[release/v0.25] Add cluster indexed label to all CRDs (#1753)

alexander-demicev · web-flow · commit 658ecc0ce634 · 2025-09-23T09:18:58.000Z
* Fix make dev-env errors

Signed-off-by: Alexandr Demicev &lt;alexandr.demicev@suse.com&gt;

* Add cluster indexed label to all CRDs

Signed-off-by: Alexandr Demicev &lt;alexandr.demicev@suse.com&gt;

---------

Signed-off-by: Alexandr Demicev &lt;alexandr.demicev@suse.com&gt;
diff --git a/config/rbac/kustomization.yaml b/config/rbac/kustomization.yaml
@@ -12,4 +12,5 @@ resources:
 - aggregated_role.yaml
 
 patches:
-- path: manager_role_aggregation_patch.yaml
+- path: manager_role_patch.yaml
+- path: manager_rolebinding_patch.yaml
diff --git a/config/rbac/manager_role_patch.yaml b/config/rbac/manager_role_patch.yaml
@@ -0,0 +1,6 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: manager-role
+  labels:
+    rancher-turtles/aggregate-to-manager: "true"
diff --git a/config/rbac/manager_rolebinding_patch.yaml b/config/rbac/manager_rolebinding_patch.yaml
@@ -1,11 +1,4 @@
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: manager-role
-  labels:
-    rancher-turtles/aggregate-to-manager: "true"
----
-apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: manager-rolebinding
diff --git a/exp/clusterclass/config/rbac/kustomization.yaml b/exp/clusterclass/config/rbac/kustomization.yaml
@@ -12,4 +12,5 @@ resources:
 - aggregated_role.yaml
 
 patches:
-- path: manager_role_aggregation_patch.yaml
+- path: manager_role_patch.yaml
+- path: manager_rolebinding_patch.yaml
diff --git a/exp/clusterclass/config/rbac/manager_role_aggregation_patch.yaml b/exp/clusterclass/config/rbac/manager_role_aggregation_patch.yaml
diff --git a/exp/clusterclass/config/rbac/manager_role_patch.yaml b/exp/clusterclass/config/rbac/manager_role_patch.yaml
@@ -0,0 +1,6 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: manager-role
+  labels:
+    rancher-turtles/aggregate-to-manager: "true"
diff --git a/exp/clusterclass/config/rbac/manager_rolebinding_patch.yaml b/exp/clusterclass/config/rbac/manager_rolebinding_patch.yaml
@@ -0,0 +1,8 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: manager-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: aggregated-manager-role
diff --git a/exp/day2/config/default/kustomization.yaml b/exp/day2/config/default/kustomization.yaml
@@ -18,7 +18,8 @@ resources:
 patches:
 - path: manager_webhook_patch.yaml
 - path: webhookcainjection_patch.yaml
-- path: manager_role_aggregation_patch.yaml
+- path: manager_role_patch.yaml
+- path: manager_rolebinding_patch.yaml
 - path: manager_image_patch.yaml
 - path: manager_pull_policy.yaml
 
diff --git a/exp/day2/config/default/manager_role_aggregation_patch.yaml b/exp/day2/config/default/manager_role_aggregation_patch.yaml
diff --git a/exp/day2/config/default/manager_role_patch.yaml b/exp/day2/config/default/manager_role_patch.yaml
@@ -0,0 +1,6 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: manager-role
+  labels:
+    rancher-turtles-exp/aggregate-to-manager: "true"
diff --git a/exp/day2/config/default/manager_rolebinding_patch.yaml b/exp/day2/config/default/manager_rolebinding_patch.yaml
@@ -0,0 +1,8 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: manager-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: aggregated-manager-role
diff --git a/exp/day2/config/rbac/kustomization.yaml b/exp/day2/config/rbac/kustomization.yaml
@@ -12,4 +12,5 @@ resources:
 - aggregated_role.yaml
 
 patches:
-- path: manager_role_aggregation_patch.yaml
+- path: manager_role_patch.yaml
+- path: manager_rolebinding_patch.yaml
diff --git a/exp/day2/config/rbac/manager_role_patch.yaml b/exp/day2/config/rbac/manager_role_patch.yaml
@@ -0,0 +1,6 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: manager-role
+  labels:
+    rancher-turtles/aggregate-to-manager: "true"
diff --git a/exp/day2/config/rbac/manager_rolebinding_patch.yaml b/exp/day2/config/rbac/manager_rolebinding_patch.yaml
@@ -0,0 +1,8 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: manager-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: aggregated-manager-role
diff --git a/internal/controllers/helpers.go b/internal/controllers/helpers.go
@@ -57,7 +57,7 @@ const (
 	externalFleetAnnotation   = "provisioning.cattle.io/externally-managed"
 
 	defaultRequeueDuration = 1 * time.Minute
-	trueAnnotationValue    = "true"
+	trueValue              = "true"
 )
 
 func getClusterRegistrationManifest(ctx context.Context, clusterName, namespace string, cl client.Client,
diff --git a/internal/controllers/import_controller_v3.go b/internal/controllers/import_controller_v3.go
@@ -501,7 +501,7 @@ func (r *CAPIImportManagementV3Reconciler) reconcileDelete(ctx context.Context,
 		annotations = map[string]string{}
 	}
 
-	annotations[turtlesannotations.ClusterImportedAnnotation] = trueAnnotationValue
+	annotations[turtlesannotations.ClusterImportedAnnotation] = trueValue
 	capiCluster.SetAnnotations(annotations)
 	controllerutil.RemoveFinalizer(capiCluster, managementv3.CapiClusterFinalizer)
 
@@ -576,7 +576,7 @@ func (r *CAPIImportManagementV3Reconciler) optOutOfClusterOwner(ctx context.Cont
 			rancherCluster.Name,
 			turtlesannotations.ClusterImportedAnnotation))
 
-		annotations[turtlesannotations.NoCreatorRBACAnnotation] = trueAnnotationValue
+		annotations[turtlesannotations.NoCreatorRBACAnnotation] = trueValue
 		rancherCluster.SetAnnotations(annotations)
 	}
 }
@@ -592,7 +592,7 @@ func (r *CAPIImportManagementV3Reconciler) optOutOfFleetManagement(ctx context.C
 	}
 
 	if _, found := annotations[externalFleetAnnotation]; !found {
-		annotations[externalFleetAnnotation] = trueAnnotationValue
+		annotations[externalFleetAnnotation] = trueValue
 		rancherCluster.SetAnnotations(annotations)
 
 		log.Info("Added fleet annotation to Rancher cluster")
diff --git a/internal/controllers/operator_reconciler.go b/internal/controllers/operator_reconciler.go
@@ -71,6 +71,8 @@ const (
 
 	azureProvider = "azure"
 	gcpProvider   = "gcp"
+
+	clusterIndexedLabelKey = "auth.cattle.io/cluster-indexed"
 )
 
 // OperatorReconciler is a mapping wrapper for CAPIProvider -> operator provider resources.
@@ -142,6 +144,8 @@ func (r *CAPIProviderReconciler) BuildWithManager(ctx context.Context, mgr ctrl.
 
 	customAlterFuncs := []repository.ComponentsAlterFn{}
 
+	customAlterFuncs = append(customAlterFuncs, addClusterIndexedLabelFn)
+
 	if feature.Gates.Enabled(feature.NoCertManager) {
 		customAlterFuncs = append(customAlterFuncs, patchProviderManifestFn, removeCertManagerFn)
 	}
@@ -305,13 +309,13 @@ func setProviderSpec(ctx context.Context, cl client.Client, provider *turtlesv1.
 			provider.Status.Variables = map[string]string{}
 		}
 
-		provider.Status.Variables["EXP_AKS_RESOURCE_HEALTH"] = "true"
+		provider.Status.Variables["EXP_AKS_RESOURCE_HEALTH"] = trueValue
 	case gcpProvider:
 		if provider.Status.Variables == nil {
 			provider.Status.Variables = map[string]string{}
 		}
 
