Browse Source

Add Sonobuoy chart

This adds a Sonobuoy chart that only runs the systemd-logs plugin[1]. The
Sonobuoy pod (tests) are executed as a `helm test`.

This chart must be installed under the heptio-sonobuoy namespace[2]. A node
with the label selector specified in values.yaml (labels.api) must exist
for the Sonobuoy pod to even be created.

Also add an experimental job to test Sonobuoy chart.

[1] https://github.com/heptio/sonobuoy-plugin-systemd-logs
[2] https://github.com/heptio/sonobuoy/issues/420

Change-Id: I613fab635b97a70ac20820e1ececde48952ac2da
Dustin Specker 6 months ago
parent
commit
f823544adb

+ 9
- 0
.zuul.yaml View File

@@ -27,6 +27,9 @@
27 27
               - ^.*\.rst$
28 28
               - ^doc/.*$
29 29
               - ^releasenotes/.*$
30
+    experimental:
31
+      jobs:
32
+        - openstack-helm-addons-sonobuoy
30 33
 
31 34
 - job:
32 35
     name: openstack-helm-addons-linter
@@ -51,3 +54,9 @@
51 54
     required-projects:
52 55
       - openstack/openstack-helm-infra
53 56
     nodeset: openstack-helm-ubuntu
57
+
58
+- job:
59
+    name: openstack-helm-addons-sonobuoy
60
+    parent: openstack-helm-multinode
61
+    nodeset: openstack-helm-ubuntu
62
+    run: tools/gate/playbooks/osh-addons-sonobuoy.yaml

+ 22
- 0
sonobuoy/Chart.yaml View File

@@ -0,0 +1,22 @@
1
+# Copyright 2017 The Openstack-Helm Authors.
2
+#
3
+# Licensed under the Apache License, Version 2.0 (the "License");
4
+# you may not use this file except in compliance with the License.
5
+# You may obtain a copy of the License at
6
+#
7
+#     http://www.apache.org/licenses/LICENSE-2.0
8
+#
9
+# Unless required by applicable law or agreed to in writing, software
10
+# distributed under the License is distributed on an "AS IS" BASIS,
11
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
+# See the License for the specific language governing permissions and
13
+# limitations under the License.
14
+
15
+apiVersion: v1
16
+description: OpenStack-Helm Sonobuoy
17
+name: sonobuoy
18
+version: 0.1.0
19
+sources:
20
+  - https://git.openstack.org/cgit/openstack/openstack-helm-addons
21
+maintainers:
22
+  - name: OpenStack-Helm Authors

+ 18
- 0
sonobuoy/requirements.yaml View File

@@ -0,0 +1,18 @@
1
+# Copyright 2017 The Openstack-Helm Authors.
2
+#
3
+# Licensed under the Apache License, Version 2.0 (the "License");
4
+# you may not use this file except in compliance with the License.
5
+# You may obtain a copy of the License at
6
+#
7
+#     http://www.apache.org/licenses/LICENSE-2.0
8
+#
9
+# Unless required by applicable law or agreed to in writing, software
10
+# distributed under the License is distributed on an "AS IS" BASIS,
11
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
+# See the License for the specific language governing permissions and
13
+# limitations under the License.
14
+
15
+dependencies:
16
+  - name: helm-toolkit
17
+    repository: http://localhost:8879/charts
18
+    version: 0.1.0

+ 21
- 0
sonobuoy/templates/bin/_run_master.sh.tpl View File

@@ -0,0 +1,21 @@
1
+#!/bin/bash
2
+
3
+{{/*
4
+Copyright 2017 The Openstack-Helm Authors.
5
+
6
+Licensed under the Apache License, Version 2.0 (the "License");
7
+you may not use this file except in compliance with the License.
8
+You may obtain a copy of the License at
9
+
10
+   http://www.apache.org/licenses/LICENSE-2.0
11
+
12
+Unless required by applicable law or agreed to in writing, software
13
+distributed under the License is distributed on an "AS IS" BASIS,
14
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15
+See the License for the specific language governing permissions and
16
+limitations under the License.
17
+*/}}
18
+
19
+set -xe
20
+
21
+/sonobuoy master --v 3 --logtostderr

+ 27
- 0
sonobuoy/templates/configmap-bin.yaml View File

@@ -0,0 +1,27 @@
1
+{{/*
2
+Copyright 2017 The Openstack-Helm Authors.
3
+
4
+Licensed under the Apache License, Version 2.0 (the "License");
5
+you may not use this file except in compliance with the License.
6
+You may obtain a copy of the License at
7
+
8
+   http://www.apache.org/licenses/LICENSE-2.0
9
+
10
+Unless required by applicable law or agreed to in writing, software
11
+distributed under the License is distributed on an "AS IS" BASIS,
12
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13
+See the License for the specific language governing permissions and
14
+limitations under the License.
15
+*/}}
16
+
17
+{{- if .Values.manifests.configmap_bin }}
18
+{{- $envAll := . }}
19
+---
20
+apiVersion: v1
21
+kind: ConfigMap
22
+metadata:
23
+  name: sonobuoy-bin
24
+data:
25
+  run_master.sh: |
26
+{{ tuple "bin/_run_master.sh.tpl" $envAll | include "helm-toolkit.utils.template" | indent 4 }}
27
+{{- end }}

+ 28
- 0
sonobuoy/templates/configmap-plugins.yaml View File

@@ -0,0 +1,28 @@
1
+{{/*
2
+Copyright 2017 The Openstack-Helm Authors.
3
+
4
+Licensed under the Apache License, Version 2.0 (the "License");
5
+you may not use this file except in compliance with the License.
6
+You may obtain a copy of the License at
7
+
8
+   http://www.apache.org/licenses/LICENSE-2.0
9
+
10
+Unless required by applicable law or agreed to in writing, software
11
+distributed under the License is distributed on an "AS IS" BASIS,
12
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13
+See the License for the specific language governing permissions and
14
+limitations under the License.
15
+*/}}
16
+
17
+{{- if .Values.manifests.configmap_plugins }}
18
+{{- $envAll := . }}
19
+---
20
+apiVersion: v1
21
+kind: ConfigMap
22
+metadata:
23
+  name: sonobuoy-plugins
24
+data:
25
+  {{ range .Values.conf.plugins }}
26
+{{- include "helm-toolkit.snippets.values_template_renderer" ( dict "envAll" $envAll "template" .data "key" .name ) | indent 4 }}
27
+  {{ end }}
28
+{{- end }}

+ 99
- 0
sonobuoy/templates/pod-api.yaml View File

@@ -0,0 +1,99 @@
1
+{{/*
2
+Copyright 2017 The Openstack-Helm Authors.
3
+
4
+Licensed under the Apache License, Version 2.0 (the "License");
5
+you may not use this file except in compliance with the License.
6
+You may obtain a copy of the License at
7
+
8
+   http://www.apache.org/licenses/LICENSE-2.0
9
+
10
+Unless required by applicable law or agreed to in writing, software
11
+distributed under the License is distributed on an "AS IS" BASIS,
12
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13
+See the License for the specific language governing permissions and
14
+limitations under the License.
15
+*/}}
16
+
17
+{{- if .Values.manifests.pod_api }}
18
+{{- $envAll := . }}
19
+
20
+{{- $serviceAccountName := "sonobuoy-serviceaccount" }}
21
+{{ tuple $envAll "sonobuoy" $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }}
22
+---
23
+apiVersion: rbac.authorization.k8s.io/v1
24
+kind: ClusterRole
25
+metadata:
26
+  name: {{ $serviceAccountName }}
27
+rules:
28
+- apiGroups:
29
+  - '*'
30
+  resources:
31
+  - '*'
32
+  verbs:
33
+  - '*'
34
+---
35
+apiVersion: rbac.authorization.k8s.io/v1
36
+kind: ClusterRoleBinding
37
+metadata:
38
+  name: {{ $serviceAccountName }}-heptio-sonobuoy
39
+roleRef:
40
+  apiGroup: rbac.authorization.k8s.io
41
+  kind: ClusterRole
42
+  name: {{ $serviceAccountName }}
43
+subjects:
44
+- kind: ServiceAccount
45
+  name: {{ $serviceAccountName }}
46
+  namespace: {{ $envAll.Release.Namespace }}
47
+---
48
+apiVersion: v1
49
+kind: Pod
50
+metadata:
51
+  labels:
52
+{{ tuple $envAll "sonobuoy" "sonobuoy" | include "helm-toolkit.snippets.kubernetes_metadata_labels"  | indent 4 }}
53
+    run: sonobuoy-master
54
+    tier: analysis
55
+  name: sonobuoy
56
+  annotations:
57
+    "helm.sh/hook": test-success
58
+spec:
59
+  nodeSelector:
60
+    {{ .Values.labels.api.node_selector_key }}: {{ .Values.labels.api.node_selector_value}}
61
+  containers:
62
+  - name: kube-sonobuoy
63
+    env:
64
+    - name: SONOBUOY_ADVERTISE_IP
65
+      valueFrom:
66
+        fieldRef:
67
+          fieldPath: status.podIP
68
+{{ tuple $envAll "sonobuoy_api" | include "helm-toolkit.snippets.image" | indent 4 }}
69
+    command:
70
+      - /run_master.sh
71
+    volumeMounts:
72
+    - mountPath: /etc/sonobuoy
73
+      name: sonobuoy-config-volume
74
+    - mountPath: /plugins.d
75
+      name: sonobuoy-plugins-volume
76
+    - mountPath: {{ .Values.conf.sonobuoy.ResultsDir }}
77
+      name: sonobuoy-output
78
+    - name: sonobuoy-bin
79
+      mountPath: /run_master.sh
80
+      subPath: run_master.sh
81
+      readOnly: true
82
+  restartPolicy: Never
83
+  serviceAccountName: {{ $serviceAccountName }}
84
+  volumes:
85
+  - name: sonobuoy-bin
86
+    configMap:
87
+      name: sonobuoy-bin
88
+      defaultMode: 0555
89
+  - secret:
90
+      secretName: sonobuoy-etc
91
+      defaultMode: 0444
92
+    name: sonobuoy-config-volume
93
+  - configMap:
94
+      name: sonobuoy-plugins
95
+      defaultMode: 0444
96
+    name: sonobuoy-plugins-volume
97
+  - emptyDir: {}
98
+    name: sonobuoy-output
99
+{{- end }}

+ 30
- 0
sonobuoy/templates/secret-etc.yaml View File

@@ -0,0 +1,30 @@
1
+{{/*
2
+Copyright 2017 The Openstack-Helm Authors.
3
+
4
+Licensed under the Apache License, Version 2.0 (the "License");
5
+you may not use this file except in compliance with the License.
6
+You may obtain a copy of the License at
7
+
8
+   http://www.apache.org/licenses/LICENSE-2.0
9
+
10
+Unless required by applicable law or agreed to in writing, software
11
+distributed under the License is distributed on an "AS IS" BASIS,
12
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13
+See the License for the specific language governing permissions and
14
+limitations under the License.
15
+*/}}
16
+
17
+{{- if .Values.manifests.secret_etc }}
18
+{{- if empty .Values.conf.WorkerImage -}}
19
+{{- $_ := set .Values.conf "WorkerImage" .Values.images.tags.sonobuoy_api -}}
20
+{{- end -}}
21
+---
22
+apiVersion: v1
23
+kind: Secret
24
+metadata:
25
+  name: sonobuoy-etc
26
+type: Opaque
27
+data:
28
+  config.json: |
29
+{{ .Values.conf.sonobuoy | toJson | b64enc | indent 4}}
30
+{{- end }}

