diff --git a/.github/workflows/build-publish-mcr.yml b/.github/workflows/build-publish-mcr.yml index b5c3252ba..c4ebf9c0e 100644 --- a/.github/workflows/build-publish-mcr.yml +++ b/.github/workflows/build-publish-mcr.yml @@ -8,6 +8,10 @@ on: releaseTag: description: 'Release tag to publish images, defaults to the latest one' type: string + arcExtensionVersion: + description: 'Release version of the Arc extension.' + type: string + required: true permissions: id-token: write @@ -16,12 +20,14 @@ permissions: env: # `public` indicates images to MCR wil be publicly available, and will be removed in the final MCR images REGISTRY_REPO: public/aks/fleet + ARC_REGISTRY_REPO: public/microsoft.fleetmember jobs: prepare-variables: runs-on: ubuntu-latest outputs: release_tag: ${{ steps.vars.outputs.release_tag }} + fleet_networking_version: ${{ steps.vars.outputs.fleet_networking_version }} steps: - uses: actions/checkout@v4 with: @@ -37,6 +43,12 @@ jobs: fi echo "release_tag=$RELEASE_TAG" >> $GITHUB_OUTPUT + # Fetch the latest fleet-networking version + # NOTE: The fleet-networking image must be cut and pushed to MCR first before retrieving this version + FLEET_NETWORKING_VERSION="${FLEET_NETWORKING_VERSION:-$(curl "https://api.github.com/repos/Azure/fleet-networking/tags" | jq -r '.[0].name')}" + echo "fleet_networking_version=$FLEET_NETWORKING_VERSION" >> $GITHUB_OUTPUT + echo "Using Fleet Networking version: $FLEET_NETWORKING_VERSION" + # NOTE: As exporting a variable from a secret is not possible, the shared variable registry obtained # from AZURE_REGISTRY secret is not exported from here. @@ -76,3 +88,18 @@ jobs: env: CRD_INSTALLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }} REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}} + # Build Arc Extension for member clusters + # Arc-connected clusters can join fleets as member clusters through an Arc Extension. + # An Arc Extension is a packaged Helm chart that gets deployed to Arc clusters. + # This step packages both the fleet member agent and networking agents into a single + # Helm chart for Arc deployment, since Arc Extensions require all components to be bundled together. + - name: Build and publish ARC member cluster agents helm chart + run: | + make helm-package-arc-member-cluster-agents + env: + ARC_MEMBER_AGENT_HELMCHART_VERSION: ${{ inputs.arcExtensionVersion }} + MEMBER_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }} + REFRESH_TOKEN_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }} + MCS_CONTROLLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.fleet_networking_version }} + MEMBER_NET_CONTROLLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.fleet_networking_version }} + REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.ARC_REGISTRY_REPO}} diff --git a/Makefile b/Makefile index ff4ade2e9..ce0320121 100644 --- a/Makefile +++ b/Makefile @@ -12,6 +12,7 @@ HUB_AGENT_IMAGE_NAME ?= hub-agent MEMBER_AGENT_IMAGE_NAME ?= member-agent REFRESH_TOKEN_IMAGE_NAME ?= refresh-token CRD_INSTALLER_IMAGE_NAME ?= crd-installer +ARC_MEMBER_AGENT_HELMCHART_NAME = arc-member-cluster-agents-helm-chart KUBECONFIG ?= $(HOME)/.kube/config HUB_SERVER_URL ?= https://172.19.0.2:6443 @@ -336,6 +337,15 @@ docker-build-crd-installer: docker-buildx-builder --pull \ --tag $(REGISTRY)/$(CRD_INSTALLER_IMAGE_NAME):$(CRD_INSTALLER_IMAGE_VERSION) . +# Fleet Agents and Networking Agents are packaged and pushed to MCR for Arc Extension. +.PHONY: helm-package-arc-member-cluster-agents +helm-package-arc-member-cluster-agents: + envsubst < charts/member-agent-arc/values.yaml > charts/member-agent-arc/values.yaml.tmp && \ + mv charts/member-agent-arc/values.yaml.tmp charts/member-agent-arc/values.yaml && \ + helm package charts/member-agent-arc/ --version $(ARC_MEMBER_AGENT_HELMCHART_VERSION) + + helm push $(ARC_MEMBER_AGENT_HELMCHART_NAME)-$(ARC_MEMBER_AGENT_HELMCHART_VERSION).tgz oci://$(REGISTRY) + ## ----------------------------------- ## Cleanup ## ----------------------------------- diff --git a/charts/member-agent-arc/.gitignore b/charts/member-agent-arc/.gitignore new file mode 100644 index 000000000..9e30eb9b7 --- /dev/null +++ b/charts/member-agent-arc/.gitignore @@ -0,0 +1 @@ +*.tgz \ No newline at end of file diff --git a/charts/member-agent-arc/.helmignore b/charts/member-agent-arc/.helmignore new file mode 100644 index 000000000..0e8a0eb36 --- /dev/null +++ b/charts/member-agent-arc/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/member-agent-arc/Chart.yaml b/charts/member-agent-arc/Chart.yaml new file mode 100644 index 000000000..b79a481c9 --- /dev/null +++ b/charts/member-agent-arc/Chart.yaml @@ -0,0 +1,24 @@ +apiVersion: v2 +name: arc-member-cluster-agents-helm-chart +description: A Helm chart for Kubernetes + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.1.0 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +# It is recommended to use it with quotes. +appVersion: "1.16.0" diff --git a/charts/member-agent-arc/templates/_helpers.tpl b/charts/member-agent-arc/templates/_helpers.tpl new file mode 100644 index 000000000..38088dee5 --- /dev/null +++ b/charts/member-agent-arc/templates/_helpers.tpl @@ -0,0 +1,62 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "fleet-member-agent.