⚠️ OPRUN-4075: Move to a helm-based configuration

.bingo/Variables.mk

@@ -53,6 +53,12 @@ $(GORELEASER): $(BINGO_DIR)/goreleaser.mod
 	@echo "(re)installing $(GOBIN)/goreleaser-v1.26.2"
 	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=goreleaser.mod -o=$(GOBIN)/goreleaser-v1.26.2 "github.com/goreleaser/goreleaser"
 
+HELM := $(GOBIN)/helm-v3.18.4
+$(HELM): $(BINGO_DIR)/helm.mod
+	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
+	@echo "(re)installing $(GOBIN)/helm-v3.18.4"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=helm.mod -o=$(GOBIN)/helm-v3.18.4 "helm.sh/helm/v3/cmd/helm"
+
 KIND := $(GOBIN)/kind-v0.29.0
 $(KIND): $(BINGO_DIR)/kind.mod
 	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.

.bingo/helm.mod

@@ -0,0 +1,5 @@
+module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
+
+go 1.24.3
+
+require helm.sh/helm/v3 v3.18.4 // cmd/helm

.bingo/variables.env

@@ -20,6 +20,8 @@ GOLANGCI_LINT="${GOBIN}/golangci-lint-v2.1.6"
 
 GORELEASER="${GOBIN}/goreleaser-v1.26.2"
 
+HELM="${GOBIN}/helm-v3.18.4"
+
 KIND="${GOBIN}/kind-v0.29.0"
 
 KUSTOMIZE="${GOBIN}/kustomize-v5.6.0"

.github/workflows/sanity.yaml

@@ -30,3 +30,15 @@ jobs:
 
  - name: Run golangci linting checks
  run: make lint
+
+ lint-helm:
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v5
+
+ - uses: actions/setup-go@v5
+ with:
+ go-version-file: "go.mod"
+
+ - name: Run helm linting checks
+ run: make lint-helm

.tilt-support

@@ -150,4 +150,4 @@ def deploy_repo(data, tags="", debug=True):
  local_port = repo['starting_debug_port']
  build_binary(reponame, repo['binary'], repo['deps'], repo['image'], tags, debug)
  k8s_resource(repo['deployment'], port_forwards=['{}:30000'.format(local_port)])
- process_yaml(kustomize(data['yaml']))
+ process_yaml(helm('helm/olmv1', name="olmv1", values=[data['yaml']]))

Makefile

@@ -83,12 +83,12 @@ export EXPERIMENTAL_RELEASE_INSTALL := install-experimental.sh
 export RELEASE_CATALOGS := default-catalogs.yaml
 
 # List of manifests that are checked in
-MANIFEST_HOME := ./manifests
-STANDARD_MANIFEST := ./manifests/standard.yaml
-STANDARD_E2E_MANIFEST := ./manifests/standard-e2e.yaml
-EXPERIMENTAL_MANIFEST := ./manifests/experimental.yaml
-EXPERIMENTAL_E2E_MANIFEST := ./manifests/experimental-e2e.yaml
-CATALOGS_MANIFEST := ./manifests/default-catalogs.yaml
+MANIFEST_HOME := manifests
+STANDARD_MANIFEST := $(MANIFEST_HOME)/standard.yaml
+STANDARD_E2E_MANIFEST := $(MANIFEST_HOME)/standard-e2e.yaml
+EXPERIMENTAL_MANIFEST := $(MANIFEST_HOME)/experimental.yaml
+EXPERIMENTAL_E2E_MANIFEST := $(MANIFEST_HOME)/experimental-e2e.yaml
+CATALOGS_MANIFEST := $(MANIFEST_HOME)/default-catalogs.yaml
 
 # Disable -j flag for make
 .NOTPARALLEL:
@@ -123,6 +123,10 @@ help-extended: #HELP Display extended help.
 lint: lint-custom $(GOLANGCI_LINT) #HELP Run golangci linter.
 	$(GOLANGCI_LINT) run --build-tags $(GO_BUILD_TAGS) $(GOLANGCI_LINT_ARGS)
 
+lint-helm: $(HELM) #HELP Run helm linter
+	helm lint helm/olmv1
+	helm lint helm/prometheus
+
 .PHONY: custom-linter-build
 custom-linter-build: #EXHELP Build custom linter
 	go build -tags $(GO_BUILD_TAGS) -o ./bin/custom-linter ./hack/ci/custom-linters/cmd
@@ -139,31 +143,39 @@ k8s-pin: #EXHELP Pin k8s staging modules based on k8s.io/kubernetes version (in
 tidy:
 	go mod tidy
 
