151 Commits

Include renames

Author	SHA1	Message	Date
Aman GuptaandGitHub	f03cafff7c	✨ feat: add NetworkPolicies for open-cluster-management-hub namespace (#1634) ... Signed-off-by: Aman Gupta <amangta.gupta@gmail.com>	2026-08-03 08:16:39 +00:00
Artur Shad NikandGitHub	ac59d84dc7	fix: keep annotations flag ordering consistent on each reconcile (#1644) ... Signed-off-by: Artur Shad Nik <arturshadnik@gmail.com>	2026-07-31 00:33:19 +00:00
3 people	374cc31e22	✨ feat: add NetworkPolicies for open-cluster-management-agent namespace (#1627) ... * feat: add NetworkPolicies for open-cluster-management-agent namespace Ship 4 NetworkPolicy manifests with the klusterlet operator to restrict ingress/egress in the agent namespace, meeting CIS Kube benchmark 5.3.2 requirements. Policies added: - default-deny-all: baseline deny for all ingress/egress - allow-dns-and-api: DNS egress (OpenShift/kube-dns) + ports-only API server egress (TCP 443/6443) - klusterlet: operator egress to intra-namespace, addon namespace, and kubernetes.default.svc - klusterlet-agent: agent egress to kubernetes.default.svc, hub webhooks, and intra-namespace Also adds: - RBAC: networking.k8s.io/networkpolicies permissions in klusterlet ClusterRole - Cleanup: *networkingv1.NetworkPolicy case in CleanUpStaticObject and GenerateRelatedResource Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Mihir Lele <mlele@redhat.com> * feat: add NetworkPolicies feature gate and fix ingress rules - Add NetworkPolicies feature gate (disabled by default) following the existing AboutAPIEnabled/ClusterProperty pattern - Filter operator-internal feature gates before ConvertToFeatureGateFlags to avoid invalid agent CLI flags and ValidFeatureGates condition issues - Conditionally apply NP manifests in both reconcile() and clean() based on the feature gate - Fix missing intra-namespace ingress rules in klusterlet and klusterlet-agent NetworkPolicies (CodeRabbit review feedback) - Revert test counts to pre-NP values and add TestSyncDeployWithNetworkPolicies for the feature-enabled path Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Mihir Lele <mlele@redhat.com> * fix: address CodeRabbit nitpicks - import grouping and defensive slice copy - Move featuregate import to correct alphabetical position in its group - Use defensive slice copy (append into new slice) instead of direct assignment from package-level var before appending Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Mihir Lele <mlele@redhat.com> * fix: update OLM CSV with NetworkPolicy RBAC permissions The ClusterServiceVersion file needs to include the networking.k8s.io networkpolicies RBAC rules added to the klusterlet ClusterRole. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Mihir Lele <mlele@redhat.com> * test: enable NetworkPolicies feature gate in integration and e2e tests Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Mihir Lele <mlele@redhat.com> * test: update relatedResources counts for NetworkPolicy resources Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Mihir Lele <mlele@redhat.com> * fix: update expected registration deployment args count for RegistrationConfiguration defaults RegistrationConfiguration triggers kubebuilder defaults (KubeAPIQPS=50, KubeAPIBurst=100), adding --kube-api-qps and --kube-api-burst args. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Mihir Lele <mlele@redhat.com> * fix: clarify relatedResources count comment arithmetic Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Mihir Lele <mlele@redhat.com> --------- Signed-off-by: Mihir Lele <mlele@redhat.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-07-24 01:30:13 +00:00
3 people	3c9dc03159	✨ Add imagePullSecrets support to cluster-manager helm chart (#1539) ... * Add configurable image pull secrets to cluster-manager Allow referencing existing pull secrets via images.imagePullSecrets in the cluster-manager Helm chart. Propagate the configured secret name to hub components through the operator --image-pull-secret-name flag, including cluster importer renderers and registration controller RBAC. Signed-off-by: Enin <enin.kaduk@docker.com> * Require .name if imagePullSecrets is set, trim ws in normalization of imagePullSecrets Signed-off-by: Enin <enin.kaduk@docker.com> * update-csv Signed-off-by: Mike Ng <ming@redhat.com> --------- Signed-off-by: Enin <enin.kaduk@docker.com> Signed-off-by: Mike Ng <ming@redhat.com> Co-authored-by: Mike Ng <ming@redhat.com>	2026-07-09 06:03:57 +00:00
4 people	34650042f6	Add cluster.local FQDN to PlacementDebugServer cert SANs (#1533) ... The CertRotationController only included the short SVC hostname (service.namespace.svc) in the serving certificate SANs. Clients resolving via the full cluster.local FQDN get a TLS verification failure because the name doesn't match. Add the .svc.cluster.local form so both resolve correctly. Signed-off-by: Randy Bruno Piverger <21374229+Randy424@users.noreply.github.com> Co-authored-by: Randy Bruno Piverger <21374229+Randy424@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-05-28 02:57:45 +00:00
3 people	fc7aa234a3	Add rokej to pkg/operator OWNERS approvers and reviewers (#1537) ... Signed-off-by: Roke Jung <roke@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-05-21 01:26:09 +00:00
shivansh sinhaandGitHub	6ec234a49f	✨ Add TLS profile configuration support for spoke cluster agents (#1486) ... * Add TLS profile configuration support for spoke cluster agents Signed-off-by: shivansh-source <shivanshsiddhi1234@gmail.com> * everything implemented Signed-off-by: shivansh-source <shivanshsiddhi1234@gmail.com> * go lint fixed Signed-off-by: shivansh-source <shivanshsiddhi1234@gmail.com> * changes to fix ci Signed-off-by: shivansh-source <shivanshsiddhi1234@gmail.com> * linting save Signed-off-by: shivansh-source <shivanshsiddhi1234@gmail.com> * args count back to 8 , 7 was wrong assumption Signed-off-by: shivansh-source <shivanshsiddhi1234@gmail.com> * changed ConfigMap assertion at index[0] Signed-off-by: shivansh-source <shivanshsiddhi1234@gmail.com> * go fmt fixed Signed-off-by: shivansh-source <shivanshsiddhi1234@gmail.com> * everything fixed Signed-off-by: shivansh-source <shivanshsiddhi1234@gmail.com> * trying to fix e2e grpc error Signed-off-by: shivansh-source <shivanshsiddhi1234@gmail.com> * indent and also remove the reductant check Signed-off-by: shivansh-source <shivanshsiddhi1234@gmail.com> * added a case where function suceed but reurns nil data Signed-off-by: shivansh-source <shivanshsiddhi1234@gmail.com> * removed NotFound case we dont need it Signed-off-by: shivansh-source <shivanshsiddhi1234@gmail.com> --------- Signed-off-by: shivansh-source <shivanshsiddhi1234@gmail.com>	2026-05-19 09:16:24 +00:00
4 people	a5c22a2bfd	🌱 Add CertRotationController support for PlacementDebugServer TLS (#1494) ... * Add service-CA certificate support for PlacementDebugServer When the PlacementDebugServer feature gate is enabled, inject a serving-cert annotation into the placement service and mount the resulting TLS secret into the debug-server container. On OpenShift, the service-serving-cert controller creates a CA-signed certificate automatically. On non-OpenShift, optional: true allows the pod to start and library-go falls back to self-signed certificates. Signed-off-by: Randy Bruno Piverger <21374229+Randy424@users.noreply.github.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Rename fields to PlacementAnnotations and PlacementServingCertSecret Scope field names to Placement per review feedback, since these are only used for the placement service and extending to other services would require separate fields. Signed-off-by: Randy Bruno Piverger <21374229+Randy424@users.noreply.github.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Replace OCP annotation with CertRotationController for PlacementDebugServer TLS Replaces the OpenShift-specific serving-cert-secret-name annotation with the OCM-native CertRotationController to provision the PlacementDebugServer's TLS serving certificate. Follows the existing GRPC conditional target pattern: the placement-debug-serving-cert target is added/removed based on the PlacementDebugServer feature gate. Signed-off-by: Randy Bruno Piverger <21374229+Randy424@users.noreply.github.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Fix misleading error messages and import ordering Correct error messages in feature-disabled cleanup paths to accurately state the operation (secret deletion with feature disabled) instead of implying a deleted ClusterManager. Also move ocmfeature import into the open-cluster-management.io group where it belongs. Signed-off-by: Randy Bruno Piverger <21374229+Randy424@users.noreply.github.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Fix RBAC and gofmt for PlacementDebugServer cert rotation Add placement-debug-serving-cert to the cluster-manager ClusterRole resourceNames allowlist and fix gofmt alignment in two files. Root cause of E2E failures: the certRotationController attempts to delete the placement-debug-serving-cert secret when the feature gate is disabled (the default). The operator ClusterRole restricts secret delete/get/update/patch to an explicit resourceNames list. Because placement-debug-serving-cert was not in that list, the delete call returned 403 Forbidden — not 404 NotFound. The error handler in syncOne() only ignores IsNotFound, so 403 caused an early return before the signing CA and ca-bundle-configmap were ever created. The clusterManagerController.sync() blocks at line 312 waiting for ca-bundle-configmap to appear, so ObservedGeneration was never set, and all four E2E suites timed out in BeforeSuite after 150 seconds. The gofmt failures were cosmetic: extra alignment spaces in the PlacementDebugServingCertSecret/PlacementDebugService const block and the PlacementDebugServerEnabled/PlacementServingCertSecret struct fields. Signed-off-by: Randy Bruno Piverger <21374229+Randy424@users.noreply.github.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * retrigger CI Signed-off-by: Randy Bruno Piverger <21374229+Randy424@users.noreply.github.com> * retrigger CI Signed-off-by: Randy Bruno Piverger <21374229+Randy424@users.noreply.github.com> --------- Signed-off-by: Randy Bruno Piverger <21374229+Randy424@users.noreply.github.com> Co-authored-by: Randy Bruno Piverger <21374229+Randy424@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-05-15 01:53:10 +00:00
Roke JungandGitHub	2fd0e8b751	fix: tls-server-name field of external-managed-kubeconfig is missing (#1502) ... Signed-off-by: Roke Jung <roke@redhat.com>	2026-04-28 01:34:04 +00:00
Jian ZhuandGitHub	a5375afe6e	🌱 Copy TLS ConfigMap to addon namespaces in klusterlet operator (#1480) ... * 🌱 Copy TLS ConfigMap to addon namespaces in klusterlet operator Add AddonTLSConfigController that copies the ocm-tls-profile ConfigMap from the klusterlet operator namespace to addon namespaces (labeled with addon.open-cluster-management.io/namespace: "true"). This allows addon agents to read TLS profile settings without cross-namespace RBAC. The controller mirrors the existing addonsecretcontroller pattern: - Watches namespaces with the addon label via filtered informer - Copies ConfigMap data on namespace creation/update - Deletes target ConfigMap when source is removed - Skips update when target is already up-to-date Assisted by Claude Signed-off-by: zhujian <jiazhu@redhat.com> * 🌱 Fix ConfigMap update to preserve ResourceVersion and add stale-target test - Reuse existing ConfigMap object on update to preserve ResourceVersion, preventing optimistic concurrency conflicts - Add test case for stale target ConfigMap being updated Assisted by Claude Signed-off-by: zhujian <jiazhu@redhat.com> --------- Signed-off-by: zhujian <jiazhu@redhat.com>	2026-04-13 06:14:02 +00:00
Jian ZhuandGitHub	336e5b0e4d	🌱 Add TLS profile compliance for gRPC server (#1471) ... Add TLS profile compliance to the gRPC server, completing TLS support for all hub components. The operator reads the ocm-tls-profile ConfigMap and injects --tls-min-version and --tls-cipher-suites flags into the gRPC server deployment, matching the pattern used by all other hub component deployments. Changes: - Add TLS flag injection to gRPC server deployment manifest - Wire TLS flags from common options to gRPC server via closure - Call ApplyTLSToCommand for the 8443 health server endpoint - Apply TLS overrides to the 8090 gRPC port via SDK ApplyTLSFlags - Update vendored sdk-go with CipherSuites support for gRPC server - Add unit, controller, and integration tests Assisted by Claude Signed-off-by: zhujian <jiazhu@redhat.com>	2026-04-07 01:54:22 +00:00
3 people	391ae86bff	✨ split debug controller as standalone service with proper validation (#1461) ... * feat(placement): split debug controller as standalone service with proper validation 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Qing Hao <qhao@redhat.com> * feat(placement): make placement service conditional on PlacementDebugServer feature gate Make placement debug service deployment conditional based on PlacementDebugServer feature gate to allow users to control whether to expose the debug endpoint. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> Signed-off-by: Qing Hao <qhao@redhat.com> --------- Signed-off-by: Qing Hao <qhao@redhat.com> Co-authored-by: Claude <noreply@anthropic.com>	2026-04-03 02:40:24 +00:00
3 people	fc55a5df7c	🌱 Add TLS ConfigMap watch and restart for cluster-manager operator (#1452) ... * 🌱 Add TLS profile configuration support via flags and ConfigMap Add pkg/common/tls library to support TLS profile compliance for OCM components. This enables components to receive TLS configuration via command-line flags (--tls-min-version and --tls-cipher-suites) from operators, aligning with the upstream enhancement proposal for TLS profile configuration. Key features: - TLS version and cipher suite parsing from flags or ConfigMap - ConfigMap-based TLS configuration for operator use - ConfigMap watcher for operators to detect profile changes - OpenSSL cipher name mapping to Go crypto/tls constants - Safe defaults (TLS 1.2) when no configuration provided Updated pkg/common/options/webhook.go to use TLS library instead of hardcoded TLS 1.2, enabling webhook components to respect TLS flags injected by operators. This is the foundation for OCM TLS profile compliance, keeping upstream code OpenShift-agnostic while supporting dynamic TLS configuration. Related: open-cluster-management-io/enhancements#175 Signed-off-by: Jia Zhu <jiazhu@redhat.com> Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> Signed-off-by: zhujian <jiazhu@redhat.com> * 🌱 Add TLS ConfigMap watch and restart to cluster-manager operator Implement ConfigMap-based TLS profile compliance for cluster-manager operator with hash comparison to prevent infinite restart loops. Changes: - Add TLS ConfigMap informer to watch ocm-tls-profile ConfigMap - Load current TLS config at startup and compute hash - Add event handlers that compare ConfigMap hash with current hash - Only restart if ConfigMap content actually differs from current config - Add comprehensive logging for all scenarios Scenarios handled: ✅ ConfigMap exists at startup (hash matches) → no restart ✅ ConfigMap created after startup (hash differs) → restart to apply ✅ ConfigMap updated (new hash differs) → restart to apply ✅ ConfigMap deleted (was using it) → restart to use defaults Leader election behavior: - This code only runs on the leader pod (due to controllercmd framework) - Non-leader pods wait idle until they acquire leadership - New leaders load current ConfigMap state when they start, ensuring latest config - Only the active leader monitors ConfigMap changes and restarts 🤖 Generated with Claude Code Signed-off-by: zhujian <jiazhu@redhat.com> * 🌱 Inject TLS config flags into addon-webhook deployment Implement Case 2 pattern for addon-webhook TLS configuration: cluster-manager-operator loads TLS config from ConfigMap and injects it as flags into the addon-webhook deployment. Changes: - Add AddonWebhookTLSMinVersion and AddonWebhookTLSCipherSuites fields to HubConfig - Load TLS config once when creating ClusterManagerController - Pass TLS config strings as parameters to controller - Inject --tls-min-version and --tls-cipher-suites flags into addon-webhook deployment template This approach ensures addon-webhook receives TLS configuration via flags without needing to watch the ConfigMap itself. When the ConfigMap changes, cluster-manager-operator restarts, reloads the config, and updates the deployment with new flags. 🤖 Generated with Claude Code Signed-off-by: zhujian <jiazhu@redhat.com> * 🌱 Log TLS min version and cipher suites on startup Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: zhujian <jiazhu@redhat.com> * 🌱 Move TLS library to sdk-go and update vendor dependencies Relocates TLS config and cipher helpers from pkg/common/tls into the vendored open-cluster-management.io/sdk-go/pkg/tls package, adds a generic watcher utility, and updates all import references accordingly. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: zhujian <jiazhu@redhat.com> * 🌱 Inject TLS flags into all hub component deployments Extend TLS flag injection from addon-webhook-only to all seven hub deployments managed by cluster-manager-operator: Manifests (operator → deployment args): - Rename HubConfig.AddonWebhookTLS* → TLS* so the same fields drive all deployments rather than only the addon webhook - Add {{- if .TLSMinVersion }} blocks to all six remaining deployment manifests (registration/work/placement controllers and registration/work webhook servers) Controller binaries (registration, work, placement, addon-manager): - Add --tls-min-version and --tls-cipher-suites flags to the common Options struct so the binaries accept the injected flags without failing; the flags are stored for future use Note: library-go's NewCommandWithContext uses cmd.Run (not RunE), so there is no clean programmatic hook to inject TLS into the 8443 health server without bypassing library-go's own boilerplate (signal handling, log init, profiling). Upstream library-go also has no native TLS configuration API on ControllerCommandConfig or ControllerBuilder. The 8443 health server defaults to TLS 1.2 via SetRecommendedHTTPServingInfoDefaults; configuring it further requires an upstream library-go enhancement. Webhook binaries already fully support these flags via WebhookOptions; no binary changes are needed there. Signed-off-by: Jian Zhu <zhujian@redhat.com> Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: zhujian <jiazhu@redhat.com> * 🌱 Wire --tls-min-version to library-go 8443 health server via WithServingTLSConfig Now that library-go has WithServingTLSConfig (ServingMinTLSVersion / ServingCipherSuites fields + injection in StartController before WithServer is called), wire the --tls-min-version and --tls-cipher-suites flags from Options into it. ApplyTLSToCommand installs a PersistentPreRunE hook that calls CmdConfig.WithServingTLSConfig after cobra flag parsing completes. PersistentPreRunE runs before cmd.Run, so all library-go boilerplate (signal handling, logging, profiling) is preserved - unlike the previous approach of replacing RunE which silently bypassed it. Uses go mod replace → /Users/jiazhu/go/src/github.com/openshift/library-go for local development/testing; replace directive to be removed once the library-go PR is merged and vendored. Signed-off-by: Jian Zhu <zhujian@redhat.com> Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: zhujian <jiazhu@redhat.com> * 🌱 Switch to --config file for controller 8443 TLS configuration Replace the WithServingTLSConfig approach with library-go's native --config flag mechanism: ApplyTLSToCommand now installs a PersistentPreRunE hook that: 1. Writes a minimal GenericOperatorConfig YAML to a temp file under /tmp (which is mounted as an emptyDir in all hub controller deployments, so writing is safe even with readOnlyRootFilesystem) 2. Sets --config to point at the temp file before cmd.Run executes All library-go boilerplate in cmd.Run (signal handling, log init, profiling, basicFlags.Validate) is fully preserved because PersistentPreRunE runs before Run, not replacing it. Inside StartController, Config() reads the temp file; the TLS values survive SetRecommendedHTTPServingInfoDefaults because DefaultString only sets fields that are currently empty. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: zhujian <jiazhu@redhat.com> * 🌱 Add tests for TLS profile compliance Unit tests (pkg/common/options): - TestApplyTLSToCommand: table-driven test covering all flag combinations: no flags (no-op), min-version only, cipher-suites only, both set, and --config pre-set by user (injection skipped). Unit tests (clustermanager_controller): - TestSyncDeployWithTLSConfig: verifies that when tlsMinVersion / tlsCipherSuites are set on the controller, the --tls-min-version and --tls-cipher-suites flags appear in the args of every managed hub deployment (registration, registration-webhook, placement, work-webhook). Also verifies the flags are absent when TLS config is not set. Integration tests (test/integration/operator): - "should inject tls-min-version into all hub deployments when ocm-tls-profile ConfigMap exists": creates the ocm-tls-profile ConfigMap with minTLSVersion=VersionTLS13 in the operator namespace and verifies all six hub deployments gain --tls-min-version=VersionTLS13 in their container args. Signed-off-by: Jian Zhu <zhujian@redhat.com> Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: zhujian <jiazhu@redhat.com> * 🌱 Switch TLS cipher suite format from OpenSSL to IANA Update vendored sdk-go to use IANA cipher suite names (e.g. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) instead of OpenSSL names (e.g. ECDHE-RSA-AES128-GCM-SHA256). IANA is the canonical format used by Go's crypto/tls, the Kubernetes apiserver --tls-cipher-suites flag, and library-go's ServingInfo.CipherSuites. Using IANA names end-to-end eliminates the format mismatch that caused library-go's 8443 health server to reject cipher suite names written by ApplyTLSToCommand. The ocm-tls-profile ConfigMap now accepts IANA names only. The downstream tls-profile-sync sidecar is responsible for converting OpenShift TLSSecurityProfile (OpenSSL-style) names to IANA before writing the ConfigMap. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: zhujian <jiazhu@redhat.com> * 🌱 Fix TLS ConfigMap test: create ConfigMap before operator startup The previous test created ocm-tls-profile ConfigMap after the operator started, which triggered the watcher's hash-change detection and called os.Exit(0), killing the test process. Move the test into a dedicated Describe with BeforeEach that creates the ConfigMap before starting the operator so the watcher seeds its hash at startup and no restart is triggered. Also add hubWorkControllerDeployment to the tlsDeployments list since its manifest includes tls-min-version injection. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: zhujian <jiazhu@redhat.com> --------- Signed-off-by: Jia Zhu <jiazhu@redhat.com> Signed-off-by: zhujian <jiazhu@redhat.com> Signed-off-by: Jian Zhu <zhujian@redhat.com> Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>	2026-04-01 06:54:30 +00:00
Ben PerryandGitHub	ee64f234aa	Remove unsupported addon webhook hosted mode config (#1450) ... Signed-off-by: Ben Perry <bhperry94@gmail.com>	2026-03-20 01:32:02 +00:00
Ben PerryandGitHub	5a6bd191eb	🌱 addon webhook config (#1420) ... * Include API changes Signed-off-by: Ben Perry <bhperry94@gmail.com> * Addon webhook configuration Signed-off-by: Ben Perry <bhperry94@gmail.com> * Temp replace api with fork Signed-off-by: Ben Perry <bhperry94@gmail.com> * integration test addr Signed-off-by: Ben Perry <bhperry94@gmail.com> * Tidy Signed-off-by: Ben Perry <bhperry94@gmail.com> * Update api to main Signed-off-by: Ben Perry <bhperry94@gmail.com> --------- Signed-off-by: Ben Perry <bhperry94@gmail.com>	2026-03-17 03:41:06 +00:00
Ben PerryandGitHub	501c2d6d35	✨ Support default mode webhook networking configuration (#1035) ... * Support default mode webhook networking configuration Signed-off-by: Ben Perry <bhperry94@gmail.com> * Share common webhook config between hosted and default mode Signed-off-by: Ben Perry <bhperry94@gmail.com> * Nest all related bind configuration together Signed-off-by: Ben Perry <bhperry94@gmail.com> * Disable surge with hostNetwork to prevent port conflicts Signed-off-by: Ben Perry <bhperry94@gmail.com> * Remove dev dependency Signed-off-by: Ben Perry <bhperry94@gmail.com> * Set defaults in one place Signed-off-by: Ben Perry <bhperry94@gmail.com> --------- Signed-off-by: Ben Perry <bhperry94@gmail.com>	2026-02-28 02:43:41 +00:00
Yang LeandGitHub	9d1a993e2c	✨ add token driver for addon registration (#1343) ... Signed-off-by: Yang Le <yangle@redhat.com>	2026-01-28 05:41:52 +00:00
Guilhem LettronandGitHub	ac5f34839d	feat(manager): implement import-renderers (#1317) ... Signed-off-by: Guilhem Lettron <glettron@akamai.com>	2026-01-09 07:38:35 +00:00
3 people	1b40e72e0b	Fix race condition: wait for CA bundle ConfigMap before applying CRDs (#1309) ... The cluster manager controller was silently using a literal "placeholder" string as the CA bundle when the ca-bundle-configmap ConfigMap didn't exist yet. This caused CRDs to be created with an invalid caBundle field (cGxhY2Vob2xkZXI= which is base64 of "placeholder"), resulting in: 1. CRD conversion webhooks failing with "InvalidCABundle" error 2. CRDs not becoming Established 3. API endpoints not being registered 4. Dependent components (like MultiClusterHub) failing with: "no matches for kind ClusterManagementAddOn" The bug was a race condition between the cert rotation controller (which creates the ca-bundle-configmap) and the cluster manager controller (which reads it). When the ConfigMap was not found, the code did "// do nothing" and silently continued with the placeholder value. This fix: 1. Creates the hub namespace FIRST (before waiting for the CA bundle) to allow the cert rotation controller to create the ca-bundle-configmap 2. Then waits for the CA bundle ConfigMap to exist before proceeding 3. Requeues via AddAfter if the ConfigMap is not found, allowing the controller to gracefully retry until the cert rotation controller has created it This ensures CRDs are always created with valid CA bundles while avoiding the deadlock where clusterManagerController waited for CA bundle but certRotationController needed the namespace first. Changes based on review feedback: - Use requeue (AddAfter) instead of returning error (@elgnay) - Use contextual logging instead of klog.V(4).Infof (@qiujian16) The issue was discovered in OpenShift CI Prow jobs for ZTP hub deployment: - https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-openshift-kni-eco-ci-cd-ztp-left-shifting-kpi-ci-4.21-telcov10n-virtualised-single-node-hub-ztp/2005051399989104640 - https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-openshift-kni-eco-ci-cd-ztp-left-shifting-kpi-ci-4.21-telcov10n-virtualised-single-node-hub-ztp/2005219283428184064 Affected versions: ACM 2.16.0-113/114, MCE 2.11.0-142/143 on OCP 4.21.0-rc.0 Signed-off-by: Carlos Cardenosa <ccardeno@redhat.com> Co-authored-by: Claude <noreply@anthropic.com>	2026-01-07 14:35:55 +00:00
3 people	c516beffa6	✨ Add addon conversion webhook for v1alpha1/v1beta1 API migration (#1289) ... * Add addon conversion webhook for v1alpha1/v1beta1 API migration 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Qing Hao <qhao@redhat.com> * Fix GroupVersion compatibility issues after API dependency update This commit fixes compilation and test errors introduced by updating the API dependency to use native conversion functions from PR #411. Changes include: 1. Fix GroupVersion type mismatches across the codebase: - Updated OwnerReference creation to use schema.GroupVersion - Fixed webhook scheme registration to use proper GroupVersion type - Applied fixes to addon, placement, migration, work, and registration controllers 2. Enhance addon conversion webhook: - Use native API conversion functions from addon/v1beta1/conversion.go - Fix InstallNamespace annotation key to match expected format - Add custom logic to populate deprecated ConfigReferent field in ConfigReferences - Properly preserve annotations during v1alpha1 <-> v1beta1 conversion 3. Remove duplicate conversion code: - Deleted pkg/addon/webhook/conversion/ directory (~500 lines) - Now using native conversion functions from the API repository 4. Patch vendored addon-framework: - Fixed GroupVersion errors in agentdeploy utils All unit tests pass successfully (97 packages, 0 failures). Signed-off-by: Qing Hao <qhao@redhat.com> --------- Signed-off-by: Qing Hao <qhao@redhat.com> Co-authored-by: Claude <noreply@anthropic.com>	2025-12-24 08:26:35 +00:00
Jian QiuandGitHub	99265f6113	Refactor to contextual logging (#1283) ... Signed-off-by: Jian Qiu <jqiu@redhat.com>	2025-12-08 08:14:30 +00:00
Jian QiuandGitHub	33310619d9	🌱 use SDK basecontroller for better logging. (#1269) ... * Use basecontroller in sdk-go instead for better logging Signed-off-by: Jian Qiu <jqiu@redhat.com> * Rename to fakeSyncContext Signed-off-by: Jian Qiu <jqiu@redhat.com> --------- Signed-off-by: Jian Qiu <jqiu@redhat.com>	2025-12-01 03:07:02 +00:00
Zhiwei YinandGitHub	76449f862c	support loadBalancer for grpc endpoint type (#1255) ... Signed-off-by: Zhiwei Yin <zyin@redhat.com>	2025-11-19 02:39:54 +00:00
Zhiwei YinandGitHub	d80ec55608	add server configuration for clusterManager helm chart (#1239) ... Signed-off-by: Zhiwei Yin <zyin@redhat.com>	2025-11-05 06:44:23 +00:00
Jian QiuandGitHub	daa9b2fa54	🐛 Avoid redundant apply and get operation in work controller (#1196) ... * Remove event after apply and add jitter when requeue Signed-off-by: Jian Qiu <jqiu@redhat.com> * Change event handler to avoid redundant reconciles Signed-off-by: Jian Qiu <jqiu@redhat.com> * Add unit tests for onAdd and onUpdate function Signed-off-by: Jian Qiu <jqiu@redhat.com> * Fix interegation test fail Signed-off-by: Jian Qiu <jqiu@redhat.com> * Set resync interval to 4-6 mins Signed-off-by: Jian Qiu <jqiu@redhat.com> --------- Signed-off-by: Jian Qiu <jqiu@redhat.com>	2025-10-17 02:04:40 +00:00
Zhiwei YinandGitHub	4a8b2ddb5e	check registration webhook deployment for HubRegistrationDegraded condidtion (#1043) ... Signed-off-by: Zhiwei Yin <zyin@redhat.com>	2025-10-16 08:19:09 +00:00
Zhiwei YinandGitHub	35bab4476a	add grpc config into the bootstrap secret (#1194) ... Signed-off-by: Zhiwei Yin <zyin@redhat.com>	2025-09-24 03:35:31 +00:00
Jian QiuandGitHub	2f04992d6c	✨ Deleted manifestwork when it is completed for ttl seconds. (#1158) ... * Delete manifestwork when it is completed after ttl Signed-off-by: Jian Qiu <jqiu@redhat.com> * Fix integration test Signed-off-by: Jian Qiu <jqiu@redhat.com> * Update operator and e2e tests Signed-off-by: Jian Qiu <jqiu@redhat.com> --------- Signed-off-by: Jian Qiu <jqiu@redhat.com>	2025-09-23 02:23:47 +00:00
3 people	1125e4c33d	🌱 Remove resolved TODO comments (#1177) ... * 🧹 Remove resolved TODO comments - Remove TODO comment about confirming subject in CustomSignerConfigurations - Remove TODO comment about namespace value in manifestwork validating webhook 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: zhujian <jiazhu@redhat.com> * Ensure addon namespace and image pull secret sync - Remove outdated TODO comment about addon deployment in Hosted mode - Namespace creation is responsibility of addon developers - Image pull secrets are synced to namespaces with addon.open-cluster-management.io/namespace label by the AddonPullImageSecretController 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: zhujian <jiazhu@redhat.com> --------- Signed-off-by: zhujian <jiazhu@redhat.com> Co-authored-by: Claude <noreply@anthropic.com>	2025-09-15 02:20:53 +00:00
Yang LeandGitHub	6d4561ca9a	🐛 fix addon namespace deletion in multi-hub scenarios (#1153) ... Signed-off-by: Yang Le <yangle@redhat.com>	2025-09-11 07:54:39 +00:00
Jian QiuandGitHub	7d42f5f9f6	Requeue ssar check if only hubKubeConfigSecret is unauthorized (#1169) ... Signed-off-by: Jian Qiu <jqiu@redhat.com>	2025-09-05 02:26:30 +00:00
Jian QiuandGitHub	e2be403132	Update grpc configuration in operator API (#1159) ... Signed-off-by: Jian Qiu <jqiu@redhat.com>	2025-09-04 11:15:15 +00:00
Wei LiuandGitHub	74aa03b01c	using api auth consts (#1146) ... Signed-off-by: Wei Liu <liuweixa@redhat.com>	2025-08-28 07:15:36 +00:00
Wei LiuandGitHub	d7c82f4d4a	support grpc auto approval user config (#1145) ... Signed-off-by: Wei Liu <liuweixa@redhat.com>	2025-08-27 08:38:20 +00:00
Wei LiuandGitHub	5bac053fe0	using dir to reorg cluster-manager manifests (#1112) ... Signed-off-by: Wei Liu <liuweixa@redhat.com>	2025-08-18 09:38:43 +00:00
Wei LiuandGitHub	064c031545	should resync the grpc-server cert after clustermanager updated (#1126) ... Signed-off-by: Wei Liu <liuweixa@redhat.com>	2025-08-15 02:26:48 +00:00
Wei LiuandGitHub	6c4102f2ca	support deploying grpc with clustermanager/klusterlet (#1107) ... Signed-off-by: Wei Liu <liuweixa@redhat.com>	2025-08-06 09:45:10 +00:00
Jian ZhuandGitHub	aa660678a4	⚠️ Remove crd apiextensions v1beta1 (#1095) ... * Remove crd apiextensions v1beta1 Signed-off-by: zhujian <jiazhu@redhat.com> * fix unit test Signed-off-by: zhujian <jiazhu@redhat.com> --------- Signed-off-by: zhujian <jiazhu@redhat.com>	2025-07-30 01:59:42 +00:00
3 people	f989a37e1a	🌱 Upgrade golang to 1.24 and helm to 3.18.4 (#1085) ... * Upgrade golang to 1.24 Signed-off-by: zhujian <jiazhu@redhat.com> * Fix lint errors Co-authored-by: gemini <gemini@google.com> Signed-off-by: zhujian <jiazhu@redhat.com> * upgrade sdk-go to latest Signed-off-by: zhujian <jiazhu@redhat.com> --------- Signed-off-by: zhujian <jiazhu@redhat.com> Co-authored-by: gemini <gemini@google.com>	2025-07-28 02:13:36 +00:00
Zhiwei YinandGitHub	ce7d226bdd	🐛 fix the labels of hub deployments cannot be updated from the clustermanager (#1046) ... * remove labels from spec.selector for cluster manager deployments Signed-off-by: Zhiwei Yin <zyin@redhat.com> * refactor labels of operators Signed-off-by: Zhiwei Yin <zyin@redhat.com> --------- Signed-off-by: Zhiwei Yin <zyin@redhat.com>	2025-06-26 03:44:57 +00:00
JeffreyandGitHub	215cfed77e	Adding support for enableSyncLabels for clustermanager operator and registration controller (#1021) ... Signed-off-by: Jeffrey Wong <jeffreywong0417@gmail.com>	2025-06-12 02:32:36 +00:00
Yang LeandGitHub	0e2bbba84e	🐛 watch filtered configmaps & deployments to reduce memory usage of cluster-manager (#1030) ... Signed-off-by: Yang Le <yangle@redhat.com>	2025-06-10 06:05:27 +00:00
Jian QiuandGitHub	0734a0b763	Enable about-api when ClusterProperty featuregate is enabled (#1025) ... Signed-off-by: Jian Qiu <jqiu@redhat.com>	2025-06-06 10:11:30 +00:00
Zhiwei YinandGitHub	98443736e9	support set hub qps and burst for work in the klusterlet (#1014) ... Signed-off-by: Zhiwei Yin <zyin@redhat.com>	2025-05-30 02:03:07 +00:00
3 people	4cbb12d5a2	✨ add support for custom ClusterClaim configuration (#1004) ... * vendor api Signed-off-by: Omar Farag <omarfarag74@gmail.com> * add support for maxCustomClusterClaim Signed-off-by: Omar Farag <omarfarag74@gmail.com> * support ReservedClusterClaimSuffixes Signed-off-by: Omar Farag <omarfarag74@gmail.com> * add and use klusterletinformer Signed-off-by: Omar Farag <omarfarag74@gmail.com> * fix tests Signed-off-by: Omar Farag <omarfarag74@gmail.com> * update for change in clusterclaimconfiguration api Signed-off-by: Omar Farag <omarfarag74@gmail.com> * requested changes, clean up Signed-off-by: Omar Farag <omarfarag74@gmail.com> * Use flag to pass the reservedClusterClaimSuffixes Signed-off-by: zhujian <jiazhu@redhat.com> * Add cluster claim tests Signed-off-by: zhujian <jiazhu@redhat.com> * use StringSliceVar to parse the reserved cluster claim suffixes flag Signed-off-by: zhujian <jiazhu@redhat.com> * fix rebase issues Signed-off-by: zhujian <jiazhu@redhat.com> * address code review comments Signed-off-by: zhujian <jiazhu@redhat.com> --------- Signed-off-by: Omar Farag <omarfarag74@gmail.com> Signed-off-by: zhujian <jiazhu@redhat.com> Co-authored-by: Omar Farag <omarfarag74@gmail.com>	2025-05-27 12:09:41 +00:00
Zhiwei YinandGitHub	3d7d770712	remove deprecated work execution clusterrolebinding (#992) ... Signed-off-by: Zhiwei Yin <zyin@redhat.com>	2025-05-27 09:40:47 +00:00
Jian ZhuandGitHub	4d1b4ee8d5	✨ make work status sync interval configurable (#1009) ... * update api Signed-off-by: zhujian <jiazhu@redhat.com> * make work status sync interval configurable Signed-off-by: zhujian <jiazhu@redhat.com> * add unit tests Signed-off-by: zhujian <jiazhu@redhat.com> * fix flaky e2e tests Signed-off-by: zhujian <jiazhu@redhat.com> * drop go mod replace Signed-off-by: zhujian <jiazhu@redhat.com> --------- Signed-off-by: zhujian <jiazhu@redhat.com>	2025-05-27 07:47:58 +00:00
Jian ZhuandGitHub	73b6e2d514	check nil for LocalSecrets config (#962) ... Signed-off-by: zhujian <jiazhu@redhat.com>	2025-04-22 08:57:23 +00:00
Jian QiuandGitHub	2e63e4519a	Remove resource relating to k8s v1.11 (#942) ... 1. remove v1beta1 crds 2. remove static rbac files Signed-off-by: Jian Qiu <jqiu@redhat.com>	2025-04-09 07:49:13 +00:00
Ankit KurmiandGitHub	cd8827572e	feat: updated golang to v1.23.6 and related k8s.io packages (#870) ... Signed-off-by: Ankit152 <ankitkurmi152@gmail.com>	2025-04-09 07:46:27 +00:00