chore: unpin github.com/openshift/api (#1090)

This commit unpins the version of `github.com/openshift/api` to depend
on the latest version. To continue supporting older OpenShift versions
which require the Console v1alpha1 API (removed since 2024), we fork the
`github.com/openshift/api` under `github.com/rhobs/openshift-api` and
pinned to the same version that was used before this change.

Signed-off-by: Simon Pasquier <spasquie@redhat.com>

Author: simonpasquier

DEPENDENCY_CONSTRAINTS.md

@@ -1,18 +1,18 @@
 # Dependency Constraints
 
-This document describes the constraints and pinned dependencies in this project.
+This document describes how we manage dependencies for this project.
 
-## Pinned Dependencies
+## Forked OpenShift API (`github.com/openshift/api`)
 
-### OpenShift API (`github.com/openshift/api`)
+This project depends on 2 versions of `github.com/openshift/api`:
+* The [canonical version](https://github.com/openshift/api).
+* A [forked version](https://github.com/rhobs/openshift-api).
 
-**Current Version:** `v0.0.0-20240404200104-96ed2d49b255`
-
-**Why Pinned:** The observability-operator needs to support both OpenShift console API `v1` and `v1alpha1` for backward compatibility:
-- OpenShift >= 4.17 uses `console/v1` API  
+**Why Forked:** The observability-operator needs to support both OpenShift console API `v1` and `v1alpha1` for backward compatibility:
+- OpenShift >= 4.17 uses `console/v1` API
 - OpenShift < 4.17 uses `console/v1alpha1` API
 
-Newer versions of `github.com/openshift/api` (after April 2024) have removed the `console/v1alpha1` API, breaking compatibility with older OpenShift versions.
+Newer versions of `github.com/openshift/api` (after April 2024) have removed the `console/v1alpha1` API, breaking compatibility with older OpenShift versions. To continue supporting older versions, we forked the library under (https://github.com/rhobs/openshift-api) using the last commit including the `v1alpha1` API and renaming the Go module in `go.mod` to `github.com/rhobs/openshift-api`.
 
 **Impact:** The codebase maintains dual API support with runtime version detection to create the appropriate Console Plugin resources.
 
@@ -23,37 +23,14 @@ Newer versions of `github.com/openshift/api` (after April 2024) have removed the
 - `pkg/operator/scheme.go` - API scheme registration
 - All uiplugin package files using `osv1alpha1` imports
 
-## Safe to Update Dependencies
-
-The following dependencies can be safely updated:
-- Kubernetes API packages (`k8s.io/*`)
-- Controller Runtime (`sigs.k8s.io/controller-runtime`)
-- Prometheus packages (`github.com/prometheus/*`)
-- RHOBS Prometheus Operator (`github.com/rhobs/obo-prometheus-operator`)
-- Go standard library extensions (`golang.org/x/*`)
-- Utility libraries (`github.com/go-logr/logr`, `github.com/google/go-cmp`, etc.)
-
 ## Updating Dependencies
 
-To update dependencies safely:
-
-1. **Individual updates:** Update specific packages excluding openshift/api:
-   ```bash
-   go get -u k8s.io/api k8s.io/apimachinery k8s.io/client-go
-   go get -u sigs.k8s.io/controller-runtime
-   go get -u github.com/rhobs/obo-prometheus-operator@v0.83.0-rhobs1
-   ```
-
-2. **Avoid bulk updates:** Don't use `go get -u ./...` as it will try to update openshift/api
-
-3. **Always test:** Run `make test-unit` and `make build` after each update
-
-4. **Fix go.sum:** Run `go mod tidy` after updates to fix missing entries
+Dependabot takes care of dependency updates, the configuration is located at `.github/dependabot.yml`.
 
