From 70b3b5b166b4360c80f3e7d06362208674986397 Mon Sep 17 00:00:00 2001 From: Fabian Kramm Date: Fri, 5 Apr 2024 15:27:30 +0200 Subject: [PATCH] chore: generate values.yaml comments --- chart/values.schema.json | 89 +++--- chart/values.yaml | 499 +++++++++++++++++++++++++----- config/config.go | 84 ++--- config/values.yaml | 93 +++--- hack/schema/main.go | 112 ++++++- pkg/config/legacyconfig/config.go | 6 +- 6 files changed, 632 insertions(+), 251 deletions(-) diff --git a/chart/values.schema.json b/chart/values.schema.json index ab93c0ebd..22b51974d 100755 --- a/chart/values.schema.json +++ b/chart/values.schema.json @@ -10,7 +10,7 @@ }, "database": { "$ref": "#/$defs/Database", - "description": "Database defines that a database backend should be used as the backend for the virtual cluster" + "description": "Database defines that a database backend should be used as the backend for the virtual cluster. This uses a project called kine under the hood which is a shim for bridging Kubernetes and relational databases." } }, "additionalProperties": false, @@ -40,15 +40,15 @@ "properties": { "distro": { "$ref": "#/$defs/Distro", - "description": "Distro holds virtual cluster related distro options." + "description": "Distro holds virtual cluster related distro options. A distro cannot be changed after vCluster is deployed." }, "backingStore": { "$ref": "#/$defs/BackingStore", - "description": "BackingStore defines which backing store to use for virtual cluster. If not defined will fallback to the default distro backing store." + "description": "BackingStore defines which backing store to use for virtual cluster. If not defined will use embedded database as a default backing store." }, "coredns": { "$ref": "#/$defs/CoreDNS", - "description": "CoreDNS defines everything coredns related." + "description": "CoreDNS defines everything related to the coredns that is deployed and used within the vCluster." }, "proxy": { "$ref": "#/$defs/ControlPlaneProxy", @@ -260,7 +260,7 @@ }, "port": { "type": "integer", - "description": "Port under which vCluster will expose the proxy." + "description": "Port under which vCluster will expose the proxy. Changing port is currently not supported." }, "extraSANs": { "items": { @@ -369,7 +369,7 @@ }, "imagePullSecrets": { "items": { - "$ref": "#/$defs/LocalObjectReference" + "$ref": "#/$defs/ImagePullSecretName" }, "type": "array", "description": "ImagePullSecrets defines extra image pull secrets for the service account." @@ -434,7 +434,7 @@ }, "pods": { "$ref": "#/$defs/LabelsAndAnnotations", - "description": "Pods are additional labels or annotations for the statefulSet pod." + "description": "Additional labels or annotations for the statefulSet pods." }, "image": { "$ref": "#/$defs/Image", @@ -485,7 +485,7 @@ }, "imagePullSecrets": { "items": { - "$ref": "#/$defs/LocalObjectReference" + "$ref": "#/$defs/ImagePullSecretName" }, "type": "array", "description": "ImagePullSecrets defines extra image pull secrets for the workload service account." @@ -516,7 +516,7 @@ }, "embedded": { "type": "boolean", - "description": "Embedded defines if vCluster will start the embedded coredns service" + "description": "Embedded defines if vCluster will start the embedded coredns service within the control-plane and not as a separate deployment. This is a PRO feature." }, "service": { "$ref": "#/$defs/CoreDNSService", @@ -627,7 +627,7 @@ }, "dataSource": { "type": "string", - "description": "DataSource is the kine dataSource to use for the database. This depends on the database format. This is optional for the embedded database." + "description": "DataSource is the kine dataSource to use for the database. This depends on the database format.\nThis is optional for the embedded database. Examples:\n* mysql: mysql://username:password@tcp(hostname:3306)/k3s\n* postgres: postgres://username:password@hostname:5432/k3s" }, "keyFile": { "type": "string", @@ -649,28 +649,28 @@ "properties": { "name": { "type": "string", - "description": "The name of the check.\n+optional" + "description": "The name of the check." }, "namespaces": { "items": { "type": "string" }, "type": "array", - "description": "Namespace describe a list of namespaces that will be affected by the check.\nAn empty list means that all namespaces will be affected.\nIn case of ClusterScoped rules, only the Namespace resource is affected.\n+optional" + "description": "Namespace describe a list of namespaces that will be affected by the check.\nAn empty list means that all namespaces will be affected.\nIn case of ClusterScoped rules, only the Namespace resource is affected." }, "rules": { "items": { "$ref": "#/$defs/RuleWithVerbs" }, "type": "array", - "description": "Rules describes on which verbs and on what resources/subresources the webhook is enforced.\nThe webhook is enforced if it matches any Rule.\nThe version of the request must match the rule version exactly. Equivalent matching is not supported.\n+optional" + "description": "Rules describes on which verbs and on what resources/subresources the webhook is enforced.\nThe webhook is enforced if it matches any Rule.\nThe version of the request must match the rule version exactly. Equivalent matching is not supported." }, "excludedUsers": { "items": { "type": "string" }, "type": "array", - "description": "ExcludedUsers describe a list of users for which the checks will be skipped.\nImpersonation attempts on these users will still be subjected to the checks.\n+optional" + "description": "ExcludedUsers describe a list of users for which the checks will be skipped.\nImpersonation attempts on these users will still be subjected to the checks." } }, "additionalProperties": false, @@ -678,6 +678,10 @@ }, "Distro": { "properties": { + "k8s": { + "$ref": "#/$defs/DistroK8s", + "description": "K8S holds K8s relevant configuration." + }, "k3s": { "$ref": "#/$defs/DistroK3s", "description": "K3S holds K3s relevant configuration." @@ -686,10 +690,6 @@ "$ref": "#/$defs/DistroK0s", "description": "K0S holds k0s relevant configuration." }, - "k8s": { - "$ref": "#/$defs/DistroK8s", - "description": "K8S holds K8s relevant configuration." - }, "eks": { "$ref": "#/$defs/DistroK8s", "description": "EKS holds eks relevant configuration." @@ -773,15 +773,15 @@ "type": "object" }, "type": "array", - "description": "Env are extra environment variables to use for the main container." + "description": "Env are extra environment variables to use for the main container and NOT the init container." }, "resources": { "type": "object", - "description": "Resources are the resources for the distro init container" + "description": "Resources for the distro init container" }, "securityContext": { "type": "object", - "description": "SecurityContext can be used for the distro init container" + "description": "Security options can be used for the distro init container" }, "image": { "$ref": "#/$defs/Image", @@ -824,15 +824,15 @@ "type": "object" }, "type": "array", - "description": "Env are extra environment variables to use for the main container." + "description": "Env are extra environment variables to use for the main container and NOT the init container." }, "resources": { "type": "object", - "description": "Resources are the resources for the distro init container" + "description": "Resources for the distro init container" }, "securityContext": { "type": "object", - "description": "SecurityContext can be used for the distro init container" + "description": "Security options can be used for the distro init container" }, "image": { "$ref": "#/$defs/Image", @@ -872,26 +872,26 @@ }, "controllerManager": { "$ref": "#/$defs/DistroContainerEnabled", - "description": "ControllerManager holds configuration specific to starting the scheduler." + "description": "ControllerManager holds configuration specific to starting the controller manager." }, "scheduler": { "$ref": "#/$defs/DistroContainer", - "description": "Scheduler holds configuration specific to starting the scheduler. Enable this via controlPlane.virtualScheduler.enabled" + "description": "Scheduler holds configuration specific to starting the scheduler. Enable this via controlPlane.advanced.virtualScheduler.enabled" }, "env": { "items": { "type": "object" }, "type": "array", - "description": "Env are extra environment variables to use for the main container." + "description": "Env are extra environment variables to use for the main container and NOT the init container." }, "resources": { "type": "object", - "description": "Resources are the resources for the distro init container" + "description": "Resources for the distro init container" }, "securityContext": { "type": "object", - "description": "SecurityContext can be used for the distro init container" + "description": "Security options can be used for the distro init container" } }, "additionalProperties": false, @@ -1543,6 +1543,16 @@ "additionalProperties": false, "type": "object" }, + "ImagePullSecretName": { + "properties": { + "name": { + "type": "string", + "description": "Name of the image pull secret to use." + } + }, + "additionalProperties": false, + "type": "object" + }, "Import": { "properties": { "apiVersion": { @@ -1630,17 +1640,6 @@ "additionalProperties": false, "type": "object" }, - "LocalObjectReference": { - "properties": { - "name": { - "type": "string", - "description": "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names" - } - }, - "additionalProperties": false, - "type": "object", - "description": "LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace." - }, "MetricsProxy": { "properties": { "nodes": { @@ -2450,32 +2449,32 @@ "type": "string" }, "type": "array", - "description": "APIGroups is the API groups the resources belong to. '*' is all groups.\nIf '*' is present, the length of the slice must be one.\nRequired.\n+listType=atomic" + "description": "APIGroups is the API groups the resources belong to. '*' is all groups." }, "apiVersions": { "items": { "type": "string" }, "type": "array", - "description": "APIVersions is the API versions the resources belong to. '*' is all versions.\nIf '*' is present, the length of the slice must be one.\nRequired.\n+listType=atomic" + "description": "APIVersions is the API versions the resources belong to. '*' is all versions." }, "resources": { "items": { "type": "string" }, "type": "array", - "description": "Resources is a list of resources this rule applies to.\n\nFor example:\n'pods' means pods.\n'pods/log' means the log subresource of pods.\n'*' means all resources, but not subresources.\n'pods/*' means all subresources of pods.\n'*/scale' means all scale subresources.\n'*/*' means all resources and their subresources.\n\nIf wildcard is present, the validation rule will ensure resources do not\noverlap with each other.\n\nDepending on the enclosing object, subresources might not be allowed.\nRequired.\n+listType=atomic" + "description": "Resources is a list of resources this rule applies to." }, "scope": { "type": "string", - "description": "scope specifies the scope of this rule.\nValid values are \"Cluster\", \"Namespaced\", and \"*\"\n\"Cluster\" means that only cluster-scoped resources will match this rule.\nNamespace API objects are cluster-scoped.\n\"Namespaced\" means that only namespaced resources will match this rule.\n\"*\" means that there are no scope restrictions.\nSubresources match the scope of their parent resource.\nDefault is \"*\".\n\n+optional" + "description": "Scope specifies the scope of this rule." }, "operations": { "items": { "type": "string" }, "type": "array", - "description": "Verb is the kube verb associated with the request for API requests, not the http verb. This includes things like list and watch.\nFor non-resource requests, this is the lowercase http verb.\nIf '*' is present, the length of the slice must be one.\nRequired.\n+listType=atomic" + "description": "Verb is the kube verb associated with the request for API requests, not the http verb. This includes things like list and watch.\nFor non-resource requests, this is the lowercase http verb.\nIf '*' is present, the length of the slice must be one." } }, "additionalProperties": false, diff --git a/chart/values.yaml b/chart/values.yaml index 85f0ccaed..847f4b7cd 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -1,130 +1,162 @@ -# Sync Options +# Sync describes how to sync resources from the virtual cluster to host cluster and back. sync: + # Configure resources to sync from the virtual cluster to the host cluster. toHost: + # Services defines if services created within the virtual cluster should get synced to the host cluster. services: enabled: true + # Endpoints defines if endpoints created within the virtual cluster should get synced to the host cluster. endpoints: enabled: true + # PersistentVolumeClaims defines if persistent volume claims created within the virtual cluster should get synced to the host cluster. persistentVolumeClaims: enabled: true + # ConfigMaps defines if config maps created within the virtual cluster should get synced to the host cluster. configMaps: enabled: true + # All defines if all resources of that type should get synced or only the necessary ones that are needed. all: false + # Secrets defines if secrets created within the virtual cluster should get synced to the host cluster. secrets: enabled: true + # All defines if all resources of that type should get synced or only the necessary ones that are needed. all: false + # Pods defines if pods created within the virtual cluster should get synced to the host cluster. pods: + # Enabled defines if pod syncing should be enabled. enabled: true + # TranslateImage maps an image to another image that should be used instead. For example this can be used to rewrite + # a certain image that is used within the virtual cluster to be another image on the host cluster translateImage: {} + # EnforceTolerations will add the specified tolerations to all pods synced by the virtual cluster. enforceTolerations: [] + # UseSecretsForSATokens will use secrets to save the generated service account tokens by virtual cluster instead of using a + # pod annotation. useSecretsForSATokens: false + # RewriteHosts is a special option needed to rewrite statefulset containers to allow the correct FQDN. virtual cluster will add + # a small container to each stateful set pod that will initially rewrite the /etc/hosts file to match the FQDN expected by + # the virtual cluster. rewriteHosts: + # Enabled specifies if rewriting stateful set pods should be enabled. enabled: true + # InitContainerImage is the image virtual cluster should use to rewrite this FQDN. initContainerImage: "library/alpine:3.13.1" + # Ingresses defines if ingresses created within the virtual cluster should get synced to the host cluster. ingresses: enabled: false + # PriorityClasses defines if priority classes created within the virtual cluster should get synced to the host cluster. priorityClasses: enabled: false + # NetworkPolicies defines if network policies created within the virtual cluster should get synced to the host cluster. networkPolicies: enabled: false + # VolumeSnapshots defines if volume snapshots created within the virtual cluster should get synced to the host cluster. volumeSnapshots: enabled: false + # PodDisruptionBudgets defines if pod disruption budgets created within the virtual cluster should get synced to the host cluster. podDisruptionBudgets: enabled: false + # ServiceAccounts defines if service accounts created within the virtual cluster should get synced to the host cluster. serviceAccounts: enabled: false + # StorageClasses defines if storage classes created within the virtual cluster should get synced to the host cluster. storageClasses: enabled: false + # PersistentVolumes defines if persistent volumes created within the virtual cluster should get synced to the host cluster. persistentVolumes: enabled: false - + + # Configure what resources vCluster should sync from the host cluster to the virtual cluster. fromHost: + # Events defines if events should get synced from the host cluster to the virtual cluster, but not back. events: enabled: true + # CSIDrivers defines if csi drivers should get synced from the host cluster to the virtual cluster, but not back. csiDrivers: enabled: false + # CSINodes defines if csi nodes should get synced from the host cluster to the virtual cluster, but not back. csiNodes: enabled: false + # CSIStorageCapacities defines if csi storage capacities should get synced from the host cluster to the virtual cluster, but not back. csiStorageCapacities: enabled: false + # IngressClasses defines if ingress