Move to helm package for operator

.github/workflows/release.yml

@@ -11,10 +11,29 @@ jobs:
     uses: ./.github/workflows/docker.yml
     secrets: inherit
 
+  build-helm-chart:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Write release version
+        id: version
+        run: |
+          VERSION=${GITHUB_REF_NAME#v}
+          echo Version: $VERSION
+          echo "VERSION=$VERSION" >> "$GITHUB_OUTPUT"
+      - name: Push helm chart
+        uses: appany/[email protected]
+        with:
+          name: restate-operator-helm
+          repository: restatedev
+          tag: ${{ steps.version.outputs.VERSION }}
+          registry: ghcr.io
+          registry_username: ${{ github.actor }}
+          registry_password: ${{ secrets.GITHUB_TOKEN }}
+
   publish-release:
     name: Publish release
     runs-on: ubuntu-latest
-    needs: [build-docker-image]
+    needs: [build-docker-image build-helm-chart]
 
     steps:
       - name: Checkout

README.md

@@ -1,6 +1,11 @@
 # Restate Operator
 
+## Installing
+```bash
+helm install restate-operator ghcr.io/restatedev/restate-operator-helm --namespace restate-operator --create-namespace
+```
+
 ## Releasing
-1. Update the image version in deploy/operator.pkl and the version in Cargo.toml eg to `0.0.2`
+1. Update the app version in charts/restate-operator/Chart.yaml and the version in Cargo.toml eg to `0.0.2`
 2. Push a new tag `v0.0.2`
 3. Accept the draft release once the workflow finishes

charts/restate-operator-helm/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

charts/restate-operator-helm/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: restate-operator
+description: An operator for Restate clusters
+type: application
+version: "0.0.1"
+appVersion: "0.0.1"

charts/restate-operator-helm/crds/restateclusters.yaml

@@ -0,0 +1 @@
+../../../crd/crd.yaml

charts/restate-operator-helm/templates/_helpers.tpl

@@ -0,0 +1,22 @@
+{{- define "controller.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "controller.fullname" -}}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "controller.labels" -}}
+{{- include "controller.selectorLabels" . }}
+app.kubernetes.io/name: {{ include "controller.name" . }}
+app.kubernetes.io/version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
+{{- end }}
+
+{{- define "controller.selectorLabels" -}}
+app: {{ include "controller.name" . }}
+{{- end }}
+
+{{- define "controller.tag" -}}
+{{- .Values.version | default .Chart.AppVersion }}
+{{- end }}

charts/restate-operator-helm/templates/deployment.yaml

@@ -0,0 +1,53 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "controller.fullname" . }}
+  labels:
+    {{- include "controller.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "controller.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "controller.selectorLabels" . | nindent 8 }}
+      annotations:
+        kubectl.kubernetes.io/default-container: {{ .Chart.Name }}
+        {{- if .Values.podAnnotations }}
+        {{- toYaml .Values.podAnnotations | nindent 8 }}
+        {{- end }}
+    spec:
+      serviceAccountName: {{ include "controller.fullname" . }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: {{ .Values.image.repository }}:{{ include "controller.tag" . }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          env:
+            - name: RUST_LOG
+              value: {{ .Values.logging.env_filter }}
+          {{- with .Values.env }}
+          {{- toYaml . | nindent 8 }}
+          {{- end }}
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 5

charts/restate-operator-helm/templates/rbac.yaml

@@ -0,0 +1,78 @@
+{{- if .Values.serviceAccount.create }}
+---
+# Scoped service account
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "controller.fullname" . }}
+  labels:
+    {{- include "controller.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  namespace: {{ .Release.Namespace }}
+automountServiceAccountToken: true
+  {{- end }}
+
+---
+# Access for the service account
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "controller.fullname" . }}
+rules:
+  - resources:
+      - restateclusters
+      - restateclusters/status
+      - restateclusters/finalizers
+    verbs:
+      - get
+      - list
+      - watch
+      - patch
+    apiGroups:
+      - restate.dev
+  - resources:
+      - events
+    verbs:
+      - create
+    apiGroups:
+      - events.k8s.io
+  - resources:
+      - namespaces
+      - services
+      - serviceaccounts
+      - networkpolicies
+      - statefulsets
+      - persistentvolumeclaims
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - patch
+    apiGroups:
+      - ''
+      - apps
+      - networking.k8s.io
+  - resources:
+      - statefulsets
+    verbs:
+      - delete
+    apiGroups:
+      - apps
+---
+# Binding the role to the account
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "controller.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    namespace: {{ .Release.Namespace }}
+    name: {{ include "controller.fullname" . }}
+roleRef:
+  kind: ClusterRole
+  name: {{ include "controller.fullname" . }}
+  apiGroup: rbac.authorization.k8s.io

charts/restate-operator-helm/templates/service.yaml

@@ -0,0 +1,21 @@
+---
+# Expose the http port of the service
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "controller.fullname" . }}
+  labels:
+    {{- include "controller.labels" . | nindent 4 }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: 8080
+      protocol: TCP
+      name: http
+  selector:
+    app: {{ include "controller.fullname" . }}

charts/restate-operator-helm/templates/servicemonitor.yaml

@@ -0,0 +1,44 @@
+{{- if .Values.serviceMonitor.enabled }}
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ include "controller.fullname" . }}
+  labels:
+    {{- include "controller.labels" . | nindent 4 }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  endpoints:
+    - port: http
+    {{- with .Values.serviceMonitor.interval }}
+      interval: {{ . }}
+    {{- end }}
+    {{- with .Values.serviceMonitor.scrapeTimeout }}
+      scrapeTimeout: {{ . }}
+    {{- end }}
+      honorLabels: true
+      path: {{ .Values.serviceMonitor.path }}
+      scheme: {{ .Values.serviceMonitor.scheme }}
+    {{- with .Values.serviceMonitor.relabelings }}
+      relabelings:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+    {{- with .Values.serviceMonitor.metricRelabelings }}
+      metricRelabelings:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+  jobLabel: {{ include "controller.fullname" . }}
+  selector:
+    matchLabels:
+      {{- include "controller.selectorLabels" . | nindent 6 }}
+  namespaceSelector:
+    matchNames:
+      - {{ .Values.namespace }}
+  {{- with .Values.serviceMonitor.targetLabels }}
+  targetLabels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}

charts/restate-operator-helm/values.yaml

@@ -0,0 +1,50 @@
+replicaCount: 1
+nameOverride: ""
+version: "" # pin a specific version
+
+image:
+  repository: ghcr.io/restatedev/restate-operator
+  pullPolicy: IfNotPresent
+
+imagePullSecrets: []
+
+serviceAccount:
+  create: true
+  annotations: {}
+podAnnotations: {}
+
+podSecurityContext:
+  fsGroup: 2000
+  fsGroupChangePolicy: "OnRootMismatch"
+securityContext:
+  capabilities:
+   drop:
+   - ALL
+  readOnlyRootFilesystem: true
+  allowPrivilegeEscalation: false
+  runAsNonRoot: true
+  runAsUser: 1000
+  runAsGroup: 3000
+
+
+logging:
+  env_filter: info,restate=debug
+
+env: []
+
+service:
+  type: ClusterIP
+  port: 80
+
+resources:
+  limits:
+    cpu: 200m
+    memory: 256Mi
+  requests:
+    cpu: 50m
+    memory: 100Mi
+
+serviceMonitor:
+  enabled: false
+  path: /metrics
+  scheme: http