[Helm] - disable cluster wide rbac resource creation

.github/workflows/test-chart.yml

@@ -0,0 +1,78 @@
+name: Test Chart
+
+on:
+  push:
+  pull_request:
+
+permissions: {}
+
+jobs:
+  test-e2e:
+    permissions:
+      contents: read
+    name: Run on Ubuntu
+    runs-on: ubuntu-latest
+    env:
+      IMG: controller:latest
+    steps:
+      - name: Clone the code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Setup Go
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        with:
+          go-version-file: go.mod
+
+      - name: Install the latest version of kind
+        run: |
+          curl -Lo ./kind https://kind.sigs.k8s.io/dl/latest/kind-linux-$(go env GOARCH)
+          chmod +x ./kind
+          sudo mv ./kind /usr/local/bin/kind
+
+      - name: Verify kind installation
+        run: kind version
+
+      - name: Create kind cluster
+        run: kind create cluster
+
+      - name: Prepare clickhouse-operator
+        run: |
+          go mod tidy
+          make docker-build
+          kind load docker-image $IMG
+
+      - name: Install Helm
+        run: make install-helm
+
+      - name: Lint Helm Chart
+        run: |
+          helm lint ./dist/chart
+
+
+      - name: Install cert-manager via Helm (wait for readiness)
+        run: |
+          helm repo add jetstack https://charts.jetstack.io
+          helm repo update
+          helm install cert-manager jetstack/cert-manager \
+            --namespace cert-manager \
+            --create-namespace \
+            --set crds.enabled=true \
+            --wait \
+            --timeout 300s
+
+# TODO: Uncomment if Prometheus is enabled
+#      - name: Install Prometheus Operator CRDs
+#        run: |
+#          helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
+#          helm repo update
+#          helm install prometheus-crds prometheus-community/prometheus-operator-crds
+
+      - name: Deploy manager via Helm
+        run: |
+          make helm-deploy
+
+      - name: Check Helm release status
+        run: |
+          make helm-status

config/manager/kustomization.yaml

@@ -5,4 +5,4 @@ kind: Kustomization
 images:
 - name: controller
   newName: ghcr.io/clickhouse/clickhouse-operator
-  newTag: v0.0.1
+  newTag: v0.0.3-34efe55

config/metrics/kustomization.yaml

@@ -9,9 +9,6 @@ patches:
       - op: add
         path: /spec/template/spec/containers/0/args/-
         value: --metrics-bind-address=:8080
-      - op: add
-        path: /spec/template/spec/containers/0/args/-
-        value: --metrics-secure=false
 
       - op: add
         path: /spec/template/spec/containers/0/ports/-

dist/chart/Chart.yaml

@@ -19,4 +19,4 @@ dependencies:
   - name: cert-manager
     version: "v1.19.2"
     repository: "oci://quay.io/jetstack/charts"
-    condition: certManager.install
+    condition: certManager.enable

dist/chart/templates/_helpers.tpl

@@ -2,8 +2,8 @@
 Expand the name of the chart.
 */}}
 {{- define "clickhouse-operator.name" -}}
-{{- default (trimSuffix "-helm" .Chart.Name) .Values.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- end }}q
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
 
 {{/*
 Create a default fully qualified app name.
@@ -14,7 +14,7 @@ If release name contains chart name it will be used as a full name.
 {{- if .Values.fullnameOverride }}
 {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
 {{- else }}
-{{- $name := include "clickhouse-operator.name" . }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
 {{- if contains $name .Release.Name }}
 {{- .Release.Name | trunc 63 | trimSuffix "-" }}
 {{- else }}
@@ -48,15 +48,3 @@ Dynamically calculates safe truncation to ensure total name length <= 63 chars.
 {{- printf "%s-%s" $fullname $suffix | trunc 63 | trimSuffix "-" }}
 {{- end }}
 {{- end }}
-
-{{/*
-Util function for generating the image URL based on the provided options.
-Cribbed from the cert-manager organization.
-*/}}
-{{- define "clickhouse-operator.image" -}}
-{{- $defaultTag := index . 1 -}}
-{{- with index . 0 -}}
-{{ printf .repository }}
-{{- if .digest -}}{{ printf "@%s" .digest }}{{- else -}}{{ printf ":%s" (default $defaultTag .tag) }}{{- end -}}
-{{- end }}
-{{- end }}

dist/chart/templates/cert-manager/selfsigned-issuer.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.certManager.enable (not .Values.certManager.issuerRef) }}
+{{- if .Values.certManager.enable }}
 apiVersion: cert-manager.io/v1
 kind: Issuer
 metadata:

dist/chart/templates/cert-manager/serving-cert.yaml

@@ -3,24 +3,18 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   labels:
-   app.kubernetes.io/managed-by: {{ .Release.Service }}
-   app.kubernetes.io/name: {{ include "clickhouse-operator.name" . }}
-   helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
-   app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/name: {{ include "clickhouse-operator.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
   name: {{ include "clickhouse-operator.resourceName" (dict "suffix" "serving-cert" "context" $) }}
   namespace: {{ .Release.Namespace }}
 spec:
   dnsNames:
-    - {{ include "clickhouse-operator.resourceName" (dict "suffix" "webhook-service" "context" $) }}.{{ .Release.Namespace }}.svc
-    - {{ include "clickhouse-operator.resourceName" (dict "suffix" "webhook-service" "context" $) }}.{{ .Release.Namespace }}.svc.cluster.local
-    - {{ include "clickhouse-operator.resourceName" (dict "suffix" "metrics-service" "context" $) }}.{{ .Release.Namespace }}.svc
-    - {{ include "clickhouse-operator.resourceName" (dict "suffix" "metrics-service" "context" $) }}.{{ .Release.Namespace }}.svc.cluster.local
+  - {{ include "clickhouse-operator.resourceName" (dict "suffix" "webhook-service" "context" $) }}.{{ .Release.Namespace }}.svc
+  - {{ include "clickhouse-operator.resourceName" (dict "suffix" "webhook-service" "context" $) }}.{{ .Release.Namespace }}.svc.cluster.local
   issuerRef:
-  {{- if .Values.certManager.issuerRef}}
-    {{ .Values.certManager.issuerRef | toYaml | nindent 4 }}
-  {{- else }}
     kind: Issuer
     name: {{ include "clickhouse-operator.resourceName" (dict "suffix" "selfsigned-issuer" "context" $) }}
-  {{- end }}
-  secretName: {{ include "clickhouse-operator.resourceName" (dict "suffix" "serving-cert" "context" $) }}
+  secretName: serving-cert
 {{- end }}