feat(helm): Add support for additional containers in API server

charts/substrate/README.md

@@ -76,6 +76,8 @@ See `values.yaml` for the full set; the important keys:
 | `ateApi.logLevel` | `info` | API server log level in its mounted config; one of `debug`, `info`, `warn`, or `error` |
 | `ateApi.authorization.bootstrapOwners` | `[]` | Global owners; empty defaults to the release's shared `ate-client` ServiceAccount |
 | `ateApi.extraArgs` | `[]` | Additional command-line arguments appended to the ateapi defaults |
+| `ateApi.extraInitContainers` | `[]` | Additional init containers in the API server pods |
+| `ateApi.extraContainers` | `[]` | Additional containers in the API server pod |
 | `otel.endpoint` | `""` | Set to an OTLP endpoint to export traces, metrics, the actor lifecycle events and the router access log |
 | `otel.traces.enabled` | `true` | Set to `false` to export no traces from the router; the Go components do not honor this yet |
 | `otel.traces.endpoint` | `""` | OTLP endpoint for traces, overriding `otel.endpoint` |

charts/substrate/templates/ate-api-server.yaml

@@ -139,6 +139,9 @@ spec:
         - { name: servicedns, mountPath: /run/servicedns.podcert.ate.dev, readOnly: true }
         - { name: podidentity, mountPath: /run/podidentity.podcert.ate.dev, readOnly: true }
         - { name: actor-id-jwt-jwks, mountPath: /run/actor-id-jwt-jwks, readOnly: true }
+{{- with .Values.ateApi.extraInitContainers }}
+{{ toYaml . | indent 6 }}
+{{- end }}
       containers:
       - name: ate-api-server
         securityContext:
@@ -249,6 +252,9 @@ spec:
             port: health
           initialDelaySeconds: 10
           periodSeconds: 10
+{{- with .Values.ateApi.extraContainers }}
+{{ toYaml . | indent 6 }}
+{{- end }}
       volumes:
       - name: objectstore-plugin
         emptyDir: {}

charts/substrate/tests/control_plane_test.yaml

@@ -412,6 +412,43 @@ tests:
   - matchRegex:
       path: data["config.yaml"]
       pattern: 'requestParking:\n\s+budget: "30s"'
+- it: runs only the built-in API server containers by default
+  template: ate-api-server.yaml
+  - lengthEqual:
+      path: spec.template.spec.initContainers
+      count: 1
+  - lengthEqual:
+      path: spec.template.spec.containers
+      count: 1
+- it: appends extra API server containers
+  template: ate-api-server.yaml
+  set:
+    ateApi.extraInitContainers:
+    - name: helper
+      image: example.com/helper:v1
+      restartPolicy: Always
+    ateApi.extraContainers:
+    - name: extra
+      image: example.com/extra:v1
+      args: [--port=5432]
+  - equal:
+      path: spec.template.spec.initContainers[0].name
+      value: objectstore-plugin
+  - equal:
+      path: spec.template.spec.initContainers[1]
+      value:
+        name: helper
+        image: example.com/helper:v1
+        restartPolicy: Always
+  - equal:
+      path: spec.template.spec.containers[0].name
+      value: ate-api-server
+  - equal:
+      path: spec.template.spec.containers[1]
+      value:
+        name: extra
+        image: example.com/extra:v1
+        args: [--port=5432]
 - it: defaults the egress proxy log filter to info
   template: atenet-egress.yaml
   documentSelector:
@@ -448,4 +485,4 @@ tests:
       path: spec.template.spec.containers[0].env
       content:
         name: RUST_LOG
-        value: "info,agentgateway=debug"
+        value: "info,agentgateway=debug"

charts/substrate/values.yaml

@@ -125,6 +125,9 @@ ateApi:
   # Defaults to the in-cluster IdP URL; set a stable issuer for external consumers.
   actorJWTIssuer: ""
   extraArgs: []
+  # Additional containers added to the API server pod.
+  extraInitContainers: []
+  extraContainers: []
   resources:
     requests:
       cpu: 100m