ACM-24258: handle K8s charts #356

rccrdpccl · 2025-10-10T16:04:36Z

adding the possibility to publish k8s charts.
if the config folder config-k8s/<PROJECT> is found, a new chart PROJECT-k8s will be generated in charts/

moved some deleting logic to kustomize
added hack.sh to deal with cases where kustomize cannot help
added config for k8s charts
added logic to handle k8s chart creation
added generated charts

marek-veber · 2025-10-14T12:17:47Z

scripts/build.sh

@@ -1,6 +1,7 @@
 #!/bin/bash
-set -e
+set -ex


let's remove x for the final version

marek-veber · 2025-10-16T13:12:49Z

scripts/build.sh

+    kustomize_build "$PROJECT" "${output_suffix}"
+}
+
+tmp_output_dir=$(mktemp -d -p ${WKDIR})


There is no out dir in clean checkout :(

Suggested change

tmp_output_dir=$(mktemp -d -p ${WKDIR})

mkdir -p ${WKDIR}

tmp_output_dir=$(mktemp -d -p ${WKDIR})

mkdir -p will create all necessary folder in the tree

edit: you're right, mktemp doesn't have the same behaviour

marek-veber · 2025-10-16T13:17:37Z

The cluster-api-provider-aws was updated by @mzazrivec & @serngawy ;) We can refresh charts/cluster-api-provider-aws.

clwheel · 2025-10-16T18:15:12Z

...-openshift-assisted-k8s/templates/apps_v1_deployment_capoa-bootstrap-controller-manager.yaml

+        - name: NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace


Need to include the ASSISTED_CA_BUNDLE_* env vars to point to the secret inside the MCE target namespace...

- name: ASSISTED_CA_BUNDLE_NAME value: assisted-installer-ca - name: ASSISTED_CA_BUNDLE_NAMESPACE value: {{ .Release.Namespace }} - name: ASSISTED_CA_BUNDLE_RESOURCE value: secret - name: ASSISTED_CA_BUNDLE_KEY value: ca.crt

clwheel · 2025-10-16T18:36:04Z

config-k8s/cluster-api-provider-openshift-assisted/bootstrap/kustomization.yaml

+      path: /spec/template/spec/containers/0/env/-
+      value:
+        name: ASSISTED_CA_BUNDLE_KEY
+        value: "ca.crt"


Patches are needed to ensure that capoa-bootstrap-validating-webhook-configuration reflects the target namespace...

- target: version: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration name: capoa-bootstrap-validating-webhook-configuration patch: |- - op: replace path: /metadata/annotations/cert-manager.io~1inject-ca-from value: '{{ .Release.Namespace }}/capoa-bootstrap-cert' - op: replace path: /webhooks/0/clientConfig/service/namespace value: '{{ .Release.Namespace }}'

serngawy · 2025-10-20T16:44:02Z

config-k8s/cluster-api/kustomization.yaml

+    patch: |-
+      - op: replace
+        path: /metadata/annotations/cert-manager.io~1inject-ca-from
+        value: "{{ .Release.Namespace }}/capi-serving-cert"


Where is this value {{ .Release.Namespace }} will come from ?

This will be rendered by the chart import process, and be swapped for NAMESPACE_PLACEHOLDER. It will then swapped back to the "release namespace" (i.e. multicluster-engine) when backplane-operator is going to render it. We discussed this choice with @cameronmwall , this is the recommended way to express "release namespace name"

serngawy · 2025-10-20T16:47:19Z

config/cluster-api-provider-metal3/delete-certificate.yaml

@@ -0,0 +1,6 @@
+$patch: delete


are we adding the Cert CR then deleting it ? why not keeping it as before not included and include it only with k8s chart.

I thought having every change centralized in kustomize would be easier to maintain/follow compared to split logic throughout build.sh/sync2chart.sh and charts.
This is why we've added the hack script: so we can customize stuff within the config folder instead of some "complicated" generic logic.
If you do not agree we can find a better solution.

serngawy · 2025-10-20T16:56:05Z

scripts/build.sh

-if [ "$PROJECT" == "cluster-api" ] ; then
-    rm -rf $CONFIGDIR/$TMPDIR/apiextensions.k8s.io_v1_customresourcedefinition_ip*.yaml
+# Helper function to build kustomize resources from a specific config directory
+_kustomize_build() {


As there is kustomize_build func better name could _kustomize_config_build

serngawy · 2025-10-20T17:04:19Z

scripts/sync2chart.sh

+    rm -rf "$chartdir/crds/*.yaml"
+}
+
+_sync_chart_files() {


Suggested change

_sync_chart_files() {

_move_chart_files() {

serngawy · 2025-10-20T17:06:06Z

scripts/sync2chart.sh

+    echo "generated helm template output to $k8s_output_file"
+}
+
+_generate_helm_template() {


Suggested change

_generate_helm_template() {

_save_helm_template() {

Is there a reason you repeating the functions names ?

Not really, the logic was naming the "public" function, then abstracting within for handling the two types of config (OCP and k8s). As the semantic was just the same, but by config, I've just named the same as the parent function but with prepending _ (meaning private method, although I know it's not really private)

Co-authored-by: Chris Wheeler <[email protected]> Signed-off-by: Riccardo Piccoli <[email protected]>

serngawy · 2025-10-21T20:52:37Z

/lgtm

openshift-ci · 2025-10-21T20:52:47Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rccrdpccl, serngawy

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [serngawy]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

marek-veber reviewed Oct 14, 2025

View reviewed changes

scripts/build.sh Outdated

@@ -1,6 +1,7 @@

#!/bin/bash

set -e

set -ex

Copy link

Collaborator

marek-veber Oct 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's remove x for the final version

rccrdpccl force-pushed the k8s-charts branch from f700f59 to 4f54ef5 Compare October 16, 2025 13:11

marek-veber reviewed Oct 16, 2025

View reviewed changes

rccrdpccl force-pushed the k8s-charts branch 2 times, most recently from cc38a21 to c6814f6 Compare October 16, 2025 16:10

clwheel reviewed Oct 16, 2025

View reviewed changes

rccrdpccl force-pushed the k8s-charts branch from c6814f6 to e22c473 Compare October 17, 2025 09:36

serngawy reviewed Oct 20, 2025

View reviewed changes

rccrdpccl force-pushed the k8s-charts branch 3 times, most recently from 57f200c to 5800c26 Compare October 21, 2025 15:53

Support k8s charts

0963f05

Co-authored-by: Chris Wheeler <[email protected]> Signed-off-by: Riccardo Piccoli <[email protected]>

rccrdpccl force-pushed the k8s-charts branch from 58de6e3 to 0963f05 Compare October 21, 2025 20:46

serngawy approved these changes Oct 21, 2025

View reviewed changes

openshift-ci bot assigned serngawy Oct 21, 2025

openshift-ci bot added lgtm approved labels Oct 21, 2025

openshift-merge-bot bot merged commit 31ca846 into stolostron:backplane-2.10 Oct 21, 2025
3 checks passed

	tmp_output_dir=$(mktemp -d -p ${WKDIR})
	mkdir -p ${WKDIR}
	tmp_output_dir=$(mktemp -d -p ${WKDIR})

ACM-24258: handle K8s charts #356

ACM-24258: handle K8s charts #356

Uh oh!

Conversation

rccrdpccl commented Oct 10, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rccrdpccl Oct 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

marek-veber commented Oct 16, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

serngawy commented Oct 21, 2025

Uh oh!

openshift-ci bot commented Oct 21, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

rccrdpccl Oct 16, 2025 •

edited

Loading