feat(k8s): package the operator as a helm chart

.github/workflows/build-operator.yaml

@@ -1,4 +1,4 @@
-name: Build & Push Streaming Operator Image
+name: Publish Streaming Operator
 
 on:
   push:
@@ -37,3 +37,43 @@ jobs:
           google_ar_image_name: ${{ matrix.image }}
           google_workload_identity_provider: projects/868781662168/locations/global/workloadIdentityPools/prod-github/providers/github-oidc-pool
           google_service_account: gha-gcr-push@sac-prod-sa.iam.gserviceaccount.com
+
+  publish-chart:
+    name: Publish Helm chart
+    needs: build-and-push
+    runs-on: ubuntu-latest
+    concurrency:
+      group: github-pages
+      cancel-in-progress: false
+    permissions:
+      contents: write
+    env:
+      CHART_DIR: sentry_streams_k8s/chart/streaming-operator
+      CHART_VERSION: 0.0.0-${{ github.sha }}
+      IMAGE_TAG: ${{ github.sha }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          fetch-depth: 0
+
+      - name: Prepare and lint chart
+        run: |
+          sed -i "s/^version:.*/version: ${CHART_VERSION}/" "${CHART_DIR}/Chart.yaml"
+          sed -i "s/^appVersion:.*/appVersion: \"${IMAGE_TAG}\"/" "${CHART_DIR}/Chart.yaml"
+          helm lint "${CHART_DIR}" --set workloadNamespace=streaming-pipelines
+          helm template streaming-operator "${CHART_DIR}" \
+            --set workloadNamespace=streaming-pipelines > /dev/null
+
+      - name: Configure Git
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+
+      - name: Release chart
+        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
+        with:
+          charts_dir: sentry_streams_k8s/chart
+          skip_existing: true
+          mark_as_latest: false
+        env:
+          CR_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/ci.yaml

@@ -30,6 +30,18 @@ jobs:
       - name: Run k8s test
         run: make tests-k8s
 
+  chart:
+    name: "Lint streaming-operator helm chart"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+      - name: Lint and render chart
+        run: |
+          helm lint sentry_streams_k8s/chart/streaming-operator \
+            --set workloadNamespace=streaming-pipelines
+          helm template streaming-operator sentry_streams_k8s/chart/streaming-operator \
+            --set workloadNamespace=streaming-pipelines > /dev/null
+
   integration-tests:
     name: "Run integration tests"
     runs-on: ubuntu-latest

.github/workflows/docs.yaml

@@ -9,6 +9,9 @@ jobs:
   docs:
     name: Sphinx
     runs-on: ubuntu-latest
+    concurrency:
+      group: github-pages
+      cancel-in-progress: false
     steps:
       - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
@@ -23,7 +26,7 @@ jobs:
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: sentry_streams/docs/build
-          force_orphan: true
+          keep_files: true
 
       - name: Archive Docs
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4

sentry_streams_k8s/chart/streaming-operator/Chart.yaml

@@ -0,0 +1,8 @@
+apiVersion: v2
+name: streaming-operator
+type: application
+kubeVersion: ">=1.23.0-0"
+version: 0.0.0
+appVersion: "latest"
+sources:
+  - https://github.com/getsentry/streams/tree/main/sentry_streams_k8s

sentry_streams_k8s/chart/streaming-operator/templates/_helpers.tpl

@@ -0,0 +1,30 @@
+{{- define "streaming-operator.name" -}}
+{{- .Chart.Name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "streaming-operator.fullname" -}}
+{{- include "streaming-operator.name" . -}}
+{{- end -}}
+
+{{- define "streaming-operator.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "streaming-operator.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{- define "streaming-operator.labels" -}}
+{{ include "streaming-operator.selectorLabels" . }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version }}
+{{- with .Values.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end -}}
+
+{{- define "streaming-operator.serviceAccountName" -}}
+{{- default (include "streaming-operator.fullname" .) .Values.serviceAccount.name -}}
+{{- end -}}
+
+{{- define "streaming-operator.workloadNamespace" -}}
+{{- required "workloadNamespace must be set" .Values.workloadNamespace -}}
+{{- end -}}

