Skip to content

Commit

Permalink
refactor and clean up catalog and ups-broker charts (openshift#546)
Browse files Browse the repository at this point in the history
  • Loading branch information
krancour authored and pmorie committed Mar 16, 2017
1 parent 73ce08f commit 54d53ac
Show file tree
Hide file tree
Showing 22 changed files with 516 additions and 252 deletions.
File renamed without changes.
68 changes: 68 additions & 0 deletions charts/catalog/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,68 @@
# Service Catalog

Service Catalog is a Kubernetes Incubator project that provides a
Kubernetes-native workflow for integrating with [Open Service Brokers]
(https://www.openservicebrokerapi.org/) to provision and bind to application
dependencies like databases, object storage, message-oriented middleware, and
more.

For more information, [visit the project on github]
(https://github.com/kubernetes-incubator/service-catalog).

## Prerequisites

- Kubernetes 1.6+ with Beta APIs enabled

## Installing the Chart

To install the chart with the release name `catalog`:

```bash
$ helm install charts/catalog --name catalog --namespace catalog
```

## Uninstalling the Chart

To uninstall/delete the `catalog` deployment:

```bash
$ helm delete catalog
```

The command removes all the Kubernetes components associated with the chart and
deletes the release.

## Configuration

The following tables lists the configurable parameters of the Service Catalog
chart and their default values.

| Parameter | Description | Default |
|-----------|-------------|---------|
| `apiserver.image` | apiserver image to use | `quay.io/kubernetes-service-catalog/apiserver:canary` |
| `apiserver.imagePullPolicy` | `imagePullPolicy` for the apiserver | `Always` |
| `apiserver.insecure` | Whether to expose an insecure endpoint; keep this enabled because there are some outstanding problems with the TLS-secured endpoint | `true` |
| `apiserver.tls.cert` | Base64-encoded x509 certificate | A self-signed certificate |
| `apiserver.tls.key` | Base64-encoded private key | The private key for the certificate above |
| `apiserver.service.type` | Type of service; valid values are `LoadBalancer` and `NodePort` | `LoadBalancer` |
| `apiserver.service.nodePort.securePort` | If service type is `NodePort`, specifies a port in allowable range (e.g. 30000 - 32767 on minikube); The TLS-enabled endpoint will be exposed here | `30443` |
| `apiserver.service.nodePort.insecurePort` | If service type is `NodePort`, specifies a port in allowable range (e.g. 30000 - 32767 on minikube); The insecure endpoint, if enabled, will be exposed here | `30080` |
| `apiserver.storage.type` | The storage backend to use; valid values are `etcd` and `tpr` | `etcd` |
| `apiserver.storage.etcd.useEmbedded` | If storage type is `etcd`: Whether to embed an etcd container in the apiserver pod; THIS IS INADEQUATE FOR PRODUCTION USE! | `true` |
| `apiserver.storage.etcd.servers` | If storage type is `etcd`: etcd URL(s); override this if NOT using embedded etcd | `http://localhost:2379` |
| `apiserver.storage.tpr.useEmbedded.globalNamespace` | If storage type is `tpr`: Some service catalog resources are not namespaced, but third party resources must be; setting this designates a namespace that will be treated as a container for such resources | `servicecatalog` |
| `apiserver.verbosity` | Log level; valid values are in the range 0 - 10 | `10` |
| `controllerManager.image` | controller-manager image to use | `quay.io/kubernetes-service-catalog/controller-manager:canary` |
| `controllerManager.imagePullPolicy` | `imagePullPolicy` for the controller-manager | `Always` |
| `controllerManager.verbosity` | Log level; valid values are in the range 0 - 10 | `10` |

Specify each parameter using the `--set key=value[,key=value]` argument to
`helm install`.

