feat(helm): allow to configure nodeMetadata for CapsuleConfiguration

ADOPTERS.md

@@ -10,6 +10,15 @@ This is a list of companies that have adopted Capsule, feel free to open a Pull-
 ### [Fastweb](https://www.fastweb.it/)
 ![Fastweb](https://www.fastweb.it/grandi-aziende/gfx/common/logo-fastweb-header.svg)
 
+### [Politecnico di Torino](https://www.polito.it/)
+![Politecnico di Torino](https://www.polito.it/themes/custom/polito/logo.svg)
+
+### [Reevo](https://www.reevo.it/)
+![Reevo Cloud and CyberSecurity](https://www.dropbox.com/s/x3q6r0oqstgvtdr/Logo_ReeVo_270x200px.svg)
+
+### [University of Torino](https://www.unito.it)
+![University of Torino](https://www.unito.it/sites/all/themes/bsunito/img/logo_new_2022.svg)
+
 ### [Velocity](https://velocity.tech/)
 ![Velocity](https://raw.githubusercontent.com/yarelm/velocity-logo/main/velocity.png)
 

charts/capsule/Chart.yaml

@@ -21,7 +21,7 @@ sources:
 
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: 0.4.1
+version: 0.4.2
 
 # This is the version number of the application being deployed.
 # This version number should be incremented each time you make changes to the application.

charts/capsule/README.md

@@ -101,6 +101,7 @@ Here the values you can override:
 | manager.options.forceTenantPrefix | bool | `false` | Boolean, enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix, separated by a dash |
 | manager.options.generateCertificates | bool | `true` | Specifies whether capsule webhooks certificates should be generated by capsule operator |
 | manager.options.logLevel | string | `"4"` | Set the log verbosity of the capsule with a value from 1 to 10 |
+| manager.options.nodeMetadata | object | `{"forbiddenAnnotations":{"denied":[],"deniedRegex":""},"forbiddenLabels":{"denied":[],"deniedRegex":""}}` | Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant |
 | manager.options.protectedNamespaceRegex | string | `""` | If specified, disallows creation of namespaces matching the passed regexp |
 | manager.readinessProbe | object | `{"httpGet":{"path":"/readyz","port":10080}}` | Configure the readiness probe using Deployment probe spec |
 | manager.resources.limits.cpu | string | `"200m"` |  |

charts/capsule/templates/configuration-default.yaml

@@ -20,3 +20,7 @@ spec:
     - {{ . }}
 {{- end}}
   protectedNamespaceRegex: {{ .Values.manager.options.protectedNamespaceRegex | quote }}
+  {{- with .Values.manager.options.nodeMetadata }}
+  nodeMetadata:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}

charts/capsule/values.yaml

@@ -51,6 +51,14 @@ manager:
     protectedNamespaceRegex: ""
     # -- Specifies whether capsule webhooks certificates should be generated by capsule operator
     generateCertificates: true
+    # -- Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant
+    nodeMetadata:
+      forbiddenLabels:
+        denied: []
+        deniedRegex: ""
+      forbiddenAnnotations:
+        denied: []
+        deniedRegex: ""
 
   # -- Configure the liveness probe using Deployment probe spec
   livenessProbe: