Split Sidecar to it's own container

.github/workflows/kubernetes-tests.yml

@@ -127,11 +127,35 @@ jobs:
       - name: Operator Binary
         run: |
           make operator
+  sidecar:
+    timeout-minutes: 30
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        go-version: [ 1.21.x ]
+        os: [ ubuntu-latest ]
+
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v4
+        with:
+          go-version: ${{ matrix.go-version }}
+      - uses: actions/cache@v3
+        name: Operator Sidecar Binary Cache
+        with:
+          path: |
+            ./minio-operator-sidecar
+          key: ${{ runner.os }}-sidecar-binary-${{ github.run_id }}
+      - name: Operator Binary
+        working-directory: ./sidecar
+        run: |
+          make sidecar
   test-tenant:
     timeout-minutes: 30
     runs-on: ${{ matrix.os }}
     needs:
       - operator
+      - sidecar
     strategy:
       matrix:
         go-version: [ 1.21.x ]
@@ -148,6 +172,12 @@ jobs:
           path: |
             ./minio-operator
           key: ${{ runner.os }}-binary-${{ github.run_id }}
+      - uses: actions/cache@v3
+        name: Operator Sidecar Binary Cache
+        with:
+          path: |
+            ./minio-operator-sidecar
+          key: ${{ runner.os }}-sidecar-binary-${{ github.run_id }}
       - name: Deploy Tenant
         run: |
           "${GITHUB_WORKSPACE}/testing/deploy-tenant.sh"
@@ -172,6 +202,12 @@ jobs:
           path: |
             ./minio-operator
           key: ${{ runner.os }}-binary-${{ github.run_id }}
+      - uses: actions/cache@v3
+        name: Operator Sidecar Binary Cache
+        with:
+          path: |
+            ./minio-operator-sidecar
+          key: ${{ runner.os }}-sidecar-binary-${{ github.run_id }}
       - name: Tenant upgrade test on Kind
         run: |
           "${GITHUB_WORKSPACE}/testing/deploy-tenant-upgrade.sh"
@@ -196,6 +232,12 @@ jobs:
           path: |
             ./minio-operator
           key: ${{ runner.os }}-binary-${{ github.run_id }}
+      - uses: actions/cache@v3
+        name: Operator Sidecar Binary Cache
+        with:
+          path: |
+            ./minio-operator-sidecar
+          key: ${{ runner.os }}-sidecar-binary-${{ github.run_id }}
       - name: Tenant KES
         run: |
           "${GITHUB_WORKSPACE}/testing/console-tenant+kes.sh"
@@ -219,6 +261,12 @@ jobs:
           path: |
             ./minio-operator
           key: ${{ runner.os }}-binary-${{ github.run_id }}
+      - uses: actions/cache@v3
+        name: Operator Sidecar Binary Cache
+        with:
+          path: |
+            ./minio-operator-sidecar
+          key: ${{ runner.os }}-sidecar-binary-${{ github.run_id }}
       - name: Deploy Tenant with cert-manager
         run: |
           "${GITHUB_WORKSPACE}/testing/deploy-cert-manager-tenant.sh"
@@ -252,6 +300,12 @@ jobs:
           path: |
             ./minio-operator
           key: ${{ runner.os }}-binary-${{ github.run_id }}
+      - uses: actions/cache@v3
+        name: Operator Sidecar Binary Cache
+        with:
+          path: |
+            ./minio-operator-sidecar
+          key: ${{ runner.os }}-sidecar-binary-${{ github.run_id }}
       - name: Test PolicyBinding CRD and sts call on kind
         run: |
           "${GITHUB_WORKSPACE}/testing/test-policy-binding.sh"
@@ -279,6 +333,12 @@ jobs:
           path: |
             ./minio-operator
           key: ${{ runner.os }}-binary-${{ github.run_id }}
+      - uses: actions/cache@v3
+        name: Operator Sidecar Binary Cache
+        with:
+          path: |
+            ./minio-operator-sidecar
+          key: ${{ runner.os }}-sidecar-binary-${{ github.run_id }}
       # Runs a set of commands using the runners shell
       - name: Deploy a MinIO Tenant on Kind
         run: |
@@ -310,7 +370,12 @@ jobs:
           path: |
             ./minio-operator
           key: ${{ runner.os }}-binary-${{ github.run_id }}
-
+      - uses: actions/cache@v3
+        name: Operator Sidecar Binary Cache
+        with:
+          path: |
+            ./minio-operator-sidecar
+          key: ${{ runner.os }}-sidecar-binary-${{ github.run_id }}
       # Runs a set of commands using the runners shell
       - name: Deploy a MinIO Tenant on Kind
         env:

