Skip to content

Commit 7d4bbd2

Browse files
butler54butler54
committed
feat: remove lets encrypt
Signed-off-by: Chris Butler <chris.butler@redhat.com>
1 parent 4b67132 commit 7d4bbd2

20 files changed

+366
-25
lines changed

‎charts/all/routingtests/Chart.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: v2
2+
description: Example
3+
name: routing-tests
4+
type: application
5+
6+
# This is the chart version. This version number should be incremented each time you make changes
7+
# to the chart and its templates, including the app version.
8+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
9+
version: 0.1.0
10+
11+
# This is the version number of the application being deployed. This version number should be
12+
# incremented each time you make changes to the application. Versions are not expected to
13+
# follow Semantic Versioning. They should reflect the version the application is using.
14+
# It is recommended to use it with quotes.
15+
appVersion: "1.0.0"

‎charts/all/routingtests/templates/ingress-based-route.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: Ingress
3+
metadata:
4+
name: test
5+
spec:
6+
ingressClassName: openshift-default
7+
rules:
8+
- host: test.test.coco.t9t8p.azure.redhatworkshops.io
9+
http:
10+
paths:
11+
- backend:
12+
service:
13+
name: standard
14+
port:
15+
number: 8888
16+
path: /
17+
pathType: Prefix

‎charts/all/routingtests/templates/standard-pod.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: standard
5+
labels:
6+
app: standard
7+
spec:
8+
runtimeClassName: {{ .Values.global.runtimeClass }}
9+
containers:
10+
- name: hello-openshift
11+
image: quay.io/openshift/origin-hello-openshift
12+
ports:
13+
- containerPort: 8888
14+
securityContext:
15+
privileged: false
16+
allowPrivilegeEscalation: false
17+
runAsNonRoot: true
18+
runAsUser: 1001
19+
capabilities:
20+
drop:
21+
- ALL
22+
seccompProfile:
23+
type: RuntimeDefault

‎charts/all/routingtests/templates/standard-route.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: route.openshift.io/v1
2+
kind: Route
3+
metadata:
4+
name: defacto-standards
5+
spec:
6+
port:
7+
targetPort: 8888
8+
to:
9+
kind: Service
10+
name: standard
11+
weight: 100
12+
wildcardPolicy: None

‎charts/all/routingtests/templates/standard-svc.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: standard
5+
spec:
6+
ports:
7+
- name: 8888-tcp
8+
port: 8888
9+
protocol: TCP
10+
targetPort: 8888
11+
selector:
12+
app: standard
13+
sessionAffinity: None
14+
type: ClusterIP

‎charts/all/routingtests/values.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
2+
secretStore:
3+
name: vault-backend
4+
kind: ClusterSecretStore
5+
6+
# Secret provisioned for the AWS Controller for Kubernetes - S3
7+
# Begin global parameters
8+
9+
10+
dsp:
11+
name: science-project
12+
description: "My science project"
13+
notebookStorage: '20Gi'
14+
pushSecret: true
15+
16+
# https://github.com/openshift-ai-examples/openshift-ai-examples/blob/main/openshift-ai-deploy-llm/manifests/3-notebook-template.yaml
17+

‎charts/coco-supported/custom-init/Chart.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: v2
2+
description: A Helm chart which uses ACM to deploy a pod with custom init data including inferring the certificate.
3+
keywords:
4+
- pattern
5+
- upstream
6+
- sandbox
7+
name: custom-init
8+
version: 0.0.1

‎charts/coco-supported/custom-init/initdata.toml.tpl‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
algorithm = "sha384"
2+
version = "0.1.0"
3+
4+
[data]
5+
"aa.toml" = '''
6+
[token_configs]
7+
[token_configs.coco_as]
8+
url = 'https://kbs-trustee-operator-system.{{ .Values.global.hubClusterDomain }}'
9+
10+
11+
[token_configs.kbs]
12+
url = 'https://kbs-trustee-operator-system.{{ .Values.global.hubClusterDomain }}'
13+
cert = """
14+
acmmagickey_trustee_cert
15+
"""
16+
'''
17+
18+
"cdh.toml" = '''
19+
socket = 'unix:///run/confidential-containers/cdh.sock'
20+
credentials = []
21+
22+
[kbc]
23+
name = 'cc_kbc'
24+
url = 'https://kbs-trustee-operator-system.{{ .Values.global.hubClusterDomain }}'
25+
kbs_cert = """
26+
acmmagickey_trustee_cert
27+
"""
28+
'''
29+
30+
"policy.rego" = '''
31+
package agent_policy
32+
33+
default AddARPNeighborsRequest := true
34+
default AddSwapRequest := true
35+
default CloseStdinRequest := true
36+
default CopyFileRequest := true
37+
default CreateContainerRequest := true
38+
default CreateSandboxRequest := true
39+
default DestroySandboxRequest := true
40+
default ExecProcessRequest := true
41+
default GetMetricsRequest := true
42+
default GetOOMEventRequest := true
43+
default GuestDetailsRequest := true
44+
default ListInterfacesRequest := true
45+
default ListRoutesRequest := true
46+
default MemHotplugByProbeRequest := true
47+
default OnlineCPUMemRequest := true
48+
default PauseContainerRequest := true
49+
default PullImageRequest := true
50+
default ReadStreamRequest := true
51+
default RemoveContainerRequest := true
52+
default RemoveStaleVirtiofsShareMountsRequest := true
53+
default ReseedRandomDevRequest := true
54+
default ResumeContainerRequest := true
55+
default SetGuestDateTimeRequest := true
56+
default SetPolicyRequest := true
57+
default SignalProcessRequest := true
58+
default StartContainerRequest := true
59+
default StartTracingRequest := true
60+
default StatsContainerRequest := true
61+
default StopTracingRequest := true
62+
default TtyWinResizeRequest := true
63+
default UpdateContainerRequest := true
64+
default UpdateEphemeralMountsRequest := true
65+
default UpdateInterfaceRequest := true
66+
default UpdateRoutesRequest := true
67+
default WaitProcessRequest := true
68+
default WriteStreamRequest := true
69+
'''

‎charts/coco-supported/custom-init/templates/custom-initdata-injection.yaml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
---
2+
apiVersion: policy.open-cluster-management.io/v1
3+
kind: Policy
4+
metadata:
5+
name: custominit-pod-policy
6+
spec:
7+
remediationAction: enforce
8+
disabled: false
9+
policy-templates:
10+
- objectDefinition:
11+
apiVersion: policy.open-cluster-management.io/v1
12+
kind: ConfigurationPolicy
13+
metadata:
14+
name: custominit-pod-cp
15+
spec:
16+
remediationAction: enforce
17+
severity: medium
18+
object-templates:
19+
20+
- complianceType: mustonlyhave
21+
objectDefinition:
22+
apiVersion: v1
23+
kind: Pod
24+
metadata:
25+
name: custom
26+
namespace: custom-init
27+
labels:
28+
app: custom
29+
annotations:
30+
io.katacontainers.config.runtime.cc_init_data: '{{ `{{if (lookup "operator.openshift.io/v1" "IngressController" "openshift-ingress-operator" "default").spec.defaultCertificate.name }}{{ fromConfigMap "openshift-sandboxed-containers-operator" "initdata-placeholder" "initdata" | base64dec | replace "acmmagickey_trustee_cert" (fromSecret "openshift-ingress" (lookup "operator.openshift.io/v1" "IngressController" "openshift-ingress-operator" "default").spec.defaultCertificate.name "tls.crt" | base64dec) | base64enc }}{{ else }}{{ fromConfigMap "openshift-sandboxed-containers-operator" "initdata-placeholder" "initdata" | base64dec | replace "acmmagickey_trustee_cert" (fromSecret "openshift-ingress" "router-certs-default" "tls.crt" | base64dec) | base64enc }}{{ end }}` }}'
31+
peerpods: "true"
32+
spec:
33+
runtimeClassName: kata-remote
34+
containers:
35+
- name: hello-openshift
36+
image: quay.io/openshift/origin-hello-openshift
37+
ports:
38+
- containerPort: 8888
39+
securityContext:
40+
privileged: false
41+
allowPrivilegeEscalation: false
42+
runAsNonRoot: true
43+
runAsUser: 1001
44+
capabilities:
45+
drop:
46+
- ALL
47+
seccompProfile:
48+
type: RuntimeDefault
49+
50+
51+
---
52+
apiVersion: policy.open-cluster-management.io/v1
53+
kind: PlacementBinding
54+
metadata:
55+
name: custominit-placement-binding
56+
annotations:
57+
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
58+
placementRef:
59+
name: custominit-placement-rule
60+
kind: PlacementRule
61+
apiGroup: apps.open-cluster-management.io
62+
subjects:
63+
- name: custominit-pod-policy
64+
kind: Policy
65+
apiGroup: policy.open-cluster-management.io
66+
---
67+
apiVersion: apps.open-cluster-management.io/v1
68+
kind: PlacementRule
69+
metadata:
70+
name: custominit-placement-rule
71+
spec:
72+
clusterConditions:
73+
- status: 'True'
74+
type: ManagedClusterConditionAvailable
75+
clusterSelector:
76+
matchLabels:
77+
cloud: Azure
78+
---
79+
{{- end }}

‎charts/coco-supported/custom-init/templates/custom-route.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: route.openshift.io/v1
2+
kind: Route
3+
metadata:
4+
name: custom
5+
namespace: custom-init
6+
spec:
7+
port:
8+
targetPort: 8888
9+
to:
10+
kind: Service
11+
name: custom
12+
weight: 100
13+
wildcardPolicy: None

0 commit comments

Comments
 (0)