feat(kustomizer): add selective manifest resource reconciliation (#101)

Implements selective manifest resource reconciliation using a 3-step process: render → filter → apply.

Adds `FilterExcludeKinds()` function to the deploy package that uses exclusion-based filtering for more intuitive resource management. Updates the controller to use centralized `reconcileManifestResources()` with exclude-based logic instead of separate render/apply cycles for each resource type.


Approved-by: VaishnaviHire

Author: mfleader

controllers/llamastackdistribution_controller.go

@@ -181,6 +181,50 @@ func (r *LlamaStackDistributionReconciler) fetchInstance(ctx context.Context, na
 	return instance, nil
 }
 
+// determineKindsToExclude returns a list of resource kinds that should be excluded
+// based on the instance specification.
+func (r *LlamaStackDistributionReconciler) determineKindsToExclude(instance *llamav1alpha1.LlamaStackDistribution) []string {
+	var kinds []string
+
+	// Exclude PersistentVolumeClaim if storage is not configured
+	if instance.Spec.Server.Storage == nil {
+		kinds = append(kinds, "PersistentVolumeClaim")
+	}
+
+	// Exclude NetworkPolicy if the feature is disabled
+	if !r.EnableNetworkPolicy {
+		kinds = append(kinds, "NetworkPolicy")
+	}
+
+	// Exclude Service if no ports are defined
+	if !instance.HasPorts() {
+		kinds = append(kinds, "Service")
+	}
+
+	return kinds
+}
+
+// reconcileManifestResources applies resources that are managed by the operator
+// based on the instance specification.
+func (r *LlamaStackDistributionReconciler) reconcileManifestResources(ctx context.Context, instance *llamav1alpha1.LlamaStackDistribution) error {
+	resMap, err := deploy.RenderManifest(filesys.MakeFsOnDisk(), manifestsBasePath, instance)
+	if err != nil {
+		return fmt.Errorf("failed to render manifests: %w", err)
+	}
+
+	kindsToExclude := r.determineKindsToExclude(instance)
+	filteredResMap, err := deploy.FilterExcludeKinds(resMap, kindsToExclude)
+	if err != nil {
+		return fmt.Errorf("failed to filter manifests: %w", err)
+	}
+
+	if err := deploy.ApplyResources(ctx, r.Client, r.Scheme, instance, filteredResMap); err != nil {
+		return fmt.Errorf("failed to apply manifests: %w", err)
+	}
+
+	return nil
+}
+
 // reconcileResources reconciles all resources for the LlamaStackDistribution instance.
 func (r *LlamaStackDistributionReconciler) reconcileResources(ctx context.Context, instance *llamav1alpha1.LlamaStackDistribution) error {
 	// Reconcile the ConfigMap if specified by the user
@@ -190,17 +234,6 @@ func (r *LlamaStackDistributionReconciler) reconcileResources(ctx context.Contex
 		}
 	}
 
-	// Reconcile the PVC if storage is configured
-	if instance.Spec.Server.Storage != nil {
-		resMap, err := deploy.RenderManifest(filesys.MakeFsOnDisk(), manifestsBasePath, instance)
-		if err != nil {
-			return fmt.Errorf("failed to render PVC manifests: %w", err)
-		}
-		if err := deploy.ApplyResources(ctx, r.Client, r.Scheme, instance, resMap); err != nil {
-			return fmt.Errorf("failed to apply PVC manifests: %w", err)
-		}
-	}
-
 	// Reconcile the NetworkPolicy
 	if err := r.reconcileNetworkPolicy(ctx, instance); err != nil {
 		return fmt.Errorf("failed to reconcile NetworkPolicy: %w", err)
@@ -217,6 +250,12 @@ func (r *LlamaStackDistributionReconciler) reconcileResources(ctx context.Contex
 			return fmt.Errorf("failed to reconcile service: %w", err)
 		}
 	}
+
+	// Reconcile manifest-based resources
+	if err := r.reconcileManifestResources(ctx, instance); err != nil {
+		return err
+	}
+
 	return nil
 }
 

pkg/deploy/kustomizer.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"path/filepath"
+	"slices"
 
 	llamav1alpha1 "github.com/llamastack/llama-stack-k8s-operator/api/v1alpha1"
 	"github.com/llamastack/llama-stack-k8s-operator/pkg/deploy/plugins"
@@ -220,3 +221,15 @@ func getStorageSize(instance *llamav1alpha1.LlamaStackDistribution) string {
 	// Returning an empty string signals the field transformer to use the default value.
 	return ""
 }
+
+func FilterExcludeKinds(resMap *resmap.ResMap, kindsToExclude []string) (*resmap.ResMap, error) {
+	filteredResMap := resmap.New()
+	for _, res := range (*resMap).Resources() {
+		if !slices.Contains(kindsToExclude, res.GetKind()) {
+			if err := filteredResMap.Append(res); err != nil {
+				return nil, fmt.Errorf("failed to append resource while filtering %s/%s: %w", res.GetKind(), res.GetName(), err)
+			}
+		}
+	}
+	return &filteredResMap, nil
+}

pkg/deploy/kustomizer_test.go

@@ -478,3 +478,55 @@ func TestApplyResources_PVCImmutability(t *testing.T) {
 	storageRequest := unchangedPVC.Spec.Resources.Requests[corev1.ResourceStorage]
 	require.Equal(t, expStorageSize, storageRequest.String(), "PVC storage spec should remain unchanged")
 }
+
+// TestFilterExcludeKinds tests the filtering functionality.
+func TestFilterExcludeKinds(t *testing.T) {
+	t.Run("excludes specified kinds", func(t *testing.T) {
+		pvc := newTestResource(t, "v1", "PersistentVolumeClaim", "test-pvc", "test-ns", nil)
+		svc := newTestResource(t, "v1", "Service", "test-svc", "test-ns", nil)
+
+		resMap := resmap.New()
+		require.NoError(t, resMap.Append(pvc))
+		require.NoError(t, resMap.Append(svc))
+
+		filtered, err := FilterExcludeKinds(&resMap, []string{"PersistentVolumeClaim"})
+		require.NoError(t, err)
+		require.Equal(t, 1, (*filtered).Size())
+		require.Equal(t, "Service", (*filtered).Resources()[0].GetKind())
+	})
+
+	t.Run("includes all when no exclusions", func(t *testing.T) {
+		svc := newTestResource(t, "v1", "Service", "test-svc", "test-ns", nil)
+		resMap := resmap.New()
+		require.NoError(t, resMap.Append(svc))
+
+		filtered, err := FilterExcludeKinds(&resMap, []string{})
+		require.NoError(t, err)
+		require.Equal(t, 1, (*filtered).Size())
+		require.Equal(t, "Service", (*filtered).Resources()[0].GetKind())
+	})
+
+	t.Run("handles empty inputs", func(t *testing.T) {
+		emptyResMap := resmap.New()
+
+		filtered, err := FilterExcludeKinds(&emptyResMap, []string{"PersistentVolumeClaim"})
+		require.NoError(t, err)
+		require.Equal(t, 0, (*filtered).Size())
+	})
+
+	t.Run("excludes multiple kinds", func(t *testing.T) {
+		pvc := newTestResource(t, "v1", "PersistentVolumeClaim", "test-pvc", "test-ns", nil)
+		svc := newTestResource(t, "v1", "Service", "test-svc", "test-ns", nil)
+		deployment := newTestResource(t, "apps/v1", "Deployment", "test-deployment", "test-ns", nil)
+
+		resMap := resmap.New()
+		require.NoError(t, resMap.Append(pvc))
+		require.NoError(t, resMap.Append(svc))
+		require.NoError(t, resMap.Append(deployment))
+
+		filtered, err := FilterExcludeKinds(&resMap, []string{"PersistentVolumeClaim", "Service"})
+		require.NoError(t, err)
+		require.Equal(t, 1, (*filtered).Size())
+		require.Equal(t, "Deployment", (*filtered).Resources()[0].GetKind())
+	})
+}