ci: support automation helm chart release (#1092)

* ci: support automation helm chart release

Signed-off-by: bitliu <bitliu@tencent.com>

* ci: support automation helm chart release

Signed-off-by: bitliu <bitliu@tencent.com>

---------

Signed-off-by: bitliu <bitliu@tencent.com>

.github/workflows/build_and_test.yaml

@@ -136,3 +136,8 @@ jobs:
       if: github.event_name == 'push' && github.ref == 'refs/heads/main'
       # tag is set to `latest` when pushing to main branch
       run: make image.push.multiarch TAG=latest PLATFORMS="linux_amd64 linux_arm64" IMAGE=envoyproxy/gateway-dev
+
+    - name: Build and Push EG Latest Helm Chart
+      if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+      # use `0.0.0` as the default latest version.
+      run: CHART_NAME=envoy-gateway OCI_REGISTRY=oci://docker.io/envoyproxy CHART_VERSION=0.0.0 TAG=latest make helm-package helm-push

.github/workflows/latest_release.yaml

@@ -62,6 +62,12 @@ jobs:
 
           It is only intended for developers wishing to try out the latest features in Envoy Gateway, some of which may not be fully implemented.
 
+          We use `0.0.0` as the latest chart version to install latest envoy-gateway:
+
+          ```shell
+          helm install eg oci://docker.io/envoyproxy/envoy-gateway --version 0.0.0 -n envoy-gateway-system --create-namespace
+          ```
+
     # Check if latest release and tag are created properly,
     # if not, the workflow needs to report an error, 
     # let maintainers be aware of it and rerun it manually.

.github/workflows/release.yaml

@@ -28,7 +28,10 @@ jobs:
           skopeo copy --all docker://docker.io/envoyproxy/gateway-dev:${{ env.sha_short }} docker://docker.io/envoyproxy/gateway:${{ env.release_tag }}
 
       - name: Generate Release Artifacts
-        run: make generate-artifacts IMAGE=envoyproxy/gateway TAG=${{ env.release_tag}} OUTPUT_DIR=release-artifacts
+        run: make generate-artifacts IMAGE=envoyproxy/gateway TAG=${{ env.release_tag }} OUTPUT_DIR=release-artifacts
+
+      - name: Build and Push EG Release Helm Chart
+        run: CHART_NAME=envoy-gateway OCI_REGISTRY=oci://docker.io/envoyproxy CHART_VERSION=${{ env.release_tag }} TAG=${{ env.release_tag }} make helm-package helm-push
 
       - name: Upload Release Manifests
         uses: softprops/action-gh-release@v1

charts/eg/Chart.yaml → charts/envoy-gateway/Chart.yaml

@@ -1,19 +1,22 @@
-apiVersion: v3
-name: eg
+apiVersion: v2
+name: envoy-gateway
 description: The Helm chart for Envoy Gateway
 type: application
 
-version: 0.1.0
-appVersion: "0.3.0"
+version: 0.0.0
+appVersion: "latest"
 
-maintainers: # (optional)
+maintainers:
+  - name: envoy-gateway-steering-committee
+    url: https://github.com/envoyproxy/gateway/blob/main/GOVERNANCE.md
   - name: envoy-gateway-maintainers
     url: https://github.com/envoyproxy/gateway/blob/main/CODEOWNERS.md
 
 keywords:
   - gateway-api
   - envoyproxy
   - envoy-gateway
+  - eg
 
 home: https://gateway.envoyproxy.io/
 

charts/eg/README.md → charts/envoy-gateway/README.md

@@ -16,13 +16,13 @@ eg` to see the charts.
 To install the eg chart along with Gateway API CRDs and Envoy Gateway CRDs:
 
 ``` shell
-    helm install envoy-gateway --create-namespace charts/eg -n envoy-gateway-system
+    helm install envoy-gateway --create-namespace charts/envoy-gateway -n envoy-gateway-system
 ```
 
 You can also install the eg chart along without Gateway API CRDs and Envoy Gateway CRDs:
 
 ``` shell
-    helm install envoy-gateway --create-namespace charts/eg -n envoy-gateway-system --skip-crds
+    helm install envoy-gateway --create-namespace charts/envoy-gateway -n envoy-gateway-system --skip-crds
 ```
 
 To uninstall the chart:

charts/eg/templates/envoy-gateway-config.yaml → charts/envoy-gateway/templates/envoy-gateway-config.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "eg.fullname" . }}-envoy-gateway-config
+  name: envoy-gateway-config
   labels:
   {{- include "eg.labels" . | nindent 4 }}
 data:

charts/eg/templates/envoy-gateway-deployment.yaml → charts/envoy-gateway/templates/envoy-gateway-deployment.yaml

@@ -1,14 +1,14 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ include "eg.fullname" . }}-envoy-gateway
+  name: envoy-gateway
   labels:
   {{- include "eg.labels" . | nindent 4 }}
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "eg.fullname" . }}-envoy-gateway
+  name: envoy-gateway
   labels:
     control-plane: envoy-gateway
   {{- include "eg.labels" . | nindent 4 }}
@@ -80,12 +80,12 @@ spec:
           }}
       securityContext:
         runAsNonRoot: true
-      serviceAccountName: {{ include "eg.fullname" . }}-envoy-gateway
+      serviceAccountName: envoy-gateway
       terminationGracePeriodSeconds: 10
       volumes:
       - configMap:
           defaultMode: 420
-          name: {{ include "eg.fullname" . }}-envoy-gateway-config
+          name: envoy-gateway-config
         name: envoy-gateway-config
       - name: certs
         secret:

charts/eg/templates/envoy-gateway-metrics-service.yaml → charts/envoy-gateway/templates/envoy-gateway-metrics-service.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "eg.fullname" . }}-envoy-gateway-metrics-service
+  name: envoy-gateway-metrics-service
   labels:
     control-plane: envoy-gateway
   {{- include "eg.labels" . | nindent 4 }}

charts/eg/templates/envoy-gateway-rbac.yaml → charts/envoy-gateway/templates/envoy-gateway-rbac.yaml

@@ -8,5 +8,5 @@ roleRef:
   name: envoy-gateway-role
 subjects:
 - kind: ServiceAccount
-  name: '{{ include "eg.fullname" . }}-envoy-gateway'
+  name: 'envoy-gateway'
   namespace: '{{ .Release.Namespace }}'

charts/eg/templates/infra-manager-rbac.yaml → charts/envoy-gateway/templates/infra-manager-rbac.yaml

@@ -37,5 +37,5 @@ roleRef:
   name: '{{ include "eg.fullname" . }}-infra-manager'
 subjects:
 - kind: ServiceAccount
-  name: '{{ include "eg.fullname" . }}-envoy-gateway'
+  name: 'envoy-gateway'
   namespace: '{{ .Release.Namespace }}'

charts/eg/templates/leader-election-rbac.yaml → charts/envoy-gateway/templates/leader-election-rbac.yaml

@@ -49,5 +49,5 @@ roleRef:
   name: '{{ include "eg.fullname" . }}-leader-election-role'
 subjects:
 - kind: ServiceAccount
-  name: '{{ include "eg.fullname" . }}-envoy-gateway'
+  name: 'envoy-gateway'
   namespace: '{{ .Release.Namespace }}'

charts/eg/templates/proxy-rbac.yaml → charts/envoy-gateway/templates/proxy-rbac.yaml

@@ -30,5 +30,5 @@ roleRef:
   name: '{{ include "eg.fullname" . }}-proxy-role'
 subjects:
 - kind: ServiceAccount
-  name: '{{ include "eg.fullname" . }}-envoy-gateway'
+  name: 'envoy-gateway'
   namespace: '{{ .Release.Namespace }}'

charts/eg/values.yaml → charts/envoy-gateway/values.yaml

@@ -43,4 +43,5 @@ envoyGatewayMetricsService:
     port: 8443
     protocol: TCP
     targetPort: https
+
 kubernetesClusterDomain: cluster.local

internal/provider/kubernetes/kubernetes_test.go

@@ -87,7 +87,7 @@ func TestProvider(t *testing.T) {
 func startEnv() (*envtest.Environment, *rest.Config, error) {
 	log.SetLogger(zap.New(zap.WriteTo(os.Stderr), zap.UseDevMode(true)))
 	gwAPIs := filepath.Join(".", "testdata", "in")
-	egAPIs := filepath.Join("..", "..", "..", "charts", "eg", "crds", "generated")
+	egAPIs := filepath.Join("..", "..", "..", "charts", "envoy-gateway", "crds", "generated")
 	env := &envtest.Environment{
 		CRDDirectoryPaths: []string{gwAPIs, egAPIs},
 	}

tools/linter/yamllint/.yamllint

@@ -1,7 +1,7 @@
 ---
 
 ignore: |
-  charts/eg/
+  charts/envoy-gateway/
   bin/install.yaml
 
 rules:

tools/make/common.mk

@@ -77,6 +77,7 @@ include tools/make/image.mk
 include tools/make/lint.mk
 include tools/make/kube.mk
 include tools/make/docs.mk
+include tools/make/helm.mk
 
 # Log the running target
 LOG_TARGET = echo -e "\033[0;32m===========> Running $@ ... \033[0m"

tools/make/helm.mk

@@ -0,0 +1,23 @@
+# This is a wrapper to manage helm chart
+#
+# All make targets related to helmß are defined in this file.
+
+OCI_REGISTRY ?= oci://docker.io/envoyproxy
+CHART_NAME ?= envoy-gateway
+CHART_VERSION ?= ${RELEASE_VERSION}
+
+##@ Helm
+helm-package:
+helm-package: ## Package envoy gateway helm chart.
+	@$(LOG_TARGET)
+	helm package charts/${CHART_NAME} --app-version ${TAG} --version ${CHART_VERSION} --destination ${OUTPUT_DIR}/charts/
+
+helm-push:
+helm-push: ## Push envoy gateway helm chart to OCI registry.
+	@$(LOG_TARGET)
+	helm push ${OUTPUT_DIR}/charts/${CHART_NAME}-${CHART_VERSION}.tgz ${OCI_REGISTRY}
+
+helm-install:
+helm-install: ## Install envoy gateway helm chart from OCI registry.
+	@$(LOG_TARGET)
+	helm install eg ${OCI_REGISTRY}/${CHART_NAME} --version ${CHART_VERSION} -n envoy-gateway-system --create-namespace

tools/make/kube.mk

@@ -26,7 +26,7 @@ CONTROLLERGEN_OBJECT_FLAGS :=  object:headerFile="$(ROOT_DIR)/tools/boilerplate/
 .PHONY: manifests
 manifests: $(tools/controller-gen) ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
 	@$(LOG_TARGET)
-	$(tools/controller-gen) rbac:roleName=envoy-gateway-role crd webhook paths="./..." output:crd:artifacts:config=charts/eg/crds/generated output:rbac:artifacts:config=charts/eg/templates/generated/rbac output:webhook:artifacts:config=charts/eg/templates/generated/webhook
+	$(tools/controller-gen) rbac:roleName=envoy-gateway-role crd webhook paths="./..." output:crd:artifacts:config=charts/envoy-gateway/crds/generated output:rbac:artifacts:config=charts/envoy-gateway/templates/generated/rbac output:webhook:artifacts:config=charts/envoy-gateway/templates/generated/webhook
 
 .PHONY: kube-generate
 kube-generate: $(tools/controller-gen) ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
@@ -50,7 +50,7 @@ IMAGE_PULL_POLICY ?= Always
 .PHONY: kube-deploy
 kube-deploy: manifests ## Install Envoy Gateway into the Kubernetes cluster specified in ~/.kube/config.
 	@$(LOG_TARGET)
-	helm install eg charts/eg --set deployment.envoyGateway.image.repository=$(IMAGE) --set deployment.envoyGateway.image.tag=$(TAG) --set deployment.envoyGateway.imagePullPolicy=$(IMAGE_PULL_POLICY) -n envoy-gateway-system --create-namespace
+	helm install eg charts/envoy-gateway --set deployment.envoyGateway.image.repository=$(IMAGE) --set deployment.envoyGateway.image.tag=$(TAG) --set deployment.envoyGateway.imagePullPolicy=$(IMAGE_PULL_POLICY) -n envoy-gateway-system --create-namespace
 
 .PHONY: kube-undeploy
 kube-undeploy: manifests ## Uninstall the Envoy Gateway into the Kubernetes cluster specified in ~/.kube/config.
@@ -99,7 +99,7 @@ kube-install-image: image.build $(tools/kind) ## Install the EG image to a kind
 run-conformance: ## Run Gateway API conformance.
 	@$(LOG_TARGET)
 	kubectl wait --timeout=5m -n gateway-system deployment/gateway-api-admission-server --for=condition=Available
-	kubectl wait --timeout=5m -n envoy-gateway-system deployment/eg-envoy-gateway --for=condition=Available
+	kubectl wait --timeout=5m -n envoy-gateway-system deployment/envoy-gateway --for=condition=Available
 	kubectl wait --timeout=5m -n gateway-system job/gateway-api-admission --for=condition=Complete
 	kubectl apply -f test/config/gatewayclass.yaml
 	go test -v -tags conformance ./test/conformance --gateway-class=envoy-gateway --debug=true --use-unique-ports=$(CONFORMANCE_UNIQUE_PORTS)
@@ -114,7 +114,7 @@ generate-manifests: ## Generate Kubernetes release manifests.
 	@$(LOG_TARGET)
 	@$(call log, "Generating kubernetes manifests")
 	mkdir -p $(OUTPUT_DIR)/
-	helm template eg charts/eg --include-crds --set deployment.envoyGateway.image.repository=$(IMAGE) --set deployment.envoyGateway.image.tag=$(TAG) --set deployment.envoyGateway.imagePullPolicy=$(IMAGE_PULL_POLICY) > $(OUTPUT_DIR)/install.yaml
+	helm template eg charts/envoy-gateway --include-crds --set deployment.envoyGateway.image.repository=$(IMAGE) --set deployment.envoyGateway.image.tag=$(TAG) --set deployment.envoyGateway.imagePullPolicy=$(IMAGE_PULL_POLICY) > $(OUTPUT_DIR)/install.yaml
 	@$(call log, "Added: $(OUTPUT_DIR)/install.yaml")
 	cp examples/kubernetes/quickstart.yaml $(OUTPUT_DIR)/quickstart.yaml
 	@$(call log, "Added: $(OUTPUT_DIR)/quickstart.yaml")