kubeplus-components-6.yaml

apiVersion: v1
kind: Secret
metadata:
  name: webhook-tls-certificates
  namespace: {{ .Release.Namespace }}
type: Opaque
data:
  username: YWRtaW4=
  password: MWYyZDFlMmU2N2Rm
---
# No need for admin role in a namespace
#apiVersion: rbac.authorization.k8s.io/v1
#kind: RoleBinding
#metadata:
#  name: kubeplus:namespace-admin
#  namespace: {{ .Release.Namespace }}
#roleRef:
#  apiGroup: rbac.authorization.k8s.io
#  kind: ClusterRole
#  name: admin
#subjects:
#- kind: ServiceAccount
#  name: kubeplus 
#  namespace: {{ .Release.Namespace }}
#  apiGroup: ""
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kubeplus:namespaceperms
rules:
- apiGroups: [""]
  resources: ["namespaces","secrets","services","configmaps","endpoints","persistentvolumeclaims","pods","pods/attach","pods/exec","pods/portforward","pods/proxy","replicationcontrollers","replicationcontrollers/scale","serviceaccounts","services/proxy","events"]
  verbs: ["get","list","create","update","delete","watch","patch"]
- apiGroups: ["apps"]
  resources: ["daemonsets","deployments","deployments/rollback","deployments/scale","replicasets","replicasets/scale","statefulsets","statefulsets/scale"]
  verbs: ["get","list","create","update","delete","watch","patch"]
- apiGroups: ["extensions"]
  resources: ["daemonsets","deployments","deployments/rollback","deployments/scale","ingresses","networkpolicies","replicasets","replicasets/scale","replicationcontrollers/scale"]
  verbs: ["get","list","create","update","delete","watch","patch"]
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses","networkpolicies"]
  verbs: ["get","list","create","update","delete","watch","patch"]
- apiGroups: ["policy"]
  resources: ["poddisruptionbudgets"]
  verbs: ["get","list","create","update","delete","watch","patch"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["rolebindings","roles"]
  verbs: ["get","list","create","update","delete","watch","patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kubeplus:namespaceperms-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kubeplus:namespaceperms
subjects:
- kind: ServiceAccount
  name: kubeplus 
  namespace: {{ .Release.Namespace }}
  apiGroup: ""
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kubeplus:allperms
rules:
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["patch"]
- apiGroups: ["certificates.k8s.io"]
  resources: ["certificatesigningrequests","certificatesigningrequests/approval"]
  verbs: ["get","list","create","update","delete","watch","patch"]
- apiGroups: ["certificates.k8s.io"]
  resources: ["signers"]
  resourceNames: ["kubernetes.io/legacy-unknown","kubernetes.io/kubelet-serving","kubernetes.io/kube-apiserver-client","cloudark.io/kubeplus"]
  verbs: ["approve"]
- apiGroups: ["apiextensions.k8s.io"]
  resources: ["customresourcedefinitions"]
  verbs: ["get","list","create","update","delete","watch","patch"]
- apiGroups: [""]
  resources: ["endpoints"]
  verbs: ["get","list","watch"]
- apiGroups: ["admissionregistration.k8s.io"]
  resources: ["mutatingwebhookconfigurations"]
  verbs: ["get","list","create","delete"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterroles"]
  verbs: ["get","list","create","delete"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterrolebindings"]
  verbs: ["get","list","create","delete"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["roles"]
  verbs: ["get","list","update","delete","create"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["rolebindings"]
  verbs: ["get","list","create","delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kubeplus:allperms-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kubeplus:allperms
subjects:
- kind: ServiceAccount
  name: kubeplus 
  namespace: {{ .Release.Namespace }}
  apiGroup: ""
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kubeplus:readallperms
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["get","list","watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kubeplus:readallperms-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kubeplus:readallperms
subjects:
- kind: ServiceAccount
  name: kubeplus 
  namespace: {{ .Release.Namespace }}
  apiGroup: ""
#- kind: ServiceAccount
#  name: kubeplus-saas-provider
#  namespace: {{ .Release.Namespace }}
#  apiGroup: ""
- kind: ServiceAccount
  name: kubeplus-saas-consumer 
  namespace: {{ .Release.Namespace }}
  apiGroup: ""
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kubeplus:providerapiperms
rules:
- apiGroups: ["workflows.kubeplus"]
  resources: ["resourcecompositions","resourceevents","resourcemonitors","resourcepolicies"]