sentry_streams_k8s/chart/streaming-operator/templates/deployment.yaml

@@ -0,0 +1,64 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "streaming-operator.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "streaming-operator.labels" . | nindent 4 }}
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      {{- include "streaming-operator.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "streaming-operator.labels" . | nindent 8 }}
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    spec:
+      serviceAccountName: {{ include "streaming-operator.serviceAccountName" . }}
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: operator
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          env:
+            - name: WORKLOAD_NAMESPACE
+              value: {{ include "streaming-operator.workloadNamespace" . | quote }}
+            {{- with .Values.env }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.priorityClassName }}
+      priorityClassName: {{ . }}
+      {{- end }}

sentry_streams_k8s/chart/streaming-operator/templates/namespace.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ include "streaming-operator.workloadNamespace" . }}
+  annotations:
+    helm.sh/resource-policy: keep
+  labels:
+    {{- include "streaming-operator.labels" . | nindent 4 }}

sentry_streams_k8s/chart/streaming-operator/templates/rbac.yaml

@@ -0,0 +1,68 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "streaming-operator.fullname" . }}
+  labels:
+    {{- include "streaming-operator.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [apiextensions.k8s.io]
+    resources: [customresourcedefinitions]
+    verbs: [list, watch]
+  - apiGroups: [""]
+    resources: [namespaces]
+    verbs: [list, watch]
+  - apiGroups: [streams.sentry.io]
+    resources: [streamingpipelines]
+    verbs: [list, watch, patch]
+  - apiGroups: [streams.sentry.io]
+    resources: [streamingpipelines/status]
+    verbs: [patch]
+  - apiGroups: [""]
+    resources: [events]
+    verbs: [create]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "streaming-operator.fullname" . }}
+  labels:
+    {{- include "streaming-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "streaming-operator.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "streaming-operator.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "streaming-operator.fullname" . }}
+  namespace: {{ include "streaming-operator.workloadNamespace" . }}
+  labels:
+    {{- include "streaming-operator.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources: [configmaps]
+    verbs: [get, list, create, patch, delete]
+  - apiGroups: [apps]
+    resources: [deployments]
+    verbs: [get, list, create, patch, delete]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "streaming-operator.fullname" . }}
+  namespace: {{ include "streaming-operator.workloadNamespace" . }}
+  labels:
+    {{- include "streaming-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "streaming-operator.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "streaming-operator.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}

sentry_streams_k8s/chart/streaming-operator/templates/serviceaccount.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "streaming-operator.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "streaming-operator.labels" . | nindent 4 }}

sentry_streams_k8s/chart/streaming-operator/values.yaml

@@ -0,0 +1,32 @@
+# - labels is for things like Sentry COGS tags (service, app_feature, component).
+# - serviceAccount.name defaults to the chart's full name when left empty.
+# - image.tag defaults to the chart's appVersion when left empty.
+
+workloadNamespace: ""
+
+image:
+  repository: us-central1-docker.pkg.dev/sentryio/streaming-operator/image
+  tag: ""
+  pullPolicy: IfNotPresent
+
+resources:
+  requests:
+    cpu: 100m
+    memory: 256Mi
+  limits:
+    memory: 256Mi
+
+env: []
+
+labels: {}
+
+podLabels: {}
+podAnnotations: {}
+
+serviceAccount:
+  name: ""
+
+nodeSelector: {}
+tolerations: []
+affinity: {}
+priorityClassName: ""

sentry_streams_k8s/pyproject.toml

@@ -50,7 +50,11 @@ where = ["."]
 include = ["sentry_streams_k8s*"]
 
 [tool.setuptools.package-data]
-sentry_streams_k8s = ["py.typed", "templates/deployment.yaml", "templates/container.yaml"]
+sentry_streams_k8s = [
+    "py.typed",
+    "templates/deployment.yaml",
+    "templates/container.yaml",
+]
 
 [tool.pytest.ini_options]
 minversion = "6.0"