Repository navigation
feat(olm): add kustomize overlay for the OLM bundle manifests - #1202
Open
GabriFedi97 wants to merge 6 commits into
Open
GabriFedi97 wants to merge 6 commits into
GabriFedi97 wants to merge 6 commits into
Conversation
NiccoloFei
approved these changes
Oct 28, 2026
GabriFedi97
force-pushed
the
dev/1194
branch
2 times, most recently
from
October 30, 2026 15:41
f007854 to
22fe44e
Compare
Render the plugin manifests for the OLM bundle without cert-manager: the TLS secret volumes are optional and the plugin, sidecar and CSV images are set from templates rendered by the olm:kustomization-patches task. The bundle also ships a scorecard configuration, whose test images are kept up to date by Renovate. Assisted-by: Claude Opus 5.5 Signed-off-by: Gabriele Fedi <gabriele.fedi@enterprisedb.com>
Signed-off-by: Niccolò Fei <niccolo.fei@enterprisedb.com>
The OLM bundle no longer mounts the plugin TLS secrets into the deployment, so users can supply the certificates through the Subscription with any volume type. The cert-manager resources are no longer stripped from the bundle manifests. Assisted-by: Claude Opus 5.5 Signed-off-by: Gabriele Fedi <gabriele.fedi@enterprisedb.com>
Signed-off-by: Gabriele Fedi <gabriele.fedi@enterprisedb.com>
The CSV description now explains that users must create the barman-cloud-server-tls and barman-cloud-client-tls Secrets in the CloudNativePG namespace and mount them through the Subscription config. It no longer lists cert-manager as a requirement. Assisted-by: Claude Opus 5.5 Signed-off-by: Gabriele Fedi <gabriele.fedi@enterprisedb.com>
The bundle again mounts barman-cloud-server-tls and barman-cloud-client-tls as optional Secret volumes, and the CSV only asks users to create those Secrets, recommending cert-manager. A generic certificate volume set through the Subscription isn't supported yet: CloudNativePG always reads the mTLS material from the Kubernetes TLS Secrets named in the plugin Service annotations, in its own namespace. The plugin must therefore use those same Secrets, so any other volume source would only duplicate them. Signed-off-by: Gabriele Fedi <gabriele.fedi@enterprisedb.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the kustomize overlay that renders the plugin manifests for the OLM bundle (
config/olm), plus a scorecard configuration (config/scorecard).The overlay includes:
cert-managerresources and the sidecar imageSecret, which an OLM bundle can't use.olm:kustomization-patches PLUGIN_IMAGE=… SIDECAR_IMAGE=…into the git-ignored config/olm/generated/. The CSV containerImage is copied from the Deployment image with a kustomize replacement.RELATED_IMAGE_SIDECAR, so it's listed in the CSV relatedImages and pinned with--use-image-digests.Closes #1194