feat: Enable controller manager

.gitignore

@@ -26,3 +26,4 @@ dist/
 
 *.tar.gz
 *.tar
+capd-kubeconfig

charts/capi-runtime-extensions/README.md

@@ -26,9 +26,11 @@ A Helm chart for capi-runtime-extensions
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
 | addons.provider | string | `"ClusterResourceSet"` |  |
-| certificate.issuer.kind | string | `"Issuer"` |  |
-| certificate.issuer.name | string | `""` |  |
-| certificate.issuer.selfSigned | bool | `true` |  |
+| certificates.issuer.kind | string | `"Issuer"` |  |
+| certificates.issuer.name | string | `""` |  |
+| certificates.issuer.selfSigned | bool | `true` |  |
+| controllers.enableLeaderElection | bool | `false` |  |
+| deployment.replicas | int | `1` |  |
 | env | object | `{}` |  |
 | image.pullPolicy | string | `"IfNotPresent"` |  |
 | image.repository | string | `"ghcr.io/d2iq-labs/capi-runtime-extensions"` |  |

charts/capi-runtime-extensions/templates/_helpers.tpl

@@ -38,13 +38,13 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 Certificate issuer name
 */}}
 {{- define "chart.issuerName" -}}
-{{- if .Values.certificate.issuer.selfSigned -}}
-{{- if .Values.certificate.issuer.name -}}
-{{ .Values.certificate.issuer.name }}
+{{- if .Values.certificates.issuer.selfSigned -}}
+{{- if .Values.certificates.issuer.name -}}
+{{ .Values.certificates.issuer.name }}
 {{- else -}}
 {{ template "chart.name" . }}-issuer
 {{- end -}}
 {{- else -}}
-{{ required "A valid .Values.certificates.issuer.name is required!" .Values.certificate.issuer.name }}
+{{ required "A valid .Values.certificates.issuer.name is required!" .Values.certificates.issuer.name }}
 {{- end -}}
 {{- end -}}

charts/capi-runtime-extensions/templates/certificates.yaml

@@ -0,0 +1,34 @@
+# Copyright 2023 D2iQ, Inc. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ template "chart.name" . }}-runtimehooks-tls
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "chart.labels" . | nindent 4 }}
+spec:
+  dnsNames:
+    - {{ template "chart.name" . }}-runtimehooks.{{ .Release.Namespace }}.svc
+    - {{ template "chart.name" . }}-runtimehooks.{{ .Release.Namespace }}.svc.cluster.local
+  issuerRef:
+    kind: {{ .Values.certificates.issuer.kind }}
+    name: {{ template "chart.issuerName" . }}
+  secretName: {{ template "chart.name" . }}-runtimehooks-tls
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ template "chart.name" . }}-controllers-tls
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "chart.labels" . | nindent 4 }}
+spec:
+  dnsNames:
+    - {{ template "chart.name" . }}-controllers.{{ .Release.Namespace }}.svc
+    - {{ template "chart.name" . }}-controllers.{{ .Release.Namespace }}.svc.cluster.local
+  issuerRef:
+    kind: {{ .Values.certificates.issuer.kind }}
+    name: {{ template "chart.issuerName" . }}
+  secretName: {{ template "chart.name" . }}-controllers-tls

charts/capi-runtime-extensions/templates/clusterrolebinding.yaml

@@ -10,7 +10,7 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: {{ include "chart.name" . }}
+  name: {{ include "chart.name" . }}-manager-role
 subjects:
 - kind: ServiceAccount
   name: {{ include "chart.name" . }}

charts/capi-runtime-extensions/templates/deployment.yaml

@@ -8,7 +8,7 @@ metadata:
   name: {{ template "chart.name" . }}
   namespace: {{ .Release.Namespace }}
 spec:
-  replicas: 1
+  replicas: {{ .Values.deployment.replicas}}
   selector:
     matchLabels:
       {{- include "chart.selectorLabels" . | nindent 6 }}
@@ -35,39 +35,57 @@ spec:
 {{- end }}
 {{- end }}
         args:
-        - --webhook-cert-dir=/certs/
-        - --addon-provider={{ .Values.addons.provider }}
+        - --controllermanager.cert-dir=/controllers-certs/
+        - --controllermanager.leader-elect={{ if gt (.Values.deployment.replicas | int) 1 }}true{{ else }}{{ .Values.controllers.enableLeaderElection }}{{ end }}
+        - --runtimehooks.cert-dir=/runtimehooks-certs/
+        - --runtimehooks.addon-provider={{ .Values.addons.provider }}
         {{- range $key, $value := .Values.extraArgs }}
         - --{{ $key }}={{ $value }}
         {{- end }}
         ports:
+        - containerPort: 8443
+          name: controllers
+          protocol: TCP
         - containerPort: 9443
-          name: https
+          name: runtimehooks
+          protocol: TCP
+        - containerPort: 8080
+          name: metrics
+          protocol: TCP
+        - containerPort: 8081
+          name: probes
           protocol: TCP
         resources:
           {{ with .Values.resources }}
           {{- toYaml . | nindent 10 }}
           {{- end }}
         volumeMounts:
-        - mountPath: /certs
-          name: cert
+        - mountPath: /runtimehooks-certs
+          name: runtimehooks-cert
           readOnly: true
-        # livenessProbe:
-        #   httpGet:
-        #     port: 9443
-        #     scheme: HTTPS
-        #     path: /healthz
-        # readinessProbe:
-        #   httpGet:
-        #     port: 9443
-        #     scheme: HTTPS
-        #     path: /readyz
+        - mountPath: /controllers-certs
+          name: controllers-cert
+          readOnly: true
+        livenessProbe:
+          httpGet:
+            port: probes
+            scheme: HTTP
+            path: /healthz
+        readinessProbe:
+          httpGet:
+            port: probes
+            scheme: HTTP
+            path: /readyz
       securityContext:
         {{ with .Values.securityContext }}
         {{- toYaml . | nindent 8}}
         {{- end }}
       volumes:
-      - name: cert
+      - name: runtimehooks-cert
+        secret:
+          defaultMode: 420
+          secretName: {{ template "chart.name" . }}-runtimehooks-tls
+      - name: controllers-cert
         secret:
           defaultMode: 420
-          secretName: {{ template "chart.name" . }}-tls
+          secretName: {{ template "chart.name" . }}-controllers-tls

charts/capi-runtime-extensions/templates/extensionconfig.yaml

@@ -5,12 +5,12 @@ apiVersion: runtime.cluster.x-k8s.io/v1alpha1
 kind: ExtensionConfig
 metadata:
   annotations:
-    runtime.cluster.x-k8s.io/inject-ca-from-secret: {{ .Release.Namespace }}/{{ template "chart.name" . }}-tls
+    runtime.cluster.x-k8s.io/inject-ca-from-secret: {{ .Release.Namespace }}/{{ template "chart.name" . }}-runtimehooks-tls
   name: {{ template "chart.name" . }}
   namespace: {{ .Release.Namespace }}
 spec:
   clientConfig:
     service:
-      name: {{ template "chart.name" . }}
+      name: {{ template "chart.name" . }}-runtimehooks
       namespace: {{ .Release.Namespace }}
       port: {{ .Values.service.port }}

charts/capi-runtime-extensions/templates/issuer_selfsigned.yaml

@@ -1,9 +1,9 @@
 # Copyright 2023 D2iQ, Inc. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-{{- if .Values.certificate.issuer.selfSigned }}
+{{- if .Values.certificates.issuer.selfSigned }}
 apiVersion: cert-manager.io/v1
-kind: {{ .Values.certificate.issuer.kind }}
+kind: {{ .Values.certificates.issuer.kind }}
 metadata:
   name: {{ template "chart.issuerName" . }}
   namespace: {{ .Release.Namespace }}

charts/capi-runtime-extensions/templates/role.yaml

@@ -5,6 +5,40 @@ metadata:
   creationTimestamp: null
   name: capi-runtime-extensions-manager-role
 rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - namespaces
+  - secrets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - addons.cluster.x-k8s.io
+  resources:
+  - '*'
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - cluster.x-k8s.io
+  resources:
+  - clusters
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - clusteraddons.labs.d2iq.io
   resources:
@@ -34,3 +68,27 @@ rules:
   - get
   - patch
   - update
+- apiGroups:
+  - helm.toolkit.fluxcd.io
+  resources:
+  - helmreleases
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - source.toolkit.fluxcd.io
+  resources:
+  - helmrepositories
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch

charts/capi-runtime-extensions/templates/service.yaml

@@ -10,15 +10,15 @@ metadata:
     {{- end }}
   labels:
     {{- include "chart.labels" . | nindent 4 }}
-  name: {{ template "chart.name" . }}
+  name: {{ template "chart.name" . }}-runtimehooks
   namespace: {{ .Release.Namespace }}
 spec:
   type: {{.Values.service.type}}
   ports:
   - name: https
     port: {{ .Values.service.port }}
     protocol: TCP
-    targetPort: https
+    targetPort: runtimehooks
     {{- if and .Values.service.nodePort (eq "NodePort" .Values.service.type) }}
     nodePort: {{ .Values.service.nodePort }}
     {{- end }}

charts/capi-runtime-extensions/values.schema.json

@@ -11,7 +11,7 @@
                 }
             }
         },
-        "certificate": {
+        "certificates": {
             "type": "object",
             "properties": {
                 "issuer": {
@@ -32,6 +32,23 @@
                 }
             }
         },
+        "controllers": {
+            "type": "object",
+            "properties": {
+                "enableLeaderElection": {
+                    "type": "boolean"
+                }
+            }
+        },
+        "deployment": {
+            "type": "object",
+            "properties": {
+                "replicas": {
+                    "type": "integer",
+                    "minimum": 0
+                }
+            }
+        },
         "env": {
             "type": "object"
         },

charts/capi-runtime-extensions/values.yaml

@@ -1,9 +1,15 @@
 # Copyright 2023 D2iQ, Inc. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 
+deployment:
+  replicas: 1
+
 addons:
   provider: ClusterResourceSet
 
+controllers:
+  enableLeaderElection: false
+
 image:
   repository: ghcr.io/d2iq-labs/capi-runtime-extensions
   tag: ""
@@ -13,7 +19,7 @@ image:
 imagePullSecrets: []
 #- name: Secret with Registry credentials
 
-certificate:
+certificates:
   issuer:
     selfSigned: true
     name: ""