feat(helm): add Helm chart and build tooling

Makefile

@@ -1,5 +1,6 @@
 # Image URL to use all building/pushing image targets
 IMG ?= controller:latest
+IMAGE_TAG ?=
 
 # Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
 ifeq (,$(shell go env GOBIN))
@@ -133,6 +134,14 @@ docker-build: ## Build docker image with the manager.
 docker-push: ## Push docker image with the manager.
 	$(CONTAINER_TOOL) push ${IMG}
 
+.PHONY: image
+image: ## Build the controller image using hack/build-image.sh.
+	@if [ -n "$(IMAGE_TAG)" ]; then \
+		IMAGE_TAG=$(IMAGE_TAG) bash ./hack/build-image.sh; \
+	else \
+		bash ./hack/build-image.sh; \
+	fi
+
 # PLATFORMS defines the target platforms for the manager image be built to provide support to multiple
 # architectures. (i.e. make docker-buildx IMG=myregistry/mypoperator:0.0.1). To use this option you need to:
 # - be able to use docker buildx. More info: https://docs.docker.com/build/buildx/

README.md

@@ -52,6 +52,39 @@ make install
 make deploy
 ```
 
+### Build Container Image
+
+The repo provides an opinionated build that mirrors the pattern used in [`STRRL/cloudflare-tunnel-ingress-controller`](https://github.com/STRRL/cloudflare-tunnel-ingress-controller). Build it with BuildKit enabled so module downloads are cached automatically:
+
+```bash
+make image
+```
+
+The helper tags the result as `ghcr.io/strrl/supabase-operator:<commit>`, `<commit>-linux-amd64`, and `latest`. Provide an extra tag if needed:
+
+```bash
+IMAGE_TAG=v0.1.0 make image
+```
+
+### Deploy with Helm
+
+A self-contained Helm chart lives in `helm/supabase-operator`, including the CRD. Render or install it directly:
+
+```bash
+# Render the manifests for review
+helm template supabase-operator ./helm/supabase-operator \
+  --namespace supabase-operator-system
+
+# Or install into a cluster
+helm install supabase-operator ./helm/supabase-operator \
+  --namespace supabase-operator-system \
+  --create-namespace \
+  --set image.repository=ghcr.io/strrl/supabase-operator \
+  --set image.tag=$(git rev-parse --short HEAD)
+```
+
+Pass additional overrides (for example `.Values.extraArgs` or `.Values.resources`) to tailor the deployment.
+
 ## Quick Start
 
 ### 1. Create Database Secret

hack/build-image.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+set -exo pipefail
+
+DIR=$(dirname $0)
+
+COMMIT_HASH=$(bash "${DIR}"/commit-hash.sh)
+
+PLATFORM=linux/amd64
+ARCH_TAG=linux-amd64
+
+cd "${DIR}"/../ && \
+    DOCKER_BUILDKIT=1 DOCKER_DEFAULT_PLATFORM=${PLATFORM} docker build -t ghcr.io/strrl/supabase-operator:"${COMMIT_HASH}" \
+    -f ./image/supabase-operator/Dockerfile ./
+
+docker tag ghcr.io/strrl/supabase-operator:"${COMMIT_HASH}" ghcr.io/strrl/supabase-operator:"${COMMIT_HASH}-${ARCH_TAG}"
+docker tag ghcr.io/strrl/supabase-operator:"${COMMIT_HASH}" ghcr.io/strrl/supabase-operator:latest
+
+if [ -n "${IMAGE_TAG:-}" ]; then
+    docker tag ghcr.io/strrl/supabase-operator:"${COMMIT_HASH}" ghcr.io/strrl/supabase-operator:"${IMAGE_TAG}"
+fi

hack/commit-hash.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+
+set -euxo pipefail
+
+HASH=$(git rev-parse --short HEAD)
+if [[ $(git status --porcelain) ]]; then
+  HASH=${HASH}-dirty
+fi 
+
+echo $HASH

hack/install-setup-envtest.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+# if setup-envtest is not installed, install it
+
+if ! command -v 'setup-envtest' &> /dev/null
+then
+    echo 'setup-envtest could not be found'
+    echo 'installing setup-envtest'
+    go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
+else
+    echo 'setup-envtest is already installed'
+fi

hack/update-kubernetes-library.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+
+# This script is adapted from chaos-mesh/chaos-mesh
+# Original: https://github.com/chaos-mesh/chaos-mesh/blob/master/hack/update-kubernetes-library.sh
+
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -euo pipefail
+
+if [ $# -ne 1 ]; then
+    echo "Usage: $0 <kubernetes-version>"
+    echo "Example: $0 v1.32.1"
+    exit 1
+fi
+
+VERSION=${1#"v"}
+if [ -z "$VERSION" ]; then
+    echo "Must specify version!"
+    exit 1
+fi
+MODS=($(
+    curl -sS https://raw.githubusercontent.com/kubernetes/kubernetes/v${VERSION}/go.mod |
+    sed -n 's|.*k8s.io/\(.*\) => ./staging/src/k8s.io/.*|k8s.io/\1|p'
+))
+for MOD in "${MODS[@]}"; do
+    V=$(
+        go mod download -json "${MOD}@kubernetes-${VERSION}" |
+        sed -n 's|.*"Version": "\(.*\)".*|\1|p'
+    )
+    echo "bump ${MOD}@${V}"
+    go mod edit "-replace=${MOD}=${MOD}@${V}"
+done
+
+go get "k8s.io/kubernetes@v${VERSION}"
+go mod tidy

helm/supabase-operator/.helmignore

@@ -0,0 +1,22 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and negation.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

helm/supabase-operator/Chart.yaml

@@ -0,0 +1,22 @@
+apiVersion: v2
+name: supabase-operator
+description: Kubernetes operator that provisions Supabase projects and dependencies.
+type: application
+version: 0.1.0
+appVersion: "0.0.1"
+home: https://github.com/STRRL/supabase-operator
+sources:
+  - https://github.com/STRRL/supabase-operator
+keywords:
+  - supabase
+  - operator
+  - kubernetes
+maintainers:
+  - name: STRRL
+    email: im@strrl.dev
+annotations:
+  artifacthub.io/containsSecurityUpdates: "false"
+  artifacthub.io/operator: "true"
+  artifacthub.io/operatorCapabilities: "Seamless Upgrades"
+  artifacthub.io/prerelease: "true"
+  artifacthub.io/license: "Apache-2.0"