Refactor code-server templates: Add secret, headless-service, scripts, persistantvolumeclaim, configmap, certificate, and service templates

cluster/code-server/templates/NOTES.txt

@@ -0,0 +1,16 @@
+1. Get the application URL by running these commands:
+{{- if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "code-server.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "code-server.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "code-server.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.ports.http.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "code-server.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}

cluster/code-server/templates/_helpers.tpl

@@ -0,0 +1,102 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "code-server.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "code-server.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "code-server.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "code-server.labels" -}}
+helm.sh/chart: {{ include "code-server.chart" . }}
+{{ include "code-server.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "code-server.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "code-server.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "code-server.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "code-server.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Certificate name
+*/}}
+{{- define "code-server.certificate.name" -}}
+{{- if not (empty .Values.certificate.dnsNames) }}
+{{- first .Values.certificate.dnsNames }}
+{{- else }}
+{{- include "code-server.fullname" . }}
+{{- end }}
+{{- end }}
+
+{{/*
+Certificate secret name
+*/}}
+{{- define "code-server.certificate.secretName" -}}
+{{- if not (empty .Values.certificate.secretName) }}
+{{- .Values.certificate.secretName }}
+{{- else }}
+{{- include "code-server.certificate.name" . }}
+{{- end }}
+{{- end }}
+
+{{/*
+Certificate issuer reference name
+*/}}
+{{- define "code-server.certificate.issuerRefName" -}}
+{{- required "Mandatory field \".certificate.issuerRef.name\" is empty!" .Values.certificate.issuerRef.name -}}
+{{- end }}
+
+{{/*
+IngressRoute TLS secret name
+*/}}
+{{- define "code-server.ingressRoute.tlsSecretName" -}}
+{{- if not (empty .Values.ingressRoute.tlsSecretName) }}
+{{- .Values.ingressRoute.tlsSecretName }}
+{{- else if .Values.certificate.create }}
+{{- include "code-server.certificate.name" . }}
+{{- end }}
+{{- end }}

cluster/code-server/templates/certificate.yaml

@@ -0,0 +1,26 @@
+{{- if and .Values.certificate.create .Values.service.enabled -}}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ include "code-server.certificate.name" . }}
+  labels:
+    {{- include "code-server.labels" . | nindent 4 }}
+    {{- with .Values.certificate.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.certificate.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  secretName: {{ include "code-server.certificate.secretName" . }}
+  {{- with .Values.certificate.dnsNames }}
+  dnsNames:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.certificate.issuerRef }}
+  issuerRef:
+    kind: {{ default "ClusterIssuer" .kind }}
+    name: {{ include "code-server.certificate.issuerRefName" $ }}
+  {{- end }}
+{{- end }}

cluster/code-server/templates/configmap.yaml

@@ -0,0 +1,27 @@
+{{- if and .Values.configMap.create (empty .Values.configMap.existingConfigMap) -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-config" (include "code-server.fullname" .) }}
+  labels:
+    {{- include "code-server.labels" . | nindent 4 }}
+    {{- with .Values.configMap.labels }}
+    {{ toYaml . | indent 4 }}
+    {{- end }}
+  {{- with .Values.configMap.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+data:
+  config.yml: |
+    {{- if or $.Values.secret.create $.Values.secret.existingSecret }}
+    auth: password
+    {{- else }}
+    auth: none
+    {{- end }}
+    {{- range $key, $val := .Values.configMap.config }}
+    {{- if ne $key "auth" }}
+    {{ $key }}: {{ $val }}
+    {{- end }}
+    {{- end }}
+{{- end }}

