buttahtoast · Oct 30, 2023 · Oct 31, 2023 · Oct 31, 2023 · Nov 6, 2023 · Nov 6, 2023
diff --git a/.github/configs/ct.yaml b/.github/configs/ct.yaml
@@ -3,7 +3,7 @@
 remote: origin
 target-branch: main
 chart-dirs:
-  - helm/
+  - charts/
 chart-repos:
   - buttahtoast=https://buttahtoast.github.io/helm-charts/
   - bitnami=https://charts.bitnami.com/bitnami

diff --git a/.github/workflow/release.yml b/.github/workflow/release.yml
diff --git a/.github/workflows/check-actions.yaml b/.github/workflows/check-actions.yaml
@@ -13,9 +13,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Ensure SHA pinned actions
-        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@f32435541e24cd6a4700a7f52bb2ec59e80603b1 # v2.1.4
+        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@b1b635d24259e8a047a6ce7d6501ea432aa7a830 # v3.0.2
         with:
           # slsa-github-generator requires using a semver tag for reusable workflows. 
           # See: https://github.com/slsa-framework/slsa-github-generator#referencing-slsa-builders-and-generators

diff --git a/.github/workflows/check-commit.yml b/.github/workflows/check-commit.yml
@@ -15,9 +15,9 @@ jobs:
   commit_lint:
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
-      - uses: wagoid/commitlint-github-action@6319f54d83768b60acd6fd60e61007ccc583e62f #v5.4.3
+      - uses: wagoid/commitlint-github-action@0d749a1a91d4770e983a7b8f83d4a3f0e7e0874e #v5.4.4
         with:
           firstParent: true
diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml
@@ -14,13 +14,14 @@ jobs:
   integration-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Check secret
         id: checksecret
-        uses: oliverbaehler/github-actions/exists@8dfd42735c85f6c58d5d4d6f3232cd0e39d1fe73 # v0.1.0
+        uses: peak-scale/github-actions/exists@38322faabccd75abfa581c435e367d446b6d2c3b # v0.1.0
         with:
           value: ${{ secrets.CODECOV_TOKEN }}
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version: '1.19'
       - name: Run integration tests

diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
@@ -17,7 +17,7 @@ jobs:
       container-digest: ${{ steps.publish.outputs.digest }}
     steps:
       - name: Checkout
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: "Extract Version"
         id: extract_version
         run: |
@@ -26,7 +26,7 @@ jobs:
           echo "Extracted version: $VERSION"
           echo "version=$VERSION" >> $GITHUB_OUTPUT
       - name: Run Trivy vulnerability (Repo)
-        uses: aquasecurity/trivy-action@fbd16365eb88e12433951383f5e99bd901fc618f # v0.12.0
+        uses: aquasecurity/trivy-action@22d2755f774d925b191a185b74e782a4b0638a41 # v0.15.0
         with:
           scan-type: 'fs'
           ignore-unfixed: true
@@ -37,7 +37,7 @@ jobs:
         uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2
       - name: Publish with KO
         id: publish
-        uses: oliverbaehler/github-actions/ko-publish-image@8dfd42735c85f6c58d5d4d6f3232cd0e39d1fe73 # v0.1.0
+        uses: peak-scale/github-actions/make-ko-publish@38322faabccd75abfa581c435e367d446b6d2c3b # v0.1.0
         with:
           makefile-target: ko-publish-all
           registry: ghcr.io

diff --git a/.github/workflows/helm-publish.yml b/.github/workflows/helm-publish.yml
@@ -14,7 +14,7 @@ jobs:
     outputs:
       chart-digest: ${{ steps.helm_publish.outputs.digest }}
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2
       - name: "Extract Version"
         id: extract_version
@@ -24,12 +24,12 @@ jobs:
           echo "version=$(echo $VERSION)" >> $GITHUB_OUTPUT
       - name: Helm | Publish
         id: helm_publish
-        uses: oliverbaehler/github-actions/helm-oci-chart@dev
+        uses: peak-scale/github-actions/helm-oci-chart@38322faabccd75abfa581c435e367d446b6d2c3b # v0.1.0
         with:
           registry: ghcr.io
           repository: ${{ github.repository_owner }}/charts
           name: "svc-ingress-propagator"
-          path: "./helm"
+          path: "./charts/svc-ingress-propagator/"
           app-version: ${{ steps.extract_version.outputs.version }}
           version: ${{ steps.extract_version.outputs.version }}
           registry-username: ${{ github.actor }}

diff --git a/.github/workflows/helm-test.yml b/.github/workflows/helm-test.yml
@@ -11,13 +11,13 @@ jobs:
   lint:
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
       - uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3
       - name: Setup Chart Linting
         id: lint
-        uses: helm/chart-testing-action@e8788873172cb653a90ca2e819d79d65a66d4e76 # v2.4.0
+        uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
       - name: Run chart-testing (list-changed)
         id: list-changed
         run: |

diff --git a/.github/workflows/releaser.yml b/.github/workflows/releaser.yml
@@ -18,9 +18,9 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - uses: creekorful/goreportcard-action@1f35ced8cdac2cba28c9a2f2288a16aacfd507f9 # v1.0
-      - uses: anchore/sbom-action/download-syft@78fc58e266e87a38d4194b2137a3d4e9bcaf7ca1
+      - uses: anchore/sbom-action/download-syft@5ecf649a417b8ae17dc8383dc32d46c03f2312df
       - name: Install Cosign
         uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2
       - name: Run GoReleaser

diff --git a/Makefile b/Makefile
@@ -16,6 +16,23 @@ IMG             ?= $(IMG_BASE):$(VERSION)
 FULL_IMG        ?= $(REGISTRY)/$(IMG_BASE)
 
 
+####################
+# -- Docker
+####################
+
+KOCACHE         ?= /tmp/ko-cache
+KO_TAGS         ?= "latest"
+ifdef VERSION
+KO_TAGS         := $(KO_TAGS),$(VERSION)
+endif
+
+LD_FLAGS        := "-X main.Version=$(VERSION) \
+					-X main.GitCommit=$(GIT_HEAD_COMMIT) \
+					-X main.GitTag=$(VERSION) \
+					-X main.GitTreeState=$(GIT_MODIFIED) \
+					-X main.BuildDate=$(BUILD_DATE) \
+					-X main.GitRepo=$(GIT_REPO)"
+
 # Docker Image Build
 # ------------------
 
@@ -47,6 +64,40 @@ ko-publish-controller: ko-login
 .PHONY: ko-publish-all
 ko-publish-all: ko-publish-controller
 
+####################
+# -- Helm
+####################
+
+# Helm
+SRC_ROOT = $(shell git rev-parse --show-toplevel)
+
+helm-controller-version:
+	$(eval VERSION := $(shell grep 'appVersion:' helm/Chart.yaml | awk '{print "v"$$2}'))
+	$(eval KO_TAGS := $(shell grep 'appVersion:' helm/Chart.yaml | awk '{print "v"$$2}'))
+
+helm-docs: HELMDOCS_VERSION := v1.11.0
+helm-docs: docker
+	@docker run -v "$(SRC_ROOT):/helm-docs" jnorwood/helm-docs:$(HELMDOCS_VERSION) --chart-search-root /helm-docs
+
+helm-lint: CT_VERSION := v3.3.1
+helm-lint: docker
+	@docker run -v "$(SRC_ROOT):/workdir" --entrypoint /bin/sh quay.io/helmpack/chart-testing:$(CT_VERSION) -c "cd /workdir; ct lint --config .github/configs/ct.yaml  --lint-conf .github/configs/lintconf.yaml  --all --debug"
+
+helm-test: helm-controller-version kind ct ko-build-all
+	@kind create cluster --wait=60s --name ct-helm-svc-ingress-propagator
+	@kind load docker-image --name ct-helm-svc-ingress-propagator $(FULL_IMG):$(VERSION)
+	@ct install --config $(SRC_ROOT)/.github/configs/ct.yaml --all --debug
+	@kind delete cluster --name ct-helm-svc-ingress-propagator
+
+docker:
+	@hash docker 2>/dev/null || {\
+		echo "You need docker" &&\
+		exit 1;\
+	}
+
+####################
+# -- Tools
+####################
 
