[occm] Sync Helm chart with raw manifests

Align the OCCM Helm chart defaults with the raw manifests to fix
scheduling and RBAC gaps:

- Replace nodeSelector (exact empty string match) with nodeAffinity
  (operator: Exists) to match the manifest behavior
- Add missing CriticalAddonsOnly and node-role.kubernetes.io/master
  tolerations from the manifest
- Add cloud-node-controller ClusterRole and ClusterRoleBinding that
  were absent from the Helm chart

Author: fvrk4n

charts/openstack-cloud-controller-manager/Chart.yaml

@@ -4,7 +4,7 @@ description: Openstack Cloud Controller Manager Helm Chart
 icon: https://object-storage-ca-ymq-1.vexxhost.net/swift/v1/6e4619c416ff4bd19e1c087f27a43eea/www-images-prod/openstack-logo/OpenStack-Logo-Vertical.png
 home: https://github.com/kubernetes/cloud-provider-openstack
 name: openstack-cloud-controller-manager
-version: 2.35.0
+version: 2.35.1
 maintainers:
   - name: eumel8
     email: f.kloeker@telekom.de

charts/openstack-cloud-controller-manager/templates/clusterrole-node-controller.yaml

@@ -0,0 +1,30 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: system:cloud-node-controller
+  labels: {{- include "common.labels.standard" . | nindent 4 }}
+  annotations:
+    {{- with .Values.commonAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - nodes
+  verbs:
+  - '*'
+- apiGroups:
+  - ""
+  resources:
+  - nodes/status
+  verbs:
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+  - update

charts/openstack-cloud-controller-manager/templates/clusterrolebinding-node-controller.yaml

@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: system:cloud-node-controller
+  labels: {{- include "common.labels.standard" . | nindent 4 }}
+  annotations:
+    {{- with .Values.commonAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:cloud-node-controller
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.serviceAccountName }}
+  namespace: {{ .Release.Namespace | quote }}

charts/openstack-cloud-controller-manager/templates/daemonset.yaml

@@ -26,8 +26,8 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.nodeSelector }}
-      nodeSelector:
+      {{- with .Values.affinity }}
+      affinity:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       {{- with .Values.podSecurityContext }}

charts/openstack-cloud-controller-manager/values.yaml

@@ -48,16 +48,27 @@ readinessProbe: {}
 
 dnsPolicy: ClusterFirst
 
-# Set nodeSelector where the controller should run, i.e. controlplane nodes
-nodeSelector:
-  node-role.kubernetes.io/control-plane: ""
+# Set affinity rules for where the controller should run, i.e. controlplane nodes
+affinity:
+  nodeAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      nodeSelectorTerms:
+      - matchExpressions:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
 
 # Set tolerations for nodes where the controller should run, i.e. node
 # should be uninitialized, controlplane...
 tolerations:
+  - key: "CriticalAddonsOnly"
+    operator: "Equal"
+    value: "true"
+    effect: NoExecute
   - key: node.cloudprovider.kubernetes.io/uninitialized
     value: "true"
     effect: NoSchedule
+  - key: node-role.kubernetes.io/master
+    effect: NoSchedule
   - key: node-role.kubernetes.io/control-plane
     effect: NoSchedule