operator: add console stanza -> CRD migration (#1177)

Reconciling a Redpanda will now produce a Console CR with a clusterRef pointing
back at the cluster itself.

Accordingly, the `console` stanza on the Redpanda CR is now deprecated. For the
time being changes to it are stlil propagated to the generated Console CR, but
deletion of the Redpanda CR will not cause deletion of the Console CR since they
should be managed separately.

Additionally, due to migration of the stanza to an otherwise opt-in CR, the flag
to enable the Console reconciler is now default-on and must be opted out of if
someone does not want to ensure the Console CRs exist in the default installation.

---------

Co-authored-by: Andrew Stucki <[email protected]>

Author: chrisseto

.changes/unreleased/operator-Deprecated-20251126-120545.yaml

@@ -0,0 +1,4 @@
+project: operator
+kind: Deprecated
+body: The entirety of the `spec.clusterSpec.console` block in the Redpanda CR is now deprecated and will be removed in the future. Any Redpanda CR that contains one will automatically be migrated to a standalone Console CR with a back reference to the parent Redpanda CR. Note that these will *not* be automatically deleted when the `console` stanza is removed or when the parent Redpanda CR is deleted.
+time: 2025-11-26T12:05:45.014863-05:00

acceptance/features/console-upgrades.feature

@@ -0,0 +1,90 @@
+@operator:none
+Feature: Upgrading the operator with Console installed
+  @skip:gke @skip:aks @skip:eks
+  Scenario: Console v2 to v3 no warnings
+    Given I helm install "redpanda-operator" "redpanda/operator" --version v25.1.3 with values:
+    """
+    """
+    And I apply Kubernetes manifest:
+    """
+    ---
+    apiVersion: cluster.redpanda.com/v1alpha2
+    kind: Redpanda
+    metadata:
+      name: operator-console-upgrade
+    spec:
+      clusterSpec:
+        console:
+          # Old versions have broken chart rendering for the console stanza
+          # unless nameOverride is set due to mapping configmap values for
+          # both the console deployment and redpanda statefulset to the same
+          # name. Setting nameOverride to "broken" works around this.
+          nameOverride: broken
+        tls:
+          enabled: false
+        external:
+          enabled: false
+        statefulset:
+          replicas: 1
+          sideCars:
+            image:
+              tag: dev
+              repository: localhost/redpanda-operator
+    """
+    And cluster "operator-console-upgrade" is available
+    Then I can helm upgrade "redpanda-operator" "../operator/chart" with values:
+    """
+    image:
+      tag: dev
+      repository: localhost/redpanda-operator
+    crds:
+      experimental: true
+    """
+    And cluster "operator-console-upgrade" should be stable with 1 nodes
+    And the migrated console cluster "operator-console-upgrade" should have 0 warnings
+
+  @skip:gke @skip:aks @skip:eks
+  Scenario: Console v2 to v3 with warnings
+    Given I helm install "redpanda-operator" "redpanda/operator" --version v25.1.3 with values:
+    """
+    """
+    And I apply Kubernetes manifest:
+    """
+    ---
+    apiVersion: cluster.redpanda.com/v1alpha2
+    kind: Redpanda
+    metadata:
+      name: operator-console-upgrade-warnings
+    spec:
+      clusterSpec:
+        console:
+          nameOverride: broken
+          console:
+            roleBindings:
+            - roleName: admin
+              subjects:
+              - kind: group
+                provider: OIDC
+                name: devs
+        tls:
+          enabled: false
+        external:
+          enabled: false
+        statefulset:
+          replicas: 1
+          sideCars:
+            image:
+              tag: dev
+              repository: localhost/redpanda-operator
+    """
+    And cluster "operator-console-upgrade-warnings" is available
+    Then I can helm upgrade "redpanda-operator" "../operator/chart" with values:
+    """
+    image:
+      tag: dev
+      repository: localhost/redpanda-operator
+    crds:
+      experimental: true
+    """
+    And cluster "operator-console-upgrade-warnings" should be stable with 1 nodes
+    And the migrated console cluster "operator-console-upgrade-warnings" should have 1 warning

acceptance/steps/console.go

@@ -33,3 +33,19 @@ func consoleIsHealthy(ctx context.Context, t framework.TestingT, name string) {
 		return upToDate && hasHealthyReplicas
 	}, time.Minute, 10*time.Second)
 }
+
+func consoleHasWarnings(ctx context.Context, t framework.TestingT, name string, expected int) {
+	key := t.ResourceKey(name)
+
+	t.Logf("Checking console %q has %d warning(s)", name, expected)
+	require.Eventually(t, func() bool {
+		var console redpandav1alpha2.Console
+		if t.Get(ctx, key, &console) != nil {
+			// we have an error fetching, maybe have not yet reconciled,
+			// so just try again
+			return false
+		}
+
+		return len(console.Spec.Warnings) == expected
+	}, time.Minute, 10*time.Second)
+}

acceptance/steps/helpers.go

@@ -657,3 +657,15 @@ func getVersion(t framework.TestingT, version string) string {
 
 	return t.Variant()
 }
+
+func sleepALongTime(ctx context.Context) error {
+	t := framework.T(ctx)
+
+	t.Log("Becoming debuggable by sleeping for 20 minutes")
+	select {
+	case <-time.After(20 * time.Minute):
+		return nil
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}

acceptance/steps/register.go

@@ -113,4 +113,8 @@ func init() {
 
 	// Console scenario steps
 	framework.RegisterStep(`^Console "([^"]+)" will be healthy`, consoleIsHealthy)
+	framework.RegisterStep(`^the migrated console cluster "([^"]+)" should have (\d+) warning(s)?$`, consoleHasWarnings)
+
+	// Debug steps
+	framework.RegisterStep(`^I become debuggable$`, sleepALongTime)
 }

charts/console/rendervalues.go

@@ -28,8 +28,8 @@ type RenderValues struct {
 	Annotations                  map[string]string                 `json:"annotations"`
 	PodAnnotations               map[string]string                 `json:"podAnnotations"`
 	PodLabels                    map[string]string                 `json:"podLabels"`
-	PodSecurityContext           corev1.PodSecurityContext         `json:"podSecurityContext"`
-	SecurityContext              corev1.SecurityContext            `json:"securityContext"`
+	PodSecurityContext           corev1.PodSecurityContext         `json:"podSecurityContext" partial:"builtin"`
+	SecurityContext              corev1.SecurityContext            `json:"securityContext" partial:"builtin"`
 	Service                      ServiceConfig                     `json:"service"`
 	Ingress                      IngressConfig                     `json:"ingress"`
 	Resources                    corev1.ResourceRequirements       `json:"resources"`
@@ -55,8 +55,8 @@ type RenderValues struct {
 	SecretMounts        []SecretMount             `json:"secretMounts"`
 	Secret              SecretConfig              `json:"secret"`
 	LicenseSecretRef    *corev1.SecretKeySelector `json:"licenseSecretRef,omitempty"`
-	LivenessProbe       corev1.Probe              `json:"livenessProbe"`
-	ReadinessProbe      corev1.Probe              `json:"readinessProbe"`
+	LivenessProbe       corev1.Probe              `json:"livenessProbe" partial:"builtin"`
+	ReadinessProbe      corev1.Probe              `json:"readinessProbe" partial:"builtin"`
 	ConfigMap           Creatable                 `json:"configmap"`
 	Deployment          DeploymentConfig          `json:"deployment"`
 	Strategy            appsv1.DeploymentStrategy `json:"strategy"`