refactor: distribute maester charts as standalone (#124)

BREAKING CHANGE:

This patch moves `oathkeeper-maester` and `hydra-maester` into their standalone charts. ORY Hydra and ORY Oathkeeper charts still list the maester charts as dependencies.

Also adds documentation around use of the maester charts.

Closes #122
Closes #103 
Closes #116 
Closes #88

Signed-off-by: Clément BUCHART <clement@buchart.dev>

.circleci/config.yml

@@ -8,8 +8,9 @@ jobs:
       - checkout
       - run: curl -L https://git.io/get_helm.sh | bash
       - run: helm lint ./helm/charts/oathkeeper/
+      - run: helm lint ./helm/charts/oathkeeper-maester/
       - run: helm lint ./helm/charts/hydra/
-      - run: helm lint ./helm/charts/hydra/charts/hydra-maester/
+      - run: helm lint ./helm/charts/hydra-maester/
       - run: helm lint ./helm/charts/hive/
       - run: helm lint ./helm/charts/example-idp/
       - run: helm lint ./helm/charts/hive-selfservice-ui-node/
@@ -52,7 +53,7 @@ jobs:
       - run:
           command: |
             export KUBECONFIG="$(kind get kubeconfig-path)"
-            .circleci/helm-test.sh hydra/charts/hydra-maester
+            .circleci/helm-test.sh hydra-maester
       # Enable hive tests at a later stage
       # 
       # - run:
@@ -68,9 +69,12 @@ jobs:
       - checkout
       - run: curl -L https://git.io/get_helm.sh | bash
       - run: helm init --client-only
+      - run: helm dep update ./helm/charts/oathkeeper/
       - run: helm package -d docs/helm/charts/ ./helm/charts/oathkeeper/ --version `echo $CIRCLE_TAG | sed s/v//g`
+      - run: helm package -d docs/helm/charts/ ./helm/charts/oathkeeper-maester/ --version `echo $CIRCLE_TAG | sed s/v//g`
+      - run: helm dep update ./helm/charts/hydra/
       - run: helm package -d docs/helm/charts/ ./helm/charts/hydra/ --version `echo $CIRCLE_TAG | sed s/v//g`
-      - run: helm package -d docs/helm/charts/ ./helm/charts/hydra/charts/hydra-maester/ --version `echo $CIRCLE_TAG | sed s/v//g`
+      - run: helm package -d docs/helm/charts/ ./helm/charts/hydra-maester/ --version `echo $CIRCLE_TAG | sed s/v//g`
       - run: helm package -d docs/helm/charts/ ./helm/charts/example-idp/ --version `echo $CIRCLE_TAG | sed s/v//g`
       - run: helm package -d docs/helm/charts/ ./helm/charts/hive/ --version `echo $CIRCLE_TAG | sed s/v//g`
       - run: helm package -d docs/helm/charts/ ./helm/charts/hive-selfservice-ui-node/ --version `echo $CIRCLE_TAG | sed s/v//g`

.circleci/helm-test.sh

@@ -12,7 +12,8 @@ function cleanup {
 }
 trap cleanup EXIT
 
-helm install -f .circleci/values/$1.yaml -n ${release} ./helm/charts/$1 --wait --debug
+helm dep update ./helm/charts/$1
+helm install -f .circleci/values/$1.yaml -n ${release} ./helm/charts/$1 --wait --debug 
 
 n=0
 until [[ $n -ge 5 ]]; do

docs/helm/hydra.md

@@ -253,3 +253,11 @@ $ helm install \
     --set 'maester.enabled=false' \
     ory/hydra
 ```
+
+#### Using fullnameOverride
+
+If you use need to override the name of the hydra resources such as the deployment or services, the traditional `fullnameOverride` value is available.
+
+If you use it and deploy maester as part of hydra, make sure you also set `maester.hydraFullnameOverride` with the same value, so that the admin service name used by maester is properly computed with the new value.
+
+Should you forget, helm will fail and remind you to.

docs/helm/oathkeeper.md

@@ -92,6 +92,14 @@ $ helm install \
     ory/oathkeeper
 ```
 
+#### Using fullnameOverride
+
+If you use need to override the name of the oathkeeper resources such as the deployment or services, the traditional `fullnameOverride` value is available.
+
+If you use it and deploy maester as part of oathkeeper, make sure you also set `maester.oathkeeperFullnameOverride` with the same value, so that the configmap name generated by maester is properly computed with the new value.
+
+Should you forget, helm will fail and remind you to.
+
 #### Operation modes
 The Oathkeeper Maester works in either of these two modes: 
 

helm/charts/hydra/requirements.yaml

@@ -1,5 +1,6 @@
 dependencies:
   - name: hydra-maester
-    version: 0.0.6
+    version: 0.0.5-alpha10
     condition: maester.enabled
     alias: maester
+    repository: file://../hydra-maester

helm/charts/hydra/templates/NOTES.txt

@@ -1,3 +1,4 @@
+{{ include "hydra.check.override.consistency" . }}
 The ORY Hydra HTTP Public API is available via:
 {{- if .Values.ingress.public.enabled }}
 {{- range $host := .Values.ingress.public.hosts }}

helm/charts/hydra/templates/_helpers.tpl

@@ -122,6 +122,19 @@ http://127.0.0.1:{{ .Values.service.public.port }}/
 {{- end -}}
 {{- end -}}
 
+{{/*
+Check overrides consistency
+*/}}
+{{- define "hydra.check.override.consistency" -}}
+{{- if and .Values.maester.enabled .Values.fullnameOverride -}}
+{{- if not .Values.maester.hydraFullnameOverride -}}
+{{ fail "hydra fullname has been overridden, but the new value has not been provided to maester. Set maester.hydraFullnameOverride" }}
+{{- else if not (eq .Values.maester.hydraFullnameOverride .Values.fullnameOverride) -}}
+{{ fail (tpl "hydra fullname has been overridden, but a different value was provided to maester. {{ .Values.maester.hydraFullnameOverride }} different of {{ .Values.fullnameOverride }}" . ) }}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
 {{- define "hydra.utils.joinListWithComma" -}}
 {{- $local := dict "first" true -}}
 {{- range $k, $v := . -}}{{- if not $local.first -}},{{- end -}}{{- $v -}}{{- $_ := set $local "first" false -}}{{- end -}}

helm/charts/oathkeeper/charts/oathkeeper-master/templates/_helpers.tpl → helm/charts/oathkeeper-maester/templates/_helpers.tpl

@@ -48,11 +48,15 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
 Get Oathkeeper rules configmap
 */}}
 {{- define "oathkeeper-maester.getCM" -}}
+{{- if .Values.oathkeeperFullnameOverride -}}
+{{- printf "%s-rules" .Values.oathkeeperFullnameOverride | trimSuffix "-" -}}
+{{- else -}}
 {{- $fullName := include "oathkeeper-maester.fullname" . -}}
 {{- $nameParts := split "-" $fullName }}
 {{- if eq $nameParts._0 $nameParts._1 -}}
 {{- printf "%s-rules" $nameParts._0 | trimSuffix "-" -}}
 {{- else -}}
 {{- printf "%s-%s-rules" $nameParts._0 $nameParts._1 | trimSuffix "-" -}}
 {{- end -}}
-{{- end -}}
+{{- end -}}
+{{- end -}}

helm/charts/oathkeeper/charts/oathkeeper-master/values.yaml → helm/charts/oathkeeper-maester/values.yaml

@@ -8,6 +8,8 @@ global:
 
 replicaCount: 1
 
+# oathkeeperFullnameOverride: oathkeeper
+
 # rulesConfigmapNamespace: some-namespace
 # rulesFileName: access-rules.json
 

helm/charts/oathkeeper/requirements.yaml

@@ -2,3 +2,5 @@ dependencies:
   - name: oathkeeper-maester
     version: 0.0.1
     condition: maester.enabled
+    alias: maester
+    repository: file://../oathkeeper-maester

helm/charts/oathkeeper/templates/NOTES.txt

@@ -1,3 +1,4 @@
+{{ include "oathkeeper.check.override.consistency" . }}
 The ORY Oathkeeper HTTP Reverse Proxy is available via:
 {{- if .Values.ingress.proxy.enabled }}
 {{- range $host := .Values.ingress.proxy.hosts }}

helm/charts/oathkeeper/templates/_helpers.tpl

@@ -43,3 +43,16 @@ app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 {{- end }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end -}}
+
+{{/*
+Check overrides consistency
+*/}}
+{{- define "oathkeeper.check.override.consistency" -}}
+{{- if and .Values.maester.enabled .Values.fullnameOverride -}}
+{{- if not .Values.maester.oathkeeperFullnameOverride -}}
+{{ fail "oathkeeper fullname has been overridden, but the new value has not been provided to maester. Set maester.oathkeeperFullnameOverride" }}
+{{- else if not (eq .Values.maester.oathkeeperFullnameOverride .Values.fullnameOverride) -}}
+{{ fail (tpl "oathkeeper fullname has been overridden, but a different value was provided to maester. {{ .Values.maester.oathkeeperFullnameOverride }} different of {{ .Values.fullnameOverride }}" . ) }}
+{{- end -}}
+{{- end -}}
+{{- end -}}