refactor: add chart for extensions

.gitignore

@@ -1,5 +1,6 @@
 additionalManifests.yaml
 extensionsManifests.yaml
+extensionCRD.yaml
 .idea
 
 # macOS system files

README.md

@@ -64,6 +64,18 @@ and makes Helm consume additional values from additionalManifests.yaml and insta
 
 If you want to install just tools use `./tools-install.sh`. Add `-k` option to install on Kind.
 
+## Standalone Kuadrant extensions
+
+Standalone Kuadrant extensions (e.g. `pipeline-policy`) are deployed by their own `charts/kuadrant-extensions` chart,
+installed as a separate Helm release. They are **not** installed by default.
+
+Extensions are only supported on Kuadrant v1.6+ / RHCL v1.5+. Leave `kuadrant.extensionsImage` empty when installing
+on lower versions.
+
+Use `-e` flag to install them: `./install.sh -e`. This requires an `extensionCRD.yaml` file (see
+[example-extensionCRD.yaml](./example-extensionCRD.yaml)) with the CRD for the
+extension, and `kuadrant.extensionsImage` set in [values.yaml](./values.yaml).
+
 ## Manual helm
 
 If you do not want to use helper `./install.sh` (and `./uninstall.sh`) script:
@@ -77,12 +89,17 @@ helm install --values values.yaml --wait -g charts/kuadrant-operators
 helm install --values values.yaml --values additionalManifests.yaml --wait -g charts/kuadrant-instances
 ```
 
-3. (Optional) Install tools operators
+3. (Optional) Install standalone extensions (e.g. `pipeline-policy`)
+```sh
+helm install --values values.yaml --values extensionCRD.yaml --wait -g charts/kuadrant-extensions
+```
+
+4. (Optional) Install tools operators
 ```sh
 helm install --values values-tools.yaml --wait -g charts/tools-operators
 ```
 
-4. (Optional) Install tools instances
+5. (Optional) Install tools instances
 ```sh
 helm install --values values-tools.yaml --wait --timeout 10m -g charts/tools-instances
 ```

charts/kuadrant-extensions/.helmignore

@@ -0,0 +1,26 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
+# CA files
+*.crt
+*.key

charts/kuadrant-extensions/Chart.yaml

@@ -0,0 +1,23 @@
+apiVersion: v2
+name: kuadrant-extensions
+description: A Helm chart deploying standalone Kuadrant extensions (e.g. pipeline-policy)
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+appVersion: "1.0"

charts/kuadrant-extensions/templates/01-kuadrant-extensions-namespace.yaml

@@ -0,0 +1,6 @@
+{{- if .Values.kuadrant.extensionsImage }}
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .Values.kuadrant.extensionsNamespace }}
+{{- end }}

charts/kuadrant-operators/templates/kuadrant/02a-extensionsManifests.yaml → charts/kuadrant-extensions/templates/02-extensionCRD.yaml

@@ -1,5 +1,5 @@
 {{- if .Values.kuadrant.extensionsImage }}
-{{- range .Values.extensionsManifests }}
+{{- range .Values.extensionCRD }}
 ---
 {{ tpl (. | toYaml) $ }}
 {{- end }}

charts/kuadrant-extensions/templates/02-extensions-rbac.yaml

@@ -0,0 +1,68 @@
+{{- if .Values.kuadrant.extensionsImage }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.kuadrant.extensionsName }}-extension
+  namespace: {{ .Values.kuadrant.extensionsNamespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Values.kuadrant.extensionsName }}-manager-role
+rules:
+- apiGroups:
+  - extensions.kuadrant.io
+  resources:
+  - pipelinepolicies
+  verbs:
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - extensions.kuadrant.io
+  resources:
+  - pipelinepolicies/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - extensions.kuadrant.io
+  resources:
+  - pipelinepolicies/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - gateway.networking.k8s.io
+  resources:
+  - httproutes
+  - gateways
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - extensions.kuadrant.io
+  resources:
+  - policyregistrations
+  resourceNames:
+  - PipelinePolicy
+  verbs:
+  - register
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ .Values.kuadrant.extensionsName }}-manager-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Values.kuadrant.extensionsName }}-manager-role
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.kuadrant.extensionsName }}-extension
+  namespace: {{ .Values.kuadrant.extensionsNamespace }}
+{{- end }}

charts/kuadrant-extensions/templates/03-extensions-deployment.yaml

@@ -0,0 +1,56 @@
+{{- if .Values.kuadrant.extensionsImage }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Values.kuadrant.extensionsName }}-extension
+  namespace: {{ .Values.kuadrant.extensionsNamespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Values.kuadrant.extensionsName }}-extension
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ .Values.kuadrant.extensionsName }}-extension
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ .Values.kuadrant.extensionsName }}-extension
+    spec:
+      serviceAccountName: {{ .Values.kuadrant.extensionsName }}-extension
+      securityContext:
+        runAsNonRoot: true
+      containers:
+      - name: {{ .Values.kuadrant.extensionsName }}
+        image: {{ .Values.kuadrant.extensionsImage }}
+        imagePullPolicy: Always
+        env:
+        - name: KUADRANT_EXTENSION_ADDRESS
+          value: "kuadrant-operator-extensions.{{ .Values.kuadrant.namespace }}.svc:50052"
+        - name: KUADRANT_EXTENSION_TOKEN_FILE
+          value: "/var/run/secrets/kuadrant/token"
+        volumeMounts:
+        - name: kuadrant-token
+          mountPath: /var/run/secrets/kuadrant
+          readOnly: true
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+            - ALL
+        resources:
+          limits:
+            cpu: 100m
+            memory: 128Mi
+          requests:
+            cpu: 50m
+            memory: 64Mi
+      volumes:
+      - name: kuadrant-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              path: token
+              audience: kuadrant-extensions
+              expirationSeconds: 3600
+{{- end }}

charts/kuadrant-extensions/values.yaml

@@ -0,0 +1 @@
+../../values.yaml