Skip to content

Commit f239f47

Browse files
oliverbaehleroliverbaehler
committed
feat(helm): implement crd lifecycle and values consistency
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
1 parent 06ed3b8 commit f239f47

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+2393
-1741
lines changed

‎charts/capsule/Chart.yaml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,9 @@ annotations:
3838
email: cncf-capsule-maintainers@lists.cncf.io
3939
artifacthub.io/links: |
4040
- name: Documentation
41-
url: https://capsule.clastix.io/
42-
# artifacthub.io/changes: |
43-
# - kind: added
44-
# description: artifacthub annotations
45-
# - kind: changed
46-
# description: maintainers contact
41+
url: https://projectcapsule.dev/
42+
artifacthub.io/changes: |
43+
- kind: added
44+
description: bundled crd lifecycle
45+
- kind: changed
46+
description: removed PodSecurityPolicy support

‎charts/capsule/README.md

Lines changed: 86 additions & 43 deletions
Large diffs are not rendered by default.

‎charts/capsule/README.md.gotmpl

Lines changed: 36 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,21 +16,40 @@ Use the Capsule Operator for easily implementing, managing, and maintaining mult
1616

1717
* A [`kubeconfig`](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) file accessing the Kubernetes cluster with cluster admin permissions.
1818

19-
## Quick Start
19+
## Major Changes
2020

21+
In the following sections you see actions which are required when you are upgrading to a specific version.
22+
23+
### Upgrading to 0.7.x
24+
25+
Introduces a new methode to manage all capsule CRDs and their lifecycle. We are no longer relying on the [native CRD hook with the Helm Chart](https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#some-caveats-and-explanations). The hook only allows to manage CRDs on install and uninstall but we can't deliver updates to the CRDs.
26+
When you newly install the chart we recommend to set `crds.install` to `true`. This will manage the CRDs with the Helm Chart. This behavior is the new default.
27+
28+
#### Changed Values
29+
30+
The following Values have changed key or Value:
31+
32+
* All values from previous releases under `webhooks` have moved to `webhooks.hooks`.
33+
* `mutatingWebhooksTimeoutSeconds` has moved to `webhooks.mutatingWebhooksTimeoutSeconds`
34+
* `validatingWebhooksTimeoutSeconds` has moved to `webhooks.validatingWebhooksTimeoutSeconds`
35+
36+
37+
## Installation
38+
39+
The Capsule Operator requires it's CRDs to be installed before the operator itself. Since the Helm CRD lifecycle has limitations, we recommend to install the CRDs separately. Our chart supports the installation of crds via a dedicated Release.
2140
The Capsule Operator Chart can be used to instantly deploy the Capsule Operator on your Kubernetes cluster.
2241

2342
1. Add this repository:
2443

2544
$ helm repo add projectcapsule https://projectcapsule.github.io/charts
2645

27-
2. Install the Chart:
46+
2. Install Capsule:
2847

29-
$ helm install capsule projectcapsule/capsule -n capsule-system --create-namespace
48+
$ helm install capsule projectcapsule/capsule --version 0.7.0 -n capsule-system --create-namespace
3049

3150
or
3251

33-
$ helm install capsule oci://ghcr.io/projectcapsule/charts/capsule --version 0.4.6 -n capsule-system --create-namespace
52+
$ helm install capsule oci://ghcr.io/projectcapsule/charts/capsule --version 0.7.0 -n capsule-system --create-namespace
3453

3554
3. Show the status:
3655

@@ -58,21 +77,31 @@ Specify your overrides file when you install the chart:
5877

5978
$ helm install capsule capsule-helm-chart --values myvalues.yaml -n capsule-system
6079

61-
The values in your overrides file `myvalues.yaml` will override their counterparts in the chart’s values.yaml file. Any values in `values.yaml` that weren’t overridden will keep their defaults.
80+
The values in your overrides file `myvalues.yaml` will override their counterparts in the chart's values.yaml file. Any values in `values.yaml` that weren’t overridden will keep their defaults.
6281

6382
If you only need to make minor customizations, you can specify them on the command line by using the `--set` option. For example:
6483

6584
$ helm install capsule capsule-helm-chart --set manager.options.forceTenantPrefix=false -n capsule-system
6685

6786
Here the values you can override:
6887

88+
### CustomResourceDefinition Lifecycle
89+
90+
| Key | Type | Default | Description |
91+
|-----|------|---------|-------------|
92+
{{- range .Values }}
93+
{{- if (hasPrefix "crds" .Key) }}
94+
| {{ .Key }} | {{ .Type }} | {{ if .Default }}{{ .Default }}{{ else }}{{ .AutoDefault }}{{ end }} | {{ if .Description }}{{ .Description }}{{ else }}{{ .AutoDescription }}{{ end }} |
95+
{{- end }}
96+
{{- end }}
97+
6998

7099
### General Parameters
71100

72101
| Key | Type | Default | Description |
73102
|-----|------|---------|-------------|
74103
{{- range .Values }}
75-
{{- if not (or (hasPrefix "manager" .Key) (hasPrefix "serviceMonitor" .Key) (hasPrefix "webhook" .Key) (hasPrefix "capsule-proxy" .Key) ) }}
104+
{{- if not (or (hasPrefix "manager" .Key) (hasPrefix "crds" .Key) (hasPrefix "serviceMonitor" .Key) (hasPrefix "webhook" .Key) (hasPrefix "capsule-proxy" .Key) ) }}
76105
| {{ .Key }} | {{ .Type }} | {{ if .Default }}{{ .Default }}{{ else }}{{ .AutoDefault }}{{ end }} | {{ if .Description }}{{ .Description }}{{ else }}{{ .AutoDescription }}{{ end }} |
77106
{{- end }}
78107
{{- end }}
@@ -97,7 +126,7 @@ Here the values you can override:
97126
{{- end }}
98127
{{- end }}
99128

