charts/redpanda: use new sidecar --selector flag

This commit builds upon a previous commit that added the `--selector` flag to
the sidecar. It updates the chart to appropriate set this new flag and adds
acceptance tests to assert the functionality works as expected.

This commit is separate as the v2.x.x branches need to release the updated
sidecar before it can be used.

Author: chrisseto

.changes/unreleased/charts-redpanda-Deprecated-20251021-143834.yaml

@@ -0,0 +1,4 @@
+project: charts/redpanda
+kind: Deprecated
+body: '- `statefulset.sideCars.controllers.createRBAC` is deprecated and no longer respected. In most cases, setting this field to `false` would result in a broken deployment. RBAC may be controlled via `rbac.enabled` or per controller via `statefulset.sideCars.controllers.{pvcUnbinder,brokerDecommissioner}.enabled`.'
+time: 2025-10-21T14:38:34.206376-04:00

.changes/unreleased/charts-redpanda-Deprecated-20251021-144413.yaml

@@ -0,0 +1,4 @@
+project: charts/redpanda
+kind: Deprecated
+body: '`statefulset.sideCars.controllers.run` has been unused for many releases and is now deprecated. Individual controllers may be enabled/disabled by setting their enabled field: `statefulset.sideCars.pvcUnbinder.enabled`, `statefulset.sideCars.brokerDecommissioner.enabled`.'
+time: 2025-10-21T14:44:13.331483-04:00

acceptance/features/helm-chart.feature

@@ -0,0 +1,36 @@
+@operator:none
+Feature: Redpanda Helm Chart
+
+  Scenario: Tolerating Node Failure
+    Given I helm install "redpanda" "../charts/redpanda/chart" with values:
+    ```yaml
+     nameOverride: foobar
+     fullnameOverride: bazquux
+
+     statefulset:
+       sideCars:
+         pvcUnbinder:
+           enabled: true
+           unbindAfter: 15s
+         brokerDecommissioner:
+           enabled: true
+           decommissionAfter: 15s
+    ```
+    When I stop the Node running Pod "bazquux-2"
+    And Pod "bazquux-2" is eventually Pending
+    Then Pod "bazquux-2" will eventually be Running
+    And kubectl exec -it "bazquux-0" "rpk redpanda admin brokers list | sed -E 's/\s+/ /gm' | cut -d ' ' -f 1,6" will eventually output:
+    ```
+    ID MEMBERSHIP
+    0 active
+    1 active
+    3 active
+    ```
+    And kubectl exec -it "bazquux-0" "rpk redpanda admin brokers list --include-decommissioned | sed -E 's/\s+/ /gm' | cut -d ' ' -f 1,6" will eventually output:
+    ```
+    ID MEMBERSHIP
+    0 active
+    1 active
+    3 active
+    2 -
+    ```

acceptance/features/migration.feature

@@ -2,7 +2,7 @@ Feature: Helm chart to Redpanda Operator migration
 
   @skip:gke @skip:aks @skip:eks
   Scenario: Migrate from a Helm chart release to a Redpanda custom resource
-        Given a Helm release named "redpanda-migration-example" of the "redpanda/redpanda" helm chart with the values:
+        Given I helm install "redpanda-migration-example" "../charts/redpanda/chart" with values:
         """
     # tag::helm-values[]
         fullnameOverride: name-override

acceptance/features/operator-upgrades.feature

@@ -3,10 +3,8 @@ Feature: Upgrading the operator
   @skip:gke @skip:aks @skip:eks
   Scenario: Operator upgrade from 2.4.5
     Given I install local CRDs from "../operator/config/crd/bases"
-    And I install redpanda helm chart version "v2.4.5" with the values:
+    And I helm install "redpanda-operator" "redpanda/operator" --version v2.4.5 with values:
     """
-    console:
-      enabled: false
     """
     And I apply Kubernetes manifest:
     """
@@ -29,7 +27,7 @@ Feature: Upgrading the operator
     # use just a Ready status check here since that's all the
     # old operator supports
     And cluster "operator-upgrade" is available
-    Then I can upgrade to the latest operator with the values:
+    Then I can helm upgrade "redpanda-operator" "../operator/chart" with values:
     """
     image:
       tag: dev
@@ -42,7 +40,7 @@ Feature: Upgrading the operator
 
