Skip to content

Commit f08fa9e

Browse files
Allex1GrigoryPervakov
Allex1
and
GrigoryPervakov
authored
feat(helm): Regenerate helm chart with latest kubebuilder (#159)
* [Helm] - Regenerate helm chart with latest kubebuilder * rescaffold manifests and helm chart, remove cert-manager subchart --------- Co-authored-by: Pervakov Grigorii <pervakov.grigory@gmail.com>
1 parent 762d058 commit f08fa9e

35 files changed

Lines changed: 793 additions & 372 deletions

‎.github/workflows/ci.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -198,6 +198,10 @@ jobs:
198198
k8s_image: v1.35.1
199199
clickhouse_version: "26.3"
200200
deploy_target: test-compat-e2e
201+
- name: olm-deploy-method
202+
k8s_image: v1.28.15
203+
clickhouse_version: "26.3"
204+
deploy_target: test-compat-e2e-olm
201205
- name: supported-clickhouse-compatibility
202206
k8s_image: v1.30.13
203207
clickhouse_version: "26.3,26.2,26.1,25.8"

‎Makefile‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,11 @@ test-clickhouse-e2e: ## Run clickhouse e2e tests.
159159

160160
.PHONY: test-compat-e2e # Run compatibility smoke tests across ClickHouse versions.
161161
test-compat-e2e: ## Run compatibility e2e tests (requires CLICKHOUSE_VERSION env var).
162-
go test ./test/deploy/ -test.timeout 30m -v --ginkgo.v --ginkgo.junit-report=report/junit-report.xml
162+
go test ./test/deploy/ -test.timeout 30m -v --ginkgo.v --ginkgo.label-filter=!olm --ginkgo.junit-report=report/junit-report.xml
163+
164+
.PHONY: test-compat-e2e-olm # Run OLM deployment smoke test.
165+
test-compat-e2e-olm: ## Run OLM deployment e2e test on a dedicated cluster.
166+
go test ./test/deploy/ -test.timeout 30m -v --ginkgo.v --ginkgo.label-filter=olm --ginkgo.junit-report=report/junit-report.xml
163167

164168
.PHONY: test-compat-e2e-manifest # Run compatibility smoke tests (manifests deployment only).
165169
test-compat-e2e-manifest: ## Run compatibility e2e tests using manifests deployment only (requires CLICKHOUSE_VERSION env var).
@@ -186,17 +190,15 @@ lint-fix: golangci-lint ## Run golangci-lint linter and perform fixes
186190
##@ Helm Chart
187191

188192
.PHONY: generate-helmchart
189-
generate-helmchart: kubebuilder ## Generate helm charts
190-
$(KUBEBUILDER) edit --plugins=helm/v2-alpha
191-
rm .github/workflows/test-chart.yml dist/install.yaml
193+
generate-helmchart: kubebuilder kustomize ## Generate helm charts
194+
$(KUSTOMIZE) build config/helm -o dist/install-helm.yaml
195+
$(KUBEBUILDER) edit --plugins=helm/v2-alpha --manifests dist/install-helm.yaml
196+
rm .github/workflows/test-chart.yml dist/install-helm.yaml
192197

193198
.PHONY: generate-helmchart-ci
194199
generate-helmchart-ci: generate-helmchart ## Generate helm charts and reset some files that will always generate diff
195200
git checkout dist/chart/templates/cert-manager/
196201
git checkout dist/chart/templates/manager/
197-
git checkout dist/chart/templates/metrics/
198-
git checkout dist/chart/templates/monitoring/
199-
git checkout dist/chart/templates/webhook/
200202

201203
.PHONY: build-helmchart-dependencies
202204
build-helmchart-dependencies: ## Build helm chart dependencies
@@ -331,7 +333,7 @@ CONTROLLER_TOOLS_VERSION ?= v0.20.1
331333
ENVTEST_VERSION ?= release-0.23
332334
GOLANGCI_LINT_VERSION ?= v2.11.4
333335
GINKGO_VERSION ?= v2.28.1
334-
KUBEBUILDER_VERSION ?= v4.13.1
336+
KUBEBUILDER_VERSION ?= v4.14.0
335337
CODESPELL_VERSION ?= 2.4.2
336338
CRD_SCHEMA_CHECKER_VERSION ?= latest
337339
CRD_REF_DOCS_VERSION ?= v0.3.0

