feat: remove RekorSearchUI and migrate to Console CR

.github/workflows/main.yml

@@ -695,7 +695,6 @@ jobs:
           DOCKER_CONFIG: /tmp
         run: |
           export OIDC_ISSUER_URL="http://${{ steps.kind.outputs.oidc_host }}/realms/trusted-artifact-signer"
-          export REKOR_UI_URL=$(kubectl  get rekor -o jsonpath='{.items[0].status.rekorSearchUIUrl}' -n ${{ env.TEST_NAMESPACE }})
           export TUF_URL=$(kubectl get tuf -o jsonpath='{.items[0].status.url}' -n ${{ env.TEST_NAMESPACE }})
           export REKOR_URL=$(kubectl get rekor -o jsonpath='{.items[0].status.url}' -n ${{ env.TEST_NAMESPACE }})
           export FULCIO_URL=$(kubectl get fulcio -o jsonpath='{.items[0].status.url}' -n ${{ env.TEST_NAMESPACE }})
@@ -705,9 +704,7 @@ jobs:
 
           cd e2e
           source ./tas-env-variables.sh
-          # Install Playwright with dependencies for UI tests
-          go run github.com/mxschmitt/playwright-go/cmd/playwright install --with-deps
-          go test -v ./test/...
+          go test -v $(go list ./test/... | grep -v rekorsearchui)
 
       - name: dump the logs of the operator
         run: |

api/v1/rekor_defaults.go

@@ -9,19 +9,13 @@ func (s *RekorSpec) SetDefaults() {
 	s.PodRequirements.SetDefaults()
 	s.Monitoring.SetDefaults()
 	s.Ingress.SetDefaults()
-	s.RekorSearchUI.SetDefaults()
 	s.Signer.SetDefaults()
 	s.Attestations.SetDefaults()
 	s.SearchIndex.SetDefaults()
 	s.BackFillRedis.SetDefaults()
 	setDefault(&s.MaxRequestBodySize, ptr.To(int64(10485760)))
 }
 
-func (s *RekorSearchUI) SetDefaults() {
-	s.PodRequirements.SetDefaults()
-	setDefault(&s.Enabled, ptr.To(true))
-}
-
 func (s *RekorAttestations) SetDefaults() {
 	setDefault(&s.Enabled, ptr.To(true))
 	setDefault(&s.Url, "file:///var/run/attestations?no_tmp_dir=true")

api/v1/rekor_types.go

@@ -36,8 +36,6 @@ type RekorSpec struct {
 	Ingress Ingress `json:"ingress,omitempty"`
 	//Enable Service monitors for rekor
 	Monitoring MonitoringWithTLogConfig `json:"monitoring,omitempty"`
-	// Rekor Search UI
-	RekorSearchUI RekorSearchUI `json:"rekorSearchUI,omitempty"`
 	// Signer configuration
 	Signer RekorSigner `json:"signer,omitempty"`
 	// Attestations configuration
@@ -128,17 +126,6 @@ type RekorSigner struct {
 	KeyRef *SecretKeySelector `json:"keyRef,omitempty"`
 }
 
