Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -129,7 +129,7 @@ $(YQ): $(LOCALBIN)
GOBIN=$(LOCALBIN) go install $(GO_INSTALL_OPTS) github.com/mikefarah/yq/v4@$(YQ_VERSION)

.PHONY: kind
kind: $(KIND) ## Download yq locally if necessary.
kind: $(KIND) ## Download kind locally if necessary.
$(KIND): $(LOCALBIN)
GOBIN=$(LOCALBIN) go install $(GO_INSTALL_OPTS) sigs.k8s.io/kind@latest

Expand Down
28 changes: 28 additions & 0 deletions crds/operators.coreos.com_clusterserviceversions.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,10 @@ spec:
jsonPath: .spec.version
name: Version
type: string
- description: The release of this version of the CSV
jsonPath: .spec.release
name: Release
type: string
- description: The name of a CSV that this one replaces
jsonPath: .spec.replaces
name: Replaces
Expand Down Expand Up @@ -8988,6 +8992,30 @@ spec:
type: string
name:
type: string
release:
description: |-
release specifies the packaging version of the operator, defaulting to empty
release is optional

A ClusterServiceVersion's release field is used to provide a secondary ordering
for operators that share the same semantic version. This is useful for
operators that need to make changes to the CSV which don't affect their functionality,
for example:
- to fix a typo in their description
- to add/amend annotations or labels
- to amend examples or documentation

It is up to operator authors to determine the semantics of release versions they use
for their operator. All release versions must conform to the semver prerelease format
(dot-separated identifiers containing only alphanumerics and hyphens) and are limited
to a maximum length of 20 characters.
type: string
maxLength: 20
x-kubernetes-validations:
- rule: self.matches('^[0-9A-Za-z-]+(\\.[0-9A-Za-z-]+)*$')
message: release version must be composed of dot-separated identifiers containing only alphanumerics and hyphens
- rule: '!self.split(''.'').exists(x, x.matches(''^0[0-9]+$''))'
message: numeric identifiers in release version must not have leading zeros
replaces:
description: The name of a CSV this one replaces. Should match the `metadata.Name` field of the old CSV.
type: string
Expand Down
2 changes: 1 addition & 1 deletion crds/zz_defs.go

Large diffs are not rendered by default.

73 changes: 73 additions & 0 deletions pkg/lib/release/release.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,73 @@
package release

import (
"encoding/json"
"slices"
"strings"

semver "github.com/blang/semver/v4"
)

// +k8s:openapi-gen=true
// OperatorRelease is a wrapper around a slice of semver.PRVersion which supports correct
// marshaling to YAML and JSON.
// +kubebuilder:validation:Type=string
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should add more validation here:

  • CEL expression that does a regex match to make sure it is a valid prerelease string
  • Max length (keeping in mind that we expect the release to be included in the CSV metadata.name, which has its own length restrictions.

Was there any API review on this front? They'd be better at pointing out all the things.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR was provided as part of the internal enhancement review, yes.
Links are in epic

Copy link
Contributor Author

@grokspawn grokspawn Dec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added some new CEL validations, including a max length of 20 chars. This was a nice, round number which was big enough for all known uses of analogous features (Freshmaker) as well as a minimal-precision date/time-stamp, and should leave ~40 chars to remain valid when composited to a metadata.name with the format <package-name>-v<version>-<release-version>.

Also added to the bundle validators to enforce the case where the author provides a noncompliant name for the release version case.

Copy link
Member

@joelanford joelanford Dec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any chance you looked for bundles that have the olm.substitutesFor annotation and checked to see if the overall <package-name>-v<version>-<release-version> format that we would require if they released again using a release field that followed the format of their version build metadata would overflow the metadata.name length requirement of a CSV?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I evaluated all available FBCs I could get my hand on, and all existing entries would satisfy the naming requirements for bundles with release versions while continuing to follow their current release version schema use.
https://github.com/grokspawn/operator-registry/blob/validate-freshmaker/cmd/opm/validate-freshmaker/cmd.go is a single-use tool which performed this validation.

// +kubebuilder:validation:MaxLength=20
// +kubebuilder:validation:XValidation:rule="self.matches('^[0-9A-Za-z-]+(\\\\.[0-9A-Za-z-]+)*$')",message="release version must be composed of dot-separated identifiers containing only alphanumerics and hyphens"
// +kubebuilder:validation:XValidation:rule="!self.split('.').exists(x, x.matches('^0[0-9]+$'))",message="numeric identifiers in release version must not have leading zeros"
type OperatorRelease struct {
Release []semver.PRVersion `json:"-"`
}

// DeepCopyInto creates a deep-copy of the Version value.
func (v *OperatorRelease) DeepCopyInto(out *OperatorRelease) {
out.Release = slices.Clone(v.Release)
}

// MarshalJSON implements the encoding/json.Marshaler interface.
func (v OperatorRelease) MarshalJSON() ([]byte, error) {
segments := []string{}
for _, segment := range v.Release {
segments = append(segments, segment.String())
}
return json.Marshal(strings.Join(segments, "."))
}

// UnmarshalJSON implements the encoding/json.Unmarshaler interface.
func (v *OperatorRelease) UnmarshalJSON(data []byte) (err error) {
var versionString string

if err = json.Unmarshal(data, &versionString); err != nil {
return
}

segments := strings.Split(versionString, ".")
for _, segment := range segments {
release, err := semver.NewPRVersion(segment)
if err != nil {
return err
}
v.Release = append(v.Release, release)
}

return nil
}

// OpenAPISchemaType is used by the kube-openapi generator when constructing
// the OpenAPI spec of this type.
//
// See: https://github.com/kubernetes/kube-openapi/tree/master/pkg/generators
func (_ OperatorRelease) OpenAPISchemaType() []string { return []string{"string"} }

// OpenAPISchemaFormat is used by the kube-openapi generator when constructing
// the OpenAPI spec of this type.
// "semver" is not a standard openapi format but tooling may use the value regardless
func (_ OperatorRelease) OpenAPISchemaFormat() string { return "semver" }

func (r OperatorRelease) String() string {
segments := []string{}
for _, segment := range r.Release {
segments = append(segments, segment.String())
}
return strings.Join(segments, ".")
}
161 changes: 161 additions & 0 deletions pkg/lib/release/release_test.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,161 @@
package release

import (
"encoding/json"
"testing"

semver "github.com/blang/semver/v4"
"github.com/stretchr/testify/require"
)

func TestOperatorReleaseMarshal(t *testing.T) {
tests := []struct {
name string
in OperatorRelease
out []byte
err error
}{
{
name: "single-segment",
in: OperatorRelease{Release: []semver.PRVersion{mustNewPRVersion("1")}},
out: []byte(`"1"`),
},
{
name: "two-segments",
in: OperatorRelease{Release: []semver.PRVersion{mustNewPRVersion("1"), mustNewPRVersion("0")}},
out: []byte(`"1.0"`),
},
{
name: "multi-segment",
in: OperatorRelease{Release: []semver.PRVersion{
mustNewPRVersion("1"),
mustNewPRVersion("2"),
mustNewPRVersion("3"),
}},
out: []byte(`"1.2.3"`),
},
{
name: "numeric-segments",
in: OperatorRelease{Release: []semver.PRVersion{
mustNewPRVersion("20240101"),
mustNewPRVersion("12345"),
}},
out: []byte(`"20240101.12345"`),
},
{
name: "alphanumeric-segments",
in: OperatorRelease{Release: []semver.PRVersion{
mustNewPRVersion("alpha"),
mustNewPRVersion("beta"),
mustNewPRVersion("1"),
}},
out: []byte(`"alpha.beta.1"`),
},
{
name: "alphanumeric-with-hyphens",
in: OperatorRelease{Release: []semver.PRVersion{
mustNewPRVersion("rc-1"),
mustNewPRVersion("build-123"),
}},
out: []byte(`"rc-1.build-123"`),
},
{
name: "mixed-alphanumeric",
in: OperatorRelease{Release: []semver.PRVersion{
mustNewPRVersion("1"),
mustNewPRVersion("2-beta"),
mustNewPRVersion("x86-64"),
}},
out: []byte(`"1.2-beta.x86-64"`),
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
m, err := tt.in.MarshalJSON()
require.Equal(t, tt.out, m, string(m))
require.Equal(t, tt.err, err)
})
}
}

