From ff68c7b17da9239e220376fa25ab65a5de6330e5 Mon Sep 17 00:00:00 2001 From: Silvia Tarabova Date: Fri, 21 Aug 2026 09:21:05 +0200 Subject: [PATCH] refactor: add chart for extensions Signed-off-by: Silvia Tarabova --- .gitignore | 1 + README.md | 18 +- charts/kuadrant-extensions/.helmignore | 26 +++ charts/kuadrant-extensions/Chart.yaml | 23 +++ .../01-kuadrant-extensions-namespace.yaml | 6 + .../templates/02-extensionCRD.yaml} | 2 +- .../templates/02-extensions-rbac.yaml | 68 +++++++ .../templates/03-extensions-deployment.yaml | 56 ++++++ charts/kuadrant-extensions/values.yaml | 1 + .../kuadrant/08-extensions-patch.yaml | 189 ------------------ ...anifests.yaml => example-extensionCRD.yaml | 50 +---- install.sh | 12 +- uninstall.sh | 2 + values.yaml | 18 +- 14 files changed, 229 insertions(+), 243 deletions(-) create mode 100644 charts/kuadrant-extensions/.helmignore create mode 100644 charts/kuadrant-extensions/Chart.yaml create mode 100644 charts/kuadrant-extensions/templates/01-kuadrant-extensions-namespace.yaml rename charts/{kuadrant-operators/templates/kuadrant/02a-extensionsManifests.yaml => kuadrant-extensions/templates/02-extensionCRD.yaml} (69%) create mode 100644 charts/kuadrant-extensions/templates/02-extensions-rbac.yaml create mode 100644 charts/kuadrant-extensions/templates/03-extensions-deployment.yaml create mode 120000 charts/kuadrant-extensions/values.yaml delete mode 100644 charts/kuadrant-operators/templates/kuadrant/08-extensions-patch.yaml rename example-extensionsManifests.yaml => example-extensionCRD.yaml (91%) diff --git a/.gitignore b/.gitignore index d3f0f0a..53e6c05 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,6 @@ additionalManifests.yaml extensionsManifests.yaml +extensionCRD.yaml .idea # macOS system files diff --git a/README.md b/README.md index 150faac..5efc6dc 100644 --- a/README.md +++ b/README.md @@ -64,6 +64,15 @@ and makes Helm consume additional values from additionalManifests.yaml and insta If you want to install just tools use `./tools-install.sh`. Add `-k` option to install on Kind. +## Standalone Kuadrant extensions + +Standalone Kuadrant extensions (e.g. `pipeline-policy`) are deployed by their own `charts/kuadrant-extensions` chart, +installed as a separate Helm release. + +Extensions are automatically installed by `./install.sh` when `kuadrant.extensionsImage` is set in +[values.yaml](./values.yaml) and an `extensionCRD.yaml` file exists (see +[example-extensionCRD.yaml](./example-extensionCRD.yaml)). Extensions are only supported on Kuadrant v1.6+ / RHCL v1.5+. + ## Manual helm If you do not want to use helper `./install.sh` (and `./uninstall.sh`) script: @@ -77,12 +86,17 @@ helm install --values values.yaml --wait -g charts/kuadrant-operators helm install --values values.yaml --values additionalManifests.yaml --wait -g charts/kuadrant-instances ``` -3. (Optional) Install tools operators +3. (Optional) Install standalone extensions (e.g. `pipeline-policy`) +```sh +helm install --values values.yaml --values extensionCRD.yaml --wait -g charts/kuadrant-extensions +``` + +4. (Optional) Install tools operators ```sh helm install --values values-tools.yaml --wait -g charts/tools-operators ``` -4. (Optional) Install tools instances +5. (Optional) Install tools instances ```sh helm install --values values-tools.yaml --wait --timeout 10m -g charts/tools-instances ``` diff --git a/charts/kuadrant-extensions/.helmignore b/charts/kuadrant-extensions/.helmignore new file mode 100644 index 0000000..f9f9671 --- /dev/null +++ b/charts/kuadrant-extensions/.helmignore @@ -0,0 +1,26 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# CA files +*.crt +*.key diff --git a/charts/kuadrant-extensions/Chart.yaml b/charts/kuadrant-extensions/Chart.yaml new file mode 100644 index 0000000..d5c6d01 --- /dev/null +++ b/charts/kuadrant-extensions/Chart.yaml @@ -0,0 +1,23 @@ +apiVersion: v2 +name: kuadrant-extensions +description: A Helm chart deploying standalone Kuadrant extensions (e.g. pipeline-policy) + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.1.0 