feat(operator-chart): package the migration operator by Siddhant-K-code · Pull Request #347 · openfga/helm-charts

Siddhant-K-code · 2026-08-24T13:34:51Z

Summary

Adds the standalone Helm chart used to install and configure the OpenFGA migration operator.

Packages the operator Deployment, ServiceAccount, namespaced RBAC, and optional PodDisruptionBudget.
Adds strict values schema validation and chart-testing defaults.
Preserves explicit PDB values of 0 and documents RBAC requirements for cross-namespace watching.
Builds and loads the operator image into kind before ct install, allowing this intermediate layer to pass installation tests independently.
Includes Helm unit coverage for PodDisruptionBudget defaults and explicit zero values.

Stack

Native stack 351. Open #345 to view the GitHub stack map. Review bottom to top:

fix(chart): harden external migration hooks #345: External migration hooks, base main
feat(operator): add migration orchestration controller #346: Migration controller, base fix(chart): harden external migration hooks #345
feat(operator-chart): package the migration operator #347: Operator Helm chart (this PR), base feat(operator): add migration orchestration controller #346
feat(chart): integrate operator-managed migrations #348: OpenFGA chart integration, base feat(operator-chart): package the migration operator #347
ci(operator): add build and upgrade coverage #349: Operator CI and upgrade E2E, base feat(chart): integrate operator-managed migrations #348
docs(operator): document migration architecture decisions #350: Migration architecture ADRs, base ci(operator): add build and upgrade coverage #349

Replaces closed #338 and carries the operator chart portion of source #331. OpenFGA chart integration and upgrade E2E remain in later layers.

Attribution

The 14 original chart commits are replayed with Ed Milic (@emilic) as their actual Git author, preserving their original author dates, messages, and commit boundaries. GitHub links the replayed commits to @emilic.

Validation

All openfga-operator Helm unit tests
Strict Helm lint and template rendering with default and CI values
Values schema and workflow YAML parsing
Focused ct lint
git diff --check

Replace Helm hook-based migrations with a lightweight Kubernetes operator that watches OpenFGA Deployments, detects version changes, and runs migrations as regular Jobs. - Go operator using controller-runtime (no CRDs) - Helm subchart with opt-in via operator.enabled (default false) - Dedicated migration ServiceAccount (separate from runtime) - Auto-recovery on database failure (delete/retry cycle) - GitHub Actions workflow for multi-arch image builds - Integration test values for local Kubernetes clusters Resolves #211, #107, #120, #100, #126

- Harden pod security (runAsNonRoot, seccompProfile, drop ALL caps) - Find container by name instead of index to handle sidecars - Skip migration for memory datastore - Persist retry-after annotation before Job deletion to survive re-enqueue - Clear MigrationFailed condition on success - Propagate imagePullSecrets and securityContext to migration Jobs - Remove unused RBAC rules (secrets, serviceaccounts) - Add POD_NAMESPACE downward API for namespace-scoped watch default - Remove no-op migration values (timeout, backoffLimit, resources) - Fix migration SA helper to require name when create=false - Guard operator logic on both operator.enabled and migration.enabled - Build and load operator image into kind for chart-testing CI - Add path filters to operator workflow - Fix ADR inaccuracies (retry strategy, default-enabled wording) - Pin Dockerfile base image to golang:1.26.2

- Render extraInitContainers in operator mode (previously skipped) - Add version label to migration Jobs and delete stale Jobs on image change - Use namespaced Role/RoleBinding when watchAllNamespaces is false - Replace Status().Update with Status().Patch to avoid write conflicts - Fix logger.Error(nil, ...) to logger.Info for expected failure state - Wire desiredVersion param into buildMigrationJob for version tracking - Update RBAC: deployments/status verb from update to patch - Don't force replicas: 0 for memory engine in operator mode - Guard migration SA creation on migration.enabled - Document both required labels and mutable tag limitation in README

- Add opt-in annotation (openfga.dev/migration-enabled) so the operator only manages migrations for explicitly opted-in Deployments - Propagate volumes, volumeMounts, and envFrom from the Deployment to migration Jobs for TLS certs and file-based credentials - Remove watchAllNamespaces option; operator is now always namespace-scoped - Update ADR-004 dependency example to match actual file:// reference - Add test for migration-not-enabled skip behavior

- Wrap deployment annotations in conditional to avoid emitting empty annotations: field which produces an invalid manifest - Store full version in annotation (openfga.dev/desired-version) and truncate label to 63 chars to support digest-pinned images - Align operator image default to ghcr.io/openfga/openfga-operator to match CI publishing target

Prevents the operator from being evicted during node drains, which could leave the OpenFGA Deployment stuck at 0 replicas with no controller to scale it back up. Disabled by default; supports both minAvailable and maxUnavailable modes.

The README documented these flags as configurable via the subchart values.yaml, but only --leader-elect and --watch-namespace were actually wired. Add migrationJob.backoffLimit, activeDeadlineSeconds, and ttlSecondsAfterFinished values with matching args in the operator Deployment template.

The _helpers.tpl namespace template already supported namespaceOverride but the value was undeclared in values.yaml, making it undiscoverable.

Falling back to the "default" ServiceAccount would silently grant operator RBAC permissions (Deployment patch, Job create/delete) to a shared SA. Require an explicit name so the user makes a deliberate choice.

Address review findings: add allowPrivilegeEscalation: false for restricted PSS compliance, set default resource requests/limits, add values.schema.json validation, use stable selectorLabels on pod template to prevent spurious rollouts, add .helmignore, and improve Chart.yaml metadata and NOTES.txt with migration commands.

- charts/openfga-operator/ci and charts/openfga/ci values files so chart-testing exercises both the standalone operator subchart and the parent chart with operator.enabled=true. - .github/ci/operator-postgres-values.yaml plus a dedicated workflow step that installs at v1.9.5 and upgrades to v1.14.1 (crossing the v1.10.0 !!REQUIRES MIGRATION!! boundary), asserting the migration ConfigMap and ready rollout at each step.

Both the operator subchart and the parent chart's operator/migration blocks were missing additionalProperties: false, so typos like `migrationjob:` (lowercase), `enbaled: true`, or misplaced fields were silently ignored at install time. Add the guard to all well-defined object blocks — free-form blocks (podAnnotations, resources, securityContext, etc.) stay permissive since they pass through to pod spec.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

coderabbitai · 2026-08-24T13:35:05Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6a3dcf39-cc0b-4d75-934c-73d83679a388

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Adds a new standalone openfga-operator Helm chart for installing and configuring the OpenFGA migration operator, plus CI updates to build/load the operator image into the chart-testing kind cluster before ct install.

Changes:

Introduces the openfga-operator chart (Deployment, ServiceAccount, namespaced RBAC, optional PodDisruptionBudget, NOTES, helpers).
Adds strict values validation via values.schema.json and chart-testing install defaults under ci/.
Updates the main test workflow to build the operator image and load it into the kind cluster prior to chart installation tests.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
charts/openfga-operator/Chart.yaml	Defines the new chart metadata (name/version/appVersion, Artifact Hub annotations).
charts/openfga-operator/values.yaml	Adds default configurable values for image, securityContext, migration job tuning, and PDB.
charts/openfga-operator/values.schema.json	Enforces strict values validation and rejects unknown keys.
charts/openfga-operator/ci/default-values.yaml	Provides CI-oriented defaults for chart-testing installs.
charts/openfga-operator/.helmignore	Adds Helm packaging ignore patterns for the new chart.
charts/openfga-operator/templates/_helpers.tpl	Adds chart naming/labeling helpers and serviceAccountName logic.
charts/openfga-operator/templates/deployment.yaml	Defines the operator Deployment and wires flags/env/probes/resources.
charts/openfga-operator/templates/serviceaccount.yaml	Creates the ServiceAccount (when enabled) with optional annotations.
charts/openfga-operator/templates/role.yaml	Grants namespaced RBAC for Deployments/Jobs/ConfigMaps/Leases/Events.
charts/openfga-operator/templates/rolebinding.yaml	Binds the Role to the operator ServiceAccount in the operator namespace.
charts/openfga-operator/templates/pdb.yaml	Adds optional PDB templating that preserves explicit zero values.
charts/openfga-operator/templates/NOTES.txt	Adds post-install notes for checking operator status/logs/migrations.
charts/openfga-operator/tests/pdb_test.yaml	Adds Helm unit tests covering PDB defaulting and explicit zero values.
charts/openfga-operator/crds/README.md	Reserves the CRD directory for later stages (no CRDs in stage 1).
.github/workflows/test.yml	Builds/loads the operator image into kind before running `ct install`.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

…ant-k-code-authored-operator-chart

emilic and others added 15 commits August 24, 2026 19:03

feat: add PodDisruptionBudget to operator subchart

0ddd8ec

Prevents the operator from being evicted during node drains, which could leave the OpenFGA Deployment stuck at 0 replicas with no controller to scale it back up. Disabled by default; supports both minAvailable and maxUnavailable modes.

fix: document namespaceOverride in operator subchart values.yaml

63dca79

The _helpers.tpl namespace template already supported namespaceOverride but the value was undeclared in values.yaml, making it undiscoverable.

fix: require explicit serviceAccount.name when create=false

cbcb4fb

Falling back to the "default" ServiceAccount would silently grant operator RBAC permissions (Deployment patch, Job create/delete) to a shared SA. Require an explicit name so the user makes a deliberate choice.

fix: add missing global block to fix helm unit tests

08c6f36

docs(operator-chart): clarify watchNamespace default

19e85eb

fix(operator-chart): retain reviewed packaging fixes

0e075a4

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

fix(ci): retain pinned workflow actions

a9bc848

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Siddhant-K-code changed the title ~~feat(operator-chart): preserve authored Helm chart history~~ feat(operator-chart): package the migration operator Aug 24, 2026

Siddhant-K-code marked this pull request as ready for review August 24, 2026 14:05

Siddhant-K-code requested review from a team as code owners August 24, 2026 14:05

Copilot AI lite review requested due to automatic review settings August 24, 2026 14:05

Copilot started reviewing on behalf of Siddhant-K-code August 24, 2026 14:06 View session

Copilot AI reviewed Aug 24, 2026

View reviewed changes

Comment thread charts/openfga-operator/Chart.yaml

Comment thread .github/workflows/test.yml

Siddhant-K-code added 9 commits August 24, 2026 19:54

Merge branch siddhant-k-code-authored-migration-controller into siddh…

e4b3b8b

…ant-k-code-authored-operator-chart

fix(operator-chart): address review feedback

e556702

Merge branch siddhant-k-code-authored-migration-controller into siddh…

13da8d9

…ant-k-code-authored-operator-chart

Merge branch siddhant-k-code-authored-migration-controller into siddh…

0cc23d2

…ant-k-code-authored-operator-chart

Merge branch siddhant-k-code-authored-migration-controller into siddh…

638e93c

…ant-k-code-authored-operator-chart

Merge branch siddhant-k-code-authored-migration-controller into siddh…

3357341

…ant-k-code-authored-operator-chart

docs(operator): restore Helm chart configuration guidance

a1842df

Merge branch siddhant-k-code-authored-migration-controller into siddh…

39d3cf1

…ant-k-code-authored-operator-chart

fix(operator-chart): allow optimistic lifecycle patches

d8b4850

Navigation Menu

feat(operator-chart): package the migration operator - #347

feat(operator-chart): package the migration operator#347
Siddhant-K-code wants to merge 25 commits into
siddhant-k-code-authored-migration-controllerfrom
siddhant-k-code-authored-operator-chart

Siddhant-K-code commented Aug 24, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 24, 2026 •

edited

Loading

Review skipped

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Siddhant-K-code commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Stack

Attribution

Validation

Uh oh!

coderabbitai Bot commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Siddhant-K-code commented Aug 24, 2026 •

edited

Loading

coderabbitai Bot commented Aug 24, 2026 •

edited

Loading