-		provider.Status.Variables["EXP_CAPG_GKE"] = "true"
+		provider.Status.Variables["EXP_CAPG_GKE"] = trueValue
 	}
 
 	return nil
@@ -343,6 +347,10 @@ func (r *CAPIProviderReconciler) purgeCertificateResources(ctx context.Context)
 
 // patchProviderManifestFn is a function to patch the provider manifest that satisfies the type repository.ComponentsAlterFn.
 func patchProviderManifestFn(objs []unstructured.Unstructured) ([]unstructured.Unstructured, error) {
+	if len(objs) == 0 {
+		return nil, nil
+	}
+
 	var (
 		secretName string
 		serviceObj *unstructured.Unstructured
@@ -388,9 +396,38 @@ func patchProviderManifestFn(objs []unstructured.Unstructured) ([]unstructured.U
 	return objs, nil
 }
 
+// addClusterIndexedLabelFn adds the auth.cattle.io/cluster-indexed="true" label to every CRD.
+func addClusterIndexedLabelFn(objs []unstructured.Unstructured) ([]unstructured.Unstructured, error) {
+	if len(objs) == 0 {
+		return nil, nil
+	}
+
+	for i := range objs {
+		o := &objs[i]
+		if o.GetKind() != "CustomResourceDefinition" {
+			continue
+		}
+
+		labels := o.GetLabels()
+		if labels == nil {
+			labels = map[string]string{}
+		}
+
+		labels[clusterIndexedLabelKey] = trueValue
+
+		o.SetLabels(labels)
+	}
+
+	return objs, nil
+}
+
 // removeCertManagerFn is a function that satisfies the type repository.ComponentsAlterFn
 // to remove cert-manager dependencies from the provider manifest.
 func removeCertManagerFn(objs []unstructured.Unstructured) ([]unstructured.Unstructured, error) {
+	if len(objs) == 0 {
+		return nil, nil
+	}
+
 	updatedObjs := []unstructured.Unstructured{}
 
 	for _, o := range objs {
diff --git a/internal/controllers/operator_reconciler_test.go b/internal/controllers/operator_reconciler_test.go
@@ -19,6 +19,8 @@ package controllers
 import (
 	"os"
 
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	turtlesv1 "github.com/rancher/turtles/api/v1alpha1"
@@ -304,3 +306,109 @@ var _ = Describe("Provider sync", func() {
 		}).Should(Succeed())
 	})
 })
+
+var _ = Describe("Alter component functions", func() {
+	It("Should add cluster indexed label to CRDs", func() {
+		crd1 := unstructured.Unstructured{}
+		crd1.SetKind("CustomResourceDefinition")
+		crd1.SetName("test")
+
+		crd2 := unstructured.Unstructured{}
+		crd2.SetKind("CustomResourceDefinition")
+		crd2.SetName("test")
+
+		svc := unstructured.Unstructured{}
+		svc.SetKind("Service")
+		svc.SetName("ignored")
+
+		alteredComponents, err := addClusterIndexedLabelFn([]unstructured.Unstructured{crd1, crd2, svc})
+		Expect(err).ToNot(HaveOccurred())
+		Expect(alteredComponents).To(HaveLen(3))
+		Expect(alteredComponents[0].GetLabels()[clusterIndexedLabelKey]).To(Equal("true"))
+		Expect(alteredComponents[1].GetLabels()[clusterIndexedLabelKey]).To(Equal("true"))
+		Expect(alteredComponents[2].GetLabels()).NotTo(HaveKey(clusterIndexedLabelKey))
+	})
+
+	It("Should patch provider manifest with certificate secret annotation on service", func() {
+		cert := unstructured.Unstructured{}
+		cert.SetKind("Certificate")
+		cert.SetName("test")
+		Expect(unstructured.SetNestedField(cert.Object, "my-cert-secret", "spec", "secretName")).ToNot(HaveOccurred())
+
+		svc := unstructured.Unstructured{}
+		svc.SetKind("Service")
+		svc.SetName("test")
+
+		alteredComponents, err := patchProviderManifestFn([]unstructured.Unstructured{svc, cert})
+		Expect(err).ToNot(HaveOccurred())
+		Expect(alteredComponents).To(HaveLen(2))
+		Expect(alteredComponents[0].GetKind()).To(Equal("Service"))
+		Expect(alteredComponents[0].GetAnnotations()[certificateAnnotationKey]).To(Equal("my-cert-secret"))
+	})
+
+	It("Should fail when Certificate secretName is missing", func() {
+		cert := unstructured.Unstructured{}
+		cert.SetKind("Certificate")
+		cert.SetName("test")
+		svc := unstructured.Unstructured{}
+		svc.SetKind("Service")
+		svc.SetName("test")
+
+		_, err := patchProviderManifestFn([]unstructured.Unstructured{cert, svc})
+		Expect(err).To(HaveOccurred())
+		Expect(err.Error()).To(ContainSubstring("secretName not found"))
+	})
+
+	It("Should remove cert-manager resources and annotations", func() {
+		cert := unstructured.Unstructured{}
+		cert.SetKind("Certificate")
+		cert.SetName("test")
+		issuer := unstructured.Unstructured{}
+		issuer.SetKind("Issuer")
+		issuer.SetName("test")
+		deploy := unstructured.Unstructured{}
+		deploy.SetKind("Deployment")
+		deploy.SetName("test")
+		deploy.SetAnnotations(map[string]string{certManagerInjectAnnotationKey: "test"})
+		svc := unstructured.Unstructured{}
+		svc.SetKind("Service")
+		svc.SetName("test")
+		svc.SetAnnotations(map[string]string{certManagerInjectAnnotationKey: "test"})
+
+		alteredComponents, err := removeCertManagerFn([]unstructured.Unstructured{cert, issuer, deploy, svc})
+		Expect(err).ToNot(HaveOccurred())
+		Expect(alteredComponents).To(HaveLen(2))
+		Expect(alteredComponents[0].GetKind()).ToNot(Or(Equal("Certificate"), Equal("Issuer")))
+		Expect(alteredComponents[1].GetKind()).ToNot(Or(Equal("Certificate"), Equal("Issuer")))
+		if alteredComponents[0].GetAnnotations() != nil {
+			Expect(alteredComponents[0].GetAnnotations()).NotTo(HaveKey(certManagerInjectAnnotationKey))
+		}
+		if alteredComponents[1].GetAnnotations() != nil {
+			Expect(alteredComponents[1].GetAnnotations()).NotTo(HaveKey(certManagerInjectAnnotationKey))
+		}
+	})
+
+	It("Should handle empty input slices", func() {
+		alteredComponents, err := addClusterIndexedLabelFn(nil)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(alteredComponents).To(BeNil())
+
+		alteredComponents, err = patchProviderManifestFn(nil)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(alteredComponents).To(BeNil())
+
+		alteredComponents, err = removeCertManagerFn(nil)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(alteredComponents).To(BeNil())
+	})
+
+	It("Should ignore manifests without Service or Certificate", func() {
+		pod := unstructured.Unstructured{}
+		pod.SetKind("Pod")
+		pod.SetName("test")
+
+		alteredComponents, err := patchProviderManifestFn([]unstructured.Unstructured{pod})
+		Expect(err).ToNot(HaveOccurred())
+		Expect(alteredComponents).To(HaveLen(1))
+	})
+})
diff --git a/scripts/turtles-dev.sh b/scripts/turtles-dev.sh
@@ -82,7 +82,7 @@ install_local_rancher_turtles_chart() {
     # Remove the previous chart directory
     rm -rf out
     # Build the chart locally
-    make build-chart
+    RELEASE_TAG=dev make build-chart
     # Build the day2 controller image
     make docker-build-prime
     # Load the day2 controller image into the kind cluster
