Skip to content

Commit aa83a55

Browse files
fao89fao89
committed
refactor(helm): prepare object-controller deployment resources
Prepare the deployment, certificates, service, network policy, disruption budget, metrics monitor, and values. The activation guard keeps generated installations unchanged until the reconciliation cutover. Refs: OPRUN-4775 Signed-off-by: Fabricio Aguiar <fabricio.aguiar@gmail.com> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED
1 parent 4d33ad1 commit aa83a55

7 files changed

Lines changed: 262 additions & 4 deletions

‎helm/olmv1/templates/cert-manager/certificate-olmv1-system-object-controller-cert.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{{- if and (include "objectController.enabled" .) .Values.options.certManager.enabled }}
2+
apiVersion: cert-manager.io/v1
3+
kind: Certificate
4+
metadata:
5+
annotations:
6+
{{- include "olmv1.annotations" . | nindent 4 }}
7+
labels:
8+
app.kubernetes.io/name: {{ include "olmv1.label.name" . }}
9+
{{- include "olmv1.labels" . | nindent 4 }}
10+
name: object-controller-cert
11+
namespace: {{ .Values.namespaces.olmv1.name }}
12+
spec:
13+
dnsNames:
14+
- object-controller-service.{{ .Values.namespaces.olmv1.name }}.svc
15+
- object-controller-service.{{ .Values.namespaces.olmv1.name }}.svc.cluster.local
16+
issuerRef:
17+
group: cert-manager.io
18+
kind: ClusterIssuer
19+
name: olmv1-ca
20+
privateKey:
21+
algorithm: ECDSA
22+
rotationPolicy: Always
23+
size: 256
24+
secretName: object-controller-cert
25+
{{- end }}