classes should get synced from the host cluster to the virtual cluster, but not back. ingressClasses: enabled: false + # StorageClasses defines if storage classes should get synced from the host cluster to the virtual cluster, but not back. storageClasses: enabled: false + # Nodes defines if nodes should get synced from the host cluster to the virtual cluster, but not back. nodes: + # Enabled specifies if syncing real nodes should be enabled. If this is disabled, vCluster will create fake nodes instead. enabled: false + # SyncBackChanges enables syncing labels and taints from the virtual cluster to the host cluster. If this is enabled someone within the virtual cluster will be able to change the labels and taints of the host cluster node. syncBackChanges: false + # ClearImageStatus will erase the image status when syncing a node. This allows to hide images that are pulled by the node. clearImageStatus: false + # Selector can be used to define more granular what nodes should get synced from the host cluster to the virtual cluster. selector: + # All specifies if all nodes should get synced by vCluster from the host to the virtual cluster or only the ones where pods are assigned to. all: false labels: {} -# Control Plane Options +# Configure vCluster's control plane components and deployment. controlPlane: - # What distro to use for vCluster, if none is specified, k8s is used + # Distro holds virtual cluster related distro options. A distro cannot be changed after vCluster is deployed. distro: - k3s: - enabled: false - command: [] - extraArgs: [] - imagePullPolicy: "" - image: - repository: "rancher/k3s" - tag: "v1.29.0-k3s1" - securityContext: {} - resources: - limits: - cpu: 100m - memory: 256Mi - requests: - cpu: 40m - memory: 64Mi - - k0s: - enabled: false - config: "" - command: [] - extraArgs: [] - imagePullPolicy: "" - image: - repository: "k0sproject/k0s" - tag: "v1.29.1-k0s.0" - securityContext: {} - resources: - limits: - cpu: 100m - memory: 256Mi - requests: - cpu: 40m - memory: 64Mi - + # K8S holds K8s relevant configuration. k8s: + # Enabled specifies if the K8s distro should be enabled. Only one distro can be enabled at the same time. enabled: false + # APIServer holds configuration specific to starting the api server. apiServer: enabled: true + # Command is the command to start the distro binary. This will override the existing command. command: [] + # ExtraArgs are additional arguments to pass to the distro binary. extraArgs: [] + # ImagePullPolicy is the pull policy for the distro image imagePullPolicy: "" + # Image is the distro image image: + # Repository is the registry and repository of the container image, e.g. my-registry.com/my-repo/my-image repository: "registry.k8s.io/kube-apiserver" + # Tag is the tag of the container image, e.g. latest tag: "v1.29.0" + # ControllerManager holds configuration specific to starting the controller manager. controllerManager: enabled: true + # Command is the command to start the distro binary. This will override the existing command. command: [] + # ExtraArgs are additional arguments to pass to the distro binary. extraArgs: [] + # ImagePullPolicy is the pull policy for the distro image imagePullPolicy: "" + # Image is the distro image image: + # Repository is the registry and repository of the container image, e.g. my-registry.com/my-repo/my-image repository: "registry.k8s.io/kube-controller-manager" + # Tag is the tag of the container image, e.g. latest tag: "v1.29.0" + # Scheduler holds configuration specific to starting the scheduler. Enable this via controlPlane.advanced.virtualScheduler.enabled scheduler: + # Command is the command to start the distro binary. This will override the existing command. command: [] + # ExtraArgs are additional arguments to pass to the distro binary. extraArgs: [] + # ImagePullPolicy is the pull policy for the distro image imagePullPolicy: "" + # Image is the distro image image: + # Repository is the registry and repository of the container image, e.g. my-registry.com/my-repo/my-image repository: "registry.k8s.io/kube-scheduler" + # Tag is the tag of the container image, e.g. latest tag: "v1.29.0" + # Env are extra environment variables to use for the main container and NOT the init container. env: [] + # Security options can be used for the distro init container securityContext: {} + # Resources for the distro init container resources: limits: cpu: 100m @@ -132,34 +164,113 @@ controlPlane: requests: cpu: 40m memory: 64Mi - + # K3S holds K3s relevant configuration. + k3s: + # Enabled specifies if the K3s distro should be enabled. Only one distro can be enabled at the same time. + enabled: false + # Command is the command to start the distro binary. This will override the existing command. + command: [] + # ExtraArgs are additional arguments to pass to the distro binary. + extraArgs: [] + # ImagePullPolicy is the pull policy for the distro image + imagePullPolicy: "" + # Image is the distro image + image: + # Repository is the registry and repository of the container image, e.g. my-registry.com/my-repo/my-image + repository: "rancher/k3s" + # Tag is the tag of the container image, e.g. latest + tag: "v1.29.0-k3s1" + # Security options can be used for the distro init container + securityContext: {} + # Resources for the distro init container + resources: + limits: + cpu: 100m + memory: 256Mi + requests: + cpu: 40m + memory: 64Mi + # K0S holds k0s relevant configuration. + k0s: + # Enabled specifies if the k0s distro should be enabled. Only one distro can be enabled at the same time. + enabled: false + # Config allows you to override the k0s config passed to the k0s binary. + config: "" + # Command is the command to start the distro binary. This will override the existing command. + command: [] + # ExtraArgs are additional arguments to pass to the distro binary. + extraArgs: [] + # ImagePullPolicy is the pull policy for the distro image + imagePullPolicy: "" + # Image is the distro image + image: + # Repository is the registry and repository of the container image, e.g. my-registry.com/my-repo/my-image + repository: "k0sproject/k0s" + # Tag is the tag of the container image, e.g. latest + tag: "v1.29.1-k0s.0" + # Security options can be used for the distro init container + securityContext: {} + # Resources for the distro init container + resources: + limits: + cpu: 100m + memory: 256Mi + requests: + cpu: 40m + memory: 64Mi + # EKS holds eks relevant configuration. eks: + # Enabled specifies if the K8s distro should be enabled. Only one distro can be enabled at the same time. enabled: false + # APIServer holds configuration specific to starting the api server. apiServer: enabled: true + # Command is the command to start the distro binary. This will override the existing command. command: [] + # ExtraArgs are additional arguments to pass to the distro binary. extraArgs: [] + # ImagePullPolicy is the pull policy for the distro image imagePullPolicy: "" + # Image is the distro image image: + # Repository is the registry and repository of the container image, e.g. my-registry.com/my-repo/my-image repository: "public.ecr.aws/eks-distro/kubernetes/kube-apiserver" + # Tag is the tag of the container image, e.g. latest tag: "v1.28.2-eks-1-28-6" + # ControllerManager holds configuration specific to starting the controller manager. controllerManager: enabled: true + # Command is the command to start the distro binary. This will override the existing command. command: [] + # ExtraArgs are additional arguments to pass to the distro binary. extraArgs: [] + # ImagePullPolicy is the pull policy for the distro image imagePullPolicy: "" + # Image is the distro image image: + # Repository is the registry and repository of the container image, e.g. my-registry.com/my-repo/my-image repository: "public.ecr.aws/eks-distro/kubernetes/kube-controller-manager" + # Tag is the tag of the container image, e.g. latest tag: "v1.28.2-eks-1-28-6" + # Scheduler holds configuration specific to starting the scheduler. Enable this via controlPlane.advanced.virtualScheduler.enabled scheduler: + # Command is the command to start the distro binary. This will override the existing command. command: [] + # ExtraArgs are additional arguments to pass to the distro binary. extraArgs: [] + # ImagePullPolicy is the pull