Skip to content

Commit 0f6a51d

Browse files
AndrewChubatiukHaleygo
AndrewChubatiuk
and
Haleygo
authored
operator: make templated crds specless (#2419)
* make templated crds specless * added CRD upgrade job Co-authored-by: Hui Wang <[email protected]>
1 parent ba042b3 commit 0f6a51d

File tree

19 files changed

+43897
-40417
lines changed

19 files changed

+43897
-40417
lines changed

‎charts/victoria-metrics-operator-crds/charts/crds/crd.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
../../../victoria-metrics-operator/crd.yaml
1+
../../../victoria-metrics-operator/charts/crds/crds/crd.yaml

‎charts/victoria-metrics-operator/CHANGELOG.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
## Next release
22

3-
- Added `securityContext` to the `cleanup` job
3+
**Update node 1**: CRDs generated with `.Values.crds.plain: false` are now specless. For this case operator is fully responsible for VM specs validation. This was done to decrease helm release secret size limit. This change affects `kubectl explain` users and tools, that are rely on CRD specs during input data validation. If this behaviour is not acceptable consider using either `victoria-metrics-operator-crds` chart for CRDs management or set `.Values.crds.plain: true` to use plain CRDs.
4+
5+
- Added `securityContext` to the `cleanup` job.
6+
- Make CRDs, that are rendered using template, specless. This allows to decrease size of k8s secret significantly. If this option is not acceptable for you consider installing CRDs separately using `victoria-metrics-operator-crds` chart or set `.Values.crds.plain: true` and `.Values.crds.upgrade.enabled: true` to use plain CRDs with upgrade job instead.
7+
- Replaced `.Values.admissionWebhooks.enabledCRDValidation` with `.Values.admissionWebhooks.disabledFor` list of CRD names to disable validation for. This change should not affect anyone, since before condition with `.Values.admissionWebhooks.enabledCRDValidation` was not working at all.
8+
- Added CRDs upgrade job, which is only available only for plain CRDs (`.Values.crds.plain: true`). See [#2334](https://github.com/VictoriaMetrics/helm-charts/issues/2334).
49

510
## 0.53.0
611

‎charts/victoria-metrics-operator/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ home: https://github.com/VictoriaMetrics/operator
66
sources:
77
- https://github.com/VictoriaMetrics/helm-charts
88
- https://github.com/VictoriaMetrics/operator
9-
version: 0.53.0
9+
version: 0.54.0
1010
appVersion: v0.63.0
1111
icon: https://avatars.githubusercontent.com/u/43720803?s=200&v=4
1212
kubeVersion: ">=1.25.0-0"

‎charts/victoria-metrics-operator/charts/crds/crds/crd.yaml‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎charts/victoria-metrics-operator/charts/crds/crds/crd.yaml‎

Lines changed: 43143 additions & 0 deletions
Large diffs are not rendered by default.

‎charts/victoria-metrics-operator/charts/crds/files/crd.yaml.bz2‎

94.6 KB
Binary file not shown.

‎charts/victoria-metrics-operator/charts/crds/templates/_helpers.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{- define "crds.upgrade.name" -}}
2+
{{- print (include "vm.plain.fullname" .) "-upgrade-crds" }}
3+
{{- end -}}
4+
5+
{{- define "crds.upgrade.serviceAccountName" -}}
6+
{{- $Values := (.helm).Values | default .Values }}
7+
{{- $upgrade := $Values.upgrade }}
8+
{{- if $upgrade.serviceAccount.create -}}
9+
{{ default (include "crds.upgrade.name" .) $upgrade.serviceAccount.name }}
10+
{{- else -}}
11+
{{ default "default" $upgrade.serviceAccount.name }}
12+
{{- end -}}
13+
{{- end -}}

‎charts/victoria-metrics-operator/charts/crds/templates/cm.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{{- if .Values.upgrade.enabled }}
2+
{{- $ctx := dict "helm" . }}
3+
{{- $upgrade := .Values.upgrade }}
4+
apiVersion: v1
5+
kind: ConfigMap
6+
metadata:
7+
name: {{ include "crds.upgrade.serviceAccountName" $ctx }}
8+
namespace: {{ template "vm.namespace" $ctx }}
9+
annotations:
10+
"helm.sh/hook": pre-install,pre-upgrade,pre-rollback
11+
"helm.sh/hook-weight": "-2"
12+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
13+
{{- $_ := set $ctx "extraLabels" (dict "app.kubernetes.io/component" "upgrade-crds") }}
14+
labels: {{ include "vm.labels" $ctx | nindent 4 }}
15+
{{- $_ := unset $ctx "extraLabels" }}
16+
binaryData:
17+
crd.yaml.bz2: {{ .Files.Get "files/crd.yaml.bz2" | b64enc }}
18+
{{- end }}

‎charts/victoria-metrics-operator/charts/crds/templates/job.yaml‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
{{- if .Values.upgrade.enabled }}
2+
{{- $app := .Values.upgrade }}
3+
{{- if empty (($app.kubectl).image).tag }}
4+
{{- $tag := regexSplit "[+-]" .Capabilities.KubeVersion.Version -1 | first -}}
5+
{{- $_ := set $app.kubectl.image "tag" $tag }}
6+
{{- else if not (kindIs "string" (($app.kubectl).image).tag) }}
7+
{{- fail "`crd.upgrade.kubectl.image.tag` is not string, most probably you need to enquote provided value" -}}
8+
{{- end }}
9+
{{- $ctx := dict "helm" . "noEnterprise" true }}
10+
apiVersion: batch/v1
11+
kind: Job
12+
metadata:
13+
name: {{ template "crds.upgrade.name" $ctx }}
14+
namespace: {{ template "vm.namespace" $ctx }}
15+
annotations:
16+
"helm.sh/hook": pre-install,pre-upgrade,pre-rollback
17+
"helm.sh/hook-weight": "5"
18+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
19+
{{- with $app.annotations }}
20+
{{- toYaml . | nindent 4 }}
21+
{{- end }}
22+
{{- $_ := set $ctx "extraLabels" $app.labels }}
23+
{{- $_ := set $ctx.extraLabels "app.kubernetes.io/component" "upgrade-crds" }}
24+
labels: {{ include "vm.labels" $ctx | nindent 4 }}
25+
{{- $_ := unset $ctx "extraLabels" }}
26+
spec:
27+
backoffLimit: 3
28+
template:
29+
metadata:
30+
{{- with $app.podLabels }}
31+
labels: {{ toYaml . | nindent 8 }}
32+
{{- end }}
33+
{{- with $app.podAnnotations }}
34+
annotations: {{ toYaml . | nindent 8 }}
35+
{{- end }}
36+
spec:
37+
{{- with (.Values.imagePullSecrets | default .Values.global.imagePullSecrets) }}
38+
imagePullSecrets: {{ toYaml . | nindent 8 }}
39+
{{- end }}
40+
serviceAccountName: {{ include "crds.upgrade.serviceAccountName" . }}
41+
{{- if $app.podSecurityContext.enabled }}
42+
securityContext: {{ include "vm.securityContext" (dict "securityContext" $app.podSecurityContext "helm" .) | nindent 8 }}
43+
{{- end }}
44+
initContainers:
45+
- name: busybox
46+
{{- $_ := set $ctx "appKey" (list "upgrade" "busybox") }}
47+
image: {{ include "vm.image" $ctx }}
48+
imagePullPolicy: {{ $app.busybox.image.pullPolicy }}
49+
workingDir: /tmp/
50+
command:
51+
- sh
52+
args:
53+
- -c
54+
- bzcat /crds/crd.yaml.bz2 > /tmp/crd.yaml
55+
{{- with $app.resources }}
56+
resources: {{ toYaml . | nindent 12 }}
57+
{{- end }}
58+
{{- with $app.securityContext }}
59+
securityContext: {{ toYaml . | nindent 12 }}
60+
{{- end }}
61+
volumeMounts:
62+
- mountPath: /crds/
63+
name: crds
64+
- mountPath: /tmp/
65+
name: tmp
66+
{{- with $app.extraVolumeMounts }}
67+
{{- toYaml . | nindent 12 }}
68+
{{- end }}
69+
{{- with $app.env }}
70+
env: {{ toYaml . | nindent 12 }}
71+
{{- end }}
72+
containers:
73+
- name: kubectl
74+
{{- $_ := set $ctx "appKey" (list "upgrade" "kubectl") }}
75+
image: {{ include "vm.image" $ctx }}
76+
imagePullPolicy: {{ $app.kubectl.image.pullPolicy }}
77+
command:
78+
- kubectl
79+
args:
80+
- apply
81+
- --server-side
82+
{{- if $app.forceConflicts }}
83+
- --force-conflicts
84+
{{- end }}
85+
- --filename
86+
- /tmp/crd.yaml
87+
{{- with $app.resources }}
88+
resources: {{ toYaml . | nindent 12 }}
89+
{{- end }}
90+
{{- with $app.securityContext }}
91+
securityContext: {{ toYaml . | nindent 12 }}
92+
{{- end }}
93+
volumeMounts:
94+
- mountPath: /tmp/
95+
name: tmp
96+
{{- with $app.extraVolumeMounts }}
97+
{{- toYaml . | nindent 12 }}
98+
{{- end }}
99+
{{- with $app.env }}
100+
env: {{ toYaml . | nindent 12 }}
101+
{{- end }}
102+
volumes:
103+
- name: tmp
104+
emptyDir: {}
105+
- name: crds
106+
configMap:
107+
name: {{ template "crds.upgrade.name" . }}
108+
{{- with $app.extraVolumes }}
109+
{{- toYaml . | nindent 8 }}
110+
{{- end }}
111+
restartPolicy: OnFailure
112+
{{- with $app.nodeSelector }}
113+
nodeSelector: {{ toYaml . | nindent 8 }}
114+
{{- end }}
115+
{{- with $app.tolerations }}
116+
tolerations: {{ toYaml . | nindent 8 }}
117+
{{- end }}
118+
{{- with $app.affinity }}
119+
affinity: {{ toYaml . | nindent 8 }}
120+
{{- end }}
121+
{{- with $app.topologySpreadConstraints }}
122+
topologySpreadConstraints: {{ toYaml . | nindent 8 }}
123+
{{- end }}
124+
{{- end }}

‎charts/victoria-metrics-operator/charts/crds/templates/role.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{{- if .Values.upgrade.enabled }}
2+
{{- $ctx := dict "helm" . }}
3+
{{- $_ := set $ctx "extraLabels" (dict "app.kubernetes.io/component" "upgrade-crds") }}
4+
{{- $labels := include "vm.labels" $ctx }}
5+
{{- $_ := unset $ctx "extraLabels" }}
6+
apiVersion: rbac.authorization.k8s.io/v1
7+
kind: ClusterRole
8+
metadata:
9+
name: {{ template "crds.upgrade.name" . }}
10+
namespace: {{ template "vm.namespace" . }}
11+
annotations:
12+
"helm.sh/hook": pre-install,pre-upgrade,pre-rollback
13+
"helm.sh/hook-weight": "-5"
14+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
15+
labels: {{ $labels | nindent 4 }}
16+
{{- $crds := .Files.Get "crds/crd.yaml" | splitList "---" }}
17+
rules:
18+
- apiGroups:
19+
- "apiextensions.k8s.io"
20+
resources:
21+
- "customresourcedefinitions"
22+
verbs:
23+
- create
24+
- patch
25+
- update
26+
- get
27+
- list
28+
resourceNames:
29+
{{- range $crds }}
30+
{{- $crd := fromYaml . }}
31+
- {{ $crd.metadata.name }}
32+
{{- end }}
33+
---
34+
apiVersion: rbac.authorization.k8s.io/v1
35+
kind: ClusterRoleBinding
36+
metadata:
37+
name: {{ template "crds.upgrade.name" . }}
38+
namespace: {{ template "vm.namespace" . }}
39+
annotations:
40+
"helm.sh/hook": pre-install,pre-upgrade,pre-rollback
41+
"helm.sh/hook-weight": "-3"
42+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
43+
labels: {{ $labels | nindent 4 }}
44+
subjects:
45+
- kind: ServiceAccount
46+
namespace: {{ template "vm.namespace" . }}
47+
name: {{ template "crds.upgrade.serviceAccountName" . }}
48+
roleRef:
49+
kind: ClusterRole
50+
name: {{ template "crds.upgrade.name" . }}
51+
apiGroup: rbac.authorization.k8s.io
52+
{{- end }}

0 commit comments

Comments
 (0)