Add chart flink kubernetes operator 1.13.0

manifests/helm/flink-kubernetes-operator/1.13.0/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

manifests/helm/flink-kubernetes-operator/1.13.0/Chart.yaml

@@ -0,0 +1,26 @@
+################################################################################
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+
+---
+apiVersion: v2
+name: flink-kubernetes-operator
+description: A Helm chart for the Apache Flink Kubernetes Operator
+type: application
+version: 1.13.0
+appVersion: 1.13.0
+icon: https://flink.apache.org/img/logo/png/50/color_50.png

manifests/helm/flink-kubernetes-operator/1.13.0/conf/flink-conf.yaml

@@ -0,0 +1,60 @@
+################################################################################
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+
+# Flink job/cluster related configs
+taskmanager.numberOfTaskSlots: 1
+parallelism.default: 1
+
+# These parameters are required for Java 17 support.
+# Flink 1.18 uses env.java.opts.all, if a user supplies their own version of these opts in their FlinkDeployment the options below will be overridden.
+# env.java.default-opts.all is used for 1.19 onwards so users can supply their own opts.all in their Job deployments and have these appended.
+kubernetes.operator.default-configuration.flink-version.v1_18.env.java.opts.all: --add-exports=java.base/sun.net.util=ALL-UNNAMED --add-exports=java.rmi/sun.rmi.registry=ALL-UNNAMED --add-exports=java.security.jgss/sun.security.krb5=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.base/java.nio=ALL-UNNAMED --add-opens=java.base/sun.nio.ch=ALL-UNNAMED --add-opens=java.base/java.lang.reflect=ALL-UNNAMED --add-opens=java.base/java.text=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.locks=ALL-UNNAMED
+kubernetes.operator.default-configuration.flink-version.v1_19+.env.java.default-opts.all: --add-exports=java.base/sun.net.util=ALL-UNNAMED --add-exports=java.rmi/sun.rmi.registry=ALL-UNNAMED --add-exports=java.security.jgss/sun.security.krb5=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.base/java.nio=ALL-UNNAMED --add-opens=java.base/sun.nio.ch=ALL-UNNAMED --add-opens=java.base/java.lang.reflect=ALL-UNNAMED --add-opens=java.base/java.text=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.locks=ALL-UNNAMED
+
+# Flink operator related configs
+# kubernetes.operator.reconcile.interval: 60 s
+# kubernetes.operator.reconcile.parallelism: 5
+# kubernetes.operator.flink.client.cancel.timeout: 1 min
+# kubernetes.operator.resource.cleanup.timeout: 60 s
+# kubernetes.operator.observer.rest-ready.delay: 10 s
+# kubernetes.operator.observer.progress-check.interval: 10 s
+# kubernetes.operator.observer.savepoint.trigger.grace-period: 10 s
+# kubernetes.operator.flink.client.timeout: 10 s
+# kubernetes.operator.deployment.rollback.enabled: false
+# kubernetes.operator.deployment.readiness.timeout: 5min
+# kubernetes.operator.user.artifacts.base.dir: /opt/flink/artifacts
+# kubernetes.operator.job.upgrade.ignore-pending-savepoint: false
+# kubernetes.operator.watched.namespaces: ns1,ns2
+# kubernetes.operator.label.selector: flink=enabled
+# kubernetes.operator.dynamic.namespaces.enabled: false
+# kubernetes.operator.retry.initial.interval: 5 s
+# kubernetes.operator.retry.interval.multiplier: 2
+# kubernetes.operator.retry.max.attempts: 10
+# kubernetes.operator.exception.stacktrace.enabled: false
+# kubernetes.operator.exception.stacktrace.max.length: 2048
+# kubernetes.operator.exception.field.max.length: 2048
+# kubernetes.operator.exception.throwable.list.max.count: 2
+# kubernetes.operator.exception.label.mapper: Job has already been submitted:duplicatedJobFound,Server returned HTTP response code:httpResponseCodeFound
+# kubernetes.operator.leader-election.enabled: false
+# kubernetes.operator.leader-election.lease-name: flink-operator-lease
+
+# kubernetes.operator.snapshot.resource.enabled: true
+# kubernetes.operator.savepoint.dispose-on-delete: true
+
+# kubernetes.operator.metrics.reporter.slf4j.factory.class: org.apache.flink.metrics.slf4j.Slf4jReporterFactory
+# kubernetes.operator.metrics.reporter.slf4j.interval: 5 MINUTE

manifests/helm/flink-kubernetes-operator/1.13.0/conf/log4j-console.properties

@@ -0,0 +1,65 @@
+################################################################################
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+
+# This affects logging for both user code and Flink
+rootLogger.level = INFO
+rootLogger.appenderRef.console.ref = ConsoleAppender
+rootLogger.appenderRef.rolling.ref = RollingFileAppender
+
+# Uncomment this if you want to _only_ change Flink's logging
+#logger.flink.name = org.apache.flink
+#logger.flink.level = INFO
+
+# The following lines keep the log level of common libraries/connectors on
+# log level INFO. The root logger does not override this. You have to manually
+# change the log levels here.
+logger.akka.name = akka
+logger.akka.level = INFO
+logger.kafka.name= org.apache.kafka
+logger.kafka.level = INFO
+logger.hadoop.name = org.apache.hadoop
+logger.hadoop.level = INFO
+logger.zookeeper.name = org.apache.zookeeper
+logger.zookeeper.level = INFO
+
+# Log all infos to the console
+appender.console.name = ConsoleAppender
+appender.console.type = CONSOLE
+appender.console.layout.type = PatternLayout
+appender.console.layout.pattern = %d{yyyy-MM-dd HH:mm:ss,SSS} %-5p %-60c %x - %m%n
+
+# Log all infos in the given rolling file
+appender.rolling.name = RollingFileAppender
+appender.rolling.type = RollingFile
+appender.rolling.append = false
+appender.rolling.fileName = ${sys:log.file}
+appender.rolling.filePattern = ${sys:log.file}.%i
+appender.rolling.layout.type = PatternLayout
+appender.rolling.layout.pattern = %d{yyyy-MM-dd HH:mm:ss,SSS} %-5p %-60c %x - %m%n
+appender.rolling.policies.type = Policies
+appender.rolling.policies.size.type = SizeBasedTriggeringPolicy
+appender.rolling.policies.size.size=100MB
+appender.rolling.strategy.type = DefaultRolloverStrategy
+appender.rolling.strategy.max = 10
+
+# Suppress the irrelevant (wrong) warnings from the Netty channel handler
+logger.netty.name = org.apache.flink.shaded.akka.org.jboss.netty.channel.DefaultChannelPipeline
+logger.netty.level = OFF
+
+# The monitor interval in seconds to enable log4j automatic reconfiguration
+# monitorInterval = 30

manifests/helm/flink-kubernetes-operator/1.13.0/conf/log4j-operator.properties

@@ -0,0 +1,37 @@
+################################################################################
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+
+rootLogger.level = INFO
+rootLogger.appenderRef.console.ref = ConsoleAppender
+
+# Log all infos to the console
+appender.console.name = ConsoleAppender
+appender.console.type = CONSOLE
+appender.console.layout.type = PatternLayout
+appender.console.layout.pattern = %style{%d}{yellow} %style{%-30c{1.}}{cyan} %highlight{[%-5level]%notEmpty{[%X{resource.namespace}/}%notEmpty{%X{resource.name}]} %msg%n%throwable}
+
+# Do not log config loading
+logger.conf.name = org.apache.flink.configuration.GlobalConfiguration
+logger.conf.level = ERROR
+
+# Avoid logging fallback key INFO messages
+logger.conf.name = org.apache.flink.configuration.Configuration
+logger.conf.level = ERROR
+
+# The monitor interval in seconds to enable log4j automatic reconfiguration
+# monitorInterval = 30

manifests/helm/flink-kubernetes-operator/1.13.0/crds/flinksessionjobs.flink.apache.org-v1.yml