-.PHONY: manifests
-KUSTOMIZE_CATD_RBAC_DIR := config/base/catalogd/rbac
-KUSTOMIZE_CATD_WEBHOOKS_DIR := config/base/catalogd/webhook
-KUSTOMIZE_OPCON_RBAC_DIR := config/base/operator-controller/rbac
 # Due to https://github.com/kubernetes-sigs/controller-tools/issues/837 we can't specify individual files
 # So we have to generate them together and then move them into place
-manifests: $(CONTROLLER_GEN) $(KUSTOMIZE) #EXHELP Generate WebhookConfiguration, ClusterRole, and CustomResourceDefinition objects.
-	# Generate CRDs via our own generator
+.PHONY: update-crds
+update-crds:
 	hack/tools/update-crds.sh
-	# Generate the remaining operator-controller standard manifests
-	$(CONTROLLER_GEN) --load-build-tags=$(GO_BUILD_TAGS),standard rbac:roleName=manager-role paths="./internal/operator-controller/..." output:rbac:artifacts:config=$(KUSTOMIZE_OPCON_RBAC_DIR)/standard
-	# Generate the remaining operator-controller experimental manifests
-	$(CONTROLLER_GEN) --load-build-tags=$(GO_BUILD_TAGS) rbac:roleName=manager-role paths="./internal/operator-controller/..." output:rbac:artifacts:config=$(KUSTOMIZE_OPCON_RBAC_DIR)/experimental
-	# Generate the remaining catalogd standard manifests
-	$(CONTROLLER_GEN) --load-build-tags=$(GO_BUILD_TAGS),standard rbac:roleName=manager-role paths="./internal/catalogd/..." output:rbac:artifacts:config=$(KUSTOMIZE_CATD_RBAC_DIR)/standard
-	$(CONTROLLER_GEN) --load-build-tags=$(GO_BUILD_TAGS),standard webhook paths="./internal/catalogd/..." output:webhook:artifacts:config=$(KUSTOMIZE_CATD_WEBHOOKS_DIR)/standard
-	# Generate the remaining catalogd experimental manifests
-	$(CONTROLLER_GEN) --load-build-tags=$(GO_BUILD_TAGS) rbac:roleName=manager-role paths="./internal/catalogd/..." output:rbac:artifacts:config=$(KUSTOMIZE_CATD_RBAC_DIR)/experimental
-	$(CONTROLLER_GEN) --load-build-tags=$(GO_BUILD_TAGS) webhook paths="./internal/catalogd/..." output:webhook:artifacts:config=$(KUSTOMIZE_CATD_WEBHOOKS_DIR)/experimental
-	# Generate manifests stored in source-control
-	mkdir -p $(MANIFEST_HOME)
-	$(KUSTOMIZE) build $(KUSTOMIZE_STANDARD_OVERLAY) > $(STANDARD_MANIFEST)
-	$(KUSTOMIZE) build $(KUSTOMIZE_STANDARD_E2E_OVERLAY) > $(STANDARD_E2E_MANIFEST)
-	$(KUSTOMIZE) build $(KUSTOMIZE_EXPERIMENTAL_OVERLAY) > $(EXPERIMENTAL_MANIFEST)
-	$(KUSTOMIZE) build $(KUSTOMIZE_EXPERIMENTAL_E2E_OVERLAY) > $(EXPERIMENTAL_E2E_MANIFEST)
+
+# The filename variables can be overridden on the command line if you want to change the set of values files:
+# e.g. make "manifests/standard.yaml=helm/cert-manager.yaml my-values-file.yaml" manifests
+#
+# The set of MANIFESTS to be generated can be changed; you can generate your own custom manifest
+# e.g. make MANIFESTS=test.yaml "test.yaml=helm/e2e.yaml" manifests
+#
+# Override HELM_SETTINGS on the command line to include additional Helm settings
+# e.g. make HELM_SETTINGS="options.openshift.enabled=true" manifests
+# e.g. make HELM_SETTINGS="operatorControllerFeatures={WebhookProviderCertManager}" manifests
+#
+MANIFESTS ?= $(STANDARD_MANIFEST) $(STANDARD_E2E_MANIFEST) $(EXPERIMENTAL_MANIFEST) $(EXPERIMENTAL_E2E_MANIFEST)
+$(STANDARD_MANIFEST) ?= helm/cert-manager.yaml
+$(STANDARD_E2E_MANIFEST) ?= helm/cert-manager.yaml helm/e2e.yaml
+$(EXPERIMENTAL_MANIFEST) ?= helm/cert-manager.yaml helm/experimental.yaml
+$(EXPERIMENTAL_E2E_MANIFEST) ?= helm/cert-manager.yaml helm/experimental.yaml helm/e2e.yaml
+HELM_SETTINGS ?=
+.PHONY: $(MANIFESTS)
+$(MANIFESTS): $(HELM)
+	@mkdir -p $(MANIFEST_HOME)
+	$(HELM) template olmv1 helm/olmv1 $(addprefix --values ,$($@)) $(addprefix --set ,$(HELM_SETTINGS)) > $@
+
+# Generate manifests stored in source-control
+.PHONY: manifests
+manifests: update-crds $(MANIFESTS) $(HELM) #EXHELP Generate OLMv1 manifests
+	# These are testing existing manifest options without saving the results
+	$(HELM) template olmv1 helm/olmv1 --values helm/tilt.yaml $(addprefix --set ,$(HELM_SETTINGS)) > /dev/null
+	$(HELM) template olmv1 helm/olmv1 --set "options.openshift.enabled=true" > /dev/null
 
