fix(helm): Add extra values to widen deployment support

charts/substrate-podcert/README.md

@@ -43,6 +43,10 @@ chart over resources still owned by the application release fails Helm ownership
 validation. Perform the release split during a planned installation update;
 do not delete the existing CA-pool Secrets.
 
+The controller Deployment is named like its ServiceAccount (`podcertificate-controller`,
+prefixed by other release names). `podLabels` and `podAnnotations` add labels and
+annotations to its pod template.
+
 Set `resources.requests` and `resources.limits` on this release to size the
 controller container. Defaults are `10m` CPU and `64Mi` memory requests, with
 `500m` CPU and `256Mi` memory limits. For example:

charts/substrate-podcert/templates/pod-certificate-controller.yaml

@@ -136,7 +136,7 @@ subjects:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: podcertificate-controller
+  name: {{ include "podcert.fullname" (list "podcertificate-controller" .) }}
   namespace: {{ .Release.Namespace }}
   labels:
     app: podcertificate-controller
@@ -149,6 +149,13 @@ spec:
     metadata:
       labels:
         app: podcertificate-controller
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
     spec:
       {{- with include "podcert.imagePullSecrets" . }}{{- . | nindent 6 }}{{- end }}
       containers:

charts/substrate-podcert/values.yaml

@@ -43,3 +43,8 @@ image:
   registry: ghcr.io
   repository: kagent-dev/substrate
   tag: ""
+
+# Labels added to the controller pod template.
+podLabels: {}
+# Annotations added to the controller pod template.
+podAnnotations: {}

charts/substrate/README.md

@@ -56,16 +56,28 @@ See `values.yaml` for the full set; the important keys:
 | `postgres.ownerConnectionStringSecretRef` | `substrate-postgres-owner` | Read the owner connection from a pre-created Secret |
 | `postgres.readWriteRole` | `substrate_readwrite` | Role assumed by read/write connections |
 | `postgres.ownerRole` | `substrate_owner` | Role assumed by owner connections |
+| `postgres.readWriteRoleSecretRef` | `{}` | `{name, key}` of a Secret key holding the read/write role name, instead of `readWriteRole`; `key` defaults to `username` |
+| `postgres.ownerRoleSecretRef` | `{}` | Same for the owner role, instead of `ownerRole` |
 | `preview` | `[]` | Preview gates for the API server, controller and workers, and atelet; set `[ExternalVolumes]` to enable external volume APIs and mounts |
 | `postgres.schema` | `substrate` | Store the Substrate tables in this PostgreSQL schema |
 | `postgres.clientCertificates.enabled` | `false` | Project separate owner and runtime login certificates into the API server |
 | `<component>.resources` | see `values.yaml` | Requests and limits for each container, e.g. `ateApi.resources` and `atenetRouter.agentgateway.resources` |
 | `rustfs.enabled` | `true` | Deploy an in-cluster S3-compatible RustFS bucket for snapshots |
+| `rustfs.storageClassName` | `""` | StorageClass of the RustFS data claim; empty uses the cluster default |
+| `rustfs.strategy` | `{}` | RustFS Deployment strategy; set `{type: Recreate}` because the data volume is ReadWriteOnce |
+| `rustfs.bucketInit.annotations` | `{}` | Annotations on the bucket-init Job, e.g. a GitOps hook so the immutable Job is replaced on change |
+| `rustfs.bucketInit.dedicatedServiceAccount` | `false` | Run the bucket-init Job under its own ServiceAccount named like the Job |
+| `podLabels` | `{}` | Labels added to every pod template, e.g. `sidecar.istio.io/inject: "false"` |
+| `podAnnotations` | `{}` | Annotations added to every pod template, e.g. node placement hints |
+| `commonLabels` | `{}` | Labels added to the RustFS PersistentVolumeClaim |
 | `ateApi.snapshotLocation` | `""` | Cluster-wide snapshot URI; defaults to `gs://<rustfs.bucket>/` with bundled RustFS |
 | `atelet.storageBackend` | `s3` | Default snapshot backend, wired to RustFS when `rustfs.enabled=true` |
 | `atelet.imageCredentialProviderConfig` | `""` | Host path to the kubelet credential provider config; set together with the bin directory |
 | `atelet.imageCredentialProviderConfigYAML` | `""` | Credential provider config as text, rendered into a ConfigMap, for nodes where that file cannot be authored or must differ from the kubelet's; mutually exclusive with the host path |
 | `atelet.imageCredentialProviderBinDir` | `""` | Host path to the kubelet credential provider binaries; both paths are mounted read-only |
+| `atelet.extraVolumes` | `[]` | Extra volumes on the atelet pod, e.g. a `kubernetes.io/dockerconfigjson` Secret a plugin reads |
+| `atelet.extraVolumeMounts` | `[]` | Extra volume mounts on the atelet container |
+| `atelet.tolerations` | sandbox-class and GKE ComputeClass taints | Tolerations of the atelet pods, replaced as a whole; set to what the cluster's admission controllers produce if they rewrite DaemonSet tolerations |
 | `credentialProvider.namespacePolicies` | `[]` | Default-deny atespace-to-namespace grants; the chart includes get-only Secret RBAC for the provider |
 | `ateApi.actorJWTIssuer` | `https://<idp-service>.<namespace>.svc` | Issuer placed in actor JWTs; set a stable URL reachable by relying parties |
 | `objectStorePlugin.extraEnv` | `[]` | Object storage credentials/settings shared by both object-store plugins |
@@ -203,6 +215,10 @@ certificates for the bundled development database.
 
