NO-ISSUE: Synchronize From Upstream Repositories

.goreleaser.yml

@@ -45,6 +45,7 @@ dockers:
     use: buildx
     build_flag_templates:
       - "--platform=linux/amd64"
+      - "--provenance=false"
   - image_templates:
       - "{{ .Env.OPCON_IMAGE_REPO }}:{{ .Env.IMAGE_TAG }}-arm64"
     dockerfile: Dockerfile.operator-controller
@@ -53,6 +54,7 @@ dockers:
     use: buildx
     build_flag_templates:
       - "--platform=linux/arm64"
+      - "--provenance=false"
   - image_templates:
       - "{{ .Env.OPCON_IMAGE_REPO }}:{{ .Env.IMAGE_TAG }}-ppc64le"
     dockerfile: Dockerfile.operator-controller
@@ -61,6 +63,7 @@ dockers:
     use: buildx
     build_flag_templates:
       - "--platform=linux/ppc64le"
+      - "--provenance=false"
   - image_templates:
       - "{{ .Env.OPCON_IMAGE_REPO }}:{{ .Env.IMAGE_TAG }}-s390x"
     dockerfile: Dockerfile.operator-controller
@@ -69,6 +72,7 @@ dockers:
     use: buildx
     build_flag_templates:
       - "--platform=linux/s390x"
+      - "--provenance=false"
   - image_templates:
       - "{{ .Env.CATD_IMAGE_REPO }}:{{ .Env.IMAGE_TAG }}-amd64"
     dockerfile: Dockerfile.catalogd
@@ -77,6 +81,7 @@ dockers:
     use: buildx
     build_flag_templates:
       - "--platform=linux/amd64"
+      - "--provenance=false"
   - image_templates:
       - "{{ .Env.CATD_IMAGE_REPO }}:{{ .Env.IMAGE_TAG }}-arm64"
     dockerfile: Dockerfile.catalogd
@@ -85,6 +90,7 @@ dockers:
     use: buildx
     build_flag_templates:
       - "--platform=linux/arm64"
+      - "--provenance=false"
   - image_templates:
       - "{{ .Env.CATD_IMAGE_REPO }}:{{ .Env.IMAGE_TAG }}-ppc64le"
     dockerfile: Dockerfile.catalogd
@@ -93,6 +99,7 @@ dockers:
     use: buildx
     build_flag_templates:
       - "--platform=linux/ppc64le"
+      - "--provenance=false"
   - image_templates:
       - "{{ .Env.CATD_IMAGE_REPO }}:{{ .Env.IMAGE_TAG }}-s390x"
     dockerfile: Dockerfile.catalogd
@@ -101,6 +108,7 @@ dockers:
     use: buildx
     build_flag_templates:
       - "--platform=linux/s390x"
+      - "--provenance=false"
 docker_manifests:
   - name_template: "{{ .Env.OPCON_IMAGE_REPO }}:{{ .Env.IMAGE_TAG }}"
     image_templates:

api/v1/clusterextensionrevision_types.go

@@ -105,6 +105,19 @@ type ClusterExtensionRevisionSpec struct {
 	// +optional
 	// <opcon:experimental>
 	ProgressDeadlineMinutes int32 `json:"progressDeadlineMinutes,omitempty"`
+
+	// collisionProtection specifies the default collision protection strategy for all objects
+	// in this revision. Individual phases or objects can override this value.
+	//
+	// When set, this value is used as the default for any phase or object that does not
+	// explicitly specify its own collisionProtection.
+	//
+	// The resolution order is: object > phase > spec
+	//
+	// +required
+	// +kubebuilder:validation:Enum=Prevent;IfNoController;None
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="collisionProtection is immutable"
+	CollisionProtection CollisionProtection `json:"collisionProtection,omitempty"`
 }
 
 // ClusterExtensionRevisionLifecycleState specifies the lifecycle state of the ClusterExtensionRevision.
@@ -144,6 +157,19 @@ type ClusterExtensionRevisionPhase struct {
 	// +required
 	// +kubebuilder:validation:MaxItems=50
 	Objects []ClusterExtensionRevisionObject `json:"objects"`
+
+	// collisionProtection specifies the default collision protection strategy for all objects
+	// in this phase. Individual objects can override this value.
+	//
+	// When set, this value is used as the default for any object in this phase that does not
+	// explicitly specify its own collisionProtection.
+	//
+	// When omitted, we use .spec.collistionProtection as the default for any object in this phase that does not
+	// explicitly specify its own collisionProtection.
+	//
+	// +optional
+	// +kubebuilder:validation:Enum=Prevent;IfNoController;None
+	CollisionProtection CollisionProtection `json:"collisionProtection,omitempty"`
 }
 
 // ClusterExtensionRevisionObject represents a Kubernetes object to be applied as part
@@ -174,7 +200,9 @@ type ClusterExtensionRevisionObject struct {
 	// Use this setting with extreme caution as it may cause multiple controllers to fight over
 	// the same resource, resulting in increased load on the API server and etcd.
 	//
-	// +required
+	// When omitted, the value is inherited from the phase, then spec.
+	//
+	// +optional
 	// +kubebuilder:validation:Enum=Prevent;IfNoController;None
 	CollisionProtection CollisionProtection `json:"collisionProtection,omitempty"`
 }

api/v1/clusterextensionrevision_types_test.go

@@ -8,6 +8,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 )
 
 func TestClusterExtensionRevisionImmutability(t *testing.T) {
@@ -21,18 +22,20 @@ func TestClusterExtensionRevisionImmutability(t *testing.T) {
 	}{
 		"revision is immutable": {
 			spec: ClusterExtensionRevisionSpec{
-				LifecycleState: ClusterExtensionRevisionLifecycleStateActive,
-				Revision:       1,
+				LifecycleState:      ClusterExtensionRevisionLifecycleStateActive,
+				Revision:            1,
+				CollisionProtection: CollisionProtectionPrevent,
 			},
 			updateFunc: func(cer *ClusterExtensionRevision) {
 				cer.Spec.Revision = 2
 			},
 		},
 		"phases may be initially empty": {
 			spec: ClusterExtensionRevisionSpec{
-				LifecycleState: ClusterExtensionRevisionLifecycleStateActive,
-				Revision:       1,
-				Phases:         []ClusterExtensionRevisionPhase{},
+				LifecycleState:      ClusterExtensionRevisionLifecycleStateActive,
+				Revision:            1,
+				CollisionProtection: CollisionProtectionPrevent,
+				Phases:              []ClusterExtensionRevisionPhase{},
 			},
 			updateFunc: func(cer *ClusterExtensionRevision) {
 				cer.Spec.Phases = []ClusterExtensionRevisionPhase{
@@ -46,8 +49,9 @@ func TestClusterExtensionRevisionImmutability(t *testing.T) {
 		},
 		"phases may be initially unset": {
 			spec: ClusterExtensionRevisionSpec{
-				LifecycleState: ClusterExtensionRevisionLifecycleStateActive,
-				Revision:       1,
+				LifecycleState:      ClusterExtensionRevisionLifecycleStateActive,
+				Revision:            1,
+				CollisionProtection: CollisionProtectionPrevent,
 			},
 			updateFunc: func(cer *ClusterExtensionRevision) {
 				cer.Spec.Phases = []ClusterExtensionRevisionPhase{
@@ -61,8 +65,9 @@ func TestClusterExtensionRevisionImmutability(t *testing.T) {
 		},
 		"phases are immutable if not empty": {
 			spec: ClusterExtensionRevisionSpec{
-				LifecycleState: ClusterExtensionRevisionLifecycleStateActive,
-				Revision:       1,
+				LifecycleState:      ClusterExtensionRevisionLifecycleStateActive,
+				Revision:            1,
+				CollisionProtection: CollisionProtectionPrevent,
 				Phases: []ClusterExtensionRevisionPhase{
 					{
 						Name:    "foo",
@@ -79,6 +84,16 @@ func TestClusterExtensionRevisionImmutability(t *testing.T) {
 				}
 			},
 		},
+		"spec collisionProtection is immutable": {
+			spec: ClusterExtensionRevisionSpec{
+				LifecycleState:      ClusterExtensionRevisionLifecycleStateActive,
+				Revision:            1,
+				CollisionProtection: CollisionProtectionPrevent,
+			},
+			updateFunc: func(cer *ClusterExtensionRevision) {
+				cer.Spec.CollisionProtection = CollisionProtectionNone
+			},
+		},
 	} {
 		t.Run(name, func(t *testing.T) {
 			cer := &ClusterExtensionRevision{
@@ -124,8 +139,9 @@ func TestClusterExtensionRevisionValidity(t *testing.T) {
 		},
 		"revision must be positive": {
 			spec: ClusterExtensionRevisionSpec{
-				LifecycleState: ClusterExtensionRevisionLifecycleStateActive,
-				Revision:       1,
+				LifecycleState:      ClusterExtensionRevisionLifecycleStateActive,
+				Revision:            1,
+				CollisionProtection: CollisionProtectionPrevent,
 			},
 			valid: true,
 		},
@@ -192,6 +208,70 @@ func TestClusterExtensionRevisionValidity(t *testing.T) {
 			},
 			valid: false,
 		},
+		"spec collisionProtection accepts Prevent": {
+			spec: ClusterExtensionRevisionSpec{
+				LifecycleState:      ClusterExtensionRevisionLifecycleStateActive,
+				Revision:            1,
+				CollisionProtection: CollisionProtectionPrevent,
+			},
+			valid: true,
+		},
+		"spec collisionProtection accepts IfNoController": {
+			spec: ClusterExtensionRevisionSpec{
+				LifecycleState:      ClusterExtensionRevisionLifecycleStateActive,
+				Revision:            1,
+				CollisionProtection: CollisionProtectionIfNoController,
+			},
+			valid: true,
+		},
+		"spec collisionProtection accepts None": {
+			spec: ClusterExtensionRevisionSpec{
+				LifecycleState:      ClusterExtensionRevisionLifecycleStateActive,
+				Revision:            1,
+				CollisionProtection: CollisionProtectionNone,
+			},
+			valid: true,
+		},
+		"spec collisionProtection is required": {
+			spec: ClusterExtensionRevisionSpec{
+				LifecycleState: ClusterExtensionRevisionLifecycleStateActive,
+				Revision:       1,
+			},
+			valid: false,
+		},
+		"spec collisionProtection rejects invalid values": {
+			spec: ClusterExtensionRevisionSpec{
+				LifecycleState:      ClusterExtensionRevisionLifecycleStateActive,
+				Revision:            1,
+				CollisionProtection: CollisionProtection("Invalid"),
+			},
+			valid: false,
+		},
+		"spec collisionProtection must be set": {
+			spec: ClusterExtensionRevisionSpec{
+				LifecycleState: ClusterExtensionRevisionLifecycleStateActive,
+				Revision:       1,
+			},
+			valid: false,
+		},
+		"object collisionProtection is optional": {
+			spec: ClusterExtensionRevisionSpec{
+				LifecycleState:      ClusterExtensionRevisionLifecycleStateActive,
+				Revision:            1,
+				CollisionProtection: CollisionProtectionPrevent,
+				Phases: []ClusterExtensionRevisionPhase{
+					{
+						Name: "deploy",
+						Objects: []ClusterExtensionRevisionObject{
+							{
+								Object: configMap(),
+							},
+						},
+					},
+				},
+			},
+			valid: true,
+		},
 	} {
 		t.Run(name, func(t *testing.T) {
 			cer := &ClusterExtensionRevision{
@@ -211,3 +291,15 @@ func TestClusterExtensionRevisionValidity(t *testing.T) {
 		})
 	}
 }
+
+func configMap() unstructured.Unstructured {
+	return unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "ConfigMap",
+			"metadata": map[string]interface{}{
+				"name": "test-cm",
+			},
+		},
+	}
+}