 .PHONY: generate
 generate: $(CONTROLLER_GEN) #EXHELP Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
@@ -285,8 +297,8 @@ test-experimental-e2e: run-internal image-registry prometheus experimental-e2e e
 .PHONY: prometheus
 prometheus: PROMETHEUS_NAMESPACE := olmv1-system
 prometheus: PROMETHEUS_VERSION := v0.83.0
-prometheus: #EXHELP Deploy Prometheus into specified namespace
-	./hack/test/install-prometheus.sh $(PROMETHEUS_NAMESPACE) $(PROMETHEUS_VERSION) $(KUSTOMIZE) $(VERSION)
+prometheus: $(KUSTOMIZE) #EXHELP Deploy Prometheus into specified namespace
+	./hack/test/install-prometheus.sh $(PROMETHEUS_NAMESPACE) $(PROMETHEUS_VERSION) $(VERSION)
 
 .PHONY: test-extension-developer-e2e
 test-extension-developer-e2e: SOURCE_MANIFEST := $(STANDARD_E2E_MANIFEST)

Tiltfile

@@ -17,7 +17,7 @@ olmv1 = {
  'starting_debug_port': 30000,
  },
  },
- 'yaml': 'config/overlays/tilt-local-dev',
+ 'yaml': 'helm/tilt.yaml',
 }
 
 deploy_repo(olmv1, '-tags containers_image_openpgp')

docs/draft/api-reference/network-policies.md

@@ -19,8 +19,8 @@ NetworkPolicy is implemented for both catalogd and operator-controller component
 
 Each component has a dedicated NetworkPolicy that applies to its respective pod through label selectors:
 
-* For catalogd: `control-plane=catalogd-controller-manager`
-* For operator-controller: `control-plane=operator-controller-controller-manager`
+* For catalogd: `app.kubernetes.io/name=catalogd`
+* For operator-controller: `app.kubernetes.io/name=operator-controller`
 
 ### Catalogd NetworkPolicy
 
@@ -78,10 +78,10 @@ If you encounter network connectivity issues after deploying OLMv1, consider the
 
 ```bash
 # Verify catalogd pod labels
-kubectl get pods -n olmv1-system --selector=control-plane=catalogd-controller-manager
+kubectl get pods -n olmv1-system --selector=apps.kubernetes.io/name=catalogd
 
 # Verify operator-controller pod labels
-kubectl get pods -n olmv1-system --selector=control-plane=operator-controller-controller-manager
+kubectl get pods -n olmv1-system --selector=apps.kubernetes.io/name=operator-controller
 
 # Compare with actual pod names
 kubectl get pods -n olmv1-system | grep -E 'catalogd|operator-controller'

docs/draft/howto/consuming-metrics.md

@@ -226,7 +226,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
  labels:
-control-plane: operator-controller-controller-manager
+apps.kubernetes.io/name: operator-controller
  name: controller-manager-metrics-monitor
  namespace: olmv1-system
 spec:
@@ -251,7 +251,7 @@ spec:
  key: tls.key
  selector:
  matchLabels:
-control-plane: operator-controller-controller-manager
+apps.kubernetes.io/name: operator-controller
 EOF
 ```
 