-type RekorSearchUI struct {
-	PodRequirements `json:",inline"`
-	// If set to true, the Operator will deploy a Rekor Search UI
-	//+kubebuilder:validation:XValidation:rule=(self || !oldSelf),message=Feature cannot be disabled
-	Enabled *bool `json:"enabled,omitempty"`
-	// Set hostname for your Ingress.
-	Host string `json:"host,omitempty"`
-	// Set labels applied to the created Ingress, e.g. for ingress-controller/route selection when sharding ingress traffic.
-	Labels map[string]string `json:"labels,omitempty"`
-}
-
 // SearchIndex define search index connection
 // +kubebuilder:validation:XValidation:rule=(!has(self.create) || !(self.create == true) || !has(self.provider) || self.provider == ""),message=Provider can be specified only with external db (create=false)
 // +kubebuilder:validation:XValidation:rule=(!has(self.create) || !(self.create == false) || self.provider != ""),message=Provider must be defined with external db (create=false)
@@ -202,14 +189,13 @@ type RekorSignerStatus struct {
 type RekorStatus struct {
 	// Reference to secret with Rekor's signer public key.
 	// Public key is automatically generated from signer private key.
-	PublicKeyRef     *SecretKeySelector    `json:"publicKeyRef,omitempty"`
-	ServerConfigRef  *LocalObjectReference `json:"serverConfigRef,omitempty"`
-	Signer           RekorSignerStatus     `json:"signer,omitempty"`
-	SearchIndex      SearchIndexStatus     `json:"searchIndex,omitempty"`
-	PvcName          string                `json:"pvcName,omitempty"`
-	MonitorPvcName   string                `json:"monitorPvcName,omitempty"`
-	Url              string                `json:"url,omitempty"`
-	RekorSearchUIUrl string                `json:"rekorSearchUIUrl,omitempty"`
+	PublicKeyRef    *SecretKeySelector    `json:"publicKeyRef,omitempty"`
+	ServerConfigRef *LocalObjectReference `json:"serverConfigRef,omitempty"`
+	Signer          RekorSignerStatus     `json:"signer,omitempty"`
+	SearchIndex     SearchIndexStatus     `json:"searchIndex,omitempty"`
+	PvcName         string                `json:"pvcName,omitempty"`
+	MonitorPvcName  string                `json:"monitorPvcName,omitempty"`
+	Url             string                `json:"url,omitempty"`
 	// PEM-encoded public key resolved from the running Rekor service API.
 	// +optional
 	PublicKey string `json:"publicKey,omitempty"`

api/v1/rekor_types_test.go

@@ -247,9 +247,6 @@ var _ = Describe("Rekor", func() {
 							Enabled: ptr.To(true),
 							Host:    "hostname",
 						},
-						RekorSearchUI: RekorSearchUI{
-							Enabled: ptr.To(true),
-						},
 						BackFillRedis: BackFillRedis{
 							Enabled:  ptr.To(true),
 							Schedule: "* */2 * * 0-3",

api/v1alpha1/conversion_roundtrip_test.go

@@ -23,11 +23,13 @@ import (
 
 	rhtasv1 "github.com/securesign/operator/api/v1"
 	utilconversion "github.com/securesign/operator/internal/conversion"
+	"github.com/securesign/operator/internal/migration"
 	urlfuzz "github.com/securesign/operator/internal/testing/fuzzer"
 	"k8s.io/apimachinery/pkg/api/apitesting/fuzzer"
 	"k8s.io/apimachinery/pkg/runtime"
 	runtimeserializer "k8s.io/apimachinery/pkg/runtime/serializer"
 	"k8s.io/utils/ptr"
+	"sigs.k8s.io/controller-runtime/pkg/conversion"
 	"sigs.k8s.io/randfill"
 )
 
@@ -311,6 +313,8 @@ func rekorStatusFuzzerFuncs(_ runtimeserializer.CodecFactory) []interface{} {
 			c.FillNoCustom(s)
 			// no v1 equivalent in RekorSignerStatus
 			s.Signer.KMS = ""
+			// no v1 equivalent — removed from v1 API
+			s.RekorSearchUIUrl = ""
 		},
 	}
 }
@@ -380,10 +384,14 @@ func securesignStatusFuzzerFuncs(_ runtimeserializer.CodecFactory) []interface{}
 // Tests
 