   @skip:gke @skip:aks @skip:eks
   Scenario: Operator upgrade from 25.1.3
-    And I install redpanda helm chart version "v25.1.3" with the values:
+    Given I helm install "redpanda-operator" "redpanda/operator" --version v25.1.3 with values:
     """
     crds:
       enabled: true
@@ -68,7 +66,7 @@ Feature: Upgrading the operator
     # use just a Ready status check here since that's all the
     # old operator supports
     And cluster "operator-upgrade" is available
-    Then I can upgrade to the latest operator with the values:
+    Then I can helm upgrade "redpanda-operator" "../operator/chart" with values:
     """
     image:
       tag: dev

acceptance/main_test.go

@@ -93,7 +93,7 @@ var setupSuite = sync.OnceValues(func() (*framework.Suite, error) {
 				return
 			}
 			t.Log("Installing default Redpanda operator chart")
-			t.InstallLocalHelmChart(ctx, "../operator/chart", helm.InstallOptions{
+			t.InstallHelmChart(ctx, "../operator/chart", helm.InstallOptions{
 				Name:      "redpanda-operator",
 				Namespace: namespace,
 				Values: operatorchart.PartialValues{
@@ -205,7 +205,7 @@ func OperatorTag(ctx context.Context, t framework.TestingT, args ...string) cont
 	}
 
 	t.Logf("Installing Redpanda operator chart: %q", name)
-	t.InstallLocalHelmChart(ctx, "../operator/chart", helm.InstallOptions{
+	t.InstallHelmChart(ctx, "../operator/chart", helm.InstallOptions{
 		Name:       "redpanda-operator",
 		Namespace:  t.Namespace(),
 		ValuesFile: filepath.Join("operator", fmt.Sprintf("%s.yaml", name)),

acceptance/steps/cluster.go

@@ -166,6 +166,25 @@ func shutdownRandomClusterNode(ctx context.Context, t framework.TestingT, cluste
 	t.ShutdownNode(ctx, pod.Spec.NodeName)
 }
 
+func shutdownNodeOfPod(ctx context.Context, t framework.TestingT, podName string) {
+	t.ResourceKey(podName)
+
+	var pod corev1.Pod
+	require.NoError(t, t.Get(ctx, t.ResourceKey(podName), &pod))
+
+	var node corev1.Node
+	require.NoError(t, t.Get(ctx, t.ResourceKey(pod.Spec.NodeName), &node))
+
+	node.Spec.Taints = append(node.Spec.Taints, corev1.Taint{
+		Key:    "node.kubernetes.io/out-of-service",
+		Effect: corev1.TaintEffectNoExecute,
+	})
+
+	require.NoError(t, t.Update(ctx, &node))
+
+	t.ShutdownNode(ctx, pod.Spec.NodeName)
+}
+
 func deleteNotReadyKubernetesNodes(ctx context.Context, t framework.TestingT) {
 	var nodes corev1.NodeList
 	require.NoError(t, t.List(ctx, &nodes))

acceptance/steps/helm.go

@@ -12,40 +12,45 @@ package steps
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	"github.com/cucumber/godog"
 	"github.com/stretchr/testify/require"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/client-go/rest"
 	"sigs.k8s.io/yaml"
 
 	framework "github.com/redpanda-data/redpanda-operator/harpoon"
 	"github.com/redpanda-data/redpanda-operator/pkg/helm"
 )
 
-// The unused parameter is meant to specify a Helm chart place (remote or local in the file system).
-func iInstallHelmRelease(ctx context.Context, t framework.TestingT, helmReleaseName, _ string, values *godog.DocString) {
+func iHelmInstall(ctx context.Context, t framework.TestingT, name, chart, version string, values *godog.DocString) {
+	// We don't really reference anything other than the redpanda repo, so just
+	// handle repos as a naive check here.
+	if strings.HasPrefix(chart, "redpanda/") {
+		t.AddHelmRepo(ctx, "redpanda", "https://charts.redpanda.com")
+	}
+
 	var valuesMap map[string]any
 	require.NoError(t, yaml.Unmarshal([]byte(values.Content), &valuesMap))
 
-	helmClient, err := helm.New(helm.Options{
-		KubeConfig: rest.CopyConfig(t.RestConfig()),
+	t.InstallHelmChart(ctx, chart, helm.InstallOptions{
+		Name:      name,
+		Version:   version,
+		Values:    valuesMap,
+		Namespace: t.Namespace(),
 	})
-	require.NoError(t, err)
-
-	require.NoError(t, helmClient.RepoAdd(ctx, "console", "https://charts.redpanda.com"))
+}
 
-	path := "../charts/redpanda/chart"
-	require.NoError(t, helmClient.DependencyBuild(ctx, path))
+func iHelmUpgrade(ctx context.Context, t framework.TestingT, name, chart, version string, values *godog.DocString) {
+	var valuesMap map[string]any
+	require.NoError(t, yaml.Unmarshal([]byte(values.Content), &valuesMap))
 
-	t.Logf("installing chart %q", path)
-	_, err = helmClient.Install(ctx, path, helm.InstallOptions{
-		Name:      helmReleaseName,
-		Namespace: t.Namespace(),
+	t.UpgradeHelmChart(ctx, name, chart, helm.UpgradeOptions{
+		Version:   version,
 		Values:    valuesMap,
+		Namespace: t.Namespace(),
 	})
-	require.NoError(t, err)
 }
 
 func iDeleteHelmReleaseSecret(ctx context.Context, t framework.TestingT, helmReleaseName string) {

acceptance/steps/helpers.go

@@ -32,9 +32,7 @@ import (
 	authenticationv1 "k8s.io/api/authentication/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/utils/ptr"
 	runtimeclient "sigs.k8s.io/controller-runtime/pkg/client"
@@ -651,20 +649,6 @@ func clientsForOperator(ctx context.Context, includeTLS bool, serviceAccountName
 	}
 }
 
-func removeAllFinalizers(ctx context.Context, t framework.TestingT, gvk schema.GroupVersionKind) {
-	list := &unstructured.UnstructuredList{}
-	list.SetGroupVersionKind(gvk)
-
-	// swallow errors for non-existent crds
-	if err := t.List(ctx, list); err == nil {
-		for i := range list.Items {
-			item := list.Items[i]
-			item.SetFinalizers(nil)
-			require.NoError(t, t.Update(ctx, &item))
-		}
-	}
-}
-
 func getVersion(t framework.TestingT, version string) string {
 	version = strings.TrimSpace(version)
 	if version != "" {

acceptance/steps/k8s.go

@@ -36,6 +36,15 @@ import (
 // for type assertions
 var _ client.Object = (client.Object)(nil)
 
+func podWillEventuallyBeInPhase(ctx context.Context, t framework.TestingT, podName string, phase string) {
+	require.EventuallyWithT(t, func(c *assert.CollectT) {
+		var pod corev1.Pod
+		require.NoError(c, t.Get(ctx, t.ResourceKey(podName), &pod))
+
+		require.Equal(c, corev1.PodPhase(phase), pod.Status.Phase)
+	}, 5*time.Minute, 5*time.Second)
+}
+
 func kubernetesObjectHasClusterOwner(ctx context.Context, t framework.TestingT, groupVersionKind, resourceName, clusterName string) {
 	var cluster redpandav1alpha2.Redpanda
 
@@ -163,7 +172,23 @@ func execJSONPath(ctx context.Context, t framework.TestingT, jsonPath, groupVers
 	return nil
 }
 
-func iExecInPodMatching(
+func execInPodEventuallyMatches(
+	ctx context.Context,
+	t framework.TestingT,
+	podName string,
+	cmd string,
+	expected *godog.DocString,
+) {
+	ctl, err := kube.FromRESTConfig(t.RestConfig())
+	require.NoError(t, err)
+
+	pod, err := kube.Get[corev1.Pod](ctx, ctl, kube.ObjectKey{Namespace: t.Namespace(), Name: podName})
+	require.NoErrorf(t, err, "Pod with name %q not found", podName)
+
+	execInPod(t, ctx, ctl, pod, cmd, expected)
+}
+
+func execInPodMatchingEventuallyMatches(
 	ctx context.Context,
 	t framework.TestingT,
 	cmd,
@@ -181,11 +206,24 @@ func iExecInPodMatching(
 
 	require.True(t, len(pods.Items) > 0, "selector %q found no Pods", selector.String())
 
-	var stdout bytes.Buffer
-	require.NoError(t, ctl.Exec(ctx, &pods.Items[0], kube.ExecOptions{
-		Command: []string{"sh", "-c", cmd},
-		Stdout:  &stdout,
-	}))
+	execInPod(t, ctx, ctl, &pods.Items[0], cmd, expected)
+}
 
-	assert.Equal(t, strings.TrimSpace(expected.Content), strings.TrimSpace(stdout.String()))
+func execInPod(
+	t framework.TestingT,
+	ctx context.Context,
+	ctl *kube.Ctl,
+	pod *corev1.Pod,
+	cmd string,
+	expected *godog.DocString,
+) {
+	require.EventuallyWithT(t, func(collect *assert.CollectT) {
+		var stdout bytes.Buffer
+		require.NoError(collect, ctl.Exec(ctx, pod, kube.ExecOptions{
+			Command: []string{"sh", "-c", cmd},
+			Stdout:  &stdout,
+		}))
+
+		assert.Equal(collect, strings.TrimSpace(expected.Content), strings.TrimSpace(stdout.String()))
+	}, 5*time.Minute, 5*time.Second)
 }