Skip to content

feat: GitOps XRD lifecycle demo, generate kyverno, and conversion metadata #111

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vrabbi merged 4 commits into from
Aug 16, 2026
Merged

feat: GitOps XRD lifecycle demo, generate kyverno, and conversion metadata #111

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
303c488
feat: GitOps XRD lifecycle demo, generate kyverno, and conversion met…
vrabbi Aug 16, 2026
1d1cb88
fix: trigger Kyverno admission on existing XRs after migrate
vrabbi Aug 16, 2026
be00895
fix: address CodeRabbit findings on demo flags, git auth, and test
vrabbi Aug 16, 2026
408a131
fix: fail closed on XR admission writes and stop toggling errexit
vrabbi Aug 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,3 +9,6 @@ dist/
*.swp
cover.out
site/
examples/crossplane-xr-multiversion/gitops/.worktree/
examples/crossplane-xr-multiversion/gitops/.demo-state
examples/crossplane-xr-multiversion/gitops/runner/convctl
11 changes: 7 additions & 4 deletions CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,13 +30,16 @@ make build # manager, webhook-server, convctl binaries into bin/
make test-prometheus # promtool unit tests for shipped alerts
make test-e2e-load # kind + synthetic ConversionReview batches (see docs/operations/capacity.md)
make test-e2e-scale # kind + generated CRD fleet + parallel Get/List (TARGETS/INSTANCES)
make dev-up # kind + cert-manager + Crossplane + kube-prometheus-stack + operator
make dev-up # kind + cert-manager + Crossplane + operator (+ monitoring + Kyverno)
make dev-up DEV_MONITORING=false DEV_KYVERNO=false # skip those extras
make dev-down # delete the kind cluster from dev-up
```

`make dev-up` enables chart ServiceMonitors / PrometheusRules / Grafana dashboards and
installs kube-prometheus-stack with anonymous Grafana (see
`hack/dev-monitoring-values.yaml`). After it finishes:
`make dev-up` installs kube-prometheus-stack (anonymous Grafana; see
`hack/dev-monitoring-values.yaml`) and Kyverno unless you set
`DEV_MONITORING=false` / `DEV_KYVERNO=false`. With monitoring on it also
enables chart ServiceMonitors / PrometheusRules / Grafana dashboards. After
it finishes:

```console
kubectl -n monitoring-system port-forward svc/monitoring-grafana 3000:80
Expand Down
109 changes: 78 additions & 31 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,26 +168,37 @@ test-prometheus: promtool ## Run promtool unit tests for chart PrometheusRule al

# Same shape as hack/e2e-common.sh's setup (kind + cert-manager + Crossplane
# + this operator's own Helm chart), but left running afterward for
# interactive use instead of being torn down by a test script. Also installs
# kube-prometheus-stack with anonymous Grafana and enables the chart's
# ServiceMonitors / PrometheusRules / dashboard ConfigMaps. A fixed image
# tag (rather than e2e's timestamped one) keeps `make dev-up` idempotent and
# safe to re-run after every code change: it rebuilds, reloads, and restarts
# the running pods so the new code actually takes effect.
# interactive use instead of being torn down by a test script. Optionally
# installs kube-prometheus-stack (anonymous Grafana) and Kyverno
# (MutatingPolicy). A fixed image tag (rather than e2e's timestamped one)
# keeps `make dev-up` idempotent and safe to re-run after every code change:
# it rebuilds, reloads, and restarts the running pods so the new code
# actually takes effect.
#
# Toggle extras (both default on):
# make dev-up DEV_MONITORING=false
# make dev-up DEV_KYVERNO=false
DEV_CLUSTER_NAME ?= declarative-conversion-dev
DEV_NAMESPACE ?= declarative-conversion-system
DEV_RELEASE_NAME ?= declarative-conversion-operator
DEV_IMG_TAG ?= dev
DEV_MANAGER_IMG ?= ghcr.io/terasky-oss/declarative-conversion-operator:$(DEV_IMG_TAG)
DEV_WEBHOOK_IMG ?= ghcr.io/terasky-oss/declarative-conversion-webhook-server:$(DEV_IMG_TAG)
DEV_CERT_MANAGER_VERSION ?= v1.21.1
DEV_MONITORING ?= true
DEV_MONITORING_NAMESPACE ?= monitoring-system
DEV_MONITORING_RELEASE ?= monitoring
# Pin so re-runs stay reproducible; bump deliberately when upgrading the stack.
DEV_KUBE_PROM_STACK_VERSION ?= 88.3.0
DEV_KYVERNO ?= true
DEV_KYVERNO_NAMESPACE ?= kyverno
DEV_KYVERNO_RELEASE ?= kyverno
# Chart 3.8.x ships Kyverno 1.18. MutatingPolicy mutateExisting is a no-op
# until #16255; generated migrate policies rely on admission instead.
DEV_KYVERNO_CHART_VERSION ?= 3.8.1

