Make ace-ocm-addons chart multicluster ready

charts/ace-ocm-addons/README.md

@@ -45,31 +45,34 @@ The command removes all the Kubernetes components associated with the chart and
 
 The following table lists the configurable parameters of the `ace-ocm-addons` chart and their default values.
 
-|                 Parameter                 |       Description       |                  Default                   |
-|-------------------------------------------|-------------------------|--------------------------------------------|
-| nameOverride                              |                         | <code>""</code>                            |
-| fullnameOverride                          |                         | <code>""</code>                            |
-| offlineInstaller                          |                         | <code>false</code>                         |
-| image.proxies.appscode                    | r.appscode.com          | <code>r.appscode.com</code>                |
-| image.proxies.dockerHub                   | company/bin:tag         | <code>""</code>                            |
-| image.proxies.dockerLibrary               | alpine, nginx etc.      | <code>""</code>                            |
-| image.proxies.ghcr                        | ghcr.io/company/bin:tag | <code>ghcr.io</code>                       |
-| image.proxies.quay                        | quay.io/company/bin:tag | <code>quay.io</code>                       |
-| image.proxies.kubernetes                  | registry.k8s.io/bin:tag | <code>registry.k8s.io</code>               |
-| registry.credentials                      |                         | <code>{}</code>                            |
-| helm.repositories.appscode-charts-oci.url |                         | <code>oci://ghcr.io/appscode-charts</code> |
-| helm.releases.kube-ui-server.enabled      |                         | <code>true</code>                          |
-| helm.releases.kube-ui-server.version      |                         | <code>"v2023.12.18"</code>                 |
-| helm.releases.license-proxyserver.enabled |                         | <code>true</code>                          |
-| helm.releases.license-proxyserver.version |                         | <code>"v2023.11.14"</code>                 |
-| helm.releases.opscenter-features.enabled  |                         | <code>true</code>                          |
-| helm.releases.opscenter-features.version  |                         | <code>"v2024.2.13"</code>                  |
+|                 Parameter                 |       Description       |                      Default                       |
+|-------------------------------------------|-------------------------|----------------------------------------------------|
+| nameOverride                              |                         | <code>""</code>                                    |
+| fullnameOverride                          |                         | <code>""</code>                                    |
+| kubeconfigSecretName                      |                         | <code>""</code>                                    |
+| addonManagerNamespace                     |                         | <code>open-cluster-management-addon</code>         |
+| placement.create                          |                         | <code>true</code>                                  |
+| placement.name                            |                         | <code>global</code>                                |
+| kubectl.image                             |                         | <code>ghcr.io/appscode/kubectl-nonroot:1.25</code> |
+| offlineInstaller                          |                         | <code>false</code>                                 |
+| image.proxies.appscode                    | r.appscode.com          | <code>r.appscode.com</code>                        |
+| image.proxies.dockerHub                   | company/bin:tag         | <code>""</code>                                    |
+| image.proxies.dockerLibrary               | alpine, nginx etc.      | <code>""</code>                                    |
+| image.proxies.ghcr                        | ghcr.io/company/bin:tag | <code>ghcr.io</code>                               |
+| image.proxies.quay                        | quay.io/company/bin:tag | <code>quay.io</code>                               |
+| image.proxies.kubernetes                  | registry.k8s.io/bin:tag | <code>registry.k8s.io</code>                       |
+| registry.credentials                      |                         | <code>{}</code>                                    |
+| helm.repositories.appscode-charts-oci.url |                         | <code>oci://ghcr.io/appscode-charts</code>         |
+| helm.releases.kube-ui-server.enabled      |                         | <code>true</code>                                  |
+| helm.releases.kube-ui-server.version      |                         | <code>"v2023.12.20"</code>                         |
+| helm.releases.opscenter-features.enabled  |                         | <code>true</code>                                  |
+| helm.releases.opscenter-features.version  |                         | <code>"v2024.2.13"</code>                          |
 
