[release/v2.3.x] charts/redpanda: use new sidecar --selector flag

.buildkite/testsuite.yml

@@ -93,7 +93,7 @@ steps:
       automatic:
         limit: 3
     soft_fail: false
-    timeout_in_minutes: 90
+    timeout_in_minutes: 150
   - continue_on_failure: true
     wait: null
   - agents:

.changes/unreleased/charts-redpanda-Deprecated-20251021-143834.yaml

@@ -0,0 +1,4 @@
+project: charts/redpanda
+kind: Deprecated
+body: '- `statefulset.sideCars.controllers.createRBAC` is deprecated and no longer respected. In most cases, setting this field to `false` would result in a broken deployment. RBAC may be controlled via `rbac.enabled` or per controller via `statefulset.sideCars.controllers.{pvcUnbinder,brokerDecommissioner}.enabled`.'
+time: 2025-10-21T14:38:34.206376-04:00

.changes/unreleased/charts-redpanda-Deprecated-20251021-144413.yaml

@@ -0,0 +1,4 @@
+project: charts/redpanda
+kind: Deprecated
+body: '`statefulset.sideCars.controllers.run` has been unused for many releases and is now deprecated. Individual controllers may be enabled/disabled by setting their enabled field: `statefulset.sideCars.pvcUnbinder.enabled`, `statefulset.sideCars.brokerDecommissioner.enabled`.'
+time: 2025-10-21T14:44:13.331483-04:00

Taskfile.yml

@@ -170,14 +170,16 @@ tasks:
       vars:
         CLI_ARGS: '' # Don't forward CLI args to build:image
     - task: build:charts
+    vars:
+      RUN: '{{ default `"^TestIntegration"` .RUN }}'
     cmds:
     - task: charts:kind-cluster
     - kind load docker-image localhost/redpanda-operator:dev
     - task: test:unit
       vars:
         GO_TEST_RUNNER:
           ref: .GO_TEST_RUNNER
-        CLI_ARGS: '{{.CLI_ARGS}} -p=1 -run "^TestIntegration" -timeout 60m -tags integration'
+        CLI_ARGS: '{{.CLI_ARGS}} -p=1 -run {{.RUN}} -timeout 60m -tags integration'
 
   test:acceptance:
     desc: "Run all acceptance tests (~90m)"
@@ -191,16 +193,6 @@ tasks:
       RUN: '{{ default `"^TestAcceptance"` .RUN }}'
       GO_TEST_RUNNER: '{{default "go test" .GO_TEST_RUNNER}}'
     cmds:
-    - defer: 'k3d cluster delete harpoon'
-    - |
-      k3d cluster create harpoon \
-      --agents=5 --timeout=3m --image=rancher/k3s:v1.29.6-k3s2 \
-      --k3s-arg --kube-controller-manager-arg=node-monitor-grace-period=10s@server:* \
-      --k3s-arg --kube-apiserver-arg=default-not-ready-toleration-seconds=10@server:* \
-      --k3s-arg --kube-apiserver-arg=default-unreachable-toleration-seconds=10@server:* \
-      --k3s-arg --disable=traefik@server:* \
-      --verbose
-    - task: test:import-images
     - task: test:unit
       vars:
         GO_TEST_RUNNER:
@@ -238,31 +230,3 @@ tasks:
     cmds:
       - for: {var: IMAGES}
         cmd: docker inspect {{.ITEM}} > /dev/null || docker pull {{.ITEM}}
-
-  test:import-images:
-    vars:
-      DEFAULT_TEST_CERTMANAGER_VERSION: v1.14.2
-      DEFAULT_TEST_REDPANDA_REPO: docker.redpanda.com/redpandadata/redpanda
-      DEFAULT_TEST_REDPANDA_VERSION: v25.1.1
-      DEFAULT_TEST_UPGRADE_REDPANDA_REPO: docker.redpanda.com/redpandadata/redpanda
-      DEFAULT_TEST_UPGRADE_REDPANDA_VERSION: v24.3.11
-      DEFAULT_TEST_UPGRADE_OPERATOR_VERSION: v2.3.9-24.3.11
-      TEST_CERTMANAGER_VERSION: '{{ .TEST_CERTMANAGER_VERSION | default .DEFAULT_TEST_CERTMANAGER_VERSION }}'
-      TEST_REDPANDA_REPO: '{{ .TEST_REDPANDA_REPO | default .DEFAULT_TEST_REDPANDA_REPO }}'
-      TEST_REDPANDA_VERSION: '{{ .TEST_REDPANDA_VERSION | default .DEFAULT_TEST_REDPANDA_VERSION }}'
-      TEST_UPGRADE_REDPANDA_REPO: '{{ .TEST_UPGRADE_REDPANDA_REPO | default .DEFAULT_TEST_UPGRADE_REDPANDA_REPO }}'
-      TEST_UPGRADE_REDPANDA_VERSION: '{{ .TEST_UPGRADE_REDPANDA_VERSION | default .DEFAULT_TEST_UPGRADE_REDPANDA_VERSION }}'
-      TEST_UPGRADE_OPERATOR_VERSION: '{{ .TEST_UPGRADE_OPERATOR_VERSION | default .DEFAULT_TEST_UPGRADE_OPERATOR_VERSION }}'
-      IMAGES:
-        - quay.io/jetstack/cert-manager-controller:{{.TEST_CERTMANAGER_VERSION}}
-        - quay.io/jetstack/cert-manager-cainjector:{{.TEST_CERTMANAGER_VERSION}}
-        - quay.io/jetstack/cert-manager-startupapicheck:{{.TEST_CERTMANAGER_VERSION}}
-        - quay.io/jetstack/cert-manager-webhook:{{.TEST_CERTMANAGER_VERSION}}
-        - '{{.TEST_REDPANDA_REPO}}:{{.TEST_REDPANDA_VERSION}}'
-        - '{{.DEFAULT_TEST_UPGRADE_REDPANDA_REPO}}:{{.TEST_UPGRADE_REDPANDA_VERSION}}'
-        - docker.redpanda.com/redpandadata/redpanda-operator:{{.TEST_UPGRADE_OPERATOR_VERSION}}
-        - localhost/redpanda-operator:dev
-
-    cmds:
-      - for: {var: IMAGES}
-        cmd: k3d image import {{.ITEM}} -c harpoon

