registry+v1: add APIService renderer support (OPRUN-4723)

The registry+v1 bundle renderer had no generator for APIService objects
from csv.spec.apiservicedefinitions.owned. This meant operators exposing
extension APIs via aggregation could not be migrated to OLMv1 (C3 hard
block in the migration tool).

Changes:

generators.go:
  - BundleCSVAPIServiceGenerator: reads csv.spec.apiservicedefinitions.owned
    and emits an APIService object for each entry (group=desc.Group,
    version=desc.Version, GroupPriorityMinimum=2000, VersionPriority=15,
    service reference to the certProvisioner's service in install namespace).
    CA bundle injected via the CertificateProvider in opts.
  - BundleCSVDeploymentGenerator: extended to inject apiservice-cert volume
    and volume mounts into deployments that serve APIServices, matching the
    existing webhook-cert injection path.
  - BundleDeploymentServiceResourceGenerator: extended to create Services
    for APIService-serving deployments (matching the webhook service path).

validators/validator.go:
  - CheckAPIServiceDeploymentReferentialIntegrity: validates that every
    owned APIService references a deployment that exists in the CSV install
    spec, preventing misconfigured bundles from being installed.

certproviders/certmanager.go, openshift_serviceca.go:
  - Added *apiregistrationv1.APIService case to InjectCABundle so the
    cert-manager and openshift-service-ca providers annotate APIService
    objects for CA bundle injection.

registryv1.go:
  - Registered BundleCSVAPIServiceGenerator and
    CheckAPIServiceDeploymentReferentialIntegrity.

Tests:
  - generators_test.go: 4 tests for BundleCSVAPIServiceGenerator covering
    zero-owned case, single APIService, multiple APIServices, and empty
    DeploymentName fallback port.
  - registryv1_test.go: enumeration tests updated.

go.mod/go.sum: upgraded k8s.io/kube-aggregator v0.36.2→v0.36.3.

Once this merges, the C3 hard block is removed from the migration tool
(operators with APIService definitions become Eligible with no override).

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Todd Short <tshort@redhat.com>

Author: tmshort

go.mod

@@ -46,6 +46,7 @@ require (
 	k8s.io/client-go v0.36.3
 	k8s.io/component-base v0.36.3
 	k8s.io/klog/v2 v2.140.0
+	k8s.io/kube-aggregator v0.36.3
 	k8s.io/utils v0.0.0-20260626114624-be93311217bd
 	pkg.package-operator.run/boxcutter v0.14.0
 	sigs.k8s.io/controller-runtime v0.24.1

go.sum

@@ -789,6 +789,8 @@ k8s.io/component-base v0.36.3 h1:vc/UFvPCkW0irPz84LAodAL1j3f4xktPM6dDJIEheAY=
 k8s.io/component-base v0.36.3/go.mod h1:hZbNFG+gCMl9EbykDGEu73feKP9/Cq6JsV4pTo9GTO8=
 k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
 k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
+k8s.io/kube-aggregator v0.36.3 h1:eypRCZKyGx3u9TLdnLva47l6R/67Zs9h9FQI+uMruaY=
+k8s.io/kube-aggregator v0.36.3/go.mod h1:WLfUZLoYlcuy+LnfBOv9eV9bVvNf+x8dYt0mfVrq/6Y=
 k8s.io/kube-openapi v0.0.0-20260520065146-aa012df4f4af h1:zLXA2Irn14q2/06WMkxViyr7YCPUO2lJ0QYE9Juy5vA=
 k8s.io/kube-openapi v0.0.0-20260520065146-aa012df4f4af/go.mod h1:V/QaCUYDa+0QpcHhVVc5l99Uz56wEMEXBSj9oCDkNDY=
 k8s.io/kubectl v0.36.2 h1:rpUGGpeL09XVOLep2yle5jrtk//JA1L6ZHfkQQtVEwk=

internal/operator-controller/rukpak/render/certproviders/certmanager.go

@@ -11,6 +11,7 @@ import (
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	apiregistrationv1 "k8s.io/kube-aggregator/pkg/apis/apiregistration/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	"github.com/operator-framework/operator-controller/internal/operator-controller/rukpak/render"
@@ -35,6 +36,8 @@ func (p CertManagerCertificateProvider) InjectCABundle(obj client.Object, cfg re
 		p.addCAInjectionAnnotation(obj, cfg.Namespace, cfg.CertName)
 	case *apiextensionsv1.CustomResourceDefinition:
 		p.addCAInjectionAnnotation(obj, cfg.Namespace, cfg.CertName)
+	case *apiregistrationv1.APIService:
+		p.addCAInjectionAnnotation(obj, cfg.Namespace, cfg.CertName)
 	}
 	return nil
 }

internal/operator-controller/rukpak/render/certproviders/openshift_serviceca.go

@@ -5,6 +5,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	apiregistrationv1 "k8s.io/kube-aggregator/pkg/apis/apiregistration/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	"github.com/operator-framework/operator-controller/internal/operator-controller/rukpak/render"
@@ -30,6 +31,8 @@ func (p OpenshiftServiceCaCertificateProvider) InjectCABundle(obj client.Object,
 		p.addInjectCABundleAnnotation(obj)
 	case *corev1.Service:
 		p.addServingCertSecretNameAnnotation(obj, cfg.CertName)
+	case *apiregistrationv1.APIService:
+		p.addInjectCABundleAnnotation(obj)
 	}
 	return nil
 }

