Init commit

examples/extensions/flux2/crd-configmap.yaml

@@ -0,0 +1,28 @@
+{{/*
+We have to create individual configmaps for each CRD - they exceed the total
+allowed length for a configmap if they are combined.
+*/}}
+{{ $currentScope := . }}
+{{- if .Values.crds.install }}
+  {{- range $path, $_ := .Files.Glob "crd-base/**" }}
+    {{- with $currentScope }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "crdInstall" . }}-{{ $path | base | trimSuffix ".yaml" }}
+  namespace: {{ .Release.Namespace | quote }}
+  annotations:
+    # create hook dependencies in the right order
+    "helm.sh/hook-weight": "-5"
+    {{- include "crdInstallAnnotations" . | nindent 4 }}
+  labels:
+    app.kubernetes.io/component: {{ include "crdInstall" . | quote }}
+    {{- include "labels.selector" . | nindent 4 }}
+    role: {{ include "crdInstallSelector" . | quote }}
+data:
+  content: |
+{{ tpl (.Files.Get $path) . | indent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end }}

examples/extensions/flux2/crd-job.yaml

@@ -0,0 +1,80 @@
+{{- if .Values.crds.install }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "crdInstallJob" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  annotations:
+    # create hook dependencies in the right order
+    "helm.sh/hook-weight": "-1"
+    {{- include "crdInstallAnnotations" . | nindent 4 }}
+  labels:
+    app.kubernetes.io/component: {{ include "crdInstall" . | quote }}
+    {{- include "labels.selector" . | nindent 4 }}
+    role: {{ include "crdInstallSelector" . | quote }}
+spec:
+  ttlSecondsAfterFinished: 3600
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: {{ include "crdInstall" . | quote }}
+        {{- include "labels.selector" . | nindent 8 }}
+    spec:
+      serviceAccountName: {{ include "crdInstall" . }}
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 2000
+        {{- if ge (int .Capabilities.KubeVersion.Minor) 19 }}
+        {{- with .Values.crds.podSeccompProfile }}
+        seccompProfile:
+          {{- . | toYaml | nindent 10 }}
+        {{- end }}
+        {{- end }}
+      tolerations:
+      - key: node-role.kubernetes.io/master
+        effect: NoSchedule
+      - key: node-role.kubernetes.io/control-plane
+        effect: NoSchedule
+      containers:
+      - name: kubectl
+        image: "{{ .Values.images.registry }}/giantswarm/docker-kubectl:1.23.6"
+        command:
+        - sh
+        - -c
+        - |
+          set -o errexit ; set -o xtrace ; set -o nounset
+
+          # piping stderr to stdout means kubectl's errors are surfaced
+          # in the pod's logs.
+
+          kubectl apply -f /data/ 2>&1
+        securityContext:
+          readOnlyRootFilesystem: true
+          {{- if ge (int .Capabilities.KubeVersion.Minor) 19 }}
+          {{- with .Values.crds.seccompProfile }}
+          seccompProfile:
+            {{- . | toYaml | nindent 12 }}
+          {{- end }}
+          {{- end }}
+        volumeMounts:
+{{- range $path, $_ := .Files.Glob "crd-base/**" }}
+        - name: {{ $path | base | trimSuffix ".yaml" }}
+          mountPath: /data/{{ $path | base }}
+          subPath: {{ $path | base }}
+{{- end }}
+        resources: {{- toYaml .Values.crds.resources | nindent 10 }}
+      volumes:
+{{ $currentScope := . }}
+{{- range $path, $_ := .Files.Glob "crd-base/**" }}
+    {{- with $currentScope }}
+      - name: {{ $path | base | trimSuffix ".yaml" }}
+        configMap:
+          name: {{ include "crdInstall" . }}-{{ $path | base | trimSuffix ".yaml" }}
+          items:
+          - key: content
+            path: {{ $path | base }}
+{{- end }}
+{{- end }}
+      restartPolicy: Never
+  backoffLimit: 4
+{{- end }}

