Warn at startup when installed CRDs are stale or missing #6

2026-07-25T22:42:15+10:00

unkinben commented

2026-07-25 22:42:15 +10:00

Why

The operator strict-decodes CustomResource specs. When the in-cluster CRDs lag the running operator — as just happened, with CRDs pinned to v0.1.0 while the operator ran v0.3.0 — new spec fields fail to decode and the operator gives no signal about the root cause. This adds an advisory startup check so a CRD/operator version mismatch is immediately visible in the operator logs.

Changes

Add CheckCRDVersions: at startup, GET each owned CRD via the apiextensions clientset and verify it carries a version-sentinel spec field; log a distinct WARNING per problem (missing CRD vs. present-but-stale schema). The check is advisory only — it never returns an error or exits.
Keep the sentinel list in one place (buckets → managePolicy, objectstoreusers → retainOnDelete, bucketaccesses → rawStatements) so it is easy to extend.
Wire the check into operator startup after the manager config is available, with a short timeout.
Add an apiextensions.k8s.io/customresourcedefinitions get;list kubebuilder RBAC marker and regenerate config/rbac/role.yaml.
Promote k8s.io/apiextensions-apiserver to a direct dependency.

Verified: gofmt, go vet ./..., CGO_ENABLED=0 go build ./..., and go test ./... all pass; make generate produces no unexpected churn.

https://claude.ai/code/session_016CEncETbf8cvy1PhsHfFHM

## Why The operator strict-decodes CustomResource specs. When the in-cluster CRDs lag the running operator — as just happened, with CRDs pinned to v0.1.0 while the operator ran v0.3.0 — new spec fields fail to decode and the operator gives no signal about the root cause. This adds an advisory startup check so a CRD/operator version mismatch is immediately visible in the operator logs. ## Changes - Add `CheckCRDVersions`: at startup, GET each owned CRD via the apiextensions clientset and verify it carries a version-sentinel spec field; log a distinct WARNING per problem (missing CRD vs. present-but-stale schema). The check is advisory only — it never returns an error or exits. - Keep the sentinel list in one place (`buckets` → `managePolicy`, `objectstoreusers` → `retainOnDelete`, `bucketaccesses` → `rawStatements`) so it is easy to extend. - Wire the check into operator startup after the manager config is available, with a short timeout. - Add an `apiextensions.k8s.io/customresourcedefinitions` `get;list` kubebuilder RBAC marker and regenerate `config/rbac/role.yaml`. - Promote `k8s.io/apiextensions-apiserver` to a direct dependency. Verified: `gofmt`, `go vet ./...`, `CGO_ENABLED=0 go build ./...`, and `go test ./...` all pass; `make generate` produces no unexpected churn. https://claude.ai/code/session_016CEncETbf8cvy1PhsHfFHM

unkinben added 1 commit 2026-07-25 22:42:16 +10:00

Warn at startup when installed CRDs are stale or missing

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

e7760b79f4

The operator strict-decodes CR specs, so when the in-cluster CRDs lag the
running operator (e.g. CRDs pinned to v0.1.0 while the operator ran v0.3.0),
new spec fields fail to decode with no operator-side signal. This adds an
advisory startup check so the mismatch is visible in the operator logs.

- Add CheckCRDVersions: GET each owned CRD and verify it carries a
  version-sentinel spec field, logging a distinct WARNING per problem
  (missing CRD vs. present-but-stale schema); advisory only, never exits.
- Keep the sentinel list (buckets/managePolicy, objectstoreusers/
  retainOnDelete, bucketaccesses/rawStatements) in one place.
- Wire the check into operator startup after the manager config is available.
- Add apiextensions customresourcedefinitions get;list RBAC marker and
  regenerate config/rbac/role.yaml.
- Promote k8s.io/apiextensions-apiserver to a direct dependency.

Claude-Session: https://claude.ai/code/session_016CEncETbf8cvy1PhsHfFHM

benvin merged commit 52e183e6f3 into main

2026-07-25 22:59:42 +10:00

benvin deleted branch benvin/crd-version-warning

2026-07-25 22:59:43 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/cephrgw-operator#6