Merge branch 'main' into post-renderer

Author: cbarbian-sap

.github/workflows/stale-issue-pr.yaml

@@ -19,7 +19,7 @@ jobs:
 
     steps:
     - name: Mark stale issues and PRs
-      uses: actions/stale@v10.1.1  # Use the latest version of the Stale Action
+      uses: actions/stale@v10.2.0  # Use the latest version of the Stale Action
       with:
         # Label to apply to stale issues
         stale-issue-label: 'stale'

go.mod

@@ -27,7 +27,7 @@ require (
 	sigs.k8s.io/controller-tools v0.20.1
 	sigs.k8s.io/kustomize/api v0.21.1
 	sigs.k8s.io/kustomize/kyaml v0.21.1
-	sigs.k8s.io/structured-merge-diff/v6 v6.3.2
+	sigs.k8s.io/structured-merge-diff/v6 v6.4.0
 	sigs.k8s.io/yaml v1.6.0
 )
 

go.sum

@@ -378,5 +378,7 @@ sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
 sigs.k8s.io/structured-merge-diff/v6 v6.3.2 h1:kwVWMx5yS1CrnFWA/2QHyRVJ8jM6dBA80uLmm0wJkk8=
 sigs.k8s.io/structured-merge-diff/v6 v6.3.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.0 h1:qmp2e3ZfFi1/jJbDGpD4mt3wyp6PE1NfKHCYLqgNQJo=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
 sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
 sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=

internal/helm/chart.go

@@ -83,6 +83,20 @@ func ParseChart(fsys fs.FS, chartPath string, parent *Chart) (*Chart, error) {
 	if err := kyaml.Unmarshal(chartRaw, chart.metadata); err != nil {
 		return nil, err
 	}
+	if chart.metadata.Dependencies == nil {
+		requirementsRaw, err := fs.ReadFile(fsys, filepath.Clean(chartPath+"/requirements.yaml"))
+		if err == nil {
+			requirements := struct {
+				Dependencies []ChartDependency `json:"dependencies,omitempty"`
+			}{}
+			if err := kyaml.Unmarshal(requirementsRaw, &requirements); err != nil {
+				return nil, err
+			}
+			chart.metadata.Dependencies = requirements.Dependencies
+		} else if !errors.Is(err, fs.ErrNotExist) {
+			return nil, err
+		}
+	}
 	if chart.metadata.Type == "" {
 		chart.metadata.Type = ChartTypeApplication
 	}

internal/helm/util.go

@@ -10,6 +10,8 @@ import (
 	"strings"
 )
 
+// TODO: consolidate all the util files into an internal reuse package
+
 /*
 func getString(data map[string]any, key string) (string, bool, bool) {
 	if v, ok := data[key]; ok {

internal/kustomize/kustomization.go

@@ -196,7 +196,7 @@ func parseKustomization(fsys fs.FS, kustomizationPath string, options Kustomizat
 
 	for _, path := range options.IncludedFiles {
 		if filepath.IsAbs(path) {
-			return nil, fmt.Errorf("include path (%s) must be absolute", path)
+			return nil, fmt.Errorf("include path (%s) must not be absolute", path)
 		}
 		absolutePath := filepath.Clean(filepath.Join(kustomizationPath, path))
 		if isSubdirectory(absolutePath, kustomizationPath) {
@@ -392,20 +392,22 @@ func makeFuncData(data any) any {
 func generateKustomization(fsys kustfsys.FileSystem, kustomizationPath string) ([]byte, error) {
 	var resources []string
 
-	f := func(path string, info fs.FileInfo, err error) error {
-		if err != nil {
-			return err
-		}
-		// TODO: IsDir() is false if it is a symlink; is that wanted to be this way?
-		if !info.IsDir() && !strings.HasPrefix(filepath.Base(path), ".") && (strings.HasSuffix(path, ".yaml") || strings.HasSuffix(path, ".yml")) {
-			resources = append(resources, path)
+	if fsys.IsDir(kustomizationPath) {
+		f := func(path string, info fs.FileInfo, err error) error {
+			if err != nil {
+				return err
+			}
+			// TODO: IsDir() is false if it is a symlink; is that wanted to be this way?
+			if !info.IsDir() && !strings.HasPrefix(filepath.Base(path), ".") && (strings.HasSuffix(path, ".yaml") || strings.HasSuffix(path, ".yml")) {
+				resources = append(resources, path)
+			}
+			return nil
 		}
-		return nil
-	}
 