 func TestSecuresignConversion(t *testing.T) {
+	t.Parallel()
 	t.Run("roundtrip", utilconversion.FuzzTestFunc(utilconversion.FuzzTestFuncInput{
 		Scheme: rhtasScheme(),
 		Hub:    &rhtasv1.Securesign{},
 		Spoke:  &Securesign{},
+		HubAfterMutation: func(hub conversion.Hub) {
+			migration.StripAll(hub.(*rhtasv1.Securesign))
+		},
 		FuzzerFuncs: []fuzzer.FuzzerFuncs{
 			securesignStatusFuzzerFuncs,
 			tsaSignerFuzzerFuncs,
@@ -401,6 +409,7 @@ func TestSecuresignConversion(t *testing.T) {
 }
 
 func TestCTlogConversion(t *testing.T) {
+	t.Parallel()
 	t.Run("roundtrip", utilconversion.FuzzTestFunc(utilconversion.FuzzTestFuncInput{
 		Scheme: rhtasScheme(),
 		Hub:    &rhtasv1.CTlog{},
@@ -415,10 +424,14 @@ func TestCTlogConversion(t *testing.T) {
 }
 
 func TestRekorConversion(t *testing.T) {
+	t.Parallel()
 	t.Run("roundtrip", utilconversion.FuzzTestFunc(utilconversion.FuzzTestFuncInput{
 		Scheme: rhtasScheme(),
 		Hub:    &rhtasv1.Rekor{},
 		Spoke:  &Rekor{},
+		HubAfterMutation: func(hub conversion.Hub) {
+			migration.StripAll(hub.(*rhtasv1.Rekor))
+		},
 		FuzzerFuncs: []fuzzer.FuzzerFuncs{
 			rekorStatusFuzzerFuncs,
 			trillianServiceFuzzerFuncs,
@@ -429,6 +442,7 @@ func TestRekorConversion(t *testing.T) {
 }
 
 func TestFulcioConversion(t *testing.T) {
+	t.Parallel()
 	t.Run("roundtrip", utilconversion.FuzzTestFunc(utilconversion.FuzzTestFuncInput{
 		Scheme: rhtasScheme(),
 		Hub:    &rhtasv1.Fulcio{},
@@ -441,6 +455,7 @@ func TestFulcioConversion(t *testing.T) {
 }
 
 func TestTrillianConversion(t *testing.T) {
+	t.Parallel()
 	t.Run("roundtrip", utilconversion.FuzzTestFunc(utilconversion.FuzzTestFuncInput{
 		Scheme: rhtasScheme(),
 		Hub:    &rhtasv1.Trillian{},
@@ -453,6 +468,7 @@ func TestTrillianConversion(t *testing.T) {
 }
 
 func TestTufConversion(t *testing.T) {
+	t.Parallel()
 	t.Run("roundtrip", utilconversion.FuzzTestFunc(utilconversion.FuzzTestFuncInput{
 		Scheme: rhtasScheme(),
 		Hub:    &rhtasv1.Tuf{},
@@ -469,6 +485,7 @@ func TestTufConversion(t *testing.T) {
 }
 
 func TestTimestampAuthorityConversion(t *testing.T) {
+	t.Parallel()
 	t.Run("roundtrip", utilconversion.FuzzTestFunc(utilconversion.FuzzTestFuncInput{
 		Scheme: rhtasScheme(),
 		Hub:    &rhtasv1.TimestampAuthority{},

api/v1alpha1/conversion_unit_test.go

@@ -22,6 +22,7 @@ import (
 	"github.com/google/go-cmp/cmp"
 	rhtasv1 "github.com/securesign/operator/api/v1"
 	utilconversion "github.com/securesign/operator/internal/conversion"
+	"github.com/securesign/operator/internal/migration"
 	core "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/equality"
 	"k8s.io/apimachinery/pkg/api/resource"
@@ -215,6 +216,7 @@ func TestSecuresignConversionUnit(t *testing.T) {
 				t.Fatalf("ConvertTo failed: %v", err)
 			}
 
