Skip to content

Commit fe5f620

Browse files
flavioflavio
authored
Merge pull request #1802 from kubewarden/default-resource-applier-chart-consolidation
feat!: admission controller Helm chart consolidation
2 parents 531d446 + 319456a commit fe5f620

102 files changed

Lines changed: 2613 additions & 5168 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/ci.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -424,8 +424,6 @@ jobs:
424424
# Disable plugin verification until the following issue is addressed https://github.com/helm-unittest/helm-unittest/issues/777
425425
- name: Install Helm-unittest
426426
run: helm plugin install https://github.com/helm-unittest/helm-unittest --verify=false
427-
- name: Verify common values
428-
run: make charts-check-common-values
429427
- name: helm unit tests
430428
run: make helm-unittest
431429

‎Makefile‎

Lines changed: 7 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
CONTROLLER_TOOLS_VERSION := v0.18.0
22
ENVTEST_VERSION := release-0.19
33
ENVTEST_K8S_VERSION := 1.31.0
4-
HELM_VALUES_SCHEMA_JSON_VERSION := v2.3.1
4+
HELM_VALUES_SCHEMA_JSON_VERSION := v2.4.0
55

66
CONTROLLER_GEN ?= go run sigs.k8s.io/controller-tools/cmd/controller-gen@$(CONTROLLER_TOOLS_VERSION)
77
ENVTEST ?= go run sigs.k8s.io/controller-runtime/tools/setup-envtest@$(ENVTEST_VERSION)
@@ -46,9 +46,7 @@ test-rust:
4646

4747
.PHONY: helm-unittest
4848
helm-unittest:
49-
helm unittest charts/kubewarden-crds --file "tests/**/*_test.yaml"
5049
helm unittest charts/kubewarden-controller --file "tests/**/*_test.yaml"
51-
helm unittest charts/kubewarden-defaults --file "tests/**/*_test.yaml"
5250

5351
.PHONY: test-e2e
5452
test-e2e: controller-image audit-scanner-image policy-server-image
@@ -166,13 +164,13 @@ manifests: ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefin
166164
$(GO_BUILD_ENV) $(CONTROLLER_GEN) rbac:roleName=kubewarden-controller-manager,fileName=controller-rbac-roles.yaml crd webhook \
167165
paths="./api/policies/v1" paths="./api/policies/v1alpha2" \
168166
paths="./internal/controller" paths="./cmd/controller" \
169-
output:crd:artifacts:config=charts/kubewarden-crds/templates/crds \
170-
output:rbac:artifacts:config=charts/kubewarden-controller/templates \
167+
output:crd:artifacts:config=charts/kubewarden-controller/templates/crds \
168+
output:rbac:artifacts:config=charts/kubewarden-controller/templates/controller \
171169
output:webhook:artifacts:config=charts
172170
echo "# to be merged manually into kubewarden-controller/templates/webhooks.yaml" | cat - charts/manifests.yaml > temp && mv temp charts/manifests.yaml
173171
mv charts/manifests.yaml charts/generated-webhooks-manifests.yaml
174-
sed -i '/^metadata:/a\ labels:\n {{- include "kubewarden-controller.labels" . | nindent 4 }}\n annotations:\n {{- include "kubewarden-controller.annotations" . | nindent 4 }}' charts/kubewarden-controller/templates/controller-rbac-roles.yaml
175-
sed -i 's/ namespace: kubewarden/ namespace: {{ .Release.Namespace }}/' charts/kubewarden-controller/templates/controller-rbac-roles.yaml
172+
sed -i '/^metadata:/a\ labels:\n {{- include "adm-controller.labels" . | nindent 4 }}\n annotations:\n {{- include "adm-controller.annotations" . | nindent 4 }}' charts/kubewarden-controller/templates/controller/controller-rbac-roles.yaml
173+
sed -i 's/ namespace: kubewarden/ namespace: {{ .Release.Namespace }}/' charts/kubewarden-controller/templates/controller/controller-rbac-roles.yaml
176174

