operator: create basic bundle #191
Conversation
WalkthroughAdds an OLM operator bundle (Dockerfile, annotations, bundle manifests, scorecard tests), new CRDs and ClusterRoles, CI for bundle checks and bundle image build, manager resource and OpenShift route registration, a fixed ConfigMap name, and small comment/CRD description updates and an e2e timestamp formatting tweak. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant PR as Pull Request
participant GH as GitHub Actions
participant Make as make (deploy/operator)
participant Gen as bundle generator
participant Bundle as Bundle image
participant Score as Scorecard tests
PR->>GH: PR opened (main or release-*)
GH->>Make: run `make bundle` (IMG=...:TAG)
Make->>Gen: generate manifests, metadata, tests
Gen->>Bundle: assemble bundle image (bundle.Dockerfile)
GH->>GH: git-diff check (fail on non-timestamp changes)
GH->>Make: run `make build-installer`
Make->>GH: produce installer artifacts
GH->>Score: execute scorecard tests (bundle/tests/scorecard/config.yaml)
Score-->>GH: report results
GH-->>PR: report workflow status
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes
Possibly related PRs
Suggested reviewers
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (6)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (2)
🧰 Additional context used🧠 Learnings (5)📚 Learning: 2025-10-24T11:57:23.796ZApplied to files:
📚 Learning: 2025-05-13T19:57:56.811ZApplied to files:
📚 Learning: 2025-10-24T11:57:13.484ZApplied to files:
📚 Learning: 2025-05-13T19:57:56.811ZApplied to files:
📚 Learning: 2025-11-14T15:47:36.325ZApplied to files:
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (7)
🔇 Additional comments (8)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (2)
deploy/operator/bundle/manifests/jumpstarter-operator-jumpstarter-admin-role_rbac.authorization.k8s.io_v1_clusterrole.yaml (1)
10-21: Consider enumerating verbs instead of using wildcard.The admin ClusterRole grants wildcard verbs (
*) on thejumpstartersresource. Even for admin roles, explicitly listing verbs (create, delete, get, list, patch, update, watch) is more maintainable and aligns with security best practices. This also makes audit logs clearer about what permissions are actually needed.- apiGroups: - operator.jumpstarter.dev resources: - jumpstarters verbs: - - '*' + - create + - delete + - get + - list + - patch + - update + - watchdeploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yaml (1)
305-311: Memory limit may be too restrictive for operator workload.The memory limit of 128Mi (line 308) is quite conservative for a Go-based Kubernetes operator managing multiple resource types. This could lead to OOMKilled pods under normal operational load, especially if managing many Client, Exporter, or Lease resources simultaneously. Consider increasing to 256Mi or 512Mi, or conduct load testing to validate the current limits are sufficient. Memory request of 64Mi may also need adjustment.
Would you like me to help determine appropriate resource limits based on typical Jumpstarter operator usage patterns?
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
deploy/operator/dist/install.yamlis excluded by!**/dist/**
📒 Files selected for processing (15)
deploy/operator/bundle.Dockerfile(1 hunks)deploy/operator/bundle/manifests/jumpstarter-operator-controller-manager-metrics-service_v1_service.yaml(1 hunks)deploy/operator/bundle/manifests/jumpstarter-operator-jumpstarter-admin-role_rbac.authorization.k8s.io_v1_clusterrole.yaml(1 hunks)deploy/operator/bundle/manifests/jumpstarter-operator-jumpstarter-editor-role_rbac.authorization.k8s.io_v1_clusterrole.yaml(1 hunks)deploy/operator/bundle/manifests/jumpstarter-operator-jumpstarter-viewer-role_rbac.authorization.k8s.io_v1_clusterrole.yaml(1 hunks)deploy/operator/bundle/manifests/jumpstarter-operator-metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml(1 hunks)deploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yaml(1 hunks)deploy/operator/bundle/manifests/jumpstarter.dev_clients.yaml(1 hunks)deploy/operator/bundle/manifests/jumpstarter.dev_exporteraccesspolicies.yaml(1 hunks)deploy/operator/bundle/manifests/jumpstarter.dev_exporters.yaml(1 hunks)deploy/operator/bundle/manifests/jumpstarter.dev_leases.yaml(1 hunks)deploy/operator/bundle/metadata/annotations.yaml(1 hunks)deploy/operator/bundle/tests/scorecard/config.yaml(1 hunks)deploy/operator/config/manager/manager.yaml(1 hunks)deploy/operator/config/manifests/bases/jumpstarter-operator.clusterserviceversion.yaml(1 hunks)
🧰 Additional context used
🧠 Learnings (8)
📓 Common learnings
Learnt from: mangelajo
Repo: jumpstarter-dev/jumpstarter-controller PR: 170
File: deploy/operator/internal/controller/jumpstarter/jumpstarter_controller.go:328-333
Timestamp: 2025-10-24T11:57:23.796Z
Learning: In the jumpstarter-controller operator (deploy/operator/), the design allows only one Jumpstarter CR per namespace, which will be enforced by a validation webhook. This constraint eliminates concerns about resource name collisions within a namespace.
Learnt from: mangelajo
Repo: jumpstarter-dev/jumpstarter-controller PR: 170
File: deploy/operator/internal/controller/jumpstarter/rbac.go:193-196
Timestamp: 2025-10-24T11:57:13.484Z
Learning: In the Jumpstarter operator codebase (deploy/operator/internal/controller/jumpstarter/rbac.go), the Role created by `createRole()` defines RBAC permissions for the managed Jumpstarter controller application, not for the operator itself. The managed controller needs delete permissions on secrets for its runtime operations.
📚 Learning: 2025-10-24T11:57:13.484Z
Learnt from: mangelajo
Repo: jumpstarter-dev/jumpstarter-controller PR: 170
File: deploy/operator/internal/controller/jumpstarter/rbac.go:193-196
Timestamp: 2025-10-24T11:57:13.484Z
Learning: In the Jumpstarter operator codebase (deploy/operator/internal/controller/jumpstarter/rbac.go), the Role created by `createRole()` defines RBAC permissions for the managed Jumpstarter controller application, not for the operator itself. The managed controller needs delete permissions on secrets for its runtime operations.
Applied to files:
deploy/operator/bundle/manifests/jumpstarter-operator-jumpstarter-viewer-role_rbac.authorization.k8s.io_v1_clusterrole.yamldeploy/operator/bundle/manifests/jumpstarter-operator-jumpstarter-editor-role_rbac.authorization.k8s.io_v1_clusterrole.yamldeploy/operator/bundle/manifests/jumpstarter-operator-jumpstarter-admin-role_rbac.authorization.k8s.io_v1_clusterrole.yamldeploy/operator/config/manifests/bases/jumpstarter-operator.clusterserviceversion.yamldeploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yamldeploy/operator/bundle/manifests/jumpstarter-operator-metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml
📚 Learning: 2025-10-24T11:57:23.796Z
Learnt from: mangelajo
Repo: jumpstarter-dev/jumpstarter-controller PR: 170
File: deploy/operator/internal/controller/jumpstarter/jumpstarter_controller.go:328-333
Timestamp: 2025-10-24T11:57:23.796Z
Learning: In the jumpstarter-controller operator (deploy/operator/), the design allows only one Jumpstarter CR per namespace, which will be enforced by a validation webhook. This constraint eliminates concerns about resource name collisions within a namespace.
Applied to files:
deploy/operator/bundle/manifests/jumpstarter-operator-jumpstarter-viewer-role_rbac.authorization.k8s.io_v1_clusterrole.yamldeploy/operator/bundle/manifests/jumpstarter.dev_leases.yamldeploy/operator/bundle/manifests/jumpstarter.dev_clients.yamldeploy/operator/bundle/manifests/jumpstarter.dev_exporters.yamldeploy/operator/bundle/manifests/jumpstarter-operator-jumpstarter-editor-role_rbac.authorization.k8s.io_v1_clusterrole.yamldeploy/operator/bundle/manifests/jumpstarter-operator-jumpstarter-admin-role_rbac.authorization.k8s.io_v1_clusterrole.yamldeploy/operator/config/manifests/bases/jumpstarter-operator.clusterserviceversion.yamldeploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yamldeploy/operator/bundle/manifests/jumpstarter-operator-metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yamldeploy/operator/bundle/manifests/jumpstarter.dev_exporteraccesspolicies.yaml
📚 Learning: 2025-10-13T09:05:03.088Z
Learnt from: mangelajo
Repo: jumpstarter-dev/jumpstarter-controller PR: 169
File: deploy/operator/config/rbac/leader_election_role_binding.yaml:3-15
Timestamp: 2025-10-13T09:05:03.088Z
Learning: In Kubebuilder-generated Kubernetes operators, RBAC manifests (RoleBindings, Roles, etc.) under config/rbac/ typically do not include explicit `metadata.namespace` fields. The namespace is injected at build time by Kustomize via the `namespace` field in config/default/kustomization.yaml (or whichever kustomization file is used). This is intentional design to keep base manifests namespace-agnostic. Do not flag missing namespaces in such RBAC manifests as issues when they are part of a Kustomize-based operator deployment structure.
Applied to files:
deploy/operator/bundle/manifests/jumpstarter-operator-jumpstarter-viewer-role_rbac.authorization.k8s.io_v1_clusterrole.yamldeploy/operator/bundle/manifests/jumpstarter-operator-jumpstarter-editor-role_rbac.authorization.k8s.io_v1_clusterrole.yamldeploy/operator/bundle/manifests/jumpstarter-operator-jumpstarter-admin-role_rbac.authorization.k8s.io_v1_clusterrole.yamldeploy/operator/bundle/manifests/jumpstarter-operator-metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml
📚 Learning: 2025-05-13T19:57:56.811Z
Learnt from: NickCao
Repo: jumpstarter-dev/jumpstarter-controller PR: 137
File: hack/deploy_with_helm.sh:26-34
Timestamp: 2025-05-13T19:57:56.811Z
Learning: The jumpstarter-dev repository uses a custom kind cluster configuration that allows NodePort services to use non-standard ports 5080 and 5443, outside the default Kubernetes NodePort range (30000-32767).
Applied to files:
deploy/operator/bundle/manifests/jumpstarter-operator-controller-manager-metrics-service_v1_service.yamldeploy/operator/config/manifests/bases/jumpstarter-operator.clusterserviceversion.yamldeploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yaml
📚 Learning: 2025-05-13T19:57:56.811Z
Learnt from: NickCao
Repo: jumpstarter-dev/jumpstarter-controller PR: 137
File: hack/deploy_with_helm.sh:26-34
Timestamp: 2025-05-13T19:57:56.811Z
Learning: The jumpstarter project uses a custom kind cluster configuration with an expanded NodePort range (3000-32767) and explicit port mappings for ingress (5080/5443) and gRPC services (30010/30011 mapped to 8082/8083).
Applied to files:
deploy/operator/bundle/manifests/jumpstarter-operator-controller-manager-metrics-service_v1_service.yamldeploy/operator/config/manifests/bases/jumpstarter-operator.clusterserviceversion.yamldeploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yaml
📚 Learning: 2025-05-13T19:56:27.924Z
Learnt from: NickCao
Repo: jumpstarter-dev/jumpstarter-controller PR: 137
File: deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/router-deployment.yaml:23-26
Timestamp: 2025-05-13T19:56:27.924Z
Learning: In the jumpstarter-controller project, the router service uses the same ConfigMap as the controller service (controller-cm.yaml) even though it has been moved to its own separate deployment.
