mirror of
https://github.com/labring/sealos.git
synced 2026-09-19 10:54:42 +08:00
feat(terminal): migrate from manifests to helm charts (#6645)
feat(terminal): migrate from manifests to helm charts (#6644) Refactor terminal controller deployment to use Helm charts for better manageability, following the pattern established by account controller. Major changes: - Replace manifests with Helm chart structure - Add terminal-controller-entrypoint.sh for automated deployment - Remove kube-rbac-proxy sidecar container - Remove kube-proxy-rbac (metrics-reader and proxy-role) - Metrics now bind to 127.0.0.1:8080 (internal only) - Update values.yaml with full image name format - Namespace created via helm --create-namespace flag - Support resource backup, adopt, and auto-configuration 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Jiahui <4543bxy@gmail.com> Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
github-actions[bot]
co-authored by
Jiahui
Claude
Jiahui
Claude
parent
9947dbd5f0
commit
1f90ced5f5
@@ -3,12 +3,7 @@ FROM scratch
|
||||
USER 65532:65532
|
||||
|
||||
COPY registry registry
|
||||
COPY manifests manifests
|
||||
COPY charts charts
|
||||
COPY terminal-controller-entrypoint.sh terminal-controller-entrypoint.sh
|
||||
|
||||
ENV userNamespace="user-system"
|
||||
ENV cloudDomain="127.0.0.1.nip.io"
|
||||
ENV cloudPort=""
|
||||
ENV wildcardCertSecretName="wildcard-cert"
|
||||
ENV wildcardCertSecretNamespace="sealos-system"
|
||||
|
||||
CMD ["kubectl apply -f manifests"]
|
||||
CMD ["bash terminal-controller-entrypoint.sh"]
|
||||
|
||||
@@ -1,11 +1,38 @@
|
||||
### How to build image
|
||||
|
||||
```shell
|
||||
sealos build -t docker.io/labring/sealos-terminal-controller:latest -f Dockerfile .
|
||||
sealos build -t docker.io/labring/sealos-terminal-controller:latest -f Kubefile .
|
||||
```
|
||||
|
||||
### How to run
|
||||
|
||||
```shell
|
||||
sealos run docker.io/labring/sealos-terminal-controller:latest
|
||||
sealos run docker.io/labring/sealos-terminal-controller:latest
|
||||
```
|
||||
|
||||
### Configuration
|
||||
|
||||
The terminal controller supports the following environment variables:
|
||||
|
||||
- `RELEASE_NAME`: Helm release name (default: `terminal`)
|
||||
- `RELEASE_NAMESPACE`: Deployment namespace (default: `terminal-system`)
|
||||
- `CHART_PATH`: Path to helm chart (default: `./charts/terminal-controller`)
|
||||
- `HELM_OPTS`: Additional helm options
|
||||
- `SEALOS_CLOUD_DOMAIN`: Cloud domain (auto-detected from sealos-config)
|
||||
- `SEALOS_CLOUD_PORT`: Cloud port (auto-detected from sealos-config)
|
||||
- `TERMINAL_BACKUP_ENABLED`: Enable resource backup (default: `true`)
|
||||
- `TERMINAL_BACKUP_DIR`: Backup directory (default: `/tmp/sealos-backup/terminal-controller`)
|
||||
|
||||
### Deployment Structure
|
||||
|
||||
This deployment uses Helm charts for better manageability:
|
||||
|
||||
- **Chart**: `charts/terminal-controller/`
|
||||
- **Entrypoint**: `terminal-controller-entrypoint.sh`
|
||||
- **CRD**: Terminals.terminal.sealos.io
|
||||
|
||||
The controller will automatically:
|
||||
- Create namespace if it doesn't exist (via `--create-namespace`)
|
||||
- Adopt existing resources for smooth migration
|
||||
- Backup resources before upgrades
|
||||
- Configure from sealos-system configmap
|
||||
|
||||
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@@ -0,0 +1,6 @@
|
||||
apiVersion: v2
|
||||
name: terminal
|
||||
description: Helm chart for the sealos terminal controller
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "0.1.0"
|
||||
+97
@@ -0,0 +1,97 @@
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.9.0
|
||||
creationTimestamp: null
|
||||
name: terminals.terminal.sealos.io
|
||||
spec:
|
||||
group: terminal.sealos.io
|
||||
names:
|
||||
kind: Terminal
|
||||
listKind: TerminalList
|
||||
plural: terminals
|
||||
singular: terminal
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.user
|
||||
name: User
|
||||
type: string
|
||||
- jsonPath: .spec.keepalived
|
||||
name: Keepalived
|
||||
type: string
|
||||
- jsonPath: .status.domain
|
||||
name: Domain
|
||||
type: string
|
||||
- jsonPath: .metadata.annotations.lastUpdateTime
|
||||
name: LastUpdateTime
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: Terminal is the Schema for the terminals API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: TerminalSpec defines the desired state of Terminal
|
||||
properties:
|
||||
apiServer:
|
||||
type: string
|
||||
ingressType:
|
||||
default: nginx
|
||||
enum:
|
||||
- nginx
|
||||
type: string
|
||||
keepalived:
|
||||
type: string
|
||||
replicas:
|
||||
format: int32
|
||||
type: integer
|
||||
token:
|
||||
type: string
|
||||
ttyImage:
|
||||
type: string
|
||||
user:
|
||||
type: string
|
||||
required:
|
||||
- keepalived
|
||||
- replicas
|
||||
- token
|
||||
- ttyImage
|
||||
- user
|
||||
type: object
|
||||
status:
|
||||
description: TerminalStatus defines the observed state of Terminal
|
||||
properties:
|
||||
availableReplicas:
|
||||
format: int32
|
||||
type: integer
|
||||
domain:
|
||||
type: string
|
||||
secretHeader:
|
||||
type: string
|
||||
serviceName:
|
||||
type: string
|
||||
required:
|
||||
- availableReplicas
|
||||
- domain
|
||||
- secretHeader
|
||||
- serviceName
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,8 @@
|
||||
Thank you for installing {{ .Chart.Name }}.
|
||||
|
||||
Your release is named {{ .Release.Name }}.
|
||||
|
||||
To learn more about the release, try:
|
||||
|
||||
$ helm status {{ .Release.Name }}
|
||||
$ helm get all {{ .Release.Name }}
|
||||
@@ -0,0 +1,60 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "terminal.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
*/}}
|
||||
{{- define "terminal.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "terminal.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "terminal.labels" -}}
|
||||
helm.sh/chart: {{ include "terminal.chart" . }}
|
||||
{{ include "terminal.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "terminal.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "terminal.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "terminal.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "terminal.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,27 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "terminal.fullname" . }}-manager-config
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
{{- include "terminal.labels" . | nindent 4 }}
|
||||
data:
|
||||
controller_manager_config.yaml: |
|
||||
apiVersion: controller-runtime.sigs.k8s.io/v1alpha1
|
||||
kind: ControllerManagerConfig
|
||||
health:
|
||||
healthProbeBindAddress: :8081
|
||||
metrics:
|
||||
bindAddress: 127.0.0.1:8080
|
||||
leaderElection:
|
||||
leaderElect: true
|
||||
resourceName: 50686b4e.sealos.io
|
||||
config.yaml: |
|
||||
global:
|
||||
cloudDomain: {{ .Values.config.cloudDomain | quote }}
|
||||
{{- if .Values.config.cloudPort }}
|
||||
cloudPort: {{ .Values.config.cloudPort | quote }}
|
||||
{{- end }}
|
||||
terminalController:
|
||||
ingressTLSSecretName: {{ .Values.config.ingressTLSSecretName | quote }}
|
||||
@@ -0,0 +1,98 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "terminal.fullname" . }}-controller-manager
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
{{- include "terminal.labels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
selector:
|
||||
matchLabels:
|
||||
control-plane: controller-manager
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
kubectl.kubernetes.io/default-container: manager
|
||||
checksum/terminal-manager-config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
{{- include "terminal.labels" . | nindent 8 }}
|
||||
{{- with .Values.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "terminal.serviceAccountName" . }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
containers:
|
||||
- name: manager
|
||||
command:
|
||||
- /manager
|
||||
args:
|
||||
- --health-probe-bind-address=:8081
|
||||
- --metrics-bind-address=127.0.0.1:8080
|
||||
- --leader-elect
|
||||
- --config-file-path=/config.yaml
|
||||
env:
|
||||
- name: TERMINAL_SYSTEM_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
image: "{{ .Values.image }}"
|
||||
imagePullPolicy: {{ .Values.imagePullPolicy }}
|
||||
livenessProbe:
|
||||
{{- toYaml .Values.livenessProbe | nindent 12 }}
|
||||
readinessProbe:
|
||||
{{- toYaml .Values.readinessProbe | nindent 12 }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
volumeMounts:
|
||||
{{- with .Values.volumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
- name: terminal-manager-config
|
||||
mountPath: /config.yaml
|
||||
subPath: config.yaml
|
||||
terminationGracePeriodSeconds: 10
|
||||
affinity:
|
||||
{{- if .Values.affinity }}
|
||||
{{- toYaml .Values.affinity | nindent 8 }}
|
||||
{{- else }}
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
podAffinityTerm:
|
||||
labelSelector:
|
||||
matchExpressions:
|
||||
- key: control-plane
|
||||
operator: In
|
||||
values:
|
||||
- controller-manager
|
||||
topologyKey: kubernetes.io/hostname
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- with .Values.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
- name: terminal-manager-config
|
||||
configMap:
|
||||
name: {{ include "terminal.fullname" . }}-manager-config
|
||||
@@ -0,0 +1,174 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "terminal.fullname" . }}-leader-election-role
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
{{- include "terminal.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "terminal.fullname" . }}-manager-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- rolebindings
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- roles
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- terminal.sealos.io
|
||||
resources:
|
||||
- terminals
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- terminal.sealos.io
|
||||
resources:
|
||||
- terminals/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- terminal.sealos.io
|
||||
resources:
|
||||
- terminals/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "terminal.fullname" . }}-leader-election-rolebinding
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
{{- include "terminal.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ include "terminal.fullname" . }}-leader-election-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "terminal.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "terminal.fullname" . }}-manager-rolebinding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "terminal.fullname" . }}-manager-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "terminal.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
@@ -0,0 +1,16 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
{{- include "terminal.labels" . | nindent 4 }}
|
||||
name: {{ include "terminal.fullname" . }}-controller-manager-metrics-service
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
ports:
|
||||
- name: https
|
||||
port: 8443
|
||||
protocol: TCP
|
||||
targetPort: https
|
||||
selector:
|
||||
control-plane: controller-manager
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "terminal.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
{{- include "terminal.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,67 @@
|
||||
# Default values for terminal controller helm chart.
|
||||
|
||||
replicaCount: 1
|
||||
|
||||
image: ghcr.io/labring/sealos-terminal-controller:latest
|
||||
imagePullPolicy: Always
|
||||
|
||||
imagePullSecrets: []
|
||||
nameOverride: ""
|
||||
fullnameOverride: "terminal"
|
||||
|
||||
serviceAccount:
|
||||
create: true
|
||||
automount: true
|
||||
annotations: {}
|
||||
name: "terminal-controller-manager"
|
||||
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
podSecurityContext:
|
||||
runAsNonRoot: true
|
||||
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
runAsNonRoot: true
|
||||
|
||||
service:
|
||||
metrics:
|
||||
port: 8443
|
||||
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 64Mi
|
||||
|
||||
config:
|
||||
cloudDomain: "cloud.sealos.io"
|
||||
cloudPort: ""
|
||||
ingressTLSSecretName: "wildcard-cert-sealos"
|
||||
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8081
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 8081
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
|
||||
volumes: []
|
||||
volumeMounts: []
|
||||
|
||||
nodeSelector: {}
|
||||
|
||||
tolerations: []
