Consolidate YAML files [part-15] (#9380)
This is the last PR for moving the YAML/JSON sample files. There still need some follow up PRs to: - rename the `codenew` shortcode to `code`. - move the examples_test.go to where it really belongs.
This commit is contained in:
@@ -1,10 +0,0 @@
|
||||
isClusterService: false
|
||||
serviceType: "LoadBalancer"
|
||||
plugins:
|
||||
kubernetes:
|
||||
enabled: false
|
||||
etcd:
|
||||
enabled: true
|
||||
zones:
|
||||
- "example.com."
|
||||
endpoint: "http://etcd-cluster.my-namespace:2379"
|
||||
@@ -1,34 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app: opa
|
||||
name: opa
|
||||
namespace: federation-system
|
||||
spec:
|
||||
replicas: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: opa
|
||||
name: opa
|
||||
spec:
|
||||
containers:
|
||||
- name: opa
|
||||
image: openpolicyagent/opa:0.4.10
|
||||
args:
|
||||
- "run"
|
||||
- "--server"
|
||||
- name: kube-mgmt
|
||||
image: openpolicyagent/kube-mgmt:0.2
|
||||
args:
|
||||
- "-kubeconfig=/srv/kubernetes/kubeconfig"
|
||||
- "-cluster=federation/v1beta1/clusters"
|
||||
volumeMounts:
|
||||
- name: federation-kubeconfig
|
||||
mountPath: /srv/kubernetes
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: federation-kubeconfig
|
||||
secret:
|
||||
secretName: federation-controller-manager-kubeconfig
|
||||
@@ -1,13 +0,0 @@
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: opa
|
||||
namespace: federation-system
|
||||
spec:
|
||||
selector:
|
||||
app: opa
|
||||
ports:
|
||||
- name: http
|
||||
protocol: TCP
|
||||
port: 8181
|
||||
targetPort: 8181
|
||||
@@ -1,21 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: ReplicaSet
|
||||
metadata:
|
||||
labels:
|
||||
app: nginx-pci
|
||||
name: nginx-pci
|
||||
annotations:
|
||||
requires-pci: "true"
|
||||
spec:
|
||||
replicas: 3
|
||||
selector:
|
||||
matchLabels:
|
||||
app: nginx-pci
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: nginx-pci
|
||||
spec:
|
||||
containers:
|
||||
- image: nginx
|
||||
name: nginx-pci
|
||||
@@ -1,29 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: admission
|
||||
namespace: federation-system
|
||||
data:
|
||||
config.yml: |
|
||||
apiVersion: apiserver.k8s.io/v1alpha1
|
||||
kind: AdmissionConfiguration
|
||||
plugins:
|
||||
- name: SchedulingPolicy
|
||||
path: /etc/kubernetes/admission/scheduling-policy-config.yml
|
||||
scheduling-policy-config.yml: |
|
||||
kubeconfig: /etc/kubernetes/admission/opa-kubeconfig
|
||||
opa-kubeconfig: |
|
||||
clusters:
|
||||
- name: opa-api
|
||||
cluster:
|
||||
server: http://opa.federation-system.svc.cluster.local:8181/v0/data/kubernetes/placement
|
||||
users:
|
||||
- name: scheduling-policy
|
||||
user:
|
||||
token: deadbeefsecret
|
||||
contexts:
|
||||
- name: default
|
||||
context:
|
||||
cluster: opa-api
|
||||
user: scheduling-policy
|
||||
current-context: default
|
||||
@@ -60,7 +60,18 @@ The CoreDNS default configuration should be customized to suit the federation.
|
||||
Shown below is the Values.yaml, which overrides the default
|
||||
configuration parameters on the CoreDNS chart.
|
||||
|
||||
{{< code file="Values.yaml" >}}
|
||||
```yaml
|
||||
isClusterService: false
|
||||
serviceType: "LoadBalancer"
|
||||
plugins:
|
||||
kubernetes:
|
||||
enabled: false
|
||||
etcd:
|
||||
enabled: true
|
||||
zones:
|
||||
- "example.com."
|
||||
endpoint: "http://etcd-cluster.my-namespace:2379"
|
||||
```
|
||||
|
||||
The above configuration file needs some explanation:
|
||||
|
||||
|
||||
@@ -34,7 +34,7 @@ received from the external policy engine.
|
||||
|
||||
Shown below is an example ConfigMap for the Admission Controller:
|
||||
|
||||
{{< code file="scheduling-policy-admission.yaml" >}}
|
||||
{{< codenew file="federation/scheduling-policy-admission.yaml" >}}
|
||||
|
||||
The ConfigMap contains three files:
|
||||
|
||||
@@ -84,7 +84,7 @@ Create a Service in the host cluster to contact the external policy engine:
|
||||
|
||||
Shown below is an example Service for OPA.
|
||||
|
||||
{{< code file="policy-engine-service.yaml" >}}
|
||||
{{< codenew file="federation/policy-engine-service.yaml" >}}
|
||||
|
||||
Create a Deployment in the host cluster with the Federation control plane:
|
||||
|
||||
@@ -92,7 +92,7 @@ Create a Deployment in the host cluster with the Federation control plane:
|
||||
|
||||
Shown below is an example Deployment for OPA.
|
||||
|
||||
{{< code file="policy-engine-deployment.yaml" >}}
|
||||
{{< codenew file="federation/policy-engine-deployment.yaml" >}}
|
||||
|
||||
## Configuring placement policies via ConfigMaps
|
||||
|
||||
@@ -128,7 +128,7 @@ Annotate one of the clusters to indicate that it is PCI certified.
|
||||
|
||||
Deploy a Federated ReplicaSet to test the placement policy.
|
||||
|
||||
{{< code file="replicaset-example-policy.yaml" >}}
|
||||
{{< codenew file="federation/replicaset-example-policy.yaml" >}}
|
||||
|
||||
Shown below is the command to deploy a ReplicaSet that *does* match the policy.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user