Merge pull request #1 from appuio/initial-implementation

Initial implementation
appuio · Oct 30, 2024 · 14ac47a · 14ac47a
2 parents 163f532 + ee760ff
commit 14ac47a
Show file tree

Hide file tree

Showing 9 changed files with 718 additions and 3 deletions.
diff --git a/class/defaults.yml b/class/defaults.yml
@@ -1,4 +1,55 @@
 parameters:
   machine_api_provider_cloudscale:
     =_metadata: {}
-    namespace: syn-machine-api-provider-cloudscale
+    namespace: openshift-machine-api
+
+    secrets: {}
+
+    images:
+      provider:
+        registry: ghcr.io
+        image: appuio/machine-api-provider-cloudscale
+        tag: v0.2.1
+      machine_api_controllers_manager:
+        registry: ghcr.io
+        image: appuio/machine-api-provider-cloudscale
+        tag: v0.2.1
+      kube_rbac_proxy:
+        registry: gcr.io
+        image: kubebuilder/kube-rbac-proxy
+        tag: v0.16.0
+
+    resources:
+      provider:
+        requests:
+          cpu: '10m'
+          memory: '32Mi'
+        limits:
+          cpu: '100m'
+          memory: '128Mi'
+
+      machine_api_controllers_manager:
+        requests:
+          cpu: '10m'
+          memory: '32Mi'
+        limits:
+          cpu: '100m'
+          memory: '64Mi'
+
+    alerts:
+      MachinesetEndpointNotFound:
+        enabled: true
+        rule:
+          expr: |
+            count(up{namespace="openshift-machine-api",endpoint=~"machineset.+"}) < 1
+          for: 15m
+          labels:
+            severity: warning
+          annotations:
+            summary: Expected machineset target not found. Autoscaling and other machine operations might be impacted.
+            description: |
+              No machineset-controller target was found. This can impact machine operations such as autoscaling.
+
+              The machineset controller is deployed by the 'machine-api-controllers-manager' container in the 'appuio-machine-api-provider-cloudscale' deployment.
+              Check for the existence of the 'appuio-machine-api-controllers' deployment and check the logs of the above manager if it does not exist.
+              If the deployment exists, check the deployment and replicaset status and events to check why the pod can't be created.
diff --git a/component/main.jsonnet b/component/main.jsonnet
@@ -1,10 +1,242 @@
 // main template for machine-api-provider-cloudscale
+local com = import 'lib/commodore.libjsonnet';
 local kap = import 'lib/kapitan.libjsonnet';
 local kube = import 'lib/kube.libjsonnet';
 local inv = kap.inventory();
 // The hiera parameters for the component
 local params = inv.parameters.machine_api_provider_cloudscale;
 
+local commonLabels = {
+  'app.kubernetes.io/name': 'machine-api-provider',
+  'app.kubernetes.io/instance': 'machine-api-provider-cloudscale',
+  'app.kubernetes.io/part-of': 'syn',
+  'app.kubernetes.io/managed-by': 'commodore',
+};
+
+local secrets = com.generateResources(
+  params.secrets,
+  function(name) kube.Secret(name) {
+    metadata+: {
+      namespace: params.namespace,
+      labels+: commonLabels,
+    },
+  }
+);
+
+local alertlabels = {
+  syn: 'true',
+  syn_component: 'machine-api-provider-cloudscale',
+};
+
+local alerts = function(name, groupName, alerts)
+  com.namespaced(params.namespace, kube._Object('monitoring.coreos.com/v1', 'PrometheusRule', name) {
+    spec+: {
+      groups+: [
+        {
+          name: groupName,
+          rules:
+            std.sort(std.filterMap(
+              function(field) alerts[field].enabled == true,
+              function(field) alerts[field].rule {
+                alert: field,
+                labels+: alertlabels,
+              },
+              std.objectFields(alerts)
+            ), function(x) x.alert),
+        },
+      ],
+    },
+  });
+
+local serviceAccount = kube.ServiceAccount('appuio-machine-api-provider-cloudscale') {
+  metadata+: {
+    namespace: params.namespace,
+    labels+: commonLabels,
+  },
+};
+
+local clusterRoleBinding = kube.ClusterRoleBinding('appuio-machine-api-provider-cloudscale') {
+  metadata+: { labels+: commonLabels },
+  subjects_: [ serviceAccount ],
+  roleRef: {
+    apiGroup: 'rbac.authorization.k8s.io',
+    kind: 'ClusterRole',
+    name: 'cluster-admin',
+  },
+};
+
+local kubeProxyContainer = function(upstreamPort, portName, exposePort) {
+  args: [
+    '--secure-listen-address=0.0.0.0:%s' % exposePort,
+    '--upstream=http://localhost:%s' % upstreamPort,
+    '--logtostderr=true',
+    '--v=0',
+  ],
+  image: '%(registry)s/%(image)s:%(tag)s' % params.images.kube_rbac_proxy,
+  imagePullPolicy: 'IfNotPresent',
+  name: 'kube-rbac-proxy-%s' % portName,
+  ports: [
+    {
+      containerPort: exposePort,
+      name: portName,
+      protocol: 'TCP',
+    },
+  ],
+  resources: {
+    requests: {
+      cpu: '10m',
+      memory: '20Mi',
+    },
+  },
+  terminationMessagePath: '/dev/termination-log',
+  terminationMessagePolicy: 'File',
+};
+
+local deployment = kube._Object('apps/v1', 'Deployment', 'appuio-machine-api-provider-cloudscale') {
+  metadata+: {
+    namespace: params.namespace,
+    annotations+: {},
+    labels+: commonLabels,
+  },
+  spec: {
+    progressDeadlineSeconds: 600,
+    replicas: 1,
+    revisionHistoryLimit: 10,
+    selector: {
+      matchLabels: {
+        'app.kubernetes.io/name': commonLabels['app.kubernetes.io/name'],
+        'app.kubernetes.io/instance': commonLabels['app.kubernetes.io/instance'],
+      },
+    },
+    template: {
+      metadata: {
+        annotations: {
+          'target.workload.openshift.io/management': '{"effect": "PreferredDuringScheduling"}',
+        },
+        labels: {
+          'app.kubernetes.io/name': commonLabels['app.kubernetes.io/name'],
+          'app.kubernetes.io/instance': commonLabels['app.kubernetes.io/instance'],
+        },
+      },
+      spec: {
+        containers: [
+          {
+            name: 'manager',
+            command: [
+              'machine-api-provider-cloudscale',
+              '-target=manager',
+            ],
+            args: [
+              '-metrics-bind-address=127.0.0.1:8080',
+              '-health-probe-bind-address=:8081',
+              '-leader-elect=true',
+              '-namespace=%s' % params.namespace,
+            ],
+            image: '%(registry)s/%(image)s:%(tag)s' % params.images.provider,
+            imagePullPolicy: 'IfNotPresent',
+            livenessProbe: {
+              httpGet: {
+                path: '/readyz',
+                port: 8081,
+                scheme: 'HTTP',
+              },
+              periodSeconds: 20,
+              initialDelaySeconds: 15,
+            },
+            readinessProbe: {
+              httpGet: {
+                path: '/healthz',
+                port: 8081,
+                scheme: 'HTTP',
+              },
+              periodSeconds: 10,
+              initialDelaySeconds: 5,
+            },
+            resources: params.resources.provider,
+          },
+          {
+            name: 'machine-api-controllers-manager',
+            command: [
+              'machine-api-provider-cloudscale',
+              '-target=machine-api-controllers-manager',
+            ],
+            args: [
+              '-metrics-bind-address=127.0.0.1:8082',
+              '-health-probe-bind-address=:8083',
+              '-leader-elect=true',
+              '-namespace=%s' % params.namespace,
+            ],
+            image: '%(registry)s/%(image)s:%(tag)s' % params.images.machine_api_controllers_manager,
+            imagePullPolicy: 'IfNotPresent',
+            livenessProbe: {
+              httpGet: {
+                path: '/readyz',
+                port: 8083,
+                scheme: 'HTTP',
+              },
+              periodSeconds: 20,
+              initialDelaySeconds: 15,
+            },
+            readinessProbe: {
+              httpGet: {
+                path: '/healthz',
+                port: 8083,
+                scheme: 'HTTP',
+              },
+              periodSeconds: 10,
+              initialDelaySeconds: 5,
+            },
+            resources: params.resources.machine_api_controllers_manager,
+          },
+          kubeProxyContainer(8080, 'manager-metrics', 8440),
+          kubeProxyContainer(8082, 'mac-metrics', 8442),
+        ],
+        dnsPolicy: 'ClusterFirst',
+        nodeSelector: {
+          'node-role.kubernetes.io/master': '',
+        },
+        priorityClassName: 'system-node-critical',
+        restartPolicy: 'Always',
+        schedulerName: 'default-scheduler',
+        securityContext: {},
+        serviceAccount: serviceAccount.metadata.name,
+        serviceAccountName: serviceAccount.metadata.name,
+        terminationGracePeriodSeconds: 30,
+        tolerations: [
+          {
+            effect: 'NoSchedule',
+            key: 'node-role.kubernetes.io/master',
+          },
+          {
+            key: 'CriticalAddonsOnly',
+            operator: 'Exists',
+          },
+          {
+            effect: 'NoExecute',
+            key: 'node.kubernetes.io/not-ready',
+            operator: 'Exists',
+            tolerationSeconds: 120,
+          },
+          {
+            effect: 'NoExecute',
+            key: 'node.kubernetes.io/unreachable',
+            operator: 'Exists',
+            tolerationSeconds: 120,
+          },
+        ],
+      },
+    },
+  },
+};
+
+
 // Define outputs below
 {
+  '00_secrets': secrets,
+
+  '10_serviceAccount': serviceAccount,
+  '10_clusterRoleBinding': clusterRoleBinding,
+  '11_deployment': deployment,
+
+  '20_alerts': alerts('appuio-machine-api-provider-cloudscale', 'provider.alerts', params.alerts),
 }