Skip to content

Commit 1902e4a

Browse files
syan-tibcosyan-tibco
authored
[PDP-3496] update recipe (#30)
* [PDP-3496] udpate recipe * Add NFS server * adjust storage * harden the provisioner chart to support restricted profile * Add more space per lint * bump the version for lint * change default to false
1 parent 928d5ff commit 1902e4a

13 files changed

+250
-32
lines changed

‎charts/platform-provisioner-ui/Chart.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
apiVersion: v2
88
name: platform-provisioner-ui
9-
version: "1.0.3"
9+
version: "1.0.8"
1010
appVersion: "2.0.0"
1111
description: A Helm chart for platform-provisioner-ui
1212
type: application

‎charts/platform-provisioner-ui/templates/deployment.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,8 @@ spec:
7070
value: "{{ .Values.guiConfig.tektonAPIVersion }}"
7171
- name: PIPELINES_CLEAN_UP_ENABLED
7272
value: "{{ .Values.guiConfig.pipelinesCleanUpEnabled }}"
73+
- name: PLATFORM_PROVISIONER_UI_SERVICE_PORT
74+
value: "{{ .Values.service.port }}"
7375
ports:
7476
- name: http
7577
containerPort: {{ .Values.service.port }}

‎charts/platform-provisioner-ui/values.yaml

+27-14
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@
1111
replicaCount: 1
1212

1313
image:
14-
repository: ghcr.io/stratosphere/cic2-web-server
15-
pullPolicy: IfNotPresent
14+
repository: ghcr.io/tibcosoftware/platform-provisioner/platform-provisioner-ui
15+
pullPolicy: Always
1616
# Overrides the image tag whose default is the chart appVersion.
1717
tag: ""
1818

@@ -40,20 +40,33 @@ serviceAccount:
4040
podAnnotations: {}
4141
podLabels: {}
4242

43-
podSecurityContext: {}
44-
# fsGroup: 2000
45-
46-
securityContext: {}
47-
# capabilities:
48-
# drop:
49-
# - ALL
50-
# readOnlyRootFilesystem: true
51-
# runAsNonRoot: true
52-
# runAsUser: 1000
53-
43+
# follow Restricted: https://kubernetes.io/docs/concepts/security/pod-security-standards/
44+
podSecurityContext:
45+
seccompProfile:
46+
type: RuntimeDefault # RuntimeDefault or Localhost (must for Restricted)
47+
runAsNonRoot: true # Prevents processes from running as root (both) Container must run as a non-root user (must for Restricted)
48+
runAsUser: 1000 # Explicitly set the user ID for running processes (both) (must for restrict, non-zero or undefined/null)
49+
# runAsGroup: 3000 # Set the group ID for running processes (both)
50+
# fsGroup: 2000 # Specify the group ID for mounted volumes (pod security context only)
51+
# fsGroupChangePolicy: OnRootMismatch # Set the policy for the change of fsGroup in the volume (pod security context only)
52+
# supplementalGroups: [1000,3000] # Specify the group IDs for running processes (pod security context only)
53+
# sysctls: {} # Kernel settings to apply (pod security context only)
54+
# seLinuxOptions: {} # SELinux options to apply (both)
55+
# windowsOptions: {} # Windows options to apply (both)
56+
57+
securityContext:
58+
readOnlyRootFilesystem: true # Prevents the container from writing to the root filesystem (container security context only)
59+
allowPrivilegeEscalation: false # Prevents privilege escalation (container security context only) (must for Restricted)
60+
capabilities: # Add or drop capabilities (container security context only)
61+
drop: ["ALL"] # Drop all capabilities (must for Restricted)
62+
# add: ["NET_BIND_SERVICE"] # Add the NET_BIND_SERVICE capability to the container (only for lower 1024 ports) (allow for Restricted)
63+
# privileged: false # Prevents privilege escalation (container security context only) (for Baseline)
64+
# procMount: Default # Set the mount propagation mode for the container (container security context only)
65+
66+
# must be over 1024
5467
service:
5568
type: ClusterIP
56-
port: 80
69+
port: 8080
5770

5871
ingress:
5972
enabled: false

‎charts/provisioner-config-local/Chart.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ apiVersion: v2
88
name: provisioner-config-local
99
description: Platform Provisioner local config
1010
type: application
11-
version: "1.0.62"
11+
version: "1.0.68"
1212
appVersion: "2.0.0"
1313
home: https://github.com/TIBCOSoftware/tp-helm-charts
1414
maintainers:

‎charts/provisioner-config-local/config/pp-deploy-cp-core-on-prem.yaml

+12-4
Original file line numberDiff line numberDiff line change
@@ -35,10 +35,12 @@ groups:
3535
index: 7
3636
description: |
3737
Cluster storage specific configurations. For the on-perm setup we have
38-
* docker desktop: `hostpath`
39-
* minikube: `standard`
40-
* kind: `standard`
41-
* microk8s: `microk8s-hostpath`
38+
* Docker Desktop: `hostpath` (support ReadWriteMany)
39+
* minikube: `standard` (support ReadWriteMany)
40+
* kind: `standard` (Don't support ReadWriteMany)
41+
* MicroK8s: `microk8s-hostpath` (support ReadWriteMany)
42+
* OpenShift: `crc-csi-hostpath-provisioner` (Don't support ReadWriteMany)
43+
* NFS server provisioner: `nfs` (support ReadWriteMany)
4244
- title: "CP Database"
4345
index: 8
4446
description: |
@@ -165,6 +167,12 @@ options:
165167
guiType: input
166168
reference: "meta.guiEnv.GUI_CP_ADMIN_EMAIL"
167169
description: "The CP admin email. You will get the email in MailDev to reset the password"
170+
- name: "CP from and replyTo email"
171+
groupIndex: 5
172+
type: string
173+
guiType: input
174+
reference: "meta.guiEnv.GUI_CP_FROM_REPLY_TO_EMAIL"
175+
description: "The CP from and replyTo email. You will get the email from this email id"
168176
- name: "CP enable log"
169177
groupIndex: 5
170178
type: boolean

‎charts/provisioner-config-local/config/pp-deploy-tp-base-on-prem-cert.yaml

+35-5
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,12 @@ groups:
1818
index: 7
1919
description: |
2020
Cluster storage specific configurations. For the on-perm setup we have
21-
* docker desktop: `hostpath`
22-
* minikube: `standard`
23-
* kind: `standard`
24-
* microk8s: `microk8s-hostpath`
21+
* Docker Desktop: `hostpath` (support ReadWriteMany)
22+
* minikube: `standard` (support ReadWriteMany)
23+
* kind: `standard` (Don't support ReadWriteMany)
24+
* MicroK8s: `microk8s-hostpath` (support ReadWriteMany)
25+
* OpenShift: `crc-csi-hostpath-provisioner` (Don't support ReadWriteMany)
26+
* NFS server provisioner: `nfs` (support ReadWriteMany)
2527
- title: "Cluster tools"
2628
index: 8
2729
description: |
@@ -95,7 +97,28 @@ options:
9597
required: true
9698
reference: "meta.guiEnv.GUI_TP_STORAGE_CLASS"
9799
description: |
98-
docker desktop: "hostpath", minikube and kind: "standard", microk8s: "microk8s-hostpath"
100+
The storage class for the TP Cluster.
101+
- name: "Storage class name for NFS server provisioner"
102+
groupIndex: 7
103+
type: string
104+
guiType: input
105+
reference: "meta.guiEnv.GUI_TP_STORAGE_CLASS_FOR_NFS_SERVER_PROVISIONER"
106+
description: |
107+
The storage class name that NFS server provisioner will use. Empty means use the default storage class.
108+
- name: "NFS server provisioner storage class name"
109+
groupIndex: 7
110+
type: string
111+
guiType: input
112+
reference: "meta.guiEnv.GUI_TP_NFS_SERVER_PROVISIONER_STORAGE_CLASS_NAME"
113+
description: |
114+
The storage class name that NFS server provisioner will create for the TP Cluster.
115+
- name: "NFS server provisioner size"
116+
groupIndex: 7
117+
type: string
118+
guiType: input
119+
reference: "meta.guiEnv.GUI_TP_NFS_SERVER_PROVISIONER_SIZE"
120+
description: |
121+
The size of the NFS server provisioner storage.
99122
100123
# groupIndex: 8 Cluster tools
101124
- name: "Install cert-manager"
@@ -112,6 +135,13 @@ options:
112135
reference: "meta.guiEnv.GUI_TP_INSTALL_METRICS_SERVER"
113136
description: |
114137
Install metrics-server for TP Cluster
138+
- name: "Install nfs-server-provisioner"
139+
groupIndex: 8
140+
type: boolean
141+
guiType: checkbox
142+
reference: "meta.guiEnv.GUI_TP_INSTALL_NFS_SERVER_PROVISIONER"
143+
description: |
144+
Install NFS server provisioner for TP Cluster
115145
- name: "Install Postgres"
116146
groupIndex: 8
117147
type: boolean