.goreleaser.yml

@@ -29,10 +29,29 @@ builds:
     env:
       - CGO_ENABLED=0
     main: ./cmd/operator/
+    dir: .
+    id: minio-operator
     ldflags:
       - -s -w -X github.com/minio/operator/pkg.ReleaseTag={{.Tag}} -X github.com/minio/operator/pkg.CommitID={{.FullCommit}} -X github.com/minio/operator/pkg.Version={{.Version}} -X github.com/minio/operator/pkg.ShortCommitID={{.ShortCommit}} -X github.com/minio/operator/pkg.ReleaseTime={{.Date}}
     flags:
       - -trimpath
+  - goos:
+      - linux
+    goarch:
+      - arm64
+      - amd64
+      - ppc64le
+      - s390x
+    env:
+      - CGO_ENABLED=0
+    id: minio-operator-sidecar
+    dir: sidecar/
+    binary: minio-operator-sidecar
+    main: ./cmd/sidecar/
+    ldflags:
+      - -s -w -X github.com/minio/operator/pkg.ReleaseTag={{.Tag}} -X github.com/minio/operator/pkg.CommitID={{.FullCommit}} -X github.com/minio/operator/sidecar/pkg.Version={{.Version}} -X github.com/minio/operator/sidecar/pkg.ShortCommitID={{.ShortCommit}} -X github.com/minio/operator/pkg.ReleaseTime={{.Date}}
+    flags:
+      - -trimpath
 
 archives:
   - allow_different_binary_count: true
@@ -127,6 +146,94 @@ dockers:
     build_flag_templates:
       - "--platform=linux/arm64"
       - "--build-arg=TAG={{ .Tag }}"
+  - image_templates:
+      - "minio/operator-sidecar:{{ .Tag }}-amd64"
+    use: buildx
+    goarch: amd64
+    dockerfile: sidecar/Dockerfile
+    extra_files:
+      - LICENSE
+      - CREDITS
+    build_flag_templates:
+      - "--platform=linux/amd64"
+      - "--build-arg=TAG={{ .Tag }}"
+  - image_templates:
+      - "minio/operator-sidecar:{{ .Tag }}-ppc64le"
+    use: buildx
+    dockerfile: sidecar/Dockerfile
+    goarch: ppc64le
+    extra_files:
+      - LICENSE
+      - CREDITS
+    build_flag_templates:
+      - "--platform=linux/ppc64le"
+      - "--build-arg=TAG={{ .Tag }}"
+  - image_templates:
+      - "minio/operator-sidecar:{{ .Tag }}-s390x"
+    use: buildx
+    goarch: s390x
+    dockerfile: sidecar/Dockerfile
+    extra_files:
+      - LICENSE
+      - CREDITS
+    build_flag_templates:
+      - "--platform=linux/s390x"
+      - "--build-arg=TAG={{ .Tag }}"
+  - image_templates:
+      - "minio/operator-sidecar:{{ .Tag }}-arm64"
+    use: buildx
+    goarch: arm64
+    dockerfile: sidecar/Dockerfile
+    extra_files:
+      - LICENSE
+      - CREDITS
+    build_flag_templates:
+      - "--platform=linux/arm64"
+      - "--build-arg=TAG={{ .Tag }}"
+  - image_templates:
+      - "quay.io/minio/operator-sidecar:{{ .Tag }}-amd64"
+    use: buildx
+    goarch: amd64
+    dockerfile: sidecar/Dockerfile
+    extra_files:
+      - LICENSE
+      - CREDITS
+    build_flag_templates:
+      - "--platform=linux/amd64"
+      - "--build-arg=TAG={{ .Tag }}"
+  - image_templates:
+      - "quay.io/minio/operator-sidecar:{{ .Tag }}-ppc64le"
+    use: buildx
+    dockerfile: sidecar/Dockerfile
+    goarch: ppc64le
+    extra_files:
+      - LICENSE
+      - CREDITS
+    build_flag_templates:
+      - "--platform=linux/ppc64le"
+      - "--build-arg=TAG={{ .Tag }}"
+  - image_templates:
+      - "quay.io/minio/operator-sidecar:{{ .Tag }}-s390x"
+    use: buildx
+    goarch: s390x
+    dockerfile: sidecar/Dockerfile
+    extra_files:
+      - LICENSE
+      - CREDITS
+    build_flag_templates:
+      - "--platform=linux/s390x"
+      - "--build-arg=TAG={{ .Tag }}"
+  - image_templates:
+      - "quay.io/minio/operator-sidecar:{{ .Tag }}-arm64"
+    use: buildx
+    goarch: arm64
+    dockerfile: sidecar/Dockerfile
+    extra_files:
+      - LICENSE
+      - CREDITS
+    build_flag_templates:
+      - "--platform=linux/arm64"
+      - "--build-arg=TAG={{ .Tag }}"
 docker_manifests:
   - name_template: minio/operator:{{ .Tag }}
     image_templates:
@@ -140,3 +247,15 @@ docker_manifests:
       - quay.io/minio/operator:{{ .Tag }}-arm64
       - quay.io/minio/operator:{{ .Tag }}-ppc64le
       - quay.io/minio/operator:{{ .Tag }}-s390x
+  - name_template: minio/operator-sidecar:{{ .Tag }}
+    image_templates:
+      - minio/operator-sidecar:{{ .Tag }}-amd64
+      - minio/operator-sidecar:{{ .Tag }}-arm64
+      - minio/operator-sidecar:{{ .Tag }}-ppc64le
+      - minio/operator-sidecar:{{ .Tag }}-s390x
+  - name_template: quay.io/minio/operator-sidecar:{{ .Tag }}
+    image_templates:
+      - quay.io/minio/operator-sidecar:{{ .Tag }}-amd64
+      - quay.io/minio/operator-sidecar:{{ .Tag }}-arm64
+      - quay.io/minio/operator-sidecar:{{ .Tag }}-ppc64le
+      - quay.io/minio/operator-sidecar:{{ .Tag }}-s390x