Applied to files:
deploy/operator/bundle/manifests/jumpstarter-operator-controller-manager-metrics-service_v1_service.yaml
📚 Learning: 2025-11-14T15:47:36.325Z
Learnt from: mangelajo
Repo: jumpstarter-dev/jumpstarter-controller PR: 190
File: api/v1alpha1/exporter_helpers.go:16-24
Timestamp: 2025-11-14T15:47:36.325Z
Learning: In the jumpstarter-controller project, migration annotations (jumpstarter.dev/migrated-namespace and jumpstarter.dev/migrated-uid) that override namespace and UID values in authentication tokens are acceptable without additional validation webhooks because the security model assumes only administrators have write access to Exporter and Client resources via K8s RBAC.
Applied to files:
deploy/operator/bundle/manifests/jumpstarter.dev_clients.yamldeploy/operator/bundle/manifests/jumpstarter.dev_exporters.yamldeploy/operator/bundle/manifests/jumpstarter-operator-jumpstarter-admin-role_rbac.authorization.k8s.io_v1_clusterrole.yamldeploy/operator/bundle/manifests/jumpstarter.dev_exporteraccesspolicies.yaml
🪛 Checkov (3.2.334)
deploy/operator/bundle/manifests/jumpstarter-operator-jumpstarter-admin-role_rbac.authorization.k8s.io_v1_clusterrole.yaml
[medium] 1-21: Minimize wildcard use in Roles and ClusterRoles
(CKV_K8S_49)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (7)
- GitHub Check: tests
- GitHub Check: e2e-tests (ubuntu-24.04)
- GitHub Check: e2e-tests (ubuntu-24.04-arm)
- GitHub Check: e2e-tests-release-0-7
- GitHub Check: deploy-kind
- GitHub Check: lint-go
- GitHub Check: e2e-test-operator
🔇 Additional comments (15)
deploy/operator/config/manager/manager.yaml (1)
92-92: Verify memory resource increase justification.The memory limits and requests have been increased 4x (limit: 128Mi→512Mi, request: 64Mi→256Mi). While this aligns with the addition of metrics exposure, verify that this increase is necessary for the operator's runtime needs and is not overly conservative. Document the rationale if significant.
Also applies to: 95-95
deploy/operator/bundle/manifests/jumpstarter-operator-metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml (1)
1-10: LGTM!The metrics-reader ClusterRole correctly defines GET access to the /metrics endpoint. This follows standard OLM conventions for operator metrics exposure.
deploy/operator/bundle/metadata/annotations.yaml (1)
1-14: LGTM!Bundle metadata annotations correctly define the OLM structure with proper references to manifests, metadata, and scorecard test configuration. This follows operator-sdk and OLM conventions.
deploy/operator/bundle/manifests/jumpstarter-operator-jumpstarter-viewer-role_rbac.authorization.k8s.io_v1_clusterrole.yaml (1)
1-23: LGTM!The viewer ClusterRole correctly defines read-only access (get, list, watch) to Jumpstarter resources and read access to status subresources. This appropriately implements the viewer permission tier.
deploy/operator/bundle/manifests/jumpstarter-operator-jumpstarter-editor-role_rbac.authorization.k8s.io_v1_clusterrole.yaml (1)
1-27: LGTM!The editor ClusterRole correctly defines write access (create, delete, patch, update) and read access to Jumpstarter resources, while restricting status to read-only. This appropriately implements the editor permission tier.
deploy/operator/config/manifests/bases/jumpstarter-operator.clusterserviceversion.yaml (1)
1-59: Verify ClusterServiceVersion is intended as a skeleton.The CSV has several empty/placeholder fields (lines 8, 30-31, 5-6, 51):
namespace: placeholderinstall.spec.deployments: null,strategy: ""- Empty
alm-examplesand iconbase64data- Links URL points to
jumpstarter-operator.domainVerify that this is an intentional skeleton meant to be populated by the build/kustomize process, or if these fields require manual completion before bundle publication.
deploy/operator/bundle/manifests/jumpstarter-operator-controller-manager-metrics-service_v1_service.yaml (1)
1-20: LGTM!The metrics service correctly exposes the controller-manager metrics endpoint on port 8443 with appropriate selector and labeling. This follows standard Kubernetes service patterns for operator metrics.
deploy/operator/bundle/manifests/jumpstarter.dev_clients.yaml (1)
1-77: LGTM!The Client CRD is well-structured with proper OpenAPI schema, status subresources enabled, and appropriate scope. The credential field uses
x-kubernetes-map-type: atomicfor semantic correctness. Per learnings, the security model assumes admin-controlled write access to Client resources via RBAC, which is reflected in the bundle's admin/editor roles.deploy/operator/bundle/manifests/jumpstarter.dev_exporteraccesspolicies.yaml (1)
1-172: CRD structure looks good.The ExporterAccessPolicy CRD provides a well-structured policy framework with proper label selectors, policy rules, and validation. No concerns identified.
deploy/operator/bundle.Dockerfile (1)
1-20: Bundle Dockerfile structure is correct.The Dockerfile follows OLM bundle image conventions with appropriate labels and manifest copies. Using
scratchas base is correct for bundle images.deploy/operator/bundle/tests/scorecard/config.yaml (1)
15-17: Verify storage specification in scorecard tests.The storage configurations use
mountPath: {}(empty object) across all tests and at the top level (lines 69-70). This appears unusual—typically,mountPathwould be an empty string ("") or omitted. Please verify this YAML is valid and functions as intended with the operator-framework tooling.Also applies to: 25-27, 35-37, 45-47, 55-57, 65-67, 69-70
deploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yaml (4)
24-25: Verify placeholder namespace is correct.The ClusterServiceVersion has
namespace: placeholderspecified at line 25. In OLM bundle installations, ensure this is properly substituted or that it's the intended default. Consider whether this should be empty or removed if not required.
28-46: CRD ownership declaration looks good.The five owned CRDs are properly listed and match the manifests provided in the bundle. The separation of API groups (operator.jumpstarter.dev for Jumpstarter, jumpstarter.dev for others) is clear.
59-260: RBAC permissions comprehensively cover operator requirements.The ClusterPermissions section (lines 59-260) appropriately grants all necessary permissions for the operator to manage Jumpstarter-related resources, leader election, deployment orchestration, and monitoring. Verbs are explicitly enumerated rather than using wildcards, which is best practice.
358-366: Install modes properly restrict to cluster-wide deployment.The CSV correctly supports only
AllNamespacesinstall mode, which is appropriate for an operator managing cluster-wide resources across multiple namespaces. This aligns with the operator's architecture.
deploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yaml
Show resolved
Hide resolved
deploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yaml
Outdated
Show resolved
Hide resolved
mangelajo
force-pushed
the
operator-bundle
branch
from
1ae111d to
1b9a58e
Compare
deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/rbac/role.yaml
Outdated
Show resolved
Hide resolved
mangelajo
force-pushed
the
operator-bundle
branch
from
1b9a58e to
006e645
Compare
mangelajo
force-pushed
the
operator-bundle
branch
6 times, most recently
from
232cd1b to
757d489
Compare
mangelajo
force-pushed
the
operator-bundle
branch
from
757d489 to
3c91135
Compare
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/check-bundle.yaml (1)
72-92: Timestamp filtering logic is pragmatic but has edge cases.The workflow attempts to distinguish between expected
createdAttimestamp changes and substantive changes using grep filtering (line 78). However, the regex pattern may have edge cases:
- The pattern
^[+-].*createdAt:.*[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Zcould potentially miss timestamps with different formatting.- The logic filters context lines (
^---|\+\+\+|@@|index|diff) but the subsequent check for^[+-]patterns might still catch unintended changes if they happen to match the pattern structure.Consider documenting the expected timestamp format more explicitly or validating this against actual
make bundleoutput to ensure it works reliably. Otherwise, developers might encounter mysterious CI failures.To test the robustness of the timestamp filtering, you could run
make bundlelocally and inspect the git diff output to ensure your regex patterns capture all expected timestamp-only changes.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
deploy/operator/dist/install.yamlis excluded by!**/dist/**
📒 Files selected for processing (18)
.github/workflows/build.yaml(1 hunks).github/workflows/check-bundle.yaml(1 hunks)api/v1alpha1/client_types.go(1 hunks)api/v1alpha1/exporter_types.go(1 hunks)api/v1alpha1/exporteraccesspolicy_types.go(1 hunks)deploy/helm/jumpstarter/crds/jumpstarter.dev_clients.yaml(1 hunks)deploy/helm/jumpstarter/crds/jumpstarter.dev_exporters.yaml(1 hunks)deploy/operator/Makefile(1 hunks)deploy/operator/api/v1alpha1/jumpstarter_types.go(1 hunks)deploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yaml(1 hunks)deploy/operator/bundle/manifests/jumpstarter.dev_clients.yaml(1 hunks)deploy/operator/bundle/manifests/jumpstarter.dev_exporters.yaml(1 hunks)deploy/operator/cmd/main.go(2 hunks)deploy/operator/config/crd/bases/jumpstarter.dev_clients.yaml(1 hunks)deploy/operator/config/crd/bases/jumpstarter.dev_exporters.yaml(1 hunks)deploy/operator/config/rbac/role.yaml(1 hunks)deploy/operator/internal/controller/jumpstarter/jumpstarter_controller.go(2 hunks)deploy/operator/test/e2e/e2e_test.go(1 hunks)
✅ Files skipped from review due to trivial changes (4)
- api/v1alpha1/exporteraccesspolicy_types.go
- api/v1alpha1/exporter_types.go
- api/v1alpha1/client_types.go
- deploy/operator/config/crd/bases/jumpstarter.dev_exporters.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
- deploy/operator/bundle/manifests/jumpstarter.dev_clients.yaml
🧰 Additional context used
🧠 Learnings (7)
📚 Learning: 2025-10-24T11:57:23.796Z
Learnt from: mangelajo
Repo: jumpstarter-dev/jumpstarter-controller PR: 170
File: deploy/operator/internal/controller/jumpstarter/jumpstarter_controller.go:328-333
Timestamp: 2025-10-24T11:57:23.796Z
Learning: In the jumpstarter-controller operator (deploy/operator/), the design allows only one Jumpstarter CR per namespace, which will be enforced by a validation webhook. This constraint eliminates concerns about resource name collisions within a namespace.
Applied to files:
.github/workflows/build.yamldeploy/operator/internal/controller/jumpstarter/jumpstarter_controller.godeploy/operator/bundle/manifests/jumpstarter.dev_exporters.yamldeploy/operator/api/v1alpha1/jumpstarter_types.godeploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yaml
📚 Learning: 2025-10-24T11:57:13.484Z
Learnt from: mangelajo
Repo: jumpstarter-dev/jumpstarter-controller PR: 170
File: deploy/operator/internal/controller/jumpstarter/rbac.go:193-196
Timestamp: 2025-10-24T11:57:13.484Z
Learning: In the Jumpstarter operator codebase (deploy/operator/internal/controller/jumpstarter/rbac.go), the Role created by `createRole()` defines RBAC permissions for the managed Jumpstarter controller application, not for the operator itself. The managed controller needs delete permissions on secrets for its runtime operations.
