✨ Move ClusterObjectSet reconciliation to standalone object-controller

cmd/operator-controller/main.go

@@ -30,15 +30,12 @@ import (
 
 	"github.com/spf13/cobra"
 	"go.podman.io/image/v5/types"
-	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	apiextensionsv1client "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1"
 	k8slabels "k8s.io/apimachinery/pkg/labels"
 	k8stypes "k8s.io/apimachinery/pkg/types"
 	apimachineryrand "k8s.io/apimachinery/pkg/util/rand"
-	"k8s.io/client-go/discovery"
-	"k8s.io/client-go/discovery/cached/memory"
 	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
 	"k8s.io/klog/v2"
@@ -61,7 +58,6 @@ import (
 	helmclient "github.com/operator-framework/helm-operator-plugins/pkg/client"
 
 	ocv1 "github.com/operator-framework/operator-controller/api/v1"
-	clusterobjctrl "github.com/operator-framework/operator-controller/internal/object-controller/controllers"
 	"github.com/operator-framework/operator-controller/internal/operator-controller/action"
 	"github.com/operator-framework/operator-controller/internal/operator-controller/applier"
 	"github.com/operator-framework/operator-controller/internal/operator-controller/catalogmetadata/cache"
@@ -119,7 +115,6 @@ type boxcutterReconcilerConfigurator struct {
 	imageCache            imageutil.Cache
 	imagePuller           imageutil.Puller
 	finalizers            crfinalizer.Finalizers
-	trackingCache         managedcache.TrackingCache
 }
 
 type helmReconcilerConfigurator struct {
@@ -461,26 +456,22 @@ func run() error {
 		crdupgradesafety.NewPreflight(aeClient.CustomResourceDefinitions()),
 	}
 
-	trackingCache, err := managedcache.NewTrackingCache(
-		ctrl.Log.WithName("trackingCache"),
-		mgr.GetConfig(),
-		crcache.Options{
-			Scheme: mgr.GetScheme(), Mapper: mgr.GetRESTMapper(),
-		},
-	)
-	if err != nil {
-		setupLog.Error(err, "unable to create tracking cache")
-		return err
-	}
-	if err := mgr.Add(trackingCache); err != nil {
-		setupLog.Error(err, "unable to add tracking cache to manager")
-		return err
-	}
-
+	var trackingCache managedcache.TrackingCache
 	var ctrlBuilderOpts []controllers.ControllerBuilderOption
 	if features.OperatorControllerFeatureGate.Enabled(features.BoxcutterRuntime) {
 		ctrlBuilderOpts = append(ctrlBuilderOpts, controllers.WithOwns(&ocv1.ClusterObjectSet{}))
 	} else {
+		trackingCache, err = managedcache.NewTrackingCache(
+			ctrl.Log.WithName("trackingCache"),
+			mgr.GetConfig(),
+			crcache.Options{Scheme: mgr.GetScheme(), Mapper: mgr.GetRESTMapper()},
+		)
+		if err != nil {
+			return fmt.Errorf("unable to create tracking cache: %w", err)
+		}
+		if err := mgr.Add(trackingCache); err != nil {
+			return fmt.Errorf("unable to add tracking cache to manager: %w", err)
+		}
 		ctrlBuilderOpts = append(ctrlBuilderOpts, controllers.WithWatchesRawSource(
 			trackingCache.Source(
 				crhandler.EnqueueRequestForOwner(mgr.GetScheme(), mgr.GetRESTMapper(), &ocv1.ClusterExtension{}),
@@ -520,7 +511,6 @@ func run() error {
 			imageCache:            imageCache,
 			imagePuller:           imagePuller,
 			finalizers:            clusterExtensionFinalizers,
-			trackingCache:         trackingCache,
 		}
 	} else {
 		cerCfg = &helmReconcilerConfigurator{
@@ -665,38 +655,6 @@ func (c *boxcutterReconcilerConfigurator) Configure(ceReconciler *controllers.Cl
 		controllers.ApplyBundleWithBoxcutter(appl.Apply),
 	}
 
-	baseDiscoveryClient, err := discovery.NewDiscoveryClientForConfig(c.mgr.GetConfig())
-	if err != nil {
-		return fmt.Errorf("unable to create discovery client: %w", err)
-	}
-
-	// Wrap the discovery client with caching to reduce memory usage from repeated OpenAPI schema fetches
-	discoveryClient := memory.NewMemCacheClient(baseDiscoveryClient)
-
-	revisionEngineFactory, err := clusterobjctrl.NewDefaultRevisionEngineFactory(
-		c.mgr.GetScheme(),
-		c.trackingCache,
-		discoveryClient,
-		c.mgr.GetRESTMapper(),
-		fieldOwnerPrefix,
-		c.mgr.GetConfig(),
-	)
-	if err != nil {
-		return fmt.Errorf("unable to create revision engine factory: %w", err)
-	}
-
-	cosClient := &secretFallbackClient{
-		Client:          c.mgr.GetClient(),
-		apiReader:       c.mgr.GetAPIReader(),
-		systemNamespace: cfg.systemNamespace,
-	}
-	if err = (&clusterobjctrl.ClusterObjectSetReconciler{
-		Client:                cosClient,
-		RevisionEngineFactory: revisionEngineFactory,
-		TrackingCache:         c.trackingCache,
-	}).SetupWithManager(c.mgr); err != nil {
-		return fmt.Errorf("unable to setup ClusterObjectSet controller: %w", err)
-	}
 	return nil
 }
 
