operator: add console stanza -> CRD migration

.changes/unreleased/operator-Deprecated-20251126-120545.yaml

@@ -0,0 +1,4 @@
+project: operator
+kind: Deprecated
+body: The entirety of the `spec.clusterSpec.console` block in the Redpanda CR is now deprecated and will be removed in the future. Any Redpanda CR that contains one will automatically be migrated to a standalone Console CR with a back reference to the parent Redpanda CR. Note that these will *not* be automatically deleted when the `console` stanza is removed or when the parent Redpanda CR is deleted.
+time: 2025-11-26T12:05:45.014863-05:00

acceptance/features/console-upgrades.feature

@@ -0,0 +1,90 @@
+@operator:none
+Feature: Upgrading the operator with Console installed
+  @skip:gke @skip:aks @skip:eks
+  Scenario: Console v2 to v3 no warnings
+    Given I helm install "redpanda-operator" "redpanda/operator" --version v25.1.3 with values:
+    """
+    """
+    And I apply Kubernetes manifest:
+    """
+    ---
+    apiVersion: cluster.redpanda.com/v1alpha2
+    kind: Redpanda
+    metadata:
+      name: operator-console-upgrade
+    spec:
+      clusterSpec:
+        console:
+          # Old versions have broken chart rendering for the console stanza
+          # unless nameOverride is set due to mapping configmap values for
+          # both the console deployment and redpanda statefulset to the same
+          # name. Setting nameOverride to "broken" works around this.
+          nameOverride: broken
+        tls:
+          enabled: false
+        external:
+          enabled: false
+        statefulset:
+          replicas: 1
+          sideCars:
+            image:
+              tag: dev
+              repository: localhost/redpanda-operator
+    """
+    And cluster "operator-console-upgrade" is available
+    Then I can helm upgrade "redpanda-operator" "../operator/chart" with values:
+    """
+    image:
+      tag: dev
+      repository: localhost/redpanda-operator
+    crds:
+      experimental: true
+    """
+    And cluster "operator-console-upgrade" should be stable with 1 nodes
+    And the migrated console cluster "operator-console-upgrade" should have 0 warnings
+
+  @skip:gke @skip:aks @skip:eks
+  Scenario: Console v2 to v3 with warnings
+    Given I helm install "redpanda-operator" "redpanda/operator" --version v25.1.3 with values:
+    """
+    """
+    And I apply Kubernetes manifest:
+    """
+    ---
+    apiVersion: cluster.redpanda.com/v1alpha2
+    kind: Redpanda
+    metadata:
+      name: operator-console-upgrade-warnings
+    spec:
+      clusterSpec:
+        console:
+          nameOverride: broken
+          console:
+            roleBindings:
+            - roleName: admin
+              subjects:
+              - kind: group
+                provider: OIDC
+                name: devs
+        tls:
+          enabled: false
+        external:
+          enabled: false
+        statefulset:
+          replicas: 1
+          sideCars:
+            image:
+              tag: dev
+              repository: localhost/redpanda-operator
+    """
+    And cluster "operator-console-upgrade-warnings" is available
+    Then I can helm upgrade "redpanda-operator" "../operator/chart" with values:
+    """
+    image:
+      tag: dev
+      repository: localhost/redpanda-operator
+    crds:
+      experimental: true
+    """
+    And cluster "operator-console-upgrade-warnings" should be stable with 1 nodes
+    And the migrated console cluster "operator-console-upgrade-warnings" should have 1 warning

acceptance/steps/console.go

@@ -33,3 +33,19 @@ func consoleIsHealthy(ctx context.Context, t framework.TestingT, name string) {
 		return upToDate && hasHealthyReplicas
 	}, time.Minute, 10*time.Second)
 }
+
+func consoleHasWarnings(ctx context.Context, t framework.TestingT, name string, expected int) {
+	key := t.ResourceKey(name)
+
+	t.Logf("Checking console %q has %d warning(s)", name, expected)
+	require.Eventually(t, func() bool {
+		var console redpandav1alpha2.Console
+		if t.Get(ctx, key, &console) != nil {
+			// we have an error fetching, maybe have not yet reconciled,
+			// so just try again
+			return false
+		}
+
+		return len(console.Spec.Warnings) == expected
+	}, time.Minute, 10*time.Second)
+}

acceptance/steps/helpers.go

@@ -657,3 +657,15 @@ func getVersion(t framework.TestingT, version string) string {
 
 	return t.Variant()
 }
+
+func sleepALongTime(ctx context.Context) error {
+	t := framework.T(ctx)
+
+	t.Log("Becoming debuggable by sleeping for 20 minutes")
+	select {
+	case <-time.After(20 * time.Minute):
+		return nil
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}

acceptance/steps/register.go

@@ -113,4 +113,8 @@ func init() {
 
 	// Console scenario steps
 	framework.RegisterStep(`^Console "([^"]+)" will be healthy`, consoleIsHealthy)
+	framework.RegisterStep(`^the migrated console cluster "([^"]+)" should have (\d+) warning(s)?$`, consoleHasWarnings)
+
+	// Debug steps
+	framework.RegisterStep(`^I become debuggable$`, sleepALongTime)
 }

charts/console/rendervalues.go

@@ -28,8 +28,8 @@ type RenderValues struct {
 	Annotations                  map[string]string                 `json:"annotations"`
 	PodAnnotations               map[string]string                 `json:"podAnnotations"`
 	PodLabels                    map[string]string                 `json:"podLabels"`
-	PodSecurityContext           corev1.PodSecurityContext         `json:"podSecurityContext"`
-	SecurityContext              corev1.SecurityContext            `json:"securityContext"`
+	PodSecurityContext           corev1.PodSecurityContext         `json:"podSecurityContext" partial:"builtin"`
+	SecurityContext              corev1.SecurityContext            `json:"securityContext" partial:"builtin"`
 	Service                      ServiceConfig                     `json:"service"`
 	Ingress                      IngressConfig                     `json:"ingress"`
 	Resources                    corev1.ResourceRequirements       `json:"resources"`
@@ -55,8 +55,8 @@ type RenderValues struct {
 	SecretMounts        []SecretMount             `json:"secretMounts"`
 	Secret              SecretConfig              `json:"secret"`
 	LicenseSecretRef    *corev1.SecretKeySelector `json:"licenseSecretRef,omitempty"`
-	LivenessProbe       corev1.Probe              `json:"livenessProbe"`
-	ReadinessProbe      corev1.Probe              `json:"readinessProbe"`
+	LivenessProbe       corev1.Probe              `json:"livenessProbe" partial:"builtin"`
+	ReadinessProbe      corev1.Probe              `json:"readinessProbe" partial:"builtin"`
 	ConfigMap           Creatable                 `json:"configmap"`
 	Deployment          DeploymentConfig          `json:"deployment"`
 	Strategy            appsv1.DeploymentStrategy `json:"strategy"`