+			migration.StripAll(gotHub)
 			if !equality.Semantic.DeepEqual(expectedHub, gotHub) {
 				t.Errorf("v1alpha1 -> v1 mismatch (-want +got):\n%s", cmp.Diff(expectedHub, gotHub))
 			}
@@ -489,6 +491,7 @@ func TestRekorConversionUnit(t *testing.T) {
 			if err := tt.spoke.ConvertTo(gotHub); err != nil {
 				t.Fatalf("ConvertTo failed: %v", err)
 			}
+			migration.StripAll(gotHub)
 			if !equality.Semantic.DeepEqual(tt.hub, gotHub) {
 				t.Errorf("mismatch (-want +got):\n%s", cmp.Diff(tt.hub, gotHub))
 			}

api/v1alpha1/rekor_conversion.go

@@ -3,24 +3,28 @@ package v1alpha1
 import (
 	rhtasv1 "github.com/securesign/operator/api/v1"
 	utilconversion "github.com/securesign/operator/internal/conversion"
+	"github.com/securesign/operator/internal/migration"
 	apiconversion "k8s.io/apimachinery/pkg/conversion"
 	"sigs.k8s.io/controller-runtime/pkg/conversion"
 )
 
+var MigrationSearchUIData = migration.Key("v1alpha1", "rekorSearchUI")
+
 func Convert_v1_RekorStatus_To_v1alpha1_RekorStatus(in *rhtasv1.RekorStatus, out *RekorStatus, s apiconversion.Scope) error {
 	return autoConvert_v1_RekorStatus_To_v1alpha1_RekorStatus(in, out, s)
 }
 
+func Convert_v1alpha1_RekorStatus_To_v1_RekorStatus(in *RekorStatus, out *rhtasv1.RekorStatus, s apiconversion.Scope) error {
+	return autoConvert_v1alpha1_RekorStatus_To_v1_RekorStatus(in, out, s)
+}
+
 func Convert_v1alpha1_RekorSpec_To_v1_RekorSpec(in *RekorSpec, out *rhtasv1.RekorSpec, s apiconversion.Scope) error {
 	if err := autoConvert_v1alpha1_RekorSpec_To_v1_RekorSpec(in, out, s); err != nil {
 		return err
 	}
 	if err := Convert_v1alpha1_ExternalAccess_To_v1_Ingress(&in.ExternalAccess, &out.Ingress, s); err != nil {
 		return err
 	}
-	if err := Convert_v1alpha1_RekorSearchUI_To_v1_RekorSearchUI(&in.RekorSearchUI, &out.RekorSearchUI, s); err != nil {
-		return err
-	}
 	return Convert_v1alpha1_Pvc_To_v1_Pvc(&in.Pvc, &out.Attestations.Pvc, s)
 }
 
@@ -31,32 +35,10 @@ func Convert_v1_RekorSpec_To_v1alpha1_RekorSpec(in *rhtasv1.RekorSpec, out *Reko
 	if err := Convert_v1_Ingress_To_v1alpha1_ExternalAccess(&in.Ingress, &out.ExternalAccess, s); err != nil {
 		return err
 	}
-	if err := Convert_v1_RekorSearchUI_To_v1alpha1_RekorSearchUI(&in.RekorSearchUI, &out.RekorSearchUI, s); err != nil {
-		return err
-	}
 	return Convert_v1_Pvc_To_v1alpha1_Pvc(&in.Attestations.Pvc, &out.Pvc, s)
 }
 