 KO = $(shell pwd)/bin/ko
 KO_VERSION = v0.14.1

diff --git a/helm/.helmignore → charts/svc-ingress-propagator/.helmignore b/helm/.helmignore → charts/svc-ingress-propagator/.helmignore
diff --git a/helm/Chart.yaml → charts/svc-ingress-propagator/Chart.yaml b/helm/Chart.yaml → charts/svc-ingress-propagator/Chart.yaml
diff --git a/charts/svc-ingress-propagator/README.md b/charts/svc-ingress-propagator/README.md
@@ -0,0 +1,49 @@
+# svc-ingress-propagator
+
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.16.0](https://img.shields.io/badge/AppVersion-1.16.0-informational?style=flat-square)
+
+Ingress Propagation Controller
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| affinity | object | `{}` |  |
+| autoscaling.enabled | bool | `false` |  |
+| autoscaling.maxReplicas | int | `100` |  |
+| autoscaling.minReplicas | int | `1` |  |
+| autoscaling.targetCPUUtilizationPercentage | int | `80` |  |
+| fullnameOverride | string | `""` |  |
+| identifier | string | `""` | instance identifier (Defaults to release name) |
+| image.pullPolicy | string | `"IfNotPresent"` |  |
+| image.registry | string | `"ghcr.io"` |  |
+| image.repository | string | `"buttahtoast/svc-ingress-propagator"` |  |
+| image.tag | string | `""` |  |
+| imagePullSecrets | list | `[]` |  |
+| ingressClass.controllerValue | string | `""` | Ingress class controller |
+| ingressClass.create | bool | `true` | Create IngressClass |
+| ingressClass.isDefaultClass | bool | `false` | Cluster default ingress class |
+| ingressClass.name | string | `"propagation"` | Ingress class name |
+| livenessProbe | object | `{"httpGet":{"path":"/healthz","port":10080}}` | Configure the liveness probe using Deployment probe spec |
+| nameOverride | string | `""` |  |
+| nodeSelector | object | `{}` |  |
+| podAnnotations | object | `{}` |  |
+| podSecurityContext | object | `{}` |  |
+| readinessProbe | object | `{"httpGet":{"path":"/readyz","port":10080}}` | Configure the readiness probe using Deployment probe spec |
+| replicaCount | int | `1` |  |
+| resources | object | `{}` |  |
+| securityContext | object | `{}` |  |
+| service.port | int | `80` |  |
+| service.type | string | `"ClusterIP"` |  |
+| serviceAccount.annotations | object | `{}` |  |
+| serviceAccount.create | bool | `true` |  |
+| serviceAccount.name | string | `""` |  |
+| target.ingressClass | string | `"propagated"` | IngressClass on target |
+| target.issuer.name | string | `""` | Issuer name on target cluster |
+| target.issuer.namespaced | bool | `false` | Whether the issuer is namespaced on target cluster |
+| target.kubeconfig | object | `{"secret":{"key":"kubeconfig.yaml","name":"loadbalancer-propagation"}}` | Target Kubeconfig Secret |
+| target.namespace | string | `"ingress-central"` | Namespaced on target |
+| tolerations | list | `[]` |  |
+
+----------------------------------------------
+Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)
diff --git a/helm/templates/_helpers.tpl → ...ingress-propagator/templates/_helpers.tpl b/helm/templates/_helpers.tpl → ...ingress-propagator/templates/_helpers.tpl
diff --git a/helm/templates/deployment.yaml → ...ress-propagator/templates/deployment.yaml b/helm/templates/deployment.yaml → ...ress-propagator/templates/deployment.yaml
@@ -36,6 +36,7 @@ spec:
           image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args:
+            - --enable-leader-election
             - --identifier={{ include "controller.identifier" $ }}
             - --ingress-class={{ .Values.ingressClass.name }}
             - --controller-class={{ include "controller.value" $ }}
@@ -46,12 +47,25 @@ spec:
               {{- with .namespace }}
             - --target-namespace={{ . }}
               {{- end }}
+              {{- with .issuer }}
+                {{- if .name }}
+            - --target-issuer-name={{ .name }}
+                {{- end }}
+              {{- end }}
             {{- end }}
             - --target-kubeconfig=/target-kubeconfig.yaml
           volumeMounts:
           - name: kubeconfig-volume
             mountPath: /target-kubeconfig.yaml
             subPath: {{ .Values.target.kubeconfig.secret.key }}
+          ports:
+          - name: metrics
+            containerPort: 8080
+            protocol: TCP
+          livenessProbe:
+            {{- toYaml .Values.livenessProbe | nindent 12}}
+          readinessProbe:
+            {{- toYaml .Values.readinessProbe | nindent 12}}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
       {{- with .Values.nodeSelector }}

diff --git a/helm/templates/ingressclass.yaml → ...ss-propagator/templates/ingressclass.yaml b/helm/templates/ingressclass.yaml → ...ss-propagator/templates/ingressclass.yaml
@@ -1,8 +1,10 @@
+{{- if .Values.ingressClass.create }}
 apiVersion: networking.k8s.io/v1
 kind: IngressClass
 metadata:
   annotations:
     ingressclass.kubernetes.io/is-default-class: {{ .Values.ingressClass.isDefaultClass | quote }}
   name: {{ .Values.ingressClass.name }}
 spec:
-  controller: {{ include "controller.value" $ }}
+  controller: {{ include "controller.value" $ }}
+{{- end }}