Alternatively, a YAML file that specifies the values for the parameters can be
provided while installing the chart. For example:

```bash
$ helm install charts/catalog --name catalog --namespace catalog \
--values values.yaml
```
9 changes: 9 additions & 0 deletions charts/catalog/templates/_helpers.tpl
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
{{/* vim: set filetype=mustache: */}}

{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "fullname" -}}
{{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
13 changes: 13 additions & 0 deletions charts/catalog/templates/apiserver-cert-secret.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
apiVersion: v1
kind: Secret
metadata:
name: {{ template "fullname" . }}-apiserver-cert
labels:
app: {{ template "fullname" . }}-apiserver
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
type: Opaque
data:
tls.crt: {{ .Values.apiserver.tls.cert }}
tls.key: {{ .Values.apiserver.tls.key }}
139 changes: 139 additions & 0 deletions charts/catalog/templates/apiserver-deployment.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,139 @@
kind: Deployment
apiVersion: extensions/v1beta1
metadata:
name: {{ template "fullname" . }}-apiserver
labels:
app: {{ template "fullname" . }}-apiserver
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
spec:
replicas: 1
selector:
matchLabels:
app: {{ template "fullname" . }}-apiserver
template:
metadata:
labels:
app: {{ template "fullname" . }}-apiserver
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
spec:
containers:
- name: apiserver
image: {{ .Values.apiserver.image }}
imagePullPolicy: {{ .Values.apiserver.imagePullPolicy }}
resources:
requests:
cpu: 100m
memory: 20Mi
limits:
cpu: 100m
memory: 30Mi
args:
- --secure-port
- "8443"
{{- if .Values.apiserver.insecure }}
- --insecure-bind-address
- 0.0.0.0
- --insecure-port
- "8080"
{{- end }}
- --storage-type
- {{ .Values.apiserver.storage.type }}
{{- if eq .Values.apiserver.storage.type "etcd" }}
- --etcd-servers
- {{ .Values.apiserver.storage.etcd.servers }}
{{- else if eq .Values.apiserver.storage.type "tpr" }}
- --global-namespace
- {{ .Values.apiserver.storage.tpr.globalNamespace }}
{{- end }}
- -v
- "{{ .Values.apiserver.verbosity }}"
ports:
{{- if .Values.apiserver.insecure }}
- containerPort: 8080
{{- end }}
- containerPort: 8443
volumeMounts:
- name: apiserver-cert
mountPath: /var/run/kubernetes-service-catalog
readOnly: true
readinessProbe:
httpGet:
port: 8443
path: /healthz
scheme: HTTPS
failureThreshold: 1
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 2
livenessProbe:
httpGet:
port: 8443
path: /healthz
scheme: HTTPS
failureThreshold: 3
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 2
{{- if and (eq .Values.apiserver.storage.type "etcd") .Values.apiserver.storage.etcd.useEmbedded }}
- name: etcd
image: quay.io/coreos/etcd:latest
imagePullPolicy: Always
resources:
requests:
cpu: 100m
memory: 20Mi
limits:
cpu: 100m
memory: 30Mi
env:
- name: ETCD_DATA_DIR
value: /etcd-data-dir
command:
- /usr/local/bin/etcd
- --listen-client-urls
- http://0.0.0.0:2379
- --advertise-client-urls
- http://localhost:2379
ports:
- containerPort: 2379
volumeMounts:
- name: etcd-data-dir
mountPath: /etcd-data-dir
readinessProbe:
httpGet:
port: 2379
path: /health
failureThreshold: 1
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 2
livenessProbe:
httpGet:
port: 2379
path: /health
failureThreshold: 3
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 2
{{- end }}
volumes:
- name: apiserver-cert
secret:
secretName: {{ template "fullname" . }}-apiserver-cert
items:
- key: tls.crt
path: apiserver.crt
- key: tls.key
path: apiserver.key
{{- if eq .Values.apiserver.storage.type "etcd" }}
- name: etcd-data-dir
emptyDir: {}
{{- end }}
30 changes: 30 additions & 0 deletions charts/catalog/templates/apiserver-service.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
kind: Service
apiVersion: v1
metadata:
name: {{ template "fullname" . }}-apiserver
labels:
app: {{ template "fullname" . }}-apiserver
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
spec:
type: {{ .Values.apiserver.service.type }}
selector:
app: {{ template "fullname" . }}-apiserver
ports:
{{- if .Values.apiserver.insecure }}
- name: insecure
protocol: TCP
port: 80
targetPort: 8080
{{- if eq .Values.apiserver.service.type "NodePort" }}
nodePort: {{ .Values.apiserver.service.nodePort.insecurePort }}
{{- end }}
{{- end }}
- name: secure
protocol: TCP
port: 443
targetPort: 8443
{{- if eq .Values.apiserver.service.type "NodePort" }}
nodePort: {{ .Values.apiserver.service.nodePort.securePort }}
{{- end }}
75 changes: 75 additions & 0 deletions charts/catalog/templates/controller-manager-deployment.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,75 @@
kind: Deployment
apiVersion: extensions/v1beta1
metadata:
name: {{ template "fullname" . }}-controller-manager
labels:
app: {{ template "fullname" . }}
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
spec:
replicas: 1
selector:
matchLabels:
app: {{ template "fullname" . }}-controller-manager
template:
metadata:
labels:
app: {{ template "fullname" . }}-controller-manager
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
spec:
containers:
- name: controller-manager
image: {{ .Values.controllerManager.image }}
imagePullPolicy: {{ .Values.controllerManager.imagePullPolicy }}
resources:
requests:
cpu: 100m
memory: 20Mi
limits:
cpu: 100m
memory: 30Mi
args:
- --port
- "8080"
- --service-catalog-api-server-url
{{- if .Values.apiserver.insecure }}
- http://{{ template "fullname" . }}-apiserver
{{- else }}
- https://{{ template "fullname" . }}-apiserver
{{- end }}
- -v
- "{{ .Values.controllerManager.verbosity }}"
ports:
- containerPort: 8080
volumeMounts:
- name: service-catalog-cert
mountPath: /etc/service-catalog-ssl
readOnly: true
readinessProbe:
httpGet:
port: 8080
path: /healthz
failureThreshold: 1
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 2
livenessProbe:
httpGet:
port: 8080
path: /healthz
failureThreshold: 3
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 2
volumes:
- name: service-catalog-cert
secret:
secretName: {{ template "fullname" . }}-apiserver-cert
