blob: 1b42597af6e59856320e72d8f51718be81885b64 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
|
apiVersion: template.openshift.io/v1
kind: Template
metadata:
name: template-service-broker-apiserver
parameters:
- name: IMAGE
value: openshift/origin:latest
- name: NAMESPACE
value: openshift-template-service-broker
- name: LOGLEVEL
value: "0"
- name: API_SERVER_CONFIG
value: |
kind: TemplateServiceBrokerConfig
apiVersion: config.templateservicebroker.openshift.io/v1
templateNamespaces:
- openshift
objects:
# to create the tsb server
- apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
namespace: ${NAMESPACE}
name: apiserver
labels:
apiserver: "true"
spec:
template:
metadata:
name: apiserver
labels:
apiserver: "true"
spec:
serviceAccountName: apiserver
containers:
- name: c
image: ${IMAGE}
imagePullPolicy: IfNotPresent
command:
- "/usr/bin/openshift"
- "start"
- "template-service-broker"
- "--secure-port=8443"
- "--audit-log-path=-"
- "--tls-cert-file=/var/serving-cert/tls.crt"
- "--tls-private-key-file=/var/serving-cert/tls.key"
- "--loglevel=${LOGLEVEL}"
- "--config=/var/apiserver-config/apiserver-config.yaml"
ports:
- containerPort: 8443
volumeMounts:
- mountPath: /var/serving-cert
name: serving-cert
- mountPath: /var/apiserver-config
name: apiserver-config
readinessProbe:
httpGet:
path: /healthz
port: 8443
scheme: HTTPS
volumes:
- name: serving-cert
secret:
defaultMode: 420
secretName: apiserver-serving-cert
- name: apiserver-config
configMap:
defaultMode: 420
name: apiserver-config
# to create the config for the TSB
- apiVersion: v1
kind: ConfigMap
metadata:
namespace: ${NAMESPACE}
name: apiserver-config
data:
apiserver-config.yaml: ${API_SERVER_CONFIG}
# to be able to assign powers to the process
- apiVersion: v1
kind: ServiceAccount
metadata:
namespace: ${NAMESPACE}
name: apiserver
# to be able to expose TSB inside the cluster
- apiVersion: v1
kind: Service
metadata:
namespace: ${NAMESPACE}
name: apiserver
annotations:
service.alpha.openshift.io/serving-cert-secret-name: apiserver-serving-cert
spec:
selector:
apiserver: "true"
ports:
- port: 443
targetPort: 8443
# This service account will be granted permission to call the TSB.
# The token for this SA will be provided to the service catalog for
# use when calling the TSB.
- apiVersion: v1
kind: ServiceAccount
metadata:
namespace: ${NAMESPACE}
name: templateservicebroker-client
# This secret will be populated with a copy of the templateservicebroker-client SA's
# auth token. Since this secret has a static name, it can be referenced more
# easily than the auto-generated secret for the service account.
- apiVersion: v1
kind: Secret
metadata:
namespace: ${NAMESPACE}
name: templateservicebroker-client
annotations:
kubernetes.io/service-account.name: templateservicebroker-client
type: kubernetes.io/service-account-token
|