internal/operator-controller/rukpak/render/registryv1/generators/generators.go

@@ -16,6 +16,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
 	"k8s.io/apimachinery/pkg/util/sets"
+	apiregistrationv1 "k8s.io/kube-aggregator/pkg/apis/apiregistration/v1"
 	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
@@ -73,6 +74,15 @@ func BundleCSVDeploymentGenerator(rv1 *bundle.RegistryV1, opts render.Options) (
 		webhookDeployments.Insert(wh.DeploymentName)
 	}
 
+	// collect deployments that service owned APIServices
+	// GetOwnedAPIServiceDescriptions() deduplicates by group+version (GetName() identity).
+	apiServiceDeployments := sets.Set[string]{}
+	for _, desc := range rv1.CSV.GetOwnedAPIServiceDescriptions() {
+		if desc.DeploymentName != "" {
+			apiServiceDeployments.Insert(desc.DeploymentName)
+		}
+	}
+
 	objs := make([]client.Object, 0, len(rv1.CSV.Spec.InstallStrategy.StrategySpec.DeploymentSpecs))
 	for _, depSpec := range rv1.CSV.Spec.InstallStrategy.StrategySpec.DeploymentSpecs {
 		// Add CSV annotations to template annotations
@@ -100,7 +110,7 @@ func BundleCSVDeploymentGenerator(rv1 *bundle.RegistryV1, opts render.Options) (
 		)
 
 		secretInfo := render.CertProvisionerFor(depSpec.Name, opts).GetCertSecretInfo()
-		if webhookDeployments.Has(depSpec.Name) && secretInfo != nil {
+		if (webhookDeployments.Has(depSpec.Name) || apiServiceDeployments.Has(depSpec.Name)) && secretInfo != nil {
 			ensureCorrectDeploymentCertVolumes(deploymentResource, *secretInfo)
 		}
 
@@ -414,6 +424,113 @@ func BundleMutatingWebhookResourceGenerator(rv1 *bundle.RegistryV1, opts render.
 	return objs, nil
 }
 
