A Helm chart for deploying the OCM Kubernetes Toolkit controller
Homepage: https://ocm.software
The OCM Kubernetes Toolkit controller manages OCM (Open Component Model) resources in Kubernetes clusters. It provides controllers for:
- Repository - OCM repository references
- Component - OCM component version tracking
- Resource - OCM resource extraction
- Deployer - Resource deployment automation
helm install ocm-k8s-toolkit oci://ghcr.io/open-component-model/kubernetes/controller/chart \
--namespace ocm-system \
--create-namespacehelm upgrade ocm-k8s-toolkit oci://ghcr.io/open-component-model/kubernetes/controller/chart \
--namespace ocm-systemhelm uninstall ocm-k8s-toolkit --namespace ocm-systemNote: CRDs are kept by default when uninstalling. To remove them:
kubectl delete crd components.delivery.ocm.software deployers.delivery.ocm.software repositories.delivery.ocm.software resources.delivery.ocm.software
| Name | Url | |
|---|---|---|
| OCM Team | https://github.com/open-component-model |
Kubernetes: >=1.26.0-0
| Key | Type | Default | Description |
|---|---|---|---|
| certManager.enable | bool | false |
Enable cert-manager for TLS certificates |
| crd.enable | bool | true |
Install CRDs with the chart |
| crd.keep | bool | true |
Keep CRDs when uninstalling |
| manager.affinity | object | {} |
Pod affinity rules |
| manager.cache.deployerDownloadMaxResourceSize | string | "2Mi" |
Maximum size of a single downloadable resource as a Kubernetes resource.Quantity (e.g. "2Mi", "512Ki"). "0" disables the limit. |
| manager.cache.deployerDownloadSize | int | 1000 |
Maximum size of the deployer download object LRU cache |
| manager.concurrency.resource | int | 4 |
Number of active resource controller workers |
| manager.env | list | [] |
Environment variables for the controller |
| manager.extraArgs | list | [] |
Extra arguments to pass to the controller |
| manager.healthProbe.bindAddress | string | ":8081" |
Address the health probe endpoint binds to |
| manager.image.pullPolicy | string | "IfNotPresent" |
Image pull policy |
| manager.image.repository | string | "ghcr.io/open-component-model/kubernetes/controller" |
Controller image repository |
| manager.image.tag | string | "latest" |
Controller image tag |
| manager.imagePullSecrets | list | [] |
Image pull secrets for the controller |
| manager.leaderElection.enabled | bool | true |
Enable leader election for controller manager |
| manager.livenessProbe.initialDelaySeconds | int | 15 |
Initial delay before starting liveness probes |
| manager.livenessProbe.path | string | "/healthz" |
Path for the liveness probe |
| manager.livenessProbe.periodSeconds | int | 20 |
Period between liveness probes |
| manager.livenessProbe.port | int | 8081 |
Port for the liveness probe |
| manager.logging.development | bool | false |
Enable development mode (console encoder, debug level, warn stacktrace) |
| manager.logging.encoder | string | "json" |
Log encoding: 'json' or 'console' |
| manager.logging.level | string | "info" |
Zap log level: 'debug', 'info', 'error', 'panic' or integer > 0 |
| manager.metricsServer.bindAddress | string | "0" |
Address the metric endpoint binds to. Set to "0" to disable |
| manager.metricsServer.enableHttp2 | bool | false |
Enable HTTP/2 for metrics and webhook servers |
| manager.metricsServer.secure | bool | false |
Serve metrics endpoint securely |
| manager.nodeSelector | object | {} |
Node selector for pod scheduling |
| manager.podSecurityContext | object | {"runAsNonRoot":true} |
Pod-level security context |
| manager.readinessProbe.initialDelaySeconds | int | 5 |
Initial delay before starting readiness probes |
| manager.readinessProbe.path | string | "/readyz" |
Path for the readiness probe |
| manager.readinessProbe.periodSeconds | int | 10 |
Period between readiness probes |
| manager.readinessProbe.port | int | 8081 |
Port for the readiness probe |
| manager.replicas | int | 1 |
Number of controller manager replicas |
| manager.resolver.cacheTTL | int | 30 |
The time-to-live (TTL) for the resolver cache entries in minutes. Setting TTL to less than 30 minutes is discouraged in productive use as it can lead to unintended performance issues. |
| manager.resolver.subscriberBufferSize | int | 100 |
Buffer size for each subscriber's event channel. Larger values reduce dropped resolution events under load. Monitor resolver_event_channel_drops_total metric. |
| manager.resolver.workerCount | int | 10 |
Number of active resolver workers |
| manager.resolver.workerQueueLength | int | 1000 |
Maximum work items in queue for component version resolution |
| manager.resources | object | {"limits":{"cpu":"500m","memory":"512Mi"},"requests":{"cpu":"100m","memory":"256Mi"}} |
Resource limits and requests |
| manager.securityContext | object | {"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]}} |
Container-level security context |
| manager.tolerations | list | [] |
Pod tolerations |
| prometheus.enable | bool | false |
Enable Prometheus ServiceMonitor (requires prometheus-operator) |
| rbacHelpers.enable | bool | false |
Install convenience admin/editor/viewer roles for CRDs |
| webhook.certSecret | string | "" |
Secret name for webhook TLS certificates (when not using cert-manager, create this secret manually) |
| webhook.enable | bool | false |
Enable conversion webhook for CRD version conversion |
Run these tasks from the kubernetes/controller directory.
When API types or //+kubebuilder:rbac markers change, regenerate the Helm
templates:
task helm/generateThis runs controller-gen to produce raw CRDs into config/crd/bases and a raw
ClusterRole into bin/gen/rbac, then invokes two post-processors:
hack/helm.generate.shreformats the CRDs and injects Helm template wrappers (crd.enable, cert-manager CA-injection annotation, conversion webhook block) intochart/templates/crd/.hack/rbac.generate.shreformats the ClusterRole and rewritesmetadata.nameto the chart's templated resource name, writingchart/templates/rbac/manager-role.yaml.
Individual targets task helm/generate-crds and task helm/generate-rbac are
also available.
Note: Only
manager-role.yamlis regenerated from Go markers. The ClusterRoleBinding, ServiceAccount, leader-election Role/RoleBinding, and per-kind editor/viewer aggregation roles underchart/templates/rbac/are hand-maintained because they are not derivable from//+kubebuilder:rbacmarkers. Other templates (manager.yaml,_helpers.tpl, etc.) are likewise hand-maintained.
Before committing, run validation to ensure all generated files are in sync:
task helm/validateThis checks:
- Chart linting passes
- Templates render successfully
- CRDs, manager-role, schema, and docs are up to date
task helm/schema # Regenerate values.schema.json
task helm/docs # Regenerate README.mdPackage the chart for distribution:
task helm/package # Use versions from Chart.yaml
task helm/package VERSION=1.0.0 # Override chart version
task helm/package APP_VERSION=1.0.0 # Override app version (image tag)
task helm/package VERSION=1.0.0 APP_VERSION=1.0.0 # Override bothThe packaged chart is saved to dist/chart-<version>.tgz.
task helm/template # Render templates locally
task helm/install # Install chart to current cluster
task helm/uninstall # Remove chart from cluster