Separate Service Secured And Insecured Ports

[ihcsim]

Change Overview

This PR separates the secured and insecured service ports of the controller into two separate Helm fields. The securedPort is used if the validating webhook is enabled, per K8s API server requirement. The insecuredPort is used if the validating webhook is disabled.

Pull request type

Please check the type of change your PR introduces:

• 🚧 Work in Progress
• 🌈 Refactoring (no functional changes, no api changes)
• 🐹 Trivial/Minor
• 🐛 Bugfix
• 🌻 Feature
• 🗺️ Documentation
• 🤖 Test

Issues

• [BUG] Disabling webhook breaks metrics- and health-endpoints #1376

Test Plan

Install Kanister with the validating webhook:

helm install kanister ./helm/kanister-operator --create-namespace --namespace kanister

kubectl -n kanister get svc kanister-kanister-operator -ojsonpath='{.spec.ports}' | jq .                                              
[
  {
    "port": 443,
    "protocol": "TCP",
    "targetPort": 9443
  }
]

Install Kanister without the validating webhook:

helm install kanister ./helm/kanister-operator --create-namespace --namespace kanister --set bpValidatingWebhook.enabled=false

kubectl -n kanister get svc kanister-kanister-operator -ojsonpath='{.spec.ports}' | jq .                                              
[
  {
    "port": 8000,
    "protocol": "TCP",
    "targetPort": 8000
  }
]

Blueprints and actionset creations still work with either setup.

• 💪 Manual
• ⚡ Unit test
• 💚 E2E

[github-actions]

Thanks for submitting this pull request 🎉. The team will review it soon and get back to you.

If you haven't already, please take a moment to review our project contributing guideline and Code of Conduct document.

[viveksinghggits]

@ihcsim the PR that I raised and just got in, should already be doing this. Or I am missing something.

[ihcsim]

@viveksinghggits in the previous PR, the controller.service.port will have no effects if the webhook is disabled. So if someone set the service port to 8080, Helm will still override it to 8000.