‎helm/olmv1/templates/deployment-olmv1-system-object-controller-controller-manager.yml‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
{{- if include "objectController.enabled" . }}
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
annotations:
6+
kubectl.kubernetes.io/default-logs-container: manager
7+
{{- include "olmv1.annotations" . | nindent 4 }}
8+
labels:
9+
app.kubernetes.io/name: object-controller
10+
{{- include "olmv1.labels" . | nindent 4 }}
11+
name: object-controller-controller-manager
12+
namespace: {{ .Values.namespaces.olmv1.name }}
13+
spec:
14+
replicas: {{ .Values.options.objectController.deployment.replicas }}
15+
strategy:
16+
type: RollingUpdate
17+
rollingUpdate:
18+
maxSurge: 1
19+
maxUnavailable: 0
20+
selector:
21+
matchLabels:
22+
control-plane: object-controller-controller-manager
23+
template:
24+
metadata:
25+
annotations:
26+
kubectl.kubernetes.io/default-container: manager
27+
{{- include "olmv1.annotations" . | nindent 8 }}
28+
{{- if .Values.options.openshift.enabled }}
29+
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
30+
openshift.io/required-scc: privileged
31+
{{- end }}
32+
labels:
33+
app.kubernetes.io/name: object-controller
34+
control-plane: object-controller-controller-manager
35+
{{- include "olmv1.labels" . | nindent 8 }}
36+
{{- with .Values.options.objectController.deployment.podLabels }}
37+
{{- toYamlPretty . | nindent 8 }}
38+
{{- end }}
39+
spec:
40+
containers:
41+
- name: manager
42+
command:
43+
- /object-controller
44+
args:
45+
- --health-probe-bind-address=:8081
46+
{{- if not .Values.options.tilt.enabled }}
47+
- --leader-elect
48+
{{- end }}
49+
{{- if .Values.options.profiling.enabled }}
50+
- --pprof-bind-address=:6060
51+
{{- end }}
52+
{{- if or .Values.options.certManager.enabled .Values.options.openshift.enabled }}
53+
- --metrics-bind-address=:8443
54+
- --tls-cert=/var/certs/tls.crt
55+
- --tls-key=/var/certs/tls.key
56+
{{- end }}
57+
{{- if .Values.options.openshift.enabled }}
58+
- --v=${LOG_VERBOSITY}
59+
{{- end }}
60+
{{- if .Values.options.e2e.enabled }}
61+
- --tls-profile=modern
62+
{{- end }}
63+
{{- range .Values.options.objectController.deployment.extraArguments }}
64+
- {{ . }}
65+
{{- end }}
66+
image: "{{ .Values.options.objectController.deployment.image }}"
67+
{{- if .Values.options.e2e.enabled }}
68+
env:
69+
- name: GOCOVERDIR
70+
value: /e2e-coverage
71+
{{- end }}
72+
{{- if not .Values.options.tilt.enabled }}
73+
livenessProbe:
74+
httpGet:
75+
path: /healthz
76+
port: 8081
77+
initialDelaySeconds: 15
78+
periodSeconds: 20
79+
readinessProbe:
80+
httpGet:
81+
path: /readyz
82+
port: 8081
83+
initialDelaySeconds: 5
84+
periodSeconds: 10
85+
{{- end }}
86+
resources:
87+
requests:
88+
cpu: 10m
89+
memory: 64Mi
90+
{{- if or .Values.options.certManager.enabled .Values.options.openshift.enabled .Values.options.e2e.enabled }}
91+
volumeMounts:
92+
{{- if or .Values.options.certManager.enabled .Values.options.openshift.enabled }}
93+
- name: object-controller-certs
94+
mountPath: /var/certs
95+
readOnly: true
96+
{{- end }}
97+
{{- if .Values.options.e2e.enabled }}
98+
- name: e2e-coverage-volume
99+
mountPath: /e2e-coverage
100+
{{- end }}
101+
{{- end }}
102+
{{- with .Values.deployments.containerSpec }}
103+
{{- toYaml . | nindent 10 }}
104+
{{- end }}
105+
serviceAccountName: object-controller-controller-manager
106+
{{- if or .Values.options.certManager.enabled .Values.options.openshift.enabled .Values.options.e2e.enabled }}
107+
volumes:
108+
{{- if or .Values.options.certManager.enabled .Values.options.openshift.enabled }}
109+
- name: object-controller-certs
110+
secret:
111+
secretName: object-controller-cert
112+
{{- end }}
113+
{{- if .Values.options.e2e.enabled }}
114+
- name: e2e-coverage-volume
115+
persistentVolumeClaim:
116+
claimName: e2e-coverage
117+
{{- end }}
118+
{{- end }}
119+
{{- with .Values.deployments.templateSpec }}
120+
{{- toYamlPretty . | nindent 6 }}
121+
{{- end }}
122+
{{- end }}

‎helm/olmv1/templates/networkpolicy/networkpolicy-olmv1-system-object-controller-controller-manager.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{{- if include "objectController.enabled" . }}
2+
apiVersion: networking.k8s.io/v1
3+
kind: NetworkPolicy
4+
metadata:
5+
annotations:
6+
{{- include "olmv1.annotations" . | nindent 4 }}
7+
labels:
8+
app.kubernetes.io/name: object-controller
9+
{{- include "olmv1.labels" . | nindent 4 }}
10+
name: object-controller-controller-manager
11+
namespace: {{ .Values.namespaces.olmv1.name }}
12+
spec:
13+
egress:
14+
- {}
15+
ingress:
16+
- ports:
17+
- port: 8443
18+
protocol: TCP
19+
podSelector:
20+
matchLabels:
21+
control-plane: object-controller-controller-manager
22+
policyTypes:
23+
- Ingress
24+
- Egress
25+
{{- end }}

