[noels]

GIT-33 (epic GIT-32). Catalogue add-on for the samba-in-kubernetes samba-operator, from the new Silex chart SilexConsulting/samba-operator-helm (OCI: ghcr.io/silexconsulting/charts/samba-operator). Upstream ships no chart.

What:

• gitops/addons/oss/samba-operator/addons-samba-operator-appset.yaml:
  • enable_samba_operator, chart 0.1.0 (operator v0.8);
  • ns samba-operator-system + release samba-operator. Object names are then exactly upstream's make deploy ones, so ivylen's hand-made 2023 install is adopted in place;
  • preserveResourcesOnDeletion: true, because the CRDs hold every SmbShare;
  • SSA, CreateNamespace.
• gitops/addons/repositories/ghcr-silexconsulting-charts.yaml: a credential-free Argo CD repository Secret (type: helm, enableOCI: "true") for the public Silex OCI registry. Argo CD needs it to pull Helm charts over OCI, and later Silex charts (Paperless, GIT-34) reuse it. Trial mode picks it up via directory.recurse; deployments mode imports it (gitops-private GIT-33).
• environments/default/addons/samba-operator/: values (upstream defaults, nothing overridden) + the commented-out reference setup (resources/ with resources: [], an SmbSecurityConfig example and a drop-box SmbShare example).

Adoption check (read-only, against ivylen): helm template … | kubectl diff --server-side against the live hand-made objects shows only:

• labels;
• CRDs: additive fields customShareConfig / customGlobalConfig;
• Deployment:
  • proxy image gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0 (deleted, which is why the pod has been ImagePullBackOff) → quay.io/brancz/kube-rbac-proxy:v0.18.1;
  • operator :latest/Always → v0.8/IfNotPresent;
  • upstream's amd64 node affinity;
  • a dedicated ServiceAccount (the RoleBindings move to it from default).

The RBAC rules are identical. The operator's reconcile is get-or-create for share Deployments and Services (it only claims ownership and adjusts replicas). So the running paperless-consume-smb smbd pod, and its Service with the hand-added MetalLB .4 annotation, are not modified.

Merge order:

1. The chart must be published first: tag v0.1.0 on samba-operator-helm.
2. This PR.
3. gitops-control-plane GIT-33 (allowlist).
4. gitops-private GIT-33 (imports these files from main).
5. Set enable_samba_operator = true in ivylen tfvars and apply.
6. Hard-refresh and sync the addons root app.

🤖 Generated with Claude Code