From e0a1d0e668d9c6a970435809999f0d8c8fb8b332 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alexis=20MARI=C3=89?= Date: Wed, 3 Jun 2026 17:41:24 +0200 Subject: [PATCH 1/5] feat(prerequisites): tools pure helm installation --- modules/prerequisites/Chart.yaml | 12 +++++ modules/prerequisites/values.schema.json | 24 ++++++++++ modules/prerequisites/values.yaml | 15 ------- modules/prerequisites/values/sandbox.yaml | 55 +++++++++++++++++++++++ 4 files changed, 91 insertions(+), 15 deletions(-) create mode 100644 modules/prerequisites/values.schema.json delete mode 100644 modules/prerequisites/values.yaml create mode 100644 modules/prerequisites/values/sandbox.yaml diff --git a/modules/prerequisites/Chart.yaml b/modules/prerequisites/Chart.yaml index 028d5b1..ac1e028 100644 --- a/modules/prerequisites/Chart.yaml +++ b/modules/prerequisites/Chart.yaml @@ -18,3 +18,15 @@ apiVersion: v2 name: prerequisites description: A Helm chart for installing OKDP prerequisites version: 0.1.0 +dependencies: + - name: reloader + version: "1.0.72" + repository: "https://stakater.github.io/stakater-charts" + - name: kubernetes-replicator + version: "2.9.2" + repository: "https://helm.mittwald.de" + alias: replicator + - name: kubernetes-secret-generator + version: "3.4.0" + repository: "https://helm.mittwald.de" + alias: secret-generator diff --git a/modules/prerequisites/values.schema.json b/modules/prerequisites/values.schema.json new file mode 100644 index 0000000..0bfe605 --- /dev/null +++ b/modules/prerequisites/values.schema.json @@ -0,0 +1,24 @@ +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "type": "object", + "properties": { + "reloader": { + "type": "object", + "properties": { + "enabled": { "type": "boolean", "default": true } + } + }, + "replicator": { + "type": "object", + "properties": { + "enabled": { "type": "boolean", "default": true } + } + }, + "secret-generator": { + "type": "object", + "properties": { + "enabled": { "type": "boolean", "default": true } + } + } + } +} diff --git a/modules/prerequisites/values.yaml b/modules/prerequisites/values.yaml deleted file mode 100644 index 088d78c..0000000 --- a/modules/prerequisites/values.yaml +++ /dev/null @@ -1,15 +0,0 @@ -# -# Copyright 2026 The OKDP Authors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# diff --git a/modules/prerequisites/values/sandbox.yaml b/modules/prerequisites/values/sandbox.yaml new file mode 100644 index 0000000..38794db --- /dev/null +++ b/modules/prerequisites/values/sandbox.yaml @@ -0,0 +1,55 @@ +# +# Copyright 2026 The OKDP Authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +reloader: + enabled: true + reloader: + deployment: + securityContext: + seccompProfile: { type: RuntimeDefault } + containerSecurityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: ["ALL"] + +replicator: + enabled: true + podSecurityContext: + seccompProfile: { type: RuntimeDefault } + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + capabilities: + drop: ["ALL"] + livenessProbe: { initialDelaySeconds: 10 } + readinessProbe: { initialDelaySeconds: 10 } + +secret-generator: + enabled: true + fullnameOverride: secret-generator + podSecurityContext: + fsGroup: 2000 + seccompProfile: { type: RuntimeDefault } + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + capabilities: + drop: ["ALL"] + From 72717cb5448978bdb98f35180df51642497c565d Mon Sep 17 00:00:00 2001 From: Huang Mori Date: Thu, 4 Jun 2026 10:59:01 +0200 Subject: [PATCH 2/5] fix(prerequisites): helm dependency and install cmds --- modules/prerequisites/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/prerequisites/README.md b/modules/prerequisites/README.md index 8096b59..04e651c 100644 --- a/modules/prerequisites/README.md +++ b/modules/prerequisites/README.md @@ -11,6 +11,7 @@ A Helm chart for installing OKDP prerequisites. To install the chart with the release name `prerequisites`: ```sh +$ helm dependency update modules/prerequisites/ $ helm install prerequisites modules/prerequisites ``` From dceb4d5492bbd5881c18985582709ae9c8620dbd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alexis=20MARI=C3=89?= Date: Thu, 4 Jun 2026 12:59:38 +0200 Subject: [PATCH 3/5] feat(prerequisites): gitignore file --- .gitignore | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 .gitignore diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..9c34947 --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +*.lock +*.tgz From c5585eb330648f7b4e6ebb369831834ec52b1ef1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alexis=20MARI=C3=89?= Date: Wed, 3 Jun 2026 17:44:00 +0200 Subject: [PATCH 4/5] feat(prerequisites): ingress-nginx pure helm installation --- modules/prerequisites/Chart.yaml | 3 +++ modules/prerequisites/values.schema.json | 6 ++++++ modules/prerequisites/values/sandbox.yaml | 18 ++++++++++++++++++ 3 files changed, 27 insertions(+) diff --git a/modules/prerequisites/Chart.yaml b/modules/prerequisites/Chart.yaml index ac1e028..a48eec1 100644 --- a/modules/prerequisites/Chart.yaml +++ b/modules/prerequisites/Chart.yaml @@ -30,3 +30,6 @@ dependencies: version: "3.4.0" repository: "https://helm.mittwald.de" alias: secret-generator + - name: ingress-nginx + version: "4.12.1" + repository: "https://kubernetes.github.io/ingress-nginx" diff --git a/modules/prerequisites/values.schema.json b/modules/prerequisites/values.schema.json index 0bfe605..61ec18e 100644 --- a/modules/prerequisites/values.schema.json +++ b/modules/prerequisites/values.schema.json @@ -19,6 +19,12 @@ "properties": { "enabled": { "type": "boolean", "default": true } } + }, + "ingress-nginx": { + "type": "object", + "properties": { + "enabled": { "type": "boolean", "default": true } + } } } } diff --git a/modules/prerequisites/values/sandbox.yaml b/modules/prerequisites/values/sandbox.yaml index 38794db..8607e53 100644 --- a/modules/prerequisites/values/sandbox.yaml +++ b/modules/prerequisites/values/sandbox.yaml @@ -53,3 +53,21 @@ secret-generator: capabilities: drop: ["ALL"] +ingress-nginx: + enabled: true + controller: + allowSnippetAnnotations: "false" + extraArgs: + enable-ssl-passthrough: "true" + admissionWebhooks: + enabled: true + service: + # To change type you just need to update here + # type: LoadBlancer + type: NodePort + nodePorts: + http: 30080 + https: 30443 + # annotations: + # metallb.universe.tf/loadBalancerIPs: "192.168.1.50" + From b9c2d24770f98af4ee8b1ae77b4fd13664033e5b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alexis=20MARI=C3=89?= Date: Thu, 4 Jun 2026 18:10:14 +0200 Subject: [PATCH 5/5] refactor(prerequisites): type not secured in the sandbox --- modules/prerequisites/values.schema.json | 6 ------ 1 file changed, 6 deletions(-) diff --git a/modules/prerequisites/values.schema.json b/modules/prerequisites/values.schema.json index 61ec18e..0bfe605 100644 --- a/modules/prerequisites/values.schema.json +++ b/modules/prerequisites/values.schema.json @@ -19,12 +19,6 @@ "properties": { "enabled": { "type": "boolean", "default": true } } - }, - "ingress-nginx": { - "type": "object", - "properties": { - "enabled": { "type": "boolean", "default": true } - } } } }