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +appVersion: "1.0" diff --git a/charts/kuadrant-extensions/templates/01-kuadrant-extensions-namespace.yaml b/charts/kuadrant-extensions/templates/01-kuadrant-extensions-namespace.yaml new file mode 100644 index 0000000..4f1293d --- /dev/null +++ b/charts/kuadrant-extensions/templates/01-kuadrant-extensions-namespace.yaml @@ -0,0 +1,6 @@ +{{- if .Values.kuadrant.extensionsImage }} +apiVersion: v1 +kind: Namespace +metadata: + name: {{ .Values.kuadrant.extensionsNamespace }} +{{- end }} diff --git a/charts/kuadrant-operators/templates/kuadrant/02a-extensionsManifests.yaml b/charts/kuadrant-extensions/templates/02-extensionCRD.yaml similarity index 69% rename from charts/kuadrant-operators/templates/kuadrant/02a-extensionsManifests.yaml rename to charts/kuadrant-extensions/templates/02-extensionCRD.yaml index 144db3c..484f3e9 100644 --- a/charts/kuadrant-operators/templates/kuadrant/02a-extensionsManifests.yaml +++ b/charts/kuadrant-extensions/templates/02-extensionCRD.yaml @@ -1,5 +1,5 @@ {{- if .Values.kuadrant.extensionsImage }} -{{- range .Values.extensionsManifests }} +{{- range .Values.extensionCRD }} --- {{ tpl (. | toYaml) $ }} {{- end }} diff --git a/charts/kuadrant-extensions/templates/02-extensions-rbac.yaml b/charts/kuadrant-extensions/templates/02-extensions-rbac.yaml new file mode 100644 index 0000000..15d0dc0 --- /dev/null +++ b/charts/kuadrant-extensions/templates/02-extensions-rbac.yaml @@ -0,0 +1,68 @@ +{{- if .Values.kuadrant.extensionsImage }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ .Values.kuadrant.extensionsName }}-extension + namespace: {{ .Values.kuadrant.extensionsNamespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Values.kuadrant.extensionsName }}-manager-role +rules: +- apiGroups: + - extensions.kuadrant.io + resources: + - pipelinepolicies + verbs: + - get + - list + - patch + - update + - watch +- apiGroups: + - extensions.kuadrant.io + resources: + - pipelinepolicies/finalizers + verbs: + - update +- apiGroups: + - extensions.kuadrant.io + resources: + - pipelinepolicies/status + verbs: + - get + - patch + - update +- apiGroups: + - gateway.networking.k8s.io + resources: + - httproutes + - gateways + verbs: + - get + - list + - watch +- apiGroups: + - extensions.kuadrant.io + resources: + - policyregistrations + resourceNames: + - PipelinePolicy + verbs: + - register +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ .Values.kuadrant.extensionsName }}-manager-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ .Values.kuadrant.extensionsName }}-manager-role +subjects: +- kind: ServiceAccount + name: {{ .Values.kuadrant.extensionsName }}-extension + namespace: {{ .Values.kuadrant.extensionsNamespace }} +{{- end }} diff --git a/charts/kuadrant-extensions/templates/03-extensions-deployment.yaml b/charts/kuadrant-extensions/templates/03-extensions-deployment.yaml new file mode 100644 index 0000000..cbe887d --- /dev/null +++ b/charts/kuadrant-extensions/templates/03-extensions-deployment.yaml @@ -0,0 +1,56 @@ +{{- if .Values.kuadrant.extensionsImage }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ .Values.kuadrant.extensionsName }}-extension + namespace: {{ .Values.kuadrant.extensionsNamespace }} + labels: + app.kubernetes.io/name: {{ .Values.kuadrant.extensionsName }}-extension +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: {{ .Values.kuadrant.extensionsName }}-extension + template: + metadata: + labels: + app.kubernetes.io/name: {{ .Values.kuadrant.extensionsName }}-extension + spec: + serviceAccountName: {{ .Values.kuadrant.extensionsName }}-extension + securityContext: + runAsNonRoot: true + containers: + - name: {{ .Values.kuadrant.extensionsName }} + image: {{ .Values.kuadrant.extensionsImage }} + imagePullPolicy: Always + env: + - name: KUADRANT_EXTENSION_ADDRESS + value: "kuadrant-operator-extensions.{{ .Values.kuadrant.namespace }}.svc:50052" + - name: KUADRANT_EXTENSION_TOKEN_FILE + value: "/var/run/secrets/kuadrant/token" + volumeMounts: + - name: kuadrant-token + mountPath: /var/run/secrets/kuadrant + readOnly: true + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + resources: + limits: + cpu: 100m + memory: 128Mi + requests: + cpu: 50m + memory: 64Mi + volumes: + - name: kuadrant-token + projected: + sources: + - serviceAccountToken: + path: token + audience: kuadrant-extensions + expirationSeconds: 3600 +{{- end }} diff --git a/charts/kuadrant-extensions/values.yaml b/charts/kuadrant-extensions/values.yaml new file mode 120000 index 0000000..ef36be5 --- /dev/null +++ b/charts/kuadrant-extensions/values.yaml @@ -0,0 +1 @@ +../../values.yaml \ No newline at end of file diff --git a/charts/kuadrant-operators/templates/kuadrant/08-extensions-patch.yaml b/charts/kuadrant-operators/templates/kuadrant/08-extensions-patch.yaml deleted file mode 100644 index b2edfb1..0000000 --- a/charts/kuadrant-operators/templates/kuadrant/08-extensions-patch.yaml +++ /dev/null @@ -1,189 +0,0 @@ -{{- if .Values.kuadrant.extensionsImage }} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: extensions-patch-hook - namespace: {{ .Values.kuadrant.namespace }} - annotations: - "helm.sh/hook": post-install,post-upgrade - "helm.sh/hook-weight": "1" - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: extensions-patch-hook-role - namespace: {{ .Values.kuadrant.namespace }} - annotations: - "helm.sh/hook": post-install,post-upgrade - "helm.sh/hook-weight": "1" - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded -rules: -- apiGroups: - - operators.coreos.com - resources: - - subscriptions - verbs: - - get - - list - - watch -- apiGroups: - - operators.coreos.com - resources: - - clusterserviceversions - verbs: - - get - - list - - patch - - watch ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: extensions-patch-hook-rb - namespace: {{ .Values.kuadrant.namespace }} - annotations: - "helm.sh/hook": post-install,post-upgrade - "helm.sh/hook-weight": "1" - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: extensions-patch-hook-role -subjects: -- kind: ServiceAccount - name: extensions-patch-hook - namespace: {{ .Values.kuadrant.namespace }} ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: extensions-patch-hook - namespace: {{ .Values.kuadrant.namespace }} - annotations: - "helm.sh/hook": post-install,post-upgrade - "helm.sh/hook-weight": "1" - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded -data: - "run.sh": | - #!/bin/bash - set -xe - - EXTENSIONS_IMAGE="{{ .Values.kuadrant.extensionsImage }}" - - # Wait for the CSV to be installed via the subscription - echo "Waiting for CSV to be installed..." - for i in $(seq 1 60); do - CSV=$(kubectl get subscription kuadrant-operator -o=jsonpath='{.status.installedCSV}' 2>/dev/null) - if [ -n "$CSV" ]; then - break - fi - echo "Attempt $i: CSV not yet available, waiting..." - sleep 5 - done - - if [ -z "$CSV" ]; then - echo "ERROR: Timed out waiting for CSV" - exit 1 - fi - - echo "Found CSV: $CSV" - - # Wait for CSV to reach Succeeded phase - kubectl wait --for=jsonpath='{.status.phase}'=Succeeded csv/"$CSV" --timeout=120s - - # Find the deployment index for kuadrant-operator-controller-manager - DEP_IDX=$(kubectl get csv "$CSV" -o json | jq '[.spec.install.spec.deployments[]] | to_entries[] | select(.value.name == "kuadrant-operator-controller-manager") | .key') - - if [ -z "$DEP_IDX" ]; then - echo "ERROR: Could not find kuadrant-operator-controller-manager deployment in CSV" - exit 1 - fi - - # Find the manager container index - MGR_IDX=$(kubectl get csv "$CSV" -o json | jq ".spec.install.spec.deployments[$DEP_IDX].spec.template.spec.containers | to_entries[] | select(.value.name == \"manager\") | .key") - - if [ -z "$MGR_IDX" ]; then - echo "ERROR: Could not find manager container in CSV deployment" - exit 1 - fi - - echo "Patching CSV: deployment index=$DEP_IDX, manager container index=$MGR_IDX" - - # Build the JSON patch: - # 1. Add the extensions emptyDir volume - # 2. Add volumeMount to the manager container - # 3. Add the copy-extensions initContainer - PATCH=$(cat <