feat(helm): add configurable PolicyServer port fields to defaults chart

Adds webhookPort, readinessProbePort, and metricsPort fields under policyServer in values.yaml (defaulting to 0, meaning use the PolicyServer CRD default). The policyserver-default.yaml template conditionally emits these fields when they are non-zero. values.schema.json is updated with integer constraints (0-65535) for the new fields. Helm unit tests verify that zero values are omitted and non-zero values are passed through to the PolicyServer spec.

Signed-off-by: José Guilherme Vanz <jguilhermevanz@suse.com>
Assisted-by: Github Copilot

Author: jvanz

charts/kubewarden-defaults/templates/policyserver-default.yaml

@@ -77,4 +77,13 @@ spec:
   {{- if .Values.policyServer.securityContexts }}
   securityContexts: {{ toYaml .Values.policyServer.securityContexts | nindent 4 }}
   {{- end }}
+  {{- if .Values.policyServer.webhookPort }}
+  webhookPort: {{ .Values.policyServer.webhookPort }}
+  {{- end }}
+  {{- if .Values.policyServer.readinessProbePort }}
+  readinessProbePort: {{ .Values.policyServer.readinessProbePort }}
+  {{- end }}
+  {{- if .Values.policyServer.metricsPort }}
+  metricsPort: {{ .Values.policyServer.metricsPort }}
+  {{- end }}
 {{- end }}

charts/kubewarden-defaults/tests/host_network_test.yaml

@@ -0,0 +1,52 @@
+suite: host-network port configuration for default PolicyServer
+templates:
+  - policyserver-default.yaml
+tests:
+  - it: "should not set port fields by default (zero values are omitted)"
+    asserts:
+      - notExists:
+          path: spec.webhookPort
+      - notExists:
+          path: spec.readinessProbePort
+      - notExists:
+          path: spec.metricsPort
+
+  - it: "should set webhookPort when overridden in values"
+    set:
+      policyServer.webhookPort: 9443
+    asserts:
+      - equal:
+          path: spec.webhookPort
+          value: 9443
+
+  - it: "should set readinessProbePort when overridden in values"
+    set:
+      policyServer.readinessProbePort: 9081
+    asserts:
+      - equal:
+          path: spec.readinessProbePort
+          value: 9081
+
+  - it: "should set metricsPort when overridden in values"
+    set:
+      policyServer.metricsPort: 9080
+    asserts:
+      - equal:
+          path: spec.metricsPort
+          value: 9080
+
+  - it: "should set all port fields when all are overridden"
+    set:
+      policyServer.webhookPort: 9443
+      policyServer.readinessProbePort: 9081
+      policyServer.metricsPort: 9080
+    asserts:
+      - equal:
+          path: spec.webhookPort
+          value: 9443
+      - equal:
+          path: spec.readinessProbePort
+          value: 9081
+      - equal:
+          path: spec.metricsPort
+          value: 9080

charts/kubewarden-defaults/values.schema.json

@@ -12,6 +12,24 @@
         "minAvailable": {
           "type": "string",
           "minLength": 1
+        },
+        "webhookPort": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 65535,
+          "description": "Port for the PolicyServer webhook listener. 0 means use default (8443)."
+        },
+        "readinessProbePort": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 65535,
+          "description": "Port for the PolicyServer readiness probe. 0 means use default (8081)."
+        },
+        "metricsPort": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 65535,
+          "description": "Port for the PolicyServer metrics endpoint. 0 means use default (8080)."
         }
       },
       "anyOf": [

charts/kubewarden-defaults/values.yaml

@@ -186,6 +186,12 @@ policyServer:
   # limits and requests, see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
   limits: {}
   requests: {}
+  # Ports used by the default PolicyServer.
+  # Override these when hostNetwork is enabled on the controller chart to avoid conflicts with other workloads.
+  # A value of 0 means "use the PolicyServer default" (8443 for webhook, 8081 for readiness, 8080 for metrics).
+  webhookPort: 0
+  readinessProbePort: 0
+  metricsPort: 0
 crdVersion: "policies.kubewarden.io/v1"
 recommendedPolicies:
   enabled: False