.PHONY: dev-up
dev-up: ## Stand up (or refresh) a full local dev environment: kind + cert-manager + Crossplane + kube-prometheus-stack (anonymous Grafana) + this operator with metrics/dashboards enabled. Safe to re-run after code changes. Requires docker, kind, kubectl, and helm on PATH.
dev-up: ## Stand up (or refresh) a local kind env: cert-manager + Crossplane + this operator. DEV_MONITORING=true (default) adds kube-prometheus-stack; DEV_KYVERNO=true (default) adds Kyverno. Safe to re-run after code changes. Requires docker, kind, kubectl, and helm on PATH.
@command -v docker >/dev/null 2>&1 || { echo "docker is required" >&2; exit 1; }
@command -v kind >/dev/null 2>&1 || { echo "kind is required (https://kind.sigs.k8s.io)" >&2; exit 1; }
@command -v kubectl >/dev/null 2>&1 || { echo "kubectl is required" >&2; exit 1; }
Expand Down Expand Up @@ -218,24 +229,51 @@ dev-up: ## Stand up (or refresh) a full local dev environment: kind + cert-manag
helm upgrade --install crossplane crossplane-stable/crossplane \
--namespace crossplane-system --create-namespace \
--wait --timeout 180s
@echo "==> Installing kube-prometheus-stack (Prometheus + Grafana, anonymous auth)"
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts --force-update
helm repo update prometheus-community
helm upgrade --install $(DEV_MONITORING_RELEASE) prometheus-community/kube-prometheus-stack \
--namespace $(DEV_MONITORING_NAMESPACE) --create-namespace \
--version $(DEV_KUBE_PROM_STACK_VERSION) \
--values hack/dev-monitoring-values.yaml \
--wait --timeout 600s
@echo "==> Installing/upgrading $(DEV_RELEASE_NAME) with the locally-built dev images + monitoring"
helm upgrade --install $(DEV_RELEASE_NAME) charts/declarative-conversion-operator \
--namespace $(DEV_NAMESPACE) --create-namespace \
--set image.manager.tag=$(DEV_IMG_TAG) \
--set image.webhookServer.tag=$(DEV_IMG_TAG) \
--set image.pullPolicy=Never \
--set metrics.serviceMonitor.enabled=true \
--set metrics.prometheusRule.enabled=true \
--set dashboards.enabled=true \
--wait --timeout 180s
@if [ "$(DEV_MONITORING)" = "true" ]; then \
echo "==> Installing kube-prometheus-stack (Prometheus + Grafana, anonymous auth)"; \
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts --force-update; \
helm repo update prometheus-community; \
helm upgrade --install $(DEV_MONITORING_RELEASE) prometheus-community/kube-prometheus-stack \
--namespace $(DEV_MONITORING_NAMESPACE) --create-namespace \
--version $(DEV_KUBE_PROM_STACK_VERSION) \
--values hack/dev-monitoring-values.yaml \
--wait --timeout 600s; \
else \
echo "==> Skipping kube-prometheus-stack (DEV_MONITORING=$(DEV_MONITORING))"; \
fi
@if [ "$(DEV_KYVERNO)" = "true" ]; then \
echo "==> Installing Kyverno $(DEV_KYVERNO_CHART_VERSION) (MutatingPolicy)"; \
helm repo add kyverno https://kyverno.github.io/kyverno/ --force-update; \
helm repo update kyverno; \
helm upgrade --install $(DEV_KYVERNO_RELEASE) kyverno/kyverno \
--namespace $(DEV_KYVERNO_NAMESPACE) --create-namespace \
--version $(DEV_KYVERNO_CHART_VERSION) \
--set crds.groups.policies.mutatingpolicies=true \
--wait --timeout 300s; \
kubectl -n $(DEV_KYVERNO_NAMESPACE) wait --for=condition=Available --timeout=180s deployment --all; \
kubectl wait --for=condition=Established --timeout=60s crd/mutatingpolicies.policies.kyverno.io; \
else \
echo "==> Skipping Kyverno (DEV_KYVERNO=$(DEV_KYVERNO))"; \
fi
@echo "==> Installing/upgrading $(DEV_RELEASE_NAME) with the locally-built dev images"
@if [ "$(DEV_MONITORING)" = "true" ]; then \
helm upgrade --install $(DEV_RELEASE_NAME) charts/declarative-conversion-operator \
--namespace $(DEV_NAMESPACE) --create-namespace \
--set image.manager.tag=$(DEV_IMG_TAG) \
--set image.webhookServer.tag=$(DEV_IMG_TAG) \
--set image.pullPolicy=Never \
--set metrics.serviceMonitor.enabled=true \
--set metrics.prometheusRule.enabled=true \
--set dashboards.enabled=true \
--wait --timeout 180s; \
else \
helm upgrade --install $(DEV_RELEASE_NAME) charts/declarative-conversion-operator \
--namespace $(DEV_NAMESPACE) --create-namespace \
--set image.manager.tag=$(DEV_IMG_TAG) \
--set image.webhookServer.tag=$(DEV_IMG_TAG) \
--set image.pullPolicy=Never \
--wait --timeout 180s; \
fi
@echo "==> Restarting pods so the freshly-loaded image content takes effect (tag is fixed across re-runs)"
kubectl -n $(DEV_NAMESPACE) rollout restart deployment/$(DEV_RELEASE_NAME)-manager
kubectl -n $(DEV_NAMESPACE) rollout status deployment/$(DEV_RELEASE_NAME)-manager --timeout=120s
Expand All @@ -247,12 +285,21 @@ dev-up: ## Stand up (or refresh) a full local dev environment: kind + cert-manag
@echo "==> Local dev environment ready."
@echo " kubectl context: kind-$(DEV_CLUSTER_NAME)"
@echo " Operator ns: $(DEV_NAMESPACE)"
@echo " Monitoring ns: $(DEV_MONITORING_NAMESPACE)"
@echo " Grafana (no login):"
@echo " kubectl -n $(DEV_MONITORING_NAMESPACE) port-forward svc/$(DEV_MONITORING_RELEASE)-grafana 3000:80"
@echo " open http://localhost:3000 (anonymous Admin; dashboards under search)"
@echo " Prometheus:"
@echo " kubectl -n $(DEV_MONITORING_NAMESPACE) port-forward svc/$(DEV_MONITORING_RELEASE)-kube-prometheus-prometheus 9090:9090"
@if [ "$(DEV_MONITORING)" = "true" ]; then \
echo " Monitoring ns: $(DEV_MONITORING_NAMESPACE)"; \
echo " Grafana (no login):"; \
echo " kubectl -n $(DEV_MONITORING_NAMESPACE) port-forward svc/$(DEV_MONITORING_RELEASE)-grafana 3000:80"; \
echo " open http://localhost:3000 (anonymous Admin; dashboards under search)"; \
echo " Prometheus:"; \
echo " kubectl -n $(DEV_MONITORING_NAMESPACE) port-forward svc/$(DEV_MONITORING_RELEASE)-kube-prometheus-prometheus 9090:9090"; \
else \
echo " Monitoring: skipped (DEV_MONITORING=$(DEV_MONITORING))"; \
fi
@if [ "$(DEV_KYVERNO)" = "true" ]; then \
echo " Kyverno ns: $(DEV_KYVERNO_NAMESPACE)"; \
else \
echo " Kyverno: skipped (DEV_KYVERNO=$(DEV_KYVERNO))"; \
fi
@echo " Made a code change? Just run 'make dev-up' again to rebuild, reload, and restart."
@echo " Tear it down with: make dev-down"

