mirror of
https://github.com/gravitational/teleport.git
synced 2026-10-12 02:15:01 +00:00
Add chart for the Relay service (#59454)
* Chart yaml, values and helpers * address comments * autogenerated reference docs * add missing extra labels and annotations for the service * admonition formatting * version and image helpers * join secret name helper * resources * update reference * add linting * Add helm unittests * Allow custom key for the trusted CA bundle secret * Remove check for negative replicaCount value * Clean up .lint/full.yaml and fill it in a bit more * Fix selector labels indentation in PDB * Redo tests avoiding snapshots * Update exercise-configmap to render the whole chart for linting
This commit is contained in:
Edoardo Spadolini
@@ -904,6 +904,7 @@ helmunit/installed:
|
||||
test-helm: helmunit/installed
|
||||
helm unittest -3 --with-subchart=false examples/chart/teleport-cluster
|
||||
helm unittest -3 --with-subchart=false examples/chart/teleport-kube-agent
|
||||
helm unittest -3 --with-subchart=false examples/chart/teleport-relay
|
||||
helm unittest -3 --with-subchart=false examples/chart/teleport-cluster/charts/teleport-operator
|
||||
helm unittest -3 --with-subchart=false examples/chart/access/*
|
||||
helm unittest -3 --with-subchart=false examples/chart/event-handler
|
||||
@@ -913,6 +914,7 @@ test-helm: helmunit/installed
|
||||
test-helm-update-snapshots: helmunit/installed
|
||||
helm unittest -3 -u --with-subchart=false examples/chart/teleport-cluster
|
||||
helm unittest -3 -u --with-subchart=false examples/chart/teleport-kube-agent
|
||||
helm unittest -3 -u --with-subchart=false examples/chart/teleport-relay
|
||||
helm unittest -3 -u --with-subchart=false examples/chart/teleport-cluster/charts/teleport-operator
|
||||
helm unittest -3 -u --with-subchart=false examples/chart/access/*
|
||||
helm unittest -3 -u --with-subchart=false examples/chart/event-handler
|
||||
@@ -1326,7 +1328,7 @@ lint-helm:
|
||||
if [ "$${CI}" = "true" ]; then echo "This is a failure when running in CI." && exit 1; fi; \
|
||||
exit 0; \
|
||||
fi; \
|
||||
for CHART in ./examples/chart/teleport-cluster ./examples/chart/teleport-kube-agent ./examples/chart/teleport-cluster/charts/teleport-operator ./examples/chart/tbot; do \
|
||||
for CHART in ./examples/chart/teleport-cluster ./examples/chart/teleport-kube-agent ./examples/chart/teleport-relay ./examples/chart/teleport-cluster/charts/teleport-operator ./examples/chart/tbot; do \
|
||||
if [ -d $${CHART}/.lint ]; then \
|
||||
for VALUES in $${CHART}/.lint/*.yaml; do \
|
||||
export HELM_TEMP=$$(mktemp); \
|
||||
@@ -1335,6 +1337,7 @@ lint-helm:
|
||||
helm lint --quiet --strict $${CHART} -f $${VALUES} || exit 1; \
|
||||
helm template test $${CHART} -f $${VALUES} 1>$${HELM_TEMP} || exit 1; \
|
||||
yamllint -c examples/chart/.lint-config.yaml $${HELM_TEMP} || { cat -en $${HELM_TEMP}; exit 1; }; \
|
||||
echo; \
|
||||
done \
|
||||
else \
|
||||
export HELM_TEMP=$$(mktemp); \
|
||||
|
||||
@@ -0,0 +1,897 @@
|
||||
|
||||
{/* Generated file. Do not edit.*/}
|
||||
{/* Generate this file by navigating to examples/chart and running make render-chart-ref*/}
|
||||
## `relayGroup`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `string` | `""` |
|
||||
|
||||
`relayGroup` sets the internal identifier for the group of Relay
|
||||
instances reachable through the same load balancer. Should be unique in the
|
||||
whole Teleport cluster.
|
||||
|
||||
## `publicHostnames`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `list` | `[]` |
|
||||
|
||||
`publicHostnames` a list of hostnames that this Relay group is publicly
|
||||
reachable at by clients.
|
||||
|
||||
```
|
||||
publicHostnames:
|
||||
- relay.example.com
|
||||
```
|
||||
|
||||
## `targetConnectionCount`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `int` | `2` |
|
||||
|
||||
`targetConnectionCount` the amount of tunnel connections that agents
|
||||
will open to distinct Relay instances. It should not be bigger than the
|
||||
replica count.
|
||||
|
||||
## `proxyAddr`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `string` | `""` |
|
||||
|
||||
`proxyAddr` provides the public-facing Teleport Proxy Service
|
||||
endpoint which should be used to join the cluster. This is the same URL used
|
||||
to access the web UI of your Teleport cluster. The port used is usually either
|
||||
3080 or 443.
|
||||
|
||||
Here are a few examples:
|
||||
|
||||
| Deployment method | Example `proxy_service.public_addr` |
|
||||
|-------------------------------|-------------------------------------|
|
||||
| On-prem Teleport cluster | `teleport.example.com:3080` |
|
||||
| Teleport Cloud cluster | `example.teleport.sh:443` |
|
||||
| `teleport-cluster` Helm chart | `teleport.example.com:443` |
|
||||
|
||||
## `enterprise`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `bool` | `false` |
|
||||
|
||||
`enterprise` controls if the `teleport-relay` chart should deploy the
|
||||
OSS version or the enterprise version of the container image. This must be set
|
||||
to `true` when connecting to Teleport Cloud or self-hosted Teleport Enterprise
|
||||
clusters to allow the agent to leverage enterprise features.
|
||||
|
||||
## `joinParams`
|
||||
|
||||
`joinParams` controls how the Teleport Agent joins the Teleport cluster.
|
||||
These sub-values must be configured for the agent to connect to a cluster.
|
||||
|
||||
The token used must grant the `Relay` role, and should be valid for the
|
||||
lifetime of the Helm release.
|
||||
|
||||
### `joinParams.method`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `string` | `""` |
|
||||
|
||||
`joinParams.method` controls which join method will be used by the
|
||||
instance to join the Teleport cluster.
|
||||
|
||||
See [the join method reference](../../reference/deployment/join-methods.mdx)
|
||||
for the list of possible values, the implications of each join method, and
|
||||
guides to set up each method.
|
||||
|
||||
Common join-methods for the `teleport-relay` are:
|
||||
- `token`: the most basic one, with regular ephemeral secret tokens
|
||||
- `kubernetes`: either the `in-cluster` variant (if the agent runs in the
|
||||
same Kubernetes cluster as the `teleport-cluster` chart) or the
|
||||
`JWKS/OIDC` variants (work in every Kubernetes cluster, regardless of the
|
||||
Teleport Auth Service location).
|
||||
|
||||
### `joinParams.tokenName`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `string` | `""` |
|
||||
|
||||
`joinParams.tokenName` controls which token is used by the agent to
|
||||
join the Teleport cluster.
|
||||
|
||||
When `joinParams.method` is [a delegated join
|
||||
method](../../reference/deployment/join-methods.mdx#delegated-join-methods),
|
||||
the value is not sensitive.
|
||||
|
||||
When `joinParams.method` is `token` (by default), `joinParams.tokenName`
|
||||
contains the secret token itself. In this case, the value is sensitive and
|
||||
is automatically stored in a Kubernetes Secret instead of being directly
|
||||
included in the agent's configuration.
|
||||
|
||||
If method is `token`, `joinParams.tokenName` can be empty if the token is
|
||||
provided through an existing Kubernetes Secret, see
|
||||
[`joinTokenSecret`](#joinTokenSecret) for more details and instructions.
|
||||
|
||||
If method is `kubernetes`, you must set
|
||||
[`teleportClusterName`](#teleportClusterName).
|
||||
|
||||
## `teleportClusterName`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `string` | `""` |
|
||||
|
||||
`teleportClusterName` is the name of the joined Teleport cluster.
|
||||
Setting this value is required when joining via the
|
||||
[Kubernetes JWKS or OIDC](../../reference/deployment/join-methods.mdx#kubernetes-jwks) join method.
|
||||
|
||||
When this value is set, the chart mounts a kubernetes service account token
|
||||
via a projected volume and configures Teleport to use it for joining.
|
||||
|
||||
## `joinTokenSecret`
|
||||
|
||||
`joinTokenSecret` manages the join token secret creation and its name. See
|
||||
the [`joinParams`](#joinParams) section for more details.
|
||||
|
||||
### `joinTokenSecret.create`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `bool` | `true` |
|
||||
|
||||
`joinTokenSecret.create` controls whether the chart creates the
|
||||
Kubernetes `Secret` containing the Teleport join token. If false, you must
|
||||
create a Kubernetes Secret with the configured name in the Helm release
|
||||
namespace.
|
||||
|
||||
### `joinTokenSecret.name`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `string` | `""` |
|
||||
|
||||
`joinTokenSecret.name` is the name of the Kubernetes Secret
|
||||
containing the Teleport join token used by the chart.
|
||||
|
||||
If `joinTokenSecret.create` is `false`, the chart will not attempt to create
|
||||
the secret itself. Instead, it will read the value from an existing secret.
|
||||
`joinTokenSecret.name` configures the name of this secret. This allows you
|
||||
to configure this secret externally and avoid having a plaintext join token
|
||||
stored in your Teleport chart values.
|
||||
|
||||
To create your own join token secret, you can use a command like this:
|
||||
|
||||
```code
|
||||
$ kubectl --namespace teleport create secret generic my-token-secret --from-literal=auth-token=<replace-with-actual-token>
|
||||
```
|
||||
|
||||
<Admonition type="note">
|
||||
|
||||
The key used for the auth token inside the secret must be `auth-token`, as
|
||||
in the command above.
|
||||
|
||||
</Admonition>
|
||||
|
||||
```yaml
|
||||
joinTokenSecret:
|
||||
create: false
|
||||
name: my-token-secret
|
||||
|
||||
joinParams:
|
||||
method: "token"
|
||||
tokenName: ""
|
||||
```
|
||||
|
||||
## `proxyProtocol`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `bool` | `false` |
|
||||
|
||||
`proxyProtocol` controls whether or not the connections coming from the
|
||||
load balancer will include a PROXY protocol v2 header.
|
||||
|
||||
## `log`
|
||||
|
||||
`log` controls the agent logging.
|
||||
|
||||
### `log.level`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `string` | `"INFO"` |
|
||||
|
||||
`log.level` is the log level for the Teleport process.
|
||||
Available log levels are: `DEBUG`, `INFO`, `WARNING`, `ERROR`.
|
||||
|
||||
The default is `INFO`, which is recommended in production.
|
||||
`DEBUG` is useful during first-time setup or to see more detailed logs for debugging.
|
||||
|
||||
### `log.format`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `string` | `"json"` |
|
||||
|
||||
`log.format` sets the log output format for the Teleport process.
|
||||
Possible values are `text` or `json`.
|
||||
|
||||
## `preStopDelay`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `string` | `"30s"` |
|
||||
|
||||
`preStopDelay` the optional time that will pass between the pod
|
||||
entering the Terminating state and the Teleport instance getting signaled to
|
||||
begin its shutdown advertisement. Useful to allow load balancers to stop
|
||||
routing connections to the terminating pod.
|
||||
|
||||
## `shutdownDelay`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `string` | `"30s"` |
|
||||
|
||||
`shutdownDelay` the optional time that the Teleport instance will
|
||||
wait after advertising its shutdown and before it will stop serving new
|
||||
inbound connections.
|
||||
|
||||
## `terminationGracePeriodSeconds`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `int` | `90` |
|
||||
|
||||
`terminationGracePeriodSeconds` the time allotted to a Teleport instance
|
||||
pod for termination. It should be longer than the sum of
|
||||
[`preStopDelay`](#preStopDelay) and [`shutdownDelay`](#shutdownDelay).
|
||||
|
||||
## `highAvailability`
|
||||
|
||||
`highAvailability` contains settings controlling the availability of the
|
||||
Teleport Agent deployed by the chart.
|
||||
|
||||
The availability can be increased by:
|
||||
- running more replicas with `replicaCount`
|
||||
- requiring that the Pods are not scheduled on the same Kubernetes Node with `requireAntiAffinity`
|
||||
- by asking Kubernetes not to delete all pods at the same time with `podDisruptionBudget`.
|
||||
|
||||
Even with highAvailability settings Restarting/rolling-out pods can still cause
|
||||
disruption for established long-lived sessions.
|
||||
|
||||
### `highAvailability.replicaCount`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `int` | `2` |
|
||||
|
||||
`highAvailability.replicaCount` is the number of agent replicas
|
||||
deployed by the Chart.
|
||||
|
||||
Set to a number higher than `1` for a high availability mode where multiple
|
||||
Teleport pods will be deployed.
|
||||
|
||||
<Admonition type="tip" title="Sizing guidelines">
|
||||
|
||||
As a rough guide, we recommend configuring one replica per distinct
|
||||
availability zone where your cluster has worker nodes.
|
||||
|
||||
2 replicas/availability zones will be fine for smaller workloads. 3-5
|
||||
replicas/availability zones will be more appropriate for bigger clusters
|
||||
with more traffic.
|
||||
|
||||
</Admonition>
|
||||
|
||||
### `highAvailability.podDisruptionBudget`
|
||||
|
||||
`highAvailability.podDisruptionBudget` controls how the chart creates and
|
||||
configures a Kubernetes PodDisruptionBudget to ensure Kubernetes does not
|
||||
delete all agent replicas at the same time.
|
||||
|
||||
#### `highAvailability.podDisruptionBudget.enabled`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `bool` | `false` |
|
||||
|
||||
`highAvailability.podDisruptionBudget.enabled` makes the chart create
|
||||
a Kubernetes PodDisruptionBudget for the agent pods.
|
||||
|
||||
#### `highAvailability.podDisruptionBudget.minAvailable`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `intOrString` | `1` |
|
||||
|
||||
`highAvailability.podDisruptionBudget.minAvailable` is the
|
||||
minimum available pod count specified on the PodDisruptionBudget.
|
||||
|
||||
## `resources`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `object` | `{}` |
|
||||
|
||||
`resources` sets the resource requests/limits for any pods created by
|
||||
the chart. See [the Kubernetes
|
||||
documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)
|
||||
for more details.
|
||||
|
||||
## `service`
|
||||
|
||||
`service` options for the Service that points to the Teleport Relay
|
||||
instances.
|
||||
|
||||
### `service.type`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `string` | `"LoadBalancer"` |
|
||||
|
||||
`service.type` the type of the Service. Unless you have specific
|
||||
needs, it should probably be set to LoadBalancer.
|
||||
|
||||
### `service.spec`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `object` | `{}` |
|
||||
|
||||
`service.spec` any additional entries here will be added to the
|
||||
Service spec.
|
||||
|
||||
```
|
||||
spec:
|
||||
loadBalancerIP: "1.2.3.4"
|
||||
loadBalancerClass: service.k8s.aws/nlb
|
||||
```
|
||||
|
||||
## `serviceAccount`
|
||||
|
||||
`serviceAccount` contains settings related to the Kubernetes service account
|
||||
used by pods.
|
||||
|
||||
### `serviceAccount.create`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `bool` | `true` |
|
||||
|
||||
`serviceAccount.create` specifies whether a `ServiceAccount` should
|
||||
be created or if an existing one should be used.
|
||||
|
||||
### `serviceAccount.name`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `string` | `""` |
|
||||
|
||||
`serviceAccount.name` the name of the `ServiceAccount` to use. If
|
||||
not set and serviceAccount.create is true, the name is generated using the
|
||||
release name. If create is false, the name will be used to reference an
|
||||
existing service account.
|
||||
|
||||
## `extraLabels`
|
||||
|
||||
`extraLabels` contains additional Kubernetes labels to apply on the resources
|
||||
created by the chart. See [the Kubernetes label documentation
|
||||
](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)
|
||||
for more information.
|
||||
|
||||
### `extraLabels.config`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `object` | `{}` |
|
||||
|
||||
`extraLabels.config` are labels to set on the ConfigMap.
|
||||
|
||||
### `extraLabels.deployment`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `object` | `{}` |
|
||||
|
||||
`extraLabels.deployment` are labels to set on the Deployment.
|
||||
|
||||
### `extraLabels.pod`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `object` | `{}` |
|
||||
|
||||
`extraLabels.pod` are labels to set on the Pods.
|
||||
|
||||
### `extraLabels.podDisruptionBudget`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `object` | `{}` |
|
||||
|
||||
`extraLabels.podDisruptionBudget` are labels to set on the
|
||||
PodDisruptionBudget.
|
||||
|
||||
### `extraLabels.secret`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `object` | `{}` |
|
||||
|
||||
`extraLabels.secret` are labels to set on the Secret.
|
||||
|
||||
### `extraLabels.service`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `object` | `{}` |
|
||||
|
||||
`extraLabels.service` are labels to set on the Service.
|
||||
|
||||
### `extraLabels.serviceAccount`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `object` | `{}` |
|
||||
|
||||
`extraLabels.serviceAccount` are labels to set on the
|
||||
ServiceAccount.
|
||||
|
||||
## `annotations`
|
||||
|
||||
`annotations` contains annotations to apply to the different Kubernetes
|
||||
objects created by the chart. See [the Kubernetes annotation
|
||||
documentation](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
|
||||
for more details.
|
||||
|
||||
### `annotations.config`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `object` | `{}` |
|
||||
|
||||
`annotations.config` are annotations to set on the ConfigMap.
|
||||
|
||||
### `annotations.deployment`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `object` | `{}` |
|
||||
|
||||
`annotations.deployment` are annotations to set on the Deployment.
|
||||
|
||||
### `annotations.pod`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `object` | `{}` |
|
||||
|
||||
`annotations.pod` are annotations to set on the Pods.
|
||||
|
||||
### `annotations.podDisruptionBudget`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `object` | `{}` |
|
||||
|
||||
`annotations.podDisruptionBudget` are annotations to set on the
|
||||
podDisruptionBudget.
|
||||
|
||||
### `annotations.secret`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `object` | `{}` |
|
||||
|
||||
`annotations.secret` are annotations to set on the Secret.
|
||||
|
||||
### `annotations.service`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `object` | `{}` |
|
||||
|
||||
`annotations.service` are annotations to set on the Service.
|
||||
|
||||
### `annotations.serviceAccount`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `object` | `{}` |
|
||||
|
||||
`annotations.serviceAccount` are annotations to set on the
|
||||
ServiceAccount.
|
||||
|
||||
## `image`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `string` | `"public.ecr.aws/gravitational/teleport-distroless"` |
|
||||
|
||||
`image` sets the container image used for Teleport Community Edition
|
||||
Agent pods created by the chart.
|
||||
|
||||
You can override this to use your own Teleport image rather than a
|
||||
Teleport-published image.
|
||||
|
||||
By default, the image contains only the Teleport application and its runtime
|
||||
dependencies, and does not contain a shell.
|
||||
|
||||
This setting only takes effect when [`enterprise`](#enterprise) is `false`.
|
||||
When running an enterprise version, you must use
|
||||
[`enterpriseImage`](#enterpriseImage) instead.
|
||||
|
||||
## `enterpriseImage`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `string` | `"public.ecr.aws/gravitational/teleport-ent-distroless"` |
|
||||
|
||||
`enterpriseImage` sets the container image used for Teleport Enterprise
|
||||
agent pods created by the chart.
|
||||
|
||||
You can override this to use your own Teleport image rather than a
|
||||
Teleport-published image.
|
||||
|
||||
By default, the image contains only the Teleport application and its runtime
|
||||
dependencies, and does not contain a shell.
|
||||
|
||||
This setting only takes effect when [`enterprise`](#enterprise) is `true`.
|
||||
When running an enterprise version, you must use [`image`](#image) instead.
|
||||
|
||||
## `imagePullSecrets`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `list` | `[]` |
|
||||
|
||||
`imagePullSecrets` is a list of secrets containing authorization tokens
|
||||
which can be optionally used to access a private Docker registry.
|
||||
|
||||
See the [Kubernetes
|
||||
reference](https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod)
|
||||
for more details.
|
||||
|
||||
## `imagePullPolicy`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `string` | `"IfNotPresent"` |
|
||||
|
||||
`imagePullPolicy` sets the pull policy for any pods created by the
|
||||
chart. See [the Kubernetes
|
||||
documentation](https://kubernetes.io/docs/concepts/containers/images/#updating-images)
|
||||
for more details.
|
||||
|
||||
## `topologySpreadConstraints`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `list` | `[]` |
|
||||
|
||||
`topologySpreadConstraints` sets the topology spread constraints for
|
||||
any pods created by the chart. See [the Kubernetes
|
||||
documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/)
|
||||
for more details.
|
||||
|
||||
When unset, the chart defaults to a soft topology spread constraint that tries
|
||||
to spread pods across hosts and zones.
|
||||
|
||||
```
|
||||
topologySpreadConstraints:
|
||||
- maxSkew: 1
|
||||
topologyKey: kubernetes.io/hostname
|
||||
whenUnsatisfiable: ScheduleAnyway
|
||||
labelSelector:
|
||||
matchLabels: # dynamically computed
|
||||
- maxSkew: 1
|
||||
topologyKey: topology.kubernetes.io/zone
|
||||
whenUnsatisfiable: ScheduleAnyway
|
||||
labelSelector:
|
||||
matchLabels: # dynamically computed
|
||||
```
|
||||
|
||||
## `disableTopologySpreadConstraints`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `bool` | `false` |
|
||||
|
||||
`disableTopologySpreadConstraints` turns off the default topology
|
||||
spread constraints.
|
||||
|
||||
## `affinity`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `object` | `{}` |
|
||||
|
||||
`affinity` sets the affinities for any pods created by the chart. See
|
||||
[the Kubernetes
|
||||
documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity)
|
||||
for more details.
|
||||
|
||||
## `tolerations`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `list` | `[]` |
|
||||
|
||||
`tolerations` sets the tolerations for any pods created by the chart.
|
||||
See [the Kubernetes
|
||||
documentation](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
|
||||
for more details.
|
||||
|
||||
## `teleportConfig`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `object` | `{}` |
|
||||
|
||||
`teleportConfig` contains YAML teleport configuration to pass to the
|
||||
Teleport pods. The configuration will be merged with the chart-generated
|
||||
configuration and will take precedence in case of conflict.
|
||||
|
||||
See the [Teleport Configuration Reference](../../reference/deployment/config.mdx) for the list of supported fields.
|
||||
|
||||
## `extraArgs`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `list` | `[]` |
|
||||
|
||||
`extraArgs` contains extra arguments to pass to `teleport start` for
|
||||
the main Teleport container.
|
||||
|
||||
## `extraEnv`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `list` | `[]` |
|
||||
|
||||
`extraEnv` contains extra environment variables to set in the main
|
||||
Teleport container.
|
||||
|
||||
For example:
|
||||
```yaml
|
||||
extraEnv:
|
||||
- name: HTTPS_PROXY
|
||||
value: "http://username:[email protected]:3128"
|
||||
```
|
||||
|
||||
## `extraVolumes`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `list` | `[]` |
|
||||
|
||||
`extraVolumes` contains extra volumes to mount into the Teleport pods.
|
||||
See [the Kubernetes volume
|
||||
documentation](https://kubernetes.io/docs/concepts/storage/volumes/) for more
|
||||
details.
|
||||
|
||||
For example:
|
||||
```yaml
|
||||
extraVolumes:
|
||||
- name: myvolume
|
||||
secret:
|
||||
secretName: testSecret
|
||||
```
|
||||
|
||||
## `extraVolumeMounts`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `list` | `[]` |
|
||||
|
||||
`extraVolumeMounts` contains extra volumes mounts for the main Teleport
|
||||
container. See [the Kubernetes volume
|
||||
documentation](https://kubernetes.io/docs/concepts/storage/volumes/) for more
|
||||
details.
|
||||
|
||||
For example:
|
||||
```yaml
|
||||
extraVolumesMounts:
|
||||
- name: myvolume
|
||||
mountPath: /path/on/host
|
||||
```
|
||||
|
||||
## `dnsConfig`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `object` | `{}` |
|
||||
|
||||
`dnsConfig` contains custom Pod DNS Configuration for the agent pods.
|
||||
This value is useful if you need to reduce the DNS load: set "ndots" to 0 and
|
||||
only use FQDNs to refer to remote hosts.