@@ -268,7 +268,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
  labels:
-control-plane: catalogd-controller-manager
+apps.kubernetes.io/name: catalogd
  name: catalogd-metrics-monitor
  namespace: olmv1-system
 spec:
@@ -298,4 +298,4 @@ EOF
 ```
 
 [prometheus-operator]: https://github.com/prometheus-operator/kube-prometheus
-[rbac-k8s-docs]: https://kubernetes.io/docs/reference/access-authn-authz/rbac/
+[rbac-k8s-docs]: https://kubernetes.io/docs/reference/access-authn-authz/rbac/

docs/draft/howto/enable-helm-chart-support.md

@@ -24,7 +24,7 @@ To enable the Helm Chart support feature gate, you need to patch the `operator-c
 2. **Wait for the controller manager pods to be ready:**
 
  ```bash
- $ kubectl -n olmv1-system wait --for condition=ready pods -l control-plane=operator-controller-controller-manager
+ $ kubectl -n olmv1-system wait --for condition=ready pods -l apps.kubernetes.io/name=operator-controller
  ```
 
 Once the above wait condition is met, the `HelmChartSupport` feature gate should be enabled in operator controller.

docs/draft/howto/profiling_with_pprof.md

@@ -21,7 +21,7 @@ The following steps are examples to demonstrate the required changes to enable P
 1. Run the following command to patch the Deployment and add the `--pprof-bind-address=:8082` flag:
 
 ```shell
-kubectl patch deployment $(kubectl get deployments -n olmv1-system -l control-plane=operator-controller-controller-manager -o jsonpath='{.items[0].metadata.name}') \
+kubectl patch deployment $(kubectl get deployments -n olmv1-system -l apps.kubernetes.io/name=operator-controller -o jsonpath='{.items[0].metadata.name}') \
 -n olmv1-system --type='json' -p='[
  {
  "op": "add",
@@ -127,7 +127,7 @@ go tool pprof -http=:8080 ./operator-controller-profile.pprof
 1. Run the following command to patch the Deployment and add the `--pprof-bind-address=:8083` flag:
 
 ```shell
-kubectl patch deployment $(kubectl get deployments -n olmv1-system -l control-plane=catalogd-controller-manager -o jsonpath='{.items[0].metadata.name}') \
+kubectl patch deployment $(kubectl get deployments -n olmv1-system -l apps.kubernetes.io/name=catalogd -o jsonpath='{.items[0].metadata.name}') \
 -n olmv1-system --type='json' -p='[
  {
  "op": "add",
@@ -235,7 +235,7 @@ go tool pprof -http=:8080 ./catalogd-profile.pprof
 1. Run the following command to bind to `--pprof-bind-address` the value `0` in order to disable the endpoint.
 
 ```shell
-kubectl patch deployment $(kubectl get deployments -n olmv1-system -l control-plane=operator-controller-controller-manager -o jsonpath='{.items[0].metadata.name}') \
+kubectl patch deployment $(kubectl get deployments -n olmv1-system -l apps.kubernetes.io/name=operator-controller -o jsonpath='{.items[0].metadata.name}') \
 -n olmv1-system --type='json' -p='[
  {
  "op": "replace",
@@ -266,7 +266,7 @@ kubectl delete pod curl-oper-con-pprof -n olmv1-system
 
 1. Run the following command to bind to `--pprof-bind-address` the value `0` in order to disable the endpoint.
 ```shell
-kubectl patch deployment $(kubectl get deployments -n olmv1-system -l control-plane=catalogd-controller-manager -o jsonpath='{.items[0].metadata.name}') \
+kubectl patch deployment $(kubectl get deployments -n olmv1-system -l apps.kubernetes.io/name=catalogd -o jsonpath='{.items[0].metadata.name}') \
 -n olmv1-system --type='json' -p='[
  {
  "op": "replace",
@@ -294,4 +294,4 @@ re-start the deployment `kubectl rollout restart deployment -n olmv1-system cata
 kubectl delete pod curl-catalogd-pprof -n olmv1-system
 ```
 
