opensource/sealos
3
0
Fork 0
mirror of https://github.com/labring/sealos.git synced 2026-09-21 05:44:43 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
49751cce2e77ea86760ed7be8721ad46de535875
sealos/controllers/user/deploy/manifests/deploy.yaml.tmpl
T
cuisongliu 05a2947dde feature(main): delete pyament env from deploy (#2032) 
Signed-off-by: cuisongliu <cuisongliu@qq.com>

Signed-off-by: cuisongliu <cuisongliu@qq.com>
2022-11-03 17:14:33 +08:00

1181 lines
31 KiB
Cheetah
Raw Blame History

apiVersion: v1
kind: Namespace
metadata:
labels:
control-plane: controller-manager
name: user-system
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.10.0
creationTimestamp: null
name: accounts.user.sealos.io
spec:
group: user.sealos.io
names:
kind: Account
listKind: AccountList
plural: accounts
singular: account
scope: Namespaced
versions:
- name: v1
schema:
openAPIV3Schema:
description: Account is the Schema for the accounts API
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
description: AccountSpec defines the desired state of Account
type: object
status:
description: AccountStatus defines the observed state of Account
properties:
balance:
format: int64
type: integer
chargeList:
description: 'INSERT ADDITIONAL STATUS FIELD - define observed state
of cluster Important: Run "make" to regenerate code after modifying
this file'
items:
properties:
balance:
format: int64
type: integer
status:
type: string
time:
format: date-time
type: string
tradeNO:
type: string
type: object
type: array
type: object
type: object
served: true
storage: true
subresources:
status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.10.0
creationTimestamp: null
name: payments.user.sealos.io
spec:
group: user.sealos.io
names:
kind: Payment
listKind: PaymentList
plural: payments
singular: payment
scope: Namespaced
versions:
- name: v1
schema:
openAPIV3Schema:
description: Payment is the Schema for the payments API
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
description: PaymentSpec defines the desired state of Payment
properties:
amount:
description: Amount is the amount of recharge
format: int64
type: integer
userID:
description: UserID is the user id who want to recharge
type: string
type: object
status:
description: PaymentStatus defines the observed state of Payment
properties:
codeURL:
description: CodeURL is the codeURL of wechatpay
type: string
status:
description: Status is the status of wechatpay, charging, closed,
timeout
type: string
tradeNO:
description: TradeNO is the tradeNO of wechatpay
type: string
type: object
type: object
served: true
storage: true
subresources:
status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.10.0
creationTimestamp: null
name: usergroupbindings.user.sealos.io
spec:
group: user.sealos.io
names:
kind: UserGroupBinding
listKind: UserGroupBindingList
plural: usergroupbindings
shortNames:
- ugbinding
singular: usergroupbinding
scope: Cluster
versions:
- additionalPrinterColumns:
- jsonPath: .userGroupRef
name: UserGroup
type: string
- jsonPath: .subject.kind
name: Kind
type: string
- jsonPath: .status.phase
name: Phase
type: string
- jsonPath: .metadata.creationTimestamp
name: Age
type: date
name: v1
schema:
openAPIV3Schema:
description: UserGroupBinding is the Schema for the usergroupbindings API
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
roleRef:
default: user
description: RoleRef can only reference a ClusterRole in the global namespace.
type: string
status:
description: Status contains the different condition statuses for this
user group.
properties:
conditions:
description: Conditions contains the different condition statuses
for this user group.
items:
properties:
lastHeartbeatTime:
description: LastHeartbeatTime is the last time this condition
was updated.
format: date-time
type: string
lastTransitionTime:
description: LastTransitionTime is the last time the condition
changed from one status to another.
format: date-time
type: string
message:
description: Message is a human-readable message indicating
details about the last status change.
type: string
reason:
description: Reason is a (brief) reason for the condition's
last status change.
type: string
status:
description: Status is the status of the condition. One of True,
False, Unknown.
type: string
type:
type: string
required:
- status
- type
type: object
type: array
observedGeneration:
description: The generation observed by the user controller.
format: int64
type: integer
phase:
default: Unknown
description: Phase is the recently observed lifecycle phase of user
group binding
type: string
type: object
subject:
description: Subject holds references to the objects the role applies
to.
properties:
apiGroup:
description: APIGroup holds the API group of the referenced subject.