policy for the distro image imagePullPolicy: "" + # Image is the distro image image: + # Repository is the registry and repository of the container image, e.g. my-registry.com/my-repo/my-image repository: "public.ecr.aws/eks-distro/kubernetes/kube-scheduler" + # Tag is the tag of the container image, e.g. latest tag: "v1.28.2-eks-1-28-6" + # Env are extra environment variables to use for the main container and NOT the init container. env: [] + # Security options can be used for the distro init container securityContext: {} + # Resources for the distro init container resources: limits: cpu: 100m @@ -167,261 +278,420 @@ controlPlane: requests: cpu: 40m memory: 64Mi - + + # BackingStore defines which backing store to use for virtual cluster. If not defined will use embedded database as a default backing store. backingStore: + # Database defines that a database backend should be used as the backend for the virtual cluster. This uses a project called kine under the hood which is a shim for bridging Kubernetes and relational databases. database: + # Embedded defines that an embedded database (sqlite) should be used as the backend for the virtual cluster embedded: + # Enabled defines if the database should be used. enabled: false - # Optional sqlite dataSource - # dataSource: "" + # External defines that an external database should be used as the backend for the virtual cluster external: + # Enabled defines if the database should be used. enabled: false + # DataSource is the kine dataSource to use for the database. This depends on the database format. + # This is optional for the embedded database. Examples: + # * mysql: mysql://username:password@tcp(hostname:3306)/k3s + # * postgres: postgres://username:password@hostname:5432/k3s dataSource: "" - # Optional database certificates - # certFile: "" - # keyFile: "" - # caFile: "" + # CertFile is the cert file to use for the database. This is optional. + certFile: "" + # KeyFile is the key file to use for the database. This is optional. + keyFile: "" + # CaFile is the ca file to use for the database. This is optional. + caFile: "" + # Etcd defines that etcd should be used as the backend for the virtual cluster etcd: + # Embedded defines to use embedded etcd as a storage backend for the virtual cluster embedded: + # Enabled defines if the embedded etcd should be used. enabled: false + # MigrateFromDeployedEtcd signals that vCluster should migrate from the deployed external etcd to embedded etcd. migrateFromDeployedEtcd: false + # Deploy defines to use an external etcd that is deployed by the helm chart deploy: + # Enabled defines that an external etcd should be deployed. enabled: false + # StatefulSet holds options for the external etcd statefulSet. statefulSet: + # Enabled defines if the statefulSet should be deployed enabled: true annotations: {} labels: {} + # Image is the image to use for the external etcd statefulSet image: + # Repository is the registry and repository of the container image, e.g. my-registry.com/my-repo/my-image repository: "registry.k8s.io/etcd" + # Tag is the tag of the container image, e.g. latest tag: "3.5.10-0" + # ImagePullPolicy is the pull policy for the external etcd image imagePullPolicy: "" + # ExtraArgs are appended to the etcd command. extraArgs: [] + # Env are extra environment variables env: [] + # Resources the etcd can consume resources: + # Requests are minimal resources that will be consumed by the container requests: cpu: 20m memory: 150Mi + # Pods defines extra metadata for the etcd pods. pods: annotations: {} labels: {} + # HighAvailability are high availability options highAvailability: + # Replicas are the amount of pods to use. replicas: 1 + # Scheduling options for the etcd pods. scheduling: + # PodManagementPolicy is the statefulSet pod management policy. podManagementPolicy: Parallel + # NodeSelector is the node selector to apply to the pod. nodeSelector: {} + # Affinity is the affinity to apply to the pod. affinity: {} + # Tolerations are the tolerations to apply to the pod. tolerations: [] + # TopologySpreadConstraints are the topology spread constraints for the pod. topologySpreadConstraints: [] + # PriorityClassName is the priority class name for the the pod. priorityClassName: "" + # Security options for the etcd pods. security: + # PodSecurityContext specifies security context options on the pod level. podSecurityContext: {} + # ContainerSecurityContext specifies security context options on the container level. containerSecurityContext: {} + # Persistence options for the etcd pods. persistence: + # VolumeClaim can be used to configure the persistent volume claim. volumeClaim: + # Enabled enables deploying a persistent volume claim. enabled: true - # Defines if the PVC should get automatically deleted when the StatefulSet is deleted. Can be either Delete or Retain + # RetentionPolicy is the persistent volume claim retention policy. retentionPolicy: Retain + # Size is the persistent volume claim storage size. size: 5Gi + # StorageClass is the persistent volume claim storage class. storageClass: "" - accessModes: [ "ReadWriteOnce" ] + # AccessModes are the persistent volume claim access modes. + accessModes: ["ReadWriteOnce"] + # VolumeClaimTemplates defines the volumeClaimTemplates for the statefulSet volumeClaimTemplates: [] + # AddVolumes defines extra volumes for the pod addVolumes: [] + # AddVolumeMounts defines extra volume mounts for the container addVolumeMounts: [] + # Service holds options for the external etcd service. service: enabled: true annotations: {} + # HeadlessService holds options for the external etcd headless service. headlessService: enabled: true annotations: {} - + + # Proxy defines options for the virtual cluster control plane proxy that is used to do authentication and intercept requests. proxy: + # BindAddress under which vCluster will expose the proxy. bindAddress: "0.0.0.0" + # Port under which vCluster will expose the proxy. Changing port is currently not supported. port: 8443 + # ExtraSANs are extra hostnames to sign the vCluster proxy certificate for. extraSANs: [] - + + # CoreDNS defines everything related to the coredns that is deployed and used within the vCluster. coredns: + # Enabled defines if coredns is enabled enabled: true + # Embedded defines if vCluster will start the embedded coredns service within the control-plane and not as a separate deployment. This is a PRO feature. embedded: false + # OverwriteManifests can be used to overwrite the coredns manifests used to deploy coredns overwriteManifests: "" + # OverwriteConfig can be used to overwrite the coredns config overwriteConfig: "" - + # Service holds extra options for the coredns service deployed within the virtual cluster service: annotations: {} labels: {} + # Spec holds extra options for the coredns service spec: type: ClusterIP - + # Deployment holds extra options for the coredns deployment deployed within the virtual cluster deployment: annotations: {} labels: {} + # Image is the coredns image to use image: "" + # Replicas is the amount of coredns pods to run. replicas: 1 + # Pods is additional metadata for the coredns pods. pods: - labels: {} - annotations: {} + labels: {} + annotations: {} + # NodeSelector is the node selector to use for coredns. nodeSelector: {} + # Resources are the desired resources for coredns. resources: + # Limits are resource limits for the container limits: cpu: 1000m memory: 170Mi + # Requests are minimal resources that will be consumed by the container requests: cpu: 20m memory: 64Mi - + + # Service defines options for vCluster service deployed by Helm. service: + # Enabled defines if the control plane service should be enabled enabled: true labels: {} annotations: {} + # KubeletNodePort is the node port where the fake kubelet is exposed. Defaults to 0. kubeletNodePort: 0 + # HTTPSNodePort is the node port where https is exposed. Defaults to 0. httpsNodePort: 0 + # Spec allows you to configure extra service options. spec: type: ClusterIP - + + # Ingress defines options for vCluster ingress deployed by Helm. ingress: + # Enabled defines if the control plane ingress should be enabled enabled: false + # Host is the host where vCluster will be reachable host: "my-host.com" + # PathType is the path type of the ingress pathType: ImplementationSpecific