Merge remote-tracking branch 'upstream/master' into update-fork-to-latest

LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2017-2018 The Argo Authors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

OWNERS

@@ -0,0 +1,8 @@
+owners:
+- alexmt
+- jessesuen
+
+approvers:
+- alexmt
+- jessesuen
+- merenbach

README.md

@@ -0,0 +1,19 @@
+# Argo Helm Charts
+
+Repository contains helm charts for http://argoproj.io/ projects. Helm charts repository is hosted using Github pages 
+and can be added using following command:
+
+```
+helm repo add argo https://argoproj.github.io/argo-helm
+```
+
+## Publishing changes
+
+To push changes use following script:
+
+```
+GIT_PUSH=true ./scripts/publish.sh
+```
+
+Script generates tar file for each chart in `charts` directory and push changes to `gh-pages` branch.
+Write access to https://github.com/argoproj/argo-helm.git is required to publish changes.

charts/argo-ci/requirements.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: argo
   repository: https://argoproj.github.io/argo-helm
-  version: 0.1.0
+  version: 0.2.1
-digest: sha256:21178ca15d323c4fa0d8c11dd50b025a590578cee0521202badc2b704af4e292
+digest: sha256:af0f837200061b1720c0e05168dfc4a9537582f3004de62eeb5ef01b4c78db64
-generated: 2018-01-03T12:11:21.170089-08:00
+generated: 2018-10-23T14:50:47.570677461-07:00

charts/argo-ci/requirements.yaml

@@ -1,4 +1,4 @@
 dependencies:
 - name: argo
-  version: 0.1.0
+  version: 0.2.1
   repository: https://argoproj.github.io/argo-helm

charts/argo-ci/templates/ci-deployment.yaml

@@ -20,7 +20,7 @@ spec:
           - name: IN_CLUSTER
             value: "true"
           - name: NAMESPACE
-            value: 'default'
+            value: {{ .Values.workflowNamespace }}
           - name: ARGO_CI_IMAGE
             value: "{{ .Values.imageNamespace }}/{{ .Values.ciImage }}:{{ .Values.imageTag }}"
           - name: CONTROLLER_INSTANCE_ID

charts/argo-ci/values.yaml

@@ -1,10 +1,10 @@
 imageNamespace: argoproj
 ciImage: argoci
-imageTag: v1.0.0-alpha1.2
+imageTag: v1.0.0-alpha2
+workflowNamespace: default
 
 argo:
   imagesNamespace: argoproj
-  imagesTag: v2.0.0-alpha3
   enableWebConsole: false
   installMinio: true
   minioBucketName: argo-artifacts

charts/argo-events/.helmignore

@@ -0,0 +1,21 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj

charts/argo-events/Chart.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+description: A Helm chart to install Argo-Events in k8s Cluster
+name: argo-events
+version: 0.2.0
+keywords:
+- argo-events
+- sensor-controller
+sources:
+- https://github.com/argoproj/argo-events
+maintainers:
+- name: Matt Magaldi
+  email: mmagaldi@blackrock.com
+- name: Vaibhav Page
+  email: vpage@blackrock.com
+appVersion: 0.1.0

charts/argo-events/README.md

@@ -0,0 +1,13 @@
+# Argo-Events Helm Chart
+This helm chart installs the [argo-events](https://github.com/argoproj/argo-events) application. This application comes packaged with:
+- Sensor Custom Resource Definition
+- Sensor Controller Deployment
+- Sensor Controller ConfigMap
+- Sensor Controller Service Account
+- Sensor Controller Cluster Roles
+- Sensor Controller Cluster Role Bindings
+
+
+Note: the associated `argo-events` cluster role and cluster role bindings can be found in the [roles](https://blade-git.blackrock.com/cloud-native/roles) repository. The purpose that these aren't included in this Helm chart is that we do not have the required permissions to create these resources in the Kubernetes clusters. Reach out to `+Group Kubernetes Support` for help in setting up these roles.
+
+## Chart Values

charts/argo-events/templates/_helpers.tpl

@@ -0,0 +1,37 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "fullname" -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "sensor-crd-json" }}
+{
+  "apiVersion": "apiextensions.k8s.io/v1beta1",
+  "kind": "CustomResourceDefinition",
+  "metadata": {
+    "name": "sensors.argoproj.io"
+  },
+  "spec": {
+    "group": "argoproj.io",
+    "names": {
+      "kind": "Sensor",
+      "listKind": "SensorList",
+      "plural": "sensors",
+      "singular": "sensor"
+    },
+    "scope": "Namespaced",
+    "version": "v1alpha1"
+  }
+}
+{{- end}}

charts/argo-events/templates/_sensor-crd.tpl

@@ -0,0 +1,20 @@
+{{- define "sensor-crd-json" }}
+{
+  "apiVersion": "apiextensions.k8s.io/{{ .Values.crd.version }}",
+  "kind": "CustomResourceDefinition",
+  "metadata": {
+    "name": "sensors.argoproj.io"
+  },
+  "spec": {
+    "group": "argoproj.io",
+    "names": {
+      "kind": "Sensor",
+      "listKind": "SensorList",
+      "plural": "sensors",
+      "singular": "sensor"
+    },
+    "scope": "Namespaced",
+    "version": "v1alpha1"
+  }
+}
+{{- end}}

charts/argo-events/templates/apply-sensor-crd-job.yaml

@@ -0,0 +1,19 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ .Release.Name }}-apply-sensor-crd
+  annotations:
+    helm.sh/hook: pre-install
+    helm.sh/hook-delete-policy: hook-succeeded
+spec:
+  backoffLimit: 5
+  activeDeadlineSeconds: 100
+  template:
+    spec:
+      serviceAccountName: {{ .Values.crd.jobServiceAccount }}
+      containers:
+      - name: kubectl-apply
+        image: lachlanevenson/k8s-kubectl
+        command: ["/bin/sh"]
+        args: ["-c", 'echo ''{{- include "sensor-crd-json" .}}'' | kubectl apply -f -']
+      restartPolicy: Never

charts/argo-events/templates/sensor-controller-clusterrole.yaml

@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.name }}-{{ .Values.controller.name}}-cluster-role
+rules:
+- apiGroups: ["argoproj.io"]
+  resources: ["sensors"]
+  verbs: ["get", "list", "watch", "update", "patch"]
+# The following rules define what the triggers can do
+- apiGroups: ["argoproj.io"]
+  resources: ["workflows"]
+  verbs: ["create", "delete"]
+- apiGroups: [""]
+  resources: ["configmaps", "secrets", "pods"]
+  verbs: ["get", "watch", "list", "patch"]

charts/argo-events/templates/sensor-controller-configmap.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-{{ .Values.controller.name }}-configmap
+  labels:
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+data:
+  config: |
+    namespace: {{ .Release.Namespace }}
+    {{- if .Values.useReleaseAsInstanceID }}
+    instanceID: {{ .Release.Name }}
+    {{- else }}
+    instanceID: {{ .Values.instanceID }}
+    {{- end }}

charts/argo-events/templates/sensor-controller-crb.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ .Release.name }}-{{ .Values.controller.name}}-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Release.name }}-{{ .Values.controller.name}}-cluster-role
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.controller.serviceAccount }}
+  namespace: {{ .Release.Namespace }}

charts/argo-events/templates/sensor-controller-deployment.yaml

@@ -0,0 +1,33 @@
+apiVersion: apps/v1beta1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-{{ .Values.controller.name }}
+  labels:
+    app: {{ .Release.Name }}-{{ .Values.controller.name }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  replicas: {{ .Values.controller.replicaCount }}
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}-{{ .Values.controller.name }}
+      release: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Release.Name }}-{{ .Values.controller.name }}
+        release: {{ .Release.Name }}
+    spec:
+      serviceAccountName: {{ .Values.controller.serviceAccount }}
+      containers:
+        - name: {{ .Values.controller.name }}
+          image: "{{ .Values.registry }}/{{ .Values.controller.image }}:{{ .Values.controller.tag }}"
+          imagePullPolicy: {{ .Values.imagePullPolicy }}
+          env:
+            - name: SENSOR_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: SENSOR_CONFIG_MAP
+              value: {{ .Release.Name }}-{{ .Values.controller.name }}-configmap

charts/argo-events/templates/sensor-controller-sa.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.controller.serviceAccount }}

charts/argo-events/templates/signals-clusterrole.yaml

@@ -0,0 +1,11 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.name }}-signals-cluster-role
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["watch", "list", "patch"]
+- apiGroups: {{ .Values.signals.listenRoles.apiGroups }}
+  resources: {{ .Values.signals.listenRoles.resources }}
+  verbs: ["get", "list", "watch"]