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "fleet-member-agent.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "fleet-member-agent.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "fleet-member-agent.labels" -}} +helm.sh/chart: {{ include "fleet-member-agent.chart" . }} +{{ include "fleet-member-agent.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "fleet-member-agent.selectorLabels" -}} +app.kubernetes.io/name: {{ include "fleet-member-agent.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "fleet-member-agent.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "fleet-member-agent.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/charts/member-agent-arc/templates/azure-proxy-secrets.yaml b/charts/member-agent-arc/templates/azure-proxy-secrets.yaml new file mode 100644 index 000000000..3c56bb741 --- /dev/null +++ b/charts/member-agent-arc/templates/azure-proxy-secrets.yaml @@ -0,0 +1,10 @@ +{{- if and .Values.Azure.proxySettings.isProxyEnabled .Values.Azure.proxySettings.proxyCert }} +apiVersion: v1 +kind: Secret +metadata: + name: azure-proxy-cert + namespace: fleet-system +type: Opaque +data: + proxy-cert.crt: {{ .Values.Azure.proxySettings.proxyCert | b64enc | quote }} +{{- end }} diff --git a/charts/member-agent-arc/templates/crds/appliedworks.yaml b/charts/member-agent-arc/templates/crds/appliedworks.yaml new file mode 100644 index 000000000..e67422a1e --- /dev/null +++ b/charts/member-agent-arc/templates/crds/appliedworks.yaml @@ -0,0 +1,130 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.11.4 + labels: +{{- if .Values.legacyAddonDelivery }} + addonmanager.kubernetes.io/mode: Reconcile +{{- end }} + kubernetes.azure.com/managedby: fleet + name: appliedworks.placement.kubernetes-fleet.io +spec: + group: placement.kubernetes-fleet.io + names: + categories: + - fleet + - fleet-placement + kind: AppliedWork + listKind: AppliedWorkList + plural: appliedworks + singular: appliedwork + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + spec: + properties: + workName: + type: string + workNamespace: + type: string + required: + - workName + - workNamespace + type: object + status: + properties: + appliedResources: + items: + properties: + group: + type: string + kind: + type: string + name: + type: string + namespace: + type: string + ordinal: + type: integer + resource: + type: string + uid: + type: string + version: + type: string + required: + - ordinal + type: object + type: array + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - name: v1beta1 + schema: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + spec: + properties: + workName: + type: string + workNamespace: + type: string + required: + - workName + - workNamespace + type: object + status: + properties: + appliedResources: + items: + properties: + group: + type: string + kind: + type: string + name: + type: string + namespace: + type: string + ordinal: + type: integer + resource: + type: string + uid: + type: string + version: + type: string + required: + - ordinal + type: object + type: array + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/charts/member-agent-arc/templates/crds/networking.yaml b/charts/member-agent-arc/templates/crds/networking.yaml new file mode 100644 index 000000000..44fcd28e1 --- /dev/null +++ b/charts/member-agent-arc/templates/crds/networking.yaml @@ -0,0 +1,1571 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.7.0 + creationTimestamp: null + name: endpointsliceexports.networking.fleet.azure.com + labels: +{{- if .Values.legacyAddonDelivery }} + addonmanager.kubernetes.io/mode: Reconcile +{{- end }} + kubernetes.azure.com/managedby: fleet +spec: + group: networking.fleet.azure.com + names: + categories: + - fleet-networking + kind: EndpointSliceExport + listKind: EndpointSliceExportList + plural: endpointsliceexports + singular: endpointsliceexport + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + spec: + properties: + addressType: + default: IPv4 + enum: + - IPv4 + type: string + endpointSliceReference: + properties: + apiVersion: + type: string + clusterId: + type: string + exportedSince: + format: date-time + type: string + generation: + format: int64 + type: integer + kind: + type: string + name: + type: string + namespace: + type: string + namespacedName: + type: string + resourceVersion: + type: string + uid: + type: string + required: + - clusterId + - generation + - kind + - name + - namespace + - namespacedName + - resourceVersion + - uid + type: object + x-kubernetes-map-type: atomic + endpoints: + items: + properties: + addresses: + items: + type: string + type: array + required: + - addresses + type: object + type: array + x-kubernetes-list-type: atomic + ownerServiceReference: + properties: + name: + type: string + namespace: + type: string + namespacedName: + type: string + required: + - name + - namespace + - namespacedName + type: object + ports: + items: + properties: + appProtocol: + type: string + name: + type: string + port: + format: int32 + type: integer + protocol: + default: TCP + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + required: + - addressType + - endpointSliceReference + - endpoints + - ownerServiceReference + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.7.0 + creationTimestamp: null + name: endpointsliceimports.networking.fleet.azure.com + labels: +{{- if .Values.legacyAddonDelivery }} + addonmanager.kubernetes.io/mode: Reconcile +{{- end }} + kubernetes.azure.com/managedby: fleet +spec: + group: networking.fleet.azure.com + names: + categories: + - fleet-networking + kind: EndpointSliceImport + listKind: EndpointSliceImportList + plural: endpointsliceimports + singular: endpointsliceimport + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + spec: + properties: + addressType: + default: IPv4 + enum: + - IPv4 + type: string + endpointSliceReference: + properties: + apiVersion: + type: string + clusterId: + type: string + exportedSince: + format: date-time + type: string + generation: + format: int64 + type: integer + kind: + type: string + name: + type: string + namespace: + type: string + namespacedName: + type: string + resourceVersion: + type: string + uid: + type: string + required: + - clusterId + - generation + - kind + - name + - namespace + - namespacedName + - resourceVersion + - uid + type: object + x-kubernetes-map-type: atomic + endpoints: + items: + properties: + addresses: + items: + type: string + type: array + required: + - addresses + type: object + type: array + x-kubernetes-list-type: atomic + ownerServiceReference: + properties: + name: + type: string + namespace: + type: string + namespacedName: + type: string + required: + - name + - namespace + - namespacedName + type: object + ports: + items: + properties: + appProtocol: + type: string + name: + type: string + port: + format: int32 + type: integer + protocol: + default: TCP + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + required: + - addressType + - endpointSliceReference + - endpoints + - ownerServiceReference + type: object + required: + - spec + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.7.0 + creationTimestamp: null + name: internalserviceexports.networking.fleet.azure.com + labels: +{{- if .Values.legacyAddonDelivery }} + addonmanager.kubernetes.io/mode: Reconcile +{{- end }} + kubernetes.azure.com/managedby: fleet +spec: + group: networking.fleet.azure.com + names: + categories: + - fleet-networking + kind: InternalServiceExport + listKind: InternalServiceExportList + plural: internalserviceexports + shortNames: + - internalsvcexport + singular: internalserviceexport + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + spec: + properties: + isDNSLabelConfigured: + type: boolean + isInternalLoadBalancer: + type: boolean + ports: + items: + properties: + appProtocol: + type: string + name: + type: string + port: + format: int32 + maximum: 65535 + minimum: 1 + type: integer + protocol: + default: TCP + enum: + - TCP + - UDP + - SCTP + type: string + targetPort: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-type: atomic + publicIPResourceID: + type: string + serviceReference: + properties: + apiVersion: + type: string + clusterId: + type: string + exportedSince: + format: date-time + type: string + generation: + format: int64 + type: integer + kind: + type: string + name: + type: string + namespace: + type: string + namespacedName: + type: string + resourceVersion: + type: string + uid: + type: string + required: + - clusterId + - generation + - kind + - name + - namespace + - namespacedName + - resourceVersion + - uid + type: object + x-kubernetes-map-type: atomic + type: + type: string + weight: + format: int64 + type: integer + required: + - ports + - serviceReference + type: object + status: + properties: + conditions: + items: + properties: + lastTransitionTime: + format: date-time + type: string + message: + maxLength: 32768 + type: string + observedGeneration: + format: int64 + minimum: 0 + type: integer + reason: + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + enum: + - "True" + - "False" + - Unknown + type: string + type: + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.7.0 + creationTimestamp: null + name: internalserviceimports.networking.fleet.azure.com + labels: +{{- if .Values.legacyAddonDelivery }} + addonmanager.kubernetes.io/mode: Reconcile +{{- end }} + kubernetes.azure.com/managedby: fleet +spec: + group: networking.fleet.azure.com + names: + categories: + - fleet-networking + kind: InternalServiceImport + listKind: InternalServiceImportList + plural: internalserviceimports + shortNames: + - internalsvcimport + singular: internalserviceimport + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + spec: + properties: + serviceImportReference: + properties: + apiVersion: + type: string + clusterId: + type: string + exportedSince: + format: date-time + type: string + generation: + format: int64 + type: integer + kind: + type: string + name: + type: string + namespace: + type: string + namespacedName: + type: string + resourceVersion: + type: string + uid: + type: string + required: + - clusterId + - generation + - kind + - name + - namespace + - namespacedName + - resourceVersion + - uid + type: object + x-kubernetes-map-type: atomic + required: + - serviceImportReference + type: object + status: + properties: + clusters: + items: + properties: + cluster: + type: string + required: + - cluster + type: object + type: array + x-kubernetes-list-map-keys: + - cluster + x-kubernetes-list-type: map + ips: + items: + type: string + maxItems: 1 + type: array + ports: + items: + properties: + appProtocol: + type: string + name: + type: string + port: + format: int32 + maximum: 65535 + minimum: 1 + type: integer + protocol: + default: TCP + enum: + - TCP + - UDP + - SCTP + type: string + targetPort: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-type: atomic + sessionAffinity: + type: string + sessionAffinityConfig: + properties: + clientIP: + properties: + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: + enum: + - ClusterSetIP + - Headless + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.7.0 + creationTimestamp: null + name: multiclusterservices.networking.fleet.azure.com + labels: +{{- if .Values.legacyAddonDelivery }} + addonmanager.kubernetes.io/mode: Reconcile +{{- end }} + kubernetes.azure.com/managedby: fleet +spec: + group: networking.fleet.azure.com + names: + categories: + - fleet-networking + kind: MultiClusterService + listKind: MultiClusterServiceList + plural: multiclusterservices + shortNames: + - mcs + singular: multiclusterservice + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.serviceImport.name + name: Service-Import + type: string + - jsonPath: .status.loadBalancer.ingress[0].ip + name: External-IP + type: string + - jsonPath: .status.conditions[?(@.type=='Valid')].status + name: Is-Valid + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + spec: + properties: + serviceImport: + properties: + name: + maxLength: 63 + pattern: ^([a-z]([-a-z0-9]*[a-z0-9])?)$ + type: string + required: + - name + type: object + type: object + status: + properties: + conditions: + items: + properties: + lastTransitionTime: + format: date-time + type: string + message: + maxLength: 32768 + type: string + observedGeneration: + format: int64 + minimum: 0 + type: integer + reason: + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + enum: + - "True" + - "False" + - Unknown + type: string + type: + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + loadBalancer: + properties: + ingress: + items: + properties: + hostname: + type: string + ip: + type: string + ipMode: + type: string + ports: + items: + properties: + error: + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + port: + format: int32 + type: integer + protocol: + default: TCP + type: string + required: + - error + - port + - protocol + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: object + required: + - spec + type: object + x-kubernetes-validations: + - message: metadata.name max length is 63 + rule: size(self.metadata.name) < 64 + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.7.0 + creationTimestamp: null + name: serviceexports.networking.fleet.azure.com + labels: +{{- if .Values.legacyAddonDelivery }} + addonmanager.kubernetes.io/mode: Reconcile +{{- end }} + kubernetes.azure.com/managedby: fleet +spec: + group: networking.fleet.azure.com + names: + categories: + - fleet-networking + kind: ServiceExport + listKind: ServiceExportList + plural: serviceexports + shortNames: + - svcexport + singular: serviceexport + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=='Valid')].status + name: Is-Valid + type: string + - jsonPath: .status.conditions[?(@.type=='Conflict')].status + name: Is-Conflicted + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + status: + properties: + conditions: + items: + properties: + lastTransitionTime: + format: date-time + type: string + message: + maxLength: 32768 + type: string + observedGeneration: + format: int64 + minimum: 0 + type: integer + reason: + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + enum: + - "True" + - "False" + - Unknown + type: string + type: + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + type: object + type: object + x-kubernetes-validations: + - message: metadata.name max length is 63 + rule: size(self.metadata.name) < 64 + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.7.0 + creationTimestamp: null + name: serviceimports.networking.fleet.azure.com + labels: +{{- if .Values.legacyAddonDelivery }} + addonmanager.kubernetes.io/mode: Reconcile +{{- end }} + kubernetes.azure.com/managedby: fleet +spec: + group: networking.fleet.azure.com + names: + categories: + - fleet-networking + kind: ServiceImport + listKind: ServiceImportList + plural: serviceimports + shortNames: + - svcimport + singular: serviceimport + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + status: + properties: + clusters: + items: + properties: + cluster: + type: string + required: + - cluster + type: object + type: array + x-kubernetes-list-map-keys: + - cluster + x-kubernetes-list-type: map + ips: + items: + type: string + maxItems: 1 + type: array + ports: + items: + properties: + appProtocol: + type: string + name: + type: string + port: + format: int32 + maximum: 65535 + minimum: 1 + type: integer + protocol: + default: TCP + enum: + - TCP + - UDP + - SCTP + type: string + targetPort: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-type: atomic + sessionAffinity: + type: string + sessionAffinityConfig: + properties: + clientIP: + properties: + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: + enum: + - ClusterSetIP + - Headless + type: string + type: object + type: object + x-kubernetes-validations: + - message: metadata.name max length is 63 + rule: size(self.metadata.name) < 64 + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: trafficmanagerbackends.networking.fleet.azure.com + labels: +{{- if .Values.legacyAddonDelivery }} + addonmanager.kubernetes.io/mode: Reconcile +{{- end }} + kubernetes.azure.com/managedby: fleet +spec: + group: networking.fleet.azure.com + names: + categories: + - fleet-networking + kind: TrafficManagerBackend + listKind: TrafficManagerBackendList + plural: trafficmanagerbackends + shortNames: + - tmb + singular: trafficmanagerbackend + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.profile.name + name: Profile + type: string + - jsonPath: .spec.backend.name + name: Backend + type: string + - jsonPath: .status.conditions[?