Upgrade to Operator SDK 1.41.1

This commit upgrades the ovn-operator to use Operator SDK version 1.41.1,
with the following major changes:

Project Structure:
- Move pkg/ packages to internal/ following Go best practices
- Move controllers/ to internal/controller/ per new operator-sdk layout
- Replace main.go with cmd/main.go
- Add controller and webhook test suites

Configuration Updates:
- Split certificate management into separate metrics and webhook certs
- Add network policies for metrics and webhook traffic
- Rename auth_proxy resources to metrics for clarity
- Add admin RBAC roles for all CRD types
- Update manager deployment configuration and patches
- Modernize kustomization configurations

Webhook Changes:
- Add dedicated webhook implementation in internal/webhook/v1beta1/
- Remove old CRD webhook and CA injection patches
- Update webhook manifests and service configuration

Cleanup:
- Remove obsolete config patches and overlays

Dependencies:
- Update go.mod and go.sum for operator-sdk 1.41.1 dependencies

Jira: OSPRH-22013

Assisted-by: claude-4-sonnet
Signed-off-by: Martin Schuppert <[email protected]>

Author: stuggi

.ci-operator.yaml

@@ -1,4 +1,4 @@
 build_root_image:
   name: tools
   namespace: openstack-k8s-operators
-  tag: ci-build-root-golang-1.24-sdk-1.31
+  tag: ci-build-root-golang-1.24-sdk-1.41.1

.github/workflows/build-swift-operator.yaml

@@ -16,7 +16,7 @@ jobs:
     with:
       operator_name: swift
       go_version: 1.24.x
-      operator_sdk_version: 1.31.0
+      operator_sdk_version: 1.41.1
     secrets:
       IMAGENAMESPACE: ${{ secrets.IMAGENAMESPACE }}
       QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}

.github/workflows/force-bump-pr-manual.yaml

@@ -9,6 +9,6 @@ jobs:
     with:
       operator_name: swift
       branch_name: ${{ github.ref_name }}
-      custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.31
+      custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.41.1
     secrets:
       FORCE_BUMP_PULL_REQUEST_PAT: ${{ secrets.FORCE_BUMP_PULL_REQUEST_PAT }}

.github/workflows/force-bump-pr-scheduled.yaml

@@ -10,6 +10,6 @@ jobs:
     uses: openstack-k8s-operators/openstack-k8s-operators-ci/.github/workflows/force-bump-branches.yaml@main
     with:
       operator_name: swift
-      custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.31
+      custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.41.1
     secrets:
       FORCE_BUMP_PULL_REQUEST_PAT: ${{ secrets.FORCE_BUMP_PULL_REQUEST_PAT }}

Dockerfile

@@ -29,7 +29,7 @@ RUN mkdir -p ${DEST_ROOT}/usr/local/bin/
 RUN if [ ! -f $CACHITO_ENV_FILE ]; then go mod download ; fi
 
 # Build manager
-RUN if [ -f $CACHITO_ENV_FILE ] ; then source $CACHITO_ENV_FILE ; fi ; env ${GO_BUILD_EXTRA_ENV_ARGS} go build ${GO_BUILD_EXTRA_ARGS} -a -o ${DEST_ROOT}/manager main.go
+RUN if [ -f $CACHITO_ENV_FILE ] ; then source $CACHITO_ENV_FILE ; fi ; env ${GO_BUILD_EXTRA_ENV_ARGS} go build ${GO_BUILD_EXTRA_ARGS} -a -o ${DEST_ROOT}/manager cmd/main.go
 
 RUN cp -r templates ${DEST_ROOT}/templates
 

Makefile

@@ -48,7 +48,7 @@ endif
 
 # Set the Operator SDK version to use. By default, what is installed on the system is used.
 # This is useful for CI or a project to utilize a specific version of the operator-sdk toolkit.
-OPERATOR_SDK_VERSION ?= v1.31.0
+OPERATOR_SDK_VERSION ?= v1.41.1
 
 # Image URL to use all building/pushing image targets
 DEFAULT_IMG ?= quay.io/openstack-k8s-operators/swift-operator:latest
@@ -132,7 +132,7 @@ PROC_CMD = --procs ${PROCS}
 
 .PHONY: test
 test: manifests generate fmt vet envtest ginkgo ## Run tests.
-	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" $(GINKGO) --trace --cover --coverpkg=../../pkg/swift,../../pkg/swiftproxy/../../pkg/swiftring,../../swiftstorage,../../controllers,../../api/v1beta1 --coverprofile cover.out --covermode=atomic ${PROC_CMD} $(GINKGO_ARGS) ./tests/...
+	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" $(GINKGO) --trace --cover --coverpkg=../../internal/...,../../api/v1beta1/... --coverprofile cover.out --covermode=atomic ${PROC_CMD} $(GINKGO_ARGS) ./test/...
 
