⚠️ Rename Kagenti → Rossoctl across kagenti-operator (→ operator)

[Ibrahim2595]

Full content rename Kagenti → Rossoctl. Repo renamed kagenti-operator → operator; all 1927 case-insensitive kagenti references updated; grep is clean. Generated files (CRDs, DeepCopy, RBAC, webhook) regenerated with controller-gen, not hand-edited.

Structural / naming decisions (for operator-team review):

• Repo / Go modules / dir / chart → operator:
  github.com/kagenti/operator → github.com/rossoctl/operator
  github.com/kagenti/token-broker → github.com/rossoctl/token-broker
  dir kagenti-operator/ → operator/; charts/kagenti-operator/ → charts/operator/;
  chart kagenti-operator-chart → operator-chart
• Deployed resource identity → rossoctl-operator-*:
  kustomize namePrefix kagenti-operator- → rossoctl-operator-;
  namespace kagenti-operator-system → rossoctl-operator-system;
  release / app-label / image kagenti-operator → rossoctl-operator
• CRD group (regenerated at source): domain kagenti.dev → rossoctl.dev;
  group agent.kagenti.dev → agent.rossoctl.dev (CRD files renamed accordingly)
• Labels / namespaces: kagenti.io/* → rossoctl.io/*, kagenti-system → rossoctl-system,
  kagenti-traces → rossoctl-traces, kagenti-controller-manager → rossoctl-controller-manager
• Extensions imports: github.com/kagenti/kagenti-extensions/authbridge/... →
  github.com/rossoctl/rossocortex/authbridge/...

Verification:

• operator module: go build ✅, go vet ✅, make test (with envtest) 21/21 packages pass incl. internal/controller + internal/webhook/v1alpha1 (envtest) + cmd
• grep sweep: 0 kagenti; no malformed names; make manifests generate idempotent
• NOT run locally: test/e2e (requires a live kind cluster) — deferred to CI/cluster
• token-broker module fails to build ONLY on github.com/rossoctl/rossocortex/ authbridge/authlib (repo not yet published) — expected cross-repo module-path break (playbook §4); resolves once rossocortex is renamed + published.

Related to #1972

Assisted-By: Claude Opus 4.8 noreply@anthropic.com

Summary

Related issue(s)

(Optional) Testing Instructions

Fixes #

[mrsabath]

Summary

This is the most careful of the three rename PRs in the #1972 series — generated artifacts (CRDs, DeepCopy, RBAC, webhook manifests) were regenerated with controller-gen rather than hand-edited, make manifests generate is idempotent, and Build / Unit Tests / Integration Tests / CodeQL all pass. The module-path rename (github.com/rossoctl/operator, rossoctl/token-broker), kustomize namePrefix → rossoctl-operator-, CRD group agent.rossoctl.dev, and rossoctl.io/* labels are consistent. Sign-off/DCO ✅, title length fine.

Requesting changes on one supply-chain correctness issue (go.sum). Both failing CI checks are non-code artifacts, explained below.

Blocking

• token-broker/go.sum checksums for the authlib dep are non-validating placeholders (inline). github.com/kagenti/kagenti-extensions/authbridge/authlib → github.com/rossoctl/rossocortex/authbridge/authlib had its path string-replaced, but the h1: and /go.mod h1: hashes were kept byte-identical. When rossocortex is published, authlib's go.mod module line changes → the /go.mod hash can't match → go mod verify / build fails with a checksum mismatch. Regenerate via go mod tidy after rossocortex is published; don't hand-edit the hashes. (Same defect as kagenti-extensions#678.)

Non-blocking

• Lint fails, but it's a PR-size false positive — not a rename defect. The workflow runs golangci-lint-action with only-new-issues: true, which fetches the PR patch to filter results to newly-touched lines. This PR exceeds 300 files, so the patch fetch fails (the diff exceeded the maximum number of files (300)) and the action falls back to reporting all issues — the pre-existing goconst (client-secret, false, default, PS256, ES256), gocyclo (Reconcile complexity 48), and revive findings that are normally suppressed. Lint is green on main, and the flagged rossoctl-operator/LabelManagedByValue goconst is the faithful rename of an identical pre-existing kagenti-operator collision. No source change needed — this clears once the diff shrinks (repo rename / rebase / split).
• E2E Tests fails on docker pull ghcr.io/rossoctl/rossocortex/authbridge-envoy:latest — the renamed sidecar image isn't published to the rossoctl org yet. Expected registry-sequencing break; resolves once rossocortex images are published.

Nit

• Bare ⚠️ title prefix; the org title Ruleset expects an allowed word prefix (e.g. Refactor:). Length (65) is fine. Consider Refactor: Rename Kagenti → Rossoctl across kagenti-operator (→ operator).

Areas reviewed: Go modules (go.mod/go.sum), CI (both failures traced end-to-end), K8s/CRD manifests (regenerated), golangci config, kustomize naming, supply-chain, commit conventions.
CI status: 2 failing (both non-code: Lint false positive + E2E registry sequencing), Build/Unit/Integration/CodeQL passing.

[mrsabath]

must-fix — these checksums won't validate once rossocortex is published.

The dep path was rewritten kagenti/kagenti-extensions/authbridge/authlib → rossoctl/rossocortex/authbridge/authlib, but both hashes were kept byte-identical:

github.com/rossoctl/rossocortex/authbridge/authlib v0.0.0-20260619001334-ce3417655ee8 h1:O5bcG8b5QGbIOGUVOFwrEBHso5pwmaRWg9UNC8OtxFI=
github.com/rossoctl/rossocortex/authbridge/authlib v0.0.0-20260619001334-ce3417655ee8/go.mod h1:C9cgtHUtuGLTO/dl0xbXL2zflPwopI2SE0UqDf5C/lA=

The /go.mod h1: line hashes authlib's go.mod contents. Once authlib is republished under rossocortex, its go.mod module directive becomes module github.com/rossoctl/rossocortex/authbridge/authlib (Go requires the module path to match the import path) — different bytes, so the /go.mod hash necessarily changes. The value here is the hash of the old kagenti-extensions authlib go.mod, so once the renamed dep exists go mod verify / any build fails with:

verifying github.com/rossoctl/rossocortex/authbridge/authlib@...: checksum mismatch
SECURITY ERROR

Fix: after rossocortex (kagenti-extensions#678) is published, run go mod tidy in token-broker/ to regenerate real checksums — don't hand-edit the h1: values. Also confirm the pinned pseudo-version v0.0.0-20260619001334-ce3417655ee8 still resolves to an existing commit in the renamed repo. Same root cause as the context-guru go.sum lines flagged in kagenti-extensions#678.

[Ibrahim2595]

Heads-up for reviewers — a proactive supply-chain fix plus a CI legend so the reds aren't misread as defects.

token-broker/go.sum (0b83877): removed non-validating placeholder checksums for github.com/rossoctl/rossocortex/authbridge/authlib. The rename's string-replace kept the old kagenti-extensions/authbridge/authlib hashes byte-identical, but the /go.mod hash changes when that module's module line becomes github.com/rossoctl/rossocortex/authbridge/authlib on republish — so they'd throw a go mod verify checksum mismatch (SECURITY ERROR) once rossocortex is published. You can't produce a valid checksum for an unpublished module, so the lines are removed; go mod tidy regenerates real ones post-publish. (Same issue @mrsabath flagged on extensions #678, fixed here preemptively.)

Expected-red CI (transition artifacts / pre-existing — not rename defects):

• token-broker build → github.com/rossoctl/rossocortex/authbridge/authlib is unresolvable until rossocortex moves under the rossoctl org and republishes (cross-repo sequencing per #1972). The operator module itself builds and tests clean.
• Lint → staticcheck findings (deprecated corev1.Endpoints / k.D, embedded-field selectors, dot-imports) in code the rename didn't logically change — appears to be pre-existing debt surfaced because the large diff re-lints touched files. Happy to confirm vs main if useful.
• E2E Tests → requires a live cluster.

Verified locally: go build ./... ✅ · go vet ./... ✅ · make test (with envtest) 21/21 packages pass, incl. the internal/controller and internal/webhook/v1alpha1 envtest suites. CRDs/DeepCopy regenerated via controller-gen (not hand-edited); grep -i kagenti is clean.

Related to #1972

[mrsabath]

Blocked on Phase 2 of the rename rollout ordering (see rossoctl/rossoctl#1972), which itself depends on kagenti-extensions#678. This PR unblocks once rossoctl/rossocortex is published — then go mod tidy in token-broker/ regenerates the real rossocortex/authbridge/authlib go.sum checksums. Everything else here (CRDs/RBAC regenerated, kustomize prefixes, module paths) is already correct.