Document required cluster-scoped prerequisites for Helm install #736

New issue

Open

opened 2026-03-28 04:27:59 +00:00 by mfreeman451 · 0 comments

mfreeman451 commented

2026-03-28 04:27:59 +00:00

Owner

Imported from GitHub.

Original GitHub issue: #2280
Original author: @mfreeman451
Original URL: https://github.com/carverauto/serviceradar/issues/2280
Original created: 2026-01-14T03:28:13Z

Problem

Fresh Helm installs require cluster-scoped resources (CRDs, ClusterRoles/Bindings, ClusterSPIFFEID) for SPIRE and the tenant-workload-operator. In restricted prod clusters, namespace-only installs will fail or be blocked without these prerequisites.

Current Behavior

Chart creates CRDs under helm/serviceradar/crds/*
Chart creates ClusterRoles/ClusterRoleBindings for SPIRE + tenant-workload-operator (helm/serviceradar/templates/spire-*.yaml, helm/serviceradar/templates/tenant-workload-operator.yaml)
Chart creates ClusterSPIFFEID resources (helm/serviceradar/templates/spire-clusterspiffeids.yaml)

Expected Behavior

Clear install instructions for restricted environments:
- One-time cluster-admin prereq step (CRDs + RBAC + SPIRE controller bits)
- Namespace-level Helm install after prereqs

Proposed Next Steps

Add a documented prereq checklist to the Helm install guide.
Optionally add a values profile for restricted clusters that disables SPIRE + tenant-workload-operator and enables base gateway for single-tenant installs.

Acceptance

A new install guide section describing required cluster-level permissions and the two-step process.
Optional restricted-mode values file (if we choose to support it).

Imported from GitHub. Original GitHub issue: #2280 Original author: @mfreeman451 Original URL: https://github.com/carverauto/serviceradar/issues/2280 Original created: 2026-01-14T03:28:13Z --- ## Problem Fresh Helm installs require cluster-scoped resources (CRDs, ClusterRoles/Bindings, ClusterSPIFFEID) for SPIRE and the tenant-workload-operator. In restricted prod clusters, namespace-only installs will fail or be blocked without these prerequisites. ## Current Behavior - Chart creates CRDs under `helm/serviceradar/crds/*` - Chart creates ClusterRoles/ClusterRoleBindings for SPIRE + tenant-workload-operator (`helm/serviceradar/templates/spire-*.yaml`, `helm/serviceradar/templates/tenant-workload-operator.yaml`) - Chart creates ClusterSPIFFEID resources (`helm/serviceradar/templates/spire-clusterspiffeids.yaml`) ## Expected Behavior - Clear install instructions for restricted environments: - One-time cluster-admin prereq step (CRDs + RBAC + SPIRE controller bits) - Namespace-level Helm install after prereqs ## Proposed Next Steps - Add a documented prereq checklist to the Helm install guide. - Optionally add a values profile for restricted clusters that disables SPIRE + tenant-workload-operator and enables base gateway for single-tenant installs. ## Acceptance - A new install guide section describing required cluster-level permissions and the two-step process. - Optional restricted-mode values file (if we choose to support it).