Promite Single Own Feature Gate to GA

camilamacedo86 · camilamacedo86 · commit 012db47959a3 · 2025-10-14T12:19:54.000+01:00
diff --git a/docs/draft/howto/single-ownnamespace-install.md b/docs/draft/howto/single-ownnamespace-install.md
@@ -1,8 +1,7 @@
 ## Description
 
 !!! note
-This feature is still in *alpha* the `SingleOwnNamespaceInstallSupport` feature-gate must be enabled to make use of it.
-See the instructions below on how to enable it.
+The `SingleOwnNamespaceInstallSupport` feature gate is enabled by default. Use this guide to configure bundles that need Single or Own namespace install modes.
 
 ---
 
@@ -31,28 +30,6 @@ include *installModes*.
 
 [![OwnNamespace Install Demo](https://asciinema.org/a/Rxx6WUwAU016bXFDW74XLcM5i.svg)](https://asciinema.org/a/Rxx6WUwAU016bXFDW74XLcM5i)
 
-## Enabling the Feature-Gate
-
-!!! tip
-
-This guide assumes OLMv1 is already installed. If that is not the case,
-you can follow the [getting started](../../getting-started/olmv1_getting_started.md) guide to install OLMv1.
-
----
-
-Patch the `operator-controller` `Deployment` adding `--feature-gates=SingleOwnNamespaceInstallSupport=true` to the
-controller container arguments:
-
-```terminal title="Enable SingleOwnNamespaceInstallSupport feature-gate"
-kubectl patch deployment -n olmv1-system operator-controller-controller-manager --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--feature-gates=SingleOwnNamespaceInstallSupport=true"}]'
-```
-
-Wait for `Deployment` rollout:
-
-```terminal title="Wait for Deployment rollout"
-kubectl rollout status -n olmv1-system deployment/operator-controller-controller-manager
-```
-
 ## Configuring the `ClusterExtension`
 
 A `ClusterExtension` can be configured to install bundle in `Single-` or `OwnNamespace` mode through the
diff --git a/docs/draft/tutorials/explore-available-content-metas-endpoint.md b/docs/draft/tutorials/explore-available-content-metas-endpoint.md
@@ -91,8 +91,9 @@ Then you can query the catalog by using `curl` commands and the `jq` CLI tool to
         ...
         ```
 
+
     !!! important
-        Currently, OLM 1.0 does not support the installation of extensions that use webhooks or that target a single or specified set of namespaces.
+        OLM 1.0 supports installing extensions that define webhooks. Targeting a single or specified set of namespaces is handled by the `SingleOwnNamespaceInstallSupport` feature gate, which is enabled by default.
 
 3. Return list of packages which support `AllNamespaces` install mode, do not use webhooks, and where the channel head version uses `olm.csv.metadata` format:
 
diff --git a/docs/project/olmv1_limitations.md b/docs/project/olmv1_limitations.md
@@ -8,8 +8,7 @@ hide:
 Currently, OLM v1 only supports installing operators packaged in [OLM v0 bundles](https://olm.operatorframework.io/docs/tasks/creating-operator-bundle/)
 , also known as `registry+v1` bundles. Additionally, the bundled operator, or cluster extension:
 
-* **must** support installation via the `AllNamespaces` install mode.
-* **must not** use webhooks.
+* **must** support installation via the `AllNamespaces` install mode, or rely on the default-enabled `SingleOwnNamespaceInstallSupport` feature gate to target a specific namespace.
 * **must not** declare dependencies using any of the following file-based catalog properties:
     * `olm.gvk.required`
     * `olm.package.required`
diff --git a/docs/tutorials/explore-available-content.md b/docs/tutorials/explore-available-content.md
@@ -91,8 +91,9 @@ Then you can query the catalog by using `curl` commands and the `jq` CLI tool to
         ...
         ```
 
+
     !!! important
-        Currently, OLM 1.0 does not support the installation of extensions that use webhooks or that target a single or specified set of namespaces.
+        OLM 1.0 supports installing extensions that define webhooks. Targeting a single or specified set of namespaces is handled by the `SingleOwnNamespaceInstallSupport` feature gate, which is enabled by default.
 
 3. Return list of packages that support `AllNamespaces` install mode and do not use webhooks:
 
diff --git a/hack/demo/own-namespace-demo-script.sh b/hack/demo/own-namespace-demo-script.sh
@@ -12,10 +12,7 @@ kubectl apply -f "$(dirname "${BASH_SOURCE[0]}")/../../manifests/experimental.ya
 # wait for experimental CRDs to be available
 kubectl wait --for condition=established --timeout=60s crd/clusterextensions.olm.operatorframework.io
 
-# enable 'SingleOwnNamespaceInstallSupport' feature gate
-kubectl patch deployment -n olmv1-system operator-controller-controller-manager --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--feature-gates=SingleOwnNamespaceInstallSupport=true"}]'
-
-# wait for operator-controller to become available
+# SingleOwnNamespaceInstallSupport is enabled by default; ensure controller is healthy
 kubectl rollout status -n olmv1-system deployment/operator-controller-controller-manager
 
 # create install namespace
@@ -57,10 +54,6 @@ kubectl delete clusterextension argocd-operator --ignore-not-found=true
 kubectl delete namespace argocd-system --ignore-not-found=true
 kubectl delete clusterrolebinding argocd-installer-crb --ignore-not-found=true
 
-# remove feature gate from deployment
-echo "Removing feature gate from operator-controller..."
-kubectl patch deployment -n olmv1-system operator-controller-controller-manager --type='json' -p='[{"op": "remove", "path": "/spec/template/spec/containers/0/args", "value": "--feature-gates=SingleOwnNamespaceInstallSupport=true"}]' || true
-
 # restore standard CRDs
 echo "Restoring standard CRDs..."
 kubectl apply -f "$(dirname "${BASH_SOURCE[0]}")/../../manifests/base.yaml"
diff --git a/hack/demo/single-namespace-demo-script.sh b/hack/demo/single-namespace-demo-script.sh
@@ -12,10 +12,7 @@ kubectl apply -f "$(dirname "${BASH_SOURCE[0]}")/../../manifests/experimental.ya
 # wait for experimental CRDs to be available
 kubectl wait --for condition=established --timeout=60s crd/clusterextensions.olm.operatorframework.io
 
-# enable 'SingleOwnNamespaceInstallSupport' feature gate
-kubectl patch deployment -n olmv1-system operator-controller-controller-manager --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--feature-gates=SingleOwnNamespaceInstallSupport=true"}]'
-
-# wait for operator-controller to become available
+# SingleOwnNamespaceInstallSupport is enabled by default; ensure controller is healthy
 kubectl rollout status -n olmv1-system deployment/operator-controller-controller-manager
 
 # create install namespace
@@ -60,10 +57,6 @@ kubectl delete clusterextension argocd-operator --ignore-not-found=true
 kubectl delete namespace argocd-system argocd --ignore-not-found=true
 kubectl delete clusterrolebinding argocd-installer-crb --ignore-not-found=true
 
-# remove feature gate from deployment
-echo "Removing feature gate from operator-controller..."
-kubectl patch deployment -n olmv1-system operator-controller-controller-manager --type='json' -p='[{"op": "remove", "path": "/spec/template/spec/containers/0/args", "value": "--feature-gates=SingleOwnNamespaceInstallSupport=true"}]' || true
-
 # restore standard CRDs
 echo "Restoring standard CRDs..."
 kubectl apply -f "$(dirname "${BASH_SOURCE[0]}")/../../manifests/base.yaml"
diff --git a/helm/experimental.yaml b/helm/experimental.yaml
@@ -7,7 +7,6 @@
 # to pull in resources or additions
 operatorControllerFeatures:
   - WebhookProviderCertManager
-  - SingleOwnNamespaceInstallSupport
   - PreflightPermissions
   - HelmChartSupport
   - BoxcutterRuntime
diff --git a/helm/tilt.yaml b/helm/tilt.yaml
@@ -14,7 +14,6 @@ options:
 
 operatorControllerFeatures:
   - WebhookProviderCertManager
-  - SingleOwnNamespaceInstallSupport
   - PreflightPermissions
   - HelmChartSupport
 
diff --git a/internal/operator-controller/features/features.go b/internal/operator-controller/features/features.go
@@ -33,8 +33,8 @@ var operatorControllerFeatureGates = map[featuregate.Feature]featuregate.Feature
 	// registry+v1 cluster extensions with single or own namespaces modes
 	// i.e. with a single watch namespace.
 	SingleOwnNamespaceInstallSupport: {
-		Default:       false,
-		PreRelease:    featuregate.Alpha,
+		Default:       true,
+		PreRelease:    featuregate.GA,
 		LockToDefault: false,
 	},
 
diff --git a/manifests/experimental-e2e.yaml b/manifests/experimental-e2e.yaml
@@ -2184,7 +2184,6 @@ spec:
             - --metrics-bind-address=:8443
             - --leader-elect
             - --feature-gates=WebhookProviderCertManager=true
-            - --feature-gates=SingleOwnNamespaceInstallSupport=true
             - --feature-gates=PreflightPermissions=true
             - --feature-gates=HelmChartSupport=true
             - --feature-gates=BoxcutterRuntime=true
diff --git a/manifests/experimental.yaml b/manifests/experimental.yaml
@@ -2097,7 +2097,6 @@ spec:
             - --metrics-bind-address=:8443
             - --leader-elect
             - --feature-gates=WebhookProviderCertManager=true
-            - --feature-gates=SingleOwnNamespaceInstallSupport=true
             - --feature-gates=PreflightPermissions=true
             - --feature-gates=HelmChartSupport=true
             - --feature-gates=BoxcutterRuntime=true
diff --git a/test/e2e/single_namespace_support_test.go b/test/e2e/single_namespace_support_test.go
@@ -0,0 +1,163 @@
+package e2e
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	rbacv1 "k8s.io/api/rbac/v1"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	apimeta "k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/utils/ptr"
+
+	ocv1 "github.com/operator-framework/operator-controller/api/v1"
+	utils "github.com/operator-framework/operator-controller/internal/shared/util/testutils"
+)
+
+func TestClusterExtensionConfigSupport(t *testing.T) {
+	t.Log("Test support for cluster extension config")
+	defer utils.CollectTestArtifacts(t, artifactName, c, cfg)
+
+	t.Log("By creating install namespace, watch namespace and necessary rbac resources")
+	namespace := corev1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "test-operator",
+		},
+	}
+	require.NoError(t, c.Create(t.Context(), &namespace))
+	t.Cleanup(func() {
+		require.NoError(t, c.Delete(context.Background(), &namespace))
+	})
+
+	watchNamespace := corev1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "test-operator-watch",
+		},
+	}
+	require.NoError(t, c.Create(t.Context(), &watchNamespace))
+	t.Cleanup(func() {
+		require.NoError(t, c.Delete(context.Background(), &watchNamespace))
+	})
+
+	serviceAccount := corev1.ServiceAccount{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-operator-installer",
+			Namespace: namespace.GetName(),
+		},
+	}
+	require.NoError(t, c.Create(t.Context(), &serviceAccount))
+	t.Cleanup(func() {
+		require.NoError(t, c.Delete(context.Background(), &serviceAccount))
+	})
+
+	clusterRoleBinding := &rbacv1.ClusterRoleBinding{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "test-operator-installer",
+		},
+		Subjects: []rbacv1.Subject{
+			{
+				Kind:      "ServiceAccount",
+				APIGroup:  corev1.GroupName,
+				Name:      serviceAccount.GetName(),
+				Namespace: serviceAccount.GetNamespace(),
+			},
+		},
+		RoleRef: rbacv1.RoleRef{
+			APIGroup: rbacv1.GroupName,
+			Kind:     "ClusterRole",
+			Name:     "cluster-admin",
+		},
+	}
+	require.NoError(t, c.Create(t.Context(), clusterRoleBinding))
+	t.Cleanup(func() {
+		require.NoError(t, c.Delete(context.Background(), clusterRoleBinding))
+	})
+
+	t.Log("By creating the test-operator ClusterCatalog")
+	extensionCatalog := &ocv1.ClusterCatalog{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "test-operator-catalog",
+		},
+		Spec: ocv1.ClusterCatalogSpec{
+			Source: ocv1.CatalogSource{
+				Type: ocv1.SourceTypeImage,
+				Image: &ocv1.ImageSource{
+					Ref:                 fmt.Sprintf("%s/e2e/test-catalog:v1", os.Getenv("CLUSTER_REGISTRY_HOST")),
+					PollIntervalMinutes: ptr.To(1),
+				},
+			},
+		},
+	}
+	require.NoError(t, c.Create(t.Context(), extensionCatalog))
+	t.Cleanup(func() {
+		require.NoError(t, c.Delete(context.Background(), extensionCatalog))
+	})
+
+	t.Log("By waiting for the catalog to serve its metadata")
+	require.EventuallyWithT(t, func(ct *assert.CollectT) {
+		require.NoError(ct, c.Get(context.Background(), types.NamespacedName{Name: extensionCatalog.GetName()}, extensionCatalog))
+		cond := apimeta.FindStatusCondition(extensionCatalog.Status.Conditions, ocv1.TypeServing)
+		require.NotNil(ct, cond)
+		require.Equal(ct, metav1.ConditionTrue, cond.Status)
+		require.Equal(ct, ocv1.ReasonAvailable, cond.Reason)
+	}, pollDuration, pollInterval)
+
+	t.Log("By installing the test-operator ClusterExtension configured in SingleNamespace mode")
+	clusterExtension := &ocv1.ClusterExtension{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "test-operator-extension",
+		},
+		Spec: ocv1.ClusterExtensionSpec{
+			Source: ocv1.SourceConfig{
+				SourceType: "Catalog",
+				Catalog: &ocv1.CatalogFilter{
+					PackageName: "test",
+					Selector: &metav1.LabelSelector{
+						MatchLabels: map[string]string{"olm.operatorframework.io/metadata.name": extensionCatalog.Name},
+					},
+				},
+			},
+			Namespace: namespace.GetName(),
+			ServiceAccount: ocv1.ServiceAccountReference{
+				Name: serviceAccount.GetName(),
+			},
+			Config: &ocv1.ClusterExtensionConfig{
+				ConfigType: ocv1.ClusterExtensionConfigTypeInline,
+				Inline: &apiextensionsv1.JSON{
+					Raw: []byte(fmt.Sprintf(`{"watchNamespace": "%s"}`, watchNamespace.GetName())),
+				},
+			},
+		},
+	}
+	require.NoError(t, c.Create(t.Context(), clusterExtension))
+	t.Cleanup(func() {
+		require.NoError(t, c.Delete(context.Background(), clusterExtension))
+	})
+
+	t.Log("By waiting for test-operator extension to be installed successfully")
+	require.EventuallyWithT(t, func(ct *assert.CollectT) {
+		require.NoError(ct, c.Get(t.Context(), types.NamespacedName{Name: clusterExtension.Name}, clusterExtension))
+		cond := apimeta.FindStatusCondition(clusterExtension.Status.Conditions, ocv1.TypeInstalled)
+		require.NotNil(ct, cond)
+		require.Equal(ct, metav1.ConditionTrue, cond.Status)
+		require.Equal(ct, ocv1.ReasonSucceeded, cond.Reason)
+		require.Contains(ct, cond.Message, "Installed bundle")
+		require.NotNil(ct, clusterExtension.Status.Install)
+		require.NotEmpty(ct, clusterExtension.Status.Install.Bundle)
+	}, pollDuration, pollInterval)
+
+	t.Log("By ensuring the test-operator deployment is correctly configured to watch the watch namespace")
+	require.EventuallyWithT(t, func(ct *assert.CollectT) {
+		deployment := &appsv1.Deployment{}
+		require.NoError(ct, c.Get(t.Context(), types.NamespacedName{Namespace: namespace.GetName(), Name: "test-operator"}, deployment))
+		require.NotNil(ct, deployment.Spec.Template.GetAnnotations())
+		require.Equal(ct, watchNamespace.GetName(), deployment.Spec.Template.GetAnnotations()["olm.targetNamespaces"])
+	}, pollDuration, pollInterval)
+}
diff --git a/test/experimental-e2e/experimental_e2e_test.go b/test/experimental-e2e/experimental_e2e_test.go
