Operator SDK – Upgrade SDK Version

Docs: Backport Policy

Mon, 01 Jan 0001 00:00:00 +0000

Mainly critical issue fixes are backported to the most recent minor release. Special backport requests can be discussed during the weekly Triage meeting; this does not guarantee an exceptional backport will be created. Occasionally non-critical issue fixes will be backported, either at an approver’s discretion or by request as noted above. For information on contacting maintainers and attending meetings, check the community repository.

Process

Typically an issue will be fixed in the master branch, which will then be cherry-picked to the most recent release’s branch. Those with approver permissions and above can create a cherry-pick PR, assuming no conflicts, by commenting /cherry-pick <release branch> in the PR fixing the issue in master. Fixes that are only relevant to a specific release branch can be made against that branch directly.

Docs: v1.42.2

Mon, 01 Jan 0001 00:00:00 +0000

There are no migrations for this release! 🎉

Docs: v1.42.1

Mon, 01 Jan 0001 00:00:00 +0000

There are no migrations for this release! 🎉

Docs: v1.42.0

Mon, 01 Jan 0001 00:00:00 +0000

There are no migrations for this release! 🎉

Docs: v1.41.0

Mon, 01 Jan 0001 00:00:00 +0000

Upgrade Go version to 1.24

Update the Go version used to 1.24. This affects:

Dockerfile:

- FROM golang:1.23 AS builder
+ FROM golang:1.24 AS builder

.devcontainer/devcontainer.json:

- "image": "golang:1.23",
+ "image": "golang:1.24",

go.mod:

- go 1.23.0
+ go 1.24.0

See #6954 for more details.

Upgrade golangci-lint and use v2 config

Update golangci-lint usage across the project:

Makefile:

- GOLANGCI_LINT_VERSION ?= v1.63.4
+ GOLANGCI_LINT_VERSION ?= v2.1.0

- $(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/cmd/golangci-lint,$(GOLANGCI_LINT_VERSION))
+ $(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/v2/cmd/golangci-lint,$(GOLANGCI_LINT_VERSION))

GitHub Actions Workflow:

- uses: golangci/golangci-lint-action@v6
+ uses: golangci/golangci-lint-action@v8

.golangci.yml:
Convert to v2 layout with keys like version, linters, settings, formatters, exclusions. You might want to copy and paste the file from the Memcached sample from the tag release v1.40.0: testdata/go/v4/memcached-operator/.golangci.yml

See #6954 for more details.

Upgrade controller-gen to `v0.18.0`

Update controller-gen tooling and annotations:

Makefile:

- CONTROLLER_TOOLS_VERSION ?= v0.17.2
+ CONTROLLER_TOOLS_VERSION ?= v0.18.0

Run make generate to regenerate code and manifests with the new version.

See #6954 for more details.

Upgrade controller-runtime to `v0.21.0`

Update the go.mod import:

- sigs.k8s.io/controller-runtime v0.20.4
+ sigs.k8s.io/controller-runtime v0.21.0

Run go mod tidy to upgrade the k8s dependencies.

See #6954 for more details.

Add cluster setup for e2e tests in Makefile and update CI workflow

Remove direct Kind commands in GitHub workflows:

Removed:

- name: Create kind cluster
  run: kind create cluster

Added to Makefile:

KIND_CLUSTER ?= <project-name>-test-e2e

.PHONY: setup-test-e2e
setup-test-e2e: ## Set up a Kind cluster for e2e tests if it does not exist
  @command -v $(KIND) >/dev/null 2>&1 || { \
    echo "Kind is not installed. Please install Kind manually."; \
    exit 1; \
  }
  @case "$$($(KIND) get clusters)" in \
    *"$(KIND_CLUSTER)"*) \
      echo "Kind cluster '$(KIND_CLUSTER)' already exists. Skipping creation." ;; \
    *) \
    echo "Creating Kind cluster '$(KIND_CLUSTER)'..."; \
    $(KIND) create cluster --name $(KIND_CLUSTER) ;; \
  esac

.PHONY: cleanup-test-e2e
cleanup-test-e2e:
	$(KIND) delete cluster --name $(KIND_CLUSTER)

Update test-e2e target to call these appropriately.

See #6954 for more details.

Docs: v1.40.0

Mon, 01 Jan 0001 00:00:00 +0000

Upgrade OPM version to v1.55.0 in the Makefile

Update the OPM version in your Makefile to v1.55.0:

-const opmVersion = "v1.23.0"
+const opmVersion = "v1.55.0"

-       curl -sSLo $(OPM) https://github.com/operator-framework/operator-registry/releases/download/v1.23.0/$${OS}-$${ARCH}-opm ;\
+       curl -sSLo $(OPM) https://github.com/operator-framework/operator-registry/releases/download/v1.55.0/$${OS}-$${ARCH}-opm ;\

See #6953 for more details.

Add a devcontainer for Go-based operators

Create the devcontainer configuration in the root of the repository under .devcontainer.

Create a new directory called .devcontainer in the root of your project.
Copy the contents of the testdata/go/v4/memcached-operator/.devcontainer available in the Operator SDK repository for the tag release v1.40.0.

See #6928 for more details.

Add new GitHub actions for Go-based operators

Add the actions configuration in the .github/workflows directory. The new actions are:

lint.yaml: Lint the code using golangci-lint
test.yaml: Run the tests using go test
test-e2e.yaml: Run the e2e tests using go test You can obtain this configuration to be added to your project by looking at the files available in testdata/go/v4/memcached-operator/.github/workflows for this release. testdata/go/v4/memcached-operator/.github/workflows

See #6928 for more details.

Update your project to properly support TLS certificates for webhooks and metrics server

Update the main.go file in your project to support TLS certificates for webhooks and metrics server.

Add the new flag definitions to accept custom certificate file paths and names:

func main() {
    ...
    var metricsCertPath, metricsCertName, metricsCertKey string
    var webhookCertPath, webhookCertName, webhookCertKey string
    ...
    flag.StringVar(&webhookCertPath, "webhook-cert-path", "", "The directory that contains the webhook certificate.")
    flag.StringVar(&webhookCertName, "webhook-cert-name", "tls.crt", "The name of the webhook certificate file.")
    flag.StringVar(&webhookCertKey, "webhook-cert-key", "tls.key", "The name of the webhook key file.")
    flag.StringVar(&metricsCertPath, "metrics-cert-path", "", "The directory that contains the metrics server certificate.")
    flag.StringVar(&metricsCertName, "metrics-cert-name", "tls.crt", "The name of the metrics server certificate file.")
    flag.StringVar(&metricsCertKey, "metrics-cert-key", "tls.key", "The name of the metrics server key file.")

After this conditional check:

if !enableHTTP2 {
    tlsOpts = append(tlsOpts, disableHTTP2)
}

Insert the following code to configure certificate watchers for webhooks and metrics:

var metricsCertWatcher, webhookCertWatcher *certwatcher.CertWatcher
webhookTLSOpts := tlsOpts

if len(webhookCertPath) > 0 {
    setupLog.Info("Initializing webhook certificate watcher using provided certificates",
        "webhook-cert-path", webhookCertPath, "webhook-cert-name", webhookCertName, "webhook-cert-key", webhookCertKey)

    var err error
    webhookCertWatcher, err = certwatcher.New(
        filepath.Join(webhookCertPath, webhookCertName),
        filepath.Join(webhookCertPath, webhookCertKey),
    )
    if err != nil {
        setupLog.Error(err, "Failed to initialize webhook certificate watcher")
        os.Exit(1)
    }

    webhookTLSOpts = append(webhookTLSOpts, func(config *tls.Config) {
        config.GetCertificate = webhookCertWatcher.GetCertificate
    })
}

Update the webhook server TLS options:

Replace:
```
TLSOpts: tlsOpts,
```
With:
```
TLSOpts: webhookTLSOpts,
```

Before initializing the manager, configure the metrics certificate watcher if metrics certs are provided:

if len(metricsCertPath) > 0 {
    setupLog.Info("Initializing metrics certificate watcher using provided certificates",
        "metrics-cert-path", metricsCertPath, "metrics-cert-name", metricsCertName, "metrics-cert-key", metricsCertKey)

    var err error
    metricsCertWatcher, err = certwatcher.New(
        filepath.Join(metricsCertPath, metricsCertName),
        filepath.Join(metricsCertPath, metricsCertKey),
    )
    if err != nil {
        setupLog.Error(err, "Failed to initialize metrics certificate watcher")
        os.Exit(1)
    }

    metricsServerOptions.TLSOpts = append(metricsServerOptions.TLSOpts, func(config *tls.Config) {
        config.GetCertificate = metricsCertWatcher.GetCertificate
    })
}

mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
    ...
})

Before calling AddHealthzCheck, ensure the certificate watchers are registered with the manager:

if metricsCertWatcher != nil {
    setupLog.Info("Adding metrics certificate watcher to manager")
    if err := mgr.Add(metricsCertWatcher); err != nil {
        setupLog.Error(err, "Unable to add metrics certificate watcher to manager")
        os.Exit(1)
    }
}

if webhookCertWatcher != nil {
    setupLog.Info("Adding webhook certificate watcher to manager")
    if err := mgr.Add(webhookCertWatcher); err != nil {
        setupLog.Error(err, "Unable to add webhook certificate watcher to manager")
        os.Exit(1)
    }
}

if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
    setupLog.Error(err, "Unable to set up health check")
    os.Exit(1)
}

Note that you can use as reference the main.go file available in the Operator SDK repository for the tag release v1.40.0 to see how the code should look like, see: testdata/go/v4/memcached-operator/cmd/main.go

Add the new certificates in the config/certmanager directory:

Add the new files:
- certificate-metrics.yaml with the content: testdata/go/v4/memcached-operator/config/certmanager/certificate-metrics.yaml
- issuer.yaml with the content: testdata/go/v4/memcached-operator/config/certmanager/issuer.yaml
Rename certificate.yaml to certificate-webhook.yaml
Update the kustomization.yaml file to include the new files and remove the old ones: Replace: - certificate.yaml

With:
```
resources:
  - certificate-metrics.yaml
  - certificate-webhook.yaml
  - issuer.yaml
```
NOTE: You can see the complete file in the repository for the tag release v1.40.0: testdata/go/v4/memcached-operator/config/certmanager/kustomization.yaml

Update the config/default/kustomization.yaml to allow work with the new options:

Under patches ensure that you have:

patches:
  ...
  # Uncomment the patches line if you enable Metrics and CertManager
  # [METRICS-WITH-CERTS] To enable metrics protected with certManager, uncomment the following line.
  # This patch will protect the metrics with certManager self-signed certs.
  - path: cert_metrics_manager_patch.yaml
    target:
      kind: Deployment

  # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
  # crd/kustomization.yaml
  - path: manager_webhook_patch.yaml
    target:
      kind: Deployment
...

Under the replacements section, replace:

  - source: # Add cert-manager annotation to ValidatingWebhookConfiguration, MutatingWebhookConfiguration and CRDs
    kind: Certificate
    group: cert-manager.io
    version: v1
    name: serving-cert # this name should match the one in certificate.yaml
    fieldPath: .metadata.namespace # namespace of the certificate CR
  targets:
    - select:
        kind: ValidatingWebhookConfiguration
      fieldPaths:
        - .metadata.annotations.[cert-manager.io/inject-ca-from]
      options:
        delimiter: '/'
        index: 0
        create: true
    - select:
        kind: MutatingWebhookConfiguration
      fieldPaths:
        - .metadata.annotations.[cert-manager.io/inject-ca-from]
      options:
        delimiter: '/'
        index: 0
        create: true
    - select:
        kind: CustomResourceDefinition
      fieldPaths:
        - .metadata.annotations.[cert-manager.io/inject-ca-from]
      options:
        delimiter: '/'
        index: 0
        create: true

With: the code from Kubebuilder samples testdata/project-v4/config/default/kustomization.yaml

NOTE: You can see the complete file in the repository for the tag release v1.40.0: testdata/go/v4/memcached-operator/config/default/kustomization.yaml

Add the new file to allow patch the certs for the metrics: testdata/go/v4/memcached-operator/config/default/cert_metrics_manager_patch.yaml
Replace the content of config/default/manager_webhook_patch.yaml with: testdata/go/v4/memcached-operator/config/default/manager_webhook_patch.yaml
Update the config/manager/manager.yaml to include the ports and volumes to allow the patch to work properly:

...
         env:
         - name: MEMCACHED_IMAGE
           value: memcached:1.4.36-alpine
+        ports: []
...

...
           requests:
             cpu: 10m
             memory: 64Mi
+        volumeMounts: []
+      volumes: []
  serviceAccountName: controller-manager
  terminationGracePeriodSeconds: 10
...

See #6928 for more details.

Update your project to properly support TLS for Prometheus scraping

Changes required under the hood config/prometheus/

1. Update the config/prometheus/kustomization.yaml add at the bottom:

      # [PROMETHEUS-WITH-CERTS] The following patch configures the ServiceMonitor in ../prometheus
      # to securely reference certificates created and managed by cert-manager.
      # Additionally, ensure that you uncomment the [METRICS WITH CERTMANAGER] patch under config/default/kustomization.yaml
      # to mount the "metrics-server-cert" secret in the Manager Deployment.
      #patches:
      #  - path: monitor_tls_patch.yaml
      #    target:
      #      kind: ServiceMonitor

1. Add the file config/prometheus/monitor_tls_patch.yaml to do the patch for the ServiceMonitor.

See #6928 for more details.

Update your project to properly support CA injection for CRDs with conversion webhooks

Changes required under the hood config/crd/

1. Update the config/crd/kustomization.yaml for the file to include the new marker +kubebuilder:scaffold:crdkustomizewebhookpatch for the tool be able to inject the path for any new CRD that is created with the --conversion flag.
1. Ensure that under the patches section you have only patches for the CRDs which are created with the --conversion flag.
1. Remove the files prefixed with cainjection_<kind>.yaml. You should have only the files prefixed with webhookpatch_<kind>.yaml for the CRDs that have the --conversion flag. (example)

Changes required under the hood config/default/

1. Update the config/default/kustomization.yaml for the file to include the new marker +kubebuilder:scaffold:crdkustomizecainjectionns for the tool be able to inject for any new CRD that is created with the --conversion flag as well to have commented the default replacement. For further information see an example in Kubebuilder testdata samples testdata/project-v4/config/default/kustomization.yaml.

NOTE: You can see the complete file in the repository for the tag release v1.40.0: testdata/go/v4/memcached-operator/config/default/kustomization.yaml

See #6928 for more details.

Use `.Named("<Kind>")` in SetupWithManager for controller registration

To improve clarity and avoid naming collisions in multi-group Go-based operator projects, each controller’s SetupWithManager call now includes an explicit .Named("<Kind>") declaration.

Example change:

func (r *DeploymentReconciler) SetupWithManager(mgr ctrl.Manager) error {
  return ctrl.NewControllerManagedBy(mgr).
    For(&appsv1.Deployment{}).
    Named("apps-deployment").
    Complete(r)
  }

This ensures controller names are unique and consistent across different APIs in multi-group scenarios, which improves controller lifecycle management and logging.

See #6928 for more details.

ENVTEST version automation and improved test binary discovery

The SDK now automates the setup of ENVTEST for Go-based operators by dynamically deriving the required versions from go.mod rather than requiring manual updates in the Makefile.

Update the Makefile:

The variables ENVTEST_VERSION and ENVTEST_K8S_VERSION are now computed using go list:

ENVTEST_VERSION := $(shell go list -m -f "{{ .Version }}" sigs.k8s.io/controller-runtime | awk -F'[v.]' '{printf "release-%d.%d", $$2, $$3}')
ENVTEST_K8S_VERSION := $(shell go list -m -f "{{ .Version }}" k8s.io/api | awk -F'[v.]' '{printf "1.%d", $$3}')

A new target setup-envtest was introduced to automatically install the binaries:

.PHONY: setup-envtest
setup-envtest:
  @$(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path || { \
    echo "Error setting up envtest"; exit 1; }

The test target now depends on setup-envtest to ensure binaries are ready before running tests.

Update the suite_test.go files for controllers and webhooks: In each internal/controller/suite_test.go and internal/webhook/<version>/webhook/suite_test.go file:

A new helper function getFirstFoundEnvTestBinaryDir() was added:

func getFirstFoundEnvTestBinaryDir() string {
  basePath := filepath.Join("..", "..", "..", "bin", "k8s")
  entries, err := os.ReadDir(basePath)
  if err != nil {
      logf.Log.Error(err, "Failed to read directory", "path", basePath)
      return ""
  }
  for _, entry := range entries {
      if entry.IsDir() {
          return filepath.Join(basePath, entry.Name())
      }
  }
  return ""
}

testEnv.BinaryAssetsDirectory now uses this helper to locate installed ENVTEST binaries:

testEnv = &envtest.Environment{
  BinaryAssetsDirectory: getFirstFoundEnvTestBinaryDir(),
  ...
}

See #6928 for more details.

Replace `exportloopref` with `copyloopvar` in `.golangci.yaml`

The exportloopref linter has been deprecated in recent versions of GolangCI-Lint. It is now replaced with the more accurate and actively maintained copyloopvar linter.

Update your .golangci.yaml file by replacing:

- exportloopref

With:

- copyloopvar

See #6928 for more details.

Add `lint-config` target to Makefile to verify linter configuration

The target uses the config verify subcommand provided by golangci-lint:

.PHONY: lint-config
lint-config: golangci-lint ## Verify golangci-lint linter configuration
	$(GOLANGCI_LINT) config verify

See #6928 for more details.

Upgrade to Go 1.23 and Kubernetes v0.32.1 dependencies

Update your go.mod to reflect the new versions:

go 1.23

require (
  github.com/onsi/ginkgo/v2 v2.22.0
  github.com/onsi/gomega v1.36.1
  k8s.io/api v0.32.1
  k8s.io/apimachinery v0.32.1
  k8s.io/client-go v0.32.1
  k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738
  sigs.k8s.io/controller-runtime v0.20.4
)

Update the Go toolchain in your Dockerfile to match:

FROM golang:1.23 AS builder

See #6928 for more details.

You must change your webhooks implementation to be able to use controller-runtime v0.20.0+

If you have no webhooks, you can skip this migration. Otherwise, ensure that you check the described steps to update your project in the release notes of Kubebuilder v4.3.0 release: https://github.com/kubernetes-sigs/kubebuilder/releases/tag/v4.3.0

See #6928 for more details.

Add `app.kubernetes.io/name` label to your manifests

The Operator SDK now adds the app.kubernetes.io/name label to scaffolded Kubernetes manifests such as Deployments, Services, and RBAC resources. This label aligns with Kubernetes labeling conventions and improves compatibility with observability and automation tools.

If upgrading from a previous version, you may want to add the following label manually to your existing manifests:

metadata:
  labels:
    app.kubernetes.io/name: <your-app-name>

See #6928 for more details.

With you wish manually add those roles to your project

See the permissions and RBAC generate as an example to know how properly create those files for each CRD you have in your project by looking at the sample in the repository for the tag release v1.40.0: testdata/go/v4/memcached-operator/config/rbac

See #6928 for more details.

With you wish manually add those roles to your project

See #6928 for more details.

Docs: v1.39.2

Mon, 01 Jan 0001 00:00:00 +0000

There are no migrations for this release! 🎉

Docs: v1.39.1

Mon, 01 Jan 0001 00:00:00 +0000

There are no migrations for this release! 🎉

Docs: v1.39.0

Mon, 01 Jan 0001 00:00:00 +0000

Upgrade K8s versions to use 1.31 and Kubebuilder network-policy scaffolding

This release contains a decent amount of migrations, but not nearly as many as the previous versions migrations so this release should be easier to follow.

[helm/v1, ansible/v1] Update the kustomize version in your Makefile

 - curl -sSLo - https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/v5.3.2/kustomize_v5.3.0_$(OS)_$(ARCH).tar.gz | \
 + curl -sSLo - https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/v5.4.3/kustomize_v5.4.2_$(OS)_$(ARCH).tar.gz | \

[go/v4] Update your go.mod file to upgrade the dependencies and run go mod tidy to download them

- github.com/onsi/ginkgo/v2 v2.17.1
- github.com/onsi/gomega v1.32.0
- k8s.io/api v0.30.1
- k8s.io/apimachinery v0.30.1
- k8s.io/client-go v0.30.1
- sigs.k8s.io/controller-runtime v0.18.4
+ github.com/onsi/ginkgo/v2 v2.19.0
+ github.com/onsi/gomega v1.33.1
+ k8s.io/api v0.31.0
+ k8s.io/apimachinery v0.31.0
+ k8s.io/client-go v0.31.0
+ sigs.k8s.io/controller-runtime v0.19.0

[go/v4] Update your Makefile with the below changes:

 - ENVTEST_K8S_VERSION = 1.30.0
 + ENVTEST_K8S_VERSION = 1.31.0

 - KUSTOMIZE_VERSION ?= v5.4.2
 - CONTROLLER_TOOLS_VERSION ?= v0.15.0
 - ENVTEST_VERSION ?= release-0.18
 + KUSTOMIZE_VERSION ?= v5.4.3
 + CONTROLLER_TOOLS_VERSION ?= v0.16.1
 + ENVTEST_VERSION ?= release-0.19

[go/v4] Update your main.go file with the below changes:

 - // - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/server
 + // - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.19.0/pkg/metrics/server

 - // https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/filters#WithAuthenticationAndAuthorization
 + // https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.19.0/pkg/metrics/filters#WithAuthenticationAndAuthorization

[go/v4, helm/v1, ansible/v1] Update your /config/default/kustomization.yaml file with the below changes:

 +# [NETWORK POLICY] Protect the /metrics endpoint and Webhook Server with NetworkPolicy.
 +# Only Pod(s) running a namespace labeled with 'metrics: enabled' will be able to gather the metrics.
 +# Only CR(s) which requires webhooks and are applied on namespaces labeled with 'webhooks: enabled' will
 +# be able to communicate with the Webhook Server.
 +#- ../network-policy

[go/v4, helm/v1, ansible/v1] Add /config/network-policy/allow-metrics-traffic.yaml

 + # This NetworkPolicy allows ingress traffic
 + # with Pods running on namespaces labeled with 'metrics: enabled'. Only Pods on those
 + # namespaces are able to gathering data from the metrics endpoint.
 + apiVersion: networking.k8s.io/v1
 + kind: NetworkPolicy
 + metadata:
 +   labels:
 +     app.kubernetes.io/name: <operator-name>
 +     app.kubernetes.io/managed-by: kustomize
 +   name: allow-metrics-traffic
 +   namespace: system
 + spec:
 +   podSelector:
 +     matchLabels:
 +       control-plane: controller-manager
 +   policyTypes:
 +     - Ingress
 +   ingress:
 +     # This allows ingress traffic from any namespace with the label metrics: enabled
 +     - from:
 +       - namespaceSelector:
 +           matchLabels:
 +             metrics: enabled  # Only from namespaces with this label
 +       ports:
 +         - port: 8443
 +           protocol: TCP

[helm/v1, ansible/v1] Add /config/network-policy/kustomization.yaml
```
 + resources:
 + - allow-metrics-traffic.yaml
```

[go/v4] Add /config/network-policy/allow-webhook-traffic.yaml

 + # This NetworkPolicy allows ingress traffic to your webhook server running
 + # as part of the controller-manager from specific namespaces and pods. CR(s) which uses webhooks
 + # will only work when applied in namespaces labeled with 'webhook: enabled'
 + apiVersion: networking.k8s.io/v1
 + kind: NetworkPolicy
 + metadata:
 +   labels:
 +     app.kubernetes.io/name: <operator-name>
 +     app.kubernetes.io/managed-by: kustomize
 +   name: allow-webhook-traffic
 +   namespace: system
 + spec:
 +   podSelector:
 +     matchLabels:
 +       control-plane: controller-manager
 +   policyTypes:
 +     - Ingress
 +   ingress:
 +     # This allows ingress traffic from any namespace with the label webhook: enabled
 +     - from:
 +       - namespaceSelector:
 +           matchLabels:
 +             webhook: enabled # Only from namespaces with this label
 +       ports:
 +         - port: 443
 +           protocol: TCP

[go/v4] Add /config/network-policy/kustomization.yaml

 + resources:
 + - allow-webhook-traffic.yaml
 + - allow-metrics-traffic.yaml

See #6878 for more details.

Docs: v1.38.0

Mon, 01 Jan 0001 00:00:00 +0000

Upgrade K8s versions to use 1.30 and Kubebuilder v4

This update has a lot of scaffolding changes due to the removal of kube-rbac-proxy, if these migrations become difficult to follow, it might be beneficial to scaffold a net new sample project to compare.

[helm/v1, ansible/v1] Update the kustomize version in your Makefile

 - curl -sSLo - https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/v5.3.0/kustomize_v5.3.0_$(OS)_$(ARCH).tar.gz | \
 + curl -sSLo - https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/v5.4.2/kustomize_v5.4.2_$(OS)_$(ARCH).tar.gz | \

[go/v4] Update your go.mod file to upgrade the dependencies and run go mod tidy to download them

 go 1.22.0
    
 github.com/onsi/ginkgo/v2 v2.17.1
 github.com/onsi/gomega v1.32.0
 k8s.io/api v0.30.1
 k8s.io/apimachinery v0.30.1
 k8s.io/client-go v0.30.1
 sigs.k8s.io/controller-runtime v0.18.4

[go/v4] Update your Makefile with the below changes:

 - ENVTEST_K8S_VERSION = 1.29.0
 + ENVTEST_K8S_VERSION = 1.30.0

 - KUSTOMIZE ?= $(LOCALBIN)/kustomize-$(KUSTOMIZE_VERSION)
 - CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen-$(CONTROLLER_TOOLS_VERSION)
 - ENVTEST ?= $(LOCALBIN)/setup-envtest-$(ENVTEST_VERSION)
 - GOLANGCI_LINT = $(LOCALBIN)/golangci-lint-$(GOLANGCI_LINT_VERSION)
 + KUSTOMIZE ?= $(LOCALBIN)/kustomize
 + CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
 + ENVTEST ?= $(LOCALBIN)/setup-envtest
 + GOLANGCI_LINT = $(LOCALBIN)/golangci-lint

 - KUSTOMIZE_VERSION ?= v5.3.0
 - CONTROLLER_TOOLS_VERSION ?= v0.14.0
 - ENVTEST_VERSION ?= release-0.17
 - GOLANGCI_LINT_VERSION ?= v1.57.2
 + KUSTOMIZE_VERSION ?= v5.4.2
 + CONTROLLER_TOOLS_VERSION ?= v0.15.0
 + ENVTEST_VERSION ?= release-0.18
 + GOLANGCI_LINT_VERSION ?= v1.59.1

 - $(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/cmd/golangci-lint,${GOLANGCI_LINT_VERSION})
 + $(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/cmd/golangci-lint,$(GOLANGCI_LINT_VERSION))

 - @[ -f $(1) ] || { \
 + @[ -f "$(1)-$(3)" ] || { \
   echo "Downloading $${package}" ;\
 + rm -f $(1) || true ;\
 - mv "$$(echo "$(1)" | sed "s/-$(3)$$//")" $(1) ;\
 - }
 + mv $(1) $(1)-$(3) ;\
 + } ;\
 + ln -sf $(1)-$(3) $(1)

[go/v4] Update your .golangci.yml with the below changes:

-  exportloopref
+     - ginkgolinter
      - prealloc
+     - revive
+ 
+ linters-settings:
+   revive:
+     rules:
+       - name: comment-spacings

[go/v4] Update your Dockerfile file with the below changes:

- FROM golang:1.21 AS builder
+ FROM golang:1.22 AS builder

[go/v4] Update your main.go file with the below changes:

     "sigs.k8s.io/controller-runtime/pkg/log/zap"
+    "sigs.k8s.io/controller-runtime/pkg/metrics/filters"

     var enableHTTP2 bool
-    flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
+    var tlsOpts []func(*tls.Config)
+    flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metrics endpoint binds to. "+
+        "Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service.")
     flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
     flag.BoolVar(&enableLeaderElection, "leader-elect", false,
         "Enable leader election for controller manager. "+
             "Enabling this will ensure there is only one active controller manager.")
-    flag.BoolVar(&secureMetrics, "metrics-secure", false,
-        "If set the metrics endpoint is served securely")
+    flag.BoolVar(&secureMetrics, "metrics-secure", true,
+        "If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.")

-    tlsOpts := []func(*tls.Config){}

+    // Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
+    // More info:
+    // - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/server
+    // - https://book.kubebuilder.io/reference/metrics.html
+    metricsServerOptions := metricsserver.Options{
+        BindAddress:   metricsAddr,
+        SecureServing: secureMetrics,
+        // TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
+        // not provided, self-signed certificates will be generated by default. This option is not recommended for
+        // production environments as self-signed certificates do not offer the same level of trust and security
+        // as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
+        // unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
+        // to provide certificates, ensuring the server communicates using trusted and secure certificates.
+        TLSOpts: tlsOpts,
+    }
+
+    if secureMetrics {
+        // FilterProvider is used to protect the metrics endpoint with authn/authz.
+        // These configurations ensure that only authorized users and service accounts
+        // can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
+        // https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.18.4/pkg/metrics/filters#WithAuthenticationAndAuthorization
+        metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
+    }
+
     mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
-        Scheme: scheme,
-        Metrics: metricsserver.Options{
-            BindAddress:   metricsAddr,
-            SecureServing: secureMetrics,
-            TLSOpts:       tlsOpts,
-        },
+        Scheme:                 scheme,
+        Metrics:                metricsServerOptions,

[go/v4, helm/v1, ansible/v1] Update your /config/default/kustomization.yaml file with the below changes:

  # [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
  #- ../prometheus
+ # [METRICS] Expose the controller manager metrics service.
+ - metrics_service.yaml
 
+ # Uncomment the patches line if you enable Metrics, and/or are using webhooks and cert-manager
  patches:
- # Protect the /metrics endpoint by putting it behind auth.
- # If you want your controller-manager to expose the /metrics
- # endpoint w/o any authn/z, please comment the following line.
- - path: manager_auth_proxy_patch.yaml
+ # [METRICS] The following patch will enable the metrics endpoint using HTTPS and the port :8443.
+ # More info: https://book.kubebuilder.io/reference/metrics
+ - path: manager_metrics_patch.yaml
+   target:
+     kind: Deployment

[go/v4, helm/v1, ansible/v1] Remove /config/default/manager_auth_proxy_patch.yaml and /config/default/manager_config_patch.yaml files.