examples/extensions/flux2/crd-np.yaml

@@ -0,0 +1,59 @@
+{{- if .Values.crds.install }}
+{{- if .Capabilities.APIVersions.Has "cilium.io/v2/CiliumNetworkPolicy" }}
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: {{ include "crdInstall" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  annotations:
+    # create hook dependencies in the right order
+    "helm.sh/hook-weight": "-7"
+    {{- include "crdInstallAnnotations" . | nindent 4 }}
+  labels:
+    app.kubernetes.io/component: {{ include "crdInstall" . | quote }}
+    {{- include "labels.selector" . | nindent 4 }}
+    role: {{ include "crdInstallSelector" . | quote }}
+spec:
+  egress:
+    - toEntities:
+        - kube-apiserver
+  endpointSelector: {}
+{{- else }}
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: {{ include "crdInstall" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  annotations:
+    # create hook dependencies in the right order
+    "helm.sh/hook-weight": "-7"
+    {{- include "crdInstallAnnotations" . | nindent 4 }}
+  labels:
+    app.kubernetes.io/component: {{ include "crdInstall" . | quote }}
+    {{- include "labels.selector" . | nindent 4 }}
+    role: {{ include "crdInstallSelector" . | quote }}
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/component: {{ include "crdInstall" . | quote }}
+      {{- include "labels.selector" . | nindent 6 }}
+  # allow egress traffic to the Kubernetes API
+  egress:
+    - ports:
+        - port: 443
+          protocol: TCP
+        # legacy port kept for compatibility
+        - port: 6443
+          protocol: TCP
+      to:
+    {{- range tuple "10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16" "100.64.0.0/10" }}
+        - ipBlock:
+            cidr: {{ . }}
+    {{- end }}
+  # deny ingress traffic
+  ingress: []
+  policyTypes:
+    - Egress
+    - Ingress
+{{- end }}
+{{- end }}

examples/extensions/flux2/crd-rbac.yaml

@@ -0,0 +1,62 @@
+{{- if .Values.crds.install }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "crdInstall" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  annotations:
+    # create hook dependencies in the right order
+    "helm.sh/hook-weight": "-3"
+    {{- include "crdInstallAnnotations" . | nindent 4 }}
+  labels:
+    app.kubernetes.io/component: {{ include "crdInstall" . | quote }}
+    {{- include "labels.selector" . | nindent 4 }}
+    role: {{ include "crdInstallSelector" . | quote }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - jobs
+  verbs:
+  - create
+  - delete
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - create
+  - delete
+  - get
+  - patch
+- apiGroups:
+  - policy
+  resources:
+  - podsecuritypolicies
+  resourceNames:
+  - {{ include "crdInstall" . }}
+  verbs:
+  - use
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "crdInstall" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  annotations:
+    # create hook dependencies in the right order
+    "helm.sh/hook-weight": "-2"
+    {{- include "crdInstallAnnotations" . | nindent 4 }}
+  labels:
+    app.kubernetes.io/component: {{ include "crdInstall" . | quote }}
+    {{- include "labels.common" . | nindent 4 }}
+    role: {{ include "crdInstallSelector" . | quote }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "crdInstall" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "crdInstall" . }}
+    namespace: {{ .Release.Namespace | quote }}
+{{- end }}

examples/extensions/flux2/crd-serviceaccount.yaml

@@ -0,0 +1,15 @@
+{{- if .Values.crds.install }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "crdInstall" . }}
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    # create hook dependencies in the right order
+    "helm.sh/hook-weight": "-4"
+    {{- include "crdInstallAnnotations" . | nindent 4 }}
+  labels:
+    app.kubernetes.io/component: {{ include "crdInstall" . | quote }}
+    {{- include "labels.selector" . | nindent 4 }}
+    role: {{ include "crdInstallSelector" . | quote }}
+{{- end }}

examples/extensions/vaultwarden/virtual-service.yaml

@@ -0,0 +1,30 @@
+{{- if .Values.virtualservice.enabled -}}
+{{- $fullName := include "vaultwarden.fullname" . -}}
+{{- $svcPort := .Values.service.port -}}
+{{- if $.Capabilities.APIVersions.Has "networking.istio.io/v1beta1" }}
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "vaultwarden.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  gateways:
+    - {{ .Values.virtaulservice.gatewayRef }}
+  hosts:
+    - ci.badhouseplants.ne
+  http:
+    - match:
+        - uri:
+            prefix: /
+      route:
+        - destination:
+            host: woodpecker-ci-server
+            port:
+              number: 80
+{{- end }}
+{{- end }}

examples/patches/flux-regexp/patch.yaml

@@ -0,0 +1,51 @@
+---
+name: Remove CRDs leftovers from values
+targets:
+  - values.yaml
+before: |-
+  installCRDs: true
+  crds:
+    # -- Add annotations to all CRD resources, e.g. "helm.sh/resource-policy": keep
+    annotations: \{\}
+after: |-
+  crds:
+    install: true
+
+    # Add seccomp to pod security context
+    podSeccompProfile:
+      type: RuntimeDefault
+
+    # Add seccomp to container security context
+    seccompProfile:
+      type: RuntimeDefault
+
+    resources:
+      requests:
+        memory: "128Mi"
+        cpu: "250m"
+      limits:
+        memory: "256Mi"
+        cpu: "500m"
+
+---
+name: Append crd install data to helpers
+targets:
+  - templates/_helper.tpl
+after: |-
+  {{- define "crdInstall" -}}
+  {{- printf "%s-%s" ( include "name" . ) "crd-install" | replace "+" "_" | trimSuffix "-" -}}
+  {{- end -}}
+
+  {{- define "crdInstallJob" -}}
+  {{- printf "%s-%s-%s" ( include "name" . ) "crd-install" .Chart.AppVersion | replace "+" "_" | replace "." "-" | trimSuffix "-" | trunc 63 -}}
+  {{- end -}}
+
+  {{- define "crdInstallAnnotations" -}}
+  "helm.sh/hook": "pre-install,pre-upgrade"
+  "helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded,hook-failed"
+  {{- end -}}
+
+  {{/* Create a label which can be used to select any orphaned crd-install hook resources */}}
+  {{- define "crdInstallSelector" -}}
+  {{- printf "%s" "crd-install-hook" -}}
+  {{- end -}}

examples/patches/git/patch-2.diff

@@ -0,0 +1,34 @@
+diff --git a/values.yaml b/values.yaml
+index 7ed6839..2b144ad 100644
+--- a/values.yaml
++++ b/values.yaml
+@@ -1,6 +1,6 @@
+ image:
+   repository: registry.hub.docker.com/vaultwarden/server
+-  pullPolicy: IfNotPresent
++  pullPolicy: Always
+   # Overrides the image tag whose default is the chart appVersion.
+   tag: ""
+ imagePullSecrets: []
+@@ -10,13 +10,14 @@ podAnnotations: {}
+ podSecurityContext: {}
+ # fsGroup: 2000
+ 
+-securityContext: {}
+-# capabilities:
+-#   drop:
+-#   - ALL
+-# readOnlyRootFilesystem: true
+-# runAsNonRoot: true
+-# runAsUser: 1000
++securityContext:
++capabilities:
++  drop:
++    - ALL
++
++readOnlyRootFilesystem: true
++runAsNonRoot: true
++runAsUser: 1000
+ 
+ service:
+   type: ClusterIP

examples/patches/git/patch.diff

@@ -0,0 +1,13 @@
+diff --git a/Chart.yaml b/Chart.yaml
+index d8995d5..0e5f5a5 100644
+--- a/Chart.yaml
++++ b/Chart.yaml
+@@ -8,7 +8,7 @@ keywords:
+ - bitwarden
+ - bitwarden_rs
+ maintainers:
+-- email: allanger@badhouseplants.net
++- email: Somebody else
+   name: Nikolai Rodionov
+   url: https://badhouseplants.net
+ name: vaultwarden

examples/patches/regexp/patch.yaml

@@ -0,0 +1,7 @@
+---
+name: Add spaces before comments
+targets:
+  - values.yaml
+before: |-
+  ^.*[\S]+.*#
+after: " #"

examples/yamlfmt.yml

@@ -0,0 +1 @@
+pad_line_comments: 2