‎helm/olmv1/templates/poddisruptionbudget-olmv1-system-object-controller.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{{- if and (include "objectController.enabled" .) .Values.options.objectController.podDisruptionBudget.enabled }}
2+
apiVersion: policy/v1
3+
kind: PodDisruptionBudget
4+
metadata:
5+
name: object-controller-controller-manager
6+
namespace: {{ .Values.namespaces.olmv1.name }}
7+
labels:
8+
app.kubernetes.io/name: object-controller
9+
{{- include "olmv1.labels" . | nindent 4 }}
10+
annotations:
11+
{{- include "olmv1.annotations" . | nindent 4 }}
12+
spec:
13+
{{- if ne (toJson .Values.options.objectController.podDisruptionBudget.maxUnavailable) "null" }}
14+
maxUnavailable: {{ .Values.options.objectController.podDisruptionBudget.maxUnavailable }}
15+
{{- else if ne (toJson .Values.options.objectController.podDisruptionBudget.minAvailable) "null" }}
16+
minAvailable: {{ .Values.options.objectController.podDisruptionBudget.minAvailable }}
17+
{{- end }}
18+
unhealthyPodEvictionPolicy: AlwaysAllow
19+
selector:
20+
matchLabels:
21+
control-plane: object-controller-controller-manager
22+
{{- end }}

‎helm/olmv1/templates/service-olmv1-system-object-controller-service.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
{{- if include "objectController.enabled" . }}
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
annotations:
6+
{{- include "olmv1.annotations" . | nindent 4 }}
7+
{{- if .Values.options.openshift.enabled }}
8+
service.beta.openshift.io/serving-cert-secret-name: object-controller-cert
9+
{{- end }}
10+
labels:
11+
app.kubernetes.io/name: object-controller
12+
{{- include "olmv1.labels" . | nindent 4 }}
13+
name: object-controller-service
14+
namespace: {{ .Values.namespaces.olmv1.name }}
15+
spec:
16+
ports:
17+
- name: metrics
18+
port: 8443
19+
protocol: TCP
20+
targetPort: 8443
21+
selector:
22+
app.kubernetes.io/name: object-controller
23+
{{- end }}

‎helm/olmv1/templates/servicemonitor-olmv1-system-object-controller-metrics-monitor.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{{- if .Values.options.openshift.enabled -}}
2+
{{- if include "objectController.enabled" . -}}
3+
apiVersion: monitoring.coreos.com/v1
4+
kind: ServiceMonitor
5+
metadata:
6+
annotations:
7+
{{- include "olmv1.annotations" . | nindent 4 }}
8+
labels:
9+
openshift.io/cluster-monitoring: 'true'
10+
app.kubernetes.io/name: object-controller
11+
{{- include "olmv1.labels" . | nindent 4 }}
12+
name: object-controller-metrics-monitor
13+
namespace: {{ .Values.namespaces.olmv1.name }}
14+
spec:
15+
endpoints:
16+
- bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
17+
interval: 30s
18+
path: /metrics
19+
port: metrics
20+
scheme: https
21+
tlsConfig:
22+
caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt
23+
certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt
24+
keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key
25+
serverName: object-controller-service.{{ .Values.namespaces.olmv1.name }}.svc
26+
namespaceSelector:
27+
matchNames:
28+
- {{ .Values.namespaces.olmv1.name }}
29+
selector:
30+
matchLabels:
31+
app.kubernetes.io/name: object-controller
32+
serviceDiscoveryRole: EndpointSlice
33+
{{- end -}}
34+
{{- end -}}

‎helm/olmv1/values.yaml‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,18 @@
11
# Default values for OLMv1.
22
# This is a YAML-formatted file.
33
# Declare variables to be passed into your templates.
4-
54
# List of components to include
65
options:
6+
objectController:
7+
# Activation is reserved until the deployment and reconciliation cutover.
8+
enabled: null
9+
deployment:
10+
image: quay.io/operator-framework/object-controller:devel
11+
replicas: 1
12+
extraArguments: []
13+
podDisruptionBudget:
14+
enabled: true
15+
minAvailable: 1
716
operatorController:
817
enabled: true
918
deployment:
@@ -49,15 +58,13 @@ options:
4958
version: v4.20
5059
# This can be one of: standard or experimental
5160
featureSet: standard
52-
5361
# The set of namespaces
5462
namespaces:
5563
olmv1:
5664
name: olmv1-system
5765
certManager:
5866
name: cert-manager
59-
60-
# Common deployment values for operator-controller and catalogd
67+
# Common deployment values for all controllers
6168
deployments:
6269
templateSpec:
6370
affinity:

0 commit comments

Comments
 (0)