Merge pull request #25 from mongodb/CLOUDP-84606-helm-chart-operator

CLOUDP-84606: Atlas Operator Helm Chart

charts/atlas-operator-crds/Chart.yaml

@@ -1,8 +1,8 @@
 apiVersion: v2
 name: mongodb-atlas-operator-crds
-description: MongoDB Atlas Operator - Helm chart for installing and upgrading Custom Resource Definitions (CRDs) for the Atlas Operator.
+description: MongoDB Atlas Operator CRDs - Helm chart for installing and upgrading Custom Resource Definitions (CRDs) for the Atlas Operator.
 type: application
-version: 0.4.0
+version: 0.1.0
 appVersion: 0.4.0
 kubeVersion: ">=1.15.0-0"
 keywords:

charts/atlas-operator-crds/README.md

@@ -1,6 +1,6 @@
-# Atlas Operator CRDs Helm Chart
+# MongoDB Atlas Operator CRDs Helm Chart
 
-A Helm chart for installing and upgrading Custom Resource Definitions (CRDs) for the Atlas Operator. These CRDs are 
+A Helm chart for installing and upgrading Custom Resource Definitions (CRDs) for the [MongoDB Atlas Operator](https://github.com/mongodb/mongodb-atlas-kubernetes). These CRDs are 
 required by the Atlas Operator to work. 
 
 ## Usage

charts/atlas-operator/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

charts/atlas-operator/Chart.yaml

@@ -0,0 +1,18 @@
+apiVersion: v2
+name: mongodb-atlas-operator
+description: |-
+  MongoDB Atlas Operator - a Helm chart for installing and upgrading Atlas Operator: the official Kubernetes operator allowing to manage MongoDB Atlas resources from Kubernetes
+type: application
+version: 0.1.0
+appVersion: 0.4.0
+kubeVersion: ">=1.15.0-0"
+keywords:
+  - mongodb
+  - atlas
+  - database
+  - cluster
+  - nosql
+home: https://github.com/mongodb/mongodb-atlas-kubernetes
+maintainers:
+  - name: MongoDB
+    email: [email protected]

charts/atlas-operator/README.md

@@ -0,0 +1,30 @@
+# MongoDB Atlas Operator Helm Chart
+
+A Helm chart for installing and upgrading [MongoDB Atlas Operator](https://github.com/mongodb/mongodb-atlas-kubernetes). 
+The Operator allows to manage resources from Atlas (projects, clusters, database users, etc) not leaving the Kubernetes cluster.
+
+## Prerequisites
+
+You need to install the [Atlas Operator CRDs](../atlas-operator-crds) first before installing the Operator.
+
+## Usage
+
+### Installing the Operator (in clusterwide mode) into the Kubernetes Cluster:
+
+```
+helm repo add mongodb https://mongodb.github.io/helm-charts
+helm install atlas-operator --namespace=atlas-operator --create-namespace mongodb/mongodb-atlas-operator
+```
+
+### Installing the Operator (in namespaced mode - watching the self namespace) into the Kubernetes Cluster:
+
+```
+helm repo add mongodb https://mongodb.github.io/helm-charts
+helm install atlas-operator --namespace=operator --set watchNamespaces=operator --create-namespace mongodb/mongodb-atlas-operator
+```
+
+### Upgrading the Operator:
+
+```
+helm upgrade mongodb-atlas-operator mongodb/mongodb-atlas-operator
+```

charts/atlas-operator/templates/NOTES.txt

@@ -0,0 +1 @@
+Thank you for installing {{ .Chart.Name }}.

charts/atlas-operator/templates/_helpers.tpl

@@ -0,0 +1,140 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "mongodb-atlas-operator.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "mongodb-atlas-operator.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "mongodb-atlas-operator.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "mongodb-atlas-operator.labels" -}}
+helm.sh/chart: {{ include "mongodb-atlas-operator.chart" . }}
+{{ include "mongodb-atlas-operator.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "mongodb-atlas-operator.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "mongodb-atlas-operator.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "mongodb-atlas-operator.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "mongodb-atlas-operator.name" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+RBAC permissions
+*/}}
+{{- define "mongodb-atlas-operator.rbacRules" -}}
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - atlas.mongodb.com
+  resources:
+  - atlasclusters
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - atlas.mongodb.com
+  resources:
+  - atlasclusters/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - atlas.mongodb.com
+  resources:
+  - atlasdatabaseusers
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - atlas.mongodb.com
+  resources:
+  - atlasdatabaseusers/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - atlas.mongodb.com
+  resources:
+  - atlasprojects
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - atlas.mongodb.com
+  resources:
+  - atlasprojects/status
+  verbs:
+  - get
+  - patch
+  - update
+{{- end -}}

charts/atlas-operator/templates/authproxy-service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "mongodb-atlas-operator.name" . }}-metrics-service
+  labels:
+    {{- include "mongodb-atlas-operator.labels" . | nindent 4 }}
+spec:
+  ports:
+    - name: https
+      port: 8443
+      targetPort: https
+  selector:
+    {{- include "mongodb-atlas-operator.selectorLabels" . | nindent 4 }}

charts/atlas-operator/templates/cluster-roles.yaml

@@ -0,0 +1,65 @@
+{{- $operatorName := include "mongodb-atlas-operator.name" . -}}
+
+{{- if not .Values.watchNamespaces }}
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: "{{ $operatorName }}"
+  labels:
+  {{- include "mongodb-atlas-operator.labels" $ | nindent 4 }}
+rules:
+{{ template "mongodb-atlas-operator.rbacRules" $ | toYaml | indent 2 }}
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ $operatorName }}
+  labels:
+  {{- include "mongodb-atlas-operator.labels" $ | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ $operatorName }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "mongodb-atlas-operator.serviceAccountName" . }}
+    namespace: {{ $.Release.Namespace }}
+
+{{- end }}
+
+{{- /* It seems that the rbac-proxy role must be Cluster-scoped to handle requests from different namespaces?
+TODO May make sense in the future to configure a specific namespace where the prometheus server resides to give Role only to that namespace? */}}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: "{{ $.Release.Namespace }}-{{ $operatorName }}-proxy-role"
+  labels:
+  {{- include "mongodb-atlas-operator.labels" $ | nindent 4 }}
+rules:
+  - apiGroups: ["authentication.k8s.io"]
+    resources:
+      - tokenreviews
+    verbs: ["create"]
+  - apiGroups: ["authorization.k8s.io"]
+    resources:
+      - subjectaccessreviews
+    verbs: ["create"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: "{{ $.Release.Namespace }}-{{ $operatorName }}-proxy-role-binding"
+  labels:
+  {{- include "mongodb-atlas-operator.labels" $ | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: "{{ $.Release.Namespace }}-{{ $operatorName }}-proxy-role"
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "mongodb-atlas-operator.serviceAccountName" . }}
+    namespace: {{ $.Release.Namespace }}