Upgrade operator-sdk from v1.31.0 to v1.41.1

This upgrades the operator-sdk to version 1.41.1, which includes migrating
to the Kubebuilder v4 layout and modernizing the project structure.

Key changes:
  - Re-scaffold the project with operator-sdk 1.41.1
  - Update both main.go to support the latest kubebuilder features. This
    includes using WithAuthenticationAndAuthorization to guard metrics
    endpoints. This drops use of kube-rbac-proxy for openstack-operator.
  - Migrated from Kubebuilder v3 to v4 layout (PROJECT file updated)
  - Renamed apis/ directory to api/ following Kubebuilder v4 conventions
  - Updated all import paths throughout the codebase to use api/ instead of apis/
  - Moved main.go to cmd/main.go per new project structure
  - Partially updated webhook implementations to use new validation/defaulting patterns. More
    work can be done to consolidate the webhook code in the internal/webhook directory in the future.
  - Added missing webhook configurations for OpenStackClient, OpenStackDataPlaneService, and
    OpenStackDataPlaneDeployment to PROJECT
  - Upgraded kustomize from v5.5.0 to v5.6.0
  - Updated controller-gen paths to reflect new directory structure
  - Updated all Makefile targets and test paths

Co-Authored-By: Claude <[email protected]>

Jira: OSPRH-21438

Author: dprince

.ci-operator.yaml

@@ -1,4 +1,4 @@
 build_root_image:
   name: tools
   namespace: openstack-k8s-operators
-  tag: ci-build-root-golang-1.24-sdk-1.31
+  tag: ci-build-root-golang-1.24-sdk-1.41.1

.github/workflows/build-openstack-operator.yaml

@@ -16,7 +16,7 @@ jobs:
     with:
       operator_name: openstack
       go_version: 1.24.x
-      operator_sdk_version: 1.31.0
+      operator_sdk_version: 1.41.1
       bundle_dockerfile: ./bundle.Dockerfile
       operator_version: 0.5.0
     secrets:

.github/workflows/force-bump-pr-manual.yaml

@@ -9,6 +9,6 @@ jobs:
     with:
       operator_name: openstack
       branch_name: ${{ github.ref_name }}
-      custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.31
+      custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.41.1
     secrets:
       FORCE_BUMP_PULL_REQUEST_PAT: ${{ secrets.FORCE_BUMP_PULL_REQUEST_PAT }}

.github/workflows/force-bump-pr-scheduled.yaml

@@ -10,6 +10,6 @@ jobs:
     uses: openstack-k8s-operators/openstack-k8s-operators-ci/.github/workflows/force-bump-branches.yaml@main
     with:
       operator_name: openstack
-      custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.31
+      custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.41.1
     secrets:
       FORCE_BUMP_PULL_REQUEST_PAT: ${{ secrets.FORCE_BUMP_PULL_REQUEST_PAT }}

Dockerfile

@@ -25,7 +25,7 @@ RUN mkdir -p ${DEST_ROOT}/usr/local/bin/
 RUN if [ ! -f $CACHITO_ENV_FILE ]; then go mod download ; fi
 
 # Build manager
-RUN if [ -f $CACHITO_ENV_FILE ] ; then source $CACHITO_ENV_FILE ; fi ; env ${GO_BUILD_EXTRA_ENV_ARGS} go build ${GO_BUILD_EXTRA_ARGS} -a -o ${DEST_ROOT}/manager main.go
+RUN if [ -f $CACHITO_ENV_FILE ] ; then source $CACHITO_ENV_FILE ; fi ; env ${GO_BUILD_EXTRA_ENV_ARGS} go build ${GO_BUILD_EXTRA_ARGS} -a -o ${DEST_ROOT}/manager cmd/main.go
 RUN if [ -f $CACHITO_ENV_FILE ] ; then source $CACHITO_ENV_FILE ; fi ; env ${GO_BUILD_EXTRA_ENV_ARGS} go build ${GO_BUILD_EXTRA_ARGS} -a -o ${DEST_ROOT}/operator cmd/operator/main.go
 
 RUN cp -r config/services ${DEST_ROOT}/services

Makefile

@@ -50,7 +50,7 @@ endif
 
 # Set the Operator SDK version to use. By default, what is installed on the system is used.
 # This is useful for CI or a project to utilize a specific version of the operator-sdk toolkit.
-OPERATOR_SDK_VERSION ?= v1.31.0
+OPERATOR_SDK_VERSION ?= v1.41.1
 
 # Image URL to use all building/pushing image targets
 DEFAULT_IMG ?= quay.io/openstack-k8s-operators/openstack-operator:latest
@@ -139,9 +139,9 @@ help: ## Display this help.
 manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
 	mkdir -p config/operator/rbac && \
 	$(CONTROLLER_GEN) crd$(CRDDESC_OVERRIDE) output:crd:artifacts:config=config/crd/bases webhook paths="./..." && \
-	$(CONTROLLER_GEN) rbac:roleName=manager-role paths="{./apis/client/...,./apis/core/...,./apis/dataplane/...,./controllers/client/...,./controllers/core/...,./controllers/dataplane/...,./pkg/...}" output:dir=config/rbac && \
-	$(CONTROLLER_GEN) rbac:roleName=operator-role paths="./controllers/operator/..." paths="./apis/operator/..." output:dir=config/operator/rbac && \
-	rm -f apis/bases/* && cp -a config/crd/bases apis/
+	$(CONTROLLER_GEN) rbac:roleName=manager-role paths="{./api/client/...,./api/core/...,./api/dataplane/...,./internal/controller/client/...,./internal/controller/core/...,./internal/controller/dataplane/...,./internal/...}" output:dir=config/rbac && \
+	$(CONTROLLER_GEN) rbac:roleName=operator-role paths="./internal/controller/operator/..." paths="./api/operator/..." output:dir=config/operator/rbac && \
+	rm -f api/bases/* && cp -a config/crd/bases api/
 
 .PHONY: generate
 generate: controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
@@ -171,22 +171,22 @@ fmt: ## Run go fmt against code.
 .PHONY: vet
 vet: gowork ## Run go vet against code.
 	go vet ./...
-	go vet ./apis/...
+	go vet ./api/...
 
 BRANCH ?= main
 .PHONY: force-bump
 force-bump: ## Force bump after tagging
 	for dep in $$(cat go.mod | grep openstack-k8s-operators | grep -vE -- 'indirect|openstack-operator|^replace' | awk '{print $$1}'); do \
 		go get $$dep@$(BRANCH) ; \
 	done
-	for dep in $$(cat apis/go.mod | grep openstack-k8s-operators | grep -vE -- 'indirect|openstack-operator|^replace' | awk '{print $$1}'); do \
-		cd ./apis && go get $$dep@$(BRANCH) && cd .. ; \
+	for dep in $$(cat api/go.mod | grep openstack-k8s-operators | grep -vE -- 'indirect|openstack-operator|^replace' | awk '{print $$1}'); do \
+		cd ./api && go get $$dep@$(BRANCH) && cd .. ; \
 	done
 
 .PHONY: tidy
 tidy: ## Run go mod tidy on every mod file in the repo
 	go mod tidy
-	cd ./apis && go mod tidy
+	cd ./api && go mod tidy
 
 GOLANGCI_LINT_VERSION ?= v2.4.0
 .PHONY: golangci-lint
@@ -207,7 +207,7 @@ ginkgo-run: ## Run ginkgo.
 	source hack/export_related_images.sh && \
 	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) -v debug --bin-dir $(LOCALBIN) use $(ENVTEST_K8S_VERSION) -p path)" \
 	OPERATOR_TEMPLATES="$(PWD)/templates" \
-	$(GINKGO) --trace --cover --coverpkg=./pkg/...,./controllers/...,./apis/... --coverprofile cover.out --covermode=atomic ${PROC_CMD} $(GINKGO_ARGS) $(GINKGO_TESTS)
+	$(GINKGO) --trace --cover --coverpkg=./internal/...,./api/... --coverprofile cover.out --covermode=atomic ${PROC_CMD} $(GINKGO_ARGS) $(GINKGO_TESTS)
 
