⚠ make spec.namespace optional with managed namespace support and PSA support#2825
Draft
nader-ziada wants to merge 2 commits into
Draft
⚠ make spec.namespace optional with managed namespace support and PSA support#2825nader-ziada wants to merge 2 commits into
nader-ziada wants to merge 2 commits into
Conversation
…t and PSA support When spec.namespace is omitted, operator-controller resolves a managed namespace from bundle metadata using the fallback chain: suggested-namespace-template > suggested-namespace > <packageName>-system. The managed namespace is included as a ClusterObjectSet object with collision protection. Pod Security Admission labels from the bundle's suggested-namespace-template annotation are applied to the managed namespace, enabling operators to declare their PSA requirements Signed-off-by: Nader Ziada <nziada@redhat.com>
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
✅ Deploy Preview for olmv1 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
This PR makes ClusterExtension.spec.namespace optional by introducing “managed namespace” behavior resolved from bundle CSV annotations (including PSA label support), and updates reconciliation + tests/docs accordingly.
Changes:
- Add managed-namespace resolution from bundle metadata with a fallback chain and persist the resolved namespace in status.
- Inject a managed Namespace object (with collision protection) and support applying PSA labels via
suggested-namespace-template. - Expand E2E/unit tests and update CRD schema/docs to reflect optional namespace + immutability rules.
Reviewed changes
Copilot reviewed 25 out of 29 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| test/internal/catalog/bundle.go | Adds test helpers to annotate CSVs (namespace template / PSA). |
| test/e2e/steps/steps.go | Adds godog steps to assert Namespace labels and parses NSTemplate bundle content option. |
| test/e2e/features/namespace.feature | New E2E scenarios validating PSA labels on managed namespaces and absence on user namespaces. |
| manifests/standard.yaml | Makes spec.namespace optional, adds immutability CEL rules, and adds status.namespace. |
| manifests/standard-e2e.yaml | Same as standard.yaml for e2e manifests. |
| manifests/experimental.yaml | Same namespace optionality + status field changes for experimental. |
| manifests/experimental-e2e.yaml | Same as experimental.yaml for e2e manifests. |
| internal/operator-controller/controllers/clusterobjectset_controller.go | Improves collision error messages, especially for Namespaces. |
| internal/operator-controller/controllers/clusterextension_reconcile_steps.go | Adds ResolveNamespace reconcile step; sets status.namespace during apply. |
| internal/operator-controller/controllers/clusterextension_controller_test.go | Adds unit test coverage for ResolveNamespace (user-provided namespace existence). |
| internal/operator-controller/controllers/clusterextension_controller.go | Extends reconcile state with resolved namespace + managed/template flags. |
| internal/operator-controller/controllers/clusterextension_admission_test.go | Updates admission expectations (namespace optional) and adds namespace immutability tests. |
| internal/operator-controller/controllers/boxcutter_reconcile_steps_apply_test.go | Updates boxcutter apply step signature to accept NamespaceConfig. |
| internal/operator-controller/controllers/boxcutter_reconcile_steps.go | Passes NamespaceConfig into boxcutter apply and sets status.namespace. |
| internal/operator-controller/applier/provider.go | Exports GetBundleAnnotations for namespace resolution usage. |
| internal/operator-controller/applier/namespace_test.go | Adds unit tests for parsing templates, resolving names, and building Namespace objects. |
| internal/operator-controller/applier/namespace.go | Implements template parsing, namespace resolution, and Namespace object construction. |
| internal/operator-controller/applier/boxcutter_test.go | Updates revision generator tests for namespace phase injection and ordering. |
| internal/operator-controller/applier/boxcutter.go | Threads NamespaceConfig through revision generation and boxcutter apply; injects Namespace object when managed. |
| helm/olmv1/base/operator-controller/crd/standard/olm.operatorframework.io_clusterextensions.yaml | Helm CRD: makes namespace optional + adds status.namespace + CEL immutability rules. |
| helm/olmv1/base/operator-controller/crd/experimental/olm.operatorframework.io_clusterextensions.yaml | Helm CRD: same as standard for experimental. |
| docs/howto/namespace-configuration-for-authors.md | New author-facing docs for namespace annotations and PSA template usage. |
| docs/concepts/managed-namespaces.md | New concept doc describing managed namespaces, deletion behavior, and PSA labels. |
| cmd/operator-controller/main.go | Wires ResolveNamespace into both boxcutter and helm reconcilers. |
| api/v1/clusterextension_types.go | Updates API docs/validation and adds status.namespace field. |
Files not reviewed (4)
- applyconfigurations/api/v1/clusterextensionspec.go: Generated file
- applyconfigurations/api/v1/clusterextensionstatus.go: Generated file
- applyconfigurations/internal/internal.go: Generated file
- internal/testutil/mock/applier/mock_applier.go: Generated file
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 25 out of 29 changed files in this pull request and generated 4 comments.
