service-provider-kro

README

service-provider-kro

An OpenControlPlane Service Provider that installs and manages Kro on workload clusters via Flux HelmReleases.

How It Works

When a Kro resource is created on the onboarding cluster, the controller:

1. Replicates the configured image pull secret into the tenant namespace and wires it into the OCIRepository
2. Creates a Flux OCIRepository pointing at the chart URL from the ProviderConfig and the version from the Kro spec
3. Creates a Flux HelmRelease that deploys the chart into kro-system on the workload cluster via a kubeconfig reference

API Reference

Kro

The domain service API. Created on the onboarding cluster, one per tenant.

apiVersion: kro.services.open-control-plane.io/v1alpha1
kind: Kro
metadata:
  name: mcp-01 # must match your MCP cluster so it will track the right cluster
spec:
  # renovate: datasource=docker depName=registry.k8s.io/kro/charts/kro
  version: 0.9.2

Field	Type	Required	Description
spec.version	string	yes	Chart version tag

Note: The name of the object MUST match the name of your MCP cluster offering. This ensures that only one installation can exist for a given cluster.

ProviderConfig

Cluster-scoped operational configuration. Controls the chart location, image pull secret replication, and Helm values passed to managed HelmReleases.

apiVersion: kro.services.open-control-plane.io/v1alpha1
kind: ProviderConfig
metadata:
  name: kro
spec:
  pollInterval: 5m
  chartURL: oci://registry.k8s.io/kro/charts/kro
  imagePullSecret:
    name: my-registry-secret
  values:
    # See https://github.com/kubernetes-sigs/kro/blob/main/helm/values.yaml
    # for all available configuration options including:
    # - rbac.mode: "unrestricted" (default) or "aggregation", see https://kro.run/docs/advanced/access-control
    # - deployment.resources: CPU/memory limits and requests
    # - config.resourceGraphDefinitionConcurrentReconciles: parallel RGD reconcilers
    # - config.dynamicControllerConcurrentReconciles: parallel dynamic controller reconcilers
    # - config.logLevel: "info", "debug", etc.

spec

Field	Type	Required	Default	Description
chartURL	string	no	oci://registry.k8s.io/kro/charts/kro	OCI URL of the Helm chart (oci:// prefix is added automatically if missing)
pollInterval	duration	no	1m	How often the controller polls for changes
imagePullSecret	LocalObjectReference	no	—	Secret to replicate from the controller's namespace into tenant namespaces and set as secretRef on the OCIRepository
values	object	no	—	Arbitrary Helm values passed directly to the HelmRelease

What is Kro

Kro (Kube Resource Orchestrator) lets you create custom Kubernetes APIs by composing existing resources into higher-level abstractions. Check out the Kro documentation for more details.

Running E2E Tests

task test-e2e

Quality Criteria

Criterion	Status	Notes
Deletion behaviour	⚠️	A finalizer ensures the Service Provider managed resources like Flux' OCIRepository and HelmRelease are cleaned-up. But there is no behaviour that ensures deletion is blocked if custom resources (e.g. kro' ResourceGraphDefinition objects) in a ControlPlane still exist.
Status reporting & error messages	✅
Operation annotations	⚠️	openmcp.cloud/operation: ignore is processed by opencontrolplane-runtime. openmcp.cloud/operation: reconcile is not processed.
API stability policy	✅
Custom CA support	❌	Custom CA bundle propagation to kro components is not implemented.
Release artifacts (image + OCM)	✅
Testing	✅
Ownership and maintenance docs	✅

See the OpenControlPlane Quality Criteria for definitions.

Support, Feedback, Contributing

This project is open to feature requests/suggestions, bug reports etc. via GitHub issues. Contribution and feedback are encouraged and always welcome. For more information about how to contribute, the project structure, as well as additional contribution information, see our Contribution Guidelines.

Security / Disclosure

If you find any bug that may be a security problem, please follow our instructions in our security policy on how to report it. Please do not create GitHub issues for security-related doubts or problems.

Code of Conduct

We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone. By participating in this project, you agree to abide by its Code of Conduct at all times.

Licensing

Copyright OpenControlPlane contributors. Please see our LICENSE for copyright and license information. Detailed information including third-party components and their licensing/copyright information is available via the REUSE tool.

---

OpenControlPlane is part of ApeiroRA, an EU Important Project of Common European Interest (IPCEI-CIS).

Copyright Linux Foundation Europe. For web site terms of use, trademark policy and other project policies please see https://linuxfoundation.eu/en/policies.