Applied to files:
deploy/operator/config/rbac/role.yamldeploy/operator/internal/controller/jumpstarter/jumpstarter_controller.godeploy/operator/api/v1alpha1/jumpstarter_types.godeploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yaml
📚 Learning: 2025-05-13T19:56:27.924Z
Learnt from: NickCao
Repo: jumpstarter-dev/jumpstarter-controller PR: 137
File: deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/router-deployment.yaml:23-26
Timestamp: 2025-05-13T19:56:27.924Z
Learning: In the jumpstarter-controller project, the router service uses the same ConfigMap as the controller service (controller-cm.yaml) even though it has been moved to its own separate deployment.
Applied to files:
deploy/operator/internal/controller/jumpstarter/jumpstarter_controller.go
📚 Learning: 2025-11-14T15:47:36.325Z
Learnt from: mangelajo
Repo: jumpstarter-dev/jumpstarter-controller PR: 190
File: api/v1alpha1/exporter_helpers.go:16-24
Timestamp: 2025-11-14T15:47:36.325Z
Learning: In the jumpstarter-controller project, migration annotations (jumpstarter.dev/migrated-namespace and jumpstarter.dev/migrated-uid) that override namespace and UID values in authentication tokens are acceptable without additional validation webhooks because the security model assumes only administrators have write access to Exporter and Client resources via K8s RBAC.
Applied to files:
deploy/operator/internal/controller/jumpstarter/jumpstarter_controller.godeploy/operator/bundle/manifests/jumpstarter.dev_exporters.yamldeploy/helm/jumpstarter/crds/jumpstarter.dev_exporters.yamldeploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yaml
📚 Learning: 2025-10-13T09:05:03.088Z
Learnt from: mangelajo
Repo: jumpstarter-dev/jumpstarter-controller PR: 169
File: deploy/operator/config/rbac/leader_election_role_binding.yaml:3-15
Timestamp: 2025-10-13T09:05:03.088Z
Learning: In Kubebuilder-generated Kubernetes operators, RBAC manifests (RoleBindings, Roles, etc.) under config/rbac/ typically do not include explicit `metadata.namespace` fields. The namespace is injected at build time by Kustomize via the `namespace` field in config/default/kustomization.yaml (or whichever kustomization file is used). This is intentional design to keep base manifests namespace-agnostic. Do not flag missing namespaces in such RBAC manifests as issues when they are part of a Kustomize-based operator deployment structure.
Applied to files:
deploy/operator/bundle/manifests/jumpstarter.dev_exporters.yaml
📚 Learning: 2025-05-13T19:57:56.811Z
Learnt from: NickCao
Repo: jumpstarter-dev/jumpstarter-controller PR: 137
File: hack/deploy_with_helm.sh:26-34
Timestamp: 2025-05-13T19:57:56.811Z
Learning: The jumpstarter-dev repository uses a custom kind cluster configuration that allows NodePort services to use non-standard ports 5080 and 5443, outside the default Kubernetes NodePort range (30000-32767).
Applied to files:
deploy/operator/api/v1alpha1/jumpstarter_types.godeploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yaml
📚 Learning: 2025-05-13T19:57:56.811Z
Learnt from: NickCao
Repo: jumpstarter-dev/jumpstarter-controller PR: 137
File: hack/deploy_with_helm.sh:26-34
Timestamp: 2025-05-13T19:57:56.811Z
Learning: The jumpstarter project uses a custom kind cluster configuration with an expanded NodePort range (3000-32767) and explicit port mappings for ingress (5080/5443) and gRPC services (30010/30011 mapped to 8082/8083).
Applied to files:
deploy/operator/api/v1alpha1/jumpstarter_types.godeploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yaml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (7)
- GitHub Check: tests
- GitHub Check: e2e-test-operator
- GitHub Check: deploy-kind
- GitHub Check: e2e-tests-release-0-7
- GitHub Check: e2e-tests (ubuntu-24.04)
- GitHub Check: e2e-tests (ubuntu-24.04-arm)
- GitHub Check: lint-go
🔇 Additional comments (19)
deploy/operator/api/v1alpha1/jumpstarter_types.go (1)
513-518: LGTM - Documentation improvement.The comment update improves clarity over the previous placeholder text. The empty struct is appropriate for a status field that will be expanded in future work.
deploy/operator/test/e2e/e2e_test.go (1)
125-125: LGTM! Cleaner timestamp formatting.The simplified call to
Format()directly onmetav1.Timeis more idiomatic than accessing.Timeexplicitly, and both produce identical output.deploy/operator/Makefile (1)
6-6: Version bump is clean and well-integrated.The change from 0.0.1 to 0.8.0 is straightforward and properly reflected throughout the Makefile via the VERSION variable. All dependent targets (BUNDLE_IMG, CATALOG_IMG, BUNDLE_GEN_FLAGS) will use this new version consistently.
.github/workflows/build.yaml (1)
29-31: Bundle image matrix entry is properly configured.The new bundle image entry follows the established pattern with correct context path (
deploy/operator) and dockerfile reference. Reuses the shared build step infrastructure cleanly without duplicating logic.deploy/operator/config/crd/bases/jumpstarter.dev_clients.yaml (1)
49-49: Schema description improved for clarity.The updated description provides clearer documentation of the credential field's purpose. This is a non-breaking improvement to the OpenAPI schema for better API documentation.
deploy/helm/jumpstarter/crds/jumpstarter.dev_clients.yaml (1)
49-49: Helm CRD in sync with operator CRD.This change mirrors the description update in the operator's CRD bases, maintaining consistency between Helm and operator-deployed instances.
.github/workflows/check-bundle.yaml (1)
94-97: Consider the order of operations: resetting after bundle validation.Line 97 (
git checkout -- .) resets all changes to ensure a clean state before building the installer. This is correct in sequence but ensure that the bundle generation in the previous step (line 70) doesn't produce any files that need to be committed before this reset. The current logic suggests bundle changes should already be committed, which is enforced by the check in lines 72-92.deploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yaml (5)
1-25: CSV metadata structure is complete.The ClusterServiceVersion metadata is well-formed with appropriate annotations for OLM (alm-examples, capabilities, builder info). The version 0.8.0 is consistent with the Makefile change.
