build(helm)!: support for CapsuleConfiguration CRD

charts/capsule/crds/capsuleconfiguration-crd.yaml

@@ -0,0 +1,62 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.5.0
+  creationTimestamp: null
+  name: capsuleconfigurations.capsule.clastix.io
+spec:
+  group: capsule.clastix.io
+  names:
+    kind: CapsuleConfiguration
+    listKind: CapsuleConfigurationList
+    plural: capsuleconfigurations
+    singular: capsuleconfiguration
+  scope: Cluster
+  versions:
+    - name: v1alpha1
+      schema:
+        openAPIV3Schema:
+          description: CapsuleConfiguration is the Schema for the Capsule configuration API
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: CapsuleConfigurationSpec defines the Capsule configuration
+              properties:
+                allowIngressHostnameCollision:
+                  default: true
+                  description: Allow the collision of Ingress resource hostnames across all the Tenants.
+                  type: boolean
+                allowTenantIngressHostnamesCollision:
+                  description: "When defining the exact match for allowed Ingress hostnames at Tenant level, a collision is not allowed. Toggling this, Capsule will not check if a hostname collision is in place, allowing the creation of two or more Tenant resources although sharing the same allowed hostname(s). \n The JSON path of the resource is: /spec/ingressHostnames/allowed"
+                  type: boolean
+                forceTenantPrefix:
+                  description: Enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix, separated by a dash. This is useful to avoid Namespace name collision in a public CaaS environment.
+                  type: boolean
+                protectedNamespaceRegex:
+                  description: Disallow creation of namespaces, whose name matches this regexp
+                  type: string
+                userGroups:
+                  default:
+                    - capsule.clastix.io
+                  description: Names of the groups for Capsule users.
+                  items:
+                    type: string
+                  type: array
+              type: object
+          type: object
+      served: true
+      storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

charts/capsule/templates/configuration-default.yaml

@@ -0,0 +1,13 @@
+apiVersion: capsule.clastix.io/v1alpha1
+kind: CapsuleConfiguration
+metadata:
+  name: default
+spec:
+  forceTenantPrefix: {{ .Values.manager.options.forceTenantPrefix }}
+  userGroups:
+{{- range .Values.manager.options.capsuleUserGroups }}
+    - {{ . }}
+{{- end}}
+  protectedNamespaceRegex: {{ .Values.manager.options.protectedNamespaceRegex | quote }}
+  allowTenantIngressHostnamesCollision: {{ .Values.manager.options.allowIngressHostnameCollision }}
+  allowIngressHostnameCollision: {{ .Values.manager.options.allowTenantIngressHostnamesCollision }}

charts/capsule/templates/deployment.yaml

@@ -48,11 +48,7 @@ spec:
           args:
           - --enable-leader-election
           - --zap-log-level={{ default 4 .Values.manager.options.logLevel }}
-          {{ if .Values.manager.options.forceTenantPrefix }}- --force-tenant-prefix={{ .Values.manager.options.forceTenantPrefix }}{{ end }}
-          {{ if .Values.manager.options.capsuleUserGroup }}- --capsule-user-group={{ .Values.manager.options.capsuleUserGroup }}{{ end }}
-          {{ if .Values.manager.options.protectedNamespaceRegex }}- --protected-namespace-regex={{ .Values.manager.options.protectedNamespaceRegex }}{{ end }}
-          - --allow-ingress-hostname-collision={{ .Values.manager.options.allowIngressHostnameCollision | default "true" }}
-          - --allow-tenant-ingress-hostnames-collision={{ .Values.manager.allowTenantIngressHostnamesCollision | default "false" }}
+          - --configuration-name=default
           image: {{ include "capsule.managerFullyQualifiedDockerImage" . }}
           imagePullPolicy: {{ .Values.manager.image.pullPolicy }}
           env:

charts/capsule/values.yaml

@@ -10,11 +10,11 @@ manager:
   # Additional Capsule options
   options:
     logLevel: '4'
-    forceTenantPrefix:
-    capsuleUserGroup:
-    protectedNamespaceRegex:
-    allowIngressHostnameCollision:
-    allowTenantIngressHostnamesCollision:
+    forceTenantPrefix: false
+    capsuleUserGroups: ["capsule.clastix.io"]
+    protectedNamespaceRegex: ""
+    allowIngressHostnameCollision: true
+    allowTenantIngressHostnamesCollision: false
   livenessProbe:
     httpGet:
       path: /healthz