+// BundleCSVAPIServiceGenerator generates APIService resources and the supporting RBAC
+// for each entry in csv.spec.apiservicedefinitions.owned, matching OLMv0 behavior:
+//
+//   - APIService object (group+version, service reference, CA bundle injection)
+//   - ClusterRoleBinding <service>-system:auth-delegator — lets kube-apiserver delegate
+//     TokenReview/SubjectAccessReview to the extension API server (required for aggregation auth)
+//   - RoleBinding <service>-auth-reader in kube-system — lets the extension API server read
+//     the extension-apiserver-authentication ConfigMap (required for reading client CA config)
+//
+// Priority values follow OLMv0 conventions: GroupPriorityMinimum=2000, VersionPriority=15.
+func BundleCSVAPIServiceGenerator(rv1 *bundle.RegistryV1, opts render.Options) ([]client.Object, error) {
+	if rv1 == nil {
+		return nil, fmt.Errorf("bundle cannot be nil")
+	}
+
+	// Build a map from deployment name → ServiceAccount name for RBAC subject lookup.
+	depSAName := make(map[string]string, len(rv1.CSV.Spec.InstallStrategy.StrategySpec.DeploymentSpecs))
+	for _, dep := range rv1.CSV.Spec.InstallStrategy.StrategySpec.DeploymentSpecs {
+		depSAName[dep.Name] = saNameOrDefault(dep.Spec.Template.Spec.ServiceAccountName)
+	}
+
+	// GetOwnedAPIServiceDescriptions() deduplicates by group+version (GetName() identity),
+	// preventing duplicate APIService objects when multiple Kinds share the same group+version.
+	// Track which deployments have already had RBAC emitted; multiple group+versions can share
+	// a single deployment and must not produce duplicate ClusterRoleBinding/RoleBinding objects.
+	generatedRBACForDeployment := sets.New[string]()
+	var objs []client.Object
+	for _, desc := range rv1.CSV.GetOwnedAPIServiceDescriptions() {
+		certProvisioner := render.CertProvisionerFor(desc.DeploymentName, opts)
+
+		containerPort := desc.ContainerPort
+		if containerPort == 0 {
+			containerPort = 443
+		}
+
+		apiService := &apiregistrationv1.APIService{
+			TypeMeta: metav1.TypeMeta{
+				APIVersion: "apiregistration.k8s.io/v1",
+				Kind:       "APIService",
+			},
+			ObjectMeta: metav1.ObjectMeta{
+				Name: desc.GetName(), // "<version>.<group>"
+			},
+			Spec: apiregistrationv1.APIServiceSpec{
+				Group:                desc.Group,
+				Version:              desc.Version,
+				GroupPriorityMinimum: 2000,
+				VersionPriority:      15,
+				Service: &apiregistrationv1.ServiceReference{
+					Namespace: opts.InstallNamespace,
+					Name:      certProvisioner.ServiceName,
+					Port:      &containerPort,
+				},
+				InsecureSkipTLSVerify: false,
+			},
+		}
+
+		if err := certProvisioner.InjectCABundle(apiService); err != nil {
+			return nil, err
+		}
+		objs = append(objs, apiService)
+
+		// Emit RBAC once per deployment — multiple group+versions may share one deployment,
+		// and creating duplicate ClusterRoleBinding/RoleBinding names would be rejected by k8s.
+		if !generatedRBACForDeployment.Has(desc.DeploymentName) {
+			generatedRBACForDeployment.Insert(desc.DeploymentName)
+
+			saName := saNameOrDefault(depSAName[desc.DeploymentName])
+			subject := rbacv1.Subject{
+				Kind:      "ServiceAccount",
+				Name:      saName,
+				Namespace: opts.InstallNamespace,
+			}
+
+			// ClusterRoleBinding: <service>-system:auth-delegator
+			// Grants the extension API server's SA the system:auth-delegator ClusterRole so
+			// kube-apiserver can delegate TokenReview/SubjectAccessReview requests to it.
+			// Mirrors OLMv0 behavior: pkg/controller/install/certresources.go:500-520
+			objs = append(objs, CreateClusterRoleBindingResource(
+				certProvisioner.ServiceName+"-system:auth-delegator",
+				WithSubjects(subject),
+				WithRoleRef(rbacv1.RoleRef{
+					APIGroup: rbacv1.GroupName,
+					Kind:     "ClusterRole",
+					Name:     "system:auth-delegator",
+				}),
+			))
+
+			// RoleBinding: <service>-auth-reader in kube-system
+			// Allows the extension API server's SA to read the extension-apiserver-authentication
+			// ConfigMap in kube-system, which contains the cluster's client CA and request-header config.
+			// Mirrors OLMv0 behavior: pkg/controller/install/certresources.go:522-537
+			objs = append(objs, CreateRoleBindingResource(
+				certProvisioner.ServiceName+"-auth-reader",
+				"kube-system",
+				WithSubjects(subject),
+				WithRoleRef(rbacv1.RoleRef{
+					APIGroup: rbacv1.GroupName,
+					Kind:     "Role",
+					Name:     "extension-apiserver-authentication-reader",
+				}),
+			))
+		}
+	}
+	return objs, nil
+}
+
 // BundleDeploymentServiceResourceGenerator generates Service resources that support, e.g. the webhooks,
 // defined in the bundle's cluster service version spec. The resource is modified by the CertificateProvider in opts
 // to add any annotations or modifications necessary for certificate injection.
@@ -422,14 +539,44 @@ func BundleDeploymentServiceResourceGenerator(rv1 *bundle.RegistryV1, opts rende
 		return nil, fmt.Errorf("bundle cannot be nil")
 	}
 
-	// collect webhook service ports
+	// collect service ports from webhooks and owned APIService definitions
 	webhookServicePortsByDeployment := map[string]sets.Set[corev1.ServicePort]{}
 	for _, wh := range rv1.CSV.Spec.WebhookDefinitions {
 		if _, ok := webhookServicePortsByDeployment[wh.DeploymentName]; !ok {
 			webhookServicePortsByDeployment[wh.DeploymentName] = sets.Set[corev1.ServicePort]{}
 		}
 		webhookServicePortsByDeployment[wh.DeploymentName].Insert(getWebhookServicePort(wh))
 	}
+	// GetOwnedAPIServiceDescriptions() deduplicates by group+version identity.
+	for _, desc := range rv1.CSV.GetOwnedAPIServiceDescriptions() {
+		if desc.DeploymentName == "" {
+			continue
+		}
+		port := desc.ContainerPort
+		if port == 0 {
+			port = 443
+		}
+		if _, ok := webhookServicePortsByDeployment[desc.DeploymentName]; !ok {
+			webhookServicePortsByDeployment[desc.DeploymentName] = sets.Set[corev1.ServicePort]{}
+		}
+		apiSvcPort := corev1.ServicePort{
+			Name:       strconv.Itoa(int(port)),
+			Port:       port,
+			TargetPort: intstr.FromInt32(port),
+		}
+		// Detect conflicts: if the deployment already has a port with the same port
+		// number but different configuration (e.g., a webhook with a different TargetPort),
+		// reject rather than generate an invalid Service with duplicate port numbers.
+		for existing := range webhookServicePortsByDeployment[desc.DeploymentName] {
+			if existing.Port == port && existing != apiSvcPort {
+				return nil, fmt.Errorf(
+					"deployment %q has a Service port conflict: APIService port %d conflicts with an existing webhook port configuration",
+					desc.DeploymentName, port,
+				)
+			}
+		}
+		webhookServicePortsByDeployment[desc.DeploymentName].Insert(apiSvcPort)
+	}
 
 	objs := make([]client.Object, 0, len(webhookServicePortsByDeployment))
 	for _, deploymentSpec := range rv1.CSV.Spec.InstallStrategy.StrategySpec.DeploymentSpecs {