Merge remote-tracking branch 'upstream/main'

Author: moulalis

.github/workflows/rhai-on-xks-chart-test.yaml

@@ -48,7 +48,7 @@ jobs:
           printf '%s' "${RHAI_PULL_SECRET}" > "${PULL_SECRET_FILE}"
           make helm-install-verify-xks \
             XKS_CLOUD_PROVIDER=${{ matrix.cloud_provider }} \
-            HELM_EXTRA_ARGS="--set-file imagePullSecret.dockerConfigJson=${PULL_SECRET_FILE}"
+            XKS_PULL_SECRET="${PULL_SECRET_FILE}"
 
       - name: Dump custom resources on failure
         if: failure()

.rules/helm-xks-chart.md

@@ -11,22 +11,41 @@ Template prefix: `rhai-on-xks-chart.` for all helpers.
 - `templates/rbac/` — ServiceAccount, ClusterRole, ClusterRoleBinding.
 - `templates/crds/` — CRDs bundled in chart.
 - `templates/hooks/` — post-install Jobs (CRs creation, gateway setup).
+  - `_crs-definitions.tpl` — **single source of truth** for provider and component CR metadata; add new providers/CRs here only. All templates update automatically.
 - `templates/webhooks/` — MutatingWebhookConfiguration.
 - `templates/cloudmanager/{azure,coreweave}/` — cloud-specific resources (RBAC, CRDs, deployment).
 - `templates/pull-secret.yaml` — optional image pull secret.
 - `templates/validation.yaml` — calls `validateCloudProvider`.
 
 ### Cloud provider pattern
 
-Exactly one of `azure.enabled` or `coreweave.enabled` must be true. Validated by `validateCloudProvider` helper.
-Cloud-specific templates gated with `{{- if .Values.<provider>.enabled }}`.
+Exactly one of `aws.enabled`, `azure.enabled`, or `coreweave.enabled` must be true. Validated by `validateCloudProvider` helper.
+Use `activeProvider | fromYaml` to access the active provider — avoid ranging over all providers or checking `.Values.<provider>.enabled` directly.
 
-### Key helpers (`_helpers.tpl`)
+**To add a new provider:** add one entry to `providerRegistry` in `templates/hooks/_crs-definitions.tpl`. No other templates need changing.
+
+### Component CR pattern
+
+Component CRs (e.g. Kserve from `components.platform.opendatahub.io`) are created/deleted via post-install and pre-delete hook jobs.
+
+**To add a new component CR:** add one entry to `componentCRRegistry` in `templates/hooks/_crs-definitions.tpl`. No other templates need changing.
+
+### Key helpers
+
+**`templates/_helpers.tpl`:**
 
 - `validateCloudProvider`: fails if zero or multiple providers enabled.
-- `imagePullSecretEnabled`: checks `imagePullSecret.dockerConfigJson`.
-- `imagePullSecretName`: defaults to `rhai-pull-secret`.
-- `imagePullSecrets`: renders pod spec block.
+- `keResourceName`: returns plural KE resource name for the active provider.
+- `kubernetesEngineDependencyNamespaces`: collects namespaces from enabled provider KE dependencies.
+- `imagePullSecretEnabled` / `imagePullSecretName` / `imagePullSecrets`: image pull secret helpers.
+
+**`templates/hooks/_crs-definitions.tpl`:**
+
+- `providerRegistry` / `componentCRRegistry`: static YAML maps — CR kind, resource name (plural + singular), default CR name, API group.
+- `activeProvider`: returns YAML dict for the one enabled provider. Parse with `| fromYaml`. Fields: `name`, `keKind`, `keResource`, `keResourceSingular`, `keName`, `keEnabled` (bool), `keSpec`, `cloudManagerNamespace`. Returns empty map if no provider enabled.
+- `enabledProviderKECR`: returns `"true"` (truthy) or empty string when provider + KE are both enabled. Used as a boolean guard only — do not parse or inspect contents.
+- `enabledComponentCRs`: returns a JSON list of enabled component names. Parse with `fromJson` before use in guards (`if or $componentCRs $providerKECR`). Do not range over or access fields — use `crApplyCommands` / `crDeleteCommands` instead.
+- `crApplyCommands` / `crDeleteCommands`: emit kubectl apply/delete bash commands for all enabled CRs. Include with `| trimPrefix "\n" | nindent 14`.
 
