feat(chart): complete Helm chart for vllm-coldstart-operator

Templatizes ServiceAccount, cluster-wide RBAC (ClusterRole +
ClusterRoleBinding), operator Deployment (GHCR image), and a toggleable
example VllmService. CRD served from crds/ so Helm installs it before the
example CR in the same release.

RBAC scope is cluster-wide: the controller watches VllmServices in all
namespaces (Api::all in src/main.rs). Rules cover vllmservices,
vllmservices/status, and apps/deployments only -- the reconciler touches
no services or pods.

securityContext pins runAsUser/runAsGroup to 65532 (distroless nonroot
UID); runAsNonRoot alone fails on the non-numeric 'nonroot' user.

Validated: helm lint, helm template, helm install/upgrade on kind
(v1.34.0). Example VllmService converges to phase=Ready, operator
server-side-applies the child Deployment.

Author: MicheleCampi

chart/.helmignore

@@ -0,0 +1,10 @@
+.DS_Store
+.git/
+.gitignore
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+.vscode/
+.idea/

chart/templates/crd.yaml chart/crds/crd.yamlchart/templates/crd.yaml renamed to chart/crds/crd.yaml

@@ -0,0 +1,39 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "vllm-coldstart-operator.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "vllm-coldstart-operator.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "vllm-coldstart-operator.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "vllm-coldstart-operator.selectorLabels" . | nindent 8 }}
+    spec:
+      serviceAccountName: {{ include "vllm-coldstart-operator.serviceAccountName" . }}
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: operator
+        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        env:
+        - name: RUST_LOG
+          value: {{ .Values.logLevel | quote }}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+            - ALL
+        resources:
+          {{- toYaml .Values.resources | nindent 10 }}

chart/templates/deployment.yaml

@@ -0,0 +1,36 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "vllm-coldstart-operator.fullname" . }}
+  labels:
+    {{- include "vllm-coldstart-operator.labels" . | nindent 4 }}
+rules:
+# Watch VllmService custom resources across all namespaces (Api::all).
+- apiGroups: ["inference.michelecampi.dev"]
+  resources: ["vllmservices"]
+  verbs: ["get", "list", "watch"]
+# Write lifecycle phase back on the /status subresource.
+- apiGroups: ["inference.michelecampi.dev"]
+  resources: ["vllmservices/status"]
+  verbs: ["get", "patch", "update"]
+# Server-side apply the owned Deployment and watch owned children (.owns).
+- apiGroups: ["apps"]
+  resources: ["deployments"]
+  verbs: ["get", "list", "watch", "create", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "vllm-coldstart-operator.fullname" . }}
+  labels:
+    {{- include "vllm-coldstart-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "vllm-coldstart-operator.fullname" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "vllm-coldstart-operator.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end }}

chart/templates/rbac.yaml

@@ -0,0 +1,9 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "vllm-coldstart-operator.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "vllm-coldstart-operator.labels" . | nindent 4 }}
+{{- end }}

chart/templates/serviceaccount.yaml

@@ -0,0 +1,11 @@
+{{- if .Values.example.enabled -}}
+apiVersion: inference.michelecampi.dev/v1alpha1
+kind: VllmService
+metadata:
+  name: {{ .Values.example.name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "vllm-coldstart-operator.labels" . | nindent 4 }}
+spec:
+  {{- toYaml .Values.example.spec | nindent 2 }}
+{{- end }}

chart/templates/vllmservice.yaml

@@ -53,3 +53,7 @@ example:
   #     image: "vllm/vllm-openai:latest"
   #     gpu: 1
   #     healthPath: "/health"
+
+# -- Value of RUST_LOG for the operator (tracing EnvFilter). Matches the
+#    binary's built-in default.
+logLevel: "info,kube=warn"