docs: unify README.md and CLAUDE.md via symlink

.tekton/OWNERS

@@ -0,0 +1,15 @@
+approvers:
+- zhujian7
+- zhiweiyin318
+- haoqing0110
+- elgnay
+- xuezhaojun
+- qiujian16
+
+reviewers:
+- zhujian7
+- zhiweiyin318
+- haoqing0110
+- elgnay
+- xuezhaojun
+- qiujian16

.tekton/cluster-permission-mce-217-pull-request.yaml

@@ -0,0 +1,56 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/stolostron/cluster-permission?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: event == "pull_request" && target_branch == "main"
+  creationTimestamp:
+  labels:
+    appstudio.openshift.io/application: release-mce-217
+    appstudio.openshift.io/component: cluster-permission-mce-217
+    pipelines.appstudio.openshift.io/type: build
+  name: cluster-permission-mce-217-on-pull-request
+  namespace: crt-redhat-acm-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/crt-redhat-acm-tenant/cluster-permission-mce-217:on-pr-{{revision}}
+  - name: image-expires-after
+    value: 5d
+  - name: build-platforms
+    value:
+    - linux/x86_64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Dockerfile.rhtap
+  - name: path-context
+    value: .
+  - name: prefetch-input
+    value: '[{"type": "gomod", "path": "."}, {"type": "rpm", "path": "."}]'
+  pipelineRef:
+    resolver: git
+    params:
+    - name: url
+      value: https://github.com/stolostron/konflux-build-catalog.git
+    - name: revision
+      value: main
+    - name: pathInRepo
+      value: pipelines/common.yaml
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-cluster-permission-mce-217
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'
+status: {}

.tekton/cluster-permission-mce-217-push.yaml

@@ -0,0 +1,59 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/stolostron/cluster-permission?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch == "main"
+  creationTimestamp:
+  labels:
+    appstudio.openshift.io/application: release-mce-217
+    appstudio.openshift.io/component: cluster-permission-mce-217
+    pipelines.appstudio.openshift.io/type: build
+  name: cluster-permission-mce-217-on-push
+  namespace: crt-redhat-acm-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image
+    value: quay.io/redhat-user-workloads/crt-redhat-acm-tenant/cluster-permission-mce-217:{{revision}}
+  - name: build-platforms
+    value:
+    - linux/x86_64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Dockerfile.rhtap
+  - name: path-context
+    value: .
+  - name: send-slack-notification
+    value: 'true'
+  - name: konflux-application-name
+    value: release-mce-217
+  - name: slack-member-id
+    value: UUSRGGQ1L
+  - name: prefetch-input
+    value: '[{"type": "gomod", "path": "."}, {"type": "rpm", "path": "."}]'
+  pipelineRef:
+    resolver: git
+    params:
+    - name: url
+      value: https://github.com/stolostron/konflux-build-catalog.git
+    - name: revision
+      value: main
+    - name: pathInRepo
+      value: pipelines/common.yaml
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-cluster-permission-mce-217
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'
+status: {}

AGENTS.md

@@ -0,0 +1 @@
+README.md

CLAUDE.md

@@ -0,0 +1 @@
+README.md

Dockerfile.rhtap

@@ -15,6 +15,19 @@ ENV OPERATOR=/usr/local/bin/cluster-permission \
     USER_UID=1001 \
     USER_NAME=cluster-permission
 
+LABEL \
+    name="multicluster-engine/cluster-permission-rhel9" \
+    com.redhat.component="cluster-permission" \
+    cpe="cpe:/a:redhat:multicluster_engine:2.11::el9" \
+    description="Cluster permission controller" \
+    maintainer="acm-contact@redhat.com" \
+    io.k8s.description="Cluster permission controller" \
+    org.label-schema.license="Red Hat Advanced Cluster Management for Kubernetes EULA" \
+    org.label-schema.schema-version="1.0" \
+    summary="Cluster permission controller" \
+    io.k8s.display-name="Cluster permission" \
+    io.openshift.tags="mce acm cluster-permission"
+
 # install operator binary
 COPY --from=plugin-builder /go/src/github.com/open-cluster-management-io/cluster-permission/bin/cluster-permission /usr/local/bin/cluster-permission
 

README.md

@@ -200,33 +200,84 @@ kubectl logs -n cluster-permission-system deployment/cluster-permission-controll
 
 ## Development
 
-### Building from Source
+### Building and Testing
 
 ```bash
+# Install CRDs to cluster
+make install
+
+# Run controller locally (requires access to OCM hub cluster)
+make run
+
 # Build the binary
 make build
 
-# Build Docker image
-make docker-build
-
 # Run tests
 make test
 
-# Generate CRDs
-make manifests
+# Run end-to-end tests (deploys OCM first)
+make test-e2e
 
-# Update generated code
-make generate
+# Build Docker image
+make docker-build
+
+# Deploy to cluster
+make deploy
+
+# Remove from cluster
+make undeploy
 ```
 
 ### Code Generation
 
 After modifying API types, regenerate code:
 ```bash
-make generate
+# Generate manifests (CRDs, RBAC, etc.)
 make manifests
+
+# Generate deepcopy methods and client code
+make generate
+
+# Combined pre-build tasks (deps, manifests, generate, fmt, vet)
+make pre-build
+```
+
+### Dependencies and Linting
+
+```bash
+# Update Go dependencies
+make deps
+
+# Format code
+make fmt
+
+# Run go vet
+make vet
 ```
 
+### Testing Framework
+
+- Uses Ginkgo/Gomega for testing
+- Controller tests in `controllers/clusterpermission_controller_test.go`
+- Test suite setup in `controllers/suite_test.go`
+- E2E tests in `e2e/` directory
+- Tests require OCM environment for full functionality
+
+### Code Structure
+
+- **API Types** (`api/v1alpha1/`): Follow Kubernetes API conventions with `+optional` markers. Condition types defined as constants.
+- **Controller** (`controllers/`): Standard controller-runtime reconciler pattern. Uses ManifestWork to deploy RBAC to managed clusters. Status conditions track reconciliation state.
+- **Generated Client** (`client/`): Auto-generated Kubernetes client code. Update with `make generate` after API changes.
+- **Configuration** (`config/`): Kubernetes manifests for CRDs, RBAC, and deployment.
+
+### Important Files
+
+- `main.go`: Controller manager entry point with scheme registration
+- `api/v1alpha1/clusterpermission_types.go`: Core API types and specifications
+- `controllers/clusterpermission_controller.go`: Main reconciliation logic
+- `controllers/helper.go`: Utility functions for manifest generation
+- `config/samples/`: Example ClusterPermission resources for testing
+
 ## Community and Support
 
 ### Contributing

chart/values.yaml

@@ -7,6 +7,7 @@ global:
   pullSecret: null
 hubconfig:
   nodeSelector: null
+  ocpVersion: 4.12.0
   proxyConfigs: {}
   replicaCount: 1
   tolerations: []

renovate.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["github>stolostron/acm-config//teams/server-foundation/renovate-with-upstream.json"]
+}

rpms.in.yaml

@@ -0,0 +1,19 @@
+contentOrigin:
+  repos:
+    - repoid: ubi-9-for-${basearch}-baseos-rpms
+      baseurl: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/${basearch}/baseos/os/
+    - repoid: ubi-9-for-${basearch}-appstream-rpms
+      baseurl: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/${basearch}/appstream/os/
+packages:
+  - jq
+  - tar
+  - gzip
+  - rsync
+  - findutils
+context:
+  containerfile: Dockerfile.rhtap
+arches:
+  - aarch64
+  - x86_64
+  - s390x
+  - ppc64le