[go/v4, helm/v1, ansible/v1] Add /config/default/manager_metrics_patch.yaml file with the below changes:

# This patch adds the args to allow exposing the metrics endpoint using HTTPS
- op: add
  path: /spec/template/spec/containers/0/args/0
  value: --metrics-bind-address=:8443

[helm/v1, ansible/v1] Update /config/default/manager_metrics_patch.yaml file with the below changes:

# This patch adds the args to allow securing the metrics endpoint
- op: add
  path: /spec/template/spec/containers/0/args/0
  value: --metrics-secure
# This patch adds the args to allow RBAC-based authn/authz the metrics endpoint
- op: add
  path: /spec/template/spec/containers/0/args/0
  value: --metrics-require-rbac

[go/v4, helm/v1, ansible/v1] Add /config/default/metrics_service.yaml file with the below changes:

apiVersion: v1
kind: Service
metadata:
  labels:
    control-plane: controller-manager
    app.kubernetes.io/name: <operator-name>
    app.kubernetes.io/managed-by: kustomize
  name: controller-manager-metrics-service
  namespace: system
spec:
  ports:
    - name: https
      port: 8443
      protocol: TCP
      targetPort: 8443
  selector:
    control-plane: controller-manager

[go/v4, helm/v1, ansible/v1] Update your /config/manager/manager.yaml file with the below changes (Note: The port for ansible is 6789):
```
  - --leader-elect
+ - --health-probe-bind-address=:8081
```

[go/v4, helm/v1, ansible/v1] Update your /config/prometheus/monitor.yaml file with the below changes:

     - path: /metrics
-      port: https
+      port: https # Ensure this is the name of the port that exposes HTTPS metrics
       tlsConfig:
+        # TODO(user): The option insecureSkipVerify: true is not recommended for production since it disables
+        # certificate verification. This poses a significant security risk by making the system vulnerable to
+        # man-in-the-middle attacks, where an attacker could intercept and manipulate the communication between
+        # Prometheus and the monitored services. This could lead to unauthorized access to sensitive metrics data,
+        # compromising the integrity and confidentiality of the information.
+        # Please use the following options for secure configurations:
+        # caFile: /etc/metrics-certs/ca.crt
+        # certFile: /etc/metrics-certs/tls.crt
+        # keyFile: /etc/metrics-certs/tls.key
         insecureSkipVerify: true

[go/v4, helm/v1, ansible/v1] Remove the following files from /config/rbac

- auth_proxy_client_clusterrole.yaml
- auth_proxy_role.yaml
- auth_proxy_role_binding.yaml
- auth_proxy_service.yaml

[go/v4, helm/v1, ansible/v1] Update your /config/rbac/kustomization.yaml file with the below changes:

  - leader_election_role_binding.yaml
- # Comment the following 4 lines if you want to disable
- # the auth proxy (https://github.com/brancz/kube-rbac-proxy)
- # which protects your /metrics endpoint.
- - auth_proxy_service.yaml
- - auth_proxy_role.yaml
- - auth_proxy_role_binding.yaml
- - auth_proxy_client_clusterrole.yaml
+ # The following RBAC configurations are used to protect
+ # the metrics endpoint with authn/authz. These configurations
+ # ensure that only authorized users and service accounts
+ # can access the metrics endpoint. Comment the following
+ # permissions if you want to disable this protection.
+ # More info: https://book.kubebuilder.io/reference/metrics.html
+ - metrics_auth_role.yaml
+ - metrics_auth_role_binding.yaml
+ - metrics_reader_role.yaml

[go/v4, helm/v1, ansible/v1] Add /config/rbac/metrics_auth_role.yaml file with the below changes:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: metrics-auth-role
rules:
  - apiGroups:
      - authentication.k8s.io
    resources:
      - tokenreviews
    verbs:
      - create
  - apiGroups:
      - authorization.k8s.io
    resources:
      - subjectaccessreviews
    verbs:
      - create

[go/v4, helm/v1, ansible/v1] Add /config/rbac/metrics_auth_role_binding.yaml file with the below changes:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: metrics-auth-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: metrics-auth-role
subjects:
  - kind: ServiceAccount
    name: controller-manager
    namespace: system

[go/v4, helm/v1, ansible/v1] Add /config/rbac/metrics_reader_role.yaml file with the below changes:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: metrics-reader
rules:
- nonResourceURLs:
  - "/metrics"
  verbs:
  - get

See #6862 for more details.

Docs: v1.37.0

Mon, 01 Jan 0001 00:00:00 +0000

Migrate to the Quarkus extension provided bootstrap

From now on, you can bootstrap your Quarkus-based operator with the provided Quarkus tools as described in the bootstrapping instructions - https://github.com/quarkiverse/quarkus-operator-sdk?tab=readme-ov-file#bootstrapping-a-project.

See #6824 for more details.

Remove hybrid-helm v1-alpha support

As an operator author you can switch to a go-based operator.

See #6833 for more details.

Docs: v1.36.0

Mon, 01 Jan 0001 00:00:00 +0000

Upgrade K8s versions to use 1.29

[go/v4] Update your go.mod file to upgrade the dependencies and run go mod tidy to download them:

k8s.io/api v0.29.2
k8s.io/apimachinery v0.29.2
k8s.io/client-go v0.29.2
sigs.k8s.io/controller-runtime v0.17.3

[go/v4, helm/v1] The projects are now scaffolded with 0.16.0 version of kube-rbac-proxy. Modify the version of kube-rbac-proxy in the following scaffolded files: - config/default/manager_auth_proxy_patch.yaml
```
- gcr.io/kubebuilder/kube-rbac-proxy:v0.15.0
+ gcr.io/kubebuilder/kube-rbac-proxy:v0.16.0
```

[go/v4] You can now generate a file that contains all the resources built with Kustomize, which are necessary to install this project without its dependencies. Update your Makefile by adding:

+ .PHONY: build-installer
+   build-installer: manifests generate kustomize ## Generate a consolidated YAML with CRDs and deployment.
+   	mkdir -p dist
+   	cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
+   	$(KUSTOMIZE) build config/default > dist/install.yaml

[go/v4] Update ENVTEST_K8S_VERSION in your Makefile:

- ENVTEST_K8S_VERSION = 1.28.3
+ ENVTEST_K8S_VERSION = 1.29.0

[go/v4] Remove the following section from your Makefile:

- GOLANGCI_LINT = $(shell pwd)/bin/golangci-lint
- GOLANGCI_LINT_VERSION ?= v1.54.2
- golangci-lint:
- 	@[ -f $(GOLANGCI_LINT) ] || { \
- 	set -e ;\
- 	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(shell dirname $(GOLANGCI_LINT)) $(GOLANGCI_LINT_VERSION) ;\
- 	}

[go/v4] Update the following in your Makefile:

- ## Tool Binaries
- KUBECTL ?= kubectl
- KUSTOMIZE ?= $(LOCALBIN)/kustomize
- CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
- ENVTEST ?= $(LOCALBIN)/setup-envtest
- 
- ## Tool Versions
- KUSTOMIZE_VERSION ?= v5.2.1
- CONTROLLER_TOOLS_VERSION ?= v0.13.0
- 
- .PHONY: kustomize
- kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary. If wrong version is installed, it will be removed before downloading.
- $(KUSTOMIZE): $(LOCALBIN)
-   @if test -x $(LOCALBIN)/kustomize && ! $(LOCALBIN)/kustomize version | grep -q $(KUSTOMIZE_VERSION); then \
-   echo "$(LOCALBIN)/kustomize version is not expected $(KUSTOMIZE_VERSION). Removing it before installing."; \
-   rm -rf $(LOCALBIN)/kustomize; \
-   fi
-   test -s $(LOCALBIN)/kustomize || GOBIN=$(LOCALBIN) GO111MODULE=on go install sigs.k8s.io/kustomize/kustomize/v5@$(KUSTOMIZE_VERSION)
- 
- .PHONY: controller-gen
- controller-gen: $(CONTROLLER_GEN) ## Download controller-gen locally if necessary. If wrong version is installed, it will be overwritten.
- $(CONTROLLER_GEN): $(LOCALBIN)
-   test -s $(LOCALBIN)/controller-gen && $(LOCALBIN)/controller-gen --version | grep -q $(CONTROLLER_TOOLS_VERSION) || \
-   GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-tools/cmd/controller-gen@$(CONTROLLER_TOOLS_VERSION)
- 
- .PHONY: envtest
- envtest: $(ENVTEST) ## Download envtest-setup locally if necessary.
- $(ENVTEST): $(LOCALBIN)
-   test -s $(LOCALBIN)/setup-envtest || GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
+ ## Tool Binaries
+ KUBECTL ?= kubectl
+ KUSTOMIZE ?= $(LOCALBIN)/kustomize-$(KUSTOMIZE_VERSION)
+ CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen-$(CONTROLLER_TOOLS_VERSION)
+ ENVTEST ?= $(LOCALBIN)/setup-envtest-$(ENVTEST_VERSION)
+ GOLANGCI_LINT = $(LOCALBIN)/golangci-lint-$(GOLANGCI_LINT_VERSION)
+ 
+ ## Tool Versions
+ KUSTOMIZE_VERSION ?= v5.3.0
+ CONTROLLER_TOOLS_VERSION ?= v0.14.0
+ ENVTEST_VERSION ?= release-0.17
+ GOLANGCI_LINT_VERSION ?= v1.57.2
+ 
+ .PHONY: kustomize
+ kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary.
+ $(KUSTOMIZE): $(LOCALBIN)
+ 	$(call go-install-tool,$(KUSTOMIZE),sigs.k8s.io/kustomize/kustomize/v5,$(KUSTOMIZE_VERSION))
+ 
+ .PHONY: controller-gen
+ controller-gen: $(CONTROLLER_GEN) ## Download controller-gen locally if necessary.
+ $(CONTROLLER_GEN): $(LOCALBIN)
+ 	$(call go-install-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/controller-gen,$(CONTROLLER_TOOLS_VERSION))
+ 
+ .PHONY: envtest
+ envtest: $(ENVTEST) ## Download setup-envtest locally if necessary.
+ $(ENVTEST): $(LOCALBIN)
+ 	$(call go-install-tool,$(ENVTEST),sigs.k8s.io/controller-runtime/tools/setup-envtest,$(ENVTEST_VERSION))
+ 
+ .PHONY: golangci-lint
+ golangci-lint: $(GOLANGCI_LINT) ## Download golangci-lint locally if necessary.
+ $(GOLANGCI_LINT): $(LOCALBIN)
+ 	$(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/cmd/golangci-lint,${GOLANGCI_LINT_VERSION})
+ 
+ # go-install-tool will 'go install' any package with custom target and name of binary, if it doesn't exist
+ # $1 - target path with name of binary (ideally with version)
+ # $2 - package url which can be installed
+ # $3 - specific version of package
+ define go-install-tool
+ @[ -f $(1) ] || { \
+ set -e; \
+ package=$(2)@$(3) ;\
+ echo "Downloading $${package}" ;\
+ GOBIN=$(LOCALBIN) go install $${package} ;\
+ mv "$$(echo "$(1)" | sed "s/-$(3)$$//")" $(1) ;\
+ }
+ endef

[helm/v1] Update the kustomize version in your Makefile:

- curl -sSLo - https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/v5.2.1/kustomize_v5.2.1_$(OS)_$(ARCH).tar.gz | \
+ curl -sSLo - https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/v5.3.0/kustomize_v5.3.0_$(OS)_$(ARCH).tar.gz | \

See #6736 for more details.

Docs: v1.35.0

Mon, 01 Jan 0001 00:00:00 +0000

Fix helm-operator scaffolding that was broken in 1.34.0, 1.34.1, and 1.34.2

Users who scaffolded a helm-operator project with 1.34.0, 1.34.1, or 1.34.2 need re-generate the project in order to get a fixed config/rbac/role.yaml file.

See #6769 for more details.

Docs: v1.34.0

Mon, 01 Jan 0001 00:00:00 +0000

To fix multi-arch build, replace docker-buildx target in project Makefile

In the project Makefile, replace existing docker-buildx target with following definition.

docker-buildx: ## Build and push docker image for the manager for cross-platform support
	- docker buildx create --name project-v3-builder
	docker buildx use project-v3-builder
	- docker buildx build --push --platform=$(PLATFORMS) --tag ${IMG} -f Dockerfile .
	- docker buildx rm project-v3-builder

See #6661 for more details.

Docs: v1.33.0

Mon, 01 Jan 0001 00:00:00 +0000

(go/v4-alpha) Move go/v4 plugin from alpha to stable

The transition from Golang v2 and v3 plugins to the new Golang v4 plugin introduces significant changes. To gain insights into the reasoning behind these changes, you can refer to the explanation provided at https://book.kubebuilder.io/migration/v3vsv4#tldr-of-the-new-gov4-plugin.

For a comprehensive understanding of the migration process to the v4 plugin format, the Kubebuilder documentation outlines the necessary steps. Detailed instructions can be found at https://book.kubebuilder.io/migration/manually_migration_guide_gov3_to_gov4.

This migration is designed to enhance your project’s functionality and compatibility, reflecting the evolving landscape of Golang development.

See #6613 for more details.

(kustomize/v2-alpha) Move kustomize/v2 plugin from alpha to stable

For more information on the kustomize/v2 plugin, please refer to the documentation at https://book.kubebuilder.io/plugins/available/kustomize-v2

See #6613 for more details.

Docs: v1.32.0

Mon, 01 Jan 0001 00:00:00 +0000

There are no migrations for this release! 🎉

Docs: v1.31.0

Mon, 01 Jan 0001 00:00:00 +0000

Updating an Ansible Operator to use the updated Ansible 2.15.0 image

Update the FROM directive in the Dockerfile to have a version tag > v1.30.0
Evaluate your dependency requirements. The change to Ansible 2.15.0 also included removal of some pre-installed Python modules. You may need to update your Dockerfile to pip install modules required by your operator.

See #6483 for more details.

Upgrading an Ansible Operator project to match the latest `ansible/v1` plugin changes

In the requirements.yml file:
- Remove the community.kubernetes collection entry
- Update the version of the operator_sdk.util collection entry to v0.5.0
In the molecule/kind/molecule.yml and molecule/default/molecule.yml files:
- Remove all instances of the lint field. For an example of the diff, see: https://github.com/operator-framework/operator-sdk/pull/6483/files#diff-f159b0d7ec17de90f5b5c297ce997254e6ea4001269167be25615c45c489539e

See #6483 for more details.

Migrating away from the `quay.io/operator-framework/ansible-operator-2.11-preview` base image

Update the FROM directive in the Dockerfile to use the base image quay.io/operator-framework/ansible-operator:vX.Y.Z where vX.Y.Z is > v1.30.0

See #6483 for more details.

Require `watch` on `secrets`

The operator now requires the watch operation on secrets. When using a custom ServiceAccount for deployment, the following additional role is now required:

rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - watch

See #6354 for more details.

Docs: v1.30.0

Mon, 01 Jan 0001 00:00:00 +0000

Header text for the migration section

Body of the migration section. This should be formatted as markdown and can span multiple lines.

Using the YAML string ‘|’ operator means that newlines in this string will be honored and interpretted as newlines in the rendered markdown.

See #6426 for more details.

Docs: v1.29.0

Mon, 01 Jan 0001 00:00:00 +0000

There are no migrations for this release! 🎉

Docs: v1.28.0

Mon, 01 Jan 0001 00:00:00 +0000

(ansible) - Upgrade kubernetes.core collection to v2.4.0

In the requirements.yaml file replace:

  - name: kubernetes.core
    version: "2.3.1"

with:

  - name: kubernetes.core
    version: "2.4.0"

See #6334 for more details.

Upgrade K8s versions to use 1.26

Regarding the upcoming major changes in the plugin, please note that go/v3 is being deprecated by Kubebuilder hence Operator SDK would also be migrating to go/v4 soon. Following are the changes to be addressed in your project structure, Makefile and go.mod files: 1) [go/v3, ansible/v1, helm/v1] Update your go.mod file to upgrade the dependencies and run go mod tidy to download them go k8s.io/api v0.26.2 k8s.io/apiextensions-apiserver v0.26.2 k8s.io/apimachinery v0.26.2 k8s.io/cli-runtime v0.26.2 k8s.io/client-go v0.26.2 k8s.io/kubectl v0.26.2 sigs.k8s.io/controller-runtime v0.14.5 sigs.k8s.io/controller-tools v0.11.3 sigs.k8s.io/kubebuilder/v3 v3.9.1 2) [go/v3, ansible/v1, helm/v1] With the bump to Kubebuilder 3.9.1, the go/v3 projects are now scaffolded with 0.13.1 version of kube-rbac-proxy. Modify the version of kube-rbac-proxy in the following scaffolded files: - config/default/manager_auth_proxy_patch.yaml - bundle/manifests/memcached-operator.clusterserviceversion.yaml

  - gcr.io/kubebuilder/kube-rbac-proxy:v0.13.0
  + gcr.io/kubebuilder/kube-rbac-proxy:v0.13.1

[gov4alpha] For scaffolds, replace scaffoldings of v1beta1 by using k8s.io/api/admission/v1 instead of k8s.io/api/admission/v1beta1 as v1beta1 is removed in latest k8s.

  - admissionv1beta1 "k8s.io/api/admission/v1beta1"
  + admissionv1 "k8s.io/api/admission/v1"

[gov4alpha] The project structure has changed from /controllers to internal/controller/. Modify the Dockerfile of the go/v4-alpha plugin to below:

  - COPY controllers/ controllers/
  + COPY internal/controller/ internal/controller/

[go/v3, gov4alpha] Update your Makefile by

Replacing ENVTEST_K8S_VERSION = 1.25 with ENVTEST_K8S_VERSION = 1.26.
Using manifests generate fmt vet to build manager binary by replacing generate fmt vet in the build target to manifests generate fmt vet:

  - build: generate fmt vet ## Build manager binary.
  + build: manifests generate fmt vet ## Build manager binary.

