Skip to content

Commit 5d7ead8

Browse files
djkormodjkormo
committed
initla version for openshift
Signed-off-by: Krzysztof Pudłowski <[email protected]>
1 parent c522215 commit 5d7ead8

File tree

3 files changed

+256
-0
lines changed

3 files changed

+256
-0
lines changed

‎README-agent-local.md‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
2+
Based on https://litmuschaos.github.io/litmus/experiments/concepts/security/openshift-scc/
3+
4+
5+
```
6+
helm search repo litmus-agent
7+
```
8+
<pre>
9+
NAME CHART VERSION APP VERSION DESCRIPTION
10+
litmuschaos/litmus-agent 3.18.0 3.18.0 A Helm chart to install litmus agen
11+
</pre>
12+
13+
```
14+
helm search repo litmus-agent --versions
15+
```
16+
<pre>
17+
NAME CHART VERSION APP VERSION DESCRIPTION
18+
litmuschaos/litmus-agent 3.18.0 3.18.0 A Helm chart to install litmus agent
19+
litmuschaos/litmus-agent 3.16.0 3.16.0 A Helm chart to install litmus agent
20+
litmuschaos/litmus-agent 3.15.0 3.15.0 A Helm chart to install litmus agent
21+
</pre>
22+
23+
24+
25+
### origin helm chart
26+
```
27+
helm template litmus charts/litmus-agent --namespace litmus-system --version 3.18 --values charts/litmus-agent/values.yaml
28+
helm template litmus charts/litmus-agent --namespace litmus-system --version 3.18 --values charts/litmus-agent/values.yaml | grep "image: "
29+
```
30+
31+
```
32+
helm install litmus-agent litmuschaos/litmus-agent \
33+
--namespace litmus-system --create-namespace \
34+
--version 3.18 \
35+
--set "INFRA_NAME=helm-agent" \
36+
--set "INFRA_DESCRIPTION=My first agent deployed with helm !" \
37+
--set "LITMUS_URL=https://chaos-center.domain.com" \ # FOR REMOTE AGENT (INGRESS)
38+
--set "LITMUS_URL=http://litmusportal-frontend-service.litmus.svc.cluster.local:9091" \ # FOR SELF AGENT (SVC)
39+
--set "LITMUS_BACKEND_URL=http://litmusportal-server-service.litmus.svc.cluster.local:9002" \ # FOR SELF AGENT (SVC)
40+
--set "LITMUS_USERNAME=admin" \
41+
--set "LITMUS_PASSWORD=litmus" \
42+
--set "LITMUS_PROJECT_ID=69395cb3-0231-4262-8990-78056c8adb4c" \
43+
--set "LITMUS_ENVIRONMENT_ID=nameofenvironment"
44+
45+
```
46+
47+
48+
### local checks
49+
```
50+
helm template litmus charts/litmus-agent --namespace litmus-system --version 3.18 --values values-agent-local-3-18-0.yaml
51+
helm template litmus charts/litmus-agent --namespace litmus-system --version 3.18 --values values-agent-local-3-18-0.yaml > all-litmus-agent-3-18-0-manifests.yaml.out
52+
helm template litmus charts/litmus-agent --namespace litmus-system --version 3.18 --values values-agent-local-3-18-0.yaml | grep "image: "
53+
helm template litmus charts/litmus-agent --namespace litmus-system --version 3.18 --values values-agent-local-3-18-0.yaml | grep "runAsUser: " -C 10
54+
helm template litmus charts/litmus-agent --namespace litmus-system --version 3.18 --values values-agent-local-3-18-0.yaml | grep "serviceAccountName:"
55+
```
56+
57+
58+
### spliting template manifest by the resource kind
59+
```
60+
yq -s '"split-agent-3-18-0"+(.kind | downcase) + "-" + .metadata.name +"-"+ $index' all-litmus-agent-3-18-0-manifests.yaml.out
61+
```
62+
63+
### checking values file
64+
```
65+
yq eval . values-agent-local-3-18-0.yaml
66+
```
67+
### testing with local cluster
68+
```
69+
kubectl apply -f all-litmus-agent-3-18-0-manifests.yaml.out -n litmus-system --dry-run=client
70+
kubectl apply -f all-litmus-agent-3-18-0-manifests.yaml.out -n litmus-system --dry-run=server
71+
```
72+
### cleaniing up
73+
```
74+
rm all-litmus-*-manifests.yaml.out
75+
rm split*.y*ml
76+
```
77+
78+
79+

‎charts/litmus-agent/templates/openshift-rbac.yaml‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
{{- if and .Values.openshift.enabled (not .Values.openshift.anyuid) (.Capabilities.APIVersions.Has "security.openshift.io/v1") }}
2+
apiVersion: security.openshift.io/v1
3+
kind: SecurityContextConstraints
4+
metadata:
5+
name: {{ .Values.openshift.sccName }}
6+
labels:
7+
app.kubernetes.io/name: {{ .Values.openshift.sccName }}
8+
9+
allowHostIPC: false
10+
allowHostNetwork: false
11+
# To run fault injection on a target container using pid namespace.
12+
# It is used in stress, network, dns and http experiments.
13+
allowHostPID: true
14+
allowHostPorts: false
15+
allowHostDirVolumePlugin: true
16+
# To run some privileged modules in dns, stress and network chaos
17+
allowPrivilegeEscalation: true
18+
allowPrivilegedContainer: true
19+
allowedCapabilities:
20+
- 'NET_ADMIN'
21+
- 'SYS_ADMIN'
22+
defaultAddCapabilities: null
23+
readOnlyRootFilesystem: false
24+
requiredDropCapabilities: null
25+
26+
runAsUser:
27+
type: RunAsAny
28+
seLinuxContext:
29+
type: RunAsAny # Valid value for seLinuxContext.type
30+
runAsUser:
31+
type: RunAsAny
32+
seLinuxContext:
33+
type: MustRunAs
34+
supplementalGroups:
35+
type: RunAsAny
36+
readOnlyRootFilesystem: true
37+
volumes:
38+
# To allow configmaps mounts on upload scripts or envs.
39+
- configMap
40+
# used for chaos injection like io chaos.
41+
- emptyDir
42+
- hostPath
43+
- projected
44+
- persistentVolumeClaim
45+
# To derive the experiment pod name in the experimemnt.
46+
- downwardAPI
47+
# To authenticate with different cloud providers
48+
- secret
49+
---
50+
apiVersion: rbac.authorization.k8s.io/v1
51+
kind: ClusterRole
52+
metadata:
53+
name: {{ .Values.openshift.sccName }}-clusterrole
54+
labels:
55+
app.kubernetes.io/name: {{ .Values.openshift.sccName }}-clusterrole
56+
rules:
57+
- apiGroups:
58+
- security.openshift.io
59+
resourceNames:
60+
- {{ .Values.openshift.sccName }}
61+
resources:
62+
- securitycontextconstraints
63+
verbs:
64+
- use
65+
---
66+
apiVersion: rbac.authorization.k8s.io/v1
67+
kind: RoleBinding
68+
metadata:
69+
name: {{ .Values.openshift.sccName }}-binding
70+
namespace: {{ .Release.Namespace }}
71+
labels:
72+
app.kubernetes.io/name: {{ .Values.openshift.sccName }}-binding
73+
roleRef:
74+
apiGroup: rbac.authorization.k8s.io
75+
kind: ClusterRole
76+
name: {{ .Values.openshift.sccName }}-clusterrole
77+
subjects:
78+
- kind: ServiceAccount
79+
name: default # TODO
80+
namespace: {{ .Release.Namespace }}
81+
{{- end }}
82+
83+

‎values-agent-local-3-18-0.yaml‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
global:
2+
infraConfigName: subscriber-config
3+
infraSecretName: subscriber-secret
4+
podAnnotations: {}
5+
customLabels: {}
6+
# INFRA_MODE: cluster, namespace
7+
INFRA_MODE: "cluster"
8+
# Default values for litmus-agent.
9+
# This is a YAML-formatted file.
10+
# Declare variables to be passed into your templates.
11+
12+
INFRA_NAME: "helm-infrastructure"
13+
INFRA_DESCRIPTION: "chaos infrastructure deployed with helm"
14+
15+
INFRA_NODE_SELECTOR: ""
16+
SA_EXISTS: true
17+
NS_EXISTS: true
18+
INFRA_TYPE: "external"
19+
# For compatibility with ChaosCenter, Version has to be same
20+
APP_VERSION: "3.18.0"
21+
SKIP_SSL: "false"
22+
23+
# PLATFORM_NAME: AWS, GKE, Openshift, Rancher, Others
24+
PLATFORM_NAME: "Openshift"
25+
26+
LITMUS_URL: "https://my-domain.com"
27+
LITMUS_BACKEND_URL: ""
28+
LITMUS_USERNAME: "admin"
29+
LITMUS_PASSWORD: "litmus"
30+
LITMUS_PROJECT_ID: ""
31+
# -- ID of the litmus environment where the infrastructure will be added
32+
LITMUS_ENVIRONMENT_ID: ""
33+
34+
image:
35+
repository: litmuschaos.docker.scarf.sh/litmuschaos/litmus-helm-agent
36+
pullPolicy: Always
37+
# Overrides the image tag whose default is the chart appVersion.
38+
tag: "latest"
39+
40+
crds:
41+
create: true
42+
43+
openshift:
44+
enabled: true # default false for vanilla kubernetes
45+
sccName: litmus-agent-scc # name of scc to be used
46+
serviceAccountName: litmus-admin # name of service account to be used
47+
48+
podAnnotations: {}
49+
50+
resources:
51+
limits:
52+
cpu: 100m
53+
memory: 128Mi
54+
requests:
55+
cpu: 100m
56+
memory: 128Mi
57+
58+
# Existing Secret name should be:
59+
# `{{ include "subscriber.fullname" . }}-hook`
60+
# I.E. `name: litmus-agent-hook`
61+
# -- Use an existing hook Secret instead of creating one with the chart, ref. to templates/secret.yaml
62+
useExistingHookSecret: false
63+
64+
# Existing ConfigMap name should be equal to .global.infraConfigName
65+
# I.E. `name: subscriber-config`
66+
# -- Use an existing infra ConfigMap instead of creating one with the chart, ref. to templates/infra-config-map.yaml
67+
useExistingInfraConfigMap: false
68+
69+
# Existing Secret name should be equal to .global.infraSecretName
70+
# I.E. `name: subscriber-secret`
71+
# -- Use an existing infra Secret instead of creating one with the chart, ref. to templates/infra-secret.yaml
72+
useExistingInfraSecret: false
73+
74+
# Existing ConfigMap name should be:
75+
# `{{ index .Values "workflow-controller" "appSettings" "configmapName" }}`
76+
# -- Use an existing infra ConfigMap instead of creating one with the chart, ref. to templates/infra-config-map-workflow.yaml
77+
useExistingWorkflowControllerConfigMap: false
78+
79+
chaos-operator:
80+
enabled: true
81+
82+
chaos-exporter:
83+
enabled: true
84+
85+
event-tracker:
86+
enabled: true
87+
88+
subscriber:
89+
enabled: true
90+
91+
workflow-controller:
92+
enabled: true
93+
crds:
94+
create: true

0 commit comments

Comments
 (0)