func TestOperatorReleaseUnmarshal(t *testing.T) {
type TestStruct struct {
Release OperatorRelease `json:"r"`
}
tests := []struct {
name string
in []byte
out TestStruct
err error
}{
{
name: "single-segment",
in: []byte(`{"r": "1"}`),
out: TestStruct{Release: OperatorRelease{Release: []semver.PRVersion{mustNewPRVersion("1")}}},
},
{
name: "two-segments",
in: []byte(`{"r": "1.0"}`),
out: TestStruct{Release: OperatorRelease{Release: []semver.PRVersion{mustNewPRVersion("1"), mustNewPRVersion("0")}}},
},
{
name: "multi-segment",
in: []byte(`{"r": "1.2.3"}`),
out: TestStruct{Release: OperatorRelease{Release: []semver.PRVersion{
mustNewPRVersion("1"),
mustNewPRVersion("2"),
mustNewPRVersion("3"),
}}},
},
{
name: "numeric-segments",
in: []byte(`{"r": "20240101.12345"}`),
out: TestStruct{Release: OperatorRelease{Release: []semver.PRVersion{
mustNewPRVersion("20240101"),
mustNewPRVersion("12345"),
}}},
},
{
name: "alphanumeric-segments",
in: []byte(`{"r": "alpha.beta.1"}`),
out: TestStruct{Release: OperatorRelease{Release: []semver.PRVersion{
mustNewPRVersion("alpha"),
mustNewPRVersion("beta"),
mustNewPRVersion("1"),
}}},
},
{
name: "alphanumeric-with-hyphens",
in: []byte(`{"r": "rc-1.build-123"}`),
out: TestStruct{Release: OperatorRelease{Release: []semver.PRVersion{
mustNewPRVersion("rc-1"),
mustNewPRVersion("build-123"),
}}},
},
{
name: "mixed-alphanumeric",
in: []byte(`{"r": "1.2-beta.x86-64"}`),
out: TestStruct{Release: OperatorRelease{Release: []semver.PRVersion{
mustNewPRVersion("1"),
mustNewPRVersion("2-beta"),
mustNewPRVersion("x86-64"),
}}},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
s := TestStruct{}
err := json.Unmarshal(tt.in, &s)
require.Equal(t, tt.out, s)
require.Equal(t, tt.err, err)
})
}
}

func mustNewPRVersion(s string) semver.PRVersion {
v, err := semver.NewPRVersion(s)
if err != nil {
panic(err)
}
return v
}
9 changes: 9 additions & 0 deletions pkg/manifests/bundleloader.go
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ func (b *bundleLoader) LoadBundle() error {

errs = append(errs, b.calculateCompressedBundleSize())
b.addChannelsFromAnnotationsFile()
b.addPackageFromAnnotationsFile()

if !b.foundCSV {
errs = append(errs, fmt.Errorf("unable to find a csv in bundle directory %s", b.dir))
Expand Down Expand Up @@ -68,6 +69,14 @@ func (b *bundleLoader) addChannelsFromAnnotationsFile() {
}
}

func (b *bundleLoader) addPackageFromAnnotationsFile() {
if b.bundle == nil {
// None of this is relevant if the bundle was not found
return
}
b.bundle.Package = b.annotationsFile.Annotations.PackageName
}

// Compress the bundle to check its size
func (b *bundleLoader) calculateCompressedBundleSize() error {
if b.bundle == nil {
Expand Down
23 changes: 21 additions & 2 deletions pkg/operators/v1alpha1/clusterserviceversion_types.go
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ import (
"k8s.io/apimachinery/pkg/labels"
"k8s.io/apimachinery/pkg/util/intstr"

"github.com/operator-framework/api/pkg/lib/release"
"github.com/operator-framework/api/pkg/lib/version"
)

Expand Down Expand Up @@ -274,8 +275,25 @@ type APIServiceDefinitions struct {
// that can manage apps for a given version.
// +k8s:openapi-gen=true
type ClusterServiceVersionSpec struct {
InstallStrategy NamedInstallStrategy `json:"install"`
Version version.OperatorVersion `json:"version,omitempty"`
InstallStrategy NamedInstallStrategy `json:"install"`
Version version.OperatorVersion `json:"version,omitempty"`
// release specifies the packaging version of the operator, defaulting to empty
// release is optional
//
// A ClusterServiceVersion's release field is used to provide a secondary ordering
// for operators that share the same semantic version. This is useful for
// operators that need to make changes to the CSV which don't affect their functionality,
// for example:
// - to fix a typo in their description
// - to add/amend annotations or labels
// - to amend examples or documentation
//
// It is up to operator authors to determine the semantics of release versions they use
// for their operator. All release versions must conform to the semver prerelease format
// (dot-separated identifiers containing only alphanumerics and hyphens) and are limited
// to a maximum length of 20 characters.
// +optional
Release release.OperatorRelease `json:"release,omitzero"`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Release release.OperatorRelease `json:"release,omitzero"`
Release *release.OperatorRelease `json:"release,omitempty"`

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Make it a pointer and use omitempty instead of omitzero?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To solve what problem?
If we make it a pointer, we get the same behavior but now also have to perform nil checking, which isn't necessary with this approach.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess it's a question of whether we want to differentiate between "field not set" which is the nil case vs "field explicitly set but empty"?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is the empty string a valid value? What does it mean for this to be set to the empty string vs being omitted entirely?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The important thing is the backwards-compatibility aspects of this change. If the value is an instance, protected by the omitzero directive, then it is omitted from the wire-format in the case where it matches a default value for the type (in this case, an empty string).
This eliminates some interactions if the sender and receiver of CSV info have not both adopted the new release feature.
An empty string is a valid value if one wished to express "no release version", as well as the default indication that no release version exists for the CSV.

