refactor:crd deployment (#952)

* refactor: moved CRDs into the crds folder

This follow the rational expressed by the helm authors:
- <https://github.com/helm/community/blob/main/hips/hip-0011.md>

TLDR: modifying a CRD (update, deletion) should be
a manual process because the ramifications are
quite complex (CR deletion for example).

CRD deployment can be skipped using the --skip-crds
option.

Some related issues:
- <helm/helm#5871>
- <helm/helm#7735>
- <helm/helm#10585>

* chore(helm): remove the deployCrd value

This can be done at helm level using the --skip-crds
option since the CRDs have been moved to the crds
folder.

* refactor: cleanup RBAC rules

While it's possible to have multiple apiGroups and
resources, the list made would not apply on
OpenShift. The generated lists would contain invalid
entries such as networking items in the apps group
and all the combinations possible.

* fix: overwrite CRD rather than adding to it

The original code appends to the file rather than
overwriting its content.

Author: sgaist

Makefile

@@ -90,7 +90,7 @@ all: build
 # More info on the awk command:
 # http://linuxcommand.org/lc3_adv_awk.php
 
-HELM_CRD_TEMPLATE ?= helm-chart/amalthea-sessions/templates/amaltheasession-crd.yaml
+HELM_CRD_TEMPLATE ?= helm-chart/amalthea-sessions/crds/amaltheasession.yaml
 
 .PHONY: help
 help: ## Display this help.
@@ -101,10 +101,8 @@ help: ## Display this help.
 .PHONY: manifests
 manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
 	$(CONTROLLER_GEN) rbac:roleName=manager-role crd webhook paths="./..." output:crd:artifacts:config=config/crd/bases
-	echo "{{- if .Values.deployCrd -}}" > $(HELM_CRD_TEMPLATE)
-	echo "# This manifest is auto-generated from the makefile do not edit manually." >> $(HELM_CRD_TEMPLATE)
+	echo "# This manifest is auto-generated from the makefile do not edit manually." > $(HELM_CRD_TEMPLATE)
 	cat config/crd/bases/*yaml >> $(HELM_CRD_TEMPLATE)
-	echo "{{- end }}" >> $(HELM_CRD_TEMPLATE)
 
 .PHONY: generate
 generate: controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.

…sions/templates/amaltheasession-crd.yaml …lthea-sessions/crds/amaltheasession.yamlhelm-chart/amalthea-sessions/templates/amaltheasession-crd.yaml renamed to helm-chart/amalthea-sessions/crds/amaltheasession.yaml helm-chart/amalthea-sessions/templates/amaltheasession-crd.yaml renamed to helm-chart/amalthea-sessions/crds/amaltheasession.yaml

@@ -1,4 +1,3 @@
-{{- if .Values.deployCrd -}}
 # This manifest is auto-generated from the makefile do not edit manually.
 ---
 apiVersion: apiextensions.k8s.io/v1
@@ -6493,4 +6492,3 @@ spec:
     storage: true
     subresources:
       status: {}
-{{- end }}

helm-chart/amalthea-sessions/templates/manager-rbac.yaml

@@ -47,15 +47,20 @@ rules:
   resources: [pods]
   verbs: [get, list, watch]
 # Amalthea: child resources we produce
-# Note that we do not patch/update/delete them ever.
 - apiGroups:
   - ""
-  - apps
-  - networking.k8s.io
   resources:
-    - statefulsets
     - persistentvolumeclaims
     - services
+  verbs: [create, get, list, watch]
+- apiGroups:
+  - apps
+  resources:
+    - statefulsets
+  verbs: [create, get, list, watch]
+- apiGroups:
+  - networking.k8s.io
+  resources:
     - ingresses
   verbs: [create, get, list, watch, patch, update]
 # Required for hibernating sessions

helm-chart/amalthea-sessions/values.yaml

@@ -25,8 +25,6 @@ controllerManager:
 kubernetesClusterDomain: cluster.local
 # If set to true then the operator will watch and operate in all namespaces
 clusterScoped: false
-# Whether to install the CRD
-deployCrd: true
 # Whether to install the dependencies or not
 deploy:
   csiRclone: false

helm-chart/amalthea/templates/crd.yaml …m-chart/amalthea/crds/jupyterserver.yamlhelm-chart/amalthea/templates/crd.yaml renamed to helm-chart/amalthea/crds/jupyterserver.yaml helm-chart/amalthea/templates/crd.yaml renamed to helm-chart/amalthea/crds/jupyterserver.yaml

@@ -1,4 +1,3 @@
-{{- if .Values.deployCrd -}}
 # This manifest is auto-generated from controller/crds/jupyter_server.yaml, do not modify.
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
@@ -307,4 +306,3 @@ spec:
               default:
                 children: {}
                 mainPod: {}
-{{- end }}

helm-chart/amalthea/templates/rbac/_rbac_rules.tpl

@@ -26,16 +26,22 @@
   # Note that we do not patch/update/delete them ever.
   - apiGroups:
       - ""
-      - apps
-      - networking.k8s.io
     resources:
-      - statefulsets
       - persistentvolumeclaims
       - services
-      - ingresses
       - secrets
       - configmaps
     verbs: [create, get, list, watch]
+  - apiGroups:
+      - apps
+    resources:
+      - statefulsets
+    verbs: [create, get, list, watch]
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingresses
+    verbs: [create, get, list, watch]
 
   # Required for hibernating sessions
   - apiGroups: ["apps"]

helm-chart/amalthea/values.schema.json

@@ -66,10 +66,6 @@
             },
             "type": "object"
         },
-        "deployCrd": {
-            "description": "Should the helm chart apply the k8s CRD.",
-            "type": "boolean"
-        },
         "networkPolicies": {
             "description": "Enable and configure network policies for the controller and jupyter servers.",
             "type": "object",
@@ -436,7 +432,6 @@
     },
     "required": [
         "scope",
-        "deployCrd",
         "networkPolicies",
         "kopf",
         "extraChildResources",

helm-chart/amalthea/values.yaml

@@ -35,8 +35,6 @@ scope:
   #    will only operate in the namespace where the helm chart is deployed.
   # namespaces: ["default"]
 
-deployCrd: true # whether to deploy the jupyterserver CRD
-
 networkPolicies:
   # # Enable sensible, default network policies. Note that until cluster-wide
   # # network policies are available in Kubernetes (https://github.com/kubernetes/enhancements/issues/2091),