feat(ci): generate install manifests for releases

The operator had no user-facing installation path beyond make
targets intended for local development. End-users had no way to
install via kubectl apply without cloning the repository.

- Expand build-installer target in Makefile to generate three
  variants: default, cert-manager, and observability
- Add validate-installer job to build-and-release.yaml to catch
  Kustomize breakage on every push to main
- Update tags.yaml to generate install YAMLs with the release
  image tag and attach them as GitHub Release assets
- Rewrite README Installation section with kubectl apply commands
  for all three variants, prerequisites, and an observability
  stack evaluation warning
- Update .gitignore comment to clarify dist/ is for releases

Users can now install with a single command:
kubectl apply --server-side -f
  https://github.com/.../releases/latest/download/install.yaml

Author: fernando-villalba

.github/workflows/build-and-release.yaml

@@ -128,3 +128,18 @@ jobs:
           IMAGE="ghcr.io/${{ github.repository }}"
           docker tag "$IMAGE:${{ github.sha }}" "$IMAGE:latest"
           docker push "$IMAGE:latest"
+
+  validate-installer:
+    needs: [ test-go ]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Install Go
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: Validate install manifests
+        run: make build-installer

.github/workflows/tags.yaml

@@ -66,10 +66,23 @@ jobs:
             --tag "$IMAGE:$VERSION_TAG" \
             "$IMAGE:$SHA_TAG"
 
+      - name: Install Go
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: Generate install manifests
+        run: |
+          make build-installer \
+            IMG="ghcr.io/${{ github.repository }}:${{ github.ref_name }}"
+
       - name: Create GitHub release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           gh release create "${{ github.ref_name }}" \
             --generate-notes \
-            --verify-tag
+            --verify-tag \
+            dist/install.yaml \
+            dist/install-certmanager.yaml \
+            dist/install-observability.yaml

.gitignore

@@ -5,7 +5,7 @@
 result
 result-*
 
-# generic
+# distribution files are added to github releases
 dist/
 
 # Go

Makefile

@@ -298,11 +298,13 @@ docker-buildx: ## Build and push docker image for cross-platform support
 	- $(CONTAINER_TOOL) buildx rm multigres-operator-builder
 
 .PHONY: build-installer
-build-installer: manifests generate kustomize ## Generate a consolidated YAML with CRDs and deployment.
+build-installer: manifests generate kustomize ## Generate consolidated install YAMLs under dist/.
 	mkdir -p dist
 	# kustomize has no build-time image override, so we mutate then restore.
 	cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
 	$(KUSTOMIZE) build config/default > dist/install.yaml
+	$(KUSTOMIZE) build config/deploy-certmanager > dist/install-certmanager.yaml
+	$(KUSTOMIZE) build config/deploy-observability > dist/install-observability.yaml
 	@git checkout -- config/manager/kustomization.yaml 2>/dev/null || true
 
 ##@ Test

README.md

@@ -16,32 +16,62 @@ The **[Multigres](https://github.com/multigres/multigres) Operator** is a Kubern
 
 ### Prerequisites
 - Kubernetes v1.25+
-- `cert-manager` (Optional, if using external certificate management)
 
 ### Quick Start
-To install the operator with default settings:
+
+Install the operator with built-in self-signed certificate management:
 
 ```bash
-# Install CRDs
-make install
+kubectl apply --server-side -f \
+  https://github.com/numtide/multigres-operator/releases/latest/download/install.yaml
+```
+
+This deploys the operator into the `multigres-operator` namespace with:
+- All CRDs (MultigresCluster, Cell, Shard, TableGroup, TopoServer, and templates)
+- RBAC roles and bindings
+- Mutating and Validating webhooks with self-signed certificates (auto-rotated)
+- The operator Deployment
+- Metrics endpoint
+
+### With cert-manager
+
+If you prefer external certificate management via [cert-manager](https://cert-manager.io/):
 
-# Deploy Operator to the cluster (uses your current kubeconfig context)
-make deploy
+```bash
+# 1. Install cert-manager (if not already present)
+kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.17.2/cert-manager.yaml
+kubectl wait --for=condition=Available deployment --all -n cert-manager --timeout=120s
+
+# 2. Install the operator
+kubectl apply --server-side -f \
+  https://github.com/numtide/multigres-operator/releases/latest/download/install-certmanager.yaml
 ```
 
-#### Local Development (Kind)
-For local testing using Kind, we provide several helper commands:
+### With observability stack
 
-| Command | Description |
-| :--- | :--- |
-| `make kind-deploy` | Deploy operator to local Kind cluster using self-signed certs (Default). |
-| `make kind-deploy-certmanager` | Deploy operator to Kind, installing `cert-manager` for certificate handling. |
-| `make kind-deploy-no-webhook` | Deploy operator to Kind with the webhook fully disabled. |
-| `make kind-deploy-observability` | Deploy operator with full observability stack (Prometheus Operator, OTel Collector, Tempo, Grafana). |
-| `make kind-portforward` | Port-forward Grafana (3000), Prometheus (9090), Tempo (3200) to localhost. Re-run if connection drops. |
+Install the operator alongside Prometheus, OpenTelemetry Collector, Tempo, and Grafana for metrics, tracing, and dashboards:
+
+```bash
+# 1. Install the Prometheus Operator (if not already present)
+kubectl apply --server-side -f \
+  https://github.com/prometheus-operator/prometheus-operator/releases/download/v0.80.0/bundle.yaml
+kubectl wait --for=condition=Available deployment/prometheus-operator -n default --timeout=120s
+
+# 2. Install the operator with observability
+kubectl apply --server-side -f \
+  https://github.com/numtide/multigres-operator/releases/latest/download/install-observability.yaml
+```
 
-### Using Sample Configurations
-We provide a set of samples to get you started quickly:
+> [!NOTE]
+> The bundled Prometheus, Tempo, Grafana, and OTel Collector are single-replica deployments with sane defaults intended for **evaluation and development**. They do not include HA, persistent storage, or authentication. For production observability, integrate the operator's metrics and traces with your existing monitoring infrastructure.
+
+### Applying samples
+
+Once the operator is running, try a sample cluster:
+
+```bash
+kubectl apply -f https://raw.githubusercontent.com/numtide/multigres-operator/main/config/samples/minimal.yaml
+```
 
 | Sample | Description |
 | :--- | :--- |
@@ -53,10 +83,17 @@ We provide a set of samples to get you started quickly:
 | `config/samples/no-templates.yaml` | A verbose example where all configuration is defined inline. |
 | `config/samples/external-etcd.yaml` | Connecting to an existing external Etcd cluster. |
 
-To apply a sample:
-```bash
-kubectl apply -f config/samples/minimal.yaml
-```
+### Local Development (Kind)
+
+For local testing using Kind, we provide several helper commands:
+
+| Command | Description |
+| :--- | :--- |
+| `make kind-deploy` | Deploy operator to local Kind cluster using self-signed certs (Default). |
+| `make kind-deploy-certmanager` | Deploy operator to Kind, installing `cert-manager` for certificate handling. |
+| `make kind-deploy-no-webhook` | Deploy operator to Kind with the webhook fully disabled. |
+| `make kind-deploy-observability` | Deploy operator with full observability stack (Prometheus Operator, OTel Collector, Tempo, Grafana). |
+| `make kind-portforward` | Port-forward Grafana (3000), Prometheus (9090), Tempo (3200) to localhost. Re-run if connection drops. |
 
 ---