-	// TODO: does this work correctly with symlinks?
-	if err := fsys.Walk(kustomizationPath, f); err != nil {
-		return nil, err
+		// TODO: does this work correctly with symlinks?
+		if err := fsys.Walk(kustomizationPath, f); err != nil {
+			return nil, err
+		}
 	}
 
 	kustomization := kusttypes.Kustomization{

internal/util/finalizer.go

@@ -0,0 +1,30 @@
+/*
+SPDX-FileCopyrightText: 2026 SAP SE or an SAP affiliate company and component-operator-runtime contributors
+SPDX-License-Identifier: Apache-2.0
+*/
+
+package util
+
+import (
+	"context"
+	"encoding/json"
+
+	apitypes "k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+// This is a workaround. Ideally Kubernetes would have a finalizers subresource, and controller-runtime
+// would offer the according subresource client.
+func UpdateFinalizers(ctx context.Context, clnt client.Client, obj client.Object, fieldOwner string) error {
+	// note: it's crucial to use string keyed maps to construct the patch; using metav1.ObjectMeta would lead to
+	// finalizers to be removed entirely from the patch when empty (because of omitempty usage there);
+	// but we need to preserve empty or null finalizers in the patch, in order to make JSON merge patch apply it correctly
+	finalizerPatch := map[string]any{
+		"metadata": map[string]any{
+			"resourceVersion": obj.GetResourceVersion(),
+			"finalizers":      obj.GetFinalizers(),
+		},
+	}
+	// note: this must() is ok because marshalling finalizers should always work
+	return clnt.Patch(ctx, obj, client.RawPatch(apitypes.MergePatchType, must(json.Marshal(finalizerPatch))), client.FieldOwner(fieldOwner))
+}

internal/util/util.go

@@ -0,0 +1,15 @@
+/*
+SPDX-FileCopyrightText: 2026 SAP SE or an SAP affiliate company and component-operator-runtime contributors
+SPDX-License-Identifier: Apache-2.0
+*/
+
+package util
+
+// TODO: consolidate all the util files into an internal reuse package
+
+func must[T any](x T, err error) T {
+	if err != nil {
+		panic(err)
+	}
+	return x
+}

pkg/component/reconciler.go

@@ -45,6 +45,7 @@ import (
 	"github.com/sap/component-operator-runtime/internal/clientfactory"
 	"github.com/sap/component-operator-runtime/internal/events"
 	"github.com/sap/component-operator-runtime/internal/metrics"
+	"github.com/sap/component-operator-runtime/internal/util"
 	"github.com/sap/component-operator-runtime/pkg/cluster"
 	"github.com/sap/component-operator-runtime/pkg/manifests"
 	"github.com/sap/component-operator-runtime/pkg/reconciler"
@@ -514,7 +515,7 @@ func (r *Reconciler[T]) Reconcile(ctx context.Context, req ctrl.Request) (result
 		// create/update case
 		// TODO: optionally (to be completely consistent) set finalizer through a mutating webhook
 		if added := controllerutil.AddFinalizer(component, *r.options.Finalizer); added {
-			if err := r.client.Update(ctx, component, client.FieldOwner(*r.options.FieldOwner)); err != nil {
+			if err := util.UpdateFinalizers(ctx, r.client, component, *r.options.FieldOwner); err != nil {
 				return ctrl.Result{}, legacyerrors.Wrap(err, "error adding finalizer")
 			}
 			// trigger another round trip
@@ -610,7 +611,7 @@ func (r *Reconciler[T]) Reconcile(ctx context.Context, req ctrl.Request) (result
 			// all dependent resources are already gone, so that's it
 			log.V(1).Info("all dependent resources are successfully deleted; removing finalizer")
 			if removed := controllerutil.RemoveFinalizer(component, *r.options.Finalizer); removed {
-				if err := r.client.Update(ctx, component, client.FieldOwner(*r.options.FieldOwner)); err != nil {
+				if err := util.UpdateFinalizers(ctx, r.client, component, *r.options.FieldOwner); err != nil {
 					return ctrl.Result{}, legacyerrors.Wrap(err, "error removing finalizer")
 				}
 			}

pkg/reconciler/reconciler.go

@@ -34,6 +34,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 
+	"github.com/sap/component-operator-runtime/internal/util"
 	"github.com/sap/component-operator-runtime/pkg/cluster"
 	"github.com/sap/component-operator-runtime/pkg/status"
 	"github.com/sap/component-operator-runtime/pkg/types"
@@ -1318,7 +1319,7 @@ func (r *Reconciler) deleteObject(ctx context.Context, key types.ObjectKey, exis
 			}
 			if ok := controllerutil.RemoveFinalizer(crd, r.finalizer); ok {
 				// note: 409 error is very likely here (because of concurrent updates happening through the api server); this is why we retry once
-				if err := r.client.Update(ctx, crd, client.FieldOwner(r.fieldOwner)); err != nil {
+				if err := util.UpdateFinalizers(ctx, r.client, crd, r.fieldOwner); err != nil {
 					if i == 1 && apierrors.IsConflict(err) {
 						log.V(1).Info("error while updating CustomResourcedefinition (409 conflict); doing one retry", "error", err.Error())
 						continue
@@ -1343,7 +1344,7 @@ func (r *Reconciler) deleteObject(ctx context.Context, key types.ObjectKey, exis
 			}
 			if ok := controllerutil.RemoveFinalizer(apiService, r.finalizer); ok {
 				// note: 409 error is very likely here (because of concurrent updates happening through the api server); this is why we retry once
-				if err := r.client.Update(ctx, apiService, client.FieldOwner(r.fieldOwner)); err != nil {
+				if err := util.UpdateFinalizers(ctx, r.client, apiService, r.fieldOwner); err != nil {
 					if i == 1 && apierrors.IsConflict(err) {
 						log.V(1).Info("error while updating APIService (409 conflict); doing one retry", "error", err.Error())
 						continue
@@ -1365,13 +1366,15 @@ func (r *Reconciler) orphanObject(ctx context.Context, existingObject *unstructu
 	}
 
 	if existingObject.GetLabels()[r.labelKeyOwnerId] != hashedOwnerId {
-		return fmt.Errorf("owner conflict; object %s has no or different owner", types.ObjectKeyToString(existingObject))
+		// the object has a different owner; so we do not raise an owner id conflict error here
+		return nil
 	}
 
+	// do cleanup on orphaned object; note: this happens only if we own it; otherwise we already returned above
 	if isCrd(existingObject) || isApiService(existingObject) {
 		object := existingObject.DeepCopy()
 		if controllerutil.RemoveFinalizer(object, r.finalizer) {
-			if err := r.client.Update(ctx, object, client.FieldOwner(r.fieldOwner)); err != nil {
+			if err := util.UpdateFinalizers(ctx, r.client, object, r.fieldOwner); err != nil {
 				return err
 			}
 		}
@@ -1528,9 +1531,11 @@ func (r *Reconciler) isTypeUsed(ctx context.Context, gk schema.GroupKind, hashed
 
 func (r *Reconciler) isCrdUsed(ctx context.Context, crd *apiextensionsv1.CustomResourceDefinition, hashedOwnerId string, onlyForeign bool) (bool, error) {
 	gvk := schema.GroupVersionKind{
-		Group:   crd.Spec.Group,
-		Version: crd.Spec.Versions[0].Name,
-		Kind:    crd.Spec.Names.Kind,
+		Group: crd.Spec.Group,
+		Version: slices.Select(crd.Spec.Versions, func(v apiextensionsv1.CustomResourceDefinitionVersion) bool {
+			return v.Served
+		})[0].Name,
+		Kind: crd.Spec.Names.Kind,
 	}
 	list := &unstructured.UnstructuredList{}
 	list.SetGroupVersionKind(gvk)