charts/argo-events/templates/signals-crb.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ .Release.name }}-signals-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Release.name }}-signals-cluster-role
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.signals.serviceAccount }}
+  namespace: {{ .Release.Namespace }}

charts/argo-events/templates/signals-sa.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.signals.serviceAccount }}

charts/argo-events/values.yaml

@@ -0,0 +1,27 @@
+registry: argoproj
+imagePullPolicy: Always
+
+# Version of the Sensor CRD
+crd:
+  version: v1beta1
+  jobServiceAccount: default
+
+# If set to true then chart set controller instance id to release name
+useReleaseAsInstanceID: true
+instanceID: 1
+
+# controller
+controller:
+  name: sensor-controller
+  image: sensor-controller
+  tag: latest
+  replicaCount: 1
+  serviceAccount: argo-events
+
+# signal microservices
+signals:
+  serviceAccount: argo-signals
+  # this controls what the resource signal pod can listen to
+  listenRoles:
+    apiGroups: ["argoproj.io", ""]
+    resources: ["sensors", "workflows", "pods"]

charts/argo/README.md

@@ -0,0 +1,28 @@
+## Argo Chart
+This chart is used to set up argo and it's needed dependencies through one command. This is used in conjunction with [helm](https://github.com/kubernetes/helm).
+
+If you want your deployment of this helm chart to most closely match the [argo CLI](https://github.com/argoproj/argo), you should deploy it in the `kube-system` namespace.
+
+## Pre-Requisites
+This chart uses an install hook to configure the CRD definition.  Installation of CRDs is a somewhat privileged process in itself and in RBAC enabled clusters the `default` service account for namespaces does not typically have the ability to do create these.
+
+A few options are:
+- Setup the CRD yourself manually and use the `--no-hooks` options of `helm install`
+- Manually create a ServiceAccount in the Namespace which your release will be deployed w/ appropriate bindings to perform this action and set the `init.serviceAccount` attribute
+- Augment the `default` ServiceAccount permissions in the Namespace in which your Release is deployed to have the appropriate permissions
+
+## Usage Notes:
+This chart defaults to setting the `controller.instanceID.enabled` to `false` now, which means the deployed controller will act upon any workflow deployed to the cluster.  If you would like to limit the behavior and deploy multiple workflow controllers, please use the `controller.instanceID.enabled` attribute along with one of it's configuration options to set the `instanceID` of the workflow controller to be properly scoped for your needs.
+
+## Values
+
+The `values.yaml` contains items used to tweak a deployment of this chart.
+Fields to note:
+* `controller.instanceID.enabled`: If set to true, the Argo Controller will **ONLY** monitor Workflow submissions with a `--instanceid`  attribute
+* `controller.instanceID.useReleaseName`: If set to true then chart set controller instance id to release name
+* `controller.instanceID.explicitID`: Allows customization of an instance id for the workflow controller to monitor
+* `controller.workflowNamespaces`: This is a list of namespaces where workflows will be ran
+* `ui.enableWebConsole`: Enables ability to SSH into pod using web UI
+* `minio.install`: If this is true, we'll install [minio](https://github.com/kubernetes/charts/tree/master/stable/minio) and build out the artifactRepository section in workflow controller config map.
+* `artifactRepository.s3.accessKeySecret` and `artifactRepository.s3.secretKeySecret` These by default link to minio default credentials stored in the secret deployed by the minio chart.
+

charts/argo/requirements.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: minio
   repository: https://kubernetes-charts.storage.googleapis.com/
-  version: 0.4.3
+  version: 1.3.3
-digest: sha256:2282e3be8457161f7fb79fe1a6a871a972146574b365e69b18d9c46e16d6c47d
+digest: sha256:d53e797d51304b850951bf6ecb57ad60d34cbccfa39a7d7bd0adf65435bbee78
-generated: 2018-01-03T12:09:41.060101-08:00
+generated: 2018-06-01T10:03:04.087865-04:00

charts/argo/requirements.yaml

@@ -1,5 +1,5 @@
 dependencies:
 - name: minio
-  version: 0.4.3
+  version: 1.3.3
   repository: https://kubernetes-charts.storage.googleapis.com/
-  condition: installMinio
+  condition: minio.install

charts/argo/templates/NOTES.txt

@@ -9,9 +9,9 @@ echo '{"apiVersion": "apiextensions.k8s.io/v1beta1","kind": "CustomResourceDefin
 
 kubectl get services -o wide | grep {{ .Release.Name }}-{{ .Values.uiName }}
 
-{{ if .Values.installMinio }}
+{{ if .Values.minio.install }}
 
-3. Access Minio UI and create bucket '{{ .Values.minioBucketName }}'. Minio UI is available on port 9000 and available via external URL. URL might be retrieved using following
+3. Access Minio UI and create bucket '{{ .Values.minio.defaultBucket.name }}'. Minio UI is available on port 9000 and available via external URL. URL might be retrieved using following
 command:
 
 kubectl get services -o wide | grep {{ .Release.Name }}-minio-svc

charts/argo/templates/_helpers.tpl

@@ -14,3 +14,23 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
 {{- $name := default .Chart.Name .Values.nameOverride -}}
 {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
+
+{{- define "workflow-crd-json" }}
+{
+  "apiVersion": "apiextensions.k8s.io/v1beta1",
+  "kind": "CustomResourceDefinition",
+  "metadata": {
+    "name": "workflows.argoproj.io"
+  },
+  "spec": {
+    "group": "argoproj.io",
+    "names": {
+      "kind": "Workflow",
+      "plural": "workflows",
+      "shortNames": ["wf"]
+    },
+    "scope": "Namespaced",
+    "version": "v1alpha1"
+  }
+}
+{{- end}}

charts/argo/templates/apply-workflow-crd-job.yaml

@@ -10,6 +10,7 @@ spec:
   activeDeadlineSeconds: 100
   template:
     spec:
+      serviceAccountName: {{ .Values.init.serviceAccount | quote }}
       containers:
       - name: kubectl-apply
         image: lachlanevenson/k8s-kubectl

charts/argo/templates/ui-cluster-role.yaml

@@ -0,0 +1,29 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-{{ .Values.ui.name}}-cluster-role
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - pods/exec
+  - pods/log
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - argoproj.io
+  resources:
+  - workflows
+  verbs:
+  - get
+  - list
+  - watch

charts/argo/templates/ui-crb.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ .Release.Name }}-{{ .Values.ui.name}}-crb
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Release.Name }}-{{ .Values.ui.name}}-cluster-role
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.ui.serviceAccount }}
+  namespace: {{ .Release.Namespace }}

charts/argo/templates/ui-deployment.yaml

@@ -2,22 +2,31 @@
 apiVersion: extensions/v1beta1
 kind: Deployment
 metadata:
-  name: {{ .Release.Name }}-{{ .Values.uiName}}
+  name: {{ .Release.Name }}-{{ .Values.ui.name}}
   labels:
     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
+    namspace: {{ .Release.Namespace }}
 spec:
   template:
     metadata:
       labels:
-        app: {{ .Release.Name }}-{{ .Values.uiName}}
+        app: {{ .Release.Name }}-{{ .Values.ui.name}}
         release: {{ .Release.Name }}
+      {{- if .Values.ui.podAnnotations }}
+      annotations:
+{{ toYaml .Values.ui.podAnnotations | indent 8}}{{- end }}
     spec:
+      serviceAccountName: {{ .Values.ui.serviceAccount | quote }}
       containers:
         - name: ui
-          image: "{{ .Values.imagesNamespace }}/{{ .Values.uiImage }}:{{ .Values.imagesTag }}"
+          image: "{{ .Values.images.namespace }}/{{ .Values.images.ui }}:{{ .Values.images.tag }}"
           env:
           - name: IN_CLUSTER
             value: "true"
+        {{- if .Values.ui.enableWebConsole }}
+          - name: ENABLE_WEB_CONSOLE
+            value: "true"
+        {{- end }}
 {{ end }}

charts/argo/templates/ui-ingress.yaml

@@ -0,0 +1,31 @@
+{{- if .Values.ui.ingress.enabled -}}
+{{- $serviceName := printf "%s-%s" .Release.Name .Values.ui.name -}}
+{{- $servicePort := .Values.ui.servicePort -}}
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: {{ .Release.Name }}-{{ .Values.ui.name }}
+  labels:
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    namspace: {{ .Release.Namespace }}
+  annotations:
+    {{- range $key, $value := .Values.ui.ingress.annotations }}
+    {{ $key }}: {{ $value | quote }}
+    {{- end }}
+spec:
+  rules:
+    {{- range .Values.ui.ingress.hosts }}
+    - host: {{ . }}
+      http:
+        paths:
+          - backend:
+              serviceName: {{ $serviceName }}
+              servicePort: {{ $servicePort }}
+    {{- end -}}
+  {{- if .Values.ui.ingress.tls }}
+  tls:
+{{ toYaml .Values.ui.ingress.tls | indent 4 }}
+  {{- end -}}
+{{- end -}}

