From 3332c3ff9c15c2331abeafdfc9c3ee4112042f17 Mon Sep 17 00:00:00 2001 From: Bart Geesink Date: Sun, 17 Sep 2023 11:10:32 +0200 Subject: [PATCH] add portainer --- portainer/hassingress.yaml | 25 +++ portainer/ingress_zoals_het_werkt | 45 ++++ portainer/install | 6 + portainer/portainer-1.0.43.tgz | Bin 0 -> 6078 bytes portainer/portainer/.helmignore | 22 ++ portainer/portainer/Chart.yaml | 14 ++ portainer/portainer/README.md | 92 +++++++++ portainer/portainer/templates/NOTES.txt | 27 +++ portainer/portainer/templates/_helpers.tpl | 87 ++++++++ portainer/portainer/templates/deployment.yaml | 193 ++++++++++++++++++ portainer/portainer/templates/ingress.yaml | 60 ++++++ portainer/portainer/templates/namespace.yaml | 6 + portainer/portainer/templates/pvc.yaml | 32 +++ portainer/portainer/templates/rbac.yaml | 14 ++ portainer/portainer/templates/service.yaml | 47 +++++ .../portainer/templates/serviceaccount.yaml | 11 + .../templates/tests/test-connection.yaml | 18 ++ portainer/portainer/values.yaml | 77 +++++++ portainer/values.yaml | 81 ++++++++ portainer/values.yaml.old | 15 ++ portainer/values2.yaml | 15 ++ 21 files changed, 887 insertions(+) create mode 100644 portainer/hassingress.yaml create mode 100644 portainer/ingress_zoals_het_werkt create mode 100644 portainer/install create mode 100644 portainer/portainer-1.0.43.tgz create mode 100644 portainer/portainer/.helmignore create mode 100644 portainer/portainer/Chart.yaml create mode 100644 portainer/portainer/README.md create mode 100644 portainer/portainer/templates/NOTES.txt create mode 100644 portainer/portainer/templates/_helpers.tpl create mode 100644 portainer/portainer/templates/deployment.yaml create mode 100644 portainer/portainer/templates/ingress.yaml create mode 100644 portainer/portainer/templates/namespace.yaml create mode 100644 portainer/portainer/templates/pvc.yaml create mode 100644 portainer/portainer/templates/rbac.yaml create mode 100644 portainer/portainer/templates/service.yaml create mode 100644 portainer/portainer/templates/serviceaccount.yaml create mode 100644 portainer/portainer/templates/tests/test-connection.yaml create mode 100644 portainer/portainer/values.yaml create mode 100644 portainer/values.yaml create mode 100644 portainer/values.yaml.old create mode 100644 portainer/values2.yaml diff --git a/portainer/hassingress.yaml b/portainer/hassingress.yaml new file mode 100644 index 0000000..299bd8e --- /dev/null +++ b/portainer/hassingress.yaml @@ -0,0 +1,25 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: hassingress + annotations: + cert-manager.io/cluster-issuer: letsencrypt-prod + haproxy.org/whitelist: "192.168.86.0/24,10.233.71.0/24" +spec: + ingressClassName: haproxy + rules: + - host: "home.geesink.org" + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: hasssvc + port: + number: 8123 + tls: + - + secretName: hass-cert-prod + hosts: + - home.geesink.org diff --git a/portainer/ingress_zoals_het_werkt b/portainer/ingress_zoals_het_werkt new file mode 100644 index 0000000..e4475cf --- /dev/null +++ b/portainer/ingress_zoals_het_werkt @@ -0,0 +1,45 @@ +# Please edit the object below. Lines beginning with a '#' will be ignored, +# and an empty file will abort the edit. If an error occurs while saving this file will be +# reopened with the relevant failures. +# +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: + cert-manager.io/cluster-issuer: letsencrypt-prod + kubernetes.io/ingress.class: haproxy + meta.helm.sh/release-name: portainer + meta.helm.sh/release-namespace: portainer + creationTimestamp: "2023-05-31T18:17:22Z" + generation: 7 + labels: + app.kubernetes.io/instance: portainer + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: portainer + app.kubernetes.io/version: ce-latest-ee-2.18.3 + helm.sh/chart: portainer-1.0.43 + name: portainer + namespace: portainer + resourceVersion: "17547843" + uid: 2471a902-9fad-49af-a56b-9d4173b562c9 +spec: + ingressClassName: haproxy + rules: + - host: portainer.geesink.org + http: + paths: + - backend: + service: + name: portainer + port: + number: 9443 + path: / + pathType: Prefix + tls: + - hosts: + - portainer.geesink.org + secretName: portainer-cert-prod +status: + loadBalancer: + ingress: + - ip: 10.86.0.100 diff --git a/portainer/install b/portainer/install new file mode 100644 index 0000000..145db04 --- /dev/null +++ b/portainer/install @@ -0,0 +1,6 @@ +helm upgrade --install --create-namespace -n portainer portainer portainer/portainer \ + --set service.type=ClusterIP \ + --set tls.force=true \ + --set ingress.enabled=true \ + --set ingress.ingressClassName=haproxy + diff --git a/portainer/portainer-1.0.43.tgz b/portainer/portainer-1.0.43.tgz new file mode 100644 index 0000000000000000000000000000000000000000..fb9939bcbb13dea585bfe0e7f0154993f5665b65 GIT binary patch literal 6078 zcmV;v7eVMBiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PH<~bKAC({hOa+Psy7mc_Ag)j-98QytzClugzTIcw)bFI(@wu zB3BY>iev%Mj%xcp`^^F%2~wmaJFYYBnKN-D3Ro-_`wPHgk)=X0o}lRO&zMlbg3aS^ zZuuDu27}$59sU1cFlhci*xem`Gu+wP-r9XO7!00$GZ=0U_nv(NgWE==?a8HL;+w%2 zx7F<2ALL;f|A<2JG#SC!mdCQJ{2HPkGlf$5i2hbEd>(9j5z0{TOz8sOV?2kD*amWm z5vUX*%;IzbYKCxFa28Bb0sozkQ6#8Pdb4znBbX_b$x*+5etsU5Oc?Og;~~K=ex7nQ z%f~^O&ifUsR-Xhr??-rsahmm6mi3vGsAQjqDSeI6S7{#3e1aKd$<&)Oo|vj~c7taHDg%g&?3e5Ox zVXgStdjQ8XE`dv6@Z-yOZ+(&zrW8gn;W1KyR~W`jAe=G5**Hc?ieQY8kuXNU6P3au z%>^i&XIi5Ko+nWA_1WSN z(g=?*#!#hV1Q%DHCsCa75MPF&rmzRVk|b4HsYqR<&}n13O|=PKg{#X!~)RM{p?8GajL6hx#^U(LY$sl2B`Kqh}qws8jTD1b-V0 z2KI%tZ+3RJ?VF;;2(|}%dwWH>`s=?DcSTeC=DC6A63GvBo4=Kk2KvqAn6UU;^_*Gu01DS(4@i7Tq>SSL25QKLP|emX++rC zpAD0Zpx5)f`HgU!JII*<{C%*SAXB-}tU8I=RGPPzbw;i7ZhqU3nUn`w5_-K>F(E`x zOZO$mnukBq6A1k%2w_=w+`5R8aDqcTRF`TC3b45o@!8|M21 z@b$Y9^!h{q8fL9j1QxD~X3dN|5vedS3ZbN@?Um%e5ebKb?|3^IrAh^xqNexA8O8mW z@%iZ19h>`Sqo*=OrFHHfygz<@6sXVYmfBe7|Ltux{lA^P!QkHiyNl=I!Y3sad^FyF z)7D;Hc~nBMWQy>R)Ci1TES1)}hROm|r30gz^xJ<~r|n-K-de?|Qea_-QtJ2ajK|p2 ziwi>QVY4L_6GVA&0hkbWqkjM5!XT!xfU7H0Q_sn$z{N%RnQFxn?I&IT;zFZYqHf-L z&5u-zPsqHHut?|?ro30u!um>qR>B(Ich(JYI%f#50FfsN**7&qNmg?{XGx^BVq-i? z<6%IO*3_Ljc>n74r^ELjj$b@{MAjozF-%c`?~_v}GZrFH&p%*{Ok!|QzP-8vKZRdp zno!4I^ezIKVW>$Ye;WK8B(`T)J+NJp1c@hMoJR<~YHl#e$}*j|&PK3f}>; z!!JM<%jJy%LT;W`kRVt=(8L%iKK1Th{e!1!q?J%6Bl4nE&rn^)vn2>$s-9Pn*5=0~qTe0;OtGVB`MChcz0AozY^ zVWD?%(Yv^?dh!uZBK!;mhr|vc3$+J>$3|B9LpiDGR&3?;>(-gc zQv2}zt4{|n-@R_oI!mKXB`k&>%d&>kOch_Wk3%&EPnYZQL@J{7i)MR7;!bIv<3mgN z-bXIE(gQH+_lH}1!5|m}!x2pyi#d>9{BUSR{&CUwjk-*I@h7P`XCi`!1qJoQR5#?> zt83c-HvjL_3}f>41C`y%Qs5f@Z)bO>x&Hs`+1}Q@|92P9#YO)KobmZcubNDFj3nkS z=0uioh9h{=*Sezr#C!cYqbVl|KJlzsYD2RD5O}tn4-rmy(jtI<^}Akg49td;mbF6F zP|5daCKGvWrnOF5%JG?0UR9IHIz8 z@gl?Uap1j~fG|RBfRwt{?40O#T$M{GdMAZRGP8LcTWnVlx3V$?O&s^J__3sEQKqxN zMnos8QG9u*J1}~&`M5fGmb5TX>I%5Twf6Sf2xfvOY688#NdGUg*MMf)y$+{!eXen! zGqfZ!b`yt&RS&P_6;mo^V~kf0u`bu^?2t=u^Vx3U!6gXHVlpDVzxJT_sdp2ZO6T)5 zF<8n~Seg#EH^Caw`KcY?w^ry zU8-^kzvijJ#*}Xv%A6%^ijhBFjA~Z;$hbz(O1WY|egoPyJL8&G36L+&ztKFN`{c?994!YD-y;u;M=6yShytpWJ%cIq9_Tw&yiQCme zIW%DR?1v@Cw-rdI2C(}Oz#tRo8=d8>I zwN+JUX#2GVYl^d)u5`_5){x>mOi&nuEckS$ihUobf)19uT&(m|WomtvI6p(NpUyL~ z!o9!07zSGde?V%GWo*o2t~knoEVr#5e8*KG?*u48b)Je-o=k(&=SD{iYm=dtCWbp- z+{73a8`g=8pA{xlNtP(om!JHrtKZxIYxDn25XT&oTM7qS?f(y-Z9m&?`2V}x!@Ya| z|1KUk{)c6m=EPH;L?d`ra)CET#UiHIsN6K(WW~c4*0b1U%Tr8lJ+SuCEI9GhiKcO^ zm@|D2XliomhS(TQ?zf>7m#)JlBs_^QQLsbJl6P+RT^KCQ z{&DXE8dF6R`oe^p0&}Lq*;}Vyod_=bI2EG1rtLy9Eof&j=!t8s+^C)B#e!`?6nYvl z1!NG?AK5&voO-7~4On4Z4KC+g&8i)PM)(4hMVA5_Y8@(?ZbQ1Za&KNN`yE{@+vcGJ z6`->;&ga;qZinfu_DqV>z7>}q4Oq`v11;;RkGciB3F<788b6^#z0DYxK0)BNxkQZC zO@;a%dK=Cm3MCzk%wBvQNAs>kaOw&kT2yR!t*M~c6t1p%&DIW`c%u!VRN+a>{dISNI{UK* z`8)vNsgCdlhhha2^mer`qV+LF_4 z!kP%Q{VtG2?