align with raven-agent charts from commit d6005a8563900e3b6d0d6313855…

…2d786cf1f3c0f

charts/raven-agent/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: raven-agent
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.4.2
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "0.4.2"

charts/raven-agent/templates/_helpers.tpl

@@ -0,0 +1,69 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "raven-agent.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "raven-agent.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "raven-agent.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "raven-agent.labels" -}}
+helm.sh/chart: {{ include "raven-agent.chart" . }}
+{{ include "raven-agent.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "raven-agent.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "raven-agent.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+raven-agent labels
+*/}}
+{{- define "raven-agent.appLabels" -}}
+app: raven-agent
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "raven-agent.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "raven-agent.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

charts/raven-agent/templates/config.yaml

@@ -0,0 +1,32 @@
+apiVersion: v1
+data:
+  enable-l3-tunnel: {{.Values.controller.enableTunnel | quote}}
+  enable-l7-proxy: {{.Values.controller.enableProxy | quote}}
+kind: ConfigMap
+metadata:
+  name: raven-cfg
+  namespace: {{ .Release.Namespace }}
+---
+apiVersion: v1
+data:
+  vpn-driver: {{ .Values.vpn.driver }}
+  forward-node-ip: {{ .Values.vpn.forwardNodeIP | quote }}
+  nat-traversal: {{ .Values.vpn.natTraversal | quote }}
+  metric-bind-addr: {{ .Values.vpn.metricBindAddr }}
+  tunnel-bind-addr: {{ .Values.vpn.tunnelAddr }}
+  proxy-external-addr: {{ .Values.proxy.externalAddr }}
+  proxy-internal-insecure-addr: {{ .Values.proxy.internalInsecureAddr }}
+  proxy-internal-secure-addr: {{ .Values.proxy.internalSecureAddr }}
+kind: ConfigMap
+metadata:
+  name: raven-agent-config
+  namespace: {{ .Release.Namespace }}
+---
+apiVersion: v1
+data:
+  vpn-connection-psk: {{ .Values.vpn.psk | b64enc }}
+kind: Secret
+metadata:
+  name: raven-agent-secret
+  namespace: {{ .Release.Namespace }}
+type: Opaque

charts/raven-agent/templates/daemonset.yaml

@@ -0,0 +1,85 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: raven-agent-ds
+  namespace: {{ .Release.Namespace }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "raven-agent.appLabels" . | nindent 8 }}
+  template:
+    metadata:
+      labels:
+        {{- include "raven-agent.appLabels" . | nindent 8 }}
+    spec:
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+      - image: {{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        name: raven-agent
+        livenessProbe:
+          failureThreshold: 10
+          httpGet:
+            path: /healthz
+            port: 10275
+            scheme: HTTP
+          initialDelaySeconds: 20
+          periodSeconds: 30
+          successThreshold: 1
+          timeoutSeconds: 15
+        readinessProbe:
+          failureThreshold: 10
+          httpGet:
+            path: /readyz
+            port: 10275
+            scheme: HTTP
+          initialDelaySeconds: 20
+          periodSeconds: 30
+          successThreshold: 1
+          timeoutSeconds: 15
+        securityContext:
+          {{- toYaml .Values.securityContext | nindent 12 }}
+        {{- with .Values.containerEnv }}
+        env:
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+        args:
+          - --v=2
+          - --vpn-driver={{.Values.vpn.driver}}
+          - --forward-node-ip={{.Values.vpn.forwardNodeIP}}
+          - --nat-traversal={{.Values.vpn.natTraversal}}
+          - --metric-bind-addr={{.Values.vpn.metricBindAddr}}
+          - --health-probe-addr={{.Values.healthyBindAddr}}
+          - --vpn-bind-port={{.Values.vpn.tunnelAddr}}
+          - --keep-alive-interval={{.Values.vpn.keepAliveInterval}}
+          - --keep-alive-timeout={{.Values.vpn.keepAliveTimeout}}
+          - --sync-raven-rules={{.Values.sync.syncRule}}
+          - --sync-raven-rules-period={{.Values.sync.syncPeriod}}
+          - --proxy-metric-bind-addr={{.Values.proxy.metricsBindAddr}}
+          - --proxy-internal-secure-addr={{.Values.proxy.internalSecureAddr}}
+          - --proxy-internal-insecure-addr={{.Values.proxy.internalInsecureAddr}}
+          - --proxy-external-addr={{.Values.proxy.externalAddr}}
+        volumeMounts:
+        - name: raven-dir
+          mountPath: /var/lib/raven
+      hostNetwork: true
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ .Values.serviceAccount.name }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+      - name: raven-dir
+        hostPath:
+          path: /var/lib/raven
+          type: DirectoryOrCreate
+  updateStrategy:
+    rollingUpdate:
+      maxUnavailable: {{ .Values.rollingUpdate.maxUnavailable }}

charts/raven-agent/templates/rbac.yaml

@@ -0,0 +1,94 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: raven-agent-account
+  namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: raven-agent-role
+rules:
+  - apiGroups:
+      - raven.openyurt.io
+    resources:
+      - gateways
+    verbs:
+      - get
+      - list
+      - watch
+      - patch
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+      - services
+      - nodes
+      - pods
+    verbs:
+      - get
+      - list
+      - update
+      - watch
+  - apiGroups:
+      - certificates.k8s.io
+    resources:
+      - certificatesigningrequests
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: raven-agent-role-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: raven-agent-role
+subjects:
+  - kind: ServiceAccount
+    name: raven-agent-account
+    namespace: {{ .Release.Namespace }}
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations:
+    rbac.authorization.kubernetes.io/autoupdate: "true"
+  name: raven-proxy-user
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - nodes/stats
+      - nodes/metrics
+      - nodes/log
+      - nodes/spec
+      - nodes/proxy
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - delete
+      - update
+      - patch
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: raven-proxy-user-binding
+subjects:
+  - kind: User
+    name: tunnel-proxy-client
+    apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: ClusterRole
+  name: raven-proxy-user
+  apiGroup: rbac.authorization.k8s.io
+---