Files not reviewed (4)
- applyconfigurations/api/v1/clusterextensionspec.go: Generated file
- applyconfigurations/api/v1/clusterextensionstatus.go: Generated file
- applyconfigurations/internal/internal.go: Generated file
- internal/testutil/mock/applier/mock_applier.go: Generated file
Comments suppressed due to low confidence (1)
internal/operator-controller/controllers/clusterextension_admission_test.go:290
- Typo in the test case name: "hypen-separated" should be "hyphen-separated".
}{
{"just alphanumeric", "justalphanumberic1", ""},
{"hypen-separated", "hyphenated-name", ""},
{"no install namespace (managed mode)", "", ""},
{"dot-separated", "dotted.name", regexMismatchError},
nader-ziada
force-pushed
the
feat/namespace-psa
branch
from
July 22, 2026 19:01
ffe7458 to
5782e26
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 25 out of 29 changed files in this pull request and generated 2 comments.
Files not reviewed (4)
- applyconfigurations/api/v1/clusterextensionspec.go: Generated file
- applyconfigurations/api/v1/clusterextensionstatus.go: Generated file
- applyconfigurations/internal/internal.go: Generated file
- internal/testutil/mock/applier/mock_applier.go: Generated file
Comments suppressed due to low confidence (1)
internal/operator-controller/controllers/clusterextension_admission_test.go:288
- Typo in the test case name: "hypen-separated" should be "hyphen-separated".
{"hypen-separated", "hyphenated-name", ""},
nader-ziada
force-pushed
the
feat/namespace-psa
branch
from
July 22, 2026 21:18
5782e26 to
8bdd50d
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 25 out of 29 changed files in this pull request and generated 2 comments.
Files not reviewed (4)
- applyconfigurations/api/v1/clusterextensionspec.go: Generated file
- applyconfigurations/api/v1/clusterextensionstatus.go: Generated file
- applyconfigurations/internal/internal.go: Generated file
- internal/testutil/mock/applier/mock_applier.go: Generated file
Comments suppressed due to low confidence (1)
internal/operator-controller/controllers/clusterextension_admission_test.go:288
- The test case name has a typo: "hypen-separated" should be "hyphen-separated" (this is just the display name for the subtest, but it’s misleading when reading test output).
{"hypen-separated", "hyphenated-name", ""},
| } | ||
|
|
||
| func getBundleAnnotations(bundleFS fs.FS) (map[string]string, error) { | ||
| func GetBundleAnnotations(bundleFS fs.FS) (map[string]string, error) { |
Signed-off-by: Nader Ziada <nziada@redhat.com>
nader-ziada
force-pushed
the
feat/namespace-psa
branch
from
July 22, 2026 22:40
8bdd50d to
56fee54
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 25 out of 29 changed files in this pull request and generated no new comments.
Files not reviewed (4)
- applyconfigurations/api/v1/clusterextensionspec.go: Generated file
- applyconfigurations/api/v1/clusterextensionstatus.go: Generated file
- applyconfigurations/internal/internal.go: Generated file
- internal/testutil/mock/applier/mock_applier.go: Generated file
Comments suppressed due to low confidence (1)
internal/operator-controller/controllers/clusterextension_admission_test.go:288
- Typo in test case name: "hypen-separated" should be "hyphen-separated".
{"hypen-separated", "hyphenated-name", ""},
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
When spec.namespace is omitted, operator-controller resolves a managed namespace from bundle metadata using the fallback chain: suggested-namespace-template > suggested-namespace > -system.
The managed namespace is included as a ClusterObjectSet object with collision protection. Pod Security Admission labels from the bundle's suggested-namespace-template annotation are applied to the managed namespace, enabling operators to declare their PSA requirements
Reviewer Checklist