|
||||
|
||||
# If no affinity is provided a default podAntiAffinity is used to spread controllers.
|
||||
affinity: {}
|
||||
@@ -1,476 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
name: terminal-system
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.9.0
|
||||
creationTimestamp: null
|
||||
name: terminals.terminal.sealos.io
|
||||
spec:
|
||||
group: terminal.sealos.io
|
||||
names:
|
||||
kind: Terminal
|
||||
listKind: TerminalList
|
||||
plural: terminals
|
||||
singular: terminal
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.user
|
||||
name: User
|
||||
type: string
|
||||
- jsonPath: .spec.keepalived
|
||||
name: Keepalived
|
||||
type: string
|
||||
- jsonPath: .status.domain
|
||||
name: Domain
|
||||
type: string
|
||||
- jsonPath: .metadata.annotations.lastUpdateTime
|
||||
name: LastUpdateTime
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: Terminal is the Schema for the terminals API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: TerminalSpec defines the desired state of Terminal
|
||||
properties:
|
||||
apiServer:
|
||||
type: string
|
||||
ingressType:
|
||||
default: nginx
|
||||
enum:
|
||||
- nginx
|
||||
type: string
|
||||
keepalived:
|
||||
type: string
|
||||
replicas:
|
||||
format: int32
|
||||
type: integer
|
||||
token:
|
||||
type: string
|
||||
ttyImage:
|
||||
type: string
|
||||
user:
|
||||
type: string
|
||||
required:
|
||||
- keepalived
|
||||
- replicas
|
||||
- token
|
||||
- ttyImage
|
||||
- user
|
||||
type: object
|
||||
status:
|
||||
description: TerminalStatus defines the observed state of Terminal
|
||||
properties:
|
||||
availableReplicas:
|
||||
format: int32
|
||||
type: integer
|
||||
domain:
|
||||
type: string
|
||||
secretHeader:
|
||||
type: string
|
||||
serviceName:
|
||||
type: string
|
||||
required:
|
||||
- availableReplicas
|
||||
- domain
|
||||
- secretHeader
|
||||
- serviceName
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: terminal-controller-manager
|
||||
namespace: terminal-system
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: terminal-leader-election-role
|
||||
namespace: terminal-system
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: terminal-manager-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- rolebindings
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- roles
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- terminal.sealos.io
|
||||
resources:
|
||||
- terminals
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- terminal.sealos.io
|
||||
resources:
|
||||
- terminals/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- terminal.sealos.io
|
||||
resources:
|
||||
- terminals/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: terminal-metrics-reader
|
||||
rules:
|
||||
- nonResourceURLs:
|
||||
- /metrics
|
||||
verbs:
|
||||
- get
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: terminal-proxy-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- authentication.k8s.io
|
||||
resources:
|
||||
- tokenreviews
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- authorization.k8s.io
|
||||
resources:
|
||||
- subjectaccessreviews
|
||||
verbs:
|
||||
- create
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: terminal-leader-election-rolebinding
|
||||
namespace: terminal-system
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: terminal-leader-election-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: terminal-controller-manager
|
||||
namespace: terminal-system
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: terminal-manager-rolebinding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: terminal-manager-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: terminal-controller-manager
|
||||
namespace: terminal-system
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: terminal-proxy-rolebinding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: terminal-proxy-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: terminal-controller-manager
|
||||
namespace: terminal-system
|
||||
---
|
||||
apiVersion: v1
|
||||
data:
|
||||
controller_manager_config.yaml: |
|
||||
apiVersion: controller-runtime.sigs.k8s.io/v1alpha1
|
||||
kind: ControllerManagerConfig
|
||||
health:
|
||||
healthProbeBindAddress: :8081
|
||||
metrics:
|
||||
bindAddress: 127.0.0.1:8080
|
||||
webhook:
|
||||
port: 9443
|
||||
leaderElection:
|
||||
leaderElect: true
|
||||
resourceName: 50686b4e.sealos.io
|
||||
# leaderElectionReleaseOnCancel defines if the leader should step down volume
|
||||
# when the Manager ends. This requires the binary to immediately end when the
|
||||
# Manager is stopped, otherwise, this setting is unsafe. Setting this significantly
|
||||
# speeds up voluntary leader transitions as the new leader don't have to wait
|
||||
# LeaseDuration time first.
|
||||
# In the default scaffold provided, the program ends immediately after
|
||||
# the manager stops, so would be fine to enable this option. However,
|
||||
# if you are doing or is intended to do any operation such as perform cleanups
|
||||
# after the manager stops then its usage might be unsafe.
|
||||
# leaderElectionReleaseOnCancel: true
|
||||
config.yaml: |
|
||||
global:
|
||||
cloudDomain: {{ .cloudDomain }}
|
||||
cloudPort: {{ if .cloudPort }}{{ .cloudPort }}{{ end }}
|
||||
terminalController:
|
||||
ingressTLSSecretName: {{ .wildcardCertSecretName }}
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: terminal-manager-config
|
||||
namespace: terminal-system
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
name: terminal-controller-manager-metrics-service
|
||||
namespace: terminal-system
|
||||
spec:
|
||||
ports:
|
||||
- name: https
|
||||
port: 8443
|
||||
protocol: TCP
|
||||
targetPort: https
|
||||
selector:
|
||||
control-plane: controller-manager
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
name: terminal-controller-manager
|
||||
namespace: terminal-system
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
control-plane: controller-manager
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
kubectl.kubernetes.io/default-container: manager
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- --secure-listen-address=0.0.0.0:8443
|
||||
- --upstream=http://127.0.0.1:8080/
|
||||
- --logtostderr=true
|
||||
- --v=0
|
||||
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.12.0
|
||||
name: kube-rbac-proxy
|
||||
ports:
|
||||
- containerPort: 8443
|
||||
name: https
|
||||
protocol: TCP
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 1024Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
runAsNonRoot: true
|
||||
- args:
|
||||
- --health-probe-bind-address=:8081
|
||||
- --metrics-bind-address=127.0.0.1:8080
|
||||
- --leader-elect
|
||||
- --config-file-path=/config.yaml
|
||||
command:
|
||||
- /manager
|
||||
image: ghcr.io/labring/sealos-terminal-controller:latest
|
||||
imagePullPolicy: Always
|
||||
volumeMounts:
|
||||
- name: terminal-manager-volume
|
||||
mountPath: /config.yaml
|
||||
subPath: config.yaml
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8081
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
name: manager
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 8081
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 64Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
runAsNonRoot: true
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
serviceAccountName: terminal-controller-manager
|
||||
terminationGracePeriodSeconds: 10
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
podAffinityTerm:
|
||||
labelSelector:
|
||||
matchExpressions:
|
||||
- key: "control-plane"
|
||||
operator: In
|
||||
values:
|
||||
- controller-manager
|
||||
topologyKey: "kubernetes.io/hostname"
|
||||
volumes:
|
||||
- name: terminal-manager-volume
|
||||
configMap:
|
||||
name: terminal-manager-config
|
||||
@@ -0,0 +1,120 @@
|
||||
#!/bin/bash
|
||||
set -ex
|
||||
|
||||
HELM_OPTS=${HELM_OPTS:-""}
|
||||
RELEASE_NAME=${RELEASE_NAME:-"terminal"}
|
||||
RELEASE_NAMESPACE=${RELEASE_NAMESPACE:-"terminal-system"}
|
||||
CHART_PATH=${CHART_PATH:-"./charts/terminal-controller"}
|
||||
|
||||
TERMINAL_BACKUP_ENABLED=${TERMINAL_BACKUP_ENABLED:-"true"}
|
||||
TERMINAL_BACKUP_DIR=${TERMINAL_BACKUP_DIR:-"/tmp/sealos-backup/terminal-controller"}
|
||||
|
||||
adopt_namespaced_resource() {
|
||||
local kind="$1"
|
||||
local name="$2"
|
||||
if kubectl -n "${RELEASE_NAMESPACE}" get "${kind}" "${name}" >/dev/null 2>&1; then
|
||||
kubectl -n "${RELEASE_NAMESPACE}" label "${kind}" "${name}" app.kubernetes.io/managed-by=Helm --overwrite >/dev/null 2>&1 || true
|
||||
kubectl -n "${RELEASE_NAMESPACE}" annotate "${kind}" "${name}" meta.helm.sh/release-name="${RELEASE_NAME}" meta.helm.sh/release-namespace="${RELEASE_NAMESPACE}" --overwrite >/dev/null 2>&1 || true
|
||||
fi
|
||||
}
|
||||
|
||||
adopt_cluster_resource() {
|
||||
local kind="$1"
|
||||
local name="$2"
|
||||
if kubectl get "${kind}" "${name}" >/dev/null 2>&1; then
|
||||
kubectl label "${kind}" "${name}" app.kubernetes.io/managed-by=Helm --overwrite >/dev/null 2>&1 || true
|
||||
kubectl annotate "${kind}" "${name}" meta.helm.sh/release-name="${RELEASE_NAME}" meta.helm.sh/release-namespace="${RELEASE_NAMESPACE}" --overwrite >/dev/null 2>&1 || true
|
||||
fi
|
||||
}
|
||||
|
||||
get_cm_value() {
|
||||
local namespace="$1"
|
||||
local name="$2"
|
||||
local key="$3"
|
||||
kubectl get configmap "${name}" -n "${namespace}" -o "jsonpath={.data.${key}}" 2>/dev/null || true
|
||||
}
|
||||
|
||||
add_set_string() {
|
||||
local key="$1"
|
||||
local value="$2"
|
||||
HELM_SET_ARGS+=(--set-string "${key}=${value}")
|
||||
}
|
||||
|
||||
backup_ns_resource() {
|
||||
local kind="$1"
|
||||
local name="$2"
|
||||
if kubectl -n "${RELEASE_NAMESPACE}" get "${kind}" "${name}" >/dev/null 2>&1; then
|
||||
kubectl -n "${RELEASE_NAMESPACE}" get "${kind}" "${name}" -o yaml >> "${TERMINAL_BACKUP_FILE}"
|
||||
printf "\n---\n" >> "${TERMINAL_BACKUP_FILE}"
|
||||
fi
|
||||
}
|
||||
|
||||
backup_cluster_resource() {
|
||||
local kind="$1"
|
||||
local name="$2"
|
||||
if kubectl get "${kind}" "${name}" >/dev/null 2>&1; then
|
||||
kubectl get "${kind}" "${name}" -o yaml >> "${TERMINAL_BACKUP_FILE}"
|
||||
printf "\n---\n" >> "${TERMINAL_BACKUP_FILE}"
|
||||
fi
|
||||
}
|
||||
|
||||
backup_terminal_resources() {
|
||||
if [ "${TERMINAL_BACKUP_ENABLED}" != "true" ]; then
