Skip to content

Commit 50065ec

Browse files
csantanaprcsantanapr
committed
add teams chart
Signed-off-by: Carlos Santana <csantana23@gmail.com>
1 parent d61bb76 commit 50065ec

File tree

16 files changed

+925
-0
lines changed

16 files changed

+925
-0
lines changed

‎charts/teams/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎charts/teams/Chart.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: v2
2+
name: team
3+
description: A Helm Chart to bootstrap a Namespace in a Multi-Tenancy setup
4+
version: 1.0.0
5+
type: application
6+

‎charts/teams/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# team
2+
3+
A Helm Chart to bootstrap a Namespace in a Multi-Tenancy setup

‎charts/teams/templates/_helpers.tpl‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "team.name" -}}
5+
{{- default .Chart.Name .Values.name | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "team.fullname" -}}
14+
{{- if .Values.name }}
15+
{{- .Values.name | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "team.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common Helm and Kubernetes labels
35+
*/}}
36+
{{- define "team.labels" -}}
37+
helm.sh/chart: {{ include "team.chart" . }}
38+
app.kubernetes.io/name: {{ include "team.name" . }}
39+
app.kubernetes.io/instance: {{ .Release.Name }}
40+
{{- if .Chart.AppVersion }}
41+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
42+
{{- end }}
43+
app.kubernetes.io/managed-by: {{ .Release.Service }}
44+
{{- if .Values.labels }}
45+
{{ toYaml .Values.labels }}
46+
{{- end }}
47+
{{- end }}
48+
49+
{{/*
50+
Common Helm and Kubernetes labels
51+
*/}}
52+
{{- define "team.annotations" -}}
53+
helm.sh/chart: {{ include "team.chart" . }}
54+
{{- if .Values.annotations }}
55+
{{ toYaml .Values.annotations }}
56+
{{- end }}
57+
{{- end }}
58+
59+
60+
{{/*
61+
Create the name of the NetworkPolicy to deny all outgoing traffic
62+
*/}}
63+
{{- define "team.networkPolicy.egress.deny.all.name" }}
64+
{{- printf "%s-%s" ((include "team.fullname" .) | trunc 47 | trimSuffix "-") "egress-deny-all" }}
65+
{{- end }}
66+
67+
{{/*
68+
Create the name of the NetworkPolicy to allow outgoing traffic to the Kubernetes DNS
69+
*/}}
70+
{{- define "team.networkPolicy.egress.allow.dns.name" }}
71+
{{- printf "%s-%s" ((include "team.fullname" .) | trunc 47 | trimSuffix "-") "egress-allow-dns" }}
72+
{{- end }}
73+
74+
{{/*
75+
Create the name of the NetworkPolicy to deny all incoming traffic
76+
*/}}
77+
{{- define "team.networkPolicy.ingress.deny.all.name" }}
78+
{{- printf "%s-%s" ((include "team.fullname" .) | trunc 46 | trimSuffix "-") "ingress-deny-all" }}
79+
{{- end }}
80+

‎charts/teams/templates/limitrange/limitrange.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{{- range $name, $tenant := .Values.namespaces }}
2+
{{- range $tenant.limitRanges }}
3+
---
4+
apiVersion: v1
5+
kind: LimitRange
6+
metadata:
7+
name: {{ .name }}
8+
namespace: {{ $name }}
9+
annotations:
10+
{{- include "team.annotations" $ | nindent 4 }}
11+
{{- if .annotations }}
12+
{{- with .annotations }}
13+
{{- toYaml . | nindent 4 }}
14+
{{- end }}
15+
{{- end }}
16+
labels:
17+
{{- include "team.labels" $ | nindent 4 }}
18+
{{- if .labels }}
19+
{{- with .labels }}
20+
{{- toYaml . | nindent 4 }}
21+
{{- end }}
22+
{{- end }}
23+
spec:
24+
limits:
25+
{{- toYaml .limits | nindent 4}}
26+
{{- end }}
27+
{{- end }}

‎charts/teams/templates/namespace/namespace.yaml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{{- range $name, $tenant := .Values.namespaces }}
2+
{{- with $tenant }}
3+
---
4+
apiVersion: v1
5+
kind: Namespace
6+
metadata:
7+
name: {{ $name }}
8+
annotations:
9+
{{- include "team.annotations" $ | nindent 4 }}
10+
{{- if and .annotations .annotations.additionalAnnotations }}
11+
{{- with .annotations.additionalAnnotations }}
12+
{{- toYaml . | nindent 4 }}
13+
{{- end }}
14+
{{- end }}
15+
{{- if and .annotations .annotations.scheduler }}
16+
{{- with .annotations.scheduler }}
17+
{{- if .defaultTolerations }}
18+
scheduler.alpha.kubernetes.io/defaultTolerations: {{ toJson .defaultTolerations | quote }}
19+
{{- end }}
20+
{{- end }}
21+
{{- if .nodeSelector }}
22+
scheduler.alpha.kubernetes.io/node-selector: {{ .nodeSelector | quote }}
23+
{{- end }}
24+
{{- if .tolerationsWhitelist }}
25+
scheduler.alpha.kubernetes.io/tolerationsWhitelist: {{ toJson .tolerationsWhitelist | quote }}
26+
{{- end }}
27+
{{- end }}
28+
labels:
29+
{{- include "team.labels" $ | nindent 4 }}
30+
{{- if and .labels .labels.additionalLabels }}
31+
{{- with .labels.additionalLabels }}
32+
{{- toYaml . | nindent 4 }}
33+
{{- end }}
34+
{{- end }}
35+
{{- if and .labels .labels.podSecurityAdmission }}
36+
{{- with .labels.podSecurityAdmission }}
37+
{{- if and .audit .audit.standard }}
38+
pod-security.kubernetes.io/audit: {{ toJson .audit.standard }}
39+
{{- end }}
40+
{{- if and .audit .audit.version }}
41+
pod-security.kubernetes.io/audit-version: {{ toJson .audit.version }}
42+
{{- end }}
43+
{{- if and .enforce .enforce.standard }}
44+
pod-security.kubernetes.io/enforce: {{ toJson .enforce.standard }}
45+
{{- end }}
46+
{{- if and .enforce .enforce.version }}
47+
pod-security.kubernetes.io/enforce-version: {{ toJson .enforce.version }}
48+
{{- end }}
49+
{{- if and .audit .warn.standard }}
50+
pod-security.kubernetes.io/warn: {{ toJson .warn.standard }}
51+
{{- end }}
52+
{{- if and .audit .warn.version }}
53+
pod-security.kubernetes.io/warn-version: {{ toJson .warn.version }}
54+
{{- end }}
55+
{{- end }}
56+
{{- end }}
57+
{{- end }}
58+
{{- end }}
59+

‎charts/teams/templates/networkpolicy/egress/allow-dns.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
{{- if and (.Values.networkPolicies.enabled) (.Values.networkPolicies.egress.allow.dns.enabled) }}
2+
{{- range $name, $tenant := .Values.namespaces }}
3+
---
4+
apiVersion: networking.k8s.io/v1
5+
kind: NetworkPolicy
6+
metadata:
7+
annotations:
8+
{{- include "team.annotations" $ | nindent 4 }}
9+
{{- if $.Values.networkPolicies.annotations }}
10+
{{- with $.Values.networkPolicies.annotations }}
11+
{{- toYaml . | nindent 4 }}
12+
{{- end }}
13+
{{- end }}
14+
labels:
15+
{{- include "team.labels" $ | nindent 4 }}
16+
{{- if $.Values.networkPolicies.labels }}
17+
{{- with $.Values.networkPolicies.labels }}
18+
{{- toYaml . | nindent 4 }}
19+
{{- end }}
20+
{{- end }}
21+
name: {{ include "team.networkPolicy.egress.allow.dns.name" $ | quote }}
22+
namespace: {{ $name }}
23+
spec:
24+
{{- if $.Values.networkPolicies.egress.allow.dns.podSelector }}
25+
podSelector:
26+
{{- toYaml $.Values.networkPolicies.egress.allow.dns.podSelector | nindent 4 }}
27+
{{- else }}
28+
podSelector: {}
29+
{{- end }}
30+
policyTypes:
31+
- Egress
32+
egress:
33+
- to:
34+
{{- if $.Values.networkPolicies.egress.allow.dns.namespace }}
35+
- namespaceSelector:
36+
matchLabels:
37+
kubernetes.io/metadata.name: {{ $.Values.networkPolicies.egress.allow.dns.namespace | quote }}
38+
{{- else }}
39+
- namespaceSelector: {}
40+
{{- end }}
41+
podSelector:
42+
matchLabels:
43+
{{- if $.Values.networkPolicies.egress.allow.dns.podLabels }}
44+
{{- toYaml $.Values.networkPolicies.egress.allow.dns.podLabels | nindent 14 }}
45+
{{- else }}
46+
k8s-app: kube-dns
47+
{{- end }}
48+
ports:
49+
- port: 53
50+
protocol: UDP
51+
- port: 53
52+
protocol: TCP
53+
{{- end }}
54+
{{- end }}

