Skip to content

Commit 1d95f9a

Browse files
jvanzjvanz
committed
chore(charts): automate CRD and RBAC manifest post-processing
Add scripts/post-generate-manifests.sh to post-process controller-gen output. It renames CRD files from the default policies.kubewarden.io_RESOURCE.yaml format to RESOURCE.yaml directly into charts/kubewarden-crds/templates/. Also it injects Helm template labels and annotations into each resource in controller-rbac-roles.yaml to match the conventions used by the rest of the chart. Update the Makefile manifests target to output CRDs directly into charts/kubewarden-crds/templates/ and invoke the post-processing script automatically. Signed-off-by: José Guilherme Vanz <jguilhermevanz@suse.com>
1 parent 20c4725 commit 1d95f9a

7 files changed

Lines changed: 88 additions & 5 deletions

File tree

‎Makefile‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -145,11 +145,12 @@ generate-controller: manifests ## Generate code containing DeepCopy, DeepCopyIn
145145
$(GO_BUILD_ENV) $(CONTROLLER_GEN) object paths="./api/policies/v1"
146146

147147
.PHONY: manifests
148-
manifests: ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects. We use yq to modify the generated files to match our naming and labels conventions.
148+
manifests: ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
149149
$(GO_BUILD_ENV) $(CONTROLLER_GEN) rbac:roleName=controller-role,fileName=controller-rbac-roles.yaml,roleName=kubewarden-controller-manager crd webhook \
150150
paths="./api/policies/v1" paths="./internal/controller" paths="./cmd/controller" \
151-
output:crd:artifacts:config=config/crd/bases \
152-
output:rbac:artifacts:config=charts/kubewarden-controller/templates \
151+
output:crd:artifacts:config=charts/kubewarden-crds/templates \
152+
output:rbac:artifacts:config=charts/kubewarden-controller/templates
153+
./scripts/post-generate-manifests.sh
153154

154155
.PHONY: generate-chart
155156
generate-chart: ## Generate Helm chart values schema.

‎charts/kubewarden-controller/templates/NOTES.txt‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,22 @@ You can now start defining admission policies by using the cluster-wide
44

55
For more information check out https://docs.kubewarden.io.
66

7+
⚠️ **Upgrade notice: RBAC resource consolidation**
8+
9+
Starting with this release, all controller RBAC permissions have been
10+
consolidated into a single ClusterRole and a single Role, simplifying the
11+
permission model. The following resources from previous versions are no longer
12+
used and should be manually deleted after a successful upgrade:
13+
14+
kubectl delete clusterrole kubewarden-controller-manager-cluster-role
15+
kubectl delete clusterrole kubewarden-controller-metrics-reader
16+
kubectl delete clusterrole kubewarden-controller-proxy-role
17+
kubectl delete clusterrolebinding kubewarden-controller-proxy-rolebinding
18+
kubectl delete rolebinding kubewarden-controller-leader-election-rolebinding -n {{ .Release.Namespace }}
19+
kubectl delete rolebinding kubewarden-controller-manager-namespaced-rolebinding -n {{ .Release.Namespace }}
20+
kubectl delete role kubewarden-controller-leader-election-role -n {{ .Release.Namespace }}
21+
kubectl delete role kubewarden-controller-manager-namespaced-role -n {{ .Release.Namespace }}
22+
723

824
🚀 **Kubewarden is applying to become a CNCF incubation project!** 🚀
925

‎charts/kubewarden-controller/templates/controller-rbac-roles.yaml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@ apiVersion: rbac.authorization.k8s.io/v1
33
kind: ClusterRole
44
metadata:
55
name: kubewarden-controller-manager
6+
labels:
7+
{{- include "kubewarden-controller.labels" . | nindent 4 }}
8+
annotations:
9+
{{- include "kubewarden-controller.annotations" . | nindent 4 }}
610
rules:
711
- apiGroups:
812
- admissionregistration.k8s.io
@@ -70,7 +74,11 @@ apiVersion: rbac.authorization.k8s.io/v1
7074
kind: Role
7175
metadata:
7276
name: kubewarden-controller-manager
73-
namespace: kubewarden
77+
labels:
78+
{{- include "kubewarden-controller.labels" . | nindent 4 }}
79+
annotations:
80+
{{- include "kubewarden-controller.annotations" . | nindent 4 }}
81+
namespace: {{ .Release.Namespace }}
7482
rules:
7583
- apiGroups:
7684
- ""

‎charts/kubewarden-crds/templates/admissionpolicies.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
apiVersion: apiextensions.k8s.io/v1
23
kind: CustomResourceDefinition
34
metadata:

‎charts/kubewarden-crds/templates/admissionpolicygroups.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
apiVersion: apiextensions.k8s.io/v1
23
kind: CustomResourceDefinition
34
metadata:

‎charts/kubewarden-crds/templates/policyservers.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
apiVersion: apiextensions.k8s.io/v1
23
kind: CustomResourceDefinition
34
metadata:
@@ -1641,7 +1642,7 @@ spec:
16411642
Name of SigstoreTrustConfig configmap in the kubewarden namespace (same
16421643
namespace as the controller deployment), containing Sigstore trust
16431644
configuration (ClientTrustConfig JSON). The configuration must be under a
1644-
key named sigstore-trust-config in the Configmap. This is used to configure
1645+
key named sigstore-trust-config in the ConfigMap. This is used to configure
16451646
a custom Sigstore instance instead of the default public Sigstore infrastructure.
16461647
WARNING: This feature requires strict access control. Users with write access
16471648
to this ConfigMap can influence policy signature verification.

‎scripts/post-generate-manifests.sh‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
#!/bin/bash
2+
# Post-processing script for controller-gen output.
3+
#
4+
# This script:
5+
# 1. Renames CRD files generated by controller-gen from the default
6+
# "policies.kubewarden.io_RESOURCE.yaml" format to "RESOURCE.yaml",
7+
# as expected by the charts/kubewarden-crds Helm chart.
8+
# 2. Injects Helm template labels and annotations into each resource in
9+
# controller-rbac-roles.yaml to match the rest of the chart templates.
10+
#
11+
# Usage: called automatically from "make manifests"
12+
13+
set -euo pipefail
14+
15+
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
16+
CRD_CHART_DIR="${REPO_ROOT}/charts/kubewarden-crds/templates"
17+
RBAC_FILE="${REPO_ROOT}/charts/kubewarden-controller/templates/controller-rbac-roles.yaml"
18+
19+
# ── 1. Rename CRD files ──────────────────────────────────────────────────────
20+
echo "Renaming CRD files in ${CRD_CHART_DIR}..."
21+
for src in "${CRD_CHART_DIR}"/policies.kubewarden.io_*.yaml; do
22+
[[ -e "${src}" ]] || continue
23+
filename="$(basename "${src}")"
24+
dest="${CRD_CHART_DIR}/${filename#policies.kubewarden.io_}"
25+
mv "${src}" "${dest}"
26+
echo " ${filename} -> $(basename "${dest}")"
27+
done
28+
29+
# ── 2. Inject Helm labels/annotations into controller-rbac-roles.yaml ────────
30+
echo "Injecting Helm labels and annotations into ${RBAC_FILE}..."
31+
32+
# Use awk to insert labels/annotations after each " name: ..." line that
33+
# appears inside a metadata block. We detect a metadata block by looking for
34+
# the line "^metadata:" and then find the " name:" line within it.
35+
awk '
36+
/^metadata:$/ { in_metadata = 1 }
37+
!in_metadata { print; next }
38+
/^ name:/ {
39+
print
40+
print " labels:"
41+
print " {{- include \"kubewarden-controller.labels\" . | nindent 4 }}"
42+
print " annotations:"
43+
print " {{- include \"kubewarden-controller.annotations\" . | nindent 4 }}"
44+
in_metadata = 0
45+
next
46+
}
47+
{ print }
48+
' "${RBAC_FILE}" > "${RBAC_FILE}.tmp"
49+
50+
mv "${RBAC_FILE}.tmp" "${RBAC_FILE}"
51+
52+
# ── 3. Replace hardcoded namespace with Helm template expression ─────────────
53+
echo "Replacing hardcoded namespace in ${RBAC_FILE}..."
54+
sed -i 's/ namespace: kubewarden/ namespace: {{ .Release.Namespace }}/' "${RBAC_FILE}"
55+
echo " Done."

0 commit comments

Comments
 (0)