 ### Image updates
 

Makefile

@@ -296,19 +296,16 @@ XKS_CHART_PATH ?= $(CHARTS_DIR)/rhai-on-xks-chart
 XKS_RELEASE_NAME ?= rhai-on-xks
 XKS_NAMESPACE ?= rhai-on-xks
 XKS_CLOUD_PROVIDER ?= azure
+XKS_PULL_SECRET ?=
 
 .PHONY: helm-verify-xks
-helm-verify-xks: ## Verify rhai-on-xks-chart installation
-	RELEASE_NAME=$(XKS_RELEASE_NAME) NAMESPACE=$(XKS_NAMESPACE) CLOUD_PROVIDER=$(XKS_CLOUD_PROVIDER) ./charts/rhai-on-xks-chart/scripts/verify.sh
+helm-verify-xks: ## Verify rhai-on-xks-chart installation and lifecycle. Use XKS_TEST=<num> for specific test
+	RELEASE_NAME="$(XKS_RELEASE_NAME)" NAMESPACE="$(XKS_NAMESPACE)" CLOUD_PROVIDER="$(XKS_CLOUD_PROVIDER)" PULL_SECRET="$(XKS_PULL_SECRET)" HELM_EXTRA_ARGS="$(HELM_EXTRA_ARGS)" bash ./charts/rhai-on-xks-chart/scripts/verify.sh $(XKS_TEST)
 
 .PHONY: helm-install-verify-xks
 helm-install-verify-xks: ## Install and verify rhai-on-xks-chart
-	@echo "=== Step 1: Install rhai-on-xks-chart ==="
 	# TODO(RHOAIENG-63729): remove -f values-e2e.yaml once a runner with sufficient resources is available
-	helm upgrade --install $(XKS_RELEASE_NAME) ./$(XKS_CHART_PATH) -n $(XKS_NAMESPACE) --create-namespace --set $(XKS_CLOUD_PROVIDER).enabled=true -f $(XKS_CHART_PATH)/test/values-e2e.yaml $(HELM_EXTRA_ARGS)
-	@echo ""
-	@echo "=== Step 2: Verify installation ==="
-	$(MAKE) helm-verify-xks
+	VALUES_FILE=$(XKS_CHART_PATH)/test/values-e2e.yaml $(MAKE) helm-verify-xks
 
 .PHONY: helm-uninstall
 helm-uninstall: ## Uninstall helm chart and all dependencies

charts/README.md

@@ -174,7 +174,6 @@ apiVersion: sailoperator.io/v1
 kind: Istio
 metadata:
   name: default
-  namespace: istio-system
 spec:
   namespace: istio-system
   version: v1.27-latest

charts/dependencies/sail-operator/templates/istio.yaml

@@ -2,7 +2,6 @@ apiVersion: sailoperator.io/v1
 kind: Istio
 metadata:
   name: default
-  namespace: {{ .Values.namespace }}
 spec:
   namespace: {{ .Values.namespace }}
   version: v1.27-latest

charts/dependencies/sail-operator/test/snapshots/default.snap.yaml

@@ -563,7 +563,6 @@ apiVersion: sailoperator.io/v1
 kind: Istio
 metadata:
   name: default
-  namespace: istio-system
 spec:
   namespace: istio-system
   version: v1.27-latest

charts/rhai-on-xks-chart/api-docs.md

@@ -98,4 +98,5 @@ RHAI on XKS Helm chart for non-OLM installation on non-OpenShift Kubernetes serv
 | rhaiOperator.resources.limits.memory | string | `"1Gi"` |  |
 | rhaiOperator.resources.requests.cpu | string | `"300m"` |  |
 | rhaiOperator.resources.requests.memory | string | `"256Mi"` |  |
+| uninstall.cleanupNamespaces | bool | `false` |  |