|
||||
|
||||
See [the Kubernetes pod DNS documentation
|
||||
](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config)
|
||||
for more information.
|
||||
|
||||
For example:
|
||||
```yaml
|
||||
nameservers:
|
||||
- 1.2.3.4
|
||||
searches:
|
||||
- ns1.svc.cluster-domain.example
|
||||
- my.dns.search.suffix
|
||||
options:
|
||||
- name: ndots
|
||||
value: "2"
|
||||
```
|
||||
|
||||
## `dnsPolicy`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `string` | `""` |
|
||||
|
||||
`dnsPolicy` sets the Pod's DNS Policy
|
||||
|
||||
See [the Kubernetes pod DNS documentation
|
||||
](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy)
|
||||
for more information.
|
||||
|
||||
## `hostAliases`
|
||||
|
||||
`hostAliases` sets Host aliases in the Teleport Pod. See [the Kubernetes
|
||||
hosts file
|
||||
documentation](https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/)
|
||||
for more details.
|
||||
|
||||
For example:
|
||||
```yaml
|
||||
hostAliases:
|
||||
- ip: "127.0.0.1"
|
||||
hostnames:
|
||||
- "foo.local"
|
||||
- "bar.local"
|
||||
- ip: "10.1.2.3"
|
||||
hostnames:
|
||||
- "foo.remote"
|
||||
- "bar.remote"
|
||||
```
|
||||
|
||||
## `tls`
|
||||
|
||||
`tls` contains settings for mounting your own TLS material in the agent pod.
|
||||
|
||||
### `tls.existingCASecretName`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `string` | `""` |
|
||||
|
||||
`tls.existingCASecretName` sets the `SSL_CERT_FILE` environment
|
||||
variable to load a trusted CA or bundle in PEM format into Teleport pods.
|
||||
The injected CA will be used to validate TLS communications with the Proxy
|
||||
Service.
|
||||
|
||||
You must create a secret containing the CA certs in the same namespace as
|
||||
Teleport using a command like:
|
||||
|
||||
```code
|
||||
$ kubectl create secret generic my-root-ca --from-file=ca.pem=/path/to/root-ca.pem
|
||||
```
|
||||
|
||||
### `tls.existingCASecretKeyName`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `string` | `"ca.pem"` |
|
||||
|
||||
`tls.existingCASecretKeyName` determines which key in the CA secret
|
||||
will be used as a trusted CA bundle file.
|
||||
|
||||
## `insecureSkipProxyTLSVerify`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `bool` | `false` |
|
||||
|
||||
`insecureSkipProxyTLSVerify` disables TLS verification of the TLS
|
||||
certificate presented by the Proxy Service.
|
||||
|
||||
This can be used for joining a Teleport instance to a Teleport cluster which
|
||||
does not have valid TLS certificates for testing.
|
||||
|
||||
<Admonition type="warning">
|
||||
|
||||
Using a self-signed TLS certificate and disabling TLS verification is OK for
|
||||
testing, but is not viable when running a production Teleport cluster as it
|
||||
will drastically reduce security. You must configure valid TLS certificates
|
||||
on your Teleport cluster for production workloads.
|
||||
|
||||
One option might be to use Teleport's built-in [ACME
|
||||
support](../../reference/helm-reference/teleport-cluster.mdx#acme) or enable
|
||||
[cert-manager
|
||||
support](../../reference/helm-reference/teleport-cluster.mdx#highavailabilitycertmanager).
|
||||
|
||||
</Admonition>
|
||||
|
||||
## `securityContext`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `object` | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}` |
|
||||
|
||||
`securityContext` sets the container security context for any pods
|
||||
created by the chart. See [the Kubernetes
|
||||
documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container)
|
||||
for more details.
|
||||
|
||||
The default value is compatible with [the restricted
|
||||
PSS](https://kubernetes.io/docs/concepts/security/pod-security-standards/).
|
||||
|
||||
To unset the security context, set it to `null` or `~`.
|
||||
|
||||
## `podSecurityContext`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `object` | `{"fsGroup":65532}` |
|
||||
|
||||
`podSecurityContext` sets the pod security context for any pods
|
||||
created by the chart. See [the Kubernetes
|
||||
documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod)
|
||||
for more details.
|
||||
|
||||
To unset the security context, set it to `null` or `~`.
|
||||
|
||||
## `priorityClassName`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `string` | `""` |
|
||||
|
||||
`priorityClassName` sets the priority class used by any pods created by the chart.
|
||||
The user is responsible for creating the `PriorityClass` resource before deploying the chart.
|
||||
See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/)
|
||||
for more details.
|
||||
|
||||
## `nameOverride`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `string` | `""` |
|
||||
|
||||
`nameOverride` optionally overrides the name of the chart, used
|
||||
together with the release name when giving a name to resources.
|
||||
|
||||
## `fullnameOverride`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `string` | `""` |
|
||||
|
||||
`fullnameOverride` optionally overrides the full name of resources.
|
||||
|
||||
## `teleportVersionOverride`
|
||||
|
||||
| Type | Default |
|
||||
|------|---------|
|
||||
| `string` | `""` |
|
||||
|
||||
`teleportVersionOverride` controls the Teleport Kubernetes Operator
|
||||
image version deployed by the chart.
|
||||
|
||||
Normally, the version of the Teleport Kubernetes Operator matches the version
|
||||
of the chart. If you install chart version 15.0.0, you'll use Teleport version
|
||||
15.0.0. Upgrading the agent is done by upgrading the chart.
|
||||
|
||||
<Admonition type="warning">
|
||||
|
||||
`teleportVersionOverride` is intended for development and MUST NOT be used
|
||||
to control the Teleport version in a typical deployment. This chart is
|
||||
designed to run a specific Teleport version. You will face compatibility
|
||||
issues trying to run a different Teleport version with it.
|
||||
|
||||
If you want to run Teleport version `X.Y.Z`, you should use `helm install
|
||||
--version X.Y.Z` instead.
|
||||
|
||||
</Admonition>
|
||||
@@ -5,3 +5,8 @@ rules:
|
||||
min-spaces-after: 0
|
||||
line-length:
|
||||
max: 120
|
||||
indentation:
|
||||
# helm's toYaml template function adds zero indentation to arrays but we
|
||||
# generally add it in our manual templates; "whatever" means that any
|
||||
# indentation level is fine (as long as it's the same within the same array)
|
||||
indent-sequences: whatever
|
||||
|
||||
+14
-2
@@ -7,7 +7,7 @@ check_access = $(addprefix check-chart-ref-access-,$(access))
|
||||
render_access = $(addprefix render-chart-ref-access-,$(access))
|
||||
|
||||
.PHONY: render-chart-ref
|
||||
render-chart-ref: render-chart-ref-example render-chart-ref-teleport-operator render-chart-ref-teleport-kube-agent render-chart-ref-tbot $(render_access) # render-chart-ref-teleport-cluster
|
||||
render-chart-ref: render-chart-ref-example render-chart-ref-teleport-operator render-chart-ref-teleport-kube-agent render-chart-ref-teleport-relay render-chart-ref-tbot $(render_access) # render-chart-ref-teleport-cluster
|
||||
|
||||
.PHONY: render-chart-ref-example
|
||||
render-chart-ref-example:
|
||||
@@ -25,6 +25,11 @@ render-chart-ref-teleport-kube-agent:
|
||||
cd ../../build.assets/tooling && \
|
||||
go run ./cmd/render-helm-ref -chart ../../examples/chart/teleport-kube-agent/ -output ../../docs/pages/includes/helm-reference/zz_generated.teleport-kube-agent.mdx
|
||||
|
||||
.PHONY: render-chart-ref-teleport-relay
|
||||
render-chart-ref-teleport-relay:
|
||||
cd ../../build.assets/tooling && \
|
||||
go run ./cmd/render-helm-ref -chart ../../examples/chart/teleport-relay/ -output ../../docs/pages/includes/helm-reference/zz_generated.teleport-relay.mdx
|
||||
|
||||
.PHONY: render-chart-ref-teleport-operator
|
||||
render-chart-ref-teleport-operator:
|
||||
cd ../../build.assets/tooling && \
|
||||
@@ -41,7 +46,7 @@ render-chart-ref-access-%:
|
||||
go run ./cmd/render-helm-ref -chart ../../examples/chart/access/$* -output ../../docs/pages/includes/helm-reference/zz_generated.access-$*.mdx
|
||||
|
||||
.PHONY: check-chart-ref
|
||||
check-chart-ref: check-chart-ref-example check-chart-ref-teleport-operator check-chart-ref-teleport-kube-agent check-chart-ref-tbot $(check_access) #check-chart-ref-teleport-cluster
|
||||
check-chart-ref: check-chart-ref-example check-chart-ref-teleport-operator check-chart-ref-teleport-kube-agent check-chart-ref-teleport-relay check-chart-ref-tbot $(check_access) #check-chart-ref-teleport-cluster
|
||||
|
||||
.PHONY: check-chart-ref-example
|
||||
check-chart-ref-example:
|
||||
@@ -64,6 +69,13 @@ check-chart-ref-teleport-kube-agent:
|
||||
go run ./cmd/render-helm-ref -chart ../../examples/chart/teleport-kube-agent -output - | diff ../../docs/pages/includes/helm-reference/zz_generated.teleport-kube-agent.mdx - || \
|
||||
( echo "Chart values.yaml and reference differ, please run 'make -C examples/chart render-chart-ref'" && exit 1 )
|
||||
|
||||
.PHONY: check-chart-ref-teleport-relay
|
||||
check-chart-ref-teleport-relay:
|
||||
@ echo "Checking teleport-relay reference"
|
||||
@ cd ../../build.assets/tooling && \
|
||||
GOWORK=off go run ./cmd/render-helm-ref -chart ../../examples/chart/teleport-relay -output - | diff ../../docs/pages/includes/helm-reference/zz_generated.teleport-relay.mdx - || \
|
||||
( echo "Chart values.yaml and reference differ, please run 'make -C examples/chart render-chart-ref'" && exit 1 )
|
||||
|
||||
.PHONY: check-chart-ref-teleport-operator
|
||||
check-chart-ref-teleport-operator:
|
||||
@echo "Checking teleport-operator reference"
|
||||
|
||||
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@@ -0,0 +1,24 @@
|
||||
joinParams:
|
||||
tokenName: token-name-2
|
||||
method: join-method-2
|
||||
|
||||
proxyAddr: proxy-2.example.com:443
|
||||
|
||||
log:
|
||||
level: randomLogLevel
|
||||
format: randomLogFormat
|
||||
|
||||
shutdownDelay: "90s"
|
||||
|
||||
relayGroup: relay-group-2
|
||||
|
||||
publicHostnames:
|
||||
- public-hostname-3.example.com
|
||||
- public-hostname-4.example.com
|
||||
|
||||
targetConnectionCount: 42
|
||||
|
||||
highAvailability:
|
||||
replicaCount: 0
|
||||
|
||||
proxyProtocol: true
|
||||
@@ -0,0 +1,11 @@
|
||||
joinParams:
|
||||
tokenName: token-name
|
||||
method: join-method
|
||||
|
||||
proxyAddr: proxy.example.com:443
|
||||
|
||||
relayGroup: relay-group
|
||||
|
||||
publicHostnames:
|
||||
- public-hostname-1.example.com
|
||||
- public-hostname-2.example.com
|
||||
@@ -0,0 +1,10 @@
|
||||
.version: &version "19.0.0-dev"
|
||||
|
||||
name: teleport-relay
|
||||
apiVersion: v2
|
||||
version: *version
|
||||
appVersion: *version
|
||||
description: This chart deploys the Teleport Relay service.
|
||||
icon: https://goteleport.com/static/teleport-symbol-bimi.svg
|
||||
keywords:
|
||||
- Teleport
|
||||
@@ -0,0 +1,9 @@
|
||||
{{- if .Values.teleportVersionOverride }}
|
||||
|
||||
DANGER: `teleportVersionOverride` MUST NOT be used to control the Teleport version.
|
||||
This chart is designed to run Teleport version {{ .Chart.AppVersion }}.
|
||||
You will face compatibility issues trying to run a different Teleport version with it.