cluster/code-server/templates/controller.yaml

@@ -0,0 +1,183 @@
+{{- if .Values.controller.enabled -}}
+{{- if empty .Values.persistentVolumeClaim.projectsPath -}}
+  {{- fail "Empty projects path detected in \".Values.persistentVolumeClaim.projectsPath\"!" -}}
+{{- end -}}
+apiVersion: apps/v1
+kind: {{ include "base.controller.kind" . }}
+metadata:
+  name: {{ include "code-server.fullname" . }}
+  labels:
+    {{- include "code-server.labels" . | nindent 4 }}
+    {{- with .Values.controller.labels }}
+    {{ toYaml . | indent 4 }}
+    {{- end }}
+  {{- with .Values.controller.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.controller.replicas }}
+  replicas: {{ .Values.controller.replicas }}
+  {{- end }}
+  {{- if eq (include "base.controller.kind" . ) "StatefulSet" }}
+  serviceName: {{ include "code-server.fullname" . }}-headless
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "code-server.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.controller.annotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "code-server.selectorLabels" . | nindent 8 }}
+    spec:
+      serviceAccountName: {{ include "code-server.serviceAccountName" . }}
+      initContainers:
+        {{- if .Values.persistentVolumeClaim.ensurePermissions }}
+        - name: {{ printf "%s-permissions" (include "code-server.fullname" .) }}
+          image: busybox:latest
+          imagePullPolicy: IfNotPresent
+          command: ['sh', '-c', 'chown -R {{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.runAsGroup }} {{ .Values.persistentVolumeClaim.mountPath }}']
+          {{- if eq (include "base.persistence.enabled" . ) "true" }}
+          volumeMounts:
+            - name: {{ include "base.persistence.suffix" (include "code-server.fullname" . ) }}
+              mountPath: {{ .Values.persistentVolumeClaim.mountPath }}
+          {{- end }}
+          securityContext:
+            runAsNonRoot: false
+            runAsGroup: 0
+            runAsUser: 0
+        {{- end }}
+        {{- if not (empty .Values.repositories) }}
+        - name: {{ printf "%s-repositories" (include "code-server.fullname" $) }}
+          image: alpine/git:latest
+          imagePullPolicy: IfNotPresent
+          workingDir: {{ .Values.persistentVolumeClaim.projectsPath }}
+          command: ['/bin/sh']
+          args: ['/scripts/repo-updater.sh']
+          volumeMounts:
+            - name: script-volume
+              mountPath: /scripts
+            {{- if eq (include "base.persistence.enabled" . ) "true" }}
+            - name: {{ include "base.persistence.suffix" (include "code-server.fullname" . ) }}
+              mountPath: {{ .Values.persistentVolumeClaim.mountPath }}
+            {{- end }}
+        {{- end }}
+      containers:
+        - name: {{ template "code-server.name" . }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            {{- range $key, $val := .Values.ports }}
+            {{- if $val.enabled }}
+            - name: {{ $key | quote }}
+              containerPort: {{ $val.port }}
+              protocol: {{ default "TCP" $val.protocol | quote }}
+            {{- end }}
+            {{- end }}
+          env:
+            {{- range $i, $val := .Values.env }}
+            - name: {{ $val.name | quote }}
+              value: {{ $val.value | quote }}
+            {{- end }}
+            {{- if .Values.ports.http.enabled }}
+            - name: PORT
+              value: {{ .Values.ports.http.port | quote }}
+            {{- end }}
+            {{- if or .Values.secret.create (not (empty .Values.secret.existingSecret)) }}
+            - name: PASSWORD
+              valueFrom:
+                secretKeyRef:
+                {{- if .Values.secret.existingSecret }}
+                  name: {{ .Values.secret.existingSecret }}
+                {{- else }}
+                  name: {{ printf "%s-password" (include "code-server.fullname" .) }}
+                {{- end }}
+                  key: password
+            {{- end }}
+            {{- if .Values.configMap.mountPath }}
+            - name: CODE_SERVER_CONFIG
+              value: {{ (printf "%s/config.yml" .Values.configMap.mountPath) | quote }}
+            {{- end }}
+            {{- if .Values.persistentVolumeClaim.mountPath }}
+            - name: XDG_DATA_HOME
+              value: {{ .Values.persistentVolumeClaim.mountPath | quote }}
+            {{- end }}
+          args: {{ if not .Values.extraArgs -}}[]{{- end }}
+            {{- range $i, $val := .Values.extraArgs }}
+            - {{ $val }}
+            {{- end }}
+          workingDir: {{ .Values.persistentVolumeClaim.projectsPath }}
+          volumeMounts:
+            - name: config-volume
+              mountPath: {{ .Values.configMap.mountPath }}
+            {{- if eq (include "base.persistence.enabled" . ) "true" }}
+            - name: {{ include "base.persistence.suffix" (include "code-server.fullname" . ) }}
+              mountPath: {{ .Values.persistentVolumeClaim.mountPath }}
+            {{- end }}
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+          resources: {{ if not .Values.resources -}}{}{{- end }}
+            {{- if .Values.resources }}
+            {{- toYaml .Values.resources | nindent 12 }}
+            {{- end }}
+      volumes:
+        {{- if not (empty .Values.repositories) }}
+        - name: script-volume
+          configMap:
+            name: {{ printf "%s-scripts" (include "code-server.fullname" . ) }}
+            defaultMode: 0777
+        {{- end }}
+        - name: config-volume
+          configMap:
+            {{- if and .Values.configMap.create (empty .Values.configMap.existingConfigMap) }}
+            name: {{ printf "%s-config" (include "code-server.fullname" . ) }}
+            {{- else }}
+            name: {{ .Values.configMap.existingConfigMap }}
+            {{- end }}
+        {{- if eq (include "base.persistence.enabled" . ) "true" }}
+        {{- if eq (include "base.persistence.type" . ) "volumes" }}
+        - name: {{ include "base.persistence.suffix" (include "code-server.fullname" . ) }}
+          persistentVolumeClaim:
+            {{- if eq (include "base.persistence.created" . ) "true" }}
+            claimName: {{ include "base.persistence.suffix" (include "code-server.fullname" . ) }}
+            {{- else }}
+            claimName: {{ .Values.persistentVolumeClaim.existingPersistentVolumeClaim }}
+            {{- end }}
+        {{- end }}
+        {{- end }}
+      {{- if .Values.securityContext }}
+      securityContext:
+        {{- toYaml .Values.securityContext | nindent 8 }}
+      {{- end }}
+      {{- if .Values.dnsConfig }}
+      dnsConfig:
+        {{- toYaml .Values.dnsConfig | nindent 12 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+  {{- if eq (include "base.persistence.enabled" . ) "true" }}
+  {{- if eq (include "base.persistence.type" . ) "volumeClaimTemplates" }}
+  volumeClaimTemplates:
+    - metadata:
+        name: {{ include "base.persistence.suffix" (include "code-server.fullname" . ) }}
+      spec:
+        {{- include "base.persistence.spec" . | nindent 8 }}
+  {{- end }}
+  {{- end }}
+{{- end }}

cluster/code-server/templates/cronjob.yaml

@@ -0,0 +1,75 @@
+{{- if and .Values.cronJob.enabled (not (empty .Values.repositories)) -}}
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ printf "%s-autoupdate" (include "code-server.fullname" .) }}
+  labels:
+    {{- include "code-server.labels" . | nindent 4 }}
+    {{- with .Values.cronJob.labels }}
+    {{ toYaml . | indent 4 }}
+    {{- end }}
+  {{- with .Values.cronJob.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  schedule: {{ .Values.cronJob.schedule }}
+  suspend: {{ .Values.cronJob.suspend }}
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: {{ .Values.cronJob.successfulJobsHistoryLimit }}
+  failedJobsHistoryLimit: {{ .Values.cronJob.failedJobsHistoryLimit }}
+  jobTemplate:
+    {{- with .Values.cronJob.annotations }}
+    metadata:
+      annotations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    spec:
+      template:
+        spec:
+          restartPolicy: Never
+          containers:
+            - name: {{ printf "%s-repositories" (include "code-server.fullname" $) }}
+              image: alpine/git:latest
+              imagePullPolicy: IfNotPresent
+              workingDir: {{ .Values.persistentVolumeClaim.projectsPath }}
+              command: ['/bin/sh']
+              args: ['/scripts/repo-updater.sh']
+              volumeMounts:
+                - name: script-volume
+                  mountPath: /scripts
+                - name: {{ include "base.persistence.suffix" (include "code-server.fullname" . ) }}
+                  mountPath: {{ .Values.persistentVolumeClaim.mountPath }}
+          volumes:
+            {{- if not (empty .Values.repositories) }}
+            - name: script-volume
+              configMap:
+                name: {{ printf "%s-scripts" (include "code-server.fullname" . ) }}
+                defaultMode: 0777
+            {{- end }}
+            {{- if eq (include "base.persistence.enabled" . ) "true" }}
+            - name: {{ include "base.persistence.suffix" (include "code-server.fullname" . ) }}
+              persistentVolumeClaim:
+                {{- if eq (include "base.persistence.created" . ) "true" }}
+                claimName: {{ include "base.persistence.suffix" (include "code-server.fullname" . ) }}
+                {{- else }}
+                claimName: {{ .Values.persistentVolumeClaim.existingPersistentVolumeClaim }}
+                {{- end }}
+            {{- end }}
+          {{- if .Values.securityContext }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          {{- end }}
+          {{- if .Values.dnsConfig }}
+          dnsConfig:
+            {{- toYaml .Values.dnsConfig | nindent 12 }}
+          {{- end }}
+          {{- with .Values.affinity }}
+          affinity:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.tolerations }}
+          tolerations:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+{{- end -}}

cluster/code-server/templates/headless-service.yaml

@@ -0,0 +1,21 @@
+{{- if eq (include "base.controller.kind" . ) "StatefulSet" -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "code-server.fullname" . }}-headless
+  labels:
+    {{- include "code-server.labels" . | nindent 4 }}
+spec:
+  clusterIP: None
+  ports:
+    {{- range $key, $val := .Values.ports }}
+    {{- if $val.enabled }}
+    - name: {{ $key | quote }}
+      port: {{ $val.port }}
+      targetPort: {{ $key | quote }}
+      protocol: {{ default "TCP" $val.protocol | quote }}
+    {{- end }}
+    {{- end }}
+  selector:
+    {{- include "code-server.selectorLabels" . | nindent 4 }}
+{{- end }}

cluster/code-server/templates/ingressroute.yaml

@@ -0,0 +1,36 @@
+{{- if and .Values.ingressRoute.create .Values.service.enabled -}}
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: {{ printf "%s-route" (include "code-server.fullname" . ) }}
+  labels:
+    {{- include "code-server.labels" . | nindent 4 }}
+    {{- with .Values.ingressRoute.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.ingressRoute.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.ingressRoute.entryPoints }}
+  entryPoints:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  routes:
+    - kind: Rule
+      match: {{ required "Mandatory field \".ingressRoute.rule\" is empty!" .Values.ingressRoute.rule }}
+      services:
+        - kind: Service
+          name: {{ include "code-server.fullname" . }}
+          namespace: {{ .Release.Namespace }}
+          port: {{ .Values.ports.http.port }}
+      {{- with .Values.ingressRoute.middlewares }}
+      middlewares:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+  {{- with (include "code-server.ingressRoute.tlsSecretName" .) }}
+  tls:
+    secretName: {{ . }}
+  {{- end }}
+{{- end }}

cluster/code-server/templates/persistantvolumeclaim.yaml

@@ -0,0 +1,19 @@
+{{- if eq (include "base.persistence.enabled" . ) "true" -}}
+{{- if eq (include "base.persistence.type" . ) "volumes" -}}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ printf "%s-storage" (include "code-server.fullname" .) }}
+  labels:
+    {{- include "code-server.labels" . | nindent 4 }}
+    {{- with .Values.persistentVolumeClaim.labels }}
+    {{ toYaml . | indent 4 }}
+    {{- end }}
+  {{- with .Values.persistentVolumeClaim.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- include "base.persistence.spec" .  | nindent 2 }}
+{{- end }}
+{{- end }}

cluster/code-server/templates/scripts.yaml

@@ -0,0 +1,26 @@
+{{- if not (empty .Values.repositories) -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-scripts" (include "code-server.fullname" .) }}
+  labels:
+    {{- include "code-server.labels" . | nindent 4 }}
+data:
+  repo-updater.sh: |
+    #!/bin/sh
+
+    # update the given repository
+    update() {
+        if [ ! -d "$1/.git" ]
+        then
+            git clone "$2" "$1"
+        else
+            cd "$1" && git fetch && git pull "$2"
+        fi
+    }
+
+    # list of repositories to update
+    {{- range $i, $repo := .Values.repositories }}
+    update "{{ $repo.name }}" "{{ $repo.url }}"
+    {{- end }}
+{{- end }}

cluster/code-server/templates/secret.yaml

@@ -0,0 +1,18 @@
+{{- if and .Values.secret.create (empty .Values.secret.existingSecret) -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ printf "%s-password" (include "code-server.fullname" .) }}
+  labels:
+    {{- include "code-server.labels" . | nindent 4 }}
+    {{- with .Values.secret.labels }}
+    {{ toYaml . | indent 4 }}
+    {{- end }}
+  {{- with .Values.secret.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+type: Opaque
+data:
+  password: {{ required "Mandatory field \".secret.password\" is empty!" .Values.secret.password | b64enc }}
+{{- end -}}

cluster/code-server/templates/service.yaml

@@ -0,0 +1,31 @@
+{{- if .Values.service.enabled -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "code-server.fullname" . }}
+  labels:
+    {{- include "code-server.labels" . | nindent 4 }}
+    {{- with .Values.service.labels }}
+    {{ toYaml . | indent 4 }}
+    {{- end }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    {{- range $key, $val := .Values.ports }}
+    {{- if $val.enabled }}
+    - name: {{ $key | quote }}
+      port: {{ $val.port }}
+      targetPort: {{ $key | quote }}
+      {{- if and (eq $.Values.service.type "NodePort") $val.nodePort }}
+      nodePort: {{ $val.nodePort }}
+      {{- end }}
+      protocol: {{ default "TCP" $val.protocol | quote }}
+    {{- end }}
+    {{- end }}
+  selector:
+    {{- include "code-server.selectorLabels" . | nindent 4 }}
+{{- end }}