mirror of
https://github.com/labring/sealos.git
synced 2026-08-29 01:39:49 +08:00
feature(main): add pyament deploy (#2035)
* feature(main): add pyament deploy Signed-off-by: cuisongliu <cuisongliu@qq.com>
This commit is contained in:
cuisongliu
@@ -85,7 +85,7 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
matrix:
|
||||
module: [ user, terminal ]
|
||||
module: [ app,cluster,infra,metering,user, terminal,imagehub ]
|
||||
permissions:
|
||||
issues: write
|
||||
steps:
|
||||
|
||||
@@ -19,7 +19,7 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
matrix:
|
||||
module: [ auth, payment ]
|
||||
module: [ auth ]
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v3
|
||||
@@ -80,21 +80,22 @@ jobs:
|
||||
-f Dockerfile \
|
||||
.
|
||||
|
||||
# build-on-cluster-image:
|
||||
# needs:
|
||||
# - image-build
|
||||
# runs-on: ubuntu-latest
|
||||
# strategy:
|
||||
# matrix:
|
||||
# module: [ auth, payment ]
|
||||
# permissions:
|
||||
# issues: write
|
||||
# steps:
|
||||
# - name: Build ${{ matrix.module }}-webhook image
|
||||
# uses: peter-evans/create-or-update-comment@v1
|
||||
# with:
|
||||
# issue-number: 140
|
||||
# repository: labring/cluster-image
|
||||
# body: |
|
||||
# /imagebuild_apps sealos-${{ matrix.module }}-service dev
|
||||
# token: "${{ secrets.GH_TOKEN }}"
|
||||
build-on-cluster-image:
|
||||
needs:
|
||||
- image-build
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
matrix:
|
||||
module: [ auth ]
|
||||
permissions:
|
||||
issues: write
|
||||
steps:
|
||||
- name: Build ${{ matrix.module }}-service image
|
||||
uses: peter-evans/create-or-update-comment@v1
|
||||
if: github.repository == 'labring/sealos'
|
||||
with:
|
||||
issue-number: 140
|
||||
repository: labring/cluster-image
|
||||
body: |
|
||||
/imagebuild_apps sealos-${{ matrix.module }}-service dev
|
||||
token: "${{ secrets.GH_TOKEN }}"
|
||||
|
||||
@@ -94,7 +94,7 @@ uninstall: manifests kustomize ## Uninstall CRDs from the K8s cluster specified
|
||||
.PHONY: pre-deploy
|
||||
pre-deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
|
||||
cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
|
||||
$(KUSTOMIZE) build config/default > deploy/manifests/deploy.yaml
|
||||
$(KUSTOMIZE) build config/default > deploy/manifests/deploy.yaml.tmpl
|
||||
|
||||
.PHONY: deploy
|
||||
deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
FROM scratch
|
||||
USER 65532:65532
|
||||
COPY registry ./registry
|
||||
COPY manifests ./terminal-controller
|
||||
CMD ["kubectl apply -f terminal-controller/deploy.yaml"]
|
||||
COPY manifests ./manifests/terminal-controller
|
||||
ENV USER_NAMESPACE=user-system
|
||||
CMD ["kubectl apply -f manifests/terminal-controller/deploy.yaml"]
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### How to build image
|
||||
|
||||
```shell
|
||||
sealos build -t docker.io/labring/sealos-terminal-controller:dev -f Dockerfile .
|
||||
```
|
||||
|
||||
### Env
|
||||
|
||||
| Name | Description | Default |
|
||||
| --- |---------------------------| --- |
|
||||
|`USER_NAMESPACE`| user controller namespace |`user-system`|
|
||||
|
||||
### How to run
|
||||
|
||||
```shell
|
||||
sealos run --env USER_NAMESPACE=user-system docker.io/labring/sealos-terminal-controller:dev
|
||||
```
|
||||
+1
-1
@@ -412,7 +412,7 @@ spec:
|
||||
- /manager
|
||||
env:
|
||||
- name: USER_NAMESPACE
|
||||
value: user-system
|
||||
value: {{ .USER_NAMESPACE }}
|
||||
image: ghcr.io/labring/sealos-terminal-controller:dev
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
@@ -94,12 +94,12 @@ uninstall: manifests kustomize ## Uninstall CRDs from the K8s cluster specified
|
||||
.PHONY: deploy
|
||||
deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
|
||||
cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
|
||||
$(KUSTOMIZE) build config/default | kubectl apply -f -
|
||||
$(KUSTOMIZE) build -e SERVICE_NAME=webhook-service -e SERVICE_NAMESPACE=system | kubectl apply -f -
|
||||
|
||||
.PHONY: deploy
|
||||
pre-deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
|
||||
cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
|
||||
$(KUSTOMIZE) build -e SERVICE_NAME=webhook-service -e SERVICE_NAMESPACE=system config/default > deploy/manifests/deploy.yaml.tmpl
|
||||
cp -rf config deploy/manifests/
|
||||
|
||||
.PHONY: undeploy
|
||||
undeploy: ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
|
||||
|
||||
@@ -12,6 +12,11 @@ namePrefix: user-
|
||||
#commonLabels:
|
||||
# someName: someValue
|
||||
|
||||
secretGenerator:
|
||||
- envs:
|
||||
- payment.env
|
||||
name: manager-secret
|
||||
|
||||
bases:
|
||||
- ../crd
|
||||
- ../rbac
|
||||
|
||||
@@ -39,9 +39,10 @@ spec:
|
||||
- "--health-probe-bind-address=:8081"
|
||||
- "--metrics-bind-address=127.0.0.1:8080"
|
||||
- "--leader-elect"
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: manager-secret
|
||||
env:
|
||||
- name: CallbackURL
|
||||
value: "{{ .PaymentCallbackURL }}"
|
||||
- name: NAMESPACE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
|
||||
@@ -0,0 +1,5 @@
|
||||
WechatPrivateKey={{ .WechatPrivateKey }}
|
||||
MchID={{ .MchID }}
|
||||
MchCertificateSerialNumber={{ .MchCertificateSerialNumber }}
|
||||
MchAPIv3Key={{ .MchAPIv3Key }}
|
||||
AppID={{ .AppID }}
|
||||
@@ -73,7 +73,7 @@ func (r *PaymentReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
|
||||
}
|
||||
}
|
||||
tradeNO := pay.GetRandomString(32)
|
||||
codeURL, err := pay.WechatPay(p.Spec.Amount, p.Spec.UserID, tradeNO, "", os.Getenv(pay.CallbackURL))
|
||||
codeURL, err := pay.WechatPay(p.Spec.Amount, p.Spec.UserID, tradeNO, "", "")
|
||||
if err != nil {
|
||||
r.Logger.Error(err, "get codeURL failed")
|
||||
return ctrl.Result{Requeue: true, RequeueAfter: time.Second}, err
|
||||
|
||||
@@ -1,7 +1,12 @@
|
||||
FROM scratch
|
||||
|
||||
USER 65532:65532
|
||||
ENV PaymentCallbackURL=""
|
||||
##
|
||||
ENV WechatPrivateKey = ""
|
||||
ENV MchID = ""
|
||||
ENV MchCertificateSerialNumber = ""
|
||||
ENV MchAPIv3Key = ""
|
||||
ENV AppID = ""
|
||||
COPY manifests ./manifests/user-controller
|
||||
COPY registry ./registry
|
||||
CMD ["kubectl apply -f manifests/user-controller/rbac.yaml","kubectl apply -f manifests/user-controller/deploy.yaml"]
|
||||
CMD ["kubectl apply -f manifests/user-controller/rbac.yaml","cd manifests/config/manager && kustomize build -e SERVICE_NAME=webhook-service -e SERVICE_NAMESPACE=system | kubectl apply -f -"]
|
||||
|
||||
@@ -6,12 +6,17 @@ sealos build -t docker.io/labring/sealos-user-controller:dev -f Dockerfile .
|
||||
|
||||
### Env
|
||||
|
||||
| Name | Description | Default |
|
||||
| --- | --- | --- |
|
||||
|`PaymentCallbackURL`|Payment callback url|`http://localhost:8080/payment/callback`|
|
||||
| Name | Description | Default |
|
||||
| --- |--------------------------------------------------------| --- |
|
||||
|`WechatPrivateKey`| Wechat private key |``|
|
||||
|`MchID`| Wechat mch id |``|
|
||||
|`MchCertificateSerialNumber`| Wechat mch certificate serial number |``|
|
||||
|`MchAPIv3Key`| Wechat mch api v3 key |``|
|
||||
|`AppID`| Wechat app id,if emoty then disable payment controller |``|
|
||||
|
||||
### How to run
|
||||
|
||||
```shell
|
||||
sealos run --env PaymentCallbackURL=http://localhost:8080/payment/callback docker.io/labring/sealos-user-controller:dev
|
||||
sealos run docker.io/labring/kustomize:v4.5.6
|
||||
sealos run --env WechatPrivateKey=xxx --env MchID=xxx --env MchCertificateSerialNumber --env MchAPIv3Key=xxx --env AppID=xxx docker.io/labring/sealos-user-controller:dev
|
||||
```
|
||||
|
||||
@@ -0,0 +1,25 @@
|
||||
# The following manifests contain a self-signed issuer CR and a certificate CR.
|
||||
# More document can be found at https://docs.cert-manager.io
|
||||
# WARNING: Targets CertManager v1.0. Check https://cert-manager.io/docs/installation/upgrading/ for breaking changes.
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: selfsigned-issuer
|
||||
namespace: system
|
||||
spec:
|
||||
selfSigned: {}
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: serving-cert # this name should match the one appeared in kustomizeconfig.yaml
|
||||
namespace: system
|
||||
spec:
|
||||
# $(SERVICE_NAME) and $(SERVICE_NAMESPACE) will be substituted by kustomize
|
||||
dnsNames:
|
||||
- $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc
|
||||
- $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc.cluster.local
|
||||
issuerRef:
|
||||
kind: Issuer
|
||||
name: selfsigned-issuer
|
||||
secretName: webhook-server-cert # this secret will not be prefixed, since it's not managed by kustomize
|
||||
@@ -0,0 +1,5 @@
|
||||
resources:
|
||||
- certificate.yaml
|
||||
|
||||
configurations:
|
||||
- kustomizeconfig.yaml
|
||||
@@ -0,0 +1,16 @@
|
||||
# This configuration is for teaching kustomize how to update name ref and var substitution
|
||||
nameReference:
|
||||
- kind: Issuer
|
||||
group: cert-manager.io
|
||||
fieldSpecs:
|
||||
- kind: Certificate
|
||||
group: cert-manager.io
|
||||
path: spec/issuerRef/name
|
||||
|
||||
varReference:
|
||||
- kind: Certificate
|
||||
group: cert-manager.io
|
||||
path: spec/commonName
|
||||
- kind: Certificate
|
||||
group: cert-manager.io
|
||||
path: spec/dnsNames
|
||||
@@ -0,0 +1,67 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.10.0
|
||||
creationTimestamp: null
|
||||
name: accounts.user.sealos.io
|
||||
spec:
|
||||
group: user.sealos.io
|
||||
names:
|
||||
kind: Account
|
||||
listKind: AccountList
|
||||
plural: accounts
|
||||
singular: account
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: Account is the Schema for the accounts API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: AccountSpec defines the desired state of Account
|
||||
type: object
|
||||
status:
|
||||
description: AccountStatus defines the observed state of Account
|
||||
properties:
|
||||
balance:
|
||||
format: int64
|
||||
type: integer
|
||||
chargeList:
|
||||
description: 'INSERT ADDITIONAL STATUS FIELD - define observed state
|
||||
of cluster Important: Run "make" to regenerate code after modifying
|
||||
this file'
|
||||
items:
|
||||
properties:
|
||||
balance:
|
||||
format: int64
|
||||
type: integer
|
||||
status:
|
||||
type: string
|
||||
time:
|
||||
format: date-time
|
||||
type: string
|
||||
tradeNO:
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,64 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.10.0
|
||||
creationTimestamp: null
|
||||
name: payments.user.sealos.io
|
||||
spec:
|
||||
group: user.sealos.io
|
||||
names:
|
||||
kind: Payment
|
||||
listKind: PaymentList
|
||||
plural: payments
|
||||
singular: payment
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: Payment is the Schema for the payments API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: PaymentSpec defines the desired state of Payment
|
||||
properties:
|
||||
amount:
|
||||
description: Amount is the amount of recharge
|
||||
format: int64
|
||||
type: integer
|
||||
userID:
|
||||
description: UserID is the user id who want to recharge
|
||||
type: string
|
||||
type: object
|
||||
status:
|
||||
description: PaymentStatus defines the observed state of Payment
|
||||
properties:
|
||||
codeURL:
|
||||
description: CodeURL is the codeURL of wechatpay
|
||||
type: string
|
||||
status:
|
||||
description: Status is the status of wechatpay, charging, closed,
|
||||
timeout
|
||||
type: string
|
||||
tradeNO:
|
||||
description: TradeNO is the tradeNO of wechatpay
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
+140
@@ -0,0 +1,140 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.10.0
|
||||
creationTimestamp: null
|
||||
name: usergroupbindings.user.sealos.io
|
||||
spec:
|
||||
group: user.sealos.io
|
||||
names:
|
||||
kind: UserGroupBinding
|
||||
listKind: UserGroupBindingList
|
||||
plural: usergroupbindings
|
||||
shortNames:
|
||||
- ugbinding
|
||||
singular: usergroupbinding
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .userGroupRef
|
||||
name: UserGroup
|
||||
type: string
|
||||
- jsonPath: .subject.kind
|
||||
name: Kind
|
||||
type: string
|
||||
- jsonPath: .status.phase
|
||||
name: Phase
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: UserGroupBinding is the Schema for the usergroupbindings API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
roleRef:
|
||||
default: user
|
||||
description: RoleRef can only reference a ClusterRole in the global namespace.
|
||||
type: string
|
||||
status:
|
||||
description: Status contains the different condition statuses for this
|
||||
user group.
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions contains the different condition statuses
|
||||
for this user group.
|
||||
items:
|
||||
properties:
|
||||
lastHeartbeatTime:
|
||||
description: LastHeartbeatTime is the last time this condition
|
||||
was updated.
|
||||
format: date-time
|
||||
type: string
|
||||
lastTransitionTime:
|
||||
description: LastTransitionTime is the last time the condition
|
||||
changed from one status to another.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: Message is a human-readable message indicating
|
||||
details about the last status change.
|
||||
type: string
|
||||
reason:
|
||||
description: Reason is a (brief) reason for the condition's
|
||||
last status change.
|
||||
type: string
|
||||
status:
|
||||
description: Status is the status of the condition. One of True,
|
||||
False, Unknown.
|
||||
type: string
|
||||
type:
|
||||
type: string
|
||||
required:
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
observedGeneration:
|
||||
description: The generation observed by the user controller.
|
||||
format: int64
|
||||
type: integer
|
||||
phase:
|
||||
default: Unknown
|
||||
description: Phase is the recently observed lifecycle phase of user
|
||||
group binding
|
||||
type: string
|
||||
type: object
|
||||
subject:
|
||||
description: Subject holds references to the objects the role applies
|
||||
to.
|
||||
properties:
|
||||
apiGroup:
|
||||
description: APIGroup holds the API group of the referenced subject.
|
||||
Defaults to "" for ServiceAccount subjects. Defaults to "rbac.authorization.k8s.io"
|
||||
for User and Group subjects.
|
||||
type: string
|
||||
kind:
|
||||
description: Kind of object being referenced. Values defined by this
|
||||
API group are "User", "Group", and "ServiceAccount". If the Authorizer
|
||||
does not recognized the kind value, the Authorizer should report
|
||||
an error.
|
||||
type: string
|
||||
name:
|
||||
description: Name of the object being referenced.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace of the referenced object. If the object kind
|
||||
is non-namespace, such as "User" or "Group", and this value is not
|
||||
empty the Authorizer should report an error.
|
||||
type: string
|
||||
required:
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
userGroupRef:
|
||||
description: UserGroupRef is the reference to the user group that this
|
||||
binding binds to.
|
||||
type: string
|
||||
required:
|
||||
- userGroupRef
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,95 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.10.0
|
||||
creationTimestamp: null
|
||||
name: usergroups.user.sealos.io
|
||||
spec:
|
||||
group: user.sealos.io
|
||||
names:
|
||||
kind: UserGroup
|
||||
listKind: UserGroupList
|
||||
plural: usergroups
|
||||
shortNames:
|
||||
- ug
|
||||
singular: usergroup
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .status.phase
|
||||
name: Phase
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: UserGroup is the Schema for the usergroups API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
status:
|
||||
description: UserGroupStatus defines the observed state of UserGroup
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions contains the different condition statuses
|
||||
for this user group.
|
||||
items:
|
||||
properties:
|
||||
lastHeartbeatTime:
|
||||
description: LastHeartbeatTime is the last time this condition
|
||||
was updated.
|
||||
format: date-time
|
||||
type: string
|
||||
lastTransitionTime:
|
||||
description: LastTransitionTime is the last time the condition
|
||||
changed from one status to another.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: Message is a human-readable message indicating
|
||||
details about the last status change.
|
||||
type: string
|
||||
reason:
|
||||
description: Reason is a (brief) reason for the condition's
|
||||
last status change.
|
||||
type: string
|
||||
status:
|
||||
description: Status is the status of the condition. One of True,
|
||||
False, Unknown.
|
||||
type: string
|
||||
type:
|
||||
type: string
|
||||
required:
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
observedGeneration:
|
||||
description: The generation observed by the user controller.
|
||||
format: int64
|
||||
type: integer
|
||||
phase:
|
||||
default: Unknown
|
||||
description: Phase is the recently observed lifecycle phase of user
|
||||
group
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,117 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.10.0
|
||||
creationTimestamp: null
|
||||
name: users.user.sealos.io
|
||||
spec:
|
||||
group: user.sealos.io
|
||||
names:
|
||||
kind: User
|
||||
listKind: UserList
|
||||
plural: users
|
||||
singular: user
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .status.phase
|
||||
name: Phase
|
||||
type: string
|
||||
- jsonPath: .status.observedCSRExpirationSeconds
|
||||
name: ExpirationSeconds
|
||||
type: integer
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: User is the Schema for the users API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: UserSpec defines the desired state of User
|
||||
properties:
|
||||
csrExpirationSeconds:
|
||||
default: 7200
|
||||
description: "expirationSeconds is the requested duration of validity
|
||||
of the issued certificate. The certificate signer may issue a certificate
|
||||
with a different validity duration so a client must check the delta
|
||||
between the notBefore and and notAfter fields in the issued certificate
|
||||
to determine the actual duration. \n The minimum valid value for
|
||||
expirationSeconds is 600, i.e. 10 minutes."
|
||||
format: int32
|
||||
type: integer
|
||||
type: object
|
||||
status:
|
||||
description: UserStatus defines the observed state of User
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions contains the different condition statuses
|
||||
for this user.
|
||||
items:
|
||||
properties:
|
||||
lastHeartbeatTime:
|
||||
description: LastHeartbeatTime is the last time this condition
|
||||
was updated.
|
||||
format: date-time
|
||||
type: string
|
||||
lastTransitionTime:
|
||||
description: LastTransitionTime is the last time the condition
|
||||
changed from one status to another.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: Message is a human-readable message indicating
|
||||
details about the last status change.
|
||||
type: string
|
||||
reason:
|
||||
description: Reason is a (brief) reason for the condition's
|
||||
last status change.
|
||||
type: string
|
||||
status:
|
||||
description: Status is the status of the condition. One of True,
|
||||
False, Unknown.
|
||||
type: string
|
||||
type:
|
||||
type: string
|
||||
required:
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
kubeConfig:
|
||||
type: string
|
||||
observedCSRExpirationSeconds:
|
||||
default: 7200
|
||||
format: int32
|
||||
type: integer
|
||||
observedGeneration:
|
||||
description: The generation observed by the user controller.
|
||||
format: int64
|
||||
type: integer
|
||||
phase:
|
||||
default: Unknown
|
||||
description: Phase is the recently observed lifecycle phase of user
|
||||
type: string
|
||||
required:
|
||||
- kubeConfig
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,39 @@
|
||||
# This kustomization.yaml is not intended to be run by itself,
|
||||
# since it depends on service name and namespace that are out of this kustomize package.
|
||||
# It should be run by config/default
|
||||
resources:
|
||||
- bases/user.sealos.io_users.yaml
|
||||
- bases/user.sealos.io_usergroups.yaml
|
||||
- bases/user.sealos.io_usergroupbindings.yaml
|
||||
- bases/user.sealos.io_accounts.yaml
|
||||
- bases/user.sealos.io_payments.yaml
|
||||
#+kubebuilder:scaffold:crdkustomizeresource
|
||||
|
||||
patchesStrategicMerge:
|
||||
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
|
||||
# patches here are for enabling the conversion webhook for each CRD
|
||||
#- patches/webhook_in_users.yaml
|
||||
#- patches/webhook_in_groups.yaml
|
||||
#- patches/webhook_in_usergroups.yaml
|
||||
#- patches/webhook_in_usergroupuserbindings.yaml
|
||||
#- patches/webhook_in_usergroupnamespacebindings.yaml
|
||||
#- patches/webhook_in_usergroupbindings.yaml
|
||||
#- patches/webhook_in_accounts.yaml
|
||||
#- patches/webhook_in_payments.yaml
|
||||
#+kubebuilder:scaffold:crdkustomizewebhookpatch
|
||||
|
||||
# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix.
|
||||
# patches here are for enabling the CA injection for each CRD
|
||||
#- patches/cainjection_in_users.yaml
|
||||
#- patches/cainjection_in_groups.yaml
|
||||
#- patches/cainjection_in_usergroups.yaml
|
||||
#- patches/cainjection_in_usergroupuserbindings.yaml
|
||||
#- patches/cainjection_in_usergroupnamespacebindings.yaml
|
||||
#- patches/cainjection_in_usergroupbindings.yaml
|
||||
#- patches/cainjection_in_accounts.yaml
|
||||
#- patches/cainjection_in_payments.yaml
|
||||
#+kubebuilder:scaffold:crdkustomizecainjectionpatch
|
||||
|
||||
# the following config is for teaching kustomize how to do kustomization for CRDs.
|
||||
configurations:
|
||||
- kustomizeconfig.yaml
|
||||
@@ -0,0 +1,19 @@
|
||||
# This file is for teaching kustomize how to substitute name and namespace reference in CRD
|
||||
nameReference:
|
||||
- kind: Service
|
||||
version: v1
|
||||
fieldSpecs:
|
||||
- kind: CustomResourceDefinition
|
||||
version: v1
|
||||
group: apiextensions.k8s.io
|
||||
path: spec/conversion/webhook/clientConfig/service/name
|
||||
|
||||
namespace:
|
||||
- kind: CustomResourceDefinition
|
||||
version: v1
|
||||
group: apiextensions.k8s.io
|
||||
path: spec/conversion/webhook/clientConfig/service/namespace
|
||||
create: false
|
||||
|
||||
varReference:
|
||||
- path: metadata/annotations
|
||||
@@ -0,0 +1,7 @@
|
||||
# The following patch adds a directive for certmanager to inject CA into the CRD
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
|
||||
name: accounts.user.sealos.io
|
||||
@@ -0,0 +1,7 @@
|
||||
# The following patch adds a directive for certmanager to inject CA into the CRD
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
|
||||
name: groups.user.sealos.io
|
||||
@@ -0,0 +1,7 @@
|
||||
# The following patch adds a directive for certmanager to inject CA into the CRD
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
|
||||
name: payments.user.sealos.io
|
||||
+7
@@ -0,0 +1,7 @@
|
||||
# The following patch adds a directive for certmanager to inject CA into the CRD
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
|
||||
name: usergroupbindings.user.sealos.io
|
||||
+7
@@ -0,0 +1,7 @@
|
||||
# The following patch adds a directive for certmanager to inject CA into the CRD
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
|
||||
name: usergroupnamespacebindings.user.sealos.io
|
||||
@@ -0,0 +1,7 @@
|
||||
# The following patch adds a directive for certmanager to inject CA into the CRD
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
|
||||
name: usergroups.user.sealos.io
|
||||
+7
@@ -0,0 +1,7 @@
|
||||
# The following patch adds a directive for certmanager to inject CA into the CRD
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
|
||||
name: usergroupuserbindings.user.sealos.io
|
||||
@@ -0,0 +1,7 @@
|
||||
# The following patch adds a directive for certmanager to inject CA into the CRD
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
|
||||
name: users.user.sealos.io
|
||||
@@ -0,0 +1,16 @@
|
||||
# The following patch enables a conversion webhook for the CRD
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: accounts.user.sealos.io
|
||||
spec:
|
||||
conversion:
|
||||
strategy: Webhook
|
||||
webhook:
|
||||
clientConfig:
|
||||
service:
|
||||
namespace: system
|
||||
name: webhook-service
|
||||
path: /convert
|
||||
conversionReviewVersions:
|
||||
- v1
|
||||
@@ -0,0 +1,16 @@
|
||||
# The following patch enables a conversion webhook for the CRD
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: payments.user.sealos.io
|
||||
spec:
|
||||
conversion:
|
||||
strategy: Webhook
|
||||
webhook:
|
||||
clientConfig:
|
||||
service:
|
||||
namespace: system
|
||||
name: webhook-service
|
||||
path: /convert
|
||||
conversionReviewVersions:
|
||||
- v1
|
||||
+16
@@ -0,0 +1,16 @@
|
||||
# The following patch enables a conversion webhook for the CRD
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: usergroupbindings.user.sealos.io
|
||||
spec:
|
||||
conversion:
|
||||
strategy: Webhook
|
||||
webhook:
|
||||
clientConfig:
|
||||
service:
|
||||
namespace: system
|
||||
name: webhook-service
|
||||
path: /convert
|
||||
conversionReviewVersions:
|
||||
- v1
|
||||
+16
@@ -0,0 +1,16 @@
|
||||
# The following patch enables a conversion webhook for the CRD
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: usergroupnamespacebindings.user.sealos.io
|
||||
spec:
|
||||
conversion:
|
||||
strategy: Webhook
|
||||
webhook:
|
||||
clientConfig:
|
||||
service:
|
||||
namespace: system
|
||||
name: webhook-service
|
||||
path: /convert
|
||||
conversionReviewVersions:
|
||||
- v1
|
||||
@@ -0,0 +1,16 @@
|
||||
# The following patch enables a conversion webhook for the CRD
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: usergroups.user.sealos.io
|
||||
spec:
|
||||
conversion:
|
||||
strategy: Webhook
|
||||
webhook:
|
||||
clientConfig:
|
||||
service:
|
||||
namespace: system
|
||||
name: webhook-service
|
||||
path: /convert
|
||||
conversionReviewVersions:
|
||||
- v1
|
||||
+16
@@ -0,0 +1,16 @@
|
||||
# The following patch enables a conversion webhook for the CRD
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: usergroupuserbindings.user.sealos.io
|
||||
spec:
|
||||
conversion:
|
||||
strategy: Webhook
|
||||
webhook:
|
||||
clientConfig:
|
||||
service:
|
||||
namespace: system
|
||||
name: webhook-service
|
||||
path: /convert
|
||||
conversionReviewVersions:
|
||||
- v1
|
||||
@@ -0,0 +1,16 @@
|
||||
# The following patch enables a conversion webhook for the CRD
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: users.user.sealos.io
|
||||
spec:
|
||||
conversion:
|
||||
strategy: Webhook
|
||||
webhook:
|
||||
clientConfig:
|
||||
service:
|
||||
namespace: system
|
||||
name: webhook-service
|
||||
path: /convert
|
||||
conversionReviewVersions:
|
||||
- v1
|
||||
@@ -0,0 +1,79 @@
|
||||
# Adds namespace to all resources.
|
||||
namespace: user-system
|
||||
|
||||
# Value of this field is prepended to the
|
||||
# names of all resources, e.g. a deployment named
|
||||
# "wordpress" becomes "alices-wordpress".
|
||||
# Note that it should also match with the prefix (text before '-') of the namespace
|
||||
# field above.
|
||||
namePrefix: user-
|
||||
|
||||
# Labels to add to all resources and selectors.
|
||||
#commonLabels:
|
||||
# someName: someValue
|
||||
|
||||
secretGenerator:
|
||||
- envs:
|
||||
- payment.env
|
||||
name: manager-secret
|
||||
|
||||
bases:
|
||||
- ../crd
|
||||
- ../rbac
|
||||
- ../manager
|
||||
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
|
||||
# crd/kustomization.yaml
|
||||
- ../webhook
|
||||
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
|
||||
- ../certmanager
|
||||
# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
|
||||
#- ../prometheus
|
||||
|
||||
patchesStrategicMerge:
|
||||
# Protect the /metrics endpoint by putting it behind auth.
|
||||
# If you want your controller-manager to expose the /metrics
|
||||
# endpoint w/o any authn/z, please comment the following line.
|
||||
- manager_auth_proxy_patch.yaml
|
||||
|
||||
# Mount the controller config file for loading manager configurations
|
||||
# through a ComponentConfig type
|
||||
#- manager_config_patch.yaml
|
||||
|
||||
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
|
||||
# crd/kustomization.yaml
|
||||
- manager_webhook_patch.yaml
|
||||
|
||||
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'.
|
||||
# Uncomment 'CERTMANAGER' sections in crd/kustomization.yaml to enable the CA injection in the admission webhooks.
|
||||
# 'CERTMANAGER' needs to be enabled to use ca injection
|
||||
- webhookcainjection_patch.yaml
|
||||
|
||||
# the following config is for teaching kustomize how to do var substitution
|
||||
vars:
|
||||
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
|
||||
- name: CERTIFICATE_NAMESPACE # namespace of the certificate CR
|
||||
objref:
|
||||
kind: Certificate
|
||||
group: cert-manager.io
|
||||
version: v1
|
||||
name: serving-cert # this name should match the one in certificate.yaml
|
||||
fieldref:
|
||||
fieldpath: metadata.namespace
|
||||
- name: CERTIFICATE_NAME
|
||||
objref:
|
||||
kind: Certificate
|
||||
group: cert-manager.io
|
||||
version: v1
|
||||
name: serving-cert # this name should match the one in certificate.yaml
|
||||
- name: SERVICE_NAMESPACE # namespace of the service
|
||||
objref:
|
||||
kind: Service
|
||||
version: v1
|
||||
name: webhook-service
|
||||
fieldref:
|
||||
fieldpath: metadata.namespace
|
||||
- name: SERVICE_NAME
|
||||
objref:
|
||||
kind: Service
|
||||
version: v1
|
||||
name: webhook-service
|
||||
@@ -0,0 +1,50 @@
|
||||
# This patch inject a sidecar container which is a HTTP proxy for the
|
||||
# controller manager, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: controller-manager
|
||||
namespace: system
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
- name: kube-rbac-proxy
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- "ALL"
|
||||
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.13.0
|
||||
args:
|
||||
- "--secure-listen-address=0.0.0.0:8443"
|
||||
- "--upstream=http://127.0.0.1:8080/"
|
||||
- "--logtostderr=true"
|
||||
- "--v=0"
|
||||
ports:
|
||||
- containerPort: 8443
|
||||
protocol: TCP
|
||||
name: https
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 5m
|
||||
memory: 64Mi
|
||||
- name: manager
|
||||
imagePullPolicy: Always
|
||||
args:
|
||||
- "--health-probe-bind-address=:8081"
|
||||
- "--metrics-bind-address=127.0.0.1:8080"
|
||||
- "--leader-elect"
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: manager-secret
|
||||
env:
|
||||
- name: NAMESPACE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: controller-manager
|
||||
namespace: system
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
- name: manager
|
||||
args:
|
||||
- "--config=controller_manager_config.yaml"
|
||||
volumeMounts:
|
||||
- name: manager-config
|
||||
mountPath: /controller_manager_config.yaml
|
||||
subPath: controller_manager_config.yaml
|
||||
volumes:
|
||||
- name: manager-config
|
||||
configMap:
|
||||
name: manager-config
|
||||
@@ -0,0 +1,23 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: controller-manager
|
||||
namespace: system
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
- name: manager
|
||||
ports:
|
||||
- containerPort: 9443
|
||||
name: webhook-server
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- mountPath: /tmp/k8s-webhook-server/serving-certs
|
||||
name: cert
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: cert
|
||||
secret:
|
||||
defaultMode: 420
|
||||
secretName: webhook-server-cert
|
||||
@@ -0,0 +1,5 @@
|
||||
WechatPrivateKey={{ .WechatPrivateKey }}
|
||||
MchID={{ .MchID }}
|
||||
MchCertificateSerialNumber={{ .MchCertificateSerialNumber }}
|
||||
MchAPIv3Key={{ .MchAPIv3Key }}
|
||||
AppID={{ .AppID }}
|
||||
@@ -0,0 +1,15 @@
|
||||
# This patch add annotation to admission webhook config and
|
||||
# the variables $(CERTIFICATE_NAMESPACE) and $(CERTIFICATE_NAME) will be substituted by kustomize.
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
name: mutating-webhook-configuration
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: validating-webhook-configuration
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
|
||||
@@ -0,0 +1,21 @@
|
||||
apiVersion: controller-runtime.sigs.k8s.io/v1alpha1
|
||||
kind: ControllerManagerConfig
|
||||
health:
|
||||
healthProbeBindAddress: :8081
|
||||
metrics:
|
||||
bindAddress: 127.0.0.1:8080
|
||||
webhook:
|
||||
port: 9443
|
||||
leaderElection:
|
||||
leaderElect: true
|
||||
resourceName: 785548a1.sealos.io
|
||||
# leaderElectionReleaseOnCancel defines if the leader should step down volume
|
||||
# when the Manager ends. This requires the binary to immediately end when the
|
||||
# Manager is stopped, otherwise, this setting is unsafe. Setting this significantly
|
||||
# speeds up voluntary leader transitions as the new leader don't have to wait
|
||||
# LeaseDuration time first.
|
||||
# In the default scaffold provided, the program ends immediately after
|
||||
# the manager stops, so would be fine to enable this option. However,
|
||||
# if you are doing or is intended to do any operation such as perform cleanups
|
||||
# after the manager stops then its usage might be unsafe.
|
||||
# leaderElectionReleaseOnCancel: true
|
||||
@@ -0,0 +1,16 @@
|
||||
resources:
|
||||
- manager.yaml
|
||||
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
|
||||
configMapGenerator:
|
||||
- files:
|
||||
- controller_manager_config.yaml
|
||||
name: manager-config
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
images:
|
||||
- name: controller
|
||||
newName: ghcr.io/labring/sealos-user-controller
|
||||
newTag: dev
|
||||
@@ -0,0 +1,72 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
name: system
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: controller-manager
|
||||
namespace: system
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
control-plane: controller-manager
|
||||
replicas: 3
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
kubectl.kubernetes.io/default-container: manager
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
spec:
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
# TODO(user): For common cases that do not require escalating privileges
|
||||
# it is recommended to ensure that all your Pods/Containers are restrictive.
|
||||
# More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
|
||||
# Please uncomment the following code if your project does NOT have to work on old Kubernetes
|
||||
# versions < 1.19 or on vendors versions which do NOT support this field by default (i.e. Openshift < 4.11 ).
|
||||
# seccompProfile:
|
||||
# type: RuntimeDefault
|
||||
containers:
|
||||
- command:
|
||||
- /manager
|
||||
args:
|
||||
- --leader-elect
|
||||
image: controller:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: manager
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- "ALL"
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8081
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 8081
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
# TODO(user): Configure the resources accordingly based on the project requirements.
|
||||
# More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 64Mi
|
||||
serviceAccountName: controller-manager
|
||||
terminationGracePeriodSeconds: 10
|
||||
@@ -0,0 +1,2 @@
|
||||
resources:
|
||||
- monitor.yaml
|
||||
@@ -0,0 +1,20 @@
|
||||
|
||||
# Prometheus Monitor Service (Metrics)
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
name: controller-manager-metrics-monitor
|
||||
namespace: system
|
||||
spec:
|
||||
endpoints:
|
||||
- path: /metrics
|
||||
port: https
|
||||
scheme: https
|
||||
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||
tlsConfig:
|
||||
insecureSkipVerify: true
|
||||
selector:
|
||||
matchLabels:
|
||||
control-plane: controller-manager
|
||||
@@ -0,0 +1,24 @@
|
||||
# permissions for end users to edit accounts.
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: account-editor-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- accounts
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- accounts/status
|
||||
verbs:
|
||||
- get
|
||||
@@ -0,0 +1,20 @@
|
||||
# permissions for end users to view accounts.
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: account-viewer-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- accounts
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- accounts/status
|
||||
verbs:
|
||||
- get
|
||||
@@ -0,0 +1,9 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: metrics-reader
|
||||
rules:
|
||||
- nonResourceURLs:
|
||||
- "/metrics"
|
||||
verbs:
|
||||
- get
|
||||
@@ -0,0 +1,17 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: proxy-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- authentication.k8s.io
|
||||
resources:
|
||||
- tokenreviews
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- authorization.k8s.io
|
||||
resources:
|
||||
- subjectaccessreviews
|
||||
verbs:
|
||||
- create
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: proxy-rolebinding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: proxy-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: controller-manager
|
||||
namespace: system
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
name: controller-manager-metrics-service
|
||||
namespace: system
|
||||
spec:
|
||||
ports:
|
||||
- name: https
|
||||
port: 8443
|
||||
protocol: TCP
|
||||
targetPort: https
|
||||
selector:
|
||||
control-plane: controller-manager
|
||||
@@ -0,0 +1,18 @@
|
||||
resources:
|
||||
# All RBAC will be applied under this service account in
|
||||
# the deployment namespace. You may comment out this resource
|
||||
# if your manager will use a service account that exists at
|
||||
# runtime. Be sure to update RoleBinding and ClusterRoleBinding
|
||||
# subjects if changing service account names.
|
||||
- service_account.yaml
|
||||
- role.yaml
|
||||
- role_binding.yaml
|
||||
- leader_election_role.yaml
|
||||
- leader_election_role_binding.yaml
|
||||
# Comment the following 4 lines if you want to disable
|
||||
# the auth proxy (https://github.com/brancz/kube-rbac-proxy)
|
||||
# which protects your /metrics endpoint.
|
||||
- auth_proxy_service.yaml
|
||||
- auth_proxy_role.yaml
|
||||
- auth_proxy_role_binding.yaml
|
||||
- auth_proxy_client_clusterrole.yaml
|
||||
@@ -0,0 +1,37 @@
|
||||
# permissions to do leader election.
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: leader-election-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: leader-election-rolebinding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: leader-election-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: controller-manager
|
||||
namespace: system
|
||||
@@ -0,0 +1,24 @@
|
||||
# permissions for end users to edit payments.
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: payment-editor-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- payments
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- payments/status
|
||||
verbs:
|
||||
- get
|
||||
@@ -0,0 +1,20 @@
|
||||
# permissions for end users to view payments.
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: payment-viewer-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- payments
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- payments/status
|
||||
verbs:
|
||||
- get
|
||||
@@ -0,0 +1,259 @@
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: manager-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- certificates.k8s.io
|
||||
resources:
|
||||
- certificatesigningrequests
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- certificates.k8s.io
|
||||
resources:
|
||||
- certificatesigningrequests/approval
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- certificates.k8s.io
|
||||
resources:
|
||||
- certificatesigningrequests/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- certificates.k8s.io
|
||||
resourceNames:
|
||||
- kubernetes.io/kube-apiserver-client
|
||||
resources:
|
||||
- signers
|
||||
verbs:
|
||||
- approve
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- serviceaccounts
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- serviceaccounts/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- clusterrolebindings
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- rolebindings
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- accounts
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- accounts/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- accounts/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- payments
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- payments/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- payments/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- usergroupbindings
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- usergroupbindings/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- usergroupbindings/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- usergroups
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- usergroups/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- usergroups/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- users
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- users/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- users/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: manager-rolebinding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: manager-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: controller-manager
|
||||
namespace: system
|
||||
@@ -0,0 +1,5 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: controller-manager
|
||||
namespace: system
|
||||
@@ -0,0 +1,24 @@
|
||||
# permissions for end users to edit users.
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: user-editor-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- users
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- users/status
|
||||
verbs:
|
||||
- get
|
||||
@@ -0,0 +1,20 @@
|
||||
# permissions for end users to view users.
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: user-viewer-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- users
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- users/status
|
||||
verbs:
|
||||
- get
|
||||
@@ -0,0 +1,24 @@
|
||||
# permissions for end users to edit usergroups.
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: usergroup-editor-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- usergroups
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- usergroups/status
|
||||
verbs:
|
||||
- get
|
||||
@@ -0,0 +1,20 @@
|
||||
# permissions for end users to view usergroups.
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: usergroup-viewer-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- usergroups
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- usergroups/status
|
||||
verbs:
|
||||
- get
|
||||
@@ -0,0 +1,24 @@
|
||||
# permissions for end users to edit usergroupbindings.
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: usergroupbinding-editor-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- usergroupbindings
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- usergroupbindings/status
|
||||
verbs:
|
||||
- get
|
||||
@@ -0,0 +1,20 @@
|
||||
# permissions for end users to view usergroupbindings.
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: usergroupbinding-viewer-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- usergroupbindings
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- usergroupbindings/status
|
||||
verbs:
|
||||
- get
|
||||
@@ -0,0 +1,90 @@
|
||||
apiVersion: user.sealos.io/v1
|
||||
kind: User
|
||||
metadata:
|
||||
name: f8699ded-58d3-432b-a9ff-56568b57a38d
|
||||
spec:
|
||||
displayName: cuisongliu
|
||||
---
|
||||
apiVersion: user.sealos.io/v1
|
||||
kind: UserGroup
|
||||
metadata:
|
||||
name: f8699ded-58d3-432b-a9ff-56568b57a38d
|
||||
---
|
||||
apiVersion: user.sealos.io/v1
|
||||
kind: UserGroupBinding
|
||||
metadata:
|
||||
name: f8699ded-58d3-432b-a9ff-56568b57a38d
|
||||
subject:
|
||||
kind: User
|
||||
name: "f8699ded-58d3-432b-a9ff-56568b57a38d" # Name is case sensitive
|
||||
apiGroup: sealos.io/v1
|
||||
userGroupRef: f8699ded-58d3-432b-a9ff-56568b57a38d
|
||||
roleRefs:
|
||||
kind: ClusterRole
|
||||
name: sealos-user-admin-role
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: user.sealos.io/v1
|
||||
kind: UserGroupBinding
|
||||
metadata:
|
||||
name: f8699ded-58d3-432b-a9ff-56568b57a38d
|
||||
subject:
|
||||
kind: Namespace
|
||||
name: "f8699ded-58d3-432b-a9ff-56568b57a38d"
|
||||
userGroupRef: f8699ded-58d3-432b-a9ff-56568b57a38d
|
||||
|
||||
## 创建者 sealos-user-create-role权限
|
||||
## 管理员 不能创建管理员使用webhook校验操作 新增sealos-user-manager-role权限
|
||||
## 只有管理员和创建者才需要设置role其他不需要设置（默认给namespace设置cluster-admin的Role权限）
|
||||
## 创建User默认创建UserGroup 和 2个UserGroupBinding (对user(直接是创建人的role)和对namespace)
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: sealos-user-create-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- 'usergroupbindings'
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- 'listusergroupsbyuser'
|
||||
- 'listuserbyusergroup'
|
||||
verbs:
|
||||
- list
|
||||
- get
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: sealos-user-manager-role
|
||||
rules:
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- '*'
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
resources:
|
||||
- 'listusergroupsbyuser'
|
||||
- 'listuserbyusergroup'
|
||||
- 'listnamespacebyusergroup'
|
||||
verbs:
|
||||
- list
|
||||
- get
|
||||
- watch
|
||||
@@ -0,0 +1,6 @@
|
||||
apiVersion: user.sealos.io/v1
|
||||
kind: Account
|
||||
metadata:
|
||||
name: account-sample
|
||||
spec:
|
||||
# TODO(user): Add fields here
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: user.sealos.io/v1
|
||||
kind: Payment
|
||||
metadata:
|
||||
name: payment-sample
|
||||
spec:
|
||||
# TODO(user): Add fields here
|
||||
userID: fanux
|
||||
amount: 1
|
||||
@@ -0,0 +1,6 @@
|
||||
apiVersion: user.sealos.io/v1
|
||||
kind: User
|
||||
metadata:
|
||||
name: f8699ded-58d3-432b-a9ff-56568b57a38d
|
||||
spec:
|
||||
csrExpirationSeconds: 1000000000
|
||||
@@ -0,0 +1,4 @@
|
||||
apiVersion: user.sealos.io/v1
|
||||
kind: UserGroup
|
||||
metadata:
|
||||
name: usergroup-sample
|
||||
@@ -0,0 +1,6 @@
|
||||
apiVersion: user.sealos.io/v1
|
||||
kind: UserGroupBinding
|
||||
metadata:
|
||||
name: usergroupbinding-sample
|
||||
spec:
|
||||
# TODO(user): Add fields here
|
||||
@@ -0,0 +1,6 @@
|
||||
resources:
|
||||
- manifests.yaml
|
||||
- service.yaml
|
||||
|
||||
configurations:
|
||||
- kustomizeconfig.yaml
|
||||
@@ -0,0 +1,25 @@
|
||||
# the following config is for teaching kustomize where to look at when substituting vars.
|
||||
# It requires kustomize v2.1.0 or newer to work properly.
|
||||
nameReference:
|
||||
- kind: Service
|
||||
version: v1
|
||||
fieldSpecs:
|
||||
- kind: MutatingWebhookConfiguration
|
||||
group: admissionregistration.k8s.io
|
||||
path: webhooks/clientConfig/service/name
|
||||
- kind: ValidatingWebhookConfiguration
|
||||
group: admissionregistration.k8s.io
|
||||
path: webhooks/clientConfig/service/name
|
||||
|
||||
namespace:
|
||||
- kind: MutatingWebhookConfiguration
|
||||
group: admissionregistration.k8s.io
|
||||
path: webhooks/clientConfig/service/namespace
|
||||
create: true
|
||||
- kind: ValidatingWebhookConfiguration
|
||||
group: admissionregistration.k8s.io
|
||||
path: webhooks/clientConfig/service/namespace
|
||||
create: true
|
||||
|
||||
varReference:
|
||||
- path: metadata/annotations
|
||||
@@ -0,0 +1,134 @@
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: mutating-webhook-configuration
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
service:
|
||||
name: webhook-service
|
||||
namespace: system
|
||||
path: /mutate-user-sealos-io-v1-user
|
||||
failurePolicy: Fail
|
||||
name: muser.kb.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- users
|
||||
sideEffects: None
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
service:
|
||||
name: webhook-service
|
||||
namespace: system
|
||||
path: /mutate-user-sealos-io-v1-usergroup
|
||||
failurePolicy: Fail
|
||||
name: musergroup.kb.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- usergroups
|
||||
sideEffects: None
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
service:
|
||||
name: webhook-service
|
||||
namespace: system
|
||||
path: /mutate-user-sealos-io-v1-usergroupbinding
|
||||
failurePolicy: Fail
|
||||
name: musergroupbinding.kb.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- usergroupbindings
|
||||
sideEffects: None
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: validating-webhook-configuration
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
service:
|
||||
name: webhook-service
|
||||
namespace: system
|
||||
path: /validate-user-sealos-io-v1-user
|
||||
failurePolicy: Fail
|
||||
name: vuser.kb.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- users
|
||||
sideEffects: None
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
service:
|
||||
name: webhook-service
|
||||
namespace: system
|
||||
path: /validate-user-sealos-io-v1-usergroup
|
||||
failurePolicy: Fail
|
||||
name: vusergroup.kb.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- usergroups
|
||||
sideEffects: None
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
service:
|
||||
name: webhook-service
|
||||
namespace: system
|
||||
path: /validate-user-sealos-io-v1-usergroupbinding
|
||||
failurePolicy: Fail
|
||||
name: vusergroupbinding.kb.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- user.sealos.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- usergroupbindings
|
||||
sideEffects: None
|
||||
@@ -0,0 +1,13 @@
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: webhook-service
|
||||
namespace: system
|
||||
spec:
|
||||
ports:
|
||||
- port: 443
|
||||
protocol: TCP
|
||||
targetPort: 9443
|
||||
selector:
|
||||
control-plane: controller-manager
|
||||
File diff suppressed because it is too large
Load Diff
@@ -116,7 +116,7 @@ func main() {
|
||||
setupLog.Error(err, "unable to create controller", "controller", "Account")
|
||||
os.Exit(1)
|
||||
}
|
||||
if os.Getenv(pay.CallbackURL) != "" {
|
||||
if os.Getenv(pay.AppID) != "" {
|
||||
if err = (&controllers.PaymentReconciler{
|
||||
Client: mgr.GetClient(),
|
||||
Scheme: mgr.GetScheme(),
|
||||
|
||||
@@ -35,14 +35,12 @@ const (
|
||||
MchCertificateSerialNumber = "MchCertificateSerialNumber"
|
||||
MchAPIv3Key = "MchAPIv3Key"
|
||||
AppID = "AppID"
|
||||
CallbackURL = "CallbackURL"
|
||||
NotifyCallbackURL = "NotifyCallbackURL"
|
||||
|
||||
StatusSuccess = "SUCCESS"
|
||||
StatusProcessing = "PROCESSING"
|
||||
StatusNotPay = "NOTPAY"
|
||||
StatusFail = "FAILED"
|
||||
|
||||
DefaultCallbackURL = "https://sealos.io/payment/wechat/callback"
|
||||
)
|
||||
|
||||
func NewClient(ctx context.Context, opts ...core.ClientOption) (*core.Client, error) {
|
||||
@@ -91,9 +89,6 @@ func WechatPay(amount int64, user, tradeNO, describe, callback string) (string,
|
||||
if tradeNO == "" {
|
||||
return "", fmt.Errorf("generate tradeNO failed")
|
||||
}
|
||||
if callback == "" {
|
||||
callback = DefaultCallbackURL
|
||||
}
|
||||
if describe == "" {
|
||||
describe = "sealos cloud recharge"
|
||||
}
|
||||
|
||||
@@ -7,4 +7,4 @@ ENV clientIDEnv=""
|
||||
ENV clientSecretEnv=""
|
||||
ENV kubeconfigEnv=""
|
||||
ENV ssoEndpointEnv="https://login.sealos.io"
|
||||
CMD ["kubectl apply -f auth-service/deploy.yaml"]
|
||||
CMD ["kubectl apply -f manifests/auth-service/deploy.yaml"]
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
|
||||
# Image URL to use all building/pushing image targets
|
||||
IMG ?= ghcr.io/labring/payment-service:dev
|
||||
IMG ?= ghcr.io/labring/sealos-payment-service:dev
|
||||
|
||||
# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
|
||||
ifeq (,$(shell go env GOBIN))
|
||||
|
||||
@@ -8,9 +8,8 @@ Set those envs, then start the server `go run main.go`
|
||||
MchCertificateSerialNumber = "MchCertificateSerialNumber"
|
||||
MchAPIv3Key = "MchAPIv3Key"
|
||||
AppID = "AppID"
|
||||
CallbackURL = "CallbackURL"
|
||||
NotifyCallbackURL = "CallbackURL"
|
||||
|
||||
DefaultCallbackURL = "https://sealos.io/payment/wechat/callback"
|
||||
```
|
||||
|
||||
# Get payment code-url
|
||||
@@ -36,4 +35,4 @@ go run main.go recharge --user fanux --amount 1
|
||||
Use WeChat to scan the QR code below to recharge, please make sure the username and amount are correct
|
||||
User: fanux
|
||||
Amount: 1
|
||||
```
|
||||
```
|
||||
|
||||
@@ -72,7 +72,7 @@ func (u Payment) getCodeURL(request *restful.Request, response *restful.Response
|
||||
return
|
||||
}
|
||||
|
||||
codeURL, err := pay.WechatPay(int64(a), user, "", "", os.Getenv(pay.CallbackURL))
|
||||
codeURL, err := pay.WechatPay(int64(a), user, "", "", os.Getenv(pay.NotifyCallbackURL))
|
||||
if err != nil {
|
||||
_ = response.WriteErrorString(http.StatusInternalServerError, fmt.Sprintf("payment error : %v", err))
|
||||
return
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
FROM scratch
|
||||
|
||||
USER 65532:65532
|
||||
|
||||
COPY registry ./registry
|
||||
COPY manifests ./whitelist-webhook
|
||||
CMD ["kubectl apply -f whitelist-webhook/deploy.yaml"]
|
||||
|
||||
Reference in New Issue
Block a user