‎charts/provisioner-config-local/config/pp-deploy-tp-base-on-prem.yaml

+35-5
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,12 @@ groups:
1818
index: 7
1919
description: |
2020
Cluster storage specific configurations. For the on-perm setup we have
21-
* docker desktop: `hostpath`
22-
* minikube: `standard`
23-
* kind: `standard`
24-
* microk8s: `microk8s-hostpath`
21+
* Docker Desktop: `hostpath` (support ReadWriteMany)
22+
* minikube: `standard` (support ReadWriteMany)
23+
* kind: `standard` (Don't support ReadWriteMany)
24+
* MicroK8s: `microk8s-hostpath` (support ReadWriteMany)
25+
* OpenShift: `crc-csi-hostpath-provisioner` (Don't support ReadWriteMany)
26+
* NFS server provisioner: `nfs` (support ReadWriteMany)
2527
- title: "Cluster tools"
2628
index: 8
2729
description: |
@@ -79,7 +81,28 @@ options:
7981
required: true
8082
reference: "meta.guiEnv.GUI_TP_STORAGE_CLASS"
8183
description: |
82-
docker desktop: "hostpath", minikube and kind: "standard", microk8s: "microk8s-hostpath"
84+
The storage class for the TP Cluster.
85+
- name: "Storage class name for NFS server provisioner"
86+
groupIndex: 7
87+
type: string
88+
guiType: input
89+
reference: "meta.guiEnv.GUI_TP_STORAGE_CLASS_FOR_NFS_SERVER_PROVISIONER"
90+
description: |
91+
The storage class name that NFS server provisioner will use. Empty means use the default storage class.
92+
- name: "NFS server provisioner storage class name"
93+
groupIndex: 7
94+
type: string
95+
guiType: input
96+
reference: "meta.guiEnv.GUI_TP_NFS_SERVER_PROVISIONER_STORAGE_CLASS_NAME"
97+
description: |
98+
The storage class name that NFS server provisioner will create for the TP Cluster.
99+
- name: "NFS server provisioner size"
100+
groupIndex: 7
101+
type: string
102+
guiType: input
103+
reference: "meta.guiEnv.GUI_TP_NFS_SERVER_PROVISIONER_SIZE"
104+
description: |
105+
The size of the NFS server provisioner storage.
83106
84107
# groupIndex: 8 Cluster tools
85108
- name: "Install cert-manager"
@@ -96,6 +119,13 @@ options:
96119
reference: "meta.guiEnv.GUI_TP_INSTALL_METRICS_SERVER"
97120
description: |
98121
Install metrics-server for TP Cluster
122+
- name: "Install nfs-server-provisioner"
123+
groupIndex: 8
124+
type: boolean
125+
guiType: checkbox
126+
reference: "meta.guiEnv.GUI_TP_INSTALL_NFS_SERVER_PROVISIONER"
127+
description: |
128+
Install NFS server provisioner for TP Cluster
99129
- name: "Install Postgres"
100130
groupIndex: 8
101131
type: boolean

‎charts/provisioner-config-local/recipes/pp-deploy-cp-core-on-prem.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,7 @@ meta:
117117
CP_PROVIDER: ${GUI_CP_PROVIDER:-local} # deployment target. Example: aws, azure, local.
118118
CP_NAMESPACE: ${GUI_CP_NAMESPACE:-"${CP_INSTANCE_ID}-ns"}
119119
CP_ADMIN_EMAIL: ${GUI_CP_ADMIN_EMAIL:-"[email protected]"}
120+
CP_FROM_REPLY_TO_EMAIL: ${GUI_CP_FROM_REPLY_TO_EMAIL:-""}
120121
CP_LOG_ENABLE: ${GUI_CP_LOG_ENABLE:-false}
121122
CP_EXTERNAL_ENVIRONMENT: ${GUI_CP_EXTERNAL_ENVIRONMENT:-"production"}
122123
CP_RESOURCES_REQUEST_CPU: ${GUI_CP_RESOURCES_REQUEST_CPU:-"50m"} # 37 pods * 50m = 1850m
@@ -755,6 +756,7 @@ helmCharts:
755756
port: "${CP_MAIL_SERVER_PORT_NUMBER}"
756757
username: "${CP_MAIL_SERVER_USERNAME}"
757758
password: "${CP_MAIL_SERVER_PASSWORD}"
759+
fromAndReplyToEmailAddress: "${CP_FROM_REPLY_TO_EMAIL}"
758760
admin:
759761
email: ${CP_ADMIN_EMAIL}
760762
firstname: "admin"
@@ -975,6 +977,14 @@ helmCharts:
975977
limits:
976978
cpu: "80m"
977979
memory: "200Mi"
980+
monitoringcapresources:
981+
resources:
982+
requests:
983+
cpu: ${CP_RESOURCES_REQUEST_CPU}
984+
memory: ${CP_RESOURCES_REQUEST_MEMORY}
985+
limits:
986+
cpu: "80m"
987+
memory: "200Mi"
978988
monitoringhomepagemetrics:
979989
resources:
980990
requests:

‎charts/provisioner-config-local/recipes/tp-base-on-prem-https.yaml

+31
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,12 @@ meta:
2121
GUI_TP_INSTALL_NGINX_INGRESS: true
2222
GUI_TP_INGRESS_SERVICE_TYPE: LoadBalancer
2323
GUI_TP_STORAGE_CLASS: ""
24+
GUI_TP_STORAGE_CLASS_FOR_NFS_SERVER_PROVISIONER: ""
25+
GUI_TP_NFS_SERVER_PROVISIONER_SIZE: 50Gi
26+
GUI_TP_NFS_SERVER_PROVISIONER_STORAGE_CLASS_NAME: nfs
2427
GUI_TP_PROVISIONER_UI_INGRESS_CLASSNAME: nginx
2528
GUI_TP_PROVISIONER_UI_NAMESPACE: tekton-tasks
29+
GUI_TP_INSTALL_NFS_SERVER_PROVISIONER: false
2630
GUI_TP_INSTALL_POSTGRES: true
2731
GUI_TP_INSTALL_PROVISIONER_UI: true
2832
GUI_TP_INSTALL_CERT_MANAGER: true
@@ -45,6 +49,10 @@ meta:
4549
TP_TLS_KEY: ${GUI_TP_TLS_KEY}
4650
# storage
4751
TP_STORAGE_CLASS: ${GUI_TP_STORAGE_CLASS:-"standard"} # hostpath for docker desktop, standard for minikube and kind, microk8s-hostpath for microk8s
52+
TP_STORAGE_CLASS_FOR_NFS_SERVER_PROVISIONER: ${GUI_TP_STORAGE_CLASS_FOR_NFS_SERVER_PROVISIONER:-""}
53+
TP_INSTALL_NFS_SERVER_PROVISIONER: ${GUI_TP_INSTALL_NFS_SERVER_PROVISIONER:-"false"}
54+
TP_NFS_SERVER_PROVISIONER_SIZE: ${GUI_TP_NFS_SERVER_PROVISIONER_SIZE:-"50Gi"}
55+
TP_NFS_SERVER_PROVISIONER_STORAGE_CLASS_NAME: ${GUI_TP_NFS_SERVER_PROVISIONER_STORAGE_CLASS_NAME:-"nfs"}
4856
# third party
4957
TP_EXT_NAMESPACE: tibco-ext
5058
TP_INSTALL_PROVISIONER_UI: ${GUI_TP_INSTALL_PROVISIONER_UI:-"true"}
@@ -218,6 +226,29 @@ helmCharts:
218226
tls.crt: ${TP_TLS_CERT}
219227
tls.key: ${TP_TLS_KEY}
220228
EOF
229+
- name: nfs-server-provisioner
230+
version: 1.8.0 # release: https://github.com/kubernetes-sigs/nfs-ganesha-server-and-external-provisioner/releases
231+
namespace: kube-system
232+
releaseName: nfs-server-provisioner
233+
condition: ${TP_INSTALL_NFS_SERVER_PROVISIONER}
234+
repo:
235+
helm:
236+
url: https://kubernetes-sigs.github.io/nfs-ganesha-server-and-external-provisioner
237+
cluster:
238+
names:
239+
- ${TP_CLUSTER_NAME}
240+
values:
241+
keepPrevious: true
242+
content: |
243+
persistence:
244+
enabled: true
245+
storageClass: "${TP_STORAGE_CLASS_FOR_NFS_SERVER_PROVISIONER}"
246+
size: "${TP_NFS_SERVER_PROVISIONER_SIZE}"
247+
storageClass:
248+
name: "${TP_NFS_SERVER_PROVISIONER_STORAGE_CLASS_NAME}"
249+
flags:
250+
createNamespace: true
251+
timeout: 1h
221252
- name: postgresql
222253
version: 15.5.38 # 15.5.38 use postgresql 16.4.0, 11.9.13 use postgresql 14.5.0 release: https://artifacthub.io/packages/helm/bitnami/postgresql
223254
namespace: ${TP_EXT_NAMESPACE}

‎charts/provisioner-config-local/recipes/tp-base-on-prem.yaml

+31-1
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,12 @@ meta:
1919
GUI_TP_INSTALL_NGINX_INGRESS: true
2020
GUI_TP_INGRESS_SERVICE_TYPE: LoadBalancer
2121
GUI_TP_STORAGE_CLASS: ""
22+
GUI_TP_STORAGE_CLASS_FOR_NFS_SERVER_PROVISIONER: ""
23+
GUI_TP_NFS_SERVER_PROVISIONER_SIZE: 50Gi
24+
GUI_TP_NFS_SERVER_PROVISIONER_STORAGE_CLASS_NAME: nfs
2225
GUI_TP_PROVISIONER_UI_INGRESS_CLASSNAME: nginx
2326
GUI_TP_PROVISIONER_UI_NAMESPACE: tekton-tasks
27+
GUI_TP_INSTALL_NFS_SERVER_PROVISIONER: false
2428
GUI_TP_INSTALL_POSTGRES: true
2529
GUI_TP_INSTALL_PROVISIONER_UI: true
2630
GUI_TP_INSTALL_CERT_MANAGER: true
@@ -41,6 +45,10 @@ meta:
4145
TP_INGRESS_USE_HOSTPORT: false # true for kind
4246
# storage
4347
TP_STORAGE_CLASS: ${GUI_TP_STORAGE_CLASS:-"standard"} # hostpath for docker desktop, standard for minikube and kind, microk8s-hostpath for microk8s
48+
TP_STORAGE_CLASS_FOR_NFS_SERVER_PROVISIONER: ${GUI_TP_STORAGE_CLASS_FOR_NFS_SERVER_PROVISIONER:-""}
49+
TP_INSTALL_NFS_SERVER_PROVISIONER: ${GUI_TP_INSTALL_NFS_SERVER_PROVISIONER:-"false"}
50+
TP_NFS_SERVER_PROVISIONER_SIZE: ${GUI_TP_NFS_SERVER_PROVISIONER_SIZE:-"50Gi"}
51+
TP_NFS_SERVER_PROVISIONER_STORAGE_CLASS_NAME: ${GUI_TP_NFS_SERVER_PROVISIONER_STORAGE_CLASS_NAME:-"nfs"}
4452
# third party
4553
TP_EXT_NAMESPACE: tibco-ext
4654
TP_INSTALL_PROVISIONER_UI: ${GUI_TP_INSTALL_PROVISIONER_UI:-"true"}
@@ -141,7 +149,6 @@ helmCharts:
141149
helm:
142150
url: https://traefik.github.io/charts
143151
values:
144-
keepPrevious: true
145152
content: |
146153
service: # for external-dns
147154
type: ${TP_INGRESS_SERVICE_TYPE}
@@ -155,6 +162,29 @@ helmCharts:
155162
wait: true
156163
timeout: 1h
157164
createNamespace: true
165+
- name: nfs-server-provisioner
166+
version: 1.8.0 # release: https://github.com/kubernetes-sigs/nfs-ganesha-server-and-external-provisioner/releases
167+
namespace: kube-system
168+
releaseName: nfs-server-provisioner
169+
condition: ${TP_INSTALL_NFS_SERVER_PROVISIONER}
170+
repo:
171+
helm:
172+
url: https://kubernetes-sigs.github.io/nfs-ganesha-server-and-external-provisioner
173+
cluster:
174+
names:
175+
- ${TP_CLUSTER_NAME}
176+
values:
177+
keepPrevious: true
178+
content: |
179+
persistence:
180+
enabled: true
181+
storageClass: "${TP_STORAGE_CLASS_FOR_NFS_SERVER_PROVISIONER}"
182+
size: "${TP_NFS_SERVER_PROVISIONER_SIZE}"
183+
storageClass:
184+
name: "${TP_NFS_SERVER_PROVISIONER_STORAGE_CLASS_NAME}"
185+
flags:
186+
createNamespace: true
187+
timeout: 1h
158188
- name: postgresql
159189
version: 15.5.38 # 15.5.38 use postgresql 16.4.0, 11.9.13 use postgresql 14.5.0 release: https://artifacthub.io/packages/helm/bitnami/postgresql
160190
namespace: ${TP_EXT_NAMESPACE}

0 commit comments

Comments
 (0)