: 4f3ccc34f78f1cd828c83b6f37b6384e1ecb8d5f -version: 102.0.1 +version: 102.0.2 additionalCharts: - workingDir: charts-crd crdOptions: From 55af894ff34f040da17dc6f6ee513a035a31b2a2 Mon Sep 17 00:00:00 2001 From: Venkata Krishna Rohit Sakala Date: Fri, 4 Aug 2023 13:04:16 -0700 Subject: [PATCH 2/3] make charts --- ...ui-plugin-operator-crd-102.0.2+up0.2.1.tgz | Bin 0 -> 822 bytes .../ui-plugin-operator-102.0.2+up0.2.1.tgz | Bin 0 -> 4354 bytes .../102.0.2+up0.2.1/Chart.yaml | 10 ++ .../102.0.2+up0.2.1/README.md | 2 + .../102.0.2+up0.2.1/templates/crds.yaml | 61 +++++++++ .../102.0.2+up0.2.1/Chart.yaml | 19 +++ .../102.0.2+up0.2.1/app-readme.md | 21 +++ .../102.0.2+up0.2.1/templates/_helpers.tpl | 89 +++++++++++++ .../templates/dashboardrole.yaml | 33 +++++ .../102.0.2+up0.2.1/templates/deployment.yaml | 67 ++++++++++ .../102.0.2+up0.2.1/templates/hardened.yaml | 123 ++++++++++++++++++ .../102.0.2+up0.2.1/templates/service.yaml | 15 +++ .../templates/serviceaccount.yaml | 101 ++++++++++++++ .../templates/validate-psp-install.yaml | 7 + .../102.0.2+up0.2.1/values.yaml | 69 ++++++++++ index.yaml | 37 ++++++ 16 files changed, 654 insertions(+) create mode 100644 assets/ui-plugin-operator-crd/ui-plugin-operator-crd-102.0.2+up0.2.1.tgz create mode 100644 assets/ui-plugin-operator/ui-plugin-operator-102.0.2+up0.2.1.tgz create mode 100644 charts/ui-plugin-operator-crd/102.0.2+up0.2.1/Chart.yaml create mode 100644 charts/ui-plugin-operator-crd/102.0.2+up0.2.1/README.md create mode 100644 charts/ui-plugin-operator-crd/102.0.2+up0.2.1/templates/crds.yaml create mode 100644 charts/ui-plugin-operator/102.0.2+up0.2.1/Chart.yaml create mode 100644 charts/ui-plugin-operator/102.0.2+up0.2.1/app-readme.md create mode 100644 charts/ui-plugin-operator/102.0.2+up0.2.1/templates/_helpers.tpl create mode 100644 charts/ui-plugin-operator/102.0.2+up0.2.1/templates/dashboardrole.yaml create mode 100644 charts/ui-plugin-operator/102.0.2+up0.2.1/templates/deployment.yaml create mode 100644 charts/ui-plugin-operator/102.0.2+up0.2.1/templates/hardened.yaml create mode 100644 charts/ui-plugin-operator/102.0.2+up0.2.1/templates/service.yaml create mode 100644 charts/ui-plugin-operator/102.0.2+up0.2.1/templates/serviceaccount.yaml create mode 100644 charts/ui-plugin-operator/102.0.2+up0.2.1/templates/validate-psp-install.yaml create mode 100644 charts/ui-plugin-operator/102.0.2+up0.2.1/values.yaml diff --git a/assets/ui-plugin-operator-crd/ui-plugin-operator-crd-102.0.2+up0.2.1.tgz b/assets/ui-plugin-operator-crd/ui-plugin-operator-crd-102.0.2+up0.2.1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..10be7783381ccf812868a6d04938ee5649bfc023 GIT binary patch literal 822 zcmV-61Ihd!iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PI&wZ{s!)_F2DTuss%5C_j=yx4_u~IkX6}*xbkD#Nvh`33BAt zDEi+EJ>2*q$5|x1iv{#u1dWC>-;n%9WTnU6R4Z-A&Qm~kVJw5XSQHpI-C$`(Z-)>< zT+U|AQwVYR6!Xb^l+9+B)5&~xIlUT*Y(Af4BM|S9`z)%+7)IjFxekl_Nr2WmM%K>8 zJOPl%Xxu85$ZROp?m|*v{isRh5YWnkLa$q)l_HzN2M!f|=ykDJQuHV(ht@cL-h6Qr znabW_fec}!aXmbT{{5Pu*AEn;b~cA~mMDrcXwS|2t&NPvMBsv8aeoux(S@EsY4TzU z-gwFZy*FAm6PB#E88b0SMLPMl@*D@6LI2+ayTU=Q>2D@mzs2oh47&svH(oWLMr(bXAaaLyy|(Mg}D@DrBtt z$5uh@o{H&_oRjED)}E{2DxV+gy$jNGBY-yb=i9p`USsm63TSqcG}fr?sxla!?FoPn z6e+CfvwgDeFZ;VDqhbz^Xd)#5QMy{ve{TDdN&q@dH|fWKN;Ng2xeMAdg@rR!X*+Ub z_!6DHLoRYi>$=jeSEY3YjmvgMTK-L{&fd0@$U)mxPc%lZV%o9U3-z#PdsUeFvCrqz zj^!vs>$1+;iIoMFn0LO;lfAyXeVBgQGuKmH_Yc}T}*b?ds)_R#v$h#F*- zciM8_Hvn51gG)m>)W4-(m!s+%en>1 z;zam%?9w?yXnQ=izteBR?c}7K_|PinwR>0ARX3VCW`BnHN!Go@j*LxzQ#-LEyMU|R zY_VE~u515Kyekj>`S)i!tPFT}oH+m8f4si=<6~N?_sDVX{+CT>hxb1*yBf}a-vhs# zy6#-VeS6&lSzut`0vYttRjP`lV7ckNPW|ZG1`HT5V8Cho7XSeN{~74_;Q$r@0OQ)B ABme*a literal 0 HcmV?d00001 diff --git a/assets/ui-plugin-operator/ui-plugin-operator-102.0.2+up0.2.1.tgz b/assets/ui-plugin-operator/ui-plugin-operator-102.0.2+up0.2.1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..1b9c583c6a1709625efd8acda5fae6515d5fc181 GIT binary patch literal 4354 zcmV+d5&iBTiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PH+#Z`?SN^I5;5AkV^y*HSUc>q_RYhTe!t&8+~2o<`~80V?_hY?|7Nhif4Db1*gxER^-X`U|LUOs4fG#q z{Eekhn#gbZ_a3V~x&I}Fa4s~_RB$y401~1J6SFuWS~HBP=#fH;h;pR~Vl-F zYPAa&l&9iCbvF0(XwG05zw#3p#;>o(Um`=I(9>&uRRWUJzm{+pgMj3D^|K!j;z5w2 zN+iv-tvc!;IaoOWQz5|thm3GC!wk6w%Hh;6=Q%DfgiO^ah=AldqlsguAOgy#k|-^U zL>Cf+YmwE<97pxeK}C~6e;D`U;U9~<9}nX}@YMU||61vg{|mwjR1c^CZjk@O{r<2e z{||=!gJ=2w7-b87z$q!12Dj{XzblgE4C7!6-p;84s(`@XkAC?%nhKc_tuciubq#*N zgb|6bAd->^Lj_vE1R*C%VG5LM0ZUOx(3s_nXjE|!NVGfsSQK23U=Rc}BQrGmM`A7% z)j}>SebMU>7yx;}*jO-{EJtv}F38fzSWRXl2p3ksg&yj-VC)PNiCT@|{RbNyq) zj!)Gt91A|BvtLNAb}hbs|5RgkU}h0Hn$0B6HsfL?LizgqwQ9VrfRPf?TTya{owgg& zH_KK2V@bFgD!IxVENR#@#Yr(M$!mZ7j0I>rC_40iC8>KK=g4xDD%SaZOo1Ep z|3QCm(9-{}_V)Ll_5Wj(%gf$Q@Z;y)Y;!$FFq#m=)IKLR5D@J2uC9X1%gF3n$`QhK zo{3Gj5TaE>yS-xs#X4sQgOga!I+KLih(2{XvB-SZ>hUb6WRfga2v^Yxa$IR?VW?#r2%xS}`&~cDn_( z9agK`o>iUT?%BKa@WmK5j3fx*A43Q~hF`z2M3xEekX5%r)-`q5&XHxYn)mDkMsRrv zlqal6H%>Elh-_@Cyeay#A1tnMm8Zc`71=QFNS?>%)uxWA=v9$~%gc@~U*MmG(Ac8M zIusZBNTbQp0V+AnTX&r_E$!&9p=x`=Q71Moka7dKn3)@7oH( zJ4ryCacg8{q41Uyt((Pft`lp`X0bCop`~VCY$C%-YQ`_G1Iz34uE~{hfY3jLw*t^5 zJ65!CF3(2~@uT!kPv`8N(^Q82I-R8sY0(Ss1i((b{1LA3F_UONJFfVf3vNQl|laM&@Ny1MVgj!8sZyvmVwp4yO%(jC@~Hfzv4_dIaGcapuQ2)g^0$qZ2>&#Q2m4Xq$a<2K31w7MRI#yAyugZoqPmn_2F?UEX>ILQ zjJmO^8yj^j@lzY7&*f3dM*lA*YCaJ}rcyAxdqDW6{NLWeVblK`_78^p&;H+IlzN^> zPDm1yLeGWtF~|7)wKJjy!8zsW2u=mVAVW=3qRA)#s7#T%d3tpfRjlLN_+(q#+OX9| zM}oJKTwsgjc?Zxy7B=)10mE;vAFYjJ zYnqBa&V|%)brr7qsju$1KsoUvZ|`geQ4|GtApf5!Pbr^0;VKA*r#Llj%5~U)d;m~m zo!g+QipjrYqU}Pvu6B&7uQOvtW-#QM8V^6cB`#0B+kSs#v;4=LiDicTe#b#>kpKJr z!-KZ`@4tGE|2;~n3m}r`Y9(uas22Y=qNXJ}tbMz|D`S;I{{=YZDRK?_28_zlW>vg_ z%!RHbYAvxA`-F)bc$EpO$=|ZlHK}=H0HrDJP_<`Qey-tuGxqCYiPbC)-5BL2@?+Ep zSPoz_FD16kG@1ipMR4GZwUz_vW@IyfJnDiP{x@detj8pt(rr`O=ta8GYSukI*!Vpnf)19IyT znC@+DijUx;tSwfwK@^mwBM-eQ_0_J7rbhc3H3q{bWOrf!LPG+-)i%UdVz|1h$p+gw zUL}KDrki`M$qc@&6qH0p6B&{(s8!u`rF-@b-9Idq?D~F-Qar%59Dxwz$ydPn(m7Ac|~tS6#$#f$X~)MOGQuj;L8}q~=M2 zvO$Y!T8(Nv)9++_uvub87syemu@n;=HC}-w{7+Nc^)@utSl9c|& zqcr>;=n}={iH(|CDbH}+P4qss(ehj#tZcOZ=R~H+F}>$mz?<^_hkJYN{Qv&pt7rTF zF-n!&wJ`u?GrTm>5Ps~3T|okukXrc+6JtHEoQ8iDlUoHQa?>qR=`$NmX*-#;wjMXxO{pdlsYq)bU_);>PNEYLg_cCFN8dAR-TNH zn-$}eA66ABjp$CG7Ys+R{Y#b&%Vx z)~L`*sYZ}d?mjngB_p3laCmUAcMt$fmD^|!1kQN9zjC%T6Z;p+&?jsvk}L!(vJzMX z+seiPx7%@mn~Z?=*5Yn)D4(s#Fu!isvYFSHkv%1E{$JxRZ&y?dVtBXqnFIjkGl{Ac z#-;|_6>b;2UFN0CK5>2Q^N;TFvAyh#{$H8HyyvH2H~4@3!$JG|uUC8f&)M2chq1Je>HG&W_rMym$t}*Pi z)?q!C|Nc8*=Ue&okI&Wj@ZcYksC9q+HesmW#vOmi89h7SzZ2*Cscn+y@_1#V{l6fL zrbJ_utGvvX-N6gE(f{wa?*AGNUhO^Se;=i6c^xv-@PZ+S7fgurB8PC3Wf4MHQ_dlT z=HJVg(6{N~t*=o_TeX9pFYXt3UWP9#h*Lrtgm35QJ^$((wN#+8gU!jpebBfD29Cxj zl{FT_*nQfaQe}{a@!41bcuZdwcus`yUSW4u{YC|1ru|d5>GyrF+5K6_Xp&OMw;~?1Df_L^{2IVu;uXba@Vh|4x z{%Gx(|NhVa3eGf<+O(p4t<^5P9}9brjos%^CaONXa9{HDdd<%xQ<11%B6xziR=qMW z+sj27l|TG(klsrtNhXLKBxYiPDNLov?1XE09F0%n3fChA#E6)J>0Q{_@dBjSG|`Bm#cUG4Z!rPTkJ{#ArVOn1x%3(?thMZF%peUa) z1UEqkeza-6t95K4KQ-K25wXt6ovd3b4vUppcB@+!lmLNGb7WZw>Jz-c1#&}JGeAao zK^R*?!jNz%^3_~l8g?o#8(~=LxW5=+0-w|Uq}J1**A zH21v}rUomj4g1dto36w`Db}iM^-N`X!n{OjDr9XBIGnw_u$$E0cV-$HZfOg)qco$+ z$kO{rHc|rVy(}+Q^Y_+N*3h-Um2WsL>0@mZr4Rx97QImf4V{S5#s6~plY wx@T#xUm= 1.16.0-0 < 1.27.0-0' + catalog.cattle.io/namespace: cattle-ui-plugin-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux, windows + catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0' + catalog.cattle.io/release-name: ui-plugin-operator +apiVersion: v1 +appVersion: 0.1.1 +description: A UI Plugin Operator Chart for plugin management in Rancher +keywords: +- applications +- infrastructure +name: ui-plugin-operator +type: application +version: 102.0.2+up0.2.1 diff --git a/charts/ui-plugin-operator/102.0.2+up0.2.1/app-readme.md b/charts/ui-plugin-operator/102.0.2+up0.2.1/app-readme.md new file mode 100644 index 0000000000..3473271768 --- /dev/null +++ b/charts/ui-plugin-operator/102.0.2+up0.2.1/app-readme.md @@ -0,0 +1,21 @@ +# Rancher UI Plugin Operator + +This chart works together with the Rancher UI extensions feature to enable the ability to install UI extensions in your cluster. + +## Upgrading to Kubernetes v1.25+ + ​ +Starting in Kubernetes v1.25, [Pod Security Policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/) have been removed from the Kubernetes API. + ​ +As a result, **before upgrading to Kubernetes v1.25** (or on a fresh install in a Kubernetes v1.25+ cluster), users are expected to perform an in-place upgrade of this chart with `global.cattle.psp.enabled` set to `false` if it has been previously set to `true`. +​ +> **Note:** +> In this chart release, any previous field that was associated with any PSP resources have been removed in favor of a single global field: `global.cattle.psp.enabled`. + ​ +> **Note:** +> If you upgrade your cluster to Kubernetes v1.25+ before removing PSPs via a `helm upgrade` (even if you manually clean up resources), **it will leave the Helm release in a broken state within the cluster such that further Helm operations will not work (`helm uninstall`, `helm upgrade`, etc.).** +> +> If your charts get stuck in this state, please consult the Rancher docs on how to clean up your Helm release secrets. +​ +Upon setting `global.cattle.psp.enabled` to false, the chart will remove any PSP resources deployed on its behalf from the cluster. This is the default setting for this chart. +​ +As a replacement for PSPs, [Pod Security Admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/) should be used. Please consult the Rancher docs for more details on how to configure your chart release namespaces to work with the new Pod Security Admission and apply Pod Security Standards. diff --git a/charts/ui-plugin-operator/102.0.2+up0.2.1/templates/_helpers.tpl b/charts/ui-plugin-operator/102.0.2+up0.2.1/templates/_helpers.tpl new file mode 100644 index 0000000000..0d41d827fc --- /dev/null +++ b/charts/ui-plugin-operator/102.0.2+up0.2.1/templates/_helpers.tpl @@ -0,0 +1,89 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "ui-plugin-operator.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "ui-plugin-operator.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "ui-plugin-operator.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "ui-plugin-operator.labels" -}} +helm.sh/chart: {{ include "ui-plugin-operator.chart" . }} +{{ include "ui-plugin-operator.