diff --git a/.github/workflows/release-helm.yml b/.github/workflows/release-helm.yml new file mode 100644 index 0000000..c2fa27b --- /dev/null +++ b/.github/workflows/release-helm.yml @@ -0,0 +1,51 @@ +name: Release Helm chart + +# Publishes the Helm chart to the GitHub Pages Helm repository when a release is +# published. The chart version and appVersion are set to the release tag, and the +# chart is uploaded via helm/chart-releaser-action (gh-pages branch + index.yaml). +on: + release: + types: [ released ] + workflow_dispatch: + +permissions: + contents: write + pages: write + +jobs: + release-chart: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v7 + with: + fetch-depth: 0 + + - name: Configure Git + run: | + git config user.name "$GITHUB_ACTOR" + git config user.email "$GITHUB_ACTOR@users.noreply.github.com" + + - name: Set chart version to release tag + env: + # release runs strip a leading "v"; workflow_dispatch falls back to the chart's value + RELEASE_TAG: ${{ github.event.release.tag_name }} + run: | + if [ -n "${RELEASE_TAG}" ]; then + VERSION="${RELEASE_TAG#v}" + chart="helm/kubernetes-glue-operator/Chart.yaml" + sed -i "s/^version:.*/version: ${VERSION}/" "$chart" + sed -i "s/^appVersion:.*/appVersion: \"${VERSION}\"/" "$chart" + echo "Chart set to version/appVersion ${VERSION}" + grep -E '^(version|appVersion):' "$chart" + fi + + - name: Install Helm + uses: azure/setup-helm@v4 + + - name: Run chart-releaser + uses: helm/chart-releaser-action@v1.7.0 + with: + charts_dir: helm + env: + CR_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/README.md b/README.md index 51d19f9..553d229 100644 --- a/README.md +++ b/README.md @@ -9,6 +9,19 @@ In other words, it also allows you to write **workflows** over resources in a ** The project is implemented as a thin layer on top of battle-tested [workflow](https://javaoperatorsdk.io/docs/workflows/) and [dependent resources](https://javaoperatorsdk.io/docs/dependent-resources/) features of Java Operator SDK, using [Quarkus based](https://github.com/quarkiverse/quarkus-operator-sdk) version of the framework. +## Installation + +Install with Helm from the chart repository: + +```bash +helm repo add glue-operator https://java-operator-sdk.github.io/kubernetes-glue-operator +helm repo update +helm install glue-operator glue-operator/kubernetes-glue-operator \ + --namespace glue-operator --create-namespace +``` + +See the [chart README](/helm/kubernetes-glue-operator/README.md) for configuration options. + ## Documentation [Getting started](/docs/getting-started.md) diff --git a/helm/kubernetes-glue-operator/.helmignore b/helm/kubernetes-glue-operator/.helmignore new file mode 100644 index 0000000..83d884b --- /dev/null +++ b/helm/kubernetes-glue-operator/.helmignore @@ -0,0 +1,11 @@ +# Patterns to ignore when building packages. +*.tmpl +*.orig +*.bak +.DS_Store +.git/ +.gitignore +.vscode/ +.idea/ +*.tgz +ci/ diff --git a/helm/kubernetes-glue-operator/Chart.yaml b/helm/kubernetes-glue-operator/Chart.yaml new file mode 100644 index 0000000..5c9c8fe --- /dev/null +++ b/helm/kubernetes-glue-operator/Chart.yaml @@ -0,0 +1,18 @@ +apiVersion: v2 +name: kubernetes-glue-operator +description: A Helm chart for the Kubernetes Glue Operator +type: application +# version (chart) and appVersion (operator image) are overwritten at release time +# to match the released operator version. +version: 0.1.0 +appVersion: "0.11.0" +home: https://github.com/java-operator-sdk/kubernetes-glue-operator +sources: + - https://github.com/java-operator-sdk/kubernetes-glue-operator +keywords: + - operator + - glue + - java-operator-sdk +maintainers: + - name: java-operator-sdk + url: https://github.com/java-operator-sdk diff --git a/helm/kubernetes-glue-operator/README.md b/helm/kubernetes-glue-operator/README.md new file mode 100644 index 0000000..d503c69 --- /dev/null +++ b/helm/kubernetes-glue-operator/README.md @@ -0,0 +1,72 @@ +# Kubernetes Glue Operator Helm chart + +Installs the [Kubernetes Glue Operator](https://github.com/java-operator-sdk/kubernetes-glue-operator): +its `Glue` and `GlueOperator` CRDs, RBAC, and the operator `Deployment`. + +## Install from the Helm repository + +```bash +helm repo add glue-operator https://java-operator-sdk.github.io/kubernetes-glue-operator +helm repo update +helm install glue-operator glue-operator/kubernetes-glue-operator \ + --namespace glue-operator --create-namespace +``` + +## Install from source + +```bash +helm install glue-operator ./helm/kubernetes-glue-operator \ + --namespace glue-operator --create-namespace +``` + +## CRDs + +The `Glue` and `GlueOperator` CRDs live in the chart's `crds/` directory. Helm installs +them on first install but, by design, does **not** upgrade or delete them. On an upgrade +that changes the CRD schema, apply the new CRDs manually: + +```bash +kubectl apply -f helm/kubernetes-glue-operator/crds/ +``` + +## Configuration + +| Key | Default | Description | +| --- | --- | --- | +| `replicaCount` | `1` | Operator replicas. | +| `image.repository` | `ghcr.io/java-operator-sdk/kubernetes-glue-operator` | Operator image. | +| `image.tag` | `""` | Image tag; defaults to the chart `appVersion`. | +| `image.pullPolicy` | `IfNotPresent` | Image pull policy. | +| `imagePullSecrets` | `[]` | Image pull secrets. | +| `watchNamespaces` | `[]` | Namespaces to watch; empty means all namespaces. | +| `serviceAccount.create` | `true` | Create a ServiceAccount. | +| `serviceAccount.name` | `""` | Override the ServiceAccount name. | +| `serviceAccount.annotations` | `{}` | ServiceAccount annotations. | +| `rbac.create` | `true` | Create ClusterRoles and bindings. | +| `rbac.allAccess` | `true` | Grant cluster-wide access to all resources. Disable for least privilege. | +| `rbac.extraRules` | `[]` | Extra rules added to the operator's ClusterRole (use with `allAccess: false`). | +| `rbac.bindView` | `true` | Bind the ServiceAccount to the built-in `view` ClusterRole. | +| `service.type` | `ClusterIP` | Service type. | +| `service.port` | `80` | Service port. | +| `resources` | `{}` | Container resource requests/limits. | +| `livenessProbe` / `readinessProbe` / `startupProbe` | Quarkus health endpoints | Probe config; set to `{}` to disable. | +| `extraEnv` | `[]` | Extra environment variables for the container. | +| `podAnnotations`, `podLabels`, `nodeSelector`, `tolerations`, `affinity`, `podSecurityContext`, `securityContext` | `{}` / `[]` | Standard pod/container scheduling and security knobs. | + +### Why `rbac.allAccess`? + +A `Glue` can manage **arbitrary** resource types, so the operator is granted cluster-wide +access by default. For a least-privilege setup, scope it to only the resource types your +`Glue`s manage: + +```yaml +rbac: + allAccess: false + extraRules: + - apiGroups: [""] + resources: ["configmaps", "secrets", "services"] + verbs: ["*"] + - apiGroups: ["apps"] + resources: ["deployments"] + verbs: ["*"] +``` diff --git a/helm/kubernetes-glue-operator/crds/glueoperators.yaml b/helm/kubernetes-glue-operator/crds/glueoperators.yaml new file mode 100644 index 0000000..9bda367 --- /dev/null +++ b/helm/kubernetes-glue-operator/crds/glueoperators.yaml @@ -0,0 +1,121 @@ +# Generated by Fabric8 CRDGenerator, manual edits might get overwritten! +apiVersion: "apiextensions.k8s.io/v1" +kind: "CustomResourceDefinition" +metadata: + name: "glueoperators.io.javaoperatorsdk.operator.glue" +spec: + group: "io.javaoperatorsdk.operator.glue" + names: + kind: "GlueOperator" + plural: "glueoperators" + shortNames: + - "go" + singular: "glueoperator" + scope: "Namespaced" + versions: + - name: "v1beta1" + schema: + openAPIV3Schema: + properties: + spec: + properties: + childResources: + items: + properties: + bulk: + type: "boolean" + clusterScoped: + type: "boolean" + condition: + type: "object" + x-kubernetes-preserve-unknown-fields: true + dependsOn: + items: + type: "string" + type: "array" + matcher: + enum: + - "NONE" + - "SSA" + type: "string" + name: + type: "string" + readyPostCondition: + type: "object" + x-kubernetes-preserve-unknown-fields: true + resource: + type: "object" + x-kubernetes-embedded-resource: true + x-kubernetes-preserve-unknown-fields: true + resourceTemplate: + type: "string" + required: + - "name" + type: "object" + type: "array" + glueMetadata: + properties: + name: + type: "string" + namespace: + type: "string" + type: "object" + parent: + properties: + apiVersion: + type: "string" + clusterScoped: + type: "boolean" + kind: + type: "string" + labelSelector: + type: "string" + status: + type: "object" + x-kubernetes-preserve-unknown-fields: true + statusTemplate: + type: "string" + type: "object" + relatedResources: + items: + properties: + apiVersion: + type: "string" + clusterScoped: + type: "boolean" + kind: + type: "string" + name: + type: "string" + namespace: + type: "string" + resourceNames: + items: + type: "string" + type: "array" + statusPatch: + type: "object" + x-kubernetes-preserve-unknown-fields: true + statusPatchTemplate: + type: "string" + required: + - "apiVersion" + - "kind" + - "name" + type: "object" + type: "array" + required: + - "parent" + type: "object" + status: + properties: + errorMessage: + type: "string" + observedGeneration: + type: "integer" + type: "object" + type: "object" + served: true + storage: true + subresources: + status: {} diff --git a/helm/kubernetes-glue-operator/crds/glues.yaml b/helm/kubernetes-glue-operator/crds/glues.yaml new file mode 100644 index 0000000..a212d3c --- /dev/null +++ b/helm/kubernetes-glue-operator/crds/glues.yaml @@ -0,0 +1,96 @@ +# Generated by Fabric8 CRDGenerator, manual edits might get overwritten! +apiVersion: "apiextensions.k8s.io/v1" +kind: "CustomResourceDefinition" +metadata: + name: "glues.io.javaoperatorsdk.operator.glue" +spec: + group: "io.javaoperatorsdk.operator.glue" + names: + kind: "Glue" + plural: "glues" + shortNames: + - "g" + singular: "glue" + scope: "Namespaced" + versions: + - name: "v1beta1" + schema: + openAPIV3Schema: + properties: + spec: + properties: + childResources: + items: + properties: + bulk: + type: "boolean" + clusterScoped: + type: "boolean" + condition: + type: "object" + x-kubernetes-preserve-unknown-fields: true + dependsOn: + items: + type: "string" + type: "array" + matcher: + enum: + - "NONE" + - "SSA" + type: "string" + name: + type: "string" + readyPostCondition: + type: "object" + x-kubernetes-preserve-unknown-fields: true + resource: + type: "object" + x-kubernetes-embedded-resource: true + x-kubernetes-preserve-unknown-fields: true + resourceTemplate: + type: "string" + required: + - "name" + type: "object" + type: "array" + relatedResources: + items: + properties: + apiVersion: + type: "string" + clusterScoped: + type: "boolean" + kind: + type: "string" + name: + type: "string" + namespace: + type: "string" + resourceNames: + items: + type: "string" + type: "array" + statusPatch: + type: "object" + x-kubernetes-preserve-unknown-fields: true + statusPatchTemplate: + type: "string" + required: + - "apiVersion" + - "kind" + - "name" + type: "object" + type: "array" + type: "object" + status: + properties: + errorMessage: + type: "string" + observedGeneration: + type: "integer" + type: "object" + type: "object" + served: true + storage: true + subresources: + status: {} diff --git a/helm/kubernetes-glue-operator/sync-crds.sh b/helm/kubernetes-glue-operator/sync-crds.sh new file mode 100755 index 0000000..a4c5f0f --- /dev/null +++ b/helm/kubernetes-glue-operator/sync-crds.sh @@ -0,0 +1,18 @@ +#!/usr/bin/env bash +# Regenerates the chart's CRDs from the latest build output. +# Run `./mvnw clean package -DskipTests` first so target/kubernetes exists. +set -euo pipefail + +repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" +gen_dir="$repo_root/target/kubernetes" +crd_dir="$repo_root/helm/kubernetes-glue-operator/crds" + +if [[ ! -d "$gen_dir" ]]; then + echo "ERROR: $gen_dir not found. Run './mvnw clean package -DskipTests' first." >&2 + exit 1 +fi + +cp "$gen_dir/glues.io.javaoperatorsdk.operator.glue-v1.yml" "$crd_dir/glues.yaml" +cp "$gen_dir/glueoperators.io.javaoperatorsdk.operator.glue-v1.yml" "$crd_dir/glueoperators.yaml" + +echo "Synced CRDs into $crd_dir" diff --git a/helm/kubernetes-glue-operator/templates/NOTES.txt b/helm/kubernetes-glue-operator/templates/NOTES.txt new file mode 100644 index 0000000..9c9175c --- /dev/null +++ b/helm/kubernetes-glue-operator/templates/NOTES.txt @@ -0,0 +1,21 @@ +{{ .Chart.Name }} {{ .Chart.AppVersion }} has been installed. + +Release: {{ .Release.Name }} +Namespace: {{ .Release.Namespace }} +Watching: {{ if .Values.watchNamespaces }}{{ join ", " .Values.watchNamespaces }}{{ else }}all namespaces{{ end }} + +Check the operator is running: + + kubectl -n {{ .Release.Namespace }} rollout status deployment/{{ include "glue-operator.fullname" . }} + +The CRDs `glues.io.javaoperatorsdk.operator.glue` (g) and +`glueoperators.io.javaoperatorsdk.operator.glue` (go) are installed. Try a Glue: + + kubectl get glues,glueoperators -A + +See samples: https://github.com/java-operator-sdk/kubernetes-glue-operator/blob/main/docs/sample-index.md + +NOTE: Helm does not upgrade or delete CRDs in the chart's crds/ directory. When +upgrading to a release with CRD schema changes, apply the new CRDs manually: + + kubectl apply -f https://raw.githubusercontent.com/java-operator-sdk/kubernetes-glue-operator/{{ .Chart.AppVersion }}/helm/kubernetes-glue-operator/crds/ diff --git a/helm/kubernetes-glue-operator/templates/_helpers.tpl b/helm/kubernetes-glue-operator/templates/_helpers.tpl new file mode 100644 index 0000000..4f00cde --- /dev/null +++ b/helm/kubernetes-glue-operator/templates/_helpers.tpl @@ -0,0 +1,59 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "glue-operator.