feat: operator migration

.github/ci/operator-postgres-values.yaml

@@ -0,0 +1,70 @@
+# Values for the operator + Postgres E2E step in .github/workflows/test.yml,
+# which installs one OpenFGA version and then upgrades to a newer one. Kept
+# out of charts/openfga/ci/ because chart-testing only installs one version.
+replicaCount: 1
+
+datastore:
+  engine: postgres
+  uriSecret: openfga-e2e-postgres-credentials
+
+openfga-operator:
+  enabled: true
+  image:
+    pullPolicy: Never
+
+extraObjects:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      name: openfga-e2e-postgres-credentials
+    stringData:
+      uri: "postgres://openfga:changeme@openfga-e2e-postgres:5432/openfga?sslmode=disable"
+  - apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: openfga-e2e-postgres
+    spec:
+      replicas: 1
+      selector:
+        matchLabels:
+          app: openfga-e2e-postgres
+      template:
+        metadata:
+          labels:
+            app: openfga-e2e-postgres
+        spec:
+          containers:
+            - name: postgres
+              image: postgres:17
+              ports:
+                - containerPort: 5432
+              env:
+                - name: POSTGRES_USER
+                  value: openfga
+                - name: POSTGRES_PASSWORD
+                  value: changeme
+                - name: POSTGRES_DB
+                  value: openfga
+                - name: PGDATA
+                  value: /var/lib/postgresql/data/pgdata
+              volumeMounts:
+                - name: data
+                  mountPath: /var/lib/postgresql/data
+              readinessProbe:
+                exec:
+                  command: ["pg_isready", "-U", "openfga", "-d", "openfga"]
+                initialDelaySeconds: 5
+                periodSeconds: 5
+          volumes:
+            - name: data
+              emptyDir: {}
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: openfga-e2e-postgres
+    spec:
+      selector:
+        app: openfga-e2e-postgres
+      ports:
+        - port: 5432
+          targetPort: 5432

.github/dependabot.yaml

@@ -19,3 +19,21 @@ updates:
       dependencies:
         patterns:
           - "*"
+
+  - package-ecosystem: "gomod"
+    directory: "/operator"
+    schedule:
+      interval: "weekly"
+    groups:
+      dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "docker"
+    directory: "/operator"
+    schedule:
+      interval: "weekly"
+    groups:
+      dependencies:
+        patterns:
+          - "*"

.github/scripts/check-operator-release.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# Fails when operator image or chart inputs changed but the chart versions that
+# publish them did not. Usage: check-operator-release.sh <base-ref>, e.g. origin/main.
+#
+# CI publishes ghcr.io/openfga/openfga-operator:<appVersion> once and never
+# overwrites it, and chart-releaser skips chart versions that already exist.
+# Release inputs are therefore only published when, in the same PR:
+#   1. charts/openfga-operator/Chart.yaml bumps version
+#   2. image changes also bump appVersion
+#   3. charts/openfga/Chart.yaml bumps version and pins the new operator chart
+# Chart.lock has to match too; `helm dependency build` in CI fails if it does not.
+set -euo pipefail
+
+base=$1
+image_inputs=(operator/cmd operator/internal operator/go.mod operator/go.sum operator/Dockerfile)
+image_changed=false
+chart_changed=false
+if ! git diff --quiet "$base...HEAD" -- "${image_inputs[@]}"; then
+  image_changed=true
+fi
+if ! git diff --quiet "$base...HEAD" -- charts/openfga-operator; then
+  chart_changed=true
+fi
+if [[ "$image_changed" == "false" && "$chart_changed" == "false" ]]; then
+  echo "operator release inputs unchanged"
+  exit 0
+fi
+
+field() { grep "^$1:" "$2" | awk '{print $2}' | tr -d '"'; }
+dependency_version() { awk '/name: openfga-operator/{f=1} f && /version:/{print $2; exit}' "$1" | tr -d '"'; }
+at_base() { git show "$base:$1" 2>/dev/null; }
+fail() { echo "::error file=$1::$2"; exit 1; }
+
+operator_chart=charts/openfga-operator/Chart.yaml
+parent_chart=charts/openfga/Chart.yaml
+lock_file=charts/openfga/Chart.lock
+operator_version=$(field version "$operator_chart")
+
+if at_base "$operator_chart" > /tmp/base-operator-chart.yaml; then
+  if [[ "$(field version /tmp/base-operator-chart.yaml)" == "$(field version "$operator_chart")" ]]; then
+    fail "$operator_chart" "operator release inputs changed but version is still $(field version "$operator_chart"); bump it so the chart change is published"
+  fi
+  if [[ "$image_changed" == "true" ]] &&
+    [[ "$(field appVersion /tmp/base-operator-chart.yaml)" == "$(field appVersion "$operator_chart")" ]]; then
+    fail "$operator_chart" "operator image inputs changed but appVersion is still $(field appVersion "$operator_chart"); bump it so the image change is published"
+  fi
+else
+  echo "operator chart is new in this PR"
+fi
+
+at_base "$parent_chart" > /tmp/base-parent-chart.yaml
+if [[ "$(field version /tmp/base-parent-chart.yaml)" == "$(field version $parent_chart)" ]]; then
+  fail "$parent_chart" "operator release inputs changed but the openfga chart version is still $(field version $parent_chart); bump it so a chart with the new operator is released"
+fi
+if [[ "$(dependency_version "$parent_chart")" != "$operator_version" ]]; then
+  fail "$parent_chart" "openfga chart pins openfga-operator $(dependency_version "$parent_chart") but the operator chart is $operator_version; update the dependency and run helm dependency update charts/openfga"
+fi
+if [[ "$(dependency_version "$lock_file")" != "$operator_version" ]]; then
+  fail "$lock_file" "Chart.lock pins openfga-operator $(dependency_version "$lock_file") but the operator chart is $operator_version; run helm dependency update charts/openfga"
+fi
+echo "operator release versions are consistent"

.github/scripts/check-operator-release_test.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo=$(git rev-parse --show-toplevel)
+check="$repo/.github/scripts/check-operator-release.sh"
+failures=0
+
+run_case() {
+  local name=$1 expected=$2 image_changed=$3 template_changed=$4 operator_version=$5 operator_app_version=$6
+  local parent_version=$7 parent_dependency=$8 lock_dependency=$9
+  local case_dir base result=0
+
+  case_dir=$(mktemp -d)
+  mkdir -p "$case_dir/operator/internal/controller" "$case_dir/charts/openfga-operator/templates" "$case_dir/charts/openfga"
+  (
+    cd "$case_dir"
+    git init -q
+    git config user.name "Release Guard Test"
+    git config user.email "release-guard@example.com"
+
+    printf 'package controller\n' > operator/internal/controller/controller.go
+    cat > charts/openfga-operator/Chart.yaml <<'EOF'
+apiVersion: v2
+name: openfga-operator
+version: "1.0.0"
+appVersion: "1.0.0"
+EOF
+    printf 'value: base\n' > charts/openfga-operator/templates/config.yaml
+    cat > charts/openfga/Chart.yaml <<'EOF'
+apiVersion: v2
+name: openfga
+version: "1.0.0"
+dependencies:
+  - name: openfga-operator
+    version: "1.0.0"
+EOF
+    cat > charts/openfga/Chart.lock <<'EOF'
+dependencies:
+- name: openfga-operator
+  version: 1.0.0
+EOF
+    git add .
+    git commit -qm base
+    base=$(git rev-parse HEAD)
+
+    if [[ "$image_changed" == "true" ]]; then
+      printf 'var changed = true\n' >> operator/internal/controller/controller.go
+    fi
+    if [[ "$template_changed" == "true" ]]; then
+      printf 'value: candidate\n' > charts/openfga-operator/templates/config.yaml
+    fi
+    cat > charts/openfga-operator/Chart.yaml <<EOF
+apiVersion: v2
+name: openfga-operator
+version: "$operator_version"
+appVersion: "$operator_app_version"
+EOF
+    cat > charts/openfga/Chart.yaml <<EOF
+apiVersion: v2
+name: openfga
+version: "$parent_version"
+dependencies:
+  - name: openfga-operator
+    version: "$parent_dependency"
+EOF
+    cat > charts/openfga/Chart.lock <<EOF
+dependencies:
+- name: openfga-operator
+  version: $lock_dependency
+EOF
+    git add .
+    if ! git diff --cached --quiet; then
+      git commit -qm candidate
+    fi
+
+    "$check" "$base" >/dev/null 2>&1 || result=$?
+    if [[ "$expected" == "pass" && "$result" -ne 0 ]] ||
+       [[ "$expected" == "fail" && "$result" -eq 0 ]]; then
+      printf 'FAIL: %s expected %s, exit code %d\n' "$name" "$expected" "$result"
+      exit 1
+    fi
+  ) || failures=$((failures + 1))
+}
+
+run_case "unchanged release inputs" pass false false 1.0.0 1.0.0 1.0.0 1.0.0 1.0.0
+run_case "consistent image release" pass true false 1.1.0 1.1.0 1.1.0 1.1.0 1.1.0
+run_case "operator version unchanged" fail true false 1.0.0 1.1.0 1.1.0 1.0.0 1.0.0
+run_case "operator appVersion unchanged" fail true false 1.1.0 1.0.0 1.1.0 1.1.0 1.1.0
+run_case "parent version unchanged" fail true false 1.1.0 1.1.0 1.0.0 1.1.0 1.1.0
+run_case "parent dependency mismatch" fail true false 1.1.0 1.1.0 1.1.0 1.0.0 1.1.0
+run_case "lock dependency mismatch" fail true false 1.1.0 1.1.0 1.1.0 1.1.0 1.0.0
+run_case "consistent chart-only release" pass false true 1.1.0 1.0.0 1.1.0 1.1.0 1.1.0
+run_case "chart-only version unchanged" fail false true 1.0.0 1.0.0 1.1.0 1.0.0 1.0.0
+
+if [[ "$failures" -ne 0 ]]; then
+  printf '%d release guard case(s) failed\n' "$failures"
+  exit 1
+fi
+
+echo "operator release guard matrix passed"