Merge remote-tracking branch 'origin/ai-factory' into inject-nvidia-auth

# Conflicts:
#	charts/aif-operator/values.yaml
#	pkg/aif-ui/pages/components/AppWizard.vue
#	pkg/aif-ui/pages/components/BlueprintInstallWizard.vue
#	pkg/aif-ui/services/fleet-bundle.ts
#	pkg/aif-ui/types/blueprint-types.ts

Author: thbertoldi

aif-operator/Dockerfile

@@ -1,6 +1,8 @@
-FROM --platform=$BUILDPLATFORM registry.suse.com/bci/golang:1.25 as builder
+FROM --platform=$BUILDPLATFORM registry.suse.com/bci/golang:1.25 AS builder
 ARG TARGETOS
 ARG TARGETARCH
+ARG VERSION=unknown
+ARG COMMIT=unknown
 
 WORKDIR /workspace
 COPY go.mod go.sum ./
@@ -10,7 +12,7 @@ COPY cmd/ cmd/
 COPY api/ api/
 COPY internal/ internal/
 
-RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -a -o manager cmd/main.go
+RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -a -ldflags "-X main.version=${VERSION} -X main.commit=${COMMIT}" -o manager cmd/main.go
 
 FROM gcr.io/distroless/static:nonroot
 WORKDIR /

aif-operator/Makefile

@@ -107,7 +107,7 @@ lint-config: golangci-lint ## Verify golangci-lint linter configuration
 
 .PHONY: build
 build: manifests generate fmt vet ## Build manager binary.
-	go build -o bin/manager cmd/main.go
+	go build -ldflags "-X main.version=$(shell cat VERSION 2>/dev/null || echo unknown) -X main.commit=$(shell git rev-parse --short HEAD 2>/dev/null || echo unknown)" -o bin/manager cmd/main.go
 
 .PHONY: run
 run: manifests generate fmt vet ## Run a controller from your host.

aif-operator/cmd/main.go

@@ -50,6 +50,12 @@ import (
 	// +kubebuilder:scaffold:imports
 )
 
+// version and commit are set at build time via -ldflags.
+var (
+	version = "unknown"
+	commit  = "unknown"
+)
+
 var (
 	scheme   = runtime.NewScheme()
 	setupLog = ctrl.Log.WithName("setup")
@@ -184,6 +190,13 @@ func main() {
 				// operatorNamespace secrets; aiworkload controller needs Helm
 				// release secrets (owner=helm) from any target namespace.
 				&corev1.Secret{}: {},
+				// Restrict ConfigMap watch to the extension namespace — the namespaced
+				// Role in cattle-ui-plugin-system grants watch; the ClusterRole does not.
+				&corev1.ConfigMap{}: {
+					Namespaces: map[string]cache.Config{
+						config.GetExtensionNamespace(): {},
+					},
+				},
 			},
 		},
 		// LeaderElectionReleaseOnCancel defines if the leader should step down voluntarily
@@ -245,6 +258,7 @@ func main() {
 	api.NewSettingsHandler(mgr.GetClient(), operatorNamespace).Register(mux)
 	api.NewAIWorkloadHandler(mgr.GetClient()).Register(mux)
 	api.NewBlueprintHandler(mgr.GetClient()).Register(mux)
+	api.NewVersionHandler(version, commit, os.Getenv("CHART_VERSION")).Register(mux)
 	srv := &http.Server{Addr: apiBindAddr, Handler: api.Chain(mux)}
 
 	ctx := ctrl.SetupSignalHandler()

aif-operator/internal/api/version.go

@@ -0,0 +1,46 @@
+/*
+Copyright 2025.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package api
+
+import "net/http"
+
+// VersionHandler serves GET /api/v1/version.
+type VersionHandler struct {
+	version      string
+	commit       string
+	chartVersion string
+}
+
+// NewVersionHandler constructs a VersionHandler.
+func NewVersionHandler(version, commit, chartVersion string) *VersionHandler {
+	return &VersionHandler{version: version, commit: commit, chartVersion: chartVersion}
+}
+
+// Register wires the handler's route onto the mux.
+func (h *VersionHandler) Register(mux *http.ServeMux) {
+	mux.HandleFunc("GET /api/v1/version", h.getVersion)
+}
+
+func (h *VersionHandler) getVersion(w http.ResponseWriter, _ *http.Request) {
+	writeJSON(w, http.StatusOK, map[string]string{
+		"version":      h.version,
+		"commit":       h.commit,
+		"chartVersion": h.chartVersion,
+	})
+}
+
+var _ Handler = (*VersionHandler)(nil)

