helm changes for v0.19.2

Author: foxish

signadot/operator/Chart.yaml

@@ -6,10 +6,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: "0.19.1"
+version: "0.19.2"
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "0.19.1"
+appVersion: "0.19.2"

signadot/operator/templates/agent-deployment.yaml

@@ -22,6 +22,8 @@ spec:
   selector:
     matchLabels:
       app: signadot-agent
+  strategy:
+    type: Recreate
   template:
     metadata:
       annotations:
@@ -72,5 +74,9 @@ spec:
           httpGet:
             path: /healthz
             port: 8088
+{{- with .Values }}{{- with .agent }}{{- with .resources }}
+        resources:
+{{ toYaml . | indent 10 }}
+{{- else -}}{{- end }}{{- else -}}{{- end }}{{- else -}}{{- end }}
       serviceAccountName: agent
 {{ end }}

signadot/operator/templates/agent-metrics-service.yaml

@@ -1,4 +1,5 @@
 # This file is generated. Do not edit.
+{{ if not .Values.disableAgent }}
 apiVersion: v1
 kind: Service
 metadata:
@@ -28,3 +29,4 @@ spec:
   selector:
     app: signadot-agent
   type: ClusterIP
+{{ end }}

signadot/operator/templates/allowed_namespaces.yaml

@@ -17,3 +17,23 @@ subjects:
   name: signadot-controller-manager
   namespace: signadot
 {{ end }}
+{{ if not .Values.disableAgent }}
+# Bind the ClusterRole containing agent permissions to the agent's
+# ServiceAccount only in the specified namespaces.
+{{ range $namespace := $allowedNamespaces }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: signadot-agent-namespaced
+  namespace: {{ $namespace | quote }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: signadot-agent-namespaced
+subjects:
+- kind: ServiceAccount
+  name: agent
+  namespace: signadot
+{{ end }}
+{{ end }}

signadot/operator/templates/forkedworkloads.signadot.com-customresourcedefinition.yaml

@@ -71,6 +71,8 @@ spec:
                 - kind
                 - name
                 type: object
+              disableSandboxTrafficManager:
+                type: boolean
               patches:
                 description: List of patches to be applied to the baseline workload
                 items:

signadot/operator/templates/io-context-server-deployment.yaml

@@ -45,4 +45,8 @@ spec:
         name: io-context-server
         ports:
         - containerPort: 8443
+{{- with .Values }}{{- with .ioContextServer }}{{- with .resources }}
+        resources:
+{{ toYaml . | indent 10 }}
+{{- else -}}{{- end }}{{- else -}}{{- end }}{{- else -}}{{- end }}
       serviceAccountName: io-context-server

signadot/operator/templates/jobs.signadot.com-customresourcedefinition.yaml

@@ -151,11 +151,16 @@ spec:
               trafficManager:
                 description: Traffic manager settings
                 properties:
+                  enabled:
+                    description: Explicitly enable traffic manager in runner pods
+                      for this job.
+                    type: boolean
                   injectRoutingKey:
                     default: Disabled
                     description: |-
                       Enable the automatic insertion of routing key headers for HTTP and gRPC
-                      (H2C) traffic
+                      (H2C) traffic. The "auto" value will overwrite the value of the Enabled
+                      field, setting it to true.
                     enum:
                     - Disabled
                     - Auto

signadot/operator/templates/routeserver-deployment.yaml

@@ -48,4 +48,8 @@ spec:
           name: http-legacy
         - containerPort: 9090
           name: http-metrics
+{{- with .Values }}{{- with .routeServer }}{{- with .resources }}
+        resources:
+{{ toYaml . | indent 10 }}
+{{- else -}}{{- end }}{{- else -}}{{- end }}{{- else -}}{{- end }}
       serviceAccountName: routeserver

signadot/operator/templates/signadot-agent-clusterrole.yaml

@@ -38,51 +38,9 @@ rules:
 - apiGroups:
   - ""
   resources:
-  - pods
-  - pods/log
-  - services
   - namespaces
   verbs:
   - get
   - list
   - watch
-- apiGroups:
-  - ""
-  - events.k8s.io
-  resources:
-  - events
-  verbs:
-  - get
-  - list
-  - watch
-  - create
-  - update
-  - delete
-- apiGroups:
-  - apps
-  resources:
-  - deployments
-  - replicasets
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - argoproj.io
-  resources:
-  - rollouts
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - ""
-  resourceNames:
-  - signadot-cluster-config
-  resources:
-  - configmaps
-  verbs:
-  - get
-  - list
-  - watch
 {{ end }}

signadot/operator/templates/signadot-agent-namespaced-clusterrole.yaml

@@ -0,0 +1,55 @@
+# This file is generated. Do not edit.
+{{ if not .Values.disableAgent }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations:
+    {{- range $key, $val := .Values.commonAnnotations }}
+    {{ $key | quote }}: {{ $val | quote }}
+    {{- end }}
+  labels:
+    {{- range $key, $val := .Values.commonLabels }}
+    {{ $key | quote }}: {{ $val | quote }}
+    {{- end }}
+  name: signadot-agent-namespaced
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - pods/log
+  - services
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  - events.k8s.io
+  resources:
+  - events
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - delete
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - replicasets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - argoproj.io
+  resources:
+  - rollouts
+  verbs:
+  - get
+  - list
+  - watch
+{{ end }}