feat: add OpenShift support

charts/pyrra/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
 
-version: 0.15.0
+version: 0.16.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/pyrra/README.md

@@ -1,6 +1,6 @@
 # pyrra
 
-![Version: 0.15.0](https://img.shields.io/badge/Version-0.15.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.8.1](https://img.shields.io/badge/AppVersion-v0.8.1-informational?style=flat-square)
+![Version: 0.16.0](https://img.shields.io/badge/Version-0.16.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.8.1](https://img.shields.io/badge/AppVersion-v0.8.1-informational?style=flat-square)
 
 SLO manager and alert generator
 
@@ -44,6 +44,11 @@ The dashboards can be deployed using a ConfigMap and get's automatically [reload
 | ingress.tls | list | `[]` |  |
 | nameOverride | string | `""` | overrides chart name |
 | nodeSelector | object | `{}` | node selector for scheduling server pod |
+| openshift.isOpenshift | bool | `false` | enables common OpenShift support |
+| openshift.openshiftOauth.enabled | bool | `false` | enables OpenShift OAuth-proxy |
+| openshift.openshiftOauth.openshiftOauthProxyImage | string | `"openshift/oauth-proxy:latest"` | OpenShift OAuth-proxy image |
+| openshift.openshiftOauth.sessionSecret | string | `""` | SessionSecret for OpenShift OAuth-proxy, string |
+| openshift.openshiftRoute.enabled | bool | `false` | enables creation of OpenShift route |
 | operatorMetricsAddress | string | `":8080"` | Address to expose operator metrics |
 | podAnnotations | object | `{}` | additional annotations for server pod |
 | podSecurityContext | object | `{}` | additional security context for server pod |

charts/pyrra/templates/clusterrole.yaml

@@ -44,3 +44,29 @@ rules:
   - get
   - patch
   - update
+{{- if .Values.openshift.isOpenshift }}
+- apiGroups:
+  - monitoring.coreos.com
+  resources:
+  - prometheuses/api
+  resourceNames:
+  - k8s
+  verbs:
+  - get
+  - create
+  - update
+{{- if .Values.openshift.openshiftOauth.enabled }}
+- verbs:
+  - create
+  apiGroups:
+  - authentication.k8s.io
+  resources:
+  - tokenreviews
+- verbs:
+  - create
+  apiGroups:
+  - authorization.k8s.io
+  resources:
+  - subjectaccessreviews
+{{- end }}
+{{- end }}

charts/pyrra/templates/configmap.yaml

@@ -0,0 +1,10 @@
+{{- if .Values.openshift.isOpenshift }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "pyrra.fullname" . }}-injected-certs
+  labels:
+    config.openshift.io/inject-trusted-cabundle: "true"
+    {{- include "pyrra.labels" . | nindent 4 }}
+{{- end }}

charts/pyrra/templates/deployment.yaml

@@ -73,9 +73,54 @@ spec:
             {{- with .Values.extraApiArgs }}
             {{- toYaml . | nindent 12 }}
             {{- end }}
+            {{- if .Values.openshift.isOpenshift }}
+            - --tls-client-ca-file=/etc/tls/openshift-service-ca.crt/service-ca.crt
+            - --prometheus-bearer-token-path=/var/run/secrets/kubernetes.io/serviceaccount/token
+            {{- end }}
           ports:
           - name: http
             containerPort: 9099
+          {{- if .Values.openshift.isOpenshift }}
+          volumeMounts:
+            - name: openshift-service-ca-crt
+              mountPath: /etc/tls/openshift-service-ca.crt
+          {{- end }}
+        {{- if and .Values.openshift.isOpenshift .Values.openshift.openshiftOauth.enabled }}
+        - name: oauth-proxy
+          resources: {}
+          securityContext: {}
+          image: {{ .Values.openshift.openshiftOauth.openshiftOauthProxyImage }}
+          ports:
+            - name: https
+              containerPort: 9091
+              protocol: TCP
+          imagePullPolicy: IfNotPresent
+          volumeMounts:
+            - name: {{ include "pyrra.fullname" . }}
+              mountPath: /etc/proxy/secrets/session_secret
+              subPath: session_secret
+            - name: {{ include "pyrra.fullname" . }}-injected-certs
+              mountPath: /etc/proxy/certs
+            - name: {{ include "pyrra.fullname" . }}-tls
+              mountPath: /etc/tls/private
+          args:
+            - "-provider=openshift"
+            - "-pass-basic-auth=false"
+            - "-https-address=:9091"
+            - "-http-address="
+            - "-email-domain=*"
+            - "-upstream=http://localhost:9099"
+            - '-openshift-sar={"resource": "clusterrolebinding", "verb": "create"}'
+            - '-openshift-delegate-urls={"/": {"resource": "clusterrolebinding", "verb": "create"}}'
+            - "-client-secret-file=/var/run/secrets/kubernetes.io/serviceaccount/token"
+            - "-cookie-secret-file=/etc/proxy/secrets/session_secret"
+            - "-openshift-service-account={{ include "pyrra.fullname" . }}"
+            - "-openshift-ca=/etc/pki/tls/cert.pem"
+            - "-openshift-ca=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+            - "-openshift-ca=/etc/proxy/certs/ca-bundle.crt"
+            - "-tls-cert=/etc/tls/private/tls.crt"
+            - "-tls-key=/etc/tls/private/tls.key"
+          {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
@@ -88,9 +133,27 @@ spec:
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if and .Values.validatingWebhookConfiguration.enabled ($.Capabilities.APIVersions.Has "cert-manager.io/v1") }}
+      {{- if or (and .Values.validatingWebhookConfiguration.enabled ($.Capabilities.APIVersions.Has "cert-manager.io/v1")) .Values.openshift.isOpenshift }}
       volumes:
+      {{- if and .Values.validatingWebhookConfiguration.enabled ($.Capabilities.APIVersions.Has "cert-manager.io/v1") }}
         - name: certs
           secret:
             secretName: {{ include "pyrra.fullname" . }}-webhook-validation
       {{- end }}
+      {{- if .Values.openshift.isOpenshift }}
+        - name: openshift-service-ca-crt
+          configMap:
+            name: openshift-service-ca.crt
+        {{- if and .Values.openshift.isOpenshift .Values.openshift.openshiftOauth.enabled }}
+        - name: {{ include "pyrra.fullname" . }}
+          secret:
+            secretName: {{ include "pyrra.fullname" . }}
+        - name: {{ include "pyrra.fullname" . }}-injected-certs
+          configMap:
+            name: {{ include "pyrra.fullname" . }}-injected-certs
+        - name: {{ include "pyrra.fullname" . }}-tls
+          secret:
+            secretName: {{ include "pyrra.fullname" . }}-tls
+        {{- end }}
+      {{- end }}
+      {{- end }}

