Adding rancher-cis-benchmark - Main chart for deploying cis-operator
Review comments and changes CRDs and adding the roles
Adding default ClusterScanProfiles in a Configmap
Updating kubernetes version to have major.minor.patch
Package the CRDs within the original chart and add package.yaml
chart changes for tolerations, crds, added
global.cattle.systemDefaultRegistry
Review changes to removed nodeSelector helper, combine all cis clusterroles in one file
CRD name change and adding keywords, moving package.yaml one folder upi
Renamed hardened benchmark
Move providesGVR to chart.yaml
This commit adds a new flag to the experimental feature of generating a CRD chart for charts that need to be able to assume the ownership of any existing CRDs within a cluster. It also modifies the existing `prepare-crd` script to use template files stored in the `./scripts/chart-templates/` directory instead of utilizing numerous `cat` commands in order to achieve the same result.
Feature charts with this flag enabled will differ from the normal CRD chart in the following ways:
- Instead of having CRDs from `crd/` in `templates/`, they will be relocated to `crd-manifest/`.
- On render, the CRDs in `crd-manifest` are placed into a ConfigMap that will be deployed on the cluster.
- On install / upgrade / rollback, a pre-install / pre-upgrade / pre-rollback hook Job that does a `kubectl apply -f` on the manifest within the crd-manifest ConfigMap (with appropriate RBAC credentials via a ServiceAccount, CRB, and ClusterRole) will install the CRDs onto the cluster.
- On uninstall, a delete hook Job does a `kubectl delete -f` on the manifest within the crd-manifest ConfigMap (with the same RBAC credentials) to remove the CRDs from the cluster.
At the moment, this will only be used by the `rancher-monitoring` chart.
Related Issue: https://github.com/rancher/rancher/issues/28326
By utilizing the `clean-crds` script, both `validate` and `clean` can cleanly deal with issues related to annotations added and files overlaid as part of the CRD chart process.
This commit deprecates the providesGVR flag used by charts in favor of charts adding this annotation directly to the patch of their chart (or their Chart.yaml).
Before, the logic for reverting a CRD chart was located in `generate-patch` since it was the only script that required these changes. Now that the same logic is required on a `make clean` in order to support reverting just the generateCRDChart changes from local charts, this commit moves that logic out to its own script `clean-crds`.
Based on discussion in https://github.com/rancher/charts/pull/607#discussion_r483288658.