items:
- key: tls.crt
path: apiserver.crt
54 changes: 54 additions & 0 deletions charts/catalog/values.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,54 @@
# Default values for Service Catalog
apiserver:
# apiserver image to use
image: quay.io/kubernetes-service-catalog/apiserver:canary
# imagePullPolicy for the apiserver; valid values are "IfNotPresent" and
# "Always"
imagePullPolicy: Always
# Whether to expose an insecure endpoint; keep this enabled because there
# are some outstanding problems with the TLS-secured endpoint
insecure: true
tls:
# Base64-encoded x509 certificate
cert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURUVENDQWpXZ0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBREFpTVNBd0hnWURWUVFEREJjeE1DNHgKTVRJdU1TNHhPRFJBTVRRNE56RTVPRE14TWpBZUZ3MHhOekF5TVRVeU1qTTRNekphRncweE9EQXlNVFV5TWpNNApNekphTUNJeElEQWVCZ05WQkFNTUZ6RXdMakV4TWk0eExqRTRORUF4TkRnM01UazRNekV5TUlJQklqQU5CZ2txCmhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBc1J6WlcxTllJQ2FaV3NScytrUGZxRU1uUnI0eE91N2gKb0l5ODI2MHltU3lCRkFZaUh0ankrVVc5NldNbXdCQkFRcVlGR3BQczN2UnI1SGF1RkJuV1dicHRMUjlnbVdZWApRa0tzYm9yK1MybTJwYWUyQ2EyVVRnMXJkMkV5VHpkbWkzaFdKMWRQMllRV0tOSXJOSGpmcTM5L25HTU5YWHRjCmJqbWYxb0ZHUER5ODVMNlIyclpVMHlaM0NMNVByczNhV0tQQmtLVXU3NDZhbldONzNTcGRoSTFxMnhNWHJseXMKcFlnUzdjV2FhZERidjVvNjFUYUFyTm0yTCtUWlNESExUMUVzOXdlVCs3TkhQQVlkUVpYTW1lRXU1V1U5ZzZ0UApnOEtmQk5PVG9iUzZPOTZLTzl4Y0VqT0JLcWdaZTQyYVpoZmFja09rcCs5aUFRN1BPQXhTVVFJREFRQUJvNEdOCk1JR0tNQTRHQTFVZER3RUIvd1FFQXdJQ3BEQVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0RBVEFQQmdOVkhSTUIKQWY4RUJUQURBUUgvTUZJR0ExVWRFUVJMTUVtQ0ZtdDFZbVZ5Ym1WMFpYTXVaR1ZtWVhWc2RDNXpkbU9DRW10MQpZbVZ5Ym1WMFpYTXVaR1ZtWVhWc2RJSUthM1ZpWlhKdVpYUmxjNElKYkc5allXeG9iM04waHdRS2NBRzRNQTBHCkNTcUdTSWIzRFFFQkN3VUFBNElCQVFCYWlPckpOS3FhMmFWdG13YVdoaDAyVFJrMjlXLzA0WlRCYnJseFlpbHQKVi9CYklHbmF3UzlxcGRyVHJNc0RBVmtBbUpRaGtabHJOeFpYbE01WnR2c2wyc3ZHMVlFVnA1UTJuaU9PT3B1Sgo1UDFINUo2SDJNWUpQS2c3OTAyVnZnZ0xPVG5QU01aVjgyWFRlV2JrRW51UjFlY3pwK1NmWjVjZFArSnE3WVRuCm52dHc3aHUzOW1mSVZIU3g3Rk0vN2lBWUJLN0tNQlNUUHZYdWk0SGRTamUzTkhkNlllL0c1bTgvOXNxVXVIL0gKcWJMT0lpenFRRVFNTFRzaFNHdUtxYlVFZ2tBU0ExaTVPbENZcWpEUGRQNTBvVEJkQ24vRnhrMVIvc0R5UlhtQwpYMUR4cUZjNzdkT0pMaHJKM0tDT1RsTy9RY2tkcytkR0tTU09jV0Y4L0p5egotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
# Base64-encoded private key
key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBc1J6WlcxTllJQ2FaV3NScytrUGZxRU1uUnI0eE91N2hvSXk4MjYweW1TeUJGQVlpCkh0ankrVVc5NldNbXdCQkFRcVlGR3BQczN2UnI1SGF1RkJuV1dicHRMUjlnbVdZWFFrS3Nib3IrUzJtMnBhZTIKQ2EyVVRnMXJkMkV5VHpkbWkzaFdKMWRQMllRV0tOSXJOSGpmcTM5L25HTU5YWHRjYmptZjFvRkdQRHk4NUw2UgoyclpVMHlaM0NMNVByczNhV0tQQmtLVXU3NDZhbldONzNTcGRoSTFxMnhNWHJseXNwWWdTN2NXYWFkRGJ2NW82CjFUYUFyTm0yTCtUWlNESExUMUVzOXdlVCs3TkhQQVlkUVpYTW1lRXU1V1U5ZzZ0UGc4S2ZCTk9Ub2JTNk85NksKTzl4Y0VqT0JLcWdaZTQyYVpoZmFja09rcCs5aUFRN1BPQXhTVVFJREFRQUJBb0lCQUUyYUVWWmxkeWhuSVN4WApBbFRKWm5iSUxhNWVhUjJrU3pIWVdHdDhRTDVDZEsvOFcvamVIOSsrZ2c1L2hod0RRdFN3LzIxOHdQMlRaSzZ1Cm5XbHJSTEw5N3hZbE9HTWVDelRhRjhrN2wxNGRqSXlhcGpVcFcrQ3pHcEl0QVNrYVloRGNBZ3Vzd3V6UVpoRXUKdlFWNXJLN3M1MUh6U0lqY0kweWNiUDlFbHl5T3lhQWJhRnNuQmw5RkFCSUgydmhIRS9NNUZsUHBOaVZPaGhraQpQUWdEQng1VGdrYUJrUDJtMVF1WmdxbnRkakRpcC9ZUWdpNE03ai9FMm9tWWtxOGkvd0lnUTBmaUkrZmxzVXpyCmNBWHNvaTU5TGVwLzEyUllqUEtoMXFJUHd4Y0dvTCtHektxNlQ0RG9xRXgxYXg4c1YwK1ZZVHJ6UHJXbTBZL0cKdHVhaXJnRUNnWUVBMm95RDVDNkdJb1JKU21ldTRTbnlxZTFJTjYrUndTd3RvMmd1SUx3K3dUSVBPTFJyNFJzMwpvRjJ6VS9NcmZpRFliTSswK0NXSGhOb3huMmcwOEsyd0pFV01EY1JlNjJLeEhjUEFXcFZuajVUcEJSaHRibUhZCkFoaGVidnErOW9RSkM3c3FLRHp3dWVpYzZhVlVmcVBtTXJ0M0tpRVh6R3VHWVVGbi93dm12dkVDZ1lFQXozYVQKaGU2OG9neHUrSEs4MElYSWNEMlljNFVYeS9UalNOSVdFakRzTUYrekhyNFNBMHJvQzBCaHc2b1djeUpERXFHdgo3WFg3dmFzMHR2SlBTc1Y3QnZieWxmUzY1cVdyN3JJQ2VsbG44Z3ptbERLUlcwbE5hNVAzWWxsSGx1bXVBR29MCjFJMHBwVUVLN3ZOK2hzQk5CdmtRL3NTVlRqME9aNTJuemo1ZmlXRUNnWUJ3TytrZnJhVEU1UnFlVTFERDRUNzEKZFIyNU96aW04NEVjZ2N2dWs3M0dpV2Ezd0RBR2ttdW10M2Y0ak5DeEhUMEg1RU1UakhKa0Q0bWNTMitraWc0RApFcFF5SGI2Qk0xV3g2MjFGRjZUdlg1R3JSRGd1ajZEV3NwME1jVWpRWUU0azhDRmVPSzJIUzZZSmR4WkZVdlpNCjUyanpBYnV2Qnlram1PdEhWMTFRZ1FLQmdGQ0xsTkxXMFYySXZqeXZMeWMyQ1krcUdsb2ZQaEh0VGFDa0QvV1kKRU5ybkRML093MmVMMlhNazE5QURaUnZtSFd4S1llY3JlMFUwQnc5UUhBREhrdkF0U0JsNEhtZ1Z3aDYxOWNoUwpsY3lmdlpXajNGTTRybG9wNUUzR284aXZpT0tZU1dlSU5yYjEvYXl2MUZ1MHBUTWoxN2xSMFRYQzlxaTd5TDZGCjhNbUJBb0dCQU0vN2ROK2lLN2NOTlFiT3haMWJ0VDduQzkySTI1ekduRWNXZFBzMWdZR2w2SnQ3TXJUQTEzRDUKNDNNTXIvTE1OdnI0ZWMyVHl0VUpkMXMzQ1dEMEM5UHg5dUlURUNOT1ZCRHpvN2hoUFcxb0NkTTl0OWM4V0hSNwpzSSsrWktKOVJVanZzeUNZeHM1SFNlNzFVNXZYMTFMcUhydkc2Q2docnNNc2lCa0N1NGZWCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
# Attributes of the apiserver's service resource
service:
# Type of service; valid values are "LoadBalancer" and "NodePort"
# NodePort is useful if deploying on bare metal or hacking locally on
# minikube
type: NodePort
# Further configuration for services of type NodePort
nodePort:
# Available port in allowable range (e.g. 30000 - 32767 on minikube)
# The TLS-enabled endpoint will be exposed here
securePort: 30443
# Available port in allowable range (e.g. 30000 - 32767 on minikube)
# The insecure endpoint, if enabled, will be exposed here
insecurePort: 30080
storage:
# The storage backend to use; valid values are "etcd" and "tpr"
type: etcd
# Further configuration for the etcd-based backend
etcd:
# Whether to embed an etcd container in the apiserver pod
# THIS IS INADEQUATE FOR PRODUCTION USE!
useEmbedded: true
# etcd URL(s); override this if NOT using embedded etcd
servers: http://localhost:2379
tpr:
# Some service catalog resources are not namespaced, but third party
# resources must be; setting this designates a namespace that will be
# treated as a container for such resources
globalNamespace: servicecatalog
# Log level; valid values are in the range 0 - 10
verbosity: 10
controllerManager:
# controller-manager image to use
image: quay.io/kubernetes-service-catalog/controller-manager:canary
# imagePullPolicy for the controller-manager; valid values are "IfNotPresent"
# and "Always"
imagePullPolicy: Always
# Log level; valid values are in the range 0 - 10
verbosity: 10
File renamed without changes.
Loading

0 comments on commit 54d53ac

Please sign in to comment.