~`~@1~y$6y|uEm+JLpIuebc}T>PZ*DLfyXm} za+b!?24tCb--eAo1Az{c(M8*eu=U|@Nom4Y&yAc$qJL6`?9#lgKehfq&I7-4(UhmB}%@m1fKh*Ya9@)*}(UPH5~9u2h3qx&$U;}r{k*Ln)#7Fvc}X5F00_Q{*ot9c@HlC_u68Qmg*Ap zV;#eAC~(3*Z?Yt7k0rORAm0dya+|(6OY9cZ`lFqet|^_PeOg_UB%hB_SYoF_ImFgy zH?HkOuL3w246fk=b+=;)cCZ0?HXwtAX4bklro&q7y5Y5wVHFXUqXf!VtrGpUt?3`{ zY4iU|b9hT0;JW-@!<}c%_`kvK&b|M47mqzHZEcg6ruIL@M z#X9zCiluip?6uF-HaLW^>HMuRuUgS_H&spHfSCB0V2p}2PS@DdzRd>Y1mSeTtj!vl z4wY?*#o264Q@trBD0tZOTAZVfzAa5RiOBUOw65ZpU}v6NI`YcYE!+I6QQRh%$h$Pc zGUt(dwC4k|=m)_SzE48zwRg0HP#>Mf%A>$vb982}c0{^|o&Sc*!`;PqMKrZ8SVfet z9wJ%AU^iC=y7HM+N5$LpzZkPyH2~}UzujTe|9dvrx!3=9^0-=9k2}lNEEW7WBc#;{ zDWlA7dWa8cjQ`+C#FOdG4~KlodYVXM{D2cJ`WgRDqL5VXP|YrHaa0`Q%tqs>dLI!nYznvV9V-O;o_JxXDtEdRbCz^ z#CMa>Uf*u}c4P`F5(ODYM=>!)wG`po77x1=D155{`EDN8T0nkMrdRFgP*JOE8=>)a z4SD1W`c#|qtLYgZs3Zu)L$jSqLIJl76UE5_Nd+7(9nB^C=cbm+hhUaV{6*w1}dyNl!=c)3;Rg+al4vIcWaVx0}$Y zD|>5ki1=r-GOd_U#VPm$JiEc3YbE~y(SlEtRNyW1*gE-twzU4Uy)(GC|9A2{fJ3Gf zibUVqV}>8jXPCe^=W)c7DP$}>WmA;pWk52|^hyKB8OAY8<8*8i-tc7l6a>ah@iWvx zX3l$-MBW2PaBA`eKgx9E8Airt|HtFN+?|mox+b9n848Gbf`J#jI{I{^Qi0wBuo($I z?jJ$Kh4g|cSAG50pzj6a-$Y;kEndu~efm>;m1jx60yJjfX`boar_y^8$n(s55{%iY z_aspB%zN^`-UIl^1W$7bZ(hBYUXY3O7Yvmb@CaGoloRPMUT`MEG{XKL$Ums$|HJE- zuim{5=FzRUv0DCzgT1Zh{?FF4?fdoLJ9!@1JYUXbKDi{R*O&Y0ls2CC51f!%$V3_< zMp~LNk-5;fD}_bU-71kaPk=>dED162{+S9W^G|vwCnsYjXI_#1+E%WrR*SnQCnx$= zFsd8JPQuhGVT@P8Bip5a02W0RkTNlPWoPZ(dpzx*K9_x`VxC1zVbLskKQ@oKrNZma z80I!B<|K{d^qhXz`R|>wCgW)XF>d?d`;l1qB2VZOj`OL5sh>DsOa{I_Rql6DWK-;T zy?85vc{UX+LhyMVkCsmkKHh@|@Bt?%z+TUk<|@mTzBAwm(gbGdxnEuM;anGmW2*Zy z0sPG7S*&jfV@hY7j?4uio~NOVykYRCy1SsFsJ*P9eDSS!gDVNzhN^ziz!%;!P`hHF zal?RfRobZE-x>rvgJ8I~8$36^SayAdF>WkMkz2UQst+tMQ_)dSnujCvQ#=1Q>Q?cK z1#xZd6^ckV1^f1fGjmtXajgT2xCLS^mATcXxD8Fe&X{0xR48PTPPdW=qt|S5buP-d z6?-Ko99Q=pl9!?xa7-=dNd$Qkp@5TCmEm6Mc@lWu6N2PmQY0NeMa+x>F zSd@ZGcvao{s=pcRF1<_eq5S7v!ik$V@dPg6K*z*WhpWyOS%izki}2{>+aF&3cx0~a zOJVpJF5zT&Vjwnigb~yV)~hr;MFHREW5+5`_4XSUYcLg?60l=7EfqlpSQjBc<``zJ zVwGL2j*O{8ziO}9SGnA89{$qot7o5>O^fxqTllox7}S%pmSGZO83 ze-j>C&~8>n0{bs}GcPI61zBk~YopcMRl-+-b#Y}ub+4Zh;Fr#Fnlg6Rf@|i9Cam%} zZih+|r^jKVWYe{=ZC+SeZ$NLS5ac3B_wgdba;WEwCl0-Bng6V=pL`0nOD=0R;u22W z?~Qhgc{;WI{qgakRwcS&V+e^ms+NDiF~K8^*#f7)LHC2G9aduH%YpK(y`fD8st7oRE zfH}Fswu}Ucq)wGd>aQ(_48ZkypTddnQ}GvRhKbMSniP(}HjZ4*)s(?HsR2(r zx@ExY6Mg!xwhK(nS`3SB=@L%*t3X(JDTSmRgrhQ?Q|g4E4-gopuqN(ga0`9NXZyf&1EHvnH4&6?TUo_lu#> zK6(rIN+z1Y&sy>G-%7hqz%=FbMdNiS!@+mF1= 1.18 you should specify the ingress-controller via the field `ingressClassName`. For instance, `nginx` | `nil` | +| `ingress.annotations` | Annotations to add to the ingress. For instane, `kubernetes.io/ingress.class: nginx` | `{}` | +| `ingress.hosts.host` | URL for Portainer Web. For instance, `portainer.example.io` | `nil` | +| `ingress.hosts.paths.path` | Path for the Portainer Web. | `/` | +| `ingress.hosts.paths.port` | Port for the Portainer Web. | `9000` | +| `ingress.tls` | TLS support on ingress. Must create a secret with TLS certificates in advance | `[]` | +| `resources` | Portainer resource requests and limits | `{}` | +| `tls.force` | Force Portainer to be configured to use TLS only | `false` | +| `tls.existingSecret` | Mount the existing TLS secret into the pod | `""` | +| `mtls.enable` | Option to specicy mtls Certs to be used by Portainer | `false` | +| `mtls.existingSecret` | Mount the existing mtls secret into the pod | `""` | +| `persistence.enabled` | Whether to enable data persistence | `true` | +| `persistence.existingClaim` | Name of an existing PVC to use for data persistence | `nil` | +| `persistence.size` | Size of the PVC used for persistence | `10Gi` | +| `persistence.annotations` | Annotations to apply to PVC used for persistence | `{}` | +| `persistence.storageClass` | StorageClass to apply to PVC used for persistence | `default` | +| `persistence.accessMode` | AccessMode for persistence | `ReadWriteOnce` | +| `persistence.selector` | Selector for persistence | `nil` | \ No newline at end of file diff --git a/portainer/portainer/templates/NOTES.txt b/portainer/portainer/templates/NOTES.txt new file mode 100644 index 0000000..afc6d1e --- /dev/null +++ b/portainer/portainer/templates/NOTES.txt @@ -0,0 +1,27 @@ +{{- if .Values.ingress.enabled }} +{{- range $host := .Values.ingress.hosts }} + {{- range .paths }} + Use the URL below to access the application + http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ if .port }}:{{ .port }}{{ else }}{{ end }}{{.path}} + {{- end }} +{{- end }} +{{- else if contains "NodePort" .Values.service.type }} + Get the application URL by running these commands: + {{- if .Values.tls.force }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "portainer.fullname" . }}) + {{- else }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[1].nodePort}" services {{ include "portainer.fullname" . }}) + {{- end}} + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo https://$NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.service.type }} + Get the application URL by running these commands: + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "portainer.fullname" . }}' + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "portainer.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") + echo https://$SERVICE_IP:{{ .Values.service.httpsPort }} +{{- else if contains "ClusterIP" .Values.service.type }} + Get the application URL by running these commands: + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "portainer.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].me$ echo "Visit http://127.0.0.1:9443 to use your application" + kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 9443:9443 +{{- end }} diff --git a/portainer/portainer/templates/_helpers.tpl b/portainer/portainer/templates/_helpers.tpl new file mode 100644 index 0000000..b428447 --- /dev/null +++ b/portainer/portainer/templates/_helpers.tpl @@ -0,0 +1,87 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "portainer.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "portainer.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "portainer.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Common labels +*/}} +{{- define "portainer.labels" -}} +helm.sh/chart: {{ include "portainer.chart" . }} +{{ include "portainer.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end -}} + +{{/* +Selector labels +*/}} +{{- define "portainer.selectorLabels" -}} +app.kubernetes.io/name: {{ include "portainer.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "portainer.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "portainer.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Provide a pre-defined claim or a claim based on the Release +*/}} +{{- define "portainer.pvcName" -}} +{{- if .Values.persistence.existingClaim }} +{{- .Values.persistence.existingClaim }} +{{- else -}} +{{- template "portainer.fullname" . }} +{{- end -}} +{{- end -}} + +{{/* +Generate a right Ingress apiVersion +*/}} +{{- define "ingress.apiVersion" -}} +{{- if semverCompare ">=1.20-0" .Capabilities.KubeVersion.GitVersion -}} +networking.k8s.io/v1 +{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} +networking.k8s.io/v1beta1 +{{- else -}} +extensions/v1 +{{- end }} +{{- end -}} \ No newline at end of file diff --git a/portainer/portainer/templates/deployment.yaml b/portainer/portainer/templates/deployment.yaml new file mode 100644 index 0000000..67b59b5 --- /dev/null +++ b/portainer/portainer/templates/deployment.yaml @@ -0,0 +1,193 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "portainer.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + io.portainer.kubernetes.application.stack: portainer + {{- include "portainer.labels" . | nindent 4 }} +spec: + replicas: {{ .Values.replicaCount }} + strategy: + type: "Recreate" + selector: + matchLabels: + {{- include "portainer.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + {{- include "portainer.selectorLabels" . | nindent 8 }} + spec: + nodeSelector: {{- toYaml .Values.nodeSelector | nindent 8 -}} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "portainer.serviceAccountName" . }} + volumes: + {{- if .Values.persistence.enabled }} + - name: "data" + persistentVolumeClaim: + claimName: {{ template "portainer.pvcName" . }} + {{- end }} + {{- if .Values.tls.existingSecret }} + - name: certs + secret: + secretName: {{ .Values.tls.existingSecret }} + {{- end }} + {{- if .Values.mtls.existingSecret }} + - name: mtlscerts + secret: + secretName: {{ .Values.mtls.existingSecret }} + {{- end }} + containers: + - name: {{ .Chart.Name }} + {{- if .Values.enterpriseEdition.enabled }} + image: "{{ .Values.enterpriseEdition.image.repository }}:{{ .Values.enterpriseEdition.image.tag }}" + imagePullPolicy: {{ .Values.enterpriseEdition.image.pullPolicy }} + {{- else }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + {{- end }} + args: + {{- if .Values.tls.force }} + - --http-disabled + {{- end }} + {{- if .Values.tls.existingSecret }} + - --sslcert=/certs/tls.crt + - --sslkey=/certs/tls.key + {{- end }} + {{- if .Values.mtls.existingSecret }} + - --mtlscacert=/certs/mtls/mtlsca.crt + - --mtlscert=/certs/mtls/mtlscert.crt + - --mtlskey=/certs/mtls/mtlskey.key + {{- end }} + {{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.service.edgeNodePort))) }} + - '--tunnel-port={{ .Values.service.edgeNodePort }}' + {{- end }} + {{- if (not (empty .Values.feature.flags)) }} + - '{{ .Values.feature.flags }}' + {{- end }} + volumeMounts: + {{- if .Values.persistence.enabled }} + - name: data + mountPath: /data + {{- end }} + {{- if .Values.tls.existingSecret }} + - name: certs + mountPath: /certs + readOnly: true + {{- end }} + {{- if .Values.mtls.existingSecret }} + - name: mtlscerts + mountPath: /certs/mtls + readOnly: true + {{- end }} + ports: + {{- if not .Values.tls.force }} + - name: http + containerPort: 9000 + protocol: TCP + {{- end }} + - name: https + containerPort: 9443 + protocol: TCP + - name: tcp-edge + containerPort: 8000 + protocol: TCP + livenessProbe: + failureThreshold: 3 + initialDelaySeconds: 45 + httpGet: + path: / + {{- if .Values.tls.force }} + port: 9443 + scheme: HTTPS + {{- else }} + {{- if .Values.enterpriseEdition.enabled }} + {{- if regexMatch "^[0-9]+\\.[0-9]+\\.[0-9]+$" .Values.enterpriseEdition.image.tag }} + {{- if eq (semver .Values.enterpriseEdition.image.tag | (semver "2.7.0").Compare) -1 }} + port: 9443 + scheme: HTTPS + {{- else }} + port: 9000 + scheme: HTTP + {{- end }} + {{- else }} + {{- if eq .Values.enterpriseEdition.image.tag "latest" }} + port: 9443 + scheme: HTTPS + {{- else }} + port: 9000 + scheme: HTTP + {{- end }} + {{- end}} + {{- else }} + {{- if regexMatch "^[0-9]+\\.[0-9]+\\.[0-9]+$" .Values.image.tag }} + {{- if eq (semver .Values.image.tag | (semver "2.6.0").Compare) -1 }} + port: 9443 + scheme: HTTPS + {{- else }} + port: 9000 + scheme: HTTP + {{- end}} + {{- else }} + {{- if eq .Values.image.tag "latest" }} + port: 9443 + scheme: HTTPS + {{- else }} + port: 9000 + scheme: HTTP + {{- end }} + {{- end }} + {{- end }} + {{- end }} + readinessProbe: + failureThreshold: 3 + initialDelaySeconds: 45 + httpGet: + path: / + {{- if .Values.tls.force }} + port: 9443 + scheme: HTTPS + {{- else }} + {{- if .Values.enterpriseEdition.enabled }} + {{- if regexMatch "^[0-9]+\\.[0-9]+\\.[0-9]+$" .Values.enterpriseEdition.image.tag }} + {{- if eq (semver .Values.enterpriseEdition.image.tag | (semver "2.7.0").Compare) -1 }} + port: 9443 + scheme: HTTPS + {{- else }} + port: 9000 + scheme: HTTP + {{- end }} + {{- else }} + {{- if eq .Values.enterpriseEdition.image.tag "latest" }} + port: 9443 + scheme: HTTPS + {{- else }} + port: 9000 + scheme: HTTP + {{- end }} + {{- end}} + {{- else }} + {{- if regexMatch "^[0-9]+\\.