aif-operator/internal/api/version_test.go

@@ -0,0 +1,51 @@
+/*
+Copyright 2025.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestGetVersion(t *testing.T) {
+	mux := http.NewServeMux()
+	NewVersionHandler("1.2.3", "abc1234", "0.1.0-dev.3").Register(mux)
+
+	req := httptest.NewRequest("GET", "/api/v1/version", nil)
+	w := httptest.NewRecorder()
+	mux.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+
+	var body map[string]string
+	if err := json.NewDecoder(w.Body).Decode(&body); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+	if body["version"] != "1.2.3" {
+		t.Errorf("expected version %q, got %q", "1.2.3", body["version"])
+	}
+	if body["commit"] != "abc1234" {
+		t.Errorf("expected commit %q, got %q", "abc1234", body["commit"])
+	}
+	if body["chartVersion"] != "0.1.0-dev.3" {
+		t.Errorf("expected chartVersion %q, got %q", "0.1.0-dev.3", body["chartVersion"])
+	}
+}

aif-operator/internal/config/runtime.go

@@ -19,3 +19,12 @@ func GetOperatorNamespace() string {
 	}
 	return DefaultOperatorNamespace
 }
+
+const DefaultOperatorService = "aif-operator"
+
+func GetOperatorService() string {
+	if svc := os.Getenv("OPERATOR_SERVICE"); svc != "" {
+		return svc
+	}
+	return DefaultOperatorService
+}

aif-operator/internal/controller/installaiextension/installaiextension_controller.go

@@ -11,14 +11,17 @@ import (
 	urlpkg "net/url"
 
 	"helm.sh/helm/v3/pkg/cli"
+	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	v1alpha1 "github.com/SUSE/aif-operator/api/v1alpha1"
+	"github.com/SUSE/aif-operator/internal/config"
 	helmClient "github.com/SUSE/aif-operator/internal/infra/helm"
 	"github.com/SUSE/aif-operator/internal/infra/kubernetes"
 	"github.com/SUSE/aif-operator/internal/infra/rancher"
@@ -28,6 +31,7 @@ import (
 const (
 	defaultReadinessTimeout = 5 * time.Minute
 	readinessRequeue        = 10 * time.Second
+	uiConfigMapName         = "aif-ui-config"
 	healthCheckInterval     = 60 * time.Second
 
 	conditionTypeReady           = "Ready"
@@ -143,10 +147,42 @@ func (r *InstallAIExtensionReconciler) reconcile(ctx context.Context, ext *v1alp
 	ext.Status.ActiveExtensionName = ext.Spec.Extension.Name
 	ext.Status.ActiveSourceKind = ext.Spec.Source.Kind
 
+	if err := r.syncUIConfigMap(ctx); err != nil {
+		logger.Error(err, "failed to sync operator coordinates to UI ConfigMap")
+		return ctrl.Result{Requeue: true}, nil
+	}
+
 	logger.Info("reconciled successfully")
 	return ctrl.Result{RequeueAfter: healthCheckInterval}, nil
 }
 
+// syncUIConfigMap writes the operator namespace and service name into the
+// aif-ui-config ConfigMap so the UI extension can reach the operator without
+// manual configuration. It runs on every successful reconcile loop, giving
+// self-healing behaviour if the ConfigMap is deleted or corrupted.
+// The ConfigMap is intentionally not deleted when the CR is removed — the UI
+// retains the last-known operator coordinates so it remains functional.
+func (r *InstallAIExtensionReconciler) syncUIConfigMap(ctx context.Context) error {
+	logger := log.FromContext(ctx)
+	ns, svc := config.GetOperatorNamespace(), config.GetOperatorService()
+	logger.V(1).Info("syncing UI ConfigMap", "operatorNamespace", ns, "operatorService", svc)
+	cm := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      uiConfigMapName,
+			Namespace: r.ExtensionNamespace,
+		},
+	}
+	_, err := controllerutil.CreateOrUpdate(ctx, r.Client, cm, func() error {
+		if cm.Data == nil {
+			cm.Data = make(map[string]string)
+		}
+		cm.Data["operatorNamespace"] = ns
+		cm.Data["operatorService"] = svc
+		return nil
+	})
+	return err
+}
+
 func (r *InstallAIExtensionReconciler) reconcileHelmSource(
 	ctx context.Context,
 	ext *v1alpha1.InstallAIExtension,