  verbs: ["get","list","create","update","delete","watch","patch"]
- apiGroups: [""]
  resources: ["pods","pods/attach","pods/exec","pods/portforward","pods/proxy"]
  verbs: ["get","list","create","update","delete","watch","patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kubeplus:providerapiperms-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kubeplus:providerapiperms
subjects:
- kind: ServiceAccount
  name: kubeplus 
  namespace: {{ .Release.Namespace }}
  apiGroup: ""
#- kind: ServiceAccount
#  name: kubeplus-saas-provider
#  namespace: {{ .Release.Namespace }}
#  apiGroup: ""
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: kubeplus-saas-provider-consumer
  namespace: {{ .Release.Namespace }}
rules:
- apiGroups: ["platformapi.kubeplus"]
  resources: ["*"]
  verbs: ["get","list","create","update","delete","watch","patch"]
- apiGroups: [""]
  resources: ["pods/portforward"]
  verbs: ["get","list","create","update","delete","watch","patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: kubeplus-saas-provider-consumer-rolebinding
  namespace: {{ .Release.Namespace }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kubeplus-saas-provider-consumer
subjects:
#- kind: ServiceAccount
#  name: kubeplus-saas-provider 
#  namespace: {{ .Release.Namespace }}
- kind: ServiceAccount
  name: kubeplus-saas-consumer 
  namespace: {{ .Release.Namespace }}
- kind: ServiceAccount
  name: kubeplus 
  namespace: {{ .Release.Namespace }}
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: kubeplus
  namespace: {{ .Release.Namespace }}
---
#kind: ServiceAccount
#apiVersion: v1
#metadata:
#  name: kubeplus-saas-provider
#  namespace: {{ .Release.Namespace }}
#---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: kubeplus-saas-consumer
  namespace: {{ .Release.Namespace }}
---
kind: Service
apiVersion: v1
metadata:
  name: kubeplus
  namespace: {{ .Release.Namespace }}
spec:
  selector:
    app: kubeplus
  type: NodePort 
  ports:
  - protocol: TCP
    port: 90
    targetPort: 8090
---
kind: Service
apiVersion: v1
metadata:
  name: kubeconfighelper
  namespace: {{ .Release.Namespace }}
spec:
  selector:
    app: kubeplus
  type: NodePort 
  ports:
  - protocol: TCP
    port: 91
    targetPort: 5005
---
kind: Service
apiVersion: v1
metadata:
  name: kubeplus-consumerui
  namespace: {{ .Release.Namespace }}
spec:
  selector:
    app: kubeplus
  ports:
  - protocol: TCP
    port: 5000
    targetPort: 5000
---
apiVersion: v1
kind: Service
metadata:
  name: crd-hook-service
  namespace: {{ .Release.Namespace }}
  labels:
    app: crd-hook-service
spec:
  ports:
  - port: 443
    targetPort: 443
  selector:
    app: kubeplus
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: kubeplus-pv  
  namespace: {{ .Release.Namespace }}
  annotations:
    helm.sh/resource-policy: "keep" 
spec:
  capacity:
    storage: 1Gi  # Adjust the size as needed
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  hostPath:
    path: /kubeplus  # This can be a path on the host system where charts will be stored.
  volumeMode: Filesystem
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: kubeplus-pvc  
  namespace: {{ .Release.Namespace }}
  annotations:
    helm.sh/resource-policy: "keep" 
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi  # Make sure this matches the PV size
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: ollama-models-pvc
  namespace: {{ .Release.Namespace }}
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 5Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kubeplus-deployment # do not change
  namespace: {{ .Release.Namespace }}
spec:
  replicas: 1
  selector:
    matchLabels:
      app: kubeplus
  template:
    metadata:
      name: kubeplus
      labels:
        app: kubeplus
      annotations:
        cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
    spec:
      serviceAccount: kubeplus-saas-provider
      initContainers:
      #containers:
      - name: webhook-cert-setup
        image: {{ .Values.WEBHOOK_INIT_CONTAINER }}  #gcr.io/cloudark-kubeplus/webhook-tls-getter:3.0.26
        imagePullPolicy: IfNotPresent 
        env:
          - name: KUBEPLUS_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
        command: ["./webhook-create-self-signed-ca-cert.sh"]
        args:
          - "--service"
          - "crd-hook-service"
          - "--namespace"
          - "$(KUBEPLUS_NAMESPACE)"
          - "--secret"
          - "webhook-tls-certificates"
      containers:
      - name: ollama-ai
        image: ollama:latest
        imagePullPolicy: IfNotPresent
        env:
          - name: MODEL_NAME
            value: "gemma:2b"
          - name: OLLAMA_MODELS
            value: "/models"
          - name: OLLAMA_MAX_LOADED_MODELS
            value: "1"
          - name: PORT
            value: "8080"
        ports:
          - name: http
            containerPort: 8080
        volumeMounts:
          - name: ollama-models
            mountPath: /models
        resources:
          requests:
            cpu: "1"
            memory: "3Gi"
            ephemeral-storage: "1Gi"
          limits:
            cpu: "2"
            memory: "5Gi"
            ephemeral-storage: "2Gi"
      - name: kubeconfiggenerator
        image: {{ .Values.CRD_REGISTRATION_HELPER }}  #gcr.io/cloudark-kubeplus/kubeconfiggenerator:3.0.27
        imagePullPolicy: IfNotPresent
        resources:
          requests:
            ephemeral-storage: "70Mi"
          limits:
            ephemeral-storage: "75Mi"
        env:
          - name: KUBEPLUS_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
                #command: ["./root/kubeconfiggenerator.sh"]
        command: [ "python3", "/root/kubeconfiggenerator.py"]
        args:
          - "$(KUBEPLUS_NAMESPACE)"
        volumeMounts:
        - name: shared-data
          mountPath: /crdinstances
      - name: crd-hook
        image: {{ .Values.MUTATING_WEBHOOK }}    #gcr.io/cloudark-kubeplus/pac-mutating-admission-webhook:3.0.14
        imagePullPolicy: IfNotPresent
        resources:
          requests:
            ephemeral-storage: "10Mi"
          limits:
            ephemeral-storage: "15Mi"
        env:
          - name: CHECK_KYVERNO_POLICIES
            value: "{{ .Values.CHECK_KYVERNO_POLICIES }}"
        args:
          - -tlsCertFile=/etc/webhook/certs/cert.pem
          - -tlsKeyFile=/etc/webhook/certs/key.pem
          - -alsologtostderr
          #- -v=4
          - 2>&1
        volumeMounts:
        - name: webhook-certs
          mountPath: /etc/webhook/certs
          readOnly: true
        - name: shared-data
          mountPath: /crdinstances
      - name: platform-operator
        image: {{ .Values.PLATFORM_OPERATOR }}   #gcr.io/cloudark-kubeplus/platform-operator:3.0.6
        imagePullPolicy: IfNotPresent
        resources:
          requests:
            ephemeral-storage: "5Mi"
          limits:
            ephemeral-storage: "10Mi"
        command: [ "/platform-operator"]
      - name: consumerui
        image: {{ .Values.CONSUMERUI }}   #gcr.io/cloudark-kubeplus/consumerui:0.0.6
        imagePullPolicy: IfNotPresent
        resources:
          requests:
            ephemeral-storage: "10Mi"
          limits:
            ephemeral-storage: "500Mi"
        command: [ "python3", "/root/consumerui.py"]
      - name: helmer
        image: {{ .Values.HELMER  }}  #gcr.io/cloudark-kubeplus/helm-pod:3.0.17
        imagePullPolicy: IfNotPresent
        resources:
          requests:
            ephemeral-storage: "10Mi"
          limits:
            ephemeral-storage: "15Mi"
        command: ["/root/helm-pod"]
        volumeMounts:
        - mountPath: /chart
          name: chart-volume
        - name: shared-data
          mountPath: /crdinstances
      volumes:
        - name: shared-data
          emptyDir: {}
        - name: chart-volume
          persistentVolumeClaim:
            claimName: kubeplus-pvc
        - name: webhook-certs
          secret:
            secretName: webhook-tls-certificates
        - name: ollama-models
          persistentVolumeClaim:
            claimName: ollama-models-pvc
---
apiVersion: batch/v1
kind: Job
metadata:
  name: cleanup-kubeplus-components
  namespace: {{ .Release.Namespace }}
  labels:
    helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
  annotations:
    # This is what defines this resource as a hook. Without this line, the
    # job is considered part of the release.
    "helm.sh/hook": pre-delete
    "helm.sh/hook-delete-policy": hook-succeeded
spec:
  template:
    metadata:
      name: "{{ .Release.Name }}"
      labels:
        helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    spec:
      restartPolicy: Never
      serviceAccountName: kubeplus
      containers:
      - name: cleanup-kubeplus-components
        env:
          - name: KUBEPLUS_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
        image: {{ .Values.RESOURCE_CLEANER }}  #gcr.io/cloudark-kubeplus/delete-kubeplus-resources:3.0.12
        imagePullPolicy: IfNotPresent
        command: ["./root/delete-kubeplus-components.sh"]
        args:
          - "$(KUBEPLUS_NAMESPACE)"