Skip to content

Extract variant branches into a generic extension mechanism #4871

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
caseydavenport wants to merge 40 commits into
base: master
Choose a base branch
from
Open

Extract variant branches into a generic extension mechanism #4871

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
40 commits
Select commit Hold shift + click to select a range
9499353
operator: add extension Context type
caseydavenport May 28, 2026
a5767f2
operator: add patch registry
caseydavenport May 28, 2026
b448227
operator: add image-override registry
caseydavenport May 28, 2026
e651d7d
render: add Named interface and component name constants for extensio…
caseydavenport May 28, 2026
c1cd817
utils: apply registered render patches in componentHandler
caseydavenport May 28, 2026
cc62d3c
operator: add installation controller extension registry
caseydavenport May 28, 2026
e8c588f
render: typha implements Named
caseydavenport May 28, 2026
f7b28f3
enterprise: move typha variant branches into a modifier
caseydavenport May 29, 2026
e78d633
installation: register enterprise modifiers and pass render Context
caseydavenport May 29, 2026
2e48ab3
enterprise: route node image selection through ResolveImage
caseydavenport May 29, 2026
0506f4c
render: fix node.go import ordering
caseydavenport May 29, 2026
f240c2d
enterprise: move node-prometheus cert setup into an InstallationExten…
caseydavenport May 29, 2026
6e426cb
enterprise: render node metrics service via a modifier
caseydavenport May 29, 2026
c74b106
variant-extensions: gofmt and replace deprecated TigeraSecureEnterpri…
caseydavenport May 29, 2026
6aea4fd
Merge remote-tracking branch 'origin/master' into pr-4871
caseydavenport Jun 3, 2026
fd4e835
Generalize the variant extension mechanism
caseydavenport Jun 3, 2026
311b79e
Simplify render context extension entrypoints
caseydavenport Jun 9, 2026
5a7cad9
Variant-scope extension registration and tighten the seams
caseydavenport Jun 9, 2026
6a33636
Collapse extension seams into Extension and Setup
caseydavenport Jun 9, 2026
9197ec9
Rename modCtx to renderCtx
caseydavenport Jun 9, 2026
6375a34
Document the extensions package and drop stale builder wording
caseydavenport Jun 9, 2026
147ec15
De-variant windows; add per-component context to extensions
caseydavenport Jun 9, 2026
ffe993e
De-variant the guardian component into an enterprise extension
caseydavenport Jun 9, 2026
0351e22
De-variant the guardian network policy
caseydavenport Jun 9, 2026
3de3639
De-variant the apiserver into an enterprise extension
caseydavenport Jun 10, 2026
d59fa4f
Merge remote-tracking branch 'origin/master' into casey-variant-exten…
caseydavenport Jun 17, 2026
139aabb
Address review feedback: cleanups
caseydavenport Jun 17, 2026
36b9881
Inject extensions instead of registering them globally
caseydavenport Jun 17, 2026
cc48b45
Use r.opts for controller options instead of copied fields
caseydavenport Jun 17, 2026
8b5349e
Apply variant extensions by decorating the rendered component
caseydavenport Jun 18, 2026
8ef2965
Restructure extensions into per-variant bundles with a typed controll…
caseydavenport Jun 18, 2026
9ae3012
Clean up the extensions API per review
caseydavenport Jun 18, 2026
76eefc3
Carry extension-produced data in an opaque RenderContext slot
caseydavenport Jun 18, 2026
1d831fd
Decouple the windows controller from enterprise via a per-controller …
caseydavenport Jun 18, 2026
9a05338
Move the enterprise manager-internal cert fetch into the controller hook
caseydavenport Jun 18, 2026
7f47288
Let extensions declare their own watches
caseydavenport Jun 18, 2026
a6e87f9
Move LogCollector process-path collection into the node modifier
caseydavenport Jun 18, 2026
632cfa2
Remove variant branches from the kube-controllers render
caseydavenport Jun 18, 2026
698254f
Move calico-kube-controllers metrics TLS into the enterprise extension
caseydavenport Jun 18, 2026
8d2ff05
Move the calico-kube-controllers enterprise surface into the extension
caseydavenport Jun 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions cmd/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ import (
"github.com/tigera/operator/pkg/controller/options"
"github.com/tigera/operator/pkg/controller/utils"
"github.com/tigera/operator/pkg/dns"
"github.com/tigera/operator/pkg/enterprise"
"github.com/tigera/operator/pkg/imports/admission"
"github.com/tigera/operator/pkg/imports/crds"
"github.com/tigera/operator/pkg/render"
Expand Down Expand Up @@ -521,6 +522,7 @@ If a value other than 'all' is specified, the first CRD with a prefix of the spe
ElasticExternal: discovery.UseExternalElastic(bootConfig),
UseV3CRDs: v3CRDs,
APIDiscovery: apiDiscovery,
Extensions: enterprise.New(),
}

// Before we start any controllers, make sure our options are valid.
Expand Down
11 changes: 10 additions & 1 deletion pkg/controller/apiserver/apiserver_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@ import (
"github.com/tigera/operator/pkg/controller/utils/imageset"
"github.com/tigera/operator/pkg/ctrlruntime"
"github.com/tigera/operator/pkg/dns"
"github.com/tigera/operator/pkg/extensions"
"github.com/tigera/operator/pkg/render"
rcertificatemanagement "github.com/tigera/operator/pkg/render/certificatemanagement"
"github.com/tigera/operator/pkg/render/common/authentication"
Expand Down Expand Up @@ -474,7 +475,14 @@ func (r *ReconcileAPIServer) Reconcile(ctx context.Context, request reconcile.Re
}

// Create a component handler to manage the rendered component.
handler := utils.NewComponentHandler(log, r.client, r.scheme, instance)
handler := utils.NewComponentHandler(
log,
r.client,
r.scheme,
instance,
utils.WithRenderContext(extensions.RenderContext{Installation: installationSpec}),
utils.WithExtensions(r.opts.Extensions),
)

// Render the desired objects from the CRD and create or update them.
reqLogger.V(3).Info("rendering components")
Expand All @@ -497,6 +505,7 @@ func (r *ReconcileAPIServer) Reconcile(ctx context.Context, request reconcile.Re
KubernetesVersion: r.opts.KubernetesVersion,
ClusterDomain: r.opts.ClusterDomain,
RequiresAggregationServer: !r.opts.UseV3CRDs,
RequiresQueryServer: installationSpec.Variant.IsEnterprise(),
QueryServerTLSKeyPairCertificateManagementOnly: queryServerTLSSecretCertificateManagementOnly,
}

Expand Down
21 changes: 21 additions & 0 deletions pkg/controller/apiserver/apiserver_controller_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,7 @@ var _ = Describe("apiserver controller tests", func() {
tierWatchReady: ready,
migrationWatchReady: &utils.ReadyFlag{},
opts: options.ControllerOptions{
Extensions: testExtensions,
EnterpriseCRDExists: true,
DetectedProvider: operatorv1.ProviderNone,
},
Expand Down Expand Up @@ -229,6 +230,7 @@ var _ = Describe("apiserver controller tests", func() {
tierWatchReady: ready,
migrationWatchReady: &utils.ReadyFlag{},
opts: options.ControllerOptions{
Extensions: testExtensions,
EnterpriseCRDExists: true,
DetectedProvider: operatorv1.ProviderNone,
},
Expand Down Expand Up @@ -282,6 +284,7 @@ var _ = Describe("apiserver controller tests", func() {
tierWatchReady: ready,
migrationWatchReady: &utils.ReadyFlag{},
opts: options.ControllerOptions{
Extensions: testExtensions,
EnterpriseCRDExists: true,
DetectedProvider: operatorv1.ProviderNone,
ClusterDomain: dns.DefaultClusterDomain,
Expand All @@ -307,6 +310,7 @@ var _ = Describe("apiserver controller tests", func() {
tierWatchReady: ready,
migrationWatchReady: &utils.ReadyFlag{},
opts: options.ControllerOptions{
Extensions: testExtensions,
EnterpriseCRDExists: true,
DetectedProvider: operatorv1.ProviderNone,
},
Expand All @@ -329,6 +333,7 @@ var _ = Describe("apiserver controller tests", func() {
tierWatchReady: ready,
migrationWatchReady: &utils.ReadyFlag{},
opts: options.ControllerOptions{
Extensions: testExtensions,
EnterpriseCRDExists: true,
DetectedProvider: operatorv1.ProviderNone,
},
Expand All @@ -353,6 +358,7 @@ var _ = Describe("apiserver controller tests", func() {
tierWatchReady: ready,
migrationWatchReady: &utils.ReadyFlag{},
opts: options.ControllerOptions{
Extensions: testExtensions,
EnterpriseCRDExists: true,
DetectedProvider: operatorv1.ProviderNone,
},
Expand All @@ -375,6 +381,7 @@ var _ = Describe("apiserver controller tests", func() {
tierWatchReady: notReady,
migrationWatchReady: &utils.ReadyFlag{},
opts: options.ControllerOptions{
Extensions: testExtensions,
EnterpriseCRDExists: true,
DetectedProvider: operatorv1.ProviderNone,
},
Expand All @@ -400,6 +407,7 @@ var _ = Describe("apiserver controller tests", func() {
tierWatchReady: ready,
migrationWatchReady: &utils.ReadyFlag{},
opts: options.ControllerOptions{
Extensions: testExtensions,
EnterpriseCRDExists: true,
DetectedProvider: operatorv1.ProviderNone,
},
Expand Down Expand Up @@ -427,6 +435,7 @@ var _ = Describe("apiserver controller tests", func() {
tierWatchReady: ready,
migrationWatchReady: &utils.ReadyFlag{},
opts: options.ControllerOptions{
Extensions: testExtensions,
EnterpriseCRDExists: true,
DetectedProvider: operatorv1.ProviderNone,
},
Expand All @@ -452,6 +461,7 @@ var _ = Describe("apiserver controller tests", func() {
tierWatchReady: notReady,
migrationWatchReady: &utils.ReadyFlag{},
opts: options.ControllerOptions{
Extensions: testExtensions,
EnterpriseCRDExists: true,
DetectedProvider: operatorv1.ProviderNone,
},
Expand All @@ -478,6 +488,7 @@ var _ = Describe("apiserver controller tests", func() {
tierWatchReady: ready,
migrationWatchReady: &utils.ReadyFlag{},
opts: options.ControllerOptions{
Extensions: testExtensions,
EnterpriseCRDExists: false,
DetectedProvider: operatorv1.ProviderNone,
},
Expand Down Expand Up @@ -520,6 +531,7 @@ var _ = Describe("apiserver controller tests", func() {
tierWatchReady: ready,
migrationWatchReady: &utils.ReadyFlag{},
opts: options.ControllerOptions{
Extensions: testExtensions,
EnterpriseCRDExists: true,
DetectedProvider: operatorv1.ProviderNone,
},
Expand Down Expand Up @@ -552,6 +564,7 @@ var _ = Describe("apiserver controller tests", func() {
tierWatchReady: ready,
migrationWatchReady: &utils.ReadyFlag{},
opts: options.ControllerOptions{
Extensions: testExtensions,
EnterpriseCRDExists: true,
DetectedProvider: operatorv1.ProviderNone,
},
Expand Down Expand Up @@ -604,6 +617,7 @@ var _ = Describe("apiserver controller tests", func() {
tierWatchReady: ready,
migrationWatchReady: &utils.ReadyFlag{},
opts: options.ControllerOptions{
Extensions: testExtensions,
EnterpriseCRDExists: true,
DetectedProvider: operatorv1.ProviderNone,
},
Expand Down Expand Up @@ -673,6 +687,7 @@ var _ = Describe("apiserver controller tests", func() {
tierWatchReady: ready,
migrationWatchReady: &utils.ReadyFlag{},
opts: options.ControllerOptions{
Extensions: testExtensions,
EnterpriseCRDExists: true,
DetectedProvider: operatorv1.ProviderNone,
},
Expand Down Expand Up @@ -777,6 +792,7 @@ var _ = Describe("apiserver controller tests", func() {
tierWatchReady: ready,
migrationWatchReady: &utils.ReadyFlag{},
opts: options.ControllerOptions{
Extensions: testExtensions,
EnterpriseCRDExists: true,
DetectedProvider: operatorv1.ProviderNone,
},
Expand Down Expand Up @@ -806,6 +822,7 @@ var _ = Describe("apiserver controller tests", func() {
tierWatchReady: ready,
migrationWatchReady: &utils.ReadyFlag{},
opts: options.ControllerOptions{
Extensions: testExtensions,
EnterpriseCRDExists: true,
DetectedProvider: operatorv1.ProviderNone,
},
Expand Down Expand Up @@ -836,6 +853,7 @@ var _ = Describe("apiserver controller tests", func() {
tierWatchReady: ready,
migrationWatchReady: &utils.ReadyFlag{},
opts: options.ControllerOptions{
Extensions: testExtensions,
EnterpriseCRDExists: true,
DetectedProvider: operatorv1.ProviderNone,
MultiTenant: true,
Expand Down Expand Up @@ -883,6 +901,7 @@ var _ = Describe("apiserver controller tests", func() {
tierWatchReady: ready,
migrationWatchReady: &utils.ReadyFlag{},
opts: options.ControllerOptions{
Extensions: testExtensions,
EnterpriseCRDExists: true,
DetectedProvider: operatorv1.ProviderNone,
UseV3CRDs: true,
Expand Down Expand Up @@ -927,6 +946,7 @@ var _ = Describe("apiserver controller tests", func() {
tierWatchReady: ready,
migrationWatchReady: &utils.ReadyFlag{},
opts: options.ControllerOptions{
Extensions: testExtensions,
EnterpriseCRDExists: false,
DetectedProvider: operatorv1.ProviderNone,
UseV3CRDs: true,
Expand Down Expand Up @@ -955,6 +975,7 @@ var _ = Describe("apiserver controller tests", func() {
tierWatchReady: ready,
migrationWatchReady: &utils.ReadyFlag{},
opts: options.ControllerOptions{
Extensions: testExtensions,
EnterpriseCRDExists: true,
DetectedProvider: operatorv1.ProviderNone,
UseV3CRDs: false,
Expand Down
9 changes: 9 additions & 0 deletions pkg/controller/apiserver/apiserver_suite_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,17 @@ import (

logf "sigs.k8s.io/controller-runtime/pkg/log"
"sigs.k8s.io/controller-runtime/pkg/log/zap"

"github.com/tigera/operator/pkg/enterprise"
"github.com/tigera/operator/pkg/extensions"
)

// testExtensions is the enterprise extension Set the API server controller tests
// reconcile with, so the componentHandler applies the API server modifier (query
// server, audit logging, Enterprise RBAC). Reconcilers built in these tests put
// it on their options, mirroring how main wires it in production.
var testExtensions *extensions.Set = enterprise.New()

func TestStatus(t *testing.T) {
logf.SetLogger(zap.New(zap.WriteTo(ginkgo.GinkgoWriter), zap.UseDevMode(true), zap.Level(uzap.NewAtomicLevelAt(uzap.DebugLevel))))
gomega.RegisterFailHandler(ginkgo.Fail)
Expand Down
18 changes: 13 additions & 5 deletions pkg/controller/clusterconnection/clusterconnection_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@ import (
"github.com/tigera/operator/pkg/controller/utils/imageset"
"github.com/tigera/operator/pkg/ctrlruntime"
"github.com/tigera/operator/pkg/dns"
"github.com/tigera/operator/pkg/extensions"
"github.com/tigera/operator/pkg/render"
"github.com/tigera/operator/pkg/render/common/networkpolicy"
"github.com/tigera/operator/pkg/render/goldmane"
Expand Down Expand Up @@ -173,9 +174,9 @@ func newReconciler(
scheme: schema,
provider: p,
status: statusMgr,
clusterDomain: opts.ClusterDomain,
tierWatchReady: tierWatchReady,
clusterInfoWatchReady: clusterInfoWatchReady,
opts: opts,
}
c.status.Run(opts.ShutdownContext)
return c
Expand All @@ -190,11 +191,11 @@ type ReconcileConnection struct {
scheme *runtime.Scheme
provider operatorv1.Provider
status status.StatusManager
clusterDomain string
tierWatchReady *utils.ReadyFlag
clusterInfoWatchReady *utils.ReadyFlag
resolvedPodProxies []*httpproxy.Config
lastAvailabilityTransition metav1.Time
opts options.ControllerOptions
}

// Reconcile reads that state of the cluster for a ManagementClusterConnection object and makes changes based on the
Expand Down Expand Up @@ -283,7 +284,7 @@ func (r *ReconcileConnection) Reconcile(ctx context.Context, request reconcile.R

log.V(2).Info("Loaded ManagementClusterConnection config", "config", managementClusterConnection)

certificateManager, err := certificatemanager.Create(r.cli, installationSpec, r.clusterDomain, common.OperatorNamespace(), certificatemanager.WithLogger(reqLogger))
certificateManager, err := certificatemanager.Create(r.cli, installationSpec, r.opts.ClusterDomain, common.OperatorNamespace(), certificatemanager.WithLogger(reqLogger))
if err != nil {
r.status.SetDegraded(operatorv1.ResourceCreateError, "Unable to create the Tigera CA", err, reqLogger)
return reconcile.Result{}, err
Expand All @@ -307,7 +308,7 @@ func (r *ReconcileConnection) Reconcile(ctx context.Context, request reconcile.R

var guardianKeyPair certificatemanagement.KeyPairInterface
if !variant.IsEnterprise() {
guardianCertificateNames := dns.GetServiceDNSNames("guardian", render.GuardianNamespace, r.clusterDomain)
guardianCertificateNames := dns.GetServiceDNSNames("guardian", render.GuardianNamespace, r.opts.ClusterDomain)
guardianCertificateNames = append(guardianCertificateNames, "localhost", "127.0.0.1")
guardianKeyPair, err = certificateManager.GetOrCreateKeyPair(r.cli, render.GuardianKeyPairSecret, whisker.WhiskerNamespace, guardianCertificateNames)
if err != nil {
Expand Down Expand Up @@ -443,7 +444,14 @@ func (r *ReconcileConnection) Reconcile(ctx context.Context, request reconcile.R
return reconcile.Result{}, err
}

ch := utils.NewComponentHandler(log, r.cli, r.scheme, managementClusterConnection)
ch := utils.NewComponentHandler(
log,
r.cli,
r.scheme,
managementClusterConnection,
utils.WithRenderContext(extensions.RenderContext{Installation: installationSpec}),
utils.WithExtensions(r.opts.Extensions),
)
guardianCfg := &render.GuardianConfiguration{
URL: managementClusterConnection.Spec.ManagementClusterAddr,
PodProxies: r.resolvedPodProxies,
Expand Down
1 change: 1 addition & 0 deletions pkg/controller/clusterconnection/clusterconnection_suite_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ import (
func TestStatus(t *testing.T) {
logf.SetLogger(zap.New(zap.WriteTo(ginkgo.GinkgoWriter)))
gomega.RegisterFailHandler(ginkgo.Fail)

suiteConfig, reporterConfig := ginkgo.GinkgoConfiguration()
reporterConfig.JUnitReport = "../../../report/ut/clusterconnection_controller_suite.xml"
ginkgo.RunSpecs(t, "pkg/controller/Management Cluster Connection Suite", suiteConfig, reporterConfig)
Expand Down
2 changes: 2 additions & 0 deletions pkg/controller/clusterconnection/shim_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ import (
operatorv1 "github.com/tigera/operator/api/v1"
"github.com/tigera/operator/pkg/controller/options"
"github.com/tigera/operator/pkg/controller/status"
"github.com/tigera/operator/pkg/enterprise"
"k8s.io/apimachinery/pkg/runtime"
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/reconcile"
Expand All @@ -40,6 +41,7 @@ func NewReconcilerWithShims(
) reconcile.Reconciler {
opts := options.ControllerOptions{
ShutdownContext: context.Background(),
Extensions: enterprise.New(),
}

return newReconciler(cli, schema, status, provider, tierWatchReady, clusterInfoWatchReady, opts)
Expand Down
2 changes: 1 addition & 1 deletion pkg/controller/gatewayapi/gatewayapi_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,7 +174,7 @@ type ReconcileGatewayAPI struct {
status status.StatusManager
clusterDomain string
multiTenant bool
newComponentHandler func(log logr.Logger, client client.Client, scheme *runtime.Scheme, cr metav1.Object) utils.ComponentHandler
newComponentHandler func(log logr.Logger, client client.Client, scheme *runtime.Scheme, cr metav1.Object, opts ...utils.ComponentHandlerOption) utils.ComponentHandler
watchEnvoyProxy func(namespacedName operatorv1.NamespacedName) error
watchEnvoyGateway func(namespacedName operatorv1.NamespacedName) error
watchGateways func() error
Expand Down
2 changes: 1 addition & 1 deletion pkg/controller/gatewayapi/gatewayapi_controller_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -779,7 +779,7 @@ var _ = Describe("Gateway API controller tests", func() {

var fakeComponentHandlers []*fakeComponentHandler

func FakeComponentHandler(log logr.Logger, client client.Client, scheme *runtime.Scheme, cr metav1.Object) utils.ComponentHandler {
func FakeComponentHandler(log logr.Logger, client client.Client, scheme *runtime.Scheme, cr metav1.Object, opts ...utils.ComponentHandlerOption) utils.ComponentHandler {
h := &fakeComponentHandler{
client: client,
scheme: scheme,
Expand Down
Loading
Loading