 .PHONY: test-all
 test-all: test golint golangci golangci-lint ## Run all tests.
@@ -220,7 +220,7 @@ cover: test ## Run tests and display functional test coverage
 
 .PHONY: build
 build: generate fmt vet ## Build manager binary.
-	go build -o bin/manager main.go
+	go build -o bin/manager cmd/main.go
 	go build -o bin/operator cmd/operator/main.go
 
 .PHONY: run
@@ -231,7 +231,7 @@ run: export ENABLE_WEBHOOKS?=false
 run: manifests generate fmt vet ## Run a controller from your host.
 	/bin/bash hack/clean_local_webhook.sh
 	source hack/export_related_images.sh && \
-		go run ./main.go -metrics-bind-address ":$(METRICS_PORT)" -health-probe-bind-address ":$(HEALTH_PORT)" -pprof-bind-address ":$(PPROF_PORT)"
+		go run ./cmd/main.go -metrics-bind-address ":$(METRICS_PORT)" -health-probe-bind-address ":$(HEALTH_PORT)" -pprof-bind-address ":$(PPROF_PORT)"
 
 .PHONY: run-operator
 run-operator: export METRICS_PORT?=8080
@@ -270,6 +270,12 @@ docker-buildx:  ## Build and push docker image for the manager for cross-platfor
 	- docker buildx rm project-v3-builder
 	rm Dockerfile.cross
 
+.PHONY: build-installer
+build-installer: manifests generate kustomize ## Generate a consolidated YAML with CRDs and deployment.
+	mkdir -p dist
+	cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
+	$(KUSTOMIZE) build config/default > dist/install.yaml
+
 ##@ Deployment
 
 ifndef ignore-not-found
@@ -306,12 +312,12 @@ CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
 ENVTEST ?= $(LOCALBIN)/setup-envtest
 CRD_MARKDOWN ?= $(LOCALBIN)/crd-to-markdown
 GINKGO ?= $(LOCALBIN)/ginkgo
-GINKGO_TESTS ?= ./tests/... ./apis/client/... ./apis/core/... ./apis/dataplane/... ./pkg/...
+GINKGO_TESTS ?= ./test/... ./api/client/... ./api/core/... ./api/dataplane/... ./internal/...
 
 KUTTL ?= $(LOCALBIN)/kubectl-kuttl
 
 ## Tool Versions
-KUSTOMIZE_VERSION ?= v5.5.0 #(dprince: bumped to aquire new features like --load-restrictor)
+KUSTOMIZE_VERSION ?= v5.6.0 #(dprince: bumped to aquire new features like --load-restrictor)
 CONTROLLER_TOOLS_VERSION ?= v0.18.0
 CRD_MARKDOWN_VERSION ?= v0.0.3
 KUTTL_VERSION ?= 0.17.0
@@ -351,7 +357,7 @@ $(GINKGO): $(LOCALBIN)
 
 .PHONY: kuttl-test
 kuttl-test: ## Run kuttl tests
-	$(LOCALBIN)/kubectl-kuttl test --config kuttl-test.yaml tests/kuttl/tests $(KUTTL_ARGS)
+	$(LOCALBIN)/kubectl-kuttl test --config kuttl-test.yaml test/kuttl/tests $(KUTTL_ARGS)
 