@@ -0,0 +1,271 @@
+################################################################################
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+# Generated by Fabric8 CRDGenerator, manual edits might get overwritten!
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: flinksessionjobs.flink.apache.org
+spec:
+  group: flink.apache.org
+  names:
+    kind: FlinkSessionJob
+    plural: flinksessionjobs
+    shortNames:
+    - sessionjob
+    singular: flinksessionjob
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - description: Last observed state of the job.
+      jsonPath: .status.jobStatus.state
+      name: Job Status
+      priority: 0
+      type: string
+    - description: "Lifecycle state of the Flink resource (including being rolled\
+        \ back, failed etc.)."
+      jsonPath: .status.lifecycleState
+      name: Lifecycle State
+      priority: 0
+      type: string
+    name: v1beta1
+    schema:
+      openAPIV3Schema:
+        properties:
+          spec:
+            properties:
+              deploymentName:
+                type: string
+              flinkConfiguration:
+                x-kubernetes-preserve-unknown-fields: true
+              job:
+                properties:
+                  allowNonRestoredState:
+                    type: boolean
+                  args:
+                    items:
+                      type: string
+                    type: array
+                  autoscalerResetNonce:
+                    type: integer
+                  checkpointTriggerNonce:
+                    type: integer
+                  entryClass:
+                    type: string
+                  initialSavepointPath:
+                    type: string
+                  jarURI:
+                    type: string
+                  parallelism:
+                    type: integer
+                  savepointRedeployNonce:
+                    type: integer
+                  savepointTriggerNonce:
+                    type: integer
+                  state:
+                    enum:
+                    - running
+                    - suspended
+                    type: string
+                  upgradeMode:
+                    enum:
+                    - last-state
+                    - savepoint
+                    - stateless
+                    type: string
+                type: object
+              restartNonce:
+                type: integer
+            type: object
+          status:
+            properties:
+              error:
+                type: string
+              jobStatus:
+                properties:
+                  checkpointInfo:
+                    properties:
+                      formatType:
+                        enum:
+                        - FULL
+                        - INCREMENTAL
+                        - UNKNOWN
+                        type: string
+                      lastCheckpoint:
+                        properties:
+                          formatType:
+                            enum:
+                            - FULL
+                            - INCREMENTAL
+                            - UNKNOWN
+                            type: string
+                          timeStamp:
+                            type: integer
+                          triggerNonce:
+                            type: integer
+                          triggerType:
+                            enum:
+                            - MANUAL
+                            - PERIODIC
+                            - UNKNOWN
+                            - UPGRADE
+                            type: string
+                        type: object
+                      lastPeriodicCheckpointTimestamp:
+                        type: integer
+                      triggerId:
+                        type: string
+                      triggerTimestamp:
+                        type: integer
+                      triggerType:
+                        enum:
+                        - MANUAL
+                        - PERIODIC
+                        - UNKNOWN
+                        - UPGRADE
+                        type: string
+                    type: object
+                  jobId:
+                    type: string
+                  jobName:
+                    type: string
+                  savepointInfo:
+                    properties:
+                      formatType:
+                        enum:
+                        - CANONICAL
+                        - NATIVE
+                        - UNKNOWN
+                        type: string
+                      lastPeriodicSavepointTimestamp:
+                        type: integer
+                      lastSavepoint:
+                        properties:
+                          formatType:
+                            enum:
+                            - CANONICAL
+                            - NATIVE
+                            - UNKNOWN
+                            type: string
+                          location:
+                            type: string
+                          timeStamp:
+                            type: integer
+                          triggerNonce:
+                            type: integer
+                          triggerType:
+                            enum:
+                            - MANUAL
+                            - PERIODIC
+                            - UNKNOWN
+                            - UPGRADE
+                            type: string
+                        type: object
+                      savepointHistory:
+                        items:
+                          properties:
+                            formatType:
+                              enum:
+                              - CANONICAL
+                              - NATIVE
+                              - UNKNOWN
+                              type: string
+                            location:
+                              type: string
+                            timeStamp:
+                              type: integer
+                            triggerNonce:
+                              type: integer
+                            triggerType:
+                              enum:
+                              - MANUAL
+                              - PERIODIC
+                              - UNKNOWN
+                              - UPGRADE
+                              type: string
+                          type: object
+                        type: array
+                      triggerId:
+                        type: string
+                      triggerTimestamp:
+                        type: integer
+                      triggerType:
+                        enum:
+                        - MANUAL
+                        - PERIODIC
+                        - UNKNOWN
+                        - UPGRADE
+                        type: string
+                    type: object
+                  startTime:
+                    type: string
+                  state:
+                    enum:
+                    - CANCELED
+                    - CANCELLING
+                    - CREATED
+                    - FAILED
+                    - FAILING
+                    - FINISHED
+                    - INITIALIZING
+                    - RECONCILING
+                    - RESTARTING
+                    - RUNNING
+                    - SUSPENDED
+                    type: string
+                  updateTime:
+                    type: string
+                  upgradeSavepointPath:
+                    type: string
+                type: object
+              lifecycleState:
+                enum:
+                - CREATED
+                - DELETED
+                - DELETING
+                - DEPLOYED
+                - FAILED
+                - ROLLED_BACK
+                - ROLLING_BACK
+                - STABLE
+                - SUSPENDED
+                - UPGRADING
+                type: string
+              observedGeneration:
+                type: integer
+              reconciliationStatus:
+                properties:
+                  lastReconciledSpec:
+                    type: string
+                  lastStableSpec:
+                    type: string
+                  reconciliationTimestamp:
+                    type: integer
+                  state:
+                    enum:
+                    - DEPLOYED
+                    - ROLLED_BACK
+                    - ROLLING_BACK
+                    - UPGRADING
+                    type: string
+                type: object
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

manifests/helm/flink-kubernetes-operator/1.13.0/crds/flinkstatesnapshots.flink.apache.org-v1.yml

@@ -0,0 +1,112 @@
+################################################################################
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+# Generated by Fabric8 CRDGenerator, manual edits might get overwritten!
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: flinkstatesnapshots.flink.apache.org
+spec:
+  group: flink.apache.org
+  names:
+    kind: FlinkStateSnapshot
+    plural: flinkstatesnapshots
+    shortNames:
+    - flinksnp
+    singular: flinkstatesnapshot
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - description: Final path of the snapshot.
+      jsonPath: .status.path
+      name: Path
+      priority: 0
+      type: string
+    - description: Timestamp when the snapshot was last created/failed.
+      jsonPath: .status.resultTimestamp
+      name: Result Timestamp
+      priority: 0
+      type: string
+    - description: Current state of the snapshot.
+      jsonPath: .status.state
+      name: Snapshot State
+      priority: 0
+      type: string
+    name: v1beta1
+    schema:
+      openAPIV3Schema:
+        properties:
+          spec:
+            properties:
+              backoffLimit:
+                type: integer
+              checkpoint:
+                type: object
+              jobReference:
+                properties:
+                  kind:
+                    enum:
+                    - FlinkDeployment
+                    - FlinkSessionJob
+                    type: string
+                  name:
+                    type: string
+                type: object
+              savepoint:
+                properties:
+                  alreadyExists:
+                    type: boolean
+                  disposeOnDelete:
+                    type: boolean
+                  formatType:
+                    enum:
+                    - CANONICAL
+                    - NATIVE
+                    - UNKNOWN
+                    type: string
+                  path:
+                    type: string
+                type: object
+            type: object
+          status:
+            properties:
+              error:
+                type: string
+              failures:
+                type: integer
+              path:
+                type: string
+              resultTimestamp:
+                type: string
+              state:
+                enum:
+                - ABANDONED
+                - COMPLETED
+                - FAILED
+                - IN_PROGRESS
+                - TRIGGER_PENDING
+                type: string
+              triggerId:
+                type: string
+              triggerTimestamp:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

manifests/helm/flink-kubernetes-operator/1.13.0/templates/_helpers.tpl

@@ -0,0 +1,79 @@
+{{- /*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/ -}}
+
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "flink-operator.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "flink-operator.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "flink-operator.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "flink-operator.labels" -}}
+{{ include "flink-operator.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+helm.sh/chart: {{ include "flink-operator.chart" . }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "flink-operator.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "flink-operator.name" . }}
+{{- end }}
+
+{{/*
+Create the path of the operator image to use
+*/}}
+{{- define "flink-operator.imagePath" -}}
+{{- if .Values.image.digest }}
+{{- .Values.image.repository }}@{{ .Values.image.digest }}
+{{- else }}
+{{- .Values.image.repository }}:{{ default .Chart.AppVersion .Values.image.tag }}
+{{- end }}
+{{- end }}

manifests/helm/flink-kubernetes-operator/1.13.0/templates/cert-manager/certificate.yaml

@@ -0,0 +1,46 @@
+{{- /*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/ -}}
+
+{{- if eq (include "flink-operator.webhook-enabled" .) "true" }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: flink-operator-serving-cert
+  namespace: {{ .Release.Namespace }}
+spec:
+  dnsNames:
+  - flink-operator-webhook-service.{{ .Release.Namespace }}.svc
+  - flink-operator-webhook-service.{{ .Release.Namespace }}.svc.cluster.local
+  keystores:
+    pkcs12:
+      create: true
+      passwordSecretRef:
+      {{- if .Values.webhook.keystore.useDefaultPassword }}
+        name: flink-operator-webhook-secret
+        key: password
+      {{- else }}
+        {{- with .Values.webhook.keystore.passwordSecretRef }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- end }}
+  issuerRef:
+    kind: Issuer
+    name: flink-operator-selfsigned-issuer
+  commonName: FlinkDeployment Validator
+  secretName: webhook-server-cert
+{{- end }}

manifests/helm/flink-kubernetes-operator/1.13.0/templates/cert-manager/issuer.yaml

@@ -0,0 +1,27 @@
+{{- /*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/ -}}
+
+{{- if eq (include "flink-operator.webhook-enabled" .) "true" }}
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: flink-operator-selfsigned-issuer
+  namespace: {{ .Release.Namespace }}
+spec:
+  selfSigned: {}
+{{- end }}

manifests/helm/flink-kubernetes-operator/1.13.0/templates/controller/configmap.yaml

@@ -0,0 +1,68 @@
+{{- /*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+    http://www.apache.org/licenses/LICENSE-2.0
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/ -}}
+
+{{- if .Values.defaultConfiguration.create }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: flink-operator-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "flink-operator.labels" . | nindent 4 }}
+data:
+  config.yaml: |+
+{{- if .Values.defaultConfiguration.append }}
+  {{- $.Files.Get "conf/flink-conf.yaml"  | nindent 4 -}}
+{{- end }}
+{{- if hasKey (.Values.defaultConfiguration) "config.yaml" }}
+  {{- index (.Values.defaultConfiguration) "config.yaml" | nindent 4 -}}
+{{- end }}
+{{- if .Values.watchNamespaces }}
+    kubernetes.operator.watched.namespaces: {{ join "," .Values.watchNamespaces  }}
+{{- end }}
+{{- if index .Values "operatorHealth" }}
+    kubernetes.operator.health.probe.enabled: true
+    kubernetes.operator.health.probe.port: {{ .Values.operatorHealth.port }}
+{{- end }}
+  flink-conf.yaml: |+
+{{- if .Values.defaultConfiguration.append }}
+  {{- $.Files.Get "conf/flink-conf.yaml"  | nindent 4 -}}
+{{- end }}
+{{- if hasKey (.Values.defaultConfiguration) "flink-conf.yaml" }}
+  {{- index (.Values.defaultConfiguration) "flink-conf.yaml" | nindent 4 -}}
+{{- end }}
+{{- if .Values.watchNamespaces }}
+    kubernetes.operator.watched.namespaces: {{ join "," .Values.watchNamespaces  }}
+{{- end }}
+{{- if index .Values "operatorHealth" }}
+    kubernetes.operator.health.probe.enabled: true
+    kubernetes.operator.health.probe.port: {{ .Values.operatorHealth.port }}
+{{- end }}
+  log4j-operator.properties: |+
+{{- if .Values.defaultConfiguration.append }}
+  {{- $.Files.Get "conf/log4j-operator.properties"  | nindent 4 -}}
+{{- end }}
+{{- if index (.Values.defaultConfiguration) "log4j-operator.properties" }}
+  {{- index (.Values.defaultConfiguration) "log4j-operator.properties" | nindent 4 -}}
+{{- end }}
+  log4j-console.properties: |+
+{{- if .Values.defaultConfiguration.append }}
+  {{- $.Files.Get "conf/log4j-console.properties"  | nindent 4 -}}
+{{- end }}
+{{- if index (.Values.defaultConfiguration) "log4j-console.properties" }}
+  {{- index (.Values.defaultConfiguration) "log4j-console.properties" | nindent 4 -}}
+{{- end }}
+{{- end }}

manifests/helm/flink-kubernetes-operator/1.13.0/templates/controller/deployment.yaml

@@ -0,0 +1,273 @@
+{{- /*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+    http://www.apache.org/licenses/LICENSE-2.0
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/ -}}
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "flink-operator.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "flink-operator.labels" . | nindent 4 }}
+    {{- if index (.Values.operatorPod) "labels" }}
+      {{- with .Values.operatorPod.labels }}
+        {{- toYaml . | nindent 4 }}
+      {{- end }}
+    {{- end }}
+spec:
+  replicas: {{ .Values.replicas }}
+  strategy:
+    {{- toYaml .Values.strategy | nindent 4 }}
+  selector:
+    matchLabels:
+      {{- include "flink-operator.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "flink-operator.selectorLabels" . | nindent 8 }}
+        {{- if index (.Values.operatorPod) "labels" }}
+          {{- with .Values.operatorPod.labels }}
+            {{- toYaml . | nindent 8 }}
+          {{- end }}
+        {{- end }}
+      annotations:
+        kubectl.kubernetes.io/default-container: {{ .Chart.Name }}
+        {{- if index (.Values.operatorPod) "annotations" }}
+          {{- with .Values.operatorPod.annotations }}
+            {{- toYaml . | nindent 8 }}
+          {{- end }}
+        {{- end }}
+    spec:
+      {{- with .Values.operatorPod.priorityClassName }}
+      priorityClassName: {{ . }}
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- if .Values.operatorPod.nodeSelector }}
+      nodeSelector: {{ toYaml .Values.operatorPod.nodeSelector | nindent 8 }}
+      {{- end }}
+      {{- if .Values.operatorPod.affinity }}
+      affinity: {{ toYaml .Values.operatorPod.affinity | nindent 8 }}
+      {{- end }}
+      {{- with .Values.operatorPod.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "flink-operator.serviceAccountName" . }}
+      {{- if .Values.operatorPod.topologySpreadConstraints }}
+      topologySpreadConstraints: {{ toYaml .Values.operatorPod.topologySpreadConstraints | nindent 8 }}
+      {{- end }}
+      {{- if .Values.operatorPod.initContainers }}
+      initContainers:
+      {{- toYaml .Values.operatorPod.initContainers | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: {{ include "flink-operator.imagePath" . }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command: ["/docker-entrypoint.sh", "operator"]
+          ports:
+          {{- if .Values.metrics.port }}
+            - containerPort: {{ .Values.metrics.port }}
+              name: metrics
+              protocol: TCP
+          {{- end }}
+          {{- if index .Values "operatorHealth" }}
+            - containerPort: {{ .Values.operatorHealth.port }}
+              name: health-port
+              protocol: TCP
+          {{- end }}
+          env:
+            - name: OPERATOR_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: HOST_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.hostIP
+            - name: POD_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: OPERATOR_NAME
+              value: {{ include "flink-operator.name" . }}
+            - name: FLINK_CONF_DIR
+              value: /opt/flink/conf
+            - name: FLINK_PLUGINS_DIR
+              value: /opt/flink/plugins
+            - name: LOG_CONFIG
+              value: {{ .Values.jvmArgs.logConfig }}
+            - name: JVM_ARGS
+              value: {{ .Values.jvmArgs.operator }}
+            {{- if .Values.tls.create }}
+            - name: OPERATOR_KEYSTORE_PATH
+              value: /opt/flink/tls-cert/keystore.jks
+            - name: OPERATOR_TRUSTSTORE_PATH
+              value: /opt/flink/tls-cert/truststore.jks
+            - name: OPERATOR_KEYSTORE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  {{- toYaml .Values.tls.secretKeyRef | nindent 18 }}
+                  optional: true
+            {{- end }}
+            {{- with .Values.operatorPod.env }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          {{- with .Values.operatorPod.envFrom }}
+          envFrom:
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          resources:
+            {{- toYaml .Values.operatorPod.resources | nindent 12 }}
+          securityContext:
+            {{- toYaml .Values.operatorSecurityContext | nindent 12 }}
+          volumeMounts:
+            - name: flink-operator-config-volume
+              mountPath: /opt/flink/conf
+            {{- if .Values.operatorVolumeMounts.create }}
+                {{- toYaml .Values.operatorVolumeMounts.data | nindent 12 }}
+            {{- else }}
+            - name: flink-artifacts-volume
+              mountPath: /opt/flink/artifacts
+            {{- end }}
+          {{- if .Values.tls.create }}
+            - name: flink-operator-cert-secret
+              mountPath: /opt/flink/tls-cert
+          {{- end }}
+          {{- if and (index .Values "operatorHealth") (index .Values.operatorHealth "livenessProbe") }}
+          livenessProbe:
+            {{- toYaml .Values.operatorHealth.livenessProbe | nindent 12 }}
+            httpGet:
+              path: /
+              port: health-port
+          {{- end }}
+          {{- if and (index .Values "operatorHealth") (index .Values.operatorHealth "startupProbe") }}
+          startupProbe:
+            {{- toYaml .Values.operatorHealth.startupProbe | nindent 12 }}
+            httpGet:
+              path: /
+              port: health-port
+          {{- end }}
+          {{- if .Values.postStart }}
+          lifecycle:
+            postStart:
+              {{- toYaml .Values.postStart | nindent 14 }}
+          {{- end }}
+        {{- if eq (include "flink-operator.webhook-enabled" .) "true" }}
+        - name: flink-webhook
+          image: {{ include "flink-operator.imagePath" . }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command: ["/docker-entrypoint.sh", "webhook"]
+          env:
+            - name: WEBHOOK_KEYSTORE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                {{- if .Values.webhook.keystore.useDefaultPassword }}
+                  name: flink-operator-webhook-secret
+                  key: password
+                {{- else }}
+                  {{- with .Values.webhook.keystore.passwordSecretRef }}
+                    {{- toYaml . | nindent 18 }}
+                  {{- end }}
+                {{- end }}
+            - name: WEBHOOK_KEYSTORE_FILE
+              value: "/certs/keystore.p12"
+            - name: WEBHOOK_KEYSTORE_TYPE
+              value: "pkcs12"
+            - name: WEBHOOK_SERVER_PORT
+              value: "9443"
+            - name: LOG_CONFIG
+              value: {{ .Values.jvmArgs.logConfig }}
+            - name: JVM_ARGS
+              value: {{ .Values.jvmArgs.webhook }}
+            - name: FLINK_CONF_DIR
+              value: /opt/flink/conf
+            - name: FLINK_PLUGINS_DIR
+              value: /opt/flink/plugins
+            - name: OPERATOR_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            {{- with .Values.operatorPod.webhook.container.env }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          resources:
+            {{- toYaml .Values.operatorPod.webhook.resources | nindent 12 }}
+          securityContext:
+            {{- toYaml .Values.webhookSecurityContext | nindent 12 }}
+          volumeMounts:
+          - name: keystore
+            mountPath: "/certs"
+            readOnly: true
+          - name: flink-operator-config-volume
+            mountPath: /opt/flink/conf
+        {{- end }}
+        {{- if .Values.operatorPod.sidecarContainers }}
+        {{- toYaml .Values.operatorPod.sidecarContainers | nindent 8 }}
+        {{- end }}
+      {{- if index (.Values.operatorPod) "dnsPolicy" }}
+      dnsPolicy: {{ .Values.operatorPod.dnsPolicy | quote }}
+      {{- end }}
+      {{- if index (.Values.operatorPod) "dnsConfig" }}
+      dnsConfig:
+        {{- with .Values.operatorPod.dnsConfig }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- end }}
+      volumes:
+        - name: flink-operator-config-volume
+          configMap:
+            name: flink-operator-config
+            items:
+            {{- if hasKey .Values.defaultConfiguration "flink-conf.yaml" }}
+              - key: flink-conf.yaml
+                path: flink-conf.yaml
+            {{- else }}
+              - key: config.yaml
+                path: config.yaml
+            {{- end }}
+              - key: log4j-operator.properties
+                path: log4j-operator.properties
+              - key: log4j-console.properties
+                path: log4j-console.properties
+        {{- if .Values.operatorVolumes.create }}
+              {{- toYaml .Values.operatorVolumes.data | nindent 8 }}
+        {{- else }}
+        - name: flink-artifacts-volume
+          emptyDir: {}
+        {{- end }}
+        {{- if eq (include "flink-operator.webhook-enabled" .) "true" }}
+        - name: keystore
+          secret:
+            secretName: webhook-server-cert
+            items:
+            - key: keystore.p12
+              path: keystore.p12
+        {{- end }}
+        {{- if .Values.tls.create }}
+        - name: flink-operator-cert-secret
+          secret:
+            secretName: {{ .Values.tls.secretName }}
+            optional: true
+        {{- end }}