[gov4alpha] The gov4alpha plugin is now being scaffolded with Kubebuilder’s go/v4-alpha which has a modified project file structure according to Go’s best practices. Refer https://github.com/kubernetes-sigs/kubebuilder/pull/2985 for changes. Make the following changes in your scaffolded project if gov4aplha plugin was used: - Replacing go run ./main.go to go run ./cmd/main.go due to the change in project structure.
- Replacing

  - `test -s $(LOCALBIN)/controller-gen || GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-tools/cmd/controller-gen@$(CONTROLLER_TOOLS_VERSION)`
  + test -s $(LOCALBIN)/controller-gen && $(LOCALBIN)/controller-gen --version | grep -q $(CONTROLLER_TOOLS_VERSION) || \
  GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-tools/cmd/controller-gen@$(CONTROLLER_TOOLS_VERSION)

See #6352 for more details.

Docs: v1.27.0

Mon, 01 Jan 0001 00:00:00 +0000

There are no migrations for this release! 🎉

Docs: v1.26.0

Mon, 01 Jan 0001 00:00:00 +0000

update ansible operator Makefile’s run target

For an ansible operator, update the Makefile’s run target to the following to fix a bug in its implementation.

.PHONY: run
ANSIBLE_ROLES_PATH?="$(shell pwd)/roles"
run: ansible-operator ## Run against the configured Kubernetes cluster in ~/.kube/config
    $(ANSIBLE_OPERATOR) run

See #6110 for more details.

Docs: v1.25.0

Mon, 01 Jan 0001 00:00:00 +0000

Kubebuilder bump brought changes that modified the `Makefile` scaffolding and also `multiarch` changes are also included.

Makefile content is updated as shown below.

    `KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" go test ./... -coverprofile cover.out`,

Add support for building binary in multiple platforms.

Add the below content to the Makefile.

# PLATFORMS defines the target platforms for  the manager image be build to provide support to multiple
# architectures. (i.e. make docker-buildx IMG=myregistry/mypoperator:0.0.1). To use this option you need to:
# - able to use docker buildx . More info: https://docs.docker.com/build/buildx/
# - have enable BuildKit, More info: https://docs.docker.com/develop/develop-images/build_enhancements/
# - be able to push the image for your registry (i.e. if you do not inform a valid value via IMG=<myregistry/image:<tag>> than the export will fail)
# To properly provided solutions that supports more than one platform you should use this option.
PLATFORMS ?= linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
.PHONY: docker-buildx
docker-buildx: test ## Build and push docker image for the manager for cross-platform support
    # copy existing Dockerfile and insert --platform=${BUILDPLATFORM} into Dockerfile.cross, and preserve the original Dockerfile
    sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' Dockerfile > Dockerfile.cross
    - docker buildx create --name project-v3-builder
    docker buildx use project-v3-builder
    - docker buildx build --push --platform=$(PLATFORMS) --tag ${IMG} -f Dockerfile.cross
    - docker buildx rm project-v3-builder
    rm Dockerfile.cross

(go/v3) Bump dependencies in go.mod file

    go 1.19   

    github.com/onsi/ginkgo/v2 v2.1.4
    github.com/onsi/gomega v1.19.0
    github.com/prometheus/client_golang v1.12.2
    k8s.io/api v0.25.0
    k8s.io/apimachinery v0.25.0
    k8s.io/client-go v0.25.0
    sigs.k8s.io/controller-runtime v0.13.0

(go/v3) Update controller-tools from 0.9.2 to 0.10.0.

In the Makefile file, replace CONTROLLER_TOOLS_VERSION ?= v0.9.2 with CONTROLLER_TOOLS_VERSION ?= v0.10.0

See #6047 for more details.

For multi-arch build support, add docker-buildx target to project Makefile

In the project Makefile below the docker-push target add the new docker-buildx target.

# PLATFORMS defines the target platforms for  the manager image be build to provide support to multiple
# architectures. (i.e. make docker-buildx IMG=myregistry/mypoperator:0.0.1). To use this option you need to:
# - able to use docker buildx . More info: https://docs.docker.com/build/buildx/
# - have enable BuildKit, More info: https://docs.docker.com/develop/develop-images/build_enhancements/
# - be able to push the image for your registry (i.e. if you do not inform a valid value via IMG=<myregistry/image:<tag>> than the export will fail)
# To properly provided solutions that supports more than one platform you should use this option.
PLATFORMS ?= linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
.PHONY: docker-buildx
docker-buildx: test ## Build and push docker image for the manager for cross-platform support
	# copy existing Dockerfile and insert --platform=${BUILDPLATFORM} into Dockerfile.cross, and preserve the original Dockerfile
	sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' Dockerfile > Dockerfile.cross
	- docker buildx create --name project-v3-builder
	docker buildx use project-v3-builder
	- docker buildx build --push --platform=$(PLATFORMS) --tag ${IMG} -f Dockerfile.cross
	- docker buildx rm project-v3-builder
	rm Dockerfile.cross

See #6093 for more details.

Docs: v1.24.0

Mon, 01 Jan 0001 00:00:00 +0000

Support for arm64

In Ansible & Helm-based operators, if you need to support arm64, add the following

| sed 's/aarch64/arm64/'

on the following line

ARCH := $(shell uname -m | sed 's/x86_64/amd64/')

The resulting line should look like this

ARCH := $(shell uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/')

See #5480 for more details.

Docs: v1.23.0

Mon, 01 Jan 0001 00:00:00 +0000

For Hybrid Helm (hybrid.helm/v1-alpha) language based operators - Bump Dockerfile Go version to 1.18

In the Dockerfile, replace the line FROM golang:1.17 as builder with FROM golang:1.18 as builder

See #5772 for more details.

(go/v3) Fix Makefile targets to not download binaries when they are found already

Update the Makefile targets by adding test -s $(LOCALBIN)/<binary-name> || before the instruction to download them, see:

KUSTOMIZE_INSTALL_SCRIPT ?= "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"
.PHONY: kustomize
kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary.
$(KUSTOMIZE): $(LOCALBIN)
	test -s $(LOCALBIN)/kustomize || { curl -s $(KUSTOMIZE_INSTALL_SCRIPT) | bash -s -- $(subst v,,$(KUSTOMIZE_VERSION)) $(LOCALBIN); }

.PHONY: controller-gen
controller-gen: $(CONTROLLER_GEN) ## Download controller-gen locally if necessary.
$(CONTROLLER_GEN): $(LOCALBIN)
	test -s $(LOCALBIN)/controller-gen || GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-tools/cmd/controller-gen@$(CONTROLLER_TOOLS_VERSION)

.PHONY: envtest
envtest: $(ENVTEST) ## Download envtest-setup locally if necessary.
$(ENVTEST): $(LOCALBIN)
	test -s $(LOCALBIN)/setup-envtest || GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest

See #5965 for more details.

(go/v3) Update `controller-tools` from `0.9.0` to `0.9.2`.

In the Makefile file, replace CONTROLLER_TOOLS_VERSION ?= v0.9.0 with CONTROLLER_TOOLS_VERSION ?= v0.9.2

See #5965 for more details.

(go/v3) Update `controller-runtime` from `v0.12.1` to `v0.12.2` and Kubernetes dependencies from `v0.24.0` to `v0.24.2`.

In the go.mod file, ensure the following dependencies versions and run go mod tidy:

k8s.io/api v0.24.2
k8s.io/apimachinery v0.24.2
k8s.io/client-go v0.24.2
sigs.k8s.io/controller-runtime v0.12.2

See #5965 for more details.

Upgrade kube proxy image `gcr.io/kubebuilder/kube-rbac-proxy` from `v0.11.0` to `v0.13.0`

In the config/default/manager_auth_proxy_patch.yaml file, replace gcr.io/kubebuilder/kube-rbac-proxy:0.11.0 with gcr.io/kubebuilder/kube-rbac-proxy:0.13.0

See #5903 and #5965 for more details.

(ansible/v1,helm/v1) Upgrade kustomize versions from `v3.8.7` to `v4.5.5`

Upgrade kustomize versions from v3.8.7 to v4.5.5

WARNING If your project has customizations using kustomize you might be impacted by them. See its Release Notes. (Note all changes are covered by its docs)

Update the kustomize version in your Makefile: ensure that the value used for KUSTOMIZE_VERSION is v4.5.5

In the config/default/kustomization.yaml file: a) Replace:

#commonLabels:
#  someName: someValue

With:

#labels:
#- includeSelectors: true
#  pairs:
#    someName: someValue

b) Replace: bases: With: resources:

(Valid Only for Ansible Projects)

In the molecule/default, replace --load_restrictor none . with --load-restrictor LoadRestrictionsNone

See #5965 for more details.

Docs: v1.22.0

Mon, 01 Jan 0001 00:00:00 +0000

For Ansible-based language operators, upgrade `community.kubernetes` from `1.2.1` to `2.0.1`.

IMPORTANT The community.kubernetes collection is being renamed to kubernetes.core. As of version 2.0.0, the collection has been replaced by deprecated redirects for all content to kubernetes.core. If you are using FQCNs starting with community.kubernetes, please update them to kubernetes.core. Ensure that you check the community.kubernetes changelog to verify if your Operator code must be updated and it is affected by the MAJOR changes.

In the requirements.yml file:

Replace:

collections:
  - name: community.kubernetes
    version: "1.2.1"

With:

collections:
  - name: community.kubernetes
    version: "2.0.1"

See #5846 for more details.

For Ansible-based language operators, upgrade `kubernetes.core` from `2.2.0` to `2.3.1`.

Ensure that you check the kubernetes.core changelog to verify if your Operator code must be updated and it is affected by the MAJOR changes.

In the requirements.yml file:

Replace:

collections:
  ...
  - name: kubernetes.core
    version: "2.2.0"

With:

collections:
  ...
  - name: kubernetes.core
    version: "2.3.1"

See #5846 for more details.

For Ansible-based language operators, upgrade `cloud.common` from `2.2.0` to `2.2.1`.

In the requirements.yml file:

Replace:

collections:
  ...
  - name: cloud.common
    version: "2.1.0"

With:

collections:
  ...
  - name: cloud.common
    version: "2.1.1"

See #5846 for more details.

Go (go/v3) and Helm Hybrid (hybrid.helm/v1-alpha) language based operators - Upgrade Kubernetes dependencies from `1.23` to `1.24` and controller-gen from `v0.8.0` to `v0.9.0`

To update your project to support Kubernetes 1.24:

In go.mod:

Replace k8s.io/api v0.23.5 with k8s.io/api v0.24.0
Replace k8s.io/apimachinery v0.23.5 with k8s.io/apimachinery v0.24.0
Replace k8s.io/client-go v0.23.5 with k8s.io/client-go v0.24.0
Replace sigs.k8s.io/controller-runtime v0.11.2 with sigs.k8s.io/controller-runtime v0.12.1
Hybrid Helm (hybrid) only: Replace github.com/operator-framework/helm-operator-plugins v0.0.11 with github.com/operator-framework/helm-operator-plugins v0.0.12-0.20220608155702-d3967d2ae2ac

Run go mod tidy to ensure all dependencies are upgraded
In Makefile:

Replace CONTROLLER_TOOLS_VERSION ?= 0.8.0 with CONTROLLER_TOOLS_VERSION ?= 0.9.0
Replace ENVTEST_K8S_VERSION = 1.23 with ENVTEST_K8S_VERSION = 1.24

Run make to run all make targets

See #5843 for more details.

Go (go/v3) and Hybrid Helm (hybrid.helm/v1-alpha) language based operators - Add support for Go 1.18

To update your project to use Go 1.18:

In the go.mod file:

Replace go 1.17 with go 1.18

Run go mod tidy to ensure all dependencies are upgraded

See #5843 for more details.

For Go (go/v3, go/v2), Ansible (ansible/v1), Helm (helm/v1), and Helm Hybrid (hybrid.helm/v1-alpha) language based operators - Bump OPM version from `v1.19.1` to `v1.23.0` More info

To update your project to use OPM v1.23.0:

In the Makefile:

Replace curl -sSLo $(OPM) https://github.com/operator-framework/operator-registry/releases/download/v1.19.1/$${OS}-$${ARCH}-opm with curl -sSLo $(OPM) https://github.com/operator-framework/operator-registry/releases/download/v1.23.0/$${OS}-$${ARCH}-opm

Run make opm

See #5843 for more details.

Docs: v1.21.0

Mon, 01 Jan 0001 00:00:00 +0000

(go/v3):For golang-language based operators, fix suite test using global cfg

In the suite test files, replace cfg, err := testEnv.Start() with:

var err error
// cfg is defined in this file globally.
cfg, err = testEnv.Start()

Note: You can find suite test files scaffold for the APIs created for your project such as api/webhook_suitetest.go directory as for your controllers in controllers/suite_test.go.

See #4863 for more details.

For Golang-based operators, update Dockerfile if you are using the declarative/v1 plugin

If you are using the declarative/v1 plugin for your scaffolds, then following the steps to update the Dockerfile. a) After COPY controllers/ controllers/ add:

# https://github.com/kubernetes-sigs/kubebuilder-declarative-pattern/blob/master/docs/addon/walkthrough/README.md#adding-a-manifest
# Stage channels and make readable
COPY channels/ /channels/
RUN chmod -R a+rx /channels/

b) After the COPY --from=builder /workspace/manager .” add:

# copy channels
COPY --from=builder /channels /channels

See #4863 for more details.

(go/v3):For Golang-based operators, upgrade controller-runtime from v0.11.0 to v0.11.2 and Kubernetes deps from 1.23.0 to 1.23.5

Update your go.mod by replacing sigs.k8s.io/controller-runtime v0.11.0 with sigs.k8s.io/controller-runtime v0.11.2 and run go mod tidy to update the K8s dependencies.

See #4863 for more details.

For Golang/Helm/Ansible-based operators, upgrade kube-rbac-proxy image from v0.8.0 to v0.11.0. (For further information see the kube-rbac-proxy release notes)

Update the tag version used for the image gcr.io/kubebuilder/kube-rbac-proxy in the file config/default/manager_auth_proxy_patch.yaml. Replace gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0 with gcr.io/kubebuilder/kube-rbac-proxy:v0.11.0

See #4863 for more details.

For Golang-based operators, change Makefile targets to replace go get with go install

The targets kustomize, controller-gen and envtest were changed. Update the Makefile replacing:

CONTROLLER_GEN = $(shell pwd)/bin/controller-gen
.PHONY: controller-gen
controller-gen: ## Download controller-gen locally if necessary.
	$(call go-get-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/controller-gen@v0.8.0)

KUSTOMIZE = $(shell pwd)/bin/kustomize
.PHONY: kustomize
kustomize: ## Download kustomize locally if necessary.
	$(call go-get-tool,$(KUSTOMIZE),sigs.k8s.io/kustomize/kustomize/v3@v3.8.7)

ENVTEST = $(shell pwd)/bin/setup-envtest
.PHONY: envtest
envtest: ## Download envtest-setup locally if necessary.
	$(call go-get-tool,$(ENVTEST),sigs.k8s.io/controller-runtime/tools/setup-envtest@latest)

# go-get-tool will 'go get' any package $2 and install it to $1.
PROJECT_DIR := $(shell dirname $(abspath $(lastword $(MAKEFILE_LIST))))
define go-get-tool
@[ -f $(1) ] || { \
set -e ;\
TMP_DIR=$$(mktemp -d) ;\
cd $$TMP_DIR ;\
go mod init tmp ;\
echo "Downloading $(2)" ;\
GOBIN=$(PROJECT_DIR)/bin go get $(2) ;\
rm -rf $$TMP_DIR ;\
}
endef

With:

##@ Build Dependencies

## Location to install dependencies to
LOCALBIN ?= $(shell pwd)/bin
$(LOCALBIN):
	mkdir -p $(LOCALBIN)

## Tool Binaries
KUSTOMIZE ?= $(LOCALBIN)/kustomize
CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
ENVTEST ?= $(LOCALBIN)/setup-envtest

## Tool Versions
KUSTOMIZE_VERSION ?= v3.8.7
CONTROLLER_TOOLS_VERSION ?= v0.8.0

KUSTOMIZE_INSTALL_SCRIPT ?= "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"
.PHONY: kustomize
kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary.
$(KUSTOMIZE): $(LOCALBIN)
	curl -s $(KUSTOMIZE_INSTALL_SCRIPT) | bash -s -- $(subst v,,$(KUSTOMIZE_VERSION)) $(LOCALBIN)

.PHONY: controller-gen
controller-gen: $(CONTROLLER_GEN) ## Download controller-gen locally if necessary.
$(CONTROLLER_GEN): $(LOCALBIN)
	GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-tools/cmd/controller-gen@$(CONTROLLER_TOOLS_VERSION)

.PHONY: envtest
envtest: $(ENVTEST) ## Download envtest-setup locally if necessary.
$(ENVTEST): $(LOCALBIN)
	GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest

See #4863 for more details.

Docs: v1.20.0

Mon, 01 Jan 0001 00:00:00 +0000

There are no migrations for this release! 🎉

Docs: v1.19.0

Mon, 01 Jan 0001 00:00:00 +0000

There are no migrations for this release! 🎉

Docs: v1.18.0

Mon, 01 Jan 0001 00:00:00 +0000

Bumped java-operator-plugins to v0.2.0

Additions:

- chore: bump go 1.17, k8s 1.23, and kubebuilder 3.3
- chore(deps): update to Quarkus SDK extension 3.0.2 and Quarkus 2.6.3
- chore(deps): update to use Quarkus JOSDK extension 3.0.1
- Remove useless file
- chore: bump k8s 1.22.2 and kubebuilder 3.2
- exposed exnpoints for micrometer metrics
- modified the Quarkus operator SDK version and tutorial too
- chore: bump fabric8 5.8.0 & quarkus 2.4.0
- modified the doc file and removed file after generation
- release: fix release script to understand release branches

Bug Fixes:

- Fix for wrongly generated file name

See #5542 for more details.

Support image digests instead of tags

Add following variables to your project’s Makefile below the BUNDLE_IMG ?=.

# BUNDLE_GEN_FLAGS are the flags passed to the operator-sdk generate bundle command
BUNDLE_GEN_FLAGS ?= -q --overwrite --version $(VERSION) $(BUNDLE_METADATA_OPTS)

# USE_IMAGE_DIGESTS defines if images are resolved via tags or digests
# You can enable this value if you would like to use SHA Based Digests
# To enable set flag to true
USE_IMAGE_DIGESTS ?= false
ifeq ($(USE_IMAGE_DIGESTS), true)
    BUNDLE_GEN_FLAGS += --use-image-digests
endif

Using the YAML string ‘|’ operator means that newlines in this string will Then in the bundle target we want to replace the flags passed to generate bundle with a reference to the BUNDLE_GEN_FLAGS above.

The generate bundle line should look like this

$(KUSTOMIZE) build config/manifests | operator-sdk generate bundle $(BUNDLE_GEN_FLAGS)

For reference the PREVIOUS version looked as follows

$(KUSTOMIZE) build config/manifests | operator-sdk generate bundle -q --overwrite --version $(VERSION) $(BUNDLE_METADATA_OPTS)

See #5567 for more details.

Add requirement cloud.common for Ansible-based operators

Add the following line in requirements.go when using operator ansible sdk:

- name: cloud.common
  version: "2.1.0"

See #5505 for more details.

Docs: v1.17.0

Mon, 01 Jan 0001 00:00:00 +0000

(go/v3) Upgrade go and dependencies

Upgrade controller-runtime from 0.10.0 to 0.11.0, k8s from 1.22 to 1.23 and controller-gen from v0.0.7 to v0.8.0. Following the steps to update your project.

Update the go.mod file with:

go 1.17

require (
  github.com/onsi/ginkgo v1.16.5
  github.com/onsi/gomega v1.17.0
  k8s.io/api v0.23.0
  k8s.io/apimachinery v0.23.0
  k8s.io/client-go v0.23.0
  sigs.k8s.io/controller-runtime v0.11.0
)

Run go mod tidy

Now, let’s update the Makefile targets accordingly:

Replace ENVTEST_K8S_VERSION = 1.22 with ENVTEST_K8S_VERSION = 1.23
Replace sigs.k8s.io/controller-tools/cmd/controller-gen@v0.7.0 with sigs.k8s.io/controller-tools/cmd/controller-gen@v0.8.0
Run make manifests and make generate to ensure that you will update your manifests with the new versions
You might want to run make all to ensure that all updates were done accordinly and succeffully

See #5505 for more details.

Reduce debug log level for the sidecar container kube-rbac-proxy from 10 to 0

Update the file config/default/manager_auth_proxy_patch.yaml by replacing "--v=10" with "--v=0"

See #5505 for more details.

Add resource requests and limits to kube-rbac-proxy

Update the file config/default/manager_auth_proxy_patch.yaml by adding:

...
resources:
  limits:
    cpu: 500m
    memory: 128Mi
  requests:
    cpu: 5m
    memory: 64Mi

See #5505 for more details.

Docs: v1.16.0

Mon, 01 Jan 0001 00:00:00 +0000

Ansible-based operators: add resource limits

Add into the config/manager/manager.yaml the following limits which are now scaffolded by default:

 ... 
 # TODO(user): Configure the resources accordingly based on the project requirements. # More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources:
  limits:
    cpu: 500m
    memory: 768Mi
  requests:
    cpu: 10m
    memory: 256Mi

IMPORTANT: Having resource limits is a best-practice and these values are reasonable defaults, but Operator authors should optimize these values based on their project’s requirements.

See #5274 for more details.

Bump operator_sdk.util in requirements.yml

Update requirements.yml to point to 0.3.1 of operator_sdk.util instead of 0.2.0

See #5462 for more details.

Add annotation to specify the default container

Add the following annotation into the file config/manager/manager.yaml

...
template:
  metadata:
    annotations:
      kubectl.kubernetes.io/default-container: manager
...

See #5330 for more details.

Add PHONY targets to Makefile

Add PHONY target to all Makefile targets. For example, refer to the Makefile in operator-sdk/testdata directory of OperatorSDK tagged by the release containing this change.

See #5330 for more details.

For Golang-based projects, add the flag `ignore-not-found` into the Makefile for the `uninstall` and `undeploy` targets

Update the Makefile with the following changes.

Above ##@ Deployment add the following:

...
ifndef ignore-not-found
  ignore-not-found = false
endif
...

Replace: sh kubectl delete -f - With: sh kubectl delete --ignore-not-found=$(ignore-not-found) -f -

NOTE You can also compare your Makefile with the one tagged by this release, in operator-sdk/testdata of the OperatorSDK project.

See #5330 for more details.

Docs: v1.15.0

Mon, 01 Jan 0001 00:00:00 +0000

Update ansible collection `community.kubernetes` to `kubernetes.core`

Add the kubernetes.core collection (>= 2.2.0) to the requrements.yml file

name: kubernetes.core version: “2.2.0”

See #5249 for more details.

Docs: v1.14.0

Mon, 01 Jan 0001 00:00:00 +0000

Upgrade K8s versions to use 1.22 (golang/v3)

Note that to ensure the backwards compatibility SDK tool will try to downgrade the versions used if you need to still scaffold the v1beta1 for CRDs and Webhooks to publish your solutions into older cluster versions. However, note that this version is no longer supported in Kubernetes 1.22+, sigs.k8s.io/controller-runtime v0.10.0 or controller-gen v0.7.0. Following are the changes to be addressed in your Makefile and go.mod file if you are not using the v1beta1 K8s APIs which are no longer supported from k8s 1.22 version.

Update your go.mod file to upgrade the dependencies and run go mod tidy to download then

k8s.io/api v0.22.1
k8s.io/apimachinery v0.22.1
k8s.io/client-go v0.22.1
sigs.k8s.io/controller-runtime v0.10.0

Update your Makefile by making the following replacements:

- ENVTEST_K8S_VERSION = 1.21
+ ENVTEST_K8S_VERSION = 1.22

- $(CONTROLLER_GEN) $(CRD_OPTIONS) rbac:roleName=manager-role webhook paths="./..." output:crd:artifacts:config=config/crd/bases
+ $(CONTROLLER_GEN) rbac:roleName=manager-role crd webhook paths="./..." output:crd:artifacts:config=config/crd/bases

Remove from the Makefile the CRD_OPTIONS, see below:

# Produce CRDs that work back to Kubernetes 1.11 (no version conversion)
CRD_OPTIONS ?= "crd:trivialVersions=true,preserveUnknownFields=false"

Replace your admissionReviewVersions={v1,v1beta1} markers with admissionReviewVersions=v1
Run make manifest to re-generate your manifests with latest versions.

See #5228 for more details.

For Ansible-based Operators, update ansible collection `community.kubernetes` to `kubernetes.core`

Add the kubernetes.core collection (>= 2.2.0) to the requrements.yml file

name: kubernetes.core version: “2.2.0”

See #5249 for more details.

Docs: v1.13.0

Mon, 01 Jan 0001 00:00:00 +0000

(Optional) Update local version of `ansible-runner`

ansible-runner 2.0+ includes a backwards incompatible change in the command signature, so in order to use make run with Ansible-based operators, users will need to upgrade their local version of ansible-runner to 2.0.2+

See #5205 for more details.

Docs: v1.12.0

Mon, 01 Jan 0001 00:00:00 +0000

There are no migrations for this release! 🎉

Docs: v1.11.0

Mon, 01 Jan 0001 00:00:00 +0000

(optional) Add local Ansible Roles path to Env in `make run`

If you would like to run your operator locally using make run, modify the run target in the Makefile to: ANSIBLE_ROLES_PATH="$(ANSIBLE_ROLES_PATH):$(shell pwd)/roles" $(ANSIBLE_OPERATOR) run

See #5118 for more details.

(go/v3) Export `KUBEBUILDER_ASSETS` in `Makefile`

In go/v3 projects, after installing setup-envtest binary, the path to KUBEBUILDER_ASSETS needs to be exported. In Makefile, add the following:

  +# ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
  +ENVTEST_K8S_VERSION = 1.21

  test: manifests generate fmt vet envtest ## Run tests.
  - go test ./... -coverprofile cover.out
  + KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path)" go test ./... -coverprofile cover.out

See #4863 for more details.

(go/v3, ansible/v1, helm/v1) Add `containerPort` protocol field in manifests.

In go/v3, ansible/v1, helm/v1 projects, specify the containerPort protocol in the following files: - config/default/manager_auth_proxy_patch.yaml - config/rbac/auth_proxy_service.yaml

  ports:
 - containerPort: 8443
 + protocol: TCP
   name: https

Additionally, in go/v3 projects, add the containerPort protocol to config/webhook/service.yaml:

   ports:
    - port: 443
    + protocol: TCP
      targetPort: 9443

See #4863 for more details.

(go/v3, ansible/v1, helm/v1) Increase resource limits for controller manager.

In go/v3, ansible/v1, helm/v1 projects, increase the cpu and memory resource limits to 200m and 100Mi respectively in config/manager/manager.yaml.

  resources:
   limits:
    - cpu: 100m
    - memory: 30Mi
    + cpu: 200m
    + memory: 100Mi

See #4863 for more details.

Docs: v1.10.0

Mon, 01 Jan 0001 00:00:00 +0000

(ansible/v1) Bump Kustomize version in helm project scaffolding to 3.8.7

Ansible projects are now scaffolded with Kustomize version 3.8.7. This version of kustomize requires that the path to patch file be provided with the --path flag in add patch command. In molecule/default/prepare.yml file, update the command under Set pull policy, to be:

     - name: Set pull policy
-      command: '{{ "{{ kustomize }}" }} edit add patch pull_policy/{{ "{{ operator_pull_policy }}" }}.yaml'
+      command: '{{ "{{ kustomize }}" }} edit add patch --path pull_policy/{{ "{{ operator_pull_policy }}" }}.yaml'

See #5057 for more details.

Docs: v1.9.0

Mon, 01 Jan 0001 00:00:00 +0000

The ansible-operator binary will reject the kubeconfig if the server URL contains a path.

There is currently no workaround other than running the operator as a pod in the cluster (where it will use the internal endpoint). The fix for this issue is currently blocked waiting on a fix to the apimachinery package. Once the upstream issue is merged then a proper fix will be done for ansible-operator. Work on this issue is being tracked here: https://github.com/operator-framework/operator-sdk/issues/4925

See #4987 for more details.

Docs: v1.8.0

Mon, 01 Jan 0001 00:00:00 +0000

There are no migrations for this release! 🎉

Docs: v1.7.1

Mon, 01 Jan 0001 00:00:00 +0000

Add the manager config patch to config/default/kustomization.yaml

The scaffolded --config flag was not added to either ansible-/helm-operator binary when config file support was originally added, so does not currently work. The --config flag supports configuration of both binaries by file; this method of configuration only applies to the underlying controller manager, not the operator as a whole. To optionally configure the operator’s Deployment with a config file, make the following update to config/default/kustomization.yaml:

# If you want your controller-manager to expose the /metrics # endpoint w/o any authn/z, please comment the following line.
\- manager_auth_proxy_patch.yaml
+# Mount the controller config file for loading manager configurations
+# through a ComponentConfig type
+- manager_config_patch.yaml

This feature is opt-in: flags can be used as-is or to override config file values.

See #4776 for more details.

Deprecate support for packagemanifests.

The operator-framework is removing support for the packagemanifests format in the near future. Hence, operator-sdk generate packagemanifests and operator-sdk run packagemanifests commands are deprecated. In order to migrate packagemanifests to bundles, operator-sdk pkgman-to-bundle command can be used. Run operator-sdk pkgman-to-bundle --help for more details.

See #4838 for more details.

(go/v3, ansible/v1, helm/v1) Move `leases.coordination.k8s.io` to its own proxy-role rule

Make the following changes to config/rbac/leader_election_role.yaml:

rules:
\- apiGroups:
  - ""
-  - coordination.k8s.io
  resources:
  - configmaps
+ verbs:
+- get
+- list
+- watch
+- create
+- update
+- patch
+- delete
+- apiGroups:
+- coordination.k8s.io
+ resources:
    - leases
  verbs:
    - get

See #4835 for more details.

(go/v3) Set the Makefile’s `SHELL` variable to the system’s `bash` binary

Importing setup-envtest.sh needs bash, so your Makefile’s SHELL variable should be set to bash with error options:

else GOBIN=$(shell go env GOBIN)
endif
+# Setting SHELL to bash allows bash commands to be executed by recipes.
+# This is a requirement for 'setup-envtest.sh' in the test target.
+# Options are set to exit when a recipe line exits non-zero or a piped command fails.
+SHELL = /usr/bin/env bash -o pipefail
+.SHELLFLAGS = -ec
+ all: build

See #4835 for more details.

Ensure that existing dependent resources have owner annotations

For Ansible-based operators, owner reference annotations on cluster-scoped dependent resources and dependent resources in other namespaces were not applied correctly. A workaround was to add these annotations manually, which is no longer required as this bug has been fixed.

See #4850 for more details.

(go/v3) Bump controller-runtime to v0.8.3 and kubernetes dependencies to v0.20.2

In your go.mod, change controller-runtime’s version to v0.8.3 and kubernetes dependencies to v0.20.2, then rebuild your project.

See #4863 for more details.

Docs: v1.7.0

Mon, 01 Jan 0001 00:00:00 +0000

Add the manager config patch to config/default/kustomization.yaml

# If you want your controller-manager to expose the /metrics # endpoint w/o any authn/z, please comment the following line.
- manager_auth_proxy_patch.yaml
+# Mount the controller config file for loading manager configurations
+# through a ComponentConfig type
+- manager_config_patch.yaml

This feature is opt-in: flags can be used as-is or to override config file values.

See #4776 for more details.

Deprecate support for packagemanifests.

See #4838 for more details.

(go/v3, ansible/v1, helm/v1) Move `leases.coordination.k8s.io` to its own proxy-role rule

Make the following changes to config/rbac/leader_election_role.yaml:

rules: \- apiGroups:
  - ""
-  - coordination.k8s.io
  resources:
  - configmaps
+ verbs:
+- get
+- list
+- watch
+- create
+- update
+- patch
+- delete
+- apiGroups:
+- coordination.k8s.io
+ resources:
    - leases
  verbs:
    - get

See #4835 for more details.

(go/v3) Set the Makefile’s `SHELL` variable to the system’s `bash` binary

Importing setup-envtest.sh needs bash, so your Makefile’s SHELL variable should be set to bash with error options:

else GOBIN=$(shell go env GOBIN)
endif
+# Setting SHELL to bash allows bash commands to be executed by recipes.
+# This is a requirement for 'setup-envtest.sh' in the test target.
+# Options are set to exit when a recipe line exits non-zero or a piped command fails.
+SHELL = /usr/bin/env bash -o pipefail
+.SHELLFLAGS = -ec
+ all: build

See #4835 for more details.

Docs: v1.6.0

Mon, 01 Jan 0001 00:00:00 +0000

(ansible/v1, helm/v1) Optional: configure `ansible-operator` and `helm-operator` with a component config.

To add this option your project you will need to:

Create the file config/default/manager_config_patch.yaml.
Create the file config/manager/controller_manager_config.yaml.
Update the config/default/kustomization.yaml by adding the following to resources:
```
resources:
...
- manager_config_patch.yaml
```
Update the config/manager/kustomization.yaml by adding:

  generatorOptions:
    disableNameSuffixHash: true

  configMapGenerator:
  - files:
    - controller_manager_config.yaml
    name: manager-config
  apiVersion: kustomize.config.k8s.io/v1beta1
  kind: Kustomization
  images:
  - name: controller
    newName: quay.io/example/memcached-operator
    newTag: v0.0.1

See #4701 for more details.

(ansible/v1, helm/v1) Add Role rules for leader election.

Add the rule for the apiGroups coordination.k8s.io and the resource leases in config/rbac/leader_election_role.yaml:

rules:
  - apiGroups:
      - ""
      - coordination.k8s.io
    resources:
      - configmaps
      - leases

See #4701 for more details.

(ansible/v1) Update Ansible collections

In your requirements.yml, change the version field for community.kubernetes to 1.2.1, and the version field for operator_sdk.util to 0.2.0.

See #4734 for more details.

(helm/v1) Replace deprecated leader election and metrics address flags

Replace deprecated flags --enable-leader-election and --metrics-addr with --leader-elect and --metrics-bind-address, respectively.

See #4654 for more details.

(helm/v1) Explicitly set `--health-probe-bind-address` in the manager’s auth proxy patch.

Add the arg --health-probe-bind-address=:8081 to the config/default/manager_auth_proxy_patch.yaml:

spec:
  template:
    spec:
      containers:
      - name: manager
        args:
        - "--health-probe-bind-address=:8081"
        ...

See #4654 for more details.

(ansible/v1) Explicitly set `--health-probe-bind-address` in the manager’s auth proxy patch.

Add the arg --health-probe-bind-address=:6789 to the config/default/manager_auth_proxy_patch.yaml:

spec:
  template:
    spec:
      containers:
      - name: manager
        args:
        - "--health-probe-bind-address=:6789"
        ...

See #4654 for more details.

(helm/v1, ansible/v1) Add `help` target to Makefile.

Ansible/Helm projects now provide a Makefile help target, similar to a --help flag. You can copy and paste this target from the relevant sample’s Makefile (helm, ansible).

See #4660 for more details.

(ansible/v1, helm/v1) Add `securityContext`'s to your manager’s Deployment.

In config/manager/manager.yaml, add the following security contexts:

spec:
  ...
  template:
    ...
    spec:
      securityContext:
        runAsNonRoot: true
      containers:
      - name: manager
        securityContext:
          allowPrivilegeEscalation: false

See #4655 for more details.

(manifests/v2) Add a kustomize patch to remove the cert-manager volume/volumeMount from your CSV

OLM does not yet support cert-manager, so a JSON patch was added to remove this volume and mount such that OLM can itself create and manage certs for your Operator. In config/manifests/kustomization.yaml, add the following:

#patchesJson6902:
#- target:
#    group: apps
#    version: v1
#    kind: Deployment
#    name: controller-manager
#    namespace: system
#  patch: |-
#    # Remove the manager container's "cert" volumeMount, since OLM will create and mount a set of certs.
#    # Update the indices in this path if adding or removing containers/volumeMounts in the manager's Deployment.
#    - op: remove
#      path: /spec/template/spec/containers/1/volumeMounts/0
#    # Remove the "cert" volume, since OLM will create and mount a set of certs.
#    # Update the indices in this path if adding or removing volumes in the manager's Deployment.
#    - op: remove
#      path: /spec/template/spec/volumes/0

If you have configured your operator to use webhooks, add this YAML block uncommented.

See #4623 for more details.

(go/v2, go/v3, ansible/v1, helm/v1) Add scheme, token, and TLS config to the Prometheus `ServiceMonitor` metrics endpoint.

The /metrics endpoint, while specifying the https port on the manager Pod, was not actually configured to serve over https because no tlsConfig was set. Since kube-rbac-proxy secures this endpoint as a manager sidecar, using the service account token mounted into the Pod by default corrects this problem. The changes should look like:

# config/prometheus/monitor.yaml
spec:
   endpoints:
     - path: /metrics
       port: https
+      scheme: https
+      bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+      tlsConfig:
+        insecureSkipVerify: true
   selector:
     matchLabels:
       control-plane: controller-manager

Note: if you have removed kube-rbac-proxy from your project, make sure to secure the /metrics endpoint using a proper TLS configuration.

See #4680 for more details.

(go/v2, go/v3, ansible/v1, helm/v1) Add `opm` and `catalog-build` Makefile targets

The opm and catalog-build Makefile targets were added so operator developers who want to create their own catalogs for their operator or add their operator’s bundle(s) to an existing catalog can do so. If this sounds like you, add the following lines to the bottom of your Makefile:

.PHONY: opm
OPM = ./bin/opm
opm:
ifeq (,$(wildcard $(OPM)))
ifeq (,$(shell which opm 2>/dev/null))
	@{ \
	set -e ;\
	mkdir -p $(dir $(OPM)) ;\
	curl -sSLo $(OPM) https://github.com/operator-framework/operator-registry/releases/download/v1.19.1/$(OS)-$(ARCH)-opm ;\
	chmod +x $(OPM) ;\
	}
else 
OPM = $(shell which opm)
endif
endif
BUNDLE_IMGS ?= $(BUNDLE_IMG) 
CATALOG_IMG ?= $(IMAGE_TAG_BASE)-catalog:v$(VERSION) ifneq ($(origin CATALOG_BASE_IMG), undefined) FROM_INDEX_OPT := --from-index $(CATALOG_BASE_IMG) endif 
.PHONY: catalog-build
catalog-build: opm
	$(OPM) index add --container-tool docker --mode semver --tag $(CATALOG_IMG) --bundles $(BUNDLE_IMGS) $(FROM_INDEX_OPT)

.PHONY: catalog-push
catalog-push: ## Push the catalog image.
	$(MAKE) docker-push IMG=$(CATALOG_IMG)

If updating a Go operator project, additionally add the following Makefile variables:

OS = $(shell go env GOOS)
ARCH = $(shell go env GOARCH)

See #4406 for more details.

(go/v2, go/v3, ansible/v1, helm/v1) Changed `BUNDLE_IMG` and added `IMAGE_TAG_BASE` Makefile variables

The following Makefile changes were made to allow make bundle-build bundle-push catalog-build catalog-push and encode image repo/namespace information in the Makefile by default:

+IMAGE_TAG_BASE ?= <registry>/<operator name>
+ 
-BUNDLE_IMG ?= controller-bundle:$(VERSION)
+BUNDLE_IMG ?= $(IMAGE_TAG_BASE)-bundle:v$(VERSION)

For example, if IMAGE_TAG_BASE ?= foo/bar-operator then running make bundle-build bundle-push catalog-build catalog-push would build foo/bar-operator-bundle:v0.0.1 and foo/bar-operator-catalog:v0.0.1 then push them to the docker.io/foo namespaced registry.

See #4406 for more details.

(ansible/v1, helm/v1) Add the `controller-manager` ServiceAccount to your project.

A non-default ServiceAccount controller-manager is scaffolded on operator-sdk init, to improve security for operators installed in shared namespaces. To add this ServiceAccount to your project, do the following:

# Create the ServiceAccount.
cat <<EOF > config/rbac/service_account.yaml apiVersion: v1 
kind: ServiceAccount
metadata:
  name: controller-manager
  namespace: system
EOF
# Add it to the list of RBAC resources.
echo "- service_account.yaml" >> config/rbac/kustomization.yaml
# Update all RoleBinding and ClusterRoleBinding subjects that reference the operator's ServiceAccount.
find config/rbac -name *_binding.yaml -exec sed -i -E 's/  name: default/  name: controller-manager/g' {} \; # Add the ServiceAccount name to the manager Deployment's spec.template.spec.serviceAccountName. sed -i -E 's/([ ]+)(terminationGracePeriodSeconds:)/\1serviceAccountName: controller-manager\n\1\2/g' config/manager/manager.yaml

The changes should look like:

# config/manager/manager.yaml
           requests:
             cpu: 100m
             memory: 20Mi
+      serviceAccountName: controller-manager
       terminationGracePeriodSeconds: 10
# config/rbac/auth_proxy_role_binding.yaml
   name: proxy-role
 subjects:
 - kind: ServiceAccount
-  name: default 
+  name: controller-manager
   namespace: system
# config/rbac/kustomization.yaml
 resources:
+- service_account.yaml
 - role.yaml
 - role_binding.yaml
 - leader_election_role.yaml
# config/rbac/leader_election_role_binding.yaml
   name: leader-election-role
 subjects:
 - kind: ServiceAccount
-  name: default
+  name: controller-manager
   namespace: system
# config/rbac/role_binding.yaml
   name: manager-role
 subjects:
 - kind: ServiceAccount
-  name: default 
+  name: controller-manager
   namespace: system
# config/rbac/service_account.yaml 
+apiVersion: v1 
+kind: ServiceAccount 
+metadata: 
+  name: controller-manager 
+  namespace: system

See #4653 for more details.

Docs: v1.6.1

Mon, 01 Jan 0001 00:00:00 +0000

(ansible/v1, helm/v1) Optional: configure `ansible-operator` and `helm-operator` with a component config.

To add this option your project you will need to:

Create the file config/default/manager_config_patch.yaml.
Create the file config/manager/controller_manager_config.yaml.
Update the config/default/kustomization.yaml by adding the following to resources:
```
resources:
...
- manager_config_patch.yaml
```
Update the config/manager/kustomization.yaml by adding:

  generatorOptions:
    disableNameSuffixHash: true

  configMapGenerator:
  - files:
    - controller_manager_config.yaml
    name: manager-config
  apiVersion: kustomize.config.k8s.io/v1beta1
  kind: Kustomization
  images:
  - name: controller
    newName: quay.io/example/memcached-operator
    newTag: v0.0.1

See #4701 for more details.

(ansible/v1, helm/v1) Add Role rules for leader election.

Add the rule for the apiGroups coordination.k8s.io and the resource leases in config/rbac/leader_election_role.yaml:

rules:
  - apiGroups:
      - ""
      - coordination.k8s.io
    resources:
      - configmaps
      - leases

See #4701 for more details.

(ansible/v1) Update Ansible collections

In your requirements.yml, change the version field for community.kubernetes to 1.2.1, and the version field for operator_sdk.util to 0.2.0.

See #4734 for more details.

(helm/v1) Replace deprecated leader election and metrics address flags

Replace deprecated flags --enable-leader-election and --metrics-addr with --leader-elect and --metrics-bind-address, respectively.

See #4654 for more details.

(helm/v1) Explicitly set `--health-probe-bind-address` in the manager’s auth proxy patch.

Add the arg --health-probe-bind-address=:8081 to the config/default/manager_auth_proxy_patch.yaml:

spec:
  template:
    spec:
      containers:
      - name: manager
        args:
        - "--health-probe-bind-address=:8081"
        ...

See #4654 for more details.

(ansible/v1) Explicitly set `--health-probe-bind-address` in the manager’s auth proxy patch.

Add the arg --health-probe-bind-address=:6789 to the config/default/manager_auth_proxy_patch.yaml:

spec:
  template:
    spec:
      containers:
      - name: manager
        args:
        - "--health-probe-bind-address=:6789"
        ...

See #4654 for more details.

(helm/v1, ansible/v1) Add `help` target to Makefile.

Ansible/Helm projects now provide a Makefile help target, similar to a --help flag. You can copy and paste this target from the relevant sample’s Makefile (helm, ansible).

See #4660 for more details.

(ansible/v1, helm/v1) Add `securityContext`'s to your manager’s Deployment.

In config/manager/manager.yaml, add the following security contexts:

spec:
  ...
  template:
    ...
    spec:
      securityContext:
        runAsNonRoot: true
      containers:
      - name: manager
        securityContext:
          allowPrivilegeEscalation: false

See #4655 for more details.

(manifests/v2) Add a kustomize patch to remove the cert-manager volume/volumeMount from your CSV

#patchesJson6902:
#- target:
#    group: apps
#    version: v1
#    kind: Deployment
#    name: controller-manager
#    namespace: system
#  patch: |-
#    # Remove the manager container's "cert" volumeMount, since OLM will create and mount a set of certs.
#    # Update the indices in this path if adding or removing containers/volumeMounts in the manager's Deployment.
#    - op: remove
#      path: /spec/template/spec/containers/1/volumeMounts/0
#    # Remove the "cert" volume, since OLM will create and mount a set of certs.
#    # Update the indices in this path if adding or removing volumes in the manager's Deployment.
#    - op: remove
#      path: /spec/template/spec/volumes/0

If you have configured your operator to use webhooks, add this YAML block uncommented.

See #4623 for more details.

(go/v2, go/v3, ansible/v1, helm/v1) Add scheme, token, and TLS config to the Prometheus `ServiceMonitor` metrics endpoint.

# config/prometheus/monitor.yaml
spec:
   endpoints:
     - path: /metrics
       port: https
+      scheme: https
+      bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+      tlsConfig:
+        insecureSkipVerify: true
   selector:
     matchLabels:
       control-plane: controller-manager

Note: if you have removed kube-rbac-proxy from your project, make sure to secure the /metrics endpoint using a proper TLS configuration.

See #4680 for more details.

(go/v2, go/v3, ansible/v1, helm/v1) Add `opm` and `catalog-build` Makefile targets

.PHONY: opm
OPM = ./bin/opm
opm:
ifeq (,$(wildcard $(OPM)))
ifeq (,$(shell which opm 2>/dev/null))
	@{ \
	set -e ;\
	mkdir -p $(dir $(OPM)) ;\
	curl -sSLo $(OPM) https://github.com/operator-framework/operator-registry/releases/download/v1.19.1/$(OS)-$(ARCH)-opm ;\
	chmod +x $(OPM) ;\
	}
else 
OPM = $(shell which opm)
endif
endif
BUNDLE_IMGS ?= $(BUNDLE_IMG) 
CATALOG_IMG ?= $(IMAGE_TAG_BASE)-catalog:v$(VERSION) ifneq ($(origin CATALOG_BASE_IMG), undefined) FROM_INDEX_OPT := --from-index $(CATALOG_BASE_IMG) endif 
.PHONY: catalog-build
catalog-build: opm
	$(OPM) index add --container-tool docker --mode semver --tag $(CATALOG_IMG) --bundles $(BUNDLE_IMGS) $(FROM_INDEX_OPT)

.PHONY: catalog-push
catalog-push: ## Push the catalog image.
	$(MAKE) docker-push IMG=$(CATALOG_IMG)

If updating a Go operator project, additionally add the following Makefile variables:

OS = $(shell go env GOOS)
ARCH = $(shell go env GOARCH)

See #4406 for more details.

(go/v2, go/v3, ansible/v1, helm/v1) Changed `BUNDLE_IMG` and added `IMAGE_TAG_BASE` Makefile variables

The following Makefile changes were made to allow make bundle-build bundle-push catalog-build catalog-push and encode image repo/namespace information in the Makefile by default:

+IMAGE_TAG_BASE ?= <registry>/<operator name>
+ 
-BUNDLE_IMG ?= controller-bundle:$(VERSION)
+BUNDLE_IMG ?= $(IMAGE_TAG_BASE)-bundle:v$(VERSION)

See #4406 for more details.

(ansible/v1, helm/v1) Add the `controller-manager` ServiceAccount to your project.

# Create the ServiceAccount.
cat <<EOF > config/rbac/service_account.yaml apiVersion: v1 
kind: ServiceAccount
metadata:
  name: controller-manager
  namespace: system
EOF
# Add it to the list of RBAC resources.
echo "- service_account.yaml" >> config/rbac/kustomization.yaml
# Update all RoleBinding and ClusterRoleBinding subjects that reference the operator's ServiceAccount.
find config/rbac -name *_binding.yaml -exec sed -i -E 's/  name: default/  name: controller-manager/g' {} \; 
# Add the ServiceAccount name to the manager Deployment's spec.template.spec.serviceAccountName. 
sed -i -E 's/([ ]+)(terminationGracePeriodSeconds:)/\1serviceAccountName: controller-manager\n\1\2/g' config/manager/manager.yaml

The changes should look like:

# config/manager/manager.yaml
           requests:
             cpu: 100m
             memory: 20Mi
+      serviceAccountName: controller-manager
       terminationGracePeriodSeconds: 10
# config/rbac/auth_proxy_role_binding.yaml
   name: proxy-role
 subjects:
 - kind: ServiceAccount
-  name: default 
+  name: controller-manager
   namespace: system
# config/rbac/kustomization.yaml
 resources:
+- service_account.yaml
 - role.yaml
 - role_binding.yaml
 - leader_election_role.yaml
# config/rbac/leader_election_role_binding.yaml
   name: leader-election-role
 subjects:
 - kind: ServiceAccount
-  name: default
+  name: controller-manager
   namespace: system
# config/rbac/role_binding.yaml
   name: manager-role
 subjects:
 - kind: ServiceAccount
-  name: default 
+  name: controller-manager
   namespace: system
# config/rbac/service_account.yaml 
+apiVersion: v1 
+kind: ServiceAccount 
+metadata: 
+  name: controller-manager 
+  namespace: system

See #4653 for more details.

Docs: v1.5.0

Mon, 01 Jan 0001 00:00:00 +0000

For Go-based operators, migrate your project to use the project version stable.

The PROJECT version config file represents the project configuration. It reach the maturate stability and it will store the data used to do the scaffolds. The motivation for this behaviour is to allow tools and helpers in the future such as to make easier the process to update the projects to use upper versions. More info: TBD. //TODO: add link for docs (see the PR kubernetes-sigs/kubebuilder#1916)

See #4402 for more details.

PROJECT config version 3-alpha must be upgraded to 3.

PROJECT config version 3-alpha has been stabilized as version 3 (the version key in your PROJECT file), and contains a set of config fields sufficient to fully describe a project. While this change is not technically breaking because the spec at that version was alpha, it was used by default in operator-sdk commands so should be marked as breaking and have a convenient migration path. The alpha config-3alpha-to-3 command will convert most of your PROJECT file from version 3-alpha to 3, and leave comments with directions where automatic conversion is not possible:

$ cat PROJECT
version: 3-alpha
resources:
- crdVersion: v1
...

$ operator-sdk alpha config-3alpha-to-3
Your PROJECT config file has been converted from version 3-alpha to 3. Please make sure all config data is correct.
$ cat PROJECT
version: "3" 
esources:
- api:
  crdVersion: v1
...

See #4613 for more details.

(go/v3) Upgrade controller-runtime to v0.7.2.

In your go.mod file, upgrade sigs.k8s.io/controller-runtime to v0.7.2.

See #4626 for more details.

(go/v3) Add a `system:controller-manager` ServiceAccount to your project.

# Create the ServiceAccount.
cat <<EOF > config/rbac/service_account.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: controller-manager
  namespace: system
EOF

# Add it to the list of RBAC resources.
echo "- service_account.yaml" >> config/rbac/kustomization.yaml

# Update all RoleBinding and ClusterRoleBinding subjects that reference the operator's ServiceAccount.
find config/rbac -name *_binding.yaml -exec sed -i -E 's/  name: default/  name: controller-manager/g' {} \;

# Add the ServiceAccount name to the manager Deployment's spec.template.spec.serviceAccountName.
sed -i -E 's/([ ]+)(terminationGracePeriodSeconds:)/\1serviceAccountName: controller-manager\n\1\2/g' config/manager/manager.yaml

The changes should look like:

# config/manager/manager.yaml
           requests:
             cpu: 100m
             memory: 20Mi
+      serviceAccountName: controller-manager
       terminationGracePeriodSeconds: 10

# config/rbac/auth_proxy_role_binding.yaml
   name: proxy-role
 subjects:
 - kind: ServiceAccount
-  name: default 
+  name: controller-manager
   namespace: system

# config/rbac/kustomization.yaml
 resources:
+- service_account.yaml
 - role.yaml
 - role_binding.yaml
 - leader_election_role.yaml

# config/rbac/leader_election_role_binding.yaml
   name: leader-election-role
 subjects:
 - kind: ServiceAccount
-  name: default 
+  name: controller-manager
   namespace: system

# config/rbac/role_binding.yaml
   name: manager-role
 subjects:
 - kind: ServiceAccount
-  name: default 
+  name: controller-manager
   namespace: system

# config/rbac/service_account.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: controller-manager
+  namespace: system

See #4626 for more details.

(ansible/v1, helm/v1) Swap the paths of liveness/readiness probes in `config/manager/manager.yaml`.

The liveness and readiness probe endpoints were incorrectly named, although this mismatch will not affect their behavior. To fix, swap the readinessProbe and livenessProbe HTTP paths in config/manager/manager.yaml:

  livenessProbe:
    httpGet:
      path: /healthz
      port: 6789
    initialDelaySeconds: 15
    periodSeconds: 20
  readinessProbe:
    httpGet:
      path: /readyz
      port: 6789
    initialDelaySeconds: 5
    periodSeconds: 10

See #4546 for more details.

Docs: v1.4.0

Mon, 01 Jan 0001 00:00:00 +0000

Change your operator’s finalizer names

The finalizer name format suggested by Kubernetes docs is <qualified-group>/<finalizer-name>, while the format previously documented by Operator SDK docs was <finalizer-name>.<qualified-group>. If your operator uses any finalizers with names matching the incorrect format, change them to match the official format. For example, finalizer.cache.example.com should be changed to cache.example.com/finalizer.

See #4472 for more details.

For Helm and Ansible projects, fix the helm-operator and ansible-operator URLs in the Makefile

Helm projects: Old: https://github.com/operator-framework/operator-sdk/releases/download/v1.3.0/helm-operator-v1.3.0-$(ARCHOPER)-$(OSOPER) New: https://github.com/operator-framework/operator-sdk/releases/download/v1.3.1/helm-operator_$(OS)_$(ARCH)
Ansible projects: Old: https://github.com/operator-framework/operator-sdk/releases/download/v1.3.0/ansible-operator-v1.3.0-$(ARCHOPER)-$(OSOPER) New: https://github.com/operator-framework/operator-sdk/releases/download/v1.3.1/ansible-operator_$(OS)_$(ARCH)

See #4407 for more details.

For Helm and Ansible projects, fix the `helm-operator`, `ansible-operator`, and `kustomize` Makefile rules

These rules will download a local binary but not use it if a global binary is present. See the diff in this PR for how to fix this.

See #4412 for more details.

For Helm-based operators, add Liveness and Readiness probe

New projects built with the tool will have the probes configured by default. The endpoints /healthz and /readyz are available now in the image based provided. You can update your pre-existing project to use them. For that update the Dockerfile to use the latest release base image, then add the following to the manager container in config/manager/manager.yaml:

  livenessProbe:
    httpGet:
      path: /healthz
      port: 8081
    initialDelaySeconds: 15
    periodSeconds: 20
  readinessProbe:
    httpGet:
      path: /readyz
      port: 8081
    initialDelaySeconds: 5
    periodSeconds: 10

See #4326 for more details.

For Ansible-based operators, add Liveness and Readiness probe

  livenessProbe:
    httpGet:
      path: /healthz
      port: 6789
    initialDelaySeconds: 15
    periodSeconds: 20
  readinessProbe:
    httpGet:
      path: /readyz
      port: 6789
    initialDelaySeconds: 5
    periodSeconds: 10

See #4326 for more details.

(go/v2) Change `go` PROJECT plugin object to `manifests` and `scorecard` objects

The manifests and scorecard plugins that create OLM and scorecard manifests, respectively, now have plugin objects that direct create subcommands to create related files. While the old go plugin configuration object is still supported, these new objects will be useful in the future as configuration options are added to their respective plugins:

Old:

version: 3-alpha
...
plugins:
  go.sdk.operatorframework.io/v2-alpha: {}

New:

version: 3-alpha
...
plugins:
  manifests.sdk.operatorframework.io/v2: {}
  scorecard.sdk.operatorframework.io/v2: {}

See #4419 for more details.

(ansible/v1, helm/v1) Add `manifests` and `scorecard` plugin objects to your PROJECT

The manifests and scorecard plugins that create OLM and scorecard manifests, respectively, now have plugin objects that direct create subcommands to create related files. While not necessary to add, these new plugin configuration objects in the PROJECT file will be useful in the future as configuration options are added to their respective plugins:

version: 3-alpha
...
plugins:
  manifests.sdk.operatorframework.io/v2: {}
  scorecard.sdk.operatorframework.io/v2: {}

See #4419 for more details.

Move positional directory argument `.` in `docker-build` make target

The directory argument . in the docker-build make target was moved to the last positional argument to align with podman's expectations, making substitution cleaner.

Old:

docker-build:
  docker build . -t ${IMG}

New:

docker-build:
  docker build -t ${IMG} .

Alternatively, you could replace it programmatically

sed -i 's/docker build . -t ${IMG}/docker build -t ${IMG} ./' $(git grep -l 'docker.*build \. ')

See #4466 for more details.

Docs: v1.3.0

Mon, 01 Jan 0001 00:00:00 +0000

Update `packagemanifests` make recipe variable `PKG_MAN_OPTS`

If your project uses the packagemanifests make recipe, update your PKG_MAN_OPTS variable to include PKG_FROM_VERSION instead of FROM_VERSION, ex:

PKG_MAN_OPTS ?= $(PKG_FROM_VERSION) $(PKG_CHANNELS) $(PKG_IS_DEFAULT_CHANNEL)

See #4303 for more details.

Update your Go project’s controller-runtime version to v0.6.4

In your go.mod file, update the sigs.k8s.io/controller-runtime version to v0.6.4

See #4282 for more details.

Upgrade your Go project from “go.kubebuilder.io/v2” to “go.kubebuilder.io/v3”

The newly released go/v3 plugin has many new features and (breaking) changes incompatible with projects created by go/v2. You are not required to upgrade and your go/v2 project will continue to work with new operator-sdk versions. If you wish to upgrade, check out the upstream migration guide.

Additionally, if using project version “3-alpha”, you must update your plugins config field:

Old:

plugins:
  go.sdk.operatorframework.io/v2-alpha: {}

New:

plugins:
  manifests.sdk.operatorframework.io/v2: {}
  scorecard.sdk.operatorframework.io/v2: {}

See #4307 for more details.

Docs: v1.2.0

Mon, 01 Jan 0001 00:00:00 +0000

(Go-based operators) Update Makefile’s bundle target

In the Makefile file, replace bundle: manifests with bundle: manifests kustomize to call the kustomize target when the bundle target is used.

See #4090 for more details.

(Go-based operators) Upgrade sigs.k8s.io/controller-runtime version to v0.6.3

In the go.mod file replace sigs.k8s.io/controller-runtime v0.6.2 with sigs.k8s.io/controller-runtime v0.6.3 and then run go mod tidy.

See #4062 for more details.

(Go-based operators with multigroup support) Fix `CRDDirectoryPath` in `controllers/<group>/suite_test.go`

If your project is multi-group, then replace CRDDirectoryPaths: []string{filepath.Join("..", "config", "crd", "bases")}, with CRDDirectoryPaths: []string{filepath.Join("..", "..", "config", "crd", "bases")}, in suite_test.go files found in controllers/<group>/ directories. Otherwise, the tests will fail since this EnvTest will not be looking for the CRD’s in the correct location. For more info, see kubebuilder#1665.

See #4062 for more details.

Docs: v1.1.0

Mon, 01 Jan 0001 00:00:00 +0000

Ansible Operator fact gathering causes performance regression

To disable fact gathering by default for your operator, you will need to add the following entry to the manager container inconfig/manager/manager.yaml:

          env:
            - name: ANSIBLE_GATHERING
              value: explicit

See #3933 for more details.

Update scorecard-test-kuttl image to use latest kuttl

The scorecard-test-kuttl image is updated to use kuttl:v0.5.2 as the base image.

See #3711 for more details.

Docs: v1.0.0

Mon, 01 Jan 0001 00:00:00 +0000

This is the first major version release of operator-sdk, which comes with a project structure rewrite and many breaking CLI changes that are incompatible with all prior minor versions (except for Go projects, which changed in v0.19.0).

Each project type has an appropriate migration guide, which we recommend following before reading this guide:

CLI changes

The following subcommands were removed:

Command	Guidance	PR(s)
`operator-sdk new`	Use `operator-sdk init`	#3385, #3343, #3531
`operator-sdk add api`	Use `operator-sdk create api`	#3385, #3343, #3531
`operator-sdk add controller`	Use `operator-sdk create api`	#3385
`operator-sdk add crd`	Use `operator-sdk create api`	#3547
`operator-sdk build`	Use `make docker-build`	#3566
`operator-sdk bundle create`	Use `make bundle`	#3414
`operator-sdk generate k8s`	Use `make generate`	#3385
`operator-sdk generate crds`	Use `make manifests`	#3385
`operator-sdk generate csv`	Use `operator-sdk generate kustomize manifests`	#3414
`operator-sdk migrate`	Removed support for hybrid operators, no migration	#3385
`operator-sdk print-deps`	Removed, no migration	#3385
`operator-sdk run local`	Use `make run`	#3406
`operator-sdk test`	Use controller-runtime’s envtest framework	#3409

Library changes

Subpackages of the pkg/ directory have either been removed or moved from the operator-sdk repo to the operator-lib repo.

Removed packages:

Packages that have been moved can be used by making the following changes:

The EnqueueRequestForAnnotation watch handler is now available in package github.com/operator-framework/operator-lib/handler

The GenerationChangedPredicate was refactored and moved. Rewrite it as a composite predicate like the following:

import (
  crpredicate "sigs.k8s.io/controller-runtime/pkg/predicate"
  libpredicate "github.com/operator-framework/operator-lib/predicate"
)

...

crpredicate.Or(
  crpredicate.GenerationChangedPredicate{},
  libpredicate.NoGenerationPredicate{},
)

The leader-for-life leader election library at pkg/leader was moved to github.com/operator-framework/operator-lib/leader.
The pkg/status library with status conditions helpers was moved to github.com/operator-framework/operator-lib/status.

See the following PRs for details:

Upgrade your project from version “2” to “3-alpha”

The SDK’s default Go plugin no longer supports OLM- or scorecard-related project files nor writes a plugins PROJECT field for projects scaffolded previously with operator-sdk init --project-version=2, Please migrate to project version “3-alpha” for support of these features by adding the following to your PROJECT file:

version: "3-alpha" # Updated from "2"
projectName: <output of "$(basename $(pwd))">
layout: go.kubebuilder.io/v2
plugins:
  go.sdk.operatorframework.io/v2-alpha: {}

See #3438 and #3697 for more details.

Add the samples scaffold marker to your `config/samples/kustomization.yaml`

Add the +kubebuilder:scaffold:manifestskustomizesamples to your config/samples/kustomization.yaml file like so (using an example sample file):

resources:
- cache_v1alpha1_memcached.yaml
#+kubebuilder:scaffold:manifestskustomizesamples

See #3645 for more details.

Update your Makefile’s `bundle` recipe to inject an operator image tag.

Make the following update to your Makefile’s bundle recipe, which will allow you to set make bundle IMG=<tag>:

bundle:
  ...
  operator-sdk generate kustomize manifests -q
  cd config/manager && $(KUSTOMIZE) edit set image controller=$(IMG) # Add this line
  ...

See #3634 for more details.

Update usage of `operator-sdk cleanup`

The operator-sdk cleanup packagemanifests command has been removed and replaced with a simpler operator-sdk cleanup command.

Update usages of operator-sdk cleanup packagemanifests to use operator-sdk cleanup <packageName>.

The value for <packageName> can be found in the *.package.yaml file in the root of your packagemanifests folder. It is typically your project name.

See #3644 for more details.

Remove `olm-namespace` flag from `operator-sdk olm install` command

The olm-namespace flag has been removed from operator-sdk olm install command, as the olm manifests published in github have a hardcoded namespace value. Hence, the olm operators can only be installed in olm namespace using this command.

See #3670 for more details.

Docker images for `s390x` are no longer created automatically

If you require an s390x image for a particular release, please open an issue in the operator-sdk GitHub project, and the maintainers will manually build and push an s390x image for supported versions

See #3710 for more details.

Default install mode for `run packagemanifests` changed from `OwnNamespace` to `AllNamespaces`

By default all operators are scaffolded to run at the cluster scope and watch all namespaces. However, if you are relying on the default behavior of the run packagemanifests command to use the default OwnNamespace install mode, you must now specify it explicitly with --install-mode=OwnNamespace.

See #3663 for more details.

Use new logging flags when running the Ansible and Helm operators

The Ansible and Helm operators now use controller-runtime’s zap package to define logging flags.

The --zap-sample and --zap-time-encoding flag have been removed since they are not present in controller-runtime’s flagset. These flags are no longer supported.

The --zap-level flag is called --zap-log-level now. Rename any usage of --zap-level to --zap-log-level

See #3596 for more details.

Core Ansible and Helm operator logic moved to `<ansible-operator|helm-operator> run` subcommand

If you are using the ansible-operator and helm-operator binaries directly, update your usage to call ansible-operator run and helm-operator run (e.g. in your Makefile’s make run target).

If you are using the base image and you are not overriding the operator entrypoint, no change is necessary because the base image has been updated to call the run subcommand by default.

See #3596 for more details.

Rename `--update-crds` flag to `--update-objects` in `generate packagemanifests` invocations

This flag has been renamed to account for all objects that can be written to the package directory, ex. Roles.

See #3610 for more details.

Update scorecard API Go import paths

The scorecard v1alpha3 API has been moved to a separate repo. Update your Go import paths:

Old:

import "github.com/operator-framework/operator-framework/pkg/apis/scorecard/v1alpha3"

New:

import "github.com/operator-framework/api/pkg/apis/scorecard/v1alpha3"

See #3622 for more details.

Package `version` is no longer public

It is no longer possible to import package version. To determine the version of operator-sdk, run operator-sdk version.

See #3617 for more details.

Remove `--operator-name` from scripts

The --operator-name flag has been removed from generate bundle and generate packagemanifests subcommands. Remove this flag from your scripts, and make sure the projectName key is set in your PROJECT file. If this key is not set, the current working directory’s base name will be used.

See #3530 for more details.

Create resources manually that were passed to `run packagemanifests --include-paths`

The run packagemanifests subcommand no longer has the --include-paths flag to create additional resources. Instead, use kubectl apply -f <paths> before invoking run packagemanifests.

See #3599 for more details.

Change the `run packagemanifests` flag `--operator-version` to `--version`

--operator-version is now --version.

See #3599 for more details.

Remove `--olm-namespace` from `run packagemanifests` invocations

OLM namespace is no longer required by this command.

See #3601 for more details.

Change the `run packagemanifests` flag `--operator-namespace` to `--namespace`

--operator-namespace is now --namespace.

See #3601 for more details.

`pkg/log/zap` is no longer a public API

Migrate to the upstream controller-runtime implementation in sigs.k8s.io/controller-runtime/pkg/log/zap.

See #3525 for more details.

Default Ansible and Helm operator metrics port has changed

To continue using port 8383, specify --metrics-bind-address=:8383 when you start the operator.

See #3489 and #3440 for more details.

Update references to legacy operator-sdk domain strings

Update various usages of domains in plugin keys and annotations:

In Kubebuilder-style projects, change the .operator-sdk.io suffix to .sdk.operatorframework.io in the PROJECT file.
In Ansible and Helm projects, change legacy annotation keys to new annotation keys in sample CR files in your repository.
In live clusters containing CRs for Ansible and Helm-based operators:
1. Patch all existing CRs that use a legacy annotation to ADD the new equivalent annotations alongside the legacy annotations.
2. Upgrade the operator
3. Patch all existing CRs that used a legacy annotation to REMOVE the legacy annotations.

Location	Legacy	New
`PROJECT` file	`go.operator-sdk.io`	`go.sdk.operatorframework.io`
Custom resources	`ansible.operator-sdk/reconcile-period`	`ansible.sdk.operatorframework.io/reconcile-period`
Custom resources	`ansible.operator-sdk/max-runner-artifacts`	`ansible.sdk.operatorframework.io/max-runner-artifacts`
Custom resources	`ansible.operator-sdk/verbosity`	`ansible.sdk.operatorframework.io/verbosity`
Custom resources	`helm.operator-sdk/upgrade-force`	`helm.sdk.operatorframework.io/upgrade-force`

See #3527 for more details.

Hybrid Ansible and Helm operator use cases are not supported

There is no migration path that enables continued use of the Ansible-based or Helm-based operator Go libraries.

See #3560 and #3537 for more details.

Changes to Ansible and Helm configuration of max workers

Flag max-workers was renamed to max-concurrent-reconciles in Ansible and Helm operators. Change all usage of --max-workers to --max-concurrent-reconciles. Functionality is identical; this is just a name change to align more with controller runtime terminology.
The WORKERS_<Kind>_<Group> environment variable was deprecated. Change all usage of these environment variables to MAX_CONCURRENT_RECONCILES_<Kind>_<Group>.

See #3435, #3452, and #3456 for more details.

Ansible Operator `meta` variable renamed to `ansible_operator_meta`

All existing references to the meta variable in your Ansible content will no longer work. Instead, your Ansible content should reference the ansible_operator_meta variable.

Alternatively, you can use the vars keyword in your watches.yaml in order to map the new ansible_operator_meta variable to meta. Below is a sample watches.yaml that has made this change:

    - version: v1alpha1
      group: test.example.com
      kind: Example
      role: test
      vars:
        meta: '{{ ansible_operator_meta }}'

See #3562 for more details.

Migrated Ansible and Helm operators to use new Kubebuilder-style metrics

Replaced kube-state-metrics style metrics on port :8686 with a similar resource_created_at metric registered with the controller-runtime metrics registry
Replace runtime creation of the metrics Service and ServiceMonitor with deploy-time kustomize manifests

See #3466 and #3451 for more details.

Removed package `pkg/k8sutil`

With the transition to Kubebuilder-style projects, pkg/k8sutil is no longer used in the default scaffolding for Go operators. Migrate your project to the new Kubebuilder-style layout to remove the need for this package.

See #3475 for more details.

Removed packages `pkg/kube-metrics` and `pkg/metrics`

Remove the call to addMetrics in your main.go file and begin using the InstrumentedEnqueueRequestForObject handler when setting up controller-runtime watches for your primary CRs.

InstrumentedEnqueueRequestForObject can be imported from github.com/operator-framework/operator-lib/handler.

See #3484 for more details.

Removed package `pkg/ready`

Use controller-runtime's readyz server that supports custom http handlers. Add a healthz.Checker (e.g. healthz.Ping) using manager.AddReadyzCheck.

See #3476 for more details.

Removed package `pkg/tls`

See the Kubebuilder docs on how to deploy and manage TLS certificates with cert-manager.

See #3468 for more details.

Update your scorecard config file to the new format

See the updated scorecard config documentation for details.

See #3434 and #3490 for more details.

Use `scorecard` instead of `alpha scorecard`

If you have been using operator-sdk alpha scorecard, update to use operator-sdk scorecard. If you have been using operator-sdk scorecard, migrate to the new scorecard. See the new scorecard documentation.

See #3444 for more details.

Scorecard output formatting has changed

Update any scripts interpretting the scorecard output to understand the v1alpha3.TestList format.

See the json and text format descriptions for details.

See #3427 for more details.

Operator SDK – Upgrade SDK Version

Docs: Backport Policy

Process

Docs: v1.42.2

Docs: v1.42.1

Docs: v1.42.0

Docs: v1.41.0

Upgrade Go version to 1.24

Upgrade golangci-lint and use v2 config

Upgrade controller-gen to v0.18.0

Upgrade controller-runtime to v0.21.0

Add cluster setup for e2e tests in Makefile and update CI workflow

Docs: v1.40.0

Upgrade OPM version to v1.55.0 in the Makefile

Add a devcontainer for Go-based operators

Add new GitHub actions for Go-based operators

Update your project to properly support TLS certificates for webhooks and metrics server

Update your project to properly support TLS for Prometheus scraping

Update your project to properly support CA injection for CRDs with conversion webhooks

Use .Named("<Kind>") in SetupWithManager for controller registration

ENVTEST version automation and improved test binary discovery

Replace exportloopref with copyloopvar in .golangci.yaml

Add lint-config target to Makefile to verify linter configuration

Upgrade to Go 1.23 and Kubernetes v0.32.1 dependencies

You must change your webhooks implementation to be able to use controller-runtime v0.20.0+

Add app.kubernetes.io/name label to your manifests

With you wish manually add those roles to your project

With you wish manually add those roles to your project

Docs: v1.39.2

Docs: v1.39.1

Docs: v1.39.0

Upgrade K8s versions to use 1.31 and Kubebuilder network-policy scaffolding

Docs: v1.38.0

Upgrade K8s versions to use 1.30 and Kubebuilder v4

Docs: v1.37.0

Migrate to the Quarkus extension provided bootstrap

Remove hybrid-helm v1-alpha support

Docs: v1.36.0

Upgrade K8s versions to use 1.29

Docs: v1.35.0

Fix helm-operator scaffolding that was broken in 1.34.0, 1.34.1, and 1.34.2

Docs: v1.34.0

To fix multi-arch build, replace docker-buildx target in project Makefile

Docs: v1.33.0

(go/v4-alpha) Move go/v4 plugin from alpha to stable

(kustomize/v2-alpha) Move kustomize/v2 plugin from alpha to stable

Docs: v1.32.0

Docs: v1.31.0

Updating an Ansible Operator to use the updated Ansible 2.15.0 image

Upgrading an Ansible Operator project to match the latest ansible/v1 plugin changes

Migrating away from the quay.io/operator-framework/ansible-operator-2.11-preview base image

Require watch on secrets

Docs: v1.30.0

Header text for the migration section

Docs: v1.29.0

Docs: v1.28.0

(ansible) - Upgrade kubernetes.core collection to v2.4.0

Upgrade K8s versions to use 1.26

Docs: v1.27.0

Docs: v1.26.0

update ansible operator Makefile’s run target

Docs: v1.25.0

Kubebuilder bump brought changes that modified the Makefile scaffolding and also multiarch changes are also included.

For multi-arch build support, add docker-buildx target to project Makefile

Docs: v1.24.0

Support for arm64

Docs: v1.23.0

For Hybrid Helm (hybrid.helm/v1-alpha) language based operators - Bump Dockerfile Go version to 1.18

(go/v3) Fix Makefile targets to not download binaries when they are found already

(go/v3) Update controller-tools from 0.9.0 to 0.9.2.

(go/v3) Update controller-runtime from v0.12.1 to v0.12.2 and Kubernetes dependencies from v0.24.0 to v0.24.2.

Upgrade kube proxy image gcr.io/kubebuilder/kube-rbac-proxy from v0.11.0 to v0.13.0

(ansible/v1,helm/v1) Upgrade kustomize versions from v3.8.7 to v4.5.5

Docs: v1.22.0

For Ansible-based language operators, upgrade community.kubernetes from 1.2.1 to 2.0.1.

For Ansible-based language operators, upgrade kubernetes.core from 2.2.0 to 2.3.1.

For Ansible-based language operators, upgrade cloud.common from 2.2.0 to 2.2.1.

Go (go/v3) and Helm Hybrid (hybrid.helm/v1-alpha) language based operators - Upgrade Kubernetes dependencies from 1.23 to 1.24 and controller-gen from v0.8.0 to v0.9.0

Go (go/v3) and Hybrid Helm (hybrid.helm/v1-alpha) language based operators - Add support for Go 1.18

For Go (go/v3, go/v2), Ansible (ansible/v1), Helm (helm/v1), and Helm Hybrid (hybrid.helm/v1-alpha) language based operators - Bump OPM version from v1.19.1 to v1.23.0 More info

Upgrade controller-gen to `v0.18.0`

Upgrade controller-runtime to `v0.21.0`

Use `.Named("<Kind>")` in SetupWithManager for controller registration

Replace `exportloopref` with `copyloopvar` in `.golangci.yaml`

Add `lint-config` target to Makefile to verify linter configuration

Add `app.kubernetes.io/name` label to your manifests

Upgrading an Ansible Operator project to match the latest `ansible/v1` plugin changes

Migrating away from the `quay.io/operator-framework/ansible-operator-2.11-preview` base image

Require `watch` on `secrets`

Kubebuilder bump brought changes that modified the `Makefile` scaffolding and also `multiarch` changes are also included.

(go/v3) Update `controller-tools` from `0.9.0` to `0.9.2`.

(go/v3) Update `controller-runtime` from `v0.12.1` to `v0.12.2` and Kubernetes dependencies from `v0.24.0` to `v0.24.2`.

Upgrade kube proxy image `gcr.io/kubebuilder/kube-rbac-proxy` from `v0.11.0` to `v0.13.0`

(ansible/v1,helm/v1) Upgrade kustomize versions from `v3.8.7` to `v4.5.5`

For Ansible-based language operators, upgrade `community.kubernetes` from `1.2.1` to `2.0.1`.

For Ansible-based language operators, upgrade `kubernetes.core` from `2.2.0` to `2.3.1`.

For Ansible-based language operators, upgrade `cloud.common` from `2.2.0` to `2.2.1`.

Go (go/v3) and Helm Hybrid (hybrid.helm/v1-alpha) language based operators - Upgrade Kubernetes dependencies from `1.23` to `1.24` and controller-gen from `v0.8.0` to `v0.9.0`

For Go (go/v3, go/v2), Ansible (ansible/v1), Helm (helm/v1), and Helm Hybrid (hybrid.helm/v1-alpha) language based operators - Bump OPM version from `v1.19.1` to `v1.23.0` More info

For Golang-based projects, add the flag `ignore-not-found` into the Makefile for the `uninstall` and `undeploy` targets

Update ansible collection `community.kubernetes` to `kubernetes.core`

For Ansible-based Operators, update ansible collection `community.kubernetes` to `kubernetes.core`

(Optional) Update local version of `ansible-runner`

(optional) Add local Ansible Roles path to Env in `make run`

(go/v3) Export `KUBEBUILDER_ASSETS` in `Makefile`

(go/v3, ansible/v1, helm/v1) Add `containerPort` protocol field in manifests.

(go/v3, ansible/v1, helm/v1) Move `leases.coordination.k8s.io` to its own proxy-role rule

(go/v3) Set the Makefile’s `SHELL` variable to the system’s `bash` binary

(go/v3, ansible/v1, helm/v1) Move `leases.coordination.k8s.io` to its own proxy-role rule

(go/v3) Set the Makefile’s `SHELL` variable to the system’s `bash` binary

(ansible/v1, helm/v1) Optional: configure `ansible-operator` and `helm-operator` with a component config.

(helm/v1) Explicitly set `--health-probe-bind-address` in the manager’s auth proxy patch.

(ansible/v1) Explicitly set `--health-probe-bind-address` in the manager’s auth proxy patch.

(helm/v1, ansible/v1) Add `help` target to Makefile.

(ansible/v1, helm/v1) Add `securityContext`'s to your manager’s Deployment.

(go/v2, go/v3, ansible/v1, helm/v1) Add scheme, token, and TLS config to the Prometheus `ServiceMonitor` metrics endpoint.

(go/v2, go/v3, ansible/v1, helm/v1) Add `opm` and `catalog-build` Makefile targets

(go/v2, go/v3, ansible/v1, helm/v1) Changed `BUNDLE_IMG` and added `IMAGE_TAG_BASE` Makefile variables

(ansible/v1, helm/v1) Add the `controller-manager` ServiceAccount to your project.

(ansible/v1, helm/v1) Optional: configure `ansible-operator` and `helm-operator` with a component config.