Skip to content

Commit 59ddf63

Browse files
Hunter-ThompsonHunter-Thompson
committed
fix: container image location
bitnami-labs/sealed-secrets#822
1 parent 2bef35e commit 59ddf63

File tree

2 files changed

+54
-63
lines changed

2 files changed

+54
-63
lines changed

‎API.md

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -119,10 +119,10 @@ public readonly command: string[];
119119
##### `env`<sup>Optional</sup> <a name="@opencdk8s/cdk8s-sealed-secrets-controller.SealedSecretsControllerOptions.property.env"></a>
120120

121121
```typescript
122-
public readonly env: string[];
122+
public readonly env: EnvVar[];
123123
```
124124

125-
- *Type:* `string`[]
125+
- *Type:* [`@opencdk8s/cdk8s-sealed-secrets-controller.k8s.EnvVar`](#@opencdk8s/cdk8s-sealed-secrets-controller.k8s.EnvVar)[]
126126

127127
---
128128

@@ -136,6 +136,16 @@ public readonly image: string;
136136

137137
---
138138

139+
##### `labels`<sup>Optional</sup> <a name="@opencdk8s/cdk8s-sealed-secrets-controller.SealedSecretsControllerOptions.property.labels"></a>
140+
141+
```typescript
142+
public readonly labels: {[ key: string ]: string};
143+
```
144+
145+
- *Type:* {[ key: string ]: `string`}
146+
147+
---
148+
139149
##### `minReadySeconds`<sup>Optional</sup> <a name="@opencdk8s/cdk8s-sealed-secrets-controller.SealedSecretsControllerOptions.property.minReadySeconds"></a>
140150