 .PHONY: gotest
 gotest: test
@@ -141,7 +141,7 @@ gotest: test
 
 .PHONY: build
 build: generate fmt vet ## Build manager binary.
-	go build -o bin/manager main.go
+	go build -o bin/manager cmd/main.go
 
 .PHONY: run
 run: export METRICS_PORT?=8080
@@ -150,7 +150,7 @@ run: export PPROF_PORT?=8082
 run: export ENABLE_WEBHOOKS?=false
 run: manifests generate fmt vet ## Run a controller from your host.
 	/bin/bash hack/clean_local_webhook.sh
-	go run ./main.go -metrics-bind-address ":$(METRICS_PORT)" -health-probe-bind-address ":$(HEALTH_PORT)" -pprof-bind-address ":$(PPROF_PORT)"
+	go run ./cmd/main.go -metrics-bind-address ":$(METRICS_PORT)" -health-probe-bind-address ":$(HEALTH_PORT)" -pprof-bind-address ":$(PPROF_PORT)"
 
 .PHONY: docker-build
 docker-build: test ## Build docker image with the manager.
@@ -196,7 +196,7 @@ CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
 ENVTEST ?= $(LOCALBIN)/setup-envtest
 
 ## Tool Versions
-KUSTOMIZE_VERSION ?= v3.8.7
+KUSTOMIZE_VERSION ?= v5.6.0
 CONTROLLER_TOOLS_VERSION ?= v0.18.0
 
 SETUP_ENVTEST_VERSION ?= release-0.22

PROJECT

@@ -1,6 +1,10 @@
+# Code generated by tool. DO NOT EDIT.
+# This file is used to track the info used to scaffold your project
+# and allow the plugins properly work.
+# More info: https://book.kubebuilder.io/reference/project-config.html
 domain: openstack.org
 layout:
-- go.kubebuilder.io/v3
+- go.kubebuilder.io/v4
 plugins:
   manifests.sdk.operatorframework.io/v2: {}
   scorecard.sdk.operatorframework.io/v2: {}

api/v1beta1/swift_webhook.go

@@ -19,13 +19,12 @@ package v1beta1
 import (
 	"fmt"
 
-	"github.com/openstack-k8s-operators/lib-common/modules/common/service"
 	topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/service"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/util/validation/field"
-	ctrl "sigs.k8s.io/controller-runtime"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/webhook"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
@@ -37,7 +36,7 @@ type SwiftDefaults struct {
 	ContainerContainerImageURL string
 	ObjectContainerImageURL    string
 	ProxyContainerImageURL     string
-	ProxyAPITimeout int
+	ProxyAPITimeout            int
 }
 
 var swiftDefaults SwiftDefaults
@@ -50,16 +49,6 @@ func SetupSwiftDefaults(defaults SwiftDefaults) {
 	swiftlog.Info("Swift defaults initialized", "defaults", defaults)
 }
 
-func (r *Swift) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr).
-		For(r).
-		Complete()
-}
-
-// TODO(user): EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
-
-//+kubebuilder:webhook:path=/mutate-swift-openstack-org-v1beta1-swift,mutating=true,failurePolicy=fail,sideEffects=None,groups=swift.openstack.org,resources=swifts,verbs=create;update,versions=v1beta1,name=mswift.kb.io,admissionReviewVersions=v1
-
 var _ webhook.Defaulter = &Swift{}
 
 // Default implements webhook.Defaulter so a webhook will be registered for the type
@@ -102,19 +91,16 @@ func (spec *SwiftSpec) Default() {
 		spec.SwiftProxy.ContainerImageProxy = swiftDefaults.ProxyContainerImageURL
 	}
 
-    if spec.SwiftProxy.APITimeout == 0 {
-        spec.SwiftProxy.APITimeout = swiftDefaults.ProxyAPITimeout
-    }
+	if spec.SwiftProxy.APITimeout == 0 {
+		spec.SwiftProxy.APITimeout = swiftDefaults.ProxyAPITimeout
+	}
 }
 
 // Default - set defaults for this Swift core spec (this version is used by OpenStackControlplane webhooks)
 func (spec *SwiftSpecCore) Default() {
 	// nothing here yet
 }
 
-// TODO(user): change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-//+kubebuilder:webhook:path=/validate-swift-openstack-org-v1beta1-swift,mutating=false,failurePolicy=fail,sideEffects=None,groups=swift.openstack.org,resources=swifts,verbs=create;update,versions=v1beta1,name=vswift.kb.io,admissionReviewVersions=v1
-
 var _ webhook.Validator = &Swift{}
 
 // ValidateCreate implements webhook.Validator so a webhook will be registered for the type