‎charts/teams/templates/networkpolicy/egress/deny-all.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{{- if and (.Values.networkPolicies.enabled) (.Values.networkPolicies.egress.deny.all) }}
2+
{{- range $name, $tenant := .Values.namespaces }}
3+
---
4+
apiVersion: networking.k8s.io/v1
5+
kind: NetworkPolicy
6+
metadata:
7+
annotations:
8+
{{- include "team.annotations" $ | nindent 4 }}
9+
{{- if $.Values.networkPolicies.annotations }}
10+
{{- with $.Values.networkPolicies.annotations }}
11+
{{- toYaml . | nindent 4 }}
12+
{{- end }}
13+
{{- end }}
14+
labels:
15+
{{- include "team.labels" $ | nindent 4 }}
16+
{{- if $.Values.networkPolicies.labels }}
17+
{{- with $.Values.networkPolicies.labels }}
18+
{{- toYaml . | nindent 4 }}
19+
{{- end }}
20+
{{- end }}
21+
name: {{ include "team.networkPolicy.egress.deny.all.name" $ | quote }}
22+
namespace: {{ $name }}
23+
spec:
24+
{{- if $.Values.networkPolicies.egress.deny.all.podSelector }}
25+
podSelector:
26+
{{- toYaml $.Values.networkPolicies.egress.deny.all.podSelector | nindent 4 }}
27+
{{- else }}
28+
podSelector: {}
29+
{{- end }}
30+
policyTypes:
31+
- Egress
32+
egress: []
33+
{{- end }}
34+
{{- end }}

‎charts/teams/templates/networkpolicy/ingress/deny-all.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{{- if and (.Values.networkPolicies.enabled) (.Values.networkPolicies.ingress.deny.all) }}
2+
{{- range $name, $tenant := .Values.namespaces }}
3+
---
4+
apiVersion: networking.k8s.io/v1
5+
kind: NetworkPolicy
6+
metadata:
7+
annotations:
8+
{{- include "team.annotations" $ | nindent 4 }}
9+
{{- if $.Values.networkPolicies.annotations }}
10+
{{- with $.Values.networkPolicies.annotations }}
11+
{{- toYaml . | nindent 4 }}
12+
{{- end }}
13+
{{- end }}
14+
labels:
15+
{{- include "team.labels" $ | nindent 4 }}
16+
{{- if $.Values.networkPolicies.labels }}
17+
{{- with $.Values.networkPolicies.labels }}
18+
{{- toYaml . | nindent 4 }}
19+
{{- end }}
20+
{{- end }}
21+
name: {{ include "team.networkPolicy.ingress.deny.all.name" $ | quote }}
22+
namespace: {{ $name }}
23+
spec:
24+
{{- if $.Values.networkPolicies.ingress.deny.all.podSelector }}
25+
podSelector:
26+
{{- toYaml $.Values.networkPolicies.ingress.deny.all.podSelector | nindent 4 }}
27+
{{- else }}
28+
podSelector: {}
29+
{{- end }}
30+
policyTypes:
31+
- Ingress
32+
ingress: []
33+
{{- end }}
34+
{{- end }}

‎charts/teams/templates/networkpolicy/networkpolicy.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{{- range $name, $tenant := .Values.namespaces }}
2+
{{- range $tenant.networkPolicies }}
3+
---
4+
apiVersion: networking.k8s.io/v1
5+
kind: NetworkPolicy
6+
metadata:
7+
name: {{ .name }}
8+
namespace: {{ $name }}
9+
annotations:
10+
{{- include "team.annotations" $ | nindent 4 }}
11+
{{- if .annotations }}
12+
{{- with .annotations }}
13+
{{- toYaml . | nindent 4 }}
14+
{{- end }}
15+
{{- end }}
16+
labels:
17+
{{- include "team.labels" $ | nindent 4 }}
18+
{{- if .labels }}
19+
{{- with .labels }}
20+
{{- toYaml . | nindent 4 }}
21+
{{- end }}
22+
{{- end }}
23+
spec:
24+
{{- toYaml .spec | nindent 2 }}
25+
{{- end }}
26+
{{- end }}
27+

0 commit comments

Comments
 (0)