feat: add a Helm chart covering the full config/ surface#397
Conversation
charts/etcd-operator covers the full config/ surface (parity with
kustomize build config/default; the Namespace is left to the release):
manager Deployment, RBAC with a cluster/namespace-scoped switch
(controller.watchNamespace), secure/insecure metrics with ServiceMonitor
and NetworkPolicy toggles, cert-manager webhook serving, and the
admission WebhookConfigurations with an optional namespaceSelector.
crds.enabled / controller.enabled / admissionWebhooks.enabled split the
chart into a cluster-scoped install lane and a namespaced runtime lane
so it can be rendered twice (e.g. two ArgoCD Applications).
templates/crds/ is generated: make helm-crds copies config/crd/bases
verbatim, wraps it in the crds.enabled guard, and escapes any {{ for
the template engine. make helm-lint runs helm lint. Nothing is wired
into existing targets.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Xavier Lange <xrlange@gmail.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: xrl The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @xrl. Thanks for your PR. I'm waiting for a etcd-io member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
1 participant
Summary
Adds a first-class Helm chart at
charts/etcd-operator(chart0.1.0, appVersionv0.2.0). It reproduces the fullconfig/surface with everything parameterized through values, sohelm install etcd-operator charts/etcd-operatoris equivalent tokustomize build config/default | kubectl apply -f -— and the pieces kustomize keeps behind commented-out[WEBHOOK]/[CERTMANAGER]/[PROMETHEUS]/[NETWORK POLICY]markers become plain toggles.Parity with
kustomize build config/defaultetcd-operator-system--create-namespace)etcdclusters.operator.etcd.iotemplates/crds/(generated, see below), gated bycrds.enabled…-controller-managerserviceaccount.yaml…-manager-role(binding)manager-rbac.yaml…-leader-election-*leader-election-rbac.yaml(always namespaced)…-metrics-auth-*,…-metrics-readermetrics-auth-rbac.yaml, rendered only whilemetrics.secure=true(the only mode that uses TokenReview/SubjectAccessReview)…-etcdcluster-{editor,viewer}-roleetcdcluster-user-rbac.yaml…-metrics-servicemetrics-service.yaml…-controller-managerdeployment.yamlPlus the optional surface: ServiceMonitor (
config/prometheus), metrics NetworkPolicy (config/network-policy), webhook Service + self-signed Issuer/Certificate (config/webhook,config/certmanager), and the Validating/Mutating WebhookConfigurations with cert-manager CA injection (#384). Webhook toggles default off to match today'sconfig/defaultand the v0.2.0 image.Values highlights
controller.image.digestrendersrepository@digestand wins overtag(which defaults toappVersion).OPERATOR_IMAGEenv defaults to the manager image ref. kustomizeimages:cannot rewrite env values; the chart keeps the two in lockstep automatically (digest pin included).controller.watchNamespace: swaps the manager ClusterRole/ClusterRoleBinding for a namespaced Role/RoleBinding in the watched namespace (noclusterissuersrule — pair withcontroller.restrictClusterIssuer; includes theevents.k8s.iorule from fix: grant RBAC for events.k8s.io Events emitted by the events/v1 recorder #391) and passes--watch-namespace/WATCH_NAMESPACE.metrics.secure=false: plain-HTTP metrics with zero cluster-scoped metrics RBAC; the Service, ServiceMonitor scheme/auth, and NetworkPolicy port all follow.admissionWebhooks.namespaceSelector: constrain the fail-closed webhooks to selected namespaces; empty keeps upstream's cluster-wide behavior.Split rendering (why three component gates)
crds.enabled/controller.enabled/admissionWebhooks.enabledlet one chart serve GitOps setups that split cluster-scoped installs from the namespaced runtime (e.g. two ArgoCD Applications, one privileged): side (a)controller.enabled=false, admissionWebhooks.enabled=truerenders only the CRDs + the two WebhookConfigurations; side (b)crds.enabled=false, webhook.enabled=truerenders the full runtime with neither. Exact values in the chart README.CRD sync idiom
templates/crds/is generated, never hand-edited:make helm-crdscopiesconfig/crd/bases/*.yamlverbatim, wraps each in thecrds.enabledguard, and escapes any{{for the template engine (none today; guarded anyway).make manifests helm-crdskeeps the chart in lockstep after API changes.make helm-lintrunshelm lint. No existing Makefile targets are touched.Verification
helm lint: clean.helm templateover four configurations: default, split side (a) (exactly 3 resources), split side (b) (no CRD/WebhookConfiguration leak), and namespace-scoped (watchNamespace=kv, metrics.secure=false: zero ClusterRoles emitted).kustomize build config/default(table above); the Namespace is the single deliberate omission.🤖 Generated with Claude Code
PR series — operability fixes, TLS & EtcdMirror
Small single-purpose PRs from live kind-cluster testing of the operator. Each stands alone unless an After is listed. → = this PR.
events.k8s.ioRBAC so operator Events are actually recordedmembers[]/leaderIDfrom one health snapshot (consistent leader)altNames.ipAddressesinto certificatesvalidityDuration(365d,100d12h) as documentedDegradedcondition (was empty status)--max-concurrent-reconciles)podTemplate.specscheduling fields: topologySpread, resources, priorityClass, schedulerNameconfig/surfacespec.tls.{peer,client}surfaces (breaking alpha API)TLSReadycondition + TLS lifecycle EventsPeerCANotSharedEtcdMirrorCRD: one-way cross-cluster replication API (types + CEL)pkg/mirroragentreplication engine (fenced checkpoint-in-target)mirror-agentbinary: config/TLS-reload/statusz/metrics + kind e2e/metricsendpointEtcdBackupCR → object storage (S3/GCS)🟢 ready · ⚪ draft