Skip to content

Commit 06b399e

Browse files
bacherflthisthattoddbaert
authored
docs: document new Flagd CRD (#641)
Signed-off-by: Florian Bacher <florian.bacher@dynatrace.com> Co-authored-by: Giovanni Liva <giovanni.liva@dynatrace.com> Co-authored-by: Todd Baert <toddbaert@gmail.com>
1 parent dd23123 commit 06b399e

File tree

2 files changed

+186
-9
lines changed

2 files changed

+186
-9
lines changed

‎docs/flagd.md

+171
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
# Flagd
2+
3+
The CRD `Flagd` at version `v1beta1` is used to create a standalone flagd deployment,
4+
accompanied by a `Service` and an optional `Ingress` to expose its API
5+
endpoint to clients outside the cluster.
6+
7+
The handling of this resource can be enabled/disabled by setting `managerConfig.flagdResourceEnabled` Helm value of the operator
8+
chart to `true` or `false` respectively.
9+
10+
Below is an example of a `Flagd` resource:
11+
12+
```yaml
13+
apiVersion: core.openfeature.dev/v1beta1
14+
kind: Flagd
15+
metadata:
16+
name: flagd-sample
17+
spec:
18+
replicas: 2
19+
serviceType: ClusterIP
20+
serviceAccountName: default
21+
featureFlagSource: end-to-end
22+
ingress:
23+
enabled: true
24+
annotations:
25+
nginx.ingress.kubernetes.io/force-ssl-redirect: "false"
26+
hosts:
27+
- flagd-sample
28+
ingressClassName: nginx
29+
pathType: ImplementationSpecific
30+
```
31+
32+
In the example above, we have created a `Flagd` resource called `flagd-sample`,
33+
which results the following resources to be created by the operator
34+
after applying it:
35+
36+
- A `flagd-sample` `Deployment` with two replicas, running an instance of `flagd` each:
37+
38+
```yaml
39+
apiVersion: apps/v1
40+
kind: Deployment
41+
metadata:
42+
labels:
43+
app: flagd-sample
44+
app.kubernetes.io/managed-by: open-feature-operator
45+
app.kubernetes.io/name: flagd-sample
46+
name: flagd-sample
47+
ownerReferences:
48+
- apiVersion: core.openfeature.dev/v1beta1
49+
kind: Flagd
50+
name: flagd-sample
51+
spec:
52+
replicas: 2
53+
selector:
54+
matchLabels:
55+
app: flagd-sample
56+
template:
57+
metadata:
58+
creationTimestamp: null
59+
labels:
60+
app: flagd-sample
61+
app.kubernetes.io/managed-by: open-feature-operator
62+
app.kubernetes.io/name: flagd-sample
63+
spec:
64+
containers:
65+
- name: flagd
66+
# renovate: datasource=github-tags depName=open-feature/flagd/flagd
67+
image: ghcr.io/open-feature/flagd:v0.10.1
68+
ports:
69+
- containerPort: 8014
70+
name: management
71+
protocol: TCP
72+
- containerPort: 8013
73+
name: flagd
74+
protocol: TCP
75+
- containerPort: 8016
76+
name: ofrep
77+
protocol: TCP
78+
- containerPort: 8015
79+
name: sync
80+
protocol: TCP
81+
serviceAccount: default
82+
serviceAccountName: default
83+
```
84+
85+
- A `flagd-sample` `Service` with the type set to `ClusterIP`, that enables access to the pods
86+
running the flagd instance:
87+
88+
```yaml
89+
apiVersion: v1
90+
kind: Service
91+
metadata:
92+
labels:
93+
app: flagd-sample
94+
app.kubernetes.io/managed-by: open-feature-operator
95+
app.kubernetes.io/name: flagd-sample
96+
name: flagd-sample
97+
ownerReferences:
98+
- apiVersion: core.openfeature.dev/v1beta1
99+
kind: Flagd
100+
name: flagd-sample
101+
spec:
102+
ports:
103+
- name: flagd
104+
port: 8013
105+
protocol: TCP
106+
targetPort: 8013
107+
- name: ofrep
108+
port: 8016
109+
protocol: TCP
110+
targetPort: 8016
111+
- name: sync
112+
port: 8015
113+
protocol: TCP
114+
targetPort: 8015
115+
- name: metrics
116+
port: 8014
117+
protocol: TCP
118+
targetPort: 8014
119+
selector:
120+
app: flagd-sample
121+
type: ClusterIP
122+
```
123+
124+
- A `flagd-sample` `Ingress` enabling the communication between outside clients and the `flagd-sample` `Service`:
125+
126+
```yaml
127+
apiVersion: networking.k8s.io/v1
128+
kind: Ingress
129+
metadata:
130+
labels:
131+
app: flagd-sample
132+
app.kubernetes.io/managed-by: open-feature-operator
133+
app.kubernetes.io/name: flagd-sample
134+
name: flagd-sample
135+
annotations:
136+
nginx.ingress.kubernetes.io/force-ssl-redirect: "false"
137+
ownerReferences:
138+
- apiVersion: core.openfeature.dev/v1beta1
139+
kind: Flagd
140+
name: flagd-sample
141+
spec:
142+
ingressClassName: nginx
143+
rules:
144+
- host: flagd-sample
145+
http:
146+
paths:
147+
- backend:
148+
service:
149+
name: flagd-sample
150+
port:
151+
number: 8013
152+
path: /flagd
153+
pathType: ImplementationSpecific
154+
- backend:
155+
service:
156+
name: flagd-sample
157+
port:
158+
number: 8016
159+
path: /ofrep
160+
pathType: ImplementationSpecific
161+
- backend:
162+
service:
163+
name: flagd-sample
164+
port:
165+
number: 8015
166+
path: /sync
167+
pathType: ImplementationSpecific
168+
```
169+
170+
Note that if the flagd service is intended only for cluster-internal use, the creation of the `Ingress` can be disabled
171+
by setting the `spec.ingress.enabled` parameter of the `Flagd` resource to `false`.

‎docs/permissions.md

+15-9
Original file line numberDiff line numberDiff line change
@@ -23,15 +23,21 @@ The `manager-role` applies the rules described below, its definition can be foun
2323
It provides the operator with sufficient permissions over the `core.openfeature.dev` resources, and the required permissions for injecting the `flagd` sidecar into appropriate pods.
2424
The `ConfigMap` permissions are needed to allow the mounting of `FeatureFlag` resources for file syncs.
2525

26-
| API Group | Resource | Verbs |
27-
|-----------------------------|---------------------------------------|-------------------------------------------------|
28-
| - | `ConfigMap` | create, delete, get, list, patch, update, watch |
29-
| - | `Pod` | create, delete, get, list, patch, update, watch |
30-
| - | `ServiceAccount` | get, list, watch |
31-
| `core.openfeature.dev` | `FeatureFlag` | create, delete, get, list, patch, update, watch |
32-
| `core.openfeature.dev` | `FeatureFlag Finalizers` | update |
33-
| `core.openfeature.dev` | `FeatureFlag Status` | get, patch, update |
34-
| `rbac.authorization.k8s.io` | `ClusterRoleBinding` | get, list, update, watch |
26+
| API Group | Resource | Verbs |
27+
|-----------------------------|--------------------------|-------------------------------------------------|
28+
| - | `ConfigMap` | create, delete, get, list, patch, update, watch |
29+
| - | `Pod` | create, delete, get, list, patch, update, watch |
30+
| - | `ServiceAccount` | get, list, watch |
31+
| - | `Service` *(\*)* | create, delete, get, list, patch, update, watch |
32+
| `networking.k8s.io` | `Ingress` *(\*)* | create, delete, get, list, patch, update, watch |
33+
| `core.openfeature.dev` | `FeatureFlag` | create, delete, get, list, patch, update, watch |
34+
| `core.openfeature.dev` | `FeatureFlag Finalizers` | update |
35+
| `core.openfeature.dev` | `FeatureFlag Status` | get, patch, update |
36+
| `core.openfeature.dev` | `Flagd` | create, delete, get, list, patch, update, watch |
37+
| `rbac.authorization.k8s.io` | `ClusterRoleBinding` | get, list, update, watch |
38+
39+
*(\*) Permissions for `Service` and `networking.k8s.ioIngress` are only granted if the `core.openfeature.dev.Flagd`
40+
CRD has been enabled via the `managerConfig.flagdResourceEnabled` helm value.*
3541

3642
### Proxy Role
3743

0 commit comments

Comments
 (0)