177175
.PHONY: generate-chart
178176
generate-chart: ## Generate Helm chart values schema.
@@ -182,17 +180,13 @@ generate-chart: ## Generate Helm chart values schema.
182180
check-generate: generate
183181
@./hack/check-for-auto-generated-changes.sh
184182

185-
.PHONY: charts-check-common-values
186-
charts-check-common-values:
187-
@./scripts/charts-check-common-values.sh
188-
189183
.PHONY: charts-generate-images-file
190184
charts-generate-images-file:
191-
@./scripts/charts-extract-images.sh ./charts
185+
@./scripts/charts-extract-images.sh ./charts/kubewarden-controller
192186

193187
.PHONY: charts-generate-policies-file
194188
charts-generate-policies-file:
195-
@./scripts/charts-extract-policies.sh ./charts
189+
@./scripts/charts-extract-policies.sh ./charts/kubewarden-controller
196190

197191
.PHONY: charts-generate-changelog-files
198192
charts-generate-changelog-files:

‎Tiltfile‎

Lines changed: 30 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,41 +1,25 @@
11
tilt_settings_file = "./tilt-settings.yaml"
22
settings = read_yaml(tilt_settings_file)
33

4-
update_settings(k8s_upsert_timeout_secs=300)
5-
64
# Create the kubewarden namespace
75
# This is required since the helm() function doesn't support the create_namespace flag
86
load("ext://namespace", "namespace_create")
97
namespace_create("kubewarden")
108

11-
# Install the CRDs Helm chart first
12-
crds_yaml = helm(
13-
"./charts/kubewarden-crds",
14-
name="kubewarden-crds",
15-
namespace="kubewarden",
16-
)
17-
k8s_yaml(crds_yaml)
18-
19-
# Group all CRDs under a single resource name for dependency tracking
20-
k8s_resource(
21-
new_name='kubewarden-crds',
22-
objects=[
23-
'policyservers.policies.kubewarden.io:CustomResourceDefinition',
24-
'admissionpolicies.policies.kubewarden.io:CustomResourceDefinition',
25-
'clusteradmissionpolicies.policies.kubewarden.io:CustomResourceDefinition',
26-
'admissionpolicygroups.policies.kubewarden.io:CustomResourceDefinition',
27-
'clusteradmissionpolicygroups.policies.kubewarden.io:CustomResourceDefinition',
28-
],
29-
)
30-
9+
# Install the unified Kubewarden admission controller chart
3110
registry = settings.get("registry")
3211
controller_image = settings.get("controller").get("image")
3312
audit_scanner_image = settings.get("audit-scanner").get("image")
3413
policy_server_image = settings.get("policy-server").get("image")
3514

36-
kubewarden_controller_yaml = helm(
15+
update_settings(
16+
k8s_upsert_timeout_secs=300,
17+
suppress_unused_image_warnings=[registry + "/" + policy_server_image],
18+
)
19+
20+
kubewarden_yaml = helm(
3721
"./charts/kubewarden-controller",
38-
name="kubewarden-controller",
22+
name="kubewarden",
3923
namespace="kubewarden",
4024
set=[
4125
"global.cattle.systemDefaultRegistry=null",
@@ -45,35 +29,33 @@ kubewarden_controller_yaml = helm(
4529
"podSecurityContext=null",
4630
"containerSecurityContext=null",
4731
"auditScanner.image.repository=" + registry + "/" + audit_scanner_image,
48-
"auditScanner.logLevel=debug",
32+
"auditScanner.logLevel=debug",
33+
"policyServer.enabled=true",
34+
"policyServer.image.repository=" + registry + "/" + policy_server_image,
35+
"policyServer.env[0].name=KUBEWARDEN_LOG_LEVEL",
36+
"policyServer.env[0].value=debug",
37+
"recommendedPolicies.defaultPoliciesRegistry=" + registry,
4938
],
5039
)
51-
k8s_yaml(kubewarden_controller_yaml)
40+
k8s_yaml(kubewarden_yaml)
5241

53-
# Wait for kubewarden-controller deployment to be ready before applying defaults
54-
# This ensures the webhook is running before PolicyServer resources are created
42+
# Group all CRDs under a single resource name for dependency tracking
5543
k8s_resource(
56-
'kubewarden-controller:deployment',
57-
new_name='kubewarden-controller',
58-
resource_deps=['kubewarden-crds'],
59-
)
60-
61-
kubewarden_defaults_yaml = helm(
62-
"./charts/kubewarden-defaults",
63-
name="kubewarden-defaults",
64-
namespace="kubewarden",
65-
set=[
66-
"global.cattle.systemDefaultRegistry=null",
67-
"policyServer.image.repository=" + registry + "/" + policy_server_image,
68-
"policyServer.env[0].name=KUBEWARDEN_LOG_LEVEL",
69-
"policyServer.env[0].value=debug",
44+
new_name='kubewarden-crds',
45+
objects=[
46+
'policyservers.policies.kubewarden.io:CustomResourceDefinition',
47+
'admissionpolicies.policies.kubewarden.io:CustomResourceDefinition',
48+
'clusteradmissionpolicies.policies.kubewarden.io:CustomResourceDefinition',
49+
'admissionpolicygroups.policies.kubewarden.io:CustomResourceDefinition',
50+
'clusteradmissionpolicygroups.policies.kubewarden.io:CustomResourceDefinition',
7051
],
7152
)
72-
k8s_yaml(kubewarden_defaults_yaml)
7353

54+
# Wait for controller deployment to be ready
7455
k8s_resource(
75-
'default',
76-
resource_deps=['kubewarden-controller', 'policy_server_tilt'],
56+
'kubewarden-kubewarden-controller',
57+
new_name='kubewarden-controller',
58+
resource_deps=['kubewarden-crds'],
7759
)
7860

7961
# Tell tilt about the image used by the PolicyServer CRD
@@ -174,10 +156,11 @@ docker_build(
174156
)
175157

176158
# Trigger PolicyServer pod restart by updating annotations when image changes
177-
# Runs automatically whenever the policy-server image is rebuilt
159+
# The default PolicyServer is created by the controller from the defaults ConfigMap,
160+
# so we depend on the controller being ready before patching.
178161
local_resource(
179162
"restart_policy_server",
180163
"kubectl get policyserver default >/dev/null 2>&1 && kubectl patch policyserver default --type=merge -p '{\"spec\":{\"annotations\":{\"restart\":\"'$(date +%s)'\"}}}' || true",
181-
resource_deps=["default"],
164+
resource_deps=["kubewarden-controller"],
182165
trigger_mode=TRIGGER_MODE_AUTO,
183166
)

‎api/policies/v1/admissionpolicy_types.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ type AdmissionPolicySpec struct {
3232
// +kubebuilder:subresource:status
3333
// +kubebuilder:resource:scope=Namespaced,shortName=ap
3434
// +kubebuilder:storageversion
35+
// +kubebuilder:metadata:annotations="helm.sh/resource-policy=keep"
3536
// +kubebuilder:printcolumn:name="Policy Server",type=string,JSONPath=`.spec.policyServer`,description="Bound to Policy Server"
3637
// +kubebuilder:printcolumn:name="Mutating",type=boolean,JSONPath=`.spec.mutating`,description="Whether the policy is mutating"
3738
// +kubebuilder:printcolumn:name="BackgroundAudit",type=boolean,JSONPath=`.spec.backgroundAudit`,description="Whether the policy is used in audit checks"

