Skip to content

🌱 Move Registry YAML and remove use of namespace in kustomizations #2088

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
+290 −113
Closed

🌱 Move Registry YAML and remove use of namespace in kustomizations #2088

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b075ca2
Remove use of namespace in kustomize
tmshort Jul 3, 2025
427a442
Move e2e registry resources into config
tmshort Jul 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -291,6 +291,7 @@ e2e-metrics: #EXHELP Request metrics from prometheus; place in ARTIFACT_PATH if
http://localhost:30900/api/v1/query > $(if $(ARTIFACT_PATH),$(ARTIFACT_PATH),.)/metrics.out

.PHONY: extension-developer-e2e
extension-developer-e2e: SOURCE_MANIFEST := $(STANDARD_E2E_MANIFEST)
extension-developer-e2e: KIND_CLUSTER_NAME := operator-controller-ext-dev-e2e
extension-developer-e2e: export INSTALL_DEFAULT_CATALOGS := false
extension-developer-e2e: run image-registry test-ext-dev-e2e kind-clean #EXHELP Run extension-developer e2e on local kind cluster
Expand All @@ -308,6 +309,7 @@ post-upgrade-checks:
go test -count=1 -v ./test/upgrade-e2e/...

.PHONY: test-upgrade-e2e
test-upgrade-e2e: SOURCE_MANIFEST := $(STANDARD_E2E_MANIFEST)
test-upgrade-e2e: KIND_CLUSTER_NAME := operator-controller-upgrade-e2e
test-upgrade-e2e: export TEST_CLUSTER_CATALOG_NAME := test-catalog
test-upgrade-e2e: export TEST_CLUSTER_EXTENSION_NAME := test-package
Expand Down
1 change: 0 additions & 1 deletion config/base/catalogd/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
# Does not include the CRD, which must be added separately (it's non-namespaced)
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: olmv1-system
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, if we need to change the name, do we have to update all the files after this change?
Also, I haven't checked, but in the downstream setup, are we using a shell script to make the change, or are we properly setting the Kustomize value and then building?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could we not do the other changes and keep the namespace definition on the kustomize?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is making the kustomization more robust.

Downstream, the kustomization is done with a completely different overlay, and thus, sets the namespace appropriately according to openshift.

It's non-trivial to change the namespace via kustomize; there are also odd interdependencies based on ordering of components that may cause the namespaces of components outside of olmv1-system to be overwritten. For example, the CA components need(ed/s) to be last, or their cert-manager namespace will be overwritten with olmv1-system. Downstream doesn't have to deal with cert-manager, so there's no issues with namespace overwriting.

This change is something @joelanford had been looking at, in his reorganization of kustomize (tagging him as he has some interest here).

We never really gave people an easy way to change the namespace anyways, as the installation was done via the quickstart-generated files, and those don't have options to change the namespace.

If we want people to change the namespace, perhaps we should add functionality to the resulting install.sh script?

Copy link
Contributor

@camilamacedo86 camilamacedo86 Jul 14, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is my only concern in the PR. That said, if everyone is aligned with the change, I’m okay moving forward with it.

If we want to provide this flexibility, we’ll need to replace the namespace (ns) in all places eventually—regardless of whether we use Kustomize to build it or not.

The only downside I see is that this information isn't currently centralised, so we’ll need to remember to update every reference manually. That said, a simple find-and-replace should be enough to handle it if changes are needed later. We can either add validation to ensure/ci if we wish to do so

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There has been some discussion on moving the configuration from kustomize to helm... but that's a project in-and-of itself...

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm having problems with the upgrade-e2e, at this point, I want to split this into two PRs, the namespace change and the registry change.

namePrefix: catalogd-
resources:
- rbac
Expand Down
2 changes: 1 addition & 1 deletion config/base/catalogd/manager/manager.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: apps/v1
kind: Deployment
metadata:
name: controller-manager
namespace: system
namespace: olmv1-system
annotations:
kubectl.kubernetes.io/default-logs-container: manager
labels:
Expand Down
2 changes: 1 addition & 1 deletion config/base/catalogd/manager/network_policy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: controller-manager
namespace: system
namespace: olmv1-system
spec:
podSelector:
matchLabels:
Expand Down
2 changes: 1 addition & 1 deletion config/base/catalogd/manager/service.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ metadata:
app.kubernetes.io/part-of: olm
app.kubernetes.io/name: catalogd
name: service
namespace: system
namespace: olmv1-system
spec:
selector:
control-plane: catalogd-controller-manager
Expand Down
2 changes: 1 addition & 1 deletion config/base/catalogd/rbac/auth_proxy_role_binding.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,4 +12,4 @@ roleRef:
subjects:
- kind: ServiceAccount
name: controller-manager
namespace: system
namespace: olmv1-system
1 change: 1 addition & 0 deletions config/base/catalogd/rbac/leader_election_role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ metadata:
app.kubernetes.io/part-of: olm
app.kubernetes.io/name: catalogd
name: leader-election-role
namespace: olmv1-system
rules:
- apiGroups:
- ""
Expand Down
3 changes: 2 additions & 1 deletion config/base/catalogd/rbac/leader_election_role_binding.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,12 @@ metadata:
app.kubernetes.io/part-of: olm
app.kubernetes.io/name: catalogd
name: leader-election-rolebinding
namespace: olmv1-system
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: leader-election-role
subjects:
- kind: ServiceAccount
name: controller-manager
namespace: system
namespace: olmv1-system
2 changes: 1 addition & 1 deletion config/base/catalogd/rbac/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: manager-role
namespace: system
namespace: olmv1-system
rules:
- apiGroups:
- ""
Expand Down
6 changes: 3 additions & 3 deletions config/base/catalogd/rbac/role_binding.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ roleRef:
subjects:
- kind: ServiceAccount
name: controller-manager
namespace: system
namespace: olmv1-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
Expand All @@ -21,12 +21,12 @@ metadata:
app.kubernetes.io/part-of: olm
app.kubernetes.io/name: catalogd
name: manager-rolebinding
namespace: system
namespace: olmv1-system
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: manager-role
subjects:
- kind: ServiceAccount
name: controller-manager
namespace: system
namespace: olmv1-system
2 changes: 1 addition & 1 deletion config/base/catalogd/rbac/service_account.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,4 +5,4 @@ metadata:
app.kubernetes.io/part-of: olm
app.kubernetes.io/name: catalogd
name: controller-manager
namespace: system
namespace: olmv1-system
2 changes: 1 addition & 1 deletion config/base/common/namespace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,4 +5,4 @@ metadata:
app.kubernetes.io/part-of: olm
pod-security.kubernetes.io/enforce: restricted
pod-security.kubernetes.io/enforce-version: latest
name: system
name: olmv1-system
2 changes: 1 addition & 1 deletion config/base/common/network_policy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-all-traffic
namespace: system
namespace: olmv1-system
spec:
podSelector: { }
policyTypes:
Expand Down
1 change: 0 additions & 1 deletion config/base/operator-controller/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
# Does not include the CRD, which must be added separately (it's non-namespaced)
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: olmv1-system
namePrefix: operator-controller-
resources:
- rbac
Expand Down
2 changes: 1 addition & 1 deletion config/base/operator-controller/manager/manager.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: apps/v1
kind: Deployment
metadata:
name: controller-manager
namespace: system
namespace: olmv1-system
annotations:
kubectl.kubernetes.io/default-logs-container: manager
labels:
Expand Down
2 changes: 1 addition & 1 deletion config/base/operator-controller/manager/network_policy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: controller-manager
namespace: system
namespace: olmv1-system
spec:
podSelector:
matchLabels:
Expand Down
2 changes: 1 addition & 1 deletion config/base/operator-controller/manager/service.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: v1
kind: Service
metadata:
name: service
namespace: system
namespace: olmv1-system
labels:
control-plane: operator-controller-controller-manager
spec:
Expand Down
2 changes: 1 addition & 1 deletion config/base/operator-controller/rbac/auth_proxy_role_binding.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,4 +9,4 @@ roleRef:
subjects:
- kind: ServiceAccount
name: controller-manager
namespace: system
namespace: olmv1-system
1 change: 1 addition & 0 deletions config/base/operator-controller/rbac/leader_election_role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: leader-election-role
namespace: olmv1-system
rules:
- apiGroups:
- ""
Expand Down
3 changes: 2 additions & 1 deletion config/base/operator-controller/rbac/leader_election_role_binding.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,12 @@ apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: leader-election-rolebinding
namespace: olmv1-system
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: leader-election-role
subjects:
- kind: ServiceAccount
name: controller-manager
namespace: system
namespace: olmv1-system
2 changes: 1 addition & 1 deletion config/base/operator-controller/rbac/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: manager-role
namespace: system
namespace: olmv1-system
rules:
- apiGroups:
- ""
Expand Down
6 changes: 3 additions & 3 deletions config/base/operator-controller/rbac/role_binding.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,18 +9,18 @@ roleRef:
subjects:
- kind: ServiceAccount
name: controller-manager
namespace: system
namespace: olmv1-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: manager-rolebinding
namespace: system
namespace: olmv1-system
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: manager-role
subjects:
- kind: ServiceAccount
name: controller-manager
namespace: system
namespace: olmv1-system
2 changes: 1 addition & 1 deletion config/base/operator-controller/rbac/service_account.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@ apiVersion: v1
kind: ServiceAccount
metadata:
name: controller-manager
namespace: system
namespace: olmv1-system
1 change: 0 additions & 1 deletion config/components/cert-manager/catalogd/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1alpha1
kind: Component
namespace: olmv1-system
resources:
- resources/certificate.yaml
patches:
Expand Down
2 changes: 1 addition & 1 deletion config/components/cert-manager/catalogd/resources/certificate.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: catalogd-service-cert
namespace: system
namespace: olmv1-system
spec:
secretName: catalogd-service-cert-git-version
dnsNames:
Expand Down
1 change: 0 additions & 1 deletion config/components/cert-manager/operator-controller/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1alpha1
kind: Component
namespace: olmv1-system
resources:
- resources/manager_cert.yaml
patches:
Expand Down
1 change: 1 addition & 0 deletions config/components/cert-manager/operator-controller/resources/manager_cert.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: olmv1-cert
namespace: olmv1-system
spec:
secretName: olmv1-cert
dnsNames:
Expand Down
1 change: 0 additions & 1 deletion config/components/e2e/coverage/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1alpha1
kind: Component
namespace: olmv1-system
resources:
- manager_e2e_coverage_pvc.yaml
- manager_e2e_coverage_copy_pod.yaml
Expand Down
1 change: 1 addition & 0 deletions config/components/e2e/coverage/manager_e2e_coverage_copy_pod.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ apiVersion: v1
kind: Pod
metadata:
name: e2e-coverage-copy-pod
namespace: olmv1-system
spec:
restartPolicy: Never
securityContext:
Expand Down
1 change: 1 addition & 0 deletions config/components/e2e/coverage/manager_e2e_coverage_pvc.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: e2e-coverage
namespace: olmv1-system
spec:
accessModes:
- ReadWriteOnce
Expand Down
2 changes: 1 addition & 1 deletion config/components/e2e/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1alpha1
kind: Component
components:
- coverage
- registries-conf
- registry
20 changes: 20 additions & 0 deletions config/components/e2e/registry/certificate.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: operator-controller-e2e-registry
namespace: operator-controller-e2e
spec:
secretName: operator-controller-e2e-registry
isCA: true
dnsNames:
- docker-registry.operator-controller-e2e.svc
- docker-registry.operator-controller-e2e.svc.cluster.local
- docker-registry-controller-manager-metrics-service.operator-controller-e2e.svc
- docker-registry-controller-manager-metrics-service.operator-controller-e2e.svc.cluster.local
privateKey:
algorithm: ECDSA
size: 256
issuerRef:
name: olmv1-ca
kind: ClusterIssuer
group: cert-manager.io
2 changes: 1 addition & 1 deletion ...tries-conf/registries_conf_configmap.yaml → ...ig/components/e2e/registry/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: v1
kind: ConfigMap
metadata:
name: e2e-registries-conf
namespace: system
namespace: olmv1-system
data:
registries.conf: |
[[registry]]
Expand Down
35 changes: 35 additions & 0 deletions config/components/e2e/registry/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: docker-registry
namespace: operator-controller-e2e
labels:
app: registry
spec:
replicas: 1
selector:
matchLabels:
app: registry
template:
metadata:
labels:
app: registry
spec:
containers:
- name: registry
image: registry:3
imagePullPolicy: IfNotPresent
volumeMounts:
- name: certs-vol
mountPath: "/certs"
env:
- name: REGISTRY_HTTP_ADDR
value: ":5000"
- name: REGISTRY_HTTP_TLS_CERTIFICATE
value: "/certs/tls.crt"
- name: REGISTRY_HTTP_TLS_KEY
value: "/certs/tls.key"
volumes:
- name: certs-vol
secret:
secretName: operator-controller-e2e-registry
7 changes: 5 additions & 2 deletions ...ts/e2e/registries-conf/kustomization.yaml → ...omponents/e2e/registry/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,10 @@
apiVersion: kustomize.config.k8s.io/v1alpha1
kind: Component
namespace: olmv1-system
resources:
- registries_conf_configmap.yaml
- certificate.yaml
- deployment.yaml
- configmap.yaml
- service.yaml
- namespace.yaml
patches:
- path: manager_e2e_registries_conf_patch.yaml
0 ...nf/manager_e2e_registries_conf_patch.yaml → ...ry/manager_e2e_registries_conf_patch.yaml
View file
Open in desktop
File renamed without changes.
4 changes: 4 additions & 0 deletions config/components/e2e/registry/namespace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: operator-controller-e2e
14 changes: 14 additions & 0 deletions config/components/e2e/registry/service.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
apiVersion: v1
kind: Service
metadata:
name: docker-registry
namespace: operator-controller-e2e
spec:
selector:
app: registry
ports:
- name: http
port: 5000
targetPort: 5000
nodePort: 30000
type: NodePort
Loading
Loading