Release 2.8.1: ship CRDs as an optional native-crds/ subchart (installCrds) (#164)

* Release 2.8.1: fix release build with dev-tools 1.17.0 for Rust 1.95.0

* Update v2.8.1.md

* fix CRD lifecycle: retain on uninstall (resource-policy keep) + document upgrade adoption

Inject helm.sh/resource-policy: keep into each templated CRD via a
fromYaml/toYaml round-trip so the CRDs (and their custom resources) survive
helm uninstall and installCrds true->false, without touching the canonical
crd/ files. Document the pre-2.8 -> 2.8 adoption path (--take-ownership or
label/annotate) and the installCrds:false out-of-band option in the v2.8.1
release notes, and correct the v2.8.0 uninstall caveat.

* Drop dev-tools base bump from 2.8.1 release

The dev-tools 1.16.1->1.17.0 base-image fix (for the Rust 1.95.0 musl
cross-compile) moves to the CI PR #165, which also adds a build-on-PR
check. 2.8.1 is now purely the version bump + CRD lifecycle fix.

* Correct installCrds comment: CRDs are retained on uninstall

The prior note said templated CRDs are removed on uninstall; #164 added
the helm.sh/resource-policy: keep annotation, so they now survive
uninstall and installCrds=true->false.

* Ship CRDs as an optional native-crds/ subchart (installCrds)

Replace the templated-CRD approach (from #161/#164) with an optional
restate-operator-crds subchart that places the CRDs in Helm's native
crds/ directory, gated by the installCrds value (default true).

Native crds/ are install-only and are never upgraded or deleted by
Helm, which eliminates the upgrade ownership-adoption error and the
uninstall cascade-delete problem the templated approach introduced.
installCrds=false still disables the CRDs entirely (for BYOC/GitOps)
by disabling the subchart dependency condition.

The subchart symlinks the canonical crd/*.yaml (single source of
truth); symlinks are resolved to real bytes at vendor time. The
vendored subchart tgz + Chart.lock are committed so the published OCI
chart is self-contained (the release pipeline does not run
helm dependency build).

* Update release notes for v2.8.0

Clarified that v2.8.0 was never published and is superseded by v2.8.1. Updated details about CRD installation approach.

Author: pcholakov

AGENTS.md

@@ -10,8 +10,10 @@ Never hand-edit files in `crd/` -- always regenerate.
 After changing a CRD struct, regenerate in this order (or run `just generate-all`):
 
 1. `just generate` -- regenerates the CRD YAML (`crd/*.yaml`). This is the authoritative schema and the
-   only artifact shipped to users (the Helm chart symlinks it). Pure Rust; no external tools. Always
-   run and commit it.
+   only artifact shipped to users. The `restate-operator-crds` subchart
+   (`charts/restate-operator-crds/crds/`) symlinks these files into Helm's native `crds/` directory,
+   and the operator Helm chart pulls that subchart in as an optional dependency (gated by
+   `installCrds`). Pure Rust; no external tools. Always run and commit it.
 2. `just generate-pkl` -- regenerates the Pkl bindings (`crd/*.pkl`), a convenience for Pkl users.
    Requires the `pkl` CLI on PATH; reads the CRD YAML, so run step 1 first.
 3. `just generate-examples` -- regenerates `crd/examples/*.yaml` from the Pkl examples. Requires `pkl`.
@@ -44,7 +46,22 @@ version files together to the new version:
 
 - `Cargo.toml`
 - `Cargo.lock` (the `restate-operator` package entry — via `cargo check`, not by hand)
-- `charts/restate-operator-helm/Chart.yaml`
+- `charts/restate-operator-helm/Chart.yaml` (the chart version *and* the `restate-operator-crds`
+  dependency version)
+- `charts/restate-operator-crds/Chart.yaml`
+
+The CRDs ship as the optional `restate-operator-crds` subchart, vendored into the operator chart as a
+committed `charts/restate-operator-helm/charts/restate-operator-crds-<version>.tgz` (the release pipeline
+does not run `helm dependency build`, so the vendored tgz + `Chart.lock` are what make the published OCI
+chart self-contained). After bumping the versions above — or any time `crd/*.yaml` changes the CRD schema —
+re-vendor so the published chart carries the current CRDs:
+
+```bash
+helm dependency update charts/restate-operator-helm
+```
+
+and commit the updated `charts/restate-operator-helm/charts/restate-operator-crds-<version>.tgz` and
+`charts/restate-operator-helm/Chart.lock`.
 
 Then consolidate the `release-notes/unreleased/` files into `v<version>.md`. See
 `release-notes/README.md` for the full, authoritative release process (bump → consolidate → delete → merge → tag).

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "restate-operator"
-version = "2.8.0"
+version = "2.8.1"
 authors = ["restate.dev"]
 edition = "2024"
 rust-version = "1.92"

Cargo.toml

@@ -0,0 +1,5 @@
+apiVersion: v2
+name: restate-operator-crds
+description: Restate operator CustomResourceDefinitions (RestateCluster, RestateDeployment, RestateCloudEnvironment)
+type: application
+version: "2.8.1"

charts/restate-operator-crds/Chart.yaml

@@ -0,0 +1,6 @@
+dependencies:
+- name: restate-operator-crds
+  repository: file://../restate-operator-crds
+  version: 2.8.1
+digest: sha256:2c8960ffeb831c853f0bdca1265b1f8c56898c210575b133681c098fb5a8c4c9
+generated: "2026-07-14T16:40:45.737059+02:00"

…-manifests/restatecloudenvironments.yaml …-crds/crds/restatecloudenvironments.yamlcharts/restate-operator-helm/crd-manifests/restatecloudenvironments.yaml renamed to charts/restate-operator-crds/crds/restatecloudenvironments.yaml charts/restate-operator-helm/crd-manifests/restatecloudenvironments.yaml renamed to charts/restate-operator-crds/crds/restatecloudenvironments.yaml

@@ -2,4 +2,10 @@ apiVersion: v2
 name: restate-operator-helm
 description: An operator for Restate clusters
 type: application
-version: "2.8.0"
+version: "2.8.1"
+
+dependencies:
+  - name: restate-operator-crds
+    version: "2.8.1"
+    repository: "file://../restate-operator-crds"
+    condition: installCrds