Copy link
Contributor Author

@grokspawn grokspawn Dec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Other than that, this reduces the number of required checks. With a pointer, it is:

  1. nil := no release
  2. non-nil and empty := no release
  3. non-nil and non-empty := has release

with the instance, it's just

  1. empty := no release
  2. non-empty := has release

For more discussion on the feature, check out this article.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is the empty string a valid value? What does it mean for this to be set to the empty string vs being omitted entirely?

I would say both of those would mean "there is no release".

@grokspawn that's a convincing argument.

@everettraven I always forget the API-specific considerations here. Does the somewhat new omitzero change the calculus on this from the API review standpoint? I feel like in the past, we've always been told to use pointers for optional structs.

The type definition here is a bit atypical, which may be a complicating factor. Usually an object has fields that end up being serialized. But here, we are using custom (de)serialization to convert between a string (in the CRD schema to a []semver.PRVersion in the Go API), so that users and developers both get the UX that suits their needs.

We need the wrapper object in order to be able to implement MarshalJSON and UnmarshalJSON

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

omitzero is new in go1.24, so our conventions docs do not address it.

Maturity string `json:"maturity,omitempty"`
CustomResourceDefinitions CustomResourceDefinitions `json:"customresourcedefinitions,omitempty"`
APIServiceDefinitions APIServiceDefinitions `json:"apiservicedefinitions,omitempty"`
Expand Down Expand Up @@ -595,6 +613,7 @@ type ResourceInstance struct {
// +kubebuilder:subresource:status
// +kubebuilder:printcolumn:name="Display",type=string,JSONPath=`.spec.displayName`,description="The name of the CSV"
// +kubebuilder:printcolumn:name="Version",type=string,JSONPath=`.spec.version`,description="The version of the CSV"
// +kubebuilder:printcolumn:name="Release",type=string,JSONPath=`.spec.release`,description="The release of this version of the CSV"
// +kubebuilder:printcolumn:name="Replaces",type=string,JSONPath=`.spec.replaces`,description="The name of a CSV that this one replaces"
// +kubebuilder:printcolumn:name="Phase",type=string,JSONPath=`.status.phase`

Expand Down
1 change: 1 addition & 0 deletions pkg/operators/v1alpha1/zz_generated.deepcopy.go

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

17 changes: 17 additions & 0 deletions pkg/validation/internal/bundle.go
Original file line number Diff line number Diff line change
Expand Up @@ -42,9 +42,26 @@ func validateBundle(bundle *manifests.Bundle) (result errors.ManifestResult) {
if sizeErrors != nil {
result.Add(sizeErrors...)
}
nameErrors := validateBundleName(bundle)
if nameErrors != nil {
result.Add(nameErrors...)
}
return result
}

func validateBundleName(bundle *manifests.Bundle) []errors.Error {
var errs []errors.Error
// bundle naming with a specified release version must follow the pattern
// <package-name>-v<csv-version>-<release-version>
if len(bundle.CSV.Spec.Release.Release) > 0 {
expectedName := fmt.Sprintf("%s-v%s-%s", bundle.Package, bundle.CSV.Spec.Version.String(), bundle.CSV.Spec.Release.String())
if bundle.Name != expectedName {
errs = append(errs, errors.ErrInvalidBundle(fmt.Sprintf("bundle name with release versioning %q does not match expected name %q", bundle.Name, expectedName), bundle.Name))
}
}
return errs
}

func validateServiceAccounts(bundle *manifests.Bundle) []errors.Error {
// get service account names defined in the csv
saNamesFromCSV := make(map[string]struct{}, 0)
Expand Down
2 changes: 1 addition & 1 deletion pkg/validation/internal/typecheck.go
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ func checkEmptyFields(result *errors.ManifestResult, v reflect.Value, parentStru

// Omitted field tags will contain ",omitempty", and ignored tags will
// match "-" exactly, respectively.
isOptionalField := strings.Contains(tag, ",omitempty") || tag == "-"
isOptionalField := strings.Contains(tag, ",omitempty") || strings.Contains(tag, ",omitzero") || tag == "-"
emptyVal := fieldValue.IsZero()

newParentStructName := fieldType.Name
Expand Down
Loading