[0-9]+\\.[0-9]+$" .Values.image.tag }} + {{- if eq (semver .Values.image.tag | (semver "2.6.0").Compare) -1 }} + port: 9443 + scheme: HTTPS + {{- else }} + port: 9000 + scheme: HTTP + {{- end}} + {{- else }} + {{- if eq .Values.image.tag "latest" }} + port: 9443 + scheme: HTTPS + {{- else }} + port: 9000 + scheme: HTTP + {{- end }} + {{- end }} + {{- end }} + {{- end }} + resources: + {{- toYaml .Values.resources | nindent 12 }} diff --git a/portainer/portainer/templates/ingress.yaml b/portainer/portainer/templates/ingress.yaml new file mode 100644 index 0000000..50d51d4 --- /dev/null +++ b/portainer/portainer/templates/ingress.yaml @@ -0,0 +1,60 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "portainer.fullname" . -}} +{{- $tlsforced := .Values.tls.force -}} +{{- $apiVersion := include "ingress.apiVersion" . -}} +apiVersion: {{ $apiVersion }} +kind: Ingress +metadata: + name: {{ $fullName }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "portainer.labels" . | nindent 4 }} + {{- with .Values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: +{{- with .Values.ingress.ingressClassName }} + ingressClassName: {{ . }} +{{- end }} +{{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} +{{- end }} + rules: + {{- range .Values.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path | default "/" }} + {{- if eq $apiVersion "networking.k8s.io/v1" }} + pathType: Prefix + {{- end }} + backend: + {{- if eq $apiVersion "networking.k8s.io/v1" }} + service: + name: {{ $fullName }} + port: + {{- if $tlsforced }} + number: {{ .port | default 9443 }} + {{- else }} + number: {{ .port | default 9000 }} + {{- end }} + {{- else }} + serviceName: {{ $fullName }} + {{- if $tlsforced }} + servicePort: {{ .port | default 9443 }} + {{- else }} + servicePort: {{ .port | default 9000 }} + {{- end }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} \ No newline at end of file diff --git a/portainer/portainer/templates/namespace.yaml b/portainer/portainer/templates/namespace.yaml new file mode 100644 index 0000000..f8d1949 --- /dev/null +++ b/portainer/portainer/templates/namespace.yaml @@ -0,0 +1,6 @@ +{{ if .Values.createNamespace }} +apiVersion: v1 +kind: Namespace +metadata: + name: portainer +{{ end }} \ No newline at end of file diff --git a/portainer/portainer/templates/pvc.yaml b/portainer/portainer/templates/pvc.yaml new file mode 100644 index 0000000..b037d3d --- /dev/null +++ b/portainer/portainer/templates/pvc.yaml @@ -0,0 +1,32 @@ +{{- if .Values.persistence.enabled -}} +{{- if not .Values.persistence.existingClaim -}} +--- +kind: "PersistentVolumeClaim" +apiVersion: "v1" +metadata: + name: {{ template "portainer.fullname" . }} + namespace: {{ .Release.Namespace }} + annotations: + {{- if .Values.persistence.storageClass }} + volume.beta.kubernetes.io/storage-class: {{ .Values.persistence.storageClass | quote }} + {{- else }} + volume.alpha.kubernetes.io/storage-class: "generic" + {{- end }} + {{- if .Values.persistence.annotations }} + {{ toYaml .Values.persistence.annotations | indent 2 }} + {{ end }} + labels: + io.portainer.kubernetes.application.stack: portainer + {{- include "portainer.labels" . | nindent 4 }} +spec: + accessModes: + - {{ default "ReadWriteOnce" .Values.persistence.accessMode | quote }} + resources: + requests: + storage: {{ .Values.persistence.size | quote }} + {{- if .Values.persistence.selector }} + selector: +{{ toYaml .Values.persistence.selector | indent 4 }} + {{ end }} +{{- end }} +{{- end }} diff --git a/portainer/portainer/templates/rbac.yaml b/portainer/portainer/templates/rbac.yaml new file mode 100644 index 0000000..079e080 --- /dev/null +++ b/portainer/portainer/templates/rbac.yaml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "portainer.fullname" . }} + labels: + {{- include "portainer.