openstack-k8s-operators · stuggi · Jul 16, 2026 · Jul 15, 2026
diff --git a/Makefile b/Makefile
@@ -60,7 +60,7 @@ OPERATOR_SDK_VERSION ?= v1.42.3
 DEFAULT_IMG ?= quay.io/openstack-k8s-operators/openstack-operator:latest
 IMG ?= $(DEFAULT_IMG)
 # ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
-ENVTEST_K8S_VERSION = 1.31
+ENVTEST_K8S_VERSION = 1.33
 
 SETUP_ENVTEST_VERSION ?= release-0.22
 
@@ -332,7 +332,7 @@ CONTROLLER_TOOLS_VERSION ?= v0.18.0
 CRD_MARKDOWN_VERSION ?= v0.0.3
 KUTTL_VERSION ?= 0.17.0
 GOTOOLCHAIN_VERSION ?= go1.26.0
-OC_VERSION ?= 4.16.0
+OC_VERSION ?= 4.20.0
 
 KUSTOMIZE_INSTALL_SCRIPT ?= "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"
 .PHONY: kustomize
@@ -568,7 +568,7 @@ run-with-webhook: manifests generate fmt vet ## Run a controller from your host.
 webhook-cleanup:
 	/bin/bash hack/clean_local_webhook.sh
 
-CRD_SCHEMA_CHECKER_VERSION ?= release-4.16
+CRD_SCHEMA_CHECKER_VERSION ?= release-4.18
 
 PHONY: crd-schema-check
 crd-schema-check: manifests

diff --git a/api/bases/dataplane.openstack.org_openstackdataplanedeployments.yaml b/api/bases/dataplane.openstack.org_openstackdataplanedeployments.yaml
@@ -120,9 +120,6 @@ spec:
             - deploymentRequeueTime
             - nodeSets
             type: object
-            x-kubernetes-validations:
-            - message: OpenStackDataPlaneDeployment Spec is immutable
-              rule: self == oldSelf
           status:
             description: OpenStackDataPlaneDeploymentStatus defines the observed state
               of OpenStackDataPlaneDeployment

diff --git a/api/client/v1beta1/openstackclient_webhook.go b/api/client/v1beta1/openstackclient_webhook.go
@@ -21,9 +21,7 @@ package v1beta1
 
 import (
 	"k8s.io/apimachinery/pkg/runtime"
-	ctrl "sigs.k8s.io/controller-runtime"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 )
 
@@ -43,18 +41,7 @@ func SetupOpenStackClientDefaults(defaults OpenStackClientDefaults) {
 	openstackclientlog.Info("OpenStackClient defaults initialized", "defaults", defaults)
 }
 
-// SetupWebhookWithManager sets up the webhook with the Manager
-func (r *OpenStackClient) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr).
-		For(r).
-		Complete()
-}
-
-// +kubebuilder:webhook:path=/mutate-client-openstack-org-v1beta1-openstackclient,mutating=true,failurePolicy=fail,sideEffects=None,groups=client.openstack.org,resources=openstackclients,verbs=create;update,versions=v1beta1,name=mopenstackclient.kb.io,admissionReviewVersions=v1
-
-var _ webhook.Defaulter = &OpenStackClient{}
-
-// Default implements webhook.Defaulter so a webhook will be registered for the type
+// Default sets default values for the OpenStackClient
 func (r *OpenStackClient) Default() {
 	openstackclientlog.Info("default", "name", r.Name)
 
@@ -68,12 +55,7 @@ func (spec *OpenStackClientSpec) Default() {
 	}
 }
 
-// TODO(user): change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-// +kubebuilder:webhook:path=/validate-client-openstack-org-v1beta1-openstackclient,mutating=false,failurePolicy=fail,sideEffects=None,groups=client.openstack.org,resources=openstackclients,verbs=create;update,versions=v1beta1,name=vopenstackclient.kb.io,admissionReviewVersions=v1
-
-var _ webhook.Validator = &OpenStackClient{}
-
-// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
+// ValidateCreate validates the OpenStackClient on creation
 func (r *OpenStackClient) ValidateCreate() (admission.Warnings, error) {
 	openstackclientlog.Info("validate create", "name", r.Name)
 

diff --git a/api/client/v1beta1/webhook_suite_test.go b/api/client/v1beta1/webhook_suite_test.go
@@ -111,7 +111,9 @@ var _ = BeforeSuite(func() {
 	})
 	Expect(err).NotTo(HaveOccurred())
 
