Merge version v0.7.0

Author: kvaps

README.md

@@ -26,7 +26,7 @@ Deploy Kubernetes in Kubernetes using Helm
 
 ```bash
 helm repo add kvaps https://kvaps.github.io/charts
-helm install foo kvaps/kubernetes --version 0.6.1 \
+helm install foo kvaps/kubernetes --version 0.7.0 \
   --namespace foo \
   --create-namespace \
   --set persistence.storageClassName=local-path

build/tools/Dockerfile

@@ -1,7 +1,7 @@
 FROM docker.io/library/alpine:3.12
 
 RUN apk add --no-cache openssl
-ARG VERSION=v1.19.1
+ARG VERSION=v1.19.3
 RUN wget "https://storage.googleapis.com/kubernetes-release/release/${VERSION}/bin/linux/amd64/kubectl" \
       -O /usr/local/bin/kubectl \
  && chmod +x /usr/local/bin/kubectl

deploy/helm/kubernetes/Chart.yaml

@@ -1,7 +1,7 @@
 name: kubernetes
 description: Production-Grade Container Scheduling and Management
-version: 0.6.1
-appVersion: 1.19.0
+version: 0.7.0
+appVersion: 1.19.3
 icon: https://upload.wikimedia.org/wikipedia/commons/thumb/3/39/Kubernetes_logo_without_workmark.svg/723px-Kubernetes_logo_without_workmark.svg.png
 keywords:
   - kubernetes

deploy/helm/kubernetes/manifests/konnectivity-agent-deployment.yaml

@@ -44,10 +44,12 @@ spec:
       {{- toYaml . | nindent 6 }}
       {{- end }}
       containers:
-      - image: {{ .Values.konnectivityAgent.image.repository }}:{{ .Values.konnectivityAgent.image.tag }}
-        name: konnectivity-agent
-        command: ["/proxy-agent"]
-        args:
+      - name: konnectivity-agent
+        {{- with .Values.konnectivityAgent.image }}
+        image: "{{ .repository }}{{ if .digest }}@{{ .digest }}{{ else }}:{{ .tag }}{{ end }}"
+        {{- end }}
+        command:
+        - /proxy-agent
         - --logtostderr=true
         - --ca-cert=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
         - --service-account-token-path=/var/run/secrets/tokens/konnectivity-agent-token

deploy/helm/kubernetes/templates/_helpers.tpl

@@ -15,14 +15,25 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
 {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
 {{- else -}}
 {{- $name := default "kubernetes" .Values.nameOverride -}}
-{{- if or (contains $name .Release.Name) (eq (.Release.Name | upper) "RELEASE-NAME") -}}
+{{- if or (eq $name .Release.Name) (eq (.Release.Name | upper) "RELEASE-NAME") -}}
 {{- $name | trunc 63 | trimSuffix "-" -}}
 {{- else -}}
 {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
 {{- end -}}
 {{- end -}}
 
+{{/*
+Create a default certificate name.
+*/}}
+{{- define "kubernetes.certname" -}}
+{{- if .Values.certnameOverride -}}
+{{- .Values.certnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- template "kubernetes.fullname" . -}}
+{{- end -}}
+{{- end -}}
+
 {{/*
 Generate etcd servers list.
 */}}

deploy/helm/kubernetes/templates/admin-deployment.yaml

@@ -51,7 +51,9 @@ spec:
       terminationGracePeriodSeconds: 5
       containers:
       - command: [ 'sleep', 'infinity' ]
-        image: {{ .Values.admin.image.repository }}:{{ .Values.admin.image.tag }}
+        {{- with .Values.admin.image }}
+        image: "{{ .repository }}{{ if .digest }}@{{ .digest }}{{ else }}:{{ .tag }}{{ end }}"
+        {{- end }}
         imagePullPolicy: {{ .Values.admin.image.PullPolicy }}
         name: admin
         livenessProbe:

deploy/helm/kubernetes/templates/apiserver-deployment.yaml

@@ -1,5 +1,6 @@
 {{- if .Values.apiServer.enabled }}
 {{- $fullName := include "kubernetes.fullname" . -}}
+{{- $certName := include "kubernetes.certname" . -}}
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -68,7 +69,7 @@ spec:
         - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
         - --proxy-client-cert-file=/pki/front-proxy-client/tls.crt
         - --proxy-client-key-file=/pki/front-proxy-client/tls.key
-        - --requestheader-allowed-names={{ $fullName }}-pki-front-proxy-client
+        - --requestheader-allowed-names={{ $certName }}-front-proxy-client
         - --requestheader-client-ca-file=/pki/front-proxy-client/ca.crt
         - --requestheader-extra-headers-prefix=X-Remote-Extra-
         - --requestheader-group-headers=X-Remote-Group
@@ -95,7 +96,9 @@ spec:
         ports:
         - containerPort: {{ .Values.apiServer.port }}
           name: client
-        image: {{ .Values.apiServer.image.repository }}:{{ .Values.apiServer.image.tag }}
+        {{- with .Values.apiServer.image }}
+        image: "{{ .repository }}{{ if .digest }}@{{ .digest }}{{ else }}:{{ .tag }}{{ end }}"
+        {{- end }}
         imagePullPolicy: {{ .Values.apiServer.image.PullPolicy }}
         livenessProbe:
           failureThreshold: 8

deploy/helm/kubernetes/templates/controller-manager-deployment.yaml

@@ -69,7 +69,9 @@ spec:
         {{- range $key, $value := .Values.controllerManager.extraArgs }}
         - --{{ $key }}={{ $value }}
         {{- end }}
-        image: {{ .Values.controllerManager.image.repository }}:{{ .Values.controllerManager.image.tag }}
+        {{- with .Values.controllerManager.image }}
+        image: "{{ .repository }}{{ if .digest }}@{{ .digest }}{{ else }}:{{ .tag }}{{ end }}"
+        {{- end }}
         imagePullPolicy: {{ .Values.controllerManager.image.PullPolicy }}
         livenessProbe:
           failureThreshold: 8

deploy/helm/kubernetes/templates/etcd-certs.yaml

@@ -1,12 +1,13 @@
 {{- if .Values.etcd.enabled }}
 {{- $fullName := include "kubernetes.fullname" . -}}
+{{- $certName := include "kubernetes.certname" . -}}
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   name: "{{ $fullName }}-pki-etcd-ca"
 spec:
-  commonName: "{{ $fullName }}-pki-etcd-ca"
+  commonName: "{{ $certName }}-etcd-ca"
   secretName: "{{ $fullName }}-pki-etcd-ca"
   duration: 87600h # 3650d
   renewBefore: 8760h # 365d
@@ -44,7 +45,7 @@ kind: Certificate
 metadata:
   name: "{{ $fullName }}-pki-etcd-peer"
 spec:
-  commonName: "{{ $fullName }}-pki-etcd-peer"
+  commonName: "{{ $certName }}-etcd-peer"
   secretName: "{{ $fullName }}-pki-etcd-peer"
   duration: 8760h # 365d
   renewBefore: 4380h # 178d
@@ -75,7 +76,7 @@ kind: Certificate
 metadata:
   name: "{{ $fullName }}-pki-etcd-server"
 spec:
-  commonName: "{{ $fullName }}-pki-etcd-server"
+  commonName: "{{ $certName }}-etcd-server"
   secretName: "{{ $fullName }}-pki-etcd-server"
   duration: 8760h # 365d
   renewBefore: 4380h # 178d
@@ -120,7 +121,7 @@ kind: Certificate
 metadata:
   name: "{{ $fullName }}-pki-etcd-healthcheck-client"
 spec:
-  commonName: "{{ $fullName }}-pki-etcd-healthcheck-client"
+  commonName: "{{ $certName }}-etcd-healthcheck-client"
   secretName: "{{ $fullName }}-pki-etcd-healthcheck-client"
   duration: 8760h # 365d
   renewBefore: 4380h # 178d
@@ -140,7 +141,7 @@ kind: Certificate
 metadata:
   name: "{{ $fullName }}-pki-apiserver-etcd-client"
 spec:
-  commonName: "{{ $fullName }}-pki-apiserver-etcd-client"
+  commonName: "{{ $certName }}-apiserver-etcd-client"
   secretName: "{{ $fullName }}-pki-apiserver-etcd-client"
   duration: 8760h # 365d
   renewBefore: 4380h # 178d

deploy/helm/kubernetes/templates/etcd-statefulset.yaml

@@ -95,7 +95,9 @@ spec:
         {{- with .Values.etcd.extraEnv }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
-        image: {{ .Values.etcd.image.repository }}:{{ .Values.etcd.image.tag }}
+        {{- with .Values.etcd.image }}
+        image: "{{ .repository }}{{ if .digest }}@{{ .digest }}{{ else }}:{{ .tag }}{{ end }}"
+        {{- end }}
         ports:
         - containerPort: {{ .Values.etcd.ports.client }}
           name: client