chore(greenhouse-organization): add helm resource policy keep

system/greenhouse-organization/Chart.yaml

@@ -3,7 +3,7 @@ name: greenhouse-organization
 description: A Helm chart for resources required for running the Greenhouse
   admin organization in Greenhouse.
 type: application
-version: 0.6.19
+version: 0.6.20
 dependencies:
   - name: secrets-injector
     repository: oci://keppel.eu-de-1.cloud.sap/ccloud-helm

system/greenhouse-organization/templates/alerts/prometheusrules.yaml

@@ -3,6 +3,8 @@
 apiVersion: monitoring.coreos.com/v1
 kind: PrometheusRule
 metadata:
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     app: operator
     role: alert-rules

system/greenhouse-organization/templates/catalogs.yaml

@@ -5,6 +5,8 @@ kind: Catalog
 metadata:
   name: {{ $name }}
   namespace: {{ $.Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   {{- with $catalog.labels }}
   labels:
     {{- toYaml . | nindent 4 }}

system/greenhouse-organization/templates/container-image-retainer.yaml

@@ -3,11 +3,15 @@ kind: ServiceAccount
 metadata:
   name: container-image-retainer
   namespace: greenhouse
+  annotations:
+    "helm.sh/resource-policy": keep
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: container-image-retainer
+  annotations:
+    "helm.sh/resource-policy": keep
 rules:
   - apiGroups:
       - ""
@@ -23,6 +27,8 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: container-image-retainer
+  annotations:
+    "helm.sh/resource-policy": keep
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -36,6 +42,8 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: container-image-retainer
+  annotations:
+    "helm.sh/resource-policy": keep
 data:
   retain.sh: |
     {{- .Files.Get "etc/retain.sh" | nindent 4 }}
@@ -44,6 +52,8 @@ apiVersion: batch/v1
 kind: CronJob
 metadata:
   name: container-image-retainer
+  annotations:
+    "helm.sh/resource-policy": keep
 spec:
   schedule: '0 1 * * *'
   concurrencyPolicy: Forbid

system/greenhouse-organization/templates/dashboards/flux-dashboards.yaml

@@ -5,6 +5,8 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ printf "%s-%s" $.Release.Name $path | replace ".json" "" | replace "/" "-" | trunc 63 }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     perses.dev/resource: "true"
 

system/greenhouse-organization/templates/organization/ccloud-ingress.yaml

@@ -3,6 +3,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   annotations:
+    "helm.sh/resource-policy": keep
     disco: "true"
     kubernetes.io/tls-acme: "true"
     nginx.ingress.kubernetes.io/proxy-buffer-size: 32k

system/greenhouse-organization/templates/organization/organization.yaml

@@ -4,6 +4,8 @@ kind: Secret
 metadata:
   name: {{ .Release.Namespace }}-auth
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
 type: greenhouse.sap/orgsecret
 data:
 {{- if .Values.global.oidc.enabled }}
@@ -28,6 +30,8 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: registry-mirrors
+  annotations:
+    "helm.sh/resource-policy": keep
 data:
   containerRegistryConfig: |
 {{- if and .Values.organization.registryAuth .Values.organization.registryAuth.secretName }}
@@ -47,6 +51,8 @@ kind: Secret
 metadata:
   name: {{ .Values.organization.registryAuth.secretName }}
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
 type: Opaque
 {{- end }}
 ---
@@ -55,6 +61,8 @@ apiVersion: greenhouse.sap/v1alpha1
 kind: Organization
 metadata:
   name: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
 spec:
   description: Greenhouse organization
   mappedOrgAdminIdPGroup: {{ required ".Values.teams.admin.mappedIdPGroup missing" .Values.teams.admin.mappedIdPGroup }}

system/greenhouse-organization/templates/organization/rbac.yaml

@@ -2,6 +2,8 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: greenhouse:cluster-admin
+  annotations:
+    "helm.sh/resource-policy": keep
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -26,6 +28,8 @@ kind: Role
 metadata:
   name: role:{{ .Release.Namespace }}:support
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
 rules:
 - apiGroups: [""]
   resources: ["configmaps", "pods", "pods/log", "secrets"]
@@ -68,6 +72,8 @@ kind: RoleBinding
 metadata:
   name: role:{{ .Release.Namespace }}:support
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role

system/greenhouse-organization/templates/organization/teams.yaml

@@ -6,6 +6,8 @@ kind: Team
 metadata:
   name: {{ required "Team name missing" $teamName | lower }}
   namespace: {{ $.Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
 {{ if $team.isSupportGroup }}
   labels:
     greenhouse.sap/support-group: "true"

system/greenhouse-organization/templates/plugins/alerts.yaml

@@ -3,6 +3,8 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: ingress-ca-cert
+  annotations:
+    "helm.sh/resource-policy": keep
 data:
   ca.crt: {{ required "missing ingress ca cert: .Values.global.caCert" .Values.global.caCert | b64enc | quote }}
 ---
@@ -11,6 +13,8 @@ kind: Plugin
 metadata:
   name: alerts
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.alerts.supportGroup | default .Values.global.supportGroup }}
 spec:

system/greenhouse-organization/templates/plugins/cert-manager.yaml

@@ -3,6 +3,8 @@ kind: Plugin
 metadata:
   name: cert-manager
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.certManager.supportGroup | default .Values.global.supportGroup }}
 spec:

system/greenhouse-organization/templates/plugins/digicert-issuer.yaml

@@ -4,6 +4,8 @@ kind: Plugin
 metadata:
   name: digicert-issuer
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.digicertIssuer.supportGroup | default .Values.global.supportGroup }}
 spec:

system/greenhouse-organization/templates/plugins/disco.yaml

@@ -4,6 +4,8 @@ kind: Plugin
 metadata:
   name: disco
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.disco.supportGroup | default .Values.global.supportGroup }}
 spec:

system/greenhouse-organization/templates/plugins/external-dns.yaml

@@ -4,6 +4,8 @@ kind: Plugin
 metadata:
   name: external-dns
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.externalDns.supportGroup | default .Values.global.supportGroup }}
 spec:

system/greenhouse-organization/templates/plugins/gatekeeper.yaml

@@ -9,6 +9,8 @@ kind: Plugin
 metadata:
   name: gatekeeper
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.gatekeeper.supportGroup | default .Values.global.supportGroup }}
 spec:

system/greenhouse-organization/templates/plugins/ingress-nginx.yaml

@@ -9,6 +9,8 @@ kind: Plugin
 metadata:
   name: ingress-nginx
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.ingress.supportGroup | default .Values.global.supportGroup }}
 spec:

system/greenhouse-organization/templates/plugins/k8s-gateway-api.yaml

@@ -9,6 +9,8 @@ kind: Plugin
 metadata:
   name: k8s-gateway-api
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.k8sGatewayApi.supportGroup | default .Values.global.supportGroup }}
 spec:

system/greenhouse-organization/templates/plugins/kgateway-crds.yaml

@@ -9,6 +9,8 @@ kind: Plugin
 metadata:
   name: kgateway-crds
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.kgatewayCrds.supportGroup | default .Values.global.supportGroup }}
 spec:

system/greenhouse-organization/templates/plugins/kgateway.yaml

@@ -9,6 +9,8 @@ kind: Plugin
 metadata:
   name: kgateway
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.kgateway.supportGroup | default .Values.global.supportGroup }}
 spec:

system/greenhouse-organization/templates/plugins/kube-monitoring.yaml

@@ -4,6 +4,8 @@ kind: ConfigMap
 metadata:
   name: flux-system
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
 data:
   config.yaml: |
     spec:
@@ -171,6 +173,8 @@ type: Opaque
 metadata:
   name: thanos-metrics-objectstore
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
 data:
   thanos.yaml: {{ toYaml .Values.monitoring.thanosObjectstoreConfig | b64enc | quote }}
 ---
@@ -179,6 +183,8 @@ kind: Plugin
 metadata:
   name: kube-monitoring
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.monitoring.supportGroup | default .Values.global.supportGroup }}
 spec:

system/greenhouse-organization/templates/plugins/logs.yaml

@@ -6,6 +6,8 @@ kind: Secret
 metadata:
   name: otel-basic-auth-users
   namespace: {{ $.Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.openTelemetry.supportGroup | default .Values.global.supportGroup }}
 data:
@@ -20,6 +22,8 @@ kind: Plugin
 metadata:
   name: logs-greenhouse
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.openTelemetry.supportGroup | default .Values.global.supportGroup }}
 spec:

system/greenhouse-organization/templates/plugins/logshipping.yaml

@@ -4,6 +4,8 @@ kind: Plugin
 metadata:
   name: logshipper-greenhouse
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.logshipping.supportGroup | default .Values.global.supportGroup }}
 spec:

system/greenhouse-organization/templates/plugins/permission-manager.yaml

@@ -9,6 +9,8 @@ kind: Plugin
 metadata:
   name: permission-manager
   namespace: greenhouse
+  annotations:
+    "helm.sh/resource-policy": keep
 spec:
   pluginDefinitionRef:
     name: permission-manager

system/greenhouse-organization/templates/plugins/perses.yaml

@@ -4,6 +4,8 @@ kind: Plugin
 metadata:
   name: perses
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.perses.supportGroup | default .Values.global.supportGroup }}
 spec:

system/greenhouse-organization/templates/plugins/repo-guard.yaml

@@ -9,6 +9,8 @@ kind: Plugin
 metadata:
   name: repo-guard
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.global.supportGroup }}
 spec:

system/greenhouse-organization/templates/plugins/shoot-grafter.yaml

@@ -9,6 +9,8 @@ apiVersion: greenhouse.sap/v1alpha1
 kind: Plugin
 metadata:
   name: shoot-grafter
+  annotations:
+    "helm.sh/resource-policy": keep
 labels:
     "greenhouse.sap/owned-by": {{ .Values.shootgrafter.supportGroup | default .Values.global.supportGroup }}
 spec:

system/greenhouse-organization/templates/plugins/thanos.yaml

@@ -4,6 +4,8 @@ kind: Plugin
 metadata:
   name: thanos
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     "greenhouse.sap/owned-by": {{ .Values.thanos.supportGroup | default .Values.global.supportGroup }}
 spec:

system/greenhouse-organization/templates/secret-kube-extensions.yaml

@@ -3,6 +3,8 @@ kind: Secret
 metadata:
   name: github-app-secret-sci
   namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     greenhouse.sap/owned-by: containers
 type: Opaque