Upgrade to Operator SDK 1.41.1

This commit upgrades the mariadb-operator to use Operator SDK version 1.41.1,
with the following major changes:

Project Structure:
- Move pkg/ packages to internal/ following Go best practices
- Move controllers/ to internal/controller/ per new operator-sdk layout
- Replace main.go with cmd/main.go
- Add controller and webhook test suites

Configuration Updates:
- Split certificate management into separate metrics and webhook certs
- Add network policies for metrics and webhook traffic
- Rename auth_proxy resources to metrics for clarity
- Add admin RBAC roles for all CRD types
- Update manager deployment configuration and patches
- Modernize kustomization configurations

Webhook Changes:
- Add dedicated webhook implementation in internal/webhook/v1beta1/
- Remove old CRD webhook and CA injection patches
- Update webhook manifests and service configuration

Cleanup:
- Remove obsolete config patches and overlays

Dependencies:
- Update go.mod and go.sum for operator-sdk 1.41.1 dependencies

Jira: OSPRH-22041

Assisted-by: claude-4-sonnet
Signed-off-by: Martin Schuppert <mschuppert@redhat.com>

Author: stuggi

.ci-operator.yaml

@@ -1,4 +1,4 @@
 build_root_image:
   name: tools
   namespace: openstack-k8s-operators
-  tag: ci-build-root-golang-1.24-sdk-1.31
+  tag: ci-build-root-golang-1.24-sdk-1.41.1

.github/workflows/build-mariadb-operator.yaml

@@ -16,7 +16,7 @@ jobs:
     with:
       operator_name: mariadb
       go_version: 1.24.x
-      operator_sdk_version: 1.31.0
+      operator_sdk_version: 1.41.1
     secrets:
       IMAGENAMESPACE: ${{ secrets.IMAGENAMESPACE }}
       QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}

.github/workflows/force-bump-pr-manual.yaml

@@ -9,6 +9,6 @@ jobs:
     with:
       operator_name: mariadb
       branch_name: ${{ github.ref_name }}
-      custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.31
+      custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.41.1
     secrets:
       FORCE_BUMP_PULL_REQUEST_PAT: ${{ secrets.FORCE_BUMP_PULL_REQUEST_PAT }}

.github/workflows/force-bump-pr-scheduled.yaml

@@ -10,6 +10,6 @@ jobs:
     uses: openstack-k8s-operators/openstack-k8s-operators-ci/.github/workflows/force-bump-branches.yaml@main
     with:
       operator_name: mariadb
-      custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.31
+      custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.41.1
     secrets:
       FORCE_BUMP_PULL_REQUEST_PAT: ${{ secrets.FORCE_BUMP_PULL_REQUEST_PAT }}

.pre-commit-config.yaml

@@ -74,4 +74,4 @@ repos:
   rev: e30d72fcbced0ab8a7b6d23be1dee129e2a7b849
   hooks:
     - id: kuttl-single-test-assert
-      args: ["tests/kuttl"]
+      args: ["test/kuttl"]

Dockerfile

@@ -26,7 +26,7 @@ RUN mkdir -p ${DEST_ROOT}/usr/local/bin/
 RUN if [ ! -f $CACHITO_ENV_FILE ]; then go mod download ; fi
 
 # Build manager
-RUN if [ -f $CACHITO_ENV_FILE ] ; then source $CACHITO_ENV_FILE ; fi ; env ${GO_BUILD_EXTRA_ENV_ARGS} go build ${GO_BUILD_EXTRA_ARGS} -a -o ${DEST_ROOT}/manager main.go
+RUN if [ -f $CACHITO_ENV_FILE ] ; then source $CACHITO_ENV_FILE ; fi ; env ${GO_BUILD_EXTRA_ENV_ARGS} go build ${GO_BUILD_EXTRA_ARGS} -a -o ${DEST_ROOT}/manager cmd/main.go
 
 
 RUN cp -r templates ${DEST_ROOT}/templates

Dockerfile.rhel

@@ -17,7 +17,7 @@ WORKDIR ${REMOTE_SOURCE_DIR}/${REMOTE_SOURCE_SUBDIR}
 RUN mkdir -p ${DEST_ROOT}/usr/local/bin/
 
 # Build
-RUN CGO_ENABLED=0 GO111MODULE=on go build ${GO_BUILD_EXTRA_ARGS} -a -o ${DEST_ROOT}/usr/local/bin/manager main.go
+RUN CGO_ENABLED=0 GO111MODULE=on go build ${GO_BUILD_EXTRA_ARGS} -a -o ${DEST_ROOT}/usr/local/bin/manager cmd/main.go
 RUN CGO_ENABLED=0 GO111MODULE=on go build ${GO_BUILD_EXTRA_ARGS} -a -o ${DEST_ROOT}/usr/local/bin/csv-generator tools/csv-generator.go
 
 RUN cp tools/user_setup ${DEST_ROOT}/usr/local/bin/

Makefile

@@ -48,7 +48,7 @@ endif
 
 # Set the Operator SDK version to use. By default, what is installed on the system is used.
 # This is useful for CI or a project to utilize a specific version of the operator-sdk toolkit.
-OPERATOR_SDK_VERSION ?= v1.31.0
+OPERATOR_SDK_VERSION ?= v1.41.1
 
 # Image URL to use all building/pushing image targets
 DEFAULT_IMG ?= quay.io/openstack-k8s-operators/mariadb-operator:latest
@@ -142,7 +142,7 @@ test: manifests generate gowork fmt vet envtest ginkgo ## Run tests.
 
 .PHONY: build
 build: generate fmt vet ## Build manager binary.
-	go build -o bin/manager main.go
+	go build -o bin/manager cmd/main.go
 
 .PHONY: run
 run: export METRICS_PORT?=8080
@@ -152,7 +152,7 @@ run: export OPERATOR_TEMPLATES=./templates/
 run: export ENABLE_WEBHOOKS?=false
 run: manifests generate fmt vet ## Run a controller from your host.
 	/bin/bash hack/clean_local_webhook.sh
-	go run ./main.go -metrics-bind-address ":$(METRICS_PORT)" -health-probe-bind-address ":$(HEALTH_PORT)" -pprof-bind-address ":$(PPROF_PORT)"
+	go run ./cmd/main.go -metrics-bind-address ":$(METRICS_PORT)" -health-probe-bind-address ":$(HEALTH_PORT)" -pprof-bind-address ":$(PPROF_PORT)"
 
 .PHONY: docker-build
 docker-build: test ## Build docker image with the manager.
@@ -216,7 +216,7 @@ ENVTEST ?= $(LOCALBIN)/setup-envtest
 GINKGO ?= $(LOCALBIN)/ginkgo
 
 ## Tool Versions
-KUSTOMIZE_VERSION ?= v3.8.7
+KUSTOMIZE_VERSION ?= v5.6.0
 CONTROLLER_TOOLS_VERSION ?= v0.18.0
 GOTOOLCHAIN_VERSION ?= go1.24.0
 

PROJECT

@@ -4,7 +4,7 @@
 # More info: https://book.kubebuilder.io/reference/project-config.html
 domain: openstack.org
 layout:
-- go.kubebuilder.io/v3
+- go.kubebuilder.io/v4
 plugins:
   manifests.sdk.operatorframework.io/v2: {}
   scorecard.sdk.operatorframework.io/v2: {}

api/go.mod

@@ -10,7 +10,6 @@ require (
 	github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20251103072528-9eb684fef4ef
 	k8s.io/api v0.31.13
 	k8s.io/apimachinery v0.31.13
-	k8s.io/client-go v0.31.13
 	k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d
 	sigs.k8s.io/controller-runtime v0.19.7
 )
@@ -24,7 +23,6 @@ require (
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
-	github.com/go-logr/zapr v1.3.0 // indirect
 	github.com/go-openapi/jsonpointer v0.21.1 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/swag v0.23.1 // indirect
@@ -53,8 +51,6 @@ require (
 	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/spf13/pflag v1.0.7 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	go.uber.org/multierr v1.11.0 // indirect
-	go.uber.org/zap v1.27.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/exp v0.0.0-20241217172543-b2144cdd0a67 // indirect
@@ -72,6 +68,7 @@ require (
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/apiextensions-apiserver v0.33.2 // indirect
+	k8s.io/client-go v0.31.13 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20250902184714-7fc278399c7f // indirect
 	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect