openstack-k8s-operators · dprince · Nov 14, 2025
diff --git a/.ci-operator.yaml b/.ci-operator.yaml
@@ -1,4 +1,4 @@
 build_root_image:
   name: tools
   namespace: openstack-k8s-operators
-  tag: ci-build-root-golang-1.24-sdk-1.31
+  tag: ci-build-root-golang-1.24-sdk-1.41.1
diff --git a/.github/workflows/force-bump-pr-manual.yaml b/.github/workflows/force-bump-pr-manual.yaml
@@ -9,6 +9,6 @@ jobs:
     with:
       operator_name: nova
       branch_name: ${{ github.ref_name }}
-      custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.31
+      custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.41.1
     secrets:
       FORCE_BUMP_PULL_REQUEST_PAT: ${{ secrets.FORCE_BUMP_PULL_REQUEST_PAT }}
diff --git a/.github/workflows/force-bump-pr-scheduled.yaml b/.github/workflows/force-bump-pr-scheduled.yaml
@@ -10,6 +10,6 @@ jobs:
     uses: openstack-k8s-operators/openstack-k8s-operators-ci/.github/workflows/force-bump-branches.yaml@main
     with:
       operator_name: nova
-      custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.31
+      custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.41.1
     secrets:
       FORCE_BUMP_PULL_REQUEST_PAT: ${{ secrets.FORCE_BUMP_PULL_REQUEST_PAT }}
diff --git a/.zuul.yaml b/.zuul.yaml
@@ -189,7 +189,9 @@
     merge-mode: rebase
     github-check:
       jobs:
-        - openstack-meta-content-provider
+        - openstack-meta-content-provider:
+            vars:
+              cifmw_install_yamls_sdk_version: v1.41.1
         - nova-operator-kuttl
         - nova-operator-tempest-multinode
         - nova-operator-tempest-multinode-ceph
@@ -223,6 +225,7 @@
               cifmw_bop_openstack_release: master
               cifmw_bop_dlrn_baseurl: "https://trunk.rdoproject.org/centos9-master"
               cifmw_repo_setup_branch: master
+              cifmw_install_yamls_sdk_version: v1.41.1
         - nova-operator-tempest-multinode: &job_vars
             override-checkout: main
             # when run from nova we need to ensure we list the nova-operator

diff --git a/Dockerfile b/Dockerfile
@@ -23,7 +23,7 @@ RUN mkdir -p ${DEST_ROOT}/usr/local/bin/
 RUN if [ ! -f $CACHITO_ENV_FILE ]; then go mod download ; fi
 
 # Build manager
-RUN if [ -f $CACHITO_ENV_FILE ] ; then source $CACHITO_ENV_FILE ; fi ; env ${GO_BUILD_EXTRA_ENV_ARGS} go build ${GO_BUILD_EXTRA_ARGS} -a -o ${DEST_ROOT}/manager main.go
+RUN if [ -f $CACHITO_ENV_FILE ] ; then source $CACHITO_ENV_FILE ; fi ; env ${GO_BUILD_EXTRA_ENV_ARGS} go build ${GO_BUILD_EXTRA_ARGS} -a -o ${DEST_ROOT}/manager cmd/main.go
 
 
 RUN cp -r templates ${DEST_ROOT}/templates

diff --git a/Makefile b/Makefile
@@ -48,7 +48,7 @@ endif
 
 # Set the Operator SDK version to use. By default, what is installed on the system is used.
 # This is useful for CI or a project to utilize a specific version of the operator-sdk toolkit.
-OPERATOR_SDK_VERSION ?= v1.31.0
+OPERATOR_SDK_VERSION ?= v1.41.1
 
 # Image URL to use all building/pushing image targets
 DEFAULT_IMG ?= quay.io/openstack-k8s-operators/nova-operator:latest
@@ -150,13 +150,13 @@ PROC_CMD = --procs ${PROCS}
 test: manifests generate fmt vet envtest ginkgo ## Run tests.
 	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) -v debug --bin-dir $(LOCALBIN) use $(ENVTEST_K8S_VERSION) -p path)" \
 	OPERATOR_TEMPLATES="$(PWD)/templates" \
-	$(GINKGO) --trace --cover --coverpkg=../../pkg/...,../../controllers,../../api/v1beta1 --coverprofile cover.out --covermode=atomic --randomize-all ${PROC_CMD} $(GINKGO_ARGS) ./test/...
+	$(GINKGO) --trace --cover --coverpkg=../../internal/...,../../api/v1beta1 --coverprofile cover.out --covermode=atomic --randomize-all ${PROC_CMD} $(GINKGO_ARGS) ./test/...
 
 ##@ Build
 
 .PHONY: build
 build: generate fmt vet ## Build manager binary.
-	go build -o bin/manager main.go
+	go build -o bin/manager cmd/main.go
 
 .PHONY: run
 run: export METRICS_PORT?=24600
@@ -165,7 +165,7 @@ run: export PPROF_PORT?=8082
 run: export ENABLE_WEBHOOKS?=false
 run: manifests generate fmt vet ## Run a controller from your host.
 	/bin/bash hack/clean_local_webhook.sh
-	go run ./main.go -metrics-bind-address ":$(METRICS_PORT)" -health-probe-bind-address ":$(HEALTH_PORT)" -pprof-bind-address ":$(PPROF_PORT)"
+	go run ./cmd/main.go -metrics-bind-address ":$(METRICS_PORT)" -health-probe-bind-address ":$(HEALTH_PORT)" -pprof-bind-address ":$(PPROF_PORT)"
 
 
 # Extra vars which will be passed to the Docker-build
@@ -216,7 +216,7 @@ ENVTEST ?= $(LOCALBIN)/setup-envtest
 GINKGO ?= $(LOCALBIN)/ginkgo
 
 ## Tool Versions
-KUSTOMIZE_VERSION ?= v3.8.7
+KUSTOMIZE_VERSION ?= v5.6.0
 CONTROLLER_TOOLS_VERSION ?= v0.18.0
 
 KUSTOMIZE_INSTALL_SCRIPT ?= "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"

diff --git a/PROJECT b/PROJECT
@@ -1,6 +1,10 @@
+# Code generated by tool. DO NOT EDIT.
+# This file is used to track the info used to scaffold your project
+# and allow the plugins properly work.
+# More info: https://book.kubebuilder.io/reference/project-config.html
 domain: openstack.org
 layout:
-- go.kubebuilder.io/v3
+- go.kubebuilder.io/v4
 plugins:
   manifests.sdk.operatorframework.io/v2: {}
   scorecard.sdk.operatorframework.io/v2: {}

diff --git a/api/v1beta1/common_types.go b/api/v1beta1/common_types.go
@@ -104,6 +104,7 @@ type PasswordSelector struct {
 	PrefixMetadataCellsSecret string `json:"prefixMetadataCellsSecret"`
 }
 
+// NovaImages defines container images used by top level Nova CR
 type NovaImages struct {
 	// +kubebuilder:validation:Required
 	// APIContainerImageURL
@@ -116,6 +117,7 @@ type NovaImages struct {
 	NovaCellImages `json:",inline"`
 }
 
+// Default sets default image URLs for NovaImages
 func (r *NovaImages) Default(defaults NovaDefaults) {
 	r.NovaCellImages.Default(defaults.NovaCellDefaults)
 	if r.APIContainerImageURL == "" {
@@ -126,6 +128,7 @@ func (r *NovaImages) Default(defaults NovaDefaults) {
 	}
 }
 
+// NovaCellImages defines container images used by NovaCell services
 type NovaCellImages struct {
 
 	// +kubebuilder:validation:Required
@@ -145,6 +148,7 @@ type NovaCellImages struct {
 	NovaComputeContainerImageURL string `json:"computeContainerImageURL"`
 }
 
+// Default sets default image URLs for NovaCellImages
 func (r *NovaCellImages) Default(defaults NovaCellDefaults) {
 	if r.ConductorContainerImageURL == "" {
 		r.ConductorContainerImageURL = defaults.ConductorContainerImageURL

diff --git a/api/v1beta1/nova_webhook.go b/api/v1beta1/nova_webhook.go
@@ -35,7 +35,6 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/util/validation/field"
 	"k8s.io/utils/ptr"
-	ctrl "sigs.k8s.io/controller-runtime"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/webhook"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
@@ -60,15 +59,6 @@ func SetupNovaDefaults(defaults NovaDefaults) {
 	novalog.Info("Nova defaults initialized", "defaults", defaults)
 }
 
-// SetupWebhookWithManager sets up the webhook with the Manager
-func (r *Nova) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr).
-		For(r).
-		Complete()
-}
-
-//+kubebuilder:webhook:path=/mutate-nova-openstack-org-v1beta1-nova,mutating=true,failurePolicy=fail,sideEffects=None,groups=nova.openstack.org,resources=nova,verbs=create;update,versions=v1beta1,name=mnova.kb.io,admissionReviewVersions=v1
-
 var _ webhook.Defaulter = &Nova{}
 
 // Default implements webhook.Defaulter so a webhook will be registered for the type
@@ -121,15 +111,13 @@ func (spec *NovaSpecCore) Default() {
 	}
 }
 
-// NOTE: change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-//+kubebuilder:webhook:path=/validate-nova-openstack-org-v1beta1-nova,mutating=false,failurePolicy=fail,sideEffects=None,groups=nova.openstack.org,resources=nova,verbs=create;update,versions=v1beta1,name=vnova.kb.io,admissionReviewVersions=v1
-
 var _ webhook.Validator = &Nova{}
 
-func (r *NovaSpecCore) ValidateCellTemplates(basePath *field.Path, namespace string) field.ErrorList {
+// ValidateCellTemplates validates cell templates configuration
+func (spec *NovaSpecCore) ValidateCellTemplates(basePath *field.Path, namespace string) field.ErrorList {
 	var errors field.ErrorList
 
-	if _, ok := r.CellTemplates[Cell0Name]; !ok {
+	if _, ok := spec.CellTemplates[Cell0Name]; !ok {
 		errors = append(
 			errors,
 			field.Required(basePath.Child("cellTemplates"),
@@ -139,7 +127,7 @@ func (r *NovaSpecCore) ValidateCellTemplates(basePath *field.Path, namespace str
 
 	cellMessageBusNames := make(map[string]string)
 
-	for name, cell := range r.CellTemplates {
+	for name, cell := range spec.CellTemplates {
 		cellPath := basePath.Child("cellTemplates").Key(name)
 		errors = append(
 			errors,
@@ -163,7 +151,7 @@ func (r *NovaSpecCore) ValidateCellTemplates(basePath *field.Path, namespace str
 
 			cellMessageBusNames[cell.CellMessageBusInstance] = name
 		}
-		if *cell.MetadataServiceTemplate.Enabled && *r.MetadataServiceTemplate.Enabled {
+		if *cell.MetadataServiceTemplate.Enabled && *spec.MetadataServiceTemplate.Enabled {
 			errors = append(
 				errors,
 				field.Invalid(
@@ -239,67 +227,67 @@ func (r *NovaSpecCore) ValidateCellTemplates(basePath *field.Path, namespace str
 }
 
 // ValidateAPIServiceTemplate -
-func (r *NovaSpecCore) ValidateAPIServiceTemplate(basePath *field.Path, namespace string) field.ErrorList {
+func (spec *NovaSpecCore) ValidateAPIServiceTemplate(basePath *field.Path, namespace string) field.ErrorList {
 	errors := field.ErrorList{}
 
 	// validate the service override key is valid
 	errors = append(errors,
 		service.ValidateRoutedOverrides(
 			basePath.Child("apiServiceTemplate").Child("override").Child("service"),
-			r.APIServiceTemplate.Override.Service)...)
+			spec.APIServiceTemplate.Override.Service)...)
 
 	errors = append(errors,
 		ValidateAPIDefaultConfigOverwrite(
 			basePath.Child("apiServiceTemplate").Child("defaultConfigOverwrite"),
-			r.APIServiceTemplate.DefaultConfigOverwrite)...)
+			spec.APIServiceTemplate.DefaultConfigOverwrite)...)
 
 	errors = append(errors,
-		r.APIServiceTemplate.ValidateTopology(
+		spec.APIServiceTemplate.ValidateTopology(
 			basePath.Child("apiServiceTemplate"),
 			namespace)...)
 
 	return errors
 }
 
 // ValidateSchedulerServiceTemplate -
-func (r *NovaSpecCore) ValidateSchedulerServiceTemplate(basePath *field.Path, namespace string) field.ErrorList {
+func (spec *NovaSpecCore) ValidateSchedulerServiceTemplate(basePath *field.Path, namespace string) field.ErrorList {
 	errors := field.ErrorList{}
 	// validate the referenced TopologyRef
 	errors = append(errors,
-		r.SchedulerServiceTemplate.ValidateTopology(
+		spec.SchedulerServiceTemplate.ValidateTopology(
 			basePath.Child("schedulerServiceTemplate"),
 			namespace)...)
 	return errors
 }
 
 // ValidateCreate validates the NovaSpec during the webhook invocation.
-func (r *NovaSpec) ValidateCreate(basePath *field.Path, namespace string) field.ErrorList {
-	return r.NovaSpecCore.ValidateCreate(basePath, namespace)
+func (spec *NovaSpec) ValidateCreate(basePath *field.Path, namespace string) field.ErrorList {
+	return spec.NovaSpecCore.ValidateCreate(basePath, namespace)
 }
 
 // ValidateCreate validates the NovaSpecCore during the webhook invocation. It is
 // expected to be called by the validation webhook in the higher level meta
 // operator
-func (r *NovaSpecCore) ValidateCreate(basePath *field.Path, namespace string) field.ErrorList {
-	errors := r.ValidateCellTemplates(basePath, namespace)
-	errors = append(errors, r.ValidateAPIServiceTemplate(basePath, namespace)...)
-	errors = append(errors, r.ValidateSchedulerServiceTemplate(basePath, namespace)...)
+func (spec *NovaSpecCore) ValidateCreate(basePath *field.Path, namespace string) field.ErrorList {
+	errors := spec.ValidateCellTemplates(basePath, namespace)
+	errors = append(errors, spec.ValidateAPIServiceTemplate(basePath, namespace)...)
+	errors = append(errors, spec.ValidateSchedulerServiceTemplate(basePath, namespace)...)
 
 	// validate TopologyRef override for top-level MetadataServiceTemplate
 	errors = append(errors,
-		r.MetadataServiceTemplate.ValidateTopology(
+		spec.MetadataServiceTemplate.ValidateTopology(
 			basePath.Child("metadataServiceTemplate"),
 			namespace)...)
 
 	errors = append(
 		errors,
-		r.MetadataServiceTemplate.ValidateDefaultConfigOverwrite(
+		spec.MetadataServiceTemplate.ValidateDefaultConfigOverwrite(
 			basePath.Child("metadataServiceTemplate"))...)
 
 	// validate top-level topology
 	errors = append(errors,
 		topologyv1.ValidateTopologyRef(
-			r.TopologyRef, *basePath.Child("topologyRef"), namespace)...)
+			spec.TopologyRef, *basePath.Child("topologyRef"), namespace)...)
 
 	return errors
 }
@@ -319,31 +307,31 @@ func (r *Nova) ValidateCreate() (admission.Warnings, error) {
 }
 
 // ValidateUpdate validates the NovaSpec during the webhook invocation.
-func (r *NovaSpec) ValidateUpdate(old NovaSpec, basePath *field.Path, namespace string) field.ErrorList {
-	return r.NovaSpecCore.ValidateUpdate(old.NovaSpecCore, basePath, namespace)
+func (spec *NovaSpec) ValidateUpdate(old NovaSpec, basePath *field.Path, namespace string) field.ErrorList {
+	return spec.NovaSpecCore.ValidateUpdate(old.NovaSpecCore, basePath, namespace)
 }
 
 // ValidateUpdate validates the NovaSpecCore during the webhook invocation. It is
 // expected to be called by the validation webhook in the higher level meta
 // operator
-func (r *NovaSpecCore) ValidateUpdate(old NovaSpecCore, basePath *field.Path, namespace string) field.ErrorList {
-	errors := r.ValidateCellTemplates(basePath, namespace)
+func (spec *NovaSpecCore) ValidateUpdate(old NovaSpecCore, basePath *field.Path, namespace string) field.ErrorList {
+	errors := spec.ValidateCellTemplates(basePath, namespace)
 	// Validate top-level TopologyRef
 	errors = append(errors, topologyv1.ValidateTopologyRef(
-		r.TopologyRef, *basePath.Child("topologyRef"), namespace)...)
+		spec.TopologyRef, *basePath.Child("topologyRef"), namespace)...)
 
