Repository: kubernetes-sigs/security-profiles-operator (c)

Issue:
Use helm-docs to auto-generate helm documentation
#### What would you like to be added:
The user experience for those installing SPO via the helm chart could be improved by using a tool like https://github.com/norwoodj/helm-docs to auto-generate documentation around the values available to the helm-chart.

#### Why is this needed:

Currently, a user would need to dig through both the values file and the templates themselves to discover what settings are available to the helm chart.

#### User story covered

As a User
I would like to be able to easily discover available SPO settings in the helm chart
so that I could deploy SPO with an appropriate configuration

Pull request description:
Init the README.md for spo
<!--  Thanks for sending a pull request!  Here are some tips for you:

- If this is your first time, please read our contributor guidelines: https://git.k8s.io/community/contributors/guide#your-first-contribution and developer guide https://git.k8s.io/community/contributors/devel/development.md#development-guide
- Please label this pull request according to what type of issue you are addressing, especially if this is a release targeted pull request. For reference on required PR/issue labels, read here:
https://git.k8s.io/community/contributors/devel/sig-release/release.md#issuepr-kind-label
- If you want *faster* PR reviews, read how: https://git.k8s.io/community/contributors/guide/pull-requests.md#best-practices-for-faster-reviews
- If the PR is unfinished, see how to mark it: https://git.k8s.io/community/contributors/guide/pull-requests.md#marking-unfinished-pull-requests
-->

#### What type of PR is this?
/kind documentation
<!--
Add one of the following kinds:
/kind bug
/kind cleanup
/kind documentation
/kind feature
/kind design

Optionally add one or more of the following kinds if applicable:
/kind api-change
/kind deprecation
/kind failing-test
/kind flake
/kind regression
-->

#### What this PR does / why we need it:

#### Which issue(s) this PR fixes:
Fixes #1194 
<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #1194 

or

None
-->

#### Does this PR have test?
N/A
Simply install the chart locally
<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:



#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
Add a README.md to make user easily discover available SPO settings in the helm chart
```

Patch:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a2aaf5976..8ce55d170 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,8 +14,8 @@ jobs:
   macos:
     runs-on: macos-12
     steps:
-      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
-      - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568
+      - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
+      - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9
         with:
           go-version: ${{ env.GO_VERSION }}
       - run: make test-unit
@@ -24,7 +24,7 @@ jobs:
   nix:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+      - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
       - uses: cachix/install-nix-action@29bd9290ef037a3ecbdafe83cbd2185e9dd0fa0a
         with:
           install_url: https://releases.nixos.org/nix/nix-${{ env.NIX_VERSION }}/install
@@ -42,10 +42,10 @@ jobs:
   bpf:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568
+      - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9
         with:
           go-version: ${{ env.GO_VERSION }}
-      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+      - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
       - uses: cachix/install-nix-action@29bd9290ef037a3ecbdafe83cbd2185e9dd0fa0a
         with:
           install_url: https://releases.nixos.org/nix/nix-${{ env.NIX_VERSION }}/install
@@ -59,7 +59,7 @@ jobs:
   build-image:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+      - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
       - name: Set up Docker Buildx
         id: buildx
         uses: docker/setup-buildx-action@4b4e9c3e2d4531116a6f8ba8e71fc6e2cb6e6c8c
@@ -106,7 +106,7 @@ jobs:
   operator-image:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+      - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
       - name: Set up Docker Buildx
         id: buildx
         uses: docker/setup-buildx-action@4b4e9c3e2d4531116a6f8ba8e71fc6e2cb6e6c8c
@@ -149,7 +149,7 @@ jobs:
   ubi-image:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+      - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
       - name: Set up Docker Buildx
         id: buildx
         uses: docker/setup-buildx-action@4b4e9c3e2d4531116a6f8ba8e71fc6e2cb6e6c8c
diff --git a/.github/workflows/helm-chart-lint.yaml b/.github/workflows/helm-chart-lint.yaml
index c63010485..8f2d193a3 100644
--- a/.github/workflows/helm-chart-lint.yaml
+++ b/.github/workflows/helm-chart-lint.yaml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/helm-chart-package.yaml b/.github/workflows/helm-chart-package.yaml
index 2a8a2cddc..383b07712 100644
--- a/.github/workflows/helm-chart-package.yaml
+++ b/.github/workflows/helm-chart-package.yaml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
         with:
           fetch-depth: 0
       - name: Set up Helm
diff --git a/deploy/helm/README.md b/deploy/helm/README.md
new file mode 100644
index 000000000..9e328eeb8
--- /dev/null
+++ b/deploy/helm/README.md
@@ -0,0 +1,33 @@
+# security-profiles-operator
+
+![Version: 0.6.1-dev](https://img.shields.io/badge/Version-0.6.1--dev-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.6.1-dev](https://img.shields.io/badge/AppVersion-0.6.1--dev-informational?style=flat-square)
+
+The Kubernetes Security Profiles Operator.
+
+## Installation
+
+please refer to [Installation Guide](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/installation-usage.md#installation-using-helm)
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| affinity | object | `{}` | `pod affinity rules` |
+| autoscaling.enabled | bool | `false` | `enable autosclaing or not` |
+| enableAppArmor | bool | `false` | `enable apparmor or not` |
+| enableBpfRecorder | bool | `false` | `enable BpfRecorder or not` |
+| enableLogEnricher | bool | `false` | `enable log enricher or not` |
+| enableProfiling | bool | `false` | `enable profiling or not` |
+| enableSelinux | bool | `false` | `enable selinux or not` |
+| nameOverride | string | `""` | `used for generating labels` |
+| nodeSelector | object | `{}` | `specify on which node to deploy the workload` |
+| podSecurityContext | object | `` | `pod security contexts` |
+| replicaCount | int | `3` | `the number of replicas of the pods` |
+| resources.limits.memory | string | `"128Mi"` | `memory limits for the pod` |
+| resources.requests.cpu | string | `"250m"` | `cpu requests for the pod` |
+| resources.requests.memory | string | `"50Mi"` | `memory requests for pod` |
+| spoImage.registry | string | `"gcr.io"` | `the registry for the spoImage` |
+| spoImage.repository | string | `"k8s-staging-sp-operator/security-profiles-operator"` | `the repository for the spoImage` |
+| spoImage.tag | string | `"latest"` | `tag for spoImage` |
+| tolerations | list | `[]` | `a list of pod tolerations rules` |
+| verbosity | int | `0` | `the log level for the spo` |
diff --git a/deploy/helm/templates/_helpers.tpl b/deploy/helm/templates/_helpers.tpl
index d2cc2d425..ee6dbdcc5 100644
--- a/deploy/helm/templates/_helpers.tpl
+++ b/deploy/helm/templates/_helpers.tpl
@@ -53,6 +53,8 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
 Selector labels
 */}}
 {{- define "security-profiles-operator.selectorLabels" -}}
+app: security-profiles-operator
+name: security-profiles-operator
 app.kubernetes.io/name: {{ include "security-profiles-operator.name" . }}
 app.kubernetes.io/instance: {{ include "security-profiles-operator.name" . }}
 {{- end }}
diff --git a/deploy/helm/templates/config.yaml b/deploy/helm/templates/config.yaml
index 5ef708f0b..0798f66c6 100644
--- a/deploy/helm/templates/config.yaml
+++ b/deploy/helm/templates/config.yaml
@@ -2,7 +2,6 @@ apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
 kind: SecurityProfilesOperatorDaemon
 metadata:
   labels:
-    app: security-profiles-operator
     {{- include "security-profiles-operator.labels" . | nindent 4 }}
   name: spod
   namespace: {{ .Release.Namespace }}
diff --git a/deploy/helm/templates/deployment.yaml b/deploy/helm/templates/deployment.yaml
index b4c33013b..362511131 100644
--- a/deploy/helm/templates/deployment.yaml
+++ b/deploy/helm/templates/deployment.yaml
@@ -2,7 +2,6 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   labels:
-    app: security-profiles-operator
     {{- include "security-profiles-operator.labels" . | nindent 4 }}
   name: security-profiles-operator
   namespace: {{ .Release.Namespace }}
@@ -12,16 +11,14 @@ spec:
   {{- end }}
   selector:
     matchLabels:
-      app: security-profiles-operator
-      name: security-profiles-operator
+      {{- include "security-profiles-operator.selectorLabels" . | nindent 6 }}
   template:
     metadata:
       annotations:
         seccomp.security.alpha.kubernetes.io/pod: runtime/default
         {{- include "security-profiles-operator.annotations" . | nindent 8 }}
       labels:
-        app: security-profiles-operator
-        name: security-profiles-operator
+        {{- include "security-profiles-operator.selectorLabels" . | nindent 8 }}
     spec:
       containers:
       - args:
@@ -43,6 +40,11 @@ spec:
         securityContext:
           allowPrivilegeEscalation: false
           readOnlyRootFilesystem: true
+      {{- with .Values.podSecurityContext }}
+      securityContext:
+      {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: security-profiles-operator
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
@@ -51,7 +53,6 @@ spec:
       affinity:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      serviceAccountName: security-profiles-operator
       tolerations:
       - effect: NoSchedule
         key: node-role.kubernetes.io/master
@@ -62,3 +63,6 @@ spec:
       - effect: NoExecute
         key: node.kubernetes.io/not-ready
         operator: Exists
+      {{- with .Values.tolerations }}
+        {{- toYaml . | nindent 6 }}
+      {{- end }}


Test patch:
diff --git a/.github/workflows/olm_tests.yaml b/.github/workflows/olm_tests.yaml
index 1f1eedcad..26d05a9e8 100644
--- a/.github/workflows/olm_tests.yaml
+++ b/.github/workflows/olm_tests.yaml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-    - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+    - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
 
     - name: Download binaries
       run: |
@@ -25,7 +25,7 @@ jobs:
         make operator-sdk
         make opm
 
-    - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568
+    - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9
       with:
         go-version: ${{ env.GO_VERSION }}
     - name: Install dependencies
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 032edf5b5..c4c7a7b19 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -18,7 +18,7 @@ jobs:
 
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+      - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
       - uses: github/codeql-action/init@16964e90ba004cdf0cd845b866b5df21038b7723
         with:
           languages: go
@@ -28,8 +28,8 @@ jobs:
   coverage:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
-      - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568
+      - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
+      - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9
         with:
           go-version: ${{ env.GO_VERSION }}
       - name: Install dependencies
@@ -47,7 +47,7 @@ jobs:
   image:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+      - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
       - run: make image
       - run: podman save -o image.tar security-profiles-operator
       - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce
@@ -63,7 +63,7 @@ jobs:
     env:
       RUN: ./hack/ci/run-fedora.sh
     steps:
-      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+      - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
       - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
         with:
           path: |
@@ -100,7 +100,7 @@ jobs:
     env:
       RUN: ./hack/ci/run-ubuntu.sh
     steps:
-      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+      - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
       - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
         with:
           path: |
@@ -135,7 +135,7 @@ jobs:
    env:
      RUN: ./hack/ci/run-flatcar.sh
    steps:
-      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+      - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
       - name: Vagrant box version
         id: vagrant-box
         run: |
@@ -175,7 +175,7 @@ jobs:
     env:
       RUN: ./hack/ci/run-ubuntu.sh
     steps:
-      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+      - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
       - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
         with:
           path: |