labels: {} annotations: nginx.ingress.kubernetes.io/backend-protocol: HTTPS nginx.ingress.kubernetes.io/ssl-passthrough: "true" nginx.ingress.kubernetes.io/ssl-redirect: "true" + # Spec allows you to configure extra ingress options. spec: tls: [] - + + # StatefulSet defines options for vCluster statefulSet deployed by Helm. statefulSet: labels: {} annotations: {} + # ImagePullPolicy is the policy how to pull the image. imagePullPolicy: "" + # Image is the image for the controlPlane statefulSet container image: + # Repository is the registry and repository of the container image, e.g. my-registry.com/my-repo/my-image repository: "ghcr.io/loft-sh/vcluster" + # Tag is the tag of the container image, e.g. latest tag: "" - + # WorkingDir specifies in what folder the main process should get started. workingDir: "" + # Command allows you to override the main command. command: [] + # Args allows you to override the main arguments. args: [] + # Env are additional environment variables for the statefulSet container. env: [] - + # Resources are the resource requests and limits for the statefulSet container. resources: + # Limits are resource limits for the container limits: ephemeral-storage: 8Gi memory: 2Gi + # Requests are minimal resources that will be consumed by the container requests: ephemeral-storage: 200Mi cpu: 200m memory: 256Mi - + # Additional labels or annotations for the statefulSet pods. pods: labels: {} annotations: {} - + # HighAvailability holds options related to high availability. highAvailability: + # Replicas is the amount of replicas to use for the statefulSet. replicas: 1 + # LeaseDuration is the time to lease for the leader. leaseDuration: 60 + # RenewDeadline is the deadline to renew a lease for the leader. renewDeadline: 40 + # RetryPeriod is the time until a replica will retry to get a lease. retryPeriod: 15 - + # Security defines pod or container security context. security: + # PodSecurityContext specifies security context options on the pod level. podSecurityContext: {} + # ContainerSecurityContext specifies security context options on the container level. containerSecurityContext: allowPrivilegeEscalation: false runAsUser: 0 runAsGroup: 0 - + # Persistence defines options around persistence for the statefulSet. persistence: + # VolumeClaim can be used to configure the persistent volume claim. volumeClaim: + # Enabled enables deploying a persistent volume claim. If auto, vCluster will automatically determine + # based on the chosen distro and other options if this is required. enabled: auto - # Defines if the PVC should get automatically deleted when the StatefulSet is deleted. Can be either Delete or Retain + # RetentionPolicy is the persistent volume claim retention policy. retentionPolicy: Retain + # Size is the persistent volume claim storage size. size: 5Gi + # StorageClass is the persistent volume claim storage class. storageClass: "" - accessModes: [ "ReadWriteOnce" ] + # AccessModes are the persistent volume claim access modes. + accessModes: ["ReadWriteOnce"] + # VolumeClaimTemplates defines the volumeClaimTemplates for the statefulSet volumeClaimTemplates: [] + # AddVolumeMounts defines extra volume mounts for the container addVolumeMounts: [] + # AddVolumes defines extra volumes for the pod addVolumes: [] - + # Scheduling holds options related to scheduling. scheduling: + # PodManagementPolicy is the statefulSet pod management policy. podManagementPolicy: Parallel + # TopologySpreadConstraints are the topology spread constraints for the pod. topologySpreadConstraints: [] + # PriorityClassName is the priority class name for the the pod. priorityClassName: "" + # NodeSelector is the node selector to apply to the pod. nodeSelector: {} + # Affinity is the affinity to apply to the pod. affinity: {} + # Tolerations are the tolerations to apply to the pod. tolerations: [] - + # Probes enables or disables the main container probes. probes: + # LivenessProbe specifies if the liveness probe for the container should be enabled livenessProbe: enabled: true + # ReadinessProbe specifies if the readiness probe for the container should be enabled readinessProbe: enabled: true + # StartupProbe specifies if the startup probe for the container should be enabled startupProbe: enabled: true - + + # ServiceMonitor can be used to automatically create a service monitor for vCluster deployment itself. serviceMonitor: + # Enabled configures if Helm should create the service monitor. enabled: false labels: {} annotations: {} - + + # Advanced holds additional configuration for the vCluster control plane. advanced: + # DefaultImageRegistry will be used as a prefix for all internal images deployed by vCluster or Helm. This makes it easy to + # upload all required vCluster images to a single private repository and set this value. Workload images are not affected by this. defaultImageRegistry: "" - + # VirtualScheduler defines if a scheduler should be used within the virtual cluster or the scheduling decision for workloads will be made by the host cluster. virtualScheduler: enabled: false - + # ServiceAccount specifies options for the vCluster control plane service account. serviceAccount: + # Enabled specifies if the service account should get deployed. enabled: true + # Name specifies what name to use for the service account. name: "" + # ImagePullSecrets defines extra image pull secrets for the service account. imagePullSecrets: [] labels: {} annotations: {} - + # WorkloadServiceAccount specifies options for the service account that will be used for the workloads that run within the virtual cluster. workloadServiceAccount: + # Enabled specifies if the service account for the workloads should get deployed. enabled: true + # Name specifies what name to use for the service account for the virtual cluster workloads. name: "" + # ImagePullSecrets defines extra image pull secrets for the workload service account. imagePullSecrets: [] annotations: {} labels: {} - + # HeadlessService specifies options for the headless service used for the vCluster StatefulSet. headlessService: labels: {} annotations: {} - + # GlobalMetadata is metadata that will be added to all resources deployed by Helm. globalMetadata: annotations: {} +# RBAC options for the virtual cluster. rbac: + # Role holds virtual cluster role configuration role: + # Enabled defines if the role should be enabled or disabled. enabled: true + # OverwriteRules will overwrite the role rules completely. overwriteRules: [] + # ExtraRules will add rules to the role. extraRules: [] + + # ClusterRole holds virtual cluster cluster role configuration clusterRole: + # Enabled defines if the cluster role should be enabled or disabled. If auto, vCluster automatically determines whether the virtual cluster requires a cluster role. enabled: auto + # OverwriteRules will overwrite the cluster role rules completely. overwriteRules: [] + # ExtraRules will add rules to the cluster role. extraRules: [] +# Observability holds options to proxy metrics from the host cluster into the virtual cluster. observability: + # Metrics allows to proxy metrics server apis from host to virtual cluster. metrics: + # Proxy holds the configuration what metrics-server apis should get proxied. proxy: + # Nodes defines if metrics-server nodes api should get proxied from host to virtual cluster. nodes: false + # Pods defines if metrics-server pods api should get proxied from host to virtual cluster. pods: false +# Networking options related to the virtual cluster. networking: - # Embedded CoreDNS plugin config + # ReplicateServices allows replicating services from the host within the virtual cluster or the other way around. replicateServices: + # ToHost defines the services that should get synced from virtual cluster to the host cluster. If services are + # synced to a different namespace than the virtual cluster is in, additional permissions for the other namespace + # are required. toHost: [] + # FromHost defines the services that should get synced from the host to the virtual cluster. fromHost: [] + + # ResolveDNS allows to define extra DNS rules. This only works if embedded coredns is configured. resolveDNS: [] + + # Advanced holds advanced network options. advanced: + # ClusterDomain is the Kubernetes cluster domain to use within the virtual