‎PROJECT‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ layout:
77
- go.kubebuilder.io/v4
88
plugins:
99
helm.kubebuilder.io/v2-alpha:
10-
manifests: dist/install.yaml
10+
manifests: dist/install-helm.yaml
1111
output: dist
1212
manifests.sdk.operatorframework.io/v2: {}
1313
scorecard.sdk.operatorframework.io/v2: {}

‎config/default/kustomization.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,35 @@ replacements:
7474
# delimiter: '.'
7575
# index: 0
7676
# create: true
77+
# - select:
78+
# kind: ServiceMonitor
79+
# group: monitoring.coreos.com
80+
# version: v1
81+
# name: controller-manager-metrics-monitor
82+
# fieldPaths:
83+
# - spec.endpoints.0.tlsConfig.serverName
84+
# options:
85+
# delimiter: '.'
86+
# index: 0
87+
# create: true
88+
#
89+
# - source:
90+
# kind: Service
91+
# version: v1
92+
# name: metrics-service
93+
# fieldPath: metadata.namespace
94+
# targets:
95+
# - select: # Uncomment the following to set the Service namespace for TLS in Prometheus ServiceMonitor
96+
# kind: ServiceMonitor
97+
# group: monitoring.coreos.com
98+
# version: v1
99+
# name: controller-manager-metrics-monitor
100+
# fieldPaths:
101+
# - spec.endpoints.0.tlsConfig.serverName
102+
# options:
103+
# delimiter: '.'
104+
# index: 1
105+
# create: true
77106

78107
# [WEBHOOK] To enable webhook, uncomment this section.
79108
- source: # Update Certificate DNS names to match the Service name

‎config/helm/kustomization.yaml‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
namespace: clickhouse-operator-system
2+
namePrefix: clickhouse-operator-
3+
4+
resources:
5+
- ../crd
6+
- ../rbac
7+
- ../manager
8+
- ../prometheus
9+
10+
components:
11+
- ../certmanager
12+
- ../webhook
13+
- ../metrics_secure
14+
15+
replacements:
16+
- source:
17+
kind: Deployment
18+
version: v1
19+
name: controller-manager
20+
fieldPath: metadata.namespace
21+
targets:
22+
- select:
23+
kind: Certificate
24+
name: serving-cert
25+
fieldPaths:
26+
- .spec.dnsNames.[=NAMESPACE]
27+
options:
28+
delimiter: '.'
29+
index: 1
30+
create: true
31+
32+
- source:
33+
kind: Service
34+
version: v1
35+
name: metrics-service
36+
fieldPath: metadata.name
37+
targets:
38+
- select:
39+
kind: Certificate
40+
name: serving-cert
41+
fieldPaths:
42+
- .spec.dnsNames.[=METRICS_SERVICE_NAME]
43+
options:
44+
delimiter: '.'
45+
index: 0
46+
create: true
47+
- select:
48+
kind: ServiceMonitor
49+
group: monitoring.coreos.com
50+
version: v1
51+
name: controller-manager-metrics-monitor
52+
fieldPaths:
53+
- spec.endpoints.0.tlsConfig.serverName
54+
options:
55+
delimiter: '.'
56+
index: 0
57+
create: true
58+
59+
- source:
60+
kind: Service
61+
version: v1
62+
name: metrics-service
63+
fieldPath: metadata.namespace
64+
targets:
65+
- select:
66+
kind: ServiceMonitor
67+
group: monitoring.coreos.com
68+
version: v1
69+
name: controller-manager-metrics-monitor
70+
fieldPaths:
71+
- spec.endpoints.0.tlsConfig.serverName
72+
options:
73+
delimiter: '.'
74+
index: 1
75+
create: true
76+
77+
- source: # Update Certificate DNS names to match the Service name
78+
kind: Service
79+
version: v1
80+
name: webhook-service
81+
fieldPath: metadata.name
82+
targets:
83+
- select:
84+
kind: Certificate
85+
name: serving-cert
86+
fieldPaths:
87+
- .spec.dnsNames.[=WEBHOOK_SERVICE_NAME]
88+
options:
89+
delimiter: '.'
90+
index: 0
91+
create: true
92+
- source: # Set certificate reference to cert-manager.io/inject-ca-from annotation
93+
kind: Certificate
94+
group: cert-manager.io
95+
version: v1
96+
name: serving-cert # This name should match the one in certificate.yaml
97+
fieldPath: .metadata.namespace # Namespace of the certificate CR
98+
targets:
99+
- select:
100+
kind: ValidatingWebhookConfiguration
101+
fieldPaths:
102+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
103+
options:
104+
delimiter: '/'
105+
index: 0
106+
create: true
107+
- select:
108+
kind: MutatingWebhookConfiguration
109+
fieldPaths:
110+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
111+
options:
112+
delimiter: '/'
113+
index: 0
114+
create: true
115+
- source:
116+
kind: Certificate
117+
group: cert-manager.io
118+
version: v1
119+
name: serving-cert
120+
fieldPath: .metadata.name
121+
targets:
122+
- select:
123+
kind: ValidatingWebhookConfiguration
124+
fieldPaths:
125+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
126+
options:
127+
delimiter: '/'
128+
index: 1
129+
create: true
130+
- select:
131+
kind: MutatingWebhookConfiguration
132+
fieldPaths:
133+
- .metadata.annotations.[cert-manager.io/inject-ca-from]
134+
options:
135+
delimiter: '/'
136+
index: 1
137+
create: true

‎config/metrics/service.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ metadata:
99
namespace: system
1010
spec:
1111
ports:
12-
- name: metrics
12+
- name: http
1313
port: 8080
1414
protocol: TCP
1515
targetPort: 8080

‎config/metrics_secure/service.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ metadata:
99
namespace: system
1010
spec:
1111
ports:
12-
- name: metrics
12+
- name: https
1313
port: 9443
1414
protocol: TCP
1515
targetPort: 9443

‎config/prometheus/monitor.yaml‎

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -11,20 +11,24 @@ metadata:
1111
spec:
1212
endpoints:
1313
- path: /metrics
14-
port: metrics # Ensure this is the name of the port that exposes HTTPS metrics
14+
port: https # Ensure this is the name of the port that exposes HTTPS metrics
1515
scheme: https
1616
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
1717
tlsConfig:
18-
# TODO(user): The option insecureSkipVerify: true is not recommended for production since it disables
19-
# certificate verification. This poses a significant security risk by making the system vulnerable to
20-
# man-in-the-middle attacks, where an attacker could intercept and manipulate the communication between
21-
# Prometheus and the monitored services. This could lead to unauthorized access to sensitive metrics data,
22-
# compromising the integrity and confidentiality of the information.
23-
# Please use the following options for secure configurations:
24-
# caFile: /etc/metrics-certs/ca.crt
25-
# certFile: /etc/metrics-certs/tls.crt
26-
# keyFile: /etc/metrics-certs/tls.key
27-
insecureSkipVerify: true
18+
# SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize
19+
serverName: SERVICE_NAME.SERVICE_NAMESPACE.svc
20+
insecureSkipVerify: false
21+
ca:
22+
secret:
23+
name: metrics-server-cert
24+
key: ca.crt
25+
cert:
26+
secret:
27+
name: metrics-server-cert
28+
key: tls.crt
29+
keySecret:
30+
name: metrics-server-cert
31+
key: tls.key
2832
selector:
2933
matchLabels:
3034
control-plane: controller-manager

‎dist/chart/Chart.lock‎

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎dist/chart/Chart.yaml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,3 @@ maintainers:
1515
email: operator@clickhouse.com
1616
home: https://github.com/ClickHouse/clickhouse-operator
1717
icon: "https://clickhouse.com/docs/img/clickhouse-operator-logo.svg"
18-
dependencies:
19-
- name: cert-manager
20-
version: "v1.19.2"
21-
repository: "oci://quay.io/jetstack/charts"
22-
condition: certManager.install

0 commit comments

Comments
 (0)