Repository navigation
Conversation
…election kates-client classifies every answer of the Kates API; KatesTest and KafkaCompliance reconcile on it, with their decisions in plain functions over the status. The binary takes the Lease, holds off on a stale CRD, and runs one controller per watched namespace. CRDs move to operator/chart/crds: the operator stays self-contained and nothing under charts/ learns about it.
…twork errors operator/chart holds the Deployment, the three install modes and the no-cluster-rights mode, leader-election RBAC, the crds apply hook, NetworkPolicy, PodMonitor, aggregated roles and a values schema. It stays out of charts/, so nothing publishes it. operator/e2e.sh runs the plan's outcomes against a real Kates and Kafka.
…CronJob recipe ci-operator.yml now runs on pushes to operator. cargo-deny failed on the path dependencies, so deny.toml allows wildcard paths; the crates are unpublished. e2e.sh covers KafkaCompliance and takes the Kafka namespace and name. The chart README gains the schedule recipe that stands in for a KatesSchedule kind.
The chart's default image never existed, so an install failed at the CRD hook on every cluster but one with a loaded image. publish-operator.yml builds amd64 and arm64 on native runners, then pushes and signs the image and the chart on GHCR. It runs from its own tag, so a Kates release never sees it. The chart README installs from the registry.
A huge KafkaCompliance interval could reach an expect, so it is capped at a year. A kates-connection can name any host, so an answer is capped at 8 MiB, under the pod's 128 Mi limit, and the client cache at 256 entries. The CRD hook's get, create and patch name the two Kates CRDs. The key goes through bearer_auth, which marks the header sensitive. Chart 0.1.1.
CI only asked the apiserver to accept the CRDs, so a reconciler regression passed. The Kind job now builds the operator image and runs e2e.sh on the one-broker stack e2e-stack.sh deploys, which a scratch cluster uses too.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Kates has no declarative, per-namespace way to run a test or a compliance check.
operator/on main is only the workspace and theKatesTestCRD. This brings the working operator: an API-backed controller that drives a Kates API already running, and never installs one.Merging this reverses the standalone decision of 2026-11-05 only in part: the code lands on main, but it still touches no
kates/,cli/,charts/orrelease.yml. Nothing outsideoperator/changes except the two workflows below.What
KatesTestandKafkaCompliancereconcilers,kates-client, leader election, metrics, thecrds applyhook.operator/chart: own namespace, some namespaces, every namespace, and no cluster-scoped rights. It stays out ofcharts/, sopublish-charts.ymland the chart version gates never see it.publish-operator.yml: anoperator-v*tag builds amd64 and arm64 and pushes the image and chart to GHCR, signed with cosign.operator-v0.1.0is out, andoperator-v0.1.1carries the tenant bounds.intervalcapped at a year, answers at 8 MiB, the client cache at 256, the CRD hook'sget,createandpatchscoped to the two Kates CRDs.ci-operator.yml: CRDs generated intooperator/chart/crds, and a push trigger onoperator.Deliberately not done
kates deploy --with-operator, no book chapter, noKatesScheduleorKatesDisruption: the chart README has a CronJob recipe instead.e2e.sh.runAsUser: 65532is probably refused byrestricted-v2. Not tested, nor is EKS, GKE or AKS.Known limit
In per-namespace mode,
kubectl delete namespacewith a liveKatesTesthangs, because the operator's RoleBinding goes with the namespace. The chart README has the patch.Tests
Rust: fmt, clippy, tests,
cargo-deny.e2e.shgreen on kind with Kates 1.38.0 and Strimzi, the CronJob recipe run from the README, and the published0.1.0chart installed on k3d with no local image.