OPRUN-4666,OPRUN-4671,OPRUN-4672,OPRUN-4673,OPRUN-4674,OPRUN-4659: Synchronize From Upstream Repositories + Remove spec.serviceAccount tests

[tmshort]

Manual sync to remove openshift/ e2e related to deprecated ServiceAccount usage in ClusterExtension API, Synthetic Permissions, and PreFlight Admissions.

Forked from current #762
With the the fix commit from #767

Summary by CodeRabbit

• New Features

  • Added dynamic GraphQL catalog queries with pagination and query-complexity safeguards.
  • Added admission-policy examples and guidance for restricting ClusterExtension access.
  • Added end-to-end demo scenarios with recorded, rendered demonstrations.

• Changes

  • ClusterExtension serviceAccount is now optional, deprecated, and ignored; a warning appears when it is configured.
  • Installation uses the operator’s trusted cluster-admin permissions model.
  • Added support and examples for single-namespace and own-namespace installation modes.

• Documentation

  • Updated manifests, tutorials, API references, and demos to reflect the simplified configuration.

[openshift-ci-robot]

@tmshort: This pull request references OPRUN-4666 which is a valid jira issue.

This pull request references OPRUN-4671 which is a valid jira issue.

This pull request references OPRUN-4672 which is a valid jira issue.

This pull request references OPRUN-4673 which is a valid jira issue.

This pull request references OPRUN-4674 which is a valid jira issue.

This pull request references OPRUN-4659 which is a valid jira issue.

Details

In response to this:

Manual sync to remove openshift/ e2e related to deprecated ServiceAccount usage in ClusterExtension API, Synthetic Permissions, and PreFlight Admissions.

Forked from current #762
With the the fix commit from #767

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

This PR deprecates ignored ClusterExtension.spec.serviceAccount configuration, switches controller operations to cluster-admin credentials, replaces service-account preauthorization and content-manager wiring, modernizes catalog GraphQL loading, and adds e2e demo recording, admission-policy tests, and documentation updates.

Changes

OLMv1 trust and API model

Layer / File(s)	Summary
Deprecated service-account contract api/v1/*, applyconfigurations/api/v1/*, helm/olmv1/base/operator-controller/crd/*	spec.serviceAccount becomes optional, deprecated, ignored, and clearable after being set.
Controller permissions and validation cmd/operator-controller/main.go, internal/operator-controller/controllers/*, manifests/*, helm/olmv1/templates/*	Controller wiring uses a shared tracking cache and cluster-admin binding; admission warnings replace service-account existence validation.
Service-account cleanup across tests and examples openshift/tests-extension/*, test/e2e/features/*, config/samples/*, docs/*	Fixtures, manifests, templates, and examples stop creating or referencing installer service accounts and related RBAC.
Access-control documentation and tests docs/howto/how-to-protect-olmv1-api-access.md, test/e2e/features/vap-access-control.feature	Documents and tests RBAC plus ValidatingAdmissionPolicy restrictions for ClusterExtension operations.

Dynamic GraphQL catalog serving

Layer / File(s)	Summary
Schema discovery and query validation internal/catalogd/graphql/*	Schema metadata is serialized without sample-object caches, array inference samples multiple elements, loaders provide pagination, and query depth, alias, and field limits are enforced.
Provider-backed service and storage internal/catalogd/service/*, internal/catalogd/storage/*, internal/catalogd/server/*	GraphQL services load persisted schemas and indexed objects through a provider, cache schemas with singleflight, apply request contexts and timeouts, and map missing catalogs to HTTP 404 responses.
GraphQL and storage validation internal/catalogd/graphql/*_test.go, internal/catalogd/service/*_test.go, internal/catalogd/storage/*_test.go	Tests cover serialization, discovery, pagination, introspection, complexity limits, cache behavior, persisted schemas, and indexed object loading.

Demo and e2e workflow

Layer / File(s)	Summary
Demo recording pipeline test/e2e/steps/asciicast_*.go, test/e2e/steps/demo_steps.go, Makefile	@demo scenarios record asciicast files, query catalog and workload state, and render recordings to SVG.
Demo scenarios and e2e execution test/e2e/features/demos.feature, test/e2e/features/*, test/e2e/steps/*	Adds catalog, install-mode, webhook, and admission-policy scenarios while making Kubernetes command execution context-aware.
Documentation and build integration README.md, docs/draft/*, mkdocs.yml, requirements.txt, .gitignore	Embeds generated demos, enables the Asciinema MkDocs plugin, updates demo dependencies, and ignores generated recordings.

Image and deployment updates

Layer / File(s)	Summary
Helm image handling removal internal/shared/util/image/*	Image layers are applied directly; Helm chart detection, extraction, caching, and related tests are removed.
Deployment annotations and maintenance internal/operator-controller/rukpak/render/registryv1/*, test/regression/convert/*, scripts/install.tpl.sh, go.mod	Generated deployments include olm.operatorNamespace; installation cleanup and dependency versions are updated.

Estimated code review effort: 5 (Critical) | ~120 minutes

Possibly related PRs

• openshift/operator-framework-operator-controller#770: Related removal of deprecated service-account provisioning and OpenShift e2e coverage.

Sequence Diagram(s)

sequenceDiagram
  participant GraphQLClient
  participant GraphQLHandler
  participant CachedGraphQLService
  participant LocalDirV1
  participant ObjectLoader
  GraphQLClient->>GraphQLHandler: Submit query
  GraphQLHandler->>CachedGraphQLService: ExecuteQuery(ctx, catalog, query)
  CachedGraphQLService->>CachedGraphQLService: ValidateQueryComplexity
  CachedGraphQLService->>LocalDirV1: LoadCatalogSchema(catalog)
  CachedGraphQLService->>LocalDirV1: NewObjectLoader(catalog)
  CachedGraphQLService->>ObjectLoader: Load paged objects
  ObjectLoader-->>CachedGraphQLService: JSON objects
  CachedGraphQLService-->>GraphQLHandler: GraphQL result
  GraphQLHandler-->>GraphQLClient: HTTP response

Loading

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tmshort

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• DOWNSTREAM_OWNERS [tmshort]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Actionable comments posted: 7

🧹 Nitpick comments (1)

test/extension-developer-e2e/extension_developer_test.go (1)

138-169: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Use t.Cleanup so resources are torn down on assertion failure. The final c.Delete calls only execute on the success path; if the EventuallyWithT install assertion fails, the ClusterCatalog and the fixed-name ClusterExtension "registryv1" are left on the cluster and can break reruns.

♻️ Register cleanup right after create

 	require.NoError(t, c.Create(context.Background(), catalog))
+	t.Cleanup(func() { _ = c.Delete(context.Background(), catalog) })

 	require.NoError(t, c.Create(context.Background(), clusterExtension))
+	t.Cleanup(func() { _ = c.Delete(context.Background(), clusterExtension) })

Then drop the trailing c.Delete calls.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/extension-developer-e2e/extension_developer_test.go` around lines 138 -
169, Register t.Cleanup handlers immediately after successfully creating the
ClusterCatalog and ClusterExtension in the test, using c.Delete to remove each
resource even when EventuallyWithT fails. Remove the trailing c.Delete calls
after the assertion, preserving cleanup for both catalog and the fixed-name
ClusterExtension "registryv1".

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.gitignore:
- Around line 57-58: The .gitignore entry for docs/demos/ incorrectly excludes
assets required by the published documentation and README. Remove that ignore
rule so the demo recordings can be committed and included by the mkdocs build;
README.md requires no direct change.

In `@docs/draft/howto/enable-webhook-support.md`:
- Around line 55-59: Fix the asciinema-player embed in the webhook support
how-to by either adding the missing webhook-support.cast asset at the referenced
location or updating the "file" value to an existing tracked cast asset path;
ensure the resulting player reference resolves correctly.

In `@docs/howto/how-to-protect-olmv1-api-access.md`:
- Around line 49-65: Update the ClusterRoleBinding example to grant
clusterextension-installer-role only to team-monitoring, removing the alice User
subject, or update the associated policy matchConditions to include every
granted subject. Keep the RBAC subjects and policy subjects aligned so no
unprotected user receives the installer role.
- Around line 39-41: Update the documented role permissions and corresponding
policy examples to avoid unrestricted ClusterExtension deletion: either remove
delete from the role or add a DELETE policy that uses oldObject to enforce the
same ownership and namespace restrictions. Apply the chosen fix consistently at
the referenced permission and policy examples.

In
`@helm/olmv1/templates/rbac/clusterrolebinding-operator-controller-manager-rolebinding.yml`:
- Around line 11-15: The operator controller is granted the overly broad
built-in cluster-admin role; replace roleRef.name in
helm/olmv1/templates/rbac/clusterrolebinding-operator-controller-manager-rolebinding.yml
lines 11-15 with an appropriate scoped or aggregated ClusterRole, then
regenerate openshift/operator-controller/manifests-experimental.yaml lines
887-891 from the template so both manifests match.

In `@manifests/experimental-e2e.yaml`:
- Around line 2226-2230: Confirm and explicitly document approval of the
intentional cluster-admin binding for the operator-controller ServiceAccount in
manifests/experimental-e2e.yaml:2226-2230,
manifests/experimental.yaml:2187-2191, and
manifests/standard-e2e.yaml:1397-1401; state that no scoped alternative is
planned for these feature sets, rather than changing the bindings.

In `@test/e2e/steps/demo_steps.go`:
- Around line 201-221: Update PodHasContainerCount to propagate the result of
waitFor instead of discarding it, returning the timeout or polling error when
the pod never reaches expected containers and nil only on success. Follow
waitFor’s actual return contract, including converting a non-error failure
result into an appropriate error if necessary, while preserving the existing
recording behavior.

---

Nitpick comments:
In `@test/extension-developer-e2e/extension_developer_test.go`:
- Around line 138-169: Register t.Cleanup handlers immediately after
successfully creating the ClusterCatalog and ClusterExtension in the test, using
c.Delete to remove each resource even when EventuallyWithT fails. Remove the
trailing c.Delete calls after the assertion, preserving cleanup for both catalog
and the fixed-name ClusterExtension "registryv1".

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

[grokspawn]

/lgtm
/verified-by CI

[grokspawn]

/verified by CI

[openshift-ci-robot]

@grokspawn: This PR has been marked as verified by CI.

Details

In response to this:

/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[tmshort]

/test openshift-e2e-aws

[tmshort]

/test openshift-e2e-aws-techpreview

[tmshort]

/test e2e-aws-upgrade-ovn-single-node

[tmshort]

/test openshift-e2e-aws
/test openshift-e2e-aws-techpreview

[tmshort]

/retest

[tmshort]

Closing in favor of merged #767