28-46: CRD ownership declarations are properly specified.All owned CRDs (Client, ExporterAccessPolicy, Exporter, Jumpstarter, Lease) are declared with correct apiVersion/version and kind. This allows OLM to manage these CRDs as part of the operator installation lifecycle.
59-269: RBAC permissions are comprehensive.The clusterPermissions cover all required resource types: core Kubernetes resources (ConfigMaps, Secrets, Services), Jumpstarter custom resources, OpenShift Routes, authentication/authorization APIs, monitoring, and networking. The granular verb lists (create, read, update, delete) align with expected operator needs.
271-331: Deployment specification is well-configured.The deployment includes health probes (liveness/readiness), reasonable resource requests/limits (10m CPU/256Mi memory request, 500m/512Mi limit), security context (non-root, no privilege escalation, drop ALL capabilities), and proper service account binding. The 1 replica and 10-second termination grace period are appropriate for an operator.
367-375: Installation mode correctly restricted to AllNamespaces.The CSV restricts installation to AllNamespaces mode only, which is appropriate for an operator managing global resources like ClusterRoles and Routes. SingleNamespace and OwnNamespace modes are correctly marked as unsupported.
deploy/helm/jumpstarter/crds/jumpstarter.dev_exporters.yaml (1)
49-49: Helm and operator Exporter CRDs remain synchronized.The description update to "Exporter status fields" mirrors the change in the operator CRD bases, maintaining consistency across deployment methods.
deploy/operator/bundle/manifests/jumpstarter.dev_exporters.yaml (2)
1-50: Bundle Exporter CRD is well-formed and complete.The CRD properly defines the Exporter resource with comprehensive schema including conditions array, device tracking, credentials, and lease references. Status fields are properly structured with condition metadata (lastTransitionTime, message, reason, observedGeneration, type, status).
51-160: Condition and reference fields follow Kubernetes conventions.Condition items follow the standard Kubernetes condition pattern with required fields and proper constraints (maxLength, pattern, enum values). LocalObjectReferences for credential and leaseRef use atomic map-type convention and include proper defaults/validation.
deploy/operator/config/rbac/role.yaml (1)
187-195: LGTM! RBAC permissions align with controller annotations.The new
routes/custom-hostpermissions correctly match the kubebuilder RBAC annotation indeploy/operator/internal/controller/jumpstarter/jumpstarter_controller.goat line 87, ensuring consistency between the generated role and controller requirements.deploy/operator/internal/controller/jumpstarter/jumpstarter_controller.go (2)
87-87: LGTM! RBAC annotation correctly defines routes/custom-host permissions.The annotation generates the corresponding RBAC rule in
deploy/operator/config/rbac/role.yaml(lines 187-195) with matching verbs.
873-873: Fix required: Validation webhook must be implemented and enabled before using fixed ConfigMap name.The ConfigMap name change from dynamic (
fmt.Sprintf("%s-controller", jumpstarter.Name)) to fixed ("jumpstarter-controller") assumes only one Jumpstarter CR per namespace. However, verification shows the validation webhook is currently disabled indeploy/operator/config/default/kustomization.yaml(webhook sections are commented out) and not implemented in the codebase.If multiple Jumpstarter CRs are created in the same namespace before the webhook is enabled, the second CR will fail permanently during reconciliation at
SetControllerReference()because the ConfigMap is already owned by the first CR. This creates a blocking failure with no recovery path short of deleting the first CR.Required actions:
- Implement the Jumpstarter validation webhook to enforce max 1 CR per namespace, OR
- Add a controller-level guard to detect and reject multiple CRs with a clear error message, OR
- Revert to dynamic ConfigMap naming until the webhook is production-ready
Add an explanatory comment if proceeding:
// Name is fixed to "jumpstarter-controller" assuming only one Jumpstarter CR // per namespace, enforced by a validation webhook (currently in progress). // TODO: Validate webhook is deployed before enabling in production. Name: "jumpstarter-controller",⛔ Skipped due to learnings
Learnt from: mangelajo Repo: jumpstarter-dev/jumpstarter-controller PR: 170 File: deploy/operator/internal/controller/jumpstarter/jumpstarter_controller.go:328-333 Timestamp: 2025-10-24T11:57:23.796Z Learning: In the jumpstarter-controller operator (deploy/operator/), the design allows only one Jumpstarter CR per namespace, which will be enforced by a validation webhook. This constraint eliminates concerns about resource name collisions within a namespace.Learnt from: mangelajo Repo: jumpstarter-dev/jumpstarter-controller PR: 190 File: api/v1alpha1/exporter_helpers.go:16-24 Timestamp: 2025-11-14T15:47:36.325Z Learning: In the jumpstarter-controller project, migration annotations (jumpstarter.dev/migrated-namespace and jumpstarter.dev/migrated-uid) that override namespace and UID values in authentication tokens are acceptable without additional validation webhooks because the security model assumes only administrators have write access to Exporter and Client resources via K8s RBAC.Learnt from: NickCao Repo: jumpstarter-dev/jumpstarter-controller PR: 137 File: deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/router-deployment.yaml:23-26 Timestamp: 2025-05-13T19:56:27.924Z Learning: In the jumpstarter-controller project, the router service uses the same ConfigMap as the controller service (controller-cm.yaml) even though it has been moved to its own separate deployment.Learnt from: NickCao Repo: jumpstarter-dev/jumpstarter-controller PR: 101 File: internal/controller/client_controller_test.go:152-152 Timestamp: 2025-02-17T20:31:08.553Z Learning: In the jumpstarter-controller repository, the `TokenKey` constant is defined within the `internal/controller` package and is accessible to all files within the same package.Learnt from: NickCao Repo: jumpstarter-dev/jumpstarter-controller PR: 101 File: internal/controller/client_controller_test.go:152-152 Timestamp: 2025-02-17T20:31:08.553Z Learning: In the jumpstarter-controller repository, the `TokenKey` constant is defined in `internal/controller/secret_helpers.go` as `const TokenKey string = "token"` and is used across the controller package for managing secret data.deploy/operator/cmd/main.go (1)
62-63: No action required—operator properly handles multi-platform scenarios.The code correctly manages Route API availability through runtime discovery. While the Route API is registered unconditionally in the scheme (line 63,
main.go), this is safe—scheme registration only adds type metadata and doesn't validate API existence. The actual Route operations are conditional: the reconciler usesdiscoverAPIResource()to detect the Route API at initialization, andcreateRouteForEndpoint()checksr.RouteAvailablebefore attempting any Route creation (line 82). When unavailable, it gracefully returnsnil, allowing the operator to function on both OpenShift and vanilla Kubernetes clusters. No changes needed.
mangelajo
force-pushed
the
operator-bundle
branch
3 times, most recently
from
51406fc to
fe81344
Compare
bkhizgiy
left a comment
bkhizgiy
left a comment
There was a problem hiding this comment.
looking good overall, just a few nitpicking comments.
| - framework | ||
| links: | ||
| - name: Jumpstarter Operator | ||
| url: https://jumpstarter-operator.domain |
There was a problem hiding this comment.
I guess it's a placeholder for now, need to remember to change it later
There was a problem hiding this comment.
Oh, I thought I had updated this one, good catch!
| @@ -0,0 +1,10 @@ | |||
| apiVersion: rbac.authorization.k8s.io/v1 | |||
| kind: ClusterRole | |||
| metadata: | |||
There was a problem hiding this comment.
missing labels, I think it will be better to include them for easier cleanup/consistency with other roles.
mangelajo
force-pushed
the
operator-bundle
branch
from
fe81344 to
266f4d9
Compare
mangelajo
force-pushed
the
operator-bundle
branch
from
266f4d9 to
203c786
Compare
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (1)
deploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yaml (1)
299-299: Acknowledge: Image tag "latest" pending release-time update.The image still uses the
latesttag. As previously noted, this will be updated to a specific version (v0.8.0) at release time—ensure this is included in your release checklist to avoid unpredictable behavior in production deployments.Also applies to: 299-299
🧹 Nitpick comments (4)
.github/workflows/check-bundle.yaml (3)
32-45: Unreachable code branch: the event_name check is unnecessary.This workflow only triggers on
pull_requestevents (lines 3-6), so the else branch at lines 42-44 will never execute. The event_name check can be removed for clarity.- - name: Get version + - name: Determine TAG from base branch run: | - if [ "${{ github.event_name }}" == "pull_request" ]; then - BASE_BRANCH="${{ github.base_ref }}" - if [ "$BASE_BRANCH" == "main" ]; then - TAG="latest" - elif [[ "$BASE_BRANCH" =~ ^release- ]]; then - TAG="$BASE_BRANCH" - else - echo "::error::Unknown base branch: $BASE_BRANCH" - exit 1 - fi - else - echo "::error::Unsupported event: ${{ github.event_name }}" - exit 1 - fi + BASE_BRANCH="${{ github.base_ref }}" + if [ "$BASE_BRANCH" == "main" ]; then + TAG="latest" + elif [[ "$BASE_BRANCH" =~ ^release- ]]; then + TAG="$BASE_BRANCH" + else + echo "::error::Unknown base branch: $BASE_BRANCH" + exit 1 + fi echo "TAG=${TAG}" >> $GITHUB_ENV echo "TAG=${TAG}"
54-73: Timestamp filtering logic is fragile and assumes specific field names and formats.The workflow filters out timestamp-only changes by looking for lines containing
createdAt:followed by ISO 8601 timestamps. This approach is brittle:
- If the bundle generation tool changes the field name (e.g., to
generatedAtortimestamp), the filter will miss it.- If the timestamp format changes from ISO 8601, the filter will fail.
- If there are other auto-generated fields besides
createdAtthat should be ignored, they won't be filtered.Consider documenting why these specific timestamps are expected, or adopt a more robust approach (e.g., regenerating and comparing only semantically significant manifest content, or using a tool-specific option to suppress timestamp generation).
75-78: Silently suppressing git errors could hide real problems.The
|| trueon line 78 suppresses errors fromgit checkout, which could hide legitimate issues like file permission problems or corruption. Consider handling errors more explicitly, or add a comment explaining why silent suppression is acceptable here.- name: Ensure clean state before build-installer run: | - # Reset any remaining changes from root - git checkout -- . || true + # Reset any remaining changes from root (timestamp changes only, already logged) + git checkout -- .deploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yaml (1)
54-56: Empty icon metadata should be populated before release.The icon
base64dataandmediatypeare empty placeholders. While acceptable for development, consider populating these with an actual icon for the final v0.8.0 release to improve the OLM catalog appearance.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
.github/workflows/build.yaml(1 hunks).github/workflows/check-bundle.yaml(1 hunks)deploy/operator/bundle/manifests/jumpstarter-operator-metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml(1 hunks)deploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yaml(1 hunks)
🧰 Additional context used
🧠 Learnings (6)
📚 Learning: 2025-10-24T11:57:23.796Z
Learnt from: mangelajo
Repo: jumpstarter-dev/jumpstarter-controller PR: 170
File: deploy/operator/internal/controller/jumpstarter/jumpstarter_controller.go:328-333
Timestamp: 2025-10-24T11:57:23.796Z
Learning: In the jumpstarter-controller operator (deploy/operator/), the design allows only one Jumpstarter CR per namespace, which will be enforced by a validation webhook. This constraint eliminates concerns about resource name collisions within a namespace.
