Docs: provide text for 'oc explain' on operator CRDs#357
Conversation
Signed-off-by: Ed Snible <snible@us.ibm.com>
Signed-off-by: Ed Snible <snible@us.ibm.com>
huang195
left a comment
huang195
left a comment
There was a problem hiding this comment.
Summary
Swaps the boilerplate "X is the Schema for the X API" kubebuilder descriptions for real, user-facing ones on AgentCard and AgentRuntime; the regenerated CRD YAMLs pick up the same text. Claims check out against the controllers — JWS signature + SPIFFE trust-domain verification on the AgentCard side, phase + per-workload SPIRE/OTel overrides on the AgentRuntime side.
Areas reviewed: Go API types, CRD YAML
Commits: 2, both signed-off (the second restores the manual webhook-manifests override that make manifests clobbered in the first)
CI status: all green
Follow-up (not blocking)
PR body correctly calls out that make manifests overwrites the manual namespaceSelector / objectSelector / timeoutSeconds in config/webhook/manifests.yaml (restored here via afe62a9) and suggests baking those into authbridge_webhook.go:214. Worth a tracking issue so the next person running make manifests doesn't silently re-regress the webhook config — happy to file one after this merges if it's not already tracked.
github-project-automation
Bot
moved this from Backlog
to Done
in Rossoctl Issue Prioritization
Restore manual webhook manifest overrides clobbered by `make manifests`, add a deprecated annotation fallback in the mode resolution chain, and clean up minor code-review nits. Per-comment changes: rossoctl#1 (must-fix): Restore namespaceSelector / objectSelector / timeoutSeconds on the inject.kagenti.io webhook in config/webhook/manifests.yaml. PR rossoctl#357 manually re-added these fields after `make manifests` clobbered them; the prior commit on this branch wiped them again. Without them the webhook fires on every pod admission cluster-wide which, combined with the new proxy-sidecar default, is a much wider blast radius than today. rossoctl#3 (suggestion): Re-introduce AnnotationAuthBridgeMode as a deprecated fourth layer of the mode resolution chain (between the namespace ConfigMap and the cluster-wide proxy-sidecar fallback). Workloads that still set kagenti.io/authbridge-mode get the same mode they had before this PR, with a `DEPRECATED:` log line per pod admission to push them toward AgentRuntime.Spec.AuthBridgeMode. rossoctl#4 (suggestion): Add a TODO on InjectionDecision.SpiffeHelper marking it for rename to SpireEnabled in a follow-up PR. rossoctl#5 (suggestion): Replace the `evaluateSidecar("spiffe-helper", true, ...)` magic-true call with a dedicated `evaluateSpiffeHelper(label)` helper, mirroring the previous evaluateClientRegistration pattern. rossoctl#6 (nit): Update the proxy-sidecar test error message that still referenced the old "authbridge-light" image name. Comment rossoctl#2 (spiffe-helper bundling readiness) is a coordination concern between this PR and kagenti-extensions PR rossoctl#409. The combined Dockerfiles on rossoctl#409's branch (76d2cb3) DO bundle spiffe-helper and the entrypoint-proxy.sh / entrypoint-envoy.sh DO conditionally start it on SPIRE_ENABLED — so end-state is correct as long as rossoctl#409 lands first. No code change here; merge ordering is the answer. Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Hai Huang <huang195@gmail.com>
3 participants
Summary
Kubernetes and OpenShift admins use
oc explainto understand CRDs.The previous output for our CRDs was based on generated Go code and very confusing:
This PR gives a real description for each of our CRDs.
(Optional) Testing Instructions
With this change, the output should include
and
Note: Running
make manifest, overrides The namespaceSelector, objectSelector, and timeoutSeconds: 10 that were deliberately added manually to config/webhook/manifests.yaml in commits 19918ea and b89651f . If we plan to continue allowingmake manifestto work, we should probably also make the changes to authbridge_webhook.go:214.