+ 100
- 0
sonobuoy/values.yaml View File

@@ -0,0 +1,100 @@
1
+# Copyright 2017 The Openstack-Helm Authors.
2
+#
3
+# Licensed under the Apache License, Version 2.0 (the "License");
4
+# you may not use this file except in compliance with the License.
5
+# You may obtain a copy of the License at
6
+#
7
+#     http://www.apache.org/licenses/LICENSE-2.0
8
+#
9
+# Unless required by applicable law or agreed to in writing, software
10
+# distributed under the License is distributed on an "AS IS" BASIS,
11
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
+# See the License for the specific language governing permissions and
13
+# limitations under the License.
14
+
15
+# Default values for Sonobuoy.
16
+# This is a YAML-formatted file.
17
+# Declare name/value pairs to be passed into your templates.
18
+# name: value
19
+
20
+labels:
21
+  api:
22
+    node_selector_key: openstack-control-plane
23
+    node_selector_value: enabled
24
+
25
+images:
26
+  tags:
27
+    sonobuoy_api: gcr.io/heptio-images/sonobuoy:v0.11.4
28
+    systemd_logs: gcr.io/heptio-images/sonobuoy-plugin-systemd-logs:v0.1
29
+  pull_policy: IfNotPresent
30
+  local_registry:
31
+    active: false
32
+    exclude: []
33
+
34
+conf:
35
+  sonobuoy:
36
+    Description: "sonobuoy run for scanner.heptio.com"
37
+    Version: v0.11.4
38
+    ResultsDir: /tmp/resultshost
39
+    Resources:
40
+      - Nodes
41
+      - ServerVersion
42
+    Filters:
43
+      Namespaces: ""
44
+      LabelSelector: ""
45
+    Server:
46
+      bindaddress: 0.0.0.0
47
+      bindport: 8080
48
+      advertiseaddress: ""
49
+      timeoutseconds: 8000
50
+    Plugins:
51
+      - name: systemd-logs
52
+    Limits:
53
+      PodLogs:
54
+        SizeLimitBytes: 10000
55
+    # NOTE: the WorkerImage should not be defined and is set in sonobuoy-etc
56
+    WorkerImage: null
57
+    ImagePullPolicy: IfNotPresent
58
+  plugins:
59
+    - name: systemd_logs.yaml
60
+      data: |
61
+        sonobuoy-config:
62
+          driver: DaemonSet
63
+          plugin-name: systemd-logs
64
+          result-type: systemd_logs
65
+        spec:
66
+          command:
67
+          - sh
68
+          - -c
69
+          - /get_systemd_logs.sh && sleep 3600
70
+          env:
71
+          - name: NODE_NAME
72
+            valueFrom:
73
+              fieldRef:
74
+                fieldPath: spec.nodeName
75
+          - name: RESULTS_DIR
76
+            value: /tmp/results
77
+          - name: CHROOT_DIR
78
+            value: /node
79
+          image: {{ .Values.images.tags.systemd_logs }}
80
+          imagePullPolicy: Always
81
+          name: sonobuoy-systemd-logs-config
82
+          securityContext:
83
+            privileged: true
84
+          volumeMounts:
85
+          - mountPath: /tmp/results
86
+            name: results
87
+            readOnly: false
88
+          - mountPath: /node
89
+            name: root
90
+            readOnly: false
91
+
92
+dependencies:
93
+  dynamic: {}
94
+  static: {}
95
+
96
+manifests:
97
+  configmap_bin: true
98
+  configmap_plugins: true
99
+  pod_api: true
100
+  secret_etc: true

+ 8
- 0
tools/gate/playbooks/osh-addons-sonobuoy.yaml View File

@@ -0,0 +1,8 @@
1
+- hosts: primary
2
+  tasks:
3
+    - name: Install and Test Sonobuoy Chart
4
+      shell: |
5
+        set -xe;
6
+        ./tools/gate/scripts/sonobuoy.sh
7
+      args:
8
+        chdir: "{{ zuul.project.src_dir }}"

+ 21
- 0
tools/gate/scripts/sonobuoy.sh View File

@@ -0,0 +1,21 @@
1
+#!/bin/bash
2
+
3
+# Copyright 2017 The Openstack-Helm Authors.
4
+#
5
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
6
+#    not use this file except in compliance with the License. You may obtain
7
+#    a copy of the License at
8
+#
9
+#         http://www.apache.org/licenses/LICENSE-2.0
10
+#
11
+#    Unless required by applicable law or agreed to in writing, software
12
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14
+#    License for the specific language governing permissions and limitations
15
+#    under the License.
16
+
17
+set -xe
18
+
19
+helm dependency update sonobuoy
20
+helm install sonobuoy --namespace=heptio-sonobuoy --name=sonobuoy
21
+helm test sonobuoy

Loading…
Cancel
Save