chore(charts): sync nebari-operator v0.1.0 from nebari-dev/nebari-operator

charts/nebari-operator/Chart.yaml

@@ -3,8 +3,8 @@ name: nebari-operator
 description: A Helm chart to distribute nebari-operator
 type: application
 
-version: 0.1.0-alpha.20
-appVersion: "v0.1.0-alpha.20"
+version: 0.1.0
+appVersion: "v0.1.0"
 
 keywords:
   - kubernetes

charts/nebari-operator/templates/_helpers.tpl

@@ -51,11 +51,11 @@ Dynamically calculates safe truncation to ensure total name length <= 63 chars.
 
 {{/*
 ServiceAccount name to use.
-If serviceAccount.enable is false and serviceAccount.name is set, use that name.
+If serviceAccount.enabled is false and serviceAccount.name is set, use that name.
 Otherwise, use the standard resourceName helper with "controller-manager" suffix.
 */}}
 {{- define "nebari-operator.serviceAccountName" -}}
-{{- if and (not (.Values.serviceAccount.enable | default true)) .Values.serviceAccount.name }}
+{{- if and (not (.Values.serviceAccount.enabled | default true)) .Values.serviceAccount.name }}
 {{- .Values.serviceAccount.name }}
 {{- else }}
 {{- include "nebari-operator.resourceName" (dict "suffix" "controller-manager" "context" .) }}

charts/nebari-operator/templates/crd/nebariapps.reconcilers.nebari.dev.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.crd.enable }}
+{{- if .Values.crd.enabled }}
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
@@ -406,9 +406,20 @@ spec:
                   icon:
                     description: |-
                       Icon is an identifier for the service icon (e.g., "jupyter", "grafana")
-                      or a URL to a custom icon image.
+                      or a URL to a custom icon image. Shown in both light and dark mode when
+                      IconLight/IconDark are not set.
                       Supported built-in icons: jupyter, grafana, prometheus, keycloak, argocd, kubernetes
                     type: string
+                  iconDark:
+                    description: |-
+                      IconDark is the URL of the icon to display when the UI is in dark mode.
+                      Takes precedence over Icon in dark mode.
+                    type: string
+                  iconLight:
+                    description: |-
+                      IconLight is the URL of the icon to display when the UI is in light mode.
+                      Takes precedence over Icon in light mode.
+                    type: string
                   priority:
                     default: 100
                     description: |-
@@ -712,7 +723,14 @@ spec:
                       of last reconciliation.
                     type: boolean
                   icon:
-                    description: Icon identifies the service icon.
+                    description: Icon identifies the service icon (default, shown
+                      in both light and dark mode).
+                    type: string
+                  iconDark:
+                    description: IconDark is the icon URL for dark mode.
+                    type: string
+                  iconLight:
+                    description: IconLight is the icon URL for light mode.
                     type: string
                   priority:
                     description: Priority controls sort order within a category (lower

charts/nebari-operator/templates/manager/manager.yaml

@@ -74,7 +74,7 @@ spec:
       {{- end }}
       containers:
       - args:
-        {{- if .Values.metrics.enable }}
+        {{- if .Values.metrics.enabled }}
         - --metrics-bind-address=:{{ .Values.metrics.port }}
         {{- if not .Values.metrics.secure }}
         - --metrics-secure=false

charts/nebari-operator/templates/metrics/controller-manager-metrics-service.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.metrics.enable }}
+{{- if .Values.metrics.enabled }}
 apiVersion: v1
 kind: Service
 metadata:

charts/nebari-operator/templates/network-policy/allow-metrics-traffic.yaml

@@ -0,0 +1,25 @@
+{{- if .Values.networkPolicy.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/name: {{ include "nebari-operator.name" . }}
+  name: {{ include "nebari-operator.resourceName" (dict "suffix" "allow-metrics-traffic" "context" $) }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  podSelector:
+    matchLabels:
+      control-plane: controller-manager
+      app.kubernetes.io/name: {{ include "nebari-operator.name" . }}
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+      - namespaceSelector:
+          matchLabels:
+            metrics: enabled
+      ports:
+        - port: {{ .Values.metrics.port }}
+          protocol: TCP
+{{- end }}

charts/nebari-operator/templates/prometheus/controller-manager-metrics-monitor.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.prometheus.enable }}
+{{- if .Values.prometheus.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
@@ -21,7 +21,7 @@ spec:
     {{- if .Values.metrics.secure }}
     tlsConfig:
       serverName: {{ include "nebari-operator.resourceName" (dict "suffix" "controller-manager-metrics-service" "context" $) }}.{{ .Release.Namespace }}.svc
-      {{- if .Values.certManager.enable }}
+      {{- if .Values.certManager.enabled }}
       ca:
         secret:
           name: metrics-server-cert

charts/nebari-operator/templates/rbac/controller-manager.yaml

@@ -1,4 +1,4 @@
-{{- if ne .Values.serviceAccount.enable false }}
+{{- if ne .Values.serviceAccount.enabled false }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:

charts/nebari-operator/templates/rbac/metrics-auth-role.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.metrics.enable .Values.metrics.secure }}
+{{- if and .Values.metrics.enabled .Values.metrics.secure }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:

charts/nebari-operator/templates/rbac/metrics-auth-rolebinding.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.metrics.enable .Values.metrics.secure }}
+{{- if and .Values.metrics.enabled .Values.metrics.secure }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:

charts/nebari-operator/templates/rbac/metrics-reader.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.metrics.enable .Values.metrics.secure }}
+{{- if and .Values.metrics.enabled .Values.metrics.secure }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:

charts/nebari-operator/templates/rbac/nebariapp-admin-role.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.rbac.helpers.enable }}
+{{- if .Values.rbac.helpers.enabled }}
 apiVersion: rbac.authorization.k8s.io/v1
 {{- if .Values.rbac.namespaced }}
 kind: Role

charts/nebari-operator/templates/rbac/nebariapp-editor-role.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.rbac.helpers.enable }}
+{{- if .Values.rbac.helpers.enabled }}
 apiVersion: rbac.authorization.k8s.io/v1
 {{- if .Values.rbac.namespaced }}
 kind: Role

charts/nebari-operator/templates/rbac/nebariapp-viewer-role.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.rbac.helpers.enable }}
+{{- if .Values.rbac.helpers.enabled }}
 apiVersion: rbac.authorization.k8s.io/v1
 {{- if .Values.rbac.namespaced }}
 kind: Role

charts/nebari-operator/values.yaml

@@ -19,7 +19,7 @@ manager:
     repository: quay.io/nebari/nebari-operator
     ## Image tag (defaults to Chart.appVersion if not set)
     ##
-    tag: "v0.1.0-alpha.20"
+    tag: "v0.1.0"
     pullPolicy: IfNotPresent
 
   ## Arguments
@@ -138,16 +138,16 @@ rbac:
   helpers:
     ## Install convenience admin/editor/viewer roles for CRDs
     ##
-    enable: false
+    enabled: false
 
 ## ServiceAccount configuration
 ##
 serviceAccount:
   # Install default ServiceAccount provided
-  enable: true
+  enabled: true
 
-  ## Existing ServiceAccount name (only when enable=false)
-  ## Note: When enable=true, respects nameOverride/fullnameOverride
+  ## Existing ServiceAccount name (only when enabled=false)
+  ## Note: When enabled=true, respects nameOverride/fullnameOverride
   ##
   # name: ""
 
@@ -163,15 +163,15 @@ serviceAccount:
 ##
 crd:
   # Install CRDs with the chart
-  enable: true
+  enabled: true
   # Keep CRDs when uninstalling
   keep: true
 
 ## Controller metrics endpoint.
 ## Enable to expose /metrics endpoint
 ##
 metrics:
-  enable: true
+  enabled: true
   # Metrics server port
   port: 8443
   # Enable secure metrics: HTTPS with certs/auth (true) or HTTP (false).
@@ -182,11 +182,17 @@ metrics:
 ## Required for webhook certificates and metrics endpoint certificates.
 ##
 certManager:
-  enable: false
+  enabled: false
 
 ## Prometheus ServiceMonitor for metrics scraping.
 ## Requires prometheus-operator to be installed in the cluster.
 ##
 prometheus:
-  enable: false
+  enabled: false
+
+## Network policies for controlling traffic flow.
+## Enable to restrict ingress to the controller manager.
+##
+networkPolicy:
+  enabled: false