manifests/helm/flink-kubernetes-operator/1.13.0/templates/flink/_helpers.tpl

@@ -0,0 +1,50 @@
+{{- /*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/ -}}
+
+{{/*
+Create the name of the job service account to use
+*/}}
+{{- define "flink-operator.jobServiceAccountName" -}}
+{{- if .Values.jobServiceAccount.create }}
+{{- default (include "flink-operator.fullname" .) .Values.jobServiceAccount.name }}
+{{- else }}
+{{- default "default" .Values.jobServiceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create the name of the job role to use
+*/}}
+{{- define "flink-operator.jobRoleName" -}}
+{{- if .Values.rbac.jobRoleBinding.create }}
+{{- default (include "flink-operator.fullname" .) .Values.rbac.jobRole.name }}
+{{- else }}
+{{- default "default" .Values.rbac.jobRole.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create the name of the job role to use
+*/}}
+{{- define "flink-operator.jobRoleBindingName" -}}
+{{- if .Values.rbac.jobRole.create }}
+{{- default (include "flink-operator.fullname" .) .Values.rbac.jobRoleBinding.name }}
+{{- else }}
+{{- default "default" .Values.rbac.jobRoleBinding.name }}
+{{- end }}
+{{- end }}

manifests/helm/flink-kubernetes-operator/1.13.0/templates/flink/role.yaml

@@ -0,0 +1,46 @@
+{{- /*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/ -}}
+
+{{- if and .Values.rbac.create .Values.rbac.jobRole.create }}
+{{- if .Values.watchNamespaces }}
+{{- range .Values.watchNamespaces }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "flink-operator.jobRoleName" $ }}
+  namespace: {{ . }}
+  labels:
+    {{- include "flink-operator.labels" $ | nindent 4 }}
+  annotations:
+    "helm.sh/resource-policy": keep
+{{- template "flink-operator.jobRbacRules" $ }}
+{{- end }}
+{{- else }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "flink-operator.jobRoleName" $ }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "flink-operator.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/resource-policy": keep
+{{- template "flink-operator.jobRbacRules" $ }}
+{{- end }}
+{{- end }}

manifests/helm/flink-kubernetes-operator/1.13.0/templates/flink/role_binding.yaml

@@ -0,0 +1,60 @@
+{{- /*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/ -}}
+
+{{- if and .Values.rbac.create .Values.rbac.jobRoleBinding.create }}
+{{- if .Values.watchNamespaces }}
+{{- range .Values.watchNamespaces }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "flink-operator.jobRoleBindingName" $ }}
+  namespace: {{ . }}
+  labels:
+    {{- include "flink-operator.labels" $ | nindent 4 }}
+  annotations:
+    "helm.sh/resource-policy": keep
+roleRef:
+  kind: {{ $role := include "flink-operator.jobRoleName" $ }}{{ include "flink-operator.roleScope" (dict "role" $role)}}
+  name: {{ include "flink-operator.jobRoleName" $ }}
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "flink-operator.jobServiceAccountName" $ }}
+    namespace: {{ . }}
+{{- end }}
+{{- else }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "flink-operator.jobRoleBindingName" $ }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "flink-operator.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/resource-policy": keep
+roleRef:
+  kind: Role
+  name: {{ include "flink-operator.jobRoleName" $ }}
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "flink-operator.jobServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}
+{{- end }}

manifests/helm/flink-kubernetes-operator/1.13.0/templates/flink/service_account.yaml

@@ -0,0 +1,53 @@
+{{- /*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/ -}}
+
+{{- if .Values.jobServiceAccount.create -}}
+{{- /* Create job service accounts for all watched namespaces. */ -}}
+{{- if .Values.watchNamespaces }}
+{{- range .Values.watchNamespaces }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "flink-operator.jobServiceAccountName" $ }}
+  namespace: {{ . }}
+  labels:
+    {{- include "flink-operator.labels" $ | nindent 4 }}
+  {{- with $.Values.jobServiceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+---
+{{- end }}
+{{- /*
+Create the job service account for the operator namespace, it is to be added for other namespaces manually
+(or via specifying them in watchNamespaces).
+*/ -}}
+{{- else }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "flink-operator.jobServiceAccountName" $ }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "flink-operator.labels" $ | nindent 4 }}
+  {{- with .Values.jobServiceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
+{{- end }}

manifests/helm/flink-kubernetes-operator/1.13.0/templates/rbac/_helpers.tpl

@@ -0,0 +1,212 @@
+{{- /*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/ -}}
+
+{{/*
+Create the name of the operator service account to use
+*/}}
+{{- define "flink-operator.serviceAccountName" -}}
+{{- if .Values.operatorServiceAccount.create }}
+{{- default (include "flink-operator.fullname" .) .Values.operatorServiceAccount.name }}
+{{- else }}
+{{- default "default" .Values.operatorServiceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Determine role scope based on name
+*/}}
+{{- define "flink-operator.roleScope" -}}
+{{- if contains ":" .role  }}
+{{- printf "ClusterRole" }}
+{{- else }}
+{{- printf "Role" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create the name of the operator role to use
+*/}}
+{{- define "flink-operator.roleName" -}}
+{{- if .Values.rbac.operatorRole.create }}
+{{- default (include "flink-operator.fullname" .) .Values.rbac.operatorRole.name }}
+{{- else }}
+{{- default "default" .Values.rbac.operatorRole.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create the name of the operator role binding to use
+*/}}
+{{- define "flink-operator.roleBindingName" -}}
+{{- if .Values.rbac.operatorRoleBinding.create }}
+{{- default (include "flink-operator.fullname" .) .Values.rbac.operatorRoleBinding.name }}
+{{- else }}
+{{- default "default" .Values.rbac.operatorRoleBinding.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+RBAC rules used to create the operator (cluster)role based on the scope
+*/}}
+{{- define "flink-operator.rbacRules" }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - services
+      - events
+      - configmaps
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+      - deletecollection
+{{- if .Values.rbac.nodesRule.create }}
+  - apiGroups:
+    - ""
+    resources:
+      - nodes
+    verbs:
+      - list
+{{- end }}
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - deployments/finalizers
+      - replicasets
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+  - apiGroups:
+      - apps
+    resources:
+      - deployments/scale
+    verbs:
+      - get
+      - update
+      - patch
+  - apiGroups:
+      - extensions
+    resources:
+      - deployments
+      - ingresses
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+  - apiGroups:
+      - flink.apache.org
+    resources:
+      - flinkdeployments
+      - flinkdeployments/finalizers
+      - flinksessionjobs
+      - flinksessionjobs/finalizers
+      - flinkstatesnapshots
+      - flinkstatesnapshots/finalizers
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+  - apiGroups:
+      - flink.apache.org
+    resources:
+      - flinkdeployments/status
+      - flinksessionjobs/status
+      - flinkstatesnapshots/status
+    verbs:
+      - get
+      - update
+      - patch
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingresses
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+  - apiGroups:
+      - coordination.k8s.io
+    resources:
+      - leases
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+{{- end }}
+
+{{/*
+RBAC rules used to create the job (cluster)role based on the scope
+*/}}
+{{- define "flink-operator.jobRbacRules" }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - deployments/finalizers
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+{{- end }}

manifests/helm/flink-kubernetes-operator/1.13.0/templates/rbac/cluster_role.yaml

@@ -0,0 +1,30 @@
+{{- /*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/ -}}
+
+{{- if and .Values.rbac.create .Values.rbac.operatorRole.create }}
+{{- if not .Values.watchNamespaces }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "flink-operator.roleName" $ }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "flink-operator.labels" . | nindent 4 }}
+{{- template "flink-operator.rbacRules" $ }}
+{{- end }}
+{{- end }}

manifests/helm/flink-kubernetes-operator/1.13.0/templates/rbac/cluster_role_binding.yaml

@@ -0,0 +1,37 @@
+{{- /*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/ -}}
+
+{{- if and .Values.rbac.create .Values.rbac.operatorRoleBinding.create }}
+{{- if not .Values.watchNamespaces }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "flink-operator.roleBindingName" $ }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "flink-operator.labels" . | nindent 4 }}
+roleRef:
+  kind: ClusterRole
+  name: {{ include "flink-operator.roleName" $ }}
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "flink-operator.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}
+{{- end }}

manifests/helm/flink-kubernetes-operator/1.13.0/templates/rbac/role.yaml

@@ -0,0 +1,58 @@
+{{- /*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/ -}}
+
+{{- if and .Values.rbac.create .Values.rbac.operatorRole.create }}
+{{- /* Namespaced scoped RBAC. */ -}}
+{{- if .Values.watchNamespaces }}
+{{- range .Values.watchNamespaces }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "flink-operator.roleName" $ }}
+  namespace: {{ . }}
+  labels:
+    {{- include "flink-operator.labels" $ | nindent 4 }}
+{{- template "flink-operator.rbacRules" $ }}
+{{- end }}
+{{- /* Give operator the ability to operate on leases in the release namespace */ -}}
+{{- if not (has .Release.Namespace .Values.watchNamespaces) }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "flink-operator.roleName" $ }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "flink-operator.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - coordination.k8s.io
+    resources:
+      - leases
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+{{- end }}
+{{- end }}
+{{- end }}

manifests/helm/flink-kubernetes-operator/1.13.0/templates/rbac/role_binding.yaml

@@ -0,0 +1,60 @@
+{{- /*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/ -}}
+
+{{- if and .Values.rbac.create .Values.rbac.operatorRoleBinding.create }}
+{{- /* Namespaced scoped RBAC. */ -}}
+{{- if .Values.watchNamespaces }}
+{{- range .Values.watchNamespaces }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "flink-operator.roleBindingName" $ }}
+  namespace: {{ . }}
+  labels:
+    {{- include "flink-operator.labels" $ | nindent 4 }}
+roleRef:
+  kind: {{ $role := include "flink-operator.roleName" $ }}{{ include "flink-operator.roleScope" (dict "role" $role)}}
+  name: {{ include "flink-operator.roleName" $ }}
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "flink-operator.serviceAccountName" $ }}
+    namespace: {{ $.Release.Namespace }}
+{{- end }}
+{{- /* Give operator the ability to operate on leases in the release namespace */ -}}
+{{- if not (has .Release.Namespace .Values.watchNamespaces) }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "flink-operator.roleBindingName" $ }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "flink-operator.labels" $ | nindent 4 }}
+roleRef:
+  kind: Role
+  name: {{ include "flink-operator.roleName" $ }}
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "flink-operator.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}
+{{- end }}
+{{- end }}

manifests/helm/flink-kubernetes-operator/1.13.0/templates/rbac/service_account.yaml

@@ -0,0 +1,29 @@
+{{- /*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+    http://www.apache.org/licenses/LICENSE-2.0
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/ -}}
+
+{{- if .Values.operatorServiceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "flink-operator.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "flink-operator.labels" . | nindent 4 }}
+  {{- with .Values.operatorServiceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}

manifests/helm/flink-kubernetes-operator/1.13.0/templates/webhook/_helpers.tpl

@@ -0,0 +1,57 @@
+{{- /*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/ -}}
+
+{{- define "flink-operator.webhook-enabled" -}}
+{{- if or (eq (include "flink-operator.validating-webhook-enabled" .) "true") (eq (include "flink-operator.mutating-webhook-enabled" .) "true") }}
+{{- printf "true" }}
+{{- else }}
+{{- printf "false" }}
+{{- end }}
+{{- end }}
+
+{{- define "flink-operator.validating-webhook-enabled" -}}
+{{- if hasKey .Values.webhook "validator" }}
+{{- if .Values.webhook.validator.create }}
+{{- printf "true" }}
+{{- else }}
+{{- printf "false" }}
+{{- end }}
+{{- else }}
+{{- if or (.Values.webhook.create) }}
+{{- printf "true" }}
+{{- else }}
+{{- printf "false" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{- define "flink-operator.mutating-webhook-enabled" -}}
+{{- if hasKey .Values.webhook "mutator" }}
+{{- if .Values.webhook.mutator.create }}
+{{- printf "true" }}
+{{- else }}
+{{- printf "false" }}
+{{- end }}
+{{- else }}
+{{- if or (.Values.webhook.create) }}
+{{- printf "true" }}
+{{- else }}
+{{- printf "false" }}
+{{- end }}
+{{- end }}
+{{- end }}

manifests/helm/flink-kubernetes-operator/1.13.0/templates/webhook/mutating_webhook_configuration.yaml

@@ -0,0 +1,55 @@
+{{- /*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/ -}}
+
+{{- if eq (include "flink-operator.webhook-enabled" .) "true" }}
+{{- if eq (include "flink-operator.mutating-webhook-enabled" .) "true" }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  annotations:
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/flink-operator-serving-cert
+  name: flink-operator-{{ .Release.Namespace }}-webhook-configuration
+webhooks:
+  - name: mutationwebhook.flink.apache.org
+    admissionReviewVersions: ["v1"]
+    clientConfig:
+      service:
+        name: flink-operator-webhook-service
+        namespace: {{ .Release.Namespace }}
+        path: /mutate
+    failurePolicy: Fail
+    rules:
+      - apiGroups: ["flink.apache.org"]
+        apiVersions: ["*"]
+        scope: "Namespaced"
+        operations:
+          - CREATE
+          - UPDATE
+        resources:
+          - flinksessionjobs
+          - flinkdeployments
+    sideEffects: None
+    {{- if .Values.watchNamespaces }}
+    namespaceSelector:
+      matchExpressions:
+        - key: kubernetes.io/metadata.name
+          operator: In
+          values: [{{- range .Values.watchNamespaces }}{{ . | quote }},{{- end}}]
+    {{- end }}
+{{- end }}
+{{- end }}

manifests/helm/flink-kubernetes-operator/1.13.0/templates/webhook/secret.yaml

@@ -0,0 +1,30 @@
+{{- /*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/ -}}
+
+{{- if eq (include "flink-operator.webhook-enabled" .) "true" }}
+{{- if .Values.webhook.keystore.useDefaultPassword }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: flink-operator-webhook-secret
+  namespace: {{ .Release.Namespace }}
+type: Opaque
+data:
+  password: cGFzc3dvcmQxMjM0
+{{- end }}
+{{- end }}

manifests/helm/flink-kubernetes-operator/1.13.0/templates/webhook/service.yaml

@@ -0,0 +1,37 @@
+{{- /*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/ -}}
+
+{{- if eq (include "flink-operator.webhook-enabled" .) "true" }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: flink-operator-webhook-service
+  namespace: {{ .Release.Namespace }}
+  {{- if .Values.webhook.serviceLabels }}
+  labels:
+    {{- range $key, $value := .Values.webhook.serviceLabels }}
+    {{ $key }}: {{ $value }}
+    {{- end }}
+  {{- end }}
+spec:
+  ports:
+  - port: 443
+    targetPort: 9443
+  selector:
+    app.kubernetes.io/name: {{ include "flink-operator.name" . }}
+{{- end }}

manifests/helm/flink-kubernetes-operator/1.13.0/templates/webhook/validating_webhook_configuration.yaml

@@ -0,0 +1,56 @@
+{{- /*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/ -}}
+
+{{- if eq (include "flink-operator.webhook-enabled" .) "true" }}
+{{- if eq (include "flink-operator.validating-webhook-enabled" .) "true" }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  annotations:
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/flink-operator-serving-cert
+  name: flink-operator-{{ .Release.Namespace }}-webhook-configuration
+webhooks:
+- name: validationwebhook.flink.apache.org
+  admissionReviewVersions: ["v1"]
+  clientConfig:
+    service:
+      name: flink-operator-webhook-service
+      namespace: {{ .Release.Namespace }}
+      path: /validate
+  failurePolicy: Fail
+  rules:
+  - apiGroups: ["flink.apache.org"]
+    apiVersions: ["*"]
+    scope: "Namespaced"
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - flinkdeployments
+    - flinksessionjobs
+    - flinkstatesnapshots
+  sideEffects: None
+  {{- if .Values.watchNamespaces }}
+  namespaceSelector:
+    matchExpressions:
+      - key: kubernetes.io/metadata.name
+        operator: In
+        values: [{{- range .Values.watchNamespaces }}{{ . | quote }},{{- end}}]
+  {{- end }}
+{{- end }}
+{{- end }}

manifests/helm/flink-kubernetes-operator/1.13.0/tests/cert-manager/certificate_test.yaml

@@ -0,0 +1,42 @@
+################################################################################
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+
+suite: Test Cert Manager Certificate
+
+templates:
+- cert-manager/certificate.yaml
+
+release:
+  name: flink-operator
+  namespace: flink-operator
+
+tests:
+- it: Should create certificate
+  asserts:
+  - containsDocument:
+      apiVersion: cert-manager.io/v1
+      kind: Certificate
+      name: flink-operator-serving-cert
+
+- it: Should use self signed issuer
+  asserts:
+  - equal:
+      path: spec.issuerRef
+      value:
+        kind: Issuer
+        name: flink-operator-selfsigned-issuer

manifests/helm/flink-kubernetes-operator/1.13.0/tests/cert-manager/issuer_test.yaml

@@ -0,0 +1,34 @@
+################################################################################
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+
+suite: Test Cert Manager Issuer
+
+templates:
+- cert-manager/issuer.yaml
+
+release:
+  name: flink-operator
+  namespace: flink-operator
+
+tests:
+- it: Should create self signed Issuer
+  asserts:
+  - containsDocument:
+      apiVersion: cert-manager.io/v1
+      kind: Issuer
+      name: flink-operator-selfsigned-issuer

manifests/helm/flink-kubernetes-operator/1.13.0/tests/controller/configmap_test.yaml

@@ -0,0 +1,38 @@
+################################################################################
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+
+suite: Test ConfigMap
+
+templates:
+  - controller/configmap.yaml
+
+release:
+  name: flink-operator
+  namespace: flink-operator
+
+tests:
+  - it: Should create a configmap with default configuration if `defaultConfiguration.create` is `true`
+    set:
+      defaultConfiguration:
+        create: true
+    asserts:
+      - containsDocument:
+          apiVersion: v1
+          kind: ConfigMap
+          name: flink-operator-config
+          namespace: flink-operator

manifests/helm/flink-kubernetes-operator/1.13.0/tests/controller/deployment_test.yaml

@@ -0,0 +1,305 @@
+################################################################################
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+
+suite: Test Deployment
+
+templates:
+- controller/deployment.yaml
+
+release:
+  name: flink-operator
+  namespace: flink-operator
+
+tests:
+- it: Should create a deployment
+  asserts:
+  - containsDocument:
+      apiVersion: apps/v1
+      kind: Deployment
+      name: flink-kubernetes-operator
+      namespace: flink-operator
+
+- it: Should use the specified image if `image.repository` and `image.tag` are set
+  set:
+    image: 
+      repository: test-repository/flink-kubernetes-operator
+      tag: test-tag
+  asserts:
+  - equal:
+      path: spec.template.spec.containers[*].image
+      value: test-repository/flink-kubernetes-operator:test-tag
+
+- it: Should use the specified image pull policy if `image.pullPolicy` is set
+  set:
+    image:
+      pullPolicy: Always
+  asserts:
+  - equal:
+      path: spec.template.spec.containers[*].imagePullPolicy
+      value: Always
+
+- it: Should use the specified image pull secrets if `imagePullsecrets` is set
+  set:
+    imagePullSecrets:
+    - name: test-secret1
+    - name: test-secret2
+  asserts:
+  - contains:
+      path: spec.template.spec.imagePullSecrets
+      content:
+        name: test-secret1
+  - contains:
+      path: spec.template.spec.imagePullSecrets
+      content:
+        name: test-secret2
+
+- it: Should use the specified replicas if `replicas` is set
+  set:
+    replicas: 0
+  asserts:
+  - equal:
+      path: spec.replicas
+      value: 0
+
+- it: Should use the specified strategy if `strategy` is set
+  set:
+    strategy:
+      type: RollingUpdate
+      rollingUpdate:
+        maxSurge: 1
+        maxUnavailable: 1
+  asserts:
+  - equal:
+      path: spec.strategy
+      value:
+        type: RollingUpdate
+        rollingUpdate:
+          maxSurge: 1
+          maxUnavailable: 1
+
+- it: Should use the specified strategy if `strategy` is set
+  set:
+    strategy:
+      type: Recreate
+  asserts:
+  - equal:
+      path: spec.strategy
+      value:
+        type: Recreate
+
+- it: Should add deployment labels if `operatorPod.labels` is set
+  set:
+    operatorPod:
+      labels:
+        KEY1: VALUE1
+        KEY2: VALUE2
+  asserts:
+  - equal:
+      path: metadata.labels.KEY1
+      value: VALUE1
+  - equal:
+      path: metadata.labels.KEY2
+      value: VALUE2
+
+- it: Should add pod template labels if `operatorPod.labels` is set
+  set:
+    operatorPod:
+      labels:
+        KEY1: VALUE1
+        KEY2: VALUE2
+  asserts:
+  - equal:
+      path: spec.template.metadata.labels.KEY1
+      value: VALUE1
+  - equal:
+      path: spec.template.metadata.labels.KEY2
+      value: VALUE2
+
+- it: Should add pod template annotations if `operatorPod.annotations` is set
+  set:
+    operatorPod:
+      annotations:
+        KEY1: VALUE1
+        KEY2: VALUE2
+  asserts:
+  - equal:
+      path: spec.template.metadata.annotations.KEY1
+      value: VALUE1
+  - equal:
+      path: spec.template.metadata.annotations.KEY2
+      value: VALUE2
+
+- it: Should use the specified DNS policy if `operatorPod.dnsPolicy` is set
+  set:
+    operatorPod:
+      dnsPolicy: ClusterFirstWithHostNet
+  asserts:
+  - equal:
+      path: spec.template.spec.dnsPolicy
+      value: ClusterFirstWithHostNet
+
+- it: Should use the specified DNS config if `operatorPod.dnsConfig` is set
+  set:
+    operatorPod:
+      dnsConfig:
+        nameservers:
+        - 1.1.1.1
+        - 8.8.8.8
+        searches:
+        - ns1.svc.cluster-domain.example
+        - my.dns.search.suffix
+        options:
+        - name: ndots
+          value: "2"
+        - name: edns0
+  asserts:
+  - equal:
+      path: spec.template.spec.dnsConfig
+      value:
+        nameservers:
+        - 1.1.1.1
+        - 8.8.8.8
+        searches:
+        - ns1.svc.cluster-domain.example
+        - my.dns.search.suffix
+        options:
+        - name: ndots
+          value: "2"
+        - name: edns0
+
+- it: Should add nodeSelector if `operatorPod.nodeSelector` is set
+  set:
+    operatorPod:
+      nodeSelector:
+        key1: value1
+        key2: value2
+  asserts:
+  - equal:
+      path: spec.template.spec.nodeSelector.key1
+      value: value1
+  - equal:
+      path: spec.template.spec.nodeSelector.key2
+      value: value2
+
+- it: Should add affinity if `operatorPod.affinity` is set
+  set:
+    operatorPod:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: topology.kubernetes.io/zone
+                operator: In
+                values:
+                - antarctica-east1
+                - antarctica-west1
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 1
+            preference:
+              matchExpressions:
+              - key: another-node-label-key
+                operator: In
+                values:
+                - another-node-label-value
+  asserts:
+  - equal:
+      path: spec.template.spec.affinity
+      value:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: topology.kubernetes.io/zone
+                operator: In
+                values:
+                - antarctica-east1
+                - antarctica-west1
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 1
+            preference:
+              matchExpressions:
+              - key: another-node-label-key
+                operator: In
+                values:
+                - another-node-label-value
+
+- it: Should add tolerations if `operatorPod.tolerations` is set
+  set:
+    operatorPod:
+      tolerations:
+      - key: key1
+        operator: Equal
+        value: value1
+        effect: NoSchedule
+      - key: key2
+        operator: Exists
+        effect: NoSchedule
+  asserts:
+  - equal:
+      path: spec.template.spec.tolerations
+      value:
+      - key: key1
+        operator: Equal
+        value: value1
+        effect: NoSchedule
+      - key: key2
+        operator: Exists
+        effect: NoSchedule
+
+- it: Should use the specified priority class name if `operatorPod.priorityClassName` is set
+  set:
+    operatorPod:
+      priorityClassName: test-priority
+  asserts:
+  - equal:
+      path: spec.template.spec.priorityClassName
+      value: test-priority
+
+- it: Should use the specified topology spread constraints if `operatorPod.topologySpreadConstraints` is set
+  set:
+    operatorPod:
+      topologySpreadConstraints:
+      - maxSkew: 1
+        topologyKey: topology.kubernetes.io/zone
+        whenUnsatisfiable: ScheduleAnyway
+      - maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: DoNotSchedule
+  asserts:
+  - contains:
+      path: spec.template.spec.topologySpreadConstraints
+      content:
+        maxSkew: 1
+        topologyKey: topology.kubernetes.io/zone
+        whenUnsatisfiable: ScheduleAnyway
+  - contains:
+      path: spec.template.spec.topologySpreadConstraints
+      content:
+        maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: DoNotSchedule
+
+- it: Should use the specified service account name if `operatorServiceAccount.name` is set
+  set:
+    operatorServiceAccount:
+      name: test-service-account
+  asserts:
+  - equal:
+      path: spec.template.spec.serviceAccountName
+      value: test-service-account

manifests/helm/flink-kubernetes-operator/1.13.0/tests/flink/role_binding_test.yaml

@@ -0,0 +1,69 @@
+################################################################################
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+
+suite: Test Flink Job RoleBinding
+
+templates:
+- flink/role_binding.yaml
+
+release:
+  name: flink-operator
+  namespace: flink-operator
+
+tests:
+- it: Should not create any role if `rbac.create` is `false`
+  set:
+    rbac:
+      create: false
+  asserts:
+  - hasDocuments:
+      count: 0
+
+- it: Should create role binding in each of the namespaces which should be watched
+  set:
+    rbac:
+      create: true
+      jobRole:
+        create: true
+    watchNamespaces:
+    - ns1
+    - ns2
+  documentIndex: 0
+  asserts:
+  - containsDocument:
+      apiVersion: rbac.authorization.k8s.io/v1
+      kind: RoleBinding
+      name: flink-role-binding
+      namespace: ns1
+
+- it: Should create role binding in each of the namespaces which should be watched
+  set:
+    rbac:
+      create: true
+      jobRole:
+        create: true
+    watchNamespaces:
+    - ns1
+    - ns2
+  documentIndex: 1
+  asserts:
+  - containsDocument:
+      apiVersion: rbac.authorization.k8s.io/v1
+      kind: RoleBinding
+      name: flink-role-binding
+      namespace: ns2

manifests/helm/flink-kubernetes-operator/1.13.0/tests/flink/role_test.yaml

@@ -0,0 +1,69 @@
+################################################################################
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+
+suite: Test Flink Job Role
+
+templates:
+- flink/role.yaml
+
+release:
+  name: flink-operator
+  namespace: flink-operator
+
+tests:
+- it: Should not create any role if `rbac.create` is `false`
+  set:
+    rbac:
+      create: false
+  asserts:
+  - hasDocuments:
+      count: 0
+
+- it: Should create role in each of the namespaces which should be watched
+  set:
+    rbac:
+      create: true
+      jobRole:
+        create: true
+    watchNamespaces:
+    - ns1
+    - ns2
+  documentIndex: 0
+  asserts:
+  - containsDocument:
+      apiVersion: rbac.authorization.k8s.io/v1
+      kind: Role
+      name: flink
+      namespace: ns1
+
+- it: Should create role in each of the namespaces which should be watched
+  set:
+    rbac:
+      create: true
+      jobRole:
+        create: true
+    watchNamespaces:
+    - ns1
+    - ns2
+  documentIndex: 1
+  asserts:
+  - containsDocument:
+      apiVersion: rbac.authorization.k8s.io/v1
+      kind: Role
+      name: flink
+      namespace: ns2

manifests/helm/flink-kubernetes-operator/1.13.0/tests/rbac/cluster_role_binding_test.yaml

@@ -0,0 +1,59 @@
+################################################################################
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+
+suite: Test Operator ClusterRoleBinding
+
+templates:
+- rbac/cluster_role_binding.yaml
+
+release:
+  name: flink-operator
+  namespace: flink-operator
+
+tests:
+- it: Should not create ClusterRoleBinding if `rbac.operatorRoleBinding.create` is `false`
+  set:
+    rbac:
+      operatorRoleBinding:
+        create: false
+  asserts:
+  - hasDocuments:
+      count: 0
+
+- it: Should create ClusterRoleBinding if `rbac.operatorRoleBinding.create` is `true`
+  set:
+    rbac:
+      operatorRoleBinding:
+        create: true
+  asserts:
+  - containsDocument:
+      apiVersion: rbac.authorization.k8s.io/v1
+      kind: ClusterRoleBinding
+      name: flink-operator-role-binding
+  - equal:
+      path: roleRef
+      value:
+        apiGroup: rbac.authorization.k8s.io
+        kind: ClusterRole
+        name: flink-operator
+  - contains:
+      path: subjects
+      content:
+        kind: ServiceAccount
+        name: flink-operator
+        namespace: flink-operator

manifests/helm/flink-kubernetes-operator/1.13.0/tests/rbac/cluster_role_test.yaml

@@ -0,0 +1,47 @@
+################################################################################
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+
+suite: Test Operator ClusterRole
+
+templates:
+- rbac/cluster_role.yaml
+
+release:
+  name: flink-operator
+  namespace: flink-operator
+
+tests:
+- it: Should not create ClusterRole if `rbac.operatorRole.create` is `false`
+  set:
+    rbac:
+      operatorRole:
+        create: false
+  asserts:
+  - hasDocuments:
+      count: 0
+
+- it: Should create ClusterRole if `rbac.operatorRole.create` is `true`
+  set:
+    rbac:
+      operatorRole:
+        create: true
+  asserts:
+  - containsDocument:
+      apiVersion: rbac.authorization.k8s.io/v1
+      kind: ClusterRole
+      name: flink-operator

manifests/helm/flink-kubernetes-operator/1.13.0/tests/rbac/role_binding_test.yaml

@@ -0,0 +1,69 @@
+################################################################################
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+
+suite: Test Operator RoleBinding
+
+templates:
+- rbac/role_binding.yaml
+
+release:
+  name: flink-operator
+  namespace: flink-operator
+
+tests:
+- it: Should not create any role if `rbac.create` is `false`
+  set:
+    rbac:
+      create: false
+  asserts:
+  - hasDocuments:
+      count: 0
+
+- it: Should create role binding in each of the namespaces which should be watched
+  set:
+    rbac:
+      create: true
+      operatorRole:
+        create: true
+    watchNamespaces:
+    - ns1
+    - ns2
+  documentIndex: 0
+  asserts:
+  - containsDocument:
+      apiVersion: rbac.authorization.k8s.io/v1
+      kind: RoleBinding
+      name: flink-operator-role-binding
+      namespace: ns1
+
+- it: Should create role binding in each of the namespaces which should be watched
+  set:
+    rbac:
+      create: true
+      operatorRole:
+        create: true
+    watchNamespaces:
+    - ns1
+    - ns2
+  documentIndex: 1
+  asserts:
+  - containsDocument:
+      apiVersion: rbac.authorization.k8s.io/v1
+      kind: RoleBinding
+      name: flink-operator-role-binding
+      namespace: ns2

manifests/helm/flink-kubernetes-operator/1.13.0/tests/rbac/role_test.yaml

@@ -0,0 +1,88 @@
+################################################################################
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+
+suite: Test Operator Role
+
+templates:
+- rbac/role.yaml
+
+release:
+  name: flink-operator
+  namespace: flink-operator
+
+tests:
+- it: Should not create any role if `rbac.create` is `false`
+  set:
+    rbac:
+      create: false
+  asserts:
+  - hasDocuments:
+      count: 0
+
+- it: Should create operator role in each of the namespaces which should be watched
+  set:
+    rbac:
+      create: true
+    operatorRole:
+      create: true
+    watchNamespaces:
+    - ns1
+    - ns2
+  documentIndex: 0
+  asserts:
+  - containsDocument:
+      apiVersion: rbac.authorization.k8s.io/v1
+      kind: Role
+      name: flink-operator
+      namespace: ns1
+
+- it: Should create operator role in each of the namespaces which should be watched
+  set:
+    rbac:
+      create: true
+      operatorRole:
+        create: true
+    watchNamespaces:
+    - ns1
+    - ns2
+  documentIndex: 1
+  asserts:
+  - containsDocument:
+      apiVersion: rbac.authorization.k8s.io/v1
+      kind: Role
+      name: flink-operator
+      namespace: ns2
+
+- it: Should create operator role in the release namespace if not watched
+  set:
+    rbac:
+      create: true
+      operatorRole:
+        create: true
+      jobRole:
+        create: true
+    watchNamespaces:
+    - ns1
+    - ns2
+  documentIndex: 2
+  asserts:
+  - containsDocument:
+      apiVersion: rbac.authorization.k8s.io/v1
+      kind: Role
+      name: flink-operator
+      namespace: flink-operator

manifests/helm/flink-kubernetes-operator/1.13.0/tests/webhook/mutating_webhook_configuration_test.yaml

@@ -0,0 +1,68 @@
+################################################################################
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+
+suite: Test MutatingWebhookConfiguration
+
+templates:
+- webhook/mutating_webhook_configuration.yaml
+
+release:
+  name: flink-operator
+  namespace: flink-operator
+
+tests:
+- it: Should not create mutating webhook configuration if `webhook.mutator.create` is `false`
+  set:
+    webhook:
+      create: true
+      mutator:
+        create: false
+  asserts:
+  - hasDocuments:
+      count: 0
+
+- it: Should create mutating webhook configuration if both  `webhook.create` and `webhook.mutator.create` are `true`
+  set:
+    webhook:
+      create: true
+      mutator:
+        create: true
+  asserts:
+  - containsDocument:
+      apiVersion: admissionregistration.k8s.io/v1
+      kind: MutatingWebhookConfiguration
+      name: flink-operator-flink-operator-webhook-configuration
+
+- it: Should add namespace selector if `watchNamespaces` is set
+  set:
+    watchNamespaces:
+    - ns1
+    - ns2
+    webhook:
+      create: true
+      mutator:
+        create: true
+  asserts:
+  - contains:
+      path: webhooks[?(@.name=="mutationwebhook.flink.apache.org")].namespaceSelector.matchExpressions
+      content:
+        key: kubernetes.io/metadata.name
+        operator: In
+        values:
+        - ns1
+        - ns2

manifests/helm/flink-kubernetes-operator/1.13.0/tests/webhook/secret_test.yaml

@@ -0,0 +1,48 @@
+################################################################################
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+
+suite: Test Webhook Secret
+
+templates:
+- webhook/secret.yaml
+
+release:
+  name: flink-operator
+  namespace: flink-operator
+
+tests:
+- it: Should not create Secret if `webhook.keystore.useDefaultPassword` is `false`
+  set:
+    webhook:
+      keystore:
+        useDefaultPassword: false
+  asserts:
+  - hasDocuments:
+      count: 0
+
+- it: Should create Secret if `webhook.keystore.useDefaultPassword` is `true`
+  set:
+    webhook:
+      keystore:
+        useDefaultPassword: true
+  asserts:
+  - containsDocument:
+      apiVersion: v1
+      kind: Secret
+      name: flink-operator-webhook-secret
+      namespace: flink-operator

manifests/helm/flink-kubernetes-operator/1.13.0/tests/webhook/service_test.yaml

@@ -0,0 +1,68 @@
+################################################################################
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+
+suite: Test Webhook Service
+
+templates:
+- webhook/service.yaml
+
+release:
+  name: flink-operator
+  namespace: flink-operator
+
+tests:
+- it: Should create webhook service if `webhook.validator.create` is `true`
+  set:
+    webhook:
+      validator:
+        create: true
+  asserts:
+  - containsDocument:
+      apiVersion: v1
+      kind: Service
+      name: flink-operator-webhook-service
+      namespace: flink-operator
+
+- it: Should create webhook service if `webhook.create` is `true`
+  set:
+    webhook:
+      validator:
+        create: false
+      create: true
+  asserts:
+  - containsDocument:
+      apiVersion: v1
+      kind: Service
+      name: flink-operator-webhook-service
+      namespace: flink-operator
+
+- it: Should add labels to webhook service if `webhook.serviceLabels` is set
+  set:
+    webhook:
+      create: true
+      serviceLabels:
+        key1: value1
+        key2: value2
+  asserts:
+  - equal:
+      path: metadata.labels.key1
+      value: value1
+  - equal:
+      path: metadata.labels.key2
+      value: value2
+  

manifests/helm/flink-kubernetes-operator/1.13.0/tests/webhook/validating_webhook_configuratioin_test.yaml

@@ -0,0 +1,68 @@
+################################################################################
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+
+suite: Test ValidatingWebhookConfiguration
+
+templates:
+- webhook/validating_webhook_configuration.yaml
+
+release:
+  name: flink-operator
+  namespace: flink-operator
+
+tests:
+- it: Should not create validating webhook configuration if `webhook.validator.create` is `false`
+  set:
+    webhook:
+      create: true
+      validator:
+        create: false
+  asserts:
+  - hasDocuments:
+      count: 0
+
+- it: Should create validating webhook configuration if both `webhook.create` and `webhook.validator.create` are `true`
+  set:
+    webhook:
+      create: true
+      validator:
+        create: true
+  asserts:
+  - containsDocument:
+      apiVersion: admissionregistration.k8s.io/v1
+      kind: ValidatingWebhookConfiguration
+      name: flink-operator-flink-operator-webhook-configuration
+
+- it: Should add namespace selector if `watchNamespaces` is set
+  set:
+    watchNamespaces:
+    - ns1
+    - ns2
+    webhook:
+      create: true
+      validator:
+        create: true
+  asserts:
+  - contains:
+      path: webhooks[?(@.name=="validationwebhook.flink.apache.org")].namespaceSelector.matchExpressions
+      content:
+        key: kubernetes.io/metadata.name
+        operator: In
+        values:
+        - ns1
+        - ns2

manifests/helm/flink-kubernetes-operator/1.13.0/values.yaml

@@ -0,0 +1,220 @@
+################################################################################
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+# limitations under the License.
+################################################################################
+
+---
+
+# List of kubernetes namespaces to watch for FlinkDeployment changes, empty means all namespaces.
+# When enabled RBAC is only created for said namespaces, otherwise it is done for the cluster scope.
+watchNamespaces: []
+# - flink
+
+image:
+  repository: ghcr.io/apache/flink-kubernetes-operator
+  pullPolicy: IfNotPresent
+  tag: "b40c553"
+  # If image digest is set then it takes precedence and the image tag will be ignored
+  digest: ""
+
+imagePullSecrets: []
+
+# Replicas must be 1 unless operator leader election is configured
+replicas: 1
+
+# Strategy type must be Recreate unless leader election is configured
+strategy:
+  type: Recreate
+
+rbac:
+  create: true
+  # kubernetes.rest-service.exposed.type: NodePort requires
+  # list permission for nodes at the cluster scope.
+  # Set create to true if you are using NodePort type.
+  nodesRule:
+    create: false
+  operatorRole:
+    create: true
+    name: "flink-operator"
+  operatorRoleBinding:
+    create: true
+    name: "flink-operator-role-binding"
+  jobRole:
+    create: true
+    name: "flink"
+  jobRoleBinding:
+    create: true
+    name: "flink-role-binding"
+
+operatorPod:
+  priorityClassName: null
+  annotations: {}
+  labels: {}
+  # The env variables only apply to the operator container in the operator pod
+  # TODO: consider making this pod level env variables
+  env:
+  # - name: ""
+  #   value: ""
+  # - name: ""
+  #   valueFrom:
+  #     configMapKeyRef:
+  #       name: ""
+  #       key: ""
+  dnsPolicy: ""
+  dnsConfig: {}
+  # Node labels and affinity for operator pod assignment
+  # https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
+  envFrom:
+  # - configMapRef:
+  #     name: ""
+  nodeSelector: {}
+
+  affinity: {}
+  # Node tolerations for operator pod assignment
+  # https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
+  tolerations: []
+  # Topology spread constrains
+  # https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/
+  topologySpreadConstraints: []
+  resources: {}
+  # resources:
+  #   limits:
+  #     cpu: "250m"
+  #     memory: "512Mi"
+  #   requests:
+  #     cpu: "250m"
+  #     memory: "512Mi"
+  webhook:
+    resources: {}
+    container:
+      env:
+      # - name: ""
+      #   value: ""
+  # optional init containers for operator pod
+  initContainers: []
+
+  # optional extra containers for operator pod
+  sidecarContainers: []
+
+operatorServiceAccount:
+  create: true
+  annotations: {}
+  name: "flink-operator"
+
+jobServiceAccount:
+  create: true
+  annotations:
+    "helm.sh/resource-policy": keep
+  name: "flink"
+
+operatorVolumeMounts:
+  create: false
+  data:
+    - name: flink-artifacts
+      mountPath: /opt/flink/artifacts
+
+operatorVolumes:
+  create: false
+  data:
+    - name: flink-artifacts
+      hostPath:
+        path: /tmp/flink/artifacts
+        type: DirectoryOrCreate
+#    - name: flink-artifacts
+#      persistentVolumeClaim:
+#        claimName: flink-artifacts
+
+podSecurityContext:
+  runAsUser: 9999
+  runAsGroup: 9999
+  # fsGroup: 9999
+
+operatorSecurityContext: {}
+
+webhookSecurityContext: {}
+
+webhook:
+  create: true
+  # validator:
+  #   create: true
+  # mutator:
+  #   create: true
+  keystore:
+    useDefaultPassword: true
+    passwordSecretRef:
+    # name: jks-password-secret
+    # key: password-key
+  serviceLabels: {}
+
+defaultConfiguration:
+  # If set to true, creates ConfigMaps/VolumeMounts. If set to false, no configuration will be created.
+  # All below fields will be ignored if create is set to false.
+  create: true
+  # If set to true,
+  #      (1) loads the built-in default configuration
+  #      (2) appends the below flink-conf and logging configuration overrides
+  # If set to false, loads just the overrides as in (2).
+  # This option has not effect, if create is equal to false.
+  append: true
+  flink-conf.yaml: |+
+    # Flink Config Overrides
+    kubernetes.operator.metrics.reporter.slf4j.factory.class: org.apache.flink.metrics.slf4j.Slf4jReporterFactory
+    kubernetes.operator.metrics.reporter.slf4j.interval: 5 MINUTE
+
+    kubernetes.operator.reconcile.interval: 15 s
+    kubernetes.operator.observer.progress-check.interval: 5 s
+  log4j-operator.properties: |+
+    # Flink Operator Logging Overrides
+    # rootLogger.level = DEBUG
+    # logger.operator.name= org.apache.flink.kubernetes.operator
+    # logger.operator.level = DEBUG
+  log4j-console.properties: |+
+    # Flink Deployment Logging Overrides
+    # rootLogger.level = DEBUG
+
+# (Optional) Exposes metrics port on the container if defined
+metrics:
+  port:
+
+nameOverride: ""
+fullnameOverride: ""
+
+# Set the jvm start up options for webhook and operator
+jvmArgs:
+  webhook: ""
+  operator: ""
+  logConfig: "-Dlog4j.configurationFile=/opt/flink/conf/log4j-operator.properties"
+
+# Configure health probes for the operator
+operatorHealth:
+  port: 8085
+  livenessProbe:
+    periodSeconds: 10
+    initialDelaySeconds: 30
+  startupProbe:
+    failureThreshold: 30
+    periodSeconds: 10
+
+# Set postStart hook of the main container
+postStart: {}
+
+# Configuration for tls
+tls:
+  create: false
+  secretName: flink-operator-cert
+  secretKeyRef:
+    name: operator-certificate-password
+    key: password