 ## Future Considerations
 
-When OpenShift < 4.17 support is no longer needed:
-1. Remove `console/v1alpha1` API usage
-2. Unpin `github.com/openshift/api` 
-3. Remove dual API support code
-4. Update this document 
+When OpenShift &lt; 4.17 support is no longer needed, we can:
+1. Remove `console/v1alpha1` API usage.
+2. Remove dual API support code.
+3. Remove dependency on `github.com/rhobs/openshift-api` 
+4. Update this document 

go.mod

@@ -9,16 +9,24 @@ require (
 	github.com/google/go-cmp v0.7.0
 	github.com/grafana/tempo-operator v0.20.0
 	github.com/open-telemetry/opentelemetry-operator v0.148.0
-	github.com/openshift/api v3.9.0+incompatible // PINNED: newer versions remove console/v1alpha1 API needed for OpenShift <4.17 compatibility
+	github.com/openshift/api v0.0.0-20260511191110-9b69e5fa27e9
 	github.com/openshift/controller-runtime-common v0.0.0-20260318085703-1812aed6dbd2
-	github.com/openshift/library-go v0.0.0-20260213153706-03f1709971c5
+	github.com/openshift/library-go v0.0.0-20260512121938-431f18311e77
 	github.com/operator-framework/api v0.42.0
+	github.com/perses/perses v0.53.1
+	github.com/perses/plugins/prometheus v0.57.0
+	github.com/perses/plugins/table v0.11.2
+	github.com/perses/plugins/timeserieschart v0.12.1
+	github.com/perses/spec v0.1.2
 	github.com/pkg/errors v0.9.1
 	github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.90.1
 	github.com/prometheus/common v0.67.5
 	github.com/rhobs/obo-prometheus-operator v0.90.1-rhobs1
 	github.com/rhobs/obo-prometheus-operator/pkg/apis/monitoring v0.90.1-rhobs1
 	github.com/rhobs/observability-operator/pkg/apis v0.0.0-20251009091129-76135c924ed6
+	github.com/rhobs/openshift-api v0.0.0-20260512142436-2e89e902a420
+	github.com/rhobs/perses v0.0.0-20260422074433-2c06d5cd1312
+	github.com/rhobs/perses-operator v0.1.10-0.20260422102948-9bec730aa616
 	github.com/stretchr/testify v1.11.1
 	go.uber.org/zap v1.27.1
 	golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90
@@ -35,22 +43,6 @@ require (
 	sigs.k8s.io/controller-runtime v0.23.3
 )
 
-replace (
-	github.com/openshift/api => github.com/openshift/api v0.0.0-20240404200104-96ed2d49b255
-	github.com/openshift/controller-runtime-common => github.com/openshift/controller-runtime-common v0.0.0-20260210092218-8eef974290cd
-	github.com/rhobs/observability-operator/pkg/apis => ./pkg/apis
-)
-
-require (
-	github.com/perses/perses v0.53.1
-	github.com/perses/plugins/prometheus v0.57.0
-	github.com/perses/plugins/table v0.11.2
-	github.com/perses/plugins/timeserieschart v0.12.1
-	github.com/perses/spec v0.1.2
-	github.com/rhobs/perses v0.0.0-20260422074433-2c06d5cd1312
-	github.com/rhobs/perses-operator v0.1.10-0.20260422102948-9bec730aa616
-)
-
 require (
 	cel.dev/expr v0.25.1 // indirect
 	dario.cat/mergo v1.0.2 // indirect
@@ -194,3 +186,5 @@ require (
 	sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )
+
+replace github.com/rhobs/observability-operator/pkg/apis => ./pkg/apis

go.sum

@@ -290,12 +290,12 @@ github.com/open-telemetry/opentelemetry-operator v0.148.0 h1:kzVgjGDejYi/tS6U9Pn
 github.com/open-telemetry/opentelemetry-operator v0.148.0/go.mod h1:FyHoJIYYJj9aSkwdUjpJekEhqtTsBz/LgjxiRp94k5k=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/openshift/api v0.0.0-20240404200104-96ed2d49b255 h1:OPEl/rl/Bt8soLkMUex9PZu9PJB59VPFnaPh/n1Pb3I=
-github.com/openshift/api v0.0.0-20240404200104-96ed2d49b255/go.mod h1:CxgbWAlvu2iQB0UmKTtRu1YfepRg1/vJ64n2DlIEVz4=
-github.com/openshift/controller-runtime-common v0.0.0-20260210092218-8eef974290cd h1:pwYZz6/NjHBCrxp/oalDmVl2KP/10Pimzr+BhfKCF9Q=
-github.com/openshift/controller-runtime-common v0.0.0-20260210092218-8eef974290cd/go.mod h1:v50YKO19Utu2nn7jsWwMFZXmO+HSHdkeDdEdNvOSy88=
-github.com/openshift/library-go v0.0.0-20260213153706-03f1709971c5 h1:9Pe6iVOMjt9CdA/vaKBNUSoEIjIe1po5Ha3ABRYXLJI=
-github.com/openshift/library-go v0.0.0-20260213153706-03f1709971c5/go.mod h1:K3FoNLgNBFYbFuG+Kr8usAnQxj1w84XogyUp2M8rK8k=
+github.com/openshift/api v0.0.0-20260511191110-9b69e5fa27e9 h1:yb8ul1HPFYhO04yp0D8T/qSySZnKv210f4nE//i/Bdg=
+github.com/openshift/api v0.0.0-20260511191110-9b69e5fa27e9/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo=
+github.com/openshift/controller-runtime-common v0.0.0-20260318085703-1812aed6dbd2 h1:GrZlVichOCE/lz8fg1+eNrAtkM0VSlqa9buuzN0vnb0=
+github.com/openshift/controller-runtime-common v0.0.0-20260318085703-1812aed6dbd2/go.mod h1:XGabTMnNbz0M5Oa7IbscZp/jmcc7aHobvOCUWwkzKvM=
+github.com/openshift/library-go v0.0.0-20260512121938-431f18311e77 h1:aj6OEadsB7mJkUoukka+7y0x0Q3o7n/BIAmkPFB4160=
+github.com/openshift/library-go v0.0.0-20260512121938-431f18311e77/go.mod h1:gKG9lctU0yEftSoT3DUyeIWz1oAgF0EHUpwI4pnCo4o=
 github.com/operator-framework/api v0.42.0 h1:rkc5V3zW8RxZMjePAe12jdL7Co/hwsYo1pLnkkhuR7s=
 github.com/operator-framework/api v0.42.0/go.mod h1:bMEj+wl/8tGqcGNtxt38cLUYagu9chNsbYzb/5HQaUQ=
 github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o=
@@ -359,6 +359,8 @@ github.com/rhobs/obo-prometheus-operator/pkg/apis/monitoring v0.90.1-rhobs1 h1:y
 github.com/rhobs/obo-prometheus-operator/pkg/apis/monitoring v0.90.1-rhobs1/go.mod h1:smEIMH0TANmMFkksWwrwxSP/pNdjVa66WNO06Nf7ylc=
 github.com/rhobs/obo-prometheus-operator/pkg/client v0.90.1-rhobs1 h1:Ut5Cirj3CBXMNy0UQnce8XwDEH/Nwv7dgEs1rUyhUrk=
 github.com/rhobs/obo-prometheus-operator/pkg/client v0.90.1-rhobs1/go.mod h1:gy2Ky11XeW8qbt7iyeOd7lhQa9wk+aIQfARs1tAffw4=
+github.com/rhobs/openshift-api v0.0.0-20260512142436-2e89e902a420 h1:7e9fFgSnTQH6mOUK9ne8eueLoDe0qFdxPZn0yYD3T4Y=
+github.com/rhobs/openshift-api v0.0.0-20260512142436-2e89e902a420/go.mod h1:W0V3SoeXIKmaTN3pqMKDiLZ23rc9viuqYenk9+89N+o=
 github.com/rhobs/perses v0.0.0-20260422074433-2c06d5cd1312 h1:FIHpZaFw4s8KwL1MbBbehbhnaIoWqK9w6BQHp8qtk50=
 github.com/rhobs/perses v0.0.0-20260422074433-2c06d5cd1312/go.mod h1:1eTdHfUEzWvkpxzblN5MeXnvcTLoMFSXcAl1rbdEkJo=
 github.com/rhobs/perses-operator v0.1.10-0.20260422102948-9bec730aa616 h1:pBAB0AH1JT21OkD8wpoxeTuPot9mWQWo2KYRKaCzPMo=

pkg/controllers/uiplugin/components.go

@@ -12,7 +12,7 @@ import (
 
 	"github.com/go-logr/logr"
 	osv1 "github.com/openshift/api/console/v1"
-	osv1alpha1 "github.com/openshift/api/console/v1alpha1"
+	osv1alpha1 "github.com/rhobs/openshift-api/console/v1alpha1"
 	"golang.org/x/mod/semver"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -265,8 +265,9 @@ func newConsolePlugin(info UIPluginInfo, namespace string) *osv1.ConsolePlugin {
 					BasePath:  "/",
 				},
 			},
-			Proxy: info.Proxies,
-			I18n:  osv1.ConsolePluginI18n{LoadType: osv1.Preload},
+			Proxy:                 info.Proxies,
+			I18n:                  osv1.ConsolePluginI18n{LoadType: osv1.Preload},
+			ContentSecurityPolicy: []osv1.ConsolePluginCSP{},
 		},
 	}
 }

pkg/controllers/uiplugin/controller.go

@@ -8,8 +8,8 @@ import (
 	"github.com/go-logr/logr"
 	configv1 "github.com/openshift/api/config/v1"
 	osv1 "github.com/openshift/api/console/v1"
-	osv1alpha1 "github.com/openshift/api/console/v1alpha1"
 	operatorv1 "github.com/openshift/api/operator/v1"
+	osv1alpha1 "github.com/rhobs/openshift-api/console/v1alpha1"
 	persesv1alpha2 "github.com/rhobs/perses-operator/api/v1alpha2"
 	appsv1 "k8s.io/api/apps/v1"
 	v1 "k8s.io/api/core/v1"

pkg/controllers/uiplugin/dashboards.go

@@ -2,7 +2,7 @@ package uiplugin
 
 import (
 	osv1 "github.com/openshift/api/console/v1"
-	osv1alpha1 "github.com/openshift/api/console/v1alpha1"
+	osv1alpha1 "github.com/rhobs/openshift-api/console/v1alpha1"
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

pkg/controllers/uiplugin/distributed_tracing.go

@@ -6,7 +6,7 @@ import (
 	"strings"
 
 	osv1 "github.com/openshift/api/console/v1"
-	osv1alpha1 "github.com/openshift/api/console/v1alpha1"
+	osv1alpha1 "github.com/rhobs/openshift-api/console/v1alpha1"
 	"gopkg.in/yaml.v3"
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"

pkg/controllers/uiplugin/logging.go

@@ -10,7 +10,7 @@ import (
 
 	"github.com/go-logr/logr"
 	osv1 "github.com/openshift/api/console/v1"
-	osv1alpha1 "github.com/openshift/api/console/v1alpha1"
+	osv1alpha1 "github.com/rhobs/openshift-api/console/v1alpha1"
 	"gopkg.in/yaml.v3"
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"

pkg/controllers/uiplugin/monitoring.go

@@ -5,7 +5,7 @@ import (
 	"strings"
 
 	osv1 "github.com/openshift/api/console/v1"
-	osv1alpha1 "github.com/openshift/api/console/v1alpha1"
+	osv1alpha1 "github.com/rhobs/openshift-api/console/v1alpha1"
 	persesv1alpha2 "github.com/rhobs/perses-operator/api/v1alpha2"
 	persesconfig "github.com/rhobs/perses/pkg/model/api/config"
 	"golang.org/x/mod/semver"

pkg/controllers/uiplugin/plugin_info_builder.go

@@ -6,8 +6,8 @@ import (
 
 	"github.com/go-logr/logr"
 	osv1 "github.com/openshift/api/console/v1"
-	osv1alpha1 "github.com/openshift/api/console/v1alpha1"
 	libgocrypto "github.com/openshift/library-go/pkg/crypto"
+	osv1alpha1 "github.com/rhobs/openshift-api/console/v1alpha1"
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
 	"k8s.io/client-go/dynamic"