-	err = (&OpenStackClient{}).SetupWebhookWithManager(mgr)
+	err = ctrl.NewWebhookManagedBy(mgr).
+		For(&OpenStackClient{}).
+		Complete()
 	Expect(err).NotTo(HaveOccurred())
 
 	// +kubebuilder:scaffold:webhook

diff --git a/api/dataplane/v1beta1/openstackdataplanedeployment_types.go b/api/dataplane/v1beta1/openstackdataplanedeployment_types.go
@@ -152,7 +152,6 @@ type OpenStackDataPlaneDeployment struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
 
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="OpenStackDataPlaneDeployment Spec is immutable"
 	Spec   OpenStackDataPlaneDeploymentSpec   `json:"spec,omitempty"`
 	Status OpenStackDataPlaneDeploymentStatus `json:"status,omitempty"`
 }

diff --git a/api/dataplane/v1beta1/openstackdataplanedeployment_webhook.go b/api/dataplane/v1beta1/openstackdataplanedeployment_webhook.go
@@ -17,30 +17,20 @@ limitations under the License.
 package v1beta1
 
 import (
+	"fmt"
+	"reflect"
+
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/util/validation/field"
-	ctrl "sigs.k8s.io/controller-runtime"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 )
 
 var openstackdataplanedeploymentlog = logf.Log.WithName("openstackdataplanedeployment-resource")
 
-// SetupWebhookWithManager sets up the webhook with the Manager
-func (r *OpenStackDataPlaneDeployment) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr).For(r).Complete()
-}
-
-// TODO(user): EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
-
-// +kubebuilder:webhook:path=/mutate-dataplane-openstack-org-v1beta1-openstackdataplanedeployment,mutating=true,failurePolicy=fail,sideEffects=None,groups=dataplane.openstack.org,resources=openstackdataplanedeployments,verbs=create;update,versions=v1beta1,name=mopenstackdataplanedeployment.kb.io,admissionReviewVersions=v1
-
-var _ webhook.Defaulter = &OpenStackDataPlaneDeployment{}
-
-// Default implements webhook.Defaulter so a webhook will be registered for the type
+// Default sets default values for the OpenStackDataPlaneDeployment
 func (r *OpenStackDataPlaneDeployment) Default() {
 
 	openstackdataplanedeploymentlog.Info("default", "name", r.Name)
@@ -49,15 +39,12 @@ func (r *OpenStackDataPlaneDeployment) Default() {
 
 // Default - set defaults for this OpenStackDataPlaneDeployment
 func (spec *OpenStackDataPlaneDeploymentSpec) Default() {
-
+	if spec.ServicesOverride == nil {
+		spec.ServicesOverride = []string{}
+	}
 }
 
-// TODO(user): change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-// +kubebuilder:webhook:path=/validate-dataplane-openstack-org-v1beta1-openstackdataplanedeployment,mutating=false,failurePolicy=fail,sideEffects=None,groups=dataplane.openstack.org,resources=openstackdataplanedeployments,verbs=create;update,versions=v1beta1,name=vopenstackdataplanedeployment.kb.io,admissionReviewVersions=v1
-
-var _ webhook.Validator = &OpenStackDataPlaneDeployment{}
-
-// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
+// ValidateCreate validates the OpenStackDataPlaneDeployment on creation
 func (r *OpenStackDataPlaneDeployment) ValidateCreate() (admission.Warnings, error) {
 
 	openstackdataplanedeploymentlog.Info("validate create", "name", r.Name)
@@ -86,7 +73,14 @@ func (spec *OpenStackDataPlaneDeploymentSpec) ValidateCreate() field.ErrorList {
 func (r *OpenStackDataPlaneDeployment) ValidateUpdate(original runtime.Object) (admission.Warnings, error) {
 	openstackdataplanedeploymentlog.Info("validate update", "name", r.Name)
 
-	errors := r.Spec.ValidateUpdate()
+	oldDeployment, ok := original.(*OpenStackDataPlaneDeployment)
+	if !ok {
+		return nil, apierrors.NewInternalError(field.InternalError(
+			field.NewPath("spec"),
+			fmt.Errorf("expected OpenStackDataPlaneDeployment, got %T", original)))
+	}
+
+	errors := r.Spec.ValidateUpdate(oldDeployment.Spec)
 
 	if len(errors) != 0 {
 		openstackdataplanedeploymentlog.Info("validation failed", "name", r.Name)
@@ -101,8 +95,20 @@ func (r *OpenStackDataPlaneDeployment) ValidateUpdate(original runtime.Object) (
 }
 
 // ValidateUpdate validates the OpenStackDataPlaneDeploymentSpec on update
-func (spec *OpenStackDataPlaneDeploymentSpec) ValidateUpdate() field.ErrorList {
-	// TODO(user): fill in your validation logic upon object update.
+func (spec *OpenStackDataPlaneDeploymentSpec) ValidateUpdate(old OpenStackDataPlaneDeploymentSpec) field.ErrorList {
+	newCopy := *spec
+	newCopy.Default()
+	old.Default()
+
+	if !reflect.DeepEqual(newCopy, old) {
+		return field.ErrorList{
+			field.Invalid(
+				field.NewPath("spec"),
+				"object",
+				"OpenStackDataPlaneDeployment Spec is immutable",
+			),
+		}
+	}
 
 	return field.ErrorList{}
 }

diff --git a/api/dataplane/v1beta1/openstackdataplaneservice_webhook.go b/api/dataplane/v1beta1/openstackdataplaneservice_webhook.go
@@ -21,26 +21,13 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/util/validation/field"
-	ctrl "sigs.k8s.io/controller-runtime"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
-	"sigs.k8s.io/controller-runtime/pkg/webhook"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 )
 
 var openstackdataplaneservicelog = logf.Log.WithName("openstackdataplaneservice-resource")
 
-// SetupWebhookWithManager sets up the webhook with the Manager
-func (r *OpenStackDataPlaneService) SetupWebhookWithManager(mgr ctrl.Manager) error {
-	return ctrl.NewWebhookManagedBy(mgr).For(r).Complete()
-}
-
-// TODO(user): EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
-
-// +kubebuilder:webhook:path=/mutate-dataplane-openstack-org-v1beta1-openstackdataplaneservice,mutating=true,failurePolicy=fail,sideEffects=None,groups=dataplane.openstack.org,resources=openstackdataplaneservices,verbs=create;update,versions=v1beta1,name=mopenstackdataplaneservice.kb.io,admissionReviewVersions=v1
-
-var _ webhook.Defaulter = &OpenStackDataPlaneService{}
-
-// Default implements webhook.Defaulter so a webhook will be registered for the type
+// Default sets default values for the OpenStackDataPlaneService
 func (r *OpenStackDataPlaneService) Default() {
 
 	openstackdataplaneservicelog.Info("default", "name", r.Name)
@@ -55,12 +42,7 @@ func (spec *OpenStackDataPlaneServiceSpec) Default(name string) {
 	}
 }
 
-// TODO(user): change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-// +kubebuilder:webhook:path=/validate-dataplane-openstack-org-v1beta1-openstackdataplaneservice,mutating=false,failurePolicy=fail,sideEffects=None,groups=dataplane.openstack.org,resources=openstackdataplaneservices,verbs=create;update,versions=v1beta1,name=vopenstackdataplaneservice.kb.io,admissionReviewVersions=v1
-
-var _ webhook.Validator = &OpenStackDataPlaneService{}
-
-// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
+// ValidateCreate validates the OpenStackDataPlaneService on creation
 func (r *OpenStackDataPlaneService) ValidateCreate() (admission.Warnings, error) {
 
 	openstackdataplaneservicelog.Info("validate create", "name", r.Name)