feat(object-controller): add standalone ClusterObjectSet manager

Add a dedicated manager with a ClusterObjectSet-only scheme and regression coverage. Reuse referenced Secret reads within each reconciliation, retry transient read failures, and show numeric revision status when no bundle version is present.

Signed-off-by: Fabricio Aguiar <fabricio.aguiar@gmail.com>

rh-pre-commit.version: 2.3.2
rh-pre-commit.check-secrets: ENABLED

Author: fao89

cmd/object-controller/main.go

@@ -0,0 +1,211 @@
+/*
+Copyright 2026.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"crypto/tls"
+	"flag"
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/spf13/cobra"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/client-go/discovery"
+	"k8s.io/client-go/discovery/cached/memory"
+	_ "k8s.io/client-go/plugin/pkg/client/auth"
+	"k8s.io/client-go/rest"
+	"k8s.io/klog/v2"
+	"k8s.io/utils/ptr"
+	"pkg.package-operator.run/boxcutter/managedcache"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/cache"
+	"sigs.k8s.io/controller-runtime/pkg/certwatcher"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/healthz"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+	"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
+	"sigs.k8s.io/controller-runtime/pkg/metrics/server"
+
+	ocv1 "github.com/operator-framework/operator-controller/api/v1"
+	"github.com/operator-framework/operator-controller/internal/object-controller/controllers"
+	"github.com/operator-framework/operator-controller/internal/object-controller/scheme"
+	cacheutil "github.com/operator-framework/operator-controller/internal/shared/util/cache"
+	"github.com/operator-framework/operator-controller/internal/shared/util/tlsprofiles"
+	"github.com/operator-framework/operator-controller/internal/shared/version"
+)
+
+type config struct {
+	metricsAddr          string
+	pprofAddr            string
+	probeAddr            string
+	certFile             string
+	keyFile              string
+	enableLeaderElection bool
+}
+
+func newCommand() *cobra.Command {
+	cfg := &config{}
+	cmd := &cobra.Command{
+		Use:   "object-controller",
+		Short: "Manage Kubernetes objects through ClusterObjectSets",
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			if err := cfg.validate(); err != nil {
+				return err
+			}
+			restConfig, err := ctrl.GetConfig()
+			if err != nil {
+				return err
+			}
+			mgr, err := newManager(cfg, restConfig)
+			if err != nil {
+				return err
+			}
+			ctrl.Log.WithName("setup").Info("starting object-controller", "version info", version.String())
+			return mgr.Start(cmd.Context())
+		},
+	}
+	flags := cmd.Flags()
+	flags.StringVar(&cfg.metricsAddr, "metrics-bind-address", "", "The metrics endpoint address. Disabled without tls-cert and tls-key; defaults to ':8443' when both are supplied.")
+	flags.StringVar(&cfg.pprofAddr, "pprof-bind-address", "0", "The pprof endpoint address. An empty string or 0 disables pprof.")
+	flags.StringVar(&cfg.probeAddr, "health-probe-bind-address", ":8081", "The health probe endpoint address.")
+	flags.StringVar(&cfg.certFile, "tls-cert", "", "The certificate file for the metrics server. Requires tls-key.")
+	flags.StringVar(&cfg.keyFile, "tls-key", "", "The key file for the metrics server. Requires tls-cert.")
+	flags.BoolVar(&cfg.enableLeaderElection, "leader-elect", false, "Enable leader election for the controller manager.")
+	logFlags := flag.NewFlagSet("logging", flag.ContinueOnError)
+	klog.InitFlags(logFlags)
+	flags.AddGoFlagSet(logFlags)
+	tlsprofiles.AddFlags(flags)
+	cmd.AddCommand(&cobra.Command{
+		Use:   "version",
+		Short: "Print object-controller version information",
+		Run: func(cmd *cobra.Command, _ []string) {
+			cmd.Println(version.String())
+		},
+	})
+	return cmd
+}
+
+func (c *config) validate() error {
+	if (c.certFile == "") != (c.keyFile == "") {
+		return fmt.Errorf("tls-cert and tls-key flags must be used together")
+	}
+	if c.metricsAddr != "" && c.certFile == "" {
+		return fmt.Errorf("metrics-bind-address requires tls-cert and tls-key flags to be set")
+	}
+	if c.certFile != "" && c.metricsAddr == "" {
+		c.metricsAddr = ":8443"
+	}
+	return nil
+}
+
+func newManager(cfg *config, restConfig *rest.Config) (manager.Manager, error) {
+	metricsOptions := server.Options{BindAddress: "0"}
+	var certWatcher *certwatcher.CertWatcher
+	if cfg.certFile != "" {
+		var err error
+		certWatcher, err = certwatcher.New(cfg.certFile, cfg.keyFile)
+		if err != nil {
+			return nil, fmt.Errorf("initializing certificate watcher: %w", err)
+		}
+		tlsProfile, err := tlsprofiles.GetTLSConfigFunc()
+		if err != nil {
+			return nil, fmt.Errorf("getting TLS profile: %w", err)
+		}
+		metricsOptions = server.Options{
+			BindAddress:    cfg.metricsAddr,
+			SecureServing:  true,
+			FilterProvider: filters.WithAuthenticationAndAuthorization,
+			TLSOpts: []func(*tls.Config){
+				func(c *tls.Config) {
+					c.GetCertificate = certWatcher.GetCertificate
+					c.NextProtos = []string{"http/1.1"}
+				},
+				tlsProfile,
+			},
+		}
+	}
+	mgr, err := ctrl.NewManager(restConfig, ctrl.Options{
+		Scheme:                        scheme.Scheme,
+		Metrics:                       metricsOptions,
+		PprofBindAddress:              cfg.pprofAddr,
+		HealthProbeBindAddress:        cfg.probeAddr,
+		LeaderElection:                cfg.enableLeaderElection,
+		LeaderElectionID:              "object-controller-lock.olm.operatorframework.io",
+		LeaderElectionReleaseOnCancel: true,
+		LeaseDuration:                 ptr.To(137 * time.Second),
+		RenewDeadline:                 ptr.To(107 * time.Second),
+		RetryPeriod:                   ptr.To(26 * time.Second),
+		Cache: cache.Options{
+			ByObject:                    map[client.Object]cache.ByObject{&ocv1.ClusterObjectSet{}: {}},
+			ReaderFailOnMissingInformer: true,
+			DefaultTransform:            cacheutil.StripAnnotations(),
+		},
+		// References can point to immutable Secrets in any namespace. Read them
+		// directly, without caching unrelated cluster Secrets or requiring a system namespace.
+		Client: client.Options{Cache: &client.CacheOptions{DisableFor: []client.Object{&corev1.Secret{}}}},
+	})
+	if err != nil {
+		return nil, fmt.Errorf("creating manager: %w", err)
+	}
+	if certWatcher != nil {
+		if err := mgr.Add(certWatcher); err != nil {
+			return nil, fmt.Errorf("adding certificate watcher: %w", err)
+		}
+	}
+	trackingCache, err := managedcache.NewTrackingCache(
+		ctrl.Log.WithName("trackingCache"), mgr.GetConfig(),
+		cache.Options{Scheme: mgr.GetScheme(), Mapper: mgr.GetRESTMapper()},
+	)
+	if err != nil {
+		return nil, fmt.Errorf("creating tracking cache: %w", err)
+	}
+	if err := mgr.Add(trackingCache); err != nil {
+		return nil, fmt.Errorf("adding tracking cache: %w", err)
+	}
+	discoveryClient, err := discovery.NewDiscoveryClientForConfig(mgr.GetConfig())
+	if err != nil {
+		return nil, fmt.Errorf("creating discovery client: %w", err)
+	}
+	// Keep the field owner prefix unchanged so existing objects can be reconciled after migration.
+	factory, err := controllers.NewDefaultRevisionEngineFactory(
+		mgr.GetScheme(), trackingCache, memory.NewMemCacheClient(discoveryClient),
+		mgr.GetRESTMapper(), "olm.operatorframework.io", mgr.GetConfig(),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("creating revision engine factory: %w", err)
+	}
+	if err := (&controllers.ClusterObjectSetReconciler{
+		Client: mgr.GetClient(), RevisionEngineFactory: factory, TrackingCache: trackingCache,
+	}).SetupWithManager(mgr); err != nil {
+		return nil, fmt.Errorf("setting up ClusterObjectSet controller: %w", err)
+	}
+	if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
+		return nil, err
+	}
+	if err := mgr.AddReadyzCheck("readyz", healthz.Ping); err != nil {
+		return nil, err
+	}
+	return mgr, nil
+}
+
+func main() {
+	ctrl.SetLogger(klog.NewKlogr())
+	if err := newCommand().ExecuteContext(ctrl.SetupSignalHandler()); err != nil {
+		os.Exit(1)
+	}
+}

cmd/object-controller/main_test.go

@@ -0,0 +1,164 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/go-logr/logr/testr"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/utils/ptr"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	ocv1 "github.com/operator-framework/operator-controller/api/v1"
+	"github.com/operator-framework/operator-controller/internal/object-controller/scheme"
+	"github.com/operator-framework/operator-controller/test"
+)
+
+func TestValidateMetricsFlags(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		cfg      config
+		wantAddr string
+		wantErr  string
+	}{
+		{name: "disabled"},
+		{name: "certificate without key", cfg: config{certFile: "cert"}, wantErr: "must be used together"},
+		{name: "key without certificate", cfg: config{keyFile: "key"}, wantErr: "must be used together"},
+		{name: "insecure metrics", cfg: config{metricsAddr: ":8443"}, wantErr: "requires tls-cert and tls-key"},
+		{name: "default address", cfg: config{certFile: "cert", keyFile: "key"}, wantAddr: ":8443"},
+		{name: "custom address", cfg: config{certFile: "cert", keyFile: "key", metricsAddr: ":9443"}, wantAddr: ":9443"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			err := tc.cfg.validate()
+			if tc.wantErr != "" {
+				require.ErrorContains(t, err, tc.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, tc.wantAddr, tc.cfg.metricsAddr)
+		})
+	}
+}
+
+func TestVersionWithoutCluster(t *testing.T) {
+	cmd := newCommand()
+	var output bytes.Buffer
+	cmd.SetOut(&output)
+	cmd.SetArgs([]string{"version"})
+	require.NoError(t, cmd.Execute())
+	require.NotEmpty(t, output.String())
+}
+
+// Exercise the actual manager and revision engine with only the ClusterObjectSet CRD installed.
+func TestStandaloneController(t *testing.T) {
+	ctrl.SetLogger(testr.New(t))
+	testEnv := test.NewEnv()
+	testEnv.CRDDirectoryPaths = []string{"../../helm/olmv1/base/operator-controller/crd/experimental/olm.operatorframework.io_clusterobjectsets.yaml"}
+	restConfig, err := testEnv.Start()
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, test.StopWithRetry(testEnv, time.Minute, time.Second)) })
+
+	cl, err := client.New(restConfig, client.Options{Scheme: scheme.Scheme})
+	require.NoError(t, err)
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	require.True(t, apierrors.IsNotFound(cl.Get(ctx, client.ObjectKey{Name: "clusterextensions.olm.operatorframework.io"}, &apiextensionsv1.CustomResourceDefinition{})))
+	require.True(t, apierrors.IsNotFound(cl.Get(ctx, client.ObjectKey{Name: "clustercatalogs.olm.operatorframework.io"}, &apiextensionsv1.CustomResourceDefinition{})))
+
+	mgr, err := newManager(&config{probeAddr: "0", pprofAddr: "0"}, restConfig)
+	require.NoError(t, err)
+	done := make(chan error, 1)
+	go func() { done <- mgr.Start(ctx) }()
+	t.Cleanup(func() {
+		cancel()
+		select {
+		case err := <-done:
+			require.NoError(t, err)
+		case <-time.After(30 * time.Second):
+			t.Error("manager did not stop")
+		}
+	})
+	syncCtx, syncCancel := context.WithTimeout(ctx, 30*time.Second)
+	defer syncCancel()
+	require.True(t, mgr.GetCache().WaitForCacheSync(syncCtx), "manager cache did not synchronize")
+
+	for _, name := range []string{"inline", "secret-ref"} {
+		t.Run(name, func(t *testing.T) {
