Repository navigation
🌱 Prepare Helm deployment and supporting resources for object-controller #2974
+264
−4
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| {{- if and (include "objectController.enabled" .) .Values.options.certManager.enabled }} | ||
| apiVersion: cert-manager.io/v1 | ||
| kind: Certificate | ||
| metadata: | ||
| annotations: | ||
| {{- include "olmv1.annotations" . | nindent 4 }} | ||
| labels: | ||
| app.kubernetes.io/name: {{ include "olmv1.label.name" . }} | ||
| {{- include "olmv1.labels" . | nindent 4 }} | ||
| name: object-controller-cert | ||
| namespace: {{ .Values.namespaces.olmv1.name }} | ||
| spec: | ||
| dnsNames: | ||
| - object-controller-service.{{ .Values.namespaces.olmv1.name }}.svc | ||
| - object-controller-service.{{ .Values.namespaces.olmv1.name }}.svc.cluster.local | ||
| issuerRef: | ||
| group: cert-manager.io | ||
| kind: ClusterIssuer | ||
| name: olmv1-ca | ||
| privateKey: | ||
| algorithm: ECDSA | ||
| rotationPolicy: Always | ||
| size: 256 | ||
| secretName: object-controller-cert | ||
| {{- end }} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,122 @@ | ||||||
| {{- if include "objectController.enabled" . }} | ||||||
| apiVersion: apps/v1 | ||||||
| kind: Deployment | ||||||
| metadata: | ||||||
| annotations: | ||||||
| kubectl.kubernetes.io/default-logs-container: manager | ||||||
| {{- include "olmv1.annotations" . | nindent 4 }} | ||||||
| labels: | ||||||
| app.kubernetes.io/name: object-controller | ||||||
| {{- include "olmv1.labels" . | nindent 4 }} | ||||||
| name: object-controller-controller-manager | ||||||
| namespace: {{ .Values.namespaces.olmv1.name }} | ||||||
| spec: | ||||||
| replicas: {{ .Values.options.objectController.deployment.replicas }} | ||||||
| strategy: | ||||||
| type: RollingUpdate | ||||||
| rollingUpdate: | ||||||
| maxSurge: 1 | ||||||
| maxUnavailable: 0 | ||||||
| selector: | ||||||
| matchLabels: | ||||||
| control-plane: object-controller-controller-manager | ||||||
| template: | ||||||
| metadata: | ||||||
| annotations: | ||||||
| kubectl.kubernetes.io/default-container: manager | ||||||
| {{- include "olmv1.annotations" . | nindent 8 }} | ||||||
| {{- if .Values.options.openshift.enabled }} | ||||||
| target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}' | ||||||
| openshift.io/required-scc: privileged | ||||||
| {{- end }} | ||||||
| labels: | ||||||
| app.kubernetes.io/name: object-controller | ||||||
| control-plane: object-controller-controller-manager | ||||||
| {{- include "olmv1.labels" . | nindent 8 }} | ||||||
| {{- with .Values.options.objectController.deployment.podLabels }} | ||||||
| {{- toYamlPretty . | nindent 8 }} | ||||||
| {{- end }} | ||||||
| spec: | ||||||
| containers: | ||||||
| - name: manager | ||||||
| command: | ||||||
| - /object-controller | ||||||
| args: | ||||||
| - --health-probe-bind-address=:8081 | ||||||
| {{- if not .Values.options.tilt.enabled }} | ||||||
| - --leader-elect | ||||||
| {{- end }} | ||||||
| {{- if .Values.options.profiling.enabled }} | ||||||
| - --pprof-bind-address=:6060 | ||||||
| {{- end }} | ||||||
| {{- if or .Values.options.certManager.enabled .Values.options.openshift.enabled }} | ||||||
| - --metrics-bind-address=:8443 | ||||||
| - --tls-cert=/var/certs/tls.crt | ||||||
| - --tls-key=/var/certs/tls.key | ||||||
| {{- end }} | ||||||
| {{- if .Values.options.openshift.enabled }} | ||||||
| - --v=${LOG_VERBOSITY} | ||||||
|
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -u
printf '%s\n' '--- revisions ---'
git rev-parse --verify aa83a5508a21cd9613eca38dab141edfcee496c9^{commit}
git rev-parse --verify 4d33ad1dd9ba6f32376ff910a0b5eb587aaca4a6^{commit}
printf '%s\n' '--- target diff ---'
git diff --no-ext-diff --unified=12 4d33ad1dd9ba6f32376ff910a0b5eb587aaca4a6 aa83a5508a21cd9613eca38dab141edfcee496c9 -- helm/olmv1/templates/deployment-olmv1-system-object-controller-controller-manager.yml
printf '%s\n' '--- target file at head ---'
nl -ba helm/olmv1/templates/deployment-olmv1-system-object-controller-controller-manager.yml | sed -n '1,180p'
printf '%s\n' '--- relevant chart references ---'
rg -n -F -- 'objectController.enabled' helm/olmv1
rg -n -F -- 'LOG_VERBOSITY' . --glob '!vendor/**' --glob '!**/go.sum'
printf '%s\n' '--- controller entrypoint and flag handling candidates ---'
rg -n -- 'object-controller|flag\.Int|IntVar|--v|verbosity|klog|pflag' cmd pkg internal main.go 2>/dev/null || trueRepository: operator-framework/operator-controller Length of output: 19758 🤖 get_repo_knowledge executed:
Length of output: 4003 🏁 Script executed: #!/bin/bash
set -u
printf '%s\n' '--- enablement helper ---'
nl -ba helm/olmv1/templates/_helpers.tpl | sed -n '55,85p'
printf '%s\n' '--- OpenShift and object-controller values ---'
rg -n --glob '*.yaml' --glob '*.yml' --glob '*.tpl' -- 'openshift:|objectController:|enabled:|LOG_VERBOSITY|object-controller' helm/olmv1/values.yaml helm/olmv1/values*.yaml helm/olmv1/templates 2>/dev/null | head -180
printf '%s\n' '--- object-controller main ---'
nl -ba cmd/object-controller/main.go | sed -n '55,115p'
nl -ba cmd/object-controller/main.go | sed -n '190,220p'
printf '%s\n' '--- sibling OpenShift args/env ---'
nl -ba helm/olmv1/templates/deployment-olmv1-system-operator-controller-controller-manager.yml | sed -n '55,90p'
nl -ba helm/olmv1/templates/deployment-olmv1-system-catalogd-controller-manager.yml | sed -n '55,88p'
printf '%s\n' '--- LOG_VERBOSITY tracked source references ---'
rg -n -F --glob '!vendor/**' --glob '!**/go.sum' -- 'LOG_VERBOSITY' . || test "$?" -eq 1Repository: operator-framework/operator-controller Length of output: 16330 🏁 Script executed: rg -n -- 'k8s.io/klog/v2' go.mod go.sum | head -12Repository: operator-framework/operator-controller Length of output: 384 🌐 Web query:
💡 Result: 🌐 Web query:
💡 Result: Use Kubernetes expansion syntax for OpenShift verbosity. The current activation guard prevents this Deployment from rendering. The helper says reconciliation handover will replace the guard. When that cutover renders this Deployment, Kubernetes can pass Use Suggested fix- - --v=${LOG_VERBOSITY}
+ - --v=$(LOG_VERBOSITY)📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||
| {{- end }} | ||||||
| {{- if .Values.options.e2e.enabled }} | ||||||
| - --tls-profile=modern | ||||||
| {{- end }} | ||||||
| {{- range .Values.options.objectController.deployment.extraArguments }} | ||||||
| - {{ . }} | ||||||
| {{- end }} | ||||||
| image: "{{ .Values.options.objectController.deployment.image }}" | ||||||
| {{- if .Values.options.e2e.enabled }} | ||||||
| env: | ||||||
| - name: GOCOVERDIR | ||||||
| value: /e2e-coverage | ||||||
| {{- end }} | ||||||
| {{- if not .Values.options.tilt.enabled }} | ||||||
| livenessProbe: | ||||||
|
Contributor
There was a problem hiding this comment. we may also want a tilt guard here as with operator-controller [ref]
Contributor
Author
There was a problem hiding this comment. Done. Added the Tilt guard around both liveness and readiness probes, matching operator-controller so debugging does not trigger probe failures. Helm lint, manifest generation, rendering checks with Tilt enabled and disabled, and make verify passed. AI-assisted response |
||||||
| httpGet: | ||||||
| path: /healthz | ||||||
| port: 8081 | ||||||
| initialDelaySeconds: 15 | ||||||
| periodSeconds: 20 | ||||||
| readinessProbe: | ||||||
| httpGet: | ||||||
| path: /readyz | ||||||
| port: 8081 | ||||||
| initialDelaySeconds: 5 | ||||||
| periodSeconds: 10 | ||||||
| {{- end }} | ||||||
| resources: | ||||||
| requests: | ||||||
| cpu: 10m | ||||||
| memory: 64Mi | ||||||
| {{- if or .Values.options.certManager.enabled .Values.options.openshift.enabled .Values.options.e2e.enabled }} | ||||||
| volumeMounts: | ||||||
| {{- if or .Values.options.certManager.enabled .Values.options.openshift.enabled }} | ||||||
| - name: object-controller-certs | ||||||
| mountPath: /var/certs | ||||||
| readOnly: true | ||||||
| {{- end }} | ||||||
| {{- if .Values.options.e2e.enabled }} | ||||||
| - name: e2e-coverage-volume | ||||||
| mountPath: /e2e-coverage | ||||||
| {{- end }} | ||||||
| {{- end }} | ||||||
| {{- with .Values.deployments.containerSpec }} | ||||||
| {{- toYaml . | nindent 10 }} | ||||||
| {{- end }} | ||||||
| serviceAccountName: object-controller-controller-manager | ||||||
| {{- if or .Values.options.certManager.enabled .Values.options.openshift.enabled .Values.options.e2e.enabled }} | ||||||
| volumes: | ||||||
| {{- if or .Values.options.certManager.enabled .Values.options.openshift.enabled }} | ||||||
| - name: object-controller-certs | ||||||
| secret: | ||||||
| secretName: object-controller-cert | ||||||
| {{- end }} | ||||||
| {{- if .Values.options.e2e.enabled }} | ||||||
| - name: e2e-coverage-volume | ||||||
| persistentVolumeClaim: | ||||||
| claimName: e2e-coverage | ||||||
| {{- end }} | ||||||
| {{- end }} | ||||||
| {{- with .Values.deployments.templateSpec }} | ||||||
| {{- toYamlPretty . | nindent 6 }} | ||||||
| {{- end }} | ||||||
| {{- end }} | ||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| {{- if include "objectController.enabled" . }} | ||
| apiVersion: networking.k8s.io/v1 | ||
| kind: NetworkPolicy | ||
| metadata: | ||
| annotations: | ||
| {{- include "olmv1.annotations" . | nindent 4 }} | ||
| labels: | ||
| app.kubernetes.io/name: object-controller | ||
| {{- include "olmv1.labels" . | nindent 4 }} | ||
| name: object-controller-controller-manager | ||
| namespace: {{ .Values.namespaces.olmv1.name }} | ||
| spec: | ||
| egress: | ||
| - {} | ||
| {{- if or .Values.options.certManager.enabled .Values.options.openshift.enabled }} | ||
| ingress: | ||
| - ports: | ||
| - port: 8443 | ||
| protocol: TCP | ||
| {{- end }} | ||
| podSelector: | ||
| matchLabels: | ||
| control-plane: object-controller-controller-manager | ||
| policyTypes: | ||
| - Ingress | ||
| - Egress | ||
| {{- end }} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| {{- if and (include "objectController.enabled" .) .Values.options.objectController.podDisruptionBudget.enabled }} | ||
| apiVersion: policy/v1 | ||
| kind: PodDisruptionBudget | ||
| metadata: | ||
| name: object-controller-controller-manager | ||
| namespace: {{ .Values.namespaces.olmv1.name }} | ||
| labels: | ||
| app.kubernetes.io/name: object-controller | ||
| {{- include "olmv1.labels" . | nindent 4 }} | ||
| annotations: | ||
| {{- include "olmv1.annotations" . | nindent 4 }} | ||
| spec: | ||
| {{- if ne (toJson .Values.options.objectController.podDisruptionBudget.maxUnavailable) "null" }} | ||
| maxUnavailable: {{ .Values.options.objectController.podDisruptionBudget.maxUnavailable }} | ||
| {{- else if ne (toJson .Values.options.objectController.podDisruptionBudget.minAvailable) "null" }} | ||
| minAvailable: {{ .Values.options.objectController.podDisruptionBudget.minAvailable }} | ||
| {{- end }} | ||
| unhealthyPodEvictionPolicy: AlwaysAllow | ||
| selector: | ||
| matchLabels: | ||
| control-plane: object-controller-controller-manager | ||
| {{- end }} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| {{- if include "objectController.enabled" . }} | ||
| apiVersion: v1 | ||
| kind: Service | ||
| metadata: | ||
| annotations: | ||
| {{- include "olmv1.annotations" . | nindent 4 }} | ||
| {{- if .Values.options.openshift.enabled }} | ||
| service.beta.openshift.io/serving-cert-secret-name: object-controller-cert | ||
| {{- end }} | ||
| labels: | ||
| app.kubernetes.io/name: object-controller | ||
| {{- include "olmv1.labels" . | nindent 4 }} | ||
| name: object-controller-service | ||
| namespace: {{ .Values.namespaces.olmv1.name }} | ||
| spec: | ||
| ports: | ||
| - name: metrics | ||
| port: 8443 | ||
| protocol: TCP | ||
| targetPort: 8443 | ||
| selector: | ||
| app.kubernetes.io/name: object-controller | ||
| {{- end }} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| {{- if .Values.options.openshift.enabled -}} | ||
| {{- if include "objectController.enabled" . -}} | ||
| apiVersion: monitoring.coreos.com/v1 | ||
| kind: ServiceMonitor | ||
| metadata: | ||
| annotations: | ||
| {{- include "olmv1.annotations" . | nindent 4 }} | ||
| labels: | ||
| openshift.io/cluster-monitoring: 'true' | ||
| app.kubernetes.io/name: object-controller | ||
| {{- include "olmv1.labels" . | nindent 4 }} | ||
| name: object-controller-metrics-monitor | ||
| namespace: {{ .Values.namespaces.olmv1.name }} | ||
| spec: | ||
| endpoints: | ||
| - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token | ||
| interval: 30s | ||
| path: /metrics | ||
| port: metrics | ||
| scheme: https | ||
| tlsConfig: | ||
| caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt | ||
| certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt | ||
| keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key | ||
| serverName: object-controller-service.{{ .Values.namespaces.olmv1.name }}.svc | ||
| namespaceSelector: | ||
| matchNames: | ||
| - {{ .Values.namespaces.olmv1.name }} | ||
| selector: | ||
| matchLabels: | ||
| app.kubernetes.io/name: object-controller | ||
| serviceDiscoveryRole: EndpointSlice | ||
| {{- end -}} | ||
| {{- end -}} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
we always seem to pass the metrics bind address in operator-controller [ref] - should we do the same here as well? Otherwise, should we also guard the NetworkPolicy 8443 rule on certs being enabled?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The conditional metrics argument is intentional: cmd/object-controller/main.go rejects an explicit metrics-bind-address unless tls-cert and tls-key are also supplied, and disables the metrics server when neither certificate is provided. Passing :8443 unconditionally would therefore prevent startup without cert-manager or OpenShift serving certificates.
The NetworkPolicy rule permits connections to 8443 but does not create a listener; without certificates there is no metrics endpoint to access. Guarding that rule would make the policy more precise, but is not required to keep metrics disabled. I have retained the conditional argument and the existing policy for now.
AI-assisted response
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
but is it problematic to keep an NP that doesn't do anything - shouldn't we follow some kind of principle of least configuration/resources or something like that? Feels like we're creating cruft.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Agreed—the unused metrics ingress rule should be conditional. I’ve guarded it on cert-manager or OpenShift certificates being enabled. The NetworkPolicy remains because its egress allowance lets object-controller reach the Kubernetes API despite the namespace’s default-deny policy.