100-
### Webhook Parameters
129+
### Webhooks Parameters
101130

102131
| Key | Type | Default | Description |
103132
|-----|------|---------|-------------|

‎charts/capsule/crds/capsule.clastix.io_capsuleconfigurations.patch

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
metadata:
2+
annotations:
3+
{{- if $.Values.certManager.generateCertificates }}
4+
cert-manager.io/inject-ca-from: {{ $.Release.Namespace }}/{{ include "capsule.fullname" $ }}-webhook-cert
5+
{{- end }}
6+
spec:
7+
conversion:
8+
strategy: Webhook
9+
webhook:
10+
clientConfig:
11+
{{- include "capsule.webhooks.service" (dict "path" "/convert" "ctx" $) | nindent 8 }}
12+
conversionReviewVersions:
13+
- v1beta1
14+
- v1beta2

‎charts/capsule/crds/capsule.clastix.io_capsuleconfigurations.yaml

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
---
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
annotations:
6+
controller-gen.kubebuilder.io/version: v0.15.0
7+
name: capsuleconfigurations.capsule.clastix.io
8+
spec:
9+
group: capsule.clastix.io
10+
names:
11+
kind: CapsuleConfiguration
12+
listKind: CapsuleConfigurationList
13+
plural: capsuleconfigurations
14+
singular: capsuleconfiguration
15+
scope: Cluster
16+
versions:
17+
- name: v1beta2
18+
schema:
19+
openAPIV3Schema:
20+
description: CapsuleConfiguration is the Schema for the Capsule configuration
21+
API.
22+
properties:
23+
apiVersion:
24+
description: |-
25+
APIVersion defines the versioned schema of this representation of an object.
26+
Servers should convert recognized schemas to the latest internal value, and
27+
may reject unrecognized values.
28+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
29+
type: string
30+
kind:
31+
description: |-
32+
Kind is a string value representing the REST resource this object represents.
33+
Servers may infer this from the endpoint the client submits requests to.
34+
Cannot be updated.
35+
In CamelCase.
36+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
37+
type: string
38+
metadata:
39+
type: object
40+
spec:
41+
description: CapsuleConfigurationSpec defines the Capsule configuration.
42+
properties:
43+
enableTLSReconciler:
44+
default: true
45+
description: |-
46+
Toggles the TLS reconciler, the controller that is able to generate CA and certificates for the webhooks
47+
when not using an already provided CA and certificate, or when these are managed externally with Vault, or cert-manager.
48+
type: boolean
49+
forceTenantPrefix:
50+
default: false
51+
description: |-
52+
Enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix,
53+
separated by a dash. This is useful to avoid Namespace name collision in a public CaaS environment.
54+
type: boolean
55+
nodeMetadata:
56+
description: |-
57+
Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant.
58+
This applies only if the Tenant has an active NodeSelector, and the Owner have right to patch their nodes.
59+
properties:
60+
forbiddenAnnotations:
61+
description: Define the annotations that a Tenant Owner cannot
62+
set for their nodes.
63+
properties:
64+
denied:
65+
items:
66+
type: string
67+
type: array
68+
deniedRegex:
69+
type: string
70+
type: object
71+
forbiddenLabels:
72+
description: Define the labels that a Tenant Owner cannot set
73+
for their nodes.
74+
properties:
75+
denied:
76+
items:
77+
type: string
78+
type: array
79+
deniedRegex:
80+
type: string
81+
type: object
82+
required:
83+
- forbiddenAnnotations
84+
- forbiddenLabels
85+
type: object
86+
overrides:
87+
default:
88+
TLSSecretName: capsule-tls
89+
mutatingWebhookConfigurationName: capsule-mutating-webhook-configuration
90+
validatingWebhookConfigurationName: capsule-validating-webhook-configuration
91+
description: |-
92+
Allows to set different name rather than the canonical one for the Capsule configuration objects,
93+
such as webhook secret or configurations.
94+
properties:
95+
TLSSecretName:
96+
default: capsule-tls
97+
description: |-
98+
Defines the Secret name used for the webhook server.
99+
Must be in the same Namespace where the Capsule Deployment is deployed.
100+
type: string
101+
mutatingWebhookConfigurationName:
102+
default: capsule-mutating-webhook-configuration
103+
description: Name of the MutatingWebhookConfiguration which contains
104+
the dynamic admission controller paths and resources.
105+
type: string
106+
validatingWebhookConfigurationName:
107+
default: capsule-validating-webhook-configuration
108+
description: Name of the ValidatingWebhookConfiguration which
109+
contains the dynamic admission controller paths and resources.
110+
type: string
111+
required:
112+
- TLSSecretName
113+
- mutatingWebhookConfigurationName
114+
- validatingWebhookConfigurationName
115+
type: object
116+
protectedNamespaceRegex:
117+
description: Disallow creation of namespaces, whose name matches this
118+
regexp
119+
type: string
120+
userGroups:
121+
default:
122+
- capsule.clastix.io
123+
description: Names of the groups for Capsule users.
124+
items:
125+
type: string
126+
type: array
127+
required:
128+
- enableTLSReconciler
129+
type: object
130+
type: object
131+
served: true
132+
storage: true

0 commit comments

Comments
 (0)