+			ns := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{GenerateName: "standalone-"}}
+			require.NoError(t, cl.Create(ctx, ns))
+			manifest := unstructured.Unstructured{Object: map[string]any{
+				"apiVersion": "v1", "kind": "ConfigMap",
+				"metadata": map[string]any{"name": name, "namespace": ns.Name},
+				"data":     map[string]any{"hello": "world"},
+			}}
+			obj := ocv1.ClusterObjectSetObject{Object: manifest}
+			if name == "secret-ref" {
+				data, err := json.Marshal(manifest.Object)
+				require.NoError(t, err)
+				secret := &corev1.Secret{
+					ObjectMeta: metav1.ObjectMeta{Name: "content", Namespace: ns.Name},
+					Immutable:  ptr.To(true), Data: map[string][]byte{"object": data},
+				}
+				require.NoError(t, cl.Create(ctx, secret))
+				obj = ocv1.ClusterObjectSetObject{Ref: ocv1.ObjectSourceRef{Name: secret.Name, Namespace: secret.Namespace, Key: "object"}}
+			}
+			cos := &ocv1.ClusterObjectSet{
+				ObjectMeta: metav1.ObjectMeta{Name: name},
+				Spec: ocv1.ClusterObjectSetSpec{
+					LifecycleState: ocv1.ClusterObjectSetLifecycleStateActive, Revision: 1,
+					CollisionProtection: ocv1.CollisionProtectionPrevent,
+					Phases:              []ocv1.ClusterObjectSetPhase{{Name: "deploy", Objects: []ocv1.ClusterObjectSetObject{obj}}},
+				},
+			}
+			require.NoError(t, cl.Create(ctx, cos))
+			require.EventuallyWithT(t, func(collect *assert.CollectT) {
+				if !assert.NoError(collect, cl.Get(ctx, client.ObjectKeyFromObject(cos), cos)) {
+					return
+				}
+				assert.True(collect, meta.IsStatusConditionTrue(cos.Status.Conditions, ocv1.ClusterObjectSetTypeSucceeded), "%v", cos.Status.Conditions)
+				progressing := meta.FindStatusCondition(cos.Status.Conditions, ocv1.ClusterObjectSetTypeProgressing)
+				if assert.NotNil(collect, progressing) {
+					assert.Equal(collect, "Revision 1 has rolled out.", progressing.Message)
+				}
+			}, time.Minute, 100*time.Millisecond)
+			cm := &corev1.ConfigMap{}
+			require.NoError(t, cl.Get(ctx, client.ObjectKey{Name: name, Namespace: ns.Name}, cm))
+			require.Equal(t, "world", cm.Data["hello"])
+			require.NotNil(t, metav1.GetControllerOf(cm))
+			require.Equal(t, cos.UID, metav1.GetControllerOf(cm).UID)
+
+			// Observe managed-object changes without updating the ClusterObjectSet.
+			originalUID := cm.UID
+			require.NoError(t, cl.Delete(ctx, cm))
+			require.EventuallyWithT(t, func(collect *assert.CollectT) {
+				if !assert.NoError(collect, cl.Get(ctx, client.ObjectKeyFromObject(cm), cm)) {
+					return
+				}
+				assert.NotEqual(collect, originalUID, cm.UID)
+				assert.Equal(collect, "world", cm.Data["hello"])
+				if assert.NotNil(collect, metav1.GetControllerOf(cm)) {
+					assert.Equal(collect, cos.UID, metav1.GetControllerOf(cm).UID)
+				}
+			}, time.Minute, 100*time.Millisecond)
+
+			// The controller releases its finalizer independently of ClusterExtension.
+			// The owner reference above lets Kubernetes garbage-collect the ConfigMap;
+			// envtest does not run that garbage collector.
+			require.NoError(t, cl.Delete(ctx, cos))
+			require.Eventually(t, func() bool {
+				return apierrors.IsNotFound(cl.Get(ctx, client.ObjectKeyFromObject(cos), cos))
+			}, time.Minute, 100*time.Millisecond)
+		})
+	}
+}