✨ Add feature gate for registry+v1 bundle deploymentConfig

cmd/operator-controller/main.go

@@ -479,6 +479,7 @@ func run() error {
 		CertificateProvider:         certProvider,
 		IsWebhookSupportEnabled:     certProvider != nil,
 		IsSingleOwnNamespaceEnabled: features.OperatorControllerFeatureGate.Enabled(features.SingleOwnNamespaceInstallSupport),
+		IsDeploymentConfigEnabled:   features.OperatorControllerFeatureGate.Enabled(features.DeploymentConfig),
 	}
 	var cerCfg reconcilerConfigurator
 	if features.OperatorControllerFeatureGate.Enabled(features.BoxcutterRuntime) {

helm/experimental.yaml

@@ -12,6 +12,7 @@ options:
         - PreflightPermissions
         - HelmChartSupport
         - BoxcutterRuntime
+        - DeploymentConfig
       disabled:
         - WebhookProviderOpenshiftServiceCA
 # List of enabled experimental features for catalogd

internal/operator-controller/applier/provider.go

@@ -33,6 +33,7 @@ type RegistryV1ManifestProvider struct {
 	CertificateProvider         render.CertificateProvider
 	IsWebhookSupportEnabled     bool
 	IsSingleOwnNamespaceEnabled bool
+	IsDeploymentConfigEnabled   bool
 }
 
 func (r *RegistryV1ManifestProvider) Get(bundleFS fs.FS, ext *ocv1.ClusterExtension) ([]client.Object, error) {
@@ -70,7 +71,11 @@ func (r *RegistryV1ManifestProvider) Get(bundleFS fs.FS, ext *ocv1.ClusterExtens
 		render.WithCertificateProvider(r.CertificateProvider),
 	}
 
-	if r.IsSingleOwnNamespaceEnabled {
+	// Always validate inline config when present so that disabled features produce
+	// a clear error rather than being silently ignored. When IsSingleOwnNamespaceEnabled
+	// is true we also call this with no config to validate required fields (e.g.
+	// watchNamespace for OwnNamespace-only bundles).
+	if r.IsSingleOwnNamespaceEnabled || ext.Spec.Config != nil {
 		configOpts, err := r.extractBundleConfigOptions(&rv1, ext)
 		if err != nil {
 			return nil, err
@@ -88,6 +93,14 @@ func (r *RegistryV1ManifestProvider) extractBundleConfigOptions(rv1 *bundle.Regi
 		return nil, fmt.Errorf("error getting configuration schema: %w", err)
 	}
 
+	// When the DeploymentConfig feature gate is disabled, remove deploymentConfig from the
+	// schema so that users get a clear "unknown field" error if they attempt to use it.
+	if !r.IsDeploymentConfigEnabled {
+		if props, ok := schema["properties"].(map[string]any); ok {
+			delete(props, "deploymentConfig")
+		}
+	}
+
 	bundleConfigBytes := extensionConfigBytes(ext)
 	bundleConfig, err := config.UnmarshalConfig(bundleConfigBytes, schema, ext.Spec.Namespace)
 	if err != nil {
@@ -99,13 +112,15 @@ func (r *RegistryV1ManifestProvider) extractBundleConfigOptions(rv1 *bundle.Regi
 		opts = append(opts, render.WithTargetNamespaces(*watchNS))
 	}
 
-	// Extract and convert deploymentConfig if present
-	if deploymentConfigMap := bundleConfig.GetDeploymentConfig(); deploymentConfigMap != nil {
-		deploymentConfig, err := convertToDeploymentConfig(deploymentConfigMap)
-		if err != nil {
-			return nil, errorutil.NewTerminalError(ocv1.ReasonInvalidConfiguration, fmt.Errorf("invalid deploymentConfig: %w", err))
+	// Extract and convert deploymentConfig if present and the feature gate is enabled.
+	if r.IsDeploymentConfigEnabled {
+		if deploymentConfigMap := bundleConfig.GetDeploymentConfig(); deploymentConfigMap != nil {
+			deploymentConfig, err := convertToDeploymentConfig(deploymentConfigMap)
+			if err != nil {
+				return nil, errorutil.NewTerminalError(ocv1.ReasonInvalidConfiguration, fmt.Errorf("invalid deploymentConfig: %w", err))
+			}
+			opts = append(opts, render.WithDeploymentConfig(deploymentConfig))
 		}
-		opts = append(opts, render.WithDeploymentConfig(deploymentConfig))
 	}
 
 	return opts, nil

internal/operator-controller/applier/provider_test.go

@@ -461,6 +461,7 @@ func Test_RegistryV1ManifestProvider_DeploymentConfig(t *testing.T) {
 				},
 			},
 			IsSingleOwnNamespaceEnabled: true,
+			IsDeploymentConfigEnabled:   true,
 		}
 
 		bundleFS := bundlefs.Builder().WithPackageName("test").
@@ -492,6 +493,7 @@ func Test_RegistryV1ManifestProvider_DeploymentConfig(t *testing.T) {
 				},
 			},
 			IsSingleOwnNamespaceEnabled: true,
+			IsDeploymentConfigEnabled:   true,
 		}
 
 		bundleFS := bundlefs.Builder().WithPackageName("test").
@@ -524,6 +526,7 @@ func Test_RegistryV1ManifestProvider_DeploymentConfig(t *testing.T) {
 				},
 			},
 			IsSingleOwnNamespaceEnabled: true,
+			IsDeploymentConfigEnabled:   true,
 		}
 
 		bundleFS := bundlefs.Builder().WithPackageName("test").
@@ -566,6 +569,7 @@ func Test_RegistryV1ManifestProvider_DeploymentConfig(t *testing.T) {
 				},
 			},
 			IsSingleOwnNamespaceEnabled: true,
+			IsDeploymentConfigEnabled:   true,
 		}
 
 		bundleFS := bundlefs.Builder().WithPackageName("test").
@@ -602,6 +606,7 @@ func Test_RegistryV1ManifestProvider_DeploymentConfig(t *testing.T) {
 				},
 			},
 			IsSingleOwnNamespaceEnabled: true,
+			IsDeploymentConfigEnabled:   true,
 		}
 
 		bundleFS := bundlefs.Builder().WithPackageName("test").
@@ -631,6 +636,7 @@ func Test_RegistryV1ManifestProvider_DeploymentConfig(t *testing.T) {
 				},
 			},
 			IsSingleOwnNamespaceEnabled: true,
+			IsDeploymentConfigEnabled:   true,
 		}
 
 		bundleFS := bundlefs.Builder().WithPackageName("test").
@@ -654,6 +660,70 @@ func Test_RegistryV1ManifestProvider_DeploymentConfig(t *testing.T) {
 		require.Contains(t, err.Error(), "deploymentConfig.env")
 		require.ErrorIs(t, err, reconcile.TerminalError(nil), "config validation errors should be terminal")
 	})
+
+	t.Run("returns terminal error when deploymentConfig is used but feature gate is disabled", func(t *testing.T) {
+		provider := applier.RegistryV1ManifestProvider{
+			BundleRenderer: render.BundleRenderer{
+				ResourceGenerators: []render.ResourceGenerator{
+					func(rv1 *bundle.RegistryV1, opts render.Options) ([]client.Object, error) {
+						return nil, nil
+					},
+				},
+			},
+			IsSingleOwnNamespaceEnabled: true,
+			IsDeploymentConfigEnabled:   false,
+		}
+
+		bundleFS := bundlefs.Builder().WithPackageName("test").
+			WithCSV(clusterserviceversion.Builder().WithInstallModeSupportFor(v1alpha1.InstallModeTypeAllNamespaces).Build()).Build()
+
+		_, err := provider.Get(bundleFS, &ocv1.ClusterExtension{
+			Spec: ocv1.ClusterExtensionSpec{
+				Namespace: "install-namespace",
+				Config: &ocv1.ClusterExtensionConfig{
+					ConfigType: ocv1.ClusterExtensionConfigTypeInline,
+					Inline: &apiextensionsv1.JSON{
+						Raw: []byte(`{"deploymentConfig": {"env": [{"name": "TEST_ENV", "value": "test-value"}]}}`),
+					},
+				},
+			},
+		})
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "unknown field \"deploymentConfig\"")
+		require.ErrorIs(t, err, reconcile.TerminalError(nil), "feature gate disabled error should be terminal")
+	})
+
+	t.Run("returns terminal error when deploymentConfig is used with SingleOwnNamespace disabled and DeploymentConfig gate disabled", func(t *testing.T) {
+		provider := applier.RegistryV1ManifestProvider{
+			BundleRenderer: render.BundleRenderer{
+				ResourceGenerators: []render.ResourceGenerator{
+					func(rv1 *bundle.RegistryV1, opts render.Options) ([]client.Object, error) {
+						return nil, nil
+					},
+				},
+			},
+			IsSingleOwnNamespaceEnabled: false,
+			IsDeploymentConfigEnabled:   false,
+		}
+
+		bundleFS := bundlefs.Builder().WithPackageName("test").
+			WithCSV(clusterserviceversion.Builder().WithInstallModeSupportFor(v1alpha1.InstallModeTypeAllNamespaces).Build()).Build()
+
+		_, err := provider.Get(bundleFS, &ocv1.ClusterExtension{
+			Spec: ocv1.ClusterExtensionSpec{
+				Namespace: "install-namespace",
+				Config: &ocv1.ClusterExtensionConfig{
+					ConfigType: ocv1.ClusterExtensionConfigTypeInline,
+					Inline: &apiextensionsv1.JSON{
+						Raw: []byte(`{"deploymentConfig": {"env": [{"name": "TEST_ENV", "value": "test-value"}]}}`),
+					},
+				},
+			},
+		})
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "unknown field \"deploymentConfig\"")
+		require.ErrorIs(t, err, reconcile.TerminalError(nil), "config should not be silently ignored when both feature gates are disabled")
+	})
 }
 
 func Test_RegistryV1HelmChartProvider_Integration(t *testing.T) {

internal/operator-controller/features/features.go

@@ -18,6 +18,7 @@ const (
 	WebhookProviderOpenshiftServiceCA featuregate.Feature = "WebhookProviderOpenshiftServiceCA"
 	HelmChartSupport                  featuregate.Feature = "HelmChartSupport"
 	BoxcutterRuntime                  featuregate.Feature = "BoxcutterRuntime"
+	DeploymentConfig                  featuregate.Feature = "DeploymentConfig"
 )
 
 var operatorControllerFeatureGates = map[featuregate.Feature]featuregate.FeatureSpec{
@@ -80,6 +81,14 @@ var operatorControllerFeatureGates = map[featuregate.Feature]featuregate.Feature
 		PreRelease:    featuregate.Alpha,
 		LockToDefault: false,
 	},
+
+	// DeploymentConfig enables support for customizing operator deployments
+	// via spec.config.inline.deploymentConfig in ClusterExtension resources.
+	DeploymentConfig: {
+		Default:       false,
+		PreRelease:    featuregate.Alpha,
+		LockToDefault: false,
+	},
 }
 
 var OperatorControllerFeatureGate featuregate.MutableFeatureGate = featuregate.NewFeatureGate()

manifests/experimental-e2e.yaml

@@ -2454,6 +2454,7 @@ spec:
             - --feature-gates=PreflightPermissions=true
             - --feature-gates=HelmChartSupport=true
             - --feature-gates=BoxcutterRuntime=true
+            - --feature-gates=DeploymentConfig=true
             - --feature-gates=WebhookProviderOpenshiftServiceCA=false
             - --tls-cert=/var/certs/tls.crt
             - --tls-key=/var/certs/tls.key

manifests/experimental.yaml

@@ -2360,6 +2360,7 @@ spec:
             - --feature-gates=PreflightPermissions=true
             - --feature-gates=HelmChartSupport=true
             - --feature-gates=BoxcutterRuntime=true
+            - --feature-gates=DeploymentConfig=true
             - --feature-gates=WebhookProviderOpenshiftServiceCA=false
             - --tls-cert=/var/certs/tls.crt
             - --tls-key=/var/certs/tls.key

test/e2e/features/install.feature

@@ -500,3 +500,38 @@ Feature: Install ClusterExtension
     And ClusterExtension is available
     And ClusterExtensionRevision "${NAME}-1" has label "olm.operatorframework.io/owner-kind" with value "ClusterExtension"
     And ClusterExtensionRevision "${NAME}-1" has label "olm.operatorframework.io/owner-name" with value "${NAME}"
+
+  @DeploymentConfig
+  Scenario: deploymentConfig nodeSelector is applied to the operator deployment
+    When ClusterExtension is applied
+      """
+      apiVersion: olm.operatorframework.io/v1
+      kind: ClusterExtension
+      metadata:
+        name: ${NAME}
+      spec:
+        namespace: ${TEST_NAMESPACE}
+        serviceAccount:
+          name: olm-sa
+        config:
+          configType: Inline
+          inline:
+            deploymentConfig:
+              nodeSelector:
+                kubernetes.io/os: linux
+        source:
+          sourceType: Catalog
+          catalog:
+            packageName: test
+            selector:
+              matchLabels:
+                "olm.operatorframework.io/metadata.name": test-catalog
+      """
+    Then resource "deployment/test-operator" matches
+      """
+      spec:
+        template:
+          spec:
+            nodeSelector:
+              kubernetes.io/os: linux
+      """

test/e2e/steps/hooks.go

@@ -71,6 +71,7 @@ var (
 		features.WebhookProviderOpenshiftServiceCA: false,
 		features.HelmChartSupport:                  false,
 		features.BoxcutterRuntime:                  false,
+		features.DeploymentConfig:                  false,
 	}
 	logger logr.Logger
 )