Defaults to "" for ServiceAccount subjects. Defaults to "rbac.authorization.k8s.io"
for User and Group subjects.
type: string
kind:
description: Kind of object being referenced. Values defined by this
API group are "User", "Group", and "ServiceAccount". If the Authorizer
does not recognized the kind value, the Authorizer should report
an error.
type: string
name:
description: Name of the object being referenced.
type: string
namespace:
description: Namespace of the referenced object. If the object kind
is non-namespace, such as "User" or "Group", and this value is not
empty the Authorizer should report an error.
type: string
required:
- kind
- name
type: object
x-kubernetes-map-type: atomic
userGroupRef:
description: UserGroupRef is the reference to the user group that this
binding binds to.
type: string
required:
- userGroupRef
type: object
served: true
storage: true
subresources:
status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.10.0
creationTimestamp: null
name: usergroups.user.sealos.io
spec:
group: user.sealos.io
names:
kind: UserGroup
listKind: UserGroupList
plural: usergroups
shortNames:
- ug
singular: usergroup
scope: Cluster
versions:
- additionalPrinterColumns:
- jsonPath: .status.phase
name: Phase
type: string
- jsonPath: .metadata.creationTimestamp
name: Age
type: date
name: v1
schema:
openAPIV3Schema:
description: UserGroup is the Schema for the usergroups API
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
status:
description: UserGroupStatus defines the observed state of UserGroup
properties:
conditions:
description: Conditions contains the different condition statuses
for this user group.
items:
properties:
lastHeartbeatTime:
description: LastHeartbeatTime is the last time this condition
was updated.
format: date-time
type: string
lastTransitionTime:
description: LastTransitionTime is the last time the condition
changed from one status to another.
format: date-time
type: string
message:
description: Message is a human-readable message indicating
details about the last status change.
type: string
reason:
description: Reason is a (brief) reason for the condition's
last status change.
type: string
status:
description: Status is the status of the condition. One of True,
False, Unknown.
type: string
type:
type: string
required:
- status
- type
type: object
type: array
observedGeneration:
description: The generation observed by the user controller.
format: int64
type: integer
phase:
default: Unknown
description: Phase is the recently observed lifecycle phase of user
group
type: string
type: object
type: object
served: true
storage: true
subresources:
status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.10.0
creationTimestamp: null
name: users.user.sealos.io
spec:
group: user.sealos.io
names:
kind: User
listKind: UserList
plural: users
singular: user
scope: Cluster
versions:
- additionalPrinterColumns:
- jsonPath: .status.phase
name: Phase
type: string
- jsonPath: .status.observedCSRExpirationSeconds
name: ExpirationSeconds
type: integer
- jsonPath: .metadata.creationTimestamp
name: Age
type: date
name: v1
schema:
openAPIV3Schema:
description: User is the Schema for the users API
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
description: UserSpec defines the desired state of User
properties:
csrExpirationSeconds:
default: 7200
description: "expirationSeconds is the requested duration of validity
of the issued certificate. The certificate signer may issue a certificate
with a different validity duration so a client must check the delta
between the notBefore and and notAfter fields in the issued certificate
to determine the actual duration. \n The minimum valid value for
expirationSeconds is 600, i.e. 10 minutes."
format: int32
type: integer
type: object
status:
description: UserStatus defines the observed state of User
properties:
conditions:
description: Conditions contains the different condition statuses
for this user.
items:
properties:
lastHeartbeatTime:
description: LastHeartbeatTime is the last time this condition
was updated.
format: date-time
type: string
lastTransitionTime:
description: LastTransitionTime is the last time the condition
changed from one status to another.
format: date-time
type: string
message:
description: Message is a human-readable message indicating
details about the last status change.
type: string
reason:
description: Reason is a (brief) reason for the condition's
last status change.
type: string
status:
description: Status is the status of the condition. One of True,
False, Unknown.
type: string
type:
type: string
required:
- status
- type
type: object
type: array
kubeConfig:
type: string
observedCSRExpirationSeconds:
default: 7200
format: int32
type: integer
observedGeneration:
description: The generation observed by the user controller.
format: int64
type: integer
phase:
default: Unknown
description: Phase is the recently observed lifecycle phase of user
type: string
required:
- kubeConfig
type: object
type: object
served: true
storage: true
subresources:
status: {}
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: user-controller-manager
namespace: user-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: user-leader-election-role
namespace: user-system
rules:
- apiGroups:
- ""
resources:
- configmaps
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- ""
resources:
- events
verbs:
- create
- patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
creationTimestamp: null
name: user-manager-role
rules:
- apiGroups:
- certificates.k8s.io
resources:
- certificatesigningrequests
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- certificates.k8s.io
resources:
- certificatesigningrequests/approval
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- certificates.k8s.io
resources:
- certificatesigningrequests/status
verbs:
- get
- patch
- update
- apiGroups:
- certificates.k8s.io
resourceNames:
- kubernetes.io/kube-apiserver-client
resources:
- signers
verbs:
- approve
- apiGroups:
- ""
resources:
- namespaces
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- ""
resources:
- secrets
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- ""
resources:
- secrets/finalizers
verbs:
- update
- apiGroups:
- ""
resources:
- secrets/status
verbs:
- get
- patch
- update
- apiGroups:
- ""
resources:
- serviceaccounts
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- ""
resources:
- serviceaccounts/status
verbs:
- get
- patch
- update
- apiGroups:
- rbac.authorization.k8s.io
resources:
- clusterrolebindings
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- rbac.authorization.k8s.io
resources:
- rolebindings
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- user.sealos.io
resources:
- accounts
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- user.sealos.io
resources:
- accounts/finalizers
verbs:
- update
- apiGroups:
- user.sealos.io
resources:
- accounts/status
verbs:
- get
- patch
- update
- apiGroups:
- user.sealos.io
resources:
- payments
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- user.sealos.io
resources:
- payments/finalizers
verbs:
- update
- apiGroups:
- user.sealos.io
resources:
- payments/status
verbs:
- get
- patch
- update
- apiGroups:
- user.sealos.io
resources:
- usergroupbindings
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- user.sealos.io
resources:
- usergroupbindings/finalizers
verbs:
- update
- apiGroups:
- user.sealos.io
resources:
- usergroupbindings/status
verbs:
- get
- patch
- update
- apiGroups:
- user.sealos.io
resources:
- usergroups
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- user.sealos.io
resources:
- usergroups/finalizers
verbs:
- update
- apiGroups:
- user.sealos.io
resources:
- usergroups/status
verbs:
- get
- patch
- update
- apiGroups:
- user.sealos.io
resources:
- users
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- user.sealos.io
resources:
- users/finalizers
verbs:
- update
- apiGroups:
- user.sealos.io
resources:
- users/status
verbs:
- get
- patch
- update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: user-metrics-reader
rules:
- nonResourceURLs:
- /metrics
verbs:
- get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: user-proxy-role
rules:
- apiGroups:
- authentication.k8s.io
resources:
- tokenreviews
verbs:
- create
- apiGroups:
- authorization.k8s.io
resources:
- subjectaccessreviews
verbs:
- create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: user-leader-election-rolebinding
namespace: user-system
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: user-leader-election-role
subjects:
- kind: ServiceAccount
name: user-controller-manager
namespace: user-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: user-manager-rolebinding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: user-manager-role
subjects:
- kind: ServiceAccount
name: user-controller-manager
namespace: user-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: user-proxy-rolebinding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: user-proxy-role
subjects:
- kind: ServiceAccount
name: user-controller-manager
namespace: user-system
---
apiVersion: v1
data:
controller_manager_config.yaml: |
apiVersion: controller-runtime.sigs.k8s.io/v1alpha1
kind: ControllerManagerConfig
health:
healthProbeBindAddress: :8081
metrics:
bindAddress: 127.0.0.1:8080
webhook:
port: 9443
leaderElection:
leaderElect: true
resourceName: 785548a1.sealos.io
# leaderElectionReleaseOnCancel defines if the leader should step down volume
# when the Manager ends. This requires the binary to immediately end when the
# Manager is stopped, otherwise, this setting is unsafe. Setting this significantly
# speeds up voluntary leader transitions as the new leader don't have to wait
# LeaseDuration time first.
# In the default scaffold provided, the program ends immediately after
# the manager stops, so would be fine to enable this option. However,
# if you are doing or is intended to do any operation such as perform cleanups
# after the manager stops then its usage might be unsafe.
# leaderElectionReleaseOnCancel: true
kind: ConfigMap
metadata:
name: user-manager-config
namespace: user-system
---
apiVersion: v1
kind: Service
metadata:
labels:
control-plane: controller-manager
name: user-controller-manager-metrics-service
namespace: user-system
spec:
ports:
- name: https
port: 8443
protocol: TCP
targetPort: https
selector:
control-plane: controller-manager
---
apiVersion: v1
kind: Service
metadata:
name: user-webhook-service
namespace: user-system
spec:
ports:
- port: 443
protocol: TCP
targetPort: 9443
selector:
control-plane: controller-manager
---
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
control-plane: controller-manager
name: user-controller-manager
namespace: user-system
spec:
replicas: 3
selector:
matchLabels:
control-plane: controller-manager
template:
metadata:
annotations:
kubectl.kubernetes.io/default-container: manager
labels:
control-plane: controller-manager
spec:
containers:
- args:
- --health-probe-bind-address=:8081
- --metrics-bind-address=127.0.0.1:8080
- --leader-elect
command:
- /manager
env:
- name: CallbackURL
value: '{{ .PaymentCallbackURL }}'
- name: NAMESPACE_NAME
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: metadata.namespace
image: ghcr.io/labring/sealos-user-controller:dev
imagePullPolicy: Always
livenessProbe:
httpGet:
path: /healthz
port: 8081
initialDelaySeconds: 15
periodSeconds: 20
name: manager
ports:
- containerPort: 9443
name: webhook-server
protocol: TCP
readinessProbe:
httpGet:
path: /readyz
port: 8081
initialDelaySeconds: 5
periodSeconds: 10
resources:
limits:
cpu: 500m
memory: 128Mi
requests:
cpu: 10m
memory: 64Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
volumeMounts:
- mountPath: /tmp/k8s-webhook-server/serving-certs
name: cert
readOnly: true
- args:
- --secure-listen-address=0.0.0.0:8443
- --upstream=http://127.0.0.1:8080/
- --logtostderr=true
- --v=0
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.13.0
name: kube-rbac-proxy
ports:
- containerPort: 8443
name: https
protocol: TCP
resources:
limits:
cpu: 500m
memory: 128Mi
requests:
cpu: 5m
memory: 64Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
securityContext:
runAsNonRoot: true
serviceAccountName: user-controller-manager
terminationGracePeriodSeconds: 10
volumes:
- name: cert
secret:
defaultMode: 420
secretName: webhook-server-cert
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: user-serving-cert
namespace: user-system
spec:
dnsNames:
- user-webhook-service.user-system.svc
- user-webhook-service.user-system.svc.cluster.local
issuerRef:
kind: Issuer
name: user-selfsigned-issuer
secretName: webhook-server-cert
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: user-selfsigned-issuer
namespace: user-system
spec:
selfSigned: {}
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
annotations:
cert-manager.io/inject-ca-from: user-system/user-serving-cert
name: user-mutating-webhook-configuration
webhooks:
- admissionReviewVersions:
- v1
clientConfig:
service:
name: user-webhook-service
namespace: user-system
path: /mutate-user-sealos-io-v1-user
failurePolicy: Fail
name: muser.kb.io
rules:
- apiGroups:
- user.sealos.io
apiVersions:
- v1
operations:
- CREATE
- UPDATE
resources:
- users
sideEffects: None
- admissionReviewVersions:
- v1
clientConfig:
service:
name: user-webhook-service
namespace: user-system
path: /mutate-user-sealos-io-v1-usergroup
failurePolicy: Fail
name: musergroup.kb.io
rules:
- apiGroups:
- user.sealos.io
apiVersions:
- v1
operations:
- CREATE
- UPDATE
resources:
- usergroups
sideEffects: None
- admissionReviewVersions:
- v1
clientConfig:
service:
name: user-webhook-service
namespace: user-system
path: /mutate-user-sealos-io-v1-usergroupbinding
failurePolicy: Fail
name: musergroupbinding.kb.io
rules:
- apiGroups:
- user.sealos.io
apiVersions:
- v1
operations:
- CREATE
- UPDATE
resources:
- usergroupbindings
sideEffects: None
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
annotations:
cert-manager.io/inject-ca-from: user-system/user-serving-cert
name: user-validating-webhook-configuration
webhooks:
- admissionReviewVersions:
- v1
clientConfig:
service:
name: user-webhook-service
namespace: user-system
path: /validate-user-sealos-io-v1-user
failurePolicy: Fail
name: vuser.kb.io
rules:
- apiGroups:
- user.sealos.io
apiVersions:
- v1
operations:
- CREATE
- UPDATE
resources:
- users
sideEffects: None
- admissionReviewVersions:
- v1
clientConfig:
service:
name: user-webhook-service
namespace: user-system
path: /validate-user-sealos-io-v1-usergroup
failurePolicy: Fail
name: vusergroup.kb.io
rules:
- apiGroups:
- user.sealos.io
apiVersions:
- v1
operations:
- CREATE
- UPDATE
resources:
- usergroups
sideEffects: None
- admissionReviewVersions:
- v1
clientConfig:
service:
name: user-webhook-service
namespace: user-system
path: /validate-user-sealos-io-v1-usergroupbinding
failurePolicy: Fail
name: vusergroupbinding.kb.io
rules:
- apiGroups:
- user.sealos.io
apiVersions:
- v1
operations:
- CREATE
- UPDATE
resources:
- usergroupbindings
sideEffects: None
Reference in New Issue View Git Blame Copy Permalink