(@.type=='Accepted')].status + name: Is-Accepted + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + spec: + properties: + backend: + properties: + name: + type: string + required: + - name + type: object + x-kubernetes-validations: + - message: spec.backend is immutable + rule: self == oldSelf + profile: + properties: + name: + type: string + required: + - name + type: object + x-kubernetes-validations: + - message: spec.profile is immutable + rule: self == oldSelf + weight: + default: 1 + format: int64 + maximum: 1000 + minimum: 0 + type: integer + required: + - backend + - profile + type: object + status: + properties: + conditions: + items: + properties: + lastTransitionTime: + format: date-time + type: string + message: + maxLength: 32768 + type: string + observedGeneration: + format: int64 + minimum: 0 + type: integer + reason: + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + enum: + - "True" + - "False" + - Unknown + type: string + type: + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + endpoints: + items: + properties: + from: + properties: + cluster: + type: string + weight: + format: int64 + type: integer + required: + - cluster + type: object + name: + type: string + resourceID: + type: string + target: + type: string + weight: + format: int64 + type: integer + required: + - name + type: object + type: array + type: object + required: + - spec + type: object + x-kubernetes-validations: + - message: metadata.name max length is 63 + rule: size(self.metadata.name) < 64 + served: false + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.profile.name + name: Profile + type: string + - jsonPath: .spec.backend.name + name: Backend + type: string + - jsonPath: .status.conditions[?(@.type=='Accepted')].status + name: Is-Accepted + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + spec: + properties: + backend: + properties: + name: + type: string + required: + - name + type: object + x-kubernetes-validations: + - message: spec.backend is immutable + rule: self == oldSelf + profile: + properties: + name: + type: string + required: + - name + type: object + x-kubernetes-validations: + - message: spec.profile is immutable + rule: self == oldSelf + weight: + default: 1 + format: int64 + maximum: 1000 + minimum: 0 + type: integer + required: + - backend + - profile + type: object + status: + properties: + conditions: + items: + properties: + lastTransitionTime: + format: date-time + type: string + message: + maxLength: 32768 + type: string + observedGeneration: + format: int64 + minimum: 0 + type: integer + reason: + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + enum: + - "True" + - "False" + - Unknown + type: string + type: + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + endpoints: + items: + properties: + from: + properties: + cluster: + type: string + weight: + format: int64 + type: integer + required: + - cluster + type: object + name: + type: string + resourceID: + type: string + target: + type: string + weight: + format: int64 + type: integer + required: + - name + type: object + type: array + type: object + required: + - spec + type: object + x-kubernetes-validations: + - message: metadata.name max length is 63 + rule: size(self.metadata.name) < 64 + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: trafficmanagerprofiles.networking.fleet.azure.com + labels: +{{- if .Values.legacyAddonDelivery }} + addonmanager.kubernetes.io/mode: Reconcile +{{- end }} + kubernetes.azure.com/managedby: fleet +spec: + group: networking.fleet.azure.com + names: + categories: + - fleet-networking + kind: TrafficManagerProfile + listKind: TrafficManagerProfileList + plural: trafficmanagerprofiles + shortNames: + - tmp + singular: trafficmanagerprofile + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.dnsName + name: DNS-Name + type: string + - jsonPath: .status.conditions[?