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "ui-plugin-operator.selectorLabels" -}} +app.kubernetes.io/name: {{ include "ui-plugin-operator.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "ui-plugin-operator.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "ui-plugin-operator.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} + +{{/* +Windows cluster will add default taint for linux nodes, +add below linux tolerations to workloads could be scheduled to those linux nodes +*/}} +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +{{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}} +beta.kubernetes.io/os: linux +{{- else -}} +kubernetes.io/os: linux +{{- end -}} +{{- end -}} diff --git a/charts/ui-plugin-operator/102.0.2+up0.2.1/templates/dashboardrole.yaml b/charts/ui-plugin-operator/102.0.2+up0.2.1/templates/dashboardrole.yaml new file mode 100644 index 0000000000..e8b7c456cf --- /dev/null +++ b/charts/ui-plugin-operator/102.0.2+up0.2.1/templates/dashboardrole.yaml @@ -0,0 +1,33 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ .Chart.Name }}-dashboard + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Chart.Name }} +rules: +- apiGroups: + - "" + resources: + - services/proxy + resourceNames: + - "http:{{ .Chart.Name }}:{{ .Values.service.port }}" + - "https:{{ .Chart.Name }}:{{ .Values.service.port }}" + verbs: + - '*' +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ .Chart.Name }}-dashboard + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Chart.Name }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ .Chart.Name }}-dashboard +subjects: +- kind: Group + name: system:authenticated + apiGroup: rbac.authorization.k8s.io diff --git a/charts/ui-plugin-operator/102.0.2+up0.2.1/templates/deployment.yaml b/charts/ui-plugin-operator/102.0.2+up0.2.1/templates/deployment.yaml new file mode 100644 index 0000000000..7cf9e5dc7e --- /dev/null +++ b/charts/ui-plugin-operator/102.0.2+up0.2.1/templates/deployment.yaml @@ -0,0 +1,67 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ .Chart.Name }} + labels: + {{- include "ui-plugin-operator.labels" . | nindent 4 }} +spec: + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicas }} + {{- end }} + selector: + matchLabels: + {{- include "ui-plugin-operator.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "ui-plugin-operator.selectorLabels" . | nindent 8 }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} +{{- if .Values.nodeSelector }} +{{ toYaml .Values.nodeSelector | indent 8 }} +{{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} +{{- if .Values.tolerations }} +{{ toYaml .Values.tolerations | indent 8 }} +{{- end }} + serviceAccountName: {{ .Chart.Name }} + containers: + - name: {{ .Chart.Name }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ template "system_default_registry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: http + containerPort: 80 + protocol: TCP + args: + - {{ template "ui-plugin-operator.name" . }} +{{- if .Values.debug }} + - --debug + - --debug-level={{ .Values.debugLevel }} +{{- end }} +{{- if .Values.additionalArgs }} +{{- toYaml .Values.additionalArgs | nindent 10 }} +{{- end }} + # livenessProbe: + # httpGet: + # path: / + # port: http + # readinessProbe: + # httpGet: + # path: / + # port: http + resources: + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/charts/ui-plugin-operator/102.0.2+up0.2.1/templates/hardened.yaml