|
||||
|
||||
If you want to run Teleport version {{.Values.teleportVersionOverride}},
|
||||
you should use `helm --version {{.Values.teleportVersionOverride}}` instead.
|
||||
{{- end }}
|
||||
@@ -0,0 +1,41 @@
|
||||
{{- define "teleport-relay.config" -}}
|
||||
version: v3
|
||||
teleport:
|
||||
join_params:
|
||||
method: {{ required "joinParams.method is required in chart values" .Values.joinParams.method | quote }}
|
||||
token_name: "/etc/teleport-secrets/auth-token"
|
||||
proxy_server: {{ required "proxyAddr is required in chart values" .Values.proxyAddr | quote }}
|
||||
log:
|
||||
severity: {{ required "log.level is required in chart values" .Values.log.level | quote }}
|
||||
format:
|
||||
output: {{ required "log.format is required in chart values" .Values.log.format | quote }}
|
||||
diag_addr: "0.0.0.0:3000"
|
||||
{{- with .Values.shutdownDelay }}
|
||||
shutdown_delay: {{ quote . }}
|
||||
{{- end }}
|
||||
auth_service:
|
||||
enabled: false
|
||||
proxy_service:
|
||||
enabled: false
|
||||
ssh_service:
|
||||
enabled: false
|
||||
relay_service:
|
||||
enabled: true
|
||||
relay_group: {{ required "relayGroup is required in chart values" .Values.relayGroup | quote }}
|
||||
{{- if le (int .Values.targetConnectionCount) 0 }}
|
||||
{{ fail "targetConnectionCount must be greater than 0" }}
|
||||
{{- end }}
|
||||
target_connection_count: {{ int .Values.targetConnectionCount }}
|
||||
{{- if empty .Values.publicHostnames }}
|
||||
{{- fail "publicHostnames cannot be empty in chart values" }}
|
||||
{{- end }}
|
||||
public_hostnames:
|
||||
{{- toYaml .Values.publicHostnames | nindent 4 }}
|
||||
transport_listen_addr: "0.0.0.0:3040"
|
||||
peer_listen_addr: "0.0.0.0:3041"
|
||||
tunnel_listen_addr: "0.0.0.0:3042"
|
||||
{{- if .Values.proxyProtocol }}
|
||||
transport_proxy_protocol: true
|
||||
tunnel_proxy_protocol: true
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,87 @@
|
||||
{{- define "teleport-relay.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
This is a modified version of the default fully qualified app name helper.
|
||||
We diverge by always honouring "nameOverride" when it's set, as opposed to the
|
||||
default behaviour of shortening if `nameOverride` is included in chart name.
|
||||
This is done to avoid naming conflicts when including the chart in other charts.
|
||||
*/}}
|
||||
{{- define "teleport-relay.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- if .Values.nameOverride }}
|
||||
{{- printf "%s-%s" .Release.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- if contains .Chart.Name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "teleport-relay.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "teleport-relay.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "teleport-relay.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "teleport-relay.labels" -}}
|
||||
helm.sh/chart: {{ include "teleport-relay.chart" . }}
|
||||
{{ include "teleport-relay.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "teleport-relay.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "teleport-relay.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- required "serviceAccount.name is required in chart values if serviceAccount.create is false" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "teleport-relay.version" -}}
|
||||
{{ default .Chart.AppVersion .Values.teleportVersionOverride }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "teleport-relay.baseImage" -}}
|
||||
{{- if .Values.enterprise }}
|
||||
{{- .Values.enterpriseImage }}
|
||||
{{- else }}
|
||||
{{- .Values.image }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "teleport-relay.image" -}}
|
||||
{{ include "teleport-relay.baseImage" . }}:{{ include "teleport-relay.version" . }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "teleport-relay.joinTokenSecretName" -}}
|
||||
{{- if .Values.joinTokenSecret.create }}
|
||||
{{- default (include "teleport-relay.fullname" .) .Values.joinTokenSecret.name }}
|
||||
{{- else }}
|
||||
{{- required "joinTokenSecret.name is required in chart values if joinTokenSecret.create is false" .Values.joinTokenSecret.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,16 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "teleport-relay.fullname" . }}
|
||||
labels:
|
||||
{{- include "teleport-relay.labels" . | nindent 4 }}
|
||||
{{- with .Values.extraLabels.config }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.annotations.config }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
teleport.yaml: |
|
||||
{{- mustMergeOverwrite (include "teleport-relay.config" . | fromYaml) .Values.teleportConfig | toYaml | nindent 4 -}}
|
||||
@@ -0,0 +1,224 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "teleport-relay.fullname" . }}
|
||||
labels:
|
||||
{{- include "teleport-relay.labels" . | nindent 4 }}
|
||||
{{- with .Values.extraLabels.deployment }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.annotations.deployment }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "teleport-relay.selectorLabels" . | nindent 6 }}
|
||||
{{- $replicaCount := int .Values.highAvailability.replicaCount }}
|
||||
{{- if and (gt $replicaCount 0) (lt $replicaCount (int .Values.targetConnectionCount)) }}
|
||||
{{- fail "highAvailability.replicaCount must not be smaller than targetConnectionCount" }}
|
||||
{{- end }}
|
||||
replicas: {{ $replicaCount }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "teleport-relay.labels" . | nindent 8 }}
|
||||
{{- with .Values.extraLabels.pod }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
||||
{{- with .Values.annotations.pod }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
serviceAccountName: {{ include "teleport-relay.serviceAccountName" . | quote }}
|
||||
automountServiceAccountToken: false
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.priorityClassName }}
|
||||
priorityClassName: {{ quote . }}
|
||||
{{- end }}
|
||||
terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
|
||||
{{- with .Values.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.dnsConfig }}
|
||||
dnsConfig:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.dnsPolicy }}
|
||||
dnsPolicy: {{ quote . }}
|
||||
{{- end }}
|
||||
{{- with .Values.hostAliases }}
|
||||
hostAliases:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and .Values.topologySpreadConstraints .Values.disableTopologySpreadConstraints }}
|
||||
{{- fail "disableTopologySpreadConstraints cannot be enabled if topologySpreadConstraints is set in chart values"}}
|
||||
{{- end }}
|
||||
{{- if .Values.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml .Values.topologySpreadConstraints | nindent 8 }}
|
||||
{{- else if not .Values.disableTopologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
- topologyKey: kubernetes.io/hostname
|
||||
maxSkew: 1
|
||||
whenUnsatisfiable: ScheduleAnyway
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
{{- include "teleport-relay.selectorLabels" . | nindent 14 }}
|
||||
- topologyKey: topology.kubernetes.io/zone
|
||||
maxSkew: 1
|
||||
whenUnsatisfiable: ScheduleAnyway
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
{{- include "teleport-relay.selectorLabels" . | nindent 14 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ include "teleport-relay.fullname" . }}
|
||||
- name: auth-token
|
||||
secret:
|
||||
secretName: {{ include "teleport-relay.joinTokenSecretName" . }}
|
||||
- name: data
|
||||
emptyDir: {}
|
||||
{{- with .Values.tls.existingCASecretName }}
|
||||
- name: teleport-tls-ca
|
||||
secret:
|
||||
secretName: {{ quote . }}
|
||||
{{- end }}
|
||||
{{- with .Values.teleportClusterName }}
|
||||
{{- /* This volume is used to obtain a service account token that can be
|
||||
used to join the Teleport cluster using the kubernetes join method. To
|
||||
ensure Kubernetes compatibility, we use .Values.teleportClusterName as
|
||||
a feature flag. The token must have the cluster name as audience, and
|
||||
its TTL must not exceed 30 minutes. We pick 10 minutes because that's
|
||||
the shortest lifetime for the token. */}}
|
||||
- name: join-sa-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: join-sa-token
|
||||
expirationSeconds: 600
|
||||
audience: {{ quote . }}
|
||||
{{- end }}
|
||||
{{- with .Values.extraVolumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: teleport
|
||||
{{- with .Values.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
image: {{ include "teleport-relay.image" . | quote }}
|
||||
{{- with .Values.imagePullPolicy }}
|
||||
imagePullPolicy: {{ quote . }}
|
||||
{{- end }}
|
||||
command:
|
||||
- /usr/bin/dumb-init
|
||||
- "--"
|
||||
- /usr/local/bin/teleport
|
||||
args:
|
||||
- start
|
||||
{{- if .Values.insecureSkipProxyTLSVerify }}
|
||||
- "--insecure"
|
||||
{{- end }}
|
||||
{{- with .Values.extraArgs }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
{{- /* This variable is set for telemetry purposes.
|
||||
Telemetry is opt-in and controlled at the auth level. */}}
|
||||
- name: TELEPORT_INSTALL_METHOD_HELM_KUBE_AGENT
|
||||
value: "true"
|
||||
{{- if .Values.teleportClusterName }}
|
||||
- name: KUBERNETES_TOKEN_PATH
|
||||
value: /var/run/secrets/teleport-join-sa-token/join-sa-token
|
||||
{{- end }}
|
||||
{{- if .Values.tls.existingCASecretName }}
|
||||
- name: SSL_CERT_FILE
|
||||
value: /etc/teleport-tls-ca.pem
|
||||
{{- end }}
|
||||
{{- with .Values.extraEnv }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: diagnostics
|
||||
protocol: TCP
|
||||
- containerPort: 3040
|
||||
name: transport
|
||||
protocol: TCP
|
||||
- containerPort: 3041
|
||||
name: peer
|
||||
protocol: TCP
|
||||
- containerPort: 3042
|
||||
name: tunnel
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: diagnostics
|
||||
failureThreshold: 6
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: diagnostics
|
||||
failureThreshold: 12
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 1
|
||||
{{- with .Values.preStopDelay }}
|
||||
lifecycle:
|
||||
{{- /* waiting during preStop ensures that load balancers have time
|
||||
to stop sending new connections to the Terminating pod */}}
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- /usr/local/bin/teleport
|
||||
- wait
|
||||
- duration
|
||||
- {{ quote . }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/teleport
|
||||
name: data
|
||||
- mountPath: /etc/teleport.yaml
|
||||
name: config
|
||||
subPath: teleport.yaml
|
||||
- mountPath: /etc/teleport-secrets
|
||||
name: auth-token
|
||||
{{- if .Values.teleportClusterName }}
|
||||
- mountPath: /var/run/secrets/teleport-join-sa-token
|
||||
name: join-sa-token
|
||||
{{- end }}
|
||||
{{- if .Values.tls.existingCASecretName }}
|
||||
- mountPath: /etc/teleport-tls-ca.pem
|
||||
name: teleport-tls-ca
|
||||
subPath: {{ required "tls.existingCASecretKeyName must be set if tls.existingCASecretName is set in chart values" .Values.tls.existingCASecretKeyName | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.extraVolumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,20 @@
|
||||
{{- if .Values.highAvailability.podDisruptionBudget.enabled }}
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "teleport-relay.fullname" . }}
|
||||
labels:
|
||||
{{- include "teleport-relay.labels" . | nindent 4 }}
|
||||
{{- with .Values.extraLabels.podDisruptionBudget }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.annotations.podDisruptionBudget }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
minAvailable: {{ .Values.highAvailability.podDisruptionBudget.minAvailable }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "teleport-relay.selectorLabels" . | nindent 6 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,17 @@
|
||||
{{- if .Values.joinTokenSecret.create }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "teleport-relay.joinTokenSecretName" . | quote }}
|
||||
{{- with .Values.extraLabels.secret }}
|
||||