141151
```typescript
@@ -176,23 +186,23 @@ public readonly replicas: number;
176186

177187
---
178188

179-
##### `runAsNonRoot`<sup>Optional</sup> <a name="@opencdk8s/cdk8s-sealed-secrets-controller.SealedSecretsControllerOptions.property.runAsNonRoot"></a>
189+
##### `resources`<sup>Optional</sup> <a name="@opencdk8s/cdk8s-sealed-secrets-controller.SealedSecretsControllerOptions.property.resources"></a>
180190

181191
```typescript
182-
public readonly runAsNonRoot: boolean;
192+
public readonly resources: ResourceRequirements;
183193
```
184194

185-
- *Type:* `boolean`
195+
- *Type:* [`@opencdk8s/cdk8s-sealed-secrets-controller.k8s.ResourceRequirements`](#@opencdk8s/cdk8s-sealed-secrets-controller.k8s.ResourceRequirements)
186196

187197
---
188198

189-
##### `selector`<sup>Optional</sup> <a name="@opencdk8s/cdk8s-sealed-secrets-controller.SealedSecretsControllerOptions.property.selector"></a>
199+
##### `runAsNonRoot`<sup>Optional</sup> <a name="@opencdk8s/cdk8s-sealed-secrets-controller.SealedSecretsControllerOptions.property.runAsNonRoot"></a>
190200

191201
```typescript
192-
public readonly selector: string;
202+
public readonly runAsNonRoot: boolean;
193203
```
194204

195-
- *Type:* `string`
205+
- *Type:* `boolean`
196206

197207
---
198208

‎src/index.ts

Lines changed: 36 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
import { ApiObject } from 'cdk8s';
22
import { Construct } from 'constructs';
33
export * as k8s from './imports/k8s';
4+
import * as k8s from './imports/k8s';
45

56
export class ControllerStrategy {
67
readonly type?: string;
@@ -14,12 +15,13 @@ export class SealedSecretsControllerOptions {
1415
readonly strategy?: ControllerStrategy;
1516
readonly args?: string[];
1617
readonly command?: string[];
17-
readonly env?: string[];
18+
readonly env?: k8s.EnvVar[];
1819
readonly image?: string;
1920
readonly runAsNonRoot?: boolean;
2021
readonly minReadySeconds?: number;
2122
readonly replicas?: number;
22-
readonly selector?: string;
23+
readonly labels?: { [key: string]: string };
24+
readonly resources?: k8s.ResourceRequirements;
2325
}
2426

2527
export class SealedSecretsTemplate extends Construct {
@@ -28,11 +30,13 @@ export class SealedSecretsTemplate extends Construct {
2830
private namespace: string;
2931
private args: string[];
3032
private command: string[];
31-
private env: string[];
33+
private env: k8s.EnvVar[];
3234
private image: string;
3335
private runAsNonRoot: boolean;
3436
private minReadySeconds: number;
3537
private replicas: number;
38+
private labels?: { [key: string]: string };
39+
private resources?: k8s.ResourceRequirements;
3640

3741
constructor(scope: Construct, id: string, options: SealedSecretsControllerOptions) {
3842
super(scope, id);
@@ -42,78 +46,71 @@ export class SealedSecretsTemplate extends Construct {
4246
this.args = [];
4347
this.command = options.command ?? ['controller'];
4448
this.env = [];
45-
this.image = options.image ?? 'quay.io/bitnami/sealed-secrets-controller:v0.9.8';
49+
this.image = options.image ?? 'bitnami/sealed-secrets-controller:v0.9.8';
4650
this.runAsNonRoot = options.runAsNonRoot ?? true;
4751
this.minReadySeconds = options.minReadySeconds ?? 30;
4852
this.replicas = options.replicas ?? 1;
53+
this.labels = options.labels ?? {
54+
name: this.name,
55+
};
56+
this.resources = options.resources ?? {
57+
limits: {
58+
cpu: 2,
59+
memory: '2Gi',
60+
},
61+
requests: {
62+
cpu: '1',
63+
memory: '1Gi',
64+
},
65+
};
4966

5067
// ServiceAccount
5168
new ApiObject(this, 'sealed-secrets-service-account', {
5269
apiVersion: 'v1',
5370
kind: 'ServiceAccount',
5471
metadata: {
55-
annotations: {},
56-
labels: {
57-
name: this.name,
58-
},
72+
labels: this.labels,
5973
name: this.name,
6074
namespace: this.namespace,
6175
},
6276
});
6377

6478
// Deployment
65-
new ApiObject(this, 'sealed-secrets-controller', {
66-
apiVersion: 'apps/v1',
67-
kind: 'Deployment',
79+
new k8s.KubeDeployment(this, 'sealed-secrets-controller', {
6880
metadata: {
69-
annotations: {},
70-
labels: {
71-
name: this.name,
72-
},
81+
labels: this.labels,
7382
name: this.name,
7483
namespace: this.namespace,
7584
},
7685
spec: {
7786
minReadySeconds: this.minReadySeconds ?? 30,
7887
replicas: this.replicas ?? 1,
7988
revisionHistoryLimit: 10,
80-
... options.selector ? {
81-
selector: {
82-
matchLabels: {
83-
name: options.selector,
84-
},
85-
},
86-
}:{
87-
selector: {
88-
matchLabels: {
89-
name: options.name,
90-
},
91-
},
89+
selector: {
90+
matchLabels: this.labels,
9291
},
9392
strategy: {
9493
... this.getStrategy(),
9594
},
9695
template: {
9796
metadata: {
98-
annotations: {},
99-
labels: {
100-
name: this.name,
101-
},
97+
labels: this.labels,
10298
},
10399
spec: {
104100
containers: [
105101
{
106-
args: this.args ?? [],
107-
command: this.command ?? ['controller'],
108-
env: this.env ?? [],
109-
image: this.image ?? 'quay.io/bitnami/sealed-secrets-controller:v0.9.8',
102+
args: this.args,
103+
command: this.command,
104+
env: this.env,
105+
image: this.image,
110106
imagePullPolicy: 'Always',
111107
livenessProbe: {
112108
httpGet: {
113109
path: '/healthz',
114110
port: 'http',
115111
},
116112
},
113+
resources: this.resources,
117114
name: this.name,
118115
ports: [
119116
{
@@ -142,8 +139,6 @@ export class SealedSecretsTemplate extends Construct {
142139
],
143140
},
144141
],
145-
initContainers: [],
146-
imagePullSecrets: [],
147142
securityContext: {
148143
fsGroup: 65534,
149144
},
@@ -165,10 +160,7 @@ export class SealedSecretsTemplate extends Construct {
165160
apiVersion: 'v1',
166161
kind: 'Service',
167162
metadata: {
168-
annotations: {},
169-
labels: {
170-
name: this.name,
171-
},
163+
labels: this.labels,
172164
name: this.name,
173165
namespace: this.namespace,
174166
},
@@ -179,9 +171,7 @@ export class SealedSecretsTemplate extends Construct {
179171
targetPort: 8080,
180172
},
181173
],
182-
selector: {
183-
name: this.name,
184-
},
174+
selector: this.labels,
185175
type: 'ClusterIP',
186176
},
187177
});
@@ -191,7 +181,6 @@ export class SealedSecretsTemplate extends Construct {
191181
apiVersion: 'rbac.authorization.k8s.io/v1beta1',
192182
kind: 'Role',
193183
metadata: {
194-
annotations: {},
195184
labels: {
196185
name: 'sealed-secrets-service-proxier',
197186
},
@@ -223,7 +212,6 @@ export class SealedSecretsTemplate extends Construct {
223212
apiVersion: 'rbac.authorization.k8s.io/v1beta1',
224213
kind: 'ClusterRole',
225214
metadata: {
226-
annotations: {},
227215
labels: {
228216
name: 'sealed-secrets-key-admin',
229217
},
@@ -251,7 +239,6 @@ export class SealedSecretsTemplate extends Construct {
251239
apiVersion: 'rbac.authorization.k8s.io/v1beta1',
252240
kind: 'ClusterRole',
253241
metadata: {
254-
annotations: {},
255242
labels: {
256243
name: 'secrets-unsealer',
257244
},
@@ -326,7 +313,6 @@ export class SealedSecretsTemplate extends Construct {
326313
apiVersion: 'rbac.authorization.k8s.io/v1beta1',
327314
kind: 'RoleBinding',
328315
metadata: {
329-
annotations: {},
330316
labels: {
331317
name: 'sealed-secrets-service-proxier',
332318
},
@@ -353,10 +339,7 @@ export class SealedSecretsTemplate extends Construct {
353339
apiVersion: 'rbac.authorization.k8s.io/v1beta1',
354340
kind: 'RoleBinding',
355341
metadata: {
356-
annotations: {},
357-
labels: {
358-
name: this.name,
359-
},
342+
labels: this.labels,
360343
name: this.name,
361344
namespace: this.namespace,
362345
},
@@ -379,7 +362,6 @@ export class SealedSecretsTemplate extends Construct {
379362
apiVersion: 'rbac.authorization.k8s.io/v1beta1',
380363
kind: 'ClusterRoleBinding',
381364
metadata: {
382-
annotations: {},
383365
labels: {
384366
name: this.name + '-key-admin',
385367
},
@@ -405,7 +387,6 @@ export class SealedSecretsTemplate extends Construct {
405387
apiVersion: 'rbac.authorization.k8s.io/v1beta1',
406388
kind: 'ClusterRoleBinding',
407389
metadata: {
408-
annotations: {},
409390
labels: {
410391
name: this.name + '-unsealer',
411392
},
@@ -436,4 +417,4 @@ export class SealedSecretsTemplate extends Construct {
436417
type: 'RollingUpdate',
437418
};
438419
}
439-
}
420+
}

0 commit comments

Comments
 (0)