 .PHONY: kuttl
 kuttl: $(KUTTL) ## Download kubectl-kuttl locally if necessary.
@@ -380,8 +386,8 @@ endif
 bundle: manifests kustomize operator-sdk ## Generate bundle manifests and metadata, then validate generated files.
 	$(OPERATOR_SDK) generate kustomize manifests -q
 	cd config/operator/deployment/ && $(KUSTOMIZE) edit set image controller=$(IMG) && \
-	$(KUSTOMIZE) edit add patch --kind Deployment --name openstack-operator-controller-operator --namespace system --patch "[{\"op\": \"replace\", \"path\": \"/spec/template/spec/containers/1/env/0\", \"value\": {\"name\": \"OPENSTACK_RELEASE_VERSION\", \"value\": \"$(OPENSTACK_RELEASE_VERSION)\"}}]" && \
-	$(KUSTOMIZE) edit add patch --kind Deployment --name openstack-operator-controller-operator --namespace system --patch "[{\"op\": \"replace\", \"path\": \"/spec/template/spec/containers/1/env/1\", \"value\": {\"name\": \"OPERATOR_IMAGE_URL\", \"value\": \"$(IMG)\"}}]"
+	$(KUSTOMIZE) edit add patch --kind Deployment --name openstack-operator-controller-operator --namespace system --patch "[{\"op\": \"replace\", \"path\": \"/spec/template/spec/containers/0/env/0\", \"value\": {\"name\": \"OPENSTACK_RELEASE_VERSION\", \"value\": \"$(OPENSTACK_RELEASE_VERSION)\"}}]" && \
+	$(KUSTOMIZE) edit add patch --kind Deployment --name openstack-operator-controller-operator --namespace system --patch "[{\"op\": \"replace\", \"path\": \"/spec/template/spec/containers/0/env/1\", \"value\": {\"name\": \"OPERATOR_IMAGE_URL\", \"value\": \"$(IMG)\"}}]"
 	$(KUSTOMIZE) build config/operator --load-restrictor='LoadRestrictionsNone' | $(OPERATOR_SDK) generate bundle $(BUNDLE_GEN_FLAGS)
 	$(OPERATOR_SDK) bundle validate ./bundle
 
@@ -468,37 +474,37 @@ get-ci-tools:
 # Run go fmt against code
 gofmt: get-ci-tools
 	GOWORK=off $(CI_TOOLS_REPO_DIR)/test-runner/gofmt.sh
-	GOWORK=off $(CI_TOOLS_REPO_DIR)/test-runner/gofmt.sh ./apis
+	GOWORK=off $(CI_TOOLS_REPO_DIR)/test-runner/gofmt.sh ./api
 
 # Run go vet against code
 govet: get-ci-tools
 	GOWORK=off $(CI_TOOLS_REPO_DIR)/test-runner/govet.sh
-	GOWORK=off $(CI_TOOLS_REPO_DIR)/test-runner/govet.sh  ./apis
+	GOWORK=off $(CI_TOOLS_REPO_DIR)/test-runner/govet.sh  ./api
 
 # Run go test against code
 gotest: test
 
 # Run golangci-lint test against code
 golangci: get-ci-tools
 	GOWORK=off $(CI_TOOLS_REPO_DIR)/test-runner/golangci.sh
-	GOWORK=off $(CI_TOOLS_REPO_DIR)/test-runner/golangci.sh  ./apis
+	GOWORK=off $(CI_TOOLS_REPO_DIR)/test-runner/golangci.sh  ./api
 
 # Run go lint against code
 golint: get-ci-tools
 	GOWORK=off PATH=$(GOBIN):$(PATH); $(CI_TOOLS_REPO_DIR)/test-runner/golint.sh
-	GOWORK=off PATH=$(GOBIN):$(PATH); $(CI_TOOLS_REPO_DIR)/test-runner/golint.sh ./apis
+	GOWORK=off PATH=$(GOBIN):$(PATH); $(CI_TOOLS_REPO_DIR)/test-runner/golint.sh ./api
 
 .PHONY: gowork
 gowork: ## Generate go.work file to support our multi module repository
 	test -f go.work || GOTOOLCHAIN=$(GOTOOLCHAIN_VERSION) go work init
 	go work use .
-	go work use ./apis
+	go work use ./api
 	go work sync
 
 .PHONY: operator-lint
 operator-lint: gowork ## Runs operator-lint
 	GOBIN=$(LOCALBIN) go install github.com/gibizer/[email protected]
-	go vet -vettool=$(LOCALBIN)/operator-lint ./... ./apis/...
+	go vet -vettool=$(LOCALBIN)/operator-lint ./... ./api/...
 
 # Used for webhook testing
 # The configure_local_webhook.sh script below will remove any OLM webhooks

PROJECT

@@ -4,7 +4,7 @@
 # More info: https://book.kubebuilder.io/reference/project-config.html
 domain: openstack.org
 layout:
-- go.kubebuilder.io/v3
+- go.kubebuilder.io/v4
 multigroup: true
 plugins:
   manifests.sdk.operatorframework.io/v2: {}
@@ -19,9 +19,10 @@ resources:
   domain: openstack.org
   group: core
   kind: OpenStackControlPlane
-  path: github.com/openstack-k8s-operators/openstack-operator/apis/core/v1beta1
+  path: github.com/openstack-k8s-operators/openstack-operator/api/core/v1beta1
   version: v1beta1
   webhooks:
+    defaulting: true
     validation: true
     webhookVersion: v1
 - api:
@@ -31,16 +32,20 @@ resources:
   domain: openstack.org
   group: client
   kind: OpenStackClient
-  path: github.com/openstack-k8s-operators/openstack-operator/apis/client/v1beta1
+  path: github.com/openstack-k8s-operators/openstack-operator/api/client/v1beta1
   version: v1beta1
+  webhooks:
+    defaulting: true
+    validation: true
+    webhookVersion: v1
 - api:
     crdVersion: v1
     namespaced: true
   controller: true
   domain: openstack.org
   group: core
   kind: OpenStackVersion
-  path: github.com/openstack-k8s-operators/openstack-operator/apis/core/v1beta1
+  path: github.com/openstack-k8s-operators/openstack-operator/api/core/v1beta1
   version: v1beta1
   webhooks:
     defaulting: true
@@ -53,7 +58,7 @@ resources:
   domain: openstack.org
   group: dataplane
   kind: OpenStackDataPlaneNodeSet
-  path: github.com/openstack-k8s-operators/openstack-operator/apis/dataplane/v1beta1
+  path: github.com/openstack-k8s-operators/openstack-operator/api/dataplane/v1beta1
   version: v1beta1
   webhooks:
     defaulting: true
@@ -66,24 +71,32 @@ resources:
   domain: openstack.org
   group: dataplane
   kind: OpenStackDataPlaneService
-  path: github.com/openstack-k8s-operators/openstack-operator/apis/dataplane/v1beta1
+  path: github.com/openstack-k8s-operators/openstack-operator/api/dataplane/v1beta1
   version: v1beta1
+  webhooks:
+    defaulting: true
+    validation: true
+    webhookVersion: v1
 - api:
     crdVersion: v1
     namespaced: true
   controller: true
   domain: openstack.org
   group: dataplane
   kind: OpenStackDataPlaneDeployment
-  path: github.com/openstack-k8s-operators/openstack-operator/apis/dataplane/v1beta1
+  path: github.com/openstack-k8s-operators/openstack-operator/api/dataplane/v1beta1
   version: v1beta1
+  webhooks:
+    defaulting: true
+    validation: true
+    webhookVersion: v1
 - api:
     crdVersion: v1
     namespaced: true
   controller: true
   domain: openstack.org
   group: operator
   kind: OpenStack
-  path: github.com/openstack-k8s-operators/openstack-operator/apis/operator/v1beta1
+  path: github.com/openstack-k8s-operators/openstack-operator/api/operator/v1beta1
   version: v1beta1
 version: "3"