diff --git a/charts/nebari-operator/Chart.yaml b/charts/nebari-operator/Chart.yaml index 86d2f61..8f06d90 100644 --- a/charts/nebari-operator/Chart.yaml +++ b/charts/nebari-operator/Chart.yaml @@ -3,8 +3,8 @@ name: nebari-operator description: A Helm chart to distribute nebari-operator type: application -version: 0.1.0-alpha.20 -appVersion: "v0.1.0-alpha.20" +version: 0.1.0 +appVersion: "v0.1.0" keywords: - kubernetes diff --git a/charts/nebari-operator/templates/_helpers.tpl b/charts/nebari-operator/templates/_helpers.tpl index 2cf9988..9f35264 100644 --- a/charts/nebari-operator/templates/_helpers.tpl +++ b/charts/nebari-operator/templates/_helpers.tpl @@ -51,11 +51,11 @@ Dynamically calculates safe truncation to ensure total name length <= 63 chars. {{/* ServiceAccount name to use. -If serviceAccount.enable is false and serviceAccount.name is set, use that name. +If serviceAccount.enabled is false and serviceAccount.name is set, use that name. Otherwise, use the standard resourceName helper with "controller-manager" suffix. */}} {{- define "nebari-operator.serviceAccountName" -}} -{{- if and (not (.Values.serviceAccount.enable | default true)) .Values.serviceAccount.name }} +{{- if and (not (.Values.serviceAccount.enabled | default true)) .Values.serviceAccount.name }} {{- .Values.serviceAccount.name }} {{- else }} {{- include "nebari-operator.resourceName" (dict "suffix" "controller-manager" "context" .) }} diff --git a/charts/nebari-operator/templates/crd/nebariapps.reconcilers.nebari.dev.yaml b/charts/nebari-operator/templates/crd/nebariapps.reconcilers.nebari.dev.yaml index 77757f6..9c5ddae 100644 --- a/charts/nebari-operator/templates/crd/nebariapps.reconcilers.nebari.dev.yaml +++ b/charts/nebari-operator/templates/crd/nebariapps.reconcilers.nebari.dev.yaml @@ -1,4 +1,4 @@ -{{- if .Values.crd.enable }} +{{- if .Values.crd.enabled }} apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: @@ -406,9 +406,20 @@ spec: icon: description: |- Icon is an identifier for the service icon (e.g., "jupyter", "grafana") - or a URL to a custom icon image. + or a URL to a custom icon image. Shown in both light and dark mode when + IconLight/IconDark are not set. Supported built-in icons: jupyter, grafana, prometheus, keycloak, argocd, kubernetes type: string + iconDark: + description: |- + IconDark is the URL of the icon to display when the UI is in dark mode. + Takes precedence over Icon in dark mode. + type: string + iconLight: + description: |- + IconLight is the URL of the icon to display when the UI is in light mode. + Takes precedence over Icon in light mode. + type: string priority: default: 100 description: |- @@ -712,7 +723,14 @@ spec: of last reconciliation. type: boolean icon: - description: Icon identifies the service icon. + description: Icon identifies the service icon (default, shown + in both light and dark mode). + type: string + iconDark: + description: IconDark is the icon URL for dark mode. + type: string + iconLight: + description: IconLight is the icon URL for light mode. type: string priority: description: Priority controls sort order within a category (lower diff --git a/charts/nebari-operator/templates/manager/manager.yaml b/charts/nebari-operator/templates/manager/manager.yaml index 1bf630b..eb942b6 100644 --- a/charts/nebari-operator/templates/manager/manager.yaml +++ b/charts/nebari-operator/templates/manager/manager.yaml @@ -74,7 +74,7 @@ spec: {{- end }} containers: - args: - {{- if .Values.metrics.enable }} + {{- if .Values.metrics.enabled }} - --metrics-bind-address=:{{ .Values.metrics.port }} {{- if not .Values.metrics.secure }} - --metrics-secure=false diff --git a/charts/nebari-operator/templates/metrics/controller-manager-metrics-service.yaml b/charts/nebari-operator/templates/metrics/controller-manager-metrics-service.yaml index 89b5c59..c0b52e9 100644 --- a/charts/nebari-operator/templates/metrics/controller-manager-metrics-service.yaml +++ b/charts/nebari-operator/templates/metrics/controller-manager-metrics-service.yaml @@ -1,4 +1,4 @@ -{{- if .Values.metrics.enable }} +{{- if .Values.metrics.enabled }} apiVersion: v1 kind: Service metadata: diff --git a/charts/nebari-operator/templates/network-policy/allow-metrics-traffic.yaml b/charts/nebari-operator/templates/network-policy/allow-metrics-traffic.yaml new file mode 100644 index 0000000..d392ef8 --- /dev/null +++ b/charts/nebari-operator/templates/network-policy/allow-metrics-traffic.yaml @@ -0,0 +1,25 @@ +{{- if .Values.networkPolicy.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/name: {{ include "nebari-operator.name" . }} + name: {{ include "nebari-operator.resourceName" (dict "suffix" "allow-metrics-traffic" "context" $) }} + namespace: {{ .Release.Namespace }} +spec: + podSelector: + matchLabels: + control-plane: controller-manager + app.kubernetes.io/name: {{ include "nebari-operator.name" . }} + policyTypes: + - Ingress + ingress: + - from: + - namespaceSelector: + matchLabels: + metrics: enabled + ports: + - port: {{ .Values.metrics.port }} + protocol: TCP +{{- end }} diff --git a/charts/nebari-operator/templates/prometheus/controller-manager-metrics-monitor.yaml b/charts/nebari-operator/templates/prometheus/controller-manager-metrics-monitor.yaml index 8f69c87..e460619 100644 --- a/charts/nebari-operator/templates/prometheus/controller-manager-metrics-monitor.yaml +++ b/charts/nebari-operator/templates/prometheus/controller-manager-metrics-monitor.yaml @@ -1,4 +1,4 @@ -{{- if .Values.prometheus.enable }} +{{- if .Values.prometheus.enabled }} apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: @@ -21,7 +21,7 @@ spec: {{- if .Values.metrics.secure }} tlsConfig: serverName: {{ include "nebari-operator.resourceName" (dict "suffix" "controller-manager-metrics-service" "context" $) }}.{{ .Release.Namespace }}.svc - {{- if .Values.certManager.enable }} + {{- if .Values.certManager.enabled }} ca: secret: name: metrics-server-cert diff --git a/charts/nebari-operator/templates/rbac/controller-manager.yaml b/charts/nebari-operator/templates/rbac/controller-manager.yaml index 5d6336b..96113bc 100644 --- a/charts/nebari-operator/templates/rbac/controller-manager.yaml +++ b/charts/nebari-operator/templates/rbac/controller-manager.yaml @@ -1,4 +1,4 @@ -{{- if ne .Values.serviceAccount.enable false }} +{{- if ne .Values.serviceAccount.enabled false }} apiVersion: v1 kind: ServiceAccount metadata: diff --git a/charts/nebari-operator/templates/rbac/metrics-auth-role.yaml b/charts/nebari-operator/templates/rbac/metrics-auth-role.yaml index 3f76015..db7fa69 100644 --- a/charts/nebari-operator/templates/rbac/metrics-auth-role.yaml +++ b/charts/nebari-operator/templates/rbac/metrics-auth-role.yaml @@ -1,4 +1,4 @@ -{{- if and .Values.metrics.enable .Values.metrics.secure }} +{{- if and .Values.metrics.enabled .Values.metrics.secure }} apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: diff --git a/charts/nebari-operator/templates/rbac/metrics-auth-rolebinding.yaml b/charts/nebari-operator/templates/rbac/metrics-auth-rolebinding.yaml index 5aff29e..97682f6 100644 --- a/charts/nebari-operator/templates/rbac/metrics-auth-rolebinding.yaml +++ b/charts/nebari-operator/templates/rbac/metrics-auth-rolebinding.yaml @@ -1,4 +1,4 @@ -{{- if and .Values.metrics.enable .Values.metrics.secure }} +{{- if and .Values.metrics.enabled .Values.metrics.secure }} apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: diff --git a/charts/nebari-operator/templates/rbac/metrics-reader.yaml b/charts/nebari-operator/templates/rbac/metrics-reader.yaml index 6b50400..f0681cc 100644 --- a/charts/nebari-operator/templates/rbac/metrics-reader.yaml +++ b/charts/nebari-operator/templates/rbac/metrics-reader.yaml @@ -1,4 +1,4 @@ -{{- if and .Values.metrics.enable .Values.metrics.secure }} +{{- if and .Values.metrics.enabled .Values.metrics.secure }} apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: diff --git a/charts/nebari-operator/templates/rbac/nebariapp-admin-role.yaml b/charts/nebari-operator/templates/rbac/nebariapp-admin-role.yaml index 107905c..ef776c6 100644 --- a/charts/nebari-operator/templates/rbac/nebariapp-admin-role.yaml +++ b/charts/nebari-operator/templates/rbac/nebariapp-admin-role.yaml @@ -1,4 +1,4 @@ -{{- if .Values.rbac.helpers.enable }} +{{- if .Values.rbac.helpers.enabled }} apiVersion: rbac.authorization.k8s.io/v1 {{- if .Values.rbac.namespaced }} kind: Role diff --git a/charts/nebari-operator/templates/rbac/nebariapp-editor-role.yaml b/charts/nebari-operator/templates/rbac/nebariapp-editor-role.yaml index 5bf9abe..ac6e3b4 100644 --- a/charts/nebari-operator/templates/rbac/nebariapp-editor-role.yaml +++ b/charts/nebari-operator/templates/rbac/nebariapp-editor-role.yaml @@ -1,4 +1,4 @@ -{{- if .Values.rbac.helpers.enable }} +{{- if .Values.rbac.helpers.enabled }} apiVersion: rbac.authorization.k8s.io/v1 {{- if .Values.rbac.namespaced }} kind: Role diff --git a/charts/nebari-operator/templates/rbac/nebariapp-viewer-role.yaml b/charts/nebari-operator/templates/rbac/nebariapp-viewer-role.yaml index e4698bf..a8bb784 100644 --- a/charts/nebari-operator/templates/rbac/nebariapp-viewer-role.yaml +++ b/charts/nebari-operator/templates/rbac/nebariapp-viewer-role.yaml @@ -1,4 +1,4 @@ -{{- if .Values.rbac.helpers.enable }} +{{- if .Values.rbac.helpers.enabled }} apiVersion: rbac.authorization.k8s.io/v1 {{- if .Values.rbac.namespaced }} kind: Role diff --git a/charts/nebari-operator/values.yaml b/charts/nebari-operator/values.yaml index 85fb4ca..a432242 100644 --- a/charts/nebari-operator/values.yaml +++ b/charts/nebari-operator/values.yaml @@ -19,7 +19,7 @@ manager: repository: quay.io/nebari/nebari-operator ## Image tag (defaults to Chart.appVersion if not set) ## - tag: "v0.1.0-alpha.20" + tag: "v0.1.0" pullPolicy: IfNotPresent ## Arguments @@ -138,16 +138,16 @@ rbac: helpers: ## Install convenience admin/editor/viewer roles for CRDs ## - enable: false + enabled: false ## ServiceAccount configuration ## serviceAccount: # Install default ServiceAccount provided - enable: true + enabled: true - ## Existing ServiceAccount name (only when enable=false) - ## Note: When enable=true, respects nameOverride/fullnameOverride + ## Existing ServiceAccount name (only when enabled=false) + ## Note: When enabled=true, respects nameOverride/fullnameOverride ## # name: "" @@ -163,7 +163,7 @@ serviceAccount: ## crd: # Install CRDs with the chart - enable: true + enabled: true # Keep CRDs when uninstalling keep: true @@ -171,7 +171,7 @@ crd: ## Enable to expose /metrics endpoint ## metrics: - enable: true + enabled: true # Metrics server port port: 8443 # Enable secure metrics: HTTPS with certs/auth (true) or HTTP (false). @@ -182,11 +182,17 @@ metrics: ## Required for webhook certificates and metrics endpoint certificates. ## certManager: - enable: false + enabled: false ## Prometheus ServiceMonitor for metrics scraping. ## Requires prometheus-operator to be installed in the cluster. ## prometheus: - enable: false + enabled: false + +## Network policies for controlling traffic flow. +## Enable to restrict ingress to the controller manager. +## +networkPolicy: + enabled: false