Avoid deploying the operator with default label

DEVELOPER.md

@@ -567,7 +567,7 @@ By default, the memory profiler is disabled. To enable it, add a parameter when
 1. Use `kubectl edit` to open the running deployment for editing:
 
    ```shell
-   kubectl edit deployment verticadb-operator-controller-manager
+   kubectl edit deployment verticadb-operator-manager
    ```
 
 2. Locate the `args` array that passes values to the deployment manager, and add `--enable-profiler`:
@@ -588,7 +588,7 @@ By default, the memory profiler is disabled. To enable it, add a parameter when
 4. Port forward 6060 to access the profiler's user interface (UI). The name of the pod differs for each deployment, so make sure that you find the one specific to your cluster:
 
    ```shell
-   kubectl port-forward pod/verticadb-operator-controller-manager-5dd5b54df4-2krcr 6060:6060
+   kubectl port-forward pod/verticadb-operator-manager-5dd5b54df4-2krcr 6060:6060
    ```
 
 5. Use a web browser or the standalone tool to connect to the profiler's UI at `http://localhost:6060/debug/pprof`.

changes/unreleased/Fixed-20240212-212436.yaml

@@ -0,0 +1,5 @@
+kind: Fixed
+body: Avoid deploying the operator with default label
+time: 2024-02-12T21:24:36.201941181-04:00
+custom:
+  Issue: "701"

config/clusterpermissions/cluster_role_binding.yaml

@@ -4,9 +4,9 @@ metadata:
   name: openshift-cluster-rolebinding
 subjects:
 - kind: ServiceAccount
-  name: controller-manager
+  name: verticadb-operator
   namespace: system
 roleRef:
   kind: ClusterRole
   name: openshift-cluster-role
-  apiGroup: rbac.authorization.k8s.io
+  apiGroup: rbac.authorization.k8s.io

config/default/kustomization.yaml

@@ -27,7 +27,7 @@ resources:
 
 patchesStrategicMerge:
 # Protect the /metrics endpoint by putting it behind auth.
-# If you want your controller-manager to expose the /metrics
+# If you want your operator to expose the /metrics
 # endpoint w/o any authn/z, please comment the following line.
 - manager_auth_proxy_patch.yaml
 

config/default/manager_auth_proxy_patch.yaml

@@ -3,7 +3,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: controller-manager
+  name: manager
   namespace: system
 spec:
   template:
@@ -47,7 +47,7 @@ spec:
         - "--level=info"
         - "--dev=false"
         - "--prefix-name=verticadb-operator"
-        - "--webhook-cert-secret=verticadb-operator-controller-manager-service-cert"
+        - "--webhook-cert-secret=verticadb-operator-service-cert"
         - "--verticadb-concurrency=5"
         - "--verticaautoscaler-concurrency=1"
         - "--eventtrigger-concurrency=1"

config/default/manager_config_patch.yaml

@@ -1,7 +1,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: controller-manager
+  name: manager
   namespace: system
 spec:
   template:

config/default/manager_webhook_patch.yaml

@@ -1,7 +1,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: controller-manager
+  name: manager
   namespace: system
 spec:
   template:

config/manager/manager.yaml

@@ -1,21 +1,21 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: controller-manager
+  name: manager
   namespace: system
   labels:
-    control-plane: controller-manager
+    control-plane: verticadb-operator
 spec:
   selector:
     matchLabels:
-      control-plane: controller-manager
+      control-plane: verticadb-operator
   replicas: 1
   template:
     metadata:
       annotations:
         kubectl.kubernetes.io/default-container: manager
       labels:
-        control-plane: controller-manager
+        control-plane: verticadb-operator
         app.kubernetes.io/name: verticadb-operator
     spec:
       securityContext:
@@ -64,7 +64,7 @@ spec:
               configMapKeyRef:
                 name: manager-config
                 key: VERSION
-      serviceAccountName: controller-manager
+      serviceAccountName: verticadb-operator-manager
       terminationGracePeriodSeconds: 10
       volumes:
       - name: tmp

config/manifests/kustomization.yaml

@@ -14,7 +14,7 @@ patchesJson6902:
     group: apps
     version: v1
     kind: Deployment
-    name: controller-manager
+    name: manager
     namespace: system
   patch: |-
     # Remove the manager container's "cert" volumeMount, since OLM will create and mount a set of certs.

config/prometheus/monitor.yaml

@@ -4,7 +4,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   labels:
-    control-plane: controller-manager
+    control-plane: verticadb-operator
   name: metrics-monitor
   namespace: system
 spec:
@@ -17,4 +17,4 @@ spec:
         insecureSkipVerify: true
   selector:
     matchLabels:
-      control-plane: controller-manager
+      control-plane: verticadb-operator

config/rbac/auth_proxy_client_clusterrolebinding.yaml

@@ -8,7 +8,7 @@ roleRef:
   name: metrics-reader
 subjects:
 - kind: ServiceAccount
-  name: controller-manager
+  name: manager
   namespace: system
 - apiGroup: rbac.authorization.k8s.io
   kind: Group

config/rbac/auth_proxy_role_binding.yaml

@@ -8,5 +8,5 @@ roleRef:
   name: proxy-role
 subjects:
 - kind: ServiceAccount
-  name: controller-manager
+  name: manager
   namespace: system

config/rbac/auth_proxy_service.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
   labels:
-    control-plane: controller-manager
+    control-plane: verticadb-operator
     vertica.com/svc-type: operator-metrics
   name: metrics-service
   namespace: system
@@ -13,4 +13,4 @@ spec:
     protocol: TCP
     targetPort: metrics
   selector:
-    control-plane: controller-manager
+    control-plane: verticadb-operator

config/rbac/leader_election_role_binding.yaml

@@ -8,5 +8,5 @@ roleRef:
   name: leader-election-role
 subjects:
 - kind: ServiceAccount
-  name: controller-manager
+  name: manager
   namespace: system

config/rbac/role_binding.yaml

@@ -8,5 +8,5 @@ roleRef:
   apiGroup: rbac.authorization.k8s.io
 subjects:
 - kind: ServiceAccount
-  name: controller-manager
+  name: manager
   namespace: system

config/rbac/service_account.yaml

@@ -1,5 +1,5 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: controller-manager
+  name: manager
   namespace: system

config/webhook/service.yaml

@@ -5,12 +5,12 @@ metadata:
   name: webhook-service
   namespace: system
   labels:
-    control-plane: controller-manager
+    control-plane: verticadb-operator
     vertica.com/svc-type: webhook
 spec:
   ports:
     - port: 443
       protocol: TCP
       targetPort: 9443
   selector:
-    control-plane: controller-manager
+    control-plane: verticadb-operator

helm-charts/verticadb-operator/templates/_helpers.tpl

@@ -12,7 +12,7 @@ Choose the serviceAccount name
 {{- if .Values.serviceAccountNameOverride }}
 {{- .Values.serviceAccountNameOverride }}
 {{- else }}
-{{- include "vdb-op.name" . }}-controller-manager
+{{- include "vdb-op.name" . }}-manager
 {{- end }}
 {{- end }}
 
@@ -38,6 +38,6 @@ it is generated internally)
 {{- else if eq .Values.webhook.certSource "internal" }}
 {{- "" }}
 {{- else }}
-{{- include "vdb-op.name" . }}-controller-manager-service-cert
+{{- include "vdb-op.name" . }}-service-cert
 {{- end }}
 {{- end }}

helm-charts/verticadb-operator/tests/image-name-and-tag_test.yaml

@@ -1,6 +1,6 @@
 suite: image tests
 templates:
-  - verticadb-operator-controller-manager-deployment.yaml
+  - verticadb-operator-manager-deployment.yaml
 tests:
   - it: allows the operator image and tag to be specified
     set:

helm-charts/verticadb-operator/tests/kind-concurrency_test.yaml

@@ -1,6 +1,6 @@
 suite: test that verifies we can control the concurrency of reconcile iterations
 templates:
-  - verticadb-operator-controller-manager-deployment.yaml
+  - verticadb-operator-manager-deployment.yaml
 tests:
   - it: we can specify a concurrency for various CRs
     set:

helm-charts/verticadb-operator/tests/metric-cert_test.yaml

@@ -1,6 +1,6 @@
 suite: Metrics certificate tests
 templates:
-  - verticadb-operator-controller-manager-deployment.yaml
+  - verticadb-operator-manager-deployment.yaml
 tests:
   - it: should include the cert if prometheus.tlsSecret is set
     set:

helm-charts/verticadb-operator/tests/metrics-deployment_test.yaml

@@ -1,6 +1,6 @@
 suite: Metrics deployment tests
 templates:
-  - verticadb-operator-controller-manager-deployment.yaml
+  - verticadb-operator-manager-deployment.yaml
 tests:
   - it: should not include proxy sidecar if expose is disabled
     set:

helm-charts/verticadb-operator/tests/pod-schedule_test.yaml

@@ -1,6 +1,6 @@
 suite: test that control where the operator is scheduled
 templates:
-  - verticadb-operator-controller-manager-deployment.yaml
+  - verticadb-operator-manager-deployment.yaml
 tests:
   - it: we can specify a node selector
     set:

helm-charts/verticadb-operator/tests/resources_test.yaml

@@ -1,6 +1,6 @@
 suite: test that resources can be specified for the operator 
 templates:
-  - verticadb-operator-controller-manager-deployment.yaml
+  - verticadb-operator-manager-deployment.yaml
 tests:
   - it: we can override the resources for the pod
     set:

helm-charts/verticadb-operator/tests/serviceaccount_test.yaml

@@ -1,6 +1,6 @@
 suite: ServiceAccount tests
 templates:
-  - verticadb-operator-controller-manager-sa.yaml
+  - verticadb-operator-manager-sa.yaml
 tests:
   - it: should allow you to override the serviceaccount name
     set:

pkg/kstepgen/kill_operator.go

@@ -48,7 +48,7 @@ var killOperatorPodTemplate = `
 apiVersion: kuttl.dev/v1beta1
 kind: TestStep
 commands:
-  - command: kubectl -n {{ .Namespace }} delete pod -l control-plane=controller-manager
+  - command: kubectl -n {{ .Namespace }} delete pod -l control-plane=verticadb-operator
   - command: {{ .ScriptsDir }}/wait-for-webhook.sh -n {{ .Namespace }}
 `
 

pkg/security/webhook.go

@@ -267,7 +267,7 @@ func getWebhookServiceName(prefixName string) string {
 	// We have slightly different names depending on the deployment type since
 	// OLM likes to generate it themselves and tie the CA cert to it.
 	if val, ok := os.LookupEnv(vmeta.OperatorDeploymentMethodEnvVar); ok && val == vmeta.OLMDeploymentType {
-		return fmt.Sprintf("%s-controller-manager-service", prefixName)
+		return fmt.Sprintf("%s-manager-service", prefixName)
 	}
 	return fmt.Sprintf("%s-webhook-service", prefixName)
 }

scripts/authorize-metrics.sh

@@ -23,7 +23,7 @@ set -o pipefail
 
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
 REPO_DIR=$(dirname $SCRIPT_DIR)
-OP_SA=verticadb-operator-controller-manager
+OP_SA=verticadb-operator
 UNDO=
 
 function usage() {