openstack-helm/ceph/templates/job-namespace-client-key-cleaner.yaml
portdirect dc105fdcfa CephFS: support for OSH
This PS adds support for CephFS in OSH.

Change-Id: I54d5302b89f04cc30f151c8db59f476f02be5652
2018-01-09 15:41:45 -05:00

102 lines
3.4 KiB
YAML

{{/*
Copyright 2017 The Openstack-Helm Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/}}
{{- if .Values.manifests.job_namespace_client_key_cleaner }}
{{- $envAll := . }}
{{- if .Values.deployment.client_secrets }}
{{- $dependencies := .Values.dependencies.namespace_client_key_cleaner }}
{{- $randStringSuffix := randAlphaNum 5 | lower }}
{{- $serviceAccountName := print "ceph-namespace-client-key-cleaner-" $randStringSuffix }}
{{ tuple $envAll $dependencies $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }}
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
name: {{ $serviceAccountName }}
annotations:
"helm.sh/hook": pre-delete
rules:
- apiGroups:
- ""
resources:
- secrets
verbs:
- get
- list
- delete
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
name: {{ $serviceAccountName }}
annotations:
"helm.sh/hook": pre-delete
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ $serviceAccountName }}
subjects:
- kind: ServiceAccount
name: {{ $serviceAccountName }}
namespace: {{ $envAll.Release.Namespace }}
---
apiVersion: batch/v1
kind: Job
metadata:
name: ceph-namespace-client-key-cleaner-{{ $randStringSuffix }}
annotations:
"helm.sh/hook": pre-delete
spec:
template:
metadata:
labels:
{{ tuple $envAll "ceph" "client-key-cleaner" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
spec:
serviceAccountName: {{ $serviceAccountName }}
restartPolicy: OnFailure
nodeSelector:
{{ $envAll.Values.labels.jobs.node_selector_key }}: {{ $envAll.Values.labels.jobs.node_selector_value }}
initContainers:
{{ tuple $envAll $dependencies list | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }}
containers:
- name: ceph-namespace-client-keys-cleaner
image: {{ .Values.images.tags.ceph_config_helper }}
imagePullPolicy: {{ .Values.images.pull_policy }}
{{ tuple $envAll $envAll.Values.pod.resources.jobs.secret_provisioning | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
env:
- name: DEPLOYMENT_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: PVC_CEPH_RBD_STORAGECLASS_USER_SECRET_NAME
value: {{ .Values.storageclass.rbd.user_secret_name }}
command:
- /opt/ceph/ceph-namespace-client-key-cleaner.sh
volumeMounts:
- name: ceph-bin
mountPath: /opt/ceph/ceph-namespace-client-key-cleaner.sh
subPath: ceph-namespace-client-key-cleaner.sh
readOnly: true
volumes:
- name: ceph-bin
configMap:
name: ceph-bin-clients
defaultMode: 0555
{{- end }}
{{- end }}