b/charts/ui-plugin-operator/102.0.2+up0.2.1/templates/hardened.yaml new file mode 100644 index 0000000000..9d11df86cc --- /dev/null +++ b/charts/ui-plugin-operator/102.0.2+up0.2.1/templates/hardened.yaml @@ -0,0 +1,123 @@ +{{- $namespaces := dict "_0" .Release.Namespace -}} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ .Chart.Name }}-patch-sa + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Chart.Name }}-patch-sa + annotations: + "helm.sh/hook": post-install, post-upgrade + "helm.sh/hook-delete-policy": hook-succeeded, before-hook-creation +spec: + template: + metadata: + name: {{ .Chart.Name }}-patch-sa + labels: + app: {{ .Chart.Name }}-patch-sa + spec: + serviceAccountName: {{ .Chart.Name }}-patch-sa + securityContext: + runAsNonRoot: true + runAsUser: 1000 + restartPolicy: Never + containers: + {{- range $_, $ns := $namespaces }} + - name: patch-sa-{{ $ns }} + image: {{ template "system_default_registry" $ }}{{ $.Values.global.kubectl.repository }}:{{ $.Values.global.kubectl.tag }} + imagePullPolicy: {{ $.Values.global.kubectl.pullPolicy }} + command: ["kubectl", "patch", "serviceaccount", "default", "-p", "{\"automountServiceAccountToken\": false}"] + args: ["-n", "{{ $ns }}"] + {{- end }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Chart.Name }}-patch-sa + labels: + app: {{ .Chart.Name }}-patch-sa +rules: +- apiGroups: + - "" + resources: + - serviceaccounts + verbs: ['get', 'patch'] +{{- if .Values.global.cattle.psp.enabled }} +- apiGroups: ['policy'] + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: + - {{ .Chart.Name }}-patch-sa +{{- end }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ .Chart.Name }}-patch-sa + labels: + app: {{ .Chart.Name }}-patch-sa +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ .Chart.Name }}-patch-sa +subjects: +- kind: ServiceAccount + name: {{ .Chart.Name }}-patch-sa + namespace: {{ .Release.Namespace }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ .Chart.Name }}-patch-sa + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Chart.Name }}-patch-sa +--- +{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicies" }} +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ .Chart.Name }}-patch-sa + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Chart.Name }}-patch-sa +spec: + privileged: false + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + rule: 'MustRunAsNonRoot' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + - min: 1 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + - min: 1 + max: 65535 + readOnlyRootFilesystem: false + volumes: + - 'secret' +{{- end }} +{{- range $_, $ns := $namespaces }} +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default-allow-all + namespace: {{ $ns }} +spec: + podSelector: {} + ingress: + - {} + egress: + - {} + policyTypes: + - Ingress + - Egress +{{- end }} diff --git a/charts/ui-plugin-operator/102.0.2+up0.2.1/templates/service.yaml b/charts/ui-plugin-operator/102.0.2+up0.2.1/templates/service.yaml new file mode 100644 index 0000000000..7c4e735e9d --- /dev/null +++ b/charts/ui-plugin-operator/102.0.2+up0.2.1/templates/service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ .Chart.Name }} + labels: + {{- include "ui-plugin-operator.labels" . | nindent 4 }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: {{ .Values.service.targetPort }} + protocol: TCP + name: http + selector: + {{- include "ui-plugin-operator.selectorLabels" . | nindent 4 }} diff --git a/charts/ui-plugin-operator/102.0.2+up0.2.1/templates/serviceaccount.yaml b/charts/ui-plugin-operator/102.0.2+up0.2.1/templates/serviceaccount.yaml new file mode 100644 index 0000000000..d43d0492b0 --- /dev/null +++ b/charts/ui-plugin-operator/102.0.2+up0.2.1/templates/serviceaccount.yaml @@ -0,0 +1,101 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ .Chart.Name }} + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Chart.Name }} +rules: +- apiGroups: [""] + resources: ["configmaps"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ .Chart.Name }} + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Chart.Name }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ .Chart.Name }} +subjects: +- kind: ServiceAccount + name: {{ .Chart.Name }} + namespace: {{ .Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Chart.Name }} + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Chart.Name }} +rules: +- apiGroups: ["catalog.cattle.io"] + resources: + - uiplugins + - uiplugins/status + verbs: ["*"] +- apiGroups: ["coordination.k8s.io"] + resources: + - leases + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ .Chart.Name }} + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Chart.Name }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ .Chart.Name }} +subjects: +- kind: ServiceAccount + name: {{ .Chart.Name }} + namespace: {{ .Release.Namespace }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ .Chart.Name }} + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Chart.Name }} +--- +{{- if .Values.global.cattle.psp.enabled }} +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ .Chart.Name }} + namespace: {{ .Release.Namespace }} + labels: + app: {{ .Chart.Name }} +spec: + privileged: false + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + rule: 'MustRunAsNonRoot' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + - min: 1 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + - min: 1 + max: 65535 + readOnlyRootFilesystem: false + volumes: + - 'secret' +{{- end }} diff --git a/charts/ui-plugin-operator/102.0.2+up0.2.1/templates/validate-psp-install.yaml b/charts/ui-plugin-operator/102.0.2+up0.2.1/templates/validate-psp-install.yaml new file mode 100644 index 0000000000..a30c59d3b7 --- /dev/null +++ b/charts/ui-plugin-operator/102.0.2+up0.2.1/templates/validate-psp-install.yaml @@ -0,0 +1,7 @@ +#{{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}} +#{{- if .Values.global.cattle.psp.enabled }} +#{{- if not (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") }} +#{{- fail "The target cluster does not have the PodSecurityPolicy API resource. Please disable PSPs in this chart before proceeding." -}} +#{{- end }} +#{{- end }} +#{{- end }} diff --git a/charts/ui-plugin-operator/102.0.2+up0.2.1/values.yaml b/charts/ui-plugin-operator/102.0.2+up0.2.1/values.yaml new file mode 100644 index 0000000000..b2b4cf2d5a --- /dev/null +++ b/charts/ui-plugin-operator/102.0.2+up0.2.1/values.yaml @@ -0,0 +1,69 @@ +# Default values for sample. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +image: + repository: rancher/ui-plugin-operator + pullPolicy: Always + tag: "v0.1.1" + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +service: + type: ClusterIP + port: 80 + targetPort: 8080 + +autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 100 + targetCPUUtilizationPercentage: 80 + +replicas: 1 + +resources: {} + +securityContext: + runAsNonRoot: true + runAsUser: 1000 + +nodeSelector: {} + +tolerations: [] + +affinity: {} + +podAnnotations: [] + +additionalArgs: [] + +global: + cattle: + systemDefaultRegistry: "" + psp: + enabled: false # PSP enablement should default to false + kubectl: + repository: rancher/kubectl + tag: v1.20.2 + pullPolicy: IfNotPresent + rbac: + ## Create RBAC resources for ServiceAccounts and users + ## + enabled: false + # create: true + # userRoles: + # ## Create default user ClusterRoles to allow users to interact with Prometheus CRs, ConfigMaps, and Secrets + # create: true + # ## Aggregate default user ClusterRoles into default k8s ClusterRoles + # aggregateToDefaultRoles: true + + # pspEnabled: true + # pspAnnotations: {} + +debug: false +debugLevel: 0 diff --git a/index.yaml b/index.yaml index 3ac70c82fe..db18fdeac2 100755 --- a/index.yaml +++ b/index.yaml @@ -15934,6 +15934,29 @@ entries: - assets/system-upgrade-controller/system-upgrade-controller-100.0.0+up0.3.0.tgz version: 100.0.0+up0.3.0 ui-plugin-operator: + - annotations: + catalog.cattle.io/auto-install: ui-plugin-operator-crd=match + catalog.cattle.io/certified: rancher + catalog.cattle.io/display-name: UI Plugin Operator + catalog.cattle.io/kube-version: '>= 1.16.0-0 < 1.27.0-0' + catalog.cattle.io/namespace: cattle-ui-plugin-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux, windows + catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0' + catalog.cattle.io/release-name: ui-plugin-operator + apiVersion: v1 + appVersion: 0.1.1 + created: "2023-08-04T13:03:43.76033-07:00" + description: A UI Plugin Operator Chart for plugin management in Rancher + digest: ceec63170a1059a0d02796333fdd74734bf33683f03e65acf3e5a51532834249 + keywords: + - applications + - infrastructure + name: ui-plugin-operator + type: application + urls: + - assets/ui-plugin-operator/ui-plugin-operator-102.0.2+up0.2.1.tgz + version: 102.0.2+up0.2.1 - annotations: catalog.cattle.io/auto-install: ui-plugin-operator-crd=match catalog.cattle.io/certified: rancher @@ -16004,6 +16027,20 @@ entries: - assets/ui-plugin-operator/ui-plugin-operator-101.0.0+up0.1.0.tgz version: 101.0.0+up0.1.0 ui-plugin-operator-crd: + - annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/namespace: cattle-ui-plugin-system + catalog.cattle.io/release-name: ui-plugin-operator-crd + apiVersion: v1 + created: "2023-08-04T13:03:43.760741-07:00" + description: Installs the CRDs for ui-plugin-operator. + digest: 72e3b085c4c2b631fbbc59fbf456e24f1549e0af240af5fd129e134cfa280cb0 + name: ui-plugin-operator-crd + type: application + urls: + - assets/ui-plugin-operator-crd/ui-plugin-operator-crd-102.0.2+up0.2.1.tgz + version: 102.0.2+up0.2.1 - annotations: catalog.cattle.io/certified: rancher catalog.cattle.io/hidden: "true" From 5753d544f4fb383fbb963830cc011a0dfbeb272d Mon Sep 17 00:00:00 2001 From: Venkata Krishna Rohit Sakala Date: Fri, 4 Aug 2023 13:05:19 -0700 Subject: [PATCH 3/3] Update release.yaml --- release.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/release.yaml b/release.yaml index 910cffc0c6..059b6aa986 100644 --- a/release.yaml +++ b/release.yaml @@ -65,3 +65,7 @@ rancher-provisioning-capi: - 100.0.0+up0.0.1 rancher-webhook: - 2.0.6+up0.3.6-rc4 +ui-plugin-operator: +- 102.0.2+up0.2.1 +ui-plugin-operator-crd: +- 102.0.2+up0.2.1 \ No newline at end of file