Deploy the operator¶
This page explains what make install / make deploy actually do, how to run
the controller locally, and how to verify RBAC.
What gets installed¶
| Artifact | Source | Notes |
|---|---|---|
5 CRDs (infra, infraclusterattachment, dhcpserver, dnsserver, proxyserver — group hostedcluster.densityops.com/v1alpha1) |
config/crd/bases |
Generated by controller-gen |
Namespace oooi-system |
config/manager |
Rendered by the manager kustomization; apply any required pod-security labels separately |
Deployment oooi-controller-manager |
config/manager |
Single replica, leader election enabled |
ServiceAccount, ClusterRole oooi-manager-role, bindings |
config/rbac |
Generated from markers in internal/controller |
Step by step¶
# Render what will be applied, without applying (dry-run review)
kustomize build config/crd > /tmp/crds.yaml
kustomize build config/default > /tmp/operator.yaml
export OOOI_IMAGE=registry.example.com/oooi@sha256:<digest>
kubectl apply -f /tmp/crds.yaml
cd config/manager && kustomize edit set image controller="$OOOI_IMAGE" && cd ../..
kustomize build config/default | kubectl apply -f -
Running the controller outside the cluster¶
For development or air-gapped debugging you can run the manager on an admin workstation against the current context:
make install # CRDs must exist in the target cluster
make run # go run ./main.go manager
# Debug logging:
go run ./main.go manager --zap-log-level=debug
The local process uses your current kubeconfig; ensure it has permissions equal to the operator ClusterRole.
Verify RBAC¶
Confirm that the controller ServiceAccount can manage child resources in the
namespace where you plan to create Infra:
kubectl auth can-i --as=system:serviceaccount:oooi-system:oooi-controller-manager \
create deployments.apps -n clusters
kubectl auth can-i --as=system:serviceaccount:oooi-system:oooi-controller-manager \
create infras.hostedcluster.densityops.com -n clusters
Apps ingress uses the hosted cluster's admin kubeconfig secret referenced
by .status.kubeconfig.name of the HostedCluster. Management-cluster RBAC does
not grant the controller direct access to hosted-cluster APIs.
For source-scoped kubernetes.* aliases, the controller also reads HyperShift
NodePool objects and CAPI Machine objects (get, list, and watch).
Machine addresses are used only when they fall inside the shared Infra CIDR.
Health and metrics¶
- Leader election:
oooi-leader-election-roleinoooi-system. - Metrics endpoint:
:8443/metrics, protected by theoooi-metrics-auth-role/oooi-metrics-readerpair. - Logs: structured zap logging; per-reconcile fields include controller kind, namespace/name, and reconcile ID.