HYPERFLEET-1406 - feat: implement the bundle controller and reconcile the API component

cmd/main.go

@@ -202,9 +202,22 @@ func main() {
 		os.Exit(1)
 	}
 
+	// operatorNamespace is where all operands are created. It comes from the
+	// downward API (POD_NAMESPACE) in-cluster; the fallback keeps `make run` and
+	// local development working when the env var is absent. The fallback must
+	// match the deploy namespace in config/default/kustomization.yaml.
+	operatorNamespace := os.Getenv("POD_NAMESPACE")
+	if operatorNamespace == "" {
+		operatorNamespace = "hyperfleet-operator-system"
+		setupLog.Info("POD_NAMESPACE not set; falling back to default operator namespace",
+			"namespace", operatorNamespace)
+	}
+
 	if err := (&controller.HyperFleetConfigReconciler{
-		Client: mgr.GetClient(),
-		Scheme: mgr.GetScheme(),
+		Client:            mgr.GetClient(),
+		Scheme:            mgr.GetScheme(),
+		OperatorNamespace: operatorNamespace,
+		APIImage:          os.Getenv("RELATED_IMAGE_HYPERFLEET_API"),
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "HyperFleetConfig")
 		os.Exit(1)

config/manager/manager.yaml

@@ -65,6 +65,18 @@ spec:
           - --health-probe-bind-address=:8081
         image: controller:latest
         name: manager
+        env:
+        # POD_NAMESPACE tells the operator which namespace to create operands in
+        # (the operator's own namespace). Sourced from the downward API.
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        # RELATED_IMAGE_HYPERFLEET_API is the image used for the API operand.
+        # Follows the OLM relatedImages convention so it can be digest-pinned at
+        # bundle build time; override per environment as needed.
+        - name: RELATED_IMAGE_HYPERFLEET_API
+          value: quay.io/openshift-hyperfleet/hyperfleet-api:latest
         ports: []
         securityContext:
           allowPrivilegeEscalation: false

config/rbac/role.yaml

@@ -4,6 +4,30 @@ kind: ClusterRole
 metadata:
   name: manager-role
 rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - serviceaccounts
+  - services
+  verbs:
+  - create
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - create
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - hyperfleet.redhat.com
   resources:
@@ -30,3 +54,15 @@ rules:
   - get
   - patch
   - update
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - rolebindings
+  - roles
+  verbs:
+  - create
+  - get
+  - list
+  - patch
+  - update
+  - watch

internal/apply/apply.go

@@ -0,0 +1,68 @@
+/*
+Copyright 2026.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package apply centralizes the idempotent server-side-apply upsert used to
+// reconcile operands: stamp a controller owner reference, then apply.
+package apply
+
+import (
+	"context"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	hyperfleetv1alpha1 "github.com/openshift-hyperfleet/hyperfleet-operator/api/v1alpha1"
+)
+
+// FieldManager is the server-side-apply field owner stamped on every operand the
+// operator manages. It lets the API server distinguish operator-owned fields from
+// any a human sets, which is what makes ForceOwnership drift-correction safe: the
+// operator is the sole intended manager of these fields.
+const FieldManager = "hyperfleet-operator"
+
+// Objects upserts each desired operand via server-side apply. For every object it:
+//
+//  1. sets a controller owner reference back to the CR, so the object is
+//     garbage-collected with the CR and wakes the controller via its Owns() watch
+//     when it drifts (a cluster-scoped owner owning namespaced dependents is
+//     valid — the owner has no namespace);
+//  2. applies the object with a fixed field manager and ForceOwnership, so
+//     re-applying identical state is a no-op (idempotent) while out-of-band edits
+//     to operator-owned fields are reclaimed.
+//
+// Each object must carry its GVK (TypeMeta) — server-side apply requires it.
+// Errors are wrapped with the object's kind and name so the caller can see which
+// operand failed.
+func Objects(
+	ctx context.Context,
+	c client.Client,
+	owner *hyperfleetv1alpha1.HyperFleetConfig,
+	scheme *runtime.Scheme,
+	objs []client.Object,
+) error {
+	for _, obj := range objs {
+		kind := obj.GetObjectKind().GroupVersionKind().Kind
+		if err := ctrl.SetControllerReference(owner, obj, scheme); err != nil {
+			return fmt.Errorf("set controller reference on %s %q: %w", kind, obj.GetName(), err)
+		}
+		if err := c.Patch(ctx, obj, client.Apply, client.FieldOwner(FieldManager), client.ForceOwnership); err != nil {
+			return fmt.Errorf("apply %s %q: %w", kind, obj.GetName(), err)
+		}
+	}
+	return nil
+}

internal/bundle/bundle.go

@@ -0,0 +1,75 @@
+/*
+Copyright 2026.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package bundle defines the component contract and resolves a bundle to its
+// ordered component set. It is the in-operator "bundle definition": adding a
+// component later is one new entry here plus its own package — never a new
+// controller.
+package bundle
+
+import (
+	"context"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	hyperfleetv1alpha1 "github.com/openshift-hyperfleet/hyperfleet-operator/api/v1alpha1"
+	"github.com/openshift-hyperfleet/hyperfleet-operator/internal/component/api"
+)
+
+// Component is the contract every component satisfies. It is deliberately tiny —
+// render the desired objects, report health — with no extension points until a
+// second component exists to justify them.
+//
+//   - Render is a pure function (CR → desired objects); it must not read or write
+//     the cluster. The controller applies what it returns.
+//   - Conditions reports component health. It is consumed starting in
+//     HYPERFLEET-1409; until then the controller does not roll it into status.
+type Component interface {
+	Name() string
+	Render(ctx context.Context, cr *hyperfleetv1alpha1.HyperFleetConfig) ([]client.Object, error)
+	Conditions(ctx context.Context, cr *hyperfleetv1alpha1.HyperFleetConfig) ([]metav1.Condition, error)
+}
+
+// Config carries the inputs the resolver needs to construct components.
+type Config struct {
+	// APIImage is the image for the API component (empty → its compiled-in default).
+	APIImage string
+	// Namespace is the operator's own namespace, where operands are created.
+	Namespace string
+}
+
+// sharedTier lists the components present in every bundle regardless of flavor.
+// In phase 1 this is exactly [API], so every bundle resolves to [API].
+func sharedTier(cfg Config) []Component {
+	return []Component{
+		api.New(cfg.APIImage, cfg.Namespace),
+	}
+}
+
+// bundleSpecific returns the components unique to a bundle beyond the shared
+// tier. Phase 1 has none for either bundle; this is the single extension point
+// where a future bundle-specific component is registered.
+func bundleSpecific(_ hyperfleetv1alpha1.BundleType) []Component {
+	return nil
+}
+
+// Resolve maps a bundle to its ordered component set: the shared tier followed by
+// any bundle-specific components. The shared tier is first so its components
+// (currently the API) reconcile before anything that might depend on them.
+func Resolve(b hyperfleetv1alpha1.BundleType, cfg Config) []Component {
+	return append(sharedTier(cfg), bundleSpecific(b)...)
+}

internal/component/api/api.go

@@ -0,0 +1,86 @@
+/*
+Copyright 2026.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package api
+
+import (
+	"context"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	hyperfleetv1alpha1 "github.com/openshift-hyperfleet/hyperfleet-operator/api/v1alpha1"
+)
+
+// DefaultImage is the compiled-in fallback image used when the operator is not
+// given RELATED_IMAGE_HYPERFLEET_API. Production deployments override it with a
+// digest-pinned image via that env var (OLM relatedImages convention).
+const DefaultImage = "quay.io/openshift-hyperfleet/hyperfleet-api:latest"
+
+// Component renders the HyperFleet API operand. It satisfies the bundle.Component
+// contract structurally (no import of internal/bundle, avoiding an import cycle:
+// bundle imports this package). It carries only rendering inputs — the Image and
+// the target Namespace — and never touches the cluster; the controller applies
+// what Render produces.
+type Component struct {
+	// Image is the API container image. Empty falls back to DefaultImage.
+	Image string
+	// Namespace is the operator's own namespace, where all operands live.
+	Namespace string
+}
+
+// New constructs the API component for the given image and operator namespace.
+func New(image, namespace string) *Component {
+	return &Component{Image: image, Namespace: namespace}
+}
+
+// Name identifies the component in logs and the app.kubernetes.io/component label.
+func (c *Component) Name() string {
+	return ComponentName
+}
+
+// Render returns the full desired-state operand set for the API, in a
+// dependency-friendly order (identity and RBAC before the workload that uses
+// them). It is a pure function of its inputs: no cluster reads or writes.
+//
+// The returned objects are structurally complete but not yet configured from the
+// CR spec — database/auth/tls env, config-file content and profile→resources are
+// wired in HYPERFLEET-1408. The ctx is part of the contract (later components may
+// need it) but is unused here.
+func (c *Component) Render(_ context.Context, cr *hyperfleetv1alpha1.HyperFleetConfig) ([]client.Object, error) {
+	image := c.Image
+	if image == "" {
+		image = DefaultImage
+	}
+
+	return []client.Object{
+		serviceAccount(cr, c.Namespace),
+		role(cr, c.Namespace),
+		roleBinding(cr, c.Namespace),
+		configMap(cr, c.Namespace),
+		service(cr, c.Namespace),
+		deployment(cr, image, c.Namespace),
+	}, nil
+}
+
+// Conditions reports the component's health as metav1.Conditions. The contract is
+// defined now (HYPERFLEET-1407) so it need not be reopened next story, but its
+// output is not yet rolled up into status.conditions — real health derivation and
+// status wiring land in HYPERFLEET-1409. Returning nil until then keeps the
+// reconciler from writing status prematurely.
+func (c *Component) Conditions(_ context.Context, _ *hyperfleetv1alpha1.HyperFleetConfig) ([]metav1.Condition, error) {
+	return nil, nil
+}