Upgrade infra-operator to operator-sdk 1.41.1

Rescaffold the infra-operator to operator-sdk 1.41.1, which includes:
 - Reorganize project structure (pkg/ -> internal/)
 - Move webhook implementations to internal/webhook/v1beta1/
 - Add new cmd/main.go entrypoint with updated controller initialization
 - Update RBAC, certmanager, and prometheus configurations
 - Enhance network policies for metrics and webhook traffic
 - Set infra as defaulting resource in PROJECT file
 - Remove auto-generated test suite scaffolding
 - Update build workflow and Dockerfile to version 1.41.1

This upgrade modernizes the operator structure and aligns with the latest
operator-sdk best practices.

Jira: OSPRH-22040

Depends-On: openstack-k8s-operators/openstack-operator#1683

Author: dprince

.ci-operator.yaml

@@ -1,4 +1,4 @@
 build_root_image:
   name: tools
   namespace: openstack-k8s-operators
-  tag: ci-build-root-golang-1.24-sdk-1.31
+  tag: ci-build-root-golang-1.24-sdk-1.41.1

.github/workflows/build-infra-operator.yaml

@@ -16,7 +16,7 @@ jobs:
     with:
       operator_name: infra
       go_version: 1.24.x
-      operator_sdk_version: 1.31.0
+      operator_sdk_version: 1.41.1
     secrets:
       IMAGENAMESPACE: ${{ secrets.IMAGENAMESPACE }}
       QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}

.github/workflows/force-bump-pr-manual.yaml

@@ -9,6 +9,6 @@ jobs:
     with:
       operator_name: infra
       branch_name: ${{ github.ref_name }}
-      custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.31
+      custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.41.1
     secrets:
       FORCE_BUMP_PULL_REQUEST_PAT: ${{ secrets.FORCE_BUMP_PULL_REQUEST_PAT }}

.github/workflows/force-bump-pr-scheduled.yaml

@@ -10,6 +10,6 @@ jobs:
     uses: openstack-k8s-operators/openstack-k8s-operators-ci/.github/workflows/force-bump-branches.yaml@main
     with:
       operator_name: infra
-      custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.31
+      custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.41.1
     secrets:
       FORCE_BUMP_PULL_REQUEST_PAT: ${{ secrets.FORCE_BUMP_PULL_REQUEST_PAT }}

Dockerfile

@@ -26,7 +26,7 @@ RUN mkdir -p ${DEST_ROOT}/usr/local/bin/
 RUN if [ ! -f $CACHITO_ENV_FILE ]; then go mod download ; fi
 
 # Build manager
-RUN if [ -f $CACHITO_ENV_FILE ] ; then source $CACHITO_ENV_FILE ; fi ; env ${GO_BUILD_EXTRA_ENV_ARGS} go build ${GO_BUILD_EXTRA_ARGS} -a -o ${DEST_ROOT}/manager main.go
+RUN if [ -f $CACHITO_ENV_FILE ] ; then source $CACHITO_ENV_FILE ; fi ; env ${GO_BUILD_EXTRA_ENV_ARGS} go build ${GO_BUILD_EXTRA_ARGS} -a -o ${DEST_ROOT}/manager cmd/main.go
 
 RUN cp -r templates ${DEST_ROOT}/templates
 

Makefile

@@ -48,7 +48,7 @@ endif
 
 # Set the Operator SDK version to use. By default, what is installed on the system is used.
 # This is useful for CI or a project to utilize a specific version of the operator-sdk toolkit.
-OPERATOR_SDK_VERSION ?= v1.31.0
+OPERATOR_SDK_VERSION ?= v1.41.1
 
 # Image URL to use all building/pushing image targets
 DEFAULT_IMG ?= quay.io/openstack-k8s-operators/infra-operator:latest
@@ -98,7 +98,7 @@ help: ## Display this help.
 .PHONY: manifests
 manifests: gowork controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
 	$(CONTROLLER_GEN) rbac:roleName=manager-role crd webhook paths="./..." output:crd:artifacts:config=config/crd/bases && \
-	rm -f apis/bases/* && cp -a config/crd/bases apis/
+	rm -f api/bases/* && cp -a config/crd/bases api/
 
 .PHONY: generate
 generate: gowork controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
@@ -111,12 +111,12 @@ fmt: ## Run go fmt against code.
 .PHONY: vet
 vet: gowork ## Run go vet against code.
 	go vet ./...
-	go vet ./apis/...
+	go vet ./api/...
 
 .PHONY: tidy
 tidy: ## Run go mod tidy on every mod file in the repo
 	go mod tidy
-	cd ./apis && go mod tidy
+	cd ./api && go mod tidy
 
 PROCS?=$(shell expr $(shell nproc --ignore 2) / 2)
 PROC_CMD = --procs ${PROCS}
@@ -125,13 +125,13 @@ PROC_CMD = --procs ${PROCS}
 test: manifests generate gowork fmt vet envtest ginkgo ## Run tests.
 	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) -v debug --bin-dir $(LOCALBIN) use $(ENVTEST_K8S_VERSION) -p path)" \
 	OPERATOR_TEMPLATES="$(PWD)/templates" \
-	$(GINKGO) --trace --cover --coverpkg=./pkg/...,./controllers/...,./apis/network/v1beta1/...,./apis/rabbitmq/v1beta1/... --coverprofile cover.out --covermode=atomic ${PROC_CMD} $(GINKGO_ARGS) ./tests/... ./apis/network/... ./apis/rabbitmq/...
+	$(GINKGO) --trace --cover --coverpkg=./internal/...,./api/network/v1beta1/... --coverprofile cover.out --covermode=atomic ${PROC_CMD} $(GINKGO_ARGS) ./test/... ./api/network/... ./api/rabbitmq/...
 
 ##@ Build
 
 .PHONY: build
 build: generate fmt vet ## Build manager binary.
-	go build -o bin/manager main.go
+	go build -o bin/manager cmd/main.go
 
 .PHONY: run
 run: export METRICS_PORT?=8080
@@ -141,7 +141,7 @@ run: export OPERATOR_TEMPLATES=./templates
 run: export ENABLE_WEBHOOKS?=false
 run: manifests generate fmt vet ## Run a controller from your host.
 	/bin/bash hack/clean_local_webhook.sh
-	go run ./main.go -metrics-bind-address ":$(METRICS_PORT)" -health-probe-bind-address ":$(HEALTH_PORT)" -pprof-bind-address ":$(PPROF_PORT)"
+	go run ./cmd/main.go -metrics-bind-address ":$(METRICS_PORT)" -health-probe-bind-address ":$(HEALTH_PORT)" -pprof-bind-address ":$(PPROF_PORT)"
 
 # If you wish built the manager image targeting other platforms you can use the --platform flag.
 # (i.e. docker build --platform linux/arm64 ). However, you must enable docker buildKit for it.
@@ -208,7 +208,7 @@ ENVTEST ?= $(LOCALBIN)/setup-envtest
 GINKGO ?= $(LOCALBIN)/ginkgo
 
 ## Tool Versions
-KUSTOMIZE_VERSION ?= v3.8.7
+KUSTOMIZE_VERSION ?= v5.6.0
 CONTROLLER_TOOLS_VERSION ?= v0.18.0
 GOTOOLCHAIN_VERSION ?= go1.24.0
 
@@ -329,37 +329,37 @@ get-ci-tools:
 # Run go fmt against code
 gofmt: get-ci-tools
 	GOWORK=off $(CI_TOOLS_REPO_DIR)/test-runner/gofmt.sh
-	GOWORK=off $(CI_TOOLS_REPO_DIR)/test-runner/gofmt.sh ./apis
+	GOWORK=off $(CI_TOOLS_REPO_DIR)/test-runner/gofmt.sh ./api
 
 # Run go vet against code
 govet: get-ci-tools
 	GOWORK=off $(CI_TOOLS_REPO_DIR)/test-runner/govet.sh
-	GOWORK=off $(CI_TOOLS_REPO_DIR)/test-runner/govet.sh  ./apis
+	GOWORK=off $(CI_TOOLS_REPO_DIR)/test-runner/govet.sh  ./api
 
 # Run go test against code
 gotest: test
 
 # Run golangci-lint test against code
 golangci: get-ci-tools
 	GOWORK=off $(CI_TOOLS_REPO_DIR)/test-runner/golangci.sh
-	GOWORK=off $(CI_TOOLS_REPO_DIR)/test-runner/golangci.sh  ./apis
+	GOWORK=off $(CI_TOOLS_REPO_DIR)/test-runner/golangci.sh  ./api
 
 # Run go lint against code
 golint: get-ci-tools
 	GOWORK=off PATH=$(GOBIN):$(PATH); $(CI_TOOLS_REPO_DIR)/test-runner/golint.sh
-	GOWORK=off PATH=$(GOBIN):$(PATH); $(CI_TOOLS_REPO_DIR)/test-runner/golint.sh ./apis
+	GOWORK=off PATH=$(GOBIN):$(PATH); $(CI_TOOLS_REPO_DIR)/test-runner/golint.sh ./api
 
 .PHONY: gowork
 gowork: ## Generate go.work file to support our multi module repository
 	test -f go.work || GOTOOLCHAIN=$(GOTOOLCHAIN_VERSION) go work init
 	go work use .
-	go work use ./apis
+	go work use ./api
 	go work sync
 
 .PHONY: operator-lint
 operator-lint: gowork ## Runs operator-lint
 	GOBIN=$(LOCALBIN) go install github.com/gibizer/operator-lint@v0.3.0
-	go vet -vettool=$(LOCALBIN)/operator-lint ./... ./apis/...
+	go vet -vettool=$(LOCALBIN)/operator-lint ./... ./api/...
 
 # Used for webhook testing
 # The configure_local_webhook.sh script below will remove any OLM webhooks
@@ -383,8 +383,8 @@ force-bump: ## Force bump operator and lib-common dependencies
 	for dep in $$(cat go.mod | grep openstack-k8s-operators | grep -vE -- 'indirect|infra-operator|^replace' | awk '{print $$1}'); do \
 		go get $$dep@$(BRANCH) ; \
 	done
-	for dep in $$(cat apis/go.mod | grep openstack-k8s-operators | grep -vE -- 'indirect|infra-operator|^replace' | awk '{print $$1}'); do \
-		cd ./apis && go get $$dep@$(BRANCH) && cd .. ; \
+	for dep in $$(cat api/go.mod | grep openstack-k8s-operators | grep -vE -- 'indirect|infra-operator|^replace' | awk '{print $$1}'); do \
+		cd ./api && go get $$dep@$(BRANCH) && cd .. ; \
 	done
 
 CRD_SCHEMA_CHECKER_VERSION ?= release-4.16

PROJECT

@@ -4,7 +4,7 @@
 # More info: https://book.kubebuilder.io/reference/project-config.html
 domain: openstack.org
 layout:
-- go.kubebuilder.io/v3
+- go.kubebuilder.io/v4
 multigroup: true
 plugins:
   manifests.sdk.operatorframework.io/v2: {}
@@ -19,7 +19,7 @@ resources:
   domain: openstack.org
   group: rabbitmq
   kind: TransportURL
-  path: github.com/openstack-k8s-operators/infra-operator/apis/rabbitmq/v1beta1
+  path: github.com/openstack-k8s-operators/infra-operator/api/rabbitmq/v1beta1
   version: v1beta1
 - api:
     crdVersion: v1
@@ -28,7 +28,7 @@ resources:
   domain: openstack.org
   group: memcached
   kind: Memcached
-  path: github.com/openstack-k8s-operators/infra-operator/apis/memcached/v1beta1
+  path: github.com/openstack-k8s-operators/infra-operator/api/memcached/v1beta1
   version: v1beta1
   webhooks:
     defaulting: true
@@ -41,7 +41,7 @@ resources:
   domain: openstack.org
   group: instanceha
   kind: InstanceHa
-  path: github.com/openstack-k8s-operators/infra-operator/apis/instanceha/v1beta1
+  path: github.com/openstack-k8s-operators/infra-operator/api/instanceha/v1beta1
   version: v1beta1
   webhooks:
     defaulting: true
@@ -54,8 +54,7 @@ resources:
   domain: openstack.org
   group: redis
   kind: Redis
-  path: github.com/openstack-k8s-operators/infra-operator/apis/redis/v1beta1
-  plural: redises
+  path: github.com/openstack-k8s-operators/infra-operator/api/redis/v1beta1
   version: v1beta1
   webhooks:
     defaulting: true
@@ -68,7 +67,7 @@ resources:
   domain: openstack.org
   group: network
   kind: DNSMasq
-  path: github.com/openstack-k8s-operators/infra-operator/apis/network/v1beta1
+  path: github.com/openstack-k8s-operators/infra-operator/api/network/v1beta1
   version: v1beta1
   webhooks:
     defaulting: true
@@ -81,15 +80,16 @@ resources:
   domain: openstack.org
   group: network
   kind: DNSData
-  path: github.com/openstack-k8s-operators/infra-operator/apis/network/v1beta1
+  path: github.com/openstack-k8s-operators/infra-operator/api/network/v1beta1
   version: v1beta1
 - api:
     crdVersion: v1
     namespaced: true
+  controller: true
   domain: openstack.org
   group: network
   kind: NetConfig
-  path: github.com/openstack-k8s-operators/infra-operator/apis/network/v1beta1
+  path: github.com/openstack-k8s-operators/infra-operator/api/network/v1beta1
   version: v1beta1
   webhooks:
     defaulting: true
@@ -98,10 +98,11 @@ resources:
 - api:
     crdVersion: v1
     namespaced: true
+  controller: true
   domain: openstack.org
   group: network
   kind: Reservation
-  path: github.com/openstack-k8s-operators/infra-operator/apis/network/v1beta1
+  path: github.com/openstack-k8s-operators/infra-operator/api/network/v1beta1
   version: v1beta1
   webhooks:
     defaulting: true
@@ -114,20 +115,29 @@ resources:
   domain: openstack.org
   group: network
   kind: IPSet
-  path: github.com/openstack-k8s-operators/infra-operator/apis/network/v1beta1
+  path: github.com/openstack-k8s-operators/infra-operator/api/network/v1beta1
   version: v1beta1
   webhooks:
     defaulting: true
     validation: true
     webhookVersion: v1
+- api:
+    crdVersion: v1
+    namespaced: true
+  controller: true
+  domain: openstack.org
+  group: topology
+  kind: Topology
+  path: github.com/openstack-k8s-operators/infra-operator/api/topology/v1beta1
+  version: v1beta1
 - api:
     crdVersion: v1
     namespaced: true
   controller: true
   domain: openstack.org
   group: network
   kind: BGPConfiguration
-  path: github.com/openstack-k8s-operators/infra-operator/apis/network/v1beta1
+  path: github.com/openstack-k8s-operators/infra-operator/api/network/v1beta1
   version: v1beta1
 - api:
     crdVersion: v1
@@ -136,7 +146,7 @@ resources:
   domain: openstack.org
   group: rabbitmq
   kind: RabbitMq
-  path: github.com/openstack-k8s-operators/infra-operator/apis/rabbitmq/v1beta1
+  path: github.com/openstack-k8s-operators/infra-operator/api/rabbitmq/v1beta1
   version: v1beta1
   webhooks:
     defaulting: true

…nstanceha.openstack.org_instancehas.yaml …nstanceha.openstack.org_instancehas.yamlapis/bases/instanceha.openstack.org_instancehas.yaml renamed to api/bases/instanceha.openstack.org_instancehas.yaml apis/bases/instanceha.openstack.org_instancehas.yaml renamed to api/bases/instanceha.openstack.org_instancehas.yaml

@@ -142,6 +142,7 @@ spec:
                       bundle file
                     type: string
                   mtls:
+                    description: MTLSSection contains mutual TLS configuration
                     properties:
                       authCertSecret:
                         description: Name of the secret containing the client cert