 For an operator-managed database, the operator must provision the identities,
 schema, and grants, and create both connection Secrets in the release namespace.
+When the provisioner generates and rotates the login and that login is itself the
+role to assume, set `postgres.readWriteRoleSecretRef` and `postgres.ownerRoleSecretRef`
+to the Secret key that holds the login name instead of fixed `readWriteRole` and
+`ownerRole` values; the API server reads the role names from those keys at start.
 
 Substrate runs `SET ROLE` for each new connection. It rejects a login without
 the required membership.

charts/substrate/templates/ate-api-server.yaml

@@ -77,7 +77,13 @@ spec:
     metadata:
       labels:
         app: ate-api-server
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
       annotations:
+        {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
         checksum/api-config: {{ .Values.ateApi.logLevel | sha256sum }}
         prometheus.io/scrape: "true"
         prometheus.io/port: "9090"
@@ -161,8 +167,16 @@ spec:
         - "--authentication-config=/etc/ateapi/authentication/authentication.yaml"
         - "--postgres-read-write-connection-string=@env"
         - "--postgres-owner-connection-string=@env"
+{{- if .Values.postgres.readWriteRoleSecretRef.name }}
+        - "--postgres-read-write-role=$(ATE_API_POSTGRES_READ_WRITE_ROLE)"
+{{- else }}
         - {{ printf "--postgres-read-write-role=%s" .Values.postgres.readWriteRole | quote }}
+{{- end }}
+{{- if .Values.postgres.ownerRoleSecretRef.name }}
+        - "--postgres-owner-role=$(ATE_API_POSTGRES_OWNER_ROLE)"
+{{- else }}
         - {{ printf "--postgres-owner-role=%s" .Values.postgres.ownerRole | quote }}
+{{- end }}
         - "--postgres-schema=@env"
         - "--actor-jwt-issuer=@env"
         - "--actor-id-jwt-pool=/run/actor-id-jwt-pool/pool.json"
@@ -205,6 +219,20 @@ spec:
             secretKeyRef:
               name: {{ include "substrate.postgres.ownerSecretName" . | quote }}
               key: {{ get $ownerConnectionStringSecretRef "key" | default "ownerConnectionString" | quote }}
+{{- with .Values.postgres.readWriteRoleSecretRef }}{{- if .name }}
+        - name: ATE_API_POSTGRES_READ_WRITE_ROLE
+          valueFrom:
+            secretKeyRef:
+              name: {{ .name | quote }}
+              key: {{ .key | default "username" | quote }}
+{{- end }}{{- end }}
+{{- with .Values.postgres.ownerRoleSecretRef }}{{- if .name }}
+        - name: ATE_API_POSTGRES_OWNER_ROLE
+          valueFrom:
+            secretKeyRef:
+              name: {{ .name | quote }}
+              key: {{ .key | default "username" | quote }}
+{{- end }}{{- end }}
 {{- with include "substrate.otel.env" . }}
 {{- . | trim | nindent 8 }}
 {{- end }}

charts/substrate/templates/ate-controller.yaml

@@ -79,6 +79,13 @@ spec:
     metadata:
       labels:
         app: ate-controller
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
     spec:
       serviceAccountName: {{ include "substrate.fullname" (list "ate-controller" .) }}
       {{- with include "substrate.imagePullSecrets" . }}{{- . | nindent 6 }}{{- end }}

charts/substrate/templates/ate-idp-server.yaml

@@ -39,6 +39,13 @@ spec:
     metadata:
       labels:
         app: ate-idp-server
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
     spec:
       {{- with include "substrate.imagePullSecrets" . }}{{- . | nindent 6 }}{{- end }}
       serviceAccountName: {{ include "substrate.fullname" (list "ate-idp-server" .) }}

charts/substrate/templates/atelet.yaml

@@ -126,21 +126,20 @@ spec:
     metadata:
       labels:
         app: atelet
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
       annotations:
+        {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
         prometheus.io/scrape: "true"
         prometheus.io/port: "9090"
     spec:
       serviceAccountName: {{ include "substrate.fullname" (list "atelet" .) }}
       priorityClassName: {{ include "substrate.fullname" (list "ate-node-critical" .) }}
-      # Run on nodes reserved for any WorkerPool sandbox class.
       tolerations:
-      - key: ate.dev/sandboxClass
-        operator: Exists
-        effect: NoSchedule
-      # GKE reserves ComputeClass nodes with this taint.
-      - key: cloud.google.com/compute-class
-        operator: Exists
-        effect: NoSchedule
+{{ toYaml .Values.atelet.tolerations | indent 6 }}
       {{- with include "substrate.imagePullSecrets" . }}{{- . | nindent 6 }}{{- end }}
       initContainers:
       - name: objectstore-plugin
@@ -297,6 +296,9 @@ spec:
           subPath: config.yaml
 {{- end }}
           readOnly: true
+{{- end }}
+{{- with .Values.atelet.extraVolumeMounts }}
+{{ toYaml . | indent 8 }}
 {{- end }}
       volumes:
       - name: objectstore-plugin
@@ -358,3 +360,6 @@ spec:
                 matchLabels:
                   podcert.ate.dev/canarying: live
               path: trust-bundle.pem
+{{- with .Values.atelet.extraVolumes }}
+{{ toYaml . | indent 6 }}
+{{- end }}

charts/substrate/templates/atenet-egress.yaml

@@ -132,6 +132,13 @@ spec:
     metadata:
       labels:
         app: atenet-egress
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
     spec:
       serviceAccountName: {{ include "substrate.fullname" (list "atenet-egress" .) }}
       securityContext:

charts/substrate/templates/atenet-router.yaml

@@ -177,7 +177,13 @@ spec:
     metadata:
       labels:
         app: atenet-router
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
       annotations:
+        {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
         prometheus.io/scrape: "true"
         prometheus.io/port: "15020"
     spec:

charts/substrate/templates/k8s-credential-provider.yaml

@@ -62,9 +62,15 @@ spec:
   template:
     metadata:
       annotations:
+        {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
         checksum/namespace-policy: {{ toJson .Values.credentialProvider.namespacePolicies | sha256sum }}
       labels:
         app: {{ include "substrate.fullname" (list "k8s-credential-provider" .) }}
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
     spec:
       serviceAccountName: {{ include "substrate.fullname" (list "k8s-credential-provider" .) }}
       {{- with include "substrate.imagePullSecrets" . }}{{- . | nindent 6 }}{{- end }}

charts/substrate/templates/rustfs.yaml

@@ -26,7 +26,14 @@ kind: PersistentVolumeClaim
 metadata:
   name: {{ include "substrate.fullname" (list "rustfs-data" .) }}
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.commonLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
+  {{- with .Values.rustfs.storageClassName }}
+  storageClassName: {{ . | quote }}
+  {{- end }}
   accessModes:
   - ReadWriteOnce
   resources:
@@ -56,6 +63,10 @@ metadata:
   name: {{ include "substrate.fullname" (list "rustfs" .) }}
   namespace: {{ .Release.Namespace }}
 spec:
+  {{- with .Values.rustfs.strategy }}
+  strategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   replicas: 1
   selector:
     matchLabels:
@@ -64,6 +75,13 @@ spec:
     metadata:
       labels:
         app: rustfs
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
     spec:
       serviceAccountName: {{ include "substrate.fullname" (list "rustfs" .) }}
       securityContext:
@@ -108,12 +126,31 @@ kind: Job
 metadata:
   name: {{ include "substrate.fullname" (list "rustfs-bucket-init" .) }}
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.rustfs.bucketInit.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   backoffLimit: 10
   template:
+    {{- if or .Values.podLabels .Values.podAnnotations }}
+    metadata:
+      {{- with .Values.podLabels }}
+      labels:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- end }}
     spec:
       restartPolicy: OnFailure
+      {{- if .Values.rustfs.bucketInit.dedicatedServiceAccount }}
+      serviceAccountName: {{ include "substrate.fullname" (list "rustfs-bucket-init" .) }}
+      {{- else }}
       serviceAccountName: {{ include "substrate.fullname" (list "rustfs" .) }}
+      {{- end }}
       {{- with include "substrate.imagePullSecrets" . }}{{- . | nindent 6 }}{{- end }}
       containers:
       - name: create-bucket
@@ -176,3 +213,16 @@ spec:
     - protocol: TCP
       port: api
 {{- end }}
+{{- if .Values.rustfs.bucketInit.dedicatedServiceAccount }}
+---
+# A ServiceAccount named like the Job, for admission policies that require it.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "substrate.fullname" (list "rustfs-bucket-init" .) }}
+  namespace: {{ .Release.Namespace }}
+  {{- with .Values.rustfs.bucketInit.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}