‎api/policies/v1/admissionpolicygroup_types.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ type AdmissionPolicyGroupSpec struct {
3232
// +kubebuilder:subresource:status
3333
// +kubebuilder:resource:scope=Namespaced,shortName=apg
3434
// +kubebuilder:storageversion
35+
// +kubebuilder:metadata:annotations="helm.sh/resource-policy=keep"
3536
// +kubebuilder:printcolumn:name="Policy Server",type=string,JSONPath=`.spec.policyServer`,description="Bound to Policy Server"
3637
// +kubebuilder:printcolumn:name="Mutating",type=boolean,JSONPath=`.spec.mutating`,description="Whether the policy is mutating"
3738
// +kubebuilder:printcolumn:name="BackgroundAudit",type=boolean,JSONPath=`.spec.backgroundAudit`,description="Whether the policy is used in audit checks"

‎api/policies/v1/clusteradmissionpolicy_types.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,7 @@ type ClusterAdmissionPolicySpec struct {
106106
// +kubebuilder:subresource:status
107107
// +kubebuilder:resource:scope=Cluster,shortName=cap
108108
// +kubebuilder:storageversion
109+
// +kubebuilder:metadata:annotations="helm.sh/resource-policy=keep"
109110
// +kubebuilder:printcolumn:name="Policy Server",type=string,JSONPath=`.spec.policyServer`,description="Bound to Policy Server"
110111
// +kubebuilder:printcolumn:name="Mutating",type=boolean,JSONPath=`.spec.mutating`,description="Whether the policy is mutating"
111112
// +kubebuilder:printcolumn:name="BackgroundAudit",type=boolean,JSONPath=`.spec.backgroundAudit`,description="Whether the policy is used in audit checks"

‎api/policies/v1/clusteradmissionpolicygroup_types.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,7 @@ type ClusterAdmissionPolicyGroupSpec struct {
101101
// +kubebuilder:subresource:status
102102
// +kubebuilder:resource:scope=Cluster,shortName=capg
103103
// +kubebuilder:storageversion
104+
// +kubebuilder:metadata:annotations="helm.sh/resource-policy=keep"
104105
// +kubebuilder:printcolumn:name="Policy Server",type=string,JSONPath=`.spec.policyServer`,description="Bound to Policy Server"
105106
// +kubebuilder:printcolumn:name="Mutating",type=boolean,JSONPath=`.spec.mutating`,description="Whether the policy is mutating"
106107
// +kubebuilder:printcolumn:name="BackgroundAudit",type=boolean,JSONPath=`.spec.backgroundAudit`,description="Whether the policy is used in audit checks"

‎api/policies/v1/policyserver_types.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -255,6 +255,7 @@ type PolicyServerStatus struct {
255255
//+kubebuilder:printcolumn:name="Replicas",type=string,JSONPath=`.spec.replicas`,description="Policy Server replicas"
256256
//+kubebuilder:printcolumn:name="Image",type=string,JSONPath=`.spec.image`,description="Policy Server image"
257257
//+kubebuilder:storageversion
258+
//+kubebuilder:metadata:annotations="helm.sh/resource-policy=keep"
258259

259260
// PolicyServer is the Schema for the policyservers API.
260261
type PolicyServer struct {

‎charts/common-values.yaml‎

Lines changed: 0 additions & 104 deletions
This file was deleted.

‎charts/hauler_manifest.yaml‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -56,15 +56,9 @@ metadata:
5656
name: kubewarden-helm-charts
5757
spec:
5858
charts:
59-
- name: kubewarden-crds
60-
repoURL: https://charts.kubewarden.io
61-
version: 1.28.0
6259
- name: kubewarden-controller
6360
repoURL: https://charts.kubewarden.io
64-
version: 5.14.0
65-
- name: kubewarden-defaults
66-
repoURL: https://charts.kubewarden.io
67-
version: 3.14.0
61+
version: 6.0.0-alpha.1
6862
- name: policy-reporter
6963
version: 3.7.4
7064
repoURL: https://kyverno.github.io/policy-reporter

0 commit comments

Comments
 (0)