charts/argo/templates/ui-sa.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.ui.serviceAccount }}
+  namspace: {{ .Release.Namespace }}

charts/argo/templates/ui-service.yaml

@@ -2,18 +2,21 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ .Release.Name }}-{{ .Values.uiName}}
+  name: {{ .Release.Name }}-{{ .Values.ui.name }}
   labels:
     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
+    namspace: {{ .Release.Namespace }}
+  {{- if .Values.ui.serviceAnnotations }}
+  annotations:
+{{ toYaml .Values.ui.serviceAnnotations | indent 4}}{{- end }}
 spec:
   ports:
-  - port: 80
+  - port: {{ .Values.ui.servicePort }}
     protocol: TCP
     targetPort: 8001
   selector:
-    app: {{ .Release.Name }}-{{ .Values.uiName}}
+    app: {{ .Release.Name }}-{{ .Values.ui.name }}
   sessionAffinity: None
-  type: {{ .Values.uiServiceType }}
+  type: {{ .Values.ui.serviceType }}
-{{ end }}

charts/argo/templates/worfkflow-controller-secrets-access.yaml

@@ -0,0 +1,18 @@
+{{ if .Values.minio.install }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-{{ .Values.controller.name}}-minio-secret
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  resourceNames:
+  - {{ .Values.artifactRepository.s3.accessKeySecret.name | default (printf "%s-%s" .Release.Name "minio") | quote }}
+  - {{ .Values.artifactRepository.s3.secretKeySecret.name | default (printf "%s-%s" .Release.Name "minio") | quote }}
+  verbs:
+  - get
+  - watch
+  - list
+{{- end }}

charts/argo/templates/workflow-controller-clusterrole.yaml

@@ -0,0 +1,42 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-{{ .Values.controller.name}}-cluster-role
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - pods/exec
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - watch
+  - list
+- apiGroups:
+  - ""
+  resources:
+  - persistentvolumeclaims
+  verbs:
+  - create
+  - delete
+- apiGroups:
+  - argoproj.io
+  resources:
+  - workflows
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+  - patch

charts/argo/templates/workflow-controller-config-map.yaml

@@ -1,31 +1,34 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ .Release.Name }}-{{ .Values.controllerName }}-configmap
+  name: {{ .Release.Name }}-{{ .Values.controller.name }}-configmap
   labels:
     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
+    namespace: {{ .Release.Namespace }}
 data:
   config: |
-    {{- if .Values.useReleaseAsInstanceID }}
+    {{- if .Values.controller.instanceID.enabled }}
+    {{- if .Values.controller.instanceID.useReleaseName }}
     instanceID: {{ .Release.Name }}
     {{- else }}
-    instanceID: {{ .Values.instanceID }}
+    instanceID: {{ .Values.controller.instanceID.explicitID }}
+    {{- end }}
     {{- end }}
     artifactRepository:
-      {{- if or .Values.installMinio .Values.useDefaultArtifactRepo }}
+      {{- if or .Values.minio.install .Values.useDefaultArtifactRepo }}
       s3:
         {{- if .Values.useStaticCredentials }}
         accessKeySecret:
           key: {{ .Values.artifactRepository.s3.accessKeySecret.key }}
-          name: {{ .Values.artifactRepository.s3.accessKeySecret.name | default (printf "%s-%s" .Release.Name "minio-user") }}
+          name: {{ .Values.artifactRepository.s3.accessKeySecret.name | default (printf "%s-%s" .Release.Name "minio") }}
         secretKeySecret:
           key: {{ .Values.artifactRepository.s3.secretKeySecret.key }}
-          name: {{ .Values.artifactRepository.s3.secretKeySecret.name | default (printf "%s-%s" .Release.Name "minio-user") }}
+          name: {{ .Values.artifactRepository.s3.secretKeySecret.name | default (printf "%s-%s" .Release.Name "minio") }}
         {{- end }}
-        bucket: {{ .Values.artifactRepository.s3.bucket | default .Values.minioBucketName }}
+        bucket: {{ .Values.artifactRepository.s3.bucket | default .Values.minio.defaultBucket.name }}
-        endpoint: {{ .Values.artifactRepository.s3.endpoint | default (printf "%s-%s" .Release.Name "minio-svc:9000") }}
+        endpoint: {{ .Values.artifactRepository.s3.endpoint | default (printf "%s-%s" .Release.Name "minio:9000") }}
         insecure: {{ .Values.artifactRepository.s3.insecure }}
       {{- end}}
-    executorImage: "{{ .Values.imagesNamespace }}/{{ .Values.executorImage }}:{{ .Values.imagesTag }}"
+    executorImage: "{{ .Values.images.namespace }}/{{ .Values.images.executor }}:{{ .Values.images.tag }}"

charts/argo/templates/workflow-controller-crb.yaml

@@ -0,0 +1,23 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ .Release.Name }}-{{ .Values.controller.name}}-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Release.Name }}-{{ .Values.controller.name}}-cluster-role
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.controller.serviceAccount }}
+    namespace: {{ .Release.Namespace }}
+{{- if .Values.controller.workflowNamespaces }}
+{{- $uiServiceAccount := .Values.controller.serviceAccount }}
+{{- $namespace := .Release.Namespace }}
+{{- range $key := .Values.controller.workflowNamespaces }}
+  {{- if not (eq $key $namespace) }}
+  - kind: ServiceAccount
+    name: {{ $uiServiceAccount }}
+    namespace: {{ $key }}
+  {{- end }}
+{{- end }}
+{{- end }}

charts/argo/templates/workflow-controller-deployment.yaml

@@ -1,24 +1,35 @@
 apiVersion: extensions/v1beta1
 kind: Deployment
 metadata:
-  name: {{ .Release.Name }}-{{ .Values.controllerName}}
+  name: {{ .Release.Name }}-{{ .Values.controller.name}}
   labels:
-    app: {{ .Release.Name }}-{{ .Values.controllerName}}
+    app: {{ .Release.Name }}-{{ .Values.controller.name}}
     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     release: {{ .Release.Name }}
+    namespace: {{ .Release.Namespace }}
     heritage: {{ .Release.Service }}
 spec:
   template:
     metadata:
       labels:
-        app: {{ .Release.Name }}-{{ .Values.controllerName}}
+        app: {{ .Release.Name }}-{{ .Values.controller.name}}
         release: {{ .Release.Name }}
+      {{- if .Values.controller.podAnnotations }}
+      annotations:
+{{ toYaml .Values.controller.podAnnotations | indent 8}}{{- end }}
     spec:
+      serviceAccountName: {{ .Values.controller.serviceAccount | quote }}
       containers:
         - name: controller
-          image: "{{ .Values.imagesNamespace }}/{{ .Values.controllerImage }}:{{ .Values.imagesTag }}"
+          image: "{{ .Values.images.namespace }}/{{ .Values.images.controller }}:{{ .Values.images.tag }}"
           command: [ "workflow-controller" ]
-          args: ["--configmap", "{{ .Release.Name }}-{{ .Values.controllerName}}-configmap"]
+          args:
+          - "--configmap"
+          - "{{ .Release.Name }}-{{ .Values.controller.name}}-configmap"
+          - "--loglevel"
+          - "{{ .Values.controller.logging.level }}"
+          - "--gloglevel"
+          - "{{ .Values.controller.logging.globallevel }}"
           env:
           - name: ARGO_NAMESPACE
             valueFrom:

charts/argo/templates/workflow-controller-minio-secret-crb.yaml

@@ -0,0 +1,25 @@
+{{ if .Values.minio.install }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-{{ .Values.controller.name}}-minio-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-{{ .Values.controller.name}}-minio-secret
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.controller.serviceAccount }}
+    namespace: {{ .Release.Namespace }}
+{{- if .Values.controller.workflowNamespaces }}
+{{- $uiServiceAccount := .Values.controller.serviceAccount }}
+{{- $namespace := .Release.Namespace }}
+{{- range $key := .Values.controller.workflowNamespaces }}
+  {{- if not (eq $key $namespace) }}
+  - kind: ServiceAccount
+    name: {{ $uiServiceAccount }}
+    namespace: {{ $key }}
+  {{- end }}
+{{- end }}
+{{- end }}
+{{- end }}

charts/argo/templates/workflow-controller-sa.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.controller.serviceAccount }}
+  namespace: {{ .Release.Namespace }}