labels:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.annotations.secret }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
stringData:
|
||||
auth-token: {{ required "joinParams.tokenName must be specified if joinTokenSecret.create is enabled" .Values.joinParams.tokenName | quote }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,29 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "teleport-relay.fullname" . }}
|
||||
labels:
|
||||
{{- include "teleport-relay.labels" . | nindent 4 }}
|
||||
{{- with .Values.extraLabels.service }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.annotations.service }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ required "service.type must be set in chart values" .Values.service.type | quote }}
|
||||
ports:
|
||||
- name: transport
|
||||
port: 443
|
||||
targetPort: transport
|
||||
protocol: TCP
|
||||
- name: tunnel
|
||||
port: 3042
|
||||
targetPort: tunnel
|
||||
protocol: TCP
|
||||
selector:
|
||||
{{- include "teleport-relay.selectorLabels" . | nindent 4 }}
|
||||
{{- with .Values.service.spec }}
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,16 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "teleport-relay.serviceAccountName" . }}
|
||||
labels:
|
||||
{{- include "teleport-relay.labels" . | nindent 4 }}
|
||||
{{- with .Values.extraLabels.serviceAccount }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.annotations.serviceAccount }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: false
|
||||
{{- end }}
|
||||
@@ -0,0 +1,64 @@
|
||||
teleport.yaml matches the snapshot (exercise-configmap):
|
||||
1: |
|
||||
|-
|
||||
auth_service:
|
||||
enabled: false
|
||||
proxy_service:
|
||||
enabled: false
|
||||
relay_service:
|
||||
enabled: true
|
||||
peer_listen_addr: 0.0.0.0:3041
|
||||
public_hostnames:
|
||||
- public-hostname-3.example.com
|
||||
- public-hostname-4.example.com
|
||||
relay_group: relay-group-2
|
||||
target_connection_count: 42
|
||||
transport_listen_addr: 0.0.0.0:3040
|
||||
transport_proxy_protocol: true
|
||||
tunnel_listen_addr: 0.0.0.0:3042
|
||||
tunnel_proxy_protocol: true
|
||||
ssh_service:
|
||||
enabled: false
|
||||
teleport:
|
||||
diag_addr: 0.0.0.0:3000
|
||||
join_params:
|
||||
method: join-method-2
|
||||
token_name: /etc/teleport-secrets/auth-token
|
||||
log:
|
||||
format:
|
||||
output: randomLogFormat
|
||||
severity: randomLogLevel
|
||||
proxy_server: proxy-2.example.com:443
|
||||
shutdown_delay: 90s
|
||||
version: v3
|
||||
teleport.yaml matches the snapshot (simple):
|
||||
1: |
|
||||
|-
|
||||
auth_service:
|
||||
enabled: false
|
||||
proxy_service:
|
||||
enabled: false
|
||||
relay_service:
|
||||
enabled: true
|
||||
peer_listen_addr: 0.0.0.0:3041
|
||||
public_hostnames:
|
||||
- public-hostname-1.example.com
|
||||
- public-hostname-2.example.com
|
||||
relay_group: relay-group
|
||||
target_connection_count: 2
|
||||
transport_listen_addr: 0.0.0.0:3040
|
||||
tunnel_listen_addr: 0.0.0.0:3042
|
||||
ssh_service:
|
||||
enabled: false
|
||||
teleport:
|
||||
diag_addr: 0.0.0.0:3000
|
||||
join_params:
|
||||
method: join-method
|
||||
token_name: /etc/teleport-secrets/auth-token
|
||||
log:
|
||||
format:
|
||||
output: json
|
||||
severity: INFO
|
||||
proxy_server: proxy.example.com:443
|
||||
shutdown_delay: 30s
|
||||
version: v3
|
||||
@@ -0,0 +1,95 @@
|
||||
suite: Test ConfigMap
|
||||
templates:
|
||||
- configmap.yaml
|
||||
|
||||
tests:
|
||||
- it: creates a config map
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
- containsDocument:
|
||||
kind: ConfigMap
|
||||
apiVersion: v1
|
||||
name: RELEASE-NAME-teleport-relay
|
||||
- isNotNull:
|
||||
path: data.teleport\.yaml
|
||||
- it: includes extraLabels and annotations
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
set:
|
||||
extraLabels:
|
||||
config:
|
||||
labelName1: labelValue1
|
||||
labelName2: labelValue2
|
||||
annotations:
|
||||
config:
|
||||
annotationName1: annotationValue1
|
||||
annotationName2: annotationValue2
|
||||
asserts:
|
||||
- isSubset:
|
||||
path: metadata.labels
|
||||
content:
|
||||
labelName1: labelValue1
|
||||
labelName2: labelValue2
|
||||
- equal:
|
||||
path: metadata.annotations
|
||||
value:
|
||||
annotationName1: annotationValue1
|
||||
annotationName2: annotationValue2
|
||||
|
||||
- it: fails if joinParams.method is missing
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
set:
|
||||
joinParams:
|
||||
method: ""
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: joinParams.method is required in chart values
|
||||
- it: fails if proxyAddr is missing
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
set:
|
||||
proxyAddr: ""
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: proxyAddr is required in chart values
|
||||
- it: fails if relayGroup is missing
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
set:
|
||||
relayGroup: ""
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: relayGroup is required in chart values
|
||||
- it: fails if targetConnectionCount is not positive
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
set:
|
||||
targetConnectionCount: -3
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: targetConnectionCount must be greater than 0
|
||||
- it: fails if publicHostnames is empty
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
set:
|
||||
publicHostnames: []
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: publicHostnames cannot be empty in chart values
|
||||
|
||||
- it: teleport.yaml matches the snapshot (simple)
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
asserts:
|
||||
- matchSnapshot:
|
||||
path: data.teleport\.yaml
|
||||
- it: teleport.yaml matches the snapshot (exercise-configmap)
|
||||
values:
|
||||
- ../.lint/exercise-configmap.yaml
|
||||
asserts:
|
||||
- matchSnapshot:
|
||||
path: data.teleport\.yaml
|
||||
@@ -0,0 +1,318 @@
|
||||
suite: Test Deployment
|
||||
templates:
|
||||
- configmap.yaml
|
||||
- deployment.yaml
|
||||
|
||||
tests:
|
||||
- it: creates a deployment
|
||||
template: deployment.yaml
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
- containsDocument:
|
||||
kind: Deployment
|
||||
apiVersion: apps/v1
|
||||
name: RELEASE-NAME-teleport-relay
|
||||
|
||||
- it: includes extraLabels and annotations
|
||||
template: deployment.yaml
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
set:
|
||||
extraLabels:
|
||||
deployment:
|
||||
labelName1: labelValue1
|
||||
labelName2: labelValue2
|
||||
annotations:
|
||||
deployment:
|
||||
annotationName1: annotationValue1
|
||||
annotationName2: annotationValue2
|
||||
asserts:
|
||||
- isSubset:
|
||||
path: metadata.labels
|
||||
content:
|
||||
labelName1: labelValue1
|
||||
labelName2: labelValue2
|
||||
- equal:
|
||||
path: metadata.annotations
|
||||
value:
|
||||
annotationName1: annotationValue1
|
||||
annotationName2: annotationValue2
|
||||
- it: includes extraLabels and annotations in the pod template
|
||||
template: deployment.yaml
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
set:
|
||||
extraLabels:
|
||||
pod:
|
||||
labelName1: labelValue1
|
||||
labelName2: labelValue2
|
||||
annotations:
|
||||
pod:
|
||||
annotationName1: annotationValue1
|
||||
annotationName2: annotationValue2
|
||||
asserts:
|
||||
- isSubset:
|
||||
path: spec.template.metadata.labels
|
||||
content:
|
||||
labelName1: labelValue1
|
||||
labelName2: labelValue2
|
||||
- isSubset:
|
||||
path: spec.template.metadata.annotations
|
||||
content:
|
||||
annotationName1: annotationValue1
|
||||
annotationName2: annotationValue2
|
||||
|
||||
- it: pods are selected by deployment, service and pdb
|
||||
template: deployment.yaml
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
# these selector labels are also checked to be matched in service_test.yaml
|
||||
# and pdb_test.yaml
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.selector.matchLabels
|
||||
value:
|
||||
app.kubernetes.io/instance: RELEASE-NAME
|
||||
app.kubernetes.io/name: teleport-relay
|
||||
- isSubset:
|
||||
path: spec.template.metadata.labels
|
||||
content:
|
||||
app.kubernetes.io/instance: RELEASE-NAME
|
||||
app.kubernetes.io/name: teleport-relay
|
||||
|
||||
- it: pods are selected by the default topologySpreadConstraints
|
||||
template: deployment.yaml
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.topologySpreadConstraints
|
||||
value:
|
||||
- topologyKey: kubernetes.io/hostname
|
||||
maxSkew: 1
|
||||
whenUnsatisfiable: ScheduleAnyway
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: RELEASE-NAME
|
||||
app.kubernetes.io/name: teleport-relay
|
||||
- topologyKey: topology.kubernetes.io/zone
|
||||
maxSkew: 1
|
||||
whenUnsatisfiable: ScheduleAnyway
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: RELEASE-NAME
|
||||
app.kubernetes.io/name: teleport-relay
|
||||
|
||||
- it: refuses to set and disable topologySpreadConstraints at the same time
|
||||
template: deployment.yaml
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
set:
|
||||
disableTopologySpreadConstraints: true
|
||||
topologySpreadConstraints: nonempty
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: disableTopologySpreadConstraints cannot be enabled if topologySpreadConstraints is set in chart values
|
||||
|
||||
- it: requires the target connection count to be not greater than the replica count
|
||||
template: deployment.yaml
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
set:
|
||||
highAvailability:
|
||||
replicaCount: 2
|
||||
targetConnectionCount: 3
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: highAvailability.replicaCount must not be smaller than targetConnectionCount
|
||||
|
||||
- it: allows the replica count to be zero no matter the target connection count
|
||||
template: deployment.yaml
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
set:
|
||||
highAvailability:
|
||||
replicaCount: 0
|
||||
targetConnectionCount: 3
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.replicas
|
||||
value: 0
|
||||
|
||||
- it: chooses the default service account and join token
|
||||
template: deployment.yaml
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.serviceAccountName
|
||||
value: RELEASE-NAME-teleport-relay
|
||||
- contains:
|
||||
path: spec.template.spec.volumes
|
||||
content:
|
||||
name: auth-token
|
||||
secret:
|
||||
secretName: RELEASE-NAME-teleport-relay
|
||||
|
||||
- it: chooses the customized service account and join token
|
||||
template: deployment.yaml
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
set:
|
||||
serviceAccount:
|
||||
name: randomServiceAccountName
|
||||
joinTokenSecret:
|
||||
name: randomSecretName
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.serviceAccountName
|
||||
value: randomServiceAccountName
|
||||
- contains:
|
||||
path: spec.template.spec.volumes
|
||||
content:
|
||||
name: auth-token
|
||||
secret:
|
||||
secretName: randomSecretName
|
||||
- contains:
|
||||
path: spec.template.spec.containers[0].volumeMounts
|
||||
content:
|
||||
mountPath: /etc/teleport-secrets
|
||||
name: auth-token
|
||||
|
||||
- it: chooses the correct configmap
|
||||
template: deployment.yaml
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.volumes
|
||||
content:
|
||||
name: config
|
||||
configMap:
|
||||
name: RELEASE-NAME-teleport-relay
|
||||
- contains:
|
||||
path: spec.template.spec.containers[0].volumeMounts
|
||||
content:
|
||||
mountPath: /etc/teleport.yaml
|
||||
name: config
|
||||
subPath: teleport.yaml
|
||||
|
||||
- it: defines the projected service account token with the appropriate audience
|
||||
template: deployment.yaml
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
set:
|
||||
teleportClusterName: randomTeleportClusterName
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.volumes
|
||||
content:
|
||||
name: join-sa-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: join-sa-token
|
||||
expirationSeconds: 600
|
||||
audience: randomTeleportClusterName
|
||||
- contains:
|
||||
path: spec.template.spec.containers[0].volumeMounts
|
||||
content:
|
||||
mountPath: /var/run/secrets/teleport-join-sa-token
|
||||
name: join-sa-token
|
||||
- contains:
|
||||
path: spec.template.spec.containers[0].env
|
||||
content:
|
||||
name: KUBERNETES_TOKEN_PATH
|
||||
value: /var/run/secrets/teleport-join-sa-token/join-sa-token
|
||||
- it: does not include a projected service account if teleportClusterName is not set
|
||||
template: deployment.yaml
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
asserts:
|
||||
- notContains:
|
||||
path: spec.template.spec.volumes
|
||||
content:
|
||||
name: join-sa-token
|
||||
any: true
|
||||
- notContains:
|
||||
path: spec.template.spec.containers[0].volumeMounts
|
||||
content:
|
||||
name: join-sa-token
|
||||
any: true
|
||||
- notContains:
|
||||
path: spec.template.spec.containers[0].env
|
||||
content:
|
||||
name: KUBERNETES_TOKEN_PATH
|
||||
any: true
|
||||
|
||||
- it: defines the ports referenced by the service
|
||||
template: deployment.yaml
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
# these are values checked for in service_test.yaml
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.containers[0].ports
|
||||
content:
|
||||
name: transport
|
||||
protocol: TCP
|
||||
any: true
|
||||
- contains:
|
||||
path: spec.template.spec.containers[0].ports
|
||||
content:
|
||||
name: tunnel
|
||||
protocol: TCP
|
||||
any: true
|
||||
|
||||
- it: uses the non-enterprise image by default
|
||||
chart:
|
||||
appVersion: 12.34.56-sigma
|
||||
template: deployment.yaml
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].image
|
||||
value: public.ecr.aws/gravitational/teleport-distroless:12.34.56-sigma
|
||||
- it: uses the enterprise image if the option is set
|
||||
chart:
|
||||
appVersion: 12.34.56-sigma
|
||||
template: deployment.yaml
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
set:
|
||||
enterprise: true
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].image
|
||||
value: public.ecr.aws/gravitational/teleport-ent-distroless:12.34.56-sigma
|
||||
|
||||
- it: mounts a secret for SSL_CERT_FILE if the option is set
|
||||
template: deployment.yaml
|
||||
values:
|
||||
- ../.lint/simple.yaml
|
||||
set:
|
||||
tls:
|
||||
existingCASecretName: randomCASecretName
|
||||
existingCASecretKeyName: randomCASecretKeyName
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.volumes
|
||||
content:
|
||||
name: teleport-tls-ca
|
||||
secret:
|
||||
secretName: randomCASecretName
|
||||
- contains:
|
||||
path: spec.template.spec.containers[0].volumeMounts
|
||||
content:
|
||||
mountPath: /etc/teleport-tls-ca.pem
|
||||
name: teleport-tls-ca
|
||||
subPath: randomCASecretKeyName
|
||||
- contains:
|
||||
path: spec.template.spec.containers[0].env
|
||||
content:
|
||||
name: SSL_CERT_FILE
|
||||
value: /etc/teleport-tls-ca.pem
|
||||
@@ -0,0 +1,73 @@
|
||||
suite: Test PodDisruptionBudget
|
||||
templates:
|
||||
- pdb.yaml
|
||||
|
||||
tests:
|
||||
- it: does not create a PDB by default
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 0
|
||||
- it: creates a PDB if highAvailability.podDisruptionBudget.enabled is set
|
||||
set:
|
||||
highAvailability:
|
||||
podDisruptionBudget:
|
||||
enabled: true
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
- containsDocument:
|
||||
kind: PodDisruptionBudget
|
||||
apiVersion: policy/v1
|
||||
name: RELEASE-NAME-teleport-relay
|
||||
- equal:
|
||||
path: spec.minAvailable
|
||||
value: 1
|
||||
- it: sets the custom minAvailable from the values
|
||||
set:
|
||||
highAvailability:
|
||||
podDisruptionBudget:
|
||||
enabled: true
|
||||
minAvailable: 42
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.minAvailable
|
||||
value: 42
|
||||
|
||||
- it: selects the deployment pods
|
||||
set:
|
||||
highAvailability:
|
||||
podDisruptionBudget:
|
||||
enabled: true
|
||||
# the selector labels are checked to be in the deployment template in
|
||||
# deployment_test.yaml
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.selector.matchLabels
|
||||
value:
|
||||
app.kubernetes.io/instance: RELEASE-NAME
|
||||
app.kubernetes.io/name: teleport-relay
|
||||
|
||||
- it: includes extraLabels and annotations
|
||||
set:
|
||||
highAvailability:
|
||||
podDisruptionBudget:
|
||||
enabled: true
|
||||
extraLabels:
|
||||
podDisruptionBudget:
|
||||
labelName1: labelValue1
|
||||
labelName2: labelValue2
|
||||
annotations:
|
||||
podDisruptionBudget:
|
||||
annotationName1: annotationValue1
|
||||
annotationName2: annotationValue2
|
||||
asserts:
|
||||
- isSubset:
|
||||
path: metadata.labels
|
||||
content:
|
||||
labelName1: labelValue1
|
||||
labelName2: labelValue2
|
||||
- equal:
|
||||
path: metadata.annotations
|
||||
value:
|
||||
annotationName1: annotationValue1
|
||||
annotationName2: annotationValue2
|
||||
@@ -0,0 +1,70 @@
|
||||
suite: Test Secret
|
||||
templates:
|
||||
- secret.yaml
|
||||
|
||||
tests:
|
||||
- it: creates a secret by default
|
||||
set:
|
||||
joinParams:
|
||||
tokenName: randomTokenName
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
- containsDocument:
|
||||
kind: Secret
|
||||
apiVersion: v1
|
||||
name: RELEASE-NAME-teleport-relay
|
||||
- it: fails if joinParams.tokenName is missing
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: joinParams.tokenName must be specified if joinTokenSecret.create is enabled
|
||||
- it: the secret contains the token in auth-token
|
||||
set:
|
||||
joinParams:
|
||||
tokenName: randomTokenName
|
||||
asserts:
|
||||
- equal:
|
||||
path: stringData.auth-token
|
||||
value: randomTokenName
|
||||
|
||||
- it: does not create a secret account if joinTokenSecret.create is false
|
||||
set:
|
||||
joinTokenSecret:
|
||||
create: false
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 0
|
||||
- it: creates a secret with the configured name
|
||||
set:
|
||||
joinParams:
|
||||
tokenName: randomTokenName
|
||||
joinTokenSecret:
|
||||
name: randomSecretName
|
||||
asserts:
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: randomSecretName
|
||||
|
||||
- it: includes extraLabels and annotations
|
||||
set:
|
||||
joinParams:
|
||||
tokenName: randomTokenName
|
||||
extraLabels:
|
||||
secret:
|
||||
labelName1: labelValue1
|
||||
labelName2: labelValue2
|
||||
annotations:
|
||||
secret:
|
||||
annotationName1: annotationValue1
|
||||
annotationName2: annotationValue2
|
||||
asserts:
|
||||
- isSubset:
|
||||
path: metadata.labels
|
||||
content:
|
||||
labelName1: labelValue1
|
||||
labelName2: labelValue2
|
||||
- equal:
|
||||
path: metadata.annotations
|
||||
value:
|
||||
annotationName1: annotationValue1
|
||||
annotationName2: annotationValue2
|
||||
@@ -0,0 +1,100 @@
|
||||
suite: Test Service
|
||||
templates:
|
||||
- service.yaml
|
||||
|
||||
tests:
|
||||
- it: creates a service
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
- containsDocument:
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
name: RELEASE-NAME-teleport-relay
|
||||
|
||||
- it: defines the expected ports
|
||||
# the port names are checked in deployment_test.yaml
|
||||
asserts:
|
||||
- lengthEqual:
|
||||
path: spec.ports
|
||||
count: 2
|
||||
- contains:
|
||||
path: spec.ports
|
||||
content:
|
||||
name: transport
|
||||
port: 443
|
||||
targetPort: transport
|
||||
protocol: TCP
|
||||
- contains:
|
||||
path: spec.ports
|
||||
content:
|
||||
name: tunnel
|
||||
port: 3042
|
||||
targetPort: tunnel
|
||||
protocol: TCP
|
||||
|
||||
- it: selects the deployment pods
|
||||
# the selector labels are checked to be in the deployment template in
|
||||
# deployment_test.yaml
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.selector
|
||||
value:
|
||||
app.kubernetes.io/instance: RELEASE-NAME
|
||||
app.kubernetes.io/name: teleport-relay
|
||||
|
||||
- it: requires service.type
|
||||
set:
|
||||
service:
|
||||
type: ""
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: service.type must be set in chart values
|
||||
- it: the default service type is LoadBalancer
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.type
|
||||
value: LoadBalancer
|
||||
- it: service.type sets the service type
|
||||
set:
|
||||
service:
|
||||
type: serviceType
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.type
|
||||
value: serviceType
|
||||
|
||||
- it: includes service.spec, extraLabels and annotations
|
||||
set:
|
||||
service:
|
||||
spec:
|
||||
specKey1:
|
||||
- specValue1
|
||||
- 42
|
||||
specKey2: specValue2
|
||||
extraLabels:
|
||||
service:
|
||||
labelName1: labelValue1
|
||||
labelName2: labelValue2
|
||||
annotations:
|
||||
service:
|
||||
annotationName1: annotationValue1
|
||||
annotationName2: annotationValue2
|
||||
asserts:
|
||||
- isSubset:
|
||||
path: metadata.labels
|
||||
content:
|
||||
labelName1: labelValue1
|
||||
labelName2: labelValue2
|
||||
- equal:
|
||||
path: metadata.annotations
|
||||
value:
|
||||
annotationName1: annotationValue1
|
||||
annotationName2: annotationValue2
|
||||
- isSubset:
|
||||
path: spec
|
||||
content:
|
||||
specKey2: specValue2
|
||||
specKey1:
|
||||
- specValue1
|
||||
- 42
|
||||
@@ -0,0 +1,49 @@
|
||||
suite: Test ServiceAccount
|
||||
templates:
|
||||
- serviceaccount.yaml
|
||||
|
||||
tests:
|
||||
- it: creates a service account by default
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
- containsDocument:
|
||||
kind: ServiceAccount
|
||||
apiVersion: v1
|
||||
name: RELEASE-NAME-teleport-relay
|
||||
- it: does not create a service account if serviceAccount.create is false
|
||||
set:
|
||||
serviceAccount:
|
||||
create: false
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 0
|
||||
- it: creates a service account with the configured name
|
||||
set:
|
||||
serviceAccount:
|
||||
name: randomServiceAccountName
|
||||
asserts:
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: randomServiceAccountName
|
||||
- it: includes extraLabels and annotations
|
||||
set:
|
||||
extraLabels:
|
||||
serviceAccount:
|
||||
labelName1: labelValue1
|
||||
labelName2: labelValue2
|
||||
annotations:
|
||||
serviceAccount:
|
||||
annotationName1: annotationValue1
|
||||
annotationName2: annotationValue2
|
||||
asserts:
|
||||
- isSubset:
|
||||
path: metadata.labels
|
||||
content:
|
||||
labelName1: labelValue1
|
||||
labelName2: labelValue2
|
||||
- equal:
|
||||
path: metadata.annotations
|
||||
value:
|
||||
annotationName1: annotationValue1
|
||||
annotationName2: annotationValue2
|
||||
@@ -0,0 +1,559 @@
|
||||
# relayGroup(string) -- sets the internal identifier for the group of Relay
|
||||
# instances reachable through the same load balancer. Should be unique in the
|
||||
# whole Teleport cluster.
|
||||
relayGroup: ""
|
||||
|
||||
# publicHostnames(list) -- a list of hostnames that this Relay group is publicly
|
||||
# reachable at by clients.
|
||||
#
|
||||
# ```
|
||||
# publicHostnames:
|
||||
# - relay.example.com
|
||||
# ```
|
||||
publicHostnames: []
|
||||
|
||||
# targetConnectionCount(int) -- the amount of tunnel connections that agents
|
||||
# will open to distinct Relay instances. It should not be bigger than the
|
||||
# replica count.
|
||||
targetConnectionCount: 2
|
||||
|
||||
# proxyAddr(string) -- provides the public-facing Teleport Proxy Service
|
||||
# endpoint which should be used to join the cluster. This is the same URL used
|
||||
# to access the web UI of your Teleport cluster. The port used is usually either
|
||||
# 3080 or 443.
|
||||
#
|
||||
# Here are a few examples:
|
||||
#
|
||||
# | Deployment method | Example `proxy_service.public_addr` |
|
||||
# |-------------------------------|-------------------------------------|
|
||||
# | On-prem Teleport cluster | `teleport.example.com:3080` |
|
||||
# | Teleport Cloud cluster | `example.teleport.sh:443` |
|
||||
# | `teleport-cluster` Helm chart | `teleport.example.com:443` |
|
||||
proxyAddr: ""
|
||||
|
||||
# enterprise(bool) -- controls if the `teleport-relay` chart should deploy the
|
||||
# OSS version or the enterprise version of the container image. This must be set
|
||||
# to `true` when connecting to Teleport Cloud or self-hosted Teleport Enterprise
|
||||
# clusters to allow the agent to leverage enterprise features.
|
||||
enterprise: false
|
||||
|
||||
# joinParams -- controls how the Teleport Agent joins the Teleport cluster.
|
||||
# These sub-values must be configured for the agent to connect to a cluster.
|
||||
#
|
||||
# The token used must grant the `Relay` role, and should be valid for the
|
||||
# lifetime of the Helm release.
|
||||
joinParams:
|
||||
# joinParams.method(string) -- controls which join method will be used by the
|
||||
# instance to join the Teleport cluster.
|
||||
#
|
||||
# See [the join method reference](../../reference/deployment/join-methods.mdx)
|
||||
# for the list of possible values, the implications of each join method, and
|
||||
# guides to set up each method.
|
||||
#
|
||||
# Common join-methods for the `teleport-relay` are:
|
||||
# - `token`: the most basic one, with regular ephemeral secret tokens
|
||||
# - `kubernetes`: either the `in-cluster` variant (if the agent runs in the
|
||||
# same Kubernetes cluster as the `teleport-cluster` chart) or the
|
||||
# `JWKS/OIDC` variants (work in every Kubernetes cluster, regardless of the
|
||||
# Teleport Auth Service location).
|
||||
method: ""
|
||||
|
||||
# joinParams.tokenName(string) -- controls which token is used by the agent to
|
||||
# join the Teleport cluster.
|
||||
#
|
||||
# When `joinParams.method` is [a delegated join
|
||||
# method](../../reference/deployment/join-methods.mdx#delegated-join-methods),
|
||||
# the value is not sensitive.
|
||||
#
|
||||
# When `joinParams.method` is `token` (by default), `joinParams.tokenName`
|
||||
# contains the secret token itself. In this case, the value is sensitive and
|
||||
# is automatically stored in a Kubernetes Secret instead of being directly
|
||||
# included in the agent's configuration.
|
||||
#
|
||||
# If method is `token`, `joinParams.tokenName` can be empty if the token is
|
||||
# provided through an existing Kubernetes Secret, see
|
||||
# [`joinTokenSecret`](#joinTokenSecret) for more details and instructions.
|
||||
#
|
||||
# If method is `kubernetes`, you must set
|
||||
# [`teleportClusterName`](#teleportClusterName).
|
||||
tokenName: ""
|
||||
|
||||
# teleportClusterName(string) -- is the name of the joined Teleport cluster.
|
||||
# Setting this value is required when joining via the
|
||||
# [Kubernetes JWKS or OIDC](../../reference/deployment/join-methods.mdx#kubernetes-jwks) join method.
|
||||
#
|
||||
# When this value is set, the chart mounts a kubernetes service account token
|
||||
# via a projected volume and configures Teleport to use it for joining.
|
||||
teleportClusterName: ""
|
||||
|
||||
# joinTokenSecret -- manages the join token secret creation and its name. See
|
||||
# the [`joinParams`](#joinParams) section for more details.
|
||||
joinTokenSecret:
|
||||
# joinTokenSecret.create(bool) -- controls whether the chart creates the
|
||||
# Kubernetes `Secret` containing the Teleport join token. If false, you must
|
||||
# create a Kubernetes Secret with the configured name in the Helm release
|
||||
# namespace.
|
||||
create: true
|
||||
# joinTokenSecret.name(string) -- is the name of the Kubernetes Secret
|
||||
# containing the Teleport join token used by the chart.
|
||||
#
|
||||
# If `joinTokenSecret.create` is `false`, the chart will not attempt to create
|
||||
# the secret itself. Instead, it will read the value from an existing secret.
|
||||
# `joinTokenSecret.name` configures the name of this secret. This allows you
|
||||
# to configure this secret externally and avoid having a plaintext join token
|
||||
# stored in your Teleport chart values.
|
||||
#
|
||||
# To create your own join token secret, you can use a command like this:
|
||||
#
|
||||
# ```code
|
||||
# $ kubectl --namespace teleport create secret generic my-token-secret --from-literal=auth-token=<replace-with-actual-token>
|
||||
# ```
|
||||
#
|
||||
# <Admonition type="note">
|
||||
#
|
||||
# The key used for the auth token inside the secret must be `auth-token`, as
|
||||
# in the command above.
|
||||
#
|
||||
# </Admonition>
|
||||
#
|
||||
# ```yaml
|
||||
# joinTokenSecret:
|
||||
# create: false
|
||||
# name: my-token-secret
|
||||
#
|
||||
# joinParams:
|
||||
# method: "token"
|
||||
# tokenName: ""
|
||||
# ```
|
||||
name: ""
|
||||
|
||||
# proxyProtocol(bool) -- controls whether or not the connections coming from the
|
||||
# load balancer will include a PROXY protocol v2 header.
|
||||
proxyProtocol: false
|
||||
|
||||
# log -- controls the agent logging.
|
||||
log:
|
||||
# log.level(string) -- is the log level for the Teleport process.
|
||||
# Available log levels are: `DEBUG`, `INFO`, `WARNING`, `ERROR`.
|
||||
#
|
||||
# The default is `INFO`, which is recommended in production.
|
||||
# `DEBUG` is useful during first-time setup or to see more detailed logs for debugging.
|
||||
level: INFO
|
||||
# log.format(string) -- sets the log output format for the Teleport process.
|
||||
# Possible values are `text` or `json`.
|
||||
format: json
|
||||
|
||||
# preStopDelay(string) -- the optional time that will pass between the pod
|
||||
# entering the Terminating state and the Teleport instance getting signaled to
|
||||
# begin its shutdown advertisement. Useful to allow load balancers to stop
|
||||
# routing connections to the terminating pod.
|
||||
preStopDelay: "30s"
|
||||
|
||||
# shutdownDelay(string) -- the optional time that the Teleport instance will
|
||||
# wait after advertising its shutdown and before it will stop serving new
|
||||
# inbound connections.
|
||||
shutdownDelay: "30s"
|
||||
|
||||
# terminationGracePeriodSeconds(int) -- the time allotted to a Teleport instance
|
||||
# pod for termination. It should be longer than the sum of
|
||||
# [`preStopDelay`](#preStopDelay) and [`shutdownDelay`](#shutdownDelay).
|
||||
terminationGracePeriodSeconds: 90
|
||||
|
||||
# highAvailability -- contains settings controlling the availability of the
|
||||
# Teleport Agent deployed by the chart.
|
||||
#
|
||||
# The availability can be increased by:
|
||||
# - running more replicas with `replicaCount`
|
||||
# - requiring that the Pods are not scheduled on the same Kubernetes Node with `requireAntiAffinity`
|
||||
# - by asking Kubernetes not to delete all pods at the same time with `podDisruptionBudget`.
|
||||
#
|
||||
# Even with highAvailability settings Restarting/rolling-out pods can still cause
|
||||
# disruption for established long-lived sessions.
|
||||
highAvailability:
|
||||
# highAvailability.replicaCount(int) -- is the number of agent replicas
|
||||
# deployed by the Chart.
|
||||
#
|
||||
# Set to a number higher than `1` for a high availability mode where multiple
|
||||
# Teleport pods will be deployed.
|
||||
#
|
||||
# <Admonition type="tip" title="Sizing guidelines">
|
||||
#
|
||||
# As a rough guide, we recommend configuring one replica per distinct
|
||||
# availability zone where your cluster has worker nodes.
|
||||
#
|
||||
# 2 replicas/availability zones will be fine for smaller workloads. 3-5
|
||||
# replicas/availability zones will be more appropriate for bigger clusters
|
||||
# with more traffic.
|
||||
#
|
||||
# </Admonition>
|
||||
replicaCount: 2
|
||||
|
||||
# highAvailability.podDisruptionBudget -- controls how the chart creates and
|
||||
# configures a Kubernetes PodDisruptionBudget to ensure Kubernetes does not
|
||||
# delete all agent replicas at the same time.
|
||||
podDisruptionBudget:
|
||||
# highAvailability.podDisruptionBudget.enabled(bool) -- makes the chart create
|
||||
# a Kubernetes PodDisruptionBudget for the agent pods.
|
||||
enabled: false
|
||||
|
||||
# highAvailability.podDisruptionBudget.minAvailable(intOrString) -- is the
|
||||
# minimum available pod count specified on the PodDisruptionBudget.
|
||||
minAvailable: 1
|
||||
|
||||
# resources(object) -- sets the resource requests/limits for any pods created by
|
||||
# the chart. See [the Kubernetes
|
||||
# documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/)
|
||||
# for more details.
|
||||
resources: {}
|
||||
|
||||
# service -- options for the Service that points to the Teleport Relay
|
||||
# instances.
|
||||
service:
|
||||
# service.type(string) -- the type of the Service. Unless you have specific
|
||||
# needs, it should probably be set to LoadBalancer.
|
||||
type: LoadBalancer
|
||||
# service.spec(object) -- any additional entries here will be added to the
|
||||
# Service spec.
|
||||
#
|
||||
# ```
|
||||
# spec:
|
||||
# loadBalancerIP: "1.2.3.4"
|
||||
# loadBalancerClass: service.k8s.aws/nlb
|
||||
# ```
|
||||
spec: {}
|
||||
# To set annotations on the Service, use the annotations.service value.
|
||||
|
||||
# serviceAccount -- contains settings related to the Kubernetes service account
|
||||
# used by pods.
|
||||
serviceAccount:
|
||||
# serviceAccount.create(bool) -- specifies whether a `ServiceAccount` should
|
||||
# be created or if an existing one should be used.
|
||||
create: true
|
||||
# serviceAccount.name(string) -- the name of the `ServiceAccount` to use. If
|
||||
# not set and serviceAccount.create is true, the name is generated using the
|
||||
# release name. If create is false, the name will be used to reference an
|
||||
# existing service account.
|
||||
name: ""
|
||||
# To set annotations on the `ServiceAccount`, use the
|
||||
# `annotations.serviceAccount` value.
|
||||
|
||||
# extraLabels -- contains additional Kubernetes labels to apply on the resources
|
||||
# created by the chart. See [the Kubernetes label documentation
|
||||
# ](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)
|
||||
# for more information.
|
||||
extraLabels:
|
||||
# extraLabels.config(object) -- are labels to set on the ConfigMap.
|
||||
config: {}
|
||||
# extraLabels.deployment(object) -- are labels to set on the Deployment.
|
||||
deployment: {}
|
||||
# extraLabels.pod(object) -- are labels to set on the Pods.
|
||||
pod: {}
|
||||
# extraLabels.podDisruptionBudget(object) -- are labels to set on the
|
||||
# PodDisruptionBudget.
|
||||
podDisruptionBudget: {}
|
||||
# extraLabels.secret(object) -- are labels to set on the Secret.
|
||||
secret: {}
|
||||
# extraLabels.service(object) -- are labels to set on the Service.
|
||||
service: {}
|
||||
# extraLabels.serviceAccount(object) -- are labels to set on the
|
||||
# ServiceAccount.
|
||||
serviceAccount: {}
|
||||
|
||||
# annotations -- contains annotations to apply to the different Kubernetes
|
||||
# objects created by the chart. See [the Kubernetes annotation
|
||||
# documentation](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
|
||||
# for more details.
|
||||
annotations:
|
||||
# annotations.config(object) -- are annotations to set on the ConfigMap.
|
||||
config: {}
|
||||
# annotations.deployment(object) -- are annotations to set on the Deployment.
|
||||
deployment: {}
|
||||
# annotations.pod(object) -- are annotations to set on the Pods.
|
||||
pod: {}
|
||||
# annotations.podDisruptionBudget(object) -- are annotations to set on the
|
||||
# podDisruptionBudget.
|
||||
podDisruptionBudget: {}
|
||||
# annotations.secret(object) -- are annotations to set on the Secret.
|
||||
secret: {}
|
||||
# annotations.service(object) -- are annotations to set on the Service.
|
||||
service: {}
|
||||
# annotations.serviceAccount(object) -- are annotations to set on the
|
||||
# ServiceAccount.
|
||||
serviceAccount: {}
|
||||
|
||||
# image(string) -- sets the container image used for Teleport Community Edition
|
||||
# Agent pods created by the chart.
|
||||
#
|
||||
# You can override this to use your own Teleport image rather than a
|
||||
# Teleport-published image.
|
||||
#
|
||||
# By default, the image contains only the Teleport application and its runtime
|
||||
# dependencies, and does not contain a shell.
|
||||
#
|
||||
# This setting only takes effect when [`enterprise`](#enterprise) is `false`.
|
||||
# When running an enterprise version, you must use
|
||||
# [`enterpriseImage`](#enterpriseImage) instead.
|
||||
image: public.ecr.aws/gravitational/teleport-distroless
|
||||
|
||||
# enterpriseImage(string) -- sets the container image used for Teleport Enterprise
|
||||
# agent pods created by the chart.
|
||||
#
|
||||
# You can override this to use your own Teleport image rather than a
|
||||
# Teleport-published image.
|
||||
#
|
||||
# By default, the image contains only the Teleport application and its runtime
|
||||
# dependencies, and does not contain a shell.
|
||||
#
|
||||
# This setting only takes effect when [`enterprise`](#enterprise) is `true`.
|
||||
# When running an enterprise version, you must use [`image`](#image) instead.
|
||||
enterpriseImage: public.ecr.aws/gravitational/teleport-ent-distroless
|
||||
|
||||
# imagePullSecrets(list) -- is a list of secrets containing authorization tokens
|
||||
# which can be optionally used to access a private Docker registry.
|
||||
#
|
||||
# See the [Kubernetes
|
||||
# reference](https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod)
|
||||
# for more details.
|
||||
imagePullSecrets: []
|
||||
|
||||
# imagePullPolicy(string) -- sets the pull policy for any pods created by the
|
||||
# chart. See [the Kubernetes
|
||||
# documentation](https://kubernetes.io/docs/concepts/containers/images/#updating-images)
|
||||
# for more details.
|
||||
imagePullPolicy: IfNotPresent
|
||||
|
||||
# topologySpreadConstraints(list) -- sets the topology spread constraints for
|
||||
# any pods created by the chart. See [the Kubernetes
|
||||
# documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/)
|
||||
# for more details.
|
||||
#
|
||||
# When unset, the chart defaults to a soft topology spread constraint that tries
|
||||
# to spread pods across hosts and zones.
|
||||
#
|
||||
# ```
|
||||
# topologySpreadConstraints:
|
||||
# - maxSkew: 1
|
||||
# topologyKey: kubernetes.io/hostname
|
||||
# whenUnsatisfiable: ScheduleAnyway
|
||||
# labelSelector:
|
||||
# matchLabels: # dynamically computed
|
||||
# - maxSkew: 1
|
||||
# topologyKey: topology.kubernetes.io/zone
|
||||
# whenUnsatisfiable: ScheduleAnyway
|
||||
# labelSelector:
|
||||
# matchLabels: # dynamically computed
|
||||
# ```
|
||||
topologySpreadConstraints: []
|
||||
|
||||
# disableTopologySpreadConstraints(bool) -- turns off the default topology
|
||||
# spread constraints.
|
||||
disableTopologySpreadConstraints: false
|
||||
|
||||
# affinity(object) -- sets the affinities for any pods created by the chart. See
|
||||
# [the Kubernetes
|
||||
# documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity)
|
||||
# for more details.
|
||||
affinity: {}
|
||||
|
||||
# tolerations(list) -- sets the tolerations for any pods created by the chart.
|
||||
# See [the Kubernetes
|
||||
# documentation](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
|
||||
# for more details.
|
||||
tolerations: []
|
||||
|
||||
# teleportConfig(object) -- contains YAML teleport configuration to pass to the
|
||||
# Teleport pods. The configuration will be merged with the chart-generated
|
||||
# configuration and will take precedence in case of conflict.
|
||||
#
|
||||
# See the [Teleport Configuration Reference](../../reference/deployment/config.mdx) for the list of supported fields.
|
||||
teleportConfig: {}
|
||||
|
||||
# extraArgs(list) -- contains extra arguments to pass to `teleport start` for
|
||||
# the main Teleport container.
|
||||
extraArgs: []
|
||||
|
||||
# extraEnv(list) -- contains extra environment variables to set in the main
|
||||
# Teleport container.
|
||||
#
|
||||
# For example:
|
||||
# ```yaml
|
||||
# extraEnv:
|
||||
# - name: HTTPS_PROXY
|
||||
# value: "http://username:[email protected]:3128"
|
||||
# ```
|
||||
extraEnv: []
|
||||
|
||||
# extraVolumes(list) -- contains extra volumes to mount into the Teleport pods.
|
||||
# See [the Kubernetes volume
|
||||
# documentation](https://kubernetes.io/docs/concepts/storage/volumes/) for more
|
||||
# details.
|
||||
#
|
||||
# For example:
|
||||
# ```yaml
|
||||
# extraVolumes:
|
||||
# - name: myvolume
|
||||
# secret:
|
||||
# secretName: testSecret
|
||||
# ```
|
||||
extraVolumes: []
|
||||
|
||||
# extraVolumeMounts(list) -- contains extra volumes mounts for the main Teleport
|
||||
# container. See [the Kubernetes volume
|
||||
# documentation](https://kubernetes.io/docs/concepts/storage/volumes/) for more
|
||||
# details.
|
||||
#
|
||||
# For example:
|
||||
# ```yaml
|
||||
# extraVolumesMounts:
|
||||
# - name: myvolume
|
||||
# mountPath: /path/on/host
|
||||
# ```
|
||||
extraVolumeMounts: []
|
||||
|
||||
# dnsConfig(object) -- contains custom Pod DNS Configuration for the agent pods.
|
||||
# This value is useful if you need to reduce the DNS load: set "ndots" to 0 and
|
||||
# only use FQDNs to refer to remote hosts.
|
||||
#
|
||||
# See [the Kubernetes pod DNS documentation
|
||||
# ](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config)
|
||||
# for more information.
|
||||
#
|
||||
# For example:
|
||||
# ```yaml
|
||||
# nameservers:
|
||||
# - 1.2.3.4
|
||||
# searches:
|
||||
# - ns1.svc.cluster-domain.example
|
||||
# - my.dns.search.suffix
|
||||
# options:
|
||||
# - name: ndots
|
||||
# value: "2"
|
||||
# ```
|
||||
dnsConfig: {}
|
||||
|
||||
# dnsPolicy(string) -- sets the Pod's DNS Policy
|
||||
#
|
||||
# See [the Kubernetes pod DNS documentation
|
||||
# ](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy)
|
||||
# for more information.
|
||||
dnsPolicy: ""
|
||||
|
||||
# hostAliases -- sets Host aliases in the Teleport Pod. See [the Kubernetes
|
||||
# hosts file
|
||||
# documentation](https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/)
|
||||
# for more details.
|
||||
#
|
||||
# For example:
|
||||
# ```yaml
|
||||
# hostAliases:
|
||||
# - ip: "127.0.0.1"
|
||||
# hostnames:
|
||||
# - "foo.local"
|
||||
# - "bar.local"
|
||||
# - ip: "10.1.2.3"
|
||||
# hostnames:
|
||||
# - "foo.remote"
|
||||
# - "bar.remote"
|
||||
# ```
|
||||
hostAliases: []
|
||||
|
||||
# tls -- contains settings for mounting your own TLS material in the agent pod.
|
||||
tls:
|
||||
# tls.existingCASecretName(string) -- sets the `SSL_CERT_FILE` environment
|
||||
# variable to load a trusted CA or bundle in PEM format into Teleport pods.
|
||||
# The injected CA will be used to validate TLS communications with the Proxy
|
||||
# Service.
|
||||
#
|
||||
# You must create a secret containing the CA certs in the same namespace as
|
||||
# Teleport using a command like:
|
||||
#
|
||||
# ```code
|
||||
# $ kubectl create secret generic my-root-ca --from-file=ca.pem=/path/to/root-ca.pem
|
||||
# ```
|
||||
existingCASecretName: ""
|
||||
# tls.existingCASecretKeyName(string) -- determines which key in the CA secret
|
||||
# will be used as a trusted CA bundle file.
|
||||
existingCASecretKeyName: ca.pem
|
||||
|
||||
# insecureSkipProxyTLSVerify(bool) -- disables TLS verification of the TLS
|
||||
# certificate presented by the Proxy Service.
|
||||
#
|
||||
# This can be used for joining a Teleport instance to a Teleport cluster which
|
||||
# does not have valid TLS certificates for testing.
|
||||
#
|
||||
# <Admonition type="warning">
|
||||
#
|
||||
# Using a self-signed TLS certificate and disabling TLS verification is OK for
|
||||
# testing, but is not viable when running a production Teleport cluster as it
|
||||
# will drastically reduce security. You must configure valid TLS certificates
|
||||
# on your Teleport cluster for production workloads.
|
||||
#
|
||||
# One option might be to use Teleport's built-in [ACME
|
||||
# support](../../reference/helm-reference/teleport-cluster.mdx#acme) or enable
|
||||
# [cert-manager
|
||||
# support](../../reference/helm-reference/teleport-cluster.mdx#highavailabilitycertmanager).
|
||||
#
|
||||
# </Admonition>
|
||||
insecureSkipProxyTLSVerify: false
|
||||
|
||||
# securityContext(object) -- sets the container security context for any pods
|
||||
# created by the chart. See [the Kubernetes
|
||||
# documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container)
|
||||
# for more details.
|
||||
#
|
||||
# The default value is compatible with [the restricted
|
||||
# PSS](https://kubernetes.io/docs/concepts/security/pod-security-standards/).
|
||||
#
|
||||
# To unset the security context, set it to `null` or `~`.
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
# podSecurityContext(object) -- sets the pod security context for any pods
|
||||
# created by the chart. See [the Kubernetes
|
||||
# documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod)
|
||||
# for more details.
|
||||
#
|
||||
# To unset the security context, set it to `null` or `~`.
|
||||
podSecurityContext:
|
||||
fsGroup: 65532
|
||||
|
||||
# priorityClassName(string) -- sets the priority class used by any pods created by the chart.
|
||||
# The user is responsible for creating the `PriorityClass` resource before deploying the chart.
|
||||
# See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/)
|
||||
# for more details.
|
||||
priorityClassName: ""
|
||||
|
||||
# nameOverride(string) -- optionally overrides the name of the chart, used
|
||||
# together with the release name when giving a name to resources.
|
||||
nameOverride: ""
|
||||
# fullnameOverride(string) -- optionally overrides the full name of resources.
|
||||
fullnameOverride: ""
|
||||
|
||||
# teleportVersionOverride(string) -- controls the Teleport Kubernetes Operator
|
||||
# image version deployed by the chart.
|
||||
#
|
||||
# Normally, the version of the Teleport Kubernetes Operator matches the version
|
||||
# of the chart. If you install chart version 15.0.0, you'll use Teleport version
|
||||
# 15.0.0. Upgrading the agent is done by upgrading the chart.
|
||||
#
|
||||
# <Admonition type="warning">
|
||||
#
|
||||
# `teleportVersionOverride` is intended for development and MUST NOT be used
|
||||
# to control the Teleport version in a typical deployment. This chart is
|
||||
# designed to run a specific Teleport version. You will face compatibility
|
||||
# issues trying to run a different Teleport version with it.
|
||||
#
|
||||
# If you want to run Teleport version `X.Y.Z`, you should use `helm install
|
||||
# --version X.Y.Z` instead.
|
||||
#
|
||||
# </Admonition>
|
||||
teleportVersionOverride: ""
|
||||
+1
-1
@@ -21,7 +21,7 @@ setver: validate-semver helm-version tsh-version
|
||||
# The weird -i usage is to make the sed commands work the same on both Linux and Mac. Test on both platforms if you change it.
|
||||
.PHONY:helm-version
|
||||
helm-version:
|
||||
for CHART in teleport-cluster tbot teleport-kube-agent teleport-cluster/charts/teleport-operator event-handler access/discord access/email access/jira access/mattermost access/msteams access/pagerduty access/slack access/datadog; do \
|
||||
for CHART in teleport-cluster tbot teleport-kube-agent teleport-cluster/charts/teleport-operator teleport-relay event-handler access/discord access/email access/jira access/mattermost access/msteams access/pagerduty access/slack access/datadog; do \
|
||||
sed -i'.bak' -e "s_^\\.version:\ .*_.version: \\&version \"$${VERSION}\"_g" examples/chart/$${CHART}/Chart.yaml || exit 1; \
|
||||
rm -f examples/chart/$${CHART}/Chart.yaml.bak; \
|
||||
done
|
||||
|
||||
Reference in New Issue
Block a user