Skip to content

Conversation

@abays
Copy link
Contributor

@abays abays commented Nov 14, 2025

This commit migrates the ironic-operator from Operator SDK 1.31.0 to 1.41.1, following the new project structure and best practices introduced in the newer SDK version.

Major Changes:

Project Structure Reorganization:

  • Moved entry point from root main.go to cmd/main.go
  • Created internal/ directory structure following operator-sdk 1.41.1 conventions:
    • internal/controller/ - Contains all controllers (moved from controllers/)
    • internal/webhook/v1beta1/ - Contains webhook setup functions
  • Updated all import paths and package declarations accordingly

Build System Updates:

  • Updated Makefile to use operator-sdk v1.41.1
  • Updated CONTROLLER_TOOLS_VERSION to v0.16.4 for compatibility
  • Updated Dockerfile to use new main.go location
  • Updated build and run targets for new project structure

Configuration Enhancements:

  • Enhanced certmanager configuration with separate certificates for metrics and webhooks
  • Added network-policy configuration for secure traffic control:
    • allow-metrics-traffic.yaml - Restricts metrics access to openstack namespace
    • allow-webhook-traffic.yaml - Allows webhook traffic from all namespaces
  • Enhanced RBAC configuration:
    • Added metrics_auth_role.yaml for TokenReview and SubjectAccessReview permissions
    • Added ironic_admin_role.yaml for full Ironic resource management
    • Updated existing roles with proper operator-sdk 1.41.1 labels and metadata
  • Updated manager configuration:
    • Added cert_metrics_manager_patch.yaml for TLS certificate mounting
    • Added manager_metrics_patch.yaml with kube-rbac-proxy sidecar for secure metrics
  • Enhanced Prometheus monitoring with TLS support via monitor_tls_patch.yaml

Controller and Webhook Updates:

  • Migrated webhook registration to function-based approach:
    • Created SetupIronicWebhookWithManager() function in internal/webhook/v1beta1/
    • Updated cmd/main.go to use new webhook setup pattern
  • Updated all controller package declarations and imports
  • Fixed test imports in tests/functional/suite_test.go

Dependency Management:

  • Updated go.mod and go.sum with compatible dependency versions
  • Resolved go.work version conflicts
  • Maintained compatibility with existing OpenStack operator ecosystem

The upgrade maintains 100% backward compatibility while modernizing the codebase to align with operator-sdk 1.41.1 best practices for security, monitoring, and deployment configurations.

All ironic-operator resources continue to function correctly:

  • Ironic (main resource with webhooks)
  • IronicAPI
  • IronicConductor
  • IronicInspector
  • IronicNeutronAgent

Verified functionality:

  • Build: PASS
  • Manifests generation: PASS
  • Bundle generation: PASS
  • Unit tests: PASS

Related: https://issues.redhat.com/browse/OSPRH-21958

Co-Authored-By: Claude [email protected]

Depends-On: openstack-k8s-operators/openstack-operator#1683

@openshift-ci openshift-ci bot requested review from dprince and olliewalsh November 14, 2025 18:54
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Nov 14, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: abays

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@abays abays force-pushed the operator_sdk_1.41.1 branch 2 times, most recently from d957eeb to 9149bd2 Compare November 17, 2025 09:42
@softwarefactory-project-zuul
Copy link

Merge Failed.

This change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset.
Warning:
Error merging github.com/openstack-k8s-operators/openstack-operator for 1683,19db487cf23204e39d5f67be71ad37d8a1632c92

@abays
Copy link
Contributor Author

abays commented Nov 17, 2025

recheck

@abays
Copy link
Contributor Author

abays commented Nov 17, 2025

/test ironic-operator-build-deploy-kuttl

1 similar comment
@abays
Copy link
Contributor Author

abays commented Nov 17, 2025

/test ironic-operator-build-deploy-kuttl

@abays abays force-pushed the operator_sdk_1.41.1 branch 2 times, most recently from 34b64db to a601852 Compare November 20, 2025 10:42
This commit migrates the ironic-operator from Operator SDK 1.31.0 to 1.41.1,
following the new project structure and best practices introduced in the newer
SDK version.

Major Changes:

Project Structure Reorganization:
- Moved entry point from root main.go to cmd/main.go
- Created internal/ directory structure following operator-sdk 1.41.1 conventions:
  - internal/controller/ - Contains all controllers (moved from controllers/)
  - internal/webhook/v1beta1/ - Contains webhook setup functions
- Updated all import paths and package declarations accordingly

Build System Updates:
- Updated Makefile to use operator-sdk v1.41.1
- Updated CONTROLLER_TOOLS_VERSION to v0.16.4 for compatibility
- Updated Dockerfile to use new main.go location
- Updated build and run targets for new project structure

Configuration Enhancements:
- Enhanced certmanager configuration with separate certificates for metrics and webhooks
- Added network-policy configuration for secure traffic control:
  - allow-metrics-traffic.yaml - Restricts metrics access to openstack namespace
  - allow-webhook-traffic.yaml - Allows webhook traffic from all namespaces
- Enhanced RBAC configuration:
  - Added metrics_auth_role.yaml for TokenReview and SubjectAccessReview permissions
  - Added ironic_admin_role.yaml for full Ironic resource management
  - Updated existing roles with proper operator-sdk 1.41.1 labels and metadata
- Updated manager configuration:
  - Added cert_metrics_manager_patch.yaml for TLS certificate mounting
  - Added manager_metrics_patch.yaml with kube-rbac-proxy sidecar for secure metrics
- Enhanced Prometheus monitoring with TLS support via monitor_tls_patch.yaml

Controller and Webhook Updates:
- Migrated webhook registration to function-based approach:
  - Created SetupIronicWebhookWithManager() function in internal/webhook/v1beta1/
  - Updated cmd/main.go to use new webhook setup pattern
- Updated all controller package declarations and imports
- Fixed test imports in tests/functional/suite_test.go

Dependency Management:
- Updated go.mod and go.sum with compatible dependency versions
- Resolved go.work version conflicts
- Maintained compatibility with existing OpenStack operator ecosystem

The upgrade maintains 100% backward compatibility while modernizing the codebase
to align with operator-sdk 1.41.1 best practices for security, monitoring, and
deployment configurations.

All ironic-operator resources continue to function correctly:
- Ironic (main resource with webhooks)
- IronicAPI
- IronicConductor
- IronicInspector
- IronicNeutronAgent

Verified functionality:
- Build: PASS
- Manifests generation: PASS
- Bundle generation: PASS
- Unit tests: PASS

Co-Authored-By: Claude <[email protected]>
Related: https://issues.redhat.com/browse/OSPRH-21958
@abays abays force-pushed the operator_sdk_1.41.1 branch from a601852 to ad84696 Compare November 20, 2025 13:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant