Skip to content

✨ helm values hardening; user-configured env; optional v1alpha1 disable #71

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Oct 10, 2025
Merged

✨ helm values hardening; user-configured env; optional v1alpha1 disable #71

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b5c2559
feat: helm values hardening; user-configured env; optional v1alpha1 d…
arturshadnik Oct 9, 2025
558fb8c
fix: include legacy crd in env test assets
arturshadnik Oct 9, 2025
555508c
chore: words
arturshadnik Oct 9, 2025
623f5a9
docs: document pod security context values
arturshadnik Oct 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions fleetconfig-controller/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,7 @@ helm-doc-gen: helmdoc ## Generate helm chart README.md
.PHONY: manifests
manifests: controller-gen ## Generate CustomResourceDefinition and WebhookConfiguration objects.
$(CONTROLLER_GEN) webhook crd paths="./..." output:crd:artifacts:config=charts/fleetconfig-controller/crds
./hack/format_legacy_crds.sh
./hack/install_crds.sh

##@ Testing Targets
Expand Down
5 changes: 4 additions & 1 deletion fleetconfig-controller/api/v1alpha1/webhook_suite_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,10 @@ var _ = BeforeSuite(func() {

By("bootstrapping test environment")
testEnv = &envtest.Environment{
CRDDirectoryPaths: []string{filepath.Join(root, "charts", "fleetconfig-controller", "crds")},
CRDDirectoryPaths: []string{
filepath.Join(root, "charts", "fleetconfig-controller", "crds"),
filepath.Join(root, "config", "crds"),
},
ErrorIfCRDPathMissing: false,
WebhookInstallOptions: envtest.WebhookInstallOptions{
Paths: []string{filepath.Join("..", "..", "config", "webhook")},
Expand Down
3 changes: 3 additions & 0 deletions fleetconfig-controller/charts/fleetconfig-controller/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,6 +155,7 @@ Resource specifications for all klusterlet-managed containers.
| --------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------- |
| `spokeConcurrentReconciles` | Maximum number of Spoke resources that will be reconciled at the same time. | `5` |
| `addonMode` | Whether to run fleetconfig-controller in addon mode. Addon mode allows for decentralized day 2 management of spoke clusters. Not supported when kubernetesProvider is EKS. | `true` |
| `enableLegacyControllers` | Whether to enable the legacy FleetConfig resource controller. | `false` |
| `kubernetesProvider` | Kubernetes provider of the cluster that fleetconfig-controller will be installed on. Valid values are "Generic", "EKS", "GKE-Ingress". | `Generic` |
| `replicas` | fleetconfig-controller replica count | `1` |
| `imageRegistry` | Image registry | `""` |
Expand All @@ -163,9 +164,11 @@ Resource specifications for all klusterlet-managed containers.
| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
| `imagePullSecrets` | Image pull secrets | `[]` |
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
| `podSecurityContext.seccompProfile.type` | seccomp profile to use for the fleetconfig-controller manager and agent pods. | `RuntimeDefault` |
| `containerSecurityContext.allowPrivilegeEscalation` | allowPrivilegeEscalation | `false` |
| `containerSecurityContext.capabilities.drop` | capabilities to drop | `["ALL"]` |
| `containerSecurityContext.runAsNonRoot` | runAsNonRoot | `true` |
| `env` | Additional environment variables to pass to the fleetconfig-controller pod. | `[]` |
| `resources.limits.cpu` | fleetconfig controller's cpu limit | `500m` |
| `resources.limits.memory` | fleetconfig controller's memory limit | `512Mi` |
| `resources.requests.cpu` | fleetconfig controller's cpu request | `200m` |
Expand Down
Loading
Loading