fix(helm): sync CRDs and fix helm-generate post-processing#60
Merged
ian-flores merged 6 commits intomainfrom Feb 2, 2026
Merged
fix(helm): sync CRDs and fix helm-generate post-processing#60ian-flores merged 6 commits intomainfrom
ian-flores merged 6 commits intomainfrom
Conversation
Regenerate Helm chart CRDs from base CRDs to include recent API changes
(sessionTolerations, flightdeck.enabled) that were only in config/crd/bases/.
Key changes:
- Sync Helm CRDs with base CRDs (source of truth is config/crd/bases/)
- Add Makefile post-processing to fix kubebuilder-generated files
- Remove unused resourcePolicy.keep feature from all templates
- Delete config/rbac/auth_proxy_service.yaml to prevent duplicate service
Why post-processing in Makefile:
The kubebuilder helm plugin generates certificate.yaml and metrics-service.yaml
from internal Go templates (not from config/), hardcoding the metrics service
name. Since we template the serviceAccountName via Helm values, we need to
patch these generated files to use {{ .Values.controllerManager.serviceAccountName }}-metrics-service
instead of the hardcoded team-operator-controller-manager-metrics-service.
Why remove resourcePolicy.keep:
This Helm annotation prevents resources from being deleted on uninstall.
For CRDs we have the dedicated crd.keep value. For other resources
(RBAC, services, etc.), we want standard Helm lifecycle management.
Why delete auth_proxy_service.yaml:
The metrics service is already defined in dist/chart/templates/metrics/
metrics-service.yaml. Having a source file in config/rbac/ caused
kubebuilder to generate a duplicate in dist/chart/templates/rbac/.
This comment was marked as outdated.
This comment was marked as outdated.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Keep the auth_proxy files but disable them by commenting out the references in kustomization.yaml. This is cleaner than deleting files since kubebuilder won't regenerate them if they're just disabled.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
Lytol
approved these changes
Jan 29, 2026
Lytol
left a comment
Lytol
left a comment
There was a problem hiding this comment.
Thanks for the clear description in the PR notes! I have two comments/questions, but as long as you're comfortable with them, don't let it stop you from merging.
- The Connect and Workbench CRDs have really big diffs that I didn't see any reasons for in the PR description. Were you expecting these?
- Yay for fixing the
helm-generatetarget to cover the eccentricities/fallout. Are we still expecting engineers to manually run this on changes? I didn't see any changes that would cause it to automatically run in typical workflows or CI.
There was a problem hiding this comment.
This diff (for the Connect CRD) seems surprisingly large. Is this expected given the description in the PR?
There was a problem hiding this comment.
Same as the Connect CRD. Is this large diff expected?
Ensures Helm chart CRDs stay in sync with base kustomize CRDs by running make helm-generate and failing if it produces any diff.
Adds automatic kubebuilder binary download (v4.5.1) to support running make helm-generate in CI. Downloads the pre-built binary from GitHub releases since go install doesn't include all plugins.
Collaborator
Author
|
@Lytol Yes, this is expected. The Helm CRDs had drifted from the kustomize source (e.g., affinity was incorrectly typed as an array). |
This was referenced Feb 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
sessionTolerations,flightdeck.enabled)helm-generateresourcePolicy.keepfeature from all templatesconfig/rbac/auth_proxy_service.yamlto prevent duplicate service creationTechnical Context
Why CRDs were out of sync
The base CRDs in
config/crd/bases/are generated fromapi/*_types.goviamake manifests. The Helm chart CRDs indist/chart/templates/crd/are generated from the base CRDs viamake helm-generate. However,helm-generatewas only run once when Helm charts were first migrated, causing drift as new API fields were added.Solution: Regenerated Helm CRDs from base CRDs. Going forward, developers should run
make helm-generateafter API changes.Why Makefile post-processing is needed
The kubebuilder helm plugin generates
certificate.yamlandmetrics-service.yamlfrom internal Go templates (not fromconfig/). These templates hardcode the metrics service name asteam-operator-controller-manager-metrics-service.Since we template the
serviceAccountNamevia Helm values, the service name should be{{ .Values.controllerManager.serviceAccountName }}-metrics-service. The sed commands in the Makefile patch these generated files to use the templated value.There is no source file to modify - the templates live inside the kubebuilder binary itself.
Why resourcePolicy.keep was removed
This Helm annotation (
helm.sh/resource-policy: keep) prevents resources from being deleted on uninstall. For CRDs, we already have the dedicatedcrd.keepvalue. For other resources (RBAC, services, etc.), we want standard Helm lifecycle management - they should be cleaned up when the release is uninstalled.Why auth_proxy_service.yaml was deleted
The metrics service is already defined in
dist/chart/templates/metrics/metrics-service.yaml. Having a source file inconfig/rbac/auth_proxy_service.yamlcaused kubebuilder to generate a duplicate indist/chart/templates/rbac/auth_proxy_service.yaml. Deleting the source file prevents this duplicate.Test plan
helm template team-operator dist/chartand verify no duplicate services