chart: fix ugprading from old CRDs

[WanzenBug]

Using httpBindAddress caused validation to fail if upgrading from older
releases with TLS configured. Since LINSTOR already redirects from HTTP
to HTTPS in all cases, the default http address does not need to be
reconfigured when TLS is used.

[kvaps]

What about /metrics?

[kvaps]

This is weird that Helm does not install CRDs before applying CRs.
Or what kind of validation are you talking about?

[WanzenBug]

This is weird that Helm does not install CRDs before applying CRs.
Or what kind of validation are you talking about?

Helm does not upgrade CRDs if they are already installed. That's always been a bit of a pain. In this case, helm upgrade ... fails because the new templates tries to set httpBindAddress, but the CRD installed in the cluster does not have that field.

For bigger changes we instructed users to manually upgrade the CRDs if required using kubectl replace -f ... but we normally try to avoid that for non-required changes.

[WanzenBug]

What about /metrics?

You are right, it seems like LINSTOR doesn't redirect in that case. I think that is actually good for rbac-proxy, which would otherwise fail to connect to LINSTOR I think. In the example you provided we explicitly set the httpBindAddress, so we don't need this fallback.

Admittedly, this is not 100% ideal, as it means the metrics are always unprotected.

[kvaps]

Ah, got it, I'll just leave links to original issues:

• CRD update during helm upgrade helm/helm#8668
• feat: Add support for a crds/ directory helm/helm#6243
• Helm update of a new chart dependency will not install its CRD's helm/helm#10784
• Proposal: Manage CRDs helm/helm#5871

[kvaps]

LGTM