|
||||
return
|
||||
fi
|
||||
local ts
|
||||
ts=$(date +%Y%m%d%H%M%S)
|
||||
mkdir -p "${TERMINAL_BACKUP_DIR}"
|
||||
TERMINAL_BACKUP_FILE="${TERMINAL_BACKUP_DIR}/update-${ts}.yaml"
|
||||
: > "${TERMINAL_BACKUP_FILE}"
|
||||
|
||||
backup_cluster_resource customresourcedefinition terminals.terminal.sealos.io
|
||||
backup_cluster_resource clusterrole terminal-manager-role
|
||||
backup_cluster_resource clusterrolebinding terminal-manager-rolebinding
|
||||
|
||||
if kubectl get namespace "${RELEASE_NAMESPACE}" >/dev/null 2>&1; then
|
||||
kubectl get namespace "${RELEASE_NAMESPACE}" -o yaml >> "${TERMINAL_BACKUP_FILE}"
|
||||
printf "\n---\n" >> "${TERMINAL_BACKUP_FILE}"
|
||||
fi
|
||||
backup_ns_resource configmap terminal-manager-config
|
||||
backup_ns_resource service terminal-controller-manager-metrics-service
|
||||
backup_ns_resource deployment terminal-controller-manager
|
||||
backup_ns_resource serviceaccount terminal-controller-manager
|
||||
backup_ns_resource role terminal-leader-election-role
|
||||
backup_ns_resource rolebinding terminal-leader-election-rolebinding
|
||||
}
|
||||
|
||||
backup_terminal_resources
|
||||
|
||||
HELM_SET_ARGS=()
|
||||
|
||||
# Auto configure from sealos-config
|
||||
SEALOS_CLOUD_DOMAIN=${SEALOS_CLOUD_DOMAIN:-"$(get_cm_value sealos-system sealos-config cloudDomain)"}
|
||||
SEALOS_CLOUD_PORT=${SEALOS_CLOUD_PORT:-"$(get_cm_value sealos-system sealos-config cloudPort)"}
|
||||
|
||||
if [ -n "${SEALOS_CLOUD_DOMAIN}" ]; then
|
||||
add_set_string config.cloudDomain "${SEALOS_CLOUD_DOMAIN}"
|
||||
fi
|
||||
|
||||
if [ -n "${SEALOS_CLOUD_PORT}" ]; then
|
||||
add_set_string config.cloudPort "${SEALOS_CLOUD_PORT}"
|
||||
fi
|
||||
|
||||
if ! helm status "${RELEASE_NAME}" -n "${RELEASE_NAMESPACE}" >/dev/null 2>&1; then
|
||||
if kubectl get namespace "${RELEASE_NAMESPACE}" >/dev/null 2>&1; then
|
||||
kubectl label namespace "${RELEASE_NAMESPACE}" app.kubernetes.io/managed-by=Helm --overwrite >/dev/null 2>&1 || true
|
||||
kubectl annotate namespace "${RELEASE_NAMESPACE}" meta.helm.sh/release-name="${RELEASE_NAME}" meta.helm.sh/release-namespace="${RELEASE_NAMESPACE}" --overwrite >/dev/null 2>&1 || true
|
||||
fi
|
||||
|
||||
adopt_namespaced_resource configmap terminal-manager-config
|
||||
adopt_namespaced_resource service terminal-controller-manager-metrics-service
|
||||
adopt_namespaced_resource deployment terminal-controller-manager
|
||||
adopt_namespaced_resource serviceaccount terminal-controller-manager
|
||||
adopt_namespaced_resource role terminal-leader-election-role
|
||||
adopt_namespaced_resource rolebinding terminal-leader-election-rolebinding
|
||||
|
||||
adopt_cluster_resource clusterrole terminal-manager-role
|
||||
adopt_cluster_resource clusterrolebinding terminal-manager-rolebinding
|
||||
fi
|
||||
|
||||
helm upgrade -i "${RELEASE_NAME}" -n "${RELEASE_NAMESPACE}" --create-namespace "${CHART_PATH}" "${HELM_SET_ARGS[@]}" ${HELM_OPTS}
|
||||
Reference in New Issue
Block a user