@@ -761,18 +719,3 @@ func main() {
 		os.Exit(1)
 	}
 }
-
-// secretFallbackClient wraps a cached client.Client and falls back to direct
-// API reads for Secrets outside the system namespace, where the cache does not watch.
-type secretFallbackClient struct {
-	client.Client
-	apiReader       client.Reader
-	systemNamespace string
-}
-
-func (c *secretFallbackClient) Get(ctx context.Context, key client.ObjectKey, obj client.Object, opts ...client.GetOption) error {
-	if _, isSecret := obj.(*corev1.Secret); isSecret && key.Namespace != c.systemNamespace {
-		return c.apiReader.Get(ctx, key, obj, opts...)
-	}
-	return c.Client.Get(ctx, key, obj, opts...)
-}

helm/experimental.yaml

@@ -1,11 +1,13 @@
 # experimental values for OLMv1.
 # This is a YAML-formatted file.
 # Declare variables to be passed into your templates.
-
 # List of enabled experimental features for operator-controller
 # Use with {{- if has "FeatureGate" .Values.options.operatorController.features.enabled }}
 # to pull in resources or additions
 options:
+  objectController:
+    deployment:
+      replicas: 2
   operatorController:
     deployment:
       replicas: 2
@@ -18,9 +20,9 @@ options:
         - WebhookProviderCertManager
       disabled:
         - WebhookProviderOpenshiftServiceCA
-# List of enabled experimental features for catalogd
-# Use with {{- if has "FeatureGate" .Values.options.catalogd.features.enabled }}
-# to pull in resources or additions
+  # List of enabled experimental features for catalogd
+  # Use with {{- if has "FeatureGate" .Values.options.catalogd.features.enabled }}
+  # to pull in resources or additions
   catalogd:
     deployment:
       replicas: 2
@@ -29,5 +31,5 @@ options:
         - APIV1MetasHandler
         - GraphQLCatalogQueries
       disabled: []
-# This can be one of: standard or experimental
+  # This can be one of: standard or experimental
   featureSet: experimental

helm/olmv1/templates/_helpers.tpl

@@ -59,14 +59,30 @@ olmv1
 {{- end -}}
 
 {{/*
-Prepare component resources without enabling a second ClusterObjectSet reconciler.
-The deployment and reconciliation handover will replace this activation guard.
+Default to a separate object-controller whenever operator-controller uses Boxcutter.
+An explicit enabled value also permits installing object-controller on its own.
+Disabling it while Boxcutter is active would leave ClusterObjectSets without a controller.
+Return an empty string when disabled so the helper can be used in conditionals.
 */}}
 {{- define "objectController.enabled" -}}
-{{- if hasKey .Values.options "objectController" -}}
-{{- if .Values.options.objectController.enabled -}}
-{{- fail "object-controller deployment support requires the reconciliation cutover" -}}
+{{- $operatorController := .Values.options.operatorController | default dict -}}
+{{- $features := $operatorController.features | default dict -}}
+{{- if and $operatorController.enabled (has "BoxcutterRuntime" $features.enabled) (has "BoxcutterRuntime" $features.disabled) -}}
+{{- fail "BoxcutterRuntime cannot appear in both options.operatorController.features.enabled and options.operatorController.features.disabled" -}}
 {{- end -}}
+{{- $boxcutterEnabled := and $operatorController.enabled (has "BoxcutterRuntime" $features.enabled) (not (has "BoxcutterRuntime" $features.disabled)) -}}
+{{- if and $boxcutterEnabled (eq (toJson .Values.options.objectController.enabled) "false") -}}
+{{- fail "options.objectController.enabled=false is incompatible with enabled BoxcutterRuntime" -}}
+{{- end -}}
+{{- $enabled := .Values.options.objectController.enabled -}}
+{{- if eq (toJson $enabled) "null" -}}
+{{- $enabled = $boxcutterEnabled -}}
+{{- end -}}
+{{- if $enabled -}}
+{{- if ne .Values.options.featureSet "experimental" -}}
+{{- fail "objectController requires options.featureSet=experimental" -}}
+{{- end -}}
+true
 {{- end -}}
 {{- end -}}
 

helm/olmv1/templates/crds/customresourcedefinition-clusterobjectsets.olm.operatorframework.io.yml

@@ -1,11 +1,3 @@
-{{- if .Values.options.operatorController.enabled }}
-{{- if (eq .Values.options.featureSet "standard") }}
-{{- /* Add when GA: tpl (.Files.Get "base/object-controller/crd/standard/olm.operatorframework.io_clusterobjectsetss.yaml") . */}}
-{{- else if (eq .Values.options.featureSet "experimental") }}
-{{- if has "BoxcutterRuntime" .Values.options.operatorController.features.enabled }}
+{{- if include "objectController.enabled" . }}
 {{ tpl (.Files.Get "base/object-controller/crd/experimental/olm.operatorframework.io_clusterobjectsets.yaml") . }}
 {{- end }}
-{{- else }}
-{{- fail "options.featureSet must be set to one of: {standard,experimental}" }}
-{{- end }}
-{{- end }}

helm/olmv1/values.yaml

@@ -4,7 +4,7 @@
 # List of components to include
 options:
   objectController:
-    # Activation is reserved until the deployment and reconciliation cutover.
+    # null follows operatorController's BoxcutterRuntime gate. Set true to deploy independently.
     enabled: null
     deployment:
       image: quay.io/operator-framework/object-controller:devel