api/v1/validation_test.go

@@ -36,6 +36,7 @@ func TestValidate(t *testing.T) {
 	}
 	defaultRevisionSpec := func(s *ClusterExtensionRevisionSpec) *ClusterExtensionRevisionSpec {
 		s.Revision = 1
+		s.CollisionProtection = CollisionProtectionPrevent
 		return s
 	}
 	c := newClient(t)

commitchecker.yaml

@@ -1,4 +1,4 @@
-expectedMergeBase: fb28936f0227ad129151ce04f53598cc08e1b96e
+expectedMergeBase: 1ef820f0ca56126586fca2dc7a422c71edd7deef
 upstreamBranch: main
 upstreamOrg: operator-framework
 upstreamRepo: operator-controller

helm/olmv1/base/operator-controller/crd/experimental/olm.operatorframework.io_clusterextensionrevisions.yaml

@@ -56,6 +56,23 @@ spec:
           spec:
             description: spec defines the desired state of the ClusterExtensionRevision.
             properties:
+              collisionProtection:
+                description: |-
+                  collisionProtection specifies the default collision protection strategy for all objects
+                  in this revision. Individual phases or objects can override this value.
+
+                  When set, this value is used as the default for any phase or object that does not
+                  explicitly specify its own collisionProtection.
+
+                  The resolution order is: object > phase > spec
+                enum:
+                - Prevent
+                - IfNoController
+                - None
+                type: string
+                x-kubernetes-validations:
+                - message: collisionProtection is immutable
+                  rule: self == oldSelf
               lifecycleState:
                 description: |-
                   lifecycleState specifies the lifecycle state of the ClusterExtensionRevision.
@@ -102,6 +119,21 @@ spec:
                     ClusterExtensionRevisionPhase represents a group of objects that are applied together. The phase is considered
                     complete only after all objects pass their status probes.
                   properties:
+                    collisionProtection:
+                      description: |-
+                        collisionProtection specifies the default collision protection strategy for all objects
+                        in this phase. Individual objects can override this value.
+
+                        When set, this value is used as the default for any object in this phase that does not
+                        explicitly specify its own collisionProtection.
+
+                        When omitted, we use .spec.collistionProtection as the default for any object in this phase that does not
+                        explicitly specify its own collisionProtection.
+                      enum:
+                      - Prevent
+                      - IfNoController
+                      - None
+                      type: string
                     name:
                       description: |-
                         name is a required identifier for this phase.
@@ -149,6 +181,8 @@ spec:
                               owned by another controller.
                               Use this setting with extreme caution as it may cause multiple controllers to fight over
                               the same resource, resulting in increased load on the API server and etcd.
+
+                              When omitted, the value is inherited from the phase, then spec.
                             enum:
                             - Prevent
                             - IfNoController
@@ -163,7 +197,6 @@ spec:
                             x-kubernetes-embedded-resource: true
                             x-kubernetes-preserve-unknown-fields: true
                         required:
-                        - collisionProtection
                         - object
                         type: object
                       maxItems: 50
@@ -205,6 +238,7 @@ spec:
                 - message: revision is immutable
                   rule: self == oldSelf
             required:
+            - collisionProtection
             - lifecycleState
             - revision
             type: object

helm/olmv1/templates/rbac/role-olmv1-system-metrics-monitor-role.yml

@@ -21,5 +21,13 @@ rules:
       - get
       - list
       - watch
+  - apiGroups:
+      - discovery.k8s.io
+    resources:
+      - endpointslices
+    verbs:
+      - get
+      - list
+      - watch
 {{- end -}}
 {{- end -}}

helm/olmv1/templates/servicemonitor-olmv1-system-metrics-monitor.yml

@@ -29,5 +29,6 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ include "olmv1.label.name" . }}
+  serviceDiscoveryRole: EndpointSlice
 {{- end -}}
 {{- end -}}