Adding support for managementPolicies (fixes #209)

[jtyr]

Description of your changes

This PR is adding support for Management Policies that allows to install a Helm chart and ignore any changes to it and still have healthy managed resource. This is useful if you want to perform the initial installation of the Helm chart via Crossplane (e.g. during bootstrap of a cluster) but later want to manage it via GitOps tool (e.g. ArgoCD or FluxCD). If the Helm chart is uninstalled via GitOps or via Helm chart client, Crossplane will make sure the chart is installed again.

Fixes #209

I have:

• Read and followed Crossplane's contribution process.
• Run make reviewable to ensure this PR is ready for review.

How has this code been tested

I have build the image and tested it on a local K3D cluster with different sets of managementPolicies. If managementPolicies: [Create, Delete, Observe], I can change the version and/or the values of the Helm chart and Crossplane doesn't reinstall it and still keeps the managed resource healthy. If I add Update or set it to *, the Helm chart is reinstalled by Crossplane if the version and/or values change. See my comment below for more details.

[jtyr]

I have built and published a Docker image that can be used to test this feature by following the bellow steps.

Make sure you have Crossplane installed on your cluster:

helm repo add crossplane-stable https://charts.crossplane.io/stable
helm repo update crossplane-stable
helm install \
  --wait \
  --namespace crossplane-system \
  --create-namespace \
  crossplane \
  crossplane-stable/crossplane

Install the Helm provider that will use the custom-built Docker image:

cat <<END | kubectl apply -n crossplane-system -f -
---
apiVersion: pkg.crossplane.io/v1alpha1
kind: ControllerConfig
metadata:
  name: helm-debug
spec:
  args:
    - --debug
    - --poll=1m
    - --sync=2m
  serviceAccountName: provider-helm
  image: ghcr.io/jtyr/docker/provider-helm:0.1.0
  imagePullPolicy: Always
---
apiVersion: pkg.crossplane.io/v1
kind: Provider
metadata:
  name: provider-helm
spec:
  package: xpkg.upbound.io/crossplane-contrib/provider-helm:v0.17.0
  controllerConfigRef:
    name: helm-debug
END

Grant cluster-admin permissions to the Helm provider:

kubectl create clusterrolebinding \
  --clusterrole cluster-admin \
  --serviceaccount crossplane-system:provider-helm \
  crossplane:provider:helm:admin

Create Helm release for Nginx:

cat <<END | kubectl apply -n crossplane-system -f -
---
apiVersion: helm.crossplane.io/v1beta1
kind: ProviderConfig
metadata:
  name: local
spec:
  credentials:
    source: InjectedIdentity
---
apiVersion: helm.crossplane.io/v1beta1
kind: Release
metadata:
  name: nginx
spec:
  forProvider:
    namespace: default
    chart:
      name: nginx
      repository: oci://registry-1.docker.io/bitnamicharts
    values:
      networkPolicy:
        enabled: false
      service:
        type: ClusterIP
  providerConfigRef:
    name: local
  managementPolicies:
    - Create
    - Delete
    - Observe
END

Check the status of the release (requires the Crossplane CLI):

crossplane beta trace -o wide -n crossplane-system release.helm.crossplane.io nginx

Check the Helm release version:

helm list -n default

Install different Nginx version:

helm upgrade \
  --install \
  --wait \
  --namespace default \
  --version 15.12.1 \
  nginx \
  oci://registry-1.docker.io/bitnamicharts/nginx

Watch the status of the release and the chart version:

watch 'crossplane beta trace -o wide -n crossplane-system release.helm.crossplane.io nginx; echo; helm list -n default'

The Release resource should stay healthy (SYNCED=True, READY=True) and the Helm chart version should stay 15.12.1 and Crossplane should never reinstall it to a different version as long as there is any release with that name installed.

[turkenh]

Great work @jtyr 💪 Loved all the details you provided and testing you did 🤩

Just left a minor comment.

[lsviben]

LGTM, thanks @jtyr !

[jtyr]

Thanks for merging this PR, @lsviben. It would be great if you could cut a new release so we can start using this new feature ;o)

[jeanduplessis]

We will want to wait for this PR to land before cutting a new release. I know @jbw976 is looking at it this week.

[jbw976]

@jeanduplessis @lsviben, we haven't been successful yet with #208 (comment) after digging for awhile. I don't see an obvious end in sight yet, so I would recommend not holding any release on that PR also. Just go ahead with a release when you wish! 🙇‍♂️