charts/redpanda: use new sidecar --selector flag

This commit builds upon a previous commit that added the `--selector` flag to
the sidecar. It updates the chart to appropriate set this new flag and adds
acceptance tests to assert the functionality works as expected.

This commit is separate as the v2.x.x branches need to release the updated
sidecar before it can be used.

(cherry picked from commit 13aeda8)

Author: chrisseto

.buildkite/testsuite.yml

@@ -93,7 +93,7 @@ steps:
       automatic:
         limit: 3
     soft_fail: true
-    timeout_in_minutes: 90
+    timeout_in_minutes: 120
   - continue_on_failure: true
     wait: null
   - agents:

.changes/unreleased/charts-redpanda-Deprecated-20251021-143834.yaml

@@ -0,0 +1,4 @@
+project: charts/redpanda
+kind: Deprecated
+body: '- `statefulset.sideCars.controllers.createRBAC` is deprecated and no longer respected. In most cases, setting this field to `false` would result in a broken deployment. RBAC may be controlled via `rbac.enabled` or per controller via `statefulset.sideCars.controllers.{pvcUnbinder,brokerDecommissioner}.enabled`.'
+time: 2025-10-21T14:38:34.206376-04:00

.changes/unreleased/charts-redpanda-Deprecated-20251021-144413.yaml

@@ -0,0 +1,4 @@
+project: charts/redpanda
+kind: Deprecated
+body: '`statefulset.sideCars.controllers.run` has been unused for many releases and is now deprecated. Individual controllers may be enabled/disabled by setting their enabled field: `statefulset.sideCars.pvcUnbinder.enabled`, `statefulset.sideCars.brokerDecommissioner.enabled`.'
+time: 2025-10-21T14:44:13.331483-04:00

Taskfile.yml

@@ -170,14 +170,16 @@ tasks:
       vars:
         CLI_ARGS: '' # Don't forward CLI args to build:image
     - task: build:charts
+    vars:
+      RUN: '{{ default `"^TestIntegration"` .RUN }}'
     cmds:
     - task: charts:kind-cluster
     - kind load docker-image localhost/redpanda-operator:dev
     - task: test:unit
       vars:
         GO_TEST_RUNNER:
           ref: .GO_TEST_RUNNER
-        CLI_ARGS: '{{.CLI_ARGS}} -p=1 -run "^TestIntegration" -timeout 60m -tags integration'
+        CLI_ARGS: '{{.CLI_ARGS}} -p=1 -run {{.RUN}} -timeout 60m -tags integration'
 
   test:acceptance:
     desc: "Run all acceptance tests (~90m)"
@@ -191,16 +193,6 @@ tasks:
       RUN: '{{ default `"^TestAcceptance"` .RUN }}'
       GO_TEST_RUNNER: '{{default "go test" .GO_TEST_RUNNER}}'
     cmds:
-    - defer: 'k3d cluster delete harpoon'
-    - |
-      k3d cluster create harpoon \
-      --agents=5 --timeout=3m --image=rancher/k3s:v1.29.6-k3s2 \
-      --k3s-arg --kube-controller-manager-arg=node-monitor-grace-period=10s@server:* \
-      --k3s-arg --kube-apiserver-arg=default-not-ready-toleration-seconds=10@server:* \
-      --k3s-arg --kube-apiserver-arg=default-unreachable-toleration-seconds=10@server:* \
-      --k3s-arg --disable=traefik@server:* \
-      --verbose
-    - task: test:import-images
     - task: test:unit
       vars:
         GO_TEST_RUNNER:
@@ -238,31 +230,3 @@ tasks:
     cmds:
       - for: {var: IMAGES}
         cmd: docker inspect {{.ITEM}} > /dev/null || docker pull {{.ITEM}}
-
-  test:import-images:
-    vars:
-      DEFAULT_TEST_CERTMANAGER_VERSION: v1.14.2
-      DEFAULT_TEST_REDPANDA_REPO: docker.redpanda.com/redpandadata/redpanda
-      DEFAULT_TEST_REDPANDA_VERSION: v25.1.1
-      DEFAULT_TEST_UPGRADE_REDPANDA_REPO: docker.redpanda.com/redpandadata/redpanda
-      DEFAULT_TEST_UPGRADE_REDPANDA_VERSION: v24.3.11
-      DEFAULT_TEST_UPGRADE_OPERATOR_VERSION: v2.3.9-24.3.11
-      TEST_CERTMANAGER_VERSION: '{{ .TEST_CERTMANAGER_VERSION | default .DEFAULT_TEST_CERTMANAGER_VERSION }}'
-      TEST_REDPANDA_REPO: '{{ .TEST_REDPANDA_REPO | default .DEFAULT_TEST_REDPANDA_REPO }}'
-      TEST_REDPANDA_VERSION: '{{ .TEST_REDPANDA_VERSION | default .DEFAULT_TEST_REDPANDA_VERSION }}'
-      TEST_UPGRADE_REDPANDA_REPO: '{{ .TEST_UPGRADE_REDPANDA_REPO | default .DEFAULT_TEST_UPGRADE_REDPANDA_REPO }}'
-      TEST_UPGRADE_REDPANDA_VERSION: '{{ .TEST_UPGRADE_REDPANDA_VERSION | default .DEFAULT_TEST_UPGRADE_REDPANDA_VERSION }}'
-      TEST_UPGRADE_OPERATOR_VERSION: '{{ .TEST_UPGRADE_OPERATOR_VERSION | default .DEFAULT_TEST_UPGRADE_OPERATOR_VERSION }}'
-      IMAGES:
-        - quay.io/jetstack/cert-manager-controller:{{.TEST_CERTMANAGER_VERSION}}
-        - quay.io/jetstack/cert-manager-cainjector:{{.TEST_CERTMANAGER_VERSION}}
-        - quay.io/jetstack/cert-manager-startupapicheck:{{.TEST_CERTMANAGER_VERSION}}
-        - quay.io/jetstack/cert-manager-webhook:{{.TEST_CERTMANAGER_VERSION}}
-        - '{{.TEST_REDPANDA_REPO}}:{{.TEST_REDPANDA_VERSION}}'
-        - '{{.DEFAULT_TEST_UPGRADE_REDPANDA_REPO}}:{{.TEST_UPGRADE_REDPANDA_VERSION}}'
-        - docker.redpanda.com/redpandadata/redpanda-operator:{{.TEST_UPGRADE_OPERATOR_VERSION}}
-        - localhost/redpanda-operator:dev
-
-    cmds:
-      - for: {var: IMAGES}
-        cmd: k3d image import {{.ITEM}} -c harpoon

