feat(helm): Adjust templates for CRD versioning/conversion

Author: Techassi

deploy/helm/opa-operator/templates/deployment.yaml

@@ -21,6 +21,9 @@ spec:
         {{- toYaml . | nindent 8 }}
         {{- end }}
       labels:
+        {{- if .Values.maintenance.customResourceDefinitions.maintain }}
+        webhook.stackable.tech/conversion: enabled
+        {{- end }}
         {{- include "operator.selectorLabels" . | nindent 8 }}
     spec:
       {{- with .Values.image.pullSecrets }}
@@ -74,13 +77,16 @@ spec:
                 fieldRef:
                   fieldPath: spec.nodeName
 
+            - name: OPA_BUNDLE_BUILDER_CLUSTERROLE
+              value: {{ include "operator.fullname" . }}-opa-bundle-builder-clusterrole
+
             {{- if .Values.kubernetesClusterDomain }}
             - name: KUBERNETES_CLUSTER_DOMAIN
               value: {{ .Values.kubernetesClusterDomain | quote }}
             {{- end }}
+
             {{- include "telemetry.envVars" . | nindent 12 }}
-            - name: OPA_BUNDLE_BUILDER_CLUSTERROLE
-              value: {{ include "operator.fullname" . }}-opa-bundle-builder-clusterrole
+            {{- include "maintenance.envVars" . | nindent 12 }}
       volumes:
         - name: config-spec
           configMap:

deploy/helm/opa-operator/templates/roles.yaml

@@ -78,6 +78,12 @@ rules:
       - customresourcedefinitions
     verbs:
       - get
+      # Required to maintain the CRD. The operator needs to do this, as it needs to enter e.g. it's
+      # generated certificate in the conversion webhook.
+      {{- if .Values.maintenance.customResourceDefinitions.maintain }}
+      - create
+      - patch
+      {{- end }}
   - apiGroups:
       - events.k8s.io
     resources:

deploy/helm/opa-operator/templates/service.yaml

@@ -1,17 +1,16 @@
-
 ---
 apiVersion: v1
 kind: Service
 metadata:
-  # Note(@sbernauer): We could also call the Service something like
-  # "product-operator-conversion-webhook". However, in the future we will have more webhooks, and
-  # it seems like an overkill to have a dedicated Service per webhook.
   name: {{ include "operator.fullname" . }}
   labels:
     {{- include "operator.labels" . | nindent 4 }}
 spec:
   selector:
-    {{- include "operator.selectorLabels" . | nindent 6 }}
+    {{- if .Values.maintenance.customResourceDefinitions.maintain }}
+    webhook.stackable.tech/conversion: enabled
+    {{- end }}
+    {{- include "operator.selectorLabels" . | nindent 4 }}
   ports:
     - name: conversion-webhook
       protocol: TCP

deploy/helm/opa-operator/values.yaml

@@ -52,6 +52,15 @@ affinity: {}
 # See the https://docs.stackable.tech/home/stable/guides/kubernetes-cluster-domain guide for details.
 # kubernetesClusterDomain: my-cluster.local
 
+maintenance:
+  endOfSupportCheck:
+    enabled: true
+    # mode: offline
+    # interval: 24h
+
+  customResourceDefinitions:
+    maintain: true
+
 # See all available options and detailed explanations about the concept here:
 # https://docs.stackable.tech/home/stable/concepts/telemetry/
 telemetry: