fix: add missing deployments RBAC to Helm chart manager-role template

config/rbac/role.yaml

@@ -105,6 +105,18 @@ rules:
   - get
   - patch
   - update
+- apiGroups:
+  - monitoring.coreos.com
+  resources:
+  - servicemonitors
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - policy
   resources:

dist/chart/templates/NOTES.txt

@@ -13,3 +13,13 @@ To learn more about the release, try:
 
   $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
   $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
+
+{{- if .Values.ingress.enabled }}
+The metrics endpoint is exposed via Ingress:
+  {{- range .Values.ingress.hosts }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ .host }}{{ range .paths }}{{ .path }}{{ end }}
+  {{- end }}
+{{- end }}
+{{- if .Values.gateway.enabled }}
+Gateway API resources have been configured (gateway.enabled=true).
+{{- end }}

dist/chart/templates/gateway/gateway.yaml

@@ -0,0 +1,21 @@
+{{- if .Values.gateway.enabled -}}
+{{- if .Values.gateway.gateway -}}
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: {{ include "hyperbytedb-operator.resourceName" (dict "suffix" "gateway" "context" $) }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/name: {{ include "hyperbytedb-operator.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    control-plane: controller-manager
+  {{- with .Values.gateway.gateway.annotations }}
+  annotations: {{ toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  gatewayClassName: {{ .Values.gateway.gateway.gatewayClassName }}
+  listeners: {{ toYaml .Values.gateway.gateway.listeners | nindent 4 }}
+{{- end }}
+{{- end }}

dist/chart/templates/gateway/httproute.yaml

@@ -0,0 +1,41 @@
+{{- if .Values.gateway.enabled -}}
+{{- if .Values.gateway.httpRoutes -}}
+{{- range .Values.gateway.httpRoutes }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ include "hyperbytedb-operator.resourceName" (dict "suffix" (printf "httproute-%s" .name) "context" $) }}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    app.kubernetes.io/managed-by: {{ $.Release.Service }}
+    app.kubernetes.io/name: {{ include "hyperbytedb-operator.name" $ }}
+    helm.sh/chart: {{ $.Chart.Name }}-{{ $.Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/instance: {{ $.Release.Name }}
+    control-plane: controller-manager
+  {{- with .annotations }}
+  annotations: {{ toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  parentRefs: {{ toYaml .parentRefs | nindent 4 }}
+  {{- with .hostnames }}
+  hostnames: {{ toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+  {{- range .rules }}
+  - matches:
+    {{- range .matches }}
+    - path:
+        type: {{ .pathType }}
+        value: {{ .path }}
+      {{- if .method }}
+      method: {{ .method }}
+      {{- end }}
+    {{- end }}
+    backendRefs:
+    - name: {{ include "hyperbytedb-operator.resourceName" (dict "suffix" "controller-manager-metrics-service" "context" $) }}
+      port: {{ $.Values.metrics.port }}
+  {{- end }}
+---
+{{- end }}
+{{- end }}
+{{- end }}

dist/chart/templates/ingress/ingress.yaml

@@ -0,0 +1,38 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "hyperbytedb-operator.resourceName" (dict "suffix" "ingress" "context" $) }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/name: {{ include "hyperbytedb-operator.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    control-plane: controller-manager
+  {{- with .Values.ingress.annotations }}
+  annotations: {{ toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.ingress.ingressClassName }}
+  ingressClassName: {{ . }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls: {{ toYaml .Values.ingress.tls | nindent 4 }}
+  {{- end }}
+  rules:
+  {{- range .Values.ingress.hosts }}
+  - host: {{ .host | quote }}
+    http:
+      paths:
+      {{- range .paths }}
+      - path: {{ .path }}
+        pathType: {{ .pathType }}
+        backend:
+          service:
+            name: {{ include "hyperbytedb-operator.resourceName" (dict "suffix" "controller-manager-metrics-service" "context" $) }}
+            port:
+              number: {{ $.Values.metrics.port }}
+      {{- end }}
+  {{- end }}
+{{- end }}

dist/chart/templates/rbac/manager-role.yaml

@@ -37,6 +37,7 @@ rules:
 - apiGroups:
   - apps
   resources:
+  - deployments
   - statefulsets
   verbs:
   - create

dist/chart/values.yaml

@@ -110,3 +110,58 @@ certManager:
 prometheus:
   enable: false
 
+## Ingress for the operator metrics endpoint.
+## Disabled by default. Enable to expose /metrics externally.
+##
+ingress:
+  enabled: false
+  ingressClassName: nginx
+  annotations: {}
+  hosts:
+    - host: operator.local
+      paths:
+        - path: /metrics
+          pathType: Prefix
+  tls: []
+  # tls:
+  #   - hosts:
+  #     - operator.local
+  #     secretName: operator-tls
+
+## Gateway API resources for the operator metrics endpoint.
+## Disabled by default. Requires Gateway API CRDs in the cluster.
+##
+gateway:
+  enabled: false
+  ## Provision a Gateway resource.
+  ## Set to null or omit to use an existing Gateway (reference it via HTTPRoute parentRefs instead).
+  gateway: null
+  # gateway:
+  #   gatewayClassName: istio
+  #   annotations: {}
+  #   listeners:
+  #     - name: https
+  #       port: 443
+  #       protocol: HTTPS
+  #       hostname: operator.local
+  #       tls:
+  #         mode: Terminate
+  #         certificateRefs:
+  #           - name: operator-tls
+
+  ## HTTPRoute resources attaching to a Gateway.
+  ## Each entry creates a separate HTTPRoute.
+  httpRoutes: []
+  # httpRoutes:
+  #   - name: metrics
+  #     annotations: {}
+  #     parentRefs:
+  #       - name: my-gateway
+  #         namespace: istio-system
+  #     hostnames:
+  #       - operator.local
+  #     rules:
+  #       - matches:
+  #           - pathType: PathPrefix
+  #             path: /metrics
+

dist/install.yaml

@@ -4740,6 +4740,18 @@ rules:
   - get
   - patch
   - update
+- apiGroups:
+  - monitoring.coreos.com
+  resources:
+  - servicemonitors
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - policy
   resources:

internal/controller/hyperbytedbcluster_controller.go

@@ -70,6 +70,7 @@ type HyperbytedbClusterReconciler struct {
 // +kubebuilder:rbac:groups="",resources=events,verbs=create;patch
 // +kubebuilder:rbac:groups=autoscaling,resources=horizontalpodautoscalers,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=policy,resources=poddisruptionbudgets,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=monitoring.coreos.com,resources=servicemonitors,verbs=get;list;watch;create;update;patch;delete
 
 // nolint:gocyclo // Reconcile orchestrates many sequential steps (finalizers, services,
 // configmap, scale-down hooks, statefulset, status, replication checks, auto-failover);