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +subjects: +- kind: ServiceAccount + namespace: {{ .Release.Namespace }} + name: {{ include "portainer.serviceAccountName" . }} \ No newline at end of file diff --git a/portainer/portainer/templates/service.yaml b/portainer/portainer/templates/service.yaml new file mode 100644 index 0000000..b6f12e5 --- /dev/null +++ b/portainer/portainer/templates/service.yaml @@ -0,0 +1,47 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "portainer.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + io.portainer.kubernetes.application.stack: portainer + {{- include "portainer.labels" . | nindent 4 }} + {{- if .Values.service.annotations }} + annotations: + {{- range $key, $value := .Values.service.annotations }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- end }} +spec: + type: {{ .Values.service.type }} + ports: + {{- if not .Values.tls.force }} + - port: {{ .Values.service.httpPort }} + targetPort: 9000 + protocol: TCP + name: http + {{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.service.httpNodePort))) }} + nodePort: {{ .Values.service.httpNodePort}} + {{- end }} + {{- end }} + - port: {{ .Values.service.httpsPort }} + targetPort: 9443 + protocol: TCP + name: https + {{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.service.httpsNodePort))) }} + nodePort: {{ .Values.service.httpsNodePort}} + {{- end }} + {{- if (eq .Values.service.type "NodePort") }} + - port: {{ .Values.service.edgeNodePort }} + targetPort: {{ .Values.service.edgeNodePort }} + {{- else }} + - port: {{ .Values.service.edgePort }} + targetPort: {{ .Values.service.edgePort }} + {{- end }} + protocol: TCP + name: edge + {{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.service.edgeNodePort))) }} + nodePort: {{ .Values.service.edgeNodePort }} + {{- end }} + selector: + {{- include "portainer.selectorLabels" . | nindent 4 }} diff --git a/portainer/portainer/templates/serviceaccount.yaml b/portainer/portainer/templates/serviceaccount.yaml new file mode 100644 index 0000000..2b9630e --- /dev/null +++ b/portainer/portainer/templates/serviceaccount.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "portainer.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "portainer.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} diff --git a/portainer/portainer/templates/tests/test-connection.yaml b/portainer/portainer/templates/tests/test-connection.yaml new file mode 100644 index 0000000..fed2dfa --- /dev/null +++ b/portainer/portainer/templates/tests/test-connection.yaml @@ -0,0 +1,18 @@ +{{- if not .Values.disableTest -}} +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "portainer.fullname" . }}-test-connection" + namespace: {{ .Release.Namespace }} + labels: + {{- include "portainer.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['{{ include "portainer.fullname" . }}:{{ .Values.service.httpPort }}'] + restartPolicy: Never +{{ end }} \ No newline at end of file diff --git a/portainer/portainer/values.yaml b/portainer/portainer/values.yaml new file mode 100644 index 0000000..728499a --- /dev/null +++ b/portainer/portainer/values.yaml @@ -0,0 +1,77 @@ +# Default values for portainer. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +# If enterpriseEdition is enabled, then use the values below _instead_ of those in .image +enterpriseEdition: + enabled: false + image: + repository: portainer/portainer-ee + tag: 2.18.3 + pullPolicy: Always + +image: + repository: portainer/portainer-ce + tag: 2.18.3 + pullPolicy: Always + +imagePullSecrets: [] + +nodeSelector: {} + +serviceAccount: + annotations: {} + name: portainer-sa-clusteradmin + +service: + # Set the httpNodePort and edgeNodePort only if the type is NodePort + # For Ingress, set the type to be ClusterIP and set ingress.enabled to true + # For Cloud Providers, set the type to be LoadBalancer + type: NodePort + httpPort: 9000 + httpsPort: 9443 + httpNodePort: 30777 + httpsNodePort: 30779 + edgePort: 8000 + edgeNodePort: 30776 + annotations: {} + +tls: + # If set, Portainer will be configured to use TLS only + force: false + # If set, will mount the existing secret into the pod + existingSecret: "" + +mtls: + # If set, Portainer will be configured to use mTLS only + enable: false + # If set, will mount the existing secret into the pod + existingSecret: "" + +feature: + flags: "" + +ingress: + enabled: false + ingressClassName: "" + annotations: {} + # kubernetes.io/ingress.class: nginx + # Only use below if tls.force=true + # nginx.ingress.kubernetes.io/backend-protocol: HTTPS + # Note: Hosts and paths are of type array + hosts: + - host: + paths: [] + # - path: "/" + tls: [] + +resources: {} + +persistence: + enabled: true + size: "10Gi" + annotations: {} + storageClass: + existingClaim: diff --git a/portainer/values.yaml b/portainer/values.yaml new file mode 100644 index 0000000..6f84c6a --- /dev/null +++ b/portainer/values.yaml @@ -0,0 +1,81 @@ +# Default values for portainer. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +# If enterpriseEdition is enabled, then use the values below _instead_ of those in .image +enterpriseEdition: + enabled: true + image: + repository: portainer/portainer-ee + tag: 2.18.3 + pullPolicy: Always + +image: + repository: portainer/portainer-ce + tag: 2.18.3 + pullPolicy: Always + +imagePullSecrets: [] + +nodeSelector: {} + +serviceAccount: + annotations: {} + name: portainer-sa-clusteradmin + +service: + # Set the httpNodePort and edgeNodePort only if the type is NodePort + # For Ingress, set the type to be ClusterIP and set ingress.enabled to true + # For Cloud Providers, set the type to be LoadBalancer + type: ClusterIP + httpPort: 9000 + httpsPort: 9443 + annotations: + haproxy.org/server-ssl: "true" + + +tls: + # If set, Portainer will be configured to use TLS only + force: true + # If set, will mount the existing secret into the pod + existingSecret: "" + +mtls: + # If set, Portainer will be configured to use mTLS only + enable: false + # If set, will mount the existing secret into the pod + existingSecret: "" + +feature: + flags: "" + +ingress: + enabled: true + ingressClassName: haproxy + annotations: + cert-manager.io/cluster-issuer: letsencrypt-prod + kubernetes.io/ingress.class: haproxy + + # kubernetes.io/ingress.class: nginx + # Only use below if tls.force=true + # nginx.ingress.kubernetes.io/backend-protocol: HTTPS + # Note: Hosts and paths are of type array + hosts: + - host: portainer.geesink.org + paths: + - path: "/" + tls: + - hosts: + - portainer.geesink.org + secretName: portainer-cert-prod + +resources: {} + +persistence: + enabled: true + size: "10Gi" + annotations: {} + storageClass: + existingClaim: diff --git a/portainer/values.yaml.old b/portainer/values.yaml.old new file mode 100644 index 0000000..1f1620f --- /dev/null +++ b/portainer/values.yaml.old @@ -0,0 +1,15 @@ +USER-SUPPLIED VALUES: +enterpriseEdition: + enabled: true +ingress: + annotations: + kubernetes.io/ingress.class: haproxy + enabled: true + hosts: + - host: portainer.geesink.org + paths: + - path: '"/"' +service: + type: ClusterIP +tls: + force: true diff --git a/portainer/values2.yaml b/portainer/values2.yaml new file mode 100644 index 0000000..1f1620f --- /dev/null +++ b/portainer/values2.yaml @@ -0,0 +1,15 @@ +USER-SUPPLIED VALUES: +enterpriseEdition: + enabled: true +ingress: + annotations: + kubernetes.io/ingress.class: haproxy + enabled: true + hosts: + - host: portainer.geesink.org + paths: + - path: '"/"' +service: + type: ClusterIP +tls: + force: true