-// RekorSearchUI had its RouteSelectorLabels field renamed to Labels in v1.
-
-func Convert_v1alpha1_RekorSearchUI_To_v1_RekorSearchUI(in *RekorSearchUI, out *rhtasv1.RekorSearchUI, s apiconversion.Scope) error {
-	if err := autoConvert_v1alpha1_RekorSearchUI_To_v1_RekorSearchUI(in, out, s); err != nil {
-		return err
-	}
-	out.Labels = in.RouteSelectorLabels
-	return nil
-}
-
-func Convert_v1_RekorSearchUI_To_v1alpha1_RekorSearchUI(in *rhtasv1.RekorSearchUI, out *RekorSearchUI, s apiconversion.Scope) error {
-	if err := autoConvert_v1_RekorSearchUI_To_v1alpha1_RekorSearchUI(in, out, s); err != nil {
-		return err
-	}
-	out.RouteSelectorLabels = in.Labels
-	return nil
-}
-
 func Convert_v1_RekorAttestations_To_v1alpha1_RekorAttestations(in *rhtasv1.RekorAttestations, out *RekorAttestations, s apiconversion.Scope) error {
-	// Pvc is handled at the RekorSpec level conversion, not here.
 	return autoConvert_v1_RekorAttestations_To_v1alpha1_RekorAttestations(in, out, s)
 }
 
@@ -65,6 +47,11 @@ func (src *Rekor) ConvertTo(dstRaw conversion.Hub) error {
 	if err := Convert_v1alpha1_Rekor_To_v1_Rekor(src, dst, nil); err != nil {
 		return err
 	}
+
+	if err := migration.Set(dst, MigrationSearchUIData, src.Spec.RekorSearchUI); err != nil {
+		return err
+	}
+
 	restored := &rhtasv1.Rekor{}
 	if ok, err := utilconversion.UnmarshalData(src, restored); err != nil || !ok {
 		return err
@@ -75,6 +62,7 @@ func (src *Rekor) ConvertTo(dstRaw conversion.Hub) error {
 	if dst.Spec.Trillian.URL == "" {
 		dst.Spec.Trillian.Ref = restored.Spec.Trillian.Ref
 	}
+
 	return nil
 }
 
@@ -83,6 +71,14 @@ func (dst *Rekor) ConvertFrom(srcRaw conversion.Hub) error {
 	if err := Convert_v1_Rekor_To_v1alpha1_Rekor(src, dst, nil); err != nil {
 		return err
 	}
+
+	var searchUI RekorSearchUI
+	if ok, err := migration.Pop(src, MigrationSearchUIData, &searchUI); err != nil {
+		return err
+	} else if ok {
+		dst.Spec.RekorSearchUI = searchUI
+	}
+
 	return utilconversion.MarshalData(src, dst)
 }
 

api/v1alpha1/securesign_conversion.go

@@ -3,6 +3,7 @@ package v1alpha1
 import (
 	rhtasv1 "github.com/securesign/operator/api/v1"
 	utilconversion "github.com/securesign/operator/internal/conversion"
+	"github.com/securesign/operator/internal/migration"
 	"k8s.io/apimachinery/pkg/api/equality"
 	apiconversion "k8s.io/apimachinery/pkg/conversion"
 	"sigs.k8s.io/controller-runtime/pkg/conversion"
@@ -39,6 +40,11 @@ func (src *Securesign) ConvertTo(dstRaw conversion.Hub) error {
 	if err := Convert_v1alpha1_Securesign_To_v1_Securesign(src, dst, nil); err != nil {
 		return err
 	}
+
+	if err := migration.Set(dst, MigrationSearchUIData, src.Spec.Rekor.RekorSearchUI); err != nil {
+		return err
+	}
+
 	restored := &rhtasv1.Securesign{}
 	if ok, err := utilconversion.UnmarshalData(src, restored); err != nil || !ok {
 		return err
@@ -104,5 +110,13 @@ func (dst *Securesign) ConvertFrom(srcRaw conversion.Hub) error {
 	if err := Convert_v1_Securesign_To_v1alpha1_Securesign(src, dst, nil); err != nil {
 		return err
 	}
+
+	var searchUI RekorSearchUI
+	if ok, err := migration.Pop(src, MigrationSearchUIData, &searchUI); err != nil {
+		return err
+	} else if ok {
+		dst.Spec.Rekor.RekorSearchUI = searchUI
+	}
+
 	return utilconversion.MarshalData(src, dst)
 }