Code review; add validation and helm template

Author: sjberman

charts/nginx-gateway-fabric/README.md

@@ -249,7 +249,7 @@ To uninstall/delete the release `ngf`:
 ```shell
 helm uninstall ngf -n nginx-gateway
 kubectl delete ns nginx-gateway
-for crd in `kubectl get crds -oname | grep gateway.nginx.org | awk -F / '{ print $2 }'`; do kubectl delete crd $crd; done
+kubectl delete crd nginxgateways.gateway.nginx.org nginxproxies.gateway.nginx.org
 ```
 
 These commands remove all the Kubernetes components associated with the release and deletes the release.
@@ -300,6 +300,7 @@ The following tables lists the configurable parameters of the NGINX Gateway Fabr
 | `nginx.image.tag`                                 | The tag for the NGINX image.                                                                                                                                                                             | edge                                                                                                            |
 | `nginx.image.pullPolicy`                          | The `imagePullPolicy` for the NGINX image.                                                                                                                                                               | Always                                                                                                          |
 | `nginx.plus`                                      | Is NGINX Plus image being used                                                                                                                                                                           | false                                                                                                           |
+| `nginx.config`                                    | The configuration for the data plane that is contained in the NginxProxy resource. | [See nginx.config section](values.yaml) |
 | `nginx.usage.secretName`                          | The namespace/name of the Secret containing the credentials for NGINX Plus usage reporting. | |
 | `nginx.usage.serverURL`                           | The base server URL of the NGINX Plus usage reporting server. | |
 | `nginx.usage.clusterName`                         | The display name of the Kubernetes cluster in the NGINX Plus usage reporting server. | |

charts/nginx-gateway-fabric/templates/_helpers.tpl

@@ -31,6 +31,14 @@ Create control plane config name.
 {{- printf "%s-config" $name | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
+{{/*
+Create data plane config name.
+*/}}
+{{- define "nginx-gateway.proxy-config-name" -}}
+{{- $name := default .Release.Name .Values.nameOverride }}
+{{- printf "%s-proxy-config" $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
 {{/*
 Create chart name and version as used by the chart label.
 */}}

charts/nginx-gateway-fabric/templates/deployment.yaml

@@ -119,7 +119,7 @@ spec:
         - name: nginx-conf
           mountPath: /etc/nginx/conf.d
         - name: nginx-includes
-          mountPath: /etc/nginx/includes
+          mountPath: /etc/nginx/modules-includes
         - name: nginx-secrets
           mountPath: /etc/nginx/secrets
         - name: nginx-run
@@ -152,7 +152,7 @@ spec:
         - name: nginx-conf
           mountPath: /etc/nginx/conf.d
         - name: nginx-includes
-          mountPath: /etc/nginx/includes
+          mountPath: /etc/nginx/modules-includes
         - name: nginx-secrets
           mountPath: /etc/nginx/secrets
         - name: nginx-run

charts/nginx-gateway-fabric/templates/gatewayclass.yaml

@@ -6,3 +6,9 @@ metadata:
   {{- include "nginx-gateway.labels" . | nindent 4 }}
 spec:
   controllerName: {{ .Values.nginxGateway.gatewayControllerName }}
+  {{- if .Values.nginx.config }}
+  parametersRef:
+    group: gateway.nginx.org
+    kind: NginxProxy
+    name: {{ include "nginx-gateway.proxy-config-name" . }}
+  {{- end }}

charts/nginx-gateway-fabric/templates/nginxproxy.yaml

@@ -0,0 +1,10 @@
+{{- if .Values.nginx.config }}
+apiVersion: gateway.nginx.org/v1alpha1
+kind: NginxProxy
+metadata:
+  name: {{ include "nginx-gateway.proxy-config-name" . }}
+  labels:
+  {{- include "nginx-gateway.labels" . | nindent 4 }}
+spec:
+  {{- toYaml .Values.nginx.config | nindent 2 }}
+{{- end }}

charts/nginx-gateway-fabric/templates/rbac.yaml

@@ -111,11 +111,17 @@ rules:
   - gateway.nginx.org
   resources:
   - nginxgateways
-  - nginxproxies
   verbs:
   - get
   - list
   - watch
+- apiGroups:
+  - gateway.nginx.org
+  resources:
+  - nginxproxies
+  verbs:
+  - list
+  - watch
 - apiGroups:
   - gateway.nginx.org
   resources:

charts/nginx-gateway-fabric/values.yaml

@@ -70,6 +70,17 @@ nginx:
   ## Is NGINX Plus image being used
   plus: false
 
+  ## The configuration for the data plane that is contained in the NginxProxy resource.
+  config: {}
+    # telemetry:
+    #   exporter:
+    #     endpoint: otel-collector.default.svc:4317
+    #     interval: 5s
+    #     batchSize: 512
+    #     batchCount: 4
+    #   serviceName: ""
+    #   spanAttributes: []
+
   ## Configuration for NGINX Plus usage reporting.
   usage:
     ## The namespace/name of the Secret containing the credentials for NGINX Plus usage reporting.

conformance/provisioner/static-deployment.yaml

@@ -71,7 +71,7 @@ spec:
         - name: nginx-conf
           mountPath: /etc/nginx/conf.d
         - name: nginx-includes
-          mountPath: /etc/nginx/includes
+          mountPath: /etc/nginx/modules-includes
         - name: nginx-secrets
           mountPath: /etc/nginx/secrets
         - name: nginx-run
@@ -97,7 +97,7 @@ spec:
         - name: nginx-conf
           mountPath: /etc/nginx/conf.d
         - name: nginx-includes
-          mountPath: /etc/nginx/includes
+          mountPath: /etc/nginx/modules-includes
         - name: nginx-secrets
           mountPath: /etc/nginx/secrets
         - name: nginx-run

deploy/manifests/nginx-gateway-experimental.yaml

@@ -93,11 +93,17 @@ rules:
   - gateway.nginx.org
   resources:
   - nginxgateways
-  - nginxproxies
   verbs:
   - get
   - list
   - watch
+- apiGroups:
+  - gateway.nginx.org
+  resources:
+  - nginxproxies
+  verbs:
+  - list
+  - watch
 - apiGroups:
   - gateway.nginx.org
   resources:
@@ -215,7 +221,7 @@ spec:
         - name: nginx-conf
           mountPath: /etc/nginx/conf.d
         - name: nginx-includes
-          mountPath: /etc/nginx/includes
+          mountPath: /etc/nginx/modules-includes
         - name: nginx-secrets
           mountPath: /etc/nginx/secrets
         - name: nginx-run
@@ -241,7 +247,7 @@ spec:
         - name: nginx-conf
           mountPath: /etc/nginx/conf.d
         - name: nginx-includes
-          mountPath: /etc/nginx/includes
+          mountPath: /etc/nginx/modules-includes
         - name: nginx-secrets
           mountPath: /etc/nginx/secrets
         - name: nginx-run

deploy/manifests/nginx-gateway.yaml

@@ -90,11 +90,17 @@ rules:
   - gateway.nginx.org
   resources:
   - nginxgateways
-  - nginxproxies
   verbs:
   - get
   - list
   - watch
+- apiGroups:
+  - gateway.nginx.org
+  resources:
+  - nginxproxies
+  verbs:
+  - list
+  - watch
 - apiGroups:
   - gateway.nginx.org
   resources:
@@ -211,7 +217,7 @@ spec:
         - name: nginx-conf
           mountPath: /etc/nginx/conf.d
         - name: nginx-includes
-          mountPath: /etc/nginx/includes
+          mountPath: /etc/nginx/modules-includes
         - name: nginx-secrets
           mountPath: /etc/nginx/secrets
         - name: nginx-run
@@ -237,7 +243,7 @@ spec:
         - name: nginx-conf
           mountPath: /etc/nginx/conf.d
         - name: nginx-includes
-          mountPath: /etc/nginx/includes
+          mountPath: /etc/nginx/modules-includes
         - name: nginx-secrets
           mountPath: /etc/nginx/secrets
         - name: nginx-run