(@.type=='Programmed')].status + name: Is-Programmed + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + spec: + properties: + monitorConfig: + properties: + customHeaders: + items: + properties: + name: + minLength: 1 + type: string + value: + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 8 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + intervalInSeconds: + default: 30 + enum: + - 10 + - 30 + format: int64 + type: integer + path: + default: / + type: string + port: + default: 80 + format: int64 + type: integer + protocol: + default: HTTP + enum: + - HTTP + - HTTPS + - TCP + type: string + timeoutInSeconds: + format: int64 + maximum: 10 + minimum: 5 + type: integer + toleratedNumberOfFailures: + default: 3 + format: int64 + maximum: 9 + minimum: 0 + type: integer + type: object + resourceGroup: + type: string + x-kubernetes-validations: + - message: resourceGroup is immutable + rule: self == oldSelf + required: + - resourceGroup + type: object + status: + properties: + conditions: + items: + properties: + lastTransitionTime: + format: date-time + type: string + message: + maxLength: 32768 + type: string + observedGeneration: + format: int64 + minimum: 0 + type: integer + reason: + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + enum: + - "True" + - "False" + - Unknown + type: string + type: + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + dnsName: + type: string + resourceID: + type: string + type: object + required: + - spec + type: object + x-kubernetes-validations: + - message: metadata.name max length is 63 + rule: size(self.metadata.name) < 64 + served: false + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .status.dnsName + name: DNS-Name + type: string + - jsonPath: .status.conditions[?(@.type=='Programmed')].status + name: Is-Programmed + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + properties: + apiVersion: + type: string + kind: + type: string + metadata: + type: object + spec: + properties: + monitorConfig: + properties: + customHeaders: + items: + properties: + name: + minLength: 1 + type: string + value: + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 8 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + intervalInSeconds: + default: 30 + enum: + - 10 + - 30 + format: int64 + type: integer + path: + default: / + type: string + port: + default: 80 + format: int64 + type: integer + protocol: + default: HTTP + enum: + - HTTP + - HTTPS + - TCP + type: string + timeoutInSeconds: + format: int64 + maximum: 10 + minimum: 5 + type: integer + toleratedNumberOfFailures: + default: 3 + format: int64 + maximum: 9 + minimum: 0 + type: integer + type: object + x-kubernetes-validations: + - message: timeoutInSeconds must be between 5 and 10 when intervalInSeconds + is 30 + rule: 'has(self.intervalInSeconds) && self.intervalInSeconds == + 30 ? (!has(self.timeoutInSeconds) || (self.timeoutInSeconds >= + 5 && self.timeoutInSeconds <= 10)) : true' + - message: timeoutInSeconds must be between 5 and 9 when intervalInSeconds + is 10 + rule: 'has(self.intervalInSeconds) && self.intervalInSeconds == + 10 ? (!has(self.timeoutInSeconds) || (self.timeoutInSeconds >= + 5 && self.timeoutInSeconds <= 9)) : true' + resourceGroup: + type: string + x-kubernetes-validations: + - message: resourceGroup is immutable + rule: self == oldSelf + required: + - resourceGroup + type: object + status: + properties: + conditions: + items: + properties: + lastTransitionTime: + format: date-time + type: string + message: + maxLength: 32768 + type: string + observedGeneration: + format: int64 + minimum: 0 + type: integer + reason: + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + enum: + - "True" + - "False" + - Unknown + type: string + type: + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + dnsName: + type: string + resourceID: + type: string + type: object + required: + - spec + type: object + x-kubernetes-validations: + - message: metadata.name max length is 63 + rule: size(self.metadata.name) < 64 + served: true + storage: true + subresources: + status: {} diff --git a/charts/member-agent-arc/templates/deployment.yaml b/charts/member-agent-arc/templates/deployment.yaml new file mode 100644 index 000000000..545789f5c --- /dev/null +++ b/charts/member-agent-arc/templates/deployment.yaml @@ -0,0 +1,370 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: fleet-member-agent + namespace: fleet-system + labels: + app.kubernetes.io/name: fleet-member-agent +spec: + selector: + matchLabels: + app.kubernetes.io/name: fleet-member-agent + template: + metadata: + labels: + app.kubernetes.io/name: fleet-member-agent + spec: + serviceAccountName: fleet-member-agent-sa + containers: + - name: addon-token-adapter + imagePullPolicy: IfNotPresent + env: + - name: TOKEN_NAMESPACE + value: "fleet-system" +{{- .Values.Azure.Identity.MSIAdapterYaml | nindent 10 }} + - name: refresh-token + image: "{{ .Values.refreshtoken.repository }}:{{ .Values.refreshtoken.tag }}" + imagePullPolicy: IfNotPresent + args: + - azure + - --clientid=any-client-id + - --scope={{ .Values.config.scope }} + resources: + limits: + cpu: 50m + memory: 128Mi + requests: + cpu: 1m + memory: 16Mi + securityContext: + capabilities: + drop: + - ALL + volumeMounts: + - name: provider-token + mountPath: /config + - name: fleet-member-agent + image: "{{ .Values.memberagent.repository }}:{{ .Values.memberagent.tag }}" + imagePullPolicy: IfNotPresent + args: + - --leader-elect=true + - --v={{ .Values.logVerbosity }} + - -add_dir_header + - --enable-v1alpha1-apis={{ .Values.enableV1Alpha1APIs }} + - --enable-v1beta1-apis={{ .Values.enableV1Beta1APIs }} + {{- if .Values.propertyProvider }} + - --property-provider={{ .Values.propertyProvider }} + {{- end }} + env: + - name: HUB_SERVER_URL + value: {{ .Values.config.hubURL | quote }} + - name: CONFIG_PATH + value: /config/token + - name: MEMBER_CLUSTER_NAME + value: {{ .Values.config.memberClusterName | quote }} + - name: HUB_CERTIFICATE_AUTHORITY + value: {{ .Values.config.hubCA | quote }} + {{- if .Values.Azure.proxySettings.isProxyEnabled }} + - name: HTTPS_PROXY + value: {{ .Values.Azure.proxySettings.httpProxy | quote }} + - name: NO_PROXY + value: {{ .Values.Azure.proxySettings.noProxy | quote }} + {{- end }} + {{- if and .Values.Azure.proxySettings.isProxyEnabled .Values.Azure.proxySettings.proxyCert }} + - name: SSL_CERT_FILE + value: /usr/local/share/ca-certificates/azure-proxy-cert.crt + {{- end }} + ports: + - containerPort: 8080 + name: hubmetrics + protocol: TCP + - containerPort: 8081 + name: hubhealthz + protocol: TCP + - containerPort: 8090 + name: membermetrics + protocol: TCP + - containerPort: 8091 + name: memberhealthz + protocol: TCP + livenessProbe: + httpGet: + path: /healthz + port: hubhealthz + readinessProbe: + httpGet: + path: /readyz + port: hubhealthz + resources: + limits: + cpu: 1 + memory: 2Gi + requests: + cpu: 10m + memory: 64Mi + securityContext: + capabilities: + drop: + - ALL + volumeMounts: + - name: provider-token + mountPath: /config + {{- if and .Values.Azure.proxySettings.isProxyEnabled .Values.Azure.proxySettings.proxyCert }} + - name: azure-proxy-cert-store + mountPath: /usr/local/share/ca-certificates/azure-proxy-cert.crt + subPath: azure-proxy-cert.crt + readOnly: true + {{- end }} + volumes: + - name: provider-token + emptyDir: { } + {{- if and .Values.Azure.proxySettings.isProxyEnabled .Values.Azure.proxySettings.proxyCert }} + - name: azure-proxy-cert-store + secret: + secretName: azure-proxy-cert + {{- end }} +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: fleet-mcs-controller-manager + namespace: fleet-system + labels: + app.kubernetes.io/name: fleet-mcs-controller-manager +spec: + selector: + matchLabels: + app.kubernetes.io/name: fleet-mcs-controller-manager + template: + metadata: + labels: + app.kubernetes.io/name: fleet-mcs-controller-manager + spec: + serviceAccountName: fleet-member-agent-sa + containers: + - name: addon-token-adapter + imagePullPolicy: IfNotPresent + env: + - name: TOKEN_NAMESPACE + value: "fleet-system" +{{- .Values.Azure.Identity.MSIAdapterYaml | nindent 10 }} + - name: refresh-token + image: "{{ .Values.refreshtoken.repository }}:{{ .Values.refreshtoken.tag }}" + imagePullPolicy: IfNotPresent + args: + - azure + - --clientid=any-client-id + - --scope={{ .Values.config.scope }} + resources: + limits: + cpu: 50m + memory: 128Mi + requests: + cpu: 1m + memory: 16Mi + securityContext: + capabilities: + drop: + - ALL + volumeMounts: + - name: provider-token + mountPath: /config + - name: fleet-mcs-controller-manager + image: "{{ .Values.mcscontrollermanager.repository }}:{{ .Values.mcscontrollermanager.tag }}" + imagePullPolicy: IfNotPresent + args: + - --v={{ .Values.logVerbosity }} + - --add_dir_header + - --enable-v1alpha1-apis={{ .Values.enableV1Alpha1APIs }} + - --enable-v1beta1-apis={{ .Values.enableV1Beta1APIs }} + securityContext: + capabilities: + drop: + - ALL + ports: + - containerPort: 8080 + name: hubmetrics + protocol: TCP + - containerPort: 8081 + name: hubhealthz + protocol: TCP + - containerPort: 8090 + name: membermetrics + protocol: TCP + - containerPort: 8091 + name: memberhealthz + protocol: TCP + livenessProbe: + httpGet: + path: /healthz + port: hubhealthz + readinessProbe: + httpGet: + path: /readyz + port: hubhealthz + resources: + limits: + cpu: 500m + memory: 1Gi + requests: + cpu: 5m + memory: 32Mi + env: + - name: HUB_SERVER_URL + value: {{ .Values.config.hubURL | quote }} + - name: CONFIG_PATH + value: /config/token + - name: MEMBER_CLUSTER_NAME + value: {{ .Values.config.memberClusterName | quote }} + - name: HUB_CERTIFICATE_AUTHORITY + value: {{ .Values.config.hubCA | quote }} + {{- if .Values.Azure.proxySettings.isProxyEnabled }} + - name: HTTPS_PROXY + value: {{ .Values.Azure.proxySettings.httpProxy | quote }} + - name: NO_PROXY + value: {{ .Values.Azure.proxySettings.noProxy | quote }} + {{- end }} + {{- if and .Values.Azure.proxySettings.isProxyEnabled .Values.Azure.proxySettings.proxyCert }} + - name: SSL_CERT_FILE + value: /usr/local/share/ca-certificates/azure-proxy-cert.crt + {{- end }} + volumeMounts: + - name: provider-token + mountPath: /config + {{- if and (or .Values.Azure.proxySettings.isCustomCert .Values.Azure.proxySettings.isProxyEnabled) (.Values.Azure.proxySettings.proxyCert) }} + - name: azure-proxy-cert-store + mountPath: /etc/ssl/certs/azure-proxy-cert.crt + subPath: azure-proxy-cert.crt + readOnly: true + {{- end }} + volumes: + - name: provider-token + emptyDir: { } + {{- if and .Values.Azure.proxySettings.isProxyEnabled .Values.Azure.proxySettings.proxyCert }} + - name: azure-proxy-cert-store + secret: + secretName: azure-proxy-cert + {{- end }} +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: fleet-member-net-controller-manager + namespace: fleet-system + labels: + app.kubernetes.io/name: fleet-member-net-controller-manager +spec: + selector: + matchLabels: + app.kubernetes.io/name: fleet-member-net-controller-manager + template: + metadata: + labels: + app.kubernetes.io/name: fleet-member-net-controller-manager + spec: + serviceAccountName: fleet-member-agent-sa + containers: + - name: addon-token-adapter + imagePullPolicy: IfNotPresent + env: + - name: TOKEN_NAMESPACE + value: "fleet-system" +{{- .Values.Azure.Identity.MSIAdapterYaml | nindent 10 }} + - name: refresh-token + image: "{{ .Values.refreshtoken.repository }}:{{ .Values.refreshtoken.tag }}" + imagePullPolicy: IfNotPresent + args: + - azure + - --clientid=any-client-id + - --scope={{ .Values.config.scope }} + resources: + limits: + cpu: 50m + memory: 128Mi + requests: + cpu: 1m + memory: 16Mi + securityContext: + capabilities: + drop: + - ALL + volumeMounts: + - name: provider-token + mountPath: /config + - name: fleet-member-net-controller-manager + image: "{{ .Values.membernetcontrollermanager.repository }}:{{ .Values.membernetcontrollermanager.tag }}" + imagePullPolicy: IfNotPresent + args: + - --v={{ .Values.logVerbosity }} + - --add_dir_header + - --enable-v1alpha1-apis={{ .Values.enableV1Alpha1APIs }} + - --enable-v1beta1-apis={{ .Values.enableV1Beta1APIs }} + - --enable-traffic-manager-feature={{ .Values.enableTrafficManagerFeature }} + ports: + - containerPort: 8080 + name: hubmetrics + protocol: TCP + - containerPort: 8081 + name: hubhealthz + protocol: TCP + - containerPort: 8090 + name: membermetrics + protocol: TCP + - containerPort: 8091 + name: memberhealthz + protocol: TCP + livenessProbe: + httpGet: + path: /healthz + port: hubhealthz + readinessProbe: + httpGet: + path: /readyz + port: hubhealthz + resources: + limits: + cpu: 500m + memory: 1Gi + requests: + cpu: 10m + memory: 64Mi + env: + - name: HUB_SERVER_URL + value: {{ .Values.config.hubURL | quote }} + - name: CONFIG_PATH + value: /config/token + - name: MEMBER_CLUSTER_NAME + value: {{ .Values.config.memberClusterName | quote }} + - name: HUB_CERTIFICATE_AUTHORITY + value: {{ .Values.config.hubCA | quote }} + {{- if .Values.Azure.proxySettings.isProxyEnabled }} + - name: HTTPS_PROXY + value: {{ .Values.Azure.proxySettings.httpProxy | quote }} + - name: NO_PROXY + value: {{ .Values.Azure.proxySettings.noProxy | quote }} + {{- end }} + {{- if and .Values.Azure.proxySettings.isProxyEnabled .Values.Azure.proxySettings.proxyCert }} + - name: SSL_CERT_FILE + value: /usr/local/share/ca-certificates/azure-proxy-cert.crt + {{- end }} + securityContext: + capabilities: + drop: + - ALL + volumeMounts: + - name: provider-token + mountPath: /config + {{- if and .Values.Azure.proxySettings.isProxyEnabled .Values.Azure.proxySettings.proxyCert }} + - name: azure-proxy-cert-store + mountPath: /etc/ssl/certs/azure-proxy-cert.crt + subPath: azure-proxy-cert.crt + readOnly: true + {{- end }} + volumes: + - name: provider-token + emptyDir: { } + {{- if and .Values.Azure.proxySettings.isProxyEnabled .Values.Azure.proxySettings.proxyCert }} + - name: azure-proxy-cert-store + secret: + secretName: azure-proxy-cert + {{- end }} diff --git a/charts/member-agent-arc/templates/rbac.yaml b/charts/member-agent-arc/templates/rbac.yaml new file mode 100644 index 000000000..0f78df527 --- /dev/null +++ b/charts/member-agent-arc/templates/rbac.yaml @@ -0,0 +1,23 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: fleet-member-agent-cluster-admin-binding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +subjects: + - kind: ServiceAccount + name: fleet-member-agent-sa + namespace: fleet-system +--- +apiVersion: clusterconfig.azure.com/v1beta1 +kind: AzureExtensionIdentity +metadata: + name: {{ .Values.Azure.Extension.Name }} + namespace: azure-arc # this must be azure-arc, do not change +spec: + serviceAccounts: # this would the service accounts that are mounted in the extension pods which require azure identity + - name: fleet-member-agent-sa + namespace: fleet-system + tokenNamespace: fleet-system # namespace where Arc extension would be deployed diff --git a/charts/member-agent-arc/templates/serviceaccount.yaml b/charts/member-agent-arc/templates/serviceaccount.yaml new file mode 100644 index 000000000..bbc3309a7 --- /dev/null +++ b/charts/member-agent-arc/templates/serviceaccount.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: fleet-member-agent-sa + namespace: fleet-system + labels: + {{- include "fleet-member-agent.labels" . | nindent 4 }} diff --git a/charts/member-agent-arc/values.yaml b/charts/member-agent-arc/values.yaml new file mode 100644 index 000000000..61833e4b5 --- /dev/null +++ b/charts/member-agent-arc/values.yaml @@ -0,0 +1,37 @@ +memberagent: + repository: mcr.microsoft.com/aks/fleet/member-agent + tag: "${MEMBER_AGENT_IMAGE_VERSION}" + +mcscontrollermanager: + repository: mcr.microsoft.com/aks/fleet/mcs-controller-manager + tag: "${MCS_CONTROLLER_IMAGE_VERSION}" + +membernetcontrollermanager: + repository: mcr.microsoft.com/aks/fleet/member-net-controller-manager + tag: "${MEMBER_NET_CONTROLLER_IMAGE_VERSION}" + +refreshtoken: + repository: mcr.microsoft.com/aks/fleet/refresh-token + tag: "${REFRESH_TOKEN_IMAGE_VERSION}" + +logVerbosity: 5 + +namespace: fleet-system + +config: + scope: "" + hubURL : "" + memberClusterName: "" + hubCA: "" + +enableV1Alpha1APIs: false +enableV1Beta1APIs: true +enableTrafficManagerFeature: false + +Azure: + proxySettings: + isProxyEnabled: "false" + httpProxy: "" + httpsProxy: "" + noProxy: "" + proxyCert: "" \ No newline at end of file