feat(helm): support Cloud configuration and finalizer permissions

charts/function-mesh-operator/README.md

@@ -36,6 +36,8 @@ function mesh operator Helm chart for Kubernetes
 | controllerManager.create | bool | `true` |  |
 | controllerManager.enableInitContainers | bool | `false` |  |
 | controllerManager.enableLeaderElection | bool | `true` |  |
+| controllerManager.extraEnv | list | `[]` | Additional operator environment variables; do not repeat NAMESPACE or ENABLE_WEBHOOKS. |
+| controllerManager.extraEnvFrom | list | `[]` | ConfigMap and Secret references for operator environment variables. |
 | controllerManager.globalBackendConfig | string | `"global-backend-config"` |  |
 | controllerManager.globalBackendConfigNamespace | string | `"default"` |  |
 | controllerManager.healthProbe.port | int | `8000` |  |

charts/function-mesh-operator/charts/admission-webhook/README.md

@@ -20,7 +20,9 @@ function mesh admission webhook Helm chart for Kubernetes
 
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
+| admissionWebhook.certificate.commonName | string | `""` | Optional subject Common Name for the cert-manager serving certificate. |
 | admissionWebhook.certificate.provider | string | `"cert-manager"` |  |
+| admissionWebhook.crdAnnotations | object | `{}` | Additional annotations applied to every Function Mesh CRD. |
 | admissionWebhook.enabled | bool | `true` |  |
 | admissionWebhook.failurePolicy | string | `"Fail"` |  |
 | admissionWebhook.secretsWebhookNamespace | string | `"default"` |  |

charts/function-mesh-operator/charts/admission-webhook/templates/certificates.yaml

@@ -7,6 +7,9 @@ metadata:
   labels:
     {{- include "function-mesh-operator.labels" . | nindent 4 }}
 spec:
+  {{- with .Values.admissionWebhook.certificate.commonName }}
+  commonName: {{ . | quote }}
+  {{- end }}
   dnsNames:
     - {{ include "function-mesh-operator.certificate.commonName" . }}
   issuerRef:

charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-backendconfigs.yaml

@@ -3,6 +3,9 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    {{- with .Values.admissionWebhook.crdAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
     {{- if eq .Values.admissionWebhook.certificate.provider "cert-manager" }}
       {{- include "function-mesh-operator.certManager.annotation" . | nindent 4 -}}
     {{- end }}

charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-functionmeshes.yaml

@@ -3,6 +3,9 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    {{- with .Values.admissionWebhook.crdAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
     controller-gen.kubebuilder.io/version: v0.16.5
   name: functionmeshes.compute.functionmesh.io
 spec:

charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-functions.yaml

@@ -3,6 +3,9 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    {{- with .Values.admissionWebhook.crdAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
     {{- if eq .Values.admissionWebhook.certificate.provider "cert-manager" }}
       {{- include "function-mesh-operator.certManager.annotation" . | nindent 4 -}}
     {{- end }}

charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-sinks.yaml

@@ -3,6 +3,9 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    {{- with .Values.admissionWebhook.crdAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
     {{- if eq .Values.admissionWebhook.certificate.provider "cert-manager" }}
       {{- include "function-mesh-operator.certManager.annotation" . | nindent 4 -}}
     {{- end }}

charts/function-mesh-operator/charts/admission-webhook/templates/crd-compute.functionmesh.io-sources.yaml

@@ -3,6 +3,9 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
+    {{- with .Values.admissionWebhook.crdAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
     {{- if eq .Values.admissionWebhook.certificate.provider "cert-manager" }}
       {{- include "function-mesh-operator.certManager.annotation" . | nindent 4 -}}
     {{- end }}

charts/function-mesh-operator/charts/admission-webhook/values.yaml

@@ -4,9 +4,13 @@
 
 admissionWebhook:
   enabled: true
+  # -- Additional annotations applied to every Function Mesh CRD.
+  crdAnnotations: {}
   secretsWebhookNamespace: default
   failurePolicy: Fail
   certificate:
+    # -- Optional subject Common Name for the cert-manager serving certificate.
+    commonName: ""
     ## The available providers are:
     ##   "cert-manager": manage certificates with Cert-Manager, default
     ##   "custom": provide custom certificates, you need to install the `function-mesh-secrets-webhook` chart first

charts/function-mesh-operator/templates/controller-manager-deployment.yaml

@@ -83,6 +83,13 @@ spec:
                 fieldPath: metadata.namespace
           - name: ENABLE_WEBHOOKS
             value: {{ .Values.admissionWebhook.enabled | quote }}
+          {{- with .Values.controllerManager.extraEnv }}
+          {{- toYaml . | nindent 10 }}
+          {{- end }}
+        {{- with .Values.controllerManager.extraEnvFrom }}
+        envFrom:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
         volumeMounts:
         {{- include "function-mesh-operator.volumeMounts" . | nindent 8 }}
         livenessProbe:

charts/function-mesh-operator/templates/controller-manager-rbac.yaml

@@ -168,6 +168,15 @@ rules:
       - patch
       - update
       - watch
+  - apiGroups:
+      - compute.functionmesh.io
+    resources:
+      - functions/finalizers
+      - sources/finalizers
+      - sinks/finalizers
+    verbs:
+      - get
+      - update
   - apiGroups:
       - compute.functionmesh.io
     resources:

charts/function-mesh-operator/values.yaml

@@ -17,6 +17,10 @@ imagePullSecrets: []
 
 controllerManager:
   create: true
+  # -- Additional operator environment variables; do not repeat NAMESPACE or ENABLE_WEBHOOKS.
+  extraEnv: []
+  # -- ConfigMap and Secret references for operator environment variables.
+  extraEnvFrom: []
   # With rbac.create=false, the user is responsible for creating this account
   # With rbac.create=true, this service account will be created
   # Also see rbac.create and clusterScoped

hack/gen-helm-crd-templates.sh

@@ -32,6 +32,9 @@ function crd::convert_metadata() {
     echo "metadata:"
     # metadata.annotations
     echo "annotations:" | sed  "s/^/$(crd::nindent 1)/"
+    echo '{{- with .Values.admissionWebhook.crdAnnotations }}' | sed "s/^/$(crd::nindent 2)/"
+    echo '{{- toYaml . | nindent 4 }}' | sed "s/^/$(crd::nindent 2)/"
+    echo '{{- end }}' | sed "s/^/$(crd::nindent 2)/"
     if "$webhook_enabled"; then
         echo "{{- if eq .Values.admissionWebhook.certificate.provider \"cert-manager\" }}" | sed  "s/^/$(crd::nindent 2)/"
         echo "{{- include \"function-mesh-operator.certManager.annotation\" . | nindent 4 -}}" | sed  "s/^/$(crd::nindent 3)/"
@@ -158,4 +161,4 @@ function crd::main() {
     crd::generate_template "$source_file" "$target_file" true
 }
 
-crd::main
+crd::main