-	errors = append(errors, r.ValidateAPIServiceTemplate(basePath, namespace)...)
-	errors = append(errors, r.ValidateSchedulerServiceTemplate(basePath, namespace)...)
+	errors = append(errors, spec.ValidateAPIServiceTemplate(basePath, namespace)...)
+	errors = append(errors, spec.ValidateSchedulerServiceTemplate(basePath, namespace)...)
 
 	// validate TopologyRef override for top-level MetadataServiceTemplate
 	errors = append(errors,
-		r.MetadataServiceTemplate.ValidateTopology(
+		spec.MetadataServiceTemplate.ValidateTopology(
 			basePath.Child("metadataServiceTemplate"),
 			namespace)...)
 
 	errors = append(
 		errors,
-		r.MetadataServiceTemplate.ValidateDefaultConfigOverwrite(
+		spec.MetadataServiceTemplate.ValidateDefaultConfigOverwrite(
 			basePath.Child("metadataServiceTemplate"))...)
 
 	return errors
@@ -379,7 +367,7 @@ func (r *Nova) ValidateDelete() (admission.Warnings, error) {
 
 // SetDefaultRouteAnnotations sets HAProxy timeout values of the route
 // NOTE: it is used by ctlplane webhook on openstack-operator
-func (r *NovaSpecCore) SetDefaultRouteAnnotations(annotations map[string]string) {
+func (spec *NovaSpecCore) SetDefaultRouteAnnotations(annotations map[string]string) {
 	const haProxyAnno = "haproxy.router.openshift.io/timeout"
 	// Use a custom annotation to flag when the operator has set the default HAProxy timeout
 	// With the annotation func determines when to overwrite existing HAProxy timeout with the APITimeout
@@ -399,7 +387,7 @@ func (r *NovaSpecCore) SetDefaultRouteAnnotations(annotations map[string]string)
 		return
 	}
 
-	timeout := fmt.Sprintf("%ds", r.APITimeout)
+	timeout := fmt.Sprintf("%ds", spec.APITimeout)
 	annotations[novaAnno] = timeout
 	annotations[haProxyAnno] = timeout
 }

diff --git a/api/v1beta1/novaapi_types.go b/api/v1beta1/novaapi_types.go
@@ -240,16 +240,16 @@ func (n NovaAPI) GetSecret() string {
 }
 
 // GetSpecTopologyRef - Returns the LastAppliedTopology Set in the Status
-func (instance *NovaAPI) GetSpecTopologyRef() *topologyv1.TopoRef {
-	return instance.Spec.TopologyRef
+func (n *NovaAPI) GetSpecTopologyRef() *topologyv1.TopoRef {
+	return n.Spec.TopologyRef
 }
 
 // GetLastAppliedTopology - Returns the LastAppliedTopology Set in the Status
-func (instance *NovaAPI) GetLastAppliedTopology() *topologyv1.TopoRef {
-	return instance.Status.LastAppliedTopology
+func (n *NovaAPI) GetLastAppliedTopology() *topologyv1.TopoRef {
+	return n.Status.LastAppliedTopology
 }
 
 // SetLastAppliedTopology - Sets the LastAppliedTopology value in the Status
-func (instance *NovaAPI) SetLastAppliedTopology(topologyRef *topologyv1.TopoRef) {
-	instance.Status.LastAppliedTopology = topologyRef
+func (n *NovaAPI) SetLastAppliedTopology(topologyRef *topologyv1.TopoRef) {
+	n.Status.LastAppliedTopology = topologyRef
 }