From 26db093059eb331144d6a892e418e534c19dbbc2 Mon Sep 17 00:00:00 2001 From: Fabian Wiesel Date: Tue, 3 Nov 2026 10:38:02 +0100 Subject: [PATCH 1/3] Regenerate CRDs with controller-gen v0.23.0 The Makefile installs controller-gen unpinned (@latest), so CI and machines without a preinstalled controller-gen already run v0.23.0 and "make generate" dirties the committed CRDs. Regenerate them to keep generation idempotent. Signed-off-by: Fabian Wiesel --- .../crds/kvm.cloud.sap_evictions.yaml | 2 +- .../crds/kvm.cloud.sap_hypervisors.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/openstack-hypervisor-operator/crds/kvm.cloud.sap_evictions.yaml b/charts/openstack-hypervisor-operator/crds/kvm.cloud.sap_evictions.yaml index 582c7628..38b4b72f 100644 --- a/charts/openstack-hypervisor-operator/crds/kvm.cloud.sap_evictions.yaml +++ b/charts/openstack-hypervisor-operator/crds/kvm.cloud.sap_evictions.yaml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.22.0 + controller-gen.kubebuilder.io/version: v0.23.0 name: evictions.kvm.cloud.sap spec: group: kvm.cloud.sap diff --git a/charts/openstack-hypervisor-operator/crds/kvm.cloud.sap_hypervisors.yaml b/charts/openstack-hypervisor-operator/crds/kvm.cloud.sap_hypervisors.yaml index 8f418e33..1e10c618 100644 --- a/charts/openstack-hypervisor-operator/crds/kvm.cloud.sap_hypervisors.yaml +++ b/charts/openstack-hypervisor-operator/crds/kvm.cloud.sap_hypervisors.yaml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.22.0 + controller-gen.kubebuilder.io/version: v0.23.0 name: hypervisors.kvm.cloud.sap spec: group: kvm.cloud.sap From dc35a751b92d9dcf7cf3988c04d8258d0c06c1b2 Mon Sep 17 00:00:00 2001 From: Fabian Wiesel Date: Mon, 2 Nov 2026 10:12:27 +0100 Subject: [PATCH 2/3] Scope the ClusterRole to the Helm release A second instance may need to run next to the production release in the same cluster. Today it cannot: both releases render the same cluster-scoped RBAC objects. A shared object blocks the second install, and one uninstall deletes it for both releases. The generator emits the release-scoped name, so "make generate" reproduces it. The production release renders the same name as before. Signed-off-by: Fabian Wiesel --- Makefile | 2 +- Makefile.maker.yaml | 4 +++- .../templates/manager-clusterrolebinding.yaml | 2 +- charts/openstack-hypervisor-operator/templates/role.yaml | 2 +- 4 files changed, 6 insertions(+), 4 deletions(-) diff --git a/Makefile b/Makefile index b2a4570c..da284c32 100644 --- a/Makefile +++ b/Makefile @@ -114,7 +114,7 @@ check: FORCE static-check build/cover.html build-all generate: install-controller-gen @printf "\e[1;36m>> controller-gen\e[0m\n" - @controller-gen crd:allowDangerousTypes=true rbac:roleName=hypervisor-operator-manager-role webhook paths="./..." output:crd:artifacts:config=charts/openstack-hypervisor-operator/crds output:rbac:artifacts:config=charts/openstack-hypervisor-operator/templates + @controller-gen crd:allowDangerousTypes=true rbac:roleName='"{{ include \"openstack-hypervisor-operator.fullname\" . }}-manager-role"' webhook paths="./..." output:crd:artifacts:config=charts/openstack-hypervisor-operator/crds output:rbac:artifacts:config=charts/openstack-hypervisor-operator/templates @controller-gen object:headerFile="hack/boilerplate.go.txt",year=$(YEAR) paths="./..." @controller-gen applyconfiguration paths="./..." diff --git a/Makefile.maker.yaml b/Makefile.maker.yaml index 13b73c28..8f19fbe7 100644 --- a/Makefile.maker.yaml +++ b/Makefile.maker.yaml @@ -9,7 +9,9 @@ controllerGen: enabled: true crdOutputPath: charts/openstack-hypervisor-operator/crds objectHeaderFile: hack/boilerplate.go.txt - rbacRoleName: hypervisor-operator-manager-role + # Release-scoped ClusterRole name (Helm template): multiple instances of + # this operator must not share RBAC objects in the same cluster. + rbacRoleName: '{{ include "openstack-hypervisor-operator.fullname" . }}-manager-role' rbacOutputPath: charts/openstack-hypervisor-operator/templates allowDangerousTypes: true diff --git a/charts/openstack-hypervisor-operator/templates/manager-clusterrolebinding.yaml b/charts/openstack-hypervisor-operator/templates/manager-clusterrolebinding.yaml index 34537573..ac49e371 100644 --- a/charts/openstack-hypervisor-operator/templates/manager-clusterrolebinding.yaml +++ b/charts/openstack-hypervisor-operator/templates/manager-clusterrolebinding.yaml @@ -7,7 +7,7 @@ metadata: roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: hypervisor-operator-manager-role + name: {{ include "openstack-hypervisor-operator.fullname" . }}-manager-role subjects: - kind: ServiceAccount name: '{{ include "openstack-hypervisor-operator.serviceAccountName" . }}' diff --git a/charts/openstack-hypervisor-operator/templates/role.yaml b/charts/openstack-hypervisor-operator/templates/role.yaml index 3b1ecda8..d420447d 100644 --- a/charts/openstack-hypervisor-operator/templates/role.yaml +++ b/charts/openstack-hypervisor-operator/templates/role.yaml @@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: hypervisor-operator-manager-role + name: '{{ include "openstack-hypervisor-operator.fullname" . }}-manager-role' rules: - apiGroups: - "" From 719b2c7312f03b24d8c2358d639f46430484c20a Mon Sep 17 00:00:00 2001 From: Fabian Wiesel Date: Mon, 2 Nov 2026 10:13:21 +0100 Subject: [PATCH 3/3] Allow overriding the manager image tag The chart pinned the manager image to Chart.AppVersion. A specific build could not be deployed. The tag defaults to Chart.AppVersion, so existing releases are unaffected. Signed-off-by: Fabian Wiesel --- charts/openstack-hypervisor-operator/templates/deployment.yaml | 2 +- charts/openstack-hypervisor-operator/values.yaml | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/charts/openstack-hypervisor-operator/templates/deployment.yaml b/charts/openstack-hypervisor-operator/templates/deployment.yaml index 0452645e..a75ad937 100644 --- a/charts/openstack-hypervisor-operator/templates/deployment.yaml +++ b/charts/openstack-hypervisor-operator/templates/deployment.yaml @@ -58,7 +58,7 @@ spec: resourceFieldRef: resource: limits.memory divisor: "1" - image: {{ .Values.controllerManager.manager.image.repository }}:{{ .Chart.AppVersion }} + image: {{ .Values.controllerManager.manager.image.repository }}:{{ .Values.controllerManager.manager.image.tag | default .Chart.AppVersion }} livenessProbe: httpGet: path: /healthz diff --git a/charts/openstack-hypervisor-operator/values.yaml b/charts/openstack-hypervisor-operator/values.yaml index 22f61295..57cdb7df 100644 --- a/charts/openstack-hypervisor-operator/values.yaml +++ b/charts/openstack-hypervisor-operator/values.yaml @@ -34,6 +34,8 @@ controllerManager: osUsername: "" image: repository: ghcr.io/cobaltcore-dev/openstack-hypervisor-operator + # Defaults to Chart.AppVersion. + tag: null resources: limits: cpu: 500m