refactor: replace contentmanager with shared TrackingCache

Replace the per-ClusterExtension contentmanager cache with a single
shared TrackingCache from boxcutter/managedcache. The contentmanager
created per-CE dynamic clients and informer factories for drift
detection; now that all operations use the same controller identity,
a single global cache is simpler and more efficient.

- Create TrackingCache at shared scope before controller setup
- Wire TrackingCache.Source to CE controller via WithWatchesRawSource
- Replace Manager+Watcher fields in Helm applier with trackingCache
  interface (Watch + Free)
- Suppress Create events on the source predicate to match old behavior
- Update finalizer to call TrackingCache.Free instead of cm.Delete
- Remove ClientRestConfigMapper from Helm action config getter
- Update helm_test.go mocks for new interface
- Delete contentmanager/ package (~1,240 lines)

OPRUN-4633

Co-Authored-By: Claude <noreply@anthropic.com>

Author: pedjak

.claude/TODO-OCPSTRAT-3040.md

@@ -69,12 +69,12 @@ Anyone:      Stream 6 (docs) ← after 4
 
 ### Stream 5 — Global shared cache refactor (after stream 4)
 
-- [ ] Refactor `contentmanager/` from per-CE caches to single global cache — **OPRUN-4633**
-- [ ] Remove `createScopedClient` from `revision_engine_factory.go` — **OPRUN-4633**
-- [ ] Simplify `RestConfigMapper` pattern — **OPRUN-4633**
-- [ ] Refactor Boxcutter to shared client (if applicable) — **OPRUN-4633**
-- [ ] Verify no regression in drift detection / managed content watching — **OPRUN-4633**
-- [ ] Update unit + e2e tests — **OPRUN-4633**
+- [X] Refactor `contentmanager/` from per-CE caches to single global cache — **OPRUN-4633**
+- [X] Remove `createScopedClient` from `revision_engine_factory.go` — **OPRUN-4633** `61b62e78` (Daniel)
+- [X] Simplify `RestConfigMapper` pattern — **OPRUN-4633**
+- [X] Refactor Boxcutter to shared client (if applicable) — **OPRUN-4633** `61b62e78` (Daniel)
+- [X] Verify no regression in drift detection / managed content watching — **OPRUN-4633**
+- [X] Update unit + e2e tests — **OPRUN-4633**
 
 > **Ticket close gate:** OPRUN-4633 closable when all stream 5 items are done
 

cmd/operator-controller/main.go

@@ -41,20 +41,22 @@ import (
 	"k8s.io/client-go/discovery/cached/memory"
 	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
-	"k8s.io/client-go/rest"
 	"k8s.io/klog/v2"
 	"k8s.io/utils/ptr"
 	"pkg.package-operator.run/boxcutter/managedcache"
 	ctrl "sigs.k8s.io/controller-runtime"
 	crcache "sigs.k8s.io/controller-runtime/pkg/cache"
 	"sigs.k8s.io/controller-runtime/pkg/certwatcher"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/event"
 	crfinalizer "sigs.k8s.io/controller-runtime/pkg/finalizer"
+	crhandler "sigs.k8s.io/controller-runtime/pkg/handler"
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
 	"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
 	"sigs.k8s.io/controller-runtime/pkg/metrics/server"
+	"sigs.k8s.io/controller-runtime/pkg/predicate"
 
 	helmclient "github.com/operator-framework/helm-operator-plugins/pkg/client"
 
@@ -63,8 +65,6 @@ import (
 	"github.com/operator-framework/operator-controller/internal/operator-controller/applier"
 	"github.com/operator-framework/operator-controller/internal/operator-controller/catalogmetadata/cache"
 	catalogclient "github.com/operator-framework/operator-controller/internal/operator-controller/catalogmetadata/client"
-	"github.com/operator-framework/operator-controller/internal/operator-controller/contentmanager"
-	cmcache "github.com/operator-framework/operator-controller/internal/operator-controller/contentmanager/cache"
 	"github.com/operator-framework/operator-controller/internal/operator-controller/controllers"
 	"github.com/operator-framework/operator-controller/internal/operator-controller/features"
 	"github.com/operator-framework/operator-controller/internal/operator-controller/finalizers"
@@ -118,6 +118,7 @@ type boxcutterReconcilerConfigurator struct {
 	imageCache            imageutil.Cache
 	imagePuller           imageutil.Puller
 	finalizers            crfinalizer.Finalizers
+	trackingCache         managedcache.TrackingCache
 }
 
 type helmReconcilerConfigurator struct {
@@ -128,7 +129,7 @@ type helmReconcilerConfigurator struct {
 	imageCache            imageutil.Cache
 	imagePuller           imageutil.Puller
 	finalizers            crfinalizer.Finalizers
-	watcher               cmcache.Watcher
+	trackingCache         managedcache.TrackingCache
 }
 
 const (
@@ -459,15 +460,40 @@ func run() error {
 		crdupgradesafety.NewPreflight(aeClient.CustomResourceDefinitions()),
 	}
 
+	trackingCache, err := managedcache.NewTrackingCache(
+		ctrl.Log.WithName("trackingCache"),
+		mgr.GetConfig(),
+		crcache.Options{
+			Scheme: mgr.GetScheme(), Mapper: mgr.GetRESTMapper(),
+		},
+	)
+	if err != nil {
+		setupLog.Error(err, "unable to create tracking cache")
+		return err
+	}
+	if err := mgr.Add(trackingCache); err != nil {
+		setupLog.Error(err, "unable to add tracking cache to manager")
+		return err
+	}
+
 	var ctrlBuilderOpts []controllers.ControllerBuilderOption
 	if features.OperatorControllerFeatureGate.Enabled(features.BoxcutterRuntime) {
 		ctrlBuilderOpts = append(ctrlBuilderOpts, controllers.WithOwns(&ocv1.ClusterObjectSet{}))
 	}
+	ctrlBuilderOpts = append(ctrlBuilderOpts, controllers.WithWatchesRawSource(
+		trackingCache.Source(
+			crhandler.EnqueueRequestForOwner(mgr.GetScheme(), mgr.GetRESTMapper(), &ocv1.ClusterExtension{}),
+			predicate.ResourceVersionChangedPredicate{},
+			predicate.Funcs{
+				CreateFunc: func(event.TypedCreateEvent[client.Object]) bool { return false },
+			},
+		),
+	))
 
 	ceReconciler := &controllers.ClusterExtensionReconciler{
 		Client: cl,
 	}
-	ceController, err := ceReconciler.SetupWithManager(mgr, ctrlBuilderOpts...)
+	_, err = ceReconciler.SetupWithManager(mgr, ctrlBuilderOpts...)
 	if err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "ClusterExtension")
 		return err
@@ -491,6 +517,7 @@ func run() error {
 			imageCache:            imageCache,
 			imagePuller:           imagePuller,
 			finalizers:            clusterExtensionFinalizers,
+			trackingCache:         trackingCache,
 		}
 	} else {
 		cerCfg = &helmReconcilerConfigurator{
@@ -501,7 +528,7 @@ func run() error {
 			imageCache:            imageCache,
 			imagePuller:           imagePuller,
 			finalizers:            clusterExtensionFinalizers,
-			watcher:               ceController,
+			trackingCache:         trackingCache,
 		}
 	}
 	if err := cerCfg.Configure(ceReconciler); err != nil {
@@ -642,23 +669,9 @@ func (c *boxcutterReconcilerConfigurator) Configure(ceReconciler *controllers.Cl
 	// Wrap the discovery client with caching to reduce memory usage from repeated OpenAPI schema fetches
 	discoveryClient := memory.NewMemCacheClient(baseDiscoveryClient)
 
-	trackingCache, err := managedcache.NewTrackingCache(
-		ctrl.Log.WithName("trackingCache"),
-		c.mgr.GetConfig(),
-		crcache.Options{
-			Scheme: c.mgr.GetScheme(), Mapper: c.mgr.GetRESTMapper(),
-		},
-	)
-	if err != nil {
-		return fmt.Errorf("unable to create boxcutter tracking cache: %v", err)
-	}
-	if err := c.mgr.Add(trackingCache); err != nil {
-		return fmt.Errorf("unable to add tracking cache to manager: %v", err)
-	}
-
 	revisionEngineFactory, err := controllers.NewDefaultRevisionEngineFactory(
 		c.mgr.GetScheme(),
-		trackingCache,
+		c.trackingCache,
 		discoveryClient,
 		c.mgr.GetRESTMapper(),
 		fieldOwnerPrefix,
@@ -676,7 +689,7 @@ func (c *boxcutterReconcilerConfigurator) Configure(ceReconciler *controllers.Cl
 	if err = (&controllers.ClusterObjectSetReconciler{
 		Client:                cosClient,
 		RevisionEngineFactory: revisionEngineFactory,
-		TrackingCache:         trackingCache,
+		TrackingCache:         c.trackingCache,
 	}).SetupWithManager(c.mgr); err != nil {
 		return fmt.Errorf("unable to setup ClusterObjectSet controller: %w", err)
 	}
@@ -688,17 +701,12 @@ func (c *helmReconcilerConfigurator) Configure(ceReconciler *controllers.Cluster
 	if err != nil {
 		return fmt.Errorf("unable to create core client: %w", err)
 	}
-	clientRestConfigMapper := func(_ context.Context, _ client.Object, _ *rest.Config) (*rest.Config, error) {
-		return rest.CopyConfig(c.mgr.GetConfig()), nil
-	}
-
 	cfgGetter, err := helmclient.NewActionConfigGetter(c.mgr.GetConfig(), c.mgr.GetRESTMapper(),
 		helmclient.StorageDriverMapper(action.ChunkedStorageDriverMapper(coreClient, c.mgr.GetAPIReader(), cfg.systemNamespace)),
 		helmclient.ClientNamespaceMapper(func(obj client.Object) (string, error) {
 			ext := obj.(*ocv1.ClusterExtension)
 			return ext.Spec.Namespace, nil
 		}),
-		helmclient.ClientRestConfigMapper(clientRestConfigMapper),
 	)
 	if err != nil {
 		return fmt.Errorf("unable to create helm action config getter: %w", err)
@@ -711,11 +719,8 @@ func (c *helmReconcilerConfigurator) Configure(ceReconciler *controllers.Cluster
 		return fmt.Errorf("unable to create helm action client getter: %w", err)
 	}
 
-	cm := contentmanager.NewManager(clientRestConfigMapper, c.mgr.GetConfig(), c.mgr.GetRESTMapper())
 	err = c.finalizers.Register(controllers.ClusterExtensionCleanupContentManagerCacheFinalizer, finalizers.FinalizerFunc(func(ctx context.Context, obj client.Object) (crfinalizer.Result, error) {
-		ext := obj.(*ocv1.ClusterExtension)
-		err := cm.Delete(ext)
-		return crfinalizer.Result{}, err
+		return crfinalizer.Result{}, c.trackingCache.Free(ctx, obj)
 	}))
 	if err != nil {
 		setupLog.Error(err, "unable to register content manager cleanup finalizer")
@@ -729,8 +734,7 @@ func (c *helmReconcilerConfigurator) Configure(ceReconciler *controllers.Cluster
 			ManifestProvider: c.regv1ManifestProvider,
 		},
 		HelmReleaseToObjectsConverter: &applier.HelmReleaseToObjectsConverter{},
-		Watcher:                       c.watcher,
-		Manager:                       cm,
+		TrackingCache:                 c.trackingCache,
 	}
 	revisionStatesGetter := &controllers.HelmRevisionStatesGetter{ActionClientGetter: acg}
 	ceReconciler.ReconcileSteps = []controllers.ReconcileStepFunc{

internal/operator-controller/applier/helm.go

@@ -16,20 +16,25 @@ import (
 	"helm.sh/helm/v3/pkg/release"
 	"helm.sh/helm/v3/pkg/storage/driver"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/sets"
 	apimachyaml "k8s.io/apimachinery/pkg/util/yaml"
 	"k8s.io/klog/v2"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	helmclient "github.com/operator-framework/helm-operator-plugins/pkg/client"
 
 	ocv1 "github.com/operator-framework/operator-controller/api/v1"
-	"github.com/operator-framework/operator-controller/internal/operator-controller/contentmanager"
-	"github.com/operator-framework/operator-controller/internal/operator-controller/contentmanager/cache"
 	"github.com/operator-framework/operator-controller/internal/operator-controller/features"
 	"github.com/operator-framework/operator-controller/internal/operator-controller/rukpak/util"
 	imageutil "github.com/operator-framework/operator-controller/internal/shared/util/image"
 )
 
+type trackingCache interface {
+	Watch(ctx context.Context, user client.Object, gvks sets.Set[schema.GroupVersionKind]) error
+	Free(ctx context.Context, user client.Object) error
+}
+
 // HelmChartProvider provides helm charts from bundle sources and cluster extensions
 type HelmChartProvider interface {
 	Get(bundle fs.FS, clusterExtension *ocv1.ClusterExtension) (*chart.Chart, error)
@@ -60,8 +65,7 @@ type Helm struct {
 	HelmChartProvider             HelmChartProvider
 	HelmReleaseToObjectsConverter HelmReleaseToObjectsConverterInterface
 
-	Manager contentmanager.Manager
-	Watcher cache.Watcher
+	TrackingCache trackingCache
 }
 
 func (h *Helm) Apply(ctx context.Context, contentFS fs.FS, ext *ocv1.ClusterExtension, objectLabels map[string]string, storageLabels map[string]string) (bool, string, error) {
@@ -149,12 +153,8 @@ func (h *Helm) Apply(ctx context.Context, contentFS fs.FS, ext *ocv1.ClusterExte
 		return true, "", err
 	}
 	klog.FromContext(ctx).Info("watching managed objects")
-	cache, err := h.Manager.Get(ctx, ext)
-	if err != nil {
-		return true, "", err
-	}
-
-	if err := cache.Watch(ctx, h.Watcher, relObjects...); err != nil {
+	gvks := gvksForObjects(relObjects)
+	if err := h.TrackingCache.Watch(ctx, ext, gvks); err != nil {
 		return true, "", err
 	}
 
@@ -194,22 +194,12 @@ func (h *Helm) reconcileExistingRelease(ctx context.Context, ac helmclient.Actio
 
 	logger.V(1).Info("setting up drift detection watches on managed objects")
 
-	// Defensive nil checks to prevent panics if Manager or Watcher not properly initialized
-	if h.Manager == nil {
-		logger.Error(fmt.Errorf("manager is nil"), "Manager not initialized, cannot set up drift detection watches (resources are applied but drift detection disabled)")
+	if h.TrackingCache == nil {
+		logger.Error(fmt.Errorf("tracking cache is nil"), "TrackingCache not initialized, cannot set up drift detection watches (resources are applied but drift detection disabled)")
 		return true, "", nil
 	}
-	cache, err := h.Manager.Get(ctx, ext)
-	if err != nil {
-		logger.Error(err, "failed to get managed content cache, cannot set up drift detection watches (resources are applied but drift detection disabled)")
-		return true, "", nil
-	}
-
-	if h.Watcher == nil {
-		logger.Error(fmt.Errorf("watcher is nil"), "Watcher not initialized, cannot set up drift detection watches (resources are applied but drift detection disabled)")
-		return true, "", nil
-	}
-	if err := cache.Watch(ctx, h.Watcher, relObjects...); err != nil {
+	gvks := gvksForObjects(relObjects)
+	if err := h.TrackingCache.Watch(ctx, ext, gvks); err != nil {
 		logger.Error(err, "failed to set up drift detection watches (resources are applied but drift detection disabled)")
 		return true, "", nil
 	}
@@ -298,3 +288,11 @@ func (p *postrenderer) Run(renderedManifests *bytes.Buffer) (*bytes.Buffer, erro
 	}
 	return &buf, nil
 }
+
+func gvksForObjects(objs []client.Object) sets.Set[schema.GroupVersionKind] {
+	gvks := sets.New[schema.GroupVersionKind]()
+	for _, obj := range objs {
+		gvks.Insert(obj.GetObjectKind().GroupVersionKind())
+	}
+	return gvks
+}