cluster. clusterDomain: "cluster.local" + # FallbackHostCluster allows to fallback dns to the host cluster. This is useful if you want to reach host services without + # any other modification. You will need to provide a namespace for the service, e.g. my-other-service.my-other-namespace fallbackHostCluster: false + # ProxyKubelets allows rewriting certain metrics and stats from the Kubelet to "fake" this for applications such as + # prometheus or other node exporters. proxyKubelets: + # ByHostname will add a special vCluster hostname to the nodes where the node can be reached at. This doesn't work + # for all applications, e.g. Prometheus requires a node IP. byHostname: true + # ByIP will create a separate service in the host cluster for every node that will point to virtual cluster and will be used to + # route traffic. byIP: true +# Policies to enforce for the virtual cluster deployment as well as within the virtual cluster. policies: + # ResourceQuota specifies resource quota options. resourceQuota: + # Enabled defines if the resource quota should be enabled. enabled: false labels: {} annotations: {} + # Quota are the quota options quota: requests.cpu: 10 requests.memory: 20Gi @@ -438,84 +708,141 @@ policies: count/secrets: 100 count/configmaps: 100 count/persistentvolumeclaims: 20 + # ScopeSelector is the resource quota scope selector scopeSelector: matchExpressions: [] + # Scopes are the resource quota scopes scopes: [] - + + # LimitRange specifies limit range options. limitRange: + # Enabled defines if the limit range should be deployed by vCluster. enabled: false labels: {} annotations: {} + # Default are the default limits for the limit range default: ephemeral-storage: 8Gi memory: 512Mi cpu: "1" + # DefaultRequest are the default request options for the limit range defaultRequest: ephemeral-storage: 3Gi memory: 128Mi cpu: 100m - + + # NetworkPolicy specifies network policy options. networkPolicy: + # Enabled defines if the network policy should be deployed by vCluster. enabled: false labels: {} annotations: {} fallbackDns: 8.8.8.8 outgoingConnections: + # IPBlock describes a particular CIDR (Ex. "192.168.1.0/24","2001:db8::/64") that is allowed + # to the pods matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs + # that should not be included within this rule. ipBlock: + # cidr is a string representing the IPBlock + # Valid examples are "192.168.1.0/24" or "2001:db8::/64" cidr: 0.0.0.0/0 + # except is a slice of CIDRs that should not be included within an IPBlock + # Valid examples are "192.168.1.0/24" or "2001:db8::/64" + # Except values will be rejected if they are outside the cidr range + # +optional except: - 100.64.0.0/10 - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - + + # CentralAdmission defines what validating or mutating webhooks should be enforced within the virtual cluster. centralAdmission: + # ValidatingWebhooks are validating webhooks that should be enforced in the virtual cluster validatingWebhooks: [] + # MutatingWebhooks are mutating webhooks that should be enforced in the virtual cluster mutatingWebhooks: [] -# Export vCluster Kube Config +# ExportKubeConfig describes how vCluster should export the vCluster kubeConfig file. exportKubeConfig: + # Context is the name of the context within the generated kubeconfig to use. context: "" + + # Override the default https://localhost:8443 and specify a custom hostname for the generated kubeconfig. server: "" + + # Declare in which host cluster secret vCluster should store the generated virtual cluster kubeconfig. + # If this is not defined, vCluster create it with `vc-NAME`. If you specify another name, + # vCluster creates the config in this other secret. secret: + # Name is the name of the secret where the kubeconfig should get stored. name: "" + # Namespace where vCluster should store the kubeconfig secret. If this is not equal to the namespace + # where you deployed vCluster, you need to make sure vCluster has access to this other namespace. namespace: "" -# What plugins should get used +# Define which vCluster plugins to load. plugins: {} -# Functionality that is likely to change, use with caution! +# Experimental features for vCluster. Configuration here might change, so be careful with this. experimental: + # MultiNamespaceMode tells virtual cluster to sync to multiple namespaces instead of a single one. This will map each virtual cluster namespace to a single namespace in the host cluster. multiNamespaceMode: + # Enabled specifies if multi namespace mode should get enabled enabled: false - + + # SyncSettings are advanced settings for the syncer controller. syncSettings: + # DisableSync will not sync any resources and disable most control plane functionality. disableSync: false + # RewriteKubernetesService will rewrite the Kubernetes service to point to the vCluster service if disableSync is enabled rewriteKubernetesService: false + # TargetNamespace is the namespace where the workloads should get synced to. targetNamespace: "" + # SetOwner specifies if vCluster should set an owner reference on the synced objects to the vCluster service. This allows for easy garbage collection. setOwner: true - + + # IsolatedControlPlane is a feature to run the vCluster control plane in a different Kubernetes cluster than the workloads themselves. isolatedControlPlane: + # Headless states that Helm should deploy the vCluster in headless mode for the isolated control plane. headless: false - + + # Deploy allows you to configure manifests and Helm charts to deploy within the virtual cluster. deploy: + # Manifests are raw Kubernetes manifests that should get applied within the virtual cluster. manifests: "" + # ManifestsTemplate is a Kubernetes manifest template that will be rendered with vCluster values before applying it within the virtual cluster. manifestsTemplate: '' + # Helm are Helm charts that should get deployed into the virtual cluster helm: [] - + + # GenericSync holds options to generically sync resources from virtual cluster to host. genericSync: clusterRole: extraRules: [] role: extraRules: [] +# Platform holds options for connecting to vCluster Platform. platform: + # APIKey defines how vCluster can find the api key used for the platform. apiKey: + # Value specifies the api key as a regular text value. value: "" + # SecretRef defines where to find the platform api key. By default vCluster will search in the following locations in this precedence: + # * platform.apiKey.value + # * environment variable called LICENSE + # * secret specified under platform.secret.name + # * secret called "vcluster-platform-api-key" in the vCluster namespace secretRef: + # Name is the name of the secret where the platform api key is stored. This defaults to vcluster-platform-api-key if undefined. name: "" + # Namespace defines the namespace where the api key secret should be retrieved from. If this is not equal to the namespace + # where the vCluster instance is deployed, you need to make sure vCluster has access to this other namespace. namespace: "" +# Configuration related to telemetry gathered about vCluster usage. telemetry: + # Enabled specifies that the telemetry for the vCluster control plane should be enabled. enabled: true diff --git a/config/config.go b/config/config.go index 625b8bb47..38e9f97eb 100644 --- a/config/config.go +++ b/config/config.go @@ -424,13 +424,13 @@ type RBACPolicyRule struct { } type ControlPlane struct { - // Distro holds virtual cluster related distro options. + // Distro holds virtual cluster related distro options. A distro cannot be changed after vCluster is deployed. Distro Distro `json:"distro,omitempty"` - // BackingStore defines which backing store to use for virtual cluster. If not defined will fallback to the default distro backing store. + // BackingStore defines which backing store to use for virtual cluster. If not defined will use embedded database as a default backing store. BackingStore BackingStore `json:"backingStore,omitempty"` - // CoreDNS defines everything coredns related. + // CoreDNS defines everything related to the coredns that is deployed and used within the vCluster. CoreDNS CoreDNS `json:"coredns,omitempty"` // Proxy defines options for the virtual cluster control plane proxy that is used to do authentication and intercept requests. @@ -476,7 +476,7 @@ type ControlPlaneStatefulSet struct { LabelsAndAnnotations `json:",inline"` - // Pods are additional labels or annotations for the statefulSet pod. + // Additional labels or annotations for the statefulSet pods. Pods LabelsAndAnnotations `json:"pods,omitempty"` // Image is the image for the controlPlane statefulSet container @@ -499,15 +499,15 @@ type ControlPlaneStatefulSet struct { } type Distro struct { + // K8S holds K8s relevant configuration. + K8S DistroK8s `json:"k8s,omitempty"` + // K3S holds K3s relevant configuration. K3S DistroK3s `json:"k3s,omitempty"` // K0S holds k0s relevant configuration. K0S DistroK0s `json:"k0s,omitempty"` - // K8S holds K8s relevant configuration. - K8S DistroK8s `json:"k8s,omitempty"` - // EKS holds eks relevant configuration. EKS DistroK8s `json:"eks,omitempty"` } @@ -530,10 +530,10 @@ type DistroK8s struct { // APIServer holds configuration specific to starting the api server. APIServer DistroContainerEnabled `json:"apiServer,omitempty"` - // ControllerManager holds configuration specific to starting the scheduler. + // ControllerManager holds configuration specific to starting the controller manager. ControllerManager DistroContainerEnabled `json:"controllerManager,omitempty"` - // Scheduler holds configuration specific to starting the scheduler. Enable this via controlPlane.virtualScheduler.enabled + // Scheduler holds configuration specific to starting the scheduler. Enable this via controlPlane.advanced.virtualScheduler.enabled Scheduler DistroContainer `json:"scheduler,omitempty"` DistroCommon `json:",inline"` @@ -551,13 +551,13 @@ type DistroK0s struct { } type DistroCommon struct { - // Env are extra environment variables to use for the main container. + // Env are extra environment variables to use for the main container and NOT the init container. Env []map[string]interface{} `json:"env,omitempty"` - // Resources are the resources for the distro init container + // Resources for the distro init container Resources map[string]interface{} `json:"resources,omitempty"` - // SecurityContext can be used for the distro init container + // Security options can be used for the distro init container SecurityContext map[string]interface{} `json:"securityContext,omitempty"` } @@ -600,11 +600,8 @@ type Image struct { Tag string `json:"tag,omitempty"` } -// LocalObjectReference contains enough information to let you locate the -// referenced object inside the same namespace. -type LocalObjectReference struct { - // Name of the referent. - // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names +type ImagePullSecretName struct { + // Name of the image pull secret to use. Name string `json:"name,omitempty"` } @@ -629,7 +626,7 @@ type BackingStore struct { // Etcd defines that etcd should be used as the backend for the virtual cluster Etcd Etcd `json:"etcd,omitempty"` - // Database defines that a database backend should be used as the backend for the virtual cluster + // Database defines that a database backend should be used as the backend for the virtual cluster. This uses a project called kine under the hood which is a shim for bridging Kubernetes and relational databases. Database Database `json:"database,omitempty"` } @@ -645,7 +642,10 @@ type DatabaseKine struct { // Enabled defines if the database should be used. Enabled bool `json:"enabled,omitempty"` - // DataSource is the kine dataSource to use for the database. This depends on the database format. This is optional for the embedded database. + // DataSource is the kine dataSource to use for the database. This depends on the database format. + // This is optional for the embedded database. Examples: + // * mysql: mysql://username:password@tcp(hostname:3306)/k3s + // * postgres: postgres://username:password@hostname:5432/k3s DataSource string `json:"dataSource,omitempty"` // KeyFile is the key file to use for the database. This is optional. @@ -766,7 +766,7 @@ type CoreDNS struct { // Enabled defines if coredns is enabled Enabled bool `json:"enabled,omitempty"` - // Embedded defines if vCluster will start the embedded coredns service + // Embedded defines if vCluster will start the embedded coredns service within the control-plane and not as a separate deployment. This is a PRO feature. Embedded bool `json:"embedded,omitempty" product:"pro"` // Service holds extra options for the coredns service deployed within the virtual cluster @@ -812,7 +812,7 @@ type ControlPlaneProxy struct { // BindAddress under which vCluster will expose the proxy. BindAddress string `json:"bindAddress,omitempty"` - // Port under which vCluster will expose the proxy. + // Port under which vCluster will expose the proxy. Changing port is currently not supported. Port int `json:"port,omitempty"` // ExtraSANs are extra hostnames to sign the vCluster proxy certificate for. @@ -1015,7 +1015,7 @@ type ControlPlaneServiceAccount struct { Name string `json:"name,omitempty"` // ImagePullSecrets defines extra image pull secrets for the service account. - ImagePullSecrets []LocalObjectReference `json:"imagePullSecrets,omitempty"` + ImagePullSecrets []ImagePullSecretName `json:"imagePullSecrets,omitempty"` // Annotations are extra annotations for this resource. Annotations map[string]string `json:"annotations,omitempty"` @@ -1032,7 +1032,7 @@ type ControlPlaneWorkloadServiceAccount struct { Name string `json:"name,omitempty"` // ImagePullSecrets defines extra image pull secrets for the workload service account. - ImagePullSecrets []LocalObjectReference `json:"imagePullSecrets,omitempty"` + ImagePullSecrets []ImagePullSecretName `json:"imagePullSecrets,omitempty"` // Annotations are extra annotations for this resource. Annotations map[string]string `json:"annotations,omitempty"` @@ -1675,74 +1675,38 @@ type PatchSync struct { type DenyRule struct { // The name of the check. - // +optional Name string `json:"name,omitempty"` // Namespace describe a list of namespaces that will be affected by the check. // An empty list means that all namespaces will be affected. // In case of ClusterScoped rules, only the Namespace resource is affected. - // +optional Namespaces []string `json:"namespaces,omitempty"` // Rules describes on which verbs and on what resources/subresources the webhook is enforced. // The webhook is enforced if it matches any Rule. // The version of the request must match the rule version exactly. Equivalent matching is not supported. - // +optional Rules []RuleWithVerbs `json:"rules,omitempty"` // ExcludedUsers describe a list of users for which the checks will be skipped. // Impersonation attempts on these users will still be subjected to the checks. - // +optional ExcludedUsers []string `json:"excludedUsers,omitempty"` } type RuleWithVerbs struct { // APIGroups is the API groups the resources belong to. '*' is all groups. - // If '*' is present, the length of the slice must be one. - // Required. - // +listType=atomic APIGroups []string `json:"apiGroups,omitempty" protobuf:"bytes,1,rep,name=apiGroups"` // APIVersions is the API versions the resources belong to. '*' is all versions. - // If '*' is present, the length of the slice must be one. - // Required. - // +listType=atomic APIVersions []string `json:"apiVersions,omitempty" protobuf:"bytes,2,rep,name=apiVersions"` // Resources is a list of resources this rule applies to. - // - // For example: - // 'pods' means pods. - // 'pods/log' means the log subresource of pods. - // '*' means all resources, but not subresources. - // 'pods/*' means all subresources of pods. - // '*/scale' means all scale subresources. - // '*/*' means all resources and their subresources. - // - // If wildcard is present, the validation rule will ensure resources do not - // overlap with each other. - // - // Depending on the enclosing object, subresources might not be allowed. - // Required. - // +listType=atomic Resources []string `json:"resources,omitempty" protobuf:"bytes,3,rep,name=resources"` - // scope specifies the scope of this rule. - // Valid values are "Cluster", "Namespaced", and "*" - // "Cluster" means that only cluster-scoped resources will match this rule. - // Namespace API objects are cluster-scoped. - // "Namespaced" means that only namespaced resources will match this rule. - // "*" means that there are no scope restrictions. - // Subresources match the scope of their parent resource. - // Default is "*". - // - // +optional + // Scope specifies the scope of this rule. Scope *string `json:"scope,omitempty" protobuf:"bytes,4,rep,name=scope"` // Verb is the kube verb associated with the request for API requests, not the http verb. This includes things like list and watch. // For non-resource requests, this is the lowercase http verb. // If '*' is present, the length of the slice must be one. - // Required. - // +listType=atomic Verbs []string `json:"operations,omitempty"` } diff --git a/config/values.yaml b/config/values.yaml index 85f0ccaed..79d258809 100644 --- a/config/values.yaml +++ b/config/values.yaml @@ -1,4 +1,6 @@ -# Sync Options +# DO NOT ADD ANY COMMENTS TO THIS FILE. +# Comments are added automatically in the hack/schema/main.go script according to the type defined in config.go +# If you want to change or add any comment, please change/add it in the config.go and rerun hack/schema/main.go sync: toHost: services: @@ -59,45 +61,8 @@ sync: all: false labels: {} -# Control Plane Options controlPlane: - # What distro to use for vCluster, if none is specified, k8s is used distro: - k3s: - enabled: false - command: [] - extraArgs: [] - imagePullPolicy: "" - image: - repository: "rancher/k3s" - tag: "v1.29.0-k3s1" - securityContext: {} - resources: - limits: - cpu: 100m - memory: 256Mi - requests: - cpu: 40m - memory: 64Mi - - k0s: - enabled: false - config: "" - command: [] - extraArgs: [] - imagePullPolicy: "" - image: - repository: "k0sproject/k0s" - tag: "v1.29.1-k0s.0" - securityContext: {} - resources: - limits: - cpu: 100m - memory: 256Mi - requests: - cpu: 40m - memory: 64Mi - k8s: enabled: false apiServer: @@ -133,6 +98,41 @@ controlPlane: cpu: 40m memory: 64Mi + k3s: + enabled: false + command: [] + extraArgs: [] + imagePullPolicy: "" + image: + repository: "rancher/k3s" + tag: "v1.29.0-k3s1" + securityContext: {} + resources: + limits: + cpu: 100m + memory: 256Mi + requests: + cpu: 40m + memory: 64Mi + + k0s: + enabled: false + config: "" + command: [] + extraArgs: [] + imagePullPolicy: "" + image: + repository: "k0sproject/k0s" + tag: "v1.29.1-k0s.0" + securityContext: {} + resources: + limits: + cpu: 100m + memory: 256Mi + requests: + cpu: 40m + memory: 64Mi + eks: enabled: false apiServer: @@ -172,15 +172,12 @@ controlPlane: database: embedded: enabled: false - # Optional sqlite dataSource - # dataSource: "" external: enabled: false dataSource: "" - # Optional database certificates - # certFile: "" - # keyFile: "" - # caFile: "" + certFile: "" + keyFile: "" + caFile: "" etcd: embedded: enabled: false @@ -219,7 +216,6 @@ controlPlane: persistence: volumeClaim: enabled: true - # Defines if the PVC should get automatically deleted when the StatefulSet is deleted. Can be either Delete or Retain retentionPolicy: Retain size: 5Gi storageClass: "" @@ -244,13 +240,11 @@ controlPlane: embedded: false overwriteManifests: "" overwriteConfig: "" - service: annotations: {} labels: {} spec: type: ClusterIP - deployment: annotations: {} labels: {} @@ -331,7 +325,6 @@ controlPlane: persistence: volumeClaim: enabled: auto - # Defines if the PVC should get automatically deleted when the StatefulSet is deleted. Can be either Delete or Retain retentionPolicy: Retain size: 5Gi storageClass: "" @@ -405,7 +398,6 @@ observability: pods: false networking: - # Embedded CoreDNS plugin config replicateServices: toHost: [] fromHost: [] @@ -474,7 +466,6 @@ policies: validatingWebhooks: [] mutatingWebhooks: [] -# Export vCluster Kube Config exportKubeConfig: context: "" server: "" @@ -482,10 +473,8 @@ exportKubeConfig: name: "" namespace: "" -# What plugins should get used plugins: {} -# Functionality that is likely to change, use with caution! experimental: multiNamespaceMode: enabled: false diff --git a/hack/schema/main.go b/hack/schema/main.go index c75379186..1be382791 100644 --- a/hack/schema/main.go +++ b/hack/schema/main.go @@ -1,24 +1,43 @@ package main import ( + "bytes" "encoding/json" + "fmt" "os" "path/filepath" + "strings" "github.com/invopop/jsonschema" "github.com/loft-sh/vcluster/config" + "gopkg.in/yaml.v3" ) const OutFile = "chart/values.schema.json" const ValuesOutFile = "chart/values.yaml" +var SkipProperties = map[string]string{ + "EnableSwitch": "*", + "SyncAllResource": "enabled", + "DistroContainerEnabled": "enabled", + "EtcdDeployService": "*", + "EtcdDeployHeadlessService": "*", + "LabelsAndAnnotations": "*", +} + +var SkipKeys = map[string]bool{ + "annotations": true, + "labels": true, +} + // Run executes the command logic func main() { - generatedSchema, err := generateSchema(&config.Config{}) + reflector, err := getReflector() if err != nil { panic(err) } + generatedSchema := reflector.Reflect(&config.Config{}) transformMapProperties(generatedSchema) modifySchema(generatedSchema, cleanUp) err = writeSchema(generatedSchema, OutFile) @@ -26,13 +45,97 @@ func main() { panic(err) } - err = os.WriteFile(ValuesOutFile, []byte(config.Values), 0666) + err = writeValues(generatedSchema) if err != nil { panic(err) } } -func generateSchema(configInstance interface{}) (*jsonschema.Schema, error) { +func writeValues(schema *jsonschema.Schema) error { + yamlNode := &yaml.Node{} + err := yaml.Unmarshal([]byte(config.Values), yamlNode) + if err != nil { + return err + } + + // traverse yaml nodes + err = traverseNode(yamlNode, schema, schema.Definitions, 0) + if err != nil { + return fmt.Errorf("traverse node: %w", err) + } + + b := &bytes.Buffer{} + enc := yaml.NewEncoder(b) + enc.SetIndent(2) + err = enc.Encode(yamlNode) + if err != nil { + return err + } + + err = os.WriteFile(ValuesOutFile, b.Bytes(), 0666) + if err != nil { + return err + } + + return nil +} + +func traverseNode(node *yaml.Node, schema *jsonschema.Schema, definitions jsonschema.Definitions, depth int) error { + if node.Kind == yaml.MappingNode { + // next nodes are key: value, key: value + if len(node.Content)%2 != 0 { + return fmt.Errorf("unexpected amount of children: %d", len(node.Content)) + } + + // loop over content + for i := 0; i < len(node.Content); i += 2 { + key := node.Content[i].Value + value := node.Content[i+1] + + // find properties + properties := schema.Properties + ref := strings.TrimPrefix(schema.Ref, "#/$defs/") + if ref != "" { + refSchema, ok := definitions[ref] + if ok { + properties = refSchema.Properties + } + } + if properties == nil || SkipProperties[ref] == key || SkipProperties[ref] == "*" || SkipKeys[key] { + continue + } + + // get property + valueSchema, ok := properties.Get(key) + if ok { + // set comment + node.Content[i].HeadComment = valueSchema.Description + + // add new line if property on level 0 + if i > 0 && depth < 2 { + node.Content[i].HeadComment = "\n" + node.Content[i].HeadComment + } + + // next node + err := traverseNode(value, valueSchema, definitions, depth+1) + if err != nil { + return err + } + } + } + } else { + for _, child := range node.Content { + err := traverseNode(child, schema, definitions, depth) + if err != nil { + return err + } + } + } + + return nil +} + +func getReflector() (*jsonschema.Reflector, error) { r := new(jsonschema.Reflector) r.RequiredFromJSONSchemaTags = true r.BaseSchemaID = "https://vcluster.com/schemas" @@ -46,8 +149,7 @@ func generateSchema(configInstance interface{}) (*jsonschema.Schema, error) { } r.CommentMap = commentMap - - return r.Reflect(configInstance), nil + return r, nil } func writeSchema(schema *jsonschema.Schema, schemaFile string) error { diff --git a/pkg/config/legacyconfig/config.go b/pkg/config/legacyconfig/config.go index 476fdc574..c5a730a93 100644 --- a/pkg/config/legacyconfig/config.go +++ b/pkg/config/legacyconfig/config.go @@ -93,9 +93,9 @@ type BaseHelm struct { Proxy ProxyValues `json:"proxy,omitempty"` Volumes []map[string]interface{} `json:"volumes,omitempty"` ServiceAccount struct { - Create *bool `json:"create,omitempty"` - Name string `json:"name,omitempty"` - ImagePullSecrets []config.LocalObjectReference `json:"imagePullSecrets"` + Create *bool `json:"create,omitempty"` + Name string `json:"name,omitempty"` + ImagePullSecrets []config.ImagePullSecretName `json:"imagePullSecrets"` } `json:"serviceAccount,omitempty"` WorkloadServiceAccount struct { Annotations map[string]string `json:"annotations,omitempty"`