Applied to files:
.github/workflows/build.yamldeploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yamldeploy/operator/bundle/manifests/jumpstarter-operator-metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml
📚 Learning: 2025-10-24T11:57:13.484Z
Learnt from: mangelajo
Repo: jumpstarter-dev/jumpstarter-controller PR: 170
File: deploy/operator/internal/controller/jumpstarter/rbac.go:193-196
Timestamp: 2025-10-24T11:57:13.484Z
Learning: In the Jumpstarter operator codebase (deploy/operator/internal/controller/jumpstarter/rbac.go), the Role created by `createRole()` defines RBAC permissions for the managed Jumpstarter controller application, not for the operator itself. The managed controller needs delete permissions on secrets for its runtime operations.
Applied to files:
deploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yamldeploy/operator/bundle/manifests/jumpstarter-operator-metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml
📚 Learning: 2025-05-13T19:57:56.811Z
Learnt from: NickCao
Repo: jumpstarter-dev/jumpstarter-controller PR: 137
File: hack/deploy_with_helm.sh:26-34
Timestamp: 2025-05-13T19:57:56.811Z
Learning: The jumpstarter-dev repository uses a custom kind cluster configuration that allows NodePort services to use non-standard ports 5080 and 5443, outside the default Kubernetes NodePort range (30000-32767).
Applied to files:
deploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yaml
📚 Learning: 2025-05-13T19:57:56.811Z
Learnt from: NickCao
Repo: jumpstarter-dev/jumpstarter-controller PR: 137
File: hack/deploy_with_helm.sh:26-34
Timestamp: 2025-05-13T19:57:56.811Z
Learning: The jumpstarter project uses a custom kind cluster configuration with an expanded NodePort range (3000-32767) and explicit port mappings for ingress (5080/5443) and gRPC services (30010/30011 mapped to 8082/8083).
Applied to files:
deploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yaml
📚 Learning: 2025-11-14T15:47:36.325Z
Learnt from: mangelajo
Repo: jumpstarter-dev/jumpstarter-controller PR: 190
File: api/v1alpha1/exporter_helpers.go:16-24
Timestamp: 2025-11-14T15:47:36.325Z
Learning: In the jumpstarter-controller project, migration annotations (jumpstarter.dev/migrated-namespace and jumpstarter.dev/migrated-uid) that override namespace and UID values in authentication tokens are acceptable without additional validation webhooks because the security model assumes only administrators have write access to Exporter and Client resources via K8s RBAC.
Applied to files:
deploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yaml
📚 Learning: 2025-10-13T09:05:03.088Z
Learnt from: mangelajo
Repo: jumpstarter-dev/jumpstarter-controller PR: 169
File: deploy/operator/config/rbac/leader_election_role_binding.yaml:3-15
Timestamp: 2025-10-13T09:05:03.088Z
Learning: In Kubebuilder-generated Kubernetes operators, RBAC manifests (RoleBindings, Roles, etc.) under config/rbac/ typically do not include explicit `metadata.namespace` fields. The namespace is injected at build time by Kustomize via the `namespace` field in config/default/kustomization.yaml (or whichever kustomization file is used). This is intentional design to keep base manifests namespace-agnostic. Do not flag missing namespaces in such RBAC manifests as issues when they are part of a Kustomize-based operator deployment structure.
Applied to files:
deploy/operator/bundle/manifests/jumpstarter-operator-metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: e2e-test-operator
- GitHub Check: e2e-tests (ubuntu-24.04)
- GitHub Check: e2e-tests (ubuntu-24.04-arm)
- GitHub Check: e2e-tests-release-0-7
🔇 Additional comments (6)
.github/workflows/build.yaml (1)
29-31: Bundle image build matrix entry is well-integrated.The new entry correctly adds the operator bundle to the existing CI/CD pipeline. It follows the established pattern, reuses the versioning and tagging logic for all matrix entries, and will build multi-platform images alongside the controller and operator.
deploy/operator/bundle/manifests/jumpstarter-operator-metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml (1)
1-13: ClusterRole manifest is well-formed with appropriate labels.The manifest correctly defines a metrics reader role for the operator. Labels are properly included (addressing the previous feedback about consistency), and the rule correctly grants GET access to the
/metricsendpoint for monitoring integration.deploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yaml (4)
384-393: Documentation link and operator metadata look good.The link has been updated from the placeholder to a real documentation URL, and operator metadata (maintainer, provider, keywords) are properly configured.
59-269: RBAC permissions are comprehensive and well-structured.The ClusterPermissions cover all required resources:
- Standard Kubernetes resources (services, configmaps, secrets, deployments, leases)
- Custom Jumpstarter API groups (clients, exporters, leases, exporteraccesspolicies)
- OpenShift routes with appropriate scoping (routes/custom-host subset is correctly restricted)
- Monitoring and networking resources
- Authentication/authorization subresources (tokenreviews, subjectaccessreviews)
The permissions align with the operator's responsibilities and the managed Jumpstarter controller's needs (e.g., secret deletion for runtime operations).
Also applies to: 332-365
321-330: Security context and resource configuration is well-hardened.Security settings are appropriate:
- Non-root user (
runAsNonRoot: true)- SecComp profile set to
RuntimeDefault- No privilege escalation allowed
- Resource limits (500m/512Mi) and requests (10m/256Mi) are reasonable
374-375: Install mode correctly limited to AllNamespaces.Only
AllNamespacesis supported, which aligns with the operator managing cluster-wide Jumpstarter resources and enforcing single-instance-per-namespace constraints (per learnings on validation webhook enforcement).
mangelajo
force-pushed
the
operator-bundle
branch
from
203c786 to
e4c4bd4
Compare
TODO:
Summary by CodeRabbit
New Features
Chores
✏️ Tip: You can customize this high-level summary in your review settings.