acceptance/features/helm-chart.feature

@@ -0,0 +1,39 @@
+@operator:none
+Feature: Redpanda Helm Chart
+
+  Scenario: Tolerating Node Failure
+    Given I helm install "redpanda" "../charts/redpanda" with values:
+    ```yaml
+     nameOverride: foobar
+     fullnameOverride: bazquux
+
+     statefulset:
+       sideCars:
+         image:
+           tag: dev
+           repository: localhost/redpanda-operator
+         pvcUnbinder:
+           enabled: true
+           unbindAfter: 15s
+         brokerDecommissioner:
+           enabled: true
+           decommissionAfter: 15s
+    ```
+    When I stop the Node running Pod "bazquux-2"
+    And Pod "bazquux-2" is eventually Pending
+    Then Pod "bazquux-2" will eventually be Running
+    And kubectl exec -it "bazquux-0" "rpk redpanda admin brokers list | sed -E 's/\s+/ /gm' | cut -d ' ' -f 1,6" will eventually output:
+    ```
+    ID MEMBERSHIP
+    0 active
+    1 active
+    3 active
+    ```
+    And kubectl exec -it "bazquux-0" "rpk redpanda admin brokers list --include-decommissioned | sed -E 's/\s+/ /gm' | cut -d ' ' -f 1,6" will eventually output:
+    ```
+    ID MEMBERSHIP
+    0 active
+    1 active
+    3 active
+    2 -
+    ```

acceptance/features/migration.feature

@@ -0,0 +1,35 @@
+Feature: Helm chart to Redpanda Operator migration
+
+  @skip:gke @skip:aks @skip:eks
+  Scenario: Migrate from a Helm chart release to a Redpanda custom resource
+        Given I helm install "redpanda-migration-example" "../charts/redpanda" with values:
+        """
+    # tag::helm-values[]
+        fullnameOverride: name-override
+    # end::helm-values[]
+        # Without the below values, the operator would have to modify the cluster after the migration.
+        # As this is test specific because we use a local version of the operator, this block is excluded from the helm-values tag above.
+        statefulset:
+          sideCars:
+            image:
+              repository: localhost/redpanda-operator
+              tag: dev
+        """
+        When I apply Kubernetes manifest:
+        """
+    # tag::redpanda-custom-resource-manifest[]
+        ---
+        apiVersion: cluster.redpanda.com/v1alpha2
+        kind: Redpanda
+        metadata:
+          name: redpanda-migration-example
+        spec:
+          # This manifest is a copy of Redpanda release Helm values
+          clusterSpec:
+            fullnameOverride: name-override
+    # end::redpanda-custom-resource-manifest[]
+        """
+        Then cluster "redpanda-migration-example" is available
+        And the Kubernetes object of type "StatefulSet.v1.apps" with name "name-override" has an OwnerReference pointing to the cluster "redpanda-migration-example"
+        And the helm release for "redpanda-migration-example" can be deleted by removing its stored secret
+        And the cluster "redpanda-migration-example" is healthy