charts/pyrra/templates/route.yaml

@@ -0,0 +1,30 @@
+{{- if and .Values.openshift.isOpenshift .Values.openshift.openshiftRoute.enabled }}
+---
+kind: Route
+apiVersion: route.openshift.io/v1
+metadata:
+  name: {{ include "pyrra.fullname" . }}
+  annotations:
+    openshift.io/host.generated: 'true'
+    {{- with .Values.service.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  labels:
+    {{- include "pyrra.labels" . | nindent 4 }}
+spec:
+  to:
+    kind: Service
+    name: {{ include "pyrra.fullname" . }}
+  port:
+    {{- if .Values.openshift.openshiftOauth.enabled }}
+    targetPort: https
+    {{- else }}
+    targetPort: http
+    {{- end }}
+  tls:
+    {{- if .Values.openshift.openshiftOauth.enabled }}
+    termination: Reencrypt
+    {{- else }}
+    termination: Edge
+    {{- end }}
+{{- end }}

charts/pyrra/templates/secrets.yaml

@@ -0,0 +1,22 @@
+{{- if and .Values.openshift.isOpenshift .Values.openshift.openshiftOauth.enabled }}
+---
+apiVersion: v1
+kind: Secret
+type: kubernetes.io/service-account-token
+metadata:
+  name: {{ include "pyrra.fullname" . }}-sa-token
+  labels:
+    {{- include "pyrra.labels" . | nindent 4 }}
+  annotations:
+    kubernetes.io/service-account.name: {{ include "pyrra.fullname" . }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "pyrra.fullname" . }}
+  labels:
+    {{- include "pyrra.labels" . | nindent 4 }}
+data:
+  session_secret: |-
+    {{ .Values.openshift.openshiftOauth.sessionSecret | b64enc }}
+{{- end }}

charts/pyrra/templates/service.yaml

@@ -3,15 +3,24 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "pyrra.fullname" . }}
-  {{- with .Values.service.annotations }}
+  {{- if or .Values.service.annotations (and .Values.openshift.isOpenshift .Values.openshift.openshiftOauth.enabled) }}
   annotations:
+    {{- with .Values.service.annotations }}
     {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- if and .Values.openshift.isOpenshift .Values.openshift.openshiftOauth.enabled }}
+    service.alpha.openshift.io/serving-cert-secret-name: {{ include "pyrra.fullname" . }}-tls
+    {{- end }}
   {{- end }}
   labels:
     {{- include "pyrra.labels" . | nindent 4 }}
 spec:
   type: {{ .Values.service.type }}
   ports:
+      {{- if and .Values.openshift.isOpenshift .Values.openshift.openshiftOauth.enabled }}
+    - name: https
+      port: 9091
+      {{- else }}
     - name: internal
       port: 9443
     - name: api
@@ -21,6 +30,7 @@ spec:
       {{- if .Values.service.nodePort }}
       nodePort: {{ .Values.service.nodePort }}
       {{- end }}
+      {{- end }}
     - name: op-metrics
       port: {{ .Values.service.operatorMetricsPort }}
       targetPort: {{ include "pyrra.operatorMetricsPort" . }}

charts/pyrra/templates/serviceaccount.yaml

@@ -6,8 +6,14 @@ metadata:
   name: {{ include "pyrra.serviceAccountName" . }}
   labels:
     {{- include "pyrra.labels" . | nindent 4 }}
-  {{- with .Values.serviceAccount.annotations }}
+  {{- if or .Values.serviceAccount.annotations (and .Values.openshift.isOpenshift .Values.openshift.openshiftOauth.enabled) }}
   annotations:
+    {{- with .Values.serviceAccount.annotations }}
     {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- if and .Values.openshift.isOpenshift .Values.openshift.openshiftOauth.enabled }}
+    serviceaccounts.openshift.io/oauth-redirectreference.primary: >-
+      {"kind":"OAuthRedirectReference","apiVersion":"v1","reference":{"kind":"Route","name":"{{ include "pyrra.fullname" . }}"}}
+    {{- end }}
   {{- end }}
 {{- end }}

charts/pyrra/values.yaml

@@ -154,3 +154,17 @@ dashboards:
   labelValue: "1"
   annotations: {}
   extraLabels: {}
+
+openshift:
+  # -- enables common OpenShift support
+  isOpenshift: false
+  openshiftOauth:
+    # -- enables OpenShift OAuth-proxy
+    enabled: false
+    # -- OpenShift OAuth-proxy image
+    openshiftOauthProxyImage: "openshift/oauth-proxy:latest"
+    # -- SessionSecret for OpenShift OAuth-proxy, string
+    sessionSecret: ""
+  openshiftRoute:
+    # -- enables creation of OpenShift route
+    enabled: false