feat(infrastructure): operator self-registers the CatalogEntry (#337)

The operator bootstrapped the workspace (APIExport + Templates) but never
created the CatalogEntry, so the provider never appeared in the catalog/portal.
Now, after deploying serve, the operator applies the provider's CatalogEntry
(embedded manifest.yaml) into the provider workspace with ui/backend URLs
rewritten to the in-cluster serve Service it owns, and stamps spec.version from
KEDGE_PROVIDER_VERSION (chart .Chart.AppVersion).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mjudeikis

providers/infrastructure/apis/v1alpha1/types_infrastructureprovider.go

@@ -193,4 +193,5 @@ const (
 	ConditionBootstrapped     = "Bootstrapped"
 	ConditionKroReleased      = "KroReleased"
 	ConditionProviderDeployed = "ProviderDeployed"
+	ConditionRegistered       = "Registered"
 )

providers/infrastructure/deploy/chart/templates/operator.yaml

@@ -92,6 +92,13 @@ spec:
           image: "{{ .Values.operator.image.repository | default .Values.image.repository }}:{{ .Values.operator.image.tag | default .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args: ["controller"]
+          env:
+            # Stamps spec.version on the CatalogEntry the operator applies, so
+            # the portal shows the release version (the embedded manifest.yaml
+            # only carries a 0.1.0 placeholder). Mirrors the chart-templated
+            # catalogentry.yaml's {{ "{{ .Chart.AppVersion }}" }}.
+            - name: KEDGE_PROVIDER_VERSION
+              value: {{ .Chart.AppVersion | quote }}
           resources:
             {{- toYaml .Values.operator.resources | nindent 12 }}
 {{- end }}

providers/infrastructure/go.mod

@@ -14,6 +14,7 @@ require (
 	k8s.io/klog/v2 v2.140.0
 	sigs.k8s.io/controller-runtime v0.24.1
 	sigs.k8s.io/multicluster-runtime v0.24.1
+	sigs.k8s.io/yaml v1.6.0
 )
 
 require (
@@ -80,7 +81,6 @@ require (
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect
-	sigs.k8s.io/yaml v1.6.0 // indirect
 )
 
 replace github.com/kcp-dev/multicluster-provider/client => github.com/kcp-dev/multicluster-provider/client v0.8.0

providers/infrastructure/operator.go

@@ -32,6 +32,7 @@ package main
 
 import (
 	"context"
+	_ "embed"
 	"fmt"
 	"log"
 	"os"
@@ -46,6 +47,13 @@ import (
 	"github.com/faroshq/provider-infrastructure/operator"
 )
 
+// catalogEntryManifest is the provider's CatalogEntry, embedded so the operator
+// can self-register it into the provider workspace (ui/backend URLs rewritten to
+// the serve Service it owns).
+//
+//go:embed manifest.yaml
+var catalogEntryManifest []byte
+
 // operatorReconcileInterval is how often the bootstrap reconcile re-runs.
 // Every step is idempotent, so this is purely a self-healing cadence —
 // e.g. it re-seeds kro if the Secret is deleted, or finishes APIExport
@@ -152,7 +160,7 @@ func runController() error {
 	if err != nil {
 		return fmt.Errorf("operator manager kubeconfig: %w", err)
 	}
-	return operator.Run(ctx, cfg)
+	return operator.Run(ctx, cfg, catalogEntryManifest)
 }
 
 // loadOperatorManagerConfig resolves the cluster the operator watches CRs in:

providers/infrastructure/operator/catalogentry.go

@@ -0,0 +1,90 @@
+/*
+Copyright 2026 The Faros Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+*/
+
+package operator
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/rest"
+	"sigs.k8s.io/yaml"
+
+	sdkinstall "github.com/faroshq/provider-sdk/install"
+)
+
+// EnsureCatalogEntry registers the provider with the hub by applying its
+// CatalogEntry (the embedded manifest) into the provider workspace, rewriting
+// the ui/backend URLs to the serve Service the operator owns. This is what makes
+// the provider appear in the catalog/portal — without it the workspace is
+// bootstrapped but the provider is never listed.
+func EnsureCatalogEntry(ctx context.Context, providerCfg *rest.Config, manifest []byte, serveURL string) error {
+	if len(manifest) == 0 {
+		return fmt.Errorf("no embedded CatalogEntry manifest")
+	}
+
+	var obj map[string]any
+	if err := yaml.Unmarshal(manifest, &obj); err != nil {
+		return fmt.Errorf("parse CatalogEntry manifest: %w", err)
+	}
+	if spec, ok := obj["spec"].(map[string]any); ok {
+		// Point ui + backend at the in-cluster serve Service the operator manages.
+		if serveURL != "" {
+			if ui, ok := spec["ui"].(map[string]any); ok {
+				ui["url"] = serveURL
+			}
+			if be, ok := spec["backend"].(map[string]any); ok {
+				be["url"] = serveURL
+			}
+		}
+		// Stamp the release version. The embedded manifest.yaml carries a
+		// placeholder (spec.version: 0.1.0); the chart injects the real
+		// .Chart.AppVersion (stamped by `helm package --app-version` at
+		// release) via KEDGE_PROVIDER_VERSION so the portal shows the same
+		// version as the chart-templated providers.
+		if v := os.Getenv("KEDGE_PROVIDER_VERSION"); v != "" {
+			spec["version"] = v
+		}
+	}
+	out, err := yaml.Marshal(obj)
+	if err != nil {
+		return fmt.Errorf("encode CatalogEntry: %w", err)
+	}
+
+	// sdkinstall.ApplyCatalogEntry reads a file; round-trip through a temp file.
+	f, err := os.CreateTemp("", "kedge-catalogentry-*.yaml")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(f.Name())
+	if _, err := f.Write(out); err != nil {
+		f.Close()
+		return err
+	}
+	if err := f.Close(); err != nil {
+		return err
+	}
+
+	dyn, err := dynamic.NewForConfig(providerCfg)
+	if err != nil {
+		return err
+	}
+	return sdkinstall.ApplyCatalogEntry(ctx, dyn, f.Name())
+}
+
+// ServeServiceURL is the in-cluster URL of the serve Service the operator owns.
+func ServeServiceURL(name string, port int32) string {
+	if port == 0 {
+		port = 8081
+	}
+	return fmt.Sprintf("http://%s.%s.svc.cluster.local:%d", name, ServeNamespace, port)
+}

providers/infrastructure/operator/controller.go

@@ -48,6 +48,10 @@ type Reconciler struct {
 	// built with). Used as the runtime cluster when a CR omits
 	// spec.runtimeKubeconfigSecret — i.e. "use the current context".
 	RestConfig *rest.Config
+	// CatalogEntryManifest is the embedded provider CatalogEntry (manifest.yaml).
+	// The operator applies it to the provider workspace (ui/backend URLs pointed
+	// at the serve Service) so the provider self-registers in the catalog.
+	CatalogEntryManifest []byte
 }
 
 // Reconcile drives one CR to its desired state.
@@ -159,11 +163,21 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Resu
 	// where serve runs as a host binary for fast iteration.
 	if os.Getenv("INFRASTRUCTURE_OPERATOR_SKIP_SERVE") == "true" {
 		setCond(&cr, v1alpha1.ConditionProviderDeployed, metav1.ConditionTrue, "Skipped", "serve managed out-of-band (INFRASTRUCTURE_OPERATOR_SKIP_SERVE)")
+		setCond(&cr, v1alpha1.ConditionRegistered, metav1.ConditionTrue, "Skipped", "CatalogEntry managed out-of-band (skip-serve)")
 	} else {
 		if err := EnsureProviderServe(ctx, cs, &cr, providerKC, runtimeKC, hubToken); err != nil {
 			return r.fail(ctx, &cr, v1alpha1.ConditionProviderDeployed, "ServeDeployFailed", err)
 		}
 		setCond(&cr, v1alpha1.ConditionProviderDeployed, metav1.ConditionTrue, "Deployed", "provider serve Deployment reconciled")
+
+		// 4. Register the provider with the hub by applying its CatalogEntry,
+		// ui/backend pointed at the serve Service the operator owns. This is what
+		// lists the provider in the catalog/portal.
+		serveURL := ServeServiceURL(cr.Name, cr.Spec.Provider.Port)
+		if err := EnsureCatalogEntry(ctx, providerCfg, r.CatalogEntryManifest, serveURL); err != nil {
+			return r.fail(ctx, &cr, v1alpha1.ConditionRegistered, "CatalogEntryFailed", err)
+		}
+		setCond(&cr, v1alpha1.ConditionRegistered, metav1.ConditionTrue, "Registered", "CatalogEntry applied ("+serveURL+")")
 	}
 
 	cr.Status.Phase = "Ready"
@@ -212,7 +226,9 @@ func (r *Reconciler) SetupWithManager(mgr ctrl.Manager) error {
 
 // Run builds a manager on the supplied config (the cluster the CRs live in) and
 // runs the InfrastructureProvider reconciler until ctx is cancelled.
-func Run(ctx context.Context, cfg *rest.Config) error {
+// catalogEntryManifest is the embedded provider CatalogEntry the operator
+// applies to self-register; may be nil to skip registration.
+func Run(ctx context.Context, cfg *rest.Config, catalogEntryManifest []byte) error {
 	ctrl.SetLogger(klog.NewKlogr())
 
 	scheme := runtime.NewScheme()
@@ -230,7 +246,7 @@ func Run(ctx context.Context, cfg *rest.Config) error {
 	if err != nil {
 		return fmt.Errorf("manager.New: %w", err)
 	}
-	if err := (&Reconciler{Client: mgr.GetClient(), RestConfig: cfg}).SetupWithManager(mgr); err != nil {
+	if err := (&Reconciler{Client: mgr.GetClient(), RestConfig: cfg, CatalogEntryManifest: catalogEntryManifest}).SetupWithManager(mgr); err != nil {
 		return fmt.Errorf("setup reconciler: %w", err)
 	}
 	klog.FromContext(ctx).Info("infrastructure operator manager starting")