acceptance/features/helm-chart.feature

@@ -0,0 +1,39 @@
+@operator:none
+Feature: Redpanda Helm Chart
+
+  Scenario: Tolerating Node Failure
+    Given I helm install "redpanda" "../charts/redpanda" with values:
+    ```yaml
+     nameOverride: foobar
+     fullnameOverride: bazquux
+
+     statefulset:
+       sideCars:
+         image:
+           tag: dev
+           repository: localhost/redpanda-operator
+         pvcUnbinder:
+           enabled: true
+           unbindAfter: 15s
+         brokerDecommissioner:
+           enabled: true
+           decommissionAfter: 15s
+    ```
+    When I stop the Node running Pod "bazquux-2"
+    And Pod "bazquux-2" is eventually Pending
+    Then Pod "bazquux-2" will eventually be Running
+    And kubectl exec -it "bazquux-0" "rpk redpanda admin brokers list | sed -E 's/\s+/ /gm' | cut -d ' ' -f 1,6" will eventually output:
+    ```
+    ID MEMBERSHIP
+    0 active
+    1 active
+    3 active
+    ```
+    And kubectl exec -it "bazquux-0" "rpk redpanda admin brokers list --include-decommissioned | sed -E 's/\s+/ /gm' | cut -d ' ' -f 1,6" will eventually output:
+    ```
+    ID MEMBERSHIP
+    0 active
+    1 active
+    3 active
+    2 -
+    ```

acceptance/features/migration.feature

@@ -0,0 +1,33 @@
+Feature: Helm chart to Redpanda Operator migration
+
+  @skip:gke @skip:aks @skip:eks
+  Scenario: Migrate from a Helm chart release to a Redpanda custom resource
+        Given I helm install "redpanda-migration-example" "../charts/redpanda" with values:
+        """
+    # tag::helm-values[]
+        fullnameOverride: name-override
+    # end::helm-values[]
+        # Without the below values, the operator would have to modify the cluster after the migration.
+        # As this is test specific because we use a local version of the operator, this block is excluded from the helm-values tag above.
+        statefulset:
+          sideCars:
+            image:
+              repository: localhost/redpanda-operator
+              tag: dev
+        """
+        When I apply Kubernetes manifest:
+        """
+    # tag::redpanda-custom-resource-manifest[]
+        ---
+        apiVersion: cluster.redpanda.com/v1alpha2
+        kind: Redpanda
+        metadata:
+          name: redpanda-migration-example
+        spec:
+          # This manifest is a copy of Redpanda release Helm values
+          clusterSpec:
+            fullnameOverride: name-override
+    # end::redpanda-custom-resource-manifest[]
+        """
+        Then cluster "redpanda-migration-example" is available
+        And the cluster "redpanda-migration-example" is healthy