From d29aa9a1b3915d0e32abf09c937e36b64f4dce7d Mon Sep 17 00:00:00 2001 From: Fabricio Aguiar Date: Thu, 1 Oct 2026 14:20:14 +0100 Subject: [PATCH] refactor(helm): prepare object-controller deployment resources Prepare the deployment, certificates, service, network policy, disruption budget, metrics monitor, and values. The activation guard keeps generated installations unchanged until the reconciliation cutover. Refs: OPRUN-4775 Signed-off-by: Fabricio Aguiar rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED --- ...te-olmv1-system-object-controller-cert.yml | 25 ++++ ...m-object-controller-controller-manager.yml | 122 ++++++++++++++++++ ...m-object-controller-controller-manager.yml | 27 ++++ ...nbudget-olmv1-system-object-controller.yml | 22 ++++ ...olmv1-system-object-controller-service.yml | 23 ++++ ...stem-object-controller-metrics-monitor.yml | 34 +++++ helm/olmv1/values.yaml | 15 ++- 7 files changed, 264 insertions(+), 4 deletions(-) create mode 100644 helm/olmv1/templates/cert-manager/certificate-olmv1-system-object-controller-cert.yml create mode 100644 helm/olmv1/templates/deployment-olmv1-system-object-controller-controller-manager.yml create mode 100644 helm/olmv1/templates/networkpolicy/networkpolicy-olmv1-system-object-controller-controller-manager.yml create mode 100644 helm/olmv1/templates/poddisruptionbudget-olmv1-system-object-controller.yml create mode 100644 helm/olmv1/templates/service-olmv1-system-object-controller-service.yml create mode 100644 helm/olmv1/templates/servicemonitor-olmv1-system-object-controller-metrics-monitor.yml diff --git a/helm/olmv1/templates/cert-manager/certificate-olmv1-system-object-controller-cert.yml b/helm/olmv1/templates/cert-manager/certificate-olmv1-system-object-controller-cert.yml new file mode 100644 index 0000000000..576004cf35 --- /dev/null +++ b/helm/olmv1/templates/cert-manager/certificate-olmv1-system-object-controller-cert.yml @@ -0,0 +1,25 @@ +{{- if and (include "objectController.enabled" .) .Values.options.certManager.enabled }} +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + annotations: + {{- include "olmv1.annotations" . | nindent 4 }} + labels: + app.kubernetes.io/name: {{ include "olmv1.label.name" . }} + {{- include "olmv1.labels" . | nindent 4 }} + name: object-controller-cert + namespace: {{ .Values.namespaces.olmv1.name }} +spec: + dnsNames: + - object-controller-service.{{ .Values.namespaces.olmv1.name }}.svc + - object-controller-service.{{ .Values.namespaces.olmv1.name }}.svc.cluster.local + issuerRef: + group: cert-manager.io + kind: ClusterIssuer + name: olmv1-ca + privateKey: + algorithm: ECDSA + rotationPolicy: Always + size: 256 + secretName: object-controller-cert +{{- end }} diff --git a/helm/olmv1/templates/deployment-olmv1-system-object-controller-controller-manager.yml b/helm/olmv1/templates/deployment-olmv1-system-object-controller-controller-manager.yml new file mode 100644 index 0000000000..aa818dc5cc --- /dev/null +++ b/helm/olmv1/templates/deployment-olmv1-system-object-controller-controller-manager.yml @@ -0,0 +1,122 @@ +{{- if include "objectController.enabled" . }} +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + kubectl.kubernetes.io/default-logs-container: manager + {{- include "olmv1.annotations" . | nindent 4 }} + labels: + app.kubernetes.io/name: object-controller + {{- include "olmv1.labels" . | nindent 4 }} + name: object-controller-controller-manager + namespace: {{ .Values.namespaces.olmv1.name }} +spec: + replicas: {{ .Values.options.objectController.deployment.replicas }} + strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 1 + maxUnavailable: 0 + selector: + matchLabels: + control-plane: object-controller-controller-manager + template: + metadata: + annotations: + kubectl.kubernetes.io/default-container: manager + {{- include "olmv1.annotations" . | nindent 8 }} + {{- if .Values.options.openshift.enabled }} + target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}' + openshift.io/required-scc: privileged + {{- end }} + labels: + app.kubernetes.io/name: object-controller + control-plane: object-controller-controller-manager + {{- include "olmv1.labels" . | nindent 8 }} + {{- with .Values.options.objectController.deployment.podLabels }} + {{- toYamlPretty . | nindent 8 }} + {{- end }} + spec: + containers: + - name: manager + command: + - /object-controller + args: + - --health-probe-bind-address=:8081 + {{- if not .Values.options.tilt.enabled }} + - --leader-elect + {{- end }} + {{- if .Values.options.profiling.enabled }} + - --pprof-bind-address=:6060 + {{- end }} + {{- if or .Values.options.certManager.enabled .Values.options.openshift.enabled }} + - --metrics-bind-address=:8443 + - --tls-cert=/var/certs/tls.crt + - --tls-key=/var/certs/tls.key + {{- end }} + {{- if .Values.options.openshift.enabled }} + - --v=${LOG_VERBOSITY} + {{- end }} + {{- if .Values.options.e2e.enabled }} + - --tls-profile=modern + {{- end }} + {{- range .Values.options.objectController.deployment.extraArguments }} + - {{ . }} + {{- end }} + image: "{{ .Values.options.objectController.deployment.image }}" + {{- if .Values.options.e2e.enabled }} + env: + - name: GOCOVERDIR + value: /e2e-coverage + {{- end }} + {{- if not .Values.options.tilt.enabled }} + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + {{- end }} + resources: + requests: + cpu: 10m + memory: 64Mi + {{- if or .Values.options.certManager.enabled .Values.options.openshift.enabled .Values.options.e2e.enabled }} + volumeMounts: + {{- if or .Values.options.certManager.enabled .Values.options.openshift.enabled }} + - name: object-controller-certs + mountPath: /var/certs + readOnly: true + {{- end }} + {{- if .Values.options.e2e.enabled }} + - name: e2e-coverage-volume + mountPath: /e2e-coverage + {{- end }} + {{- end }} + {{- with .Values.deployments.containerSpec }} + {{- toYaml . | nindent 10 }} + {{- end }} + serviceAccountName: object-controller-controller-manager + {{- if or .Values.options.certManager.enabled .Values.options.openshift.enabled .Values.options.e2e.enabled }} + volumes: + {{- if or .Values.options.certManager.enabled .Values.options.openshift.enabled }} + - name: object-controller-certs + secret: + secretName: object-controller-cert + {{- end }} + {{- if .Values.options.e2e.enabled }} + - name: e2e-coverage-volume + persistentVolumeClaim: + claimName: e2e-coverage + {{- end }} + {{- end }} + {{- with .Values.deployments.templateSpec }} + {{- toYamlPretty . | nindent 6 }} + {{- end }} +{{- end }} diff --git a/helm/olmv1/templates/networkpolicy/networkpolicy-olmv1-system-object-controller-controller-manager.yml b/helm/olmv1/templates/networkpolicy/networkpolicy-olmv1-system-object-controller-controller-manager.yml new file mode 100644 index 0000000000..707c23e542 --- /dev/null +++ b/helm/olmv1/templates/networkpolicy/networkpolicy-olmv1-system-object-controller-controller-manager.yml @@ -0,0 +1,27 @@ +{{- if include "objectController.enabled" . }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + annotations: + {{- include "olmv1.annotations" . | nindent 4 }} + labels: + app.kubernetes.io/name: object-controller + {{- include "olmv1.labels" . | nindent 4 }} + name: object-controller-controller-manager + namespace: {{ .Values.namespaces.olmv1.name }} +spec: + egress: + - {} + {{- if or .Values.options.certManager.enabled .Values.options.openshift.enabled }} + ingress: + - ports: + - port: 8443 + protocol: TCP + {{- end }} + podSelector: + matchLabels: + control-plane: object-controller-controller-manager + policyTypes: + - Ingress + - Egress +{{- end }} diff --git a/helm/olmv1/templates/poddisruptionbudget-olmv1-system-object-controller.yml b/helm/olmv1/templates/poddisruptionbudget-olmv1-system-object-controller.yml new file mode 100644 index 0000000000..ee9a2d0702 --- /dev/null +++ b/helm/olmv1/templates/poddisruptionbudget-olmv1-system-object-controller.yml @@ -0,0 +1,22 @@ +{{- if and (include "objectController.enabled" .) .Values.options.objectController.podDisruptionBudget.enabled }} +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: object-controller-controller-manager + namespace: {{ .Values.namespaces.olmv1.name }} + labels: + app.kubernetes.io/name: object-controller + {{- include "olmv1.labels" . | nindent 4 }} + annotations: + {{- include "olmv1.annotations" . | nindent 4 }} +spec: + {{- if ne (toJson .Values.options.objectController.podDisruptionBudget.maxUnavailable) "null" }} + maxUnavailable: {{ .Values.options.objectController.podDisruptionBudget.maxUnavailable }} + {{- else if ne (toJson .Values.options.objectController.podDisruptionBudget.minAvailable) "null" }} + minAvailable: {{ .Values.options.objectController.podDisruptionBudget.minAvailable }} + {{- end }} + unhealthyPodEvictionPolicy: AlwaysAllow + selector: + matchLabels: + control-plane: object-controller-controller-manager +{{- end }} diff --git a/helm/olmv1/templates/service-olmv1-system-object-controller-service.yml b/helm/olmv1/templates/service-olmv1-system-object-controller-service.yml new file mode 100644 index 0000000000..6c3b56ec2f --- /dev/null +++ b/helm/olmv1/templates/service-olmv1-system-object-controller-service.yml @@ -0,0 +1,23 @@ +{{- if include "objectController.enabled" . }} +apiVersion: v1 +kind: Service +metadata: + annotations: + {{- include "olmv1.annotations" . | nindent 4 }} + {{- if .Values.options.openshift.enabled }} + service.beta.openshift.io/serving-cert-secret-name: object-controller-cert + {{- end }} + labels: + app.kubernetes.io/name: object-controller + {{- include "olmv1.labels" . | nindent 4 }} + name: object-controller-service + namespace: {{ .Values.namespaces.olmv1.name }} +spec: + ports: + - name: metrics + port: 8443 + protocol: TCP + targetPort: 8443 + selector: + app.kubernetes.io/name: object-controller +{{- end }} diff --git a/helm/olmv1/templates/servicemonitor-olmv1-system-object-controller-metrics-monitor.yml b/helm/olmv1/templates/servicemonitor-olmv1-system-object-controller-metrics-monitor.yml new file mode 100644 index 0000000000..ddaf02bb2b --- /dev/null +++ b/helm/olmv1/templates/servicemonitor-olmv1-system-object-controller-metrics-monitor.yml @@ -0,0 +1,34 @@ +{{- if .Values.options.openshift.enabled -}} +{{- if include "objectController.enabled" . -}} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + annotations: + {{- include "olmv1.annotations" . | nindent 4 }} + labels: + openshift.io/cluster-monitoring: 'true' + app.kubernetes.io/name: object-controller + {{- include "olmv1.labels" . | nindent 4 }} + name: object-controller-metrics-monitor + namespace: {{ .Values.namespaces.olmv1.name }} +spec: + endpoints: + - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token + interval: 30s + path: /metrics + port: metrics + scheme: https + tlsConfig: + caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt + certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt + keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key + serverName: object-controller-service.{{ .Values.namespaces.olmv1.name }}.svc + namespaceSelector: + matchNames: + - {{ .Values.namespaces.olmv1.name }} + selector: + matchLabels: + app.kubernetes.io/name: object-controller + serviceDiscoveryRole: EndpointSlice +{{- end -}} +{{- end -}} diff --git a/helm/olmv1/values.yaml b/helm/olmv1/values.yaml index fda0bdc900..ac491762f7 100644 --- a/helm/olmv1/values.yaml +++ b/helm/olmv1/values.yaml @@ -1,9 +1,18 @@ # Default values for OLMv1. # This is a YAML-formatted file. # Declare variables to be passed into your templates. - # List of components to include options: + objectController: + # Activation is reserved until the deployment and reconciliation cutover. + enabled: null + deployment: + image: quay.io/operator-framework/object-controller:devel + replicas: 1 + extraArguments: [] + podDisruptionBudget: + enabled: true + minAvailable: 1 operatorController: enabled: true deployment: @@ -49,15 +58,13 @@ options: version: v4.20 # This can be one of: standard or experimental featureSet: standard - # The set of namespaces namespaces: olmv1: name: olmv1-system certManager: name: cert-manager - -# Common deployment values for operator-controller and catalogd +# Common deployment values for all controllers deployments: templateSpec: affinity: