Merge pull request #141 from SUSE/feat/operator-ns-configmap-sync

feat: auto-sync operator coordinates to aif-ui-config ConfigMap

Author: gunamata

aif-operator/Dockerfile

@@ -1,4 +1,4 @@
-FROM --platform=$BUILDPLATFORM registry.suse.com/bci/golang:1.25 as builder
+FROM --platform=$BUILDPLATFORM registry.suse.com/bci/golang:1.25 AS builder
 ARG TARGETOS
 ARG TARGETARCH
 ARG VERSION=unknown

aif-operator/cmd/main.go

@@ -190,6 +190,13 @@ func main() {
 				// operatorNamespace secrets; aiworkload controller needs Helm
 				// release secrets (owner=helm) from any target namespace.
 				&corev1.Secret{}: {},
+				// Restrict ConfigMap watch to the extension namespace — the namespaced
+				// Role in cattle-ui-plugin-system grants watch; the ClusterRole does not.
+				&corev1.ConfigMap{}: {
+					Namespaces: map[string]cache.Config{
+						config.GetExtensionNamespace(): {},
+					},
+				},
 			},
 		},
 		// LeaderElectionReleaseOnCancel defines if the leader should step down voluntarily

aif-operator/internal/config/runtime.go

@@ -19,3 +19,12 @@ func GetOperatorNamespace() string {
 	}
 	return DefaultOperatorNamespace
 }
+
+const DefaultOperatorService = "aif-operator"
+
+func GetOperatorService() string {
+	if svc := os.Getenv("OPERATOR_SERVICE"); svc != "" {
+		return svc
+	}
+	return DefaultOperatorService
+}

aif-operator/internal/controller/installaiextension/installaiextension_controller.go

@@ -11,14 +11,17 @@ import (
 	urlpkg "net/url"
 
 	"helm.sh/helm/v3/pkg/cli"
+	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	v1alpha1 "github.com/SUSE/aif-operator/api/v1alpha1"
+	"github.com/SUSE/aif-operator/internal/config"
 	helmClient "github.com/SUSE/aif-operator/internal/infra/helm"
 	"github.com/SUSE/aif-operator/internal/infra/kubernetes"
 	"github.com/SUSE/aif-operator/internal/infra/rancher"
@@ -28,6 +31,7 @@ import (
 const (
 	defaultReadinessTimeout = 5 * time.Minute
 	readinessRequeue        = 10 * time.Second
+	uiConfigMapName         = "aif-ui-config"
 	healthCheckInterval     = 60 * time.Second
 
 	conditionTypeReady           = "Ready"
@@ -143,10 +147,42 @@ func (r *InstallAIExtensionReconciler) reconcile(ctx context.Context, ext *v1alp
 	ext.Status.ActiveExtensionName = ext.Spec.Extension.Name
 	ext.Status.ActiveSourceKind = ext.Spec.Source.Kind
 
+	if err := r.syncUIConfigMap(ctx); err != nil {
+		logger.Error(err, "failed to sync operator coordinates to UI ConfigMap")
+		return ctrl.Result{Requeue: true}, nil
+	}
+
 	logger.Info("reconciled successfully")
 	return ctrl.Result{RequeueAfter: healthCheckInterval}, nil
 }
 
+// syncUIConfigMap writes the operator namespace and service name into the
+// aif-ui-config ConfigMap so the UI extension can reach the operator without
+// manual configuration. It runs on every successful reconcile loop, giving
+// self-healing behaviour if the ConfigMap is deleted or corrupted.
+// The ConfigMap is intentionally not deleted when the CR is removed — the UI
+// retains the last-known operator coordinates so it remains functional.
+func (r *InstallAIExtensionReconciler) syncUIConfigMap(ctx context.Context) error {
+	logger := log.FromContext(ctx)
+	ns, svc := config.GetOperatorNamespace(), config.GetOperatorService()
+	logger.V(1).Info("syncing UI ConfigMap", "operatorNamespace", ns, "operatorService", svc)
+	cm := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      uiConfigMapName,
+			Namespace: r.ExtensionNamespace,
+		},
+	}
+	_, err := controllerutil.CreateOrUpdate(ctx, r.Client, cm, func() error {
+		if cm.Data == nil {
+			cm.Data = make(map[string]string)
+		}
+		cm.Data["operatorNamespace"] = ns
+		cm.Data["operatorService"] = svc
+		return nil
+	})
+	return err
+}
+
 func (r *InstallAIExtensionReconciler) reconcileHelmSource(
 	ctx context.Context,
 	ext *v1alpha1.InstallAIExtension,

charts/aif-operator/templates/extension/installaiextension.yaml

@@ -12,6 +12,10 @@ spec:
     helm:
       chartURL: {{ .Values.aiExtension.source.helm.chartURL | quote }}
       version: {{ .Values.aiExtension.source.helm.version | quote }}
+      {{- with .Values.aiExtension.source.helm.values }}
+      values:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
     {{- end }}
   extension:
     name: {{ .Values.aiExtension.extension.name | quote }}

charts/aif-operator/templates/manager/manager.yaml

@@ -61,6 +61,10 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.namespace
+            - name: OPERATOR_SERVICE
+              # Static at install time (chart-derived name); not a fieldRef because
+              # the service name is determined by the chart, not the pod's runtime state.
+              value: {{ include "aif-operator.fullname" . | quote }}
             - name: EXTENSION_NAMESPACE
               value: {{ include "aif-operator.extensionsNamespace" . | quote }}
             - name: CHART_VERSION

charts/aif-operator/values.yaml

@@ -108,6 +108,12 @@ aiExtension:
     helm:
       chartURL: "oci://ghcr.io/suse/chart/aif-ui"
       version: "0.1.0-dev.4"
+      # values are merged onto the aif-ui chart's default values. Useful for
+      # overriding the UI image during development:
+      #   aiExtension.source.helm.values.image.registry=ghcr.io
+      #   aiExtension.source.helm.values.image.repository=suse/aif-ui
+      #   aiExtension.source.helm.values.image.tag=0.1.0-dev.4
+      values: {}
   extension:
     name: "aif-ui"
     version: "0.1.0-dev.4"

pkg/aif-ui/l10n/en-us.json

@@ -115,6 +115,8 @@
             "warning": "Advanced settings for air-gapped or custom deployments only. Modify with care.",
             "operatorConnection": {
               "title": "Operator Connection",
+              "managed": "Operator namespace and service are managed by an InstallAIExtension resource. The operator updates these values automatically — editing is disabled.",
+              "forbidden": "Cannot verify whether the operator connection is managed — access to InstallAIExtension resources is restricted. If a resource exists, changes saved here may be overwritten by the operator.",
               "found": "Configuration loaded from the aif-ui-config ConfigMap in cattle-ui-plugin-system. Changes take effect immediately on save.",
               "notFound": "No aif-ui-config ConfigMap found in cattle-ui-plugin-system. Fields below show defaults. Saving will create the ConfigMap.",
               "namespace": {

pkg/aif-ui/pages/Settings.vue

@@ -9,7 +9,7 @@ import { Checkbox }     from '@components/Form/Checkbox';
 import SecretSelector   from '@shell/components/form/SecretSelector';
 import { getSettings, putSettings } from '../utils/operator-api';
 import { TIMEOUT_VALUES } from '../utils/constants';
-import { loadOperatorConfig, getOperatorConfig, getOperatorNamespace, saveOperatorConfig, isConfigMapFound } from '../utils/operator-config';
+import { loadOperatorConfig, getOperatorConfig, getOperatorNamespace, saveOperatorConfig, isConfigMapFound, hasInstallAIExtension, isExtensionCheckForbidden } from '../utils/operator-config';
 import { ensureClusterRepo } from '../services/rancher-apps';
 import { APP_COLLECTION_REPO_URL, SUSE_REGISTRY_REPO_URL, NVIDIA_REPO_URL, NVIDIA_BLUEPRINT_REPO_URL } from '../services/app-collection';
 
@@ -39,7 +39,11 @@ export default {
   },
 
   async fetch() {
-    await loadOperatorConfig();
+    [this.operatorManaged] = await Promise.all([
+      hasInstallAIExtension(),
+      loadOperatorConfig(),
+    ]);
+    this.operatorForbidden      = isExtensionCheckForbidden();
     const operatorCfg = getOperatorConfig();
     this.operatorNamespace      = operatorCfg.namespace;
     this.operatorService        = operatorCfg.service;
@@ -68,9 +72,11 @@ export default {
       fetchErrorMessage: null,
       errors:            [],
       mode:              'edit',
-      operatorNamespace:  '',
-      operatorService:    '',
+      operatorNamespace:      '',
+      operatorService:        '',
       operatorConfigMapFound: false,
+      operatorManaged:        false,
+      operatorForbidden:      false,
       expanded:          {
         fleet:         false,
         appCollection: true,
@@ -362,8 +368,11 @@ export default {
         // that the subsequent putSettings call reaches the correct operator URL.
         // If the user is correcting a wrong namespace, putSettings would fail
         // against the old URL if called before the cache is updated.
-        await saveOperatorConfig(this.operatorNamespace || 'aif-operator', this.operatorService || 'aif-operator');
-        this.operatorConfigMapFound = true;
+        // Skip when managed by InstallAIExtension — the reconciler owns the ConfigMap.
+        if (!this.operatorManaged) {
+          await saveOperatorConfig(this.operatorNamespace || 'aif-operator', this.operatorService || 'aif-operator');
+          this.operatorConfigMapFound = true;
+        }
         const data = await putSettings(this.buildCrdSpec(this.spec));
 
         this.spec = this.buildSpec(data.spec);
@@ -705,7 +714,19 @@ export default {
             {{ t('suseai.pages.settings.sections.advanced.operatorConnection.title') }}
           </h3>
           <Banner
-            v-if="operatorConfigMapFound"
+            v-if="operatorManaged"
+            color="info"
+            :label="t('suseai.pages.settings.sections.advanced.operatorConnection.managed')"
+            class="mb-15"
+          />
+          <Banner
+            v-else-if="operatorForbidden"
+            color="warning"
+            :label="t('suseai.pages.settings.sections.advanced.operatorConnection.forbidden')"
+            class="mb-15"
+          />
+          <Banner
+            v-else-if="operatorConfigMapFound"
             color="info"
             :label="t('suseai.pages.settings.sections.advanced.operatorConnection.found')"
             class="mb-15"
@@ -722,15 +743,15 @@ export default {
                 v-model:value="operatorNamespace"
                 :label="t('suseai.pages.settings.sections.advanced.operatorConnection.namespace.label')"
                 :placeholder="t('suseai.pages.settings.sections.advanced.operatorConnection.namespace.placeholder')"
-                :mode="mode"
+                :mode="operatorManaged ? 'view' : mode"
               />
             </div>
             <div class="col span-4">
               <LabeledInput
                 v-model:value="operatorService"
                 :label="t('suseai.pages.settings.sections.advanced.operatorConnection.service.label')"
                 :placeholder="t('suseai.pages.settings.sections.advanced.operatorConnection.service.placeholder')"
-                :mode="mode"
+                :mode="operatorManaged ? 'view' : mode"
               />
             </div>
           </div>

pkg/aif-ui/utils/operator-config.ts

@@ -23,6 +23,8 @@ let cache: OperatorCache | null = null;
 let loadPromise: Promise<void> | null = null;
 let connectionError: string | null = null;
 let checkPromise: Promise<void> | null = null;
+let checkExtPromise: Promise<boolean> | null = null;
+let extensionForbidden = false;
 
 function configMapUrl(): string {
   return `/k8s/clusters/${ MANAGEMENT_CLUSTER }/api/v1/namespaces/${ CONFIG_NAMESPACE }/configmaps/${ CONFIG_MAP_NAME }`;
@@ -147,11 +149,47 @@ export function isConfigMapFound(): boolean {
   return cache?.found ?? false;
 }
 
+/** Returns true when at least one InstallAIExtension CR exists in the cluster,
+ *  meaning the operator owns the ConfigMap and the Settings fields should be read-only.
+ *  Returns false on any error (404 = CRD not installed, network error).
+ *  On 403, sets the extensionForbidden flag — call isExtensionCheckForbidden() to
+ *  distinguish "not managed" from "cannot determine". Idempotent: subsequent calls
+ *  return the shared in-flight promise; pass force=true to re-run the check. */
+export function hasInstallAIExtension(force = false): Promise<boolean> {
+  if (force) { checkExtPromise = null; extensionForbidden = false; }
+  if (!checkExtPromise) checkExtPromise = _doCheckExtension();
+  return checkExtPromise;
+}
+
+async function _doCheckExtension(): Promise<boolean> {
+  try {
+    const url = `/k8s/clusters/${ MANAGEMENT_CLUSTER }/apis/ai-platform.suse.com/v1alpha1/installaiextensions`;
+    const res = await fetch(url, { headers: { Accept: 'application/json' } });
+    if (res.status === 403) {
+      extensionForbidden = true;
+      return false;
+    }
+    if (!res.ok) return false;
+    const body = await res.json().catch(() => null);
+    return Array.isArray(body?.items) && body.items.length > 0;
+  } catch {
+    return false;
+  }
+}
+
+/** Returns true when hasInstallAIExtension() returned false due to a 403 —
+ *  meaning the managed state is unknown, not confirmed absent. */
+export function isExtensionCheckForbidden(): boolean {
+  return extensionForbidden;
+}
+
 export function invalidateOperatorConfig(): void {
-  cache           = null;
-  loadPromise     = null;
-  connectionError = null;
-  checkPromise    = null;
+  cache               = null;
+  loadPromise         = null;
+  connectionError     = null;
+  checkPromise        = null;
+  checkExtPromise     = null;
+  extensionForbidden  = false;
 }
 
 /** Write operator coordinates to the ConfigMap and refresh the in-memory cache.