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +*/}} +{{- define "glue-operator.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Chart name and version label value. +*/}} +{{- define "glue-operator.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "glue-operator.labels" -}} +helm.sh/chart: {{ include "glue-operator.chart" . }} +{{ include "glue-operator.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels (match the operator's pod selector: app.kubernetes.io/name). +*/}} +{{- define "glue-operator.selectorLabels" -}} +app.kubernetes.io/name: {{ include "glue-operator.name" . }} +{{- end }} + +{{/* +ServiceAccount name to use. +*/}} +{{- define "glue-operator.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "glue-operator.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/helm/kubernetes-glue-operator/templates/deployment.yaml b/helm/kubernetes-glue-operator/templates/deployment.yaml new file mode 100644 index 0000000..6685ff4 --- /dev/null +++ b/helm/kubernetes-glue-operator/templates/deployment.yaml @@ -0,0 +1,90 @@ +{{- $watch := "JOSDK_ALL_NAMESPACES" -}} +{{- if .Values.watchNamespaces -}} +{{- $watch = join "," .Values.watchNamespaces -}} +{{- end -}} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "glue-operator.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "glue-operator.labels" . | nindent 4 }} +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + {{- include "glue-operator.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + {{- include "glue-operator.labels" . | nindent 8 }} + {{- with .Values.podLabels }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + serviceAccountName: {{ include "glue-operator.serviceAccountName" . }} + terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: {{ .Chart.Name }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + {{- with .Values.securityContext }} + securityContext: + {{- toYaml . | nindent 12 }} + {{- end }} + ports: + - name: http + containerPort: 8080 + protocol: TCP + env: + - name: KUBERNETES_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: QUARKUS_OPERATOR_SDK_CONTROLLERS_GLUE_NAMESPACES + value: {{ $watch | quote }} + - name: QUARKUS_OPERATOR_SDK_CONTROLLERS_GLUE_OPERATOR_NAMESPACES + value: {{ $watch | quote }} + {{- with .Values.extraEnv }} + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.livenessProbe }} + livenessProbe: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.readinessProbe }} + readinessProbe: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.startupProbe }} + startupProbe: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.resources }} + resources: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/helm/kubernetes-glue-operator/templates/rbac.yaml b/helm/kubernetes-glue-operator/templates/rbac.yaml new file mode 100644 index 0000000..ef991e6 --- /dev/null +++ b/helm/kubernetes-glue-operator/templates/rbac.yaml @@ -0,0 +1,103 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "glue-operator.fullname" . }}-manager + labels: + {{- include "glue-operator.labels" . | nindent 4 }} +rules: + - apiGroups: + - io.javaoperatorsdk.operator.glue + resources: + - glues + - glues/status + - glues/finalizers + - glueoperators + - glueoperators/status + - glueoperators/finalizers + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + # The operator validates its CRDs against the cluster on startup. + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + {{- with .Values.rbac.extraRules }} + {{- toYaml . | nindent 2 }} + {{- end }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "glue-operator.fullname" . }}-manager + labels: + {{- include "glue-operator.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "glue-operator.fullname" . }}-manager +subjects: + - kind: ServiceAccount + name: {{ include "glue-operator.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- if .Values.rbac.allAccess }} +--- +# A Glue can manage arbitrary resource types, so the operator needs broad access. +# Disable with rbac.allAccess=false and grant scoped rules via rbac.extraRules. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "glue-operator.fullname" . }}-all-access + labels: + {{- include "glue-operator.labels" . | nindent 4 }} +rules: + - apiGroups: + - '*' + resources: + - '*' + verbs: + - '*' +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "glue-operator.fullname" . }}-all-access + labels: + {{- include "glue-operator.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "glue-operator.fullname" . }}-all-access +subjects: + - kind: ServiceAccount + name: {{ include "glue-operator.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end }} +{{- if .Values.rbac.bindView }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "glue-operator.fullname" . }}-view + namespace: {{ .Release.Namespace }} + labels: + {{- include "glue-operator.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: view +subjects: + - kind: ServiceAccount + name: {{ include "glue-operator.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end }} +{{- end }} diff --git a/helm/kubernetes-glue-operator/templates/service.yaml b/helm/kubernetes-glue-operator/templates/service.yaml new file mode 100644 index 0000000..34faccc --- /dev/null +++ b/helm/kubernetes-glue-operator/templates/service.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "glue-operator.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "glue-operator.labels" . | nindent 4 }} +spec: + type: {{ .Values.service.type }} + ports: + - name: http + port: {{ .Values.service.port }} + targetPort: {{ .Values.service.targetPort }} + protocol: TCP + selector: + {{- include "glue-operator.selectorLabels" . | nindent 4 }} diff --git a/helm/kubernetes-glue-operator/templates/serviceaccount.yaml b/helm/kubernetes-glue-operator/templates/serviceaccount.yaml new file mode 100644 index 0000000..b1401a3 --- /dev/null +++ b/helm/kubernetes-glue-operator/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "glue-operator.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "glue-operator.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/helm/kubernetes-glue-operator/values.yaml b/helm/kubernetes-glue-operator/values.yaml new file mode 100644 index 0000000..00db59b --- /dev/null +++ b/helm/kubernetes-glue-operator/values.yaml @@ -0,0 +1,84 @@ +# Default values for the kubernetes-glue-operator chart. + +replicaCount: 1 + +image: + repository: ghcr.io/java-operator-sdk/kubernetes-glue-operator + pullPolicy: IfNotPresent + # Image tag. Defaults to the chart appVersion when left empty. + tag: "" + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + # Create a ServiceAccount for the operator. + create: true + annotations: {} + # If not set and create is true, a name is generated from the fullname template. + name: "" + +# Namespaces the operator watches. Empty list means all namespaces (cluster-wide). +watchNamespaces: [] + +rbac: + # Create RBAC resources (ClusterRoles and bindings) for the operator. + create: true + # A Glue/GlueOperator can manage arbitrary resource types, so by default the + # operator is granted cluster-wide access to all resources. Set to false to + # supply your own least-privilege ClusterRole/binding instead (see + # extraClusterRoleRules / bindExistingClusterRole below). + allAccess: true + # Extra rules added to the operator's ClusterRole. Useful when allAccess is + # false to scope access to only the resource types your Glues manage. + extraRules: [] + # Bind the operator's ServiceAccount to the built-in "view" ClusterRole in the + # release namespace (matches the operator's generated manifests). + bindView: true + +service: + type: ClusterIP + port: 80 + targetPort: 8080 + +# Container resource requests/limits. +resources: {} + +# Probes hit the Quarkus health endpoints. Set any to null/{} to disable. +livenessProbe: + httpGet: + path: /q/health/live + port: 8080 + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 10 + failureThreshold: 3 +readinessProbe: + httpGet: + path: /q/health/ready + port: 8080 + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 10 + failureThreshold: 3 +startupProbe: + httpGet: + path: /q/health/started + port: 8080 + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 10 + failureThreshold: 3 + +# Extra environment variables for the operator container. +extraEnv: [] + +podAnnotations: {} +podLabels: {} +podSecurityContext: {} +securityContext: {} +nodeSelector: {} +tolerations: [] +affinity: {} +terminationGracePeriodSeconds: 10