feat(orchestrator-infra): add OLM v1 ClusterExtension install path (RHIDP-14789)

.github/actions/test-charts/action.yml

@@ -190,9 +190,8 @@ runs:
       env:
         SONATAFLOW_OPERATOR_VERSION: "10.1.0"
       run: |
-        for crdDir in charts/orchestrator-infra/crds/*; do
-          kubectl create -f "${crdDir}"
-        done
+        kubectl create -f charts/orchestrator-infra/crds/knative-eventing/knative-eventing-crd.yaml
+        kubectl create -f charts/orchestrator-infra/crds/knative-serving/knative-serving-crd.yaml
         kubectl create -f "https://github.com/apache/incubator-kie-tools/releases/download/${SONATAFLOW_OPERATOR_VERSION}/apache-kie-${SONATAFLOW_OPERATOR_VERSION}-incubating-sonataflow-operator.yaml"
 
     - name: Set up external services and test resources for rhdh

charts/orchestrator-infra/Chart.yaml

@@ -14,4 +14,4 @@ maintainers:
 type: application
 sources:
   - https://github.com/redhat-developer/rhdh-chart
-version: 0.6.1
+version: 0.7.0

charts/orchestrator-infra/README.md

@@ -1,7 +1,7 @@
 
 # Orchestrator Infra Chart for OpenShift
 
-![Version: 0.6.1](https://img.shields.io/badge/Version-0.6.1-informational?style=flat-square)
+![Version: 0.7.0](https://img.shields.io/badge/Version-0.7.0-informational?style=flat-square)
 ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 Helm chart to deploy the Orchestrator solution's required infrastructure suite on OpenShift, including OpenShift Serverless Operator and OpenShift Serverless Logic Operator, both required to configure Red Hat Developer Hub to use the Orchestrator.
@@ -25,7 +25,7 @@ Kubernetes: `>= 1.25.0-0`
 ```console
 helm repo add redhat-developer https://redhat-developer.github.io/rhdh-chart
 
-helm install my-orchestrator-infra redhat-developer/redhat-developer-hub-orchestrator-infra --version 0.6.1
+helm install my-orchestrator-infra redhat-developer/redhat-developer-hub-orchestrator-infra --version 0.7.0
 ```
 
 > **Tip**: List all releases using `helm list`
@@ -83,6 +83,10 @@ The command removes all the Kubernetes components associated with the chart and
 
 | Key | Description | Type | Default |
 |-----|-------------|------|---------|
+| olm.catalog.selector | ClusterCatalog selector for OLM v1 ClusterExtension resources | object | `{"matchLabels":{"olm.operatorframework.io/metadata.name":"openshift-redhat-operators"}}` |
+| olmVersion | OLM API version to use for operator installation (`v0` or `v1`) | string | `"v0"` |
+| serverlessLogicOperator.clusterExtension.serviceAccount.name | service account used by OLM v1 to install the operator | string | `"serverless-logic-operator-installer"` |
+| serverlessLogicOperator.createNamespace | whether to create the operator namespace (set to false if namespace already exists) | bool | `true` |
 | serverlessLogicOperator.enabled | whether the operator should be deployed by the chart | bool | `true` |
 | serverlessLogicOperator.subscription.namespace | namespace where the operator should be deployed | string | `"openshift-serverless-logic"` |
 | serverlessLogicOperator.subscription.spec.channel | channel of an operator package to subscribe to | string | `"stable"` |
@@ -91,6 +95,8 @@ The command removes all the Kubernetes components associated with the chart and
 | serverlessLogicOperator.subscription.spec.source | name of the catalog source | string | `"redhat-operators"` |
 | serverlessLogicOperator.subscription.spec.sourceNamespace |  | string | `"openshift-marketplace"` |
 | serverlessLogicOperator.subscription.spec.startingCSV | The initial version of the operator, must match CRDs installed by the chart | string | `"logic-operator.v1.38.0"` |
+| serverlessOperator.clusterExtension.serviceAccount.name | service account used by OLM v1 to install the operator | string | `"serverless-operator-installer"` |
+| serverlessOperator.createNamespace | whether to create the operator namespace (set to false if namespace already exists) | bool | `true` |
 | serverlessOperator.enabled | whether the operator should be deployed by the chart | bool | `true` |
 | serverlessOperator.subscription.namespace | namespace where the operator should be deployed | string | `"openshift-serverless"` |
 | serverlessOperator.subscription.spec.channel | channel of an operator package to subscribe to | string | `"stable"` |
@@ -101,6 +107,18 @@ The command removes all the Kubernetes components associated with the chart and
 | tests.enabled | Whether to create the test pod used for testing the Release using `helm test`. | bool | `true` |
 | tests.image | Test pod image | string | `"bitnami/kubectl:latest"` |
 
+### OLM v0 and OLM v1 operator installation
+
+The chart defaults to `olmVersion: v0`.
+
+- `v0`: creates `Subscription` resources
+- `v1`: creates `ClusterExtension` resources with an installer ServiceAccount and ClusterRoleBinding
+
+```bash
+helm install my-orchestrator-infra ./charts/orchestrator-infra --set olmVersion=v0
+helm install my-orchestrator-infra ./charts/orchestrator-infra --set olmVersion=v1
+```
+
 ### Installing Knative Eventing and Knative Serving CRDs
 
 The orchestrator-infra chart requires several CRDs for Knative Eventing and Knative Serving. These CRDs will be applied prior to installing the chart, ensuring that Knative CRs can be created as part of the chart's deployment process. This approach eliminates the need to wait for the OpenShift Serverless Operator's subscription to install them beforehand.
@@ -116,5 +134,3 @@ podman container run --rm --entrypoint cat "$osl_bundle" /manifests/operator_v1b
 
 podman container run --rm --entrypoint cat "$osl_bundle" /manifests/operator_v1beta1_knativeserving_crd.yaml > crds/knative-serving/knative-serving-crd.yaml
 ```
-
-After running these commands, you may need to re-add the `helm.sh/hook` annotations.

charts/orchestrator-infra/README.md.gotmpl

@@ -76,12 +76,24 @@ The command removes all the Kubernetes components associated with the chart and
 
 {{ template "chart.valuesSection" . }}
 
+### OLM v0 and OLM v1 operator installation
+
+The chart defaults to `olmVersion: v0`.
+
+- `v0`: creates `Subscription` resources
+- `v1`: creates `ClusterExtension` resources with an installer ServiceAccount and ClusterRoleBinding
+
+```bash
+helm install my-orchestrator-infra ./charts/orchestrator-infra --set olmVersion=v0
+helm install my-orchestrator-infra ./charts/orchestrator-infra --set olmVersion=v1
+```
+
 ### Installing Knative Eventing and Knative Serving CRDs
 
 The orchestrator-infra chart requires several CRDs for Knative Eventing and Knative Serving. These CRDs will be applied prior to installing the chart, ensuring that Knative CRs can be created as part of the chart's deployment process. This approach eliminates the need to wait for the OpenShift Serverless Operator's subscription to install them beforehand.
 
 The KnativeEventing and KnativeServing CRDs are required for this chart to run. These CRDs need to be present under the `crds/` directory before running `helm install`.
-After installing the openshift-serverless subscription, more Knative CRDs will be installed on the cluster. 
+After installing the openshift-serverless subscription, more Knative CRDs will be installed on the cluster.
 
 The versions of the CRDs present in the chart and the ones in the subscription must match. In order to verify the correct CRD, use this following command to extract the CRD:
 
@@ -91,5 +103,3 @@ podman container run --rm --entrypoint cat "$osl_bundle" /manifests/operator_v1b
 
 podman container run --rm --entrypoint cat "$osl_bundle" /manifests/operator_v1beta1_knativeserving_crd.yaml > crds/knative-serving/knative-serving-crd.yaml
 ```
-
-After running these commands, you may need to re-add the `helm.sh/hook` annotations.

charts/orchestrator-infra/ci/upstream-olm-values.yaml

@@ -1,11 +1,13 @@
 serverlessLogicOperator:
   enabled: true
+  createNamespace: false
   subscription:
     namespace: operators
     spec:
       sourceNamespace: olm
 
 serverlessOperator:
+  createNamespace: false
   subscription:
     namespace: operators
     spec:

charts/orchestrator-infra/crds/knative-eventing/knative-eventing-crd.yaml

@@ -16,10 +16,6 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   name: knativeeventings.operator.knative.dev
-  annotations:
-    "helm.sh/hook": pre-delete
-    "helm.sh/hook-weight": "-10"
-    "helm.sh/hook-delete-policy": before-hook-creation
   labels:
     app.kubernetes.io/version: devel
     app.kubernetes.io/name: knative-operator

charts/orchestrator-infra/crds/knative-serving/knative-serving-crd.yaml

@@ -16,10 +16,6 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   name: knativeservings.operator.knative.dev
-  annotations:
-    "helm.sh/hook": pre-delete
-    "helm.sh/hook-weight": "-10"
-    "helm.sh/hook-delete-policy": before-hook-creation
   labels:
     app.kubernetes.io/version: devel
     app.kubernetes.io/name: knative-operator

charts/orchestrator-infra/templates/NOTES.txt

@@ -4,18 +4,11 @@ Helm Release {{ .Release.Name }} installed in namespace {{ .Release.Namespace }}
 {{- $yes := "YES" }}
 {{- $no := "NO " }}
 {{- $serverlessOperatorInstalled := $no }}
-{{- $knativeServingInstalled := $no }}
-{{- $knativeEventingInstalled := $no }}
 {{- $serverlessLogicOperatorInstalled := $no }}
-{{- $sonataFlowPlatformInstalled := $no }}
-{{- $timeout := "--timeout=5m" }}
 
 {{- if .Values.serverlessOperator.enabled }}
-{{- $unmanagedSubscriptionExists := include "unmanaged-resource-exists" (list "operators.coreos.com/v1alpha1" "Subscription" .Values.serverlessOperator.subscription.namespace "serverless-operator" .Release.Name .Capabilities.APIVersions ) }}
-{{- if eq $unmanagedSubscriptionExists "false" }}
 {{- $serverlessOperatorInstalled = $yes }}
 {{- end }}
-{{- end }}
 
 {{- if .Values.serverlessLogicOperator.enabled }}
 {{- $serverlessLogicOperatorInstalled = $yes }}

charts/orchestrator-infra/templates/_helpers.tpl

@@ -1,37 +1,13 @@
 {{/* Helper functions */}}
 
-{{- define "unmanaged-resource-exists" -}}
-    {{- $api := index . 0 -}}
-    {{- $kind := index . 1 -}}
-    {{- $namespace := index . 2 -}}
-    {{- $name := index . 3 -}}
-    {{- $releaseName := index . 4 -}}
-    {{- $apiCapabilities := index . 5 -}}
-    {{- $unmanagedSubscriptionExists := "true" -}}
-    {{- if $apiCapabilities.Has (printf "%s/%s" $api $kind) }}
-        {{- $existingOperator := lookup $api $kind $namespace $name -}}
-        {{- if empty $existingOperator -}}
-            {{- "false" -}}
-        {{- else -}}
-            {{- $isManagedResource := include "is-managed-resource" (list $existingOperator $releaseName) -}}
-            {{- if eq $isManagedResource "true" -}}
-                {{- "false" -}}
-            {{- else -}}
-                {{- "true" -}}
-            {{- end -}}
-        {{- end -}}
-    {{- else -}}
-        {{- "false" -}}
-    {{- end -}}
+{{- define "olm-version" -}}
+    {{- $requested := default "v0" .Values.olmVersion -}}
+    {{- $requested -}}
 {{- end -}}
 
-{{- define "is-managed-resource" -}}
-    {{- $resource := index . 0 -}}
-    {{- $releaseName := index . 1 -}}
-    {{- $resourceReleaseName := dig "metadata" "annotations" (dict "meta.helm.sh/release-name" "NA") $resource -}}
-    {{- if eq (get $resourceReleaseName "meta.helm.sh/release-name") $releaseName -}}
-        {{- "true" -}}
-    {{- else -}}
-        {{- "false" -}}
-    {{- end -}}
-{{- end -}}
+{{- define "csv-version" -}}
+    {{- $csv := index . 0 -}}
+    {{- $packageName := index . 1 -}}
+    {{- $version := trimPrefix (printf "%s." $packageName) $csv -}}
+    {{- trimPrefix "v" $version -}}
+{{- end -}}

charts/orchestrator-infra/templates/serverless-logic/clusterextension.yaml

@@ -0,0 +1,55 @@
+{{- $packageName := .Values.serverlessLogicOperator.subscription.spec.name -}}
+{{- $namespace := .Values.serverlessLogicOperator.subscription.namespace -}}
+{{- $serviceAccountName := .Values.serverlessLogicOperator.clusterExtension.serviceAccount.name -}}
+{{- if and (eq (include "olm-version" .) "v1") .Values.serverlessLogicOperator.enabled }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ $serviceAccountName }}
+  namespace: {{ $namespace }}
+  annotations:
+    meta.helm.sh/release-name: {{ .Release.Name }}
+    meta.helm.sh/release-namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ $packageName }}-installer-binding
+  annotations:
+    meta.helm.sh/release-name: {{ .Release.Name }}
+    meta.helm.sh/release-namespace: {{ .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: {{ $serviceAccountName }}
+    namespace: {{ $namespace }}
+---
+apiVersion: olm.operatorframework.io/v1
+kind: ClusterExtension
+metadata:
+  name: {{ $packageName }}
+  annotations:
+    meta.helm.sh/release-name: {{ .Release.Name }}
+    meta.helm.sh/release-namespace: {{ .Release.Namespace }}
+spec:
+  install:
+    preflight:
+      crdUpgradeSafety:
+        enforcement: None
+  namespace: {{ $namespace }}
+  serviceAccount:
+    name: {{ $serviceAccountName }}
+  source:
+    sourceType: Catalog
+    catalog:
+      packageName: {{ $packageName }}
+      channels:
+        - {{ .Values.serverlessLogicOperator.subscription.spec.channel }}
+      version: {{ include "csv-version" (list .Values.serverlessLogicOperator.subscription.spec.startingCSV $packageName) | quote }}
+      selector:
+        {{- toYaml .Values.olm.catalog.selector | nindent 8 }}
+      upgradeConstraintPolicy: CatalogProvided
+{{- end }}

charts/orchestrator-infra/templates/serverless-logic/namespace.yaml

@@ -1,8 +1,9 @@
-{{- $unmanagedNamespaceExists := include "unmanaged-resource-exists" (list "v1" "Namespace" "" .Values.serverlessLogicOperator.subscription.namespace .Release.Name .Capabilities.APIVersions) }}
-{{- if and (eq $unmanagedNamespaceExists "false") .Values.serverlessLogicOperator.enabled }}
+{{- if and .Values.serverlessLogicOperator.enabled .Values.serverlessLogicOperator.createNamespace (ne .Values.serverlessLogicOperator.subscription.namespace .Values.serverlessOperator.subscription.namespace) }}
 ---
 apiVersion: v1
 kind: Namespace
 metadata:
   name: {{ .Values.serverlessLogicOperator.subscription.namespace }}
+  annotations:
+    "helm.sh/resource-policy": keep
 {{- end }}

charts/orchestrator-infra/templates/serverless-logic/operator-group.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.serverlessLogicOperator.enabled }}
+{{- if and .Values.serverlessLogicOperator.enabled (eq (include "olm-version" .) "v0") }}
 apiVersion: operators.coreos.com/v1
 kind: OperatorGroup
 metadata:

charts/orchestrator-infra/templates/serverless-logic/subscription.yaml

@@ -1,10 +1,11 @@
-{{- $unmanagedSubscriptionExists := include "unmanaged-resource-exists" (list "operators.coreos.com/v1alpha1" "Subscription" .Values.serverlessLogicOperator.subscription.namespace .Values.serverlessLogicOperator.subscription.spec.name .Release.Name .Capabilities.APIVersions ) }}
-{{- if and (eq $unmanagedSubscriptionExists "false") .Values.serverlessLogicOperator.enabled }}
+{{- $packageName := .Values.serverlessLogicOperator.subscription.spec.name -}}
+{{- $subscriptionNamespace := .Values.serverlessLogicOperator.subscription.namespace -}}
+{{- if and (eq (include "olm-version" .) "v0") .Values.serverlessLogicOperator.enabled }}
 apiVersion: operators.coreos.com/v1alpha1
 kind: Subscription
 metadata:
-  name: {{ .Values.serverlessLogicOperator.subscription.spec.name }}
-  namespace: {{ .Values.serverlessLogicOperator.subscription.namespace }}
+  name: {{ $packageName }}
+  namespace: {{ $subscriptionNamespace }}
 spec:
   {{- toYaml .Values.serverlessLogicOperator.subscription.spec | nindent 2 }}
 {{- end }}

charts/orchestrator-infra/templates/serverless/clusterextension.yaml

@@ -0,0 +1,54 @@
+{{- $packageName := .Values.serverlessOperator.subscription.spec.name -}}
+{{- $namespace := .Values.serverlessOperator.subscription.namespace -}}
+{{- $serviceAccountName := .Values.serverlessOperator.clusterExtension.serviceAccount.name -}}
+{{- if and (eq (include "olm-version" .) "v1") .Values.serverlessOperator.enabled }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ $serviceAccountName }}
+  namespace: {{ $namespace }}
+  annotations:
+    meta.helm.sh/release-name: {{ .Release.Name }}
+    meta.helm.sh/release-namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ $packageName }}-installer-binding
+  annotations:
+    meta.helm.sh/release-name: {{ .Release.Name }}
+    meta.helm.sh/release-namespace: {{ .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: {{ $serviceAccountName }}
+    namespace: {{ $namespace }}
+---
+apiVersion: olm.operatorframework.io/v1
+kind: ClusterExtension
+metadata:
+  name: {{ $packageName }}
+  annotations:
+    meta.helm.sh/release-name: {{ .Release.Name }}
+    meta.helm.sh/release-namespace: {{ .Release.Namespace }}
+spec:
+  install:
+    preflight:
+      crdUpgradeSafety:
+        enforcement: None
+  namespace: {{ $namespace }}
+  serviceAccount:
+    name: {{ $serviceAccountName }}
+  source:
+    sourceType: Catalog
+    catalog:
+      packageName: {{ $packageName }}
+      channels:
+        - {{ .Values.serverlessOperator.subscription.spec.channel }}
+      selector:
+        {{- toYaml .Values.olm.catalog.selector | nindent 8 }}
+      upgradeConstraintPolicy: CatalogProvided
+{{- end }}