 
 Specify each parameter using the `--set key=value[,key=value]` argument to `helm upgrade -i`. For example:
 
 ```bash
-$ helm upgrade -i ace-ocm-addons appscode/ace-ocm-addons -n open-cluster-management --create-namespace --version=v2024.2.13 --set image.proxies.appscode=r.appscode.com
+$ helm upgrade -i ace-ocm-addons appscode/ace-ocm-addons -n open-cluster-management --create-namespace --version=v2024.2.13 --set addonManagerNamespace=open-cluster-management-addon
 ```
 
 Alternatively, a YAML file that specifies the values for the parameters can be provided while

charts/ace-ocm-addons/templates/clustersetbinding.yaml → charts/ace-ocm-addons/common/addon/clustersetbinding.yaml

@@ -1,7 +1,11 @@
+{{- if .Values.placement.create }}
+
 apiVersion: cluster.open-cluster-management.io/v1beta2
 kind: ManagedClusterSetBinding
 metadata:
   name: global
-  namespace: global-kubeops
+  namespace: {{ include "ace-ocm-addons.namespace" . }}
 spec:
   clusterSet: global
+
+{{- end }}

charts/ace-ocm-addons/templates/manifestrelicaset.yaml → charts/ace-ocm-addons/common/addon/manifestrelicaset.yaml

@@ -1,11 +1,11 @@
 apiVersion: work.open-cluster-management.io/v1alpha1
 kind: ManifestWorkReplicaSet
 metadata:
-  name: opscenter-core-addons
-  namespace: global-kubeops
+  name: ace-addons
+  namespace: {{ include "ace-ocm-addons.namespace" $ }}
 spec:
   placementRefs:
-    - name: global
+    - name: {{ .Values.placement.name }}
   manifestWorkTemplate:
     # deleteOption:
     #   propagationPolicy: SelectivelyOrphan

charts/ace-ocm-addons/common/addon/placement.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.placement.create }}
+
+apiVersion: cluster.open-cluster-management.io/v1beta1
+kind: Placement
+metadata:
+  name: {{ .Values.placement.name }}
+  namespace: {{ include "ace-ocm-addons.namespace" . }}
+spec:
+  clusterSets:
+    - global
+
+{{- end }}

charts/ace-ocm-addons/templates/_helpers.tpl

@@ -51,14 +51,10 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
 
 {{/*
-Create the name of the service account to use
+Addon manager namespace
 */}}
-{{- define "ace-ocm-addons.serviceAccountName" -}}
-{{- if .Values.serviceAccount.create }}
-{{- default (include "ace-ocm-addons.fullname" .) .Values.serviceAccount.name }}
-{{- else }}
-{{- default "default" .Values.serviceAccount.name }}
-{{- end }}
+{{- define "ace-ocm-addons.namespace" -}}
+{{ ternary .Release.Namespace (required "A valid .Values.addonManagerNamespace is required!" .Values.addonManagerNamespace) (empty .Values.kubeconfigSecretName) }}
 {{- end }}
 
 {{/*

charts/ace-ocm-addons/templates/k8s/addon.yaml

@@ -0,0 +1,12 @@
+{{- if not .Values.kubeconfigSecretName }}
+
+{{- $restpl := $.Files.Get "common/addon/clustersetbinding.yaml" }}
+{{ tpl $restpl $ }}
+---
+{{- $restpl := $.Files.Get "common/addon/placement.yaml" }}
+{{ tpl $restpl $ }}
+---
+{{- $restpl := $.Files.Get "common/addon/manifestrelicaset.yaml" }}
+{{ tpl $restpl $ }}
+
+{{- end }}

