Add support for HelmLockerPolicy resources to allow admin to specify changes that are allowed #101
Description
If you have a Helm release deployed but you don't want Helm Locker to reconcile changes to certain resources (identified by GVK), certain subsets of the spec of those resources (e.g. .spec.containers to allow something like Istio to inject a sidecar), or you want certain patches to be applied (e.g. adding nodeSelectors and tolerations to all Workloads deployed by the Helm chart), you need the ability to specify these configurations and persist them to the cluster for Helm Locker to use.
HelmLockerPolicy is a proposed resource that would select a list of HelmReleases (by label selector) and modify the apply call made to the ObjectSet on behalf of the HelmRelease to add an apply.Patcher to it that does custom sanitization based on the reconcile action provided.
The example manifest deploying a HelmLockerPolicy would look something like this:
kind: HelmLockerPolicy
apiVersion: helm.cattle.io/v1alpha1
metadata:
name: allow-partial-mutation-on-configmaps
namespace: cattle-helm-system
spec:
releaseSelector: # required, identifies which HelmRelease objects are selected by metav1.labelSelector. If not provided, this policy is a noop. This HelmLockerPolicy will only apply to HelmRelease CRs in the same namespace as itself.
matchLabels:
helm.cattle.io/configmaps: partially-mutable # example label to use
policies:
- apiVersion: v1 # required
kind: ConfigMap # required
name: my-config-map # optional, mutually exclusive with .spec.policies[i].selector. If both are provided, this will be chosen.
selector: # optional, mutually exclusive with .spec.policies[i].name
matchLabels:
myworkload: true
apply: # optional, the map provided here will override the values provided in the manifest for all targeted resources before they are parsed into an ObjectSet. It will not be validated that these patches are valid on the targeted resource, but if they are invalid the HelmRelease that selects this will be marked with the status FailedToApplyPolicy. If multiple selected patchers try to modify the same field, the HelmRelease will also be marked FailedToApplyPolicy. If you need to modify a list, provide _i (e.g. _1, _2, etc.) as the key to the map to indicate changes to resources in that index.
data:
config: "hello: world"
ignorePaths: # paths that should be ignored on reconciling changes
- '.data.config' # marks a path on which changes made are ignored. Providing `.` here will mark all paths as ignored and will allow changes to occur, although the resource will still be watched and recreated on deletion