Expand Down
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,7 +156,7 @@ make helm-lint helm-template

### Local dev environment

`make dev-up` stands up a full local environment — a [kind](https://kind.sigs.k8s.io/) cluster, cert-manager, Crossplane, [kube-prometheus-stack](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack) (Prometheus + Grafana with anonymous access), and this operator's own Helm chart installed with images built from your local checkout (ServiceMonitors, PrometheusRules, and Grafana dashboard ConfigMaps enabled) — and leaves it running for interactive use. It's the same setup the e2e tests use (see below), minus the test assertions, the teardown, and the monitoring stack. Safe to re-run after every code change: it rebuilds the images, reloads them into the cluster, and restarts the running pods so the new code actually takes effect. Requires `docker`, `kind`, `kubectl`, and `helm` on `PATH`; tear it down with `make dev-down`.
`make dev-up` stands up a full local environment — a [kind](https://kind.sigs.k8s.io/) cluster, cert-manager, Crossplane, [Kyverno](https://kyverno.io/) (for `demo.sh --demo-mode gitops`), [kube-prometheus-stack](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack) (Prometheus + Grafana with anonymous access), and this operator's own Helm chart installed with images built from your local checkout (ServiceMonitors, PrometheusRules, and Grafana dashboard ConfigMaps enabled when monitoring is on) — and leaves it running for interactive use. It's the same setup the e2e tests use (see below), minus the test assertions, the teardown, and those optional extras. Skip extras with `DEV_MONITORING=false` and/or `DEV_KYVERNO=false` (both default `true`). Safe to re-run after every code change: it rebuilds the images, reloads them into the cluster, and restarts the running pods so the new code actually takes effect. Requires `docker`, `kind`, `kubectl`, and `helm` on `PATH`; tear it down with `make dev-down`.

### End-to-end tests

Expand Down
Loading