cmd/operator/app_commands.go

@@ -20,7 +20,5 @@ import (
 
 var appCmds = []cli.Command{
 	controllerCmd,
-	sidecarCmd,
-	validateCmd,
 	uiCmd,
 }

pkg/controller/main-controller.go

@@ -34,7 +34,6 @@ import (
 
 	"github.com/minio/minio-go/v7/pkg/set"
 	"github.com/minio/operator/pkg/controller/certificates"
-	"github.com/minio/pkg/env"
 	"k8s.io/apimachinery/pkg/api/meta"
 	"k8s.io/klog/v2"
 
@@ -192,8 +191,6 @@ type Controller struct {
 	// time, and makes it easy to ensure we are never processing the same item
 	// simultaneously in two different workers.
 	healthCheckQueue queue.RateLimitingInterface
-	// image being used in the operator deployment
-	operatorImage string
 
 	// policyBindingListerSynced returns true if the PolicyBinding shared informer
 	// has synced at least once.
@@ -251,34 +248,6 @@ func NewController(
 	eventBroadcaster.StartRecordingToSink(&typedcorev1.EventSinkImpl{Interface: kubeClientSet.CoreV1().Events("")})
 	recorder := eventBroadcaster.NewRecorder(scheme.Scheme, corev1.EventSource{Component: controllerAgentName})
 
-	// get operator deployment name
-	ns := miniov2.GetNSFromFile()
-	ctx := context.Background()
-	oprImg := DefaultOperatorImage
-	oprDep, err := kubeClientSet.AppsV1().Deployments(ns).Get(ctx, getOperatorDeploymentName(), metav1.GetOptions{})
-	if err == nil && oprDep != nil {
-		// assume we are the first container, just in case they changed the default name
-		if len(oprDep.Spec.Template.Spec.Containers) > 0 {
-			oprImg = oprDep.Spec.Template.Spec.Containers[0].Image
-		}
-		// attempt to iterate in case there's multiple containers
-		for _, c := range oprDep.Spec.Template.Spec.Containers {
-			if c.Name == "minio-operator" || c.Name == "operator" {
-				oprImg = c.Image
-			}
-		}
-	}
-
-	oprImg = env.Get(DefaultOperatorImageEnv, oprImg)
-
-	//controllerConfig := controllerConfig{
-	//	serviceLister:     serviceInformer.Lister(),
-	//	kubeClientSet:     kubeClientSet,
-	//	statefulSetLister: statefulSetInformer.Lister(),
-	//	deploymentLister:  deploymentInformer.Lister(),
-	//	recorder:          recorder,
-	//}
-
 	controller := &Controller{
 		podName:                   podName,
 		namespacesToWatch:         namespacesToWatch,
@@ -300,7 +269,6 @@ func NewController(
 		hostsTemplate:             hostsTemplate,
 		operatorVersion:           operatorVersion,
 		policyBindingListerSynced: policyBindingInformer.Informer().HasSynced,
-		operatorImage:             oprImg,
 		controllers: []*JobController{
 			NewJobController(
 				minioJobinformer,
@@ -1007,7 +975,6 @@ func (c *Controller) syncHandler(key string) (Result, error) {
 				HostsTemplate:   c.hostsTemplate,
 				OperatorVersion: c.operatorVersion,
 				OperatorCATLS:   operatorCATLSExists,
-				OperatorImage:   c.operatorImage,
 			})
 			ss, err = c.kubeClientSet.AppsV1().StatefulSets(tenant.Namespace).Create(ctx, ss, cOpts)
 			if err != nil {
@@ -1217,7 +1184,6 @@ func (c *Controller) syncHandler(key string) (Result, error) {
 				HostsTemplate:   c.hostsTemplate,
 				OperatorVersion: c.operatorVersion,
 				OperatorCATLS:   operatorCATLSExists,
-				OperatorImage:   c.operatorImage,
 			})
 			if _, err = c.kubeClientSet.AppsV1().StatefulSets(tenant.Namespace).Update(ctx, ss, uOpts); err != nil {
 				return WrapResult(Result{}, err)
@@ -1267,7 +1233,6 @@ func (c *Controller) syncHandler(key string) (Result, error) {
 			HostsTemplate:   c.hostsTemplate,
 			OperatorVersion: c.operatorVersion,
 			OperatorCATLS:   operatorCATLSExists,
-			OperatorImage:   c.operatorImage,
 		})
 		// Verify if this pool matches the spec on the tenant (resources, affinity, sidecars, etc)
 		poolMatchesSS, err := poolSSMatchesSpec(expectedStatefulSet, existingStatefulSet)