-[pprof]: https://github.com/google/pprof/blob/main/doc/README.md
+[pprof]: https://github.com/google/pprof/blob/main/doc/README.md

hack/test/install-prometheus.sh

@@ -1,22 +1,23 @@
 #!/bin/bash
 
+source ".bingo/variables.env"
+
 set -euo pipefail
 
 help="install-prometheus.sh is used to set up prometheus monitoring for e2e testing.
 Usage:
- install-prometheus.sh [PROMETHEUS_NAMESPACE] [PROMETHEUS_VERSION] [KUSTOMIZE] [GIT_VERSION]
+ install-prometheus.sh [PROMETHEUS_NAMESPACE] [PROMETHEUS_VERSION] [GIT_VERSION]
 "
 
-if [[ "$#" -ne 4 ]]; then
+if [[ "$#" -ne 3 ]]; then
  echo "Illegal number of arguments passed"
  echo "${help}"
  exit 1
 fi
 
 PROMETHEUS_NAMESPACE="$1"
 PROMETHEUS_VERSION="$2"
-KUSTOMIZE="$3"
-GIT_VERSION="$4"
+GIT_VERSION="$3"
 
 TMPDIR="$(mktemp -d)"
 trap 'echo "Cleaning up $TMPDIR"; rm -rf "$TMPDIR"' EXIT
@@ -26,16 +27,16 @@ curl -s "https://raw.githubusercontent.com/prometheus-operator/prometheus-operat
 curl -s "https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/refs/tags/${PROMETHEUS_VERSION}/bundle.yaml" > "${TMPDIR}/bundle.yaml"
 
 echo "Patching namespace to ${PROMETHEUS_NAMESPACE}..."
-(cd "$TMPDIR" && $KUSTOMIZE edit set namespace "$PROMETHEUS_NAMESPACE")
+(cd "$TMPDIR" && ${KUSTOMIZE} edit set namespace "$PROMETHEUS_NAMESPACE")
 
 echo "Applying Prometheus base..."
 kubectl apply -k "$TMPDIR" --server-side
 
 echo "Waiting for Prometheus Operator pod to become ready..."
 kubectl wait --for=condition=Ready pod -n "$PROMETHEUS_NAMESPACE" -l app.kubernetes.io/name=prometheus-operator
 
-echo "Applying overlay config..."
-$KUSTOMIZE build config/overlays/prometheus | sed "s/cert-git-version/cert-${VERSION}/g" | kubectl apply -f -
+echo "Applying prometheus Helm chart..."
+${HELM} template prometheus helm/prometheus | sed "s/cert-git-version/cert-${VERSION}/g" | kubectl apply -f -
 
 echo "Waiting for metrics scraper to become ready..."
 kubectl wait --for=create pods -n "$PROMETHEUS_NAMESPACE" prometheus-prometheus-0 --timeout=60s

hack/tools/update-crds.sh

@@ -43,7 +43,7 @@ for b in ${!modules[@]}; do
  # will not be generated for the standard channel - so we check the expected generated
  # file exists before copying it.
  FILE="${CRD_TMP}/${c}/${crds[${b}]}"
- [[ -e "${FILE}" ]] && cp "${FILE}" config/base/${modules[${b}]}/crd/${c}
+ [[ -e "${FILE}" ]] && cp "${FILE}" helm/olmv1/base/${modules[${b}]}/crd/${c}
  done
 done
 

helm/cert-manager.yaml

@@ -0,0 +1,8 @@
+# Default values for OLMv1.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+# List of components to include
+options:
+ certManager:
+ enabled: true

helm/e2e.yaml

@@ -0,0 +1,8 @@
+# e2e values for OLMv1.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+# List of components to include
+options:
+ e2e:
+ enabled: true

helm/experimental.yaml

@@ -0,0 +1,23 @@
+# experimental values for OLMv1.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+# List of enabled experimental features for operator-controller
+# Use with {{- if has "FeatureGate" .Values.operatorControllerFeatures }}
+# to pull in resources or additions
+operatorControllerFeatures:
+ - WebhookProviderCertManager
+ - SingleOwnNamespaceInstallSupport
+ - PreflightPermissions
+ - HelmChartSupport
+ - BoxcutterRuntime
+
+# List of enabled experimental features for catalogd
+# Use with {{- if has "FeatureGate" .Values.catalogdFeatures }}
+# to pull in resources or additions
+catalogdFeatures:
+ - APIV1MetasHandler
+
+# This can be one of: standard or experimental
+options:
+ featureSet: experimental

helm/olmv1/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/