charts/ace-ocm-addons/templates/ocm-mc/addon.yaml

@@ -0,0 +1,49 @@
+{{- if .Values.kubeconfigSecretName }}
+
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: ace-configure-addon
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/hook-weight": "2"
+    "helm.sh/hook": post-install,post-upgrade,post-rollback
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
+spec:
+  ttlSecondsAfterFinished: 0
+  backoffLimit: 3
+  template:
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - name: kubectl
+        image: {{ .Values.kubectl.image }}
+        workingDir: /var/run/secrets/ocm
+        command:
+          - sh
+          - -c
+          - |
+              sleep 2; \
+              kubectl --kubeconfig=auth/kubeconfig create ns {{ include "ace-ocm-addons.namespace" $ }} || true; \
+              kubectl --kubeconfig=auth/kubeconfig apply -f - <<EOF
+              {{- $restpl := $.Files.Get "common/addon/clustersetbinding.yaml" -}}
+              {{- tpl $restpl $ | nindent 14 }}
+              ---
+              {{- $restpl := $.Files.Get "common/addon/placement.yaml" -}}
+              {{- tpl $restpl $ | nindent 14 }}
+              ---
+              {{- $restpl := $.Files.Get "common/addon/manifestrelicaset.yaml" -}}
+              {{- tpl $restpl $ | nindent 14 }}
+              EOF
+        imagePullPolicy: {{ .Values.imagePullPolicy }}
+        volumeMounts:
+        - mountPath: /var/run/secrets/ocm/auth
+          name: ocm-auth
+      volumes:
+      - name: ocm-auth
+        secret:
+          defaultMode: 420
+          secretName: {{ .Values.kubeconfigSecretName }}
+      restartPolicy: Never
+
+{{- end }}

charts/ace-ocm-addons/templates/ocm-mc/crds.yaml

@@ -0,0 +1,62 @@
+{{- if .Values.kubeconfigSecretName }}
+{{ range $path, $data := .Files.Glob  "crds/**.yaml" }}
+
+{{ $content := toString $data }}
+{{ $crd := dig "spec" "names" "plural" "" ($content | fromYaml) }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ace-regcrd-{{ $crd }}
+  namespace: {{ $.Release.Namespace }}
+  annotations:
+    "helm.sh/hook-weight": "0"
+    "helm.sh/hook": post-install,post-upgrade,post-rollback
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
+data:
+  crd.yaml: |
+    {{- $content | nindent 4 }}
+
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: ace-regcrd-{{ $crd }}
+  namespace: {{ $.Release.Namespace }}
+  annotations:
+    "helm.sh/hook-weight": "1"
+    "helm.sh/hook": post-install,post-upgrade,post-rollback
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
+spec:
+  ttlSecondsAfterFinished: 0
+  backoffLimit: 3
+  template:
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - name: kubectl
+        image: {{ $.Values.kubectl.image }}
+        workingDir: /var/run/secrets/ocm
+        command:
+          - sh
+          - -c
+          - "sleep 2; \
+            kubectl --kubeconfig=auth/kubeconfig apply -f /etc/crds/crd.yaml; \
+            "
+        imagePullPolicy: {{ $.Values.imagePullPolicy }}
+        volumeMounts:
+        - mountPath: /var/run/secrets/ocm/auth
+          name: ocm-auth
+        - name: crd-volume
+          mountPath: /etc/crds
+      volumes:
+      - name: ocm-auth
+        secret:
+          defaultMode: 420
+          secretName: {{ $.Values.kubeconfigSecretName }}
+      - name: crd-volume
+        configMap:
+          name: ace-regcrd-{{ $crd }}
+      restartPolicy: Never
+{{- end }}
+{{- end }}

charts/ace-ocm-addons/values.yaml

@@ -5,6 +5,16 @@
 nameOverride: ""
 fullnameOverride: ""
 
+kubeconfigSecretName: ""
+addonManagerNamespace: open-cluster-management-addon
+
+placement:
+  create: true
+  name: global
+
+kubectl:
+  image: ghcr.io/appscode/kubectl-nonroot:1.25
+
 offlineInstaller: false
 
 image:
@@ -36,10 +46,7 @@ helm:
   releases:
     kube-ui-server:
       enabled: true
-      version: "v2023.12.18"
-    license-proxyserver:
-      enabled: true
-      version: "v2023.11.14"
+      version: "v2023.12.20"
     opscenter-features:
       enabled: true
       version: "v2024.2.13"

charts/license-proxyserver-manager/templates/deployment.yaml

@@ -48,10 +48,8 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.namespace
-            {{- if .Values.kubeconfigSecretName }}
             - name: NAMESPACE
               value: {{ include "license-proxyserver-manager.namespace" . }}
-            {{- end }}
           volumeMounts:
             - mountPath: /tmp/licenses
               name: cache-dir