charts/argo/values.yaml

@@ -1,33 +1,96 @@
-imagesNamespace: argoproj
+images:
-controllerImage: workflow-controller
+  namespace: argoproj
-uiImage: argoui
+  controller: workflow-controller
-executorImage: argoexec
+  ui: argoui
-imagesTag: v2.1.0-alpha1
+  executor: argoexec
-controllerName: workflow-controller
+  tag: v2.1.1
+
+crdVersion: v1alpha1
+
+init:
+  # By default the installation will not set an explicit one, which will mean it uses `default` for the namespace the chart is
+  # being deployed to.  In RBAC clusters, that will almost certainly fail.  See the NOTES: section of the readme for more info.
+  serviceAccount: ""
+
+controller:
+  # podAnnotations is an optional map of annotations to be applied to the controller Pods
+  podAnnotations: {}
+  serviceAccount: argo
+  name: workflow-controller
+  workflowNamespaces:
+    - default
+  instanceID:
+    # `instanceID.enabled` configures the controller to filter workflow submissions
+    # to only those which have a matching instanceID attribute.
+    enabled: false
+    # NOTE: If `instanceID.enabled` is set to `true` then either `instanceID.userReleaseName`
+    # or `instanceID.explicitID` must be defined.
+    # useReleaseName: true
+    # explicitID: unique-argo-controller-identifier
+  logging:
+    level: info
+    globallevel: "0"
 
 ui:
   enabled: true
+  # optional map of annotations to be applied to the ui Pods
+  podAnnotations: {}
+  name: ui
   # Enables ability to SSH into pod using web UI
   enableWebConsole: false
-uiName: ui
+  serviceType: ClusterIP
-uiServiceType: LoadBalancer
+  servicePort: 80
-crdVersion: v1alpha1
+  serviceAccount: argo-ui
+  # Annotations to be applied to the UI Service
+  serviceAnnotations: {}
   
-# If set to true then chart set controller instance id to release name
+  ## Ingress configuration.
-useReleaseAsInstanceID: false
+  ## ref: https://kubernetes.io/docs/user-guide/ingress/
-instanceID:
+  ##
+  ingress:
+    enabled: false
 
+    ## Annotations to be added to the web ingress.
+    ##
+    # annotations:
+    #   kubernetes.io/ingress.class: nginx
+    #   kubernetes.io/tls-acme: "true"
+
+    ## Hostnames.
+    ## Must be provided if Ingress is enabled.
+    ##
+    # hosts:
+    #   - argo.domain.com
+
+    ## TLS configuration.
+    ## Secrets must be manually created in the namespace.
+    ##
+    # tls:
+    #   - secretName: argo-ui-tls
+    #     hosts:
+    #       - argo.domain.com
+
+# Influences the creation of the ConfigMap for the workflow-controller itself.
 useDefaultArtifactRepo: false
 useStaticCredentials: true
-
-# If set to true then chart installs minio and generate according artifactRepository section in workflow controller config map
-installMinio: true
-minioBucketName: argo-artifacts
-
 artifactRepository:
   s3:
+    # Note the `key` attribute is not the actual secret, it's the PATH to
+    # the contents in the associated secret, as defined by the `name` attribute.
     accessKeySecret:
+      # name: <releaseName>-minio (default)
       key: accesskey
     secretKeySecret:
+      # name: <releaseName>-minio
       key: secretkey
     insecure: true
+    # bucket:
+    # endpoint:
+
+# NOTE: These are setting attributes for the `minio` optional dependency
+minio:
+  # If set to true then chart installs minio and generate according artifactRepository section in workflow controller config map
+  install: false
+  defaultBucket:
+    enabled: true
+    name: argo-artifacts

scripts/publish.sh

@@ -2,7 +2,7 @@
 
 SRCROOT="$(cd "$(dirname "$0")/.." && pwd)"
 
-mkdir -p $SRCROOT/output
+rm -rf $SRCROOT/output && git clone -b gh-pages git@github.com:argoproj/argo-helm.git $SRCROOT/output
 
 for dir in $SRCROOT/charts/*;
 do
@@ -11,3 +11,10 @@ do
  tar -cvzf $SRCROOT/output/$(basename $dir)-$version.tgz -C $dir .
  cd $SRCROOT/output && helm repo index .
 done
+
+cd $SRCROOT/output && git status
+
+if [ "$GIT_PUSH" == "true" ]